run

#!/bin/bash

## The below is modified from https://github.com/activeeos/wireguard-docker

# Find a Wireguard interface
interfaces=`find /etc/wireguard -type f`
if [[ -z $interfaces ]]; then
    echo "$(date): ---FATAL--- Interface not found in /etc/wireguard" >&2
    exit 1
fi

for interface in $interfaces; do
    echo "$(date): ---INFO--- Starting Wireguard $interface"
    wg-quick up $interface
done


## Verify thet wireguard module is installed
wg_module=`find /lib/modules/$(uname -r) -type f \( -name '*.ko' -o -name '*.ko.xz' \) | grep -i wireguard`
echo "$(date): ---INFO--- Module output: $wg_module"

if [[ -z $wg_module ]]; then
    echo "$(date): ---INFO--- Wireguard module not installed..  Installing" >&2
    apt update ; apt install -y linux-headers-amd64 wireguard-dkms
else
    echo "$(date): ---INFO--- Wireguard module seems to be installed: $wg_module      Moving on... "
fi


# Add masquerade rule for NAT'ing VPN traffic bound for the Internet
if [[ $IPTABLES_MASQ -eq 1 ]]; then
    echo "$(date): ---INFO--- Adding iptables NAT rule"
    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
else
    echo "$(date): ---INFO--- IPTABLES_MASQ not set; not adding iptables NAT rule"
fi


## Do some DNS fixing
# write /etc/dnsmasq.conf
cat << 'EOF' > /etc/dnsmasq.conf
# dont use hosts nameservers
no-resolv

# listen on 127.0.0.1
listen-address=127.0.0.1
EOF

if [[ -n $LOCAL_TLD ]]; then
    echo "" >> /etc/dnsmasq.conf
    echo "$(date): ---INFO--- Writing \"server=/$LOCAL_TLD/127.0.0.11\" to /etc/dnsmasq.conf"
    echo "# send queries for $LOCAL_TLD domain to docker DNS" >> /etc/dnsmasq.conf
    echo server=/$LOCAL_TLD/127.0.0.11 >> /etc/dnsmasq.conf
fi

for service_name in $SERVICE_NAMES; do
    echo "$(date): ---INFO--- Writing \"server=/$service_name/127.0.0.11\" to /etc/dnsmasq.conf"
    echo server=/$service_name/127.0.0.11 >> /etc/dnsmasq.conf
done

echo "" >> /etc/dnsmasq.conf
echo "# send all other queries to interface DNS server" >> /etc/dnsmasq.conf
default_dns="1.1.1.1"
dns_found=""
# look for DNS addresses like DNS =
for interface in $interfaces; do
    dns_address=$(grep -Po '^DNS\s?=\s?\K[0-9\.]{7,}' $interface)
    if [[ -n $dns_address ]]; then
        dns_found="true"
        echo "$(date): ---INFO--- Writing \"server=$dns_address\" to /etc/dnsmasq.conf"
        echo server=$dns_address >> /etc/dnsmasq.conf
    fi
    dns_address=""
done
# if no DNS addresses were found, write the default address
if [[ -z $dns_found ]]; then
    echo "$(date): ---INFO--- No DNS address found in interfaces. Writing default address \"server=$default_dns\""
    echo server=$default_dns >> /etc/dnsmasq.conf
fi

# restart dnsmasq
/etc/init.d/dnsmasq restart

# write /etc/resolv.conf
cat << 'EOF' > /etc/resolv.conf
# set nameserver to 127.0.0.1 to use dnsmasq to resolve DNS
nameserver 127.0.0.1
EOF
if [[ -n $LOCAL_TLD ]]; then
    echo "search $LOCAL_TLD" >> /etc/resolv.conf
fi


# Fix route back to local network
if [[ -z $LOCAL_NETWORK ]]; then
    echo "$(date): ---INFO--- No network provided. Ignoring route back to local network"
else
    echo "$(date): ---INFO--- Adding route back to local network: $LOCAL_NETWORK"
    gw=$(ip route |awk '/default/ {print $3}')
    ip route add to $LOCAL_NETWORK via $gw dev eth0
fi

# Handle shutdown behavior
function finish {
    echo "$(date): ---INFO--- Shutting down Wireguard"
    for interface in $interfaces; do
        wg-quick down $interface
    done
    if [[ $IPTABLES_MASQ -eq 1 ]]; then
        iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
    fi

    exit 0
}

# Fill the expected and actual ips
function fill_ips {
    expected_ips=()
    for interface in $interfaces; do
        expected_ip=$(grep -Po '^Endpoint\s?=\s?\K[0-9\.]{7,}' $interface)
        expected_ips+=($expected_ip)
    done

    actual_ips=()
    actual_ip=$(wg | grep -Po 'endpoint:\s\K[^:]*')
    actual_ips+=($actual_ip)
}

trap finish SIGTERM SIGINT SIGQUIT

# Write /etc/hosts with service addresses to fix docker service  DNS resolution
function write_service_hosts {
    NETWORK_NAME=${NETWORK_NAME:-mediaserver-docker_default}
    service_hosts=$(docker network inspect $NETWORK_NAME) || true
    if [[ ${service_hosts[@]+"${service_hosts[@]}"} && $service_hosts != "[]" ]]; then
        echo "$(date): ---INFO--- Adding services to /etc/hosts"
        service_hosts=$(echo $service_hosts | jq -r '.[0].Containers[] | .IPv4Address + " " + .Name | gsub("/[0-9]{1,}"; "")')
        echo "$service_hosts"
        echo "$service_hosts" >> /etc/hosts
    else
        echo "$(date): ---WARNING--- No response from docker network inspect. Did you mount docker.sock?"
    fi
}

fill_ips
echo "$(date): ---INFO--- Endpoint in config: $expected_ips"
echo "$(date): ---INFO--- Active EndPoint : $actual_ips"

write_service_hosts

# Check IP address every 10 seconds
retry=true
while $retry
do
    sleep 10;

    fill_ips
    if [[ $expected_ips != $actual_ips ]];
    then
        # Make one attempt to restart the wireguard interface if the IP is incorrect
        echo "$(date): ---WARNING--- Expected IP to be $expected_ips but found $actual_ips. Attempting to restart wireguard."
        for interface in $interfaces; do
            wg-quick down $interface; wg-quick up $interface
        done

        fill_ips
        if [[ $expected_ips != $actual_ips ]];
        then
            # Exit the container if the IP is still incorrect after wireguard restart
            echo "$(date): ---WARNING--- Expected IP to be $expected_ips but found $actual_ips. Activating killswitch."
            retry=false
        fi
    fi
done