Skip to content

Commit 2473ae3

Browse files
SloCompTechSloCompTech
committed
First version
1 parent 2f6e9f6 commit 2473ae3

File tree

24 files changed

+1181
-1
lines changed

24 files changed

+1181
-1
lines changed

‎CONTRIBUTING.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Contribute guide
2+
3+
Feel free to contribute to this project.
4+
5+
## Table of contents
6+
7+
Sections:
8+
9+
- [Example configs & hooks](root/defaults/example/README.md)
10+
- [Guides](docs/README.md)
11+
- [Helper Scripts](root/app/README.md)
12+
- [Modules](root/defaults/module/README.md)
13+
14+
## Syntax
15+
16+
- Identation: tab (4 spaces width)
17+
- Javadoc style documentation
18+
19+
## Directory structure of project
20+
21+
```
22+
/app # Utils (part of image)
23+
bin # Scripts for using this image
24+
/config # Configuration dir (all config is here, generated on container start)
25+
openvpn # Openvpn configuration
26+
ccd # Client config directory
27+
client # Client configuration directory
28+
<clientconffile>.conf # Base for building client config (all files merged)
29+
server # Server configuration directory
30+
<name>.conf # Server config files (all files merged)
31+
pki
32+
ca.crt # CA certificate
33+
certs by serial # Certs by Serial ID
34+
<serial-id-cert>.pem
35+
crl.pem # CRL
36+
dh.pem
37+
index.txt # Database index file
38+
issued
39+
<name>.crt # Certificates
40+
private # Directory with private keys
41+
ca.key # CA secret
42+
<name>.key # Certificate secrets
43+
reqs # Directroy with signing requests
44+
serial # The current serial number
45+
ta.key # Secret for tls-auth, tls-crypt
46+
ssl
47+
safessl-easyrsa.cnf
48+
vars
49+
example # Example configs
50+
config # Example client & server configs (see root/defaults/example/README.md)
51+
hook # Example hook configs
52+
module # Modules for openvpn
53+
hooks # Put your custom scripts in one of subfolders
54+
init # Init container
55+
route-up # After routes are added
56+
route-pre-down # Before routes are removed
57+
up # After interface is up
58+
down # After interface is down
59+
client-connect # Client connected
60+
client-disconnect # Client disconnected
61+
learn-address
62+
tls-verify # Check certificate
63+
auth # On authentication (needs to be enabled in config)
64+
system.conf # System OpenVPN config file (do not edit, unless instructed)
65+
include-server.conf # File that includes all server configuration files (automatically generated)
66+
donotdelete # Leave this file alone, if deleted it triggers full setup
67+
/defaults # Default configuration, which is copied into config on full setup
68+
example # Examples
69+
config # Example configs
70+
hook # Example hooks
71+
module # Modules (for example password authentication ...)
72+
system.conf # Original server config
73+
/etc # System config
74+
cont-init.d # Scripts run before services are started
75+
fix-attrs.d # Fix file permissions
76+
logrotate.d # Log settings
77+
services.d # Scripts that start services
78+
```
79+
80+
## Useful links
81+
82+
**Project:**
83+
84+
- [Versioning](https://semver.org/)
85+
- [Container labels](https://github.com/opencontainers/image-spec/blob/master/annotations.md)
86+
- [Container badges](https://microbadger.com/about)
87+
- [s6 overlay](https://github.com/just-containers/s6-overlay)
88+
89+
**OpenVPN:**
90+
91+
- [OpenVPN docs](https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN)
92+
- [EasyRSA](https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN)

‎Dockerfile‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
2+
# Base image
3+
FROM lsiobase/alpine.python3:latest
4+
5+
#
6+
# Image labels
7+
# @see https://github.com/opencontainers/image-spec/blob/master/annotations.md
8+
# @see https://semver.org/
9+
#
10+
LABEL org.opencontainers.image.title = "OpenVPN Server" \
11+
org.opencontainers.image.description = "Docker image with OpenVPN server" \
12+
org.opencontainers.image.url = "" \
13+
org.opencontainers.image.authors = "Martin Dagarin <>" \
14+
org.opencontainers.image.version = "0.0.2"
15+
16+
#
17+
# Environment variables
18+
# @see https://github.com/OpenVPN/easy-rsa/blob/master/doc/EasyRSA-Advanced.md
19+
#
20+
ENV PATH="/app/bin:$PATH" \
21+
S6_BEHAVIOUR_IF_STAGE2_FAILS=0 \
22+
EASYRSA=/usr/share/easy-rsa \
23+
EASYRSA_PKI=/config/pki \
24+
EASYRSA_VARS_FILE=/config/ssl/vars \
25+
#EASYRSA_SSL_CONF=/config/ssl/openssl-easyrsa.cnf \
26+
EASYRSA_SAFE_CONF=/config/ssl/safessl-easyrsa.cnf \
27+
EASYRSA_TEMP_FILE=/config/temp \
28+
OVPN_ROOT=/config \
29+
OVPN_CONFIG=/config/openvpn \
30+
OVPN_HOOKS=/config/hooks \
31+
OVPN_RUN=system.conf
32+
33+
# Install packages
34+
RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/main/" >> /etc/apk/repositories && \
35+
apk add --no-cache \
36+
# Core packages
37+
bash sudo iptables git openvpn easy-rsa && \
38+
# Link easy-rsa in bin directory
39+
ln -s ${EASYRSA}/easyrsa /usr/local/bin && \
40+
# Link python3 also as python
41+
ln -s /usr/bin/python3 /usr/bin/python && \
42+
# Remove any temporary files created by apk
43+
rm -rf /tmp/* /var/tmp/* /var/cache/apk/* /var/cache/distfiles/* && \
44+
# Add permission for network management to user abc
45+
echo "abc ALL=(ALL) NOPASSWD: /sbin/ip" >> /etc/sudoers && \
46+
# Create tunnel interface
47+
mkdir -p /dev/net && \
48+
mknod /dev/net/tun c 10 200
49+
50+
# Add repo files to image
51+
COPY root/ /
52+
53+
# Configure
54+
RUN chmod +x /app/bin/* && \
55+
chmod -R 0644 /etc/logrotate.d

‎README.md‎

Lines changed: 84 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,84 @@
1-
docker-openvpn
1+
2+
# [slocomptech/docker-openvpn]()
3+
4+
5+
## Usage
6+
7+
### docker
8+
9+
``` bash
10+
11+
```
12+
13+
### docker-compose
14+
15+
```
16+
17+
```
18+
19+
## Parameters
20+
21+
|**Parameter**|**Function**|
22+
|:-----------:|:----------:|
23+
24+
## User / Group Identifiers
25+
26+
When using volumes (`-v` flags) permissions issues can arise between the host OS and the container, we avoid this issue by allowing you to specify the user `PUID` and group `PGID`.
27+
28+
Ensure any volume directories on the host are owned by the same user you specify and any permissions issues will vanish like magic.
29+
30+
In this instance `PUID=1000` and `PGID=1000`, to find yours use `id user` as below:
31+
32+
```
33+
$ id username
34+
uid=1000(dockeruser) gid=1000(dockergroup) groups=1000(dockergroup)
35+
```
36+
37+
## Application setup
38+
39+
``` bash
40+
# Setup config directory
41+
sudo docker run -v <Config on Host>:/config --rm -it slocomptech/docker-openvpn bash
42+
$ ovpn_init
43+
# Here will ask for password for CA (needed for signing new certificates) (add nopass if you dont want to set password)
44+
# Enable basic example as config & edit /config/openvpn/server/server_*.conf & /config/openvpn/client_*.conf
45+
$ ovpn_enconf basic1
46+
# Or put your own server config in /config/openvpn/server & client template (without certs) to /config/openvpn/client
47+
# To add client (generate certificates)
48+
$ ovpn_client add <name> [nopass]
49+
# To build .ovpn file
50+
$ ovpn_client ovpn <name> > <file>
51+
# Or from outside of docker (currently not working yet)
52+
sudo docker exec -it <container name> ovpn_client add <name> nopass && ovpn_client ovpn <name> > <file>
53+
# Exit from temporary container
54+
$ exit
55+
# Run container for real
56+
sudo docker run -v <Config on Host>:/config --cap-add NET_ADMIN -p 1104:1194/udp --restart=unless-stopped slocomptech/docker-openvpn
57+
# Setup routing
58+
59+
```
60+
61+
See more in [docs](docs).
62+
63+
## Contribute
64+
65+
Feel free to contribute new features to this container, but first see [Contribute Guide](CONTRIBUTING.md).
66+
67+
## TODO
68+
69+
Planed features:
70+
71+
- Hooks
72+
- Example configs
73+
- Setup instructions
74+
- Setup scripts
75+
- Setup & run via environment variables
76+
- Config overwrite protection
77+
78+
Wanted features (please help implement):
79+
80+
- LDAP authentication script
81+
- Google authenticator
82+
83+
## Versions
84+

‎docs/README.md‎

Whitespace-only changes.

‎root/app/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# App
2+
3+
Here are located all helper scripts and dependencies written to help user with tasks. All scripts are located in `bin` directory, scripts with functions only, which are used in multiple other scripts are located in `lib` folder.
4+
5+
Every script **MUST** start with **ovpn_** prefix, so it can be easy identified that script belongs to this project. Please write guide how to use your script, so users will be able to use it without checking source code and give a lot of examples.

‎root/app/bin/ovpn_backup‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
3+
#
4+
# Backup sciript
5+
#
6+
7+
ARCHIVE_CMD="tar --exclude=$OVPN_ROOT/backup -zcvf"
8+
9+
# User permission fix
10+
if [ "$USER" != "abc" ]; then
11+
RUNAS="sudo -E -u abc"
12+
else
13+
RUNAS=""
14+
fi
15+
16+
function usage() {
17+
echo "Usage: ovpn_backup COMMAND"
18+
echo ""
19+
echo "Commands:"
20+
echo " all # Backup whole config directory"
21+
echo " pki # Backup PKI files"
22+
echo " hooks # Backup hooks"
23+
echo " openvpn # Backup openvpn live config"
24+
}
25+
26+
if [ $# -lt 1 ] || [ $1 = "help" ] || [ $1 = "-h" ] || [ $1 = "--help" ]; then
27+
usage
28+
exit 1
29+
fi
30+
31+
32+
33+
if [ $1 = "all" ]; then
34+
$RUNAS $ARCHIVE_CMD $OVPN_ROOT/backup/backup_all_$(date +%H%M%S%d%m%Y).tar.gz $OVPN_ROOT
35+
elif [ $1 = "pki" ]; then
36+
$RUNAS $ARCHIVE_CMD $OVPN_ROOT/backup/backup_pki_$(date +%H%M%S%d%m%Y).tar.gz $EASYRSA_PKI $OVPN_ROOT/ssl
37+
elif [ $1 = "hooks" ]; then
38+
$RUNAS $ARCHIVE_CMD $OVPN_ROOT/backup/backup_hooks_$(date +%H%M%S%d%m%Y).tar.gz $OVPN_HOOKS
39+
elif [ $1 = "openvpn" ]; then
40+
$RUNAS $ARCHIVE_CMD $OVPN_ROOT/backup/backup_conf_$(date +%H%M%S%d%m%Y).tar.gz $OVPN_CONFIG
41+
else
42+
usage
43+
exit 1
44+
fi

‎root/app/bin/ovpn_client‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/bin/bash
2+
3+
#
4+
# OpenVPN client configuration generator
5+
#
6+
7+
source /app/lib/utils
8+
9+
# User permission fix
10+
if [ "$USER" != "abc" ]; then
11+
RUNAS="sudo -E -u abc"
12+
else
13+
RUNAS=""
14+
fi
15+
16+
function usage() {
17+
echo "Usage: ovpn_client COMMAND [ARGS]"
18+
echo ""
19+
echo "Commands:"
20+
echo " add [NAME [nopass]] # Creates certificates for client"
21+
echo " ovpn NAME # Builds .ovpn file"
22+
echo " revoke|ban|delete|remove NAME # Removes client"
23+
}
24+
25+
function build_ovpn() {
26+
if [ $# -gt 0 ]; then
27+
# Client standard config
28+
for file in $OVPN_ROOT/openvpn/client/*.conf
29+
do
30+
[ -e "$file" ] || continue
31+
cat $file
32+
done
33+
34+
# CA
35+
echo "<ca>"
36+
cat $EASYRSA_PKI/ca.crt
37+
echo "</ca>"
38+
echo ""
39+
40+
# Client certs
41+
echo "<cert>"
42+
cat $EASYRSA_PKI/issued/$1.crt
43+
echo "</cert>"
44+
45+
# Client key
46+
echo "<key>"
47+
cat $EASYRSA_PKI/private/$1.key
48+
echo "</key>"
49+
50+
# tls-crypt
51+
echo "<tls-crypt>"
52+
cat $EASYRSA_PKI/ta.key
53+
echo "</tls-crypt>"
54+
fi
55+
}
56+
57+
# Check if command even set
58+
if [ $# -lt 1 ]; then
59+
# Invalid command
60+
usage
61+
exit 1
62+
fi
63+
64+
if [ "$1" = "add" ]; then
65+
if [ $# -eq 1 ]; then
66+
# Cert guide
67+
read -p "Common name:" CN
68+
echo -n "Password protect "
69+
P=$(yn)
70+
if [ $P -eq 0 ]; then
71+
$RUNAS easyrsa gen-req $CN nopass
72+
else
73+
$RUNAS easyrsa gen-req $CN
74+
fi
75+
$RUNAS easyrsa sign-req client $CN
76+
else
77+
# Just build cert
78+
$RUNAS easyrsa gen-req ${@:2}
79+
$RUNAS easyrsa sign-req client ${@:2}
80+
fi
81+
82+
elif [ "$1" = "ovpn" ]; then
83+
if [ $# -eq 2 ]; then
84+
build_ovpn $2
85+
else
86+
usage
87+
exit 1
88+
fi
89+
elif [ "$1" = "ban" ] || [ "$1" = "remove" ] || [ "$1" = "delete"] || [ "$1" = "revoke" ] ; then
90+
if [ $# -eq 2 ]; then
91+
$RUNAS easyrsa revoke $2
92+
$RUNAS easyrsa gen-crl
93+
else
94+
usage
95+
exit 1
96+
fi
97+
else
98+
usage
99+
exit 1
100+
fi
101+
102+
103+

0 commit comments

Comments
 (0)