35 lines
1.1 KiB
Bash
35 lines
1.1 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Set the two kernel sysctls wg-easy needs, directly on the VPS host.
|
||
|
|
#
|
||
|
|
# Why this can't just be docker-compose.yaml's `sysctls:` key: that key
|
||
|
|
# sets namespaced (per-network-namespace) sysctls inside a container's own
|
||
|
|
# network namespace. wg-easy runs with network_mode: host (see the comment
|
||
|
|
# on that service), which means it has no network namespace of its own —
|
||
|
|
# runc flatly refuses to start the container if `sysctls:` is set at all
|
||
|
|
# under host networking ("not allowed in host network namespace"),
|
||
|
|
# confirmed by actually trying it, not assumed. These have to be host-level
|
||
|
|
# settings instead.
|
||
|
|
#
|
||
|
|
# Run this once on the VPS, before `docker compose up -d`.
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
if [[ $EUID -ne 0 ]]; then
|
||
|
|
echo "must be run as root" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
CONF_FILE=/etc/sysctl.d/99-furtka-gateway.conf
|
||
|
|
|
||
|
|
cat > "$CONF_FILE" <<'EOF'
|
||
|
|
# Required by furtka-gateway's wg-easy service (network_mode: host) — see
|
||
|
|
# docker-compose.yaml and ops/host-sysctls.sh.
|
||
|
|
net.ipv4.ip_forward=1
|
||
|
|
net.ipv4.conf.all.src_valid_mark=1
|
||
|
|
EOF
|
||
|
|
|
||
|
|
sysctl --system >/dev/null
|
||
|
|
|
||
|
|
echo "Applied and persisted (via $CONF_FILE):"
|
||
|
|
sysctl net.ipv4.ip_forward net.ipv4.conf.all.src_valid_mark
|