Wireguard Road Warrior setup for RaspberryPi 4

Code in this repository produces files for bootable Micro-SD card for RaspberryPi 4. During the boot it creates entropi_nomap WIFI access point (hotspot) that clients can connect to. It then encrypts all client traffic through Wireguard tunnel via any known WIFI network in reach. This is supposed to be a headless Alpine Linux router essentially. There is no web admin interface - only SSH access from the client side using public keys (or, you know, physical access with keyboard and monitor attached to the RaspberryPi).

Requirements

• RaspberryPi
• WIFI over USB dongle
• USB-C cable for powering RaspberryPi (could be plugged directly into a laptop)
• Micro-SD card (I use 2GB and that's plenty big) - Formatted with single FAT32 partition named entropi
• Properly set up machine running Wireguard peer instance reachable from the Internet

Usage

1. Clone this repository
2. Edit .env file
3. Create .vault_password_file and put a plain text password inside (used for decrypting/encrypting wireguard keys and other stuff)
4. Replace all files listed as FILES_IN_VAULT inside the vault script with appropriate contents
5. Create known networks files (see below)
6. Insert MicroSD card into your computer and make sure it is mounted under /media/{user}/entropi (edit the Makefile if necessary)
7. Run make card
8. Eject the card and use it to boot RaspberryPi (after a minute or two you should see it provides your wifi)

Known WIFI networks setup

Create secrets folder and put plain text files inside named {KNOWN_WIFI_SSID}.psk where {KNOWN_WIFI_SSID} is the name of each wifi you want to be used to tunnel through (coffee shops, your ISP etc.). Contents of each file needs to be following:

[Security]
Passphrase={KNOWN_WIFI_PASSWORD}
AlwaysRandomizeAddress=true

[Settings]
AutoConnect=true

All the files will be automatically picked up by the wifi daemon after the RaspberryPi finishes boot process