104 lines
5.1 KiB
Bash
Executable File
104 lines
5.1 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
. /usr/share/debconf/confmodule
|
|
|
|
# The answer to a question in ANSWER, or "" when the question has not been seen; the
|
|
# default debconf holds for an unseen question is not an answer.
|
|
answer() {
|
|
ANSWER=""
|
|
db_fget "$1" seen
|
|
if [ "$RET" = "true" ]; then
|
|
db_get "$1"
|
|
ANSWER="$RET"
|
|
fi
|
|
}
|
|
|
|
case "$1" in
|
|
configure)
|
|
# --- Read the installer's answers ---
|
|
answer vpn-router/platform; VPN_ROUTER_PLATFORM="$ANSWER"
|
|
answer vpn-router/mode; VPN_ROUTER_MODE="$ANSWER"
|
|
answer vpn-router/int_addr; VPN_ROUTER_INT_ADDR="$ANSWER"
|
|
answer vpn-router/external_interface; VPN_ROUTER_EXTERNAL_INTERFACE="$ANSWER"
|
|
answer vpn-router/internal_interface; VPN_ROUTER_INTERNAL_INTERFACE="$ANSWER"
|
|
answer vpn-router/local_fqdn; VPN_ROUTER_LOCAL_FQDN="$ANSWER"
|
|
answer vpn-router/local_id_mode; VPN_ROUTER_LOCAL_ID_MODE="$ANSWER"
|
|
answer vpn-router/local_cidrs; VPN_ROUTER_LOCAL_CIDRS="$ANSWER"
|
|
answer vpn-router/int_gateway_ip; VPN_ROUTER_INT_GATEWAY_IP="$ANSWER"
|
|
answer vpn-router/remote_addrs; VPN_ROUTER_REMOTE_ADDRS="$ANSWER"
|
|
answer vpn-router/remote_id; VPN_ROUTER_REMOTE_ID="$ANSWER"
|
|
answer vpn-router/remote_cidrs; VPN_ROUTER_REMOTE_CIDRS="$ANSWER"
|
|
answer vpn-router/psk; VPN_ROUTER_PSK="$ANSWER"
|
|
answer vpn-router/p2s_enabled; VPN_ROUTER_P2S_ENABLED="$ANSWER"
|
|
answer vpn-router/p2s_address_pool; VPN_ROUTER_P2S_ADDRESS_POOL="$ANSWER"
|
|
answer vpn-router/pki_root_name; VPN_ROUTER_PKI_ROOT_NAME="$ANSWER"
|
|
answer vpn-router/wg_enabled; VPN_ROUTER_WG_ENABLED="$ANSWER"
|
|
answer vpn-router/wg_address; VPN_ROUTER_WG_ADDRESS="$ANSWER"
|
|
answer vpn-router/wg_listen_port; VPN_ROUTER_WG_LISTEN_PORT="$ANSWER"
|
|
|
|
export VPN_ROUTER_PLATFORM VPN_ROUTER_MODE VPN_ROUTER_INT_ADDR \
|
|
VPN_ROUTER_EXTERNAL_INTERFACE \
|
|
VPN_ROUTER_INTERNAL_INTERFACE VPN_ROUTER_LOCAL_FQDN \
|
|
VPN_ROUTER_LOCAL_ID_MODE VPN_ROUTER_LOCAL_CIDRS \
|
|
VPN_ROUTER_INT_GATEWAY_IP \
|
|
VPN_ROUTER_REMOTE_ADDRS VPN_ROUTER_REMOTE_ID \
|
|
VPN_ROUTER_REMOTE_CIDRS VPN_ROUTER_PSK \
|
|
VPN_ROUTER_P2S_ENABLED VPN_ROUTER_P2S_ADDRESS_POOL \
|
|
VPN_ROUTER_PKI_ROOT_NAME VPN_ROUTER_WG_ENABLED \
|
|
VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT
|
|
|
|
# --- Hand a candidate configuration to ucf ---
|
|
# ucf compares it against the file in /etc and decides what to do about
|
|
# local changes, prompting through debconf only for a real conflict.
|
|
# This is what makes dpkg-reconfigure apply without destroying edits.
|
|
CANDIDATE="$(mktemp)"
|
|
/usr/lib/vpn-router/generate-config "$CANDIDATE"
|
|
ucf --three-way --debconf-ok "$CANDIDATE" /etc/vpn-router/vpn-router.json
|
|
ucfr vpn-router /etc/vpn-router/vpn-router.json
|
|
chmod 0600 /etc/vpn-router/vpn-router.json
|
|
rm -f "$CANDIDATE"
|
|
|
|
# The key now lives in the configuration file; do not keep a copy. An
|
|
# empty answer means "leave alone" next time, so clearing it here does
|
|
# not blank the key on the next dpkg-reconfigure.
|
|
db_set vpn-router/psk ""
|
|
|
|
# The Router Manager's administrator account for vpn-router-setup to create, when a name and a
|
|
# password were given; the answers are cleared so that a later run does not ask for it again.
|
|
db_get vpn-router/admin_username
|
|
ADMIN_USERNAME="$RET"
|
|
db_get vpn-router/admin_password
|
|
ADMIN_PASSWORD="$RET"
|
|
if [ -n "$ADMIN_USERNAME" ] && [ -n "$ADMIN_PASSWORD" ]; then
|
|
(umask 077; ADMIN_USERNAME="$ADMIN_USERNAME" ADMIN_PASSWORD="$ADMIN_PASSWORD" python3 -c \
|
|
'import json, os, sys; json.dump({"username": os.environ["ADMIN_USERNAME"], "password": os.environ["ADMIN_PASSWORD"]}, sys.stdout)' \
|
|
> /etc/vpn-router/manager-admin.json)
|
|
elif [ -n "$ADMIN_USERNAME" ]; then
|
|
echo 'vpn-router: no administrator password was given; no Router Manager administrator is created' >&2
|
|
fi
|
|
db_set vpn-router/admin_username ""
|
|
db_set vpn-router/admin_password ""
|
|
|
|
# Apply the sysctl drop-in shipped by this package so it takes effect
|
|
# without waiting for a reboot.
|
|
sysctl --system >/dev/null
|
|
|
|
# The firewall is not touched here. Enabling it, allowing SSH and
|
|
# setting the forward policy all belong to vpn-router-setup, which does
|
|
# them only once the configuration says this host is a router.
|
|
|
|
# The setup, web and manager services wait for libpq in the linker cache,
|
|
# which dpkg refreshes after this script, so they are started without
|
|
# waiting for them.
|
|
if [ -d /run/systemd/system ]; then
|
|
systemctl --no-block restart vpn-router-setup.service >/dev/null 2>&1 || true
|
|
systemctl --no-block restart vpn-router-web.service >/dev/null 2>&1 || true
|
|
systemctl --no-block restart vpn-router-manager.service >/dev/null 2>&1 || true
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
db_stop
|