85 lines
4.0 KiB
Bash
Executable File
85 lines
4.0 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
. /usr/share/debconf/confmodule
|
|
|
|
# The answer to a question in ANSWER, or "" when the question has not been seen; the
|
|
# default debconf holds for an unseen question is not an answer.
|
|
answer() {
|
|
ANSWER=""
|
|
db_fget "$1" seen
|
|
if [ "$RET" = "true" ]; then
|
|
db_get "$1"
|
|
ANSWER="$RET"
|
|
fi
|
|
}
|
|
|
|
case "$1" in
|
|
configure)
|
|
# --- Read the installer's answers ---
|
|
answer vpn-router/platform; VPN_ROUTER_PLATFORM="$ANSWER"
|
|
answer vpn-router/mode; VPN_ROUTER_MODE="$ANSWER"
|
|
answer vpn-router/int_addr; VPN_ROUTER_INT_ADDR="$ANSWER"
|
|
answer vpn-router/external_interface; VPN_ROUTER_EXTERNAL_INTERFACE="$ANSWER"
|
|
answer vpn-router/internal_interface; VPN_ROUTER_INTERNAL_INTERFACE="$ANSWER"
|
|
answer vpn-router/local_fqdn; VPN_ROUTER_LOCAL_FQDN="$ANSWER"
|
|
answer vpn-router/local_id_mode; VPN_ROUTER_LOCAL_ID_MODE="$ANSWER"
|
|
answer vpn-router/local_cidrs; VPN_ROUTER_LOCAL_CIDRS="$ANSWER"
|
|
answer vpn-router/int_gateway_ip; VPN_ROUTER_INT_GATEWAY_IP="$ANSWER"
|
|
answer vpn-router/remote_addrs; VPN_ROUTER_REMOTE_ADDRS="$ANSWER"
|
|
answer vpn-router/remote_id; VPN_ROUTER_REMOTE_ID="$ANSWER"
|
|
answer vpn-router/remote_cidrs; VPN_ROUTER_REMOTE_CIDRS="$ANSWER"
|
|
answer vpn-router/psk; VPN_ROUTER_PSK="$ANSWER"
|
|
answer vpn-router/p2s_enabled; VPN_ROUTER_P2S_ENABLED="$ANSWER"
|
|
answer vpn-router/p2s_address_pool; VPN_ROUTER_P2S_ADDRESS_POOL="$ANSWER"
|
|
answer vpn-router/pki_root_name; VPN_ROUTER_PKI_ROOT_NAME="$ANSWER"
|
|
answer vpn-router/wg_enabled; VPN_ROUTER_WG_ENABLED="$ANSWER"
|
|
answer vpn-router/wg_address; VPN_ROUTER_WG_ADDRESS="$ANSWER"
|
|
answer vpn-router/wg_listen_port; VPN_ROUTER_WG_LISTEN_PORT="$ANSWER"
|
|
|
|
export VPN_ROUTER_PLATFORM VPN_ROUTER_MODE VPN_ROUTER_INT_ADDR \
|
|
VPN_ROUTER_EXTERNAL_INTERFACE \
|
|
VPN_ROUTER_INTERNAL_INTERFACE VPN_ROUTER_LOCAL_FQDN \
|
|
VPN_ROUTER_LOCAL_ID_MODE VPN_ROUTER_LOCAL_CIDRS \
|
|
VPN_ROUTER_INT_GATEWAY_IP \
|
|
VPN_ROUTER_REMOTE_ADDRS VPN_ROUTER_REMOTE_ID \
|
|
VPN_ROUTER_REMOTE_CIDRS VPN_ROUTER_PSK \
|
|
VPN_ROUTER_P2S_ENABLED VPN_ROUTER_P2S_ADDRESS_POOL \
|
|
VPN_ROUTER_PKI_ROOT_NAME VPN_ROUTER_WG_ENABLED \
|
|
VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT
|
|
|
|
# --- Hand a candidate configuration to ucf ---
|
|
# ucf compares it against the file in /etc and decides what to do about
|
|
# local changes, prompting through debconf only for a real conflict.
|
|
# This is what makes dpkg-reconfigure apply without destroying edits.
|
|
CANDIDATE="$(mktemp)"
|
|
/usr/lib/vpn-router/generate-config "$CANDIDATE"
|
|
ucf --three-way --debconf-ok "$CANDIDATE" /etc/vpn-router/vpn-router.json
|
|
ucfr vpn-router /etc/vpn-router/vpn-router.json
|
|
chmod 0600 /etc/vpn-router/vpn-router.json
|
|
rm -f "$CANDIDATE"
|
|
|
|
# The key now lives in the configuration file; do not keep a copy. An
|
|
# empty answer means "leave alone" next time, so clearing it here does
|
|
# not blank the key on the next dpkg-reconfigure.
|
|
db_set vpn-router/psk ""
|
|
|
|
# Apply the sysctl drop-in shipped by this package so it takes effect
|
|
# without waiting for a reboot.
|
|
sysctl --system >/dev/null
|
|
|
|
# The firewall is not touched here. Enabling it, allowing SSH and
|
|
# setting the forward policy all belong to vpn-router-setup, which does
|
|
# them only once the configuration says this host is a router.
|
|
|
|
# The web service waits for libpq in the linker cache, which dpkg
|
|
# refreshes after this script, so it is started without waiting for it.
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl --no-block restart vpn-router-web.service >/dev/null 2>&1 || true
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
db_stop
|