mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 19:14:02 +01:00
Krzysztof kuhy Rudnicki
0aa78ea7aa
transcribe.sh 473 -> 39, setup_activitywatch.sh 457 -> 102 and setup_wireguard_ssh.sh 464 -> 136. enforce_vbox_hosts.sh is reverted: its seam landed inside a heredoc and the resulting lib had an unterminated here-document. That is the worst failure yet, because shellcheck reported it only as SC1094 on the caller - which reads like a nicety, not a file that will not parse. The verifier now runs bash -n over every lib before linting the entry and names the offending file; proven by corrupting a copy and restoring it. Also guarded a cd before `git clone ... .`, which would otherwise have cloned an AUR repo into the caller's directory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
43 lines
1.2 KiB
Bash
Executable File
43 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Key generation and the WireGuard service.
|
|
#
|
|
# Sourced by setup_wireguard_ssh.sh; split out to keep it under the 250-line
|
|
# cap. Sourced rather than run, so it inherits the caller's strict mode
|
|
# and the variables defined above the source line.
|
|
|
|
generate_server_keys() {
|
|
ensure_dir "$WG_DIR"
|
|
chmod 700 "$WG_DIR"
|
|
if [[ -f "${WG_DIR}/server_private.key" ]]; then
|
|
log_info "Server keypair already exists -- not rotating (would break existing peer configs)."
|
|
return 0
|
|
fi
|
|
umask 077
|
|
wg genkey | tee "${WG_DIR}/server_private.key" | wg pubkey >"${WG_DIR}/server_public.key"
|
|
log_ok "Generated server keypair."
|
|
}
|
|
|
|
write_wg0_conf() {
|
|
if [[ -f $WG_CONF ]]; then
|
|
log_info "${WG_CONF} already exists -- leaving peers intact, not regenerating."
|
|
return 0
|
|
fi
|
|
local server_private_key
|
|
server_private_key=$(<"${WG_DIR}/server_private.key")
|
|
umask 077
|
|
cat >"$WG_CONF" <<EOF
|
|
[Interface]
|
|
Address = ${WG_SERVER_IP}/24
|
|
ListenPort = ${WG_PORT}
|
|
PrivateKey = ${server_private_key}
|
|
# No PostUp/PostDown NAT: this is a host-only tunnel, not a routed VPN.
|
|
EOF
|
|
chmod 600 "$WG_CONF"
|
|
log_ok "Wrote ${WG_CONF}."
|
|
}
|
|
|
|
enable_wg_service() {
|
|
enable_service "wg-quick@${WG_IFACE}"
|
|
log_ok "wg-quick@${WG_IFACE} enabled and started."
|
|
}
|