From 11b6518b75e06dcd716bf04e133ef1a67c591cae Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Wed, 1 Jul 2026 10:16:13 +0900
Subject: Fix VPN: send certificate always, split cert chain, fix entrypoint

- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
  fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/entrypoint.sh | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

(limited to 'vpn/entrypoint.sh')

diff --git a/vpn/entrypoint.sh b/vpn/entrypoint.sh
index 00e3131..febdfef 100644
--- a/vpn/entrypoint.sh
+++ b/vpn/entrypoint.sh
@@ -36,23 +36,19 @@ export VPN_DOMAIN="${VPN_DOMAIN:-vpn.yyamashita.com}"
 # テンプレートから swanctl.conf を生成
 envsubst < /etc/swanctl/swanctl.conf.tpl > /etc/swanctl/swanctl.conf
 
-# charon (IKE デーモン) 起動
-ipsec start
-
-# 初期化待ち
-sleep 2
+# charon を直接フォアグラウンドで起動（ログが Docker に流れる）
+/usr/lib/strongswan/charon &
+CHARON_PID=$!
+
+# vici ソケット待ち
+for i in $(seq 1 10); do
+    swanctl --list-conns > /dev/null 2>&1 && break
+    sleep 1
+done
 
-# 設定ロード
 swanctl --load-conns
 swanctl --load-creds --noprompt
 swanctl --load-pools
-
 echo "VPN ready. Domain: ${VPN_DOMAIN}"
 
-# シグナルハンドラ
-trap 'ipsec stop; exit 0' TERM INT
-
-# charon が生きている間ループ
-while ipsec status > /dev/null 2>&1; do
-    sleep 10
-done
+wait $CHARON_PID
-- 
cgit v1.2.3