mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 08:59:30 +03:00
fbefc98792
- deploy-remote-access-lab.sh: install iptables via apk if missing; modprobe wireguard - cluster.env: add DB_BACKEND=1 (MariaDB default; 2=Postgres, 3=SQLite) Co-authored-by: Cursor <cursoragent@cursor.com>
89 lines
3.4 KiB
Bash
Executable File
89 lines
3.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# Lab WireGuard + RSSH bastion on cast01 primary (ac/* cluster).
|
|
set -eu
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
# shellcheck source=/dev/null
|
|
. "$ROOT/scripts/lib/common.sh"
|
|
load_cluster_env
|
|
load_secrets_lab 2>/dev/null || true
|
|
|
|
is_primary_node || { log "deploy-remote-access-lab: skip (not primary)"; exit 0; }
|
|
|
|
# Ensure iptables is available (needed for WireGuard PostUp/PostDown NAT rules)
|
|
if ! command -v iptables >/dev/null 2>&1; then
|
|
log "iptables not found; installing via apk"
|
|
apk add --no-cache iptables >/dev/null 2>&1 || log "WARN: iptables install failed — PostUp/PostDown may error"
|
|
fi
|
|
|
|
# Load wireguard kernel module if not already loaded
|
|
modprobe wireguard 2>/dev/null || true
|
|
|
|
WG_EXAMPLES="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}/ac-ms-remote-access/examples/wireguard"
|
|
[ -d "$WG_EXAMPLES" ] || die "missing $WG_EXAMPLES (init ac-ms-remote-access submodule)"
|
|
|
|
WG_IF="${WG_INTERFACE:-wg0}"
|
|
WG_PORT="${WG_LISTEN_PORT:-51820}"
|
|
WG_NET_PREFIX="${WG_CLIENT_IP_PREFIX:-172.200.2.}"
|
|
WG_DIR="/etc/wireguard"
|
|
WG_CONF="${WG_DIR}/${WG_IF}.conf"
|
|
SUDOERS_DST="/etc/sudoers.d/androidcast-wg"
|
|
|
|
mkdir -p "$WG_DIR" "${WG_DIR}/keys"
|
|
chmod 700 "${WG_DIR}/keys"
|
|
|
|
if [ -z "${WG_SERVER_PRIVATE_KEY:-}" ] || [ -z "${WG_SERVER_PUBLIC_KEY:-}" ]; then
|
|
if [ ! -f "${WG_DIR}/keys/server.privatekey" ]; then
|
|
log "generating lab WG server keys"
|
|
wg genkey | tee "${WG_DIR}/keys/server.privatekey" | wg pubkey > "${WG_DIR}/keys/server.publickey"
|
|
chmod 600 "${WG_DIR}/keys/server.privatekey"
|
|
fi
|
|
WG_SERVER_PRIVATE_KEY="$(cat "${WG_DIR}/keys/server.privatekey")"
|
|
WG_SERVER_PUBLIC_KEY="$(cat "${WG_DIR}/keys/server.publickey")"
|
|
fi
|
|
|
|
if [ ! -f "$WG_CONF" ] || [ "${FORCE_WG_CONF:-0}" = "1" ]; then
|
|
log "writing ${WG_CONF} listen=${WG_PORT}"
|
|
cat > "$WG_CONF" <<EOF
|
|
[Interface]
|
|
Address = ${WG_NET_PREFIX}1/16
|
|
ListenPort = ${WG_PORT}
|
|
PrivateKey = ${WG_SERVER_PRIVATE_KEY}
|
|
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
|
EOF
|
|
chmod 600 "$WG_CONF"
|
|
fi
|
|
|
|
if [ -f "${WG_EXAMPLES}/alpine-be-sudoers-wg" ]; then
|
|
install -m 440 "${WG_EXAMPLES}/alpine-be-sudoers-wg" "$SUDOERS_DST"
|
|
visudo -cf "$SUDOERS_DST"
|
|
fi
|
|
|
|
rc-service "wg-quick@${WG_IF}" start 2>/dev/null || wg-quick up "$WG_IF" 2>/dev/null || true
|
|
rc-update add "wg-quick@${WG_IF}" default 2>/dev/null || true
|
|
|
|
# RSSH: ephemeral ra-* users via sshd snippet (lab — port 22 on cast01)
|
|
RSSH_SSHD="/etc/ssh/sshd_config.d/90-androidcast-ra.conf"
|
|
if [ ! -f "$RSSH_SSHD" ] || [ "${FORCE_RSSH_SSHD:-0}" = "1" ]; then
|
|
log "install ${RSSH_SSHD}"
|
|
cat > "$RSSH_SSHD" <<'EOF'
|
|
# Android Cast lab RSSH bastion — Match User ra-*
|
|
Match User ra-*
|
|
PasswordAuthentication yes
|
|
PubkeyAuthentication no
|
|
AllowTcpForwarding yes
|
|
GatewayPorts no
|
|
X11Forwarding no
|
|
PermitTTY no
|
|
EOF
|
|
rc-service sshd reload 2>/dev/null || rc-service sshd restart 2>/dev/null || true
|
|
fi
|
|
|
|
BASTION_SCRIPT="${COMPOSE_BACKEND:-/var/www/ac/composed/backend}/scripts/rssh_bastion_user.sh"
|
|
if [ -f "$ROOT/lab-seeds/backend/scripts/rssh_bastion_user.sh" ] && [ ! -x "$BASTION_SCRIPT" ]; then
|
|
mkdir -p "$(dirname "$BASTION_SCRIPT")"
|
|
install -m 755 "$ROOT/lab-seeds/backend/scripts/rssh_bastion_user.sh" "$BASTION_SCRIPT"
|
|
fi
|
|
|
|
log "deploy-remote-access-lab_ok pub=${WG_SERVER_PUBLIC_KEY} endpoint=${WG_ENDPOINT:-cast01:${WG_PORT}}"
|