|
|
|
@@ -1,42 +1,42 @@ |
|
|
|
#!/bin/bash |
|
|
|
vpn_provider="$(echo $OPENVPN_PROVIDER | tr '[A-Z]' '[a-z]')" |
|
|
|
vpn_provider_configs="/etc/openvpn/$vpn_provider" |
|
|
|
if [ ! -d "$vpn_provider_configs" ]; then |
|
|
|
echo "Could not find OpenVPN provider: $OPENVPN_PROVIDER" |
|
|
|
echo "Please check your settings." |
|
|
|
exit 1 |
|
|
|
VPN_PROVIDER="${OPENVPN_PROVIDER,,}" |
|
|
|
VPN_PROVIDER_CONFIGS="/etc/openvpn/${VPN_PROVIDER}" |
|
|
|
|
|
|
|
if [[ "${OPENVPN_PROVIDER}" == "**None**" ]] || [[ -z "${OPENVPN_PROVIDER-}" ]]; then |
|
|
|
echo "OpenVPN provider not set. Exiting." |
|
|
|
exit 1 |
|
|
|
elif [[ ! -d "${VPN_PROVIDER_CONFIGS}" ]]; then |
|
|
|
echo "Could not find OpenVPN provider: ${OPENVPN_PROVIDER}" |
|
|
|
echo "Please check your settings." |
|
|
|
exit 1 |
|
|
|
fi |
|
|
|
|
|
|
|
echo "Using OpenVPN provider: $OPENVPN_PROVIDER" |
|
|
|
|
|
|
|
if [ ! -z "$OPENVPN_CONFIG" ] |
|
|
|
then |
|
|
|
n=$(echo "$OPENVPN_CONFIG" | wc -w) |
|
|
|
if [ $n -gt 1 ] |
|
|
|
then |
|
|
|
rnd=$((RANDOM%n+1)) |
|
|
|
srv=$(echo "$OPENVPN_CONFIG" | awk -vrnd=$rnd '{print $rnd}') |
|
|
|
echo "$n servers found in OPENVPN_CONFIG, $srv chosen randomly" |
|
|
|
OPENVPN_CONFIG=$srv |
|
|
|
fi |
|
|
|
|
|
|
|
if [ -f $vpn_provider_configs/"${OPENVPN_CONFIG}".ovpn ] |
|
|
|
then |
|
|
|
echo "Starting OpenVPN using config ${OPENVPN_CONFIG}.ovpn" |
|
|
|
OPENVPN_CONFIG=$vpn_provider_configs/${OPENVPN_CONFIG}.ovpn |
|
|
|
else |
|
|
|
echo "Supplied config ${OPENVPN_CONFIG}.ovpn could not be found." |
|
|
|
echo "Using default OpenVPN gateway for provider ${vpn_provider}" |
|
|
|
OPENVPN_CONFIG=$vpn_provider_configs/default.ovpn |
|
|
|
fi |
|
|
|
echo "Using OpenVPN provider: ${OPENVPN_PROVIDER}" |
|
|
|
|
|
|
|
if [[ -n "${OPENVPN_CONFIG-}" ]]; then |
|
|
|
readarray -t OPENVPN_CONFIG_ARRAY <<< "${OPENVPN_CONFIG//,/$'\n'}" |
|
|
|
if (( ${#OPENVPN_CONFIG_ARRAY[@]} > 1 )); then |
|
|
|
OPENVPN_CONFIG_RANDOM=$((RANDOM%${#OPENVPN_CONFIG_ARRAY[@]})) |
|
|
|
echo "${#OPENVPN_CONFIG_ARRAY[@]} servers found in OPENVPN_CONFIG, ${OPENVPN_CONFIG_ARRAY[${OPENVPN_CONFIG_RANDOM}]} chosen randomly" |
|
|
|
OPENVPN_CONFIG="${OPENVPN_CONFIG_ARRAY[${OPENVPN_CONFIG_RANDOM}]}" |
|
|
|
fi |
|
|
|
|
|
|
|
if [[ -f "${VPN_PROVIDER_CONFIGS}/${OPENVPN_CONFIG}".ovpn ]]; then |
|
|
|
echo "Starting OpenVPN using config ${OPENVPN_CONFIG}.ovpn" |
|
|
|
OPENVPN_CONFIG="${VPN_PROVIDER_CONFIGS}/${OPENVPN_CONFIG}.ovpn" |
|
|
|
else |
|
|
|
echo "Supplied config ${OPENVPN_CONFIG}.ovpn could not be found." |
|
|
|
echo "Using default OpenVPN gateway for provider ${VPN_PROVIDER}" |
|
|
|
OPENVPN_CONFIG="${VPN_PROVIDER_CONFIGS}/default.ovpn" |
|
|
|
fi |
|
|
|
else |
|
|
|
echo "No VPN configuration provided. Using default." |
|
|
|
OPENVPN_CONFIG=$vpn_provider_configs/default.ovpn |
|
|
|
echo "No VPN configuration provided. Using default." |
|
|
|
OPENVPN_CONFIG="${VPN_PROVIDER_CONFIGS}/default.ovpn" |
|
|
|
fi |
|
|
|
|
|
|
|
# add OpenVPN user/pass |
|
|
|
if [ "${OPENVPN_USERNAME}" = "**None**" ] || [ "${OPENVPN_PASSWORD}" = "**None**" ] ; then |
|
|
|
if [ ! -f /config/openvpn-credentials.txt ] ; then |
|
|
|
if [[ "${OPENVPN_USERNAME}" == "**None**" ]] || [[ "${OPENVPN_PASSWORD}" == "**None**" ]] ; then |
|
|
|
if [[ ! -f /config/openvpn-credentials.txt ]] ; then |
|
|
|
echo "OpenVPN credentials not set. Exiting." |
|
|
|
exit 1 |
|
|
|
fi |
|
|
|
@@ -44,67 +44,97 @@ if [ "${OPENVPN_USERNAME}" = "**None**" ] || [ "${OPENVPN_PASSWORD}" = "**None** |
|
|
|
else |
|
|
|
echo "Setting OPENVPN credentials..." |
|
|
|
mkdir -p /config |
|
|
|
echo $OPENVPN_USERNAME > /config/openvpn-credentials.txt |
|
|
|
echo $OPENVPN_PASSWORD >> /config/openvpn-credentials.txt |
|
|
|
echo "${OPENVPN_USERNAME}" > /config/openvpn-credentials.txt |
|
|
|
echo "${OPENVPN_PASSWORD}" >> /config/openvpn-credentials.txt |
|
|
|
chmod 600 /config/openvpn-credentials.txt |
|
|
|
fi |
|
|
|
|
|
|
|
# add transmission credentials from env vars |
|
|
|
echo $TRANSMISSION_RPC_USERNAME > /config/transmission-credentials.txt |
|
|
|
echo $TRANSMISSION_RPC_PASSWORD >> /config/transmission-credentials.txt |
|
|
|
echo "${TRANSMISSION_RPC_USERNAME}" > /config/transmission-credentials.txt |
|
|
|
echo "${TRANSMISSION_RPC_PASSWORD}" >> /config/transmission-credentials.txt |
|
|
|
|
|
|
|
# Persist transmission settings for use by transmission-daemon |
|
|
|
dockerize -template /etc/transmission/environment-variables.tmpl:/etc/transmission/environment-variables.sh |
|
|
|
|
|
|
|
TRANSMISSION_CONTROL_OPTS="--script-security 2 --up-delay --up /etc/openvpn/tunnelUp.sh --down /etc/openvpn/tunnelDown.sh" |
|
|
|
|
|
|
|
if [ "true" = "$ENABLE_UFW" ]; then |
|
|
|
## If we use UFW or the LOCAL_NETWORK we need to grab network config info |
|
|
|
if [[ "${ENABLE_UFW,,}" == "true" ]] || [[ -n "${LOCAL_NETWORK-}" ]]; then |
|
|
|
eval $(/sbin/ip r l m 0.0.0.0 | awk '{if($5!="tun0"){print "GW="$3"\nINT="$5; exit}}') |
|
|
|
## IF we use UFW_ALLOW_GW_NET along with ENABLE_UFW we need to know what our netmask CIDR is |
|
|
|
if [[ "${ENABLE_UFW,,}" == "true" ]] && [[ "${UFW_ALLOW_GW_NET,,}" == "true" ]]; then |
|
|
|
eval $(ip r l dev ${INT} | awk '{if($5=="link"){print "GW_CIDR="$1; exit}}') |
|
|
|
fi |
|
|
|
fi |
|
|
|
|
|
|
|
## Open port to any address |
|
|
|
function ufwAllowPort { |
|
|
|
typeset -n portNum=${1} |
|
|
|
if [[ "${ENABLE_UFW,,}" == "true" ]] && [[ -n "${portNum-}" ]]; then |
|
|
|
echo "allowing ${portNum} through the firewall" |
|
|
|
ufw allow ${portNum} |
|
|
|
fi |
|
|
|
} |
|
|
|
|
|
|
|
## Open port to specific address. |
|
|
|
function ufwAllowPortLong { |
|
|
|
typeset -n portNum=${1} sourceAddress=${2} |
|
|
|
|
|
|
|
if [[ "${ENABLE_UFW,,}" == "true" ]] && [[ -n "${portNum-}" ]] && [[ -n "${sourceAddress-}" ]]; then |
|
|
|
echo "allowing ${sourceAddress} through the firewall to port ${portNum}" |
|
|
|
ufw allow from ${sourceAddress} to any port ${portNum} |
|
|
|
fi |
|
|
|
} |
|
|
|
|
|
|
|
if [[ "${ENABLE_UFW,,}" == "true" ]]; then |
|
|
|
# Enable firewall |
|
|
|
echo "enabling firewall" |
|
|
|
sed -i -e s/IPV6=yes/IPV6=no/ /etc/default/ufw |
|
|
|
ufw enable |
|
|
|
|
|
|
|
if [ "true" = "$TRANSMISSION_PEER_PORT_RANDOM_ON_START" ]; then |
|
|
|
PEER_PORT="$TRANSMISSION_PEER_PORT_RANDOM_LOW:$TRANSMISSION_PEER_PORT_RANDOM_HIGH/tcp" |
|
|
|
if [[ "${TRANSMISSION_PEER_PORT_RANDOM_ON_START,,}" == "true" ]]; then |
|
|
|
PEER_PORT="${TRANSMISSION_PEER_PORT_RANDOM_LOW}:${TRANSMISSION_PEER_PORT_RANDOM_HIGH}" |
|
|
|
else |
|
|
|
PEER_PORT=$TRANSMISSION_PEER_PORT |
|
|
|
PEER_PORT="${TRANSMISSION_PEER_PORT}" |
|
|
|
fi |
|
|
|
|
|
|
|
echo "allowing $PEER_PORT through the firewall" |
|
|
|
ufw allow $PEER_PORT |
|
|
|
ufwAllowPort PEER_PORT |
|
|
|
|
|
|
|
if [ "true" = "$WEBPROXY_ENABLED" ]; then |
|
|
|
echo "allowing $WEBPROXY_PORT through the firewall" |
|
|
|
ufw allow $WEBPROXY_PORT |
|
|
|
if [[ "${WEBPROXY_ENABLED,,}" == "true" ]]; then |
|
|
|
ufwAllowPort WEBPROXY_PORT |
|
|
|
fi |
|
|
|
if [[ "${UFW_ALLOW_GW_NET,,}" == "true" ]]; then |
|
|
|
ufwAllowPortLong TRANSMISSION_RPC_PORT GW_CIDR |
|
|
|
else |
|
|
|
ufwAllowPortLong TRANSMISSION_RPC_PORT GW |
|
|
|
fi |
|
|
|
|
|
|
|
eval $(/sbin/ip r l m 0.0.0.0 | awk '{if($5!="tun0"){print "GW="$3"\nINT="$5; exit}}') |
|
|
|
echo "allowing access to $TRANSMISSION_RPC_PORT from $GW" |
|
|
|
ufw allow proto tcp from $GW to any port $TRANSMISSION_RPC_PORT |
|
|
|
if [ ! -z "${UFW_EXTRA_PORTS}" ]; then |
|
|
|
if [[ -n "${UFW_EXTRA_PORTS-}" ]]; then |
|
|
|
for port in ${UFW_EXTRA_PORTS//,/ }; do |
|
|
|
echo "allowing access to ${port} from $GW" |
|
|
|
ufw allow proto tcp from $GW to any port ${port} |
|
|
|
if [[ "${UFW_ALLOW_GW_NET,,}" == "true" ]]; then |
|
|
|
ufwAllowPortLong port GW_CIDR |
|
|
|
else |
|
|
|
ufwAllowPortLong port GW |
|
|
|
fi |
|
|
|
done |
|
|
|
fi |
|
|
|
fi |
|
|
|
|
|
|
|
if [ -n "${LOCAL_NETWORK-}" ]; then |
|
|
|
eval $(/sbin/ip r l m 0.0.0.0 | awk '{if($5!="tun0"){print "GW="$3"\nINT="$5; exit}}') |
|
|
|
if [ -n "${GW-}" -a -n "${INT-}" ]; then |
|
|
|
echo "adding route to local network $LOCAL_NETWORK via $GW dev $INT" |
|
|
|
/sbin/ip r a "$LOCAL_NETWORK" via "$GW" dev "$INT" |
|
|
|
if [ "true" = "$ENABLE_UFW" ]; then |
|
|
|
echo "allowing access to $TRANSMISSION_RPC_PORT from $LOCAL_NETWORK" |
|
|
|
ufw allow proto tcp from $LOCAL_NETWORK to any port $TRANSMISSION_RPC_PORT |
|
|
|
if [ ! -z "${UFW_EXTRA_PORTS}" ]; then |
|
|
|
for port in ${UFW_EXTRA_PORTS//,/ }; do |
|
|
|
echo "allowing access to ${port} from $LOCAL_NETWORK" |
|
|
|
ufw allow proto tcp from $LOCAL_NETWORK to any port ${port} |
|
|
|
done |
|
|
|
if [[ -n "${LOCAL_NETWORK-}" ]]; then |
|
|
|
if [[ -n "${GW-}" ]] && [[ -n "${INT-}" ]]; then |
|
|
|
for localNet in ${LOCAL_NETWORK//,/ }; do |
|
|
|
echo "adding route to local network ${localNet} via ${GW} dev ${INT}" |
|
|
|
/sbin/ip r a "${localNet}" via "${GW}" dev "${INT}" |
|
|
|
if [[ "${ENABLE_UFW,,}" == "true" ]]; then |
|
|
|
ufwAllowPortLong TRANSMISSION_RPC_PORT localNet |
|
|
|
if [[ -n "${UFW_EXTRA_PORTS-}" ]]; then |
|
|
|
for port in ${UFW_EXTRA_PORTS//,/ }; do |
|
|
|
ufwAllowPortLong port localNet |
|
|
|
done |
|
|
|
fi |
|
|
|
fi |
|
|
|
fi |
|
|
|
done |
|
|
|
fi |
|
|
|
fi |
|
|
|
|
|
|
|
exec openvpn $TRANSMISSION_CONTROL_OPTS $OPENVPN_OPTS --config "$OPENVPN_CONFIG" |
|
|
|
exec openvpn ${TRANSMISSION_CONTROL_OPTS} ${OPENVPN_OPTS} --config "${OPENVPN_CONFIG}" |
Kristian Haugene
6 years ago