rewrite pi-hole and pivpn scripts to use docker containers

.github/workflows/update-wireguard-major-version.yml

@@ -0,0 +1,88 @@
+name: 'Update WireGuard Major Version'
+
+on:
+  schedule:
+    # Run on the first day of every month at 04:00 UTC
+    - cron: '0 4 1 * *'
+  workflow_dispatch: # Allow manual trigger
+
+jobs:
+  update-wireguard:
+    name: Update the pinned wg-easy major version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Update the pinned major version
+        id: update
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          CURRENT="$(grep -oP '(?<=ghcr\.io/wg-easy/wg-easy:)\d+' not-supported/wireguard.sh | head -1)"
+          if [ -z "$CURRENT" ]
+          then
+              echo "Could not find the pinned wg-easy version in not-supported/wireguard.sh"
+              exit 1
+          fi
+          # The 'latest' endpoint never returns drafts or prereleases,
+          # which is important since wg-easy publishes beta releases as well
+          TAG="$(gh api repos/wg-easy/wg-easy/releases/latest --jq '.tag_name')"
+          # '|| true' since a non-matching grep would otherwise abort the step
+          # before the error message below can run, as GitHub runs this with 'bash -e'
+          LATEST="$(echo "$TAG" | grep -oP '(?<=^v)\d+' || true)"
+          if [ -z "$LATEST" ]
+          then
+              echo "Could not parse a major version from the tag '$TAG'"
+              exit 1
+          fi
+          # Compare numerically here so that e.g. 9 -> 10 is handled correctly
+          if [ "$LATEST" -le "$CURRENT" ]
+          then
+              echo "The pinned version $CURRENT is already up to date"
+              exit 0
+          fi
+          # Make sure that we don't pin a tag that isn't published on ghcr.io,
+          # since the release and the image don't necessarily appear at once
+          if ! docker manifest inspect "ghcr.io/wg-easy/wg-easy:$LATEST" &>/dev/null
+          then
+              echo "The image tag '$LATEST' doesn't exist (yet) on ghcr.io"
+              exit 0
+          fi
+          sed -i "s|ghcr.io/wg-easy/wg-easy:$CURRENT|ghcr.io/wg-easy/wg-easy:$LATEST|g" not-supported/wireguard.sh
+          if ! git diff --quiet .
+          then
+              echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
+              echo "version=$LATEST" >> "$GITHUB_OUTPUT"
+              echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create Pull Request
+        if: steps.update.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@v8
+        with:
+          commit-message: 'Update WireGuard to major version ${{ steps.update.outputs.version }}'
+          title: 'Update WireGuard to major version ${{ steps.update.outputs.version }}'
+          body: |
+            Automated update of the pinned wg-easy image from major version `${{ steps.update.outputs.current }}` to `${{ steps.update.outputs.version }}` (latest release: `${{ steps.update.outputs.tag }}`).
+
+            The image in `not-supported/wireguard.sh` is pinned to a major tag so that `nextcloud_update.sh` only pulls patch releases automatically. Major upgrades are intentionally not automatic and need this PR.
+
+            > [!WARNING]
+            > Please **do not merge this without testing it first**. Major releases of wg-easy have contained breaking changes in the past, which can affect:
+            > - the `INIT_*` environment variables that create the admin account
+            > - the format of the config in the `wg_easy` docker volume, which existing installs keep across a reinstall
+            > - the sysctls, capabilities and the web interface port
+            >
+            > Please check the [release notes](https://github.com/wg-easy/wg-easy/releases/tag/${{ steps.update.outputs.tag }}) and run a fresh install **and** a reinstall over an existing volume before merging.
+          branch: 'automated/wireguard-version'
+          delete-branch: true
+          labels: |
+            automated
+            maintenance
+          reviewers: 'szaimen'
+          assignees: 'szaimen'

lib.sh

@@ -54,7 +54,7 @@ INTERNET_DNS="9.9.9.9"
 # Default Quad9 DNS servers, overwritten by the systemd global DNS defined servers, if set
 DNS1="9.9.9.9"
 DNS2="149.112.112.112"
-NONO_PORTS=(22 25 53 80 443 1024 3012 3306 5178 5179 5432 7867 7983 8983 10000 8081 8443 9443 9000 9980 9090 9200 9600 1234)
+NONO_PORTS=(22 25 53 80 443 1024 3012 3306 5178 5179 5432 7867 7983 8094 8573 8983 10000 8081 8443 9443 9000 9980 9090 9200 9600 1234 51820 51821 51822)
 # 9000 9980 9090 9200 9600 1234 are local docker ports, don't remember if they are needed here or not.
 use_global_systemd_dns() {
 if [ -f "/etc/systemd/resolved.conf" ]

nextcloud_update.sh

@@ -753,6 +753,10 @@ $DOCKER_RUN_OUTPUT"
     docker_update_specific 'jellyfin' "Jellyfin Media Server"
     # Imaginary
     docker_update_specific 'imaginary' "Imaginary"
+    # Pi-hole
+    docker_update_specific 'pihole' "Pi-hole"
+    # WireGuard: the image is pinned to a major tag, hence this only updates within it
+    docker_update_specific 'wg-easy' "WireGuard"
 fi
 
 # Fix Collabora change too coolwsd

not-supported/firewall.sh

@@ -86,20 +86,31 @@ then
     ufw allow samba comment Samba
 fi
 
-# Pi-hole
-if pihole &>/dev/null
+# Pi-hole. Port 53 is published by the container, which docker opens in the
+# nat table before ufw, hence only the proxy port needs a rule.
+if is_docker_running && docker ps -a --format "{{.Names}}" | grep -q "^pihole$"
 then
     print_text_in_color "$ICyan" "Allow Pi-hole"
-    ufw allow 53/tcp comment 'Pi-hole TCP'
-    ufw allow 53/udp comment 'Pi-hole UDP'
     ufw allow 8094/tcp comment 'Pi-hole Web'
+    # unbound runs on the host and is reached via the docker bridge,
+    # which does hit the INPUT chain and hence needs a rule
+    if [ -f /etc/unbound/unbound.conf.d/pi-hole.conf ]
+    then
+        DOCKER_GATEWAY="$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}' 2>/dev/null)"
+        if [ -z "$DOCKER_GATEWAY" ]
+        then
+            DOCKER_GATEWAY=172.17.0.1
+        fi
+        ufw allow in on docker0 to "$DOCKER_GATEWAY" port 5335 comment 'Pi-hole unbound'
+    fi
 fi
 
-# PiVPN
-if pivpn &>/dev/null
+# WireGuard
+# The VPN port is published by the container, see the Pi-hole comment above
+if is_docker_running && docker ps -a --format "{{.Names}}" | grep -q "^wg-easy$"
 then
-    print_text_in_color "$ICyan" "Allow PiVPN"
-    ufw allow 51820/udp comment 'PiVPN'
+    print_text_in_color "$ICyan" "Allow WireGuard"
+    ufw allow 51822/tcp comment 'WireGuard Web'
 fi
 
 # Plex

not-supported/not-supported_menu.sh

@@ -39,11 +39,11 @@ $CHECKLIST_GUIDE" "$WT_HEIGHT" "$WT_WIDTH" 4 \
 "Monitor Link Shares" "(Monitors the creation of link shares)" OFF \
 "Off-Shore Backup Wizard" "(Create an Off-Shore Backup script)" OFF \
 "Pi-hole" "(Network wide ads- and tracker blocking)" OFF \
-"PiVPN" "(Install a Wireguard VPN server with PiVPN)" OFF \
 "PLEX Media Server" "(Multimedia server application)" OFF \
 "Remotedesktop" "(Install a remotedesktop based on xrdp)" OFF \
 "SMB-server" "(Create and manage a SMB-server on OS level)" OFF \
-"System Restore" "(Restore the system partition from a backup)" OFF 3>&1 1>&2 2>&3)
+"System Restore" "(Restore the system partition from a backup)" OFF \
+"WireGuard" "(Install a WireGuard VPN server)" OFF 3>&1 1>&2 2>&3)
 
 case "$choice" in
     *"BTRFS Format"*)
@@ -102,10 +102,6 @@ case "$choice" in
         print_text_in_color "$ICyan" "Downloading the Pi-hole script..."
         run_script NOT_SUPPORTED_FOLDER pi-hole
     ;;&
-    *"PiVPN"*)
-        print_text_in_color "$ICyan" "Downloading the PiVPN script..."
-        run_script NOT_SUPPORTED_FOLDER pivpn
-    ;;&
     *"PLEX Media Server"*)
         print_text_in_color "$ICyan" "Downloading the PLEX Media Server script..."
         run_script NOT_SUPPORTED_FOLDER plexmediaserver
@@ -122,6 +118,10 @@ case "$choice" in
         print_text_in_color "$ICyan" "Downloading the System Restore script..."
         run_script NOT_SUPPORTED_FOLDER system-restore
     ;;&
+    *"WireGuard"*)
+        print_text_in_color "$ICyan" "Downloading the WireGuard script..."
+        run_script NOT_SUPPORTED_FOLDER wireguard
+    ;;&
     *)
     ;;
 esac