#!/bin/bash

#Update the system and install Wireguard and UFW
apt update
apt -y full-upgrade
apt -y install wireguard wireguard-tools qrencode fail2ban dhcpcd5
snap refresh
apt -y autoremove
apt -y autoclean
umask 077 /etc/wireguard

#Generate some information for the configuration files
serverPrivateKey=`wg genkey`
serverPublicKey=`echo $serverPrivateKey | wg pubkey`
clientPrivateKey=`wg genkey`
clientPublicKey=`echo $clientPrivateKey | wg pubkey`
ip=`dig +short myip.opendns.com @resolver1.opendns.com -4`
port="123"
endpoint="$ip:$port"
interface=`ip -br a | grep -v lo | cut -d " " -f 1 | head -n 1`
postUp="iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o $interface -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o $interface -j MASQUERADE"
postDown="iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o $interface -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o $interface -j MASQUERADE"

#Write server configuration file
echo "[Interface]" > /etc/wireguard/wg0.conf
echo "PrivateKey = $serverPrivateKey" >> /etc/wireguard/wg0.conf
echo "Address = 169.254.66.1/24, fd00:666::1/64"  >> /etc/wireguard/wg0.conf
echo "ListenPort = 123" >> /etc/wireguard/wg0.conf
echo "PostUp = $postUp" >> /etc/wireguard/wg0.conf
echo "PostDown = $postDown" >> /etc/wireguard/wg0.conf
echo "SaveConfig = true" >>/etc/wireguard/wg0.conf
echo "" >> /etc/wireguard/wg0.conf
echo "[Peer]" >> /etc/wireguard/wg0.conf
echo "PublicKey = $clientPublicKey" >> /etc/wireguard/wg0.conf
echo "AllowedIPs = 169.254.66.2/32, fd00:666::2/128" >> /etc/wireguard/wg0.conf

#Write out server public key to file
echo "$serverPublicKey" > /etc/wireguard/serverPublicKey

#Enable routing
cat << EOF >> /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
EOF
sysctl -p

#Enable and start the service
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

#Create PiHole Unattended Installation Config File
mkdir /etc/pihole
echo "WEBPASSWORD=a3c7f03895d6dc02f126c6a3767aeed7d300847ca91e4ea1ee6057d9cd5aa58c
PIHOLE_INTERFACE=$interface
IPV4_ADDRESS=169.254.66.1/24
IPV6_ADDRESS=fd00:666::1/64
QUERY_LOGGING=true
INSTALL_WEB=true
DNSMASQ_LISTENING=all
PIHOLE_DNS_1=208.67.222.222
PIHOLE_DNS_2=208.67.220.220
PIHOLE_DNS_3=2620:0:ccc::2
PIHOLE_DNS_4=2620:0:ccd::2
DNS_FQDN_REQUIRED=true
DNS_BOGUS_PRIV=true
DNSSEC=false
TEMPERATUREUNIT=C
WEBUIBOXEDLAYOUT=traditional
API_EXCLUDE_DOMAINS=
API_EXCLUDE_CLIENTS=
API_QUERY_LOG_SHOW=all
API_PRIVACY_MODE=false" > /etc/pihole/setupVars.conf

#Make the PiHole installer think we don't want DHCP
echo '# 169.254.66.1' >> /etc/dhcpcd.conf

#Install PiHole
curl -L https://install.pi-hole.net | bash /dev/stdin --unattended

#Uninstall dhcpcd
apt purge -y dhcpcd5

##Create client configuration files

#Generate some information for the configuration files
serverPublicKeyFile=`cat /etc/wireguard/serverPublicKey`

#Shut down Wireguard to add new clients
wg-quick down wg0

#Write client configuration files
for i in {1..254}
do \
clientPrivateKey=`wg genkey`
clientPublicKey=`echo $clientPrivateKey | wg pubkey`
echo "[Interface]" > /etc/wireguard/clientconfig_$i
echo "PrivateKey = $clientPrivateKey" >> /etc/wireguard/clientconfig_$i
echo "Address = 169.254.66.$i/32, fd00:666::$i/64" >> /etc/wireguard/clientconfig_$i
echo "DNS = 169.254.66.1, fd00:666::1" >> /etc/wireguard/clientconfig_$i
echo "" >> /etc/wireguard/clientconfig_$i
echo "[Peer]" >> /etc/wireguard/clientconfig_$i
echo "PublicKey = $serverPublicKeyFile" >> /etc/wireguard/clientconfig_$i
echo "Endpoint = $endpoint" >> /etc/wireguard/clientconfig_$i
echo "AllowedIPs = 0.0.0.0/0, ::/0" >> /etc/wireguard/clientconfig_$i
echo "PersistentKeepalive = 15" >> /etc/wireguard/clientconfig_$i

#Add new clients to Wireguard server as peers
echo "" >> /etc/wireguard/wg0.conf
echo "[Peer]" >> /etc/wireguard/wg0.conf
echo "PublicKey = $clientPublicKey" >> /etc/wireguard/wg0.conf
echo "AllowedIPs = 169.254.66.$i/32, fd00:666::$i/128" >> /etc/wireguard/wg0.conf
done

#Bring Wireguard back up. Probably not necessary because of the reboot but doesn't hurt.
wg-quick up wg0

init 6
