#!/bin/sh
#
# Example: unattended install and configuration of vpn-router on an existing
# host. Run as root. Adjust the values below, or set them in the environment.
#
# This is the same end state as the cloud-init example and as configuring the
# router by hand; only the way the file is written differs.

set -e

DEB="${DEB:-./vpn-router_1.0.0-1_all.deb}"

# List values are JSON arrays.
PLATFORM="${PLATFORM:-generic}"
MODE="${MODE:-manual}"
EXTERNAL_INTERFACE="${EXTERNAL_INTERFACE:-eth0}"
INTERNAL_INTERFACE="${INTERNAL_INTERFACE:-eth1}"
LOCAL_FQDN="${LOCAL_FQDN:-router.example.com}"
LOCAL_ID_MODE="${LOCAL_ID_MODE:-fqdn}"
LOCAL_CIDRS="${LOCAL_CIDRS:-[\"10.0.0.0/24\"]}"
INT_ADDR="${INT_ADDR:-10.1.1.4}"
INT_GATEWAY_IP="${INT_GATEWAY_IP:-10.1.1.1}"
REMOTE_ADDRS="${REMOTE_ADDRS:-[\"peer.example.net\"]}"
REMOTE_ID="${REMOTE_ID:-peer.example.net}"
REMOTE_CIDRS="${REMOTE_CIDRS:-[\"192.168.0.0/24\"]}"
PSK="${PSK:-change-me}"
P2S_ENABLED="${P2S_ENABLED:-false}"
P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
PKI_ROOT_NAME="${PKI_ROOT_NAME:-VPN Router Root CA}"
WG_ENABLED="${WG_ENABLED:-false}"
WG_ADDRESS="${WG_ADDRESS:-}"
WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"

# Write the configuration before installing, so postinst leaves it alone. The
# pre-shared key goes to its own file, so it needs no JSON escaping.
install -d -m 0755 /etc/vpn-router
umask 077
printf %s "$PSK" > /etc/vpn-router/psk
cat > /etc/vpn-router/vpn-router.json <<EOF
{
  "general": {
    "platform": "${PLATFORM}",
    "mode": "${MODE}"
  },
  "interfaces": {
    "external": "${EXTERNAL_INTERFACE}",
    "internal": "${INTERNAL_INTERFACE}"
  },
  "wan": {
    "local_fqdn": "${LOCAL_FQDN}"
  },
  "local": {
    "cidrs": ${LOCAL_CIDRS},
    "int_addr": "${INT_ADDR}",
    "int_gateway_ip": "${INT_GATEWAY_IP}"
  },
  "site_to_site": {
    "remote-site": {
      "addrs": ${REMOTE_ADDRS},
      "id": "${REMOTE_ID}",
      "cidrs": ${REMOTE_CIDRS},
      "local_cidrs": ${LOCAL_CIDRS},
      "local_id_mode": "${LOCAL_ID_MODE}",
      "psk_file": "/etc/vpn-router/psk"
    }
  },
  "p2s": {
    "enabled": ${P2S_ENABLED},
    "address_pool": "${P2S_ADDRESS_POOL}"
  },
  "pki": {
    "root_name": "${PKI_ROOT_NAME}"
  },
  "wireguard": {
    "enabled": ${WG_ENABLED},
    "address": "${WG_ADDRESS}",
    "listen_port": ${WG_LISTEN_PORT}
  }
}
EOF
umask 022

DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB"

# Installing starts vpn-router-setup, which applies the file above. Restart it
# explicitly after any later edit.
systemctl restart vpn-router-setup
systemctl --no-pager status vpn-router-setup