2021-03-17 04:23:04 -04:00
# ovpn-admin
2021-02-26 07:11:13 -05:00
2021-03-17 05:33:46 -04:00
Simple web UI to manage OpenVPN users, their certificates & routes in Linux. While backend is written in Go, frontend is based on Vue.js.
2021-03-17 05:27:08 -04:00
2021-03-26 04:04:34 -04:00
Originally created in [Flant ](https://flant.com/ ) for internal needs & used for years, then updated to be more modern and [publicly released ](https://blog.flant.com/introducing-ovpn-admin-web-interface-for-openvpn/ ) in March'21. Your contributions are welcome!
2021-11-10 23:12:10 -05:00
***DISCLAIMER!** This project was created for experienced users (system administrators) and private (e.g., protected by network policies) environments only. Thus, it is not implemented with security in mind (e.g., it doesn't strictly check all parameters passed by users, etc.). It also relies heavily on files and fails if required files aren't available.*
2021-03-17 05:27:08 -04:00
## Features
2021-03-17 05:53:00 -04:00
* Adding OpenVPN users (generating certificates for them);
2021-03-17 05:27:08 -04:00
* Revoking/restoring users certificates;
* Generating ready-to-user config files;
2021-03-17 05:53:00 -04:00
* Providing metrics for Prometheus, including certificates expiration date, number of (connected/total) users, information about connected users;
2021-03-17 05:27:08 -04:00
* (optionally) Specifying CCD (`client-config-dir`) for each user;
* (optionally) Operating in a master/slave mode (syncing certs & CCD with other server);
2021-10-22 00:26:09 -04:00
* (optionally) Specifying/changing password for additional authorization in OpenVPN;
* (optionally) Specifying the Kubernetes LoadBalancer if it's used in front of the OpenVPN server (to get an automatically defined `remote` in the `client.conf.tpl` template).
2022-01-20 11:42:36 -05:00
* (optionally) Storing certificates and other files in Kubernetes Secrets (**Attention, this feature is experimental!**).
2021-02-26 07:11:13 -05:00
2021-03-17 05:50:43 -04:00
### Screenshots
Managing users in ovpn-admin:
![ovpn-admin UI ](https://raw.githubusercontent.com/flant/ovpn-admin/master/img/ovpn-admin-users.png )
An example of dashboard made using ovpn-admin metrics:
![ovpn-admin metrics ](https://raw.githubusercontent.com/flant/ovpn-admin/master/img/ovpn-admin-metrics.png )
2021-03-17 05:33:46 -04:00
## Installation
2021-02-26 07:11:13 -05:00
2021-03-17 05:27:08 -04:00
### Disclaimer
2021-02-26 07:25:10 -05:00
2021-04-22 04:42:57 -04:00
This tool uses external calls for `bash` , `coreutils` and `easy-rsa` , thus **Linux systems only are supported** at the moment.
2021-02-26 07:11:13 -05:00
2021-03-17 05:30:12 -04:00
### 1. Docker
2021-02-26 07:11:13 -05:00
2021-03-17 05:27:08 -04:00
There is a ready-to-use [docker-compose.yaml ](https://github.com/flant/ovpn-admin/blob/master/docker-compose.yaml ), so you can just change/add values you need and start it with [start.sh ](https://github.com/flant/ovpn-admin/blob/master/start.sh ).
2021-02-26 07:11:13 -05:00
2021-03-17 05:27:08 -04:00
Requirements. You need [Docker ](https://docs.docker.com/get-docker/ ) and [docker-compose ](https://docs.docker.com/compose/install/ ) installed.
Commands to execute:
2021-02-26 07:11:13 -05:00
```bash
2021-03-17 04:23:04 -04:00
git clone https://github.com/flant/ovpn-admin.git
cd ovpn-admin
2021-03-17 05:27:08 -04:00
./start.sh
2021-02-26 07:11:13 -05:00
```
2021-03-17 05:30:12 -04:00
### 2. Building from source
2021-02-26 07:11:13 -05:00
2021-03-17 05:27:08 -04:00
Requirements. You need Linux with the following components installed:
- [golang ](https://golang.org/doc/install )
- [packr2 ](https://github.com/gobuffalo/packr#installation )
- [nodejs/npm ](https://nodejs.org/en/download/package-manager/ )
2021-02-26 07:11:13 -05:00
2021-03-17 05:27:08 -04:00
Commands to execute:
2021-02-26 07:11:13 -05:00
```bash
2021-03-17 04:23:04 -04:00
git clone https://github.com/flant/ovpn-admin.git
cd ovpn-admin
2021-03-17 05:27:08 -04:00
./bootstrap.sh
./build.sh
2021-03-17 05:30:12 -04:00
./ovpn-admin
2021-02-26 07:11:13 -05:00
```
2021-10-20 02:37:10 -04:00
(Please don't forget to configure all needed params in advance.)
2021-03-17 05:27:08 -04:00
2022-07-21 11:17:53 -04:00
### 3. Prebuilt binary
2021-03-17 05:27:08 -04:00
2021-10-05 11:09:29 -04:00
You can also download and use prebuilt binaries from the [releases ](https://github.com/flant/ovpn-admin/releases ) page — just choose a relevant tar.gz file.
2021-02-26 07:11:13 -05:00
2022-07-21 11:17:53 -04:00
## Notes
2021-10-22 00:26:09 -04:00
To use password authentication (the `--auth` flag) you have to install [openvpn-user ](https://github.com/pashcovich/openvpn-user/releases ). This tool should be available in your `$PATH` and its binary should be executable (`+x`).
2021-10-21 06:01:03 -04:00
2021-02-26 07:11:13 -05:00
## Usage
2020-11-19 12:08:55 -05:00
```
2021-03-17 04:23:04 -04:00
usage: ovpn-admin [< flags > ]
2020-11-19 12:08:55 -05:00
Flags:
2021-10-22 00:26:09 -04:00
--help show context-sensitive help (try also --help-long and --help-man)
2021-03-17 04:23:04 -04:00
--listen.host="0.0.0.0" host for ovpn-admin
2022-07-21 11:17:53 -04:00
(or OVPN_LISTEN_HOST)
2021-10-22 00:26:09 -04:00
2021-03-17 04:23:04 -04:00
--listen.port="8080" port for ovpn-admin
2022-07-21 11:17:53 -04:00
(or OVPN_LISTEN_PROT)
2021-10-22 00:26:09 -04:00
--role="master" server role, master or slave
2022-07-21 11:17:53 -04:00
(or OVPN_ROLE)
2021-10-22 00:26:09 -04:00
2021-02-20 08:40:14 -05:00
--master.host="http://127.0.0.1"
2022-07-21 11:17:53 -04:00
(or OVPN_MASTER_HOST) URL for the master server
2021-10-22 00:26:09 -04:00
2021-10-22 00:35:16 -04:00
--master.basic-auth.user="" user for master server's Basic Auth
2022-07-21 11:17:53 -04:00
(or OVPN_MASTER_USER)
2021-10-22 00:26:09 -04:00
2021-02-20 08:40:14 -05:00
--master.basic-auth.password=""
2022-07-21 11:17:53 -04:00
(or OVPN_MASTER_PASSWORD) password for master server's Basic Auth
2021-10-22 00:26:09 -04:00
--master.sync-frequency=600 master host data sync frequency in seconds
2022-07-21 11:17:53 -04:00
(or OVPN_MASTER_SYNC_FREQUENCY)
2021-10-22 00:26:09 -04:00
2021-02-26 07:11:13 -05:00
--master.sync-token=TOKEN master host data sync security token
2022-07-21 11:17:53 -04:00
(or OVPN_MASTER_TOKEN)
2021-10-22 00:26:09 -04:00
2021-02-20 08:40:14 -05:00
--ovpn.network="172.16.100.0/24"
2022-07-21 11:17:53 -04:00
(or OVPN_NETWORK) NETWORK/MASK_PREFIX for OpenVPN server
2021-10-22 00:26:09 -04:00
2021-02-26 07:11:13 -05:00
--ovpn.server=HOST:PORT:PROTOCOL ...
2022-07-21 11:17:53 -04:00
(or OVPN_SERVER) HOST:PORT:PROTOCOL for OpenVPN server
2021-10-22 00:26:09 -04:00
can have multiple values
--ovpn.server.behindLB enable if your OpenVPN server is behind Kubernetes
2022-07-21 11:17:53 -04:00
(or OVPN_LB) Service having the LoadBalancer type
2021-10-22 00:26:09 -04:00
2021-10-05 11:09:29 -04:00
--ovpn.service="openvpn-external"
2022-07-21 11:17:53 -04:00
(or OVPN_LB_SERVICE) the name of Kubernetes Service having the LoadBalancer
2021-10-22 00:26:09 -04:00
type if your OpenVPN server is behind it
2021-02-20 08:40:14 -05:00
--mgmt=main=127.0.0.1:8989 ...
2022-07-21 11:17:53 -04:00
(or OVPN_MGMT) ALIAS=HOST:PORT for OpenVPN server mgmt interface;
2021-10-22 00:26:09 -04:00
can have multiple values
--metrics.path="/metrics" URL path for exposing collected metrics
2022-07-21 11:17:53 -04:00
(or OVPN_METRICS_PATH)
2021-10-22 00:26:09 -04:00
2021-02-26 07:11:13 -05:00
--easyrsa.path="./easyrsa/" path to easyrsa dir
2022-07-21 11:17:53 -04:00
(or EASYRSA_PATH)
2021-10-22 00:26:09 -04:00
2021-02-26 07:11:13 -05:00
--easyrsa.index-path="./easyrsa/pki/index.txt"
2022-07-21 11:17:53 -04:00
(or OVPN_INDEX_PATH) path to easyrsa index file
2021-10-22 00:26:09 -04:00
--ccd enable client-config-dir
2022-07-21 11:17:53 -04:00
(or OVPN_CCD)
2021-10-22 00:26:09 -04:00
2021-02-26 07:11:13 -05:00
--ccd.path="./ccd" path to client-config-dir
2022-07-21 11:17:53 -04:00
(or OVPN_CCD_PATH)
2021-10-22 00:26:09 -04:00
2021-10-21 06:01:03 -04:00
--templates.clientconfig-path=""
2022-07-21 11:17:53 -04:00
(or OVPN_TEMPLATES_CC_PATH) path to custom client.conf.tpl
2021-10-22 00:26:09 -04:00
2021-10-21 06:01:03 -04:00
--templates.ccd-path="" path to custom ccd.tpl
2022-07-21 11:17:53 -04:00
(or OVPN_TEMPLATES_CCD_PATH)
2021-10-22 00:26:09 -04:00
--auth.password enable additional password authorization
2022-07-21 11:17:53 -04:00
(or OVPN_AUTH)
2021-10-22 00:26:09 -04:00
--auth.db="./easyrsa/pki/users.db"
2022-07-21 11:17:53 -04:00
(or OVPN_AUTH_DB_PATH) database path for password authorization
2021-10-22 00:26:09 -04:00
--debug enable debug mode
2022-07-21 11:17:53 -04:00
(or OVPN_DEBUG)
2021-10-22 00:26:09 -04:00
--verbose enable verbose mode
2022-07-21 11:17:53 -04:00
(or OVPN_VERBOSE)
2022-01-20 11:42:36 -05:00
--log.level set log level: trace, debug, info, warn, error (default info)
2022-07-21 11:17:53 -04:00
(or LOG_LEVEL)
2022-01-20 11:42:36 -05:00
--log.format set log format: text, json (default text)
2022-07-21 11:17:53 -04:00
(or LOG_FORMAT)
2022-01-20 11:42:36 -05:00
--storage.backend storage backend: filesystem, kubernetes.secrets (default filesystem)
2022-07-21 11:17:53 -04:00
(or STORAGE_BACKEND)
2021-10-22 00:26:09 -04:00
--version show application version
2021-03-17 04:23:04 -04:00
```
2021-03-17 05:27:08 -04:00
## Further information
Please feel free to use [issues ](https://github.com/flant/ovpn-admin/issues ) and [discussions ](https://github.com/flant/ovpn-admin/discussions ) to get help from maintainers & community.