diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:16:13 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:16:13 +0900 |
| commit | 11b6518b75e06dcd716bf04e133ef1a67c591cae (patch) | |
| tree | afb24a215bed7c7b9b0d74e0820eaaf78bfe3e98 /vpn/entrypoint.sh | |
| parent | dd15de090cc70454f5039f8a1a9bb1d98358435b (diff) | |
Fix VPN: send certificate always, split cert chain, fix entrypoint
- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn/entrypoint.sh')
| -rw-r--r-- | vpn/entrypoint.sh | 24 |
1 files changed, 10 insertions, 14 deletions
diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh index 00e3131..febdfef 100644 --- a/vpn/entrypoint.sh +++ b/vpn/entrypoint.sh @@ -36,23 +36,19 @@ export VPN_DOMAIN="${VPN_DOMAIN:-vpn.yyamashita.com}" # テンプレートから swanctl.conf を生成 envsubst < /etc/swanctl/swanctl.conf.tpl > /etc/swanctl/swanctl.conf -# charon (IKE デーモン) 起動 -ipsec start - -# 初期化待ち -sleep 2 +# charon を直接フォアグラウンドで起動（ログが Docker に流れる） +/usr/lib/strongswan/charon & +CHARON_PID=$! + +# vici ソケット待ち +for i in $(seq 1 10); do + swanctl --list-conns > /dev/null 2>&1 && break + sleep 1 +done -# 設定ロード swanctl --load-conns swanctl --load-creds --noprompt swanctl --load-pools - echo "VPN ready. Domain: ${VPN_DOMAIN}" -# シグナルハンドラ -trap 'ipsec stop; exit 0' TERM INT - -# charon が生きている間ループ -while ipsec status > /dev/null 2>&1; do - sleep 10 -done +wait $CHARON_PID |