Tirsvad
fce3cf8c6b
actions/connect-wireguard brings a WireGuard tunnel up for a deployment job and takes it down again, with a guide and offline tests. The runs on a real runner (MIL-012 task 3) are still to do. Refs #184 Task: MIL-012#3
132 lines
4.8 KiB
Bash
132 lines
4.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Steps of the composite action actions/connect-wireguard/action.yml.
|
|
#
|
|
# connect-wireguard.sh mask print ::add-mask:: for every secret input
|
|
# connect-wireguard.sh up write the configuration and bring the tunnel up
|
|
# connect-wireguard.sh down take the tunnel down and delete the configuration
|
|
#
|
|
# Settings come from the environment, never from interpolated expressions:
|
|
# WG_CONFIG, WG_PRIVATE_KEY, WG_ADDRESS, WG_PEER_PUBLIC_KEY, WG_ENDPOINT,
|
|
# WG_ALLOWED_IPS, WG_PRESHARED_KEY, WG_DNS, WG_KEEPALIVE, WG_INTERFACE,
|
|
# WG_HEALTH_CHECK_HOST. WG_DIR is the configuration directory (/etc/wireguard
|
|
# by default); WG_QUICK, WG_SUDO and WG_PING name the commands, for the tests.
|
|
# Every failure is printed as ::error::[category] message. A key is never printed.
|
|
|
|
WG_DIR="${WG_DIR:-/etc/wireguard}"
|
|
WG_QUICK="${WG_QUICK:-wg-quick}"
|
|
WG_PING="${WG_PING:-ping}"
|
|
SUDO="${WG_SUDO-sudo}"
|
|
|
|
fail() {
|
|
echo "::error::[$1] $2"
|
|
exit 1
|
|
}
|
|
|
|
mask_secrets() {
|
|
local value line
|
|
for value in "${WG_PRIVATE_KEY:-}" "${WG_PRESHARED_KEY:-}"; do
|
|
[ -n "$value" ] && echo "::add-mask::$value"
|
|
done
|
|
# every line of a full configuration is masked, so a key cannot leak in pieces
|
|
while IFS= read -r line; do
|
|
line="${line#"${line%%[![:space:]]*}"}"
|
|
[ -n "$line" ] && echo "::add-mask::$line"
|
|
done <<<"${WG_CONFIG:-}"
|
|
return 0
|
|
}
|
|
|
|
check_interface() {
|
|
[[ "$WG_INTERFACE" =~ ^[a-zA-Z0-9_=+.-]{1,15}$ ]] ||
|
|
fail configuration "interface '$WG_INTERFACE' is not a valid interface name."
|
|
}
|
|
|
|
# render_config: the wg-quick configuration on stdout
|
|
render_config() {
|
|
if [ -n "${WG_CONFIG:-}" ]; then
|
|
printf '%s\n' "$WG_CONFIG"
|
|
return 0
|
|
fi
|
|
local name
|
|
for name in WG_PRIVATE_KEY WG_ADDRESS WG_PEER_PUBLIC_KEY WG_ENDPOINT WG_ALLOWED_IPS; do
|
|
[ -n "${!name:-}" ] ||
|
|
fail configuration "set config, or all of private-key, address, peer-public-key, endpoint and allowed-ips ($name is empty)."
|
|
done
|
|
[[ "$WG_KEEPALIVE" =~ ^[0-9]+$ ]] ||
|
|
fail configuration "persistent-keepalive must be a number of seconds."
|
|
printf '[Interface]\nPrivateKey = %s\nAddress = %s\n' "$WG_PRIVATE_KEY" "$WG_ADDRESS"
|
|
[ -z "${WG_DNS:-}" ] || printf 'DNS = %s\n' "$WG_DNS"
|
|
printf '\n[Peer]\nPublicKey = %s\nEndpoint = %s\nAllowedIPs = %s\nPersistentKeepalive = %s\n' \
|
|
"$WG_PEER_PUBLIC_KEY" "$WG_ENDPOINT" "$WG_ALLOWED_IPS" "$WG_KEEPALIVE"
|
|
[ -z "${WG_PRESHARED_KEY:-}" ] || printf 'PresharedKey = %s\n' "$WG_PRESHARED_KEY"
|
|
}
|
|
|
|
install_tools() {
|
|
command -v "$WG_QUICK" >/dev/null 2>&1 && return 0
|
|
echo "Installing wireguard-tools"
|
|
if ! { $SUDO apt-get update -qq &&
|
|
$SUDO apt-get install -y -qq wireguard-tools resolvconf iproute2 iputils-ping; }; then
|
|
fail environment "wireguard-tools is not installed and could not be installed (a Debian or Ubuntu runner with root is needed)."
|
|
fi
|
|
}
|
|
|
|
# Use the user-space implementation when the kernel has no WireGuard module,
|
|
# which is the usual case in a Gitea runner container.
|
|
choose_implementation() {
|
|
if $SUDO ip link add dev "wgprobe$$" type wireguard 2>/dev/null; then
|
|
$SUDO ip link delete dev "wgprobe$$" 2>/dev/null || true
|
|
return 0
|
|
fi
|
|
if command -v wireguard-go >/dev/null 2>&1 || $SUDO apt-get install -y -qq wireguard-go 2>/dev/null; then
|
|
export WG_QUICK_USERSPACE_IMPLEMENTATION=wireguard-go
|
|
echo "No kernel WireGuard module; using wireguard-go."
|
|
else
|
|
fail environment "the runner has no WireGuard kernel module and wireguard-go could not be installed; the runner container needs NET_ADMIN and /dev/net/tun (see guides/vpn-wireguard.md)."
|
|
fi
|
|
}
|
|
|
|
tunnel_up() {
|
|
check_interface
|
|
local conf="$WG_DIR/$WG_INTERFACE.conf" rendered
|
|
# on failure the captured output is the ::error:: line, which must be shown
|
|
rendered="$(render_config)" || {
|
|
echo "$rendered"
|
|
exit 1
|
|
}
|
|
install_tools
|
|
choose_implementation
|
|
$SUDO install -d -m 700 "$WG_DIR"
|
|
(umask 077 && printf '%s\n' "$rendered" | $SUDO tee "$conf" >/dev/null)
|
|
$SUDO chmod 600 "$conf"
|
|
$SUDO "$WG_QUICK" up "$WG_INTERFACE" ||
|
|
fail connection "wg-quick could not bring $WG_INTERFACE up."
|
|
if [ -n "${WG_HEALTH_CHECK_HOST:-}" ]; then
|
|
"$WG_PING" -c 3 -W 5 "$WG_HEALTH_CHECK_HOST" >/dev/null 2>&1 ||
|
|
fail connection "health-check-host '$WG_HEALTH_CHECK_HOST' does not answer through the tunnel."
|
|
fi
|
|
echo "WireGuard interface $WG_INTERFACE is up."
|
|
}
|
|
|
|
tunnel_down() {
|
|
check_interface
|
|
local conf="$WG_DIR/$WG_INTERFACE.conf"
|
|
$SUDO "$WG_QUICK" down "$WG_INTERFACE" 2>/dev/null || echo "Interface $WG_INTERFACE was not up."
|
|
$SUDO rm -f "$conf"
|
|
echo "WireGuard interface $WG_INTERFACE is down."
|
|
}
|
|
|
|
main() {
|
|
set -uo pipefail
|
|
WG_INTERFACE="${WG_INTERFACE:-wg0}"
|
|
WG_KEEPALIVE="${WG_KEEPALIVE:-25}"
|
|
case "${1:-}" in
|
|
mask) mask_secrets ;;
|
|
up) tunnel_up ;;
|
|
down) tunnel_down ;;
|
|
*) fail configuration "unknown command '${1:-}'; use mask, up or down." ;;
|
|
esac
|
|
}
|
|
|
|
if [ "${BASH_SOURCE[0]}" = "$0" ]; then
|
|
main "$@"
|
|
fi
|