mirror of
https://github.com/angristan/openvpn-install.git
synced 2026-07-21 14:58:15 +02:00
2e0605e2eb439aaa854068c63305e538aa9cead7
22
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
8375af5452 |
feat: add configurable MTU support (#1417)
## Summary - Add `--mtu <size>` CLI option to configure tunnel MTU (valid range: 576-65535) - Add interactive prompt with user-friendly explanation for non-technical users - Write `tun-mtu` to server.conf and client template when custom value is set - OpenVPN auto-calculates MSSFIX based on the MTU value (no separate option needed) ## Use cases - PPPoE connections (typically need MTU ~1492) - Mobile/cellular networks with variable MTU - Networks with connectivity issues due to fragmentation ## Usage ```bash # CLI mode ./openvpn-install.sh install --mtu 1400 # Interactive mode prompts with explanation: # "MTU controls the maximum packet size. Lower values can help # with connectivity issues on some networks (e.g., PPPoE, mobile)." ``` Close https://github.com/angristan/openvpn-install/pull/1300 Co-authored-by: Fabian Druschke <fdruschke@outlook.com> |
||
|
StanislasandGitHub
|
898489f3c9 |
fix: exit non-zero when client name exists (#1407)
Fixes https://github.com/angristan/openvpn-install/issues/1194 |
||
|
StanislasandGitHub
|
ec3e80ac16 |
feat: add CLI interface with subcommands (#1398)
Replace environment variable-based configuration with a proper CLI interface using subcommands and flags. ### Commands ``` openvpn-install <command> [options] Commands: install Install and configure OpenVPN server uninstall Remove OpenVPN server client Manage client certificates (add/list/revoke/renew) server Server management (status/renew) interactive Launch interactive menu ``` ### Highlights - **No args → help**: Running without arguments shows help instead of interactive menu - **JSON output**: `client list` and `server status` support `--format json` - **25+ install flags**: Network, DNS, security, and client options - **Interactive mode preserved**: `install --interactive` or `interactive` command ### Breaking Changes Environment variables (`AUTO_INSTALL`, `MENU_OPTION`, `CLIENT`, etc.) are no longer supported. Use CLI flags instead. ```bash # Before MENU_OPTION=1 CLIENT=foo PASS=1 ./openvpn-install.sh # After ./openvpn-install.sh client add foo ``` Closes https://github.com/angristan/openvpn-install/issues/1202 |
||
|
|
e9deb4b8ab |
feat: add configurable VPN subnet (#1394)
Allow users to customize the VPN subnet during installation instead of using the hardcoded `10.8.0.0/24`. - Add subnet prompt during interactive installation (default or custom) - Add `VPN_SUBNET` environment variable for headless installs - Validate RFC1918 /24 networks (e.g., `10.9.0.0`, `172.16.0.0`, `192.168.1.0`) Closes https://github.com/angristan/openvpn-install/issues/153 Closes https://github.com/angristan/openvpn-install/pull/550 Closes https://github.com/angristan/openvpn-install/pull/1150 Closes https://github.com/angristan/openvpn-install/pull/952 Closes https://github.com/angristan/openvpn-install/pull/551 Co-authored-by: browningluke <lrbrowning6@gmail.com> |
||
|
StanislasandGitHub
|
8ea2d1b5b2 |
feat: add native nftables support (#1389)
- Add nftables as a third firewall backend option alongside firewalld and iptables - Detection priority: firewalld → nftables → iptables (legacy fallback) - Uses dedicated `openvpn` and `openvpn-nat` tables for clean isolation - Integrates with native `nftables.service` via include in `/etc/nftables.conf` Closes https://github.com/angristan/openvpn-install/issues/530 |
||
|
StanislasandGitHub
|
d8aa625639 |
feat: add native firewalld support (#1388)
## Summary - Add native firewalld support for RHEL/Fedora/CentOS systems - When firewalld is active, use `firewall-cmd --permanent` instead of raw iptables - Rules persist across `firewall-cmd --reload` - Fall back to iptables when firewalld is not active - Add `After=firewalld.service` to iptables systemd unit for safety ## Changes **Install:** Detect firewalld, use `firewall-cmd` to add port, masquerade, and rich rules. Fall back to iptables if inactive. **Uninstall:** Detect which method was used and clean up accordingly. **Tests:** Add `fedora-42-firewalld` CI test with firewalld enabled. --- Closes https://github.com/angristan/openvpn-install/issues/356 Closes https://github.com/angristan/openvpn-install/pull/1200 |
||
|
StanislasandGitHub
|
9175c2c221 |
feat: support headless client revocation by name (#1387)
Add support for revoking clients by setting the CLIENT environment variable directly with the client name, in addition to the existing CLIENTNUMBER support (from https://github.com/angristan/openvpn-install/pull/1328) This makes headless revocation more user-friendly as users no longer need to know the client's index number. |
||
|
StanislasandGitHub
|
190e49ec33 |
feat: add list clients menu option (#1382)
## Summary - Add new "List existing users" option to management menu (option 2) - Displays all client certificates with status (Valid/Revoked), expiration date, and days remaining - Reads expiry directly from certificate files using openssl for accurate 4-digit year dates - Output sorted by expiration date (oldest first) - Updates test MENU_OPTION values to match new menu numbering Example output: ``` === Existing Clients === Found 2 certificate(s) Name Status Expiry Remaining ---- ------ ------ --------- user1 Valid 2035-12-11 3649 days user2 Revoked unknown unknown ``` Closes #567 Closes #563 Closes #587 |
||
|
|
cb2d67be74 |
Add PASSPHRASE support in headless mode (#1015)
Add support for a password protected user in headless mode Fixes #389 --------- Co-authored-by: Siebren Kraak <siebren.kraak@secura.com> Co-authored-by: Stanislas Lange <git@slange.me> |
||
|
StanislasandGitHub
|
3561d13389 |
feat: add tls-crypt-v2 support with per-client keys (#1377)
## Summary - Add support for OpenVPN's `tls-crypt-v2` feature (per-client TLS keys) - Set `tls-crypt-v2` as the new recommended default - Add CI tests for all 3 TLS key types Closes #983 Closes #758 Closes https://github.com/angristan/openvpn-install/pull/1257 ## What is tls-crypt-v2? Unlike `tls-crypt` (shared key), `tls-crypt-v2` generates unique keys per client: - **Better security**: Compromised client keys don't affect other clients - **Easier management**: Individual client key revocation without regenerating server key - **Scalability**: Better suited for large deployments Requires OpenVPN 2.5+ (released 2020). ## Menu options ``` 1) tls-crypt-v2 (recommended): Encrypts control channel, unique key per client 2) tls-crypt: Encrypts control channel, shared key for all clients 3) tls-auth: Authenticates control channel, no encryption ``` |
||
|
StanislasandGitHub
|
2c53bc0f83 |
feat: add run_cmd_fatal, fix Fedora, improve CI (#1369)
## Summary This PR contains three related improvements: ### 1. Add `run_cmd_fatal` for critical operations - New helper function that wraps `run_cmd` and exits on failure - Converts critical operations (package installs, PKI setup, certificate generation) to fail fast - Non-critical operations (systemctl, cleanup) still use `run_cmd` - Password-protected client certs run directly to preserve interactive prompt ### 2. Fix Fedora installation - Skip Copr repository setup since Fedora already ships OpenVPN 2.6.x - Simplifies installation and removes external repository dependency ### 3. Improve CI test reliability - Fail fast when `openvpn-test.service` fails during startup - Add `journalctl` output to error diagnostics - Display service status in wait loop - Increase VPN gateway ping count from 3 to 10 for stability |
||
|
StanislasandGitHub
|
9e1bb4b175 |
feat: enable proper systemd support in Docker tests (#1373)
- Replace the `sed` hack that disabled `systemctl` commands with proper systemd support in Docker containers - This allows testing the actual `systemctl` commands used by the install script - No more manual workarounds for starting OpenVPN/Unbound services |
||
|
StanislasandGitHub
|
179cbc0c25 |
fix: increase DNS test retries and use seq for loop (#1370)
- Increase DNS retry count from 5 to 10 for improved test reliability when Unbound needs more time to initialize - Refactor retry loop to use `seq` with a `DNS_MAX_RETRIES` to be cleaner |
||
|
StanislasandGitHub
|
44c995df8e |
feat: migrate to OpenVPN 2.4+ directory structure and improve distro compatibility (#1364)
## Summary Migrates OpenVPN configuration to use the modern OpenVPN 2.4+ directory structure and improves compatibility across different Linux distributions. Close https://github.com/angristan/openvpn-install/issues/1307, close https://github.com/angristan/openvpn-install/issues/788, close https://github.com/angristan/openvpn-install/issues/605, close https://github.com/angristan/openvpn-install/pull/653, close https://github.com/angristan/openvpn-install/issues/1214 ### Directory Structure Changes - All server files now in `/etc/openvpn/server/` instead of `/etc/openvpn/` - Uses `openvpn-server@server.service` consistently across all distros - `server.conf` uses relative paths for portability ### Distro-Specific User/Group Handling Different distros configure OpenVPN differently: | Distro | User | Group | systemd handles user? | |--------|------|-------|----------------------| | Debian/Ubuntu | nobody | nogroup | No | | Fedora/RHEL/Amazon | openvpn | openvpn | No | | Arch | openvpn | network | **Yes** (via `User=` in service) | The script now: 1. Detects if an `openvpn` user exists and uses appropriate group 2. Checks if systemd service already has `User=` directive 3. Skips `user`/`group` in config when systemd handles it (avoids "double privilege drop" error on Arch) 4. Sets file ownership with `chown -R` for non-root OpenVPN users ### Other Changes - Updated FAQ.md with new paths - Added systemd service file validation in tests - Added CRL reload verification in tests |
||
|
|
bbf93a19d5 |
Add openSUSE Tumbleweed/Leap support (#1166)
<!--- ❗️ Please read ❗️ ➡️ Please make sure you've followed the guidelines: https://github.com/angristan/openvpn-install#contributing ✅ Please make sure your changes are tested and working 🗣️ Please avoid large PRs, and discuss changes in a GitHub issue first ✋ If the changes are too big and not in line with the project, they will probably be rejected. Remember that this script is meant to be simple and easy to use. ---> --------- Co-authored-by: Stanislas Lange <git@slange.me> |
||
|
StanislasandGitHub
|
0d4d2229f4 |
test: add e2e tests for certificate revocation (#1345)
## Summary - Add end-to-end tests for certificate revocation functionality - Test that a revoked client certificate cannot connect to the VPN - Test that a new certificate can be created with the same name as a revoked one (validating the fix from #1185) - Test that the new certificate can successfully connect ## Test Flow 1. **Initial connectivity tests** - existing tests pass 2. **Certificate revocation test**: - Create a new client `revoketest` - Connect with the certificate (verifies it works) - Disconnect the client - Revoke the certificate via the install script - Try to reconnect with revoked cert (verifies connection is rejected) 3. **Reuse revoked name test**: - Create a new certificate with the same name `revoketest` - Verify both revoked and valid entries exist in `index.txt` - Connect with the new certificate (verifies it works) ## Changes | File | Changes | |------|---------| | `test/server-entrypoint.sh` | Start OpenVPN in background, add revocation test orchestration | | `test/client-entrypoint.sh` | Add revocation test phases with signal file coordination | | `docker-compose.yml` | Remove read-only restriction on shared volume for client | | `Makefile` | Increase timeout from 60 to 180 iterations | | `.github/workflows/docker-test.yml` | Increase timeouts, fix shared volume | |
||
|
|
2374e4e81c |
Refactor Unbound setup and add E2E tests (#1340)
Refactor Unbound DNS installation to use modern `conf.d` pattern and add E2E testing. **Changes:** - Unified Unbound config across all distros using `/etc/unbound/unbound.conf.d/openvpn.conf` - Added startup validation with retry logic - Added `ip-freebind` to allow binding before tun interface exists - E2E tests now verify Unbound DNS resolution from VPN clients **Testing:** - Server: verifies config creation, interface binding, security options - Client: verifies DNS resolution through Unbound (10.8.0.1) --- Closes https://github.com/angristan/openvpn-install/issues/602 Closes https://github.com/angristan/openvpn-install/pull/604 Closes https://github.com/angristan/openvpn-install/issues/1189 Co-authored-by: Henry N <henrynmail-github@yahoo.de> |
||
|
1aae852c60 |
chore(deps): update super-linter/super-linter action to v8 (#1339)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [super-linter/super-linter](https://redirect.github.com/super-linter/super-linter) | action | major | `v7` -> `v8` | --- ### Release Notes <details> <summary>super-linter/super-linter (super-linter/super-linter)</summary> ### [`v8`](https://redirect.github.com/super-linter/super-linter/blob/HEAD/CHANGELOG.md#680-2024-07-31) [Compare Source](https://redirect.github.com/super-linter/super-linter/compare/v7...v8) ##### 🚀 Features - allow using both prettier and standardjs ([#​5679](https://redirect.github.com/super-linter/super-linter/issues/5679)) ([2daf461](https://redirect.github.com/super-linter/super-linter/commit/2daf461143778318ccc60ba59f175d385f222e4d)) - customize phpstan config file name ([#​5940](https://redirect.github.com/super-linter/super-linter/issues/5940)) ([20c4df5](https://redirect.github.com/super-linter/super-linter/commit/20c4df58c060cf122dce53b14ec578d48d921fb0)) - enable dotenv-linter for slim images ([#​5868](https://redirect.github.com/super-linter/super-linter/issues/5868)) ([c770a8d](https://redirect.github.com/super-linter/super-linter/commit/c770a8d253f8b8852fd3404b63b807d93cc3691a)) - remove no-eslintrc and simplify eslint conf ([#​5809](https://redirect.github.com/super-linter/super-linter/issues/5809)) ([5be4926](https://redirect.github.com/super-linter/super-linter/commit/5be49266330f237f4a8ab2acccffe93b69cf4b04)), closes [#​5688](https://redirect.github.com/super-linter/super-linter/issues/5688) - write github actions step summary ([#​5867](https://redirect.github.com/super-linter/super-linter/issues/5867)) ([57c8658](https://redirect.github.com/super-linter/super-linter/commit/57c86588c388a515ae31f498b4cc4a6337169c11)), closes [#​5650](https://redirect.github.com/super-linter/super-linter/issues/5650) ##### 🐛 Bugfixes - avoid duplicated content in summary ([#​5939](https://redirect.github.com/super-linter/super-linter/issues/5939)) ([ef57e13](https://redirect.github.com/super-linter/super-linter/commit/ef57e132e136ab9991a0cc1517236e827d27baf9)) - store outputs in the main output directory ([#​5899](https://redirect.github.com/super-linter/super-linter/issues/5899)) ([78ed3ef](https://redirect.github.com/super-linter/super-linter/commit/78ed3ef5fc8fe45290b530f94077281d2ac8e634)) - update pylint to ignore import-errors ([#​5927](https://redirect.github.com/super-linter/super-linter/issues/5927)) ([eec862d](https://redirect.github.com/super-linter/super-linter/commit/eec862d0ea33fe6a836dfd545eef1125e530c794)) - update the list of linters to remove ([#​5870](https://redirect.github.com/super-linter/super-linter/issues/5870)) ([6bd7659](https://redirect.github.com/super-linter/super-linter/commit/6bd76596f3f7df70a323eabb797f028293873424)) ##### ⬆️ Dependency updates - **bundler:** bump rubocop-minitest in /dependencies ([#​5875](https://redirect.github.com/super-linter/super-linter/issues/5875)) ([9751e62](https://redirect.github.com/super-linter/super-linter/commit/9751e62beed14780ff12fc073c7aa9eafbd449f7)) - **bundler:** bump rubocop-performance in /dependencies ([#​5777](https://redirect.github.com/super-linter/super-linter/issues/5777)) ([763dcc4](https://redirect.github.com/super-linter/super-linter/commit/763dcc4d456ae0c347801d30b5ec00dbfaa60ef2)) - **bundler:** bump rubocop-rspec from 2.30.0 to 3.0.3 in /dependencies ([#​5878](https://redirect.github.com/super-linter/super-linter/issues/5878)) ([592d903](https://redirect.github.com/super-linter/super-linter/commit/592d903c509a4c70c89cc009e74b63c3273c5e7b)) - **dev-docker:** bump node in /dev-dependencies ([#​5872](https://redirect.github.com/super-linter/super-linter/issues/5872)) ([587fe0a](https://redirect.github.com/super-linter/super-linter/commit/587fe0a8b9318324fbfd86b9cd87b0ac6b24ba42)) - **dev-npm:** bump release-please in /dev-dependencies ([#​5754](https://redirect.github.com/super-linter/super-linter/issues/5754)) ([6bb3f78](https://redirect.github.com/super-linter/super-linter/commit/6bb3f789bb5cacff35492a1245befb2fd13b97f5)) - **docker:** bump alpine/helm from 3.14.4 to 3.15.3 ([#​5882](https://redirect.github.com/super-linter/super-linter/issues/5882)) ([b5bf9f2](https://redirect.github.com/super-linter/super-linter/commit/b5bf9f297d13e9563bd708ae98e2e05b9b44698c)) - **docker:** bump alpine/terragrunt from 1.9.0 to 1.9.2 ([#​5883](https://redirect.github.com/super-linter/super-linter/issues/5883)) ([95feeac](https://redirect.github.com/super-linter/super-linter/commit/95feeacb0ab075e7e183c5f8ea1c515992f66bbf)) - **docker:** bump dart from 3.4.2-sdk to 3.4.4-sdk ([#​5764](https://redirect.github.com/super-linter/super-linter/issues/5764)) ([b75f1cf](https://redirect.github.com/super-linter/super-linter/commit/b75f1cfcefc1b62a81b916bd00d0b8dfa7ad69aa)) - **docker:** bump dotnet/sdk ([#​5873](https://redirect.github.com/super-linter/super-linter/issues/5873)) ([f068663](https://redirect.github.com/super-linter/super-linter/commit/f06866359b4158e04825a03d5852823d47d78b05)) - **docker:** bump golangci/golangci-lint from v1.59.0 to v1.59.1 ([#​5748](https://redirect.github.com/super-linter/super-linter/issues/5748)) ([81ab76d](https://redirect.github.com/super-linter/super-linter/commit/81ab76d00179b8d66e7f909c546cb7bfbde8ae9f)) - **docker:** bump goreleaser/goreleaser from v1.26.2 to v2.1.0 ([#​5881](https://redirect.github.com/super-linter/super-linter/issues/5881)) ([d84d439](https://redirect.github.com/super-linter/super-linter/commit/d84d4393933047f08abf0871aacefa04c63b5f32)) - **docker:** bump hashicorp/terraform from 1.8.4 to 1.9.2 ([#​5885](https://redirect.github.com/super-linter/super-linter/issues/5885)) ([d384e67](https://redirect.github.com/super-linter/super-linter/commit/d384e674c729dfd236ce888d04e4bdd24a85b630)) - **docker:** bump mstruebing/editorconfig-checker from v3.0.1 to v3.0.3 ([#​5856](https://redirect.github.com/super-linter/super-linter/issues/5856)) ([81196f4](https://redirect.github.com/super-linter/super-linter/commit/81196f4267199e63ec82dd0aaff9d1f400b38cac)) - **docker:** bump python from 3.12.3-alpine3.20 to 3.12.4-alpine3.20 ([#​5884](https://redirect.github.com/super-linter/super-linter/issues/5884)) ([8a044b5](https://redirect.github.com/super-linter/super-linter/commit/8a044b58dee1dd7a03fcaf2d7d6b58754f156be2)) - **docker:** bump scalameta/scalafmt from v3.8.1 to v3.8.2 ([#​5765](https://redirect.github.com/super-linter/super-linter/issues/5765)) ([4931da5](https://redirect.github.com/super-linter/super-linter/commit/4931da55da35a8b438354adc03d220f693458f75)) - **docker:** bump terraform-linters/tflint from v0.51.2 to v0.52.0 ([#​5858](https://redirect.github.com/super-linter/super-linter/issues/5858)) ([ae1dba5](https://redirect.github.com/super-linter/super-linter/commit/ae1dba53fdc862da0064f56382dd86cd273862f6)) - **docker:** bump yoheimuta/protolint from 0.50.2 to 0.50.3 ([#​5857](https://redirect.github.com/super-linter/super-linter/issues/5857)) ([913bd0d](https://redirect.github.com/super-linter/super-linter/commit/913bd0dd47d3a42d6f2d3acad8fb59c2f185337b)) - **docker:** bump zricethezav/gitleaks from v8.18.3 to v8.18.4 ([#​5768](https://redirect.github.com/super-linter/super-linter/issues/5768)) ([33bb4b4](https://redirect.github.com/super-linter/super-linter/commit/33bb4b46d473c80a82364c50746ed20d19231f90)) - **github-actions:** bump actions/download-artifact from 4.1.7 to 4.1.8 ([#​5861](https://redirect.github.com/super-linter/super-linter/issues/5861)) ([ed72e66](https://redirect.github.com/super-linter/super-linter/commit/ed72e66416df8df15b492f7df00b8621b556893f)) - **github-actions:** bump actions/upload-artifact from 4.3.3 to 4.3.4 ([#​5860](https://redirect.github.com/super-linter/super-linter/issues/5860)) ([dd4313c](https://redirect.github.com/super-linter/super-linter/commit/dd4313c9b3bee70bfd968923e77430f3f19785aa)) - **github-actions:** bump docker/build-push-action from 5 to 6 ([#​5770](https://redirect.github.com/super-linter/super-linter/issues/5770)) ([27170b8](https://redirect.github.com/super-linter/super-linter/commit/27170b8e9243df7e18e59e7c43163b142568ee22)) - **java:** bump com.pinterest.ktlint:ktlint-cli in /dependencies/ktlint ([#​5849](https://redirect.github.com/super-linter/super-linter/issues/5849)) ([19c5fce](https://redirect.github.com/super-linter/super-linter/commit/19c5fcea2ea6a72741e59a30cb815c5faac524be)) - **npm:** bump [@​babel/eslint-parser](https://redirect.github.com/babel/eslint-parser) in /dependencies ([#​5886](https://redirect.github.com/super-linter/super-linter/issues/5886)) ([387a2b5](https://redirect.github.com/super-linter/super-linter/commit/387a2b56261451b12b00fc37d2fb79766564044d)) - **npm:** bump [@​babel/preset-react](https://redirect.github.com/babel/preset-react) in /dependencies ([#​5740](https://redirect.github.com/super-linter/super-linter/issues/5740)) ([4eeb628](https://redirect.github.com/super-linter/super-linter/commit/4eeb62862e823fd431fefb0078e5605484934254)) - **npm:** bump [@​babel/preset-typescript](https://redirect.github.com/babel/preset-typescript) in /dependencies ([#​5734](https://redirect.github.com/super-linter/super-linter/issues/5734)) ([de4b193](https://redirect.github.com/super-linter/super-linter/commit/de4b1930064cb6b5f65625101be33892c50d400f)) - **npm:** bump [@​react-native/eslint-config](https://redirect.github.com/react-native/eslint-config) in /dependencies ([#​5835](https://redirect.github.com/super-linter/super-linter/issues/5835)) ([28c228d](https://redirect.github.com/super-linter/super-linter/commit/28c228dfc0b8279e28ca5bb72a34e9390eca81b9)) - **npm:** bump [@​typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) in /dependencies ([#​5895](https://redirect.github.com/super-linter/super-linter/issues/5895)) ([7f5b018](https://redirect.github.com/super-linter/super-linter/commit/7f5b018fb7237ef0d6d1cb1578729065bacb4310)) - **npm:** bump eslint-plugin-jest in /dependencies ([#​5738](https://redirect.github.com/super-linter/super-linter/issues/5738)) ([1312398](https://redirect.github.com/super-linter/super-linter/commit/1312398b9c72138ce76f443dd933a8ff82f75fae)) - **npm:** bump eslint-plugin-jsx-a11y in /dependencies ([#​5797](https://redirect.github.com/super-linter/super-linter/issues/5797)) ([8972772](https://redirect.github.com/super-linter/super-linter/commit/89727727323246be93c3ed88c0b0fe1f07e25468)) - **npm:** bump eslint-plugin-react in /dependencies ([#​5890](https://redirect.github.com/super-linter/super-linter/issues/5890)) ([fe3e1f8](https://redirect.github.com/super-linter/super-linter/commit/fe3e1f83b7c7645640af9202bb7f4d8993f088fc)) - **npm:** bump eslint-plugin-vue from 9.26.0 to 9.27.0 in /dependencies ([#​5851](https://redirect.github.com/super-linter/super-linter/issues/5851)) ([c2e85a9](https://redirect.github.com/super-linter/super-linter/commit/c2e85a9f03ceccfe41107ea1e627c8c222b2154a)) - **npm:** bump jscpd from 4.0.4 to 4.0.5 in /dependencies ([#​5852](https://redirect.github.com/super-linter/super-linter/issues/5852)) ([042c6b1](https://redirect.github.com/super-linter/super-linter/commit/042c6b191708878b5db2b5096eadb1b4a6f4f27d)) - **npm:** bump next from 14.2.3 to 14.2.5 in /dependencies ([#​5887](https://redirect.github.com/super-linter/super-linter/issues/5887)) ([22b7ba9](https://redirect.github.com/super-linter/super-linter/commit/22b7ba91d0d273fdc5369d1ead66ae2cee451df0)) - **npm:** bump prettier from 3.3.2 to 3.3.3 in /dependencies ([#​5891](https://redirect.github.com/super-linter/super-linter/issues/5891)) ([b601212](https://redirect.github.com/super-linter/super-linter/commit/b6012126df99c9a8cdc5878bb9417ca7afee6809)) - **npm:** bump react-router-dom from 6.23.1 to 6.25.0 in /dependencies ([#​5897](https://redirect.github.com/super-linter/super-linter/issues/5897)) ([ef71e94](https://redirect.github.com/super-linter/super-linter/commit/ef71e944ab41a8f04ba143f44d4b8443d2d982b5)) - **npm:** bump renovate from 37.421.5 to 37.432.0 in /dependencies ([#​5896](https://redirect.github.com/super-linter/super-linter/issues/5896)) ([09a01eb](https://redirect.github.com/super-linter/super-linter/commit/09a01ebbe6dbb5e502817bb927191b8986c7c912)) - **npm:** bump textlint-rule-terminology in /dependencies ([#​5853](https://redirect.github.com/super-linter/super-linter/issues/5853)) ([55b065d](https://redirect.github.com/super-linter/super-linter/commit/55b065d3c2d512648c52d4d695761a7d274ae769)) - **npm:** bump typescript from 5.4.5 to 5.5.3 in /dependencies ([#​5832](https://redirect.github.com/super-linter/super-linter/issues/5832)) ([8605c2b](https://redirect.github.com/super-linter/super-linter/commit/8605c2b584b36201ac8d1acf98254c2d70776c75)) - **python:** bump ansible-lint in /dependencies/python ([#​5877](https://redirect.github.com/super-linter/super-linter/issues/5877)) ([e90ee32](https://redirect.github.com/super-linter/super-linter/commit/e90ee328a2f6eb42952eeda45929271fddaf0c77)) - **python:** bump cfn-lint from 1.4.2 to 1.6.1 in /dependencies/python ([#​5876](https://redirect.github.com/super-linter/super-linter/issues/5876)) ([ebf8cc8](https://redirect.github.com/super-linter/super-linter/commit/ebf8cc807a6c756755e790419fefcf9e5353b911)) - **python:** bump checkov in /dependencies/python ([#​5879](https://redirect.github.com/super-linter/super-linter/issues/5879)) ([47392ad](https://redirect.github.com/super-linter/super-linter/commit/47392ad6636919b4b21e6ef2c3e1418cb1e931f3)) - **python:** bump flake8 from 7.0.0 to 7.1.0 in /dependencies/python ([#​5780](https://redirect.github.com/super-linter/super-linter/issues/5780)) ([f019ee3](https://redirect.github.com/super-linter/super-linter/commit/f019ee34d21aa778d4b04217e7f717779ddfa767)) - **python:** bump ruff from 0.5.0 to 0.5.2 in /dependencies/python ([#​5880](https://redirect.github.com/super-linter/super-linter/issues/5880)) ([3fd69a1](https://redirect.github.com/super-linter/super-linter/commit/3fd69a107b05f04135f1c01544c50b940a3b1e99)) - **python:** bump snakemake in /dependencies/python ([#​5874](https://redirect.github.com/super-linter/super-linter/issues/5874)) ([2b6aa12](https://redirect.github.com/super-linter/super-linter/commit/2b6aa1290608468ee3828efdeabbeb467be43b80)) - **python:** bump sqlfluff from 3.0.7 to 3.1.0 in /dependencies/python ([#​5847](https://redirect.github.com/super-linter/super-linter/issues/5847)) ([31da61e](https://redirect.github.com/super-linter/super-linter/commit/31da61e1899ca3c9d26681c265b0928b559f1274)) ##### 🧰 Maintenance - add super-linter configuration in the bug template ([#​5910](https://redirect.github.com/super-linter/super-linter/issues/5910)) ([26ddd8b](https://redirect.github.com/super-linter/super-linter/commit/26ddd8b084201554e0351abf421d184864076a56)) - authenticate tflint init ([#​5894](https://redirect.github.com/super-linter/super-linter/issues/5894)) ([cc20e45](https://redirect.github.com/super-linter/super-linter/commit/cc20e4561e549c6f6609900ba68602930c01fb7d)) - bump alpine image to 3.20 and php to 8.3.x ([#​5863](https://redirect.github.com/super-linter/super-linter/issues/5863)) ([d9d1909](https://redirect.github.com/super-linter/super-linter/commit/d9d19095ecf48511e4c21a2e23f0def36187d141)) - enable dev-dependencies docker build checks ([#​5871](https://redirect.github.com/super-linter/super-linter/issues/5871)) ([12da497](https://redirect.github.com/super-linter/super-linter/commit/12da4973c69e6987217089a418199a8227f658d7)) - fix docker build warnings ([#​5862](https://redirect.github.com/super-linter/super-linter/issues/5862)) ([fc094cc](https://redirect.github.com/super-linter/super-linter/commit/fc094cc1a4be6a290c49c633fb857c454a98da47)) - print info about the environment, image size ([#​5869](https://redirect.github.com/super-linter/super-linter/issues/5869)) ([bcf8ca8](https://redirect.github.com/super-linter/super-linter/commit/bcf8ca82ad571bb0a04f028193b3f56486cfbeb4)) - remove duplicated configuration files ([#​5928](https://redirect.github.com/super-linter/super-linter/issues/5928)) ([70e0239](https://redirect.github.com/super-linter/super-linter/commit/70e02391170f6aaff4f0b4e80bf9bc8300940171)) - run docker build checks ([#​5864](https://redirect.github.com/super-linter/super-linter/issues/5864)) ([ce59f5c](https://redirect.github.com/super-linter/super-linter/commit/ce59f5c323a8e5038753582dc265ab172b654834)) - split validation logic in smaller functions ([#​5892](https://redirect.github.com/super-linter/super-linter/issues/5892)) ([d2d7334](https://redirect.github.com/super-linter/super-linter/commit/d2d73347d3e49fb28061a41df471afdcf0a579ba)) - update dependabot config for ci/dev updates ([#​5898](https://redirect.github.com/super-linter/super-linter/issues/5898)) ([e374e48](https://redirect.github.com/super-linter/super-linter/commit/e374e489339410662293e39f4147dc69d098077f)) - update release-please to the new workspace ([#​5901](https://redirect.github.com/super-linter/super-linter/issues/5901)) ([2ecf945](https://redirect.github.com/super-linter/super-linter/commit/2ecf94533920fb6a90ba5f029230cd4cdc69f855)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/angristan/openvpn-install). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi40Mi4yIiwidXBkYXRlZEluVmVyIjoiNDIuNDIuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Stanislas Lange <git@slange.me> |
||
|
StanislasandGitHub
|
ffcffac061 |
refactor: improve certificate duration variable naming (#1329)
## Summary - Rename constants to `DEFAULT_CERT_VALIDITY_DURATION_DAYS` and `DEFAULT_CRL_VALIDITY_DURATION_DAYS` for clarity - Replace all hardcoded `3650` values with the constants - Split `DAYS_VALID` into `CLIENT_CERT_DURATION_DAYS` and `SERVER_CERT_DURATION_DAYS` for more granular control over client vs server certificate validity - Increase CRL validity to 15 years (5475 days) to provide a 5-year safety buffer over the default 10-year certificate validity - Update README with new headless install variables ## Breaking changes - `DAYS_VALID` environment variable is replaced by `CLIENT_CERT_DURATION_DAYS` and `SERVER_CERT_DURATION_DAYS` |
||
|
StanislasandGitHub
|
6b09270347 |
feat: add certificate renewal functionality (#1328)
## Summary
- Add certificate renewal for both client and server certificates
- Allow custom validity period during renewal (prompts user, defaults to
3650 days)
- Show expiry info inline in menus (e.g., "Renew the server certificate
(expires in 3542 days)")
- Regenerate `.ovpn` files after client renewal
- Restart OpenVPN service after server renewal
- Extract reusable helper functions to reduce code duplication
- Add robust input validation and error handling
## New menu option
```
What do you want to do?
1) Add a new user
2) Revoke existing user
3) Renew certificate ← NEW
4) Remove OpenVPN
5) Exit
```
## Renewal submenu
```
What do you want to renew?
1) Renew a client certificate
2) Renew the server certificate (expires in 3542 days)
3) Back to main menu
```
Client list shows expiry for each:
```
Select the existing client certificate you want to renew
1) alice (expires in 3542 days)
2) bob (expires in 30 days)
3) charlie (EXPIRED 5 days ago)
```
## Helper functions added
Extracted common code into reusable functions:
- `getHomeDir()` - home directory detection
- `regenerateCRL()` - CRL regeneration after cert changes
- `generateClientConfig()` - .ovpn file generation
- `selectClient()` - client listing with optional expiry display
- `getDaysUntilExpiry()` - certificate expiry calculation
- `formatExpiry()` - human-readable expiry formatting
## Test plan
- [x] Client certificate renewal tested in Docker CI
- [x] Server certificate renewal tested in Docker CI
- [x] Certificate validity verified after renewal (~3650 days)
- [x] VPN connectivity tested with renewed certificate
Closes #974 #1002 #1228 #1060
|
||
|
StanislasandGitHub
|
004fbb477a |
Add structured logging system with color-coded output and file logging (#1321)
## Summary - Add comprehensive logging system with color-coded log levels ([INFO], [WARN], [ERROR], [OK]) - Wrap all command executions with `run_cmd()` to capture output and prevent leaks to stdout - Add file logging with timestamps (default: `openvpn-install.log`) - Suppress interactive prompts in auto-install mode for cleaner CI/scripted usage - Show log file location hint on errors for easier debugging ## Changes - **openvpn-install.sh**: New logging functions (`log_info`, `log_warn`, `log_error`, `log_fatal`, `log_success`, `log_prompt`, `log_header`, `log_menu`, `run_cmd`), all `echo` statements converted to use logging functions - **test/validate-output.sh**: New E2E validator that ensures all script output uses proper log formatting (catches raw echo leaks) - **test/server-entrypoint.sh**: Integrates output validation into Docker tests - **test/Dockerfile.server**: Copies validation script into container ## Configuration - `VERBOSE=1` - Show command output in terminal - `LOG_FILE=path` - Customize log location (default: `openvpn-install.log`) - `LOG_FILE=""` - Disable file logging - `FORCE_COLOR=1` - Force colored output in non-TTY environments |
||
|
StanislasandGitHub
|
a3389c126c |
Add Docker-based E2E testing (#1320)
### Summary - Add automated end-to-end testing using Docker to verify the installation script works across 18 Linux distributions - Add Oracle Linux 9 support to the installation script - Drop support for EOL distributions (Debian 8/9/10, CentOS 7, Ubuntu 16.04) - Disable Digital Ocean droplets based end-to-end tests, let's use docker from now on ### Changes **New test infrastructure:** - `test/Dockerfile.server` - Multi-OS server image with `BASE_IMAGE` build arg - `test/Dockerfile.client` - Ubuntu 24.04 client for connectivity testing - `test/server-entrypoint.sh` - Runs install script, verifies files exist, asserts iptables NAT rules, starts OpenVPN - `test/client-entrypoint.sh` - Connects to VPN, verifies tun0 interface, pings gateway - `docker-compose.yml` - Orchestrates server + client with shared volume - `.github/workflows/docker-test.yml` - CI matrix testing 18 OS variants - `.github/workflows/test.yml` - Removed push/PR triggers, now manual only for DO tests - `Makefile` - Local testing commands (`make test`, `make test-ubuntu-24.04`, etc.) **Distributions tested (18 total):** | Family | Versions | |--------|----------| | Ubuntu | 18.04, 20.04, 22.04, 24.04 | | Debian | 11, 12 | | Fedora | 40, 41 | | Rocky Linux | 8, 9 | | AlmaLinux | 8, 9 | | Oracle Linux | 8, 9 | | Amazon Linux | 2, 2023 | | CentOS Stream | 9 | | Arch Linux | latest | |