dev
3c40e94a57
- Dockerfile.cloudflared: add iptables + ip6tables (wg-quick needs them for ::/0 full tunnel) - docker-compose: privileged:true for cloudflared so wg-quick can set net.ipv4.conf.all.src_valid_mark - start-cloudflared.sh: restore resolv.conf after wg-quick (resolvconf wiped docker DNS 127.0.0.11 => app unresolvable => Host Error)
25 lines
1.3 KiB
Bash
Executable File
25 lines
1.3 KiB
Bash
Executable File
#!/bin/sh
|
|
set -e
|
|
|
|
# Опциональный WireGuard: если в wg/wg0.conf лежит конфиг — поднимаем VPN
|
|
# и только после установки handshake запускаем туннель. Без конфига —
|
|
# cloudflared стартует сразу, как в базовой схеме Quick Tunnel.
|
|
if [ -f /etc/wireguard/wg0.conf ]; then
|
|
echo "WireGuard config found, bringing up wg0..."
|
|
cp /etc/resolv.conf /tmp/resolv.conf.default
|
|
wg-quick up wg0
|
|
# wg-quick/resolvconf перезаписывает resolv.conf (убирает docker-DNS 127.0.0.11),
|
|
# из-за чего внутреннее имя app не резолвится. Восстанавливаем прежний конфиг.
|
|
cat /tmp/resolv.conf.default > /etc/resolv.conf
|
|
echo "Waiting for WireGuard handshake..."
|
|
# Формат `wg show wg0 latest-handshakes`: "<pubkey> <epoch-ts>"; 0 = handshake ещё не было.
|
|
until wg show wg0 latest-handshakes | awk '{ if ($2 != 0) found=1 } END { exit !found }'; do
|
|
sleep 2
|
|
done
|
|
echo "WireGuard is up, starting Cloudflare tunnel through VPN..."
|
|
else
|
|
echo "No WireGuard config, starting Cloudflare tunnel directly..."
|
|
fi
|
|
|
|
exec cloudflared --no-autoupdate tunnel --url "$CLOUDFLARE_TUNNEL_URL"
|