slawek
3c665c2b6c
- Introduced debian templates for cloud-router configuration parameters. - Added simple-ca.sh script for managing a minimal Certificate Authority (CA) for IKEv2 PKI. - Created sysctl configuration to enable IP forwarding and adjust rp_filter settings. - Implemented configure script to render configuration files using Jinja2 templates. - Added simple-ca script for generating CA and certificates. - Created Jinja2 templates for various configuration files including netplan, strongSwan, and WireGuard. - Implemented UFW rules setup for IPsec and WireGuard. - Added support for road-warrior and site-to-site VPN configurations.
54 lines
2.7 KiB
Bash
Executable File
54 lines
2.7 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
. /usr/share/debconf/confmodule
|
|
|
|
case "$1" in
|
|
configure)
|
|
# ── Read debconf answers ──────────────────────────────────────────────
|
|
db_get cloud-router/local_addrs; CLOUD_ROUTER_LOCAL_ADDRS="$RET"
|
|
db_get cloud-router/local_fqdn; CLOUD_ROUTER_LOCAL_FQDN="$RET"
|
|
db_get cloud-router/local_id_mode; CLOUD_ROUTER_LOCAL_ID_MODE="$RET"
|
|
db_get cloud-router/local_cidrs; CLOUD_ROUTER_LOCAL_CIDRS="$RET"
|
|
db_get cloud-router/remote_addrs; CLOUD_ROUTER_REMOTE_ADDRS="$RET"
|
|
db_get cloud-router/remote_id; CLOUD_ROUTER_REMOTE_ID="$RET"
|
|
db_get cloud-router/psk; CLOUD_ROUTER_PSK="$RET"
|
|
db_get cloud-router/remote_cidrs; CLOUD_ROUTER_REMOTE_CIDRS="$RET"
|
|
db_get cloud-router/router_int_gateway_ip; CLOUD_ROUTER_ROUTER_INT_GATEWAY_IP="$RET"
|
|
db_get cloud-router/p2s_address_pool; CLOUD_ROUTER_P2S_ADDRESS_POOL="$RET"
|
|
db_get cloud-router/wg_enabled; CLOUD_ROUTER_WG_ENABLED="$RET"
|
|
db_get cloud-router/wg_address; CLOUD_ROUTER_WG_ADDRESS="$RET"
|
|
db_get cloud-router/wg_listen_port; CLOUD_ROUTER_WG_LISTEN_PORT="$RET"
|
|
|
|
# ── Render configuration files via Jinja2 templates ─────────────────
|
|
export CLOUD_ROUTER_LOCAL_ADDRS CLOUD_ROUTER_LOCAL_FQDN \
|
|
CLOUD_ROUTER_LOCAL_ID_MODE CLOUD_ROUTER_LOCAL_CIDRS \
|
|
CLOUD_ROUTER_REMOTE_ADDRS CLOUD_ROUTER_REMOTE_ID \
|
|
CLOUD_ROUTER_PSK CLOUD_ROUTER_REMOTE_CIDRS \
|
|
CLOUD_ROUTER_ROUTER_INT_GATEWAY_IP CLOUD_ROUTER_P2S_ADDRESS_POOL \
|
|
CLOUD_ROUTER_WG_ENABLED CLOUD_ROUTER_WG_ADDRESS \
|
|
CLOUD_ROUTER_WG_LISTEN_PORT
|
|
|
|
/usr/lib/cloud-router/configure
|
|
|
|
db_set cloud-router/psk ""
|
|
|
|
# ── Apply system settings ─────────────────────────────────────────────
|
|
sysctl --system
|
|
netplan apply
|
|
systemctl daemon-reload
|
|
systemctl restart systemd-resolved
|
|
|
|
# ── UFW: ensure SSH is allowed then enable ────────────────────────────
|
|
ufw allow 22/tcp
|
|
ufw --force enable
|
|
ufw reload
|
|
|
|
# ── strongSwan ────────────────────────────────────────────────────────
|
|
systemctl enable --now strongswan
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
db_stop
|