mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
83b20b3078
Align the macOS example with the repo's existing fips-gateway binary name and override the test image entrypoint so first-run identity generation succeeds.
101 lines
3.3 KiB
Bash
Executable File
101 lines
3.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Start the WireGuard sidecar and configure macOS to reach the mesh.
|
|
#
|
|
# Sets up:
|
|
# 1. WireGuard tunnel from macOS to the FIPS Docker container
|
|
# 2. macOS DNS resolver for .fips names
|
|
# 3. fd00::/8 routed through the WireGuard tunnel
|
|
#
|
|
# Safe to run multiple times (idempotent).
|
|
#
|
|
# Usage: ./fips-on.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
IDENTITY_DIR="$SCRIPT_DIR/identity"
|
|
WG_DIR="$IDENTITY_DIR/wireguard"
|
|
HOST_HELPER="$SCRIPT_DIR/fips-host.sh"
|
|
REAL_USER="${SUDO_USER:-$USER}"
|
|
|
|
run_as_real_user() {
|
|
if [ "$(id -u)" -eq 0 ] && [ -n "${SUDO_USER:-}" ]; then
|
|
sudo -u "$SUDO_USER" "$@"
|
|
else
|
|
"$@"
|
|
fi
|
|
}
|
|
|
|
run_host_helper() {
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
"$HOST_HELPER" "$@"
|
|
else
|
|
sudo "$HOST_HELPER" "$@"
|
|
fi
|
|
}
|
|
|
|
# ── 1. Generate persistent FIPS identity if missing ───────────
|
|
mkdir -p "$IDENTITY_DIR" "$WG_DIR"
|
|
|
|
if [ ! -f "$IDENTITY_DIR/fips.key" ]; then
|
|
echo "Generating FIPS identity keypair..."
|
|
run_as_real_user docker run --rm \
|
|
--entrypoint fipsctl \
|
|
-v "$IDENTITY_DIR:/etc/fips" \
|
|
fips-test:latest \
|
|
keygen --dir /etc/fips
|
|
fi
|
|
|
|
# ── 2. Generate WireGuard client keys ─────────────────────────
|
|
mkdir -p "$WG_DIR"
|
|
|
|
if [ ! -f "$WG_DIR/client.key" ]; then
|
|
echo "Generating WireGuard client keypair..."
|
|
run_as_real_user sh -c 'umask 077; wg genkey | tee "$1/client.key" | wg pubkey > "$1/client.pub"' sh "$WG_DIR"
|
|
elif [ ! -f "$WG_DIR/client.pub" ]; then
|
|
echo "Regenerating WireGuard client public key..."
|
|
run_as_real_user sh -c 'wg pubkey < "$1/client.key" > "$1/client.pub" && chmod 600 "$1/client.pub"' sh "$WG_DIR"
|
|
fi
|
|
|
|
# Keep bind-mounted client keys readable to Docker Desktop on macOS.
|
|
run_host_helper fix-key-perms "$REAL_USER" "$WG_DIR"
|
|
|
|
# ── 3. Start Docker container ─────────────────────────────────
|
|
echo "Starting WireGuard sidecar container..."
|
|
run_as_real_user docker compose -f "$SCRIPT_DIR/docker-compose.yml" up -d --build --force-recreate
|
|
|
|
echo "Waiting for container..."
|
|
for i in $(seq 1 30); do
|
|
if run_as_real_user docker exec wireguard-sidecar wg show wg0 >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
if ! run_as_real_user docker exec wireguard-sidecar wg show wg0 >/dev/null 2>&1; then
|
|
echo "Error: WireGuard not ready in container after 30s"
|
|
echo "Check: docker logs wireguard-sidecar"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -f "$WG_DIR/server.pub" ]; then
|
|
echo " Server pubkey: $(cat "$WG_DIR/server.pub")"
|
|
fi
|
|
|
|
# ── 4. Configure host networking ──────────────────────────────
|
|
run_host_helper on "$SCRIPT_DIR"
|
|
|
|
# ── Done ──────────────────────────────────────────────────────
|
|
echo ""
|
|
echo "WireGuard sidecar is ON."
|
|
echo ""
|
|
echo " WireGuard: fips0 tunnel active (fd00::/8 routed)"
|
|
echo " DNS: .fips names resolve via localhost:5354"
|
|
echo ""
|
|
echo "Usage:"
|
|
echo " ping6 -c3 \$(dig +short AAAA your-bootstrap-peer.fips @127.0.0.1 -p 5354)"
|
|
echo ""
|
|
echo " docker exec wireguard-sidecar fipsctl show status"
|
|
echo " docker exec wireguard-sidecar fipsctl show peers"
|
|
echo ""
|
|
echo "To stop: ./fips-off.sh"
|