5 files changed, 21 insertions, 16 deletions
diff --git a/vpn/docker-compose.yml b/vpn/docker-compose.yml
index 83ff270..1961a99 100644
--- a/vpn/docker-compose.yml
+++ b/vpn/docker-compose.yml
@@ -8,6 +8,7 @@ services:
       - SYS_MODULE
     volumes:
       - ./certs/server.crt:/etc/swanctl/x509/server.crt:ro
+      - ./certs/server-chain.crt:/etc/swanctl/x509ca/server-chain.crt:ro
       - ./certs/server.key:/etc/swanctl/private/server.key:ro
       - ./users.conf:/etc/strongswan/users.conf:ro
     environment:
diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh
index 00e3131..febdfef 100644
--- a/vpn/entrypoint.sh
+++ b/vpn/entrypoint.sh
@@ -36,23 +36,19 @@ export VPN_DOMAIN="${VPN_DOMAIN:-vpn.yyamashita.com}"
 # テンプレートから swanctl.conf を生成
 envsubst < /etc/swanctl/swanctl.conf.tpl > /etc/swanctl/swanctl.conf
 
-# charon (IKE デーモン) 起動
-ipsec start
-
-# 初期化待ち
-sleep 2
+# charon を直接フォアグラウンドで起動（ログが Docker に流れる）
+/usr/lib/strongswan/charon &
+CHARON_PID=$!
+
+# vici ソケット待ち
+for i in $(seq 1 10); do
+    swanctl --list-conns > /dev/null 2>&1 && break
+    sleep 1
+done
 
-# 設定ロード
 swanctl --load-conns
 swanctl --load-creds --noprompt
 swanctl --load-pools
-
 echo "VPN ready. Domain: ${VPN_DOMAIN}"
 
-# シグナルハンドラ
-trap 'ipsec stop; exit 0' TERM INT
-
-# charon が生きている間ループ
-while ipsec status > /dev/null 2>&1; do
-    sleep 10
-done
+wait $CHARON_PID
diff --git a/vpn/install.sh b/vpn/install.sh
index 9a2f33d..3dc29bc 100644
--- a/vpn/install.sh
+++ b/vpn/install.sh
@@ -39,6 +39,12 @@ docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \
     cat "${CADDY_CERT_BASE}.key" > "$CERT_DIR/server.key"
 
 chmod 600 "$CERT_DIR/server.key"
+
+# 証明書チェーンを分割: 1枚目=リーフ、残り=中間CA
+awk '/BEGIN CERTIFICATE/{n++} n==1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-leaf.crt"
+awk '/BEGIN CERTIFICATE/{n++} n>1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-chain.crt"
+mv "$CERT_DIR/server-leaf.crt" "$CERT_DIR/server.crt"
+
 echo "証明書を $CERT_DIR/ に保存しました。"
 
 # VPN コンテナ起動
diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf
index b42f8c0..eeed46c 100644
--- a/vpn/strongswan.conf
+++ b/vpn/strongswan.conf
@@ -6,8 +6,9 @@ charon {
     filelog {
         stderr {
             default = 1
-            ike = 2
-            knl = 3
+            ike = 4
+            cfg = 3
+            knl = 2
         }
     }
     send_vendor_id = no
diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl
index f3a9e2e..da988e0 100644
--- a/vpn/swanctl.conf.tpl
+++ b/vpn/swanctl.conf.tpl
@@ -25,6 +25,7 @@ connections {
 
         pools = pool4
         send_certreq = no
+        send_cert = always
         dpd_delay = 30s
     }
 }