Monitor WireGuard VPN server with Prometheus and Grafana dashboards

#!/usr/bin/env bash
set -euo pipefail

# WireGuard Monitoring with Prometheus and Grafana Installation Script
# Supports: Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, RHEL, Fedora

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
WIREGUARD_INTERFACE=${1:-wg0}
EXPORTER_PORT=9586
PROMETHEUS_PORT=9090
GRAFANA_PORT=3000

usage() {
    echo "Usage: $0 [wireguard_interface]"
    echo "Example: $0 wg0"
    exit 1
}

cleanup() {
    echo -e "${RED}Installation failed. Cleaning up...${NC}"
    systemctl stop wireguard-exporter.service 2>/dev/null || true
    systemctl disable wireguard-exporter.service 2>/dev/null || true
    rm -f /etc/systemd/system/wireguard-exporter.service
    rm -f /usr/local/bin/wireguard_exporter
    userdel wireguard-exporter 2>/dev/null || true
    rm -rf /var/lib/wireguard-exporter
    rm -rf /opt/prometheus_wireguard_exporter
}

trap cleanup ERR

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root or with sudo${NC}"
    exit 1
fi

# Detect distribution
echo -e "${YELLOW}[1/12] Detecting distribution...${NC}"
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            PROMETHEUS_CONFIG="/etc/prometheus/prometheus.yml"
            PROMETHEUS_SERVICE="prometheus"
            GRAFANA_CONFIG="/etc/grafana/grafana.ini"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            PROMETHEUS_CONFIG="/etc/prometheus/prometheus.yml"
            PROMETHEUS_SERVICE="prometheus"
            GRAFANA_CONFIG="/etc/grafana/grafana.ini"
            if [[ "$ID" == "centos" && "${VERSION_ID%%.*}" -lt 8 ]]; then
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
            fi
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            PROMETHEUS_CONFIG="/etc/prometheus/prometheus.yml"
            PROMETHEUS_SERVICE="prometheus"
            GRAFANA_CONFIG="/etc/grafana/grafana.ini"
            ;;
        *) 
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1 
            ;;
    esac
    echo -e "${GREEN}Detected: $PRETTY_NAME${NC}"
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

# Check if WireGuard is installed
echo -e "${YELLOW}[2/12] Checking WireGuard installation...${NC}"
if ! command -v wg >/dev/null 2>&1; then
    echo -e "${RED}WireGuard is not installed. Please install WireGuard first.${NC}"
    exit 1
fi

if [ ! -f "/etc/wireguard/$WIREGUARD_INTERFACE.conf" ]; then
    echo -e "${RED}WireGuard configuration /etc/wireguard/$WIREGUARD_INTERFACE.conf not found${NC}"
    exit 1
fi

echo -e "${GREEN}WireGuard is installed and configured${NC}"

# Update system packages
echo -e "${YELLOW}[3/12] Updating system packages...${NC}"
$PKG_UPDATE

# Install dependencies
echo -e "${YELLOW}[4/12] Installing dependencies...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL golang-go git curl wget
elif [[ "$PKG_MGR" == "dnf" || "$PKG_MGR" == "yum" ]]; then
    $PKG_INSTALL golang git curl wget
    if [[ "$ID" == "almalinux" || "$ID" == "rocky" || "$ID" == "centos" ]]; then
        $PKG_INSTALL epel-release
    fi
fi

# Download and compile WireGuard Prometheus exporter
echo -e "${YELLOW}[5/12] Building WireGuard Prometheus exporter...${NC}"
cd /opt
git clone https://github.com/MindFlavor/prometheus_wireguard_exporter.git
cd prometheus_wireguard_exporter
go build -o wireguard_exporter

# Create WireGuard exporter user and directories
echo -e "${YELLOW}[6/12] Creating system user and directories...${NC}"
useradd --system --shell /bin/false --home /var/lib/wireguard-exporter --create-home wireguard-exporter
mkdir -p /var/lib/wireguard-exporter
cp wireguard_exporter /usr/local/bin/
chmod 755 /usr/local/bin/wireguard_exporter
chown wireguard-exporter:wireguard-exporter /var/lib/wireguard-exporter

# Grant WireGuard exporter access
echo -e "${YELLOW}[7/12] Configuring permissions...${NC}"
usermod -a -G systemd-network wireguard-exporter
chmod 640 "/etc/wireguard/$WIREGUARD_INTERFACE.conf"
chgrp systemd-network "/etc/wireguard/$WIREGUARD_INTERFACE.conf"

# Create systemd service
echo -e "${YELLOW}[8/12] Creating systemd service...${NC}"
cat > /etc/systemd/system/wireguard-exporter.service << EOF
[Unit]
Description=Prometheus WireGuard Exporter
Wants=network-online.target
After=network-online.target

[Service]
User=wireguard-exporter
Group=wireguard-exporter
Type=simple
ExecStart=/usr/local/bin/wireguard_exporter -n /etc/wireguard/$WIREGUARD_INTERFACE.conf
Restart=on-failure
RestartSec=5
CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true

[Install]
WantedBy=multi-user.target
EOF

# Start WireGuard exporter
echo -e "${YELLOW}[9/12] Starting WireGuard exporter...${NC}"
systemctl daemon-reload
systemctl enable --now wireguard-exporter.service

# Install Prometheus
echo -e "${YELLOW}[10/12] Installing Prometheus...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL prometheus
elif [[ "$PKG_MGR" == "dnf" ]]; then
    $PKG_INSTALL prometheus2
    PROMETHEUS_SERVICE="prometheus2"
elif [[ "$PKG_MGR" == "yum" ]]; then
    $PKG_INSTALL prometheus2 || $PKG_INSTALL prometheus
fi

# Configure Prometheus
echo -e "${YELLOW}[11/12] Configuring Prometheus...${NC}"
mkdir -p /etc/prometheus
cat > $PROMETHEUS_CONFIG << EOF
global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:$PROMETHEUS_PORT']

  - job_name: 'wireguard'
    static_configs:
      - targets: ['localhost:$EXPORTER_PORT']
    scrape_interval: 10s
    metrics_path: /metrics
EOF

chown prometheus:prometheus $PROMETHEUS_CONFIG
chmod 644 $PROMETHEUS_CONFIG

# Install and configure Grafana
echo -e "${YELLOW}[12/12] Installing Grafana...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    curl -fsSL https://packages.grafana.com/gpg.key | apt-key add -
    echo "deb https://packages.grafana.com/oss/deb stable main" | tee /etc/apt/sources.list.d/grafana.list
    apt update
    $PKG_INSTALL grafana
elif [[ "$PKG_MGR" == "dnf" || "$PKG_MGR" == "yum" ]]; then
    cat > /etc/yum.repos.d/grafana.repo << EOF
[grafana]
name=grafana
baseurl=https://packages.grafana.com/oss/rpm
repo_gpgcheck=1
enabled=1
gpgcheck=1
gpgkey=https://packages.grafana.com/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF
    $PKG_INSTALL grafana
fi

# Configure firewall
if command -v ufw >/dev/null 2>&1; then
    ufw allow $EXPORTER_PORT/tcp
    ufw allow $PROMETHEUS_PORT/tcp
    ufw allow $GRAFANA_PORT/tcp
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-port=$EXPORTER_PORT/tcp
    firewall-cmd --permanent --add-port=$PROMETHEUS_PORT/tcp
    firewall-cmd --permanent --add-port=$GRAFANA_PORT/tcp
    firewall-cmd --reload
fi

# Start services
systemctl enable --now $PROMETHEUS_SERVICE
systemctl enable --now grafana-server

# Verification
echo -e "${GREEN}Installation completed! Verifying services...${NC}"

sleep 5

if systemctl is-active --quiet wireguard-exporter.service; then
    echo -e "${GREEN}✓ WireGuard exporter is running${NC}"
else
    echo -e "${RED}✗ WireGuard exporter failed to start${NC}"
    exit 1
fi

if systemctl is-active --quiet $PROMETHEUS_SERVICE; then
    echo -e "${GREEN}✓ Prometheus is running${NC}"
else
    echo -e "${RED}✗ Prometheus failed to start${NC}"
    exit 1
fi

if systemctl is-active --quiet grafana-server; then
    echo -e "${GREEN}✓ Grafana is running${NC}"
else
    echo -e "${RED}✗ Grafana failed to start${NC}"
    exit 1
fi

# Test endpoints
if curl -s localhost:$EXPORTER_PORT/metrics >/dev/null; then
    echo -e "${GREEN}✓ WireGuard exporter metrics available${NC}"
else
    echo -e "${RED}✗ WireGuard exporter metrics not accessible${NC}"
fi

if curl -s localhost:$PROMETHEUS_PORT >/dev/null; then
    echo -e "${GREEN}✓ Prometheus web interface accessible${NC}"
else
    echo -e "${RED}✗ Prometheus web interface not accessible${NC}"
fi

echo -e "${GREEN}"
echo "=================================================="
echo "WireGuard Monitoring Setup Complete!"
echo "=================================================="
echo "WireGuard Exporter: http://localhost:$EXPORTER_PORT/metrics"
echo "Prometheus: http://localhost:$PROMETHEUS_PORT"
echo "Grafana: http://localhost:$GRAFANA_PORT (admin/admin)"
echo ""
echo "Next steps:"
echo "1. Access Grafana and change default password"
echo "2. Add Prometheus as data source (http://localhost:$PROMETHEUS_PORT)"
echo "3. Import WireGuard dashboard"
echo -e "${NC}"