wireguard-go userspace rc.d script for OpenBSD

rc.conf.local

# /etc/rc.conf.local
# set flag to NO -> service won't be started
# set flag to x -> makes wg-quick use /etc/wireguard/x.conf

wg_quick_flags=wg-config

# Assumes you symlinked /etc/rc.d/wg_quick to /etc/rc.d/wg_quick_foo
wg_quick_foo_flags=wg-foo

wg_quick

#!/bin/ksh
#
# Author: Mark Vainomaa <[email protected]>

daemon="/usr/local/bin/wg-quick"

rc_reload=NO

. /etc/rc.d/rc.subr

pexp_wg="^/usr/local/bin/bash ${daemon} up ${daemon_flags}"
pexp_route="route -n monitor"

rc_check() {
    # Check the pid of wg-quick script whose parent is init
    pid="$(pgrep -P 1 -f "${pexp_wg}")"
    if [ -z "${pid}" ]; then
        return 1
    fi

    # Check for a stale wg-quick script process handling
    # only `route -n monitor`
    if [ ! -z "$(pgrep -P "${pid}" -f "${pexp_route}")" ]; then
        # TODO: uh-oh, stale wg-quick & route monitor; what should we do?
        return 1
    fi

    return 0
}

rc_start() {
    ${daemon} up ${daemon_flags}
}

rc_stop() {
    ${daemon} down ${daemon_flags}

    # TODO: remove this when wg-quick gets fixed
    #       this is here to kill 'route -n monitor' which
    #       keeps wg_quick rc script blocked on this function
    pid="$(pgrep -P 1 -f "${pexp_wg}")"
    pid2="$(pgrep -P "${pid}" -f "${pexp_wg}")"
    rpid="$(pgrep -P "${pid2}" -f "${pexp_route}")"

    # Get rid of the stale `route -n monitor' process
    if [ ! -z "${rpid}" ] && kill -0 "${rpid}"; then
        kill -15 "${rpid}"
    fi
}

rc_pre() {
    # Error out if flags are empty
    if [ -z "${daemon_flags}" ]; then
        echo "ERROR: daemon flags cannot be empty and must contain WireGuard tunnel configuration name!"
        return 1
    fi
    
    # Pass flags through basename so users couldn't do
    # something like `../../x' and other dumb stuff.
    configname="$(basename ${daemon_flags})"

    # Check if WireGuard's configuration file exists
    if [ ! -f "/etc/wireguard/${configname}.conf" ]; then
        echo "ERROR: file \`/etc/wireguard/${configname}.conf' does not exist!"
        return 1
    fi
    
    # Check if tunnel with given name is already running
    if [ -f "/var/run/wireguard/${configname}.name" ]; then
        echo "ERROR: tunnel \`${configname}' is already running!"
        return 1
    fi
}

rc_cmd $1