Parahub AI
f96a455dc8
vpn-tunnel reads IP from /etc/parahub/tunnel_ip instead of hardcoded 172.16.0.2. On first boot, calls heartbeat synchronously to get assignment. Heartbeat parses tunnel_ip from response and restarts vpn-tunnel on change. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
98 lines
3.7 KiB
Bash
Executable File
98 lines
3.7 KiB
Bash
Executable File
#!/bin/sh /etc/rc.common
|
|
# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
|
|
# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
|
|
# handler, so we create the tunnel manually with ip6gre.
|
|
#
|
|
# Tunnel IP is assigned by Django and stored in /etc/parahub/tunnel_ip.
|
|
# If the file doesn't exist (first boot), heartbeat is called synchronously to get it.
|
|
#
|
|
# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
|
|
# Destination Options extension headers (added by default encaplimit 4).
|
|
|
|
START=96
|
|
STOP=10
|
|
|
|
VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
|
|
GRE_GATEWAY="172.16.0.1"
|
|
TUNNEL_IP_FILE="/etc/parahub/tunnel_ip"
|
|
|
|
start() {
|
|
# Only for Bumblebee role
|
|
[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
|
|
|
|
# Wait for Yggdrasil address (up to 60s)
|
|
local ygg_addr="" attempts=0
|
|
while [ $attempts -lt 30 ]; do
|
|
ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
|
|
[ -n "$ygg_addr" ] && break
|
|
attempts=$((attempts + 1))
|
|
sleep 2
|
|
done
|
|
|
|
if [ -z "$ygg_addr" ]; then
|
|
logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
|
|
return 1
|
|
fi
|
|
|
|
# Get tunnel IP — from file, or request via heartbeat on first boot
|
|
local gre_local_ip
|
|
gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
|
|
|
|
if [ -z "$gre_local_ip" ]; then
|
|
logger -t parahub-vpn "No tunnel IP file, calling heartbeat to get assignment..."
|
|
HEARTBEAT_CURL_TIMEOUT=30 /usr/bin/parahub-heartbeat
|
|
gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
|
|
fi
|
|
|
|
if [ -z "$gre_local_ip" ]; then
|
|
logger -t parahub-vpn "Failed to get tunnel IP from heartbeat, falling back to 172.16.0.2"
|
|
gre_local_ip="172.16.0.2"
|
|
fi
|
|
|
|
# Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
|
|
ip -6 tunnel add gre6-vpn mode ip6gre \
|
|
remote "$VPS_YGG" \
|
|
local "$ygg_addr" \
|
|
encaplimit none
|
|
ip addr add ${gre_local_ip}/24 dev gre6-vpn
|
|
ip link set gre6-vpn mtu 1400 up
|
|
|
|
# Default route through GRE (table 100 — used by guest policy routing)
|
|
ip route add default via "$GRE_GATEWAY" table 100
|
|
|
|
# Guest subnet direct route in table 100 (background — WiFi may not be up yet)
|
|
# Without this, router's own replies (source IP in guest subnet) go through
|
|
# GRE instead of back to the guest client (ip rule matches source-based)
|
|
local guest_subnet
|
|
guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
|
|
if [ -n "$guest_subnet" ]; then
|
|
# WiFi interfaces take time to come up at boot — retry in background
|
|
(
|
|
local guest_dev="" ga=0
|
|
while [ $ga -lt 30 ]; do
|
|
guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
|
|
[ -n "$guest_dev" ] && break
|
|
ga=$((ga + 1))
|
|
sleep 2
|
|
done
|
|
if [ -n "$guest_dev" ]; then
|
|
ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null
|
|
logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
|
|
else
|
|
logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s"
|
|
fi
|
|
) &
|
|
fi
|
|
|
|
# Reload firewall so vpn_tunnel zone picks up gre6-vpn device
|
|
/etc/init.d/firewall reload 2>/dev/null &
|
|
|
|
logger -t parahub-vpn "GRE6 tunnel up: ${gre_local_ip} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
|
|
}
|
|
|
|
stop() {
|
|
ip route flush table 100 2>/dev/null
|
|
ip -6 tunnel del gre6-vpn 2>/dev/null
|
|
logger -t parahub-vpn "GRE6 tunnel down"
|
|
}
|