marcus.hinz
68 lines
2.0 KiB
Bash
Executable File
68 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Baut das Wuerth-VPN rootlos auf (openconnect + ocproxy, SOCKS5 statt tun)
|
|
# und startet Edge mit eigenem, isoliertem Profil ueber diesen Proxy.
|
|
# Beim Schliessen von Edge wird openconnect beendet.
|
|
set -euo pipefail
|
|
|
|
export PATH="/opt/homebrew/bin:$PATH"
|
|
|
|
SERVER="loki.witglobal.net"
|
|
VPN_USER="ex08802409"
|
|
PORT=11080
|
|
PACPORT=11081
|
|
PROFILE="$HOME/.wuerth-edge"
|
|
EDGE="/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"
|
|
START_URL="https://gitops.apps.ocp-dev01.wgn.wuerth.com"
|
|
# Hosts, die ueber das VPN (SOCKS) laufen sollen; alles andere geht direkt.
|
|
INTERNAL_GLOB="*.wgn.wuerth.com"
|
|
|
|
read -rsp "VPN-Passwort fuer ${VPN_USER}: " VPN_PW; echo
|
|
|
|
printf '%s\n' "$VPN_PW" | openconnect \
|
|
--protocol=anyconnect \
|
|
--user "$VPN_USER" \
|
|
--passwd-on-stdin \
|
|
--script "ocproxy -D ${PORT}" \
|
|
--script-tun \
|
|
"https://${SERVER}" &
|
|
OC_PID=$!
|
|
|
|
# PAC-Datei: nur INTERNAL_GLOB ueber den VPN-SOCKS, Rest direkt ins Internet.
|
|
PACDIR="$(mktemp -d)"
|
|
cat >"$PACDIR/wuerth.pac" <<PAC
|
|
function FindProxyForURL(url, host) {
|
|
if (shExpMatch(host, "${INTERNAL_GLOB}")) {
|
|
return "SOCKS5 127.0.0.1:${PORT}";
|
|
}
|
|
return "DIRECT";
|
|
}
|
|
PAC
|
|
|
|
# Edge blockt file://-PAC -> ueber lokalen HTTP-Server ausliefern.
|
|
python3 -m http.server "$PACPORT" --bind 127.0.0.1 --directory "$PACDIR" >/dev/null 2>&1 &
|
|
HTTP_PID=$!
|
|
|
|
cleanup() { kill "$OC_PID" "$HTTP_PID" 2>/dev/null || true; rm -rf "$PACDIR"; }
|
|
trap cleanup EXIT INT TERM
|
|
|
|
# Warten, bis ocproxy den SOCKS-Port geoeffnet hat (max. 30 s)
|
|
for _ in $(seq 1 60); do
|
|
if nc -z 127.0.0.1 "$PORT" 2>/dev/null; then break; fi
|
|
if ! kill -0 "$OC_PID" 2>/dev/null; then
|
|
echo "openconnect beendet sich (Auth fehlgeschlagen?)." >&2
|
|
exit 1
|
|
fi
|
|
sleep 0.5
|
|
done
|
|
|
|
echo "SOCKS5 auf 127.0.0.1:${PORT} aktiv. Starte Edge..."
|
|
|
|
"$EDGE" \
|
|
--user-data-dir="$PROFILE" \
|
|
--proxy-pac-url="http://127.0.0.1:${PACPORT}/wuerth.pac" \
|
|
--host-resolver-rules="MAP ${INTERNAL_GLOB} ~NOTFOUND" \
|
|
--no-first-run --no-default-browser-check \
|
|
"$START_URL"
|
|
|
|
# Edge beendet -> trap raeumt openconnect ab
|