Configure WireGuard site-to-site VPN connections with advanced routing and security

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Global variables
SITE_ROLE=""
SITE_A_ENDPOINT=""
SITE_B_ENDPOINT=""
SITE_A_NETWORK="192.168.1.0/24"
SITE_B_NETWORK="192.168.2.0/24"
WG_NETWORK="10.100.0.0/30"
WG_PORT="51820"

# Cleanup function
cleanup() {
    echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
    systemctl stop wg-quick@wg0 2>/dev/null || true
    systemctl disable wg-quick@wg0 2>/dev/null || true
    rm -f /etc/wireguard/wg0.conf
    rm -f /etc/wireguard/private.key /etc/wireguard/public.key
}

trap cleanup ERR

usage() {
    echo "Usage: $0 <site_role> [site_a_endpoint] [site_b_endpoint]"
    echo "  site_role: 'primary' or 'secondary'"
    echo "  site_a_endpoint: Public IP/hostname of primary site (required for secondary)"
    echo "  site_b_endpoint: Public IP/hostname of secondary site (optional)"
    echo ""
    echo "Examples:"
    echo "  $0 primary"
    echo "  $0 secondary 203.0.113.10"
    echo "  $0 primary 203.0.113.10 203.0.113.20"
    exit 1
}

log() {
    echo -e "${GREEN}$1${NC}"
}

warn() {
    echo -e "${YELLOW}$1${NC}"
}

error() {
    echo -e "${RED}$1${NC}"
    exit 1
}

check_root() {
    if [[ $EUID -ne 0 ]]; then
        error "This script must be run as root"
    fi
}

detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_INSTALL="apt install -y"
                IPTABLES_SERVICE="netfilter-persistent"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                IPTABLES_SERVICE="iptables"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                IPTABLES_SERVICE="iptables"
                ;;
            *)
                error "Unsupported distribution: $ID"
                ;;
        esac
    else
        error "Cannot detect distribution (no /etc/os-release found)"
    fi
    log "[✓] Detected distribution: $ID"
}

install_packages() {
    echo "[2/8] Installing WireGuard and dependencies..."
    
    $PKG_UPDATE
    
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL wireguard wireguard-tools iptables-persistent
            ;;
        dnf|yum)
            $PKG_INSTALL wireguard-tools iptables-services
            systemctl enable --now iptables
            ;;
    esac
    
    log "[✓] Packages installed successfully"
}

enable_ip_forwarding() {
    echo "[3/8] Enabling IP forwarding..."
    
    echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-wireguard.conf
    sysctl -p /etc/sysctl.d/99-wireguard.conf
    
    log "[✓] IP forwarding enabled"
}

generate_keys() {
    echo "[4/8] Generating WireGuard keys..."
    
    mkdir -p /etc/wireguard
    chmod 700 /etc/wireguard
    
    wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key
    chmod 600 /etc/wireguard/private.key
    chmod 644 /etc/wireguard/public.key
    
    log "[✓] Keys generated successfully"
}

get_default_interface() {
    ip route | grep default | awk '{print $5}' | head -n1
}

create_config() {
    echo "[5/8] Creating WireGuard configuration..."
    
    local private_key=$(cat /etc/wireguard/private.key)
    local default_iface=$(get_default_interface)
    
    if [[ "$SITE_ROLE" == "primary" ]]; then
        cat > /etc/wireguard/wg0.conf << EOF
[Interface]
PrivateKey = $private_key
Address = 10.100.0.1/30
ListenPort = $WG_PORT
SaveConfig = false

# Enable IP forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1

# Add route to remote network
PostUp = ip route add $SITE_B_NETWORK dev wg0

# Configure firewall rules
PostUp = iptables -A FORWARD -i wg0 -o $default_iface -j ACCEPT
PostUp = iptables -A FORWARD -i $default_iface -o wg0 -j ACCEPT
PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -s $WG_NETWORK -o $default_iface -j MASQUERADE

# Cleanup on shutdown
PreDown = ip route del $SITE_B_NETWORK dev wg0 2>/dev/null || true
PreDown = iptables -D FORWARD -i wg0 -o $default_iface -j ACCEPT 2>/dev/null || true
PreDown = iptables -D FORWARD -i $default_iface -o wg0 -j ACCEPT 2>/dev/null || true
PreDown = iptables -D FORWARD -i wg0 -o wg0 -j ACCEPT 2>/dev/null || true
PreDown = iptables -t nat -D POSTROUTING -s $WG_NETWORK -o $default_iface -j MASQUERADE 2>/dev/null || true

# Peer configuration will be added manually
EOF
    else
        if [[ -z "$SITE_A_ENDPOINT" ]]; then
            error "Primary site endpoint is required for secondary site"
        fi
        
        cat > /etc/wireguard/wg0.conf << EOF
[Interface]
PrivateKey = $private_key
Address = 10.100.0.2/30
SaveConfig = false

# Enable IP forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1

# Add route to remote network
PostUp = ip route add $SITE_A_NETWORK dev wg0

# Configure firewall rules
PostUp = iptables -A FORWARD -i wg0 -o $default_iface -j ACCEPT
PostUp = iptables -A FORWARD -i $default_iface -o wg0 -j ACCEPT
PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -s $WG_NETWORK -o $default_iface -j MASQUERADE

# Cleanup on shutdown
PreDown = ip route del $SITE_A_NETWORK dev wg0 2>/dev/null || true
PreDown = iptables -D FORWARD -i wg0 -o $default_iface -j ACCEPT 2>/dev/null || true
PreDown = iptables -D FORWARD -i $default_iface -o wg0 -j ACCEPT 2>/dev/null || true
PreDown = iptables -D FORWARD -i wg0 -o wg0 -j ACCEPT 2>/dev/null || true
PreDown = iptables -t nat -D POSTROUTING -s $WG_NETWORK -o $default_iface -j MASQUERADE 2>/dev/null || true

[Peer]
Endpoint = $SITE_A_ENDPOINT:$WG_PORT
PublicKey = PLACEHOLDER_PRIMARY_PUBLIC_KEY
AllowedIPs = 10.100.0.1/32, $SITE_A_NETWORK
PersistentKeepalive = 25
EOF
    fi
    
    chmod 600 /etc/wireguard/wg0.conf
    log "[✓] Configuration created"
}

configure_selinux() {
    if command -v getenforce >/dev/null 2>&1 && [[ "$(getenforce)" != "Disabled" ]]; then
        echo "[6/8] Configuring SELinux..."
        setsebool -P domain_can_mmap_files 1 2>/dev/null || true
        log "[✓] SELinux configured"
    else
        echo "[6/8] SELinux not active, skipping..."
    fi
}

enable_service() {
    echo "[7/8] Enabling WireGuard service..."
    
    systemctl enable wg-quick@wg0
    
    warn "Service enabled but not started yet - peer configuration needed first"
    log "[✓] Service configured"
}

show_summary() {
    echo "[8/8] Installation complete!"
    echo ""
    echo -e "${BLUE}=== WireGuard Site-to-Site VPN Configuration ===${NC}"
    echo -e "${BLUE}Site Role:${NC} $SITE_ROLE"
    echo -e "${BLUE}Public Key:${NC} $(cat /etc/wireguard/public.key)"
    echo -e "${BLUE}Network:${NC} $(if [[ "$SITE_ROLE" == "primary" ]]; then echo "$SITE_A_NETWORK"; else echo "$SITE_B_NETWORK"; fi)"
    echo -e "${BLUE}Tunnel IP:${NC} $(if [[ "$SITE_ROLE" == "primary" ]]; then echo "10.100.0.1"; else echo "10.100.0.2"; fi)"
    echo ""
    
    if [[ "$SITE_ROLE" == "primary" ]]; then
        echo -e "${YELLOW}Next steps for PRIMARY site:${NC}"
        echo "1. Share your public key with the secondary site"
        echo "2. Get the secondary site's public key"
        echo "3. Add peer configuration:"
        echo "   wg set wg0 peer SECONDARY_PUBLIC_KEY allowed-ips 10.100.0.2/32,$SITE_B_NETWORK"
        echo "4. Start the service: systemctl start wg-quick@wg0"
    else
        echo -e "${YELLOW}Next steps for SECONDARY site:${NC}"
        echo "1. Replace PLACEHOLDER_PRIMARY_PUBLIC_KEY in /etc/wireguard/wg0.conf"
        echo "2. Start the service: systemctl start wg-quick@wg0"
        echo "3. Share your public key with the primary site"
    fi
    
    echo ""
    echo -e "${GREEN}Installation completed successfully!${NC}"
}

# Main execution
main() {
    if [[ $# -lt 1 ]]; then
        usage
    fi
    
    SITE_ROLE="$1"
    
    if [[ "$SITE_ROLE" != "primary" && "$SITE_ROLE" != "secondary" ]]; then
        error "Invalid site role. Must be 'primary' or 'secondary'"
    fi
    
    if [[ "$SITE_ROLE" == "secondary" && $# -lt 2 ]]; then
        error "Secondary site requires primary site endpoint"
    fi
    
    if [[ $# -ge 2 ]]; then
        SITE_A_ENDPOINT="$2"
    fi
    
    if [[ $# -ge 3 ]]; then
        SITE_B_ENDPOINT="$3"
    fi
    
    echo -e "${BLUE}WireGuard Site-to-Site VPN Installer${NC}"
    echo "===================================="
    
    echo "[1/8] Checking prerequisites..."
    check_root
    detect_distro
    
    install_packages
    enable_ip_forwarding
    generate_keys
    create_config
    configure_selinux
    enable_service
    show_summary
}

main "$@"