diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:16:13 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-01 10:16:13 +0900 |
| commit | 11b6518b75e06dcd716bf04e133ef1a67c591cae (patch) | |
| tree | afb24a215bed7c7b9b0d74e0820eaaf78bfe3e98 /vpn | |
| parent | dd15de090cc70454f5039f8a1a9bb1d98358435b (diff) | |
Fix VPN: send certificate always, split cert chain, fix entrypoint
- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn')
| -rw-r--r-- | vpn/docker-compose.yml | 1 | ||||
| -rw-r--r-- | vpn/entrypoint.sh | 24 | ||||
| -rw-r--r-- | vpn/install.sh | 6 | ||||
| -rw-r--r-- | vpn/strongswan.conf | 5 | ||||
| -rw-r--r-- | vpn/swanctl.conf.tpl | 1 |
5 files changed, 21 insertions, 16 deletions
diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml index 83ff270..1961a99 100644 --- a/vpn/docker-compose.yml +++ b/vpn/docker-compose.yml @@ -8,6 +8,7 @@ services: - SYS_MODULE volumes: - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro + - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro - ./certs/server.key:/etc/swanctl/private/server.key:ro - ./users.conf:/etc/strongswan/users.conf:ro environment: diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh index 00e3131..febdfef 100644 --- a/vpn/entrypoint.sh +++ b/vpn/entrypoint.sh @@ -36,23 +36,19 @@ export VPN_DOMAIN="${VPN_DOMAIN:-vpn.yyamashita.com}" # テンプレートから swanctl.conf を生成 envsubst < /etc/swanctl/swanctl.conf.tpl > /etc/swanctl/swanctl.conf -# charon (IKE デーモン) 起動 -ipsec start - -# 初期化待ち -sleep 2 +# charon を直接フォアグラウンドで起動（ログが Docker に流れる） +/usr/lib/strongswan/charon & +CHARON_PID=$! + +# vici ソケット待ち +for i in $(seq 1 10); do + swanctl --list-conns > /dev/null 2>&1 && break + sleep 1 +done -# 設定ロード swanctl --load-conns swanctl --load-creds --noprompt swanctl --load-pools - echo "VPN ready. Domain: ${VPN_DOMAIN}" -# シグナルハンドラ -trap 'ipsec stop; exit 0' TERM INT - -# charon が生きている間ループ -while ipsec status > /dev/null 2>&1; do - sleep 10 -done +wait $CHARON_PID diff --git a/vpn/install.sh b/vpn/install.sh index 9a2f33d..3dc29bc 100644 --- a/vpn/install.sh +++ b/vpn/install.sh @@ -39,6 +39,12 @@ docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \ cat "${CADDY_CERT_BASE}.key" > "$CERT_DIR/server.key" chmod 600 "$CERT_DIR/server.key" + +# 証明書チェーンを分割: 1枚目=リーフ、残り=中間CA +awk '/BEGIN CERTIFICATE/{n++} n==1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-leaf.crt" +awk '/BEGIN CERTIFICATE/{n++} n>1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-chain.crt" +mv "$CERT_DIR/server-leaf.crt" "$CERT_DIR/server.crt" + echo "証明書を $CERT_DIR/ に保存しました。" # VPN コンテナ起動 diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index b42f8c0..eeed46c 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -6,8 +6,9 @@ charon { filelog { stderr { default = 1 - ike = 2 - knl = 3 + ike = 4 + cfg = 3 + knl = 2 } } send_vendor_id = no diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl index f3a9e2e..da988e0 100644 --- a/vpn/swanctl.conf.tpl +++ b/vpn/swanctl.conf.tpl @@ -25,6 +25,7 @@ connections { pools = pool4 send_certreq = no + send_cert = always dpd_delay = 30s } } |