wireguard/assets/root/Makefile

@@ -1,64 +0,0 @@
-
-
-
-SERVER_TPL := templates/wg0.conf
-SERVER_CLIENT_TPL := templates/wg0-client.conf
-SERVER_CONF := /etc/wireguard/wg0.conf
-SERVER_KEY := /etc/wireguard/server_id
-SERVER_PUBLIC_KEY := /etc/wireguard/server_id.pub
-
-CLIENT_TPL := templates/client.conf
-CLIENT_DIR := /etc/wireguard/clients/
-
-ENDPOINT_PORT := 51820
-ENDPOINT := 
-CLIENT_IPS := 10.42.0.0/16
-DNS := 10.1.1.1
-
-
-%_id:
-	wg genkey > $@
-
-%_id.pub: %_id
-	cat $< | wg pubkey > $@
-
-
-$(SERVER_CONF): $(SERVER_TPL) $(SERVER_KEY)
-	cat $< \
-		| sed \
-			-e 's/$${SERVER_PORT}/$(SERVER_PORT)/g' \
-			-e 's/$${CLIENT_IPS}/$(CLIENT_IPS)/g' \
-			-e 's/$${SERVER_PRIVATE_KEY}/'$$(cat "$(SERVER_KEY)")'/g' \
-		> "$@"
-
-$(CLIENT_DIR)/%.conf: $(CLIENT_TPL) $(SERVER_CLIENT_TPL) \
-		$(CLIENT_DIR)/%_id $(CLIENT_DIR)/%_id.pub \
-		$(SERVER_CONF) $(SERVER_PUBLIC_KEY)
-	cat "$<" \
-		| sed \
-			-e 's/$${DNS}/$(DNS)/g' \
-			-e 's/$${ENDPOINT}/$(ENDPOINT)/g' \
-			-e 's/$${ENDPOINT_PORT}/$(ENDPOINT_PORT)/g' \
-			-e 's/$${ALLOWED_IPS}/$(ALLOWED_IPS)/g' \
-			-e 's/$${CLIENT_IP}/$(CLIENT_IP)/g' \
-			-e 's/$${CLIENT_PRIVATE_KEY}/'$$(cat "$(CLIENT_DIR)/$%_id")'/g' \
-			-e 's/$${SERVER_PUBLIC_KEY}/'$$(cat "$(SERVER_PUBLIC_KEY)")'/g' \
-		> "$@"
-	cat "$(SERVER_CLIENT_TPL)" \
-		| sed \
-			-e 's/$${CLIENT_IP}/$(CLIENT_IP)/g' \
-			-e 's/$${ENDPOINT}/$(ENDPOINT)/g' \
-			-e 's/$${ENDPOINT_PORT}/$(ENDPOINT_PORT)/g' \
-			-e 's/$${CLIENT_PUBLIC_KEY}/'$$(cat "$(CLIENT_DIR)/$%_id.pub")'/g' \
-			-e 's/$${SERVER_PUBLIC_KEY}/'$$(cat "$(SERVER_PUBLIC_KEY)")'/g' \
-		>> "$(SERVER_CONF)"
-
-
-
-server: $(SERVER_CONF)
-
-
-clients:
-
-
-

wireguard/assets/root/make-client

@@ -1,8 +0,0 @@
-#!/usr/bin/bash
-
-SERVER_TEMPLATE=
-CLIENT_TEMPLATE=
-
-PRIVATE_KEY=
-PUBLIC_KEY=
-

wireguard/assets/root/make-server

@@ -1,24 +0,0 @@
-#!/usr/bin/bash
-
-SERVER_TEMPLATE=${SERVER_TEMPLATE:=templates/wg0.conf}
-SERVER_CONF=/etc/wireguard/wg0.conf
-
-PUBLIC_KEY=/etc/wireguard/server_id
-PRIVATE_KEY=/etc/wireguard/server_id.pub
-
-
-if ! [ -e "$PRIVATE_KEY" ] ; then
-	wg genkey > "$PRIVATE_KEY" 
-fi
-if ! [ -e "$PUBLIC_KEY" ] ; then
-	cat "$PRIVATE_KEY" | wg pubkey > "$PUBLIC_KEY"
-fi
-
-PRIVATE_KEY=$(cat "$PRIVATE_KEY")
-cat ${SERVER_TEMPLATE} \
-	| sed \
-		-q 's/\${SERVER_PRIVATE_KEY}/'${PRIVATE_KEY}'/g' \
-	> "${SERVER_CONF}"
-
-./make-client
-

wireguard/assets/root/templates/client.config

@@ -1,10 +0,0 @@
-[Interface]
-PrivateKey = ${CLIENT_PRIVATE_KEY}
-Address = ${CLIENT_IP}/32
-DNS = ${DNS}
-
-[Peer]
-PublicKey = ${SERVER_PUBLIC_KEY}
-AllowedIPs = ${ALLOWED_IPS}
-Endpoint = ${ENDPOINT}:${ENDPOINT_PORT}
-

wireguard/assets/root/templates/wg0-client.tpl

@@ -1,6 +0,0 @@
-
-[Peer]
-PublicKey = ${CLIENT_PUBLIC_KEY} 
-AllowedIPs = ${CLIENT_IP}/32
-Endpoint = ${ENDPOINT}:${ENDPOINT_PORT}
-

wireguard/assets/root/templates/wg0.conf

@@ -1,9 +0,0 @@
-[Interface]
-Address = ${CLIENT_IPS}
-SaveConfig = true
-PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o lan -j MASQUERADE; iptables -t nat -A POSTROUTING -o admin -j MASQUERADE;
-PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o lan -j MASQUERADE; iptables -t nat -D POSTROUTING -o admin -j MASQUERADE;
-ListenPort = ${ENDPOINT_PORT}
-PrivateKey = ${SERVER_PRIVATE_KEY} 
-
-

wireguard/make.sh

@@ -1,103 +0,0 @@
-#!/usr/bin/bash
-#----------------------------------------------------------------------
-# https://wiki.alpinelinux.org/wiki/Configure_a_Wireguard_interface_(wg)
-
-cd $(dirname $0)
-PATH=$PATH:$(dirname "$(pwd)")
-
-
-#----------------------------------------------------------------------
-
-source ../.pct-helpers
-
-
-#----------------------------------------------------------------------
-
-readConfig
-
-
-#----------------------------------------------------------------------
-
-DFL_ID=${DFL_ID:=103}
-DFL_CTHOSTNAME=${DFL_CTHOSTNAME:=wireguard}
-
-DFL_CORES=${DFL_CORES:=1}
-DFL_RAM=${DFL_RAM:=256}
-DFL_SWAP=${DFL_SWAP:=${DFL_RAM}}
-DFL_DRIVE=${DFL_DRIVE:=1}
-
-WAN_IP=-
-WAN_GATE=-
-ADMIN_IP=-
-ADMIN_GATE=-
-LAN_IP=-
-LAN_GATE=-
-
-REBOOT=${REBOOT:=1}
-
-readVars
-
-
-
-#----------------------------------------------------------------------
-
-OPTS_STAGE_1="\
-	--hostname $CTHOSTNAME \
-	--cores $CORES \
-	--memory $RAM \
-	--swap $SWAP \
-	--net0 name=lan,bridge=vmbr${LAN_BRIDGE},firewall=1,ip=dhcp,type=veth \
-	--net1 name=admin,bridge=vmbr${ADMIN_BRIDGE},firewall=1,ip=dhcp,type=veth \
-	--storage local-lvm \
-	--rootfs local-lvm:$DRIVE \
-	--unprivileged 1 \
-	--features nesting=1 \
-	${PCT_EXTRA} \
-"
-
-OPTS_STAGE_2="\
-	--onboot 1 \
-"
-
-
-#----------------------------------------------------------------------
-
-echo "# Building config..."
-buildAssets "$TEMPLATE_DIR" "$ASSETS_DIR"
-
-echo "# Creating CT..."
-pctCreateAlpine $ID "${OPTS_STAGE_1}" "$PASS"
-
-echo "# Installing dependencies..."
-@ lxc-attach $ID apk add iptables wireguard-tools-wg-quick
-
-echo "# Copying assets..."
-@ pct-push-r $ID ./assets /
-
-echo "# Setup: wireguard server..."
-@ lxc-attach $ID -- bash -c 'wg genkey | tee server.privatekey | wg pubkey > server.publickey' 
-
-# XXX move this into a script on the CT side...
-echo "# Setup: wireguard user..."
-xread "profile name: " WG_PROFILE
-xread "allowed ips: " ALLOWED_IPs
-
-# XXX client:
-# 	- generate keys
-# 	- add to wg0.conf
-# 	- add to $WG_PROFILE.conf
-
-echo "# Setup: bridge device..."
-@ lxc-attach $ID wg up wg0 
-
-echo "# Post config..."
-pctSet $ID "${OPTS_STAGE_2}" $REBOOT
-
-echo "# Done."
-
-
-
-#----------------------------------------------------------------------
-# vim:set ts=4 sw=4 :
-
-