#! /usr/bin/env bash set -e action="$1" LEGACY_KEYS_DIR="/opt/dnscrypt-wrapper/etc/keys" KEYS_DIR="/opt/encrypted-dns/etc/keys" CONF_DIR="/opt/encrypted-dns/etc" CONFIG_FILE="${CONF_DIR}/encrypted-dns.toml" CONFIG_FILE_TEMPLATE="${CONF_DIR}/encrypted-dns.toml.in" # -N provider-name -E external-ip-address:port init() { if [ "$(is_initialized)" = yes ]; then start exit $? fi while getopts "h?N:E:" opt; do case "$opt" in h | \?) usage ;; N) provider_name=$(echo "$OPTARG" | sed -e 's/^[ \t]*//' | tr A-Z a-z) ;; E) ext_address=$(echo "$OPTARG" | sed -e 's/^[ \t]*//' | tr A-Z a-z) ;; esac done [ -z "$provider_name" ] && usage case "$provider_name" in .*) usage ;; 2.dnscrypt-cert.*) ;; *) provider_name="2.dnscrypt-cert.${provider_name}" ;; esac [ -z "$ext_address" ] && usage case "$ext_address" in .*) usage ;; 0.*) echo "Do not use 0.0.0.0, use an actual external IP address" >&2 exit 1 ;; esac echo "Provider name: [$provider_name]" echo "$provider_name" >"${KEYS_DIR}/provider_name" chmod 644 "${KEYS_DIR}/provider_name" sed \ -e "s/@PROVIDER_NAME@/${provider_name}/" \ -e "s/@EXTERNAL_IPV4@/${ext_address}/" \ "$CONFIG_FILE_TEMPLATE" >"$CONFIG_FILE" /opt/encrypted-dns/sbin/encrypted-dns \ --config "$CONFIG_FILE" --dry-run | tee "${KEYS_DIR}/provider-info.txt" echo echo ----------------------------------------------------------------------- echo echo "Congratulations! The container has been properly initialized." echo "Take a look up above at the way dnscrypt-proxy has to be configured in order" echo "to connect to your resolver. Then, start the container with the default command." } provider_info() { ensure_initialized echo cat "${KEYS_DIR}/provider-info.txt" echo } is_initialized() { if [ ! -f "${KEYS_DIR}/encrypted-dns.state" ] && [ ! -f "${KEYS_DIR}/provider-info.txt" ] && [ ! -f "${KEYS_DIR}/provider_name" ]; then echo no else echo yes fi } ensure_initialized() { if [ "$(is_initialized)" = no ]; then echo "Please provide an initial configuration (init -N -E )" >&2 exit 1 fi } start() { ensure_initialized echo "Starting DNSCrypt service for provider: " cat "${KEYS_DIR}/provider_name" exec /sbin/start_runit } usage() { cat < -E : initialize the container for a server accessible at ip on port , for a provider named . This is required only once. * start (default command): start the resolver and the dnscrypt server proxy. Ports 443/udp and 443/tcp have to be publicly exposed. * provider-info: prints the provider name and provider public key. This container has a single volume that you might want to securely keep a backup of: /opt/encrypted-dns/etc/keys EOT exit 1 } case "$action" in start) start ;; init) shift init $* ;; provider-info) provider_info ;; *) usage ;; esac