fix sed, sudo, and wg-quick

Author: ipitio

README.md

@@ -53,7 +53,7 @@ Keep in mind that:
 - Unbound connects to Cloudflare's servers using DoT by default, but you can uncomment its volume in `compose.yml` to use it as a recursive resolver.
 - To configure Pi-hole more extensively, such as by enabling DHCP, see the [Pi-hole documentation](https://github.com/pi-hole/docker-pi-hole/tree/2024.07.0?tab=readme-ov-file#environment-variables).
 - The hooks may be useful, for example, if you'd like to coordinate with an external, outbound VPN on a Hub or SaaH. All arguments given to `start.sh`and `stop.sh` are passed to their respective hooks.
-- For AP+STA mode, define as many `X@[iface].conf` files as bands the device supports, where X is an integer band.
+- For AP+STA mode, you can define as many `X@[iface].conf` files as bands the device supports, where X is an integer band.
 
 > [!NOTE]
 > The WireGuard service in the Compose file must be configured whether or not you'll use Docker ([docs](https://docs.linuxserver.io/images/docker-wireguard)).
@@ -68,7 +68,7 @@ Create or update a node in two or three steps:
 1. Install the package by either:
     - pasting the one-liner or block below;
     - downloading it from [Releases](https://github.com/ipitio/closure/releases); or
-    - copying this repo to `/opt/closure`, then ensuring `rc.local` is executable and moved to `/etc`.
+    - copying this repo to `/opt/closure`, then ensuring the executable `rc.local` is moved to `/etc`.
 
 ```{bash}
 curl -sSLNZ https://ipitio.github.io/closure/i | sudo bash

debian/control

@@ -4,7 +4,7 @@ Homepage: https://github.com/ipitio/closure
 Standards-Version: 3.9.2
 
 Package: closure
-Version: 1.6.17
+Version: 1.6.18
 Maintainer: ipitio <21136719+ipitio@users.noreply.github.com>
 Depends: curl, flatpak, gpg, hostapd, isc-dhcp-server, iw, macchanger, netplan.io, network-manager, net-tools, qrencode, rfkill, wireguard, wireless-tools, wget
 Recommends: containerd.io, docker-ce, docker-ce-cli, docker-buildx-plugin, docker-compose-plugin

init.sh

@@ -171,7 +171,7 @@ if [ "$CLS_DOCKER" = "true" ]; then
     sudo docker compose build
 fi
 
-sudo sed -i 's/#\?DNSStubListener=.*/DNSStubListener=no/g' /etc/systemd/resolved.conf
+sudo sed -i 's/\#\?DNSStubListener=.*/DNSStubListener=no/g' /etc/systemd/resolved.conf
 sudo systemctl restart systemd-resolved
 sudo systemctl disable isc-dhcp-server &>/dev/null
 sudo systemctl stop hostapd &>/dev/null

kickstart.sh

@@ -4,6 +4,6 @@
 script_path="$(dirname "$(readlink -f "$0")")"
 sudo -i bash <<EOF
 pushd "$script_path" || exit 1
-CLS_WG_ONLY=${CLS_WG_ONLY:-false} bash start.sh ${@@Q} > ks.log
+CLS_WG_ONLY=${CLS_WG_ONLY:-false} bash start.sh ${@@Q} &>start.log
 popd || exit 1
 EOF

lib.sh

@@ -40,9 +40,9 @@ user_exists() { id "$1" &>/dev/null; }
 
 sudo() {
     if command -v sudo >/dev/null; then
-        command sudo -E ${@:-:} || ${@:-:}
+        command sudo -E "${@:-:}" || "${@:-:}"
     else
-        ${@:-:}
+        "${@:-:}"
     fi
 }
 
@@ -106,6 +106,7 @@ start_hostapd() {
         [ ! -f /etc/resolv.conf ] || sudo rm -f /etc/resolv.conf
         (
             cat resolv.conf
+            echo ""
             (
                 nmcli dev show "$CLS_LOCAL_IFACE" | grep DNS | grep -oP '\S+$'
             ) | while read -r ip; do echo "nameserver $ip"; done
@@ -231,7 +232,7 @@ curl() {
 }
 
 dig() {
-    command dig "$1" +trace 2>/dev/null | grep -oP "(?<=^${1//\./\\\.}\.).+(AAA)?A.+" | grep -oP '\S+$'
+    command dig "$1" +trace 2>/dev/null | grep -oP "(?<=^${1//\./\\\.}\.).+(AAA)?A.+" | grep -oP '\S+$' || command dig +short "$1" 2>/dev/null | tail -n1
 }
 
 direct_domain() {

rc.local

@@ -1,5 +1,5 @@
 #!/bin/bash
 
 # closure
-[ -f /opt/closure/installed ] || bash /opt/closure/init.sh
+[ -f /opt/closure/installed ] || bash /opt/closure/init.sh &>/opt/closure/init.log
 ifconfig | grep -oP '^\S+(?=:)' | xargs -P0 -I{} bash -c 'ifconfig "{}" down; macchanger -r "{}"; ifconfig "{}" up' &>/dev/null

restart.sh

@@ -5,9 +5,9 @@ this_dir=$(dirname "$(readlink -f "$0")")
 pushd "$this_dir" || exit 1
 source "lib.sh"
 
-eval "cast pre-down ${*@Q}"
 sudo sysctl -w net.ipv4.ip_forward=0
 sudo sysctl -w net.ipv6.conf.all.forwarding=0
+eval "cast pre-down ${*@Q}"
 sudo docker ps | grep -q wireguard && sudo docker compose stop wireguard || sudo wg-quick down "$CLS_INTERN_IFACE"
 
 # shellcheck disable=SC2009

start.sh

@@ -59,7 +59,7 @@ if ! ${CLS_WG_ONLY:-false}; then
     sudo cp -f netplan.yml /etc/netplan/99_config.yaml
     sudo chmod 0600 /etc/netplan/99_config.yaml
     stop_hostapd
-    sudo sed -i '/# subnets for hostapd/q' dhcp/dhcpd.conf
+    sudo sed -i '/\# subnets for hostapd/q' dhcp/dhcpd.conf
     grep -q "subnets for hostapd" dhcp/dhcpd.conf || echo -e "# subnets for hostapd are generated automatically" | sudo tee -a dhcp/dhcpd.conf >/dev/null
     ifconfig | grep -oP '^\S+(?=:)' | while read -r iface; do
         sudo ifconfig "$iface" down
@@ -83,6 +83,8 @@ else
     sudo sysctl -w net.ipv4.ip_forward=0
     sudo sysctl -w net.ipv6.conf.all.forwarding=0
     for iface in $(wg | grep -oP '(?<=interface: ).+'); do sudo wg-quick down "$iface"; done
+    wg | grep -oP '(?<=^interface: ).+' | while read -r iface; do sudo wg-quick down "$iface" &>/dev/null; done
+    sudo ls wireguard/config/wg_confs | grep -oP '.+\.conf$' | while read -r conf; do sudo wg-quick down "${conf%.conf}"; done
 fi
 
 eval "cast pre-up ${*@Q}"

wireguard/etc/run

@@ -1,10 +1,11 @@
-#!/usr/bin/with-contenv bash
+#!/bin/bash
 # shellcheck shell=bash
 # shellcheck disable=SC2016,SC1091,SC2183
 # https://github.com/linuxserver/docker-wireguard/blob/master/root/etc/s6-overlay/s6-rc.d/init-wireguard-confs/run
 # This file has been modified from the above source: paths were changed to be relative to the project root
 
 mkdir -p wireguard/config/wg_confs
+mkdir -p wireguard/config/templates
 
 # prepare templates
 if [[ ! -f wireguard/config/templates/server.conf ]]; then