#!/usr/bin/env bash # PIA over WireGuard, headless. # # PIA's desktop client (pia-daemon + piactl) cannot work here: its daemon never # accepts a client connection without the GUI running, and `piactl --help` says # as much. This talks to PIA's public API directly instead, which is the path # PIA themselves document for headless use. # # sudo pia-wg.sh up tunnel up, only 1.1.1.1 routed through it (safe test) # sudo pia-wg.sh up --full tunnel up, all *public* traffic exits via PIA # sudo pia-wg.sh down tear down, restoring DNS and routes # sudo pia-wg.sh status handshake, DNS and current public IP # # Requires the project's "VPN support" setting (Config -> Runtime) to be on. # # Settings are read from the environment, but note that sudo resets it: they # have to be passed *through* sudo, after the word `sudo`, not before it. # # sudo PIA_REGION=uk_london pia-wg.sh up --full # works # PIA_REGION=uk_london sudo pia-wg.sh up --full # silently ignored # # PIA_CREDS credentials file, two lines: username, then password # (default /home/claude/pia-creds; never echoed by this script) # PIA_REGION region id (default us_chicago). List them with: # curl -s https://serverlist.piaservers.net/vpninfo/servers/v6 \ # | head -1 | jq -r '.regions[].id' set -euo pipefail # Not ~/pia-creds: under sudo, HOME is /root. # Read by up()'s EXIT trap, which runs after the function's locals are gone. SETUP_OK=0 CREDS=${PIA_CREDS:-/home/claude/pia-creds} REGION=${PIA_REGION:-us_chicago} IFACE=pia0 STATE=/run/pia-wg # Kept off the tunnel in --full mode. The container's DNS resolver, the Docker # host network (host.docker.internal, any host-side Ollama), sibling containers # and the LAN all live in here. PIA cannot route any of it, so without these # exclusions the container reaches the public internet and nothing else -- # including, fatally, its own resolver. PRIVATE_NETS="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16" # Args are joined with spaces so a long message can be written as several # source lines without the indentation ending up in the output. die() { echo "pia-wg: $*" >&2; exit 1; } # `x=$(cmd)` is a plain assignment, so `set -e` kills the script on a non-zero # cmd *before* any `[ -z "$x" ] || die` line can run. Every capture below # therefore goes through `run`; without it a wrong password exits 22 with no # output at all, which is the most likely way this is used wrongly and was the # least explained. # # It takes a description rather than reporting the command it ran: one of these # invocations carries the account password in `-u`, and an error message is # exactly the wrong place for that to surface. run() { local what=$1; shift; "$@" || die "$what (exit $?)"; } preflight() { [ "$(id -u)" = 0 ] || die "run with sudo" # CAP_NET_ADMIN is bit 12. Checking it by name gives a usable error; without # it the first `ip` call fails with a bare "Operation not permitted" that # points nowhere near the setting that actually needs changing. # # Deliberately NOT checking /dev/net/tun: kernel WireGuard is a netlink # interface and does not use it (verified -- `ip link add type wireguard` # succeeds with NET_ADMIN and no tun device). It is OpenVPN and userspace # wireguard-go that need it. The real kernel dependency here is the # `wireguard` module, which `ip link add` below reports on directly. local caps caps=$(awk '/^CapEff:/{print $2}' /proc/self/status) if [ $(( 0x$caps & 0x1000 )) -eq 0 ]; then die "this container has no CAP_NET_ADMIN." \ "Turn on \"VPN support\" in Config -> Runtime and start the project" \ "again. That recreates the container; the home and .claude volumes" \ "are preserved, so nothing in them is lost." fi command -v wg >/dev/null || \ die "wireguard-tools is not installed." \ "If this project's container was built from an older base image," \ "migrate it onto the current one -- that is what ships \`wg\`." [ -r "$CREDS" ] || \ die "no credentials at $CREDS." \ "Two lines are expected: username, then password." \ "Set PIA_CREDS (after the word \`sudo\`) to read them elsewhere." } # Routes that must work. A silent failure here is the worst state this script # can reach: the two half-routes need no gateway and would succeed, so the # tunnel captures everything while the exclusions that keep DNS and the Docker # host reachable are quietly missing -- and `status` still says "full tunnel". add_route() { ip route add "$@" || die "could not add route '$*'" printf '%s\n' "$*" >> "$STATE/routes" } up() { case "${1:-}" in ""|--full) ;; *) die "unknown option '$1' (expected --full or nothing)." \ "Refusing rather than silently giving you a test route." ;; esac preflight mkdir -p "$STATE"; cd "$STATE" # `curl -o` creates the file before it knows the request failed, so a plain # `[ -f ]` cache check can pin a truncated cert forever -- and /run rides the # snapshot, so "forever" outlives the container. Fetch to a temp name and # rename only on success. if [ ! -s ca.rsa.4096.crt ]; then run "could not download PIA's CA certificate" \ curl -sf -m 20 -o ca.crt.part \ https://raw.githubusercontent.com/pia-foss/manual-connections/master/ca.rsa.4096.crt [ -s ca.crt.part ] || die "PIA's CA certificate downloaded empty" mv ca.crt.part ca.rsa.4096.crt fi local u p tok srv sip scn priv pub resp ep gw dns u=$(sed -n 1p "$CREDS"); p=$(sed -n 2p "$CREDS") [ -n "$u" ] && [ -n "$p" ] || die "$CREDS needs two lines: username, then password" tok=$(run "PIA rejected the credentials in $CREDS, or could not be reached" \ curl -sf -m 25 -u "$u:$p" \ https://www.privateinternetaccess.com/gtoken/generateToken | jq -r .token) [ -n "$tok" ] && [ "$tok" != null ] || die "PIA returned no token - check the credentials in $CREDS" run "could not fetch PIA's server list" \ curl -sf -m 30 https://serverlist.piaservers.net/vpninfo/servers/v6 \ | head -1 > servers.json srv=$(jq -r --arg r "$REGION" '.regions[] | select(.id==$r) | .servers.wg[0]' servers.json) sip=$(echo "$srv" | jq -r .ip); scn=$(echo "$srv" | jq -r .cn) [ -n "$sip" ] && [ "$sip" != null ] || die "no WireGuard server for region '$REGION'" # Only now tear down any previous tunnel. Doing it up front (as an earlier # version did) meant a failed token fetch or an unreachable server list took # a *working* tunnel down with it and silently reverted the container to its # real address, while the error talked about credentials. Everything above # this line can fail; nothing above it has touched the network stack. # # It also still does the job it was added for: clearing a stale resolv.conf # backup so a second `up` cannot save PIA's own resolvers over the real ones. down >/dev/null 2>&1 || true # From here on the network stack is being modified, so any failure has to put # it back rather than exit half-configured. `down` is idempotent and restores # routes and resolv.conf exactly. # # EXIT rather than ERR, and a flag rather than the trap's own exit status: an # ERR trap is not inherited by shell functions without `set -E`, so a failure # inside add_route would not fire it, and `die` exits explicitly, which is not # an error and would not fire it either. EXIT catches both. SETUP_OK=0 trap '[ "$SETUP_OK" = 1 ] || { echo "pia-wg: setup failed - rolling back" >&2; down >/dev/null 2>&1; }' EXIT # umask, not a later chmod: the file is created under the inherited 0022 # otherwise, so the key is world-readable for the moment in between. ( umask 077; priv=$(wg genkey); printf '%s' "$priv" > wg.priv ) priv=$(cat wg.priv); pub=$(printf '%s' "$priv" | wg pubkey) # The token goes in on stdin as a curl config rather than in the argv, where # `ps` and /proc/*/cmdline expose it to every process in the container -- # verified. It is a ~24h bearer credential for the whole PIA account. # PIA pins its certificate to the server's common name, which is why this # connects by CN and lets --connect-to point that name at the real address. resp=$(printf -- '--data-urlencode "pt=%s"\n--data-urlencode "pubkey=%s"\n' "$tok" "$pub" \ | run "could not register the key with $scn" \ curl -sf -m 25 -G -K - --connect-to "$scn::$sip:" \ --cacert ca.rsa.4096.crt "https://$scn:1337/addKey") [ "$(echo "$resp" | jq -r .status)" = OK ] || die "key registration failed: $resp" : > "$STATE/routes" ip link add "$IFACE" type wireguard 2>/dev/null || \ die "could not create a WireGuard interface." \ "The Docker host's kernel has no 'wireguard' module." wg set "$IFACE" private-key wg.priv \ peer "$(echo "$resp" | jq -r .server_key)" \ endpoint "$(echo "$resp" | jq -r .server_ip):$(echo "$resp" | jq -r .server_port)" \ allowed-ips 0.0.0.0/0 persistent-keepalive 25 # The kernel holds the key from here, so the file has no reason to outlive # this line -- and every reason not to: /run is in the writable layer, and a # recreate or migrate runs `docker commit` over it without tearing the tunnel # down first, baking the key into the project's snapshot image. `down` also # removes it, for the case where `up` never got this far. rm -f wg.priv ip addr add "$(echo "$resp" | jq -r .peer_ip)/32" dev "$IFACE" ip link set "$IFACE" up if [ "${1:-}" = "--full" ]; then ep=$(echo "$resp" | jq -r .server_ip) gw=$(ip route show default | awk '{print $3; exit}') # `default dev eth0` with no `via` yields the literal "eth0" here, which # would make every exclusion below a malformed no-op. [[ $gw =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || \ die "no usable default gateway to pin the tunnel against (got '${gw:-none}')" # PIA's resolvers are required in --full. Without them the 10/8 exclusion # below is already in place, so every lookup would go to the container's # own resolver *outside* the tunnel -- a full tunnel leaking all its DNS, # reported by `status` as perfectly healthy. dns=$(echo "$resp" | jq -r '.dns_servers[]? // empty' | head -2) [ -n "$dns" ] || die "PIA returned no DNS servers; refusing a full tunnel that would leak every lookup" # Pin the endpoint to the pre-existing gateway first, so the tunnel's own # packets do not try to route through the tunnel. Then beat the default # route with two half-routes rather than replacing it -- nothing to restore # on teardown, and the container keeps working if this script dies midway. add_route "$ep/32" via "$gw" add_route 0.0.0.0/1 dev "$IFACE" add_route 128.0.0.0/1 dev "$IFACE" # Keep container, host and LAN traffic off the tunnel. Longer prefixes than # the two halves above, so these win. for n in $PRIVATE_NETS; do add_route "$n" via "$gw"; done # PIA's resolvers live inside 10/8, so pin them back through the tunnel with # /32s -- longer still, so they beat the exclusion just added. cp /etc/resolv.conf "$STATE/resolv.conf.bak" for d in $dns; do add_route "$d/32" dev "$IFACE"; done # resolv.conf is a bind mount: write through it, never replace it. for d in $dns; do echo "nameserver $d"; done > /etc/resolv.conf echo "full tunnel: public traffic exits via PIA; private ranges stay local" else add_route 1.1.1.1/32 dev "$IFACE" echo "test route only: 1.1.1.1 goes via PIA, everything else unchanged" fi # A tunnel with no handshake still routes -- into a black hole. Without this # `up --full` would exit 0 having pointed all traffic *and* resolv.conf at a # peer that never answered, and `status` would print "mode: full tunnel". local waited=0 until [ "$(wg show "$IFACE" latest-handshakes | awk '{print $2; exit}')" != 0 ]; do waited=$((waited + 1)) [ "$waited" -lt 20 ] || die "no handshake from $REGION after 10s - rolled back" sleep 0.5 done SETUP_OK=1 trap - EXIT status } down() { [ "$(id -u)" = 0 ] || die "run with sudo" # Only restore something that actually looks like a resolver file. Restoring # an empty or truncated backup leaves the container with no DNS at all, which # is worse than leaving the current one alone. if [ -f "$STATE/resolv.conf.bak" ]; then if grep -q '^nameserver' "$STATE/resolv.conf.bak" 2>/dev/null; then cat "$STATE/resolv.conf.bak" > /etc/resolv.conf else echo "pia-wg: warning - saved resolv.conf looks empty; leaving the current one alone" >&2 fi rm -f "$STATE/resolv.conf.bak" fi if [ -f "$STATE/routes" ]; then # Reverse order: the specific overrides go before the ranges they sit in. tac "$STATE/routes" | while read -r r; do [ -n "$r" ] && ip route del $r 2>/dev/null || true done rm -f "$STATE/routes" fi ip link del "$IFACE" 2>/dev/null || true # /run is in the writable layer and `docker commit` bakes it into the # project's snapshot image, so a key left here rides that image into every # future container. Verified: a snapshot already carried one. rm -f "$STATE/wg.priv" echo "tunnel down" } # Both are Cloudflare and both answer /cdn-cgi/trace over their bare address, so # neither needs DNS. Only 1.1.1.1 is ever routed into the tunnel, which is what # lets status tell the two exits apart. TRACE_TUNNELLED=https://1.1.1.1/cdn-cgi/trace TRACE_DIRECT=https://1.0.0.1/cdn-cgi/trace exit_ip() { curl -s -m 20 "$1" | sed -n 's/^ip=//p'; } status() { # `wg show` needs root; `ip route`/`ip link` do not. Without this guard an # unprivileged run prints "no tunnel up" and then "mode: full tunnel" in the # same breath, and an agent reading the first line re-runs `up`. [ "$(id -u)" = 0 ] || die "run with sudo" wg show "$IFACE" 2>/dev/null | grep -E "latest handshake|transfer" || echo "no tunnel up" # Resolve a name, not an IP literal. A curl to 1.1.1.1 succeeds while DNS is # completely broken, which is exactly how a dead resolver goes unnoticed. printf 'DNS: ' if timeout 10 getent hosts api.anthropic.com >/dev/null 2>&1; then echo "ok (via $(sed -n 's/^nameserver //p' /etc/resolv.conf | tr '\n' ' '))" else echo "BROKEN - cannot resolve api.anthropic.com" fi # Report the exit per mode. In test mode the probe address is itself the one # thing inside the tunnel, so a single "public IP" line would print a PIA # address while every other packet leaves directly -- the exact reading that # makes a test tunnel look like a full one. if ip route show 0.0.0.0/1 2>/dev/null | grep -q "$IFACE"; then echo "mode: full tunnel" echo " all traffic exits: $(exit_ip "$TRACE_TUNNELLED")" elif ip link show "$IFACE" >/dev/null 2>&1; then echo "mode: test route only (1.1.1.1 through the tunnel, nothing else)" echo " through the tunnel: $(exit_ip "$TRACE_TUNNELLED")" echo " everything else: $(exit_ip "$TRACE_DIRECT") <- your real address" else echo "mode: no tunnel" echo " all traffic exits: $(exit_ip "$TRACE_DIRECT")" fi } case "${1:-}" in up) shift; up "${1:-}" ;; down) down ;; status) status ;; *) sed -n '2,26p' "$0" | sed 's/^# \{0,1\}//'; exit 1 ;; esac