From 11b6518b75e06dcd716bf04e133ef1a67c591cae Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Wed, 1 Jul 2026 10:16:13 +0900
Subject: Fix VPN: send certificate always, split cert chain, fix entrypoint

- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
  fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/strongswan.conf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'vpn/strongswan.conf')

diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf
index b42f8c0..eeed46c 100644
--- a/vpn/strongswan.conf
+++ b/vpn/strongswan.conf
@@ -6,8 +6,9 @@ charon {
     filelog {
         stderr {
             default = 1
-            ike = 2
-            knl = 3
+            ike = 4
+            cfg = 3
+            knl = 2
         }
     }
     send_vendor_id = no
-- 
cgit v1.2.3