Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add note about iptables modprobe, move activeconfs #339

Merged
merged 2 commits into from
Jun 14, 2024
Merged

Add note about iptables modprobe, move activeconfs #339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ebdf68
Add note about iptables modprobe
thespad Jun 13, 2024
640f754
Write activeconfs to /run
thespad Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion root/etc/s6-overlay/s6-rc.d/init-wireguard-module/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,10 @@ if ip link add dev test type wireguard; then
ip link del dev test
if capsh --current | grep "Current:" | grep -q "cap_sys_module"; then
echo "**** As the wireguard module is already active you can remove the SYS_MODULE capability from your container run/compose. ****"
echo "**** If your host does not automatically load the iptables module, you may still need the SYS_MODULE capability. ****"
fi
else
echo "**** The wireguard module is not active. If you believe that your kernel should have wireguard support already, make sure that it is activated via modprobe! ****"
echo "**** If you have an old kernel without wireguard support built-in, you can try using the "legacy" tag for this image to compile the modules from scratch. ****"
echo "**** If you have an old kernel without wireguard support built-in, you can try using the 'legacy' tag for this image to compile the modules from scratch. ****"
sleep infinity
fi
6 changes: 3 additions & 3 deletions root/etc/s6-overlay/s6-rc.d/svc-wireguard/finish
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
#!/usr/bin/with-contenv bash
# shellcheck shell=bash

if [[ -f "/app/activeconfs" ]]; then
. /app/activeconfs
if [[ -f "/run/activeconfs" ]]; then
. /run/activeconfs
for tunnel in $(printf '%s\n' "${WG_CONFS[@]}" | tac | tr '\n' ' '; echo); do
echo "**** Disabling tunnel ${tunnel} ****"
wg-quick down "${tunnel}" || :
done
echo "**** All tunnels are down ****"
rm -rf /app/activeconfs
rm -rf /run/activeconfs
fi
8 changes: 4 additions & 4 deletions root/etc/s6-overlay/s6-rc.d/svc-wireguard/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# shellcheck shell=bash

unset WG_CONFS
rm -rf /app/activeconfs
rm -rf /run/activeconfs
# Enumerate interfaces
for wgconf in $(ls /config/wg_confs/*.conf); do
if grep -q "\[Interface\]" "${wgconf}"; then
Expand All @@ -23,13 +23,13 @@ unset FAILED
for tunnel in ${WG_CONFS[@]}; do
echo "**** Activating tunnel ${tunnel} ****"
if ! wg-quick up "${tunnel}"; then
FAILED="${tunnel}"
break
FAILED="${tunnel}"
break
fi
done

if [[ -z "${FAILED}" ]]; then
declare -p WG_CONFS > /app/activeconfs
declare -p WG_CONFS > /run/activeconfs
echo "**** All tunnels are now active ****"
else
echo "**** Tunnel ${FAILED} failed, will stop all others! ****"
Expand Down