Compare commits
5 Commits
6d6cffa42c
...
1c1d5e370e
| Author | SHA1 | Date | |
|---|---|---|---|
| 1c1d5e370e | |||
| 383569de92 | |||
| 69a8285c8c | |||
| 454e811594 | |||
| b6ff803e5d |
@@ -1 +1,2 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcethx5tVJWXTj4GjG7h75Fr3IKrwdkpBRc8sN6uRrA andrey.perliev@gmail.com
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjS7Ii3+TQcZcUkzw4kHMqZ0omyBHPl6uD9y4c4ZWBM norn@parahub-ng
|
||||
|
||||
@@ -2,9 +2,16 @@
|
||||
# Parahub Mesh Node — Zero-Touch First Boot Configuration
|
||||
# This script runs once on first boot via uci-defaults mechanism.
|
||||
# It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
|
||||
#
|
||||
# Roles:
|
||||
# bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
|
||||
# bee (L2 Transport) — minimal: batman-adv mesh relay, heartbeat
|
||||
|
||||
set -e
|
||||
|
||||
# Read firmware role (written by build.sh)
|
||||
ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "bumblebee")
|
||||
|
||||
# ============================================================================
|
||||
# 1. IDENTITY GENERATION
|
||||
# ============================================================================
|
||||
@@ -55,6 +62,7 @@ mkdir -p /etc/parahub
|
||||
cat > /etc/parahub/keys <<KEYS_EOF
|
||||
# Parahub Mesh Node Keys — Generated at first boot
|
||||
# Node: ${HOSTNAME}
|
||||
# Role: ${ROLE}
|
||||
# Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
PRIVATE_WIFI_KEY=${PRIVATE_KEY}
|
||||
MESH_SAE_KEY=${MESH_KEY}
|
||||
@@ -69,8 +77,9 @@ chmod 600 /etc/parahub/keys
|
||||
# 4. NETWORK CONFIGURATION
|
||||
# ============================================================================
|
||||
|
||||
# Clean existing network config (preserve wan)
|
||||
uci batch <<-NET_EOF
|
||||
if [ "$ROLE" = "bee" ]; then
|
||||
# --- Bee: minimal network (bat0 gw_mode=client, no GRE6, no guest, no policy routing) ---
|
||||
uci batch <<-NET_EOF
|
||||
# --- loopback ---
|
||||
set network.loopback=interface
|
||||
set network.loopback.device='lo'
|
||||
@@ -78,14 +87,65 @@ set network.loopback.proto='static'
|
||||
set network.loopback.ipaddr='127.0.0.1'
|
||||
set network.loopback.netmask='255.0.0.0'
|
||||
|
||||
# --- bat0 (batman-adv virtual interface) ---
|
||||
# --- bat0 (batman-adv, client mode — uses Bumblebee as gateway) ---
|
||||
set network.bat0=interface
|
||||
set network.bat0.proto='batadv'
|
||||
set network.bat0.routing_algo='BATMAN_V'
|
||||
set network.bat0.aggregated_ogms='1'
|
||||
set network.bat0.bridge_loop_avoidance='1'
|
||||
set network.bat0.distributed_arp_table='1'
|
||||
set network.bat0.gw_mode='off'
|
||||
set network.bat0.gw_mode='client'
|
||||
set network.bat0.hop_penalty='15'
|
||||
set network.bat0.orig_interval='1000'
|
||||
|
||||
# --- bat0 hardif for mesh0 (2.4GHz mesh) ---
|
||||
set network.bat0_hardif_mesh0=interface
|
||||
set network.bat0_hardif_mesh0.proto='batadv_hardif'
|
||||
set network.bat0_hardif_mesh0.master='bat0'
|
||||
|
||||
# --- bat0 hardif for mesh1 (5GHz mesh) ---
|
||||
set network.bat0_hardif_mesh1=interface
|
||||
set network.bat0_hardif_mesh1.proto='batadv_hardif'
|
||||
set network.bat0_hardif_mesh1.master='bat0'
|
||||
|
||||
# --- private bridge (bat0 + LAN ethernet) ---
|
||||
set network.private_dev=device
|
||||
set network.private_dev.type='bridge'
|
||||
set network.private_dev.name='br-private'
|
||||
delete network.private_dev.ports
|
||||
add_list network.private_dev.ports='bat0'
|
||||
add_list network.private_dev.ports='eth0'
|
||||
|
||||
set network.private=interface
|
||||
set network.private.device='br-private'
|
||||
set network.private.proto='static'
|
||||
set network.private.ipaddr='${PRIV_IP}'
|
||||
set network.private.netmask='255.255.255.0'
|
||||
|
||||
# --- wan (DHCP, create if missing) ---
|
||||
set network.wan=interface
|
||||
set network.wan.device='eth1'
|
||||
set network.wan.proto='dhcp'
|
||||
NET_EOF
|
||||
|
||||
else
|
||||
# --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
|
||||
uci batch <<-NET_EOF
|
||||
# --- loopback ---
|
||||
set network.loopback=interface
|
||||
set network.loopback.device='lo'
|
||||
set network.loopback.proto='static'
|
||||
set network.loopback.ipaddr='127.0.0.1'
|
||||
set network.loopback.netmask='255.0.0.0'
|
||||
|
||||
# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
|
||||
set network.bat0=interface
|
||||
set network.bat0.proto='batadv'
|
||||
set network.bat0.routing_algo='BATMAN_V'
|
||||
set network.bat0.aggregated_ogms='1'
|
||||
set network.bat0.bridge_loop_avoidance='1'
|
||||
set network.bat0.distributed_arp_table='1'
|
||||
set network.bat0.gw_mode='server'
|
||||
set network.bat0.hop_penalty='15'
|
||||
set network.bat0.orig_interval='1000'
|
||||
|
||||
@@ -132,7 +192,16 @@ set network.vpn_tunnel.ipaddr='172.16.0.2'
|
||||
set network.vpn_tunnel.netmask='255.255.255.0'
|
||||
set network.vpn_tunnel.gateway='172.16.0.1'
|
||||
set network.vpn_tunnel.mtu='1400'
|
||||
set network.vpn_tunnel.ip4table='100'
|
||||
|
||||
# --- Policy routing: guest traffic → VPN table 100 ---
|
||||
add network rule
|
||||
set network.@rule[-1].src='${GUEST_SUBNET}/24'
|
||||
set network.@rule[-1].lookup='100'
|
||||
set network.@rule[-1].priority='100'
|
||||
NET_EOF
|
||||
fi
|
||||
|
||||
uci commit network
|
||||
|
||||
# ============================================================================
|
||||
@@ -195,9 +264,20 @@ set wireless.mesh_2g.key='${MESH_KEY}'
|
||||
set wireless.mesh_2g.network='bat0_hardif_mesh0'
|
||||
WIFI_2G_MESH
|
||||
|
||||
# Public AP on 2.4GHz (better range) — OWE transition mode
|
||||
# Devices that support OWE get encrypted; legacy devices fall back to open
|
||||
uci batch <<-WIFI_2G_PUB
|
||||
if [ "$ROLE" = "bee" ]; then
|
||||
# Bee: Parahub_Free on private bridge (no guest isolation)
|
||||
uci batch <<-WIFI_2G_PUB
|
||||
set wireless.public_2g=wifi-iface
|
||||
set wireless.public_2g.device='${RADIO_2G}'
|
||||
set wireless.public_2g.mode='ap'
|
||||
set wireless.public_2g.ssid='${PUBLIC_SSID}'
|
||||
set wireless.public_2g.encryption='owe'
|
||||
set wireless.public_2g.owe_transition='1'
|
||||
set wireless.public_2g.network='private'
|
||||
WIFI_2G_PUB
|
||||
else
|
||||
# Bumblebee: Parahub_Free on guest network (isolated)
|
||||
uci batch <<-WIFI_2G_PUB
|
||||
set wireless.public_2g=wifi-iface
|
||||
set wireless.public_2g.device='${RADIO_2G}'
|
||||
set wireless.public_2g.mode='ap'
|
||||
@@ -207,6 +287,7 @@ set wireless.public_2g.owe_transition='1'
|
||||
set wireless.public_2g.isolate='1'
|
||||
set wireless.public_2g.network='guest'
|
||||
WIFI_2G_PUB
|
||||
fi
|
||||
fi
|
||||
|
||||
# --- 5GHz radio: mesh backhaul + Private AP ---
|
||||
@@ -247,7 +328,52 @@ while uci -q delete firewall.@forwarding[0]; do :; done
|
||||
while uci -q delete firewall.@rule[0]; do :; done
|
||||
while uci -q delete firewall.@redirect[0]; do :; done
|
||||
|
||||
uci batch <<-FW_EOF
|
||||
if [ "$ROLE" = "bee" ]; then
|
||||
# --- Bee: minimal firewall (lan + wan only) ---
|
||||
uci batch <<-FW_EOF
|
||||
# --- Zone: lan (private network) ---
|
||||
add firewall zone
|
||||
set firewall.@zone[-1].name='lan'
|
||||
set firewall.@zone[-1].input='ACCEPT'
|
||||
set firewall.@zone[-1].output='ACCEPT'
|
||||
set firewall.@zone[-1].forward='ACCEPT'
|
||||
add_list firewall.@zone[-1].network='private'
|
||||
|
||||
# --- Zone: wan ---
|
||||
add firewall zone
|
||||
set firewall.@zone[-1].name='wan'
|
||||
set firewall.@zone[-1].input='REJECT'
|
||||
set firewall.@zone[-1].output='ACCEPT'
|
||||
set firewall.@zone[-1].forward='REJECT'
|
||||
set firewall.@zone[-1].masq='1'
|
||||
set firewall.@zone[-1].mtu_fix='1'
|
||||
add_list firewall.@zone[-1].network='wan'
|
||||
|
||||
# --- Forwarding: lan → wan ---
|
||||
add firewall forwarding
|
||||
set firewall.@forwarding[-1].src='lan'
|
||||
set firewall.@forwarding[-1].dest='wan'
|
||||
|
||||
# --- Standard WAN input rules ---
|
||||
add firewall rule
|
||||
set firewall.@rule[-1].name='Allow-DHCP-Renew'
|
||||
set firewall.@rule[-1].src='wan'
|
||||
set firewall.@rule[-1].proto='udp'
|
||||
set firewall.@rule[-1].dest_port='68'
|
||||
set firewall.@rule[-1].target='ACCEPT'
|
||||
set firewall.@rule[-1].family='ipv4'
|
||||
|
||||
add firewall rule
|
||||
set firewall.@rule[-1].name='Allow-Ping'
|
||||
set firewall.@rule[-1].src='wan'
|
||||
set firewall.@rule[-1].proto='icmp'
|
||||
set firewall.@rule[-1].icmp_type='echo-request'
|
||||
set firewall.@rule[-1].target='ACCEPT'
|
||||
FW_EOF
|
||||
|
||||
else
|
||||
# --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
|
||||
uci batch <<-FW_EOF
|
||||
# --- Zone: lan (private network) ---
|
||||
add firewall zone
|
||||
set firewall.@zone[-1].name='lan'
|
||||
@@ -356,6 +482,8 @@ set firewall.@rule[-1].proto='icmp'
|
||||
set firewall.@rule[-1].icmp_type='echo-request'
|
||||
set firewall.@rule[-1].target='ACCEPT'
|
||||
FW_EOF
|
||||
fi
|
||||
|
||||
uci commit firewall
|
||||
|
||||
# ============================================================================
|
||||
@@ -366,7 +494,18 @@ uci commit firewall
|
||||
uci -q delete dhcp.lan 2>/dev/null || true
|
||||
uci -q delete dhcp.guest 2>/dev/null || true
|
||||
|
||||
uci batch <<-DHCP_EOF
|
||||
if [ "$ROLE" = "bee" ]; then
|
||||
# Bee: private DHCP only (no guest pool)
|
||||
uci batch <<-DHCP_EOF
|
||||
set dhcp.private=dhcp
|
||||
set dhcp.private.interface='private'
|
||||
set dhcp.private.start='100'
|
||||
set dhcp.private.limit='150'
|
||||
set dhcp.private.leasetime='12h'
|
||||
DHCP_EOF
|
||||
else
|
||||
# Bumblebee: private + guest DHCP
|
||||
uci batch <<-DHCP_EOF
|
||||
# --- Private DHCP ---
|
||||
set dhcp.private=dhcp
|
||||
set dhcp.private.interface='private'
|
||||
@@ -381,35 +520,39 @@ set dhcp.guest.start='100'
|
||||
set dhcp.guest.limit='50'
|
||||
set dhcp.guest.leasetime='1h'
|
||||
DHCP_EOF
|
||||
fi
|
||||
|
||||
uci commit dhcp
|
||||
|
||||
# ============================================================================
|
||||
# 8. SQM TRAFFIC SHAPING (guest 512 kbps limit)
|
||||
# 8. SPEED CONTROL (Bumblebee only — per-client shaping, paid Lightning upgrade)
|
||||
# ============================================================================
|
||||
|
||||
# Find the guest interface device name (will be set after network restart)
|
||||
# SQM watches the interface name from the network config
|
||||
if [ "$ROLE" != "bee" ]; then
|
||||
chmod +x /usr/bin/parahub-speed-control
|
||||
|
||||
uci batch <<-SQM_EOF
|
||||
set sqm.guest=queue
|
||||
set sqm.guest.enabled='1'
|
||||
set sqm.guest.interface='br-guest'
|
||||
set sqm.guest.download='512'
|
||||
set sqm.guest.upload='512'
|
||||
set sqm.guest.qdisc='cake'
|
||||
set sqm.guest.script='piece_of_cake.qos'
|
||||
set sqm.guest.linklayer='ethernet'
|
||||
set sqm.guest.overhead='44'
|
||||
SQM_EOF
|
||||
uci commit sqm
|
||||
# Create init.d service for speed control
|
||||
cat > /etc/init.d/parahub-speed <<'INITEOF'
|
||||
#!/bin/sh /etc/rc.common
|
||||
START=99
|
||||
start() { /usr/bin/parahub-speed-control init; }
|
||||
stop() {
|
||||
tc qdisc del dev br-guest root 2>/dev/null
|
||||
tc qdisc del dev br-guest ingress 2>/dev/null
|
||||
ip link del ifb-guest 2>/dev/null
|
||||
nft delete table inet parahub 2>/dev/null
|
||||
}
|
||||
INITEOF
|
||||
chmod +x /etc/init.d/parahub-speed
|
||||
/etc/init.d/parahub-speed enable
|
||||
fi
|
||||
|
||||
# ============================================================================
|
||||
# 9. DNS-OVER-HTTPS (guest DNS privacy)
|
||||
# 9. DNS-OVER-HTTPS (Bumblebee only — guest DNS privacy)
|
||||
# ============================================================================
|
||||
|
||||
# https-dns-proxy: local DoH resolver for guest DNS queries
|
||||
# Guest DNS is hijacked via firewall redirect to this resolver
|
||||
uci batch <<-DOH_EOF
|
||||
if [ "$ROLE" != "bee" ]; then
|
||||
uci batch <<-DOH_EOF
|
||||
set https-dns-proxy.main=main
|
||||
set https-dns-proxy.main.doh_paramters='-4'
|
||||
set https-dns-proxy.main.listen_addr='0.0.0.0'
|
||||
@@ -420,16 +563,17 @@ set https-dns-proxy.cloudflare.resolver_url='https://1.1.1.1/dns-query'
|
||||
set https-dns-proxy.cloudflare.listen_addr='127.0.0.1'
|
||||
set https-dns-proxy.cloudflare.listen_port='5053'
|
||||
DOH_EOF
|
||||
uci commit https-dns-proxy
|
||||
uci commit https-dns-proxy
|
||||
|
||||
# Configure dnsmasq to use DoH for upstream
|
||||
uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
|
||||
uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
|
||||
uci set dhcp.@dnsmasq[0].noresolv='1'
|
||||
uci commit dhcp
|
||||
# Configure dnsmasq to use DoH for upstream
|
||||
uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
|
||||
uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
|
||||
uci set dhcp.@dnsmasq[0].noresolv='1'
|
||||
uci commit dhcp
|
||||
|
||||
# Enable https-dns-proxy service
|
||||
/etc/init.d/https-dns-proxy enable 2>/dev/null || true
|
||||
# Enable https-dns-proxy service
|
||||
/etc/init.d/https-dns-proxy enable 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# ============================================================================
|
||||
# 10. SYSTEM SETTINGS
|
||||
@@ -446,46 +590,68 @@ SYS_EOF
|
||||
uci commit system
|
||||
|
||||
# ============================================================================
|
||||
# 11. YGGDRASIL OVERLAY NETWORK
|
||||
# 11. YGGDRASIL OVERLAY NETWORK (Bumblebee only)
|
||||
# ============================================================================
|
||||
|
||||
# Generate unique keys for this node
|
||||
yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
|
||||
if [ "$ROLE" != "bee" ]; then
|
||||
# Generate unique keys for this node
|
||||
yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
|
||||
|
||||
# Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
|
||||
sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
|
||||
# Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
|
||||
sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
|
||||
|
||||
# UCI network interface for yggdrasil TUN
|
||||
uci batch <<-YGG_EOF
|
||||
# UCI network interface for yggdrasil TUN
|
||||
uci batch <<-YGG_EOF
|
||||
set network.yggdrasil=interface
|
||||
set network.yggdrasil.device='ygg0'
|
||||
set network.yggdrasil.proto='none'
|
||||
YGG_EOF
|
||||
uci commit network
|
||||
uci commit network
|
||||
|
||||
# Add yggdrasil to LAN zone (mesh nodes trust each other)
|
||||
uci add_list firewall.@zone[0].network='yggdrasil'
|
||||
uci commit firewall
|
||||
# Add yggdrasil to LAN zone (mesh nodes trust each other)
|
||||
uci add_list firewall.@zone[0].network='yggdrasil'
|
||||
uci commit firewall
|
||||
|
||||
# Enable yggdrasil service
|
||||
/etc/init.d/yggdrasil enable
|
||||
# Enable yggdrasil service
|
||||
/etc/init.d/yggdrasil enable
|
||||
|
||||
# Save yggdrasil address to node keys file
|
||||
YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
|
||||
echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
|
||||
# Save yggdrasil address to node keys file
|
||||
YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
|
||||
echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
|
||||
else
|
||||
YGG_ADDR="none"
|
||||
fi
|
||||
|
||||
# ============================================================================
|
||||
# 12. FINAL
|
||||
# 12. HEARTBEAT (phone-home to Parahub cloud)
|
||||
# ============================================================================
|
||||
|
||||
chmod +x /usr/bin/parahub-heartbeat
|
||||
|
||||
# Cron: every 5 minutes
|
||||
echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
|
||||
/etc/init.d/cron enable
|
||||
|
||||
# ============================================================================
|
||||
# 13. FINAL
|
||||
# ============================================================================
|
||||
|
||||
# Log completion
|
||||
logger -t parahub-mesh "First boot configuration complete"
|
||||
logger -t parahub-mesh "First boot configuration complete (role: ${ROLE})"
|
||||
logger -t parahub-mesh "Hostname: ${HOSTNAME}"
|
||||
logger -t parahub-mesh "Role: ${ROLE}"
|
||||
logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
|
||||
logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
|
||||
logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
|
||||
logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
|
||||
logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
|
||||
logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
|
||||
|
||||
if [ "$ROLE" = "bee" ]; then
|
||||
logger -t parahub-mesh "Parahub_Free: bridged to private (no guest isolation)"
|
||||
logger -t parahub-mesh "bat0 gw_mode: client (uses Bumblebee as gateway)"
|
||||
else
|
||||
logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
|
||||
logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
|
||||
logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
|
||||
logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
|
||||
logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
|
||||
logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
71
files/usr/bin/parahub-heartbeat
Executable file
71
files/usr/bin/parahub-heartbeat
Executable file
@@ -0,0 +1,71 @@
|
||||
#!/bin/sh
|
||||
# Phone-home heartbeat to Parahub cloud
|
||||
PARAHUB_API_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/api/v1/iot/mesh/heartbeat"
|
||||
PARAHUB_API_PUBLIC="https://parahub.io/api/v1/iot/mesh/heartbeat"
|
||||
HEARTBEAT_KEY="IqPosrcpTQKSbLHxOG3iLTl_K2MsDxvd"
|
||||
|
||||
# Read firmware role
|
||||
ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "unknown")
|
||||
|
||||
# Read identity from /etc/parahub/keys
|
||||
. /etc/parahub/keys 2>/dev/null
|
||||
MAC="${NODE_MAC:-$(cat /sys/class/net/br-lan/address 2>/dev/null)}"
|
||||
HOSTNAME="$(uci -q get system.@system[0].hostname)"
|
||||
YGG_ADDR="${YGGDRASIL_ADDRESS:-unknown}"
|
||||
SSID="${PRIVATE_SSID:-unknown}"
|
||||
UPTIME="$(cut -d. -f1 /proc/uptime)"
|
||||
|
||||
# Get mesh IP (br-private address)
|
||||
MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
|
||||
MESH_IP="${MESH_IP:-unknown}"
|
||||
|
||||
# Detect hardware from board_name
|
||||
HW=$(cat /tmp/sysinfo/board_name 2>/dev/null)
|
||||
case "$HW" in
|
||||
glinet,gl-axt1800) HW="axt1800" ;;
|
||||
glinet,gl-mt3000) HW="mt3000" ;;
|
||||
glinet,gl-mt6000) HW="mt6000" ;;
|
||||
xiaomi,redmi-router-ax6s) HW="ax6s" ;;
|
||||
asus,rt-ax53u) HW="ax53u" ;;
|
||||
glinet,gl-ar300m16) HW="ar300m16" ;;
|
||||
cudy,wr3000-v1) HW="wr3000" ;;
|
||||
*) HW="${HW:-unknown}" ;;
|
||||
esac
|
||||
|
||||
PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"25.12.0-rc4\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\"}"
|
||||
|
||||
RESPONSE=""
|
||||
|
||||
if [ "$ROLE" = "bee" ]; then
|
||||
# Bee: no yggdrasil, use public URL only
|
||||
RESPONSE=$(curl -s -m 10 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${HEARTBEAT_KEY}" \
|
||||
-d "$PAYLOAD" \
|
||||
"${PARAHUB_API_PUBLIC}" 2>/dev/null)
|
||||
else
|
||||
# Bumblebee: try yggdrasil first, fallback to public
|
||||
if ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
|
||||
RESPONSE=$(curl -s -m 10 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${HEARTBEAT_KEY}" \
|
||||
-d "$PAYLOAD" \
|
||||
"${PARAHUB_API_YGG}" 2>/dev/null)
|
||||
else
|
||||
RESPONSE=$(curl -s -m 10 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${HEARTBEAT_KEY}" \
|
||||
-d "$PAYLOAD" \
|
||||
"${PARAHUB_API_PUBLIC}" 2>/dev/null)
|
||||
fi
|
||||
fi
|
||||
|
||||
# Sync paid_clients to speed control (Bumblebee only)
|
||||
if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPONSE" ]; then
|
||||
PAID_IPS=$(echo "$RESPONSE" | jsonfilter -e '$.paid_clients[*]' 2>/dev/null)
|
||||
# Flush and re-add all paid IPs
|
||||
parahub-speed-control flush
|
||||
for IP in $PAID_IPS; do
|
||||
parahub-speed-control add "$IP"
|
||||
done
|
||||
fi
|
||||
297
files/usr/bin/parahub-mullvad
Executable file
297
files/usr/bin/parahub-mullvad
Executable file
@@ -0,0 +1,297 @@
|
||||
#!/bin/sh
|
||||
# Parahub Mesh — Local Mullvad WireGuard Manager
|
||||
#
|
||||
# Allows the node owner to run Mullvad directly on the router.
|
||||
# Guest traffic routes through the local WireGuard tunnel instead of
|
||||
# the default GRE6→VPS path, giving lower latency and using the
|
||||
# nearest Mullvad server.
|
||||
#
|
||||
# Usage:
|
||||
# parahub-mullvad setup <account_key> [country_code]
|
||||
# parahub-mullvad status
|
||||
# parahub-mullvad remove
|
||||
|
||||
set -e
|
||||
|
||||
PARAHUB_DIR="/etc/parahub"
|
||||
ACCOUNT_FILE="$PARAHUB_DIR/mullvad_account"
|
||||
|
||||
# ============================================================================
|
||||
# Helpers
|
||||
# ============================================================================
|
||||
|
||||
# Find the firewall forwarding index where src=guest
|
||||
find_guest_forwarding() {
|
||||
local idx=0
|
||||
while uci -q get "firewall.@forwarding[$idx]" >/dev/null 2>&1; do
|
||||
local src=$(uci -q get "firewall.@forwarding[$idx].src")
|
||||
if [ "$src" = "guest" ]; then
|
||||
echo "$idx"
|
||||
return 0
|
||||
fi
|
||||
idx=$((idx + 1))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# Find firewall zone index by name
|
||||
find_zone_index() {
|
||||
local name="$1"
|
||||
local idx=0
|
||||
while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
|
||||
local zname=$(uci -q get "firewall.@zone[$idx].name")
|
||||
if [ "$zname" = "$name" ]; then
|
||||
echo "$idx"
|
||||
return 0
|
||||
fi
|
||||
idx=$((idx + 1))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# setup <account_key> [country_code]
|
||||
# ============================================================================
|
||||
|
||||
cmd_setup() {
|
||||
local ACCOUNT="$1"
|
||||
local COUNTRY="$2"
|
||||
|
||||
if [ -z "$ACCOUNT" ]; then
|
||||
echo "Usage: parahub-mullvad setup <account_key> [country_code]"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " parahub-mullvad setup 3032661375392987 pt # Portugal"
|
||||
echo " parahub-mullvad setup 3032661375392987 de # Germany"
|
||||
echo " parahub-mullvad setup 3032661375392987 # Auto-detect"
|
||||
echo ""
|
||||
echo "Countries: us gb de nl se pt fr es ch at it jp sg br ..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Auto-detect country from WAN IP
|
||||
if [ -z "$COUNTRY" ]; then
|
||||
echo "Auto-detecting country from WAN IP..."
|
||||
COUNTRY=$(curl -s --max-time 5 https://ipinfo.io/country 2>/dev/null | tr 'A-Z' 'a-z')
|
||||
if [ -z "$COUNTRY" ] || [ ${#COUNTRY} -ne 2 ]; then
|
||||
echo "Error: Could not detect country."
|
||||
echo "Specify manually: parahub-mullvad setup $ACCOUNT <country>"
|
||||
exit 1
|
||||
fi
|
||||
echo "Detected: $COUNTRY"
|
||||
fi
|
||||
|
||||
COUNTRY=$(echo "$COUNTRY" | tr 'A-Z' 'a-z')
|
||||
|
||||
# --- Step 1: Generate WireGuard keys ---
|
||||
echo "Generating WireGuard keys..."
|
||||
umask 077
|
||||
wg genkey > "$PARAHUB_DIR/wg_private.key"
|
||||
wg pubkey < "$PARAHUB_DIR/wg_private.key" > "$PARAHUB_DIR/wg_public.key"
|
||||
|
||||
PRIVKEY=$(cat "$PARAHUB_DIR/wg_private.key")
|
||||
PUBKEY=$(cat "$PARAHUB_DIR/wg_public.key")
|
||||
|
||||
# --- Step 2: Register with Mullvad API ---
|
||||
echo "Registering key with Mullvad..."
|
||||
RESULT=$(curl -s --max-time 15 -X POST https://api.mullvad.net/wg/ \
|
||||
-d "account=$ACCOUNT" \
|
||||
-d "pubkey=$PUBKEY")
|
||||
|
||||
if echo "$RESULT" | grep -q "^[0-9]"; then
|
||||
MULLVAD_IPV4=$(echo "$RESULT" | cut -d',' -f1)
|
||||
echo "Mullvad IP: $MULLVAD_IPV4"
|
||||
else
|
||||
echo "Error from Mullvad: $RESULT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# --- Step 3: Find server in target country ---
|
||||
echo "Finding Mullvad server in '$COUNTRY'..."
|
||||
curl -s --max-time 15 https://api.mullvad.net/www/relays/wireguard/ | \
|
||||
tr '{' '\n' | \
|
||||
grep "\"country_code\":\"${COUNTRY}\"" | \
|
||||
grep '"active":true' | \
|
||||
head -1 > /tmp/mullvad_relay.tmp
|
||||
|
||||
if [ ! -s /tmp/mullvad_relay.tmp ]; then
|
||||
echo "Error: No active WireGuard server for country '$COUNTRY'"
|
||||
rm -f /tmp/mullvad_relay.tmp
|
||||
exit 1
|
||||
fi
|
||||
|
||||
SERVER_IP=$(sed 's/.*"ipv4_addr_in":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
|
||||
SERVER_PUBKEY=$(sed 's/.*"pubkey":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
|
||||
SERVER_HOST=$(sed 's/.*"hostname":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
|
||||
rm -f /tmp/mullvad_relay.tmp
|
||||
|
||||
echo "Server: $SERVER_HOST ($SERVER_IP)"
|
||||
|
||||
# --- Step 4: Clean previous config ---
|
||||
uci -q delete network.mullvad_local 2>/dev/null || true
|
||||
while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
|
||||
|
||||
# --- Step 5: Create WireGuard interface (routes in table 100) ---
|
||||
echo "Configuring WireGuard..."
|
||||
uci batch <<-WG_EOF
|
||||
set network.mullvad_local=interface
|
||||
set network.mullvad_local.proto='wireguard'
|
||||
set network.mullvad_local.private_key='${PRIVKEY}'
|
||||
add_list network.mullvad_local.addresses='${MULLVAD_IPV4}'
|
||||
set network.mullvad_local.mtu='1420'
|
||||
set network.mullvad_local.ip4table='100'
|
||||
|
||||
add network wireguard_mullvad_local
|
||||
set network.@wireguard_mullvad_local[-1].public_key='${SERVER_PUBKEY}'
|
||||
set network.@wireguard_mullvad_local[-1].endpoint_host='${SERVER_IP}'
|
||||
set network.@wireguard_mullvad_local[-1].endpoint_port='51820'
|
||||
add_list network.@wireguard_mullvad_local[-1].allowed_ips='0.0.0.0/0'
|
||||
set network.@wireguard_mullvad_local[-1].route_allowed_ips='1'
|
||||
set network.@wireguard_mullvad_local[-1].persistent_keepalive='25'
|
||||
WG_EOF
|
||||
|
||||
# Disable GRE6 tunnel (WG replaces it in table 100)
|
||||
uci set network.vpn_tunnel.auto='0'
|
||||
uci commit network
|
||||
|
||||
# --- Step 6: Firewall zone for mullvad_local ---
|
||||
local zone_idx
|
||||
if zone_idx=$(find_zone_index "mullvad_local"); then
|
||||
uci delete "firewall.@zone[$zone_idx]"
|
||||
fi
|
||||
|
||||
uci batch <<-FW_EOF
|
||||
add firewall zone
|
||||
set firewall.@zone[-1].name='mullvad_local'
|
||||
set firewall.@zone[-1].input='REJECT'
|
||||
set firewall.@zone[-1].output='ACCEPT'
|
||||
set firewall.@zone[-1].forward='REJECT'
|
||||
set firewall.@zone[-1].masq='1'
|
||||
set firewall.@zone[-1].mtu_fix='1'
|
||||
add_list firewall.@zone[-1].network='mullvad_local'
|
||||
FW_EOF
|
||||
|
||||
# Switch guest forwarding to mullvad_local
|
||||
local fwd_idx
|
||||
if fwd_idx=$(find_guest_forwarding); then
|
||||
uci set "firewall.@forwarding[$fwd_idx].dest=mullvad_local"
|
||||
fi
|
||||
uci commit firewall
|
||||
|
||||
# --- Step 7: Save config ---
|
||||
cat > "$ACCOUNT_FILE" <<-ACCT_EOF
|
||||
MULLVAD_ACCOUNT=${ACCOUNT}
|
||||
MULLVAD_COUNTRY=${COUNTRY}
|
||||
MULLVAD_SERVER=${SERVER_HOST}
|
||||
MULLVAD_SERVER_IP=${SERVER_IP}
|
||||
MULLVAD_LOCAL_IP=${MULLVAD_IPV4}
|
||||
ACCT_EOF
|
||||
chmod 600 "$ACCOUNT_FILE"
|
||||
|
||||
# --- Step 8: Apply ---
|
||||
echo "Restarting network..."
|
||||
/etc/init.d/network restart
|
||||
/etc/init.d/firewall restart
|
||||
|
||||
echo ""
|
||||
echo "Done! Guest traffic now routes directly through Mullvad."
|
||||
echo "Server: $SERVER_HOST ($COUNTRY)"
|
||||
echo "Test: connect to Parahub_Free, visit https://am.i.mullvad.net"
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# status
|
||||
# ============================================================================
|
||||
|
||||
cmd_status() {
|
||||
echo "=== Parahub Mesh VPN Status ==="
|
||||
echo ""
|
||||
|
||||
if [ -f "$ACCOUNT_FILE" ]; then
|
||||
echo "Mode: LOCAL MULLVAD (direct)"
|
||||
cat "$ACCOUNT_FILE"
|
||||
echo ""
|
||||
wg show mullvad_local 2>/dev/null || echo "WireGuard interface: not up"
|
||||
else
|
||||
echo "Mode: VPS GATEWAY (GRE6 tunnel)"
|
||||
echo "VPS: 91.98.123.238 -> Mullvad Portugal"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Guest forwarding:"
|
||||
local fwd_idx
|
||||
if fwd_idx=$(find_guest_forwarding); then
|
||||
echo " guest -> $(uci -q get "firewall.@forwarding[$fwd_idx].dest")"
|
||||
fi
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# remove
|
||||
# ============================================================================
|
||||
|
||||
cmd_remove() {
|
||||
if [ ! -f "$ACCOUNT_FILE" ]; then
|
||||
echo "No local Mullvad configured. Nothing to remove."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Removing local Mullvad, reverting to VPS gateway..."
|
||||
|
||||
# Remove WireGuard interface
|
||||
uci -q delete network.mullvad_local 2>/dev/null || true
|
||||
while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
|
||||
|
||||
# Re-enable GRE6 tunnel
|
||||
uci -q delete network.vpn_tunnel.auto 2>/dev/null || true
|
||||
uci commit network
|
||||
|
||||
# Remove firewall zone
|
||||
local zone_idx
|
||||
if zone_idx=$(find_zone_index "mullvad_local"); then
|
||||
uci delete "firewall.@zone[$zone_idx]"
|
||||
fi
|
||||
|
||||
# Switch guest forwarding back to vpn_tunnel
|
||||
local fwd_idx
|
||||
if fwd_idx=$(find_guest_forwarding); then
|
||||
uci set "firewall.@forwarding[$fwd_idx].dest=vpn_tunnel"
|
||||
fi
|
||||
uci commit firewall
|
||||
|
||||
# Clean up files
|
||||
rm -f "$PARAHUB_DIR/wg_private.key" "$PARAHUB_DIR/wg_public.key" "$ACCOUNT_FILE"
|
||||
|
||||
echo "Restarting network..."
|
||||
/etc/init.d/network restart
|
||||
/etc/init.d/firewall restart
|
||||
|
||||
echo "Done! Guest traffic now routes through VPS gateway."
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# Main
|
||||
# ============================================================================
|
||||
|
||||
case "${1:-}" in
|
||||
setup)
|
||||
cmd_setup "$2" "${3:-}"
|
||||
;;
|
||||
status)
|
||||
cmd_status
|
||||
;;
|
||||
remove)
|
||||
cmd_remove
|
||||
;;
|
||||
*)
|
||||
echo "Parahub Mesh — Mullvad WireGuard Manager"
|
||||
echo ""
|
||||
echo "Commands:"
|
||||
echo " parahub-mullvad setup <account_key> [country]"
|
||||
echo " parahub-mullvad status"
|
||||
echo " parahub-mullvad remove"
|
||||
echo ""
|
||||
echo "By default, guest traffic goes through the VPS gateway."
|
||||
echo "With 'setup', it routes directly through your own Mullvad"
|
||||
echo "account — faster, and uses the nearest server."
|
||||
;;
|
||||
esac
|
||||
74
files/usr/bin/parahub-speed-control
Executable file
74
files/usr/bin/parahub-speed-control
Executable file
@@ -0,0 +1,74 @@
|
||||
#!/bin/sh
|
||||
# Parahub Mesh — Per-client speed control
|
||||
# Free tier: 512kbps (default), Paid tier: full speed (via nftables set + tc HTB)
|
||||
#
|
||||
# Usage: parahub-speed-control init|add <ip>|remove <ip>|list|flush
|
||||
|
||||
IFACE="br-guest"
|
||||
SLOW_RATE="512kbit"
|
||||
|
||||
case "$1" in
|
||||
init)
|
||||
# Remove SQM if active
|
||||
/etc/init.d/sqm stop 2>/dev/null
|
||||
/etc/init.d/sqm disable 2>/dev/null
|
||||
|
||||
# --- Egress shaping (router → client, i.e. download for client) ---
|
||||
tc qdisc del dev $IFACE root 2>/dev/null
|
||||
tc qdisc add dev $IFACE root handle 1: htb default 10
|
||||
tc class add dev $IFACE parent 1: classid 1:1 htb rate 1000mbit
|
||||
tc class add dev $IFACE parent 1:1 classid 1:10 htb rate $SLOW_RATE ceil $SLOW_RATE # free tier
|
||||
tc class add dev $IFACE parent 1:1 classid 1:20 htb rate 1000mbit # paid tier
|
||||
tc qdisc add dev $IFACE parent 1:10 fq_codel
|
||||
tc qdisc add dev $IFACE parent 1:20 fq_codel
|
||||
|
||||
# tc filter: packets with mark 0x20 → paid class
|
||||
tc filter add dev $IFACE parent 1: protocol ip handle 0x20 fw flowid 1:20
|
||||
|
||||
# --- Ingress shaping (client → router, i.e. upload for client) via IFB ---
|
||||
ip link add ifb-guest type ifb 2>/dev/null
|
||||
ip link set ifb-guest up
|
||||
tc qdisc del dev $IFACE ingress 2>/dev/null
|
||||
tc qdisc add dev $IFACE ingress
|
||||
tc filter add dev $IFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb-guest
|
||||
|
||||
tc qdisc del dev ifb-guest root 2>/dev/null
|
||||
tc qdisc add dev ifb-guest root handle 1: htb default 10
|
||||
tc class add dev ifb-guest parent 1: classid 1:1 htb rate 1000mbit
|
||||
tc class add dev ifb-guest parent 1:1 classid 1:10 htb rate $SLOW_RATE ceil $SLOW_RATE
|
||||
tc class add dev ifb-guest parent 1:1 classid 1:20 htb rate 1000mbit
|
||||
tc qdisc add dev ifb-guest parent 1:10 fq_codel
|
||||
tc qdisc add dev ifb-guest parent 1:20 fq_codel
|
||||
tc filter add dev ifb-guest parent 1: protocol ip handle 0x20 fw flowid 1:20
|
||||
|
||||
# --- nftables: paid_clients set + mark rules ---
|
||||
nft add table inet parahub 2>/dev/null
|
||||
nft flush table inet parahub 2>/dev/null
|
||||
nft add set inet parahub paid_clients '{ type ipv4_addr; }'
|
||||
nft add chain inet parahub speed_mark '{ type filter hook forward priority -150; }'
|
||||
nft add rule inet parahub speed_mark ip daddr @paid_clients meta mark set 0x20
|
||||
nft add rule inet parahub speed_mark ip saddr @paid_clients meta mark set 0x20
|
||||
|
||||
logger -t parahub-speed "Speed control initialized: free=${SLOW_RATE}, paid=unlimited"
|
||||
;;
|
||||
add)
|
||||
[ -z "$2" ] && echo "Usage: $0 add <ip>" && exit 1
|
||||
nft add element inet parahub paid_clients "{ $2 }" 2>/dev/null
|
||||
logger -t parahub-speed "Added paid client: $2"
|
||||
;;
|
||||
remove)
|
||||
[ -z "$2" ] && echo "Usage: $0 remove <ip>" && exit 1
|
||||
nft delete element inet parahub paid_clients "{ $2 }" 2>/dev/null
|
||||
logger -t parahub-speed "Removed paid client: $2"
|
||||
;;
|
||||
list)
|
||||
nft list set inet parahub paid_clients 2>/dev/null
|
||||
;;
|
||||
flush)
|
||||
nft flush set inet parahub paid_clients 2>/dev/null
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $0 {init|add <ip>|remove <ip>|list|flush}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
100
scripts/build.sh
100
scripts/build.sh
@@ -22,22 +22,37 @@ device_config() {
|
||||
axt1800)
|
||||
OPENWRT_TARGET="qualcommax/ipq60xx"
|
||||
PROFILE="glinet_gl-axt1800"
|
||||
FIRMWARE_ROLE="bumblebee"
|
||||
;;
|
||||
mt3000)
|
||||
OPENWRT_TARGET="mediatek/filogic"
|
||||
PROFILE="glinet_gl-mt3000"
|
||||
FIRMWARE_ROLE="bumblebee"
|
||||
;;
|
||||
mt6000)
|
||||
OPENWRT_TARGET="mediatek/filogic"
|
||||
PROFILE="glinet_gl-mt6000"
|
||||
FIRMWARE_ROLE="bumblebee"
|
||||
;;
|
||||
ax6s)
|
||||
OPENWRT_TARGET="mediatek/filogic"
|
||||
PROFILE="xiaomi_redmi-router-ax6s"
|
||||
FIRMWARE_ROLE="bumblebee"
|
||||
;;
|
||||
ax53u)
|
||||
OPENWRT_TARGET="ramips/mt7621"
|
||||
PROFILE="asus_rt-ax53u"
|
||||
FIRMWARE_ROLE="bumblebee"
|
||||
;;
|
||||
ar300m16)
|
||||
OPENWRT_TARGET="ath79/generic"
|
||||
PROFILE="glinet_gl-ar300m16"
|
||||
FIRMWARE_ROLE="bee"
|
||||
;;
|
||||
wr3000)
|
||||
OPENWRT_TARGET="mediatek/filogic"
|
||||
PROFILE="cudy_wr3000-v1"
|
||||
FIRMWARE_ROLE="bee"
|
||||
;;
|
||||
*)
|
||||
return 1
|
||||
@@ -49,37 +64,32 @@ device_config() {
|
||||
# Packages
|
||||
# ============================================================================
|
||||
|
||||
PACKAGES_CORE=(
|
||||
# batman-adv mesh
|
||||
# Bee (L2 Transport): minimal mesh relay — no overlay, no guest isolation
|
||||
PACKAGES_BEE=(
|
||||
kmod-batman-adv
|
||||
batctl-full
|
||||
|
||||
# 802.11s mesh support (replace basic wpad, includes OWE)
|
||||
wpad-mesh-mbedtls
|
||||
-wpad-basic-mbedtls
|
||||
|
||||
# Yggdrasil overlay network
|
||||
yggdrasil
|
||||
|
||||
# GRE6 tunnel (guest traffic → VPS gateway)
|
||||
kmod-gre6
|
||||
|
||||
# DNS-over-HTTPS for guest privacy
|
||||
https-dns-proxy
|
||||
|
||||
# SQM traffic shaping
|
||||
sqm-scripts
|
||||
kmod-sched-cake
|
||||
|
||||
# Management
|
||||
luci
|
||||
luci-app-sqm
|
||||
curl
|
||||
)
|
||||
|
||||
PACKAGES_FULL=(
|
||||
"${PACKAGES_CORE[@]}"
|
||||
|
||||
# Diagnostics
|
||||
# Bumblebee (L3 Gateway): full stack — overlay, VPN, guest isolation, diagnostics
|
||||
PACKAGES_BUMBLEBEE=(
|
||||
kmod-batman-adv
|
||||
batctl-full
|
||||
wpad-mesh-mbedtls
|
||||
-wpad-basic-mbedtls
|
||||
yggdrasil
|
||||
kmod-gre6
|
||||
kmod-wireguard
|
||||
wireguard-tools
|
||||
luci-proto-wireguard
|
||||
https-dns-proxy
|
||||
tc-full
|
||||
kmod-ifb
|
||||
kmod-sched-htb
|
||||
luci
|
||||
tcpdump
|
||||
iperf3
|
||||
iwinfo
|
||||
@@ -93,12 +103,18 @@ PACKAGES_FULL=(
|
||||
usage() {
|
||||
echo "Usage: $0 <device>"
|
||||
echo ""
|
||||
echo "Devices:"
|
||||
echo " axt1800 GL.iNet GL-AXT1800 (Slate AX) qualcommax/ipq60xx"
|
||||
echo " mt3000 GL.iNet GL-MT3000 (Beryl AX) mediatek/filogic"
|
||||
echo " mt6000 GL.iNet GL-MT6000 (Flint 2) mediatek/filogic"
|
||||
echo " ax6s Xiaomi Redmi AX6S mediatek/filogic"
|
||||
echo " ax53u Asus RT-AX53U ramips/mt7621"
|
||||
echo "Devices: Role"
|
||||
echo " axt1800 GL.iNet GL-AXT1800 (Slate AX) qualcommax/ipq60xx Bumblebee"
|
||||
echo " mt3000 GL.iNet GL-MT3000 (Beryl AX) mediatek/filogic Bumblebee"
|
||||
echo " mt6000 GL.iNet GL-MT6000 (Flint 2) mediatek/filogic Bumblebee"
|
||||
echo " ax6s Xiaomi Redmi AX6S mediatek/filogic Bumblebee"
|
||||
echo " ax53u Asus RT-AX53U ramips/mt7621 Bumblebee"
|
||||
echo " ar300m16 GL.iNet GL-AR300M16-EXT (16MB) ath79/generic Bee"
|
||||
echo " wr3000 Cudy AX3000 (WR3000) mediatek/filogic Bee"
|
||||
echo ""
|
||||
echo "Roles:"
|
||||
echo " Bumblebee L3 Gateway — full stack (yggdrasil, VPN, guest isolation, SQM, DoH)"
|
||||
echo " Bee L2 Transport — minimal mesh relay (batman-adv, luci, heartbeat)"
|
||||
echo ""
|
||||
echo "OpenWrt version: ${OPENWRT_VERSION} (override with OPENWRT_VERSION env var)"
|
||||
echo ""
|
||||
@@ -136,18 +152,35 @@ download_builder() {
|
||||
build_firmware() {
|
||||
local dir
|
||||
dir="$(builder_dir)"
|
||||
local packages="${PACKAGES_FULL[*]} ${PACKAGES_EXTRA:-}"
|
||||
|
||||
# Select package list by role
|
||||
local packages
|
||||
if [ "$FIRMWARE_ROLE" = "bee" ]; then
|
||||
packages="${PACKAGES_BEE[*]} ${PACKAGES_EXTRA:-}"
|
||||
else
|
||||
packages="${PACKAGES_BUMBLEBEE[*]} ${PACKAGES_EXTRA:-}"
|
||||
fi
|
||||
|
||||
# Create temp FILES dir with role marker
|
||||
local tmpfiles
|
||||
tmpfiles=$(mktemp -d)
|
||||
cp -a "${PROJECT_DIR}/files/"* "$tmpfiles/"
|
||||
mkdir -p "$tmpfiles/etc/parahub"
|
||||
echo "$FIRMWARE_ROLE" > "$tmpfiles/etc/parahub/role"
|
||||
|
||||
echo "Building firmware for profile: ${PROFILE}"
|
||||
echo "Role: ${FIRMWARE_ROLE}"
|
||||
echo "Packages: ${packages}"
|
||||
echo "Custom files: ${PROJECT_DIR}/files"
|
||||
echo "Custom files: ${tmpfiles}"
|
||||
|
||||
make -C "$dir" image \
|
||||
PROFILE="$PROFILE" \
|
||||
PACKAGES="$packages" \
|
||||
FILES="${PROJECT_DIR}/files" \
|
||||
FILES="$tmpfiles" \
|
||||
BIN_DIR="${PROJECT_DIR}/output"
|
||||
|
||||
rm -rf "$tmpfiles"
|
||||
|
||||
echo ""
|
||||
echo "Build complete! Firmware images:"
|
||||
ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
|
||||
@@ -173,6 +206,7 @@ fi
|
||||
|
||||
echo "=== Parahub Mesh Firmware Builder ==="
|
||||
echo "Device: ${INPUT}"
|
||||
echo "Role: ${FIRMWARE_ROLE}"
|
||||
echo "OpenWrt: ${OPENWRT_VERSION}"
|
||||
echo "Target: ${OPENWRT_TARGET}"
|
||||
echo "Profile: ${PROFILE}"
|
||||
|
||||
Reference in New Issue
Block a user