wireguard-vpn/build.sh

#!/bin/bash
# build.sh - Generates the install.sh file dynamically by embedding .sh and .service files

set -euo pipefail

INSTALL_SCRIPT="install.sh"

echo "Building ${INSTALL_SCRIPT}..."

# Write the header
cat << 'MAIN_EOF' > "$INSTALL_SCRIPT"
#!/bin/bash
# WireGuard Policy Firewall Installer/Uninstaller
# This file is auto-generated. Do not edit directly. Run build.sh or build.bat instead.

set -euo pipefail

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root."
   exit 1
fi

if ! command -v wg &>/dev/null; then
    echo "[ERROR] WireGuard is not installed."
    echo "  Debian/Ubuntu: apt install wireguard"
    echo "  RHEL/CentOS:   dnf install wireguard-tools"
    echo "  Arch:          pacman -S wireguard-tools"
    exit 1
fi

if [[ ! -f /etc/wireguard/wg0.conf ]]; then
    echo "[WARN] WireGuard config not found: /etc/wireguard/wg0.conf"
    echo "  PostUp/PostDown hooks will not be added automatically."
    echo "  Create your wg0.conf first, then re-install."
fi

WG_CONF="/etc/wireguard/wg0.conf"

install_hooks() {
    if [[ ! -f "$WG_CONF" ]]; then
        return 0
    fi

    if grep -q "wg-sync-policy.sh" "$WG_CONF" 2>/dev/null; then
        echo "[OK] PostUp/PostDown hooks already present in $WG_CONF"
        return 0
    fi

    echo "Adding PostUp/PostDown hooks to $WG_CONF..."
    cp "$WG_CONF" "${WG_CONF}.bak.$(date +%Y%m%d%H%M%S)"

    local peer_line
    peer_line=$(grep -n '^\[Peer\]' "$WG_CONF" | head -1 | cut -d: -f1)

    if [[ -n "$peer_line" ]]; then
        sed -i "${peer_line}i\\
# WireGuard Policy Firewall hooks\\
PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh\\
PostDown = /usr/local/bin/wg-policy-cleanup.sh" "$WG_CONF"
    else
        {
            echo ""
            echo "# WireGuard Policy Firewall hooks"
            echo "PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh"
            echo "PostDown = /usr/local/bin/wg-policy-cleanup.sh"
        } >> "$WG_CONF"
    fi

    echo "[OK] Hooks added to $WG_CONF"
}

remove_hooks() {
    if [[ ! -f "$WG_CONF" ]]; then
        return 0
    fi

    if ! grep -q "wg-sync-policy.sh" "$WG_CONF" 2>/dev/null; then
        return 0
    fi

    echo "Removing PostUp/PostDown hooks from $WG_CONF..."
    cp "$WG_CONF" "${WG_CONF}.bak.$(date +%Y%m%d%H%M%S)"
    sed -i '/# WireGuard Policy Firewall hooks/d' "$WG_CONF"
    sed -i '/wg-sync-policy\.sh/d' "$WG_CONF"
    sed -i '/wg-policy-cleanup\.sh/d' "$WG_CONF"
    echo "[OK] Hooks removed from $WG_CONF"
}

install_policy() {
    echo "Installing WireGuard Policy Firewall..."

    echo "Checking dependencies..."
    apt-get update -y || true
    apt-get install -y jq inotify-tools nftables || true

    echo "Writing scripts to /usr/local/bin/..."

MAIN_EOF

# Helper function to append file content inside a heredoc
append_file() {
    local file=$1
    local target=$2
    local delimiter="EOF_${file//[-.]/_}"
    delimiter=$(echo "$delimiter" | tr '[:lower:]' '[:upper:]')
    
    echo "    cat << '${delimiter}' > ${target}" >> "$INSTALL_SCRIPT"
    cat "$file" >> "$INSTALL_SCRIPT"
    
    # Ensure there is a newline before the EOF marker just in case the file lacks it
    echo "" >> "$INSTALL_SCRIPT"
    echo "${delimiter}" >> "$INSTALL_SCRIPT"
    echo "" >> "$INSTALL_SCRIPT"
}

# Append all necessary files
append_file "wg-policy-lib.sh" "/usr/local/bin/wg-policy-lib.sh"
append_file "wg-policy-engine.sh" "/usr/local/bin/wg-policy-engine.sh"
append_file "wg-policy-cleanup.sh" "/usr/local/bin/wg-policy-cleanup.sh"
append_file "wg-sync-policy.sh" "/usr/local/bin/wg-sync-policy.sh"
append_file "wg-sync-watch.sh" "/usr/local/bin/wg-sync-watch.sh"
append_file "wg-policy-ctl" "/usr/local/bin/wg-policy-ctl"

cat << 'MAIN_EOF_MID' >> "$INSTALL_SCRIPT"
    echo "Writing systemd units to /etc/systemd/system/..."

MAIN_EOF_MID

append_file "wg-policy.service" "/etc/systemd/system/wg-policy.service"
append_file "wg-policy-health.service" "/etc/systemd/system/wg-policy-health.service"
append_file "wg-policy-health.timer" "/etc/systemd/system/wg-policy-health.timer"

# Write the rest of the installation and uninstallation logic
cat << 'MAIN_EOF_END' >> "$INSTALL_SCRIPT"
    chmod +x /usr/local/bin/wg-*.sh /usr/local/bin/wg-policy-ctl

    echo "Reloading systemd daemon..."
    systemctl daemon-reload
    
    echo "Enabling and starting services..."
    systemctl enable --now wg-policy.service
    systemctl enable --now wg-policy-health.timer

    install_hooks

    echo "Installation complete!"
    echo "You can check status with: wg-policy-ctl status"
}

uninstall_policy() {
    echo "Uninstalling WireGuard Policy Firewall..."

    echo "Stopping and disabling services..."
    systemctl disable --now wg-policy.service wg-policy-health.timer wg-policy-health.service 2>/dev/null || true

    echo "Running cleanup script..."
    if [ -x /usr/local/bin/wg-policy-cleanup.sh ]; then
        /usr/local/bin/wg-policy-cleanup.sh || true
    fi

    remove_hooks

    echo "Removing systemd units..."
    rm -f /etc/systemd/system/wg-policy.service
    rm -f /etc/systemd/system/wg-policy-health.service
    rm -f /etc/systemd/system/wg-policy-health.timer
    systemctl daemon-reload

    echo "Removing scripts from /usr/local/bin/..."
    rm -f /usr/local/bin/wg-policy-lib.sh
    rm -f /usr/local/bin/wg-sync-policy.sh
    rm -f /usr/local/bin/wg-policy-engine.sh
    rm -f /usr/local/bin/wg-policy-cleanup.sh
    rm -f /usr/local/bin/wg-sync-watch.sh
    rm -f /usr/local/bin/wg-policy-ctl

    echo "Uninstallation complete!"
}

case "${1:-}" in
    install)
        install_policy
        ;;
    uninstall)
        uninstall_policy
        ;;
    *)
        echo "Usage: $0 {install|uninstall}"
        exit 1
        ;;
esac
MAIN_EOF_END

chmod +x "$INSTALL_SCRIPT"

echo "Done! Generated ${INSTALL_SCRIPT} successfully."