setup-tinc-peer.sh

#!/usr/bin/env bash

# Based on https://github.com/edanaher/scaleway-utils/blob/45d89a534d0ff9427a120e509d215e195fe083dc/tinc/add-tinc.sh

export PS4="\[\033[32;1m++\[\033[0m "
set -ex

HOST=$1
TINCIP=$2
TINCNAME=${3:-$1}

TINCROUTE=$(ssh -l root $HOST -C 'ip r' | grep /31 | cut -d/ -f1)

VPNNAME=mesh
TINCPATH=/etc/tinc/$VPNNAME

MYTINCIP=$(ip addr show $VPNNAME | grep -o 'inet [^/]*' | cut -d' ' -f 2)
MYIP=$(ip addr show eth0 | grep -o 'inet [^/]*' | cut -d' ' -f 2)
MYNAME=$(cat $TINCPATH/tinc.conf | awk '/Name/ { print $3}')

scp /var/cache/apk/{tinc,lzo,libressl*-libcrypto}*.apk root@${HOST}:/tmp

ssh -l root $HOST -C bash <<EOF
export PS4="\[\033[32;1m++++\[\033[0m "
set -ex
apk info tinc > /dev/null || apk add /tmp/libressl*-libcrypto*.apk /tmp/lzo*.apk /tmp/tinc*.apk

mkdir -p ${TINCPATH}/hosts

if [ ! -f ${TINCPATH}/tinc.conf ]; then
	echo "Name = ${TINCNAME}" > ${TINCPATH}/tinc.conf
	echo "AddressFamily = ipv4" >> ${TINCPATH}/tinc.conf
	echo "Interface = $VPNNAME" >> ${TINCPATH}/tinc.conf
	echo "ConnectTo = $MYNAME" >> ${TINCPATH}/tinc.conf
fi

if [ ! -f ${TINCPATH}/hosts/${TINCNAME} ]; then
	echo "Subnet = ${TINCIP}/32" > ${TINCPATH}/hosts/${TINCNAME}
	tincd -n $VPNNAME -K4096
fi

echo "#!/bin/sh" > ${TINCPATH}/tinc-up
echo 'ip link set \$INTERFACE up mtu 1400' >> ${TINCPATH}/tinc-up
echo "ip addr add $TINCIP/24 dev \\\$INTERFACE" >> ${TINCPATH}/tinc-up
echo "ip route add 10.0.0.0/8 via $TINCROUTE dev eth0" >> ${TINCPATH}/tinc-up
echo 'ip route change default dev \$INTERFACE' >> ${TINCPATH}/tinc-up

echo "#!/bin/sh" > ${TINCPATH}/tinc-down
echo "ip route change default via $TINCROUTE" >> ${TINCPATH}/tinc-down
echo 'ip link set \$INTERFACE down' >> ${TINCPATH}/tinc-down

chmod +x ${TINCPATH}/tinc-{up,down}
grep "NETWORK: $VPNNAME" /etc/conf.d/tinc.networks || echo "NETWORK: $VPNNAME" >> /etc/conf.d/tinc.networks
EOF

scp ${TINCPATH}/hosts/$MYNAME $HOST:${TINCPATH}/hosts/
scp $HOST:${TINCPATH}/hosts/${TINCNAME} ${TINCPATH}/hosts/
tincd -n $VPNNAME -k HUP || service tincd restart

ssh -l root $HOST <<EOF
service tincd restart
EOF