initial commit

.gitignore

@@ -0,0 +1,2 @@
+/local
+/data/awg0.conf

data/install.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/bash
+set -euo pipefail
+. data/vps.env
+export DEBIAN_FRONTEND=noninteractive
+apt-get install -y software-properties-common python3-launchpadlib gnupg2 linux-headers-$(uname -r)
+add-apt-repository -y ppa:amnezia/ppa
+apt-get install -y amneziawg amneziawg-tools iptables-persistent
+cat <<EOF >> /etc/sysctl.conf
+net.ipv4.ip_forward = 1
+net.ipv4.conf.all.forwarding = 1
+net.ipv6.conf.all.forwarding = 1
+EOF
+for v in "" 6; do
+    ip${v}tables -P FORWARD DROP
+    ip${v}tables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+    ip${v}tables -A FORWARD -i awg0 -j ACCEPT
+    ip${v}tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+done
+for route in tcp:25 tcp:80 tcp:443 udp:443; do
+    PROTO=${route%:*}
+    PORT=${route#*:}
+    iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -p $PROTO --dport $PORT -j DNAT --to-destination $DEST:$PORT
+    iptables -A FORWARD -d $DEST -p $PROTO --dport $PORT -j ACCEPT
+    ip6tables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -p $PROTO --dport $PORT -j DNAT --to-destination [$DEST6]:$PORT
+    ip6tables -A FORWARD -d $DEST6 -p $PROTO --dport $PORT -j ACCEPT
+done
+netfilter-persistent save
+mv data/awg0.conf /etc/amnezia/amneziawg
+systemctl enable awg-quick@awg0
+apt-get autoremove --purge -y
+apt-get clean
+echo Installed in $(($(date +%s)-$(cat start)))s
+rm -r *
+reboot
+exit

data/setup.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/bash
+set -euo pipefail
+cd /etc/ssh
+FILENAME="$(mktemp)"
+(echo PasswordAuthentication no; cat sshd_config) > "$FILENAME"
+mv "$FILENAME" sshd_config
+fallocate -l 1GiB /var/swapfile
+chmod 600 /var/swapfile
+mkswap /var/swapfile
+echo "/var/swapfile none swap defaults 0 0" >> /etc/fstab
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get dist-upgrade -y -o Dpkg::Options::="--force-confold"
+reboot
+exit

data/vps.env

@@ -0,0 +1,2 @@
+DEST=10.0.0.2
+DEST6=fc00::2

host.env

@@ -0,0 +1 @@
+SERVER=bogaledev.ru

pack.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/bash
+set -euo pipefail
+. host.env
+ssh-wait() {
+    until ssh "root@$SERVER" "$1" || [ $? -eq 1 ]; do sleep 1; done
+}
+ssh-wait "date +%s > start"
+tar -czf data.tar.gz data
+scp data.tar.gz "root@$SERVER:"
+rm data.tar.gz
+ssh-wait "tar --no-same-owner -xf data.tar.gz; ./data/setup.sh"
+ssh-wait "./data/install.sh"