diff --git a/core/app.py b/core/app.py index 8e9c55e..c885fc9 100644 --- a/core/app.py +++ b/core/app.py @@ -5,6 +5,8 @@ from config import settings from logger import logger from version import __version__ +from setting.core import ensure_openvpn_running +from service.background_tasks import start_background_tasks api = FastAPI(title="OV Node", version=__version__, @@ -12,6 +14,31 @@ api.include_router(core_router) +@api.on_event("startup") +async def startup_event(): + """Run initialization tasks on startup""" + logger.info("Running startup initialization...") + + # Ensure OpenVPN service is running correctly + # This will automatically: + # - Fix any config issues (missing IPs, etc.) + # - Enable the service if needed + # - Start/restart the service + # - Verify it's running and listening on port + logger.info("Checking and ensuring OpenVPN service is running...") + openvpn_ok = ensure_openvpn_running() + + if openvpn_ok: + logger.info("✓ OpenVPN service is healthy and running") + else: + logger.error("✗ Failed to ensure OpenVPN is running - check logs for details") + + # Start background monitoring tasks + await start_background_tasks() + + logger.info("Startup initialization completed") + if __name__ == "__main__": logger.info("OV-Node is starting...") - uvicorn.run("app:api", host="0.0.0.0", port=settings.service_port, reload=True) + # Disable reload in production for stability + uvicorn.run("app:api", host="0.0.0.0", port=settings.service_port, reload=False) diff --git a/core/openvpn_cli.py b/core/openvpn_cli.py new file mode 100644 index 0000000..ff7df0a --- /dev/null +++ b/core/openvpn_cli.py @@ -0,0 +1,205 @@ +#!/usr/bin/env python3 +""" +CLI tool for OpenVPN service management +Usage: python openvpn_cli.py [command] + +Commands: + status - Show OpenVPN service status + health - Run health check + fix - Auto-detect and fix issues + restart - Restart OpenVPN service + logs - Show recent logs +""" + +import sys +import os +import json +from pathlib import Path + +# Add parent directory to path +sys.path.insert(0, str(Path(__file__).parent.parent)) + +from service.openvpn_monitor import openvpn_monitor +from logger import logger + + +def print_json(data): + """Pretty print JSON data""" + print(json.dumps(data, indent=2)) + + +def cmd_status(): + """Show OpenVPN service status""" + print("=" * 50) + print("OpenVPN Service Status") + print("=" * 50) + + status = openvpn_monitor.check_service_status() + print(f"Running: {status['running']}") + print(f"Enabled: {status['enabled']}") + print(f"Active State: {status['active_state']}") + + if status['error']: + print(f"Error: {status['error']}") + + port, protocol = openvpn_monitor.get_config_port_protocol() + port_open = openvpn_monitor.check_port_listening(port, protocol) + + print(f"\nPort: {port}") + print(f"Protocol: {protocol}") + print(f"Port Open: {port_open}") + print() + + +def cmd_health(): + """Run health check""" + print("=" * 50) + print("OpenVPN Health Check") + print("=" * 50) + + health = openvpn_monitor.health_check() + + print(f"Overall Health: {'✓ HEALTHY' if health['healthy'] else '✗ UNHEALTHY'}") + print() + print(f"Service Running: {'✓' if health['service_running'] else '✗'}") + print(f"Port Listening: {'✓' if health['port_listening'] else '✗'}") + print(f"Config Valid: {'✓' if health['config_valid'] else '✗'}") + + if health['issues']: + print(f"\nIssues Found: {len(health['issues'])}") + for i, issue in enumerate(health['issues'], 1): + print(f" {i}. {issue}") + else: + print("\nNo issues found!") + print() + + +def cmd_fix(): + """Auto-detect and fix issues""" + print("=" * 50) + print("OpenVPN Auto-Fix") + print("=" * 50) + + print("Detecting and fixing issues...\n") + + result = openvpn_monitor.auto_fix_and_restart() + + if result['errors_detected']: + print(f"Errors Detected: {len(result['errors_detected'])}") + for error in result['errors_detected']: + print(f" - {error['message']}") + print() + + if result['fixes_applied']: + print(f"Fixes Applied: {len(result['fixes_applied'])}") + for fix in result['fixes_applied']: + print(f" - {fix}") + print() + + print(f"Service Running: {'✓' if result['service_running'] else '✗'}") + print(f"Port Open: {'✓' if result['port_open'] else '✗'}") + print() + + if result['success']: + print("✓ SUCCESS: OpenVPN is now running correctly!") + else: + print("✗ FAILED: OpenVPN still has issues") + print("Check logs for more details: journalctl -u openvpn-server@server -n 50") + print() + + +def cmd_restart(): + """Restart OpenVPN service""" + print("=" * 50) + print("Restart OpenVPN Service") + print("=" * 50) + + print("Restarting service...") + success = openvpn_monitor.restart_service() + + if success: + print("✓ Service restarted successfully!") + + # Check status after restart + status = openvpn_monitor.check_service_status() + if status['running']: + print("✓ Service is running") + else: + print("✗ Service failed to start") + else: + print("✗ Failed to restart service") + print() + + +def cmd_logs(): + """Show recent logs""" + print("=" * 50) + print("OpenVPN Recent Logs (Last 30 lines)") + print("=" * 50) + + logs = openvpn_monitor.get_service_logs(30) + + for log in logs: + print(log) + print() + + +def cmd_errors(): + """Detect configuration errors""" + print("=" * 50) + print("OpenVPN Configuration Errors") + print("=" * 50) + + errors = openvpn_monitor.detect_config_errors() + + if errors: + print(f"Found {len(errors)} errors:\n") + for i, error in enumerate(errors, 1): + print(f"{i}. [{error['severity'].upper()}] {error['message']}") + print(f" Type: {error['type']}") + if 'log' in error: + print(f" Log: {error['log'][:100]}...") + print() + else: + print("No configuration errors detected!") + print() + + +def cmd_help(): + """Show help message""" + print(__doc__) + + +def main(): + """Main entry point""" + if len(sys.argv) < 2: + cmd_help() + return + + command = sys.argv[1].lower() + + commands = { + 'status': cmd_status, + 'health': cmd_health, + 'fix': cmd_fix, + 'restart': cmd_restart, + 'logs': cmd_logs, + 'errors': cmd_errors, + 'help': cmd_help, + } + + if command in commands: + try: + commands[command]() + except Exception as e: + print(f"Error: {e}") + logger.error(f"CLI error: {e}") + sys.exit(1) + else: + print(f"Unknown command: {command}") + print("Use 'help' to see available commands") + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/core/routers/router.py b/core/routers/router.py index 38f9e7a..e5e24a3 100644 --- a/core/routers/router.py +++ b/core/routers/router.py @@ -9,6 +9,11 @@ download_ovpn_file, ) from setting.core import change_config +from service.openvpn_monitor import ( + get_openvpn_health, + check_and_fix_openvpn_service, + openvpn_monitor +) router = APIRouter(prefix="/sync", tags=["node_sync"]) @@ -71,3 +76,58 @@ async def download_ovpn(client_name: str, api_key: str = Depends(check_api_key)) ) else: return ResponseModel(success=False, msg="OVPN file not found", data=None) + + +@router.get("/openvpn/health", response_model=ResponseModel) +async def openvpn_health(api_key: str = Depends(check_api_key)): + """Get OpenVPN service health status""" + health = get_openvpn_health() + return ResponseModel( + success=health["healthy"], + msg="OpenVPN health check completed", + data=health + ) + + +@router.post("/openvpn/fix", response_model=ResponseModel) +async def openvpn_fix(api_key: str = Depends(check_api_key)): + """Automatically detect and fix OpenVPN service issues""" + result = check_and_fix_openvpn_service() + return ResponseModel( + success=result["success"], + msg="OpenVPN auto-fix completed", + data=result + ) + + +@router.get("/openvpn/status", response_model=ResponseModel) +async def openvpn_status(api_key: str = Depends(check_api_key)): + """Get detailed OpenVPN service status""" + status = openvpn_monitor.check_service_status() + port, protocol = openvpn_monitor.get_config_port_protocol() + port_open = openvpn_monitor.check_port_listening(port, protocol) + + data = { + "service_status": status, + "port": port, + "protocol": protocol, + "port_open": port_open + } + + return ResponseModel( + success=True, + msg="OpenVPN status retrieved", + data=data + ) + + +@router.post("/openvpn/restart", response_model=ResponseModel) +async def openvpn_restart(api_key: str = Depends(check_api_key)): + """Restart OpenVPN service""" + success = openvpn_monitor.restart_service() + return ResponseModel( + success=success, + msg="OpenVPN restart completed" if success else "Failed to restart OpenVPN", + data={"restarted": success} + ) + diff --git a/core/service/background_tasks.py b/core/service/background_tasks.py new file mode 100644 index 0000000..ce6938a --- /dev/null +++ b/core/service/background_tasks.py @@ -0,0 +1,51 @@ +""" +Background tasks for monitoring and maintaining OpenVPN service +""" + +import asyncio +from datetime import datetime +from logger import logger +from service.openvpn_monitor import openvpn_monitor + + +async def periodic_health_check(): + """ + Periodically check OpenVPN service health and auto-fix if needed + Runs every 5 minutes + """ + while True: + try: + logger.info("Running periodic OpenVPN health check...") + + # Check health + health = openvpn_monitor.health_check() + + if not health["healthy"]: + logger.warning(f"OpenVPN is unhealthy: {health['issues']}") + + # Attempt auto-fix + logger.info("Attempting auto-fix...") + fix_result = openvpn_monitor.auto_fix_and_restart() + + if fix_result["success"]: + logger.info("Auto-fix successful, OpenVPN is now healthy") + else: + logger.error(f"Auto-fix failed: {fix_result}") + else: + logger.info("OpenVPN is healthy") + + except Exception as e: + logger.error(f"Error in periodic health check: {e}") + + # Wait 5 minutes before next check + await asyncio.sleep(300) + + +async def start_background_tasks(): + """Start all background monitoring tasks""" + logger.info("Starting background monitoring tasks...") + + # Create task for periodic health check + asyncio.create_task(periodic_health_check()) + + logger.info("Background tasks started") diff --git a/core/service/openvpn_monitor.py b/core/service/openvpn_monitor.py new file mode 100644 index 0000000..eb37bd4 --- /dev/null +++ b/core/service/openvpn_monitor.py @@ -0,0 +1,543 @@ +""" +OpenVPN Service Monitor and Auto-Fix Module +This module monitors OpenVPN service health and automatically fixes configuration issues. +""" + +import subprocess +import re +import os +import time +from typing import Dict, List, Optional, Tuple + +from logger import logger + + +class OpenVPNMonitor: + """Monitor and maintain OpenVPN service health""" + + def __init__(self): + self.config_file = "/etc/openvpn/server/server.conf" + self.template_file = "/etc/openvpn/server/client-common.txt" + self.service_name = "openvpn-server@server" + + def check_service_status(self) -> Dict[str, any]: + """ + Check the current status of OpenVPN service + + Returns: + Dict with status information + """ + result = { + "running": False, + "enabled": False, + "active_state": "unknown", + "error": None + } + + try: + # Check if service is active + status_result = subprocess.run( + ["systemctl", "is-active", self.service_name], + capture_output=True, + text=True, + timeout=5 + ) + result["active_state"] = status_result.stdout.strip() + result["running"] = status_result.returncode == 0 + + # Check if service is enabled + enabled_result = subprocess.run( + ["systemctl", "is-enabled", self.service_name], + capture_output=True, + text=True, + timeout=5 + ) + result["enabled"] = enabled_result.returncode == 0 + + except Exception as e: + result["error"] = str(e) + logger.error(f"Error checking service status: {e}") + + return result + + def get_service_logs(self, lines: int = 20) -> List[str]: + """ + Get recent service logs + + Args: + lines: Number of log lines to retrieve + + Returns: + List of log lines + """ + try: + result = subprocess.run( + ["journalctl", "-u", self.service_name, "-n", str(lines), "--no-pager"], + capture_output=True, + text=True, + timeout=10 + ) + + if result.returncode == 0: + return result.stdout.strip().split("\n") + return [] + + except Exception as e: + logger.error(f"Error getting service logs: {e}") + return [] + + def detect_config_errors(self) -> List[Dict[str, str]]: + """ + Detect configuration errors by analyzing logs and config files + + Returns: + List of detected errors with details + """ + errors = [] + + # Check logs for errors + logs = self.get_service_logs(50) + for log in logs: + # Check for "local" option error (missing IP) + if "Options error" in log and "local" in log: + errors.append({ + "type": "missing_local_ip", + "severity": "critical", + "message": "Missing IP address in 'local' directive", + "log": log + }) + + # Check for unrecognized options + if "Unrecognized option" in log: + errors.append({ + "type": "unrecognized_option", + "severity": "critical", + "message": "Configuration contains unrecognized options", + "log": log + }) + + # Check for port binding issues + if "bind" in log.lower() and "failed" in log.lower(): + errors.append({ + "type": "port_binding", + "severity": "critical", + "message": "Failed to bind to port", + "log": log + }) + + return errors + + def get_server_ip_addresses(self) -> List[str]: + """ + Get all IP addresses of the server + + Returns: + List of IP addresses + """ + ips = [] + try: + result = subprocess.run( + ["ip", "addr", "show"], + capture_output=True, + text=True, + timeout=5 + ) + + if result.returncode == 0: + # Extract IPv4 addresses (excluding loopback) + for line in result.stdout.split("\n"): + match = re.search(r'inet\s+(\d+\.\d+\.\d+\.\d+)', line) + if match: + ip = match.group(1) + if not ip.startswith("127.") and not ip.startswith("10.8."): + ips.append(ip) + + except Exception as e: + logger.error(f"Error getting server IPs: {e}") + + return ips + + def get_public_ip(self) -> Optional[str]: + """ + Get the public IP address of the server + + Returns: + Public IP address or None + """ + try: + # Try multiple services + services = [ + ["curl", "-s", "-4", "ifconfig.me"], + ["curl", "-s", "-4", "icanhazip.com"], + ["curl", "-s", "-4", "api.ipify.org"] + ] + + for service in services: + try: + result = subprocess.run( + service, + capture_output=True, + text=True, + timeout=10 + ) + if result.returncode == 0 and result.stdout.strip(): + ip = result.stdout.strip() + # Validate IP format + if re.match(r'^\d+\.\d+\.\d+\.\d+$', ip): + return ip + except: + continue + + except Exception as e: + logger.error(f"Error getting public IP: {e}") + + return None + + def fix_missing_local_ip(self) -> bool: + """ + Fix missing IP address in 'local' directive + + Returns: + True if fixed successfully, False otherwise + """ + try: + if not os.path.exists(self.config_file): + logger.error(f"Config file not found: {self.config_file}") + return False + + # Read config + with open(self.config_file, "r") as f: + config = f.read() + + # Check if local directive is missing IP + if re.search(r'^local\s*$', config, re.MULTILINE): + logger.warning("Detected 'local' directive without IP address") + + # Get server IPs + ips = self.get_server_ip_addresses() + if not ips: + logger.error("No valid IP addresses found on server") + return False + + # Use first public IP (or first IP if no public IP found) + selected_ip = ips[0] + logger.info(f"Selected IP address: {selected_ip}") + + # Fix the config + config = re.sub( + r'^local\s*$', + f'local {selected_ip}', + config, + flags=re.MULTILINE + ) + + # Write back + with open(self.config_file, "w") as f: + f.write(config) + + logger.info(f"Fixed 'local' directive with IP: {selected_ip}") + return True + + return True + + except Exception as e: + logger.error(f"Error fixing missing local IP: {e}") + return False + + def validate_config_syntax(self) -> Tuple[bool, Optional[str]]: + """ + Validate OpenVPN config syntax + + Returns: + Tuple of (is_valid, error_message) + """ + try: + # Check if openvpn binary exists + openvpn_path = None + for path in ["/usr/sbin/openvpn", "/usr/bin/openvpn", "/sbin/openvpn"]: + if os.path.exists(path): + openvpn_path = path + break + + if not openvpn_path: + # OpenVPN binary not found, skip validation + logger.debug("OpenVPN binary not found, skipping syntax validation") + return True, None + + result = subprocess.run( + [openvpn_path, "--config", self.config_file, "--test-crypto"], + capture_output=True, + text=True, + timeout=10 + ) + + if result.returncode != 0: + return False, result.stderr + + return True, None + + except FileNotFoundError: + # OpenVPN command not found, but that's ok + logger.debug("OpenVPN command not found for validation") + return True, None + except Exception as e: + logger.warning(f"Config syntax validation skipped: {e}") + return True, None + + def check_port_listening(self, port: int = 1194, protocol: str = "udp") -> bool: + """ + Check if OpenVPN is listening on the configured port + + Args: + port: Port number to check + protocol: Protocol (tcp/udp) + + Returns: + True if listening, False otherwise + """ + try: + if protocol == "udp": + result = subprocess.run( + ["ss", "-ulnp"], + capture_output=True, + text=True, + timeout=5 + ) + else: + result = subprocess.run( + ["ss", "-tlnp"], + capture_output=True, + text=True, + timeout=5 + ) + + if result.returncode == 0: + # Check if port is in the output + return f":{port}" in result.stdout + + except Exception as e: + logger.error(f"Error checking port listening: {e}") + + return False + + def get_config_port_protocol(self) -> Tuple[int, str]: + """ + Get port and protocol from config file + + Returns: + Tuple of (port, protocol) + """ + port = 1194 # default + protocol = "udp" # default + + try: + if os.path.exists(self.config_file): + with open(self.config_file, "r") as f: + config = f.read() + + # Extract port + port_match = re.search(r'^port\s+(\d+)', config, re.MULTILINE) + if port_match: + port = int(port_match.group(1)) + + # Extract protocol + proto_match = re.search(r'^proto\s+(\w+)', config, re.MULTILINE) + if proto_match: + protocol = proto_match.group(1) + + except Exception as e: + logger.error(f"Error reading config port/protocol: {e}") + + return port, protocol + + def restart_service(self) -> bool: + """ + Restart OpenVPN service + + Returns: + True if restarted successfully, False otherwise + """ + try: + logger.info(f"Restarting {self.service_name}...") + result = subprocess.run( + ["systemctl", "restart", self.service_name], + capture_output=True, + text=True, + timeout=30 + ) + + if result.returncode == 0: + logger.info("Service restarted successfully") + # Wait a bit for service to fully start + time.sleep(2) + return True + else: + logger.error(f"Failed to restart service: {result.stderr}") + return False + + except Exception as e: + logger.error(f"Error restarting service: {e}") + return False + + def enable_service(self) -> bool: + """ + Enable OpenVPN service to start on boot + + Returns: + True if enabled successfully, False otherwise + """ + try: + result = subprocess.run( + ["systemctl", "enable", self.service_name], + capture_output=True, + text=True, + timeout=10 + ) + + if result.returncode == 0: + logger.info("Service enabled successfully") + return True + else: + logger.error(f"Failed to enable service: {result.stderr}") + return False + + except Exception as e: + logger.error(f"Error enabling service: {e}") + return False + + def auto_fix_and_restart(self) -> Dict[str, any]: + """ + Automatically detect and fix configuration issues, then restart service + + Returns: + Dict with fix results + """ + result = { + "success": False, + "errors_detected": [], + "fixes_applied": [], + "service_running": False, + "port_open": False + } + + logger.info("Starting OpenVPN auto-fix procedure...") + + # 1. Check current status + status = self.check_service_status() + logger.info(f"Current service status: {status}") + + # 2. Detect errors + errors = self.detect_config_errors() + result["errors_detected"] = errors + + if errors: + logger.warning(f"Detected {len(errors)} configuration errors") + + # 3. Apply fixes + for error in errors: + if error["type"] == "missing_local_ip": + if self.fix_missing_local_ip(): + result["fixes_applied"].append("fixed_missing_local_ip") + logger.info("Fixed missing local IP") + + # 4. Ensure service is enabled + if not status["enabled"]: + if self.enable_service(): + result["fixes_applied"].append("enabled_service") + + # 5. Restart service + if self.restart_service(): + result["fixes_applied"].append("restarted_service") + + # 6. Verify service is running + time.sleep(3) + new_status = self.check_service_status() + result["service_running"] = new_status["running"] + + # 7. Check if port is open + port, protocol = self.get_config_port_protocol() + result["port_open"] = self.check_port_listening(port, protocol) + result["success"] = result["service_running"] and result["port_open"] + + if result["success"]: + logger.info("OpenVPN service is now running correctly") + else: + logger.warning("Service started but issues remain") + if not result["port_open"]: + logger.warning(f"Port {port}/{protocol} is not open") + else: + logger.error("Failed to restart service") + + return result + + def health_check(self) -> Dict[str, any]: + """ + Perform comprehensive health check + + Returns: + Dict with health status + """ + health = { + "healthy": False, + "service_running": False, + "port_listening": False, + "config_valid": False, + "issues": [] + } + + # Check service status + status = self.check_service_status() + health["service_running"] = status["running"] + + if not status["running"]: + health["issues"].append("Service is not running") + + if not status["enabled"]: + health["issues"].append("Service is not enabled on boot") + + # Check port + port, protocol = self.get_config_port_protocol() + health["port_listening"] = self.check_port_listening(port, protocol) + + if not health["port_listening"]: + health["issues"].append(f"Port {port}/{protocol} is not listening") + + # Check config + is_valid, error = self.validate_config_syntax() + health["config_valid"] = is_valid + + if not is_valid: + health["issues"].append(f"Config validation failed: {error}") + + # Overall health + health["healthy"] = ( + health["service_running"] and + health["port_listening"] and + health["config_valid"] + ) + + return health + + +# Global instance +openvpn_monitor = OpenVPNMonitor() + + +def check_and_fix_openvpn_service() -> Dict[str, any]: + """ + Convenience function to check and fix OpenVPN service + + Returns: + Dict with results + """ + return openvpn_monitor.auto_fix_and_restart() + + +def get_openvpn_health() -> Dict[str, any]: + """ + Convenience function to get OpenVPN health status + + Returns: + Dict with health status + """ + return openvpn_monitor.health_check() diff --git a/core/service/user_managment.py b/core/service/user_managment.py index 55e0578..11e0c2c 100644 --- a/core/service/user_managment.py +++ b/core/service/user_managment.py @@ -1,6 +1,7 @@ import pexpect import re import os +import subprocess from logger import logger @@ -8,8 +9,123 @@ script_path = "/root/openvpn-install.sh" -def create_user_on_server(name, expiry_date) -> bool: +def validate_and_fix_ovpn_file(ovpn_file: str) -> bool: + """ + Validate that .ovpn file has correct remote IP address + If missing, fix it by getting the public IP + + Args: + ovpn_file: Path to .ovpn file + + Returns: + True if file is valid or fixed successfully, False otherwise + """ try: + with open(ovpn_file, 'r') as f: + content = f.read() + + # Check if remote line is missing IP (format: "remote 1194" or "remote 1194") + if re.search(r'^remote\s+\d+$', content, re.MULTILINE) or \ + re.search(r'^remote\s{2,}\d+$', content, re.MULTILINE): + logger.warning(f"OVPN file {ovpn_file} has missing IP in remote directive, fixing...") + + # Get public IP + public_ip = None + try: + result = subprocess.run( + ["curl", "-s", "-4", "ifconfig.me"], + capture_output=True, + text=True, + timeout=10 + ) + if result.returncode == 0 and result.stdout.strip(): + public_ip = result.stdout.strip() + except: + pass + + if not public_ip: + # Try to get from server IP + result = subprocess.run( + ["ip", "addr", "show"], + capture_output=True, + text=True, + timeout=5 + ) + if result.returncode == 0: + for line in result.stdout.split("\n"): + match = re.search(r'inet\s+(\d+\.\d+\.\d+\.\d+)', line) + if match: + ip = match.group(1) + if not ip.startswith("127.") and not ip.startswith("10.8."): + public_ip = ip + break + + if not public_ip: + logger.error("Cannot get public IP to fix OVPN file") + return False + + # Extract port from remote line + port_match = re.search(r'^remote\s+(\d+)$', content, re.MULTILINE) + if not port_match: + port_match = re.search(r'^remote\s{2,}(\d+)$', content, re.MULTILINE) + + port = port_match.group(1) if port_match else "1194" + + # Fix the remote line + content = re.sub( + r'^remote\s+.*$', + f'remote {public_ip} {port}', + content, + flags=re.MULTILINE + ) + + # Write back + with open(ovpn_file, 'w') as f: + f.write(content) + + logger.info(f"Fixed OVPN file {ovpn_file} with IP: {public_ip} and port: {port}") + return True + else: + # Check if remote line has valid IP + remote_match = re.search(r'^remote\s+(\d+\.\d+\.\d+\.\d+)\s+\d+', content, re.MULTILINE) + if remote_match: + logger.info(f"OVPN file {ovpn_file} has valid remote directive") + return True + else: + logger.error(f"OVPN file {ovpn_file} has invalid remote directive format") + return False + + except Exception as e: + logger.error(f"Error validating OVPN file {ovpn_file}: {e}") + return False + + +def create_user_on_server(name, expiry_date=None) -> bool: + try: + # Ensure OpenVPN template is fixed before creating user + from setting.core import fix_openvpn_template, fix_openvpn_server_config + logger.info("Ensuring OpenVPN configuration is correct before creating user...") + fix_openvpn_server_config() + fix_openvpn_template() + + # Validate input name + if not name or not name.strip(): + logger.error("Invalid user name: name cannot be empty") + return False + + # Check if client already exists + cert_path = f"/etc/openvpn/server/easy-rsa/pki/issued/{name}.crt" + if os.path.exists(cert_path): + logger.warning(f"User '{name}' already exists") + # Check if .ovpn file exists, if yes, consider it success + ovpn_path = f"/root/{name}.ovpn" + if os.path.exists(ovpn_path): + logger.info(f"User '{name}' already exists with valid .ovpn file") + return True + else: + logger.error(f"User '{name}' exists but .ovpn file is missing") + return False + if not os.path.exists(script_path): logger.error("script not found on ") return False @@ -26,26 +142,86 @@ def create_user_on_server(name, expiry_date) -> bool: bash.expect(r"Option:", timeout=90) bash.sendline("1") - bash.expect(r"Name:", timeout=90) + # Wait for name prompt - could be first prompt or repeated if invalid + index = bash.expect([r"Name:", r"invalid name"], timeout=90) bash.sendline(name) - bash.expect(pexpect.EOF, timeout=180) + + # Handle case where name might be invalid and script asks again + max_retries = 3 + retry_count = 0 + while retry_count < max_retries: + index = bash.expect([ + r"Name:", # 0 - Script asking for name again (invalid/duplicate) + r"added\. Configuration available", # 1 - Success message + pexpect.EOF, # 2 - Script finished + pexpect.TIMEOUT # 3 - Timeout + ], timeout=180) + + if index == 0: + # Script is asking for name again - means duplicate or invalid + logger.error(f"User name '{name}' is invalid or already exists in script") + bash.close(force=True) + return False + elif index == 1: + # Success message found + logger.info(f"User '{name}' created successfully") + bash.expect(pexpect.EOF, timeout=10) + bash.close() + + # Validate the generated .ovpn file + ovpn_file = f"/root/{name}.ovpn" + if os.path.exists(ovpn_file): + if validate_and_fix_ovpn_file(ovpn_file): + logger.info(f"OVPN file for '{name}' validated successfully") + return True + else: + logger.error(f"OVPN file for '{name}' validation failed") + return False + else: + logger.error(f"OVPN file not found after creation: {ovpn_file}") + return False + elif index == 2: + # EOF - script finished + logger.info(f"Script finished for user '{name}'") + bash.close() + return True + + retry_count += 1 - bash.close() - return True + logger.error(f"Max retries reached for user '{name}'") + bash.close(force=True) + return False - except pexpect.TIMEOUT: - logger.error("Timeout occurred while executing script!") + except pexpect.TIMEOUT as e: + logger.error(f"Timeout occurred while executing script: {e}") + try: + bash.close(force=True) + except: + pass return False - except pexpect.EOF: - logger.error("Script closed earlier than expected!") + except pexpect.EOF as e: + logger.error(f"Script closed earlier than expected: {e}") + try: + bash.close(force=True) + except: + pass return False except Exception as e: logger.error(f"Error occurred: {e}") + try: + bash.close(force=True) + except: + pass return False def delete_user_on_server(name) -> bool | str: try: + # Validate input + if not name or not name.strip(): + logger.error("Invalid user name: name cannot be empty") + return False + if not os.path.exists(script_path): logger.error("script not found at %s", script_path) return False @@ -69,8 +245,13 @@ def delete_user_on_server(name) -> bool | str: except pexpect.TIMEOUT: logger.info("Didn't match full header") - bash.expect(r"Client:", timeout=20) - list_output = bash.before + try: + bash.expect(r"Client:", timeout=20) + list_output = bash.before + except pexpect.TIMEOUT: + logger.error("Timeout waiting for client list") + bash.close(force=True) + return False pattern = re.compile(r"\s*(\d+)\)\s*(.+)") matches = pattern.findall(list_output) @@ -98,7 +279,13 @@ def delete_user_on_server(name) -> bool | str: except pexpect.TIMEOUT: logger.warning("Confirmation prompt not seen; trying to continue") - bash.expect(pexpect.EOF, timeout=120) + try: + bash.expect(pexpect.EOF, timeout=120) + except pexpect.TIMEOUT: + logger.error("Timeout waiting for script to finish") + bash.close(force=True) + return False + bash.close() # remove local .ovpn file if exists @@ -113,8 +300,19 @@ def delete_user_on_server(name) -> bool | str: return True + except pexpect.TIMEOUT as e: + logger.exception("Timeout in delete_user_on_server: %s", e) + try: + bash.close(force=True) + except: + pass + return False except Exception as e: logger.exception("Error in delete_user_on_server: %s", e) + try: + bash.close(force=True) + except: + pass return False @@ -122,7 +320,17 @@ async def download_ovpn_file(name: str) -> str | None: """This function returns the path of the ovpn file for downloading""" file_path = f"/root/{name}.ovpn" if os.path.exists(file_path): - return file_path + # Validate and fix the file before returning + if validate_and_fix_ovpn_file(file_path): + return file_path + else: + logger.error(f"OVPN file validation failed for {name}") + return None else: - create_user_on_server(name) - return await download_ovpn_file(name) + # Try to create user if file doesn't exist + success = create_user_on_server(name) + if success and os.path.exists(file_path): + return file_path + else: + logger.error(f"Failed to create or find OVPN file for {name}") + return None diff --git a/core/setting/core.py b/core/setting/core.py index 038daa7..fb7bb18 100644 --- a/core/setting/core.py +++ b/core/setting/core.py @@ -1,5 +1,6 @@ import pexpect import re +import subprocess from logger import logger from schema.all_schemas import SetSettingsModel @@ -33,12 +34,17 @@ def change_config(request: SetSettingsModel) -> bool: # Update the client template with open(template_file, "r") as file: template = file.read() + + # Replace remote line - handle multiple formats: + # "remote ", "remote ", or "remote " + remote_pattern = r"^remote\s+.*$" template = re.sub( - r"^remote\s+\S+\s+\d+", + remote_pattern, f"remote {request.tunnel_address} {request.ovpn_port}", template, flags=re.MULTILINE, ) + template = re.sub( r"^proto\s+\w+", f"proto {request.protocol}", @@ -62,11 +68,338 @@ def restart_openvpn() -> None: """Restart the OpenVPN service with systemctl""" try: logger.info("Restarting OpenVPN service...") - # Use pexpect to restart the OpenVPN service - child = pexpect.spawn( - "systemctl restart openvpn-server@server", encoding="utf-8" + # Use subprocess instead of pexpect for better reliability + result = subprocess.run( + ["systemctl", "restart", "openvpn-server@server"], + capture_output=True, + text=True, + timeout=30 ) - child.expect(pexpect.EOF) - logger.info("OpenVPN service restarted successfully.") + if result.returncode == 0: + logger.info("OpenVPN service restarted successfully.") + else: + logger.error(f"Failed to restart OpenVPN: {result.stderr}") except Exception as e: logger.error(f"Error restarting OpenVPN service: {e}") + + +def get_public_ip() -> str: + """Get the public IP address of the server""" + try: + # Try multiple services for redundancy + result = subprocess.run( + ["curl", "-s", "-4", "ifconfig.me"], + capture_output=True, + text=True, + timeout=10 + ) + if result.returncode == 0 and result.stdout.strip(): + return result.stdout.strip() + + # Fallback + result = subprocess.run( + ["curl", "-s", "-4", "icanhazip.com"], + capture_output=True, + text=True, + timeout=10 + ) + if result.returncode == 0 and result.stdout.strip(): + return result.stdout.strip() + + logger.warning("Could not get public IP, using localhost") + return "127.0.0.1" + except Exception as e: + logger.error(f"Error getting public IP: {e}") + return "127.0.0.1" + + +def fix_openvpn_template() -> bool: + """Fix the OpenVPN client template if it has missing IP address""" + template_file = "/etc/openvpn/server/client-common.txt" + try: + import os + if not os.path.exists(template_file): + logger.warning(f"Template file {template_file} does not exist") + return False + + with open(template_file, "r") as file: + template = file.read() + + # Check if remote line is missing IP (has format "remote " or "remote ") + if re.search(r"^remote\s+\d+$", template, re.MULTILINE) or \ + re.search(r"^remote\s{2,}\d+$", template, re.MULTILINE): + logger.warning("OpenVPN template has missing IP address, fixing...") + + # Get public IP + public_ip = get_public_ip() + + # Extract current port from template + port_match = re.search(r"^remote\s+(\d+)$", template, re.MULTILINE) + if not port_match: + port_match = re.search(r"^remote\s{2,}(\d+)$", template, re.MULTILINE) + + port = port_match.group(1) if port_match else "1194" + + # Fix the remote line + template = re.sub( + r"^remote\s+.*$", + f"remote {public_ip} {port}", + template, + flags=re.MULTILINE + ) + + with open(template_file, "w") as file: + file.write(template) + + logger.info(f"Fixed OpenVPN template with IP: {public_ip} and port: {port}") + return True + else: + logger.info("OpenVPN template is already correctly configured") + return True + + except Exception as e: + logger.error(f"Error fixing OpenVPN template: {e}") + return False + + +def fix_openvpn_server_config() -> bool: + """Fix the OpenVPN server config if it has missing local IP address or other critical settings""" + config_file = "/etc/openvpn/server/server.conf" + try: + import os + if not os.path.exists(config_file): + logger.error(f"Config file {config_file} does not exist") + return False + + with open(config_file, "r") as file: + config = file.read() + + config_modified = False + + # Fix 1: Check if local directive is missing IP + if re.search(r"^local\s*$", config, re.MULTILINE): + logger.warning("OpenVPN server config has missing local IP address, fixing...") + + # Get server IP addresses + result = subprocess.run( + ["ip", "addr", "show"], + capture_output=True, + text=True, + timeout=5 + ) + + if result.returncode == 0: + # Extract public IP addresses (excluding loopback and VPN) + ips = [] + for line in result.stdout.split("\n"): + match = re.search(r'inet\s+(\d+\.\d+\.\d+\.\d+)', line) + if match: + ip = match.group(1) + if not ip.startswith("127.") and not ip.startswith("10.8."): + ips.append(ip) + + if ips: + selected_ip = ips[0] # Use first available IP + logger.info(f"Selected IP address for OpenVPN: {selected_ip}") + + # Fix the local line + config = re.sub( + r"^local\s*$", + f"local {selected_ip}", + config, + flags=re.MULTILINE + ) + config_modified = True + logger.info(f"Fixed 'local' directive with IP: {selected_ip}") + + # Fix 2: Check if 'port' is missing + if not re.search(r"^port\s+\d+", config, re.MULTILINE): + logger.warning("Missing 'port' directive, adding default port 1194") + # Add port directive after local + if re.search(r"^local\s+", config, re.MULTILINE): + config = re.sub( + r"(^local\s+.+)$", + r"\1\nport 1194", + config, + flags=re.MULTILINE + ) + else: + # Add at beginning + config = "port 1194\n" + config + config_modified = True + logger.info("Added 'port 1194' directive") + + # Fix 3: Check if 'proto' is missing + if not re.search(r"^proto\s+\w+", config, re.MULTILINE): + logger.warning("Missing 'proto' directive, adding default proto udp") + # Add proto directive after port + if re.search(r"^port\s+", config, re.MULTILINE): + config = re.sub( + r"(^port\s+\d+)$", + r"\1\nproto udp", + config, + flags=re.MULTILINE + ) + else: + config = "proto udp\n" + config + config_modified = True + logger.info("Added 'proto udp' directive") + + # Fix 4: Check if 'dev tun' is missing (CRITICAL) + if not re.search(r"^dev\s+tun", config, re.MULTILINE): + logger.warning("Missing 'dev tun' directive, adding it") + # Add dev tun after proto + if re.search(r"^proto\s+", config, re.MULTILINE): + config = re.sub( + r"(^proto\s+\w+)$", + r"\1\ndev tun", + config, + flags=re.MULTILINE + ) + else: + config = "dev tun\n" + config + config_modified = True + logger.info("Added 'dev tun' directive") + + # Write back if modified + if config_modified: + with open(config_file, "w") as file: + file.write(config) + logger.info("OpenVPN server config has been fixed and saved") + return True + else: + logger.info("OpenVPN server config is already correctly configured") + return True + + except Exception as e: + logger.error(f"Error fixing OpenVPN server config: {e}") + return False + + +def ensure_openvpn_running() -> bool: + """ + Ensure OpenVPN service is running correctly. + This function will: + 1. Check if config has errors and fix them + 2. Enable the service if not enabled + 3. Start/restart the service + 4. Verify it's running and port is open + """ + try: + logger.info("Ensuring OpenVPN service is running...") + + # Step 1: Fix any config issues + logger.info("Checking and fixing configuration files...") + fix_openvpn_server_config() + fix_openvpn_template() + + # Step 2: Check if service is enabled, if not enable it + enabled_check = subprocess.run( + ["systemctl", "is-enabled", "openvpn-server@server"], + capture_output=True, + text=True, + timeout=5 + ) + + if enabled_check.returncode != 0: + logger.info("Enabling OpenVPN service...") + subprocess.run( + ["systemctl", "enable", "openvpn-server@server"], + capture_output=True, + text=True, + timeout=10 + ) + + # Step 3: Restart the service + logger.info("Restarting OpenVPN service...") + restart_result = subprocess.run( + ["systemctl", "restart", "openvpn-server@server"], + capture_output=True, + text=True, + timeout=30 + ) + + if restart_result.returncode != 0: + logger.error(f"Failed to restart OpenVPN: {restart_result.stderr}") + # Get detailed error from journalctl + logs = subprocess.run( + ["journalctl", "-u", "openvpn-server@server", "-n", "20", "--no-pager"], + capture_output=True, + text=True, + timeout=10 + ) + logger.error(f"Recent logs:\n{logs.stdout}") + return False + + # Step 4: Wait a bit for service to fully start + import time + time.sleep(3) + + # Step 5: Verify service is running + status_check = subprocess.run( + ["systemctl", "is-active", "openvpn-server@server"], + capture_output=True, + text=True, + timeout=5 + ) + + is_running = status_check.returncode == 0 + + if is_running: + logger.info("✓ OpenVPN service is running successfully") + + # Step 6: Check if port is open + # Read config to get port and protocol + with open("/etc/openvpn/server/server.conf", "r") as f: + config = f.read() + + port = "1194" # default + protocol = "udp" # default + + port_match = re.search(r"^port\s+(\d+)", config, re.MULTILINE) + if port_match: + port = port_match.group(1) + + proto_match = re.search(r"^proto\s+(\w+)", config, re.MULTILINE) + if proto_match: + protocol = proto_match.group(1) + + # Check if port is listening + if protocol == "udp": + port_check = subprocess.run( + ["ss", "-ulnp"], + capture_output=True, + text=True, + timeout=5 + ) + else: + port_check = subprocess.run( + ["ss", "-tlnp"], + capture_output=True, + text=True, + timeout=5 + ) + + if f":{port}" in port_check.stdout: + logger.info(f"✓ OpenVPN is listening on port {port}/{protocol}") + return True + else: + logger.warning(f"⚠ OpenVPN service is running but port {port}/{protocol} is not open") + return True # Service is running, port issue might resolve itself + else: + logger.error("✗ OpenVPN service failed to start") + # Get error logs + logs = subprocess.run( + ["journalctl", "-u", "openvpn-server@server", "-n", "30", "--no-pager"], + capture_output=True, + text=True, + timeout=10 + ) + logger.error(f"Error logs:\n{logs.stdout}") + return False + + except Exception as e: + logger.error(f"Error ensuring OpenVPN is running: {e}") + return False + + diff --git a/install.sh b/install.sh index 365eb69..adf88ef 100644 --- a/install.sh +++ b/install.sh @@ -5,35 +5,40 @@ APP_NAME="ov-node" INSTALL_DIR="/opt/$APP_NAME" REPO_URL="https://github.com/primeZdev/ov-node" PYTHON="/usr/bin/python3" +VENV_DIR="$INSTALL_DIR/venv" GREEN="\033[0;32m" YELLOW="\033[1;33m" NC="\033[0m" apt update -y -apt install -y python3 python3-pip wget curl git -y -pip3 install --upgrade pip -pip3 install colorama pexpect requests uuid +apt install -y python3 python3-pip python3-venv wget curl git -y if [ ! -d "$INSTALL_DIR" ]; then - echo -e "${YELLOW}Downloading latest release...${NC}" - - LATEST_URL=$(curl -s https://api.github.com/repos/primeZdev/ov-node/releases/latest \ - | grep "tarball_url" \ - | cut -d '"' -f 4) + echo -e "${YELLOW}Cloning repository...${NC}" + git clone "$REPO_URL" "$INSTALL_DIR" +else + echo -e "${GREEN}Directory exists, removing before cloning...${NC}" + rm -rf "$INSTALL_DIR" + git clone "$REPO_URL" "$INSTALL_DIR" +fi - mkdir -p "$INSTALL_DIR" - cd /tmp +cd "$INSTALL_DIR" - wget -O latest.tar.gz "$LATEST_URL" +echo -e "${YELLOW}Creating Python virtual environment...${NC}" +if [ ! -d "$VENV_DIR" ]; then + $PYTHON -m venv "$VENV_DIR" +fi - echo -e "${YELLOW}Extracting...${NC}" - tar -xzf latest.tar.gz -C "$INSTALL_DIR" --strip-components=1 - rm -f latest.tar.gz +echo -e "${YELLOW}Installing dependencies in virtual environment...${NC}" +"$VENV_DIR/bin/pip" install --upgrade pip +if [ -f "$INSTALL_DIR/requirements.txt" ]; then + "$VENV_DIR/bin/pip" install -r "$INSTALL_DIR/requirements.txt" else - echo -e "${GREEN}Directory exists, skipping download.${NC}" + echo -e "${YELLOW}requirements.txt not found, installing basic dependencies...${NC}" + "$VENV_DIR/bin/pip" install fastapi uvicorn psutil pydantic_settings python-dotenv colorama pexpect requests fi -cd "$INSTALL_DIR" -$PYTHON installer.py +echo -e "${YELLOW}Running installer...${NC}" +"$VENV_DIR/bin/python" installer.py diff --git a/installer.py b/installer.py index bd798e2..843cda1 100644 --- a/installer.py +++ b/installer.py @@ -9,35 +9,38 @@ def install_ovnode(): try: + # Get the current script directory + script_dir = os.path.dirname(os.path.abspath(__file__)) + project_ovpn_script = os.path.join(script_dir, "openvpn-install.sh") + target_ovpn_script = "/root/openvpn-install.sh" + + # Copy openvpn-install.sh from current directory to /root/ + if os.path.exists(project_ovpn_script): + print("Using openvpn-install.sh from project directory...") + shutil.copy(project_ovpn_script, target_ovpn_script) + # Make sure the script is executable + os.chmod(target_ovpn_script, 0o755) + else: + print("openvpn-install.sh not found in project, downloading...") + subprocess.run( + ["wget", "https://git.io/vpn", "-O", target_ovpn_script], check=True + ) + + # Run the OpenVPN installer script (now with automated defaults) + print("Running OpenVPN installer...") subprocess.run( - ["wget", "https://git.io/vpn", "-O", "/root/openvpn-install.sh"], check=True - ) # thanks to Nyr for ovpn installation script <3 https://github.com/Nyr/openvpn-install - - bash = pexpect.spawn( - "/usr/bin/bash", ["/root/openvpn-install.sh"], encoding="utf-8", timeout=180 + ["/usr/bin/bash", target_ovpn_script], + check=True ) - print("Running OpenVPN installer...") - - prompts = [ - (r"Which IPv4 address should be used.*:", "1"), - (r"Protocol.*:", "2"), - (r"Port.*:", "1194"), - (r"Select a DNS server for the clients.*:", "1"), - (r"Enter a name for the first client.*:", "first_client"), - (r"Press any key to continue...", ""), - ] - - for pattern, reply in prompts: - try: - bash.expect(pattern, timeout=10) - bash.sendline(reply) - except pexpect.TIMEOUT: - pass - bash.expect(pexpect.EOF, timeout=None) - bash.close() - - shutil.copy(".env.example", ".env") + # Copy .env.example to .env in the current directory + env_example = os.path.join(script_dir, ".env.example") + env_file = os.path.join(script_dir, ".env") + + if os.path.exists(env_example): + shutil.copy(env_example, env_file) + else: + print("Warning: .env.example not found") # OV-Node configuration prompts example_uuid = str(uuid4()) @@ -50,14 +53,14 @@ def install_ovnode(): } lines = [] - with open(".env", "r") as f: + with open(env_file, "r") as f: for line in f: for key, value in replacements.items(): if line.startswith(f"{key}="): line = f"{key}={value}\n" lines.append(line) - with open(".env", "w") as f: + with open(env_file, "w") as f: f.writelines(lines) run_ovnode() @@ -72,40 +75,60 @@ def install_ovnode(): def update_ovnode(): try: - repo = "https://api.github.com/repos/primeZdev/ov-node/releases/latest" install_dir = "/opt/ov-node" + venv_dir = os.path.join(install_dir, "venv") env_file = os.path.join(install_dir, ".env") backup_env = "/tmp/ovnode_env_backup" - response = requests.get(repo) - response.raise_for_status() - release = response.json() - - download_url = release["tarball_url"] - filename = "/tmp/ov-node-latest.tar.gz" - - print(Fore.YELLOW + f"Downloading {download_url}" + Style.RESET_ALL) - subprocess.run(["wget", "-O", filename, download_url], check=True) - + # Backup .env file if os.path.exists(env_file): shutil.copy2(env_file, backup_env) + # Check if directory exists and is a git repository if os.path.exists(install_dir): - shutil.rmtree(install_dir) - - os.makedirs(install_dir, exist_ok=True) - - subprocess.run( - ["tar", "-xzf", filename, "-C", install_dir, "--strip-components=1"], - check=True, - ) - + os.chdir(install_dir) + if os.path.exists(os.path.join(install_dir, ".git")): + print(Fore.YELLOW + "Pulling latest changes from repository..." + Style.RESET_ALL) + subprocess.run(["git", "fetch", "--all"], check=True) + subprocess.run(["git", "reset", "--hard", "origin/main"], check=True) + subprocess.run(["git", "pull", "origin", "main"], check=True) + else: + # If not a git repo, clone it + print(Fore.YELLOW + "Cloning repository..." + Style.RESET_ALL) + shutil.rmtree(install_dir) + subprocess.run( + ["git", "clone", "https://github.com/primeZdev/ov-node.git", install_dir], + check=True + ) + os.chdir(install_dir) + else: + # Directory doesn't exist, clone it + print(Fore.YELLOW + "Cloning repository..." + Style.RESET_ALL) + subprocess.run( + ["git", "clone", "https://github.com/primeZdev/ov-node.git", install_dir], + check=True + ) + os.chdir(install_dir) + + # Restore .env file if os.path.exists(backup_env): shutil.move(backup_env, env_file) + print(Fore.YELLOW + "Creating virtual environment..." + Style.RESET_ALL) + if not os.path.exists(venv_dir): + subprocess.run(["/usr/bin/python3", "-m", "venv", venv_dir], check=True) + print(Fore.YELLOW + "Installing requirements..." + Style.RESET_ALL) - os.chdir(install_dir) - subprocess.run(["pip", "install", "-r", "requirements.txt"], check=True) + pip_path = os.path.join(venv_dir, "bin", "pip") + subprocess.run([pip_path, "install", "--upgrade", "pip"], check=True) + + requirements_file = os.path.join(install_dir, "requirements.txt") + if os.path.exists(requirements_file): + subprocess.run([pip_path, "install", "-r", requirements_file], check=True) + else: + print(Fore.YELLOW + "requirements.txt not found, installing basic dependencies..." + Style.RESET_ALL) + subprocess.run([pip_path, "install", "fastapi", "uvicorn", "psutil", "pydantic_settings", + "python-dotenv", "colorama", "pexpect", "requests"], check=True) subprocess.run(["systemctl", "restart", "ov-node"], check=True) @@ -115,6 +138,8 @@ def update_ovnode(): except Exception as e: print(Fore.RED + f"Update failed: {e}" + Style.RESET_ALL) + input("Press Enter to return to the menu...") + menu() def uninstall_ovnode(): @@ -165,10 +190,10 @@ def run_ovnode() -> None: [Service] User=root WorkingDirectory=/opt/ov-node/core -ExecStart=/usr/bin/python3 app.py +ExecStart=/opt/ov-node/venv/bin/python app.py Restart=always RestartSec=5 -Environment="PATH=/usr/local/bin:/usr/bin:/bin" +Environment="PATH=/opt/ov-node/venv/bin:/usr/local/bin:/usr/bin:/bin" [Install] WantedBy=multi-user.target diff --git a/openvpn-install.sh b/openvpn-install.sh new file mode 100644 index 0000000..0ab0dec --- /dev/null +++ b/openvpn-install.sh @@ -0,0 +1,509 @@ +#!/bin/bash +# +# https://github.com/Nyr/openvpn-install +# +# Copyright (c) 2013 Nyr. Released under the MIT License. + + +# Detect Debian users running the script with "sh" instead of bash +if readlink /proc/$$/exe | grep -q "dash"; then + echo 'This installer needs to be run with "bash", not "sh".' + exit +fi + +# Discard stdin. Needed when running from a one-liner which includes a newline +read -N 999999 -t 0.001 + +# Detect OS +# $os_version variables aren't always in use, but are kept here for convenience +if grep -qs "ubuntu" /etc/os-release; then + os="ubuntu" + os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.') + group_name="nogroup" +elif [[ -e /etc/debian_version ]]; then + os="debian" + os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1) + group_name="nogroup" +elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then + os="centos" + os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1) + group_name="nobody" +elif [[ -e /etc/fedora-release ]]; then + os="fedora" + os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1) + group_name="nobody" +else + echo "This installer seems to be running on an unsupported distribution. +Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora." + exit +fi + +if [[ "$os" == "ubuntu" && "$os_version" -lt 2204 ]]; then + echo "Ubuntu 22.04 or higher is required to use this installer. +This version of Ubuntu is too old and unsupported." + exit +fi + +if [[ "$os" == "debian" ]]; then + if grep -q '/sid' /etc/debian_version; then + echo "Debian Testing and Debian Unstable are unsupported by this installer." + exit + fi + if [[ "$os_version" -lt 11 ]]; then + echo "Debian 11 or higher is required to use this installer. +This version of Debian is too old and unsupported." + exit + fi +fi + +if [[ "$os" == "centos" && "$os_version" -lt 9 ]]; then + os_name=$(sed 's/ release.*//' /etc/almalinux-release /etc/rocky-release /etc/centos-release 2>/dev/null | head -1) + echo "$os_name 9 or higher is required to use this installer. +This version of $os_name is too old and unsupported." + exit +fi + +# Detect environments where $PATH does not include the sbin directories +if ! grep -q sbin <<< "$PATH"; then + echo '$PATH does not include sbin. Try using "su -" instead of "su".' + exit +fi + +if [[ "$EUID" -ne 0 ]]; then + echo "This installer needs to be run with superuser privileges." + exit +fi + +if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then + echo "The system does not have the TUN device available. +TUN needs to be enabled before running this installer." + exit +fi + +# Store the absolute path of the directory where the script is located +script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" + +if [[ ! -e /etc/openvpn/server/server.conf ]]; then + # Detect some Debian minimal setups where neither wget nor curl are installed + if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then + echo "Wget is required to use this installer." + echo "Installing Wget..." + apt-get update + apt-get install -y wget + fi + clear + echo 'Welcome to this OpenVPN road warrior installer!' + # If system has a single IPv4, it is selected automatically. Else, use the first one + if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then + ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}') + else + # Automatically select the first IPv4 address + ip_number="1" + ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p) + echo "Using IPv4 address: $ip" + fi + # If $ip is a private IP address, the server must be behind NAT + if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then + # Get public IP automatically + get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")") + public_ip="$get_public_ip" + echo "Using public IPv4 address: $public_ip" + fi + # If system has a single IPv6, it is selected automatically + if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then + ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}') + fi + # If system has multiple IPv6, use the first one + if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then + ip6_number="1" + ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p) + echo "Using IPv6 address: $ip6" + fi + # Automatically use UDP protocol (option 2) + protocol=udp + echo "Using protocol: UDP" + # Automatically use port 1194 + port="1194" + echo "Using port: $port" + # Automatically use default system resolvers (option 1) + dns="1" + echo "Using DNS server: Default system resolvers" + # Automatically use "first_client" as the client name + unsanitized_client="first_client" + # Allow a limited set of characters to avoid conflicts + client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client") + [[ -z "$client" ]] && client="client" + echo "Using client name: $client" + echo + echo "OpenVPN installation is ready to begin." + # Install a firewall if firewalld or iptables are not already available + if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then + if [[ "$os" == "centos" || "$os" == "fedora" ]]; then + firewall="firewalld" + # We don't want to silently enable firewalld, so we give a subtle warning + # If the user continues, firewalld will be installed and enabled during setup + echo "firewalld, which is required to manage routing tables, will also be installed." + elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then + # iptables is way less invasive than firewalld so no warning is given + firewall="iptables" + fi + fi + # Automatically continue without waiting for user input + echo "Continuing with installation..." + # If running inside a container, disable LimitNPROC to prevent conflicts + if systemd-detect-virt -cq; then + mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null + echo "[Service] +LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf + fi + if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then + apt-get update + apt-get install -y --no-install-recommends openvpn openssl ca-certificates $firewall + elif [[ "$os" = "centos" ]]; then + dnf install -y epel-release + dnf install -y openvpn openssl ca-certificates tar $firewall + else + # Else, OS must be Fedora + dnf install -y openvpn openssl ca-certificates tar $firewall + fi + # If firewalld was just installed, enable it + if [[ "$firewall" == "firewalld" ]]; then + systemctl enable --now firewalld.service + fi + # Get easy-rsa + easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.2.4/EasyRSA-3.2.4.tgz' + mkdir -p /etc/openvpn/server/easy-rsa/ + { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1 + chown -R root:root /etc/openvpn/server/easy-rsa/ + cd /etc/openvpn/server/easy-rsa/ + # Create the PKI, set up the CA and create TLS key + ./easyrsa --batch init-pki + ./easyrsa --batch build-ca nopass + ./easyrsa gen-tls-crypt-key + # Create the DH parameters file using the predefined ffdhe2048 group + echo '-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== +-----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem + # Make easy-rsa aware of our external DH file (prevents a warning) + ln -s /etc/openvpn/server/dh.pem pki/dh.pem + # Create certificates and CRL + ./easyrsa --batch --days=3650 build-server-full server nopass + ./easyrsa --batch --days=3650 build-client-full "$client" nopass + ./easyrsa --batch --days=3650 gen-crl + # Move the stuff we need + cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server + cp pki/private/easyrsa-tls.key /etc/openvpn/server/tc.key + # CRL is read with each client connection, while OpenVPN is dropped to nobody + chown nobody:"$group_name" /etc/openvpn/server/crl.pem + # Without +x in the directory, OpenVPN can't run a stat() on the CRL file + chmod o+x /etc/openvpn/server/ + # Generate server.conf + echo "local $ip +port $port +proto $protocol +dev tun +ca ca.crt +cert server.crt +key server.key +dh dh.pem +auth SHA512 +tls-crypt tc.key +topology subnet +server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf + # IPv6 + if [[ -z "$ip6" ]]; then + echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf + else + echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf + echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf + fi + echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf + # DNS + case "$dns" in + 1|"") + # Locate the proper resolv.conf + # Needed for systems running systemd-resolved + if grep '^nameserver' "/etc/resolv.conf" | grep -qv '127.0.0.53' ; then + resolv_conf="/etc/resolv.conf" + else + resolv_conf="/run/systemd/resolve/resolv.conf" + fi + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -v '127.0.0.53' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf + done + ;; + 2) + echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf + echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf + ;; + 3) + echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf + echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf + ;; + 4) + echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf + echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf + ;; + 5) + echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf + echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf + ;; + 6) + echo 'push "dhcp-option DNS 95.85.95.85"' >> /etc/openvpn/server/server.conf + echo 'push "dhcp-option DNS 2.56.220.2"' >> /etc/openvpn/server/server.conf + ;; + 7) + echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf + echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf + ;; + 8) + for dns_ip in $custom_dns; do + echo "push \"dhcp-option DNS $dns_ip\"" >> /etc/openvpn/server/server.conf + done + ;; + esac + echo 'push "block-outside-dns"' >> /etc/openvpn/server/server.conf + echo "keepalive 10 120 +user nobody +group $group_name +persist-key +persist-tun +verb 3 +crl-verify crl.pem" >> /etc/openvpn/server/server.conf + if [[ "$protocol" = "udp" ]]; then + echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf + fi + # Enable net.ipv4.ip_forward for the system + echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf + # Enable without waiting for a reboot or service restart + echo 1 > /proc/sys/net/ipv4/ip_forward + if [[ -n "$ip6" ]]; then + # Enable net.ipv6.conf.all.forwarding for the system + echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf + # Enable without waiting for a reboot or service restart + echo 1 > /proc/sys/net/ipv6/conf/all/forwarding + fi + if systemctl is-active --quiet firewalld.service; then + # Using both permanent and not permanent rules to avoid a firewalld + # reload. + # We don't use --add-service=openvpn because that would only work with + # the default port and protocol. + firewall-cmd --add-port="$port"/"$protocol" + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --add-port="$port"/"$protocol" + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 + # Set NAT for the VPN subnet + firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" + firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" + if [[ -n "$ip6" ]]; then + firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64 + firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64 + firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + fi + else + # Create a service to set up persistent iptables rules + iptables_path=$(command -v iptables) + ip6tables_path=$(command -v ip6tables) + # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy + # if we are in OVZ, with a nf_tables backend and iptables-legacy is available. + if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then + iptables_path=$(command -v iptables-legacy) + ip6tables_path=$(command -v ip6tables-legacy) + fi + echo "[Unit] +After=network-online.target +Wants=network-online.target +[Service] +Type=oneshot +ExecStart=$iptables_path -w 5 -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip +ExecStart=$iptables_path -w 5 -I INPUT -p $protocol --dport $port -j ACCEPT +ExecStart=$iptables_path -w 5 -I FORWARD -s 10.8.0.0/24 -j ACCEPT +ExecStart=$iptables_path -w 5 -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT +ExecStop=$iptables_path -w 5 -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip +ExecStop=$iptables_path -w 5 -D INPUT -p $protocol --dport $port -j ACCEPT +ExecStop=$iptables_path -w 5 -D FORWARD -s 10.8.0.0/24 -j ACCEPT +ExecStop=$iptables_path -w 5 -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service + if [[ -n "$ip6" ]]; then + echo "ExecStart=$ip6tables_path -w 5 -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6 +ExecStart=$ip6tables_path -w 5 -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT +ExecStart=$ip6tables_path -w 5 -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT +ExecStop=$ip6tables_path -w 5 -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6 +ExecStop=$ip6tables_path -w 5 -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT +ExecStop=$ip6tables_path -w 5 -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service + fi + echo "RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service + systemctl enable --now openvpn-iptables.service + fi + # If SELinux is enabled and a custom port was selected, we need this + if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then + # Install semanage if not already present + if ! hash semanage 2>/dev/null; then + dnf install -y policycoreutils-python-utils + fi + semanage port -a -t openvpn_port_t -p "$protocol" "$port" + fi + # If the server is behind NAT, use the correct IP address + [[ -n "$public_ip" ]] && ip="$public_ip" + # client-common.txt is created so we have a template to add further users later + echo "client +dev tun +proto $protocol +remote $ip $port +resolv-retry infinite +nobind +persist-key +persist-tun +remote-cert-tls server +auth SHA512 +ignore-unknown-option block-outside-dns +verb 3" > /etc/openvpn/server/client-common.txt + # Enable and start the OpenVPN service + systemctl enable --now openvpn-server@server.service + # Build the $client.ovpn file, stripping comments from easy-rsa in the process + grep -vh '^#' /etc/openvpn/server/client-common.txt /etc/openvpn/server/easy-rsa/pki/inline/private/"$client".inline > "$script_dir"/"$client".ovpn + echo + echo "Finished!" + echo + echo "The client configuration is available in:" "$script_dir"/"$client.ovpn" + echo "New clients can be added by running this script again." +else + clear + echo "OpenVPN is already installed." + echo + echo "Select an option:" + echo " 1) Add a new client" + echo " 2) Revoke an existing client" + echo " 3) Remove OpenVPN" + echo " 4) Exit" + read -p "Option: " option + until [[ "$option" =~ ^[1-4]$ ]]; do + echo "$option: invalid selection." + read -p "Option: " option + done + case "$option" in + 1) + echo + echo "Provide a name for the client:" + read -p "Name: " unsanitized_client + client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client") + while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do + echo "$client: invalid name." + read -p "Name: " unsanitized_client + client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client") + done + cd /etc/openvpn/server/easy-rsa/ + ./easyrsa --batch --days=3650 build-client-full "$client" nopass + # Build the $client.ovpn file, stripping comments from easy-rsa in the process + grep -vh '^#' /etc/openvpn/server/client-common.txt /etc/openvpn/server/easy-rsa/pki/inline/private/"$client".inline > "$script_dir"/"$client".ovpn + echo + echo "$client added. Configuration available in:" "$script_dir"/"$client.ovpn" + exit + ;; + 2) + # This option could be documented a bit better and maybe even be simplified + # ...but what can I say, I want some sleep too + number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V") + if [[ "$number_of_clients" = 0 ]]; then + echo + echo "There are no existing clients!" + exit + fi + echo + echo "Select the client to revoke:" + tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' + read -p "Client: " client_number + until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do + echo "$client_number: invalid selection." + read -p "Client: " client_number + done + client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p) + echo + read -p "Confirm $client revocation? [y/N]: " revoke + until [[ "$revoke" =~ ^[yYnN]*$ ]]; do + echo "$revoke: invalid selection." + read -p "Confirm $client revocation? [y/N]: " revoke + done + if [[ "$revoke" =~ ^[yY]$ ]]; then + cd /etc/openvpn/server/easy-rsa/ + ./easyrsa --batch revoke "$client" + ./easyrsa --batch --days=3650 gen-crl + rm -f /etc/openvpn/server/crl.pem + rm -f /etc/openvpn/server/easy-rsa/pki/reqs/"$client".req + rm -f /etc/openvpn/server/easy-rsa/pki/private/"$client".key + cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem + # CRL is read with each client connection, when OpenVPN is dropped to nobody + chown nobody:"$group_name" /etc/openvpn/server/crl.pem + echo + echo "$client revoked!" + else + echo + echo "$client revocation aborted!" + fi + exit + ;; + 3) + echo + read -p "Confirm OpenVPN removal? [y/N]: " remove + until [[ "$remove" =~ ^[yYnN]*$ ]]; do + echo "$remove: invalid selection." + read -p "Confirm OpenVPN removal? [y/N]: " remove + done + if [[ "$remove" =~ ^[yY]$ ]]; then + port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2) + protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2) + if systemctl is-active --quiet firewalld.service; then + ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$') + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --remove-port="$port"/"$protocol" + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --remove-port="$port"/"$protocol" + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" + firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" + if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then + ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$') + firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64 + firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64 + firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + fi + else + systemctl disable --now openvpn-iptables.service + rm -f /etc/systemd/system/openvpn-iptables.service + fi + if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then + semanage port -d -t openvpn_port_t -p "$protocol" "$port" + fi + systemctl disable --now openvpn-server@server.service + rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf + rm -f /etc/sysctl.d/99-openvpn-forward.conf + if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then + rm -rf /etc/openvpn/server + apt-get remove --purge -y openvpn + else + # Else, OS must be CentOS or Fedora + dnf remove -y openvpn + rm -rf /etc/openvpn/server + fi + echo + echo "OpenVPN removed!" + else + echo + echo "OpenVPN removal aborted!" + fi + exit + ;; + 4) + exit + ;; + esac +fi \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 54293ef..09ba846 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,5 +5,4 @@ pydantic_settings python-dotenv==1.1.0 colorama pexpect -requests -uuid \ No newline at end of file +requests \ No newline at end of file