alpine-wg-deploy.sh

#!/bin/sh

apk add --update ifupdown-ng-wireguard iptables

# Enable forwarding
sysctl net.ipv4.ip_forward=1

# persist
echo net.ipv4.ip_forward = 1 >/etc/sysctl.d/40_forward.conf
rc-update add sysctl

# allow interfaces.d
echo source-directory /etc/network/interfaces.d >>/etc/network/interfaces

mkdir -p /etc/network/interfaces.d /etc/wireguard

# add wg0 to interfaces
cat <<'EOF' >/etc/network/interfaces.d/40_wg0
auto wg0

iface wg0 inet static
    requires eth0
    use wireguard
    address 10.10.10.1/24
    post-up iptables -A FORWARD -i $IFACE -j ACCEPT
    post-up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    post-up iptables -A FORWARD -i $IFACE -o $IFACE -j DROP
    post-down iptables -D FORWARD -i $IFACE -j ACCEPT
    post-down iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
    post-down iptables -D FORWARD -i $IFACE -o $IFACE -j DROP

EOF

# add wg0 config
cat <<EOF >/etc/wireguard/wg0.conf
[Interface]
ListenPort = 443
PrivateKey = SRV_PRIV_KEY

[Peer]
PublicKey = CLIENT_PUB_KEY
AllowedIPs = 10.10.10.254/32

EOF

# MINIMAL CLIENT CONFIG
#
# [Interface]
# PrivateKey = CLIENT_PRIV_KEY
# Address = 10.10.10.254/24
# DNS = 1.1.1.1

# [Peer]
# PublicKey = SRV_PUB_KEY
# AllowedIPs = 0.0.0.0/0
# Endpoint = server_ip:443