own wireguard

2026-05-05 21:02:00 +02:00
parent d96ea7ce29
commit 1180e9e1b0
7 changed files with 532 additions and 0 deletions
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+log() { echo "[$(date -Is)] $*"; }
+
+require_env() {
+  local name="$1"
+  if [[ -z "${!name:-}" ]]; then
+    >&2 echo "Missing required env var: $name"
+    exit 2
+  fi
+}
+
+pia_get_token() {
+  require_env PIA_USER
+  require_env PIA_PASS
+
+  local resp token
+  resp="$(curl -fsS --location --request POST \
+    'https://www.privateinternetaccess.com/api/client/v2/token' \
+    --form "username=${PIA_USER}" \
+    --form "password=${PIA_PASS}")"
+
+  token="$(jq -r '.token // empty' <<<"$resp")"
+  if [[ -z "$token" ]]; then
+    >&2 echo "Failed to authenticate to PIA (no token). Response:"
+    >&2 echo "$resp" | head -c 2000
+    exit 3
+  fi
+
+  echo "$token"
+}
+
+pia_serverlist_v4() {
+  curl -fsS 'https://serverlist.piaservers.net/vpninfo/servers/v4'
+}
+
+parse_regions() {
+  # Supports:
+  # - CSV: "nl_amsterdam,de_berlin"
+  # - JSON: '["nl_amsterdam","de_berlin"]'
+  local raw="${PIA_REGIONS:-}"
+  if [[ -z "$raw" ]]; then
+    >&2 echo "Missing required env var: PIA_REGIONS"
+    exit 2
+  fi
+
+  if [[ "$raw" =~ ^\[.*\]$ ]]; then
+    jq -r '.[]' <<<"$raw"
+    return
+  fi
+
+  tr ',' '\n' <<<"$raw" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | awk 'NF'
+}
+
+pia_pick_region_candidates() {
+  # Input: serverlist JSON via stdin
+  # Output: for each requested region id -> line "region_id|wg_ip|wg_cn"
+  local requested
+  requested="$(parse_regions | tr '\n' ' ')"
+
+  jq -r --arg requested "$requested" '
+    def wanted($id): ($requested | split(" ") | index($id)) != null;
+    .regions[]
+    | select(wanted(.id))
+    | . as $r
+    | ($r.servers.wg[0] // empty) as $wg
+    | select($wg != null)
+    | "\($r.id)|\($wg.ip)|\($wg.cn)"
+  '
+}
+
+pia_wireguard_add_key() {
+  # Args: WG_SERVER_IP WG_HOSTNAME PIA_TOKEN PUBKEY CA_CERT_PATH
+  local wg_ip="$1"
+  local wg_hostname="$2"
+  local token="$3"
+  local pubkey="$4"
+  local ca_cert="$5"
+
+  curl -fsS -G \
+    --connect-to "${wg_hostname}::${wg_ip}:" \
+    --cacert "$ca_cert" \
+    --data-urlencode "pt=${token}" \
+    --data-urlencode "pubkey=${pubkey}" \
+    "https://${wg_hostname}:1337/addKey"
+}
+
+pia_pf_get_signature() {
+  # Args: PF_GATEWAY PF_HOSTNAME PIA_TOKEN CA_CERT_PATH
+  local gateway="$1"
+  local hostname="$2"
+  local token="$3"
+  local ca_cert="$4"
+
+  curl -fsS -m 10 \
+    --connect-to "${hostname}::${gateway}:" \
+    --cacert "$ca_cert" \
+    -G --data-urlencode "token=${token}" \
+    "https://${hostname}:19999/getSignature"
+}
+
+pia_pf_bind_port() {
+  # Args: PF_GATEWAY PF_HOSTNAME PAYLOAD SIGNATURE CA_CERT_PATH
+  local gateway="$1"
+  local hostname="$2"
+  local payload="$3"
+  local signature="$4"
+  local ca_cert="$5"
+
+  curl -fsS -m 10 \
+    --connect-to "${hostname}::${gateway}:" \
+    --cacert "$ca_cert" \
+    -G \
+    --data-urlencode "payload=${payload}" \
+    --data-urlencode "signature=${signature}" \
+    "https://${hostname}:19999/bindPort"
+}
+