From 11b6518b75e06dcd716bf04e133ef1a67c591cae Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Wed, 1 Jul 2026 10:16:13 +0900
Subject: Fix VPN: send certificate always, split cert chain, fix entrypoint

- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
  fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/install.sh | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'vpn/install.sh')

diff --git a/vpn/install.sh b/vpn/install.sh
index 9a2f33d..3dc29bc 100644
--- a/vpn/install.sh
+++ b/vpn/install.sh
@@ -39,6 +39,12 @@ docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \
     cat "${CADDY_CERT_BASE}.key" > "$CERT_DIR/server.key"
 
 chmod 600 "$CERT_DIR/server.key"
+
+# 証明書チェーンを分割: 1枚目=リーフ、残り=中間CA
+awk '/BEGIN CERTIFICATE/{n++} n==1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-leaf.crt"
+awk '/BEGIN CERTIFICATE/{n++} n>1' "$CERT_DIR/server.crt" > "$CERT_DIR/server-chain.crt"
+mv "$CERT_DIR/server-leaf.crt" "$CERT_DIR/server.crt"
+
 echo "証明書を $CERT_DIR/ に保存しました。"
 
 # VPN コンテナ起動
-- 
cgit v1.2.3