From 6d8c93b54cb5d7c1928331351ce2a2c84c8d743c Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Sat, 1 Aug 2020 12:26:17 +0200 Subject: [PATCH] iHmm? Signed-off-by: Nico Schottelius --- viirb-2-configure-fully-after-upgrade.sh | 4 + viirb-setup-all.sh | 391 ----------------------- 2 files changed, 4 insertions(+), 391 deletions(-) delete mode 100755 viirb-setup-all.sh diff --git a/viirb-2-configure-fully-after-upgrade.sh b/viirb-2-configure-fully-after-upgrade.sh index 161b39d..f92a13c 100755 --- a/viirb-2-configure-fully-after-upgrade.sh +++ b/viirb-2-configure-fully-after-upgrade.sh @@ -63,7 +63,10 @@ uci delete dhcp.lan.leasetime # Do not announce ULA - we have GUA uci delete network.globals.ula_prefix +# This is configuring the dhcp IPv4 client uci set dhcp.lan=dhcp + +# Setup Router Advertisements uci set dhcp.lan.interface='lanv6' uci set dhcp.lan.ra='server' uci set dhcp.lan.dynamicdhcp='0' @@ -114,6 +117,7 @@ uci delete wireless.radio0.disabled # This is temporary - keeping it until the config process is through # Probably not needet - we can connect to the final IPv6 address! +# This code commented out == The address vanishes due to above reconfiguration # uci set network.lanv4temp=interface # uci set network.lanv4temp.proto='static' # uci set network.lanv4temp.ifname='br-lan' diff --git a/viirb-setup-all.sh b/viirb-setup-all.sh deleted file mode 100755 index 63286cb..0000000 --- a/viirb-setup-all.sh +++ /dev/null @@ -1,391 +0,0 @@ -#!/bin/sh -# 2020-06-13, Nico Schottelius -# See https://ungleich.ch/u/products/viirb-ipv6-box/ - -if [ $# -lt 4 ]; then - echo "$0 interface viirb-id your-dot-cdist [stages]" - echo " interface to add the config ip address to" - echo " viirb-id: number in decimal format" - echo " your-dot-cdist: path to YOUR ungleich-dot-cdist repo" - echo " owner-mail-reference: How to identify the owner" - echo " stages: define which stages to execute" - echo "" - echo " stage1: setup your host, check connection to VIIRB" - echo " stage2: flash latest openwrt onto the VIIRB" - echo " stage3: configure the vpn endpoint" - echo " stage4: configure the VIIRB with wireguard + settings" - echo " stage5: Verify VIIRB on VPN, cleanup VIIRB" - echo "" - echo "Example to configure viirb02:" - echo "$0 wlan0 2 ~/vcs/ungleich-dot-cdist 'Nico Schottelius, nico.schottelius@ungleich.ch, Ticket 2342'" - echo "$0 wlan0 2 ~/vcs/ungleich-dot-cdist 'Nico Schottelius, nico.schottelius@ungleich.ch, Ticket 2342' '1 3 4'" - exit 1 -fi - -echo "FIXME: missing IPv6 announcements on LAN" -echo "FIXME: DNS situation: upstream, non upstream, ungleich, how to resolve tunnel endpoint" - -set -x - -set -x -dev=$1; shift -id=$1; shift -dot_cdist=$1; shift -owner=$1; shift - -if [ $# -ge 1 ]; then - stages=$1; shift -else - stages="1 2 3 4 5" -fi - -hex_id=$(printf "%0.2x\n" "$id") -viirb_hostname=viirb${hex_id} - -prefix_base=2a0a:e5c1:3 -my_prefix=${prefix_base}${hex_id} -my_network=${my_prefix}::/48 - -my_wireguard_ip=${my_prefix}::42 -my_lan_ip=${my_prefix}:cafe::42 -my_wifi_ip=${my_prefix}:7ea::42 - -# openwrt -version=19.07.3 -filename=openwrt-${version}-ramips-mt76x8-vocore2-squashfs-sysupgrade.bin - -# root password -root_password=$(pwgen -1 32) - -# IP address for setting it up initially -viirb_ip=192.168.61.1 - -# wireguard -private_key=$(wg genkey) -public_key=$(echo $private_key | wg pubkey) - -vpn_endpoint_host=vpn-2a0ae5c1300.ungleich.ch -vpn_endpoint_pubkey=ft68G2RID7gZ6PXjFCSCOdJ9yspRg+tUw0YrNK9cTxE= - -# cdist -dot_cdist_files=${dot_cdist}/type/__ungleich_wireguard/files -peerfilename=${vpn_endpoint_host}.peer${hex_id} -peerfile=${dot_cdist_files}/${peerfilename} -vpnconfig=${dot_cdist_files}/${vpn_endpoint_host} - -################################################################################ -# Stage 1: test / connect to the new VIIRB -# -# We delete so that we can run idempotent -stage1() -{ - sudo ip addr del 192.168.61.2/24 dev "$dev" 2>/dev/null || true - sudo ip addr add 192.168.61.2/24 dev "$dev" - - # don't care about other/old known_host entries - ssh-keygen -R ${viirb_ip} - - ping -c2 ${viirb_ip} - if [ $? -ne 0 ]; then - echo "Cannot reach any VIIRB - exiting" - exit 1 - fi - - cat ~/.ssh/id_rsa.pub | ssh root@${viirb_ip} "cat > /etc/dropbear/authorized_keys" -} - - - -################################################################################ -# Get latest OpenWRT & flash it -stage2() -{ - # Don't re-download if we already have it - wget -c http://downloads.openwrt.org/releases/${version}/targets/ramips/mt76x8/${filename} - scp ${filename} root@${viirb_ip}:/tmp - ssh root@${viirb_ip} "sysupgrade /tmp/*.bin" - - # It still pings for some time - wait for the reboot to happen - echo "Waiting for VIIRB to disappear" - sleep 15 - - wait=0 - found="" - - while [ $wait -lt 180 ]; do - ping -c1 ${viirb_ip} >/dev/null - - if [ $? -eq 0 ]; then - found=yes - # wait for ssh to come up - sleep 10 - break - fi - - sleep 1 - wait=$((wait+1)) - done - - if [ ! "$found" ]; then - echo "Did not find updated viirb - debug / restart it" - exit 1 - fi - -} - - -################################################################################ -# Stage 3: prepare VPN endpoint -# - -stage3() -{ - - # Configure VPN server / update cdist - echo Updating VPNserver - cat < ${peerfile} -# ${viirb_hostname} ${owner} -[Peer] -PublicKey = ${public_key} -AllowedIPs = ${my_network} - -EOF - - # Generate real config - cat ${dot_cdist_files}/${vpn_endpoint_host}.* > ${vpnconfig} - cd ${dot_cdist_files} - git add ${vpn_endpoint_host} ${peerfilename} - git commit -m "[vpn] Updated config for peer ${viirb_hostname} ${my_network}" - git pull - git push - - cdist config -vv -j8 ${vpn_endpoint_host} -c ${dot_cdist} -} - -################################################################################ -# Stage 4: configure the VIIRB -# -stage4() -{ - - cat </dev/null - - if [ $? -eq 0 ]; then - found=yes - break - fi - sleep 1 - wait=$((wait+1)) - done - - if [ ! "$found" ]; then - echo "Cannot reach VIIRB via VPN - check manually" - exit 1 - fi - - echo "Cleanup process." - echo "Set the root password when prompted to: ${root_password}" - - # VPN works, remove artefacts, set correct DNS servers that support DNS64 - cat <