2020-11-17 12:48:26 -05:00
|
|
|
#!/usr/bin/env bash
|
2020-10-29 06:50:19 -04:00
|
|
|
set -x
|
2020-11-17 12:48:26 -05:00
|
|
|
|
2020-10-15 12:12:31 -04:00
|
|
|
EASY_RSA_LOC="/etc/openvpn/easyrsa"
|
|
|
|
|
SERVER_CERT="${EASY_RSA_LOC}/pki/issued/server.crt"
|
|
|
|
|
cd $EASY_RSA_LOC
|
|
|
|
|
if [ -e "$SERVER_CERT" ]; then
|
2020-11-17 12:48:26 -05:00
|
|
|
echo "Found existing certs - reusing"
|
2020-10-15 12:12:31 -04:00
|
|
|
else
|
2020-11-17 12:48:26 -05:00
|
|
|
if [ ${OPVN_ROLE:-"master"} = "slave" ]; then
|
2020-11-19 12:08:55 -05:00
|
|
|
echo "Waiting for initial sync data from master"
|
|
|
|
|
while [ $(wget -q localhost/api/sync/last/try -O - | wc -m) -lt 1 ]
|
2020-11-17 12:48:26 -05:00
|
|
|
do
|
|
|
|
|
sleep 5
|
|
|
|
|
done
|
|
|
|
|
else
|
|
|
|
|
echo "Generating new certs"
|
|
|
|
|
easyrsa init-pki
|
|
|
|
|
cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC/pki
|
|
|
|
|
echo "ca" | easyrsa build-ca nopass
|
|
|
|
|
easyrsa build-server-full server nopass
|
|
|
|
|
easyrsa gen-dh
|
|
|
|
|
openvpn --genkey --secret ./pki/ta.key
|
|
|
|
|
fi
|
2020-10-15 12:12:31 -04:00
|
|
|
fi
|
|
|
|
|
easyrsa gen-crl
|
|
|
|
|
|
|
|
|
|
iptables -t nat -A POSTROUTING -s 172.16.100.0/255.255.255.0 ! -d 172.16.100.0/255.255.255.0 -j MASQUERADE
|
|
|
|
|
|
|
|
|
|
mkdir -p /dev/net
|
|
|
|
|
if [ ! -c /dev/net/tun ]; then
|
|
|
|
|
mknod /dev/net/tun c 10 200
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
cp -f /etc/openvpn/setup/openvpn.conf /etc/openvpn/openvpn.conf
|
|
|
|
|
|
2020-11-02 11:30:36 -05:00
|
|
|
[ -d $EASY_RSA_LOC/pki ] && chmod 755 $EASY_RSA_LOC/pki
|
|
|
|
|
[ -f $EASY_RSA_LOC/pki/crl.pem ] && chmod 644 $EASY_RSA_LOC/pki/crl.pem
|
2020-10-15 12:12:31 -04:00
|
|
|
|
2020-10-29 06:50:19 -04:00
|
|
|
mkdir -p /etc/openvpn/ccd
|
|
|
|
|
|
2020-10-15 12:12:31 -04:00
|
|
|
openvpn --config /etc/openvpn/openvpn.conf --client-config-dir /etc/openvpn/ccd
|
|
|
|
|
|
