mirror of
https://github.com/angristan/openvpn-install.git
synced 2025-12-11 23:12:41 +01:00
a3389c126c
### Summary - Add automated end-to-end testing using Docker to verify the installation script works across 18 Linux distributions - Add Oracle Linux 9 support to the installation script - Drop support for EOL distributions (Debian 8/9/10, CentOS 7, Ubuntu 16.04) - Disable Digital Ocean droplets based end-to-end tests, let's use docker from now on ### Changes **New test infrastructure:** - `test/Dockerfile.server` - Multi-OS server image with `BASE_IMAGE` build arg - `test/Dockerfile.client` - Ubuntu 24.04 client for connectivity testing - `test/server-entrypoint.sh` - Runs install script, verifies files exist, asserts iptables NAT rules, starts OpenVPN - `test/client-entrypoint.sh` - Connects to VPN, verifies tun0 interface, pings gateway - `docker-compose.yml` - Orchestrates server + client with shared volume - `.github/workflows/docker-test.yml` - CI matrix testing 18 OS variants - `.github/workflows/test.yml` - Removed push/PR triggers, now manual only for DO tests - `Makefile` - Local testing commands (`make test`, `make test-ubuntu-24.04`, etc.) **Distributions tested (18 total):** | Family | Versions | |--------|----------| | Ubuntu | 18.04, 20.04, 22.04, 24.04 | | Debian | 11, 12 | | Fedora | 40, 41 | | Rocky Linux | 8, 9 | | AlmaLinux | 8, 9 | | Oracle Linux | 8, 9 | | Amazon Linux | 2, 2023 | | CentOS Stream | 9 | | Arch Linux | latest |
110 lines
3.2 KiB
Bash
Executable File
110 lines
3.2 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
echo "=== OpenVPN Server Container ==="
|
|
|
|
# Create TUN device if it doesn't exist
|
|
if [ ! -c /dev/net/tun ]; then
|
|
mkdir -p /dev/net
|
|
mknod /dev/net/tun c 10 200
|
|
chmod 600 /dev/net/tun
|
|
fi
|
|
|
|
echo "TUN device ready"
|
|
|
|
# Set up environment for auto-install
|
|
export AUTO_INSTALL=y
|
|
export APPROVE_INSTALL=y
|
|
export APPROVE_IP=y
|
|
export IPV6_SUPPORT=n
|
|
export PORT_CHOICE=1
|
|
export PROTOCOL_CHOICE=1
|
|
export DNS=9 # Google DNS (works in containers)
|
|
export COMPRESSION_ENABLED=n
|
|
export CUSTOMIZE_ENC=n
|
|
export CLIENT=testclient
|
|
export PASS=1
|
|
export ENDPOINT=openvpn-server
|
|
|
|
# Prepare script for container environment:
|
|
# - Replace systemctl calls with no-ops (systemd doesn't work in containers)
|
|
# This ensures the script won't fail silently on systemctl commands
|
|
sed 's/\bsystemctl /echo "[SKIPPED] systemctl " # /g' /opt/openvpn-install.sh >/tmp/openvpn-install.sh
|
|
chmod +x /tmp/openvpn-install.sh
|
|
|
|
echo "Running OpenVPN install script..."
|
|
# Run in subshell because the script calls 'exit 0' after generating client config
|
|
# Use || true to prevent set -e from exiting on failure, then check exit code
|
|
(bash -x /tmp/openvpn-install.sh) && INSTALL_EXIT_CODE=0 || INSTALL_EXIT_CODE=$?
|
|
|
|
echo "=== Installation complete (exit code: $INSTALL_EXIT_CODE) ==="
|
|
|
|
if [ "$INSTALL_EXIT_CODE" -ne 0 ]; then
|
|
echo "ERROR: Install script failed with exit code $INSTALL_EXIT_CODE"
|
|
exit 1
|
|
fi
|
|
|
|
# Verify all expected files were created
|
|
echo "Verifying installation..."
|
|
MISSING_FILES=0
|
|
for f in \
|
|
/etc/openvpn/server.conf \
|
|
/etc/openvpn/ca.crt \
|
|
/etc/openvpn/ca.key \
|
|
/etc/openvpn/tls-crypt.key \
|
|
/etc/openvpn/crl.pem \
|
|
/etc/openvpn/easy-rsa/pki/ca.crt \
|
|
/etc/iptables/add-openvpn-rules.sh \
|
|
/root/testclient.ovpn; do
|
|
if [ ! -f "$f" ]; then
|
|
echo "ERROR: Missing file: $f"
|
|
MISSING_FILES=$((MISSING_FILES + 1))
|
|
fi
|
|
done
|
|
|
|
if [ $MISSING_FILES -gt 0 ]; then
|
|
echo "ERROR: $MISSING_FILES required files are missing"
|
|
exit 1
|
|
fi
|
|
|
|
echo "All required files present"
|
|
echo ""
|
|
echo "Server config:"
|
|
cat /etc/openvpn/server.conf
|
|
|
|
# Copy client config to shared volume
|
|
cp /root/testclient.ovpn /shared/client.ovpn
|
|
# Modify remote address to use container hostname
|
|
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
|
|
echo "Client config copied to /shared/client.ovpn"
|
|
|
|
# Start OpenVPN server manually (systemd doesn't work in containers)
|
|
echo "Starting OpenVPN server..."
|
|
|
|
# Apply iptables rules manually (systemd not available in containers)
|
|
echo "Applying iptables rules..."
|
|
bash /etc/iptables/add-openvpn-rules.sh
|
|
|
|
# Verify iptables NAT rules exist
|
|
echo "Verifying iptables NAT rules..."
|
|
if iptables -t nat -L POSTROUTING -n | grep -q "10.8.0.0"; then
|
|
echo "PASS: NAT POSTROUTING rule for 10.8.0.0/24 exists"
|
|
else
|
|
echo "FAIL: NAT POSTROUTING rule for 10.8.0.0/24 not found"
|
|
echo "Current NAT rules:"
|
|
iptables -t nat -L POSTROUTING -n -v
|
|
exit 1
|
|
fi
|
|
|
|
# Enable IP forwarding (may already be set via docker-compose sysctls)
|
|
if [ "$(cat /proc/sys/net/ipv4/ip_forward)" != "1" ]; then
|
|
echo 1 >/proc/sys/net/ipv4/ip_forward || {
|
|
echo "ERROR: Failed to enable IP forwarding"
|
|
exit 1
|
|
}
|
|
fi
|
|
|
|
# Start OpenVPN in foreground (run from /etc/openvpn so relative paths work)
|
|
cd /etc/openvpn
|
|
exec openvpn --config /etc/openvpn/server.conf
|