Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Detect WireGuard in Containers, and allow install. #185

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Detect WireGuard in Containers, and allow install. #185

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0665813
Detect WireGuard in Containers, and allow install.
jaminmc Feb 7, 2021
b2bbdc4
Cleaner display of container differences.
jaminmc Feb 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 49 additions & 15 deletions wireguard-install.sh
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,32 @@ function isRoot() {

function checkVirt() {
if [ "$(systemd-detect-virt)" == "openvz" ]; then
echo "OpenVZ is not supported"
exit 1
if ip link add wg999 type wireguard 2> /dev/null ; then
echo "OpenVZ is not supported, but it seems to have correct kernel modules."
ip link del wg999
read -rp "Press enter to continue at your own risk, or CTRL-C to quit."
Container=1
angristan marked this conversation as resolved.
Show resolved Hide resolved
else
echo "OpenVZ is not supported"
exit 1
fi
Comment on lines +15 to +23
Copy link
Author

@jaminmc jaminmc Feb 8, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Tests for the WireGuard Module, and allows the install of the script at the users risk. As I have not tested OpenVZ.

The Test works by creating a Wireguard Interface of wg999, and if successful, the Wireguard Kernel module exists and works. Then it deletes that interface.

fi

if [ "$(systemd-detect-virt)" == "lxc" ]; then
echo "LXC is not supported (yet)."
echo "WireGuard can technically run in an LXC container,"
echo "but the kernel module has to be installed on the host,"
echo "the container has to be run with some specific parameters"
echo "and only the tools need to be installed in the container."
exit 1
if ip link add wg999 type wireguard 2> /dev/null ; then
ip link del wg999
echo "LXC is currently in Beta."
echo "WireGuard can technically run in an LXC container,"
echo "but the kernel module has to be installed on the host,"
echo "the container has to be run with some specific parameters"
echo "and only the tools need to be installed in the container."
echo "The Kernel seems to support Wireguard."
read -rp "Press enter to continue at your own risk, or CTRL-C to quit."
Container=1
else
echo "Your LXC host does not have the WireGuard Kernel Module."
echo "If you have access to the host, try installing wireguard-dkms on it."
exit 1
fi
Comment on lines +26 to +40
Copy link
Author

@jaminmc jaminmc Feb 8, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Tests for WireGuard, and allows user to continue. I have tested this on my own LXD Ubuntu 20.04 server with Centos 7/8, Fedora 32/22, Debian 10, Ubuntu 16.04/18.04/20.04, and ArchLinux.
It the Kernel module isn't there, It exits, and suggests to install it to the Host, if user has access to it. Doesn't help if they are using a VPS that they can't change.

The Test works by creating a Wireguard Interface of wg999, and if successful, the Wireguard Kernel module exists and works. Then it deletes that interface.

fi
}

Expand Down Expand Up @@ -121,28 +136,47 @@ function installWireGuard() {
# Install WireGuard tools and module
if [[ ${OS} == 'ubuntu' ]]; then
apt-get update
apt-get install -y wireguard iptables resolvconf qrencode
if [[ $Container == 1 ]]; then
apt-get install -y wireguard-tools --no-install-recommends
apt-get install -y iptables resolvconf qrencode
else
apt-get install -y wireguard iptables resolvconf qrencode
fi

jaminmc marked this conversation as resolved.
Show resolved Hide resolved
elif [[ ${OS} == 'debian' ]]; then
if ! grep -rqs "^deb .* buster-backports" /etc/apt/; then
echo "deb http://deb.debian.org/debian buster-backports main" >/etc/apt/sources.list.d/backports.list
apt-get update
fi
apt update
apt-get install -y iptables resolvconf qrencode
apt-get install -y -t buster-backports wireguard
if [[ $Container == 1 ]]; then
apt-get install -y -t buster-backports wireguard-tools --no-install-recommends
else
apt-get install -y -t buster-backports wireguard
fi
Comment on lines +152 to +156
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Install only wireguard-tools for Debian, as that is all that is needed when Kernel Module works.


elif [[ ${OS} == 'fedora' ]]; then
if [[ ${VERSION_ID} -lt 32 ]]; then
dnf install -y dnf-plugins-core
dnf copr enable -y jdoss/wireguard
dnf install -y wireguard-dkms
if [[ $Container != 1 ]]; then
dnf install -y wireguard-dkms
fi
Comment on lines +162 to +164
Copy link
Author

@jaminmc jaminmc Feb 8, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If not a Container, then install wireguard-dkms. Not needed if it is in Kernel with a container.

fi
dnf install -y wireguard-tools iptables qrencode

elif [[ ${OS} == 'centos' ]]; then
yum -y install epel-release elrepo-release
if [[ ${VERSION_ID} -eq 7 ]]; then
yum -y install yum-plugin-elrepo
fi
yum -y install kmod-wireguard wireguard-tools iptables qrencode
if [[ $Container == 1 ]]; then
yum -y install wireguard-tools iptables qrencode
else
yum -y install kmod-wireguard wireguard-tools iptables qrencode
fi
Comment on lines +173 to +177
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Install only wireguard-tools for Centos, as that is all that is needed when Kernel Module works.


elif [[ ${OS} == 'arch' ]]; then
# Check if current running kernel is LTS
ARCH_KERNEL_RELEASE=$(uname -r)
Expand Down Expand Up @@ -353,9 +387,9 @@ function uninstallWg() {
systemctl disable "wg-quick@${SERVER_WG_NIC}"

if [[ ${OS} == 'ubuntu' ]]; then
apt-get autoremove --purge -y wireguard qrencode
apt-get autoremove --purge -y wireguard wireguard-tools qrencode
elif [[ ${OS} == 'debian' ]]; then
apt-get autoremove --purge -y wireguard qrencode
apt-get autoremove --purge -y wireguard wireguard-tools qrencode
Comment on lines -356 to +391
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added wireguard-tools to the uninstall, as it is installed either way, but not purged if a container.

elif [[ ${OS} == 'fedora' ]]; then
dnf remove -y wireguard-tools qrencode
if [[ ${VERSION_ID} -lt 32 ]]; then
Expand Down