89 lines
2.5 KiB
Bash
Executable File
89 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# Example: unattended install and configuration of vpn-router on an existing
|
|
# host. Run as root. Adjust the values below, or set them in the environment.
|
|
#
|
|
# This is the same end state as the cloud-init example and as configuring the
|
|
# router by hand; only the way the file is written differs.
|
|
|
|
set -e
|
|
|
|
DEB="${DEB:-./vpn-router_1.0.0-1_all.deb}"
|
|
|
|
# List values are JSON arrays.
|
|
PLATFORM="${PLATFORM:-generic}"
|
|
MODE="${MODE:-manual}"
|
|
EXTERNAL_INTERFACE="${EXTERNAL_INTERFACE:-eth0}"
|
|
INTERNAL_INTERFACE="${INTERNAL_INTERFACE:-eth1}"
|
|
LOCAL_FQDN="${LOCAL_FQDN:-router.example.com}"
|
|
LOCAL_ID_MODE="${LOCAL_ID_MODE:-fqdn}"
|
|
LOCAL_CIDRS="${LOCAL_CIDRS:-[\"10.0.0.0/24\"]}"
|
|
INT_ADDR="${INT_ADDR:-10.1.1.4}"
|
|
INT_GATEWAY_IP="${INT_GATEWAY_IP:-10.1.1.1}"
|
|
REMOTE_ADDRS="${REMOTE_ADDRS:-[\"peer.example.net\"]}"
|
|
REMOTE_ID="${REMOTE_ID:-peer.example.net}"
|
|
REMOTE_CIDRS="${REMOTE_CIDRS:-[\"192.168.0.0/24\"]}"
|
|
PSK="${PSK:-change-me}"
|
|
P2S_ENABLED="${P2S_ENABLED:-false}"
|
|
P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
|
|
PKI_ROOT_NAME="${PKI_ROOT_NAME:-VPN Router Root CA}"
|
|
WG_ENABLED="${WG_ENABLED:-false}"
|
|
WG_ADDRESS="${WG_ADDRESS:-}"
|
|
WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"
|
|
|
|
# Write the configuration before installing, so postinst leaves it alone. The
|
|
# pre-shared key goes to its own file, so it needs no JSON escaping.
|
|
install -d -m 0755 /etc/vpn-router
|
|
umask 077
|
|
printf %s "$PSK" > /etc/vpn-router/psk
|
|
cat > /etc/vpn-router/vpn-router.json <<EOF
|
|
{
|
|
"general": {
|
|
"platform": "${PLATFORM}",
|
|
"mode": "${MODE}"
|
|
},
|
|
"interfaces": {
|
|
"external": "${EXTERNAL_INTERFACE}",
|
|
"internal": "${INTERNAL_INTERFACE}"
|
|
},
|
|
"wan": {
|
|
"local_fqdn": "${LOCAL_FQDN}"
|
|
},
|
|
"local": {
|
|
"cidrs": ${LOCAL_CIDRS},
|
|
"int_addr": "${INT_ADDR}",
|
|
"int_gateway_ip": "${INT_GATEWAY_IP}"
|
|
},
|
|
"site_to_site": {
|
|
"remote-site": {
|
|
"addrs": ${REMOTE_ADDRS},
|
|
"id": "${REMOTE_ID}",
|
|
"cidrs": ${REMOTE_CIDRS},
|
|
"local_cidrs": ${LOCAL_CIDRS},
|
|
"local_id_mode": "${LOCAL_ID_MODE}",
|
|
"psk_file": "/etc/vpn-router/psk"
|
|
}
|
|
},
|
|
"p2s": {
|
|
"enabled": ${P2S_ENABLED},
|
|
"address_pool": "${P2S_ADDRESS_POOL}"
|
|
},
|
|
"pki": {
|
|
"root_name": "${PKI_ROOT_NAME}"
|
|
},
|
|
"wireguard": {
|
|
"enabled": ${WG_ENABLED},
|
|
"address": "${WG_ADDRESS}",
|
|
"listen_port": ${WG_LISTEN_PORT}
|
|
}
|
|
}
|
|
EOF
|
|
umask 022
|
|
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y "$DEB"
|
|
|
|
# Installing starts vpn-router-setup, which applies the file above. Restart it
|
|
# explicitly after any later edit.
|
|
systemctl restart vpn-router-setup
|
|
systemctl --no-pager status vpn-router-setup
|