feat: added support for running the VPN router on a host with Docker Community Edition.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -8,6 +8,7 @@ import ipaddress
 import json
 import os
 import pathlib
+import re
 import shutil
 import subprocess
 import sys
@@ -46,8 +47,17 @@ SCHEMA = {
     'remote':     {'addrs': [], 'id': '', 'cidrs': [], 'psk': '', 'psk_file': ''},
     'p2s':        {'enabled': False, 'address_pool': '', 'ca_name': 'VPN Router CA'},
     'wireguard':  {'enabled': False, 'address': '', 'listen_port': 51820},
+    'docker':     {'mode': 'auto', 'exposed_ports': []},
 }
 
+DOCKER_MODES = ('auto', 'on', 'off')
+
+#: A port or a port range as iptables multiport takes it: 443 or 8000:8100.
+DOCKER_PORT = re.compile(r'^\d{1,5}(:\d{1,5})?$')
+
+#: The multiport match takes at most 15 ports, and a range counts as two.
+DOCKER_PORT_LIMIT = 15
+
 TYPE_NAMES = {str: 'a string', list: 'a list of strings', bool: 'a boolean',
               int: 'an integer'}
 
@@ -212,6 +222,24 @@ def validate(cfg):
     if not 1 <= port <= 65535:
         raise ConfigError(f'wireguard.listen_port: {port} is not a valid port')
 
+    docker_mode = _get(cfg, 'docker', 'mode')
+    if docker_mode not in DOCKER_MODES:
+        raise ConfigError(
+            f'docker.mode: {docker_mode!r} is not one of {", ".join(DOCKER_MODES)}')
+
+    ports = _get_list(cfg, 'docker', 'exposed_ports')
+    weight = 0
+    for item in ports:
+        if not DOCKER_PORT.match(item) or any(
+                not 1 <= int(part) <= 65535 for part in item.split(':')):
+            raise ConfigError(
+                f'docker.exposed_ports: {item!r} is not a port or a port range')
+        weight += 2 if ':' in item else 1
+    if weight > DOCKER_PORT_LIMIT:
+        raise ConfigError(
+            f'docker.exposed_ports: at most {DOCKER_PORT_LIMIT} ports are allowed, '
+            'a range counting as two')
+
 
 def resolve_psk(cfg):
     """Return the pre-shared key, or '' when none is configured."""