wireguard fixes

diff --git a/brc2 b/brc2
index 172e00681583193f5b8e71c867f873f681f4f460..3c3ac99ac132c4d9de41d621c6d81e7131b5952c 100644 (file)
--- a/brc2
+++ b/brc2
@@ -1541,12 +1541,35 @@ apache-strip() {
 }
 
 chro() {
+  local prtmp pid ret=0
   if type -p chromium &>/dev/null; then
     cmd=chromium
   else
     cd /
     cmd="schroot -c bookworm chromium"
-    CHROMIUM_FLAGS='--enable-remote-extensions' $cmd -- "$@" & r
+  fi
+  # without --no-sandbox, it fails due to not having user namespaces
+  # enabled. As of 2026, User namespaces has too often been a
+  # mechanism for giving root rather than being useful as a security
+  # measure.
+  echo "iank: running CHROMIUM_FLAGS=--enable-remote-extensions $cmd -- --no-sandbox $*"
+  CHROMIUM_FLAGS=--enable-remote-extensions $cmd -- --no-sandbox "$@" &
+  pid=$!
+  # wait in case it dies right away so that we print the output instead of exiting
+  sleep 2
+  prtmp=$(jobs -s; jobs -r)
+  if (( ${#prtmp} != 0  )); then
+    printf '\n\n\n\n\n#################\n\n'
+    echo "iank: exiting this shell for convenience"
+    sleep 0.5
+    r
+  else
+    # background: The pid arg is required to get the exit code.
+    wait $pid || ret=$?
+    printf '\n\n\n\n\n#################\n\n'
+    echo "iank: detected chromium exit with success (perhaps it was already running). exiting this shell for convenience"
+    sleep 2
+    r
   fi
 }
 
@@ -2200,6 +2223,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.$ipsuf start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
@@ -2322,12 +2346,13 @@ EOF
     for host in ${!vpn_ips[@]}; do
       ipsuf=${vpn_ips[$host]}
       cat <<EOF
-$host  A       10.0.0.$ipsuf
 ${host}wg      A       10.8.0.$ipsuf
 ${host}vp      A       10.5.5.$ipsuf
 ${host}tr      A       10.174.$ipsuf.2
 ${host}i       CNAME   i.b8.nz.
 EOF
+      if [[ $host == frodo ]]; then ipsuf=1; fi # notes in host-info
+      printf '%s\n' "$host     A       10.0.0.$ipsuf"
     done
   } | cedit -e vpn-ips-update /p/c/machine_specific/vps/bind-initial/db.b8.nz
 
@@ -3839,10 +3864,9 @@ sdnncmd() {
   m sudo nsenter -t $pid -n sudo -u $USER -i bash -c ". $tmpf"
 }
 
-
-mailnnbash() {
-  sdnbashroot mailnn
-}
+ mailnnbash() {
+   sdnbashroot wg-quick-mail
+ }
 
 # we use wireguard now, use mailnnbash.
 # mailvpnbash() {
@@ -3869,6 +3893,7 @@ nmtc() {
   s nmtui-connect "$@"
 }
 
+## todo: fix, mailnn unit is old and no longer exists.
 # check exim and others network namespace
 mailnncheck() {
   local unit pid ns mailnn spamd_ser
@@ -3935,8 +3960,7 @@ vpni() {
 vpnbash() {
   local n="$1" ser_suf=tr
   if [[ $n ]]; then ser_suf=nn; fi
-  #m sudm nsenter --net=/var/run/netns/client bash # only gets netns
-  sdncmdroot wg-quick-$ser_suf@client$n.service bash
+  m sdncmdroot wg-quick-$ser_suf@client$n.service bash
 }
 
 

diff --git a/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 7f228e7a7ceb09f79436bf4cb60e00e43fa4aadb..ee8e5ad14f9c73c681fecd986fcc62c0b062a636 100644 (file)
--- a/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.29 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 128c86c11b4e17d8b3c0614b2e1a443ebfdd9b74..4687ad8326a503dfb83866be6284fb9774596370 100644 (file)
--- a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,7 +3,8 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.1 start %i
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
+ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.34 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
 

diff --git a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service
index b2ef48afb5b5fc44f81cc640f791031201241142..2afc64314b1afe6bceb87aee5046af9978efbb5e 100644 (file)
--- a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service
+++ b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service
@@ -9,11 +9,11 @@ Documentation=man:wg(8)
 Type=simple
 ExecReload=/bin/bash -c 'exec /usr/bin/wg syncconf %i <(exec /usr/bin/wg-quick strip %i)'
 ExecStartPre=/sbin/iptables-restore /a/bin/distro-setup/transmission-firewall/netns.rules
-ExecStartPre=/usr/sbin/ip r add 10.8.0.0/24 via 10.174.1.1 dev veth1-client
+ExecStartPre=/usr/sbin/ip r add 10.8.0.0/24 via 10.174.34.1 dev veth1-client
 ExecStartPre=/usr/bin/wg-quick up %i
 ExecStart=/bin/sleep infinity
 ExecStopPost=/usr/bin/wg-quick down %i
-ExecStopPost=/usr/sbin/ip r del 10.8.0.0/24 via 10.174.1.1 dev veth1-client
+ExecStopPost=/usr/sbin/ip r del 10.8.0.0/24 via 10.174.34.1 dev veth1-client
 NetworkNamespacePath=/var/run/netns/%i
 BindReadOnlyPaths=/etc/tr-resolv:/run/systemd/resolve:norbind /etc/basic-nsswitch:/etc/resolved-nsswitch:norbind
 # copied from wg-quick@.service

diff --git a/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index a837dd7aa853152a116a91239fb254bf6f74cd23..8c071d53688c2f1c8c59d89db898e841ebe77bac 100644 (file)
--- a/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.2 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo b/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo
index de17a560c1fa10286c08c101c4cc483b86cb5165..7fbb17ceb20d2d98f434f918d78ba5b607acca80 100644 (file)
--- a/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo
+++ b/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo
@@ -1 +1 @@
-ifconfig-push 10.5.5.1 255.255.255.0
+ifconfig-push 10.5.5.34 255.255.255.0

diff --git a/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 62c09826735cbd4d6925987d5d3d88d641e3e7d6..b4565dbee42a4569ef38f5a2c6e959167caa0e8c 100644 (file)
--- a/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.97 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 16560d18967cc197ad7a5dbcc2913d2ebdafec71..c771a5b15eadbf305a1f1546806dacf6c2e15f7e 100644 (file)
--- a/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.99 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 554ea54dfa44470922a44fd7851c526fc0248da0..e8b3f0b6b7252abd5d1bcb43482dfe14bb2b8078 100644 (file)
--- a/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.9 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index e59c9222c4b416b93d052e58b4c01f11969c6f09..2d5280aaea3603699f3f4995ddb8da2053b52cf4 100644 (file)
--- a/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.3 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 31c0184fbdbd5876340369e8188e3364e28e017a..ea43189b01670489bb52f5ed7f3d4511bee1f34c 100644 (file)
--- a/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.7 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 9e231e366f3bcd1054bb3fa6dfd05b6f36cbca28..c4979e6006e60d9a12026ae6fbbf1d952ca4d4fb 100644 (file)
--- a/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.28 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 9370efe234a7cd42e0607a0c57392d827357f274..e7bc80fc9660c14a107410ec7c063799de3c4744 100644 (file)
--- a/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.8 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes

diff --git a/mail-setup b/mail-setup
index d4987ff76437af0db5ae986c39da1eba21b71290..c27d7ed9ae5ccb95dda86048beaec56090a37c51 100755 (executable)
--- a/mail-setup
+++ b/mail-setup
@@ -19,6 +19,7 @@
 
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+
 # TODO: on desktop, somehow
 # exim updates screwed up the config file, probably by generating it
 # outside of the normal processes. I'm tracking those changes via
@@ -913,8 +914,12 @@ fi
 #
 #1: unify the mail vpn and wghole
 # into 1 network.  this seems simple and logical, so I'm doing it.
-# One general downside is tying things together, if I need to mess
-# with one thing, it breaks the other. Oh well for now.
+# Note: this is a bit confusing because we intentionally have
+# mail host netns interface + wghole interface on the same host
+# with different ips on the same net. Looks like a bug at first glance,
+# but it is just a convenient way to have static ip & routing rules
+# for the mail ip which the mail host adopts, while wghole ips vary
+# per host.
 #
 # 2. We can route 10.5.3.0/24 out of the mail nn and nat it into wghole.
 #
@@ -4849,9 +4854,9 @@ fi
 
 case $HOSTNAME in
   $MAIL_HOST|bk)
-    # If any of these have config changes, then restart them as needed:
-    # sre  wg-quick-mail
-    son wg-quick-mail
+    # note: this is sre instead of son because wireguard can fail in multiple
+    # ways but the unit will show as running fine.
+    sre wg-quick-mail
     ;;&
   $MAIL_HOST)
     # If this service's config changes, add a manual restart here.
@@ -4891,7 +4896,8 @@ case $HOSTNAME in
     ;;&
 esac
 
-## wip to only restart services that actually need restarting.
+## wip (does nothing yet) to only restart services that actually need
+## restarting.
 all_units=(
   wg-quick-mail.service
   unbound.service