norn/parahub-mesh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
69a8285c8c42ef08872c13fa9d1480a9d004a8d9
parahub-mesh/files/etc/uci-defaults/99-parahub-mesh
Parahub AI 69a8285c8c feat: Add heartbeat phone-home script and norn SSH key 
- parahub-heartbeat: cURL heartbeat to cloud API every 5min via cron
- authorized_keys: add norn@parahub-ng for WiFi password SSH retrieval
- 99-parahub-mesh: section 12 enables cron + heartbeat on first boot

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-05 18:30:20 +00:00

509 lines
17 KiB
Bash
Executable File
Raw Blame History

#!/bin/sh
# Parahub Mesh Node — Zero-Touch First Boot Configuration
# This script runs once on first boot via uci-defaults mechanism.
# It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
set -e
# ============================================================================
# 1. IDENTITY GENERATION
# ============================================================================
# Get br-lan MAC (fallback to eth0 if br-lan doesn't exist yet)
BASE_MAC=$(cat /sys/class/net/br-lan/address 2>/dev/null || cat /sys/class/net/eth0/address 2>/dev/null || echo "00:00:00:00:00:00")
# Last 4 hex digits of MAC for unique suffix
NODE_SUFFIX=$(echo "$BASE_MAC" | awk -F: '{print toupper($5$6)}')
HOSTNAME="Parahub-${NODE_SUFFIX}"
PRIVATE_SSID="Parahub_${NODE_SUFFIX}"
MESH_ID="parahub-mesh"
PUBLIC_SSID="Parahub_Free"
# ============================================================================
# 2. SUBNET GENERATION (collision avoidance from MAC octets)
# ============================================================================
# Private: octets 4,5 → 10.P1.P2.0/24
PRIV_O1=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$4}')
PRIV_O2=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$5}')
# Guest: octets 2,3 → 10.G1.G2.0/24 (guaranteed different from private since different MAC positions)
GUEST_O1=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$2}')
GUEST_O2=$(echo "$BASE_MAC" | awk -F: '{printf "%d", "0x"$3}')
# Avoid 0 and 255 in second octet (reserved)
[ "$PRIV_O1" -eq 0 ] && PRIV_O1=1
[ "$PRIV_O1" -eq 255 ] && PRIV_O1=254
[ "$GUEST_O1" -eq 0 ] && GUEST_O1=2
[ "$GUEST_O1" -eq 255 ] && GUEST_O1=253
PRIV_SUBNET="10.${PRIV_O1}.${PRIV_O2}.0"
PRIV_IP="10.${PRIV_O1}.${PRIV_O2}.1"
GUEST_SUBNET="10.${GUEST_O1}.${GUEST_O2}.0"
GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"
# ============================================================================
# 3. KEY GENERATION
# ============================================================================
PRIVATE_KEY=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
# Shared mesh SAE key — same across all Parahub nodes for auto-peering
MESH_KEY="ndIPclyqSn9LaCki"
mkdir -p /etc/parahub
cat > /etc/parahub/keys <<KEYS_EOF
# Parahub Mesh Node Keys — Generated at first boot
# Node: ${HOSTNAME}
# Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)
PRIVATE_WIFI_KEY=${PRIVATE_KEY}
MESH_SAE_KEY=${MESH_KEY}
PRIVATE_SSID=${PRIVATE_SSID}
PRIVATE_SUBNET=${PRIV_SUBNET}/24
GUEST_SUBNET=${GUEST_SUBNET}/24
NODE_MAC=${BASE_MAC}
KEYS_EOF
chmod 600 /etc/parahub/keys
# ============================================================================
# 4. NETWORK CONFIGURATION
# ============================================================================
# Clean existing network config (preserve wan)
uci batch <<-NET_EOF
# --- loopback ---
set network.loopback=interface
set network.loopback.device='lo'
set network.loopback.proto='static'
set network.loopback.ipaddr='127.0.0.1'
set network.loopback.netmask='255.0.0.0'
# --- bat0 (batman-adv virtual interface) ---
set network.bat0=interface
set network.bat0.proto='batadv'
set network.bat0.routing_algo='BATMAN_V'
set network.bat0.aggregated_ogms='1'
set network.bat0.bridge_loop_avoidance='1'
set network.bat0.distributed_arp_table='1'
set network.bat0.gw_mode='off'
set network.bat0.hop_penalty='15'
set network.bat0.orig_interval='1000'
# --- bat0 hardif for mesh0 (2.4GHz mesh) ---
set network.bat0_hardif_mesh0=interface
set network.bat0_hardif_mesh0.proto='batadv_hardif'
set network.bat0_hardif_mesh0.master='bat0'
# --- bat0 hardif for mesh1 (5GHz mesh) ---
set network.bat0_hardif_mesh1=interface
set network.bat0_hardif_mesh1.proto='batadv_hardif'
set network.bat0_hardif_mesh1.master='bat0'
# --- private bridge (bat0 + LAN ethernet) ---
set network.private_dev=device
set network.private_dev.type='bridge'
set network.private_dev.name='br-private'
delete network.private_dev.ports
add_list network.private_dev.ports='bat0'
add_list network.private_dev.ports='eth0'
set network.private=interface
set network.private.device='br-private'
set network.private.proto='static'
set network.private.ipaddr='${PRIV_IP}'
set network.private.netmask='255.255.255.0'
# --- guest (standalone, no bridge to mesh) ---
set network.guest=interface
set network.guest.proto='static'
set network.guest.ipaddr='${GUEST_IP}'
set network.guest.netmask='255.255.255.0'
# --- wan (DHCP, create if missing) ---
set network.wan=interface
set network.wan.device='eth1'
set network.wan.proto='dhcp'
# --- GRE6 tunnel (guest traffic → VPS gateway via Yggdrasil) ---
set network.vpn_tunnel=interface
set network.vpn_tunnel.proto='grev6'
set network.vpn_tunnel.peeraddr='200:39f1:6a26:328a:d901:fbd2:d30d:faef'
set network.vpn_tunnel.ipaddr='172.16.0.2'
set network.vpn_tunnel.netmask='255.255.255.0'
set network.vpn_tunnel.gateway='172.16.0.1'
set network.vpn_tunnel.mtu='1400'
set network.vpn_tunnel.ip4table='100'
# --- Policy routing: guest traffic → VPN table 100 ---
add network rule
set network.@rule[-1].src='${GUEST_SUBNET}/24'
set network.@rule[-1].lookup='100'
set network.@rule[-1].priority='100'
NET_EOF
uci commit network
# ============================================================================
# 5. WIRELESS CONFIGURATION
# ============================================================================
# Detect radios dynamically
RADIOS=$(uci show wireless | grep '=wifi-device' | cut -d'=' -f1 | cut -d'.' -f2)
# Determine which radio is 2.4GHz and which is 5GHz
RADIO_2G=""
RADIO_5G=""
for radio in $RADIOS; do
band=$(uci -q get "wireless.${radio}.band" 2>/dev/null || echo "")
htmode=$(uci -q get "wireless.${radio}.htmode" 2>/dev/null || echo "")
if [ "$band" = "2g" ]; then
RADIO_2G="$radio"
elif [ "$band" = "5g" ]; then
RADIO_5G="$radio"
else
# Fallback: detect from htmode or channel
channel=$(uci -q get "wireless.${radio}.channel" 2>/dev/null || echo "0")
if [ "$channel" -le 14 ] 2>/dev/null; then
RADIO_2G="$radio"
else
RADIO_5G="$radio"
fi
fi
done
# Fallback: if only one radio detected, use it for both
if [ -z "$RADIO_2G" ] && [ -n "$RADIO_5G" ]; then
RADIO_2G="$RADIO_5G"
fi
if [ -z "$RADIO_5G" ] && [ -n "$RADIO_2G" ]; then
RADIO_5G="$RADIO_2G"
fi
# Remove all existing wifi-iface sections
while uci -q delete wireless.@wifi-iface[0]; do :; done
# Enable radios (remove disabled flag)
for radio in $RADIOS; do
uci -q delete "wireless.${radio}.disabled" 2>/dev/null || true
done
# --- 2.4GHz radio: mesh backhaul + Parahub_Free AP ---
if [ -n "$RADIO_2G" ]; then
# Mesh interface on 2.4GHz
uci batch <<-WIFI_2G_MESH
set wireless.mesh_2g=wifi-iface
set wireless.mesh_2g.device='${RADIO_2G}'
set wireless.mesh_2g.mode='mesh'
set wireless.mesh_2g.mesh_id='${MESH_ID}'
set wireless.mesh_2g.mesh_fwding='0'
set wireless.mesh_2g.encryption='sae'
set wireless.mesh_2g.key='${MESH_KEY}'
set wireless.mesh_2g.network='bat0_hardif_mesh0'
WIFI_2G_MESH
# Public AP on 2.4GHz (better range) — OWE transition mode
# Devices that support OWE get encrypted; legacy devices fall back to open
uci batch <<-WIFI_2G_PUB
set wireless.public_2g=wifi-iface
set wireless.public_2g.device='${RADIO_2G}'
set wireless.public_2g.mode='ap'
set wireless.public_2g.ssid='${PUBLIC_SSID}'
set wireless.public_2g.encryption='owe'
set wireless.public_2g.owe_transition='1'
set wireless.public_2g.isolate='1'
set wireless.public_2g.network='guest'
WIFI_2G_PUB
fi
# --- 5GHz radio: mesh backhaul + Private AP ---
if [ -n "$RADIO_5G" ]; then
# Mesh interface on 5GHz
uci batch <<-WIFI_5G_MESH
set wireless.mesh_5g=wifi-iface
set wireless.mesh_5g.device='${RADIO_5G}'
set wireless.mesh_5g.mode='mesh'
set wireless.mesh_5g.mesh_id='${MESH_ID}'
set wireless.mesh_5g.mesh_fwding='0'
set wireless.mesh_5g.encryption='sae'
set wireless.mesh_5g.key='${MESH_KEY}'
set wireless.mesh_5g.network='bat0_hardif_mesh1'
WIFI_5G_MESH
# Private AP on 5GHz (better throughput)
uci batch <<-WIFI_5G_PRIV
set wireless.private_5g=wifi-iface
set wireless.private_5g.device='${RADIO_5G}'
set wireless.private_5g.mode='ap'
set wireless.private_5g.ssid='${PRIVATE_SSID}'
set wireless.private_5g.encryption='sae'
set wireless.private_5g.key='${PRIVATE_KEY}'
set wireless.private_5g.network='private'
WIFI_5G_PRIV
fi
uci commit wireless
# ============================================================================
# 6. FIREWALL CONFIGURATION
# ============================================================================
# Reset firewall to clean state
while uci -q delete firewall.@zone[0]; do :; done
while uci -q delete firewall.@forwarding[0]; do :; done
while uci -q delete firewall.@rule[0]; do :; done
while uci -q delete firewall.@redirect[0]; do :; done
uci batch <<-FW_EOF
# --- Zone: lan (private network) ---
add firewall zone
set firewall.@zone[-1].name='lan'
set firewall.@zone[-1].input='ACCEPT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='ACCEPT'
add_list firewall.@zone[-1].network='private'
# --- Zone: guest (IPv4 only — IPv6 blocked) ---
add firewall zone
set firewall.@zone[-1].name='guest'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
set firewall.@zone[-1].family='ipv4'
add_list firewall.@zone[-1].network='guest'
# --- Zone: wan ---
add firewall zone
set firewall.@zone[-1].name='wan'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
set firewall.@zone[-1].masq='1'
set firewall.@zone[-1].mtu_fix='1'
add_list firewall.@zone[-1].network='wan'
# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
add firewall zone
set firewall.@zone[-1].name='vpn_tunnel'
set firewall.@zone[-1].input='REJECT'
set firewall.@zone[-1].output='ACCEPT'
set firewall.@zone[-1].forward='REJECT'
set firewall.@zone[-1].masq='1'
set firewall.@zone[-1].mtu_fix='1'
add_list firewall.@zone[-1].network='vpn_tunnel'
# --- Forwarding: lan → wan (internet for owner) ---
add firewall forwarding
set firewall.@forwarding[-1].src='lan'
set firewall.@forwarding[-1].dest='wan'
# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
add firewall forwarding
set firewall.@forwarding[-1].src='guest'
set firewall.@forwarding[-1].dest='vpn_tunnel'
# --- Rule: guest DHCP (allow guests to get IP) ---
add firewall rule
set firewall.@rule[-1].name='Guest DHCP'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].proto='udp'
set firewall.@rule[-1].dest_port='67'
set firewall.@rule[-1].target='ACCEPT'
set firewall.@rule[-1].family='ipv4'
# --- Rule: guest DNS to router only (hijacked to DoH) ---
add firewall rule
set firewall.@rule[-1].name='Guest DNS'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].proto='tcpudp'
set firewall.@rule[-1].dest_port='53'
set firewall.@rule[-1].target='ACCEPT'
set firewall.@rule[-1].family='ipv4'
# --- Rule: block guest → lan (isolation) ---
add firewall rule
set firewall.@rule[-1].name='Block guest to LAN'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].dest='lan'
set firewall.@rule[-1].proto='all'
set firewall.@rule[-1].target='REJECT'
# --- Rule: block ALL IPv6 from guest (leak prevention) ---
add firewall rule
set firewall.@rule[-1].name='Block guest IPv6'
set firewall.@rule[-1].src='guest'
set firewall.@rule[-1].proto='all'
set firewall.@rule[-1].family='ipv6'
set firewall.@rule[-1].target='REJECT'
# --- DNS hijack: redirect guest DNS to local DoH resolver ---
add firewall redirect
set firewall.@redirect[-1].name='Guest DNS hijack'
set firewall.@redirect[-1].src='guest'
set firewall.@redirect[-1].src_dport='53'
set firewall.@redirect[-1].proto='tcpudp'
set firewall.@redirect[-1].target='DNAT'
set firewall.@redirect[-1].dest='lan'
set firewall.@redirect[-1].dest_port='53'
set firewall.@redirect[-1].family='ipv4'
# --- Standard WAN input rules ---
add firewall rule
set firewall.@rule[-1].name='Allow-DHCP-Renew'
set firewall.@rule[-1].src='wan'
set firewall.@rule[-1].proto='udp'
set firewall.@rule[-1].dest_port='68'
set firewall.@rule[-1].target='ACCEPT'
set firewall.@rule[-1].family='ipv4'
add firewall rule
set firewall.@rule[-1].name='Allow-Ping'
set firewall.@rule[-1].src='wan'
set firewall.@rule[-1].proto='icmp'
set firewall.@rule[-1].icmp_type='echo-request'
set firewall.@rule[-1].target='ACCEPT'
FW_EOF
uci commit firewall
# ============================================================================
# 7. DHCP CONFIGURATION
# ============================================================================
# Remove existing DHCP pools that may conflict
uci -q delete dhcp.lan 2>/dev/null || true
uci -q delete dhcp.guest 2>/dev/null || true
uci batch <<-DHCP_EOF
# --- Private DHCP ---
set dhcp.private=dhcp
set dhcp.private.interface='private'
set dhcp.private.start='100'
set dhcp.private.limit='150'
set dhcp.private.leasetime='12h'
# --- Guest DHCP ---
set dhcp.guest=dhcp
set dhcp.guest.interface='guest'
set dhcp.guest.start='100'
set dhcp.guest.limit='50'
set dhcp.guest.leasetime='1h'
DHCP_EOF
uci commit dhcp
# ============================================================================
# 8. SQM TRAFFIC SHAPING (guest 512 kbps limit)
# ============================================================================
# Find the guest interface device name (will be set after network restart)
# SQM watches the interface name from the network config
uci batch <<-SQM_EOF
set sqm.guest=queue
set sqm.guest.enabled='1'
set sqm.guest.interface='br-guest'
set sqm.guest.download='512'
set sqm.guest.upload='512'
set sqm.guest.qdisc='cake'
set sqm.guest.script='piece_of_cake.qos'
set sqm.guest.linklayer='ethernet'
set sqm.guest.overhead='44'
SQM_EOF
uci commit sqm
# ============================================================================
# 9. DNS-OVER-HTTPS (guest DNS privacy)
# ============================================================================
# https-dns-proxy: local DoH resolver for guest DNS queries
# Guest DNS is hijacked via firewall redirect to this resolver
uci batch <<-DOH_EOF
set https-dns-proxy.main=main
set https-dns-proxy.main.doh_paramters='-4'
set https-dns-proxy.main.listen_addr='0.0.0.0'
set https-dns-proxy.main.listen_port='5053'
set https-dns-proxy.cloudflare=https-dns-proxy
set https-dns-proxy.cloudflare.resolver_url='https://1.1.1.1/dns-query'
set https-dns-proxy.cloudflare.listen_addr='127.0.0.1'
set https-dns-proxy.cloudflare.listen_port='5053'
DOH_EOF
uci commit https-dns-proxy
# Configure dnsmasq to use DoH for upstream
uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
uci set dhcp.@dnsmasq[0].noresolv='1'
uci commit dhcp
# Enable https-dns-proxy service
/etc/init.d/https-dns-proxy enable 2>/dev/null || true
# ============================================================================
# 10. SYSTEM SETTINGS
# ============================================================================
uci batch <<-SYS_EOF
set system.@system[0].hostname='${HOSTNAME}'
set system.@system[0].timezone='UTC0'
set system.@system[0].zonename='UTC'
set system.@system[0].log_proto='udp'
set system.@system[0].conloglevel='7'
set system.@system[0].cronloglevel='9'
SYS_EOF
uci commit system
# ============================================================================
# 11. YGGDRASIL OVERLAY NETWORK
# ============================================================================
# Generate unique keys for this node
yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
# Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
# UCI network interface for yggdrasil TUN
uci batch <<-YGG_EOF
set network.yggdrasil=interface
set network.yggdrasil.device='ygg0'
set network.yggdrasil.proto='none'
YGG_EOF
uci commit network
# Add yggdrasil to LAN zone (mesh nodes trust each other)
uci add_list firewall.@zone[0].network='yggdrasil'
uci commit firewall
# Enable yggdrasil service
/etc/init.d/yggdrasil enable
# Save yggdrasil address to node keys file
YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
# ============================================================================
# 12. HEARTBEAT (phone-home to Parahub cloud)
# ============================================================================
chmod +x /usr/bin/parahub-heartbeat
# Cron: every 5 minutes
echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
/etc/init.d/cron enable
# ============================================================================
# 13. FINAL
# ============================================================================
# Log completion
logger -t parahub-mesh "First boot configuration complete"
logger -t parahub-mesh "Hostname: ${HOSTNAME}"
logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
exit 0
Reference in New Issue View Git Blame Copy Permalink