Moduletrace/wireguard-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor wireguard to use a different config dir instead of /etc/wireguard

Browse Source
This commit is contained in:
tben
2026-09-13 13:37:48 +01:00
parent 06cf72b2c9
commit 42224c94d3
10 changed files with 192 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/scripts/install-wg-ui.sh
+31 -8
View File
@@ -12,6 +12,7 @@ log() { echo "==> $*"; }
fail() { echo "error: $*" >&2; exit 1; }
WGUI_LIB_DIR="/var/lib/wgui"
WG_QUICK_HELPER="$WGUI_LIB_DIR/scripts/wg-quick-systemd.sh"
INSTALL_DIR="${INSTALL_DIR:-}"
SERVICE_USER="${SERVICE_USER:-}"
SERVICE_GROUP="${SERVICE_GROUP:-}"
@@ -125,8 +126,9 @@ install_bun() {
}
setup_service_user() {
mkdir -p "$WGUI_LIB_DIR/iptables" "$WGUI_LIB_DIR/keys" "$WGUI_LIB_DIR/clients"
mkdir -p "$WGUI_LIB_DIR/iptables" "$WGUI_LIB_DIR/keys" "$WGUI_LIB_DIR/clients" "$WGUI_LIB_DIR/hosts" "$WGUI_LIB_DIR/scripts"
chown -R "$SERVICE_USER:$SERVICE_GROUP" "$WGUI_LIB_DIR"
chmod 770 "$WGUI_LIB_DIR/hosts"
}
clone_or_update() {
@@ -187,11 +189,30 @@ setup_wireguard() {
fi
}
grant_runtime_access() {
log "granting $SERVICE_USER access to /etc/wireguard ..."
mkdir -p /etc/wireguard
chown "root:$SERVICE_GROUP" /etc/wireguard
chmod 770 /etc/wireguard
install_wg_quick_helper() {
local helper_src="$INSTALL_DIR/src/scripts/wg-quick-systemd.sh"
if [ ! -f "$helper_src" ]; then
fail "missing $helper_src — cannot install the wg-quick systemd helper"
fi
log "installing wg-quick systemd helper to $WG_QUICK_HELPER ..."
install -m 755 -o root -g root "$helper_src" "$WG_QUICK_HELPER"
}
install_wg_quick_sudoers() {
if [ "$SERVICE_USER" = "root" ]; then
return 0
fi
if ! command -v visudo >/dev/null 2>&1; then
log "visudo not found — skipping sudoers entry for $SERVICE_USER (tunnel management will require root)"
return 0
fi
local sudoers_file="/etc/sudoers.d/wgui-wg-quick"
log "granting $SERVICE_USER passwordless access to $WG_QUICK_HELPER ..."
cat > "$sudoers_file" <<EOF
$SERVICE_USER ALL=(root) NOPASSWD: $WG_QUICK_HELPER *
EOF
chmod 440 "$sudoers_file"
visudo -cf "$sudoers_file" >/dev/null 2>&1 || fail "invalid sudoers file $sudoers_file"
}
install_systemd_unit() {
@@ -274,7 +295,8 @@ fi
install_dependencies
ensure_env_file
setup_wireguard
grant_runtime_access
install_wg_quick_helper
install_wg_quick_sudoers
if [ "$DEV_MODE" = false ]; then
case "$INIT_SYSTEM" in
@@ -295,7 +317,8 @@ fi
PORT="$(grab_port)"
log "wg-ui install complete."
log "webapp: $INSTALL_DIR"
log "runtime: $WGUI_LIB_DIR (keys, iptables, client configs)"
log "runtime: $WGUI_LIB_DIR (host configs, keys, iptables, client configs)"
log "tunnels: systemd units wg-quick@wgui<host_id>.service (configs in $WGUI_LIB_DIR/hosts — /etc/wireguard is never touched)"
if [ "$DEV_MODE" = true ]; then
log "process: development mode — no system service installed"
else