Add strongSwan IKEv2 VPN service

- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 41 insertions, 0 deletions

diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl
new file mode 100644
index 0000000..f3a9e2e
--- /dev/null
+++ b/vpn/swanctl.conf.tpl
@@ -0,0 +1,41 @@
+connections {
+    ikev2-eap {
+        version = 2
+        # iOS/macOS/Android 互換の暗号スイート
+        proposals = aes256gcm16-prfsha256-ecp256,aes256-sha256-ecp256,aes256gcm16-prfsha384-ecp384,aes256-sha256-modp2048,aes256-sha1-modp2048
+
+        local {
+            auth = pubkey
+            certs = server.crt
+            id = ${VPN_DOMAIN}
+        }
+
+        remote {
+            auth = eap-mschapv2
+            eap_id = %any
+        }
+
+        children {
+            vpn {
+                local_ts = 0.0.0.0/0
+                esp_proposals = aes256gcm16,aes256-sha256,aes256-sha1
+                dpd_action = clear
+            }
+        }
+
+        pools = pool4
+        send_certreq = no
+        dpd_delay = 30s
+    }
+}
+
+pools {
+    pool4 {
+        addrs = 10.10.0.0/24
+        dns = 1.1.1.1,8.8.8.8
+    }
+}
+
+secrets {
+${VPN_SECRETS}
+}