Nik Afiq
325d3bc5c7
Registers minisforum as a PIA WireGuard peer for VPN VLAN 50, with a boot-ordered kill switch (dedicated PIA-VLAN50 iptables chain + a terminal unreachable route in a dedicated routing table), multi-region addKey fallback (Hong Kong -> Taiwan -> JP Tokyo, each region's full server list, in order), and an observability-only health check. Verified live against minisforum: registration succeeds, wg-quick@pia-wg is up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
676 B
Django/Jinja
21 lines
676 B
Django/Jinja
# Managed by Ansible (role: pia-gateway). Do not edit by hand.
|
|
#
|
|
# Seeds the VLAN 50 kill switch (policy-routing rule, terminal unreachable
|
|
# route, static drop rule) before wg-quick@{{ pia_wg_interface }}.service
|
|
# is allowed to start — see the drop-in this role installs on that unit
|
|
# (wg-quick-order.conf.j2) for the other half of the ordering.
|
|
[Unit]
|
|
Description=PIA gateway kill switch (VLAN 50 policy routing seed)
|
|
Before=wg-quick@{{ pia_wg_interface }}.service
|
|
DefaultDependencies=no
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/pia-killswitch.sh
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|