Add wireguard-sidecar

2026-09-26 17:18:50 -05:00
parent 82fad44e85
commit 615ba8bb86
8 changed files with 235 additions and 2 deletions
--- a/wireguard-sidecar/wg-convert-config.sh
+++ b/wireguard-sidecar/wg-convert-config.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+#
+# wg-convert-config — rewrite a WireGuard config's DNS= line as an equivalent
+# PostUp command, for containers where openresolv/resolvconf can't run.
+#
+# usage: wg-convert-config <wg0.conf> [out.conf]
+#        wg-convert-config <wg0.conf> -        # write to stdout
+#
+# With no output path, writes ./ctr<basename of input>.
+
+set -euo pipefail
+
+prog=${0##*/}
+
+usage() {
+    cat >&2 <<EOF
+usage: $prog <wg0.conf> [out.conf]
+
+Moves DNS= out of [Interface] and appends an equivalent PostUp that writes
+/etc/resolv.conf directly. Handles comma-separated addresses (v4 and v6) and
+treats non-IP values as search domains. Use - as out.conf for stdout.
+Defaults to ./ctr<input basename>.
+EOF
+    exit "${1:-2}"
+}
+
+case ${1:-} in
+    -h | --help) usage 0 ;;
+    "" | -*) usage ;;
+esac
+(($# <= 2)) || usage
+
+src=$1
+dst=${2:-ctr${src##*/}}
+
+[[ -r $src ]] || { printf '%s: cannot read %s\n' "$prog" "$src" >&2; exit 1; }
+if [[ $dst != - && -e $dst && $src -ef $dst ]]; then
+    printf '%s: refusing to overwrite the source file\n' "$prog" >&2
+    exit 1
+fi
+
+convert() {
+    awk '
+    BEGIN { q = "\047" }
+
+    function flushpend(   i) {
+        for (i = 1; i <= npend; i++) print pend[i]
+        npend = 0
+    }
+
+    function emit(   i, out) {
+        if (!nns && !nsd) return
+        out = "PostUp = printf " q "%s\\n" q
+        for (i = 1; i <= nns; i++) out = out " " q "nameserver " ns[i] q
+        if (nsd) {
+            out = out " " q "search"
+            for (i = 1; i <= nsd; i++) out = out " " sd[i]
+            out = out q
+        }
+        print out " > /etc/resolv.conf"
+        if (nns > 3)
+            printf("%s: %d nameservers emitted; glibc reads only the first 3\n",
+                   prog, nns) > "/dev/stderr"
+        nns = 0; nsd = 0
+    }
+
+    # Section header: close out the [Interface] block before leaving it.
+    /^[[:space:]]*\[/ {
+        if (iface) emit()
+        flushpend()
+        iface = (tolower($0) ~ /^[[:space:]]*\[interface\][[:space:]]*$/)
+        print
+        next
+    }
+
+    # DNS = a, b, c  (keys are case-insensitive, # starts a comment)
+    iface && tolower($0) ~ /^[[:space:]]*dns[[:space:]]*=/ {
+        s = $0
+        sub(/#.*/, "", s)
+        sub(/^[^=]*=/, "", s)
+        gsub(/,/, " ", s)
+        n = split(s, a, /[[:space:]]+/)
+        for (i = 1; i <= n; i++) {
+            if (a[i] == "") continue
+            if (a[i] ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/ ||
+                (a[i] ~ /:/ && a[i] ~ /^[0-9a-fA-F:.%]+$/))
+                ns[++nns] = a[i]
+            else
+                sd[++nsd] = a[i]
+        }
+        next
+    }
+
+    # Hold blank lines so the PostUp lands above them, not under [Peer].
+    iface && /^[[:space:]]*$/ { pend[++npend] = $0; next }
+
+    { flushpend(); print }
+
+    END { if (iface) emit(); flushpend() }
+    ' prog="$prog" "$src"
+}
+
+if [[ $dst == - ]]; then
+    convert
+else
+    tmp=$(mktemp -- "$dst.XXXXXX")
+    trap 'rm -f -- "$tmp"' EXIT
+    convert > "$tmp"
+    chmod --reference="$src" -- "$tmp" 2>/dev/null || chmod 600 -- "$tmp"
+    mv -- "$tmp" "$dst"
+    trap - EXIT
+    printf '%s: wrote %s\n' "$prog" "$dst" >&2
+fi