120 lines
2.8 KiB
Bash
120 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
log() { echo "[$(date -Is)] $*"; }
|
|
|
|
require_env() {
|
|
local name="$1"
|
|
if [[ -z "${!name:-}" ]]; then
|
|
>&2 echo "Missing required env var: $name"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
pia_get_token() {
|
|
require_env PIA_USER
|
|
require_env PIA_PASS
|
|
|
|
local resp token
|
|
resp="$(curl -fsS --location --request POST \
|
|
'https://www.privateinternetaccess.com/api/client/v2/token' \
|
|
--form "username=${PIA_USER}" \
|
|
--form "password=${PIA_PASS}")"
|
|
|
|
token="$(jq -r '.token // empty' <<<"$resp")"
|
|
if [[ -z "$token" ]]; then
|
|
>&2 echo "Failed to authenticate to PIA (no token). Response:"
|
|
>&2 echo "$resp" | head -c 2000
|
|
exit 3
|
|
fi
|
|
|
|
echo "$token"
|
|
}
|
|
|
|
pia_serverlist_v4() {
|
|
curl -fsS 'https://serverlist.piaservers.net/vpninfo/servers/v4'
|
|
}
|
|
|
|
parse_regions() {
|
|
# Supports:
|
|
# - CSV: "nl_amsterdam,de_berlin"
|
|
# - JSON: '["nl_amsterdam","de_berlin"]'
|
|
local raw="${PIA_REGIONS:-}"
|
|
if [[ -z "$raw" ]]; then
|
|
>&2 echo "Missing required env var: PIA_REGIONS"
|
|
exit 2
|
|
fi
|
|
|
|
if [[ "$raw" =~ ^\[.*\]$ ]]; then
|
|
jq -r '.[]' <<<"$raw"
|
|
return
|
|
fi
|
|
|
|
tr ',' '\n' <<<"$raw" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | awk 'NF'
|
|
}
|
|
|
|
pia_pick_region_candidates() {
|
|
# Input: serverlist JSON via stdin
|
|
# Output: for each requested region id -> line "region_id|wg_ip|wg_cn"
|
|
local requested
|
|
requested="$(parse_regions | tr '\n' ' ')"
|
|
|
|
jq -r --arg requested "$requested" '
|
|
def wanted($id): ($requested | split(" ") | index($id)) != null;
|
|
.regions[]
|
|
| select(wanted(.id))
|
|
| . as $r
|
|
| ($r.servers.wg[0] // empty) as $wg
|
|
| select($wg != null)
|
|
| "\($r.id)|\($wg.ip)|\($wg.cn)"
|
|
'
|
|
}
|
|
|
|
pia_wireguard_add_key() {
|
|
# Args: WG_SERVER_IP WG_HOSTNAME PIA_TOKEN PUBKEY CA_CERT_PATH
|
|
local wg_ip="$1"
|
|
local wg_hostname="$2"
|
|
local token="$3"
|
|
local pubkey="$4"
|
|
local ca_cert="$5"
|
|
|
|
curl -fsS -G \
|
|
--connect-to "${wg_hostname}::${wg_ip}:" \
|
|
--cacert "$ca_cert" \
|
|
--data-urlencode "pt=${token}" \
|
|
--data-urlencode "pubkey=${pubkey}" \
|
|
"https://${wg_hostname}:1337/addKey"
|
|
}
|
|
|
|
pia_pf_get_signature() {
|
|
# Args: PF_GATEWAY PF_HOSTNAME PIA_TOKEN CA_CERT_PATH
|
|
local gateway="$1"
|
|
local hostname="$2"
|
|
local token="$3"
|
|
local ca_cert="$4"
|
|
|
|
curl -fsS -m 10 \
|
|
--connect-to "${hostname}::${gateway}:" \
|
|
--cacert "$ca_cert" \
|
|
-G --data-urlencode "token=${token}" \
|
|
"https://${hostname}:19999/getSignature"
|
|
}
|
|
|
|
pia_pf_bind_port() {
|
|
# Args: PF_GATEWAY PF_HOSTNAME PAYLOAD SIGNATURE CA_CERT_PATH
|
|
local gateway="$1"
|
|
local hostname="$2"
|
|
local payload="$3"
|
|
local signature="$4"
|
|
local ca_cert="$5"
|
|
|
|
curl -fsS -m 10 \
|
|
--connect-to "${hostname}::${gateway}:" \
|
|
--cacert "$ca_cert" \
|
|
-G \
|
|
--data-urlencode "payload=${payload}" \
|
|
--data-urlencode "signature=${signature}" \
|
|
"https://${hostname}:19999/bindPort"
|
|
}
|
|
|