container-openvpn/Dockerfile

# Original credit: https://github.com/jpetazzo/dockvpn

# Smallest base image
FROM ubuntu:18.04@sha256:bc025862c3e8ec4a8754ea4756e33da6c41cba38330d7e324abd25c8e0b93300

LABEL maintainer="lawtancool"

# Testing: pamtester
#RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories && \
#    apk add --update openvpn iptables bash easy-rsa openvpn-auth-pam google-authenticator pamtester && \
#    ln -s /usr/share/easy-rsa/easyrsa /usr/local/bin && \
#    rm -rf /tmp/* /var/tmp/* /var/cache/apk/* /var/cache/distfiles/*
    
RUN apt-get update && apt-get install -y wget tar unzip build-essential libssl-dev iproute2 liblz4-dev liblzo2-dev libpam0g-dev libpkcs11-helper1-dev libsystemd-dev easy-rsa iptables pkg-config && \
    wget http://swupdate.openvpn.org/community/releases/openvpn-2.4.8.tar.gz && tar xvf openvpn-2.4.8.tar.gz && \
    wget https://github.com/Tunnelblick/Tunnelblick/archive/v3.8.2beta02.zip && unzip v3.8.2beta02.zip && \
    cp Tunnelblick-3.8.2beta02/third_party/sources/openvpn/openvpn-2.4.8/patches/*.diff openvpn-2.4.8 && \
    cd openvpn-2.4.8 && \
    patch -p1 < 02-tunnelblick-openvpn_xorpatch-a.diff && \
    patch -p1 < 03-tunnelblick-openvpn_xorpatch-b.diff && \
    patch -p1 < 04-tunnelblick-openvpn_xorpatch-c.diff && \
    patch -p1 < 05-tunnelblick-openvpn_xorpatch-d.diff && \
    patch -p1 < 06-tunnelblick-openvpn_xorpatch-e.diff && \
    ./configure --disable-systemd --enable-async-push --enable-iproute2 && \
    make && make install
    
# Needed by scripts
ENV OPENVPN /etc/openvpn
ENV EASYRSA /usr/share/easy-rsa
ENV EASYRSA_PKI $OPENVPN/pki
ENV EASYRSA_VARS_FILE $OPENVPN/vars

# Prevents refused client connection because of an expired CRL
ENV EASYRSA_CRL_DAYS 3650

VOLUME ["/etc/openvpn"]

# Internally uses port 1194/udp, remap using `docker run -p 443:1194/tcp`
EXPOSE 1194

CMD ["ovpn_run"]

ADD ./bin /usr/local/bin
RUN chmod a+x /usr/local/bin/*

# Add support for OTP authentication using a PAM module
ADD ./otp/openvpn /etc/pam.d/
Dockerfile: Add MAINTAINER line * Add maintrainer line and credit jpetazzo 2014-06-04 03:35:44 +00:00			`# Original credit: https://github.com/jpetazzo/dockvpn`

Back to Alpine Linux using packaged version of google-authenticator 2016-02-11 17:10:51 +00:00			`# Smallest base image`
Update ubuntu:18.04 Docker digest to bc02586 2020-01-16 02:50:25 +00:00			`FROM ubuntu:18.04@sha256:bc025862c3e8ec4a8754ea4756e33da6c41cba38330d7e324abd25c8e0b93300`
Dockerfile: Add MAINTAINER line * Add maintrainer line and credit jpetazzo 2014-06-04 03:35:44 +00:00
update maintainer 2019-11-16 03:49:39 +00:00			`LABEL maintainer="lawtancool"`
Dockerfile: Add MAINTAINER line * Add maintrainer line and credit jpetazzo 2014-06-04 03:35:44 +00:00
Dockerfile: Swtich from dl-4 to dl-cdn.alpinelinux.org * At the time of this commit dl-4.alpinelinux.org was unreachable. * Switch to the CDN instead of some hardcoded server. 2017-05-11 18:19:39 +00:00			`# Testing: pamtester`
Update Dockerfile 2019-06-22 01:26:57 +00:00			`#RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories && \`
			`# apk add --update openvpn iptables bash easy-rsa openvpn-auth-pam google-authenticator pamtester && \`
			`# ln -s /usr/share/easy-rsa/easyrsa /usr/local/bin && \`
			`# rm -rf /tmp/* /var/tmp/* /var/cache/apk/* /var/cache/distfiles/*`

add iptables 2019-06-22 04:48:54 +00:00			`RUN apt-get update && apt-get install -y wget tar unzip build-essential libssl-dev iproute2 liblz4-dev liblzo2-dev libpam0g-dev libpkcs11-helper1-dev libsystemd-dev easy-rsa iptables pkg-config && \`
update to openvpn 2.4.8 2019-11-16 03:49:14 +00:00			`wget http://swupdate.openvpn.org/community/releases/openvpn-2.4.8.tar.gz && tar xvf openvpn-2.4.8.tar.gz && \`
			`wget https://github.com/Tunnelblick/Tunnelblick/archive/v3.8.2beta02.zip && unzip v3.8.2beta02.zip && \`
fix tunnelblick source path again 2019-11-16 04:19:11 +00:00			`cp Tunnelblick-3.8.2beta02/third_party/sources/openvpn/openvpn-2.4.8/patches/*.diff openvpn-2.4.8 && \`
update to openvpn 2.4.8 2019-11-16 03:49:14 +00:00			`cd openvpn-2.4.8 && \`
Update Dockerfile 2019-06-22 01:26:57 +00:00			`patch -p1 < 02-tunnelblick-openvpn_xorpatch-a.diff && \`
			`patch -p1 < 03-tunnelblick-openvpn_xorpatch-b.diff && \`
			`patch -p1 < 04-tunnelblick-openvpn_xorpatch-c.diff && \`
			`patch -p1 < 05-tunnelblick-openvpn_xorpatch-d.diff && \`
			`patch -p1 < 06-tunnelblick-openvpn_xorpatch-e.diff && \`
disable systemd in configure 2019-06-22 02:06:59 +00:00			`./configure --disable-systemd --enable-async-push --enable-iproute2 && \`
Update Dockerfile 2019-06-22 01:26:57 +00:00			`make && make install`

Dockerfile: Add ENV configuration * Add ENV configuration options to Dockerfile as opposed to keeping in the wrapper script. * First step to splitting up openvpn.sh in to smaller scripts. 2014-06-04 17:52:59 +00:00			`# Needed by scripts`
			`ENV OPENVPN /etc/openvpn`
Back to Alpine Linux using packaged version of google-authenticator 2016-02-11 17:10:51 +00:00			`ENV EASYRSA /usr/share/easy-rsa`
Dockerfile: Add ENV configuration * Add ENV configuration options to Dockerfile as opposed to keeping in the wrapper script. * First step to splitting up openvpn.sh in to smaller scripts. 2014-06-04 17:52:59 +00:00			`ENV EASYRSA_PKI $OPENVPN/pki`
			`ENV EASYRSA_VARS_FILE $OPENVPN/vars`

Set CRL next update to 3650 days 2017-06-17 11:01:24 +00:00			`# Prevents refused client connection because of an expired CRL`
			`ENV EASYRSA_CRL_DAYS 3650`

Dockerfile: Add EasyRSA-3 support * EasyRSA v3 is preferred over v2 because it includes support for elliptic curves. 2014-06-04 04:10:55 +00:00			`VOLUME ["/etc/openvpn"]`
openvpn.sh: Add wrapper script * Add the beginning of a wrapper script that will handle cert generation and OpenVPN invocation. 2014-06-04 03:54:47 +00:00
Dockerfile: Clarify port mapping * Extend comment about port mapping since everyone seems to want to run on port 443/tcp. * Accept that nobody (except the already competent) will read the comment and ask anyway. 2015-06-22 05:55:16 +00:00			# Internally uses port 1194/udp, remap using `docker run -p 443:1194/tcp`
expose tcp as well 2019-06-22 02:01:42 +00:00			`EXPOSE 1194`
openvpn.sh: Add wrapper script * Add the beginning of a wrapper script that will handle cert generation and OpenVPN invocation. 2014-06-04 03:54:47 +00:00
openvpn.sh: Split in to smaller scripts * Split soon to be massive wrapper into smaller managable scripts. * Re-organized Dockerfile to exploit cache when rebuilding 2014-06-04 18:13:59 +00:00			`CMD ["ovpn_run"]`

			`ADD ./bin /usr/local/bin`
Dockerfile: Chmod everything in /usr/local/bin * Keep it simple. * Nothing should ever be put in bin that isn't excutable. 2015-09-08 02:21:55 +00:00			`RUN chmod a+x /usr/local/bin/*`
Server side configuration for OTP 2016-02-06 19:23:59 +00:00
			`# Add support for OTP authentication using a PAM module`
Fix for Dockerfile, trailing slash is needed. 2016-02-07 13:45:28 +00:00			`ADD ./otp/openvpn /etc/pam.d/`