Tygozwolle
9dc029e32f
Build and Push Docker Image to Gitea Container Registry / build-and-push (push) Successful in 1m14s
78 lines
2.8 KiB
Bash
78 lines
2.8 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Default environment variables
|
|
DB_HOST="${DB_HOST:-postgres}"
|
|
DB_PORT="${DB_PORT:-5432}"
|
|
DB_USER="${DB_USER:-radius}"
|
|
DB_PASS="${DB_PASS:-radpass}"
|
|
DB_NAME="${DB_NAME:-radius}"
|
|
RADIUS_SECRET="${RADIUS_SECRET:-radpass}"
|
|
|
|
echo "================================================="
|
|
echo " Starting RADIUS Controller & FreeRADIUS Stack"
|
|
echo " DB Host: $DB_HOST:$DB_PORT | Database: $DB_NAME"
|
|
echo " RADIUS Secret: $RADIUS_SECRET (Allows all IP addresses)"
|
|
echo "================================================="
|
|
|
|
# Dynamically update FreeRADIUS SQL configuration with DB settings
|
|
SQL_CONF="/etc/freeradius/3.0/mods-enabled/sql"
|
|
if [ -f "$SQL_CONF" ]; then
|
|
sed -i "s/server = .*/server = \"$DB_HOST\"/" "$SQL_CONF"
|
|
sed -i "s/port = .*/port = $DB_PORT/" "$SQL_CONF"
|
|
sed -i "s/login = .*/login = \"$DB_USER\"/" "$SQL_CONF"
|
|
sed -i "s/password = .*/password = \"$DB_PASS\"/" "$SQL_CONF"
|
|
sed -i "s/radius_db = .*/radius_db = \"$DB_NAME\"/" "$SQL_CONF"
|
|
fi
|
|
|
|
# Dynamically update RADIUS shared secret for all client networks from env
|
|
CLIENTS_CONF="/etc/freeradius/3.0/clients.conf"
|
|
if [ -f "$CLIENTS_CONF" ]; then
|
|
sed -i "s/secret = .*/secret = $RADIUS_SECRET/" "$CLIENTS_CONF"
|
|
fi
|
|
|
|
# Generate FreeRADIUS EAP certificates if missing
|
|
CERT_DIR="/etc/freeradius/3.0/certs"
|
|
if [ ! -f "$CERT_DIR/server.pem" ]; then
|
|
echo "Generating FreeRADIUS EAP certificates..."
|
|
mkdir -p "$CERT_DIR"
|
|
|
|
# Generate CA key and certificate
|
|
openssl req -new -x509 -keyout "$CERT_DIR/ca.key" -out "$CERT_DIR/ca.pem" \
|
|
-days 3650 -nodes -subj "/CN=RADIUS CA" 2>/dev/null
|
|
|
|
# Generate server key and CSR
|
|
openssl req -new -keyout "$CERT_DIR/server.key" -out "$CERT_DIR/server.csr" \
|
|
-nodes -subj "/CN=RADIUS Server" 2>/dev/null
|
|
|
|
# Sign the server certificate with the CA
|
|
openssl x509 -req -in "$CERT_DIR/server.csr" -CA "$CERT_DIR/ca.pem" \
|
|
-CAkey "$CERT_DIR/ca.key" -CAcreateserial -out "$CERT_DIR/server.crt" \
|
|
-days 3650 2>/dev/null
|
|
|
|
# Combine server key + cert into server.pem
|
|
cat "$CERT_DIR/server.key" "$CERT_DIR/server.crt" > "$CERT_DIR/server.pem"
|
|
|
|
# Generate DH parameters (small size for speed, adequate for internal use)
|
|
openssl dhparam -out "$CERT_DIR/dh" 1024 2>/dev/null
|
|
|
|
# Clean up intermediate files
|
|
rm -f "$CERT_DIR/server.csr" "$CERT_DIR/server.key" "$CERT_DIR/server.crt" "$CERT_DIR/ca.key" "$CERT_DIR/ca.srl"
|
|
|
|
echo "EAP certificates generated successfully."
|
|
fi
|
|
|
|
# Ensure correct permissions for FreeRADIUS config directory
|
|
chown -R freerad:freerad /etc/freeradius/3.0/ || true
|
|
|
|
# Start FreeRADIUS daemon in background
|
|
echo "Starting FreeRADIUS service..."
|
|
freeradius -x &
|
|
|
|
# Wait briefly for FreeRADIUS to initialize
|
|
sleep 2
|
|
|
|
# Start ASP.NET Core Application
|
|
echo "Starting ASP.NET Core Web Controller..."
|
|
exec dotnet radiuscontroller.dll
|