From 58f7917662ff92a3712289acccff8310c8f1baff Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Tue, 30 Jun 2026 22:29:07 +0900
Subject: Add strongSwan IKEv2 VPN service
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 vpn/swanctl.conf.tpl | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 vpn/swanctl.conf.tpl

(limited to 'vpn/swanctl.conf.tpl')

diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl
new file mode 100644
index 0000000..f3a9e2e
--- /dev/null
+++ b/vpn/swanctl.conf.tpl
@@ -0,0 +1,41 @@
+connections {
+    ikev2-eap {
+        version = 2
+        # iOS/macOS/Android 互換の暗号スイート
+        proposals = aes256gcm16-prfsha256-ecp256,aes256-sha256-ecp256,aes256gcm16-prfsha384-ecp384,aes256-sha256-modp2048,aes256-sha1-modp2048
+
+        local {
+            auth = pubkey
+            certs = server.crt
+            id = ${VPN_DOMAIN}
+        }
+
+        remote {
+            auth = eap-mschapv2
+            eap_id = %any
+        }
+
+        children {
+            vpn {
+                local_ts = 0.0.0.0/0
+                esp_proposals = aes256gcm16,aes256-sha256,aes256-sha1
+                dpd_action = clear
+            }
+        }
+
+        pools = pool4
+        send_certreq = no
+        dpd_delay = 30s
+    }
+}
+
+pools {
+    pool4 {
+        addrs = 10.10.0.0/24
+        dns = 1.1.1.1,8.8.8.8
+    }
+}
+
+secrets {
+${VPN_SECRETS}
+}
-- 
cgit v1.2.3