#!/bin/bash
# ═══════════════════════════════════════════════════════════════════
# WireGuard Server Setup (VPS VPN)
# Install WireGuard, generate server keys, configure interface
# Network: 10.0.0.0/24
# Server IP: 10.0.0.1
# Listen: 0.0.0.0:51820/udp
# ═══════════════════════════════════════════════════════════════════

set -e

echo "[*] Setting up WireGuard Server..."

# ─── Install WireGuard ─────────────────────────────────────────
echo "[*] Installing WireGuard..."
apt-get update -qq
apt-get install -y wireguard wireguard-tools

# ─── Create key directory ──────────────────────────────────────
mkdir -p /etc/wireguard
cd /etc/wireguard
umask 077

# ─── Generate server keys ──────────────────────────────────────
if [ ! -f privatekey ]; then
  echo "[*] Generating server private key..."
  wg genkey > privatekey
  cat privatekey | wg pubkey > publickey
  echo "[✓] Keys generated"
  echo ""
  echo "Server Public Key:"
  cat publickey
  echo ""
else
  echo "[!] Server keys already exist"
fi

# ─── Create wg0 configuration ──────────────────────────────────
echo "[*] Creating WireGuard interface configuration..."

cat > wg0.conf << 'EOF'
[Interface]
# Server IP dans le réseau VPN
Address = 10.0.0.1/24
ListenPort = 51820

# Charger la clé privée
PrivateKey = PRIVATE_KEY_PLACEHOLDER

# Accepter VPN traffic
PostUp = iptables -I FORWARD 1 -i %i -j ACCEPT; iptables -I FORWARD 1 -o %i -j ACCEPT; iptables -t nat -I POSTROUTING 1 -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Peers: monitoring-uber, admins (ajouté après)
EOF

# Remplacer placeholder par clé réelle
PRIVATE_KEY=$(cat privatekey)
sed -i "s|PRIVATE_KEY_PLACEHOLDER|$PRIVATE_KEY|" wg0.conf

# ─── Enable WireGuard interface ────────────────────────────────
echo "[*] Bringing up WireGuard interface..."
ip link add dev wg0 type wireguard
ip addr add 10.0.0.1/24 dev wg0
ip link set wg0 up
wg set wg0 private-key <(cat privatekey)
wg set wg0 listen-port 51820

# ─── Enable at boot ───────────────────────────────────────────
echo "[*] Enabling WireGuard at boot..."
systemctl enable wg-quick@wg0 2>/dev/null || true
systemctl start wg-quick@wg0 2>/dev/null || true

echo ""
echo "[✓] WireGuard Server configured"
echo ""
echo "Configuration Summary:"
echo "  • Interface: wg0"
echo "  • Server IP: 10.0.0.1/24"
echo "  • Listen: 0.0.0.0:51820/udp"
echo "  • Config: /etc/wireguard/wg0.conf"
echo ""
echo "Server Public Key (for clients):"
cat publickey
echo ""
echo "Next steps:"
echo "  1. Create client configs with wg-quick or manually"
echo "  2. Add peers to wg0:"
echo "     wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.X/32"