spb/maclustr-dispatch

1#!/bin/bash2# wg-node-setup.sh — installe WireGuard (wireguard-go + wg-quick) sur un Mac du cluster et le raccorde au hub R9128.3# Usage : bash wg-node-setup.sh <ip-wg du nœud> <pubkey-serveur> <mot-de-passe-sudo> [iface=$IF] [endpoint=51.255.75.61:51820]4#   $IF = hub R9128 (France, 10.66.0.x) ; wg1 = hub BHS64 (Québec, 10.67.0.x). Un LaunchDaemon par interface.5# Imprime « PUBKEY <clé> » à la fin (à donner à tunnelctl peer add sur la passerelle).6set -euo pipefail7ADDR=${1:?ip wg}; SERVER_PUB=${2:?pubkey serveur}; PW=${3:?sudo}; IF=${4:-wg0}; ENDPOINT=${5:-51.255.75.61:51820}8SUBNET=${ADDR%.*}   # ex. 10.67.09BREW=/opt/homebrew/bin/brew10# NB : sudo -S lit le mot de passe sur stdin → ne jamais combiner sudo_ avec un heredoc/pipe de contenu.11sudo_(){ echo "$PW" | sudo -S -p '' "$@"; }12export PATH=/opt/homebrew/bin:/opt/homebrew/sbin:$PATH13[ -x "$BREW" ] || { echo "Homebrew absent"; exit 2; }14if ! [ -x /opt/homebrew/bin/wg-quick ]; then HOMEBREW_NO_AUTO_UPDATE=1 "$BREW" install -q wireguard-tools >/dev/null 2>&1 || HOMEBREW_NO_AUTO_UPDATE=1 "$BREW" install wireguard-tools; fi15[ -x /opt/homebrew/bin/wireguard-go ] || HOMEBREW_NO_AUTO_UPDATE=1 "$BREW" install -q wireguard-go >/dev/null 2>&1 || true16ETC=/opt/homebrew/etc/wireguard17sudo_ mkdir -p "$ETC"18if ! sudo_ test -f "$ETC/$IF.key"; then19  K=$(/opt/homebrew/bin/wg genkey); T=$(mktemp); chmod 600 "$T"; printf '%s\n' "$K" > "$T"20  sudo_ install -m 600 -o root "$T" "$ETC/$IF.key"; rm -f "$T"21fi22PRIV=$(sudo_ cat "$ETC/$IF.key")23PUB=$(printf '%s' "$PRIV" | /opt/homebrew/bin/wg pubkey)24TMPC=$(mktemp); chmod 600 "$TMPC"25{26  echo "[Interface]"27  echo "PrivateKey = $PRIV"28  echo "Address = $ADDR/24"29  echo "MTU = 1380"30  echo31  echo "[Peer]"32  echo "# hub R9128 (OVH)"33  echo "PublicKey = $SERVER_PUB"34  echo "Endpoint = $ENDPOINT"35  echo "AllowedIPs = $SUBNET.0/24"36  echo "PersistentKeepalive = 25"37} > "$TMPC"38sudo_ install -m 600 -o root "$TMPC" "$ETC/$IF.conf"; rm -f "$TMPC"3940# LaunchDaemon : monte $IF au boot (wireguard-go reste en arrière-plan) et le remonte s'il tombe.41TMPP=$(mktemp)42cat > "$TMPP" <<PLIST43<?xml version="1.0" encoding="UTF-8"?>44<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">45<plist version="1.0"><dict>46  <key>Label</key><string>io.maclustr.wireguard-$IF</string>47  <key>ProgramArguments</key><array>48    <string>/bin/bash</string><string>-c</string>49    <string>export PATH=/opt/homebrew/bin:/opt/homebrew/sbin:/usr/bin:/bin:/usr/sbin:/sbin; up(){ n=\$(cat /var/run/wireguard/$IF.name 2>/dev/null) &amp;&amp; [ -n "\$n" ] &amp;&amp; /opt/homebrew/bin/wg show "\$n" >/dev/null 2>&amp;1; }; while true; do if ! up; then /opt/homebrew/bin/wg-quick down $IF >/dev/null 2>&amp;1; /opt/homebrew/bin/wg-quick up $IF || true; fi; sleep 30; done</string>50  </array>51  <key>RunAtLoad</key><true/>52  <key>KeepAlive</key><true/>53  <key>StandardOutPath</key><string>/var/log/maclustr-wireguard-$IF.log</string>54  <key>StandardErrorPath</key><string>/var/log/maclustr-wireguard-$IF.log</string>55</dict></plist>56PLIST57sudo_ install -m 644 -o root -g wheel "$TMPP" /Library/LaunchDaemons/io.maclustr.wireguard-$IF.plist; rm -f "$TMPP"58sudo_ launchctl bootout system/io.maclustr.wireguard-$IF >/dev/null 2>&1 || true59sudo_ /opt/homebrew/bin/wg-quick down $IF >/dev/null 2>&1 || true60sleep 261ok=0; for i in 1 2 3 4 5 6; do62  if sudo_ launchctl bootstrap system /Library/LaunchDaemons/io.maclustr.wireguard-$IF.plist 2>/tmp/wg-bootstrap.err; then ok=1; break; fi63  grep -q -i "already" /tmp/wg-bootstrap.err && { ok=1; break; }64  sleep 365done66[ $ok = 1 ] || { cat /tmp/wg-bootstrap.err; echo "bootstrap KO → démarrage direct"; sudo_ /opt/homebrew/bin/wg-quick up $IF; }67# NB : `wg show $IF` ne résout pas le nom sur macOS (wireguard-tools 1.0.2026) → passer par /var/run/wireguard/$IF.name.68for i in $(seq 1 30); do N=$(sudo_ cat /var/run/wireguard/$IF.name 2>/dev/null || true); [ -n "$N" ] && sudo_ /opt/homebrew/bin/wg show "$N" >/dev/null 2>&1 && break; sleep 1; done69sudo_ /opt/homebrew/bin/wg show "$N" | head -370echo "NODE $(cat ~/.maclustr-node 2>/dev/null) IF $N PUBKEY $PUB"71