migrate to one service

2026-06-10 17:15:11 +00:00
parent 06376fc362
commit 3ef1f5ca07
8 changed files with 107 additions and 58 deletions
@@ -0,0 +1,82 @@
+#!/usr/bin/with-contenv bash
+set -eu
+
+if [ -z "${OUTLINE_TRANSPORT:-}" ]; then
+  echo "ERROR: OUTLINE_TRANSPORT is required (ss://...)" >&2
+  exit 1
+fi
+
+if [ -z "${INTERNAL_SUBNET:-}" ]; then
+  echo "ERROR: INTERNAL_SUBNET is required (e.g. 10.13.13.0)" >&2
+  exit 1
+fi
+
+WG_FWMARK=0x51820
+WG_SUBNET="${INTERNAL_SUBNET}/24"
+
+apply_bypass_rules() {
+  # WireGuard UDP replies go to the peer's public IP, not the WG subnet.
+  # Mark and bypass Outline policy routing for those packets.
+  ip rule add pref 50 fwmark "${WG_FWMARK}" lookup main 2>/dev/null || true
+
+  # Inner IP traffic to WG peers must use the main table (replies via wg0).
+  ip rule add pref 100 to "${WG_SUBNET}" lookup main 2>/dev/null || true
+
+  # Docker/custom bridge subnets differ per host (e.g. 172.17.0.0/16, 10.200.0.0/16).
+  local pref=101
+  local cidr
+  for cidr in $(ip -4 route show proto kernel scope link 2>/dev/null | awk '$2 == "dev" { print $1 }'); do
+    ip rule add pref "${pref}" to "${cidr}" lookup main 2>/dev/null || true
+    pref=$((pref + 1))
+  done
+}
+
+setup_wg_mangle() {
+  local wg_port="$1"
+  if iptables -t mangle -C OUTPUT -p udp --sport "${wg_port}" -j MARK --set-mark "${WG_FWMARK}" 2>/dev/null; then
+    return 0
+  fi
+  iptables -t mangle -A OUTPUT -p udp --sport "${wg_port}" -j MARK --set-mark "${WG_FWMARK}"
+}
+
+wait_for_outline_routing() {
+  local i
+  for i in $(seq 1 30); do
+    if ip link show outline233 >/dev/null 2>&1 && ip rule show | grep -q 'lookup 233'; then
+      return 0
+    fi
+    sleep 1
+  done
+  echo "WARN: Outline routing not ready after 30s, applying bypass rules anyway" >&2
+  return 1
+}
+
+/usr/local/bin/outline-cli -transport "${OUTLINE_TRANSPORT}" &
+OUTLINE_PID=$!
+
+wait_for_outline_routing || true
+apply_bypass_rules
+setup_wg_mangle "${SERVERPORT:-51820}"
+
+# wg0 starts after this service; refresh rules once the interface and listen port are known.
+(
+  for _ in $(seq 1 60); do
+    if ip link show wg0 >/dev/null 2>&1; then
+      wg_port="$(wg show wg0 listen-port 2>/dev/null || echo "${SERVERPORT:-51820}")"
+      setup_wg_mangle "${wg_port}"
+      apply_bypass_rules
+      break
+    fi
+    sleep 2
+  done
+) &
+
+# Ensure exactly one NAT rule for traffic leaving via Outline interface.
+if iptables -t nat -C POSTROUTING -o outline+ -j MASQUERADE 2>/dev/null; then
+  while iptables -t nat -C POSTROUTING -o outline+ -j MASQUERADE 2>/dev/null; do
+    iptables -t nat -D POSTROUTING -o outline+ -j MASQUERADE || true
+  done
+fi
+iptables -t nat -A POSTROUTING -o outline+ -j MASQUERADE
+
+wait "$OUTLINE_PID"