Initial commit
Basic working code that is capable of establishing the Wireguard tunnel given that there is properly configured `.psk` file for at least one known wifi network (see README.md for more details)
This commit is contained in:
Lukas Stancik
@@ -0,0 +1,19 @@
|
|||||||
|
root = true
|
||||||
|
|
||||||
|
[*]
|
||||||
|
charset = utf-8
|
||||||
|
indent_style = space
|
||||||
|
indent_size = 2
|
||||||
|
end_of_line = lf
|
||||||
|
insert_final_newline = true
|
||||||
|
trim_trailing_whitespace = true
|
||||||
|
|
||||||
|
# Tab indentation (no size specified)
|
||||||
|
[Makefile]
|
||||||
|
indent_style = tab
|
||||||
|
|
||||||
|
[*.mk]
|
||||||
|
indent_style = tab
|
||||||
|
|
||||||
|
[*.start]
|
||||||
|
indent_style = tab
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
BUILDER_UID=<%= $(id -u) %>
|
||||||
|
BUILDER_GID=<%= $(id -g) %>
|
||||||
|
BUILDER_USER=<%= $(whoami) %>
|
||||||
|
BUILDER_DOCKER_IMAGE=repository-builder
|
||||||
|
BUILDER_KEY_BASENAME=packager
|
||||||
|
CACHE_DIR=<%= $(pwd) %>/cache
|
||||||
|
ALPINE_MIRROR=https://dl-cdn.alpinelinux.org/alpine
|
||||||
|
ALPINE_ARCH=aarch64
|
||||||
|
ALPINE_VER_MAJOR=3
|
||||||
|
ALPINE_VER_MINOR=20
|
||||||
|
ALPINE_VER_PATCH=3
|
||||||
|
REQUIREMENTS_FILE=required-apks.txt
|
||||||
|
eth0=eth0
|
||||||
|
wlan0=wlan0
|
||||||
|
wlan1=wlan1
|
||||||
|
wg0=wg0
|
||||||
|
wg_port=51820
|
||||||
|
wg_server=31.31.79.229
|
||||||
|
hostname=entropi
|
||||||
|
ssid=entropi_nomap
|
||||||
|
wlan0_base=192.168.66
|
||||||
|
wg0_base=10.0.22
|
||||||
|
ROUTER_TIMEZONE=Europe/Prague
|
||||||
|
ROUTER_DNS_PRIMARY=1.1.1.1
|
||||||
|
ROUTER_NTP_PRIMARY=195.113.144.201
|
||||||
|
ROUTER_NTP_SECONDARY=195.113.144.238
|
||||||
@@ -0,0 +1,105 @@
|
|||||||
|
.DEFAULT_GOAL:=build
|
||||||
|
|
||||||
|
TEMP_DIR=$(shell ./preflight)
|
||||||
|
DIST_DIR=${TEMP_DIR}/dist
|
||||||
|
DOT_ENV_FILE=${TEMP_DIR}/.env
|
||||||
|
DOT_ENV_PAIRS=$(shell cat ${DOT_ENV_FILE})
|
||||||
|
BUILD_ARGS=$(shell for ARG in ${DOT_ENV_PAIRS}; do echo "--build-arg $$ARG"; done;)
|
||||||
|
|
||||||
|
-include ${DOT_ENV_FILE}
|
||||||
|
|
||||||
|
vault/encrypt:
|
||||||
|
@echo "### Encrypting secrets..."
|
||||||
|
@./vault encrypt
|
||||||
|
@echo "### Encrypting done"
|
||||||
|
|
||||||
|
vault/decrypt:
|
||||||
|
@echo "### Decrypting secrets..."
|
||||||
|
@./vault decrypt
|
||||||
|
@echo "### Decrypting done"
|
||||||
|
|
||||||
|
init:
|
||||||
|
@echo "### Init..."
|
||||||
|
@./require ${DOT_ENV_FILE} alpine_source
|
||||||
|
@./require ${DOT_ENV_FILE} tailspin_bin
|
||||||
|
@./require ${DOT_ENV_FILE} age_bin
|
||||||
|
@echo "### Init done"
|
||||||
|
-@make vault/decrypt
|
||||||
|
|
||||||
|
build: repository
|
||||||
|
@echo "### Assembling..."
|
||||||
|
@rsync -chaz ${CACHE_DIR}/${RELEASE_BASENAME}/ ${DIST_DIR}
|
||||||
|
@mkdir -p ${TEMP_DIR}/overlay_headless/etc/local.d
|
||||||
|
@mkdir -p ${TEMP_DIR}/overlay_headless/etc/runlevels/default
|
||||||
|
@touch ${TEMP_DIR}/overlay_headless/etc/.default_boot_services
|
||||||
|
-@ln -s /etc/init.d/local ${TEMP_DIR}/overlay_headless/etc/runlevels/default/local
|
||||||
|
@./src/esh -o ${TEMP_DIR}/overlay_headless/etc/local.d/headless.start src/headless.start ${DOT_ENV_PAIRS}
|
||||||
|
@chmod +x ${TEMP_DIR}/overlay_headless/etc/local.d/headless.start
|
||||||
|
@tar czf ${DIST_DIR}/headless.apkovl.tar.gz -C ${TEMP_DIR}/overlay_headless/ .
|
||||||
|
@rsync -chaz ${CACHE_DIR}/aport/${RELEASE_VERSION}/main/ ${DIST_DIR}/extras
|
||||||
|
@cp ${CACHE_DIR}/tailspin/tspin ${DIST_DIR}
|
||||||
|
@./src/esh -o ${DIST_DIR}/hotspot.conf src/hotspot.conf ${DOT_ENV_PAIRS}
|
||||||
|
@./src/esh -o ${DIST_DIR}/wg0.conf src/wg0.conf ${DOT_ENV_PAIRS}
|
||||||
|
@cp secrets/*.psk ${DIST_DIR}
|
||||||
|
@cp src/authorized_keys ${DIST_DIR}
|
||||||
|
@cp src/config.toml ${DIST_DIR}
|
||||||
|
@cp src/logpattern.conf ${DIST_DIR}
|
||||||
|
@cp src/main.conf ${DIST_DIR}
|
||||||
|
@cp src/rsyslog.conf ${DIST_DIR}
|
||||||
|
@cp src/usercfg.txt ${DIST_DIR}
|
||||||
|
@cp src/watchdog.sh ${DIST_DIR}
|
||||||
|
@cp src/repository-builder/packager.rsa.pub ${DIST_DIR}
|
||||||
|
@cp src/repository-builder/${REQUIREMENTS_FILE} ${DIST_DIR}
|
||||||
|
@echo "### Assembling done"
|
||||||
|
@make vault/encrypt
|
||||||
|
|
||||||
|
card: clean build
|
||||||
|
@echo "### Copying to sdcard..."
|
||||||
|
@rsync -chavz --delete ${DIST_DIR}/ /media/$(shell whoami)/entropi
|
||||||
|
@echo "### Copying to sdcard done"
|
||||||
|
-@make clean
|
||||||
|
|
||||||
|
clean:
|
||||||
|
@echo "### Cleaning..."
|
||||||
|
-@rm -rf ${DIST_DIR}
|
||||||
|
-@rm -rf tmp*
|
||||||
|
-@rm -f ${CACHE_DIR}/aport/${RELEASE_VERSION}/main/${ALPINE_ARCH}/APKINDEX.tar.gz
|
||||||
|
-@docker rmi ${BUILDER_DOCKER_IMAGE} 1> /dev/null
|
||||||
|
@echo "### Cleaning done"
|
||||||
|
|
||||||
|
mrproper: clean
|
||||||
|
@echo "### Purging cache..."
|
||||||
|
-@rm -rf ${CACHE_DIR}
|
||||||
|
@echo "### Done"
|
||||||
|
|
||||||
|
repository-builder: init
|
||||||
|
@mkdir -p ${CACHE_DIR}/aport/${RELEASE_VERSION}/main/
|
||||||
|
@rsync -chaz ${CACHE_DIR}/${RELEASE_BASENAME}/apks/ ${CACHE_DIR}/aport/${RELEASE_VERSION}/main/
|
||||||
|
|
||||||
|
@tar \
|
||||||
|
--exclude='.git' \
|
||||||
|
-czh ./src/repository-builder | docker build -f ./src/repository-builder/repository.Dockerfile \
|
||||||
|
--build-arg ALPINE_DOCKER_IMAGE=${ALPINE_DOCKER_IMAGE} \
|
||||||
|
--build-arg REQUIREMENTS_FILE=${REQUIREMENTS_FILE} \
|
||||||
|
--build-arg BUILDER_USER=${BUILDER_USER} \
|
||||||
|
--build-arg BUILDER_UID=${BUILDER_UID} \
|
||||||
|
--build-arg BUILDER_GID=${BUILDER_GID} \
|
||||||
|
-t ${BUILDER_DOCKER_IMAGE} -
|
||||||
|
|
||||||
|
repository: repository-builder
|
||||||
|
@echo "### Repository..."
|
||||||
|
@wget --quiet --spider https://alpinelinux.org/ && \
|
||||||
|
docker run --rm -ti \
|
||||||
|
-e ALPINE_ARCH=${ALPINE_ARCH} \
|
||||||
|
-e RELEASE_VERSION=${RELEASE_VERSION} \
|
||||||
|
-e REQUIREMENTS_FILE=${REQUIREMENTS_FILE} \
|
||||||
|
-e BUILDER_KEY_BASENAME=${BUILDER_KEY_BASENAME} \
|
||||||
|
-e BUILDER_UID=${BUILDER_UID} \
|
||||||
|
-e BUILDER_GID=${BUILDER_GID} \
|
||||||
|
-v $(PWD)/src/repository-builder/packager.rsa:/root/.abuild/packager.rsa \
|
||||||
|
-v $(PWD)/src/repository-builder/packager.rsa.pub:/root/.abuild/packager.rsa.pub \
|
||||||
|
-v $(PWD)/src/repository-builder/abuild.conf:/root/.abuild/abuild.conf \
|
||||||
|
-v ${CACHE_DIR}/aport:/mirror \
|
||||||
|
${BUILDER_DOCKER_IMAGE} build-repository \
|
||||||
|
|| echo "No Internet!!! Skipping repository..."
|
||||||
|
@echo "### Repository done"
|
||||||
@@ -0,0 +1,37 @@
|
|||||||
|
# Wireguard Road Warrior setup for RaspberryPi 4
|
||||||
|
|
||||||
|
Code in this repository produces files for bootable Micro-SD card for RaspberryPi 4. During the boot it creates `entropi_nomap` WIFI access point (hotspot) that clients can connect to. It then encrypts all client traffic through Wireguard tunnel via any known WIFI network in reach. This is supposed to be a headless Alpine Linux router essentially. There is no web admin interface - only SSH access from the client side using public keys (or, you know, physical access with keyboard and monitor attached to the RaspberryPi).
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
- RaspberryPi
|
||||||
|
- WIFI over USB dongle
|
||||||
|
- USB-C cable for powering RaspberryPi (could be plugged directly into a laptop)
|
||||||
|
- Micro-SD card (I use 2GB and that's plenty big) - Formatted with single FAT32 partition named `entropi`
|
||||||
|
- Properly set up machine running Wireguard peer instance reachable from the Internet
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
1. Clone this repository
|
||||||
|
1. Edit `.env` file
|
||||||
|
1. Create `.vault_password_file` and put a plain text password inside (used for decrypting/encrypting wireguard keys and other stuff)
|
||||||
|
1. Replace all files listed as `FILES_IN_VAULT` inside the `vault` script with appropriate contents
|
||||||
|
1. Create known networks files (see below)
|
||||||
|
1. Insert MicroSD card into your computer and make sure it is mounted under /media/{user}/entropi (edit the Makefile if necessary)
|
||||||
|
1. Run `make card`
|
||||||
|
1. Eject the card and use it to boot RaspberryPi (after a minute or two you should see it provides your wifi)
|
||||||
|
|
||||||
|
### Known WIFI networks setup
|
||||||
|
|
||||||
|
Create `secrets` folder and put plain text files inside named `{KNOWN_WIFI_SSID}.psk` where `{KNOWN_WIFI_SSID}` is the name of each wifi you want to be used to tunnel through (coffee shops, your ISP etc.). Contents of each file needs to be following:
|
||||||
|
|
||||||
|
```
|
||||||
|
[Security]
|
||||||
|
Passphrase={KNOWN_WIFI_PASSWORD}
|
||||||
|
AlwaysRandomizeAddress=true
|
||||||
|
|
||||||
|
[Settings]
|
||||||
|
AutoConnect=true
|
||||||
|
```
|
||||||
|
|
||||||
|
All the files will be automatically picked up by the wifi daemon after the RaspberryPi finishes boot process
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
#! /bin/sh
|
||||||
|
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
# Let's find out if a temporary build directory exists already
|
||||||
|
BUILD_DIR=$(find . -type d -name "tmp*" -print -quit 2>/dev/null)
|
||||||
|
|
||||||
|
# Create it if it doesn't
|
||||||
|
if ! echo "$BUILD_DIR" | grep -q .; then
|
||||||
|
BUILD_DIR=$(mktemp --tmpdir=. --directory tmp.build.XXXXXXXXXX)
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Preprocess the dotenv file
|
||||||
|
./src/esh -o "$BUILD_DIR"/.env ./.env
|
||||||
|
|
||||||
|
# Load the contents of the preprocessed dotenv file in order to
|
||||||
|
# use the values for init stage below
|
||||||
|
# https://www.shellcheck.net/wiki/SC1090
|
||||||
|
# shellcheck source=/dev/null
|
||||||
|
. "$BUILD_DIR"/.env
|
||||||
|
|
||||||
|
echo "
|
||||||
|
RELEASE_BASENAME=alpine-rpi-$ALPINE_VER_MAJOR.$ALPINE_VER_MINOR.$ALPINE_VER_PATCH-$ALPINE_ARCH
|
||||||
|
RELEASE_VERSION=v$ALPINE_VER_MAJOR.$ALPINE_VER_MINOR
|
||||||
|
ALPINE_DOCKER_IMAGE=alpine:$ALPINE_VER_MAJOR.$ALPINE_VER_MINOR.$ALPINE_VER_PATCH
|
||||||
|
|
||||||
|
wlan0_cidr=$wlan0_base.0/24
|
||||||
|
wlan0_address=$wlan0_base.1
|
||||||
|
wlan0_range_start=$wlan0_base.2
|
||||||
|
wlan0_range_end=$wlan0_base.254
|
||||||
|
|
||||||
|
wg0_cidr=$wg0_base.0/24
|
||||||
|
wg0_address=$wg0_base.12
|
||||||
|
wg0_gateway=$wg0_base.1" >> "$BUILD_DIR"/.env
|
||||||
|
|
||||||
|
echo "$BUILD_DIR"
|
||||||
@@ -0,0 +1,41 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# First argument is preprocessed .env file supposed to be in tmp.build.XXXXXXXXXX directory
|
||||||
|
# Let's load it up
|
||||||
|
. $1
|
||||||
|
|
||||||
|
alpine_source() {
|
||||||
|
find ${CACHE_DIR} -type f -name ${RELEASE_BASENAME}.tar.gz | grep -q ${RELEASE_BASENAME} || \
|
||||||
|
curl -sSL ${ALPINE_MIRROR}/${RELEASE_VERSION}/releases/${ALPINE_ARCH}/${RELEASE_BASENAME}.tar.gz -o ${CACHE_DIR}/${RELEASE_BASENAME}.tar.gz
|
||||||
|
|
||||||
|
mkdir -p ${CACHE_DIR}/${RELEASE_BASENAME}
|
||||||
|
|
||||||
|
find ${CACHE_DIR}/${RELEASE_BASENAME} -type d -empty -exec tar xfz ${CACHE_DIR}/${RELEASE_BASENAME}.tar.gz -C ${CACHE_DIR}/${RELEASE_BASENAME} \;
|
||||||
|
}
|
||||||
|
|
||||||
|
tailspin_bin() {
|
||||||
|
find ${CACHE_DIR} -type f -name tailspin.tar.gz | grep -q tailspin || \
|
||||||
|
curl -sSL https://github.com/bensadeh/tailspin/releases/download/4.0.0/tailspin-x86_64-unknown-linux-musl.tar.gz -o ${CACHE_DIR}/tailspin.tar.gz
|
||||||
|
|
||||||
|
mkdir -p ${CACHE_DIR}/tailspin
|
||||||
|
|
||||||
|
find ${CACHE_DIR}/tailspin -type d -empty -exec tar xfz ${CACHE_DIR}/tailspin.tar.gz -C ${CACHE_DIR}/tailspin \;
|
||||||
|
}
|
||||||
|
|
||||||
|
age_bin() {
|
||||||
|
find ${CACHE_DIR} -type d -name age-src | grep -q age-src || \
|
||||||
|
git clone https://github.com/wj/age.git ${CACHE_DIR}/age-src
|
||||||
|
|
||||||
|
mkdir -p ${CACHE_DIR}/age
|
||||||
|
|
||||||
|
find ${CACHE_DIR}/age -type d -empty -exec docker run --rm -v ${CACHE_DIR}/age:/usr/local/bin -e GOBIN=/usr/local/bin/ -v ${CACHE_DIR}/age-src:/usr/src/age -w /usr/src/age golang:1.22-alpine go install ./cmd/age \;
|
||||||
|
}
|
||||||
|
|
||||||
|
mkdir -p secrets
|
||||||
|
mkdir -p ${CACHE_DIR}/aport
|
||||||
|
mkdir -p ${CACHE_DIR}/extras
|
||||||
|
|
||||||
|
# Second argument is supposed to be name of the functions decalred above
|
||||||
|
# Let's call it
|
||||||
|
$2
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCBWcXR2SHJWTkIydlB2SHg4
|
||||||
|
eXYwSHRRIDE4CkNvMG1MTkMxeEZvbkRDd1dSMzFaM3FtOEk1WVhKMUNVQm11T1Vk
|
||||||
|
YUpoY2cKLS0tIExHOW1ldWh0ZEY0MTdqZFNrR2c4OHpDcUpLNldaNTF3Y3B1L1dy
|
||||||
|
REt4SXcKzHFocRvKS4/XoF9XqntZJ537DswygYkETQ64qBcBZR45MF5WP/qGmz6p
|
||||||
|
YZ6S4KOOTJpgibcWht9zzAgaBI1pvGx61lM7StxOoUPpKJGbpx2vxm5T3hljf5GP
|
||||||
|
1veT6YHwFbVMHBRWNcgFji+ZVloOWC9rhHlF6tjzpY2XlWA+7YBH5OzMnPj8Wysu
|
||||||
|
JDp7Zx9XJ6Y3vZsLXOWlb36/22hhNRFCvnNA6Mc1RUosbc4PhjMTnh9jeO6sbhGp
|
||||||
|
kTM9Rq023c8Q8BuKhyJwNEVkOF+l/CvUmm5GGr6+P59/bjvrGseqJeCTESQ0Nlzh
|
||||||
|
dmm10NRzMKnqHSHUdvtCa5GEoD1NgnNh6cMTCyJr4yIJx6iwcr1G0vuX7iE7THtD
|
||||||
|
EH/MYowZ1oRPVE60ghWKTiY2bHQCT7VxZX81QVBdIw9LDey4b2MQdsni/2i2sO53
|
||||||
|
cUqL3CzO559wiCwPm2gULjuS/QmG9rwfMks6wGZX/intyel2o1yqofyx+tdyxQtB
|
||||||
|
9qBZ1bEsREB4jUeK8uZJYjiJJgSemKs4sxJV0KdpAffryb8=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
@@ -0,0 +1,82 @@
|
|||||||
|
# style = { fg = "color", bg = "color", italic = false, bold = false, underline = false }
|
||||||
|
|
||||||
|
[date]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[date_word] # e.g. "Jan 01", "Mon Feb 28"
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[time]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['INBOUND']
|
||||||
|
style = { fg = "cyan", faint = true }
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['OUTBOUND']
|
||||||
|
style = { fg = "cyan", faint = false }
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['DROP']
|
||||||
|
style = { fg = "red" }
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['REJECT']
|
||||||
|
style = { fg = "yellow" }
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['ACCEPT']
|
||||||
|
style = { fg = "green" }
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['TCP']
|
||||||
|
style = { fg = "blue" }
|
||||||
|
|
||||||
|
[[keywords]]
|
||||||
|
words = ['UDP']
|
||||||
|
style = { fg = "magenta" }
|
||||||
|
|
||||||
|
[[regexps]]
|
||||||
|
regular_expression = 'MAC=(.*?) '
|
||||||
|
style = { faint = true }
|
||||||
|
|
||||||
|
# IP v4 regexp
|
||||||
|
[[regexps]]
|
||||||
|
regular_expression = '(\b\d{1,3})(\.)(\d{1,3})(\.)(\d{1,3})(\.)(\d{1,3}\b)'
|
||||||
|
style = { fg = "yellow", bold = true }
|
||||||
|
|
||||||
|
[[regexps]]
|
||||||
|
regular_expression = 'SPT=(.*?) '
|
||||||
|
style = { faint = true }
|
||||||
|
|
||||||
|
[[regexps]]
|
||||||
|
regular_expression = 'DPT=(.*?)$'
|
||||||
|
style = { bold = true }
|
||||||
|
|
||||||
|
[url]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[number]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[ip]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[quotes]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[path]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[uuid]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[pointer]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[key_value]
|
||||||
|
disabled = true
|
||||||
|
|
||||||
|
[process]
|
||||||
|
disabled = true
|
||||||
@@ -0,0 +1,366 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
# vim: set ts=4:
|
||||||
|
#---help---
|
||||||
|
# USAGE:
|
||||||
|
# esh [options] [--] <input> [<variable>...]
|
||||||
|
# esh <-h | -V>
|
||||||
|
#
|
||||||
|
# Process and evaluate an ESH template.
|
||||||
|
#
|
||||||
|
# ARGUMENTS:
|
||||||
|
# <input> Path of the template file or "-" to read from STDIN.
|
||||||
|
# <variable> Variable(s) specified as <name>=<value> to pass into the
|
||||||
|
# template (the have higher priority than environment
|
||||||
|
# variables).
|
||||||
|
#
|
||||||
|
# OPTIONS:
|
||||||
|
# -d Don't evaluate template, just dump a shell script.
|
||||||
|
# -o <file> Output file or "-" for STDOUT. Defaults to "-".
|
||||||
|
# -s <shell> Command name or path of the shell to use for template
|
||||||
|
# evaluation. It must not contain spaces.
|
||||||
|
# Defaults to "/bin/sh".
|
||||||
|
# -h Show this help message and exit.
|
||||||
|
# -V Print version and exit.
|
||||||
|
#
|
||||||
|
# ENVIRONMENT:
|
||||||
|
# ESH_AWK Command name of path of the awk program to use.
|
||||||
|
# It must not contain spaces. Defaults to "awk".
|
||||||
|
# ESH_MAX_DEPTH Maximum include depth. Defaults to 3.
|
||||||
|
# ESH_SHELL Same as -s.
|
||||||
|
#
|
||||||
|
# EXIT STATUS:
|
||||||
|
# 0 Clean exit, no error has encountered.
|
||||||
|
# 1 Generic error.
|
||||||
|
# 10 Invalid usage.
|
||||||
|
# 11 ESH syntax error.
|
||||||
|
# 12 Include error: file not found.
|
||||||
|
# 13 Include error: exceeded max include depth (ESH_MAX_DEPTH).
|
||||||
|
#
|
||||||
|
# Please report bugs at <https://github.com/jirutka/esh/issues>.
|
||||||
|
#---help---
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
readonly PROGNAME='esh'
|
||||||
|
readonly VERSION='0.3.2'
|
||||||
|
readonly SCRIPTPATH="$0"
|
||||||
|
|
||||||
|
AWK_CONVERTER=$(cat <<'AWK'
|
||||||
|
function fail(code, msg) {
|
||||||
|
state = "ERROR"
|
||||||
|
# FIXME: /dev/stderr is not portable
|
||||||
|
printf("%s: %s\n", line_info(), msg) > "/dev/stderr"
|
||||||
|
exit code
|
||||||
|
}
|
||||||
|
function line_info() {
|
||||||
|
return FILENAME ? (filenames[depth] ":" linenos[depth]) : "(init)" # (init) if inside BEGIN
|
||||||
|
}
|
||||||
|
# IMPORTANT: This is the only function that should print a newline.
|
||||||
|
function puts(str) {
|
||||||
|
print(line_info()) > MAP_FILE
|
||||||
|
print(str)
|
||||||
|
}
|
||||||
|
function fputs(str) {
|
||||||
|
printf("%s", str)
|
||||||
|
}
|
||||||
|
function trim(str) {
|
||||||
|
gsub(/^[ \t\r\n]+|[ \t\r\n]+$/, "", str)
|
||||||
|
return str
|
||||||
|
}
|
||||||
|
function read(len, _str) {
|
||||||
|
if (len == "") {
|
||||||
|
_str = buff
|
||||||
|
buff = ""
|
||||||
|
} else if (len > 0) {
|
||||||
|
_str = substr(buff, 1, len)
|
||||||
|
buff = substr(buff, len + 1, length(buff))
|
||||||
|
}
|
||||||
|
return _str
|
||||||
|
}
|
||||||
|
function skip(len) {
|
||||||
|
buff = substr(buff, len + 1, length(buff))
|
||||||
|
}
|
||||||
|
function flush(len, _str) {
|
||||||
|
_str = read(len)
|
||||||
|
|
||||||
|
if (state == "TEXT") {
|
||||||
|
gsub("'", "'\\''", _str)
|
||||||
|
}
|
||||||
|
if (state != "COMMENT") {
|
||||||
|
fputs(_str)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
function file_exists(filename, _junk) {
|
||||||
|
if ((getline _junk < filename) >= 0) {
|
||||||
|
close(filename)
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
function dirname(path) {
|
||||||
|
return sub(/\/[^\/]+\/*$/, "/", path) ? path : ""
|
||||||
|
}
|
||||||
|
function include(filename) {
|
||||||
|
if (index(filename, "/") != 1) { # if does not start with "/"
|
||||||
|
filename = dirname(filenames[depth]) filename
|
||||||
|
}
|
||||||
|
if (!file_exists(filename)) {
|
||||||
|
fail(12, "cannot include " filename ": not a file or not readable")
|
||||||
|
}
|
||||||
|
if (depth > MAX_DEPTH) {
|
||||||
|
fail(13, "cannot include " filename ": exceeded maximum depth of " MAX_DEPTH)
|
||||||
|
}
|
||||||
|
buffs[depth] = buff
|
||||||
|
states[depth] = state
|
||||||
|
filenames[depth + 1] = filename
|
||||||
|
depth++
|
||||||
|
|
||||||
|
init()
|
||||||
|
while ((getline buff < filename) > 0) {
|
||||||
|
if (print_nl && state != "COMMENT") {
|
||||||
|
puts("")
|
||||||
|
}
|
||||||
|
process_line()
|
||||||
|
}
|
||||||
|
end_text()
|
||||||
|
close(filename)
|
||||||
|
|
||||||
|
depth--
|
||||||
|
buff = buffs[depth]
|
||||||
|
state = states[depth]
|
||||||
|
}
|
||||||
|
function init() {
|
||||||
|
buff = ""
|
||||||
|
linenos[depth] = 0
|
||||||
|
print_nl = 0
|
||||||
|
start_text()
|
||||||
|
}
|
||||||
|
function start_text() {
|
||||||
|
puts("")
|
||||||
|
fputs("printf '%s' '")
|
||||||
|
state = "TEXT"
|
||||||
|
}
|
||||||
|
function end_text() {
|
||||||
|
if (state != "TEXT") { return }
|
||||||
|
puts("' #< " line_info())
|
||||||
|
state = "UNDEF"
|
||||||
|
}
|
||||||
|
function process_line() {
|
||||||
|
print_nl = 1
|
||||||
|
linenos[depth]++
|
||||||
|
|
||||||
|
while (buff != "") {
|
||||||
|
print_nl = 1
|
||||||
|
|
||||||
|
if (state == "TEXT" && match(buff, /<%/)) {
|
||||||
|
flush(RSTART - 1) # print buff before "<%"
|
||||||
|
skip(2) # skip "<%"
|
||||||
|
|
||||||
|
flag = substr(buff, 1, 1)
|
||||||
|
if (flag != "%") {
|
||||||
|
end_text()
|
||||||
|
}
|
||||||
|
if (flag == "%") { # <%%
|
||||||
|
skip(1)
|
||||||
|
fputs("<%")
|
||||||
|
} else if (flag == "=") { # <%=
|
||||||
|
skip(1)
|
||||||
|
fputs("__print ")
|
||||||
|
state = "TAG"
|
||||||
|
} else if (flag == "+") { # <%+
|
||||||
|
if (!match(buff, /[^%]%>/)) {
|
||||||
|
fail(11, "syntax error: <%+ must be closed on the same line")
|
||||||
|
}
|
||||||
|
filename = trim(substr(buff, 2, match(buff, /.-?%>/) - 1))
|
||||||
|
skip(RSTART)
|
||||||
|
include(filename)
|
||||||
|
state = "TAG"
|
||||||
|
} else if (flag == "#") { # <%#
|
||||||
|
state = "COMMENT"
|
||||||
|
} else {
|
||||||
|
state = "TAG"
|
||||||
|
}
|
||||||
|
} else if (state != "TEXT" && match(buff, /%>/)) {
|
||||||
|
flag = RSTART > 1 ? substr(buff, RSTART - 1, 1) : ""
|
||||||
|
|
||||||
|
if (flag == "%") { # %%>
|
||||||
|
flush(RSTART - 2)
|
||||||
|
skip(1)
|
||||||
|
flush(2)
|
||||||
|
} else if (flag == "-") { # -%>
|
||||||
|
flush(RSTART - 2)
|
||||||
|
skip(3)
|
||||||
|
print_nl = 0
|
||||||
|
} else { # %>
|
||||||
|
flush(RSTART - 1)
|
||||||
|
skip(2)
|
||||||
|
}
|
||||||
|
if (flag != "%") {
|
||||||
|
start_text()
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
flush()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
BEGIN {
|
||||||
|
FS = ""
|
||||||
|
depth = 0
|
||||||
|
|
||||||
|
puts("#!" (SHELL ~ /\// ? SHELL : "/usr/bin/env " SHELL))
|
||||||
|
puts("set -eu")
|
||||||
|
puts("if ( set -o pipefail 2>/dev/null ); then set -o pipefail; fi")
|
||||||
|
puts("__print() { printf '%s' \"$*\"; }")
|
||||||
|
|
||||||
|
split(VARS, _lines, /\n/)
|
||||||
|
for (_i in _lines) {
|
||||||
|
puts(_lines[_i])
|
||||||
|
}
|
||||||
|
init()
|
||||||
|
}
|
||||||
|
{
|
||||||
|
if (NR == 1) {
|
||||||
|
filenames[0] = FILENAME # this var is not defined in BEGIN so we must do it here
|
||||||
|
}
|
||||||
|
buff = $0
|
||||||
|
process_line()
|
||||||
|
|
||||||
|
if (print_nl && state != "COMMENT") {
|
||||||
|
puts("")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
END {
|
||||||
|
end_text()
|
||||||
|
}
|
||||||
|
AWK
|
||||||
|
)
|
||||||
|
AWK_ERR_FILTER=$(cat <<'AWK'
|
||||||
|
function line_info(lno, _line, _i) {
|
||||||
|
while ((getline _line < MAPFILE) > 0 && _i++ < lno) { }
|
||||||
|
close(MAPFILE)
|
||||||
|
return _line
|
||||||
|
}
|
||||||
|
{
|
||||||
|
if (match($0, "^" SRCFILE ":( line)? ?[0-9]+:") && match(substr($0, 1, RLENGTH), /[0-9]+:$/)) {
|
||||||
|
lno = substr($0, RSTART, RLENGTH - 1) + 0
|
||||||
|
msg = substr($0, RSTART + RLENGTH + 1) # v-- some shells duplicate filename
|
||||||
|
msg = index(msg, SRCFILE ":") == 1 ? substr(msg, length(SRCFILE) + 3) : msg
|
||||||
|
print(line_info(lno) ": " msg)
|
||||||
|
} else if ($0 != "") {
|
||||||
|
print($0)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
AWK
|
||||||
|
)
|
||||||
|
readonly AWK_CONVERTER AWK_ERR_FILTER
|
||||||
|
|
||||||
|
print_help() {
|
||||||
|
sed -En '/^#---help---/,/^#---help---/p' "$SCRIPTPATH" | sed -E 's/^# ?//; 1d;$d;'
|
||||||
|
}
|
||||||
|
|
||||||
|
filter_shell_stderr() {
|
||||||
|
$ESH_AWK \
|
||||||
|
-v SRCFILE="$1" \
|
||||||
|
-v MAPFILE="$2" \
|
||||||
|
-- "$AWK_ERR_FILTER"
|
||||||
|
}
|
||||||
|
|
||||||
|
evaluate() {
|
||||||
|
local srcfile="$1"
|
||||||
|
local mapfile="$2"
|
||||||
|
|
||||||
|
# This FD redirection magic is for swapping stdout/stderr back and forth.
|
||||||
|
exec 3>&1
|
||||||
|
{ set +e; $ESH_SHELL "$srcfile" 2>&1 1>&3; echo $? >>"$mapfile"; } \
|
||||||
|
| filter_shell_stderr "$srcfile" "$mapfile" >&2
|
||||||
|
exec 3>&-
|
||||||
|
|
||||||
|
return $(tail -n 1 "$mapfile")
|
||||||
|
}
|
||||||
|
|
||||||
|
convert() {
|
||||||
|
local input="$1"
|
||||||
|
local vars="$2"
|
||||||
|
local map_file="${3:-"/dev/null"}"
|
||||||
|
|
||||||
|
$ESH_AWK \
|
||||||
|
-v MAX_DEPTH="$ESH_MAX_DEPTH" \
|
||||||
|
-v SHELL="$ESH_SHELL" \
|
||||||
|
-v MAP_FILE="$map_file" \
|
||||||
|
-v VARS="$vars" \
|
||||||
|
-- "$AWK_CONVERTER" "$input"
|
||||||
|
}
|
||||||
|
|
||||||
|
process() {
|
||||||
|
local input="$1"
|
||||||
|
local vars="$2"
|
||||||
|
local evaluate="${3:-yes}"
|
||||||
|
local ret=0 tmpfile mapfile
|
||||||
|
|
||||||
|
if [ "$evaluate" = yes ]; then
|
||||||
|
tmpfile=$(mktemp)
|
||||||
|
mapfile=$(mktemp)
|
||||||
|
|
||||||
|
convert "$input" "$vars" "$mapfile" > "$tmpfile" || ret=$?
|
||||||
|
test $ret -ne 0 || evaluate "$tmpfile" "$mapfile" || ret=$?
|
||||||
|
|
||||||
|
rm -f "$tmpfile" "$mapfile"
|
||||||
|
else
|
||||||
|
convert "$input" "$vars" || ret=$?
|
||||||
|
fi
|
||||||
|
return $ret
|
||||||
|
}
|
||||||
|
|
||||||
|
: ${ESH_AWK:="awk"}
|
||||||
|
: ${ESH_MAX_DEPTH:=3}
|
||||||
|
: ${ESH_SHELL:="/bin/sh"}
|
||||||
|
EVALUATE='yes'
|
||||||
|
OUTPUT=''
|
||||||
|
|
||||||
|
while getopts ':dho:s:V' OPT; do
|
||||||
|
case "$OPT" in
|
||||||
|
d) EVALUATE=no;;
|
||||||
|
h) print_help; exit 0;;
|
||||||
|
o) OUTPUT="$OPTARG";;
|
||||||
|
s) ESH_SHELL="$OPTARG";;
|
||||||
|
V) echo "$PROGNAME $VERSION"; exit 0;;
|
||||||
|
'?') echo "$PROGNAME: unknown option: -$OPTARG" >&2; exit 10;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
shift $(( OPTIND - 1 ))
|
||||||
|
|
||||||
|
if [ $# -eq 0 ]; then
|
||||||
|
printf "$PROGNAME: %s\n\n" 'missing argument <input>' >&2
|
||||||
|
print_help >&2
|
||||||
|
exit 10
|
||||||
|
fi
|
||||||
|
|
||||||
|
INPUT="$1"; shift
|
||||||
|
if [ "$INPUT" != '-' ] && ! [ -f "$INPUT" -a -r "$INPUT" ]; then
|
||||||
|
echo "$PROGNAME: can't read $INPUT: not a file or not readable" >&2; exit 10
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Validate arguments.
|
||||||
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
|
*=*) ;;
|
||||||
|
*) echo "$PROGNAME: illegal argument: $arg" >&2; exit 10;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
# Format variables into shell variable assignments.
|
||||||
|
vars=''; for item in "$@"; do
|
||||||
|
vars="$vars\n${item%%=*}='$(
|
||||||
|
printf %s "${item#*=}" | $ESH_AWK "{ gsub(/'/, \"'\\\\\\\''\"); print }"
|
||||||
|
)'"
|
||||||
|
done
|
||||||
|
|
||||||
|
export ESH="$0"
|
||||||
|
|
||||||
|
if [ "${OUTPUT#-}" ]; then
|
||||||
|
tmpfile="$(mktemp)"
|
||||||
|
trap 'rm -f -- "$tmpfile"' EXIT HUP INT TERM
|
||||||
|
process "$INPUT" "$vars" "$EVALUATE" > "$tmpfile"
|
||||||
|
cat "$tmpfile" > "$OUTPUT"
|
||||||
|
else
|
||||||
|
process "$INPUT" "$vars" "$EVALUATE"
|
||||||
|
fi
|
||||||
Executable
+207
@@ -0,0 +1,207 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -ex
|
||||||
|
|
||||||
|
SDCARD_MEDIA=$(find /media -name *.apkovl.tar.gz -exec dirname {} \; -quit)
|
||||||
|
|
||||||
|
copyfile() {
|
||||||
|
OWNER="$1"
|
||||||
|
PERMS="$2"
|
||||||
|
SOURCE="$3"
|
||||||
|
DEST="$4"
|
||||||
|
cp -f "$SOURCE" "$DEST"
|
||||||
|
chown "$OWNER" "$DEST"
|
||||||
|
chmod "$PERMS" "$DEST"
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_loopback_interface()
|
||||||
|
{
|
||||||
|
cat <<-EOF > /etc/network/interfaces
|
||||||
|
auto lo
|
||||||
|
iface lo inet loopback
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_eth_interface()
|
||||||
|
{
|
||||||
|
cat <<-EOF >> /etc/network/interfaces
|
||||||
|
auto <%= $eth0 %>
|
||||||
|
iface <%= $eth0 %> inet dhcp
|
||||||
|
hostname <%= $hostname %>
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_integrated_wireless_interface()
|
||||||
|
{
|
||||||
|
cat <<-EOF >> /etc/network/interfaces
|
||||||
|
auto <%= $wlan0 %>
|
||||||
|
iface <%= $wlan0 %> inet static
|
||||||
|
hostname <%= $hostname %>
|
||||||
|
pre-up sysctl -w net.ipv4.ip_forward=1
|
||||||
|
pre-up iwctl device <%= $wlan0 %> set-property Mode ap
|
||||||
|
pre-up iwctl ap <%= $wlan0 %> start-profile <%= $ssid %>
|
||||||
|
post-up iptables -t nat -A POSTROUTING -s <%= $wlan0_cidr %> -j MASQUERADE
|
||||||
|
pre-down iptables -t nat -D POSTROUTING -s <%= $wlan0_cidr %> -j MASQUERADE
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_external_wireless_interface()
|
||||||
|
{
|
||||||
|
cat <<-EOF >> /etc/network/interfaces
|
||||||
|
auto <%= $wlan1 %>
|
||||||
|
iface <%= $wlan1 %> inet dhcp
|
||||||
|
hostname <%= $hostname %>
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# Uncomment for alternative:
|
||||||
|
#
|
||||||
|
# ALPINE_MIRROR=https://mirror.fit.cvut.cz/alpine
|
||||||
|
__setup_network_repositories()
|
||||||
|
{
|
||||||
|
cat <<-EOF > /etc/apk/repositories
|
||||||
|
${SDCARD_MEDIA}/apks
|
||||||
|
${SDCARD_MEDIA}/extras
|
||||||
|
<%= $ALPINE_MIRROR %>/<%= $RELEASE_VERSION %>/main
|
||||||
|
<%= $ALPINE_MIRROR %>/<%= $RELEASE_VERSION %>/community
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_local_repositories()
|
||||||
|
{
|
||||||
|
cp ${SDCARD_MEDIA}/<%= $BUILDER_KEY_BASENAME %>.rsa.pub /etc/apk/keys
|
||||||
|
chmod 644 /etc/apk/keys/<%= $BUILDER_KEY_BASENAME %>.rsa.pub
|
||||||
|
|
||||||
|
cat <<-EOF > /etc/apk/repositories
|
||||||
|
${SDCARD_MEDIA}/apks
|
||||||
|
${SDCARD_MEDIA}/extras
|
||||||
|
EOF
|
||||||
|
|
||||||
|
apk update
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_user_account()
|
||||||
|
{
|
||||||
|
mkdir -p /root/.ssh
|
||||||
|
cp ${SDCARD_MEDIA}/authorized_keys /root/.ssh/authorized_keys
|
||||||
|
chown -R root:root /root/.ssh
|
||||||
|
|
||||||
|
cat <<-EOF >> /root/.profile
|
||||||
|
tail -f -n 60 /var/log/messages
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_time()
|
||||||
|
{
|
||||||
|
rc-service chronyd stop
|
||||||
|
|
||||||
|
cat <<-EOF > /etc/chrony/chrony.conf
|
||||||
|
initstepslew 60 <%= $ROUTER_NTP_PRIMARY %> <%= $ROUTER_NTP_SECONDARY %>
|
||||||
|
driftfile /var/lib/chrony/chrony.drift
|
||||||
|
rtcsync
|
||||||
|
cmdport 0
|
||||||
|
server <%= $ROUTER_NTP_PRIMARY %> iburst
|
||||||
|
server <%= $ROUTER_NTP_SECONDARY %> iburst
|
||||||
|
makestep 60 10
|
||||||
|
EOF
|
||||||
|
|
||||||
|
rc-service chronyd start
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_profiles()
|
||||||
|
{
|
||||||
|
cat <<-EOF >> /etc/profile
|
||||||
|
|
||||||
|
alias l="tail -f -n 60 /var/log/messages"
|
||||||
|
alias k="tail -f -n 60 /var/log/kern.log | tspin"
|
||||||
|
alias ll="ls -la"
|
||||||
|
alias ..="cd .."
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_randomness()
|
||||||
|
{
|
||||||
|
rc-service haveged start
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_logging()
|
||||||
|
{
|
||||||
|
copyfile root:root 0700 ${SDCARD_MEDIA}/tspin /usr/bin/tspin
|
||||||
|
mkdir -p /root/.config/tailspin
|
||||||
|
copyfile root:root 0700 ${SDCARD_MEDIA}/config.toml /root/.config/tailspin/config.toml
|
||||||
|
|
||||||
|
mkdir -p /etc/rsyslog.d
|
||||||
|
copyfile root:root 0700 ${SDCARD_MEDIA}/logpattern.conf /etc/rsyslog.d/logpattern.conf
|
||||||
|
copyfile root:root 0700 ${SDCARD_MEDIA}/rsyslog.conf /etc/rsyslog.conf
|
||||||
|
|
||||||
|
rc-service --list | grep rsyslog && \
|
||||||
|
rc-service syslog stop && \
|
||||||
|
rc-service rsyslog start
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_firewall() {
|
||||||
|
modprobe -v ip_tables
|
||||||
|
modprobe -v iptable_nat
|
||||||
|
|
||||||
|
sysctl -w net.ipv4.ip_forward=1
|
||||||
|
sysctl -w net.ipv4.conf.all.forwarding=1
|
||||||
|
|
||||||
|
iptables -A INPUT -j LOG --log-prefix 'fw: INBOUND '
|
||||||
|
iptables -A OUTPUT -j LOG --log-prefix 'fw: OUTBOUND '
|
||||||
|
|
||||||
|
/etc/init.d/iptables save
|
||||||
|
rc-service iptables start
|
||||||
|
}
|
||||||
|
|
||||||
|
__setup_wireless_client() {
|
||||||
|
mkdir -p /var/lib/iwd/ap/
|
||||||
|
|
||||||
|
copyfile root:root 0644 ${SDCARD_MEDIA}/main.conf /etc/iwd/main.conf
|
||||||
|
copyfile root:root 0644 ${SDCARD_MEDIA}/NUMERI_AC11.psk /var/lib/iwd/NUMERI_AC11.psk
|
||||||
|
copyfile root:root 0644 ${SDCARD_MEDIA}/robusta_nomap.psk /var/lib/iwd/robusta_nomap.psk
|
||||||
|
|
||||||
|
copyfile root:root 0644 ${SDCARD_MEDIA}/hotspot.conf /var/lib/iwd/ap/<%= $ssid %>.ap
|
||||||
|
copyfile root:root 0700 ${SDCARD_MEDIA}/watchdog.sh /etc/wireguard/watchdog.sh
|
||||||
|
|
||||||
|
rc-service dbus start
|
||||||
|
rc-service dbus start
|
||||||
|
rc-service iwd start
|
||||||
|
}
|
||||||
|
|
||||||
|
/sbin/setup-hostname <%= $hostname %>
|
||||||
|
/sbin/setup-timezone -z <%= $ROUTER_TIMEZONE %>
|
||||||
|
|
||||||
|
__setup_local_repositories
|
||||||
|
|
||||||
|
apk add `cat ${SDCARD_MEDIA}/<%= $REQUIREMENTS_FILE %>`
|
||||||
|
|
||||||
|
__setup_logging
|
||||||
|
__setup_randomness
|
||||||
|
__setup_profiles
|
||||||
|
__setup_user_account
|
||||||
|
|
||||||
|
__setup_loopback_interface
|
||||||
|
__setup_eth_interface
|
||||||
|
__setup_integrated_wireless_interface
|
||||||
|
__setup_external_wireless_interface
|
||||||
|
__setup_wireless_client
|
||||||
|
__setup_firewall
|
||||||
|
|
||||||
|
rc-service networking start
|
||||||
|
|
||||||
|
mkdir -p /etc/wireguard
|
||||||
|
copyfile root:root 0600 ${SDCARD_MEDIA}/wg0.conf /etc/wireguard/wg0.conf
|
||||||
|
|
||||||
|
ln -s /etc/init.d/wg-quick /etc/init.d/wg-quick.wg0
|
||||||
|
# rc-service wg-quick.wg0 start
|
||||||
|
|
||||||
|
__setup_time
|
||||||
|
|
||||||
|
/etc/wireguard/watchdog.sh
|
||||||
|
|
||||||
|
__setup_network_repositories
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
[General]
|
||||||
|
DisableHT=true
|
||||||
|
|
||||||
|
[Security]
|
||||||
|
Passphrase=<% cat src/wifi-password.txt %>
|
||||||
|
|
||||||
|
[IPv4]
|
||||||
|
Address=<%= $wlan0_address %>
|
||||||
|
Gateway=<%= $wlan0_address %>
|
||||||
|
Netmask=255.255.255.0
|
||||||
|
DNSList=<%= $wg0_gateway %>
|
||||||
|
IPRange=<%= $wlan0_range_start %>,<%= $wlan0_range_end %>
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
$template logpattern,"%timegenerated:1:19:date-rfc3339% %msg:F,32:3% %msg:R,ERE,1,BLANK:(IN=[a-zA-Z0-9]*)--end% %msg:R,ERE,1,BLANK:(OUT=[a-zA-Z0-9]*)--end% %msg:R,ERE,1,BLANK:(SRC=[a-zA-Z0-9\.]*)--end% %msg:R,ERE,1,BLANK:(DST=[a-zA-Z0-9\.]*)--end% %msg:R,ERE,1,BLANK:(PROTO=[a-zA-Z0-9]*)--end% %msg:R,ERE,1,BLANK:(SPT=[0-9]*)--end% %msg:R,ERE,1,BLANK:(DPT=[0-9]*)--end%\n"
|
||||||
@@ -0,0 +1,41 @@
|
|||||||
|
# Note: The lines starting with # are ignored. To enable any of the
|
||||||
|
# configuration options below, remove # from the beginning of a respective line.
|
||||||
|
|
||||||
|
# this file is not distributed upstream as of iwd 1.0 version
|
||||||
|
# It is created as transitional config from latest version
|
||||||
|
# Please read iwd.config(5), iwd.network(5), iwctl(1), iwmon(1) before setting
|
||||||
|
# these parameters below
|
||||||
|
|
||||||
|
# main.conf format is changed with iwd 1.3 release
|
||||||
|
|
||||||
|
#[EAP]
|
||||||
|
#mtu=1400
|
||||||
|
|
||||||
|
#[General]
|
||||||
|
|
||||||
|
#EnableNetworkConfiguration=True
|
||||||
|
#ControlPortOverNL80211=True
|
||||||
|
#RoamThreshold=-70
|
||||||
|
|
||||||
|
#[Network]
|
||||||
|
|
||||||
|
#NameResolvingService=resolvconf
|
||||||
|
|
||||||
|
#[Scan]
|
||||||
|
|
||||||
|
# DisablePeriodicScan=false
|
||||||
|
# DisableRoamingScan=false
|
||||||
|
|
||||||
|
#[Blacklist]
|
||||||
|
|
||||||
|
#[Rank]
|
||||||
|
|
||||||
|
# BandModifier5Ghz=1.0
|
||||||
|
|
||||||
|
[General]
|
||||||
|
EnableNetworkConfiguration=True
|
||||||
|
Country=CZ
|
||||||
|
|
||||||
|
[Network]
|
||||||
|
EnableIPv6=false
|
||||||
|
NameResolvingService=resolvconf
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
PACKAGER_PRIVKEY="/root/.abuild/packager.rsa"
|
||||||
@@ -0,0 +1,74 @@
|
|||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCBrbk9nejJwcDF6WmdHaEN2
|
||||||
|
N0JHT1BBIDE4CndHZnVkUU5MUmhxT09kZXZ0V1Vwei9LRVFER1E1aktqT0VSaXUx
|
||||||
|
c043U3MKLS0tIGdLL3B4a0lhNXVGVXZyU01CQ09Rc2RyUlpFVVVoZXBSVlRBWlRW
|
||||||
|
QXRUb1kKULpkyDn3NpjI2IO/iehEDS1TxAPh9leKHNSNTeHvWnPMHeeUZbXZd9+O
|
||||||
|
DzInQbNT7x+g+eFBc2hAvMBm04OuP0Z0f2vuk6oUIjFSwbaRAkh9QsYKkglkUCEA
|
||||||
|
cUHu2xdl58IL51LROyHjAztxtQUTekWWh7l/PC60xWTXAWLeGZFBFAfcH25isvIF
|
||||||
|
EUfW77+HoUoYLZrorN60xF0QUFsQKqaCpT7KBxPw1Mh3NRdmC9MJbUd5A+v48ADh
|
||||||
|
/QFmg5MCofL3K7EIaKJiptAl2AQVbGKAEBbsqEMM0IwqBBphZm4Kp4o5xMBEFQeQ
|
||||||
|
fKmp+1Mm1jlX3388M8lkl3ugwOQ5Le9J6arZPP6VCbUdPP4vsYjykUjLQly6ihDe
|
||||||
|
O/u+MV3bKZErygZ8FNFQr3wQmSim60ys8nKpz6NH393F+lY69Y1TAFfx39GBI6li
|
||||||
|
7ZrzwgteYa/HTW8vcIfVxwKYHkgocdVOtuWjgG579ntPzieIYxTaj4win0BzkGaH
|
||||||
|
+5Z/z7tMTyUd7ISkXnQwwUomrkHp9FLj3AGgbjC7hp9WqZ/cgTysiRGGmrI6H4iG
|
||||||
|
xRsXAsB7VsHEuGQe+qvF2OYI7LUKcBBrmEDJXJ1cTJxf7qwUf/+dmiHeVuwOaozW
|
||||||
|
lxGDbZ8KdBuxfW28WMoH3gHq1jonOSwiPYhWfb/wtM3NIZPpZXAXjujUACIoaF/e
|
||||||
|
ZFmPn5N1nrefon3LaE53GusKuXpobKL+CY8Zkw2cPcCJW6E0IqanFD1waphYK1f2
|
||||||
|
hkihZR4c8Jo5aWLlSkljFojo4n7+Xmtwcep/LKYDeXXgu1+amT9R/5+S081q2QzF
|
||||||
|
+jJotlojm2hu+O5Q7LgjuMgIuZzMa8rNYVAaOTZuxG1bu6JwHUjoUTdzrzQq3KeI
|
||||||
|
oQc16lWdxI5g+2tisyRTyPOVN6y5kAfG4ZkUqMj2tIhCwW615G1ywXvvLQUoLshl
|
||||||
|
FoGX/ITldWS+oQU/OKUPpGa8VZysM3C0XRWnwat+ChVQnIuVxkuAFXAC0oODpLnL
|
||||||
|
MI424fjM6/5YOgVmkpSd8E/+8oXgeDpXXAx7+Fo5Ngpd69EUNs4w4nK5huAWsg7m
|
||||||
|
QCWXL02xHP6iiPW7wKyegCLgMAFeVc2zcC6n+77Qlz9G7onww5+0Lnz687qz65FI
|
||||||
|
4SkqYfM7/1unmBDHOJlsG71tYMr2nbCUSisDWJdjNdmWiSH7RCNN42phLdQss9Kp
|
||||||
|
whIfCUpCBtBw6vPy4Bc318L/H0Bq4TpQWFdB/OVCyvUDNGbK3KAKLRyvsDif/Z6A
|
||||||
|
CffZdbxn4phtueK1vZQQvodGF4SgcNdd2AdVDyYxL6tnUs+EWAoxnH0MixlCxnKO
|
||||||
|
PNlyiYsiW/YdjeFZygUM+qdLYiMpxonhsjBbKbqCdddP2ccfArnxH7BnnILhbjCD
|
||||||
|
tKuihrblOWpiH0S3UkAx3HuCh/5q0fCa5MkL6o+I5bN/V/V//iGtr9FRPDEz6To4
|
||||||
|
p/bTbq1CGLHci9mUJkdkU+Y8RW+tbDTpgcNHRc0LwiVdsc+bjVFDIs2kMAH6C/lz
|
||||||
|
7toauF7uGCmdBapZHJMwAZKeBYlXEQiR6NxcWEbUSPr7xVtRrwxQBATKFn6N+C/A
|
||||||
|
1A4Oiq87409Q9w/q8PFAQhBeK3tNzOb+6Sg61kzeZv5IMYu2cuKCTTMfSGxZyzCJ
|
||||||
|
ReGNHoye4kQ0w0TwpYnmYH898rnuKGLYgTm9sqg/7DBFG4Dez1YrOO6Rnr3XgwHb
|
||||||
|
S49HN1QGt//6Trv3orR6bjqn+ehEkFtWQk827cOsUtPAzw9Y2gmKnNOfUUo6pyuX
|
||||||
|
PoDTxg8L1Bv1zZAQJlwzH0FJrVjEYb5Eq4KOVRgclXQ1Qlm75YO5v7IJpiN/tkVL
|
||||||
|
olqAHnk7iXWcjMW9Zazv8qPg0S5NkKtYdPQg756Y54K/uhTvtpI0N9JHNRysLWL7
|
||||||
|
diGvtJDkidA0frQ1P2Em2ABHOKc5ObKlt1sgWofjE+zGKgt46oAC/0erTrpyH8jt
|
||||||
|
lf4gFL8nUHMWxV3fl8rfNaS7a2Ti3qP6g/BYyLbvxf6xY+Ey/oqc+BqSvU1kcUdc
|
||||||
|
hpYmQ+eRwDKXHJvFzHNedG/I9tDIso/achpuxEot3V5+bT0TnTL54cR5y+AE0diz
|
||||||
|
frysWuMKxSGDzdMPsrAECK52J03J512wCEKAyjl4jZImIgfAb7dGVwPyRf9jbpXD
|
||||||
|
u3bOJ5j6hoMwtEPKS5Pi0WebUVoJfWd1GuZB0tMhsVQOvggnh+zuN5X1FwEzxfDq
|
||||||
|
mXufznwj+Qoi5sqQErD/uDIYISPryR81EvprkLKbq+pPuEMea2s5F1wjz3iBgqZT
|
||||||
|
vjeevrWJhR/hDgJsNt1Sq5lQj6xqAi6Tdfl1fG663ocxmMSPXQiH1Wi/R9A383Jk
|
||||||
|
vilvpAfvuAqdeLTwNi1Eo43qVwenmK4kZ2dbvJ5yJ0jq+pB4KgA5o3AAhCSVHhK8
|
||||||
|
UYyZprNSE61N4rggxJsc6PBp83v/ZGqCe0owLrSIkK8BKJ/ANXuj6X4aLWdZkRFC
|
||||||
|
vzhGQxCCOpgGI5gWR7rdQE3UimnvvydoT4xnTLylHrhR0/51TLyz+FgHlhUSutnu
|
||||||
|
h6miERLXt52oDYKxvFgMPButZMe1plafKx3xsHgYcEyA7/xLDLRGCK82E7F+8wvo
|
||||||
|
Wcng71kfww2LnSOKyd8FhulBYcFLWZs9XgEdg5rWLg32q1GyHzl+unxFNh7FB27E
|
||||||
|
1V7+ZGEbEEJSBrNCFKNqCqcm8K8HkGDmNAgcMQtt2Ho1kS+4PhdcBKfWI7iLfLQX
|
||||||
|
9Tf7gsjLYLZhfsVlEnUVv/sZLxkJTbyNoOEEiQdKqcqifoqf/dKop3DP3SaFbAB7
|
||||||
|
hthiQ+99M6ML20nIL3/xGeLfNIDZcgqOCEtBDQ2y3l4aF5UQLIj+hntMKBBOZ9wI
|
||||||
|
VIROnx48U/hEIyuFEuGwPdaC0Te15OuMq6o6QWWf2mfXOa2OmZuoD1FHFG4BCFNt
|
||||||
|
GTZRq13x75C4mP+vEbwPg5XaG7NtJMwMWFd5BsjFFezRa3V6YJ+YYG7mB5UvWiiL
|
||||||
|
oziBxrUhP8qcsA1uVWYvKPh42Lu3ClV0iPst6b+7rC1ztWu6npmvaAiuP1ELrRKM
|
||||||
|
JnrFGh26/n8Tqs4cXfOu5+5E1a1f2EuPSPlu/8uQUDYbLETmF+dUOMbggX3W4YP7
|
||||||
|
rv/cqi9FwO7eq9RDWnwXkatN8uM57rxOPqZ3DRtVojdsacvuNS5lmX0V+8fBESNw
|
||||||
|
mSlwA/bvfiHXUZEo29waFaZxTb0Qbwje4UfFVW2YuYXN2TWY/3a1nMBUwTo8bOW2
|
||||||
|
3abvIjmrVKYXnmTq4VBeYuAV/9++mMqzJcD+OTYFAxzP+QKbO6B4w9606vKBpZNz
|
||||||
|
JnZsL9rQF4EXUNTDZ/BRkFreP0l2rBsCb74PkFvF04iUzrQlb+K7+ZvaX1GpiOYO
|
||||||
|
pDArKFAw8v1pwwjjEwlak+JCNg/46iwKZnEID5iAZFtL3hTsSAiXTa+BXd7BYFZ1
|
||||||
|
RsmcLu6EhCddBMq6wOTJ+pyRgLmGU9+id6nQTZ5VyhhV8uNXCjt1Q6uKuEQbp5QJ
|
||||||
|
UZOHjFQDPyXQ2KrHEmiwYql+zbGuYEQZfgT9x36+mWHLocGUMSPtJdvh1G/X5Nhq
|
||||||
|
rQKLg12adc1o2xqerQUrV6JgWOv5s2jDKQakyRXtNunLFVtzhbKfGsB1uxEtkL+L
|
||||||
|
/utFv0Tq/QE1D+ab3E7Skw6mjONn2iZKxkghU1xdiO0Vc7xVdPB+Ev9HW446a5+M
|
||||||
|
z6rdgTbnvgVmHov3pQuQ6j7ceuu9evvlJ+ewxBxIoLqWDl06kKFmEOMUFSgLKKKk
|
||||||
|
+tuS924mD3CShklHlc+fm2yLGSU4H4CMKkL0ZcgilB0DCTP0xE10r2/elzDR1YiS
|
||||||
|
xGto/ztrdEmGY50znWtx6TLPoNGqdfTU223k7dH4uKzxDFMjYFApUuAsFiNuIJ2X
|
||||||
|
EIVPD8hv6kXIncmonh4Rb5UJIpPwVrl42iY+IRcejIf+/UWN+SAy280lvLhMErsM
|
||||||
|
ClDCeHq4mDIFK0f6+Q6LKw7vU/vHK7wbDJFX2youaJVFZUE9CuPRkBWztj+LgAPA
|
||||||
|
c0A/YFSZ0j3IZraO3nsjXYlfDN5kvN2Y5e2APCXQafQRWGudfBN1XuHbPSNgsX3F
|
||||||
|
ZnAncBvKFFqh3KYwTLaWScpxkfB5xo/s+lU8GPXhLYDGXfbXgdUtSSxPbea28j4K
|
||||||
|
tIVB5jHAwSjZF0hw1717XlndYowFnxHmLlHh83EHXKbAraV6iNdpEmF1reaHJiRs
|
||||||
|
dscH1q6mIsV1tAWbD62BDA1jZW608Y3U4O2UK7L/dxb958UCcuZlpmPpJ3WhF+1s
|
||||||
|
qs50HrGTYxC2dMUHWCqXZMAxNnIYxwCJrK0hl67/bnEancPctmvW2rJ9AEmDno63
|
||||||
|
ThPHxjeMrP3F9WQLmZlc0IgCd0leBWBoRNieNPOAWib0IHgHBNQ7bs9y
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCAvS2hSWUIyMGRWb1JiSWZk
|
||||||
|
cGtDeWNnIDE4CkhLNlhkV1NNZTNKRGFEUGQ1MnRWMkpobzh0dnZuMXRlVWZhOCtF
|
||||||
|
cklmR1kKLS0tIFdmMUlRMWo0YVF6WWFLNFR6NEttMFhmQVh6c1V5Slh6M1dOZllY
|
||||||
|
WGs3WWcKsYHS7ureliLncEfsmDd+XOOYNjZybEDgy2FrfhzPLLGmIhItQP9xVuRp
|
||||||
|
ur7XwemHDZ6WY53DB27gSZI0zsCKivgLfrajOAQZoQtkR4A4TKxd9nQBhtCnoS+I
|
||||||
|
jrIJXh60D/5WxCHRH2MkvgoHWPEK2KfXcNorUXuuU3v6uYigEZik0H2QSubWFQLP
|
||||||
|
l349pTFvOZFXaSmj4Z2GBH8pZ206/7FhMZVdEuTx63T+HKNku4OS4e7/6M+kImn2
|
||||||
|
0wvOQsKQWvBTFYeez8rtEeUMZWYUD4iaPIhZBw3jFICL0WC5ujiPJ61tyN67aa+d
|
||||||
|
igdT2VZ3PU0G6VOYRU+9Q4fU1A0mB2ZeOfhzQygCqe84tac4rCLmXpON03r5mAPm
|
||||||
|
khcWaqrMv4MZTApqyrvfSY/Nh1adr3hZjefTWbWuNOxCC3P3SL54MvxlMwJOtlhD
|
||||||
|
najYWdKIHeBbrMmZH3zw9g6Kh18ZnbMYVdq3zLxbpcKw71NVP8W1OfA6OcHVqWZy
|
||||||
|
ydyVPSRWRLzjxwDPmt+CYL3cM6H1jNoD+0xTk+QgFrmUMySvkjrnXodHTuyKKcYo
|
||||||
|
zud7DhtCRk6hueaXRauMdEkCoXDn2nOUxekgSLjlt1l1fYPmQliRijXxTnv9lNTg
|
||||||
|
3kovw+vUsl2RIUqMDT4dgs11oYe4gndkCMqYuM7tXNPTjRkWBF3UOp1LxJ9QH/A0
|
||||||
|
TbPTHtBPCj0Jc/0+TN0nDkllf2RSMqu8AISyNkxSptdgsMfnMxxfb4Ec7rsdbKu9
|
||||||
|
HTAaudA0TgdDa65PU2MFAHJbZGjZBtDwchNxtegaXjrNKjjarSkxSqBBpYoiRf5u
|
||||||
|
IE236DyyqF9QviD51dEgZzY333FFmOuIidDIYbYFSkLUQAVfrrF8HCqsu5/VFj2q
|
||||||
|
ZruHPOa6oFBuDeXGEOppvw1yarWHroygj7Ab01CxFCwMKmsNTM+AMi5K69ZatEB1
|
||||||
|
a7L8MLk7cQiO1DgI7ysJZ9uPTbnd7Q/+osSO2tFLjstFWvGXRRutfJLDOet2+HhF
|
||||||
|
IO9ZrjpbY+lDvU4105LVDTOq6fwSuDQ2or/uRZiDPBzLwvcf1LuzTeukKV+saIt2
|
||||||
|
77oRYixJFeHjfSHHz9Ue0F7YIyYSJg==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
# syntax = docker/dockerfile:1
|
||||||
|
ARG ALPINE_DOCKER_IMAGE
|
||||||
|
FROM $ALPINE_DOCKER_IMAGE
|
||||||
|
|
||||||
|
ARG REQUIREMENTS_FILE
|
||||||
|
ARG BUILDER_USER
|
||||||
|
ARG BUILDER_UID
|
||||||
|
ARG BUILDER_GID
|
||||||
|
|
||||||
|
RUN /usr/sbin/addgroup -g $BUILDER_GID $BUILDER_USER && \
|
||||||
|
/usr/sbin/adduser -D -g "" $BUILDER_USER -u $BUILDER_UID -G $BUILDER_USER
|
||||||
|
|
||||||
|
RUN mkdir /root/.abuild
|
||||||
|
RUN apk add --no-cache abuild
|
||||||
|
|
||||||
|
ADD src/repository-builder/$REQUIREMENTS_FILE /tmp/$REQUIREMENTS_FILE
|
||||||
|
ADD src/repository-builder/repository.build.sh /bin/build-repository
|
||||||
Executable
+27
@@ -0,0 +1,27 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
# 1>/dev/null
|
||||||
|
|
||||||
|
APKS_TO_INSTALL=`cat /tmp/$REQUIREMENTS_FILE`
|
||||||
|
|
||||||
|
apk fix --arch $ALPINE_ARCH
|
||||||
|
apk update --arch $ALPINE_ARCH --allow-untrusted
|
||||||
|
apk fetch --allow-untrusted --recursive --link --arch $ALPINE_ARCH --output /mirror/$RELEASE_VERSION/main/$ALPINE_ARCH $APKS_TO_INSTALL
|
||||||
|
|
||||||
|
if ! ls /mirror/$RELEASE_VERSION/main/$ALPINE_ARCH/*.apk >& /dev/null; then
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
chown -R $BUILDER_UID:$BUILDER_GID /mirror
|
||||||
|
|
||||||
|
echo /mirror/$RELEASE_VERSION/main > /etc/apk/repositories
|
||||||
|
|
||||||
|
# abuild-keygen -a
|
||||||
|
cp /root/.abuild/$BUILDER_KEY_BASENAME.rsa.pub /etc/apk/keys
|
||||||
|
|
||||||
|
apk index -vU -d $RELEASE_VERSION --allow-untrusted --rewrite-arch $ALPINE_ARCH -o /mirror/$RELEASE_VERSION/main/$ALPINE_ARCH/APKINDEX.tar.gz `ls /mirror/$RELEASE_VERSION/main/$ALPINE_ARCH/*.apk`
|
||||||
|
abuild-sign -k /root/.abuild/$BUILDER_KEY_BASENAME.rsa /mirror/$RELEASE_VERSION/main/$ALPINE_ARCH/APKINDEX.tar.gz
|
||||||
|
chown -R $BUILDER_UID:$BUILDER_GID /mirror
|
||||||
|
|
||||||
|
apk update --arch $ALPINE_ARCH --allow-untrusted
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
busybox-extras
|
||||||
|
busybox-extras-openrc
|
||||||
|
chrony
|
||||||
|
haveged
|
||||||
|
rsyslog-openrc
|
||||||
|
rsyslog
|
||||||
|
less
|
||||||
|
iptables
|
||||||
|
wireguard-tools
|
||||||
|
iwd
|
||||||
|
mc
|
||||||
|
nano
|
||||||
@@ -0,0 +1,96 @@
|
|||||||
|
# rsyslog configuration file
|
||||||
|
#
|
||||||
|
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
|
||||||
|
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html
|
||||||
|
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
|
||||||
|
|
||||||
|
|
||||||
|
#### Global directives ####
|
||||||
|
|
||||||
|
# Sets the directory that rsyslog uses for work files.
|
||||||
|
$WorkDirectory /var/lib/rsyslog
|
||||||
|
|
||||||
|
# Sets default permissions for all log files.
|
||||||
|
$FileOwner root
|
||||||
|
$FileGroup adm
|
||||||
|
$FileCreateMode 0640
|
||||||
|
$DirCreateMode 0755
|
||||||
|
$Umask 0022
|
||||||
|
|
||||||
|
# Check config syntax on startup and abort if unclean (default off).
|
||||||
|
#$AbortOnUncleanConfig on
|
||||||
|
|
||||||
|
# Reduce repeating messages (default off).
|
||||||
|
#$RepeatedMsgReduction on
|
||||||
|
|
||||||
|
|
||||||
|
#### Modules ####
|
||||||
|
|
||||||
|
# Provides --MARK-- message capability.
|
||||||
|
module(load="immark")
|
||||||
|
|
||||||
|
# Provides support for local system logging (e.g. via logger command).
|
||||||
|
module(load="imuxsock")
|
||||||
|
|
||||||
|
# Reads kernel messages.
|
||||||
|
module(load="imklog")
|
||||||
|
|
||||||
|
#### Config files ####
|
||||||
|
|
||||||
|
# Include all config files in /etc/rsyslog.d/.
|
||||||
|
include(file="/etc/rsyslog.d/*.conf" mode="optional")
|
||||||
|
|
||||||
|
#### Rules ####
|
||||||
|
|
||||||
|
# Log all kernel messages to kern.log.
|
||||||
|
|
||||||
|
# Log anything (except mail) of level info or higher.
|
||||||
|
# Don't log private authentication messages!
|
||||||
|
# NOTE: The minus sign in front of filename disables buffer flush.
|
||||||
|
*.info;authpriv.none;cron.none;kern.none;mail.none -/var/log/messages
|
||||||
|
|
||||||
|
# The authpriv file has restricted access.
|
||||||
|
authpriv.* /var/log/auth.log
|
||||||
|
|
||||||
|
# Log all the mail messages in one place.
|
||||||
|
mail.* -/var/log/mail.log
|
||||||
|
|
||||||
|
# Log cron stuff.
|
||||||
|
cron.* -/var/log/cron.log
|
||||||
|
|
||||||
|
# Everybody gets emergency messages.
|
||||||
|
*.emerg :omusrmsg:*
|
||||||
|
|
||||||
|
# Log all kernel messages to the console.
|
||||||
|
# Logging much else clutters up the screen.
|
||||||
|
#kern.* /dev/console
|
||||||
|
|
||||||
|
|
||||||
|
### Examples ####
|
||||||
|
|
||||||
|
# Send all logs to remote syslog via UDP.
|
||||||
|
# An on-disk queue is created for this action. If the remote host is
|
||||||
|
# down, messages are spooled to disk and sent when it is up again.
|
||||||
|
#*.* action(
|
||||||
|
# type="omfwd"
|
||||||
|
# target="192.168.0.1"
|
||||||
|
# port="514"
|
||||||
|
# protocol="udp"
|
||||||
|
# queue.filename="fwdRule1" # unique name prefix for spool files
|
||||||
|
# queue.type="LinkedList"
|
||||||
|
# queue.maxDiskSpace="256m"
|
||||||
|
# queue.saveOnShutdown="on"
|
||||||
|
# action.resumeRetryCount="-1"
|
||||||
|
# action.resumeInterval="30"
|
||||||
|
#)
|
||||||
|
|
||||||
|
# Receive messages from remote host via UDP
|
||||||
|
# for parameters see http://www.rsyslog.com/doc/imudp.html
|
||||||
|
#module(load="imudp") # needs to be done just once
|
||||||
|
#input(
|
||||||
|
# type="imudp"
|
||||||
|
# port="514"
|
||||||
|
#)
|
||||||
|
:msg, contains, "fw:" /var/log/kern.log;logpattern
|
||||||
|
& stop
|
||||||
|
kern.* /var/log/kern.log
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
disable_splash=1
|
||||||
|
|
||||||
|
# Disable Wi-Fi and Bluetooth to save power
|
||||||
|
# dtoverlay=disable-wifi
|
||||||
|
dtoverlay=disable-bt
|
||||||
|
|
||||||
|
# This will use more power but lower
|
||||||
|
# overall system latency, which is fairly desirable for a
|
||||||
|
# system acting as a router.
|
||||||
|
force_turbo=1
|
||||||
Executable
+37
@@ -0,0 +1,37 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
current_process=$$
|
||||||
|
tries=3
|
||||||
|
some_time=5
|
||||||
|
|
||||||
|
kill_child_processes() {
|
||||||
|
for dir in /proc/[0-9]*; do
|
||||||
|
process_id=$(cat ${dir}/stat | awk '{print $4}')
|
||||||
|
child_id=$(cat ${dir}/stat | awk '{print $1}')
|
||||||
|
if [ ${process_id} -eq $1 ]; then
|
||||||
|
kill -9 ${child_id}
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
trap "kill_child_processes ${current_process} ; kill -9 ${current_process}" SIGTERM SIGINT SIGHUP
|
||||||
|
|
||||||
|
while [ $tries -ge 1 ]
|
||||||
|
do
|
||||||
|
if ! ping -q -c 1 10.0.22.1 > /dev/null ; then
|
||||||
|
until ntpd -n -q -p $(nslookup tik.cesnet.cz 1.1.1.1 | grep 'Address' | tail -1 | cut -d ' ' -f 2)
|
||||||
|
do
|
||||||
|
rc-service wg-quick.wg0 stop
|
||||||
|
logger -t ntp_sync "Trying to sync time..."
|
||||||
|
sleep $some_time &
|
||||||
|
wait $!
|
||||||
|
done
|
||||||
|
rc-service wg-quick.wg0 status | grep "started" || rc-service wg-quick.wg0 start
|
||||||
|
sleep $some_time &
|
||||||
|
wait $!
|
||||||
|
fi
|
||||||
|
sleep $some_time &
|
||||||
|
wait $!
|
||||||
|
tries=$(( $tries - 1 ))
|
||||||
|
done
|
||||||
|
exit 0
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
[Interface]
|
||||||
|
ListenPort = <%= $wg_port %>
|
||||||
|
PrivateKey = <%= $(cat src/wireguard.private.key) %>
|
||||||
|
Address = <%= $wg0_address %>
|
||||||
|
DNS = <%= $wg0_gateway %>
|
||||||
|
MTU = 1280
|
||||||
|
|
||||||
|
[Peer]
|
||||||
|
PublicKey = <%= $(cat src/wireguard.public.key) %>
|
||||||
|
Endpoint = <%= $wg_server %>:<%= $wg_port %>
|
||||||
|
AllowedIPs = 0.0.0.0/0
|
||||||
|
PersistentKeepalive = 25
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCAweWZSMk14YkN6NjZibmpN
|
||||||
|
ZjRXSkxnIDE4CitRZVR4aDZJZ21ZYVY0RWxvdTE4OVVhVXE3RVRmRUtYRlBRRm9Q
|
||||||
|
ZUFoTWcKLS0tIFg1S0pOOEt3NGlUYTRTeXVwTS9LaDhmdDdsNFpQRnpycGhXeCtD
|
||||||
|
S0FYN0kK7VkM5XZAPBGpnZy0imULXgM7M0ZG0CcxPoX/IjqBdpx99WJOVc3HReY=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCBSMXRlOCtyRmlzZ3pRc2lT
|
||||||
|
eTBKWVJRIDE4Ckc2dmZVdTZjSjg3L1NzY2UzTCtDcFdFU3Z2NmF2WWhVd3IySy9J
|
||||||
|
MmlINVUKLS0tIC94NnpqOG5McXkvU0NEVDZHcDExMCswU0pOTDIyY0hIWnZIaCs5
|
||||||
|
akpFWm8K6ny4xFB41oG/h8JToFnfgHBB3zWoPsLtuTCKpQE6EV+n9C/sWdB5yNJK
|
||||||
|
FoR5NdSUfxhIMK2W6HK4QAVB3oxtqqeQCY2vg3MNJ1iMkBE=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCAyanV2aU1wVWx3Q0J3ZVhu
|
||||||
|
ZGdQalNBIDE4Cm9LQzlZNk80M1VhcXNVREs0S0ZqdkpkclE2ZXhDNURSaG81aEV2
|
||||||
|
Zk0zdkkKLS0tIGtOdHAwZDhYVWQ3N3Z2cmVOUktDU3NnV0ozNldSTGxrNngwMWd5
|
||||||
|
aGZET0kKSHjNMXCJvE3aYWVH5CuJ6KTBVYrtKd8EP+lua36ECKK5ARb/zKnsqd8q
|
||||||
|
C3817wLCoyeW54XNtH34QU63noK6DBtTHD1mzCp+ytPiNUY=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
set -e
|
||||||
|
|
||||||
|
FILES_IN_VAULT='./src/wifi-password.txt
|
||||||
|
./src/repository-builder/packager.rsa
|
||||||
|
./src/repository-builder/packager.rsa.pub
|
||||||
|
./src/wireguard.private.key
|
||||||
|
./src/wireguard.public.key
|
||||||
|
./src/authorized_keys'
|
||||||
|
|
||||||
|
age_encrypt() {
|
||||||
|
local input="$1"
|
||||||
|
local output="$1.tmp"
|
||||||
|
local AGE_PASSPHRASE=`cat ./.vault_password_file`
|
||||||
|
|
||||||
|
./cache/age/age --encrypt --passphrase --armor --output $output $input && rm $input && mv $output $input
|
||||||
|
}
|
||||||
|
|
||||||
|
age_decrypt() {
|
||||||
|
local input="$1"
|
||||||
|
local output="$1.tmp"
|
||||||
|
local AGE_PASSPHRASE=`cat ./.vault_password_file`
|
||||||
|
|
||||||
|
./cache/age/age --decrypt --output $output $input && rm $input && mv $output $input
|
||||||
|
}
|
||||||
|
|
||||||
|
encrypt() {
|
||||||
|
for FILE in $FILES_IN_VAULT; do
|
||||||
|
age_encrypt $FILE
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
decrypt() {
|
||||||
|
for FILE in $FILES_IN_VAULT; do
|
||||||
|
age_decrypt $FILE
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
$1
|
||||||
Reference in New Issue
Block a user