Robert Syrnicki
e240f071d5
Some checks failed
Build control-plane image / build-image (push) Has been cancelled
Restructure the deployment model: instead of bundling and owning its own Traefik + wg-easy, the control-plane now plugs into a Traefik and wg-easy the operator already runs (as sibling containers, or otherwise reachable). This avoids duplicating infra self-hosters commonly already have, and sidesteps having to run a second ACME/DNS setup entirely — the operator's own Traefik already has a working cert resolver. - New control_plane/wgeasy_v15.py: a wg-easy v15 REST client, verified live against a real running container (auth model, route shapes, and the new per-client PresharedKey all differ materially from v14's API). Threaded the preshared key through to the box side (furtka/wireguard.py in the furtka repo) so v15's handshake actually completes. - GATEWAY_CERT_RESOLVER is now a real env var instead of a GATEWAY_MODE- derived hardcoded "le", so it can mirror whatever resolver name (if any) the operator's own Traefik already has configured. - Root docker-compose.yaml/ops/deploy.sh: control-plane only now. deploy.sh asks how the operator's Traefik reaches it (same docker network, joined via `docker network connect`, or a separate host) instead of prompting for DNS-01 providers and port remaps single-parallel mode needed. - single-parallel mode is retired outright — nothing needs it once furtka-gateway doesn't own a second Traefik/wg-easy to remap ports for. - The old bundled stack (own Traefik+wg-easy, HTTP-01) moves to examples/starter-stack/ as the documented zero-infra on-ramp. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R3jVwAqESRjPdW9P9nvfem
34 lines
1.1 KiB
Bash
Executable file
34 lines
1.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Set the two kernel sysctls wg-easy needs, directly on the VPS host.
|
|
#
|
|
# Why this can't just be docker-compose.yaml's `sysctls:` key: that key
|
|
# sets namespaced (per-network-namespace) sysctls inside a container's own
|
|
# network namespace. wg-easy runs with network_mode: host (see the comment
|
|
# on that service), which means it has no network namespace of its own —
|
|
# runc flatly refuses to start the container if `sysctls:` is set at all
|
|
# under host networking ("not allowed in host network namespace"),
|
|
# confirmed by actually trying it, not assumed. These have to be host-level
|
|
# settings instead.
|
|
#
|
|
# Run this once on the VPS, before `docker compose up -d`.
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "must be run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
CONF_FILE=/etc/sysctl.d/99-furtka-gateway.conf
|
|
|
|
cat > "$CONF_FILE" <<'EOF'
|
|
# Required by furtka-gateway's wg-easy service (network_mode: host) — see
|
|
# docker-compose.yaml and ops/host-sysctls.sh.
|
|
net.ipv4.ip_forward=1
|
|
net.ipv4.conf.all.src_valid_mark=1
|
|
EOF
|
|
|
|
sysctl --system >/dev/null
|
|
|
|
echo "Applied and persisted (via $CONF_FILE):"
|
|
sysctl net.ipv4.ip_forward net.ipv4.conf.all.src_valid_mark
|