main
1#!/usr/bin/env bash
2# Connect to RedHat VPN
3# This will ask for which VPN to connect (using available tools) and
4# do some magic
5set -e
6
7# Detect desktop environment and available tools
8DESKTOP="${XDG_CURRENT_DESKTOP:-}"
9GRAPHICS=1
10
11# Check if running in a graphical environment
12if [[ "$DESKTOP" != "sway" && "$DESKTOP" != "niri" ]]; then
13 if ! command -v xset &>/dev/null; then
14 GRAPHICS=0
15 elif ! timeout 1s xset q &>/dev/null; then
16 GRAPHICS=0
17 fi
18fi
19
20# Use terse output with colon separators to handle multi-word names
21vpn_list=$(nmcli -t -f NAME,UUID,TYPE connection show | grep ':vpn$')
22
23# Select VPN connection based on environment
24if [[ GRAPHICS -eq 0 ]]; then
25 # Terminal: use fzf
26 selected="$(echo "$vpn_list" | cut -d: -f1 | fzf)"
27elif [[ "$DESKTOP" == "sway" || "$DESKTOP" == "niri" ]]; then
28 # Wayland compositors (Sway/Niri): use fuzzel
29 selected="$(echo "$vpn_list" | cut -d: -f1 | fuzzel --dmenu --prompt "VPN: ")"
30else
31 # X11: use zenity
32 selected="$(echo "$vpn_list" | cut -d: -f1 | zenity --list --title "Red Hat VPNs" --text "Choose your VPN.." --column "Name" --width=600 --height=450)"
33fi
34NOTIFY_CMD="notify-send"
35if [[ GRAPHICS -eq 0 ]]; then
36 NOTIFY_CMD="echo"
37fi
38
39name="$selected"
40uuid=$(echo "$vpn_list" | grep "^${selected}:" | cut -d: -f2)
41VPNSTATUS=$(nmcli connection show --active "$uuid" | wc -l)
42if [ "$VPNSTATUS" == "0" ]; then
43 key=$(authkey)
44 passfile=$(mktemp)
45
46 echo -n "vpn.secrets.password:" >"$passfile"
47 if [ -f ~/.oath/key ]; then
48 passage show redhat/vpn/pass | tr -d '\r\n' 2>/dev/null >>"$passfile"
49 else
50 passage show redhat/vpn/yubikey-pass | tr -d '\r\n' 2>/dev/null >>"$passfile"
51 fi
52 # gpg --decrypt $HOME/sync/naruhodo.pass.gpg 2>/dev/null >>"$passfile"
53 echo -n "${key}" >>"$passfile"
54
55 nmcli connection up "${uuid}" passwd-file "$passfile"
56 rm "$passfile"
57 $NOTIFY_CMD "VPN ${name} is connected." "You are now connected to the Red Hat VPN, let's work !"
58else
59 $NOTIFY_CMD "VPN ${name} is already connected." "You are already connected to the Red Hat VPN, let's work !"
60fi
61# Ask for kerberos password if klist returns an error (no creds)
62kinit vdemeest@IPA.REDHAT.COM <<<"$(passage show redhat/ldap/vdemeest)"
63# gpg --decrypt $HOME/sync/pass.gpg 2>/dev/null | kinit vdemeest@REDHAT.COM
64# if ! [[ GRAPHICS -eq 0 ]]; then
65# klist || {
66# zenity --password --title="Kerberos password" | kinit vdemeest@REDHAT.COM
67# }
68# fi