wireguard_hook

#!/bin/bash

_fatal () { echo ":: WireGuard [FATAL]: ${@}. Cannot initialise WireGuard!"; break=y; }

. /etc/wireguard/initcpio/unlock

run_hook()
{
    if [ -z $INTERFACE ]; then
        _fatal 'Interface name is not defined!'
        return 1
    fi

    if [ -z $INTERFACE_ADDR ]; then
        _fatal 'Interface address is not defined!'
        return 1
    fi

    if [ -z $PEER_PUBLIC_KEY ]; then
        _fatal 'Peer Public Key is not defined!'
        return 1
    fi

    if [ ! -s $PRIVATE_KEYFILE ]; then
        _fatal 'Private keyfile is not defined!'
        return 1
    fi

    if [ -z $PEER_ENDPOINT ]; then
        _fatal 'Peer endpoint is not defined!'
        return 1
    fi

    if [ -z $PERSISTENT_KEEPALIVES ]; then
        _fatal 'Persistent Keep Alives is not defined!'
        return 1
    fi

    if [ -z $ALLOWED_IPS ]; then
        _fatal 'Allowed IPs is not defined!'
        return 1
    fi

    echo "Adding WireGuard interface '$INTERFACE'."
    ip link add dev $INTERFACE type wireguard

    if [ -z $PRESHARED_KEYFILE ]; then
        echo "Starting WireGuard."
        wg set $INTERFACE \
            private-key $PRIVATE_KEYFILE \
            peer $PEER_PUBLIC_KEY \
            endpoint $PEER_ENDPOINT \
            persistent-keepalive $PERSISTENT_KEEPALIVES \
            allowed-ips $ALLOWED_IPS
    else
        echo "Starting WireGuard *WITH* a preshared key."
        wg set $INTERFACE \
            private-key $PRIVATE_KEYFILE \
            peer $PEER_PUBLIC_KEY \
            preshared-key $PRESHARED_KEYFILE \
            endpoint $PEER_ENDPOINT \
            persistent-keepalive $PERSISTENT_KEEPALIVES \
            allowed-ips $ALLOWED_IPS
    fi

    ip addr add $INTERFACE_ADDR dev $INTERFACE
    ip link set $INTERFACE up
    ip route add $ALLOWED_IPS dev $INTERFACE

    echo "WireGuard interface '$INTERFACE' has been added and configured."
}

run_cleanuphook() {

    ip link delete dev $INTERFACE

}
# vim:set syntax=sh tw=78: