From 11b6518b75e06dcd716bf04e133ef1a67c591cae Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Wed, 1 Jul 2026 10:16:13 +0900
Subject: Fix VPN: send certificate always, split cert chain, fix entrypoint

- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
  fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/swanctl.conf.tpl | 1 +
 1 file changed, 1 insertion(+)

(limited to 'vpn/swanctl.conf.tpl')

diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl
index f3a9e2e..da988e0 100644
--- a/vpn/swanctl.conf.tpl
+++ b/vpn/swanctl.conf.tpl
@@ -25,6 +25,7 @@ connections {
 
         pools = pool4
         send_certreq = no
+        send_cert = always
         dpd_delay = 30s
     }
 }
-- 
cgit v1.2.3