20 lines
817 B
Plaintext
20 lines
817 B
Plaintext
|
#!/usr/bin/env bash
|
||
|
|
if [ -z "$( ls -A '/opt/data/openvpn' )" ] || [ "${EASY_RSA_REGEN}" == "true" ]; then
|
||
|
|
rm -rf /opt/data/openvpn/*
|
||
|
|
# -- It should prepare certs with easy-rsa
|
||
|
|
/usr/share/easy-rsa/easyrsa init-pki
|
||
|
|
# -- Currently only no password
|
||
|
|
/usr/share/easy-rsa/easyrsa build-ca nopass
|
||
|
|
/usr/share/easy-rsa/easyrsa gen-dh
|
||
|
|
`unset EASYRSA_REQ_CN && /usr/share/easy-rsa/easyrsa build-server-full server nopass`
|
||
|
|
# -- Generate the CRL for client/server certificates revocation.
|
||
|
|
/usr/share/easy-rsa/easyrsa gen-crl
|
||
|
|
openvpn --genkey tls-crypt-v2-server "pki/private/${EASYRSA_REQ_CN}.pem"
|
||
|
|
openvpn --genkey secret > "ta.key"
|
||
|
|
|
||
|
|
else
|
||
|
|
echo "Easy RSA config is already prepared, skipping"
|
||
|
|
fi
|
||
|
|
|
||
|
|
cp /opt/data/openvpn/ta.key /etc/openvpn/server
|
||
|
|
openvpn --config /opt/config/server.conf
|