diff options
| author | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
| commit | 83f7fe4b8402bab171d110703a1b1115efbc9b28 (patch) | |
| tree | 19110702c7d740f6bd8ee4f5d2ebcb97442be237 /fix-sanctum.sh | |
| parent | 51d43498b07dc97d795947964534f0903cd05db5 (diff) | |
| download | bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.tar.gz bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.zip | |
cleaned up many scrits and deleted some that were of no use; renamed a lot
Diffstat (limited to 'fix-sanctum.sh')
| -rwxr-xr-x | fix-sanctum.sh | 73 |
1 files changed, 0 insertions, 73 deletions
diff --git a/fix-sanctum.sh b/fix-sanctum.sh deleted file mode 100755 index 070fb07..0000000 --- a/fix-sanctum.sh +++ /dev/null @@ -1,73 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -# ================= CONFIG ================= -WG_CON="wg-sanctum" -SERVER_WG_IP="10.50.0.1" -SERVER_USER="lukasz" -SSH_PORT="57385" -SSH_KEY="$HOME/.ssh/sacrum.key" - -# ================= HELPERS ================= -log() { printf "\n==> %s\n" "$*"; } -die() { printf "\nERROR: %s\n" "$*" >&2; exit 1; } - -# ================= 1) RESTART WG ================= -log "Restarting WireGuard connection: $WG_CON" - -nmcli -t -f NAME con show | grep -Fxq "$WG_CON" \ - || die "NetworkManager connection '$WG_CON' not found" - -nmcli con down "$WG_CON" >/dev/null 2>&1 || true -nmcli con up "$WG_CON" >/dev/null - -sleep 2 - -log "WireGuard status (host)" -sudo wg show "$WG_CON" || die "wg show failed" - -# ================= 2) TEST WG ================= -log "Testing WG reachability to server ($SERVER_WG_IP)" - -if ! ping -c 2 -W 2 "$SERVER_WG_IP" >/dev/null; then - die "WG ping failed (likely VPN/killswitch or routing issue)" -fi - -log "WG ping OK" - -# ================= 3) FIX SSH ON SERVER ================= -log "Fixing SSH permissions on server (interactive, safe)" - -ssh -tt -i "$SSH_KEY" -p "$SSH_PORT" \ - -o IdentitiesOnly=yes \ - "$SERVER_USER@$SERVER_WG_IP" \ - "set -e; - USER_NAME='lukasz'; - HOME_DIR=\"/home/\$USER_NAME\"; - SSH_DIR=\"\$HOME_DIR/.ssh\"; - AUTH_KEYS=\"\$SSH_DIR/authorized_keys\"; - - echo '-> Enforcing SSH directory invariants'; - sudo mkdir -p \"\$SSH_DIR\"; - sudo chown -R \"\$USER_NAME:\$USER_NAME\" \"\$SSH_DIR\"; - sudo chmod 700 \"\$SSH_DIR\"; - - if [ -f \"\$AUTH_KEYS\" ]; then - sudo chown \"\$USER_NAME:\$USER_NAME\" \"\$AUTH_KEYS\"; - sudo chmod 600 \"\$AUTH_KEYS\"; - fi; - - echo '-> Restarting sshd'; - sudo systemctl restart ssh; - " - -# ================= 4) FINAL VERIFICATION ================= -log "Final SSH verification over WireGuard" - -ssh -i "$SSH_KEY" -p "$SSH_PORT" \ - -o IdentitiesOnly=yes \ - "$SERVER_USER@$SERVER_WG_IP" \ - 'echo "SSH OK via WireGuard"' - -log "ALL FIXES APPLIED SUCCESSFULLY" - |
