Update image reference in vpn-proxy.json to use safebox/wireguard-proxy-client

Update .drone.yml and JSON configuration files for service adjustments
replaced safebox
2025-03-05 22:39:38 +01:00 · 2025-03-05 21:58:15 +01:00 · 2025-03-05 17:13:07 +01:00 · 2025-03-05 10:45:14 +00:00 · 2025-03-05 10:44:40 +00:00 · 2024-10-17 14:42:04 +02:00
8 changed files with 368 additions and 247 deletions
--- a/.drone.yml
+++ b/.drone.yml
@@ -0,0 +1,47 @@
+kind: pipeline
+type: kubernetes
+name: default
+
+node_selector:
+  physical-node: dev1
+
+trigger:
+  branch:
+    - master
+  event:
+    - push
+workspace:
+  path: /drone/src
+
+steps:
+  - name: build multiarch from dev
+    image: docker.io/owncloudci/drone-docker-buildx:4
+    privileged: true
+    settings:
+      cache-from: [ "registry.dev.format.hu/wireguard-proxy-client" ]
+      registry: registry.dev.format.hu
+      repo: registry.dev.format.hu/wireguard-proxy-client
+      tags: latest
+      dockerfile: Dockerfile
+      username:
+        from_secret: dev-hu-registry-username
+      password: 
+        from_secret: dev-hu-registry-password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+    
+  - name: pull image to dockerhub
+    image: docker.io/owncloudci/drone-docker-buildx:4
+    privileged: true
+    settings:
+      cache-from: [ "safebox/wireguard-proxy-client" ]
+      repo: safebox/wireguard-proxy-client
+      tags: latest
+      username:
+        from_secret: dockerhub-username
+      password: 
+        from_secret: dockerhub-password
+      platforms:
+        - linux/amd64
+        - linux/arm64
--- a/5
+++ b/5
@@ -1,10 +1,10 @@
 FROM alpine:latest

 RUN apk add --no-cache alpine-sdk rustup \
- && rustup-init -y --target x86_64-unknown-linux-musl --default-toolchain beta --profile minimal \
+ && rustup-init -y --default-toolchain beta --profile minimal \
 #&& curl https://sh.rustup.rs -sSf | sh -s -- -y  --default-host x86_64-unknown-linux-musl --profile minimal \
 && source ~/.cargo/env \
- && cargo install --target x86_64-unknown-linux-musl boringtun-cli
+ && cargo install boringtun-cli

 FROM alpine:latest

@@ -24,4 +24,5 @@ VOLUME ["/etc/wireguard"]

 ENV WG_QUICK_USERSPACE_IMPLEMENTATION=boringtun LOGNAME=nobody INTERFACE=wg0
 COPY set_gateway.sh /etc/wireguard/
+COPY persistentkeepalive.sh /etc/wireguard/
 ENTRYPOINT ["/sbin/tini", "--", "/bin/sh", "-c", "test -f \"/etc/wireguard/$INTERFACE.conf\" || ( umask 077 && printf '%s\\n' '[Interface]' 'Address = 10.8.0.1/24' 'PostUp = iptables --table nat --append POSTROUTING --jump MASQUERADE' 'PostDown = iptables --table nat --delete POSTROUTING --jump MASQUERADE' 'ListenPort = 51820' \"PrivateKey = $(wg genkey)\" | tee \"/etc/wireguard/$INTERFACE.conf\" ) && test -c /dev/net/tun || { mkdir -p /dev/net && mknod -m 666 /dev/net/tun c 10 200; } && exec wg-quick up \"$INTERFACE\"", "--"]
--- a/firewall-vpn-proxy-postrouting.json
+++ b/firewall-vpn-proxy-postrouting.json
@@ -1,70 +1,88 @@
 {
-	"main": {
-		"SERVICE_NAME": "firewalls",
-		"DOMAIN": "null" 
-	},
-	"containers": [
-		{ 
-			"IMAGE": "registry.format.hu/firewall",
-			"UPDATE": "true",
-			"NAME": "firewall",
-			"SCALE": "0",
-			"MEMORY": "64M",
-			"NETWORK": "host",
-			"VOLUMES": [
-				{
-				"SOURCE": "/proc/",
-				"DEST": "/proc/",
-				"TYPE": "rw"
-				},
-				{
-				"SOURCE": "/run/",
-				"DEST": "/run/",
-				"TYPE": "rw"
-				},
-				{
-				"SOURCE": "/etc/user/config/services",
-				"DEST": "/services",
-				"TYPE": "ro"
-				},
-				{
-                                 "SOURCE": "/var/run/docker.sock",
-                                 "DEST": "/var/run/docker.sock",
-                                 "TYPE": "rw"
-                                 },
-                                 {
-                                 "SOURCE": "/usr/bin/docker",
-                                 "DEST": "/usr/bin/docker",
-                                 "TYPE": "ro"
-                                 },
-        			 {     
-        			"SOURCE": "/etc/system/data/dns/hosts.local",
-        			"DEST": "/etc/dns/hosts.local", 
-        			"TYPE": "ro"
-        			 }
-				],
-			"PORTS": [ ],
-			"READYNESS": [
-			        {"tcp": ""},
-			        {"HTTP": ""},
-				{"EXEC": "/ready.sh"}
-				],
-                        "ENVS": [
-				{ "NSENTER": "true" },
-                                { "POSTROUTING": "true" },
-				{ "NAME": "NAME", "VALUE": "wireguardproxy" },
-                                { "TARGET": "smarthostloadbalancer" }, 
-				{ "TYPE": "tcp" },
-                                { "TARGET_PORT_1": "80" },
-                                { "TARGET_PORT_2": "443" },
-                                { "COMMENT": "client" }
-                                ], 
-			"EXTRA": "--privileged --rm",
-			"DEPEND": "null",
-			"START_ON_BOOT": "false",
-			"CMD": "null",
-			"PRE_START": "null",
-			"POST_START": "null"
-		}
-	]
+    "main": {
+        "SERVICE_NAME": "firewalls",
+        "DOMAIN": "null"
+    },
+    "containers": [
+        {
+            "IMAGE": "registry.format.hu/firewall",
+            "UPDATE": "true",
+            "NAME": "firewall",
+            "SCALE": "0",
+            "MEMORY": "64M",
+            "NETWORK": "host",
+            "VOLUMES": [
+                {
+                    "SOURCE": "/proc/",
+                    "DEST": "/proc/",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/run/",
+                    "DEST": "/run/",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/etc/user/config/services",
+                    "DEST": "/services",
+                    "TYPE": "ro"
+                },
+                {
+                    "SOURCE": "/var/run/docker.sock",
+                    "DEST": "/var/run/docker.sock",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/etc/system/data/dns/hosts.local",
+                    "DEST": "/etc/dns/hosts.local",
+                    "TYPE": "ro"
+                }
+            ],
+            "PORTS": [],
+            "READYNESS": [
+                {
+                    "tcp": ""
+                },
+                {
+                    "HTTP": ""
+                },
+                {
+                    "EXEC": "/ready.sh"
+                }
+            ],
+            "ENVS": [
+                {
+                    "NSENTER": "true"
+                },
+                {
+                    "POSTROUTING": "true"
+                },
+                {
+                    "NAME": "NAME",
+                    "VALUE": "wireguardproxy"
+                },
+                {
+                    "TARGET": "smarthostloadbalancer"
+                },
+                {
+                    "TYPE": "tcp"
+                },
+                {
+                    "TARGET_PORT_1": "80"
+                },
+                {
+                    "TARGET_PORT_2": "443"
+                },
+                {
+                    "COMMENT": "client"
+                }
+            ],
+            "EXTRA": "--privileged --rm",
+            "DEPEND": "null",
+            "START_ON_BOOT": "false",
+            "CMD": "null",
+            "PRE_START": "null",
+            "POST_START": "null"
+        }
+    ]
 }
--- a/firewall-vpn-proxy-prerouting.json
+++ b/firewall-vpn-proxy-prerouting.json
@@ -1,74 +1,100 @@
 {
-	"main": {
-		"SERVICE_NAME": "firewalls",
-		"DOMAIN": "null" 
-	},
-	"containers": [
-		{ 
-			"IMAGE": "registry.format.hu/firewall",
-			"UPDATE": "true",
-			"NAME": "wireguardfirewall",
-			"SCALE": "0",
-			"MEMORY": "64M",
-			"NETWORK": "host",
-			"VOLUMES": [
-				{
-				"SOURCE": "/proc/",
-				"DEST": "/proc/",
-				"TYPE": "rw"
-				},
-				{
-				"SOURCE": "/run/",
-				"DEST": "/run/",
-				"TYPE": "rw"
-				},
-				{
-				"SOURCE": "/etc/user/config/services",
-				"DEST": "/services",
-				"TYPE": "ro"
-				},
-				{
-                                 "SOURCE": "/var/run/docker.sock",
-                                 "DEST": "/var/run/docker.sock",
-                                 "TYPE": "rw"
-                                 },
-                                 {
-                                 "SOURCE": "/usr/bin/docker",
-                                 "DEST": "/usr/bin/docker",
-                                 "TYPE": "ro"
-                                 },
-        			 {     
-        			"SOURCE": "/etc/system/data/dns/hosts.local",
-        			"DEST": "/etc/dns/hosts.local", 
-        			"TYPE": "ro"
-        			 }
-				],
-			"PORTS": [ ],
-			"READYNESS": [
-			        {"tcp": ""},
-			        {"HTTP": ""},
-				{"EXEC": "/ready.sh"}
-				],
-                        "ENVS": [
-				{ "NSENTER": "true" },
-                                { "PREROUTING": "true" },
-				{ "SOURCE_IFACE": "wg0" },
-                                { "TARGET": "smarthostloadbalancer" },
-				{ "NAME": "NAME", "VALUE": "wireguardproxy" },
-				{ "TYPE": "tcp" },
-                                { "SOURCE_PORT_1": "80" },
-                                { "SOURCE_PORT_2": "443" },
-                                { "TARGET_PORT_1": "80" },
-                                { "TARGET_PORT_2": "443" },
-                                { "COMMENT": "client" }
-                                ], 
-			"ENV_FILES": [ "/etc/user/config/user.json" ],
-			"EXTRA": "--privileged --rm",
-			"DEPEND": "null",
-			"START_ON_BOOT": "false",
-			"CMD": "null",
-			"PRE_START": "null",
-			"POST_START": "null"
-		}
-	]
+    "main": {
+        "SERVICE_NAME": "firewalls",
+        "DOMAIN": "null"
+    },
+    "containers": [
+        {
+            "IMAGE": "registry.format.hu/firewall",
+            "UPDATE": "true",
+            "NAME": "wireguardfirewall",
+            "SCALE": "0",
+            "MEMORY": "64M",
+            "NETWORK": "host",
+            "VOLUMES": [
+                {
+                    "SOURCE": "/proc/",
+                    "DEST": "/proc/",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/run/",
+                    "DEST": "/run/",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/etc/user/config/services",
+                    "DEST": "/services",
+                    "TYPE": "ro"
+                },
+                {
+                    "SOURCE": "/var/run/docker.sock",
+                    "DEST": "/var/run/docker.sock",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/etc/system/data/dns/hosts.local",
+                    "DEST": "/etc/dns/hosts.local",
+                    "TYPE": "ro"
+                }
+            ],
+            "PORTS": [],
+            "READYNESS": [
+                {
+                    "tcp": ""
+                },
+                {
+                    "HTTP": ""
+                },
+                {
+                    "EXEC": "/ready.sh"
+                }
+            ],
+            "ENVS": [
+                {
+                    "NSENTER": "true"
+                },
+                {
+                    "PREROUTING": "true"
+                },
+                {
+                    "SOURCE_IFACE": "wg0"
+                },
+                {
+                    "TARGET": "smarthostloadbalancer"
+                },
+                {
+                    "NAME": "NAME",
+                    "VALUE": "wireguardproxy"
+                },
+                {
+                    "TYPE": "tcp"
+                },
+                {
+                    "SOURCE_PORT_1": "80"
+                },
+                {
+                    "SOURCE_PORT_2": "443"
+                },
+                {
+                    "TARGET_PORT_1": "80"
+                },
+                {
+                    "TARGET_PORT_2": "443"
+                },
+                {
+                    "COMMENT": "client"
+                }
+            ],
+            "ENV_FILES": [
+                "/etc/user/config/user.json"
+            ],
+            "EXTRA": "--privileged --rm",
+            "DEPEND": "null",
+            "START_ON_BOOT": "false",
+            "CMD": "null",
+            "PRE_START": "null",
+            "POST_START": "null"
+        }
+    ]
 }
--- a/firewall-vpn-smarthost-loadbalancer.json
+++ b/firewall-vpn-smarthost-loadbalancer.json
@@ -1,64 +1,79 @@
 {
-	"main": {
-		"SERVICE_NAME": "firewalls",
-		"DOMAIN": "null" 
-	},
-	"containers": [
-		{ 
-			"IMAGE": "registry.format.hu/firewall",
-			"UPDATE": "true",
-			"NAME": "firewall",
-			"MEMORY": "64M",
-			"NETWORK": "host",
-			"SCALE": "0",
-			"VOLUMES": [
-				{
-				"SOURCE": "/run/",
-				"DEST": "/run/",
-				"TYPE": "rw"
-				},
-				{
-				"SOURCE": "/etc/user/config/services",
-				"DEST": "/services",
-				"TYPE": "ro"
-				},
-				{
-                                "SOURCE": "/etc/system/data/dns/hosts.local", 
-                                "DEST": "/etc/dns/hosts.local",
-                                "TYPE": "ro"
-                                },
-				{
-                                 "SOURCE": "/var/run/docker.sock",
-                                 "DEST": "/var/run/docker.sock",
-                                 "TYPE": "rw"
-                                 },
-                                 {
-                                 "SOURCE": "/usr/bin/docker",
-                                 "DEST": "/usr/bin/docker",
-                                 "TYPE": "ro"
-                                 }
-				],
-			"PORTS": [ ],
-			"READYNESS": [
-			        {"tcp": ""},
-			        {"HTTP": ""},
-				{"EXEC": "/ready.sh"}
-				],
-                        "ENVS": [ 
-               			{ "CHAIN": "DOCKER-USER" },
-                                { "SOURCE": "proxyvpnclient" },
-                                { "TARGET": "smarthostloadbalancer" },
-                                { "TYPE": "tcp" },
-                                { "TARGET_PORT_1": "80" },
-                                { "TARGET_PORT_2": "443" },
-                                { "COMMENT": "vpn access smarthost loadbalancer" }
-                                ], 
-			"EXTRA": "--privileged --rm",
-			"DEPEND": "null",
-			"START_ON_BOOT": "false",
-			"CMD": "null",
-			"PRE_START": "null",
-			"POST_START": "null"
-		}
-	]
+    "main": {
+        "SERVICE_NAME": "firewalls",
+        "DOMAIN": "null"
+    },
+    "containers": [
+        {
+            "IMAGE": "registry.format.hu/firewall",
+            "UPDATE": "true",
+            "NAME": "firewall",
+            "MEMORY": "64M",
+            "NETWORK": "host",
+            "SCALE": "0",
+            "VOLUMES": [
+                {
+                    "SOURCE": "/run/",
+                    "DEST": "/run/",
+                    "TYPE": "rw"
+                },
+                {
+                    "SOURCE": "/etc/user/config/services",
+                    "DEST": "/services",
+                    "TYPE": "ro"
+                },
+                {
+                    "SOURCE": "/etc/system/data/dns/hosts.local",
+                    "DEST": "/etc/dns/hosts.local",
+                    "TYPE": "ro"
+                },
+                {
+                    "SOURCE": "/var/run/docker.sock",
+                    "DEST": "/var/run/docker.sock",
+                    "TYPE": "rw"
+                }
+            ],
+            "PORTS": [],
+            "READYNESS": [
+                {
+                    "tcp": ""
+                },
+                {
+                    "HTTP": ""
+                },
+                {
+                    "EXEC": "/ready.sh"
+                }
+            ],
+            "ENVS": [
+                {
+                    "CHAIN": "DOCKER-USER"
+                },
+                {
+                    "SOURCE": "wireguardproxy"
+                },
+                {
+                    "TARGET": "smarthostloadbalancer"
+                },
+                {
+                    "TYPE": "tcp"
+                },
+                {
+                    "TARGET_PORT_1": "80"
+                },
+                {
+                    "TARGET_PORT_2": "443"
+                },
+                {
+                    "COMMENT": "vpn access smarthost loadbalancer"
+                }
+            ],
+            "EXTRA": "--privileged --rm",
+            "DEPEND": "null",
+            "START_ON_BOOT": "false",
+            "CMD": "null",
+            "PRE_START": "null",
+            "POST_START": "null"
+        }
+    ]
 }
--- a/persistentkeepalive.sh
+++ b/persistentkeepalive.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+sleep 15;
+PERSISTENT_KEEP_ALIVE=$(cat /etc/wireguard/wg0.conf | grep PersistentKeepalive | awk '{print $3}');
+WG_SERVER_IP="$(cat /etc/wireguard/wg0.conf | grep Address | awk '{print $3}' | cut -d . -f1-3).1";
+ping -s 0 -I wg0 -i $PERSISTENT_KEEP_ALIVE $WG_SERVER_IP
--- a/set_gateway.sh
+++ b/set_gateway.sh
@@ -1,5 +1,7 @@
 #!/bin/sh

-ENDPOINT=$(cat /etc/wireguard/wg0.conf | grep Endpoint | awk '{print $3}' |cut -d ':' -f1)
+ENDPOINT=$(cat /etc/wireguard/wg0.conf | grep Endpoint | awk '{print $3}' |cut -d ':' -f1);
 IP_GATEWAY=$(route -n | grep 'UG[ \t]' | awk '{print $2}');
-route add -host $ENDPOINT gw $IP_GATEWAY
+route add -host $ENDPOINT gw $IP_GATEWAY;
+
+/etc/wireguard/persistentkeepalive.sh &
--- a/vpn-proxy.json
+++ b/vpn-proxy.json
@@ -1,39 +1,45 @@
 {
-	"main": {
-		"SERVICE_NAME": "wireguard-client",
-		"DOMAIN": "null" 
-	},
-	"containers": [
-		{ 
-			"IMAGE": "registry.format.hu/wireguard-client",
-			"UPDATE": "true",
-			"NAME": "wireguardproxy-client",
-			"MEMORY": "64M",
-			"SELECTOR": "proxyvpnclient",
-			"VOLUMES": [
-                                {   
-                                "SOURCE": "/etc/user/secret/vpn-proxy/wg0.conf",
-                                "DEST": "/etc/wireguard/wg0.conf",
-                                "TYPE": "ro"
-                                } 
-				],
-			"PORTS": [ ],
-			"READYNESS": [
-			        {"tcp": ""},
-			        {"HTTP": ""},
-				{"EXEC": "/ready.sh"}
-				],
-                        "ENVS":  "null",
-                        "EXTRA": "--privileged --cap-add=NET_ADMIN --device=/dev/net/tun --cap-add MKNOD --cap-add NET_RAW",
-                        "DEPEND": "null",
-                        "START_ON_BOOT": "true",
-                        "CMD": "null",			
-			"PRE_START": "null",
-			"POST_START": [ "firewall-vpn-smarthost-loadbalancer",
-					"firewall-vpn-proxy-postrouting",
-					"firewall-vpn-proxy-prerouting"
-					]
-		}
-	]
+    "main": {
+        "SERVICE_NAME": "wireguard-client",
+        "DOMAIN": "null"
+    },
+    "containers": [
+        {
+            "IMAGE": "safebox/wireguard-proxy-client",
+            "UPDATE": "true",
+            "NAME": "wireguardproxy-client",
+            "MEMORY": "64M",
+            "SELECTOR": "wireguardproxy",
+            "VOLUMES": [
+                {
+                    "SOURCE": "/etc/user/secret/vpn-proxy/wg0.conf",
+                    "DEST": "/etc/wireguard/wg0.conf",
+                    "TYPE": "ro"
+                }
+            ],
+            "PORTS": [],
+            "READYNESS": [
+                {
+                    "tcp": ""
+                },
+                {
+                    "HTTP": ""
+                },
+                {
+                    "EXEC": "/ready.sh"
+                }
+            ],
+            "ENVS": "null",
+            "EXTRA": "--restart unless-stopped --privileged --cap-add=NET_ADMIN --device=/dev/net/tun --cap-add MKNOD --cap-add NET_RAW",
+            "DEPEND": "null",
+            "START_ON_BOOT": "true",
+            "CMD": "null",
+            "PRE_START": "null",
+            "POST_START": [
+                "firewall-vpn-smarthost-loadbalancer",
+                "firewall-vpn-proxy-postrouting",
+                "firewall-vpn-proxy-prerouting"
+            ]
+        }
+    ]
 }
-
Author	SHA1	Message	Date
gyurix	70459a4533	Update image reference in vpn-proxy.json to use safebox/wireguard-proxy-client All checks were successful continuous-integration/drone/push Build is passing Details	2025-03-05 22:39:38 +01:00
gyurix	f44dd33f71	Update .drone.yml and JSON configuration files for service adjustments All checks were successful continuous-integration/drone/push Build is passing Details	2025-03-05 21:58:15 +01:00
gyurix	025b8c1bb4	replaced safebox All checks were successful continuous-integration/drone/push Build is passing Details	2025-03-05 17:13:07 +01:00
Gyorgy Berenyi	dc73bffa54	Update .drone.yml All checks were successful continuous-integration/drone/push Build is passing Details	2025-03-05 10:45:14 +00:00
Gyorgy Berenyi	d9f5e07a21	Add .drone.yml	2025-03-05 10:44:40 +00:00
Gyurix	0687287436	changed service file	2024-10-17 14:42:04 +02:00
Gyurix	2aafd3adb8	removed docker bin from firewall files	2024-10-13 15:03:35 +02:00
Gyurix	207311ddbe	prepared image to run under arm infra also	2024-09-10 13:56:07 +02:00
gyurix	3cc178f690	Added persistent keep alive script instead of built in wireguard ping process	2023-08-01 06:24:36 +00:00
gyurix	bd43aaea64	Merge branch 'master' of ssh://git.format.hu:20202/format/wireguard-proxy-client	2023-08-01 06:24:21 +00:00
gyurix	2d4fad9532	Added persistent keep alive script instead of built in wireguard ping process	2023-08-01 06:23:15 +00:00