feat(headless): make script idempotent

This set of changes adjusts the script so that you can run it multiple times with the same input and not have any unexpected changes. This makes it appropriate for "enforcing state", as required by automated provisioners like Puppet, Salt, Chef, or Ansible.

 - Unbound, OpenVPN, easy-rsa, and other dependencies are only installed from upstream if they are not already present. This prevents multiple runs of the script from causing unexpected version upgrades.
 - The easy-rsa system is put in a folder called "easy-rsa-auto" so it can't conflict with the "easy-rsa" folder from some older OpenVPN packages
 - The easy-rsa CA is only initialized once
 - SERVER_CN and SERVER_NAME are randomly generated once and saved for future reference
 - File append ('>>') is only done strictly after a file is created with '>' (e.g. /etc/sysctl.d/20-openvpn.conf)
 - Clients are only added to easy-rsa once
 - If AUTO_INSTALL == y, then the script operates in install mode and doesn't enter manageMenu

README.md

@@ -72,6 +72,8 @@ Other variables can be set depending on your choice (encryption, compression). Y
 
 Password-protected clients are not supported by the headless installation method since user input is expected by Easy-RSA.
 
+The headless install is more-or-less idempotent, in that it has been made safe to run multiple times with the same parameters, e.g. by a state provisioner like Ansible/Terraform/Salt/Chef/Puppet. It will only install and regenerate the Easy-RSA PKI if it doesn't already exist, and it will only install OpenVPN and other upstream dependencies if OpenVPN isn't already installed. It will recreate all local config and re-generate the client file on each headless run.
+
 ### Headless User Addition
 
 It's also possible to automate the addition of a new user. Here, the key is to provide the (string) value of the `MENU_OPTION` variable along with the remaining mandatory variables before invoking the script.

openvpn-install.sh

@@ -97,6 +97,7 @@ function initialCheck () {
 }
 
 function installUnbound () {
+	# If Unbound isn't installed, install it
 	if [[ ! -e /etc/unbound/unbound.conf ]]; then
 
 		if [[ "$OS" =~ (debian|ubuntu) ]]; then
@@ -136,7 +137,9 @@ prefetch: yes' >> /etc/unbound/unbound.conf
 			# Get root servers list
 			curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache
 
+			if [[ ! -f /etc/unbound/unbound.conf.old ]]; then
 				mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old
+			fi
 
 			echo 'server:
 	use-syslog: yes
@@ -595,9 +598,13 @@ function installOpenVPN () {
 		PASS=${PASS:-1}
 		CONTINUE=${CONTINUE:-y}
 
-		# Behind NAT, we'll default to the publicly reachable IPv4.
+		# Behind NAT, we'll default to the publicly reachable IPv4/IPv6.
-		PUBLIC_IPV4=$(curl ifconfig.co)
+		if [[ $IPV6_SUPPORT == "y" ]]; then
-		ENDPOINT=${ENDPOINT:-$PUBLIC_IPV4}
+			PUBLIC_IP=$(curl https://ifconfig.co)
+		else
+			PUBLIC_IP=$(curl -4 https://ifconfig.co)
+		fi
+		ENDPOINT=${ENDPOINT:-$PUBLIC_IP}
 	fi
 
 	# Run setup questions first, and set other variales if auto-install
@@ -622,34 +629,43 @@ function installOpenVPN () {
                 fi
         fi
 
+	# If OpenVPN isn't installed yet, install it. This script is more-or-less
+	# idempotent on multiple runs, but will only install OpenVPN from upstream
+	# the first time.
+	if [[ ! -e /etc/openvpn/server.conf ]]; then
 		if [[ "$OS" =~ (debian|ubuntu) ]]; then
 			apt-get update
 			apt-get -y install ca-certificates gnupg
 			# We add the OpenVPN repo to get the latest version.
-		if [[ "$VERSION_ID" == "8" ]]; then
+			if [[ "$VERSION_ID" = "8" ]]; then
 				echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list
 				wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
 				apt-get update
 			fi
-		if [[ "$VERSION_ID" == "16.04" ]]; then
+			if [[ "$VERSION_ID" = "16.04" ]]; then
 				echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" > /etc/apt/sources.list.d/openvpn.list
 				wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
 				apt-get update
 			fi
 			# Ubuntu > 16.04 and Debian > 8 have OpenVPN >= 2.4 without the need of a third party repository.
 			apt-get install -y openvpn iptables openssl wget ca-certificates curl
-	elif [[ "$OS" == 'centos' ]]; then
+		elif [[ "$OS" = 'centos' ]]; then
 			yum install -y epel-release
 			yum install -y openvpn iptables openssl wget ca-certificates curl tar 'policycoreutils-python*'
-	elif [[ "$OS" == 'amzn' ]]; then
+		elif [[ "$OS" = 'amzn' ]]; then
 			amazon-linux-extras install -y epel
 			yum install -y openvpn iptables openssl wget ca-certificates curl
-	elif [[ "$OS" == 'fedora' ]]; then
+		elif [[ "$OS" = 'fedora' ]]; then
 			dnf install -y openvpn iptables openssl wget ca-certificates curl
-	elif [[ "$OS" == 'arch' ]]; then
+		elif [[ "$OS" = 'arch' ]]; then
 			# Install required dependencies and upgrade the system
 			pacman --needed --noconfirm -Syu openvpn iptables openssl wget ca-certificates curl
 		fi
+		# An old version of easy-rsa was available by default in some openvpn packages
+		if [[ -d /etc/openvpn/easy-rsa/ ]]; then
+			rm -rf /etc/openvpn/easy-rsa/
+		fi
+	fi
 
 	# Find out if the machine uses nogroup or nobody for the permissionless group
 	if grep -qs "^nogroup:" /etc/group; then
@@ -658,16 +674,14 @@ function installOpenVPN () {
 		NOGROUP=nobody
 	fi
 
-	# An old version of easy-rsa was available by default in some openvpn packages
+	# Install the latest version of easy-rsa from source, if not already
-	if [[ -d /etc/openvpn/easy-rsa/ ]]; then
+	# installed.
-		rm -rf /etc/openvpn/easy-rsa/
+	if [[ ! -d /etc/openvpn/easy-rsa/ ]]; then
-	fi
-
-	# Install the latest version of easy-rsa from source
 		local version="3.0.6"
 		wget -O ~/EasyRSA-unix-v${version}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-unix-v${version}.tgz
 		tar xzf ~/EasyRSA-unix-v${version}.tgz -C ~/
-	mv ~/EasyRSA-v${version} /etc/openvpn/easy-rsa
+		mkdir -p /etc/openvpn/easy-rsa
+		mv ~/EasyRSA-v${version}/* /etc/openvpn/easy-rsa/
 		chown -R root:root /etc/openvpn/easy-rsa/
 		rm -f ~/EasyRSA-unix-v${version}.tgz
 
@@ -684,7 +698,10 @@ function installOpenVPN () {
 
 		# Generate a random, alphanumeric identifier of 16 characters for CN and one for server name
 		SERVER_CN="cn_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
+		echo "$SERVER_CN" > SERVER_CN_GENERATED
 		SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
+		echo "$SERVER_NAME" > SERVER_NAME_GENERATED
+
 		echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars
 
 		# Create the PKI, set up the CA, the DH params and the server certificate
@@ -714,6 +731,12 @@ function installOpenVPN () {
 				openvpn --genkey --secret /etc/openvpn/tls-auth.key
 			;;
 		esac
+	else
+		# If easy-rsa is already installed, grab the generated SERVER_NAME
+		# for client configs
+		cd /etc/openvpn/easy-rsa/ || return
+		SERVER_NAME=$(cat SERVER_NAME_GENERATED)
+	fi
 
 	# Move all the generated files
 	cp pki/ca.crt pki/private/ca.key "pki/issued/$SERVER_NAME.crt" "pki/private/$SERVER_NAME.key" /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
@@ -858,8 +881,8 @@ verb 3" >> /etc/openvpn/server.conf
 	mkdir -p /var/log/openvpn
 
 	# Enable routing
-	echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/20-openvpn.conf
+	echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/20-openvpn.conf
-	if [[ "$IPV6_SUPPORT" == 'y' ]]; then
+	if [[ "$IPV6_SUPPORT" = 'y' ]]; then
 		echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/20-openvpn.conf
 	fi
 	# Apply sysctl rules
@@ -1028,6 +1051,11 @@ function newClient () {
 		read -rp "Select an option [1-2]: " -e -i 1 PASS
 	done
 
+	CLIENTEXISTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c -E "/CN=$CLIENT\$")
+	if [[ "$CLIENTEXISTS" = '1' ]]; then
+		echo ""
+		echo "The specified client CN was found in easy-rsa."
+	else
 		cd /etc/openvpn/easy-rsa/ || return
 		case $PASS in
 			1)
@@ -1038,6 +1066,8 @@ function newClient () {
 				./easyrsa build-client-full "$CLIENT"
 			;;
 		esac
+		echo "Client $CLIENT added."
+	fi
 
 	# Home directory of the user, where the client configuration (.ovpn) will be written
 	if [ -e "/home/$CLIENT" ]; then  # if $1 is a user name
@@ -1086,7 +1116,7 @@ function newClient () {
 	} >> "$homeDir/$CLIENT.ovpn"
 
 	echo ""
-	echo "Client $CLIENT added, the configuration file is available at $homeDir/$CLIENT.ovpn."
+	echo "The configuration file has been written to $homeDir/$CLIENT.ovpn."
 	echo "Download the .ovpn file and import it in your OpenVPN client."
 
 	exit 0
@@ -1276,7 +1306,7 @@ function manageMenu () {
 initialCheck
 
 # Check if OpenVPN is already installed
-if [[ -e /etc/openvpn/server.conf ]]; then
+if [[ -e /etc/openvpn/server.conf && $AUTO_INSTALL != "y" ]]; then
 	manageMenu
 else
 	installOpenVPN