Bernhard.Linz/openvpn-install
1
0
포크 0
다음의 미러 https://github.com/angristan/openvpn-install.git 동기화됨 2026-09-25 11:13:21 +02:00
코드 이슈 프로젝트 릴리즈 위키 활동
855 커밋 9 브랜치 0 태그
33afa5758dc821d4a5a99f3de677f1b4c4b62c82
커밋 그래프
106 커밋
작성자 SHA1 메시지 날짜
Stanislas d2fc6d444b Add configurable VPN access policies (#1505) 
## Summary

- add independent install options for internet routing, client-to-client
access, and explicit server-side networks
- enforce the selected policy across firewalld, nftables, and iptables,
including DCO traffic
- use destination-scoped NAT for home LAN access and preserve client
routes and DNS in split-tunnel mode
- document the new defaults and add focused Docker policy coverage

Defaults remain internet access enabled, client-to-client access
disabled, and server-side network access disabled.


Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213
#147
 2026-08-02 22:57:05 +02:00
Stanislas 25476a7143 Handle unsupported OpenVPN APT suites (#1502) 
## Summary

- check that the official OpenVPN APT repository publishes the detected
suite before configuring it
- fall back to distribution packages for unsupported suites such as
Debian Sid/Forky
- remove stale repository configuration so failed installations can be
retried
- add Debian Sid to the Docker test matrix

Closes #1498
 2026-07-24 21:10:30 +02:00
renovate[bot] 935e5591e1 chore(deps): update docker/setup-buildx-action action to v4 2026-04-30 16:01:04 +02:00
renovate[bot] cc4a92b55f chore(deps): update super-linter/super-linter action to v8.3.2 (#1440) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[super-linter/super-linter](https://redirect.github.com/super-linter/super-linter)
| action | patch | `v8.3.1` -> `v8.3.2` |

---

### Release Notes

<details>
<summary>super-linter/super-linter (super-linter/super-linter)</summary>

###
[`v8.3.2`](https://redirect.github.com/super-linter/super-linter/releases/tag/v8.3.2)

[Compare
Source](https://redirect.github.com/super-linter/super-linter/compare/v8.3.1...v8.3.2)

##### 🐛 Bugfixes

- centralize file array additions and fix type
([#&#8203;7323](https://redirect.github.com/super-linter/super-linter/issues/7323))
([ce80cf6](https://redirect.github.com/super-linter/super-linter/commit/ce80cf6842c49618adb1eef1c4a455fb7a32f51c)),
closes
[#&#8203;7302](https://redirect.github.com/super-linter/super-linter/issues/7302)
- create log groups for enabled languages only
([#&#8203;7329](https://redirect.github.com/super-linter/super-linter/issues/7329))
([7c85bf3](https://redirect.github.com/super-linter/super-linter/commit/7c85bf3695efa7784c55c760b591a26994eb1538)),
closes
[#&#8203;7307](https://redirect.github.com/super-linter/super-linter/issues/7307)
- initialize github\_before\_sha
([#&#8203;7120](https://redirect.github.com/super-linter/super-linter/issues/7120))
([a93b722](https://redirect.github.com/super-linter/super-linter/commit/a93b722492ae64610b681733132b03316b5a3f1a)),
closes
[#&#8203;7118](https://redirect.github.com/super-linter/super-linter/issues/7118)
[#&#8203;7275](https://redirect.github.com/super-linter/super-linter/issues/7275)

##### ⬆️ Dependency updates

- **bundler:** bump rubocop in /dependencies in the rubocop group
([#&#8203;7313](https://redirect.github.com/super-linter/super-linter/issues/7313))
([7fab96c](https://redirect.github.com/super-linter/super-linter/commit/7fab96c232891c27aa68d1ccb78a4df73fc8d845))
- **docker:** bump clj-kondo/clj-kondo in the docker group
([#&#8203;7325](https://redirect.github.com/super-linter/super-linter/issues/7325))
([fa23c54](https://redirect.github.com/super-linter/super-linter/commit/fa23c5433efb749f5fb300cbec569e2c0874a335))
- **docker:** bump the docker group with 4 updates
([#&#8203;7318](https://redirect.github.com/super-linter/super-linter/issues/7318))
([dc49a6d](https://redirect.github.com/super-linter/super-linter/commit/dc49a6d6bdd54b017a4b5a246f6f74cdd7a39b99))
- **java:** bump com.puppycrawl.tools:checkstyle
([#&#8203;7312](https://redirect.github.com/super-linter/super-linter/issues/7312))
([ab58437](https://redirect.github.com/super-linter/super-linter/commit/ab584378be9a17bc1544a55d48a6daf69bf119bc))
- **npm:** bump next from 16.0.10 to 16.1.0 in /dependencies
([#&#8203;7316](https://redirect.github.com/super-linter/super-linter/issues/7316))
([a8572e2](https://redirect.github.com/super-linter/super-linter/commit/a8572e292ba5ca18ef118b066eb3d1570b8de902))
- **npm:** bump renovate
([#&#8203;7300](https://redirect.github.com/super-linter/super-linter/issues/7300))
([191338a](https://redirect.github.com/super-linter/super-linter/commit/191338acc8928b9e523533a22c8cea7f83daefec))
- **npm:** bump the npm group across 1 directory with 10 updates
([#&#8203;7322](https://redirect.github.com/super-linter/super-linter/issues/7322))
([24d9e00](https://redirect.github.com/super-linter/super-linter/commit/24d9e00de99a2a9056c1717e69163f832d18756e))
- **npm:** bump the npm group across 1 directory with 2 updates
([#&#8203;7296](https://redirect.github.com/super-linter/super-linter/issues/7296))
([0697485](https://redirect.github.com/super-linter/super-linter/commit/069748517af0b1ddbfae6ed6545a636162b99aa9))
- **npm:** bump the npm group across 1 directory with 2 updates
([#&#8203;7301](https://redirect.github.com/super-linter/super-linter/issues/7301))
([4b2bf76](https://redirect.github.com/super-linter/super-linter/commit/4b2bf76ed4965f51047c2f8825b7f2181fd4591e))
- **npm:** bump the npm group across 1 directory with 4 updates
([#&#8203;7327](https://redirect.github.com/super-linter/super-linter/issues/7327))
([07e73d6](https://redirect.github.com/super-linter/super-linter/commit/07e73d60033bef44a0c4224fb7f0ce1389714002))
- **python:** bump ansible-lint
([#&#8203;7326](https://redirect.github.com/super-linter/super-linter/issues/7326))
([47962ea](https://redirect.github.com/super-linter/super-linter/commit/47962eae72ffee1ebc038c4b719d6394178658ee))
- **python:** bump snakemake
([#&#8203;7295](https://redirect.github.com/super-linter/super-linter/issues/7295))
([3f92589](https://redirect.github.com/super-linter/super-linter/commit/3f925892e7f0f6020a698a69caef86eb3277cd9c))
- **python:** bump the pip group across 1 directory with 2 updates
([#&#8203;7299](https://redirect.github.com/super-linter/super-linter/issues/7299))
([0ca0315](https://redirect.github.com/super-linter/super-linter/commit/0ca0315180d0039872dd5c0828f50530a2747722))
- **python:** bump the pip group across 1 directory with 6 updates
([#&#8203;7317](https://redirect.github.com/super-linter/super-linter/issues/7317))
([ae7e8d8](https://redirect.github.com/super-linter/super-linter/commit/ae7e8d8e5c32255e2bc335540e2c92c49a095d6f))

##### 🧰 Maintenance

- disable dependabot cooldown
([#&#8203;7311](https://redirect.github.com/super-linter/super-linter/issues/7311))
([e98f7d3](https://redirect.github.com/super-linter/super-linter/commit/e98f7d3c79423480207804b55cf282c76156bbac))
- **docs:** mention conflicting tools in upgrades
([#&#8203;7324](https://redirect.github.com/super-linter/super-linter/issues/7324))
([7afe608](https://redirect.github.com/super-linter/super-linter/commit/7afe608fff92093619af9fe2aacf61a093419551)),
closes
[#&#8203;7298](https://redirect.github.com/super-linter/super-linter/issues/7298)
- **github-actions:** bump the dev-ci-tools group with 2 updates
([#&#8203;7315](https://redirect.github.com/super-linter/super-linter/issues/7315))
([4b07868](https://redirect.github.com/super-linter/super-linter/commit/4b07868ae26255da8c0d8a69d7c0a4aff02e1b04))
- group eslint updates
([#&#8203;7321](https://redirect.github.com/super-linter/super-linter/issues/7321))
([20f25a3](https://redirect.github.com/super-linter/super-linter/commit/20f25a369053b8067ccfedf04e3ed98e7df71ff6))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-25 13:44:05 +01:00
renovate[bot] 46ac668bbc chore(deps): update docker/setup-buildx-action action to v3.12.0 (#1438) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[docker/setup-buildx-action](https://redirect.github.com/docker/setup-buildx-action)
| action | minor | `v3.11.1` -> `v3.12.0` |

---

### Release Notes

<details>
<summary>docker/setup-buildx-action
(docker/setup-buildx-action)</summary>

###
[`v3.12.0`](https://redirect.github.com/docker/setup-buildx-action/compare/v3.11.1...v3.12.0)

[Compare
Source](https://redirect.github.com/docker/setup-buildx-action/compare/v3.11.1...v3.12.0)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-25 13:43:54 +01:00
Stanislas df242ee069 feat: add peer-fingerprint authentication mode (OpenVPN 2.6+) (#1437) 
## Summary

Implements support for OpenVPN's `--peer-fingerprint` option, enabling
PKI-less authentication using SHA256 certificate fingerprints instead of
a CA chain.

Closes #1361

## Changes

- Add `--auth-mode` option (`pki` or `fingerprint`) for install command
- Use Easy-RSA's `self-sign-server` and `self-sign-client` commands for
fingerprint mode
- Server stores client fingerprints in `<peer-fingerprint>` block in
`server.conf`
- Clients verify server using `peer-fingerprint` directive instead of CA
- Revocation removes fingerprint from config and reloads OpenVPN
(instant effect)
- Version check ensures OpenVPN 2.6+ when fingerprint mode is selected

## Usage

```bash
# Interactive mode prompts for auth mode choice

# CLI mode
./openvpn-install.sh install --auth-mode fingerprint
```

## Comparison

| Aspect | PKI Mode | Fingerprint Mode |
|--------|----------|------------------|
| Server cert | CA-signed | Self-signed |
| Client cert | CA-signed | Self-signed |
| Revocation | CRL-based | Remove fingerprint |
| OpenVPN | Any version | 2.6.0+ required |
| Best for | Large deployments | Small/home setups |
 2025-12-18 17:20:28 +01:00
renovate[bot] cf4a6a791a chore(deps): update super-linter/super-linter action to v8.3.1 (#1429) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[super-linter/super-linter](https://redirect.github.com/super-linter/super-linter)
| action | patch | `v8.3.0` -> `v8.3.1` |

---

### Release Notes

<details>
<summary>super-linter/super-linter (super-linter/super-linter)</summary>

###
[`v8.3.1`](https://redirect.github.com/super-linter/super-linter/releases/tag/v8.3.1)

[Compare
Source](https://redirect.github.com/super-linter/super-linter/compare/v8.3.0...v8.3.1)

##### 🐛 Bugfixes

- **docs:** ansible-lints lints the entire dir
([#&#8203;7272](https://redirect.github.com/super-linter/super-linter/issues/7272))
([b721f3c](https://redirect.github.com/super-linter/super-linter/commit/b721f3c5457b44561da6e4c2b9410de8315440dd)),
closes
[#&#8203;7263](https://redirect.github.com/super-linter/super-linter/issues/7263)
- handle paths with parentheses
([#&#8203;7273](https://redirect.github.com/super-linter/super-linter/issues/7273))
([d29d0d4](https://redirect.github.com/super-linter/super-linter/commit/d29d0d4ffb9e0d5f71026f616ba31b1228b772fa))
- rollback to python 3.13
([#&#8203;7269](https://redirect.github.com/super-linter/super-linter/issues/7269))
([10265f1](https://redirect.github.com/super-linter/super-linter/commit/10265f11c8902b6d12c083edd0a23da2cafc7f00))
- trivial log message bug when file does not exist
([#&#8203;7268](https://redirect.github.com/super-linter/super-linter/issues/7268))
([c6a7b38](https://redirect.github.com/super-linter/super-linter/commit/c6a7b385670ac9c594f1630063254fcc4a5c5d74))

##### ⬆️ Dependency updates

- **bundler:** bump rubocop-rails in /dependencies in the rubocop group
([#&#8203;7251](https://redirect.github.com/super-linter/super-linter/issues/7251))
([d8a2032](https://redirect.github.com/super-linter/super-linter/commit/d8a2032a5d9a067d05b55db58c52ebcff6620c11))
- **java:** bump com.google.googlejavaformat:google-java-format
([#&#8203;7270](https://redirect.github.com/super-linter/super-linter/issues/7270))
([140a2e3](https://redirect.github.com/super-linter/super-linter/commit/140a2e37bc294b770e31def087a16ce1051a68d7))
- **java:** bump com.puppycrawl.tools:checkstyle
([#&#8203;7264](https://redirect.github.com/super-linter/super-linter/issues/7264))
([550df3c](https://redirect.github.com/super-linter/super-linter/commit/550df3c97df2127bae653a3e8de0caccb9092973))
- **java:** bump the java-gradle group across 3 directories with 3
updates
([#&#8203;7252](https://redirect.github.com/super-linter/super-linter/issues/7252))
([5306a0a](https://redirect.github.com/super-linter/super-linter/commit/5306a0a618372a73fe40d7e8c157ca632de75af7))
- **npm:** bump
[@&#8203;modelcontextprotocol/sdk](https://redirect.github.com/modelcontextprotocol/sdk)
in /dependencies
([#&#8203;7248](https://redirect.github.com/super-linter/super-linter/issues/7248))
([4d59852](https://redirect.github.com/super-linter/super-linter/commit/4d59852bbcda028357fdbbfeb61187fa28507200))
- **npm:** bump express from 5.1.0 to 5.2.1 in /dependencies
([#&#8203;7246](https://redirect.github.com/super-linter/super-linter/issues/7246))
([50462d3](https://redirect.github.com/super-linter/super-linter/commit/50462d3ff8b4563663815874498977d4546e80eb))
- **npm:** bump jws from 4.0.0 to 4.0.1 in /dependencies
([#&#8203;7260](https://redirect.github.com/super-linter/super-linter/issues/7260))
([cc90344](https://redirect.github.com/super-linter/super-linter/commit/cc90344711f7c84363cb32fff58a42f42dd05cbb))
- **npm:** bump next from 16.0.7 to 16.0.9 in /dependencies
([#&#8203;7277](https://redirect.github.com/super-linter/super-linter/issues/7277))
([b7cedfb](https://redirect.github.com/super-linter/super-linter/commit/b7cedfbfe661f16a7a2b3b91cc367a189e1400f7))
- **npm:** bump the npm group across 1 directory with 3 updates
([#&#8203;7289](https://redirect.github.com/super-linter/super-linter/issues/7289))
([f65215e](https://redirect.github.com/super-linter/super-linter/commit/f65215e93e5c2aecdcda71d181af47012d384681))
- **npm:** bump the npm group across 1 directory with 5 updates
([#&#8203;7271](https://redirect.github.com/super-linter/super-linter/issues/7271))
([b4e616f](https://redirect.github.com/super-linter/super-linter/commit/b4e616f557869b1de38e2ef5093fa160a5849a4d))
- **npm:** bump the npm group across 1 directory with 7 updates
([#&#8203;7259](https://redirect.github.com/super-linter/super-linter/issues/7259))
([0ab9ad4](https://redirect.github.com/super-linter/super-linter/commit/0ab9ad42083eb92b8794c962bfe942d433701e35))
- **npm:** bump the npm group across 1 directory with 8 updates
([#&#8203;7266](https://redirect.github.com/super-linter/super-linter/issues/7266))
([39e94f8](https://redirect.github.com/super-linter/super-linter/commit/39e94f843cca4e7fac6a58db01bc5c2760a1840f))
- **python:** bump the pip group across 1 directory with 2 updates
([#&#8203;7288](https://redirect.github.com/super-linter/super-linter/issues/7288))
([4559b6e](https://redirect.github.com/super-linter/super-linter/commit/4559b6e55a3d219bec6c7907d52030e309a584b8))
- **python:** bump the pip group across 1 directory with 7 updates
([#&#8203;7265](https://redirect.github.com/super-linter/super-linter/issues/7265))
([026d3fe](https://redirect.github.com/super-linter/super-linter/commit/026d3fe1edbb7414b79a39be4d11e666425176bd))

##### 🧰 Maintenance

- add prettier and htmlhint to the npm group
([#&#8203;7257](https://redirect.github.com/super-linter/super-linter/issues/7257))
([4692c1c](https://redirect.github.com/super-linter/super-linter/commit/4692c1cc3aa66f6d26c62a78534a168391a1a9d5))
- **deps:** update docker dependencies
([#&#8203;7285](https://redirect.github.com/super-linter/super-linter/issues/7285))
([f4d16d3](https://redirect.github.com/super-linter/super-linter/commit/f4d16d3155f32058b79f8f54c19067aec415ddd8)),
closes
[#&#8203;7244](https://redirect.github.com/super-linter/super-linter/issues/7244)
- fix docs typos and update next
([#&#8203;7284](https://redirect.github.com/super-linter/super-linter/issues/7284))
([0df9f3c](https://redirect.github.com/super-linter/super-linter/commit/0df9f3cff24518f8f07f624457dcc52a48e76bea))
- update issue template and print graph
([#&#8203;7276](https://redirect.github.com/super-linter/super-linter/issues/7276))
([dfb728c](https://redirect.github.com/super-linter/super-linter/commit/dfb728c158a47400469455f19e2504e323ac6482))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-18 12:46:41 +01:00
Stanislas 9289770e8b refactor: eliminate CHOICE variables and centralize configuration (#1427) 
## Summary

- Eliminate all CHOICE intermediary variables (~17 variables removed)
- Replace numeric values with descriptive string values throughout
- Centralize configuration defaults in a single function
- Add comprehensive validation for all configuration values
- Add reusable helper functions for interactive prompts
- Fix non-interactive mode to skip interactive prompts entirely

## Changes

### Configuration Values Now Use Strings

| Variable | Before | After |
|----------|--------|-------|
| TLS_SIG | 1, 2, 3 | "crypt-v2", "crypt", "auth" |
| CERT_TYPE | 1, 2 | "ecdsa", "rsa" |
| DNS | 1-13 | "cloudflare", "quad9", "custom", etc. |

### Code Reduction

- Removed ~80 lines of duplicate defaults from `installOpenVPN()`
- Removed ~60 lines of CHOICE variable assignments from `cmd_install()`
- Net change: cleaner structure with better separation of concerns

### New Functions

- `set_installation_defaults()`: Single source of truth for all defaults
- `validate_configuration()`: Validates all config values after defaults
applied
- `select_from_array()`: Generic menu selection helper
- `select_with_labels()`: Menu with display labels different from values
- `prompt_yes_no()`: Yes/no prompts with validation
- `prompt_validated()`: Custom value prompts with validation function
- `detect_server_ips()`: Detects server IPv4/IPv6 addresses
- `prepare_network_config()`: Calculates derived network config
(gateways, etc.)

### Configuration Constants

Added readonly arrays for valid options:
- `PROTOCOLS`, `DNS_PROVIDERS`, `CIPHERS`, `CERT_TYPES`
- `CERT_CURVES`, `RSA_KEY_SIZES`, `TLS_VERSIONS`
- `TLS13_CIPHERSUITES_OPTIONS`, `TLS_GROUPS_OPTIONS`
- `HMAC_ALGORITHMS`, `TLS_SIG_MODES`

### Non-Interactive Mode Fix

- `installQuestions()` is now only called in interactive mode
- IP detection and gateway calculations extracted to separate functions
- Renamed `AUTO_INSTALL` to `NON_INTERACTIVE_INSTALL` for clarity
- Non-interactive installs no longer hang waiting for user input

## Test plan

- [ ] Run `make test` (default Ubuntu)
- [ ] Test interactive installation
- [ ] Test non-interactive installation with CLI flags
- [ ] Test non-interactive installation with environment variables
- [ ] Test invalid configuration values are rejected
 2025-12-17 23:48:10 +01:00
Stanislas 6b07477dd9 feat: flexible IPv4/IPv6 support with independent endpoint and client addressing (#1419) 
## Summary

Comprehensive IPv4/IPv6 overhaul that decouples server endpoint
addressing from client tunnel addressing, supporting all combinations
with automatic leak prevention.

### Supported Configurations

| Endpoint | Client Mode | Description |
|----------|-------------|-------------|
| IPv4 | IPv4-only | Traditional setup (4→4) |
| IPv4 | Dual-stack | IPv4 endpoint, clients get both (4→4/6) |
| IPv4 | IPv6-only | IPv4 endpoint, clients get IPv6 only (4→6) |
| IPv6 | IPv4-only | IPv6 endpoint, clients get IPv4 only (6→4) |
| IPv6 | Dual-stack | IPv6 endpoint, clients get both (6→4/6) |
| IPv6 | IPv6-only | Full IPv6 setup (6→6) |

### Leak Prevention

- **IPv4-only mode**: Pushes `block-ipv6` to clients, blocking all IPv6
traffic
- **IPv6-only mode**: Assigns IPv4 addresses and pushes
`redirect-gateway def1` to capture IPv4 traffic, which is then dropped
(no IPv4 NAT configured)
- **Dual-stack mode**: Both protocols tunneled normally

### New CLI Options

```
Network Options:
  --endpoint-type <4|6>     Endpoint IP version (default: 4)
  --client-ipv4             Enable IPv4 for VPN clients (default: enabled)
  --no-client-ipv4          Disable IPv4 for VPN clients
  --client-ipv6             Enable IPv6 for VPN clients (default: disabled)
  --no-client-ipv6          Disable IPv6 for VPN clients
  --subnet-ipv4 <x.x.x.0>   IPv4 VPN subnet (default: 10.8.0.0)
  --subnet-ipv6 <prefix>    IPv6 VPN subnet (default: fd42:42:42:42::)
```

### Usage Examples

```bash
# Dual-stack clients (IPv4 + IPv6)
./openvpn-install.sh install --client-ipv4 --client-ipv6

# IPv6-only clients (IPv4 traffic blocked)
./openvpn-install.sh install --no-client-ipv4 --client-ipv6

# IPv4-only clients (IPv6 traffic blocked) - default behavior
./openvpn-install.sh install --client-ipv4 --no-client-ipv6

# IPv6 server endpoint
./openvpn-install.sh install --endpoint-type 6 --endpoint 2001:db8::1

# Custom subnets
./openvpn-install.sh install --client-ipv6 --subnet-ipv4 10.9.0.0 --subnet-ipv6 fd00:1234:5678::
```

### Implementation Details

**Core changes:**
- New `ENDPOINT_TYPE` variable (4 or 6) controls server listening
protocol
- New `CLIENT_IPV4`/`CLIENT_IPV6` variables control client tunnel
addressing
- Renamed `VPN_SUBNET` → `VPN_SUBNET_IPV4`, added `VPN_SUBNET_IPV6`
- Separate `resolvePublicIPv4()` and `resolvePublicIPv6()` functions
- New `validate_subnet_ipv6()` for ULA (fd00::/8) validation

**Protocol handling:**
- Uses `proto udp6`/`tcp6` when endpoint type is IPv6
- Firewall and SELinux commands handle both protocol variants

**Firewall updates:**
- firewalld: Conditional IPv6 masquerade and forwarding
- nftables: Separate ip/ip6 tables for NAT based on client config
- iptables: ip6tables rules only when IPv6 clients enabled

**DNS configuration:**
- Unbound listens on IPv4/IPv6 gateway addresses as needed
- All third-party DNS providers now include IPv6 servers:
  - Cloudflare: 2606:4700:4700::1111
  - Quad9: 2620:fe::fe
  - Google: 2001:4860:4860::8888
  - OpenDNS: 2620:119:35::35
  - AdGuard: 2a10:50c0::ad1:ff

**CI/Testing:**
- Added `ubuntu-24.04-dual-stack` test matrix entry
- Docker test container enables IPv6 forwarding
- `CLIENT_IPV6` environment variable passed to test container

## Test Plan

- [x] Shellcheck passes
- [x] CI Docker tests pass (including new dual-stack test)
- [x] Manual testing: IPv4-only mode blocks IPv6 traffic
- [x] Manual testing: IPv6-only mode blocks IPv4 traffic
- [x] Manual testing: Dual-stack mode tunnels both protocols

---

Closes #1317
Closes #1288
Closes #1084
Closes #701
Closes #350
 2025-12-15 22:19:02 +01:00
Stanislas ec3e80ac16 feat: add CLI interface with subcommands (#1398) 
Replace environment variable-based configuration with a proper CLI
interface using subcommands and flags.

### Commands

```
openvpn-install <command> [options]

Commands:
  install       Install and configure OpenVPN server
  uninstall     Remove OpenVPN server
  client        Manage client certificates (add/list/revoke/renew)
  server        Server management (status/renew)
  interactive   Launch interactive menu
```

### Highlights

- **No args → help**: Running without arguments shows help instead of
interactive menu
- **JSON output**: `client list` and `server status` support `--format
json`
- **25+ install flags**: Network, DNS, security, and client options
- **Interactive mode preserved**: `install --interactive` or
`interactive` command

### Breaking Changes

Environment variables (`AUTO_INSTALL`, `MENU_OPTION`, `CLIENT`, etc.)
are no longer supported. Use CLI flags instead.

```bash
# Before
MENU_OPTION=1 CLIENT=foo PASS=1 ./openvpn-install.sh

# After
./openvpn-install.sh client add foo
```


Closes https://github.com/angristan/openvpn-install/issues/1202
 2025-12-14 22:08:44 +01:00
Stanislas cb0ef7b1c2 fix: use /etc/openvpn/server/ for tls-crypt-v2 temp files (#1393) 
## Summary

- Fix tls-crypt-v2 client key generation failing on Ubuntu 25.04+ with
"Permission denied"
- Add Ubuntu 25.10 to CI test matrix

## Root Cause

Ubuntu 25.04 introduced an AppArmor profile for openvpn
(`/etc/apparmor.d/openvpn`) that restricts where the binary can write.
The allowed paths are:
- `/etc/openvpn/{,**}`
- `@{HOME}/**` (owner only)

The script was using `mktemp` which creates files in `/tmp`, causing the
error:
```
Cannot open file '/tmp/tmp.XXX' for write: Permission denied (errno=13)
```

## Fix

Changed the temp file location from `/tmp` to `/etc/openvpn/server/`:
```bash
# Before
tls_crypt_v2_tmpfile=$(mktemp)

# After
tls_crypt_v2_tmpfile=$(mktemp /etc/openvpn/server/tls-crypt-v2-client.XXXXXX)
```

Fixes #1391
 2025-12-14 00:23:43 +01:00
Stanislas 8ea2d1b5b2 feat: add native nftables support (#1389) 
- Add nftables as a third firewall backend option alongside firewalld
and iptables
- Detection priority: firewalld → nftables → iptables (legacy fallback)
- Uses dedicated `openvpn` and `openvpn-nat` tables for clean isolation
- Integrates with native `nftables.service` via include in
`/etc/nftables.conf`


Closes https://github.com/angristan/openvpn-install/issues/530
 2025-12-14 00:03:29 +01:00
Stanislas d8aa625639 feat: add native firewalld support (#1388) 
## Summary

- Add native firewalld support for RHEL/Fedora/CentOS systems
- When firewalld is active, use `firewall-cmd --permanent` instead of
raw iptables
- Rules persist across `firewall-cmd --reload`
- Fall back to iptables when firewalld is not active
- Add `After=firewalld.service` to iptables systemd unit for safety

## Changes

**Install:** Detect firewalld, use `firewall-cmd` to add port,
masquerade, and rich rules. Fall back to iptables if inactive.

**Uninstall:** Detect which method was used and clean up accordingly.

**Tests:** Add `fedora-42-firewalld` CI test with firewalld enabled.

---

Closes https://github.com/angristan/openvpn-install/issues/356
Closes https://github.com/angristan/openvpn-install/pull/1200
 2025-12-13 20:49:40 +01:00
renovate[bot]Stanislas Langegithub-actions[bot]
 		be2a195bb5 chore(deps): update dependency openvpn/easy-rsa to v3.2.5 (#1381) 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [OpenVPN/easy-rsa](https://redirect.github.com/OpenVPN/easy-rsa) |
patch | `3.2.4` -> `3.2.5` |

---

### Release Notes

<details>
<summary>OpenVPN/easy-rsa (OpenVPN/easy-rsa)</summary>

###
[`v3.2.5`](https://redirect.github.com/OpenVPN/easy-rsa/releases/tag/v3.2.5):
3.2.5

[Compare
Source](https://redirect.github.com/OpenVPN/easy-rsa/compare/v3.2.4...v3.2.5)

#### What's Changed

- Replace `local` / `global` `openssl-easyrsa.cnf` by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1394](https://redirect.github.com/OpenVPN/easy-rsa/pull/1394)
- init-pki: Introduce configurable cryptography by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1397](https://redirect.github.com/OpenVPN/easy-rsa/pull/1397)
- Drop x509 type kdc built-in by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1399](https://redirect.github.com/OpenVPN/easy-rsa/pull/1399)
- Always generate an `openssl-easyrsa.cnf` or `x509-types` tmp-file by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1401](https://redirect.github.com/OpenVPN/easy-rsa/pull/1401)
- Libressl use `$EASYRSA_FORCE_SAFE_SSL` by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1402](https://redirect.github.com/OpenVPN/easy-rsa/pull/1402)
- Update EasyRSA-Advanced.md by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1403](https://redirect.github.com/OpenVPN/easy-rsa/pull/1403)
- `source_vars()`: Add `grep` regex for assign by equal `=` by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1405](https://redirect.github.com/OpenVPN/easy-rsa/pull/1405)
- export\_pkcs(), PKCS12 inline: Respect $EASYRSA\_NO\_INLINE by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1407](https://redirect.github.com/OpenVPN/easy-rsa/pull/1407)
- Introduce peer-fingerprint inline lists by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1410](https://redirect.github.com/OpenVPN/easy-rsa/pull/1410)
- help: Add '-b' alias for --batch and correct default 'vars' file by
[@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1411](https://redirect.github.com/OpenVPN/easy-rsa/pull/1411)
- New function ssl\_cert\_sig\_digest(); Extract certificae digest name
by [@&#8203;TinCanTech](https://redirect.github.com/TinCanTech) in
[#&#8203;1414](https://redirect.github.com/OpenVPN/easy-rsa/pull/1414)
- Upgrading OpenSSL for Windows to 3.6.0 by
[@&#8203;ecrist](https://redirect.github.com/ecrist) in
[#&#8203;1416](https://redirect.github.com/OpenVPN/easy-rsa/pull/1416)

**Full Changelog**:
<https://github.com/OpenVPN/easy-rsa/compare/v3.2.4...v3.2.5>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi40Mi4yIiwidXBkYXRlZEluVmVyIjoiNDIuNDIuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Stanislas Lange <git@slange.me>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
 2025-12-13 19:48:07 +01:00
Stanislas 75ea8ef1c1 ci: only cancel in-progress jobs for pull requests (#1378) 
- Only cancel in-progress CI jobs for pull requests, not for master
branch pushes
- Ensures all master branch jobs run to completion while still saving CI
resources on PRs
 2025-12-13 15:14:15 +01:00
Stanislas 3561d13389 feat: add tls-crypt-v2 support with per-client keys (#1377) 
## Summary

- Add support for OpenVPN's `tls-crypt-v2` feature (per-client TLS keys)
- Set `tls-crypt-v2` as the new recommended default
- Add CI tests for all 3 TLS key types

Closes #983
Closes #758
Closes https://github.com/angristan/openvpn-install/pull/1257

## What is tls-crypt-v2?

Unlike `tls-crypt` (shared key), `tls-crypt-v2` generates unique keys
per client:

- **Better security**: Compromised client keys don't affect other
clients
- **Easier management**: Individual client key revocation without
regenerating server key
- **Scalability**: Better suited for large deployments

Requires OpenVPN 2.5+ (released 2020).

## Menu options

```
1) tls-crypt-v2 (recommended): Encrypts control channel, unique key per client
2) tls-crypt: Encrypts control channel, shared key for all clients
3) tls-auth: Authenticates control channel, no encryption
```
 2025-12-13 14:32:38 +01:00
Stanislas 2c53bc0f83 feat: add run_cmd_fatal, fix Fedora, improve CI (#1369) 
## Summary

This PR contains three related improvements:

### 1. Add `run_cmd_fatal` for critical operations
- New helper function that wraps `run_cmd` and exits on failure
- Converts critical operations (package installs, PKI setup, certificate
generation) to fail fast
- Non-critical operations (systemctl, cleanup) still use `run_cmd`
- Password-protected client certs run directly to preserve interactive
prompt

### 2. Fix Fedora installation
- Skip Copr repository setup since Fedora already ships OpenVPN 2.6.x
- Simplifies installation and removes external repository dependency

### 3. Improve CI test reliability
- Fail fast when `openvpn-test.service` fails during startup
- Add `journalctl` output to error diagnostics
- Display service status in wait loop
- Increase VPN gateway ping count from 3 to 10 for stability
 2025-12-13 13:31:54 +01:00
Stanislas 9e1bb4b175 feat: enable proper systemd support in Docker tests (#1373) 
- Replace the `sed` hack that disabled `systemctl` commands with proper
systemd support in Docker containers
- This allows testing the actual `systemctl` commands used by the
install script
- No more manual workarounds for starting OpenVPN/Unbound services
 2025-12-13 01:14:54 +01:00
Guo Yunhe그리고Stanislas Lange bbf93a19d5 Add openSUSE Tumbleweed/Leap support (#1166) 
<!---
❗️ Please read ❗️
➡️ Please make sure you've followed the guidelines:
https://github.com/angristan/openvpn-install#contributing
✅ Please make sure your changes are tested and working
🗣️ Please avoid large PRs, and discuss changes in a GitHub issue first
✋ If the changes are too big and not in line with the project, they will
probably be rejected. Remember that this script is meant to be simple
and easy to use.
--->

---------

Co-authored-by: Stanislas Lange <git@slange.me>
 2025-12-11 21:22:12 +01:00
Stanislas 4b00f44e8e feat: add version 10 support for RHEL-based distributions (#1346) 
## Summary

- Add version 10 support for CentOS Stream, Rocky Linux, AlmaLinux, and
Oracle Linux
- Consolidate version check logic into a single check for all RHEL-based
distributions
- Fix Rocky Linux Docker image names to `rockylinux/rockylinux:tag`
- Increase Easy-RSA download curl retry from 3 to 5
- Fail early if EPEL/Copr repository setup fails
- Fix Oracle Linux EPEL package name (`oracle-epel-release-el*` instead
of `epel-release`)

## Changes

### `openvpn-install.sh`
- Combine version checks for CentOS/Rocky/AlmaLinux and Oracle Linux
into one
- Update error message to list supported distributions
- Change Easy-RSA download `--retry 3` to `--retry 5`
- Add `|| log_fatal` to EPEL and Copr setup commands to fail early on
errors
- Use `oracle-epel-release-el{8,9,10}` for Oracle Linux instead of
`epel-release`

### `.github/workflows/docker-test.yml`
- Add CentOS Stream 10 (`quay.io/centos/centos:stream10`)
- Add Rocky Linux 10 (`rockylinux/rockylinux:10`)
- Add AlmaLinux 10 (`almalinux:10`)
- Add Oracle Linux 10 (`oraclelinux:10`)
- Fix Rocky Linux image names from `rockylinux:X` to
`rockylinux/rockylinux:X`

## Test plan

- [ ] CI passes for existing distributions
- [ ] CI passes for new version 10 distributions (where images are
available)
 2025-12-11 20:22:00 +01:00
Stanislas 0d4d2229f4 test: add e2e tests for certificate revocation (#1345) 
## Summary

- Add end-to-end tests for certificate revocation functionality
- Test that a revoked client certificate cannot connect to the VPN
- Test that a new certificate can be created with the same name as a
revoked one (validating the fix from #1185)
- Test that the new certificate can successfully connect

## Test Flow

1. **Initial connectivity tests** - existing tests pass
2. **Certificate revocation test**:
   - Create a new client `revoketest`
   - Connect with the certificate (verifies it works)
   - Disconnect the client
   - Revoke the certificate via the install script
- Try to reconnect with revoked cert (verifies connection is rejected)
3. **Reuse revoked name test**:
   - Create a new certificate with the same name `revoketest`
   - Verify both revoked and valid entries exist in `index.txt`
   - Connect with the new certificate (verifies it works)

## Changes

| File | Changes |
|------|---------|
| `test/server-entrypoint.sh` | Start OpenVPN in background, add
revocation test orchestration |
| `test/client-entrypoint.sh` | Add revocation test phases with signal
file coordination |
| `docker-compose.yml` | Remove read-only restriction on shared volume
for client |
| `Makefile` | Increase timeout from 60 to 180 iterations |
| `.github/workflows/docker-test.yml` | Increase timeouts, fix shared
volume |
 2025-12-11 18:22:16 +01:00
Stanislas Lange 690414a56e ci: update Fedora versions to 42 and 43 2025-12-11 17:21:48 +01:00
Stanislas Lange d9e11822db fix: use pgrep -f to detect OpenVPN server, not transient processes 
The previous check using `pgrep -x openvpn` was matching transient
openvpn processes like `openvpn --genkey` that run during installation,
causing false positives. This led to race conditions where the CI
thought the server was running when it was actually still installing.

Use `pgrep -f "openvpn.*server.conf"` to specifically match the actual
OpenVPN server process running with the server configuration.
 2025-12-11 17:21:48 +01:00
Stanislas Lange 6cca56f5b5 ci: add install script log output in docker-test workflow 
Add step to display the install script log file (openvpn-install.log)
which includes timestamps and all installation activity.

This makes debugging CI failures easier by providing detailed logs
directly in the workflow output.
 2025-12-11 17:21:48 +01:00
Stanislas Lange 599d122113 fix: use pgrep -x to accurately check for OpenVPN process in docker-test workflow 2025-12-11 16:26:45 +01:00
renovate[bot]그리고Stanislas Lange 1aae852c60 chore(deps): update super-linter/super-linter action to v8 (#1339) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[super-linter/super-linter](https://redirect.github.com/super-linter/super-linter)
| action | major | `v7` -> `v8` |

---

### Release Notes

<details>
<summary>super-linter/super-linter (super-linter/super-linter)</summary>

###
[`v8`](https://redirect.github.com/super-linter/super-linter/blob/HEAD/CHANGELOG.md#680-2024-07-31)

[Compare
Source](https://redirect.github.com/super-linter/super-linter/compare/v7...v8)

##### 🚀 Features

- allow using both prettier and standardjs
([#&#8203;5679](https://redirect.github.com/super-linter/super-linter/issues/5679))
([2daf461](https://redirect.github.com/super-linter/super-linter/commit/2daf461143778318ccc60ba59f175d385f222e4d))
- customize phpstan config file name
([#&#8203;5940](https://redirect.github.com/super-linter/super-linter/issues/5940))
([20c4df5](https://redirect.github.com/super-linter/super-linter/commit/20c4df58c060cf122dce53b14ec578d48d921fb0))
- enable dotenv-linter for slim images
([#&#8203;5868](https://redirect.github.com/super-linter/super-linter/issues/5868))
([c770a8d](https://redirect.github.com/super-linter/super-linter/commit/c770a8d253f8b8852fd3404b63b807d93cc3691a))
- remove no-eslintrc and simplify eslint conf
([#&#8203;5809](https://redirect.github.com/super-linter/super-linter/issues/5809))
([5be4926](https://redirect.github.com/super-linter/super-linter/commit/5be49266330f237f4a8ab2acccffe93b69cf4b04)),
closes
[#&#8203;5688](https://redirect.github.com/super-linter/super-linter/issues/5688)
- write github actions step summary
([#&#8203;5867](https://redirect.github.com/super-linter/super-linter/issues/5867))
([57c8658](https://redirect.github.com/super-linter/super-linter/commit/57c86588c388a515ae31f498b4cc4a6337169c11)),
closes
[#&#8203;5650](https://redirect.github.com/super-linter/super-linter/issues/5650)

##### 🐛 Bugfixes

- avoid duplicated content in summary
([#&#8203;5939](https://redirect.github.com/super-linter/super-linter/issues/5939))
([ef57e13](https://redirect.github.com/super-linter/super-linter/commit/ef57e132e136ab9991a0cc1517236e827d27baf9))
- store outputs in the main output directory
([#&#8203;5899](https://redirect.github.com/super-linter/super-linter/issues/5899))
([78ed3ef](https://redirect.github.com/super-linter/super-linter/commit/78ed3ef5fc8fe45290b530f94077281d2ac8e634))
- update pylint to ignore import-errors
([#&#8203;5927](https://redirect.github.com/super-linter/super-linter/issues/5927))
([eec862d](https://redirect.github.com/super-linter/super-linter/commit/eec862d0ea33fe6a836dfd545eef1125e530c794))
- update the list of linters to remove
([#&#8203;5870](https://redirect.github.com/super-linter/super-linter/issues/5870))
([6bd7659](https://redirect.github.com/super-linter/super-linter/commit/6bd76596f3f7df70a323eabb797f028293873424))

##### ⬆️ Dependency updates

- **bundler:** bump rubocop-minitest in /dependencies
([#&#8203;5875](https://redirect.github.com/super-linter/super-linter/issues/5875))
([9751e62](https://redirect.github.com/super-linter/super-linter/commit/9751e62beed14780ff12fc073c7aa9eafbd449f7))
- **bundler:** bump rubocop-performance in /dependencies
([#&#8203;5777](https://redirect.github.com/super-linter/super-linter/issues/5777))
([763dcc4](https://redirect.github.com/super-linter/super-linter/commit/763dcc4d456ae0c347801d30b5ec00dbfaa60ef2))
- **bundler:** bump rubocop-rspec from 2.30.0 to 3.0.3 in /dependencies
([#&#8203;5878](https://redirect.github.com/super-linter/super-linter/issues/5878))
([592d903](https://redirect.github.com/super-linter/super-linter/commit/592d903c509a4c70c89cc009e74b63c3273c5e7b))
- **dev-docker:** bump node in /dev-dependencies
([#&#8203;5872](https://redirect.github.com/super-linter/super-linter/issues/5872))
([587fe0a](https://redirect.github.com/super-linter/super-linter/commit/587fe0a8b9318324fbfd86b9cd87b0ac6b24ba42))
- **dev-npm:** bump release-please in /dev-dependencies
([#&#8203;5754](https://redirect.github.com/super-linter/super-linter/issues/5754))
([6bb3f78](https://redirect.github.com/super-linter/super-linter/commit/6bb3f789bb5cacff35492a1245befb2fd13b97f5))
- **docker:** bump alpine/helm from 3.14.4 to 3.15.3
([#&#8203;5882](https://redirect.github.com/super-linter/super-linter/issues/5882))
([b5bf9f2](https://redirect.github.com/super-linter/super-linter/commit/b5bf9f297d13e9563bd708ae98e2e05b9b44698c))
- **docker:** bump alpine/terragrunt from 1.9.0 to 1.9.2
([#&#8203;5883](https://redirect.github.com/super-linter/super-linter/issues/5883))
([95feeac](https://redirect.github.com/super-linter/super-linter/commit/95feeacb0ab075e7e183c5f8ea1c515992f66bbf))
- **docker:** bump dart from 3.4.2-sdk to 3.4.4-sdk
([#&#8203;5764](https://redirect.github.com/super-linter/super-linter/issues/5764))
([b75f1cf](https://redirect.github.com/super-linter/super-linter/commit/b75f1cfcefc1b62a81b916bd00d0b8dfa7ad69aa))
- **docker:** bump dotnet/sdk
([#&#8203;5873](https://redirect.github.com/super-linter/super-linter/issues/5873))
([f068663](https://redirect.github.com/super-linter/super-linter/commit/f06866359b4158e04825a03d5852823d47d78b05))
- **docker:** bump golangci/golangci-lint from v1.59.0 to v1.59.1
([#&#8203;5748](https://redirect.github.com/super-linter/super-linter/issues/5748))
([81ab76d](https://redirect.github.com/super-linter/super-linter/commit/81ab76d00179b8d66e7f909c546cb7bfbde8ae9f))
- **docker:** bump goreleaser/goreleaser from v1.26.2 to v2.1.0
([#&#8203;5881](https://redirect.github.com/super-linter/super-linter/issues/5881))
([d84d439](https://redirect.github.com/super-linter/super-linter/commit/d84d4393933047f08abf0871aacefa04c63b5f32))
- **docker:** bump hashicorp/terraform from 1.8.4 to 1.9.2
([#&#8203;5885](https://redirect.github.com/super-linter/super-linter/issues/5885))
([d384e67](https://redirect.github.com/super-linter/super-linter/commit/d384e674c729dfd236ce888d04e4bdd24a85b630))
- **docker:** bump mstruebing/editorconfig-checker from v3.0.1 to v3.0.3
([#&#8203;5856](https://redirect.github.com/super-linter/super-linter/issues/5856))
([81196f4](https://redirect.github.com/super-linter/super-linter/commit/81196f4267199e63ec82dd0aaff9d1f400b38cac))
- **docker:** bump python from 3.12.3-alpine3.20 to 3.12.4-alpine3.20
([#&#8203;5884](https://redirect.github.com/super-linter/super-linter/issues/5884))
([8a044b5](https://redirect.github.com/super-linter/super-linter/commit/8a044b58dee1dd7a03fcaf2d7d6b58754f156be2))
- **docker:** bump scalameta/scalafmt from v3.8.1 to v3.8.2
([#&#8203;5765](https://redirect.github.com/super-linter/super-linter/issues/5765))
([4931da5](https://redirect.github.com/super-linter/super-linter/commit/4931da55da35a8b438354adc03d220f693458f75))
- **docker:** bump terraform-linters/tflint from v0.51.2 to v0.52.0
([#&#8203;5858](https://redirect.github.com/super-linter/super-linter/issues/5858))
([ae1dba5](https://redirect.github.com/super-linter/super-linter/commit/ae1dba53fdc862da0064f56382dd86cd273862f6))
- **docker:** bump yoheimuta/protolint from 0.50.2 to 0.50.3
([#&#8203;5857](https://redirect.github.com/super-linter/super-linter/issues/5857))
([913bd0d](https://redirect.github.com/super-linter/super-linter/commit/913bd0dd47d3a42d6f2d3acad8fb59c2f185337b))
- **docker:** bump zricethezav/gitleaks from v8.18.3 to v8.18.4
([#&#8203;5768](https://redirect.github.com/super-linter/super-linter/issues/5768))
([33bb4b4](https://redirect.github.com/super-linter/super-linter/commit/33bb4b46d473c80a82364c50746ed20d19231f90))
- **github-actions:** bump actions/download-artifact from 4.1.7 to 4.1.8
([#&#8203;5861](https://redirect.github.com/super-linter/super-linter/issues/5861))
([ed72e66](https://redirect.github.com/super-linter/super-linter/commit/ed72e66416df8df15b492f7df00b8621b556893f))
- **github-actions:** bump actions/upload-artifact from 4.3.3 to 4.3.4
([#&#8203;5860](https://redirect.github.com/super-linter/super-linter/issues/5860))
([dd4313c](https://redirect.github.com/super-linter/super-linter/commit/dd4313c9b3bee70bfd968923e77430f3f19785aa))
- **github-actions:** bump docker/build-push-action from 5 to 6
([#&#8203;5770](https://redirect.github.com/super-linter/super-linter/issues/5770))
([27170b8](https://redirect.github.com/super-linter/super-linter/commit/27170b8e9243df7e18e59e7c43163b142568ee22))
- **java:** bump com.pinterest.ktlint:ktlint-cli in /dependencies/ktlint
([#&#8203;5849](https://redirect.github.com/super-linter/super-linter/issues/5849))
([19c5fce](https://redirect.github.com/super-linter/super-linter/commit/19c5fcea2ea6a72741e59a30cb815c5faac524be))
- **npm:** bump
[@&#8203;babel/eslint-parser](https://redirect.github.com/babel/eslint-parser)
in /dependencies
([#&#8203;5886](https://redirect.github.com/super-linter/super-linter/issues/5886))
([387a2b5](https://redirect.github.com/super-linter/super-linter/commit/387a2b56261451b12b00fc37d2fb79766564044d))
- **npm:** bump
[@&#8203;babel/preset-react](https://redirect.github.com/babel/preset-react)
in /dependencies
([#&#8203;5740](https://redirect.github.com/super-linter/super-linter/issues/5740))
([4eeb628](https://redirect.github.com/super-linter/super-linter/commit/4eeb62862e823fd431fefb0078e5605484934254))
- **npm:** bump
[@&#8203;babel/preset-typescript](https://redirect.github.com/babel/preset-typescript)
in /dependencies
([#&#8203;5734](https://redirect.github.com/super-linter/super-linter/issues/5734))
([de4b193](https://redirect.github.com/super-linter/super-linter/commit/de4b1930064cb6b5f65625101be33892c50d400f))
- **npm:** bump
[@&#8203;react-native/eslint-config](https://redirect.github.com/react-native/eslint-config)
in /dependencies
([#&#8203;5835](https://redirect.github.com/super-linter/super-linter/issues/5835))
([28c228d](https://redirect.github.com/super-linter/super-linter/commit/28c228dfc0b8279e28ca5bb72a34e9390eca81b9))
- **npm:** bump
[@&#8203;typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin)
in /dependencies
([#&#8203;5895](https://redirect.github.com/super-linter/super-linter/issues/5895))
([7f5b018](https://redirect.github.com/super-linter/super-linter/commit/7f5b018fb7237ef0d6d1cb1578729065bacb4310))
- **npm:** bump eslint-plugin-jest in /dependencies
([#&#8203;5738](https://redirect.github.com/super-linter/super-linter/issues/5738))
([1312398](https://redirect.github.com/super-linter/super-linter/commit/1312398b9c72138ce76f443dd933a8ff82f75fae))
- **npm:** bump eslint-plugin-jsx-a11y in /dependencies
([#&#8203;5797](https://redirect.github.com/super-linter/super-linter/issues/5797))
([8972772](https://redirect.github.com/super-linter/super-linter/commit/89727727323246be93c3ed88c0b0fe1f07e25468))
- **npm:** bump eslint-plugin-react in /dependencies
([#&#8203;5890](https://redirect.github.com/super-linter/super-linter/issues/5890))
([fe3e1f8](https://redirect.github.com/super-linter/super-linter/commit/fe3e1f83b7c7645640af9202bb7f4d8993f088fc))
- **npm:** bump eslint-plugin-vue from 9.26.0 to 9.27.0 in /dependencies
([#&#8203;5851](https://redirect.github.com/super-linter/super-linter/issues/5851))
([c2e85a9](https://redirect.github.com/super-linter/super-linter/commit/c2e85a9f03ceccfe41107ea1e627c8c222b2154a))
- **npm:** bump jscpd from 4.0.4 to 4.0.5 in /dependencies
([#&#8203;5852](https://redirect.github.com/super-linter/super-linter/issues/5852))
([042c6b1](https://redirect.github.com/super-linter/super-linter/commit/042c6b191708878b5db2b5096eadb1b4a6f4f27d))
- **npm:** bump next from 14.2.3 to 14.2.5 in /dependencies
([#&#8203;5887](https://redirect.github.com/super-linter/super-linter/issues/5887))
([22b7ba9](https://redirect.github.com/super-linter/super-linter/commit/22b7ba91d0d273fdc5369d1ead66ae2cee451df0))
- **npm:** bump prettier from 3.3.2 to 3.3.3 in /dependencies
([#&#8203;5891](https://redirect.github.com/super-linter/super-linter/issues/5891))
([b601212](https://redirect.github.com/super-linter/super-linter/commit/b6012126df99c9a8cdc5878bb9417ca7afee6809))
- **npm:** bump react-router-dom from 6.23.1 to 6.25.0 in /dependencies
([#&#8203;5897](https://redirect.github.com/super-linter/super-linter/issues/5897))
([ef71e94](https://redirect.github.com/super-linter/super-linter/commit/ef71e944ab41a8f04ba143f44d4b8443d2d982b5))
- **npm:** bump renovate from 37.421.5 to 37.432.0 in /dependencies
([#&#8203;5896](https://redirect.github.com/super-linter/super-linter/issues/5896))
([09a01eb](https://redirect.github.com/super-linter/super-linter/commit/09a01ebbe6dbb5e502817bb927191b8986c7c912))
- **npm:** bump textlint-rule-terminology in /dependencies
([#&#8203;5853](https://redirect.github.com/super-linter/super-linter/issues/5853))
([55b065d](https://redirect.github.com/super-linter/super-linter/commit/55b065d3c2d512648c52d4d695761a7d274ae769))
- **npm:** bump typescript from 5.4.5 to 5.5.3 in /dependencies
([#&#8203;5832](https://redirect.github.com/super-linter/super-linter/issues/5832))
([8605c2b](https://redirect.github.com/super-linter/super-linter/commit/8605c2b584b36201ac8d1acf98254c2d70776c75))
- **python:** bump ansible-lint in /dependencies/python
([#&#8203;5877](https://redirect.github.com/super-linter/super-linter/issues/5877))
([e90ee32](https://redirect.github.com/super-linter/super-linter/commit/e90ee328a2f6eb42952eeda45929271fddaf0c77))
- **python:** bump cfn-lint from 1.4.2 to 1.6.1 in /dependencies/python
([#&#8203;5876](https://redirect.github.com/super-linter/super-linter/issues/5876))
([ebf8cc8](https://redirect.github.com/super-linter/super-linter/commit/ebf8cc807a6c756755e790419fefcf9e5353b911))
- **python:** bump checkov in /dependencies/python
([#&#8203;5879](https://redirect.github.com/super-linter/super-linter/issues/5879))
([47392ad](https://redirect.github.com/super-linter/super-linter/commit/47392ad6636919b4b21e6ef2c3e1418cb1e931f3))
- **python:** bump flake8 from 7.0.0 to 7.1.0 in /dependencies/python
([#&#8203;5780](https://redirect.github.com/super-linter/super-linter/issues/5780))
([f019ee3](https://redirect.github.com/super-linter/super-linter/commit/f019ee34d21aa778d4b04217e7f717779ddfa767))
- **python:** bump ruff from 0.5.0 to 0.5.2 in /dependencies/python
([#&#8203;5880](https://redirect.github.com/super-linter/super-linter/issues/5880))
([3fd69a1](https://redirect.github.com/super-linter/super-linter/commit/3fd69a107b05f04135f1c01544c50b940a3b1e99))
- **python:** bump snakemake in /dependencies/python
([#&#8203;5874](https://redirect.github.com/super-linter/super-linter/issues/5874))
([2b6aa12](https://redirect.github.com/super-linter/super-linter/commit/2b6aa1290608468ee3828efdeabbeb467be43b80))
- **python:** bump sqlfluff from 3.0.7 to 3.1.0 in /dependencies/python
([#&#8203;5847](https://redirect.github.com/super-linter/super-linter/issues/5847))
([31da61e](https://redirect.github.com/super-linter/super-linter/commit/31da61e1899ca3c9d26681c265b0928b559f1274))

##### 🧰 Maintenance

- add super-linter configuration in the bug template
([#&#8203;5910](https://redirect.github.com/super-linter/super-linter/issues/5910))
([26ddd8b](https://redirect.github.com/super-linter/super-linter/commit/26ddd8b084201554e0351abf421d184864076a56))
- authenticate tflint init
([#&#8203;5894](https://redirect.github.com/super-linter/super-linter/issues/5894))
([cc20e45](https://redirect.github.com/super-linter/super-linter/commit/cc20e4561e549c6f6609900ba68602930c01fb7d))
- bump alpine image to 3.20 and php to 8.3.x
([#&#8203;5863](https://redirect.github.com/super-linter/super-linter/issues/5863))
([d9d1909](https://redirect.github.com/super-linter/super-linter/commit/d9d19095ecf48511e4c21a2e23f0def36187d141))
- enable dev-dependencies docker build checks
([#&#8203;5871](https://redirect.github.com/super-linter/super-linter/issues/5871))
([12da497](https://redirect.github.com/super-linter/super-linter/commit/12da4973c69e6987217089a418199a8227f658d7))
- fix docker build warnings
([#&#8203;5862](https://redirect.github.com/super-linter/super-linter/issues/5862))
([fc094cc](https://redirect.github.com/super-linter/super-linter/commit/fc094cc1a4be6a290c49c633fb857c454a98da47))
- print info about the environment, image size
([#&#8203;5869](https://redirect.github.com/super-linter/super-linter/issues/5869))
([bcf8ca8](https://redirect.github.com/super-linter/super-linter/commit/bcf8ca82ad571bb0a04f028193b3f56486cfbeb4))
- remove duplicated configuration files
([#&#8203;5928](https://redirect.github.com/super-linter/super-linter/issues/5928))
([70e0239](https://redirect.github.com/super-linter/super-linter/commit/70e02391170f6aaff4f0b4e80bf9bc8300940171))
- run docker build checks
([#&#8203;5864](https://redirect.github.com/super-linter/super-linter/issues/5864))
([ce59f5c](https://redirect.github.com/super-linter/super-linter/commit/ce59f5c323a8e5038753582dc265ab172b654834))
- split validation logic in smaller functions
([#&#8203;5892](https://redirect.github.com/super-linter/super-linter/issues/5892))
([d2d7334](https://redirect.github.com/super-linter/super-linter/commit/d2d73347d3e49fb28061a41df471afdcf0a579ba))
- update dependabot config for ci/dev updates
([#&#8203;5898](https://redirect.github.com/super-linter/super-linter/issues/5898))
([e374e48](https://redirect.github.com/super-linter/super-linter/commit/e374e489339410662293e39f4147dc69d098077f))
- update release-please to the new workspace
([#&#8203;5901](https://redirect.github.com/super-linter/super-linter/issues/5901))
([2ecf945](https://redirect.github.com/super-linter/super-linter/commit/2ecf94533920fb6a90ba5f029230cd4cdc69f855))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi40Mi4yIiwidXBkYXRlZEluVmVyIjoiNDIuNDIuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Stanislas Lange <git@slange.me>
 2025-12-11 11:12:00 +01:00
renovate[bot] 9162924468 chore(deps): update actions/checkout action to v6 (#1338) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) |
action | major | `v4` -> `v6` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

### [`v6`](https://redirect.github.com/actions/checkout/compare/v5...v6)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v5...v6)

### [`v5`](https://redirect.github.com/actions/checkout/compare/v4...v5)

[Compare
Source](https://redirect.github.com/actions/checkout/compare/v4...v5)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi40Mi4yIiwidXBkYXRlZEluVmVyIjoiNDIuNDIuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-11 10:29:01 +01:00
Stanislas ba1d0419a8 fix: use PAT to trigger CI after hash update (#1337) 
- Commits made with `GITHUB_TOKEN` don't trigger workflows
- Using a PAT allows the hash update commit to trigger CI checks
- Fixes the issue where PR #1335 didn't have CI triggered after the hash
update
 2025-12-10 18:23:58 +01:00
Stanislas Lange a6154c2653 Disable renovate check for disabled workflow 2025-12-10 18:14:57 +01:00
Stanislas a4c51f9bf9 ci: add Renovate for Easy-RSA version updates (#1333) 
## Summary

- Add Renovate configuration to automatically track Easy-RSA releases
- Add GitHub Action to auto-update SHA256 hash on Renovate PRs

## How it works

1. **Renovate** detects a new Easy-RSA release → creates PR updating
`EASYRSA_VERSION`
2. **GitHub Action** triggers on the PR → downloads tarball → computes
SHA256 → commits fix
3. PR is ready to merge with both version and hash updated

---

I intentionally updated to the second-to-last version in
https://github.com/angristan/openvpn-install/commit/bda450948a933224f4f779a24a44c6279e1574a1
to test if this works.
 2025-12-10 18:08:54 +01:00
Stanislas b9a1650027 feat: drop Amazon Linux 2 support (#1332) 
## Summary

- Remove Amazon Linux 2 support from the installer
- Amazon Linux 2023 remains fully supported

## Motivation

Amazon Linux 2 is reaching EOL.

Additionally, Amazon Linux 2 ships with **OpenSSL 1.0.2k** (from 2017)
which is incompatible with Easy-RSA 3.2.x. The newer Easy-RSA versions
use `openssl x509 -ext` which doesn't exist in OpenSSL 1.0.x, causing
certificate generation to fail.

This blocks our ability to upgrade Easy-RSA:
https://github.com/angristan/openvpn-install/commit/bda450948a933224f4f779a24a44c6279e1574a1

## Changes

- Updated OS detection to reject Amazon Linux 2 with a clear message
- Removed Amazon Linux 2 specific code paths (EPEL installation, yum
commands)
- Removed from CI test matrix
- Updated README supported distributions table
- Updated Makefile test targets
- Also, add Amazon Linux 2023 Unbound handling
 2025-12-10 17:54:00 +01:00
Stanislas 66890fb5d3 ci: prevent duplicate workflow runs (#1324) 
## Summary
- Restrict `push` trigger to `master` branch only (feature branch pushes
won't trigger CI)
- Add concurrency groups to cancel redundant runs when new commits are
pushed
- Works correctly with fork PRs using standard `pull_request` event
 2025-12-09 19:47:02 +01:00
Stanislas Lange 8a133b7bed ci: run Docker e2e tests on pull requests 2025-12-09 18:06:53 +01:00
Stanislas a3389c126c Add Docker-based E2E testing (#1320) 
### Summary
- Add automated end-to-end testing using Docker to verify the installation script works across 18 Linux distributions
- Add Oracle Linux 9 support to the installation script
- Drop support for EOL distributions (Debian 8/9/10, CentOS 7, Ubuntu 16.04) 
- Disable Digital Ocean droplets based end-to-end tests, let's use docker from now on

### Changes
**New test infrastructure:**
- `test/Dockerfile.server` - Multi-OS server image with `BASE_IMAGE` build arg
- `test/Dockerfile.client` - Ubuntu 24.04 client for connectivity testing
- `test/server-entrypoint.sh` - Runs install script, verifies files exist, asserts iptables NAT rules, starts OpenVPN
- `test/client-entrypoint.sh` - Connects to VPN, verifies tun0 interface, pings gateway
- `docker-compose.yml` - Orchestrates server + client with shared volume
- `.github/workflows/docker-test.yml` - CI matrix testing 18 OS variants
- `.github/workflows/test.yml` - Removed push/PR triggers, now manual only for DO tests
- `Makefile` - Local testing commands (`make test`, `make test-ubuntu-24.04`, etc.)

**Distributions tested (18 total):**
| Family | Versions |
|--------|----------|
| Ubuntu | 18.04, 20.04, 22.04, 24.04 |
| Debian | 11, 12 |
| Fedora | 40, 41 |
| Rocky Linux | 8, 9 |
| AlmaLinux | 8, 9 |
| Oracle Linux | 8, 9 |
| Amazon Linux | 2, 2023 |
| CentOS Stream | 9 |
| Arch Linux | latest |
 2025-12-07 12:27:41 +01:00
Stanislas Lange 94c1af2b5d Remove Fedora 43 OS image from CI workflow 2025-12-04 23:18:15 +01:00
Stanislas Lange f92582fb2f Update Fedora OS images in CI workflow to include 42 and 43 2025-12-04 23:15:24 +01:00
Stanislas Lange 469bc2f883 Update OS images in CI workflow to include Debian 13 and remove 11 2025-12-04 23:12:57 +01:00
Stanislas Lange 6b92f8a61f Quote shell variables in test.yml to fix shellcheck warnings 2025-12-04 23:04:11 +01:00
Stanislas Lange 62c336022f Add permissions to test.yml for security best practices 2025-12-04 23:04:11 +01:00
Stanislas Lange cad43ad99e Add permissions to lint.yml for security best practices 2025-12-04 23:04:11 +01:00
Stanislas Lange 77f28d1595 ci: add fetch-depth: 0 for super-linter v7 compatibility 
Super-linter v7 requires full git history to find the default branch
for comparison. Without fetch-depth: 0, it fails with 'master branch
doesn't exist' error.
 2025-12-04 23:04:11 +01:00
Stanislas Lange 7c2c491fab ci: update appleboy/ssh-action from v0.1.6 to v1.2.0 
Updates to a more recent stable version with bug fixes and
improvements.
 2025-12-04 23:04:11 +01:00
Stanislas Lange 00f3cd1605 ci: update Super Linter from v4.1.0 to v7 
The super-linter project has been moved to the super-linter org
and significantly updated. v7 includes many improvements and
bug fixes.
 2025-12-04 23:04:11 +01:00
Stanislas Lange d61b16f3b8 ci: replace deprecated set-output with GITHUB_OUTPUT 
The set-output workflow command was deprecated in favor of
environment files. See:
https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
 2025-12-04 23:04:11 +01:00
Stanislas Lange 19e4b7961f CI: add Fedora 41 and remove 39 for e2e workflow 2025-03-10 10:27:19 +01:00
Stanislas Lange dc114f3243 Update distribution matrix for end-to-end tests 2024-11-07 20:49:42 +01:00
Stanislas Lange 0d58ddcb8c Update distribution matrix for end-to-end tests 2024-11-07 20:46:51 +01:00
Stanislas Lange 2ce1ee765e Remove centos-stream-8-x64 from test workflow 
Not available on DO anymore
 2024-07-12 18:22:34 +02:00
Stanislas Lange 67701fac77 CI: wait for dpkg lock in debian/ubuntu setup step 2024-05-16 20:37:23 +02:00
Stanislas Lange 0cc002e17d CI: wait for dpkg lock in debian/ubuntu setup step 2024-05-16 20:33:32 +02:00