mikeconrad/wireguard-terraform-digitalocean
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed typos in scripts

Browse Source
This commit is contained in:
Mike Conrad
2024-09-25 09:34:53 -04:00
parent cceeda2164
commit 2efbbbe48b
2 changed files with 32 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
main.tf
View File

@ -6,24 +6,14 @@ resource "digitalocean_ssh_key" "default" {
# Create a new Web Droplet in the nyc2 region
resource "digitalocean_droplet" "web" {
image = "ubuntu-22-04-x64"
name = "wireguard"
region = "nyc1"
size = "s-2vcpu-4gb"
ssh_keys = [digitalocean_ssh_key.default.fingerprint]
image = "ubuntu-22-04-x64"
name = "wireguard"
region = "nyc1"
size = "s-2vcpu-4gb"
ssh_keys = [digitalocean_ssh_key.default.fingerprint]
user_data = file("setup.sh")
connection {
host = digitalocean_droplet.web.ipv4_address
type = "ssh"
user = "root"
private_key = "${file("./tf-digitalocean")}"
}
provisioner "remote-exec" {
inline = [ "cat /root/wireguard-conf/client-config.conf" ]
}
}
output "droplet_output" {
value = digitalocean_droplet.web.ipv4_address
}
}

50
setup.sh
View File

@ -1,50 +1,55 @@
#!/bin/bash
apt update
#!/usr/bin/env sh
set -e
set -u
# Set the listen port used by Wireguard, this is the default so feel free to change it.
LISTENPORT=51820
CONFIG_DIR=/root/wireguard-conf
umask 077
mkdir -p $CONFIG_DIR/client
# Install wireguard
apt install -y wireguard
apt update && apt install -y wireguard
LISTENPORT=51820
umask 077
# Generate public and private key
mkdir /root/wireguard-conf
cd /root/wireguard-conf
# Generate public/private key for the "server".
wg genkey > $CONFIG_DIR/privatekey
wg pubkey < $CONFIG_DIR/privatekey > $CONFIG_DIR/publickey
wg genkey > privatekey
wg pubkey < privatekey > publickey
mkdir client
wg genkey > client/privatekey
wg pubkey < client/privatekey > client/publickey
# Generate public/private key for the "client"
wg genkey > $CONFIG_DIR/client/privatekey
wg pubkey < $CONFIG_DIR/client/privatekey > $CONFIG_DIR/client/publickey
# Generate server config
echo "[Interface]
Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = $LISTENPORT
PrivateKey = $(cat privatekey)
PrivateKey = $(cat $CONFIG_DIR/privatekey)
### Client mike-home
### Client config
[Peer]
PublicKey = $(cat client/publickey)
PublicKey = $(cat $CONFIG_DIR/client/publickey)
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128
" > /etc/wireguard/do.conf
wg-quick up do
# Generate client config. This will need to be copied to your machine.
echo "[Interface]
PrivateKey = $(cat client/privatekey)
PrivateKey = $(cat $CONFIG_DIR/client/privatekey)
Address = 10.66.66.2/32,fd42:42:42::2/128
DNS = 1.1.1.1,1.0.0.1
[Peer]
PublicKey = $(cat publickey)
PublicKey = $(cat $CONFIG_DIR/publickey)
Endpoint = $(curl icanhazip.com):$LISTENPORT
AllowedIPs = 0.0.0.0/0,::/0
" > client-config.conf
" > $CONFIG_DIR/client-config.conf
wg-quick up do
# Add iptables rules to forward internet traffic through this box
# We are assuming our Wireguard interface is called do and our
# primary public facing interface is called eth0.
iptables -I INPUT -p udp --dport 51820 -j ACCEPT
iptables -I FORWARD -i eth0 -o do -j ACCEPT
iptables -I FORWARD -i do -j ACCEPT
@ -56,6 +61,3 @@ ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo "net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1" >/etc/sysctl.d/wg.conf
sysctl --system
cat client-config.conf