added scripts for vpn

scripts/patch-wg-hooks.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Replace wg-easy iptables hooks with nftables equivalents.
+
+wg-easy images ship iptables-legacy, which cannot initialize the `nat`/`filter`
+tables inside a podman container netns on nftables-only kernels (fc42). Every
+`wg-quick up wg0` then fails at the PostUp hook, so the wg0 interface is rolled
+back and ALL client API calls 500 with "Unable to access interface: No such device".
+
+The official wg-easy podman+nftables tutorial replaces the hooks with nft rules.
+This script rewrites hooks_table in /opt/apps/wireguard/wg-easy.db when the hooks
+still reference iptables. Run it with the wg-easy container stopped, then restart
+the container so wg0.conf is regenerated. Idempotent.
+"""
+import sqlite3
+import sys
+
+DB = "/opt/apps/wireguard/wg-easy.db"
+
+POSTUP = (
+    "nft add table inet wg_table;"
+    " nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \\; };"
+    " nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \\; };"
+    " nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade;"
+    " nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade;"
+    " nft add chain inet wg_table input { type filter hook input priority 0 \\; policy accept \\; };"
+    " nft add rule inet wg_table input udp dport {{port}} accept;"
+    " nft add rule inet wg_table input tcp dport {{uiPort}} accept;"
+    " nft add chain inet wg_table forward { type filter hook forward priority 0 \\; policy accept \\; };"
+    ' nft add rule inet wg_table forward iifname "wg0" accept;'
+    ' nft add rule inet wg_table forward oifname "wg0" accept;'
+)
+POSTDOWN = "nft delete table inet wg_table"
+
+
+def main() -> int:
+    con = sqlite3.connect(DB)
+    try:
+        rows = con.execute("SELECT id, post_up, post_down FROM hooks_table").fetchall()
+        changed = 0
+        for name, post_up, post_down in rows:
+            post_up = post_up or ""
+            post_down = post_down or ""
+            if "iptables" in post_up or "iptables" in post_down:
+                con.execute(
+                    "UPDATE hooks_table SET post_up=?, post_down=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                    (POSTUP, POSTDOWN, name),
+                )
+                print(f"patched hooks for {name!r}")
+                changed += 1
+            else:
+                print(f"hooks ok for {name!r}")
+        con.commit()
+    finally:
+        con.close()
+    print(f"changed={changed}")
+    return 0 if changed >= 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())