spb/cluster-skill

1#!/bin/bash2# wg-forward-setup.sh — expose sur l'IP WireGuard du Mac des services qui n'écoutent que sur 127.0.0.13# (ex. spbgit :7420, api-ka :8000) sans toucher aux apps : un relais socat par port, en LaunchDaemon.4# Usage : bash wg-forward-setup.sh <ip-wg> <mot-de-passe-sudo> <port> [<port>…]5set -euo pipefail6WGIP=${1:?ip wg}; PW=${2:?sudo}; shift 2; PORTS=("$@"); [ ${#PORTS[@]} -gt 0 ] || { echo "ports ?"; exit 1; }7sudo_(){ echo "$PW" | sudo -S -p '' "$@"; }8export PATH=/opt/homebrew/bin:/opt/homebrew/sbin:$PATH9[ -x /opt/homebrew/bin/socat ] || HOMEBREW_NO_AUTO_UPDATE=1 brew install -q socat >/dev/null 2>&1 || HOMEBREW_NO_AUTO_UPDATE=1 brew install socat10CONF=/opt/homebrew/etc/maclustr-wgfwd.conf11T=$(mktemp); { [ -f "$CONF" ] && cat "$CONF"; for p in "${PORTS[@]}"; do echo "$WGIP $p"; done; } | sort -u > "$T"12sudo_ install -m 644 -o root "$T" "$CONF"; rm -f "$T"13TMPP=$(mktemp)14cat > "$TMPP" <<'PLIST'15<?xml version="1.0" encoding="UTF-8"?>16<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">17<plist version="1.0"><dict>18  <key>Label</key><string>io.maclustr.wgfwd</string>19  <key>ProgramArguments</key><array>20    <string>/bin/bash</string><string>-c</string>21    <string>export PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin; pids=""; while read -r ip port; do [ -z "$ip" ] && continue; ( while true; do /opt/homebrew/bin/socat -T 3600 TCP-LISTEN:$port,bind=$ip,fork,reuseaddr TCP:127.0.0.1:$port 2>>/var/log/maclustr-wgfwd.log; sleep 5; done ) &amp; pids="$pids $!"; done &lt; /opt/homebrew/etc/maclustr-wgfwd.conf; wait</string>22  </array>23  <key>RunAtLoad</key><true/>24  <key>KeepAlive</key><true/>25  <key>StandardErrorPath</key><string>/var/log/maclustr-wgfwd.log</string>26</dict></plist>27PLIST28sudo_ install -m 644 -o root -g wheel "$TMPP" /Library/LaunchDaemons/io.maclustr.wgfwd.plist; rm -f "$TMPP"29sudo_ launchctl bootout system/io.maclustr.wgfwd >/dev/null 2>&1 || true30sleep 231ok=0; for i in 1 2 3 4 5 6; do sudo_ launchctl bootstrap system /Library/LaunchDaemons/io.maclustr.wgfwd.plist 2>/tmp/wgfwd.err && { ok=1; break; }; grep -q -i already /tmp/wgfwd.err && { ok=1; break; }; sleep 3; done32[ $ok = 1 ] || { cat /tmp/wgfwd.err; exit 1; }33sleep 234for p in "${PORTS[@]}"; do if sudo_ lsof -nP -iTCP@$WGIP:$p -sTCP:LISTEN >/dev/null 2>&1; then echo "relais $WGIP:$p → 127.0.0.1:$p OK"; else echo "relais $WGIP:$p KO"; fi; done35