258 lines
11 KiB
Bash
258 lines
11 KiB
Bash
#!/bin/bash -eu
|
|
# =============================================================================
|
|
# 00-migrate-root.sh — Run as ROOT
|
|
# 1. Full backup (keys, peers, nginx, certs, ufw, env)
|
|
# 2. Shuts down legacy stack
|
|
# 3. Cleans system for fresh install
|
|
# =============================================================================
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "[X] Run as root: sudo bash 00-migrate-root.sh"
|
|
exit 1
|
|
fi
|
|
|
|
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RESET='\033[0m'
|
|
|
|
LINUX_USER="${SUDO_USER:-}"
|
|
if [ -z "$LINUX_USER" ] || [ "$LINUX_USER" = "root" ]; then
|
|
LINUX_USER=$(getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' | head -1 || true)
|
|
fi
|
|
[ -z "$LINUX_USER" ] && { echo -e "${RED}[X]${RESET} Could not detect Linux user."; exit 1; }
|
|
LINUX_HOME=$(getent passwd "$LINUX_USER" | cut -d: -f6)
|
|
|
|
BACKUP_DIR="$LINUX_HOME/.wg-migration"
|
|
LOG="$BACKUP_DIR/migration.log"
|
|
|
|
mkdir -p "$BACKUP_DIR"
|
|
chmod 700 "$BACKUP_DIR"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR"
|
|
: > "$LOG"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$LOG"
|
|
|
|
ok() { echo -e "${GREEN}[OK]${RESET} $1"; echo "[OK] $1" >> "$LOG"; }
|
|
info() { echo -e "${CYAN}[i]${RESET} $1"; echo "[i] $1" >> "$LOG"; }
|
|
warn() { echo -e "${YELLOW}[!]${RESET} $1"; echo "[!] $1" >> "$LOG"; }
|
|
fail() { echo -e "${RED}[X]${RESET} $1"; echo "[X] $1" >> "$LOG"; exit 1; }
|
|
sep() { echo -e "\n${CYAN}------------------------------------${RESET}"; }
|
|
|
|
_save() {
|
|
if [ -e "$1" ]; then
|
|
cp -r "$1" "$BACKUP_DIR/$2" 2>/dev/null || true
|
|
chown -R "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/$2" 2>/dev/null || true
|
|
ok "Saved: $1 → $2"
|
|
else
|
|
warn "Not found (skipped): $1"
|
|
fi
|
|
}
|
|
|
|
echo ""
|
|
echo "========================================="
|
|
echo " 00 - Backup, cleanup and preparation"
|
|
echo " $(date '+%Y-%m-%d %H:%M:%S')"
|
|
echo " User : $LINUX_USER"
|
|
echo " Backup : $BACKUP_DIR"
|
|
echo "========================================="
|
|
echo "[START-00] $(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG"
|
|
|
|
# ─── DOCKER ───────────────────────────────────────────────────────────────────
|
|
sep
|
|
info "Checking Docker..."
|
|
command -v docker &>/dev/null || fail "Docker not installed."
|
|
ok "Docker: $(docker --version)"
|
|
|
|
# ─── DETECT LEGACY WIREGUARD ──────────────────────────────────────────────────
|
|
sep
|
|
info "Detecting legacy WireGuard container..."
|
|
LEGACY_WG=$(docker ps --format '{{.Names}} {{.Image}}' | \
|
|
grep -i "linuxserver/wireguard\|lscr.io/linuxserver/wireguard" | \
|
|
awk '{print $1}' | head -1 || true)
|
|
if [ -z "$LEGACY_WG" ]; then
|
|
LEGACY_WG=$(docker ps --format '{{.Names}}' | \
|
|
grep -iE "^wireguard$|^wg$|^sp-wireguard$" | head -1 || true)
|
|
fi
|
|
[ -z "$LEGACY_WG" ] && fail "No legacy WireGuard container found. Check: docker ps"
|
|
ok "Legacy WireGuard: $LEGACY_WG"
|
|
|
|
# ─── DETECT LEGACY STACK ──────────────────────────────────────────────────────
|
|
sep
|
|
info "Detecting legacy stack location..."
|
|
LEGACY_COMPOSE_DIR=""
|
|
|
|
# Search in known paths first
|
|
for DIR in "$LINUX_HOME/sp-env-wireguard" \
|
|
"$LINUX_HOME/sp-env-wireguard-ipv6" \
|
|
"$LINUX_HOME/wireguard" \
|
|
/root/sp-env-wireguard \
|
|
/root/sp-env-wireguard-ipv6 \
|
|
/opt/sp-env-wireguard \
|
|
/srv/wireguard; do
|
|
if [ -f "$DIR/docker-compose.yml" ] && grep -q "wireguard" "$DIR/docker-compose.yml" 2>/dev/null; then
|
|
LEGACY_COMPOSE_DIR="$DIR"
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Fallback: search entire home directory
|
|
if [ -z "$LEGACY_COMPOSE_DIR" ]; then
|
|
LEGACY_COMPOSE_DIR=$(find "$LINUX_HOME" -maxdepth 6 -name "docker-compose.yml" 2>/dev/null | \
|
|
while read -r f; do
|
|
grep -q "wireguard" "$f" 2>/dev/null && dirname "$f" && break
|
|
done | head -1)
|
|
fi
|
|
|
|
[ -z "$LEGACY_COMPOSE_DIR" ] && fail "Legacy docker-compose.yml not found."
|
|
ok "Legacy stack: $LEGACY_COMPOSE_DIR"
|
|
echo "$LEGACY_COMPOSE_DIR" > "$BACKUP_DIR/legacy_compose_dir"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/legacy_compose_dir"
|
|
|
|
# ─── BACKUP WIREGUARD KEYS AND PEERS ──────────────────────────────────────────
|
|
sep
|
|
info "Backing up WireGuard keys and peers..."
|
|
|
|
WG_CONF_CONTENT=$(docker exec "$LEGACY_WG" cat /config/wg_confs/wg0.conf 2>/dev/null || true)
|
|
[ -z "$WG_CONF_CONTENT" ] && fail "Could not read wg0.conf from container $LEGACY_WG"
|
|
|
|
LEGACY_PRIVATE_KEY=$(echo "$WG_CONF_CONTENT" | grep "^PrivateKey" | awk '{print $3}' | tr -d '[:space:]')
|
|
[ -z "$LEGACY_PRIVATE_KEY" ] && fail "PrivateKey not found in wg0.conf"
|
|
echo "$LEGACY_PRIVATE_KEY" > "$BACKUP_DIR/private_key"
|
|
chmod 600 "$BACKUP_DIR/private_key"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/private_key"
|
|
ok "Private key saved."
|
|
|
|
LEGACY_PUBLIC_KEY=$(docker exec "$LEGACY_WG" cat /config/server/publickey-server 2>/dev/null | tr -d '[:space:]' || true)
|
|
if [ -z "$LEGACY_PUBLIC_KEY" ]; then
|
|
warn "publickey-server not found — deriving from private key..."
|
|
LEGACY_PUBLIC_KEY=$(echo "$LEGACY_PRIVATE_KEY" | wg pubkey 2>/dev/null || true)
|
|
fi
|
|
[ -z "$LEGACY_PUBLIC_KEY" ] && fail "Could not obtain public key."
|
|
echo "$LEGACY_PUBLIC_KEY" > "$BACKUP_DIR/public_key"
|
|
chmod 600 "$BACKUP_DIR/public_key"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/public_key"
|
|
ok "Public key: $LEGACY_PUBLIC_KEY"
|
|
|
|
PEER_CONF=$(docker exec "$LEGACY_WG" wg showconf wg0 2>/dev/null || echo "$WG_CONF_CONTENT")
|
|
echo "$PEER_CONF" > "$BACKUP_DIR/wg0-legacy.conf"
|
|
cp "$BACKUP_DIR/wg0-legacy.conf" "$BACKUP_DIR/wg0-legacy.conf.original"
|
|
chmod 600 "$BACKUP_DIR/wg0-legacy.conf" "$BACKUP_DIR/wg0-legacy.conf.original"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/wg0-legacy.conf" "$BACKUP_DIR/wg0-legacy.conf.original"
|
|
PEER_COUNT=$(grep -c "^\[Peer\]" "$BACKUP_DIR/wg0-legacy.conf" || echo 0)
|
|
ok "$PEER_COUNT peers saved."
|
|
|
|
# ─── BACKUP NGINX ─────────────────────────────────────────────────────────────
|
|
sep
|
|
info "Backing up Nginx..."
|
|
mkdir -p "$BACKUP_DIR/nginx"
|
|
_save /etc/nginx/sites-available nginx/sites-available
|
|
_save /etc/nginx/sites-enabled nginx/sites-enabled
|
|
_save /etc/nginx/nginx.conf nginx/nginx.conf
|
|
|
|
# ─── BACKUP SSL CERTIFICATES ──────────────────────────────────────────────────
|
|
sep
|
|
info "Backing up SSL certificates..."
|
|
mkdir -p "$BACKUP_DIR/letsencrypt"
|
|
if [ -d /etc/letsencrypt ]; then
|
|
cp -r /etc/letsencrypt/. "$BACKUP_DIR/letsencrypt/"
|
|
chown -R "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/letsencrypt/"
|
|
ok "Certificates saved."
|
|
else
|
|
warn "/etc/letsencrypt not found."
|
|
fi
|
|
|
|
# ─── BACKUP UFW ───────────────────────────────────────────────────────────────
|
|
sep
|
|
info "Backing up UFW rules..."
|
|
ufw status verbose > "$BACKUP_DIR/ufw-snapshot.txt" 2>/dev/null || true
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/ufw-snapshot.txt"
|
|
ok "UFW snapshot saved."
|
|
|
|
# ─── BACKUP LEGACY ENV ────────────────────────────────────────────────────────
|
|
sep
|
|
info "Backing up legacy .env..."
|
|
_save "$LEGACY_COMPOSE_DIR/.env" legacy.env
|
|
|
|
# ─── DETECT NETWORK ───────────────────────────────────────────────────────────
|
|
IPV6_ADDRS=$(ip -6 addr show | grep -oP 'inet6 \K[0-9a-fA-F:]+' | grep -v '^::1$' || true)
|
|
if [ -n "$IPV6_ADDRS" ]; then
|
|
echo "ipv6=true" > "$BACKUP_DIR/network_info"
|
|
ok "IPv6 detected."
|
|
else
|
|
echo "ipv6=false" > "$BACKUP_DIR/network_info"
|
|
info "IPv4 only."
|
|
fi
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/network_info"
|
|
|
|
# ─── SSH KEY ──────────────────────────────────────────────────────────────────
|
|
sep
|
|
info "Adding $LINUX_USER to docker group..."
|
|
usermod -aG docker "$LINUX_USER" 2>/dev/null || true
|
|
ok "$LINUX_USER added to docker group. Changes take effect on next login."
|
|
|
|
info "Checking SSH key for private repo..."
|
|
mkdir -p "$LINUX_HOME/.ssh"
|
|
chmod 700 "$LINUX_HOME/.ssh"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$LINUX_HOME/.ssh"
|
|
if [ ! -f "$LINUX_HOME/.ssh/id_ed25519" ]; then
|
|
sudo -u "$LINUX_USER" ssh-keygen -t ed25519 -f "$LINUX_HOME/.ssh/id_ed25519" -N "" -q
|
|
ok "SSH key generated."
|
|
else
|
|
ok "SSH key already exists."
|
|
fi
|
|
SSH_PUBKEY=$(cat "$LINUX_HOME/.ssh/id_ed25519.pub")
|
|
echo "$SSH_PUBKEY" > "$BACKUP_DIR/ssh_pubkey"
|
|
chown "$LINUX_USER":"$LINUX_USER" "$BACKUP_DIR/ssh_pubkey"
|
|
|
|
# ─── SHUT DOWN LEGACY STACK ───────────────────────────────────────────────────
|
|
sep
|
|
warn "Shutting down legacy stack..."
|
|
cd "$LEGACY_COMPOSE_DIR"
|
|
docker compose down --remove-orphans 2>/dev/null || true
|
|
|
|
for CNAME in $(docker ps -a --format '{{.Names}} {{.Image}}' | \
|
|
grep -iE "linuxserver/wireguard|lscr.io/linuxserver/wireguard|wireguard-api|sp-wireguard-api" | \
|
|
awk '{print $1}' || true); do
|
|
docker stop "$CNAME" 2>/dev/null || true
|
|
docker rm "$CNAME" 2>/dev/null || true
|
|
warn "Removed: $CNAME"
|
|
done
|
|
ok "Legacy stack stopped."
|
|
|
|
# ─── CLEAN NGINX ──────────────────────────────────────────────────────────────
|
|
sep
|
|
info "Cleaning Nginx for fresh install..."
|
|
for SITE in /etc/nginx/sites-enabled/*; do
|
|
rm -f "$SITE" && warn "Removed from sites-enabled: $(basename $SITE)"
|
|
done
|
|
for SITE in /etc/nginx/sites-available/*; do
|
|
NAME=$(basename "$SITE")
|
|
[ "$NAME" = "default" ] && continue
|
|
rm -f "$SITE" && warn "Removed from sites-available: $NAME"
|
|
done
|
|
rm -f /etc/nginx/sites-enabled/certbot-temp /etc/nginx/sites-available/certbot-temp 2>/dev/null || true
|
|
systemctl stop nginx 2>/dev/null || true
|
|
ok "Nginx cleaned."
|
|
|
|
# ─── VERIFY PORT 51820 FREE ───────────────────────────────────────────────────
|
|
sep
|
|
info "Checking port 51820/UDP..."
|
|
sleep 3
|
|
ss -ulnp 2>/dev/null | grep -q ":51820" && fail "Port 51820 still in use." || ok "Port 51820/UDP free."
|
|
|
|
echo "[END-00] $(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG"
|
|
|
|
echo ""
|
|
echo "========================================="
|
|
echo " Backup complete — System ready"
|
|
echo "========================================="
|
|
echo ""
|
|
echo " Backup dir : $BACKUP_DIR"
|
|
echo " Legacy stack : $LEGACY_COMPOSE_DIR"
|
|
echo " Public key : $LEGACY_PUBLIC_KEY"
|
|
echo " Peers saved : $PEER_COUNT"
|
|
echo ""
|
|
echo " SSH key for Simplified Privacy:"
|
|
echo " $SSH_PUBKEY"
|
|
echo ""
|
|
echo " Once SP authorizes access, run:"
|
|
echo " bash 01-migrate-user.sh"
|
|
echo ""
|
|
echo " Log: cat $LOG"
|
|
echo "========================================="
|