hetzner-infra/vpn/docker-compose.yml, branch master

Fix VPN cert chain: split multi-cert PEM for strongSwan

2026-07-01T15:28:31+00:00

Caddy's cert chain contains 4 certs:
  1. leaf (signed by YE1)
  2. YE1 (signed by Root YE)
  3. Root YE (cross-signed by ISRG Root X2)
  4. ISRG Root X2 (cross-signed by ISRG Root X1)

iOS/Android trust ISRG Root X1 but not Root YE directly.
The full cross-signed chain must be sent in IKE_AUTH.

strongSwan only reads the first cert from a multi-cert PEM file,
so entrypoint.sh now splits server-chain.crt into individual files
in x509ca/ before starting charon.

Co-Authored-By: Claude Sonnet 4.6

Restore intermediate cert + reduce IKE fragment size to 512 bytes

2026-07-01T15:21:40+00:00

iOS/Android VPN stacks don't follow AIA to download intermediate certs,
so YE1 must be sent by the server for cert chain validation.

The original 1236-byte IKE fragment was being dropped mid-path.
Setting fragment_size=512 splits the 1776-byte IKE_AUTH into ~4
fragments of ≤560 bytes each, which should traverse any NAT/router.

Co-Authored-By: Claude Sonnet 4.6

Remove intermediate CA cert to fix IKE fragmentation

2026-07-01T10:39:22+00:00

YE1 intermediate cert was inflating IKE_AUTH response to 1776 bytes,
causing it to be split into 2 IKE fragments that iOS/Android clients
could not reassemble. Both iOS and Android 12 (Beam Pro) have
Let's Encrypt trust chain in their system store, so the intermediate
cert is not needed.

Co-Authored-By: Claude Sonnet 4.6

Revert VPN file logging (caused container crash)

2026-07-01T10:10:52+00:00

Co-Authored-By: Claude Sonnet 4.6

Add file logging to VPN container for diagnostics

2026-07-01T08:35:43+00:00

Logs to /home/yyamashita/vpn-logs/charon.log (readable without root)
to diagnose iPhone IKEv2 connection failures.

Co-Authored-By: Claude Sonnet 4.6

Restore intermediate CA cert, disable IKE fragmentation

2026-07-01T03:30:02+00:00

Android (XREAL Beam Pro) fails to reassemble IKE fragments even though
FRAG_SUP is negotiated. IP-level fragmentation (handled by the OS kernel)
works better. Removing the intermediate cert broke macOS/iOS.

This config:
- Sends leaf cert + YE1 intermediate (so any client can verify the chain)
- fragment_size=0 disables IKE fragmentation; the 1776-byte IKE_AUTH
  response is sent as one large UDP packet (OS handles IP fragmentation)

Co-Authored-By: Claude Sonnet 4.6

Remove intermediate CA cert mount to fix Android IKEv2 fragmentation

2026-07-01T01:29:36+00:00

Android (XREAL Beam Pro) advertises FRAG_SUP but fails to reassemble
IKE fragments. The IKE_AUTH response was 1776 bytes (leaf + YE1 intermediate)
requiring fragmentation into 2 packets. Without x509ca mount, only the leaf
cert is sent (~886 bytes total), fitting in a single packet without fragmentation.
Android fetches the intermediate CA (YE1) via AIA extension before tunnel setup.

Co-Authored-By: Claude Sonnet 4.6

Fix VPN: send certificate always, split cert chain, fix entrypoint

2026-07-01T01:16:13+00:00

- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
  fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging

Co-Authored-By: Claude Sonnet 4.6

Add strongSwan IKEv2 VPN service

2026-06-30T13:29:07+00:00

- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加

Co-Authored-By: Claude Sonnet 4.6