openvpn.sh: Split in to smaller scripts

* Split soon to be massive wrapper into smaller managable scripts.
* Re-organized Dockerfile to exploit cache when rebuilding

Dockerfile

@@ -11,9 +11,6 @@ RUN git clone https://github.com/OpenVPN/easy-rsa.git /usr/local/share/easy-rsa
 RUN cd /usr/local/share/easy-rsa && git checkout -b tested 89f369c5bbd13fbf0da2ea6361632c244e8af532
 RUN ln -s /usr/local/share/easy-rsa/easyrsa3/easyrsa /usr/local/bin
 
-ADD ./bin /usr/local/bin
-RUN chmod a+x /usr/local/bin/*
-
 # Needed by scripts
 ENV OPENVPN /etc/openvpn
 ENV EASYRSA /usr/local/share/easy-rsa/easyrsa3
@@ -24,4 +21,7 @@ VOLUME ["/etc/openvpn"]
 
 EXPOSE 1194/udp
 
-ENTRYPOINT ["openvpn.sh"]
+CMD ["ovpn_run"]
+
+ADD ./bin /usr/local/bin
+RUN chmod a+x /usr/local/bin/*

bin/easyrsa_vars

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+#
+# Import/export EasyRSA default settings
+#
+
+set -ex
+
+if [ $# -lt 1 ]; then
+    echo "No command provided"
+    echo
+    echo "$0 export > /path/to/file"
+    echo "$0 import < /path/to/file"
+    exit 1
+fi
+
+cmd=$1
+shift
+
+case "$cmd" in
+    export)
+        if [ -f "$EASYRSA_VARS_FILE" ]; then
+            cat "$EASYRSA_VARS_FILE"
+        else
+            cat "$EASYRSA/vars.example"
+        fi
+        ;;
+    import)
+        cat > "$EASYRSA_VARS_FILE"
+        ;;
+    *)
+        echo "Unknown cmd \"$cmd\""
+        exit 2
+        ;;
+esac

bin/openvpn.sh

@@ -1,152 +0,0 @@
-#!/bin/bash
-#
-# OpenVPN + Docker Wrapper Script
-#
-
-set -ex
-
-abort() {
-    echo "Error: $@"
-    exit 1
-}
-
-if [ $# -lt 1 ]; then
-    abort "No command specified"
-fi
-
-do_openvpn() {
-    mkdir -p /dev/net
-    if [ ! -c /dev/net/tun ]; then
-        mknod /dev/net/tun c 10 200
-    fi
-
-    iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
-
-    openvpn --config "$OPENVPN/udp1194.conf"
-}
-
-do_init() {
-    cn=$1
-
-    # Provides a sufficient warning before erasing pre-existing files
-    easyrsa init-pki
-
-    # For a CA key with a password, manually init; this is autopilot
-    easyrsa build-ca nopass
-
-    easyrsa gen-dh
-    openvpn --genkey --secret $OPENVPN/pki/ta.key
-
-    if [ -z "$cn"]; then
-        #TODO: Handle IPv6 (when I get a VPS with IPv6)...
-        ip4=$(dig +short myip.opendns.com @resolver1.opendns.com)
-        ptr=$(dig +short -x $ip4 | sed -e 's:\.$::')
-
-        [ -n "$ptr" ] && cn=$ptr || cn=$ip4
-    fi
-
-    echo "$cn" > $OPENVPN/servername
-
-    easyrsa build-server-full $cn nopass
-
-    [ -f "$OPENVPN/udp1194.conf" ] || cat > "$OPENVPN/udp1194.conf" <<EOF
-server 192.168.255.128 255.255.255.128
-verb 3
-#duplicate-cn
-key $EASYRSA_PKI/private/$cn.key
-ca $EASYRSA_PKI/ca.crt
-cert $EASYRSA_PKI/issued/$cn.crt
-dh $EASYRSA_PKI/dh.pem
-#tls-auth $EASYRSA_PKI/ta.key
-#key-direction 0
-keepalive 10 60
-persist-key
-persist-tun
-push "dhcp-option DNS 8.8.4.4"
-push "dhcp-option DNS 8.8.8.8"
-
-proto udp
-port 1194
-dev tun1194
-status /tmp/openvpn-status-1194.log
-EOF
-}
-
-do_getclientconfig() {
-    cn=$1
-
-    [ -z "$cn" ] && abort "Common name not specified"
-
-    if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then
-        easyrsa build-server-full $cn nopass
-    fi
-
-    servername=$(cat $OPENVPN/servername)
-
-    cat <<EOF
-client
-nobind
-dev tun
-redirect-gateway def1
-
-<key>
-$(cat $EASYRSA_PKI/private/$cn.key)
-</key>
-<cert>
-$(cat $EASYRSA_PKI/issued/$cn.crt)
-</cert>
-<ca>
-$(cat $EASYRSA_PKI/ca.crt)
-</ca>
-<dh>
-$(cat $EASYRSA_PKI/dh.pem)
-</dh>
-#<tls-auth>
-#$(echo cat $EASYRSA_PKI/ta.key)
-#</tls-auth>
-#key-direction 1
-
-<connection>
-remote $servername 1194 udp
-</connection>
-EOF
-}
-
-# Read arguments from command line
-cmd=$1
-shift
-
-case "$cmd" in
-    # nop for volume creation
-    init)
-        do_init "$@"
-        ;;
-    easyrsa)
-        easyrsa "$@"
-        ;;
-    easyrsa-export-vars)
-        if [ -f "$EASYRSA_VARS_FILE" ]; then
-            cat "$EASYRSA_VARS_FILE"
-        else
-            cat "$EASYRSA/vars.example"
-        fi
-        ;;
-    easyrsa-import-vars)
-        cat > "$EASYRSA_VARS_FILE"
-        ;;
-    bash)
-        $cmd "$@"
-        ;;
-    getclientconfig)
-        do_getclientconfig "$@"
-        ;;
-    openvpn)
-        do_openvpn "$@"
-        ;;
-    log)
-        tail -F /tmp/openvpn-status-1194.log
-        ;;
-    *)
-        abort "Unknown cmd \"$cmd\""
-        ;;
-esac

bin/ovpn_getclient

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+#
+# Get an OpenVPN client configuration file
+#
+
+set -ex
+
+cn=$1
+
+if [ -z "$cn" ]; then
+    echo "Common name not specified"
+    exit 1
+fi
+
+if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then
+    easyrsa build-server-full $cn nopass
+fi
+
+servername=$(cat $OPENVPN/servername)
+
+cat <<EOF
+client
+nobind
+dev tun
+redirect-gateway def1
+
+<key>
+$(cat $EASYRSA_PKI/private/$cn.key)
+</key>
+<cert>
+$(cat $EASYRSA_PKI/issued/$cn.crt)
+</cert>
+<ca>
+$(cat $EASYRSA_PKI/ca.crt)
+</ca>
+<dh>
+$(cat $EASYRSA_PKI/dh.pem)
+</dh>
+#<tls-auth>
+#$(echo cat $EASYRSA_PKI/ta.key)
+#</tls-auth>
+#key-direction 1
+
+<connection>
+remote $servername 1194 udp
+</connection>
+EOF

bin/ovpn_init

@@ -0,0 +1,57 @@
+#!/bin/sh
+
+#
+# Initialize the PKI and OpenVPN configs
+#
+
+set -ex
+
+cn=$1
+
+if [ -z "$cn" ]; then
+    echo "Common name not specified"
+    exit 1
+fi
+
+# Provides a sufficient warning before erasing pre-existing files
+easyrsa init-pki
+
+# For a CA key with a password, manually init; this is autopilot
+easyrsa build-ca nopass
+
+easyrsa gen-dh
+openvpn --genkey --secret $OPENVPN/pki/ta.key
+
+if [ -z "$cn"]; then
+    #TODO: Handle IPv6 (when I get a VPS with IPv6)...
+    ip4=$(dig +short myip.opendns.com @resolver1.opendns.com)
+    ptr=$(dig +short -x $ip4 | sed -e 's:\.$::')
+
+    [ -n "$ptr" ] && cn=$ptr || cn=$ip4
+fi
+
+echo "$cn" > $OPENVPN/servername
+
+easyrsa build-server-full $cn nopass
+
+[ -f "$OPENVPN/udp1194.conf" ] || cat > "$OPENVPN/udp1194.conf" <<EOF
+server 192.168.255.128 255.255.255.128
+verb 3
+#duplicate-cn
+key $EASYRSA_PKI/private/$cn.key
+ca $EASYRSA_PKI/ca.crt
+cert $EASYRSA_PKI/issued/$cn.crt
+dh $EASYRSA_PKI/dh.pem
+#tls-auth $EASYRSA_PKI/ta.key
+#key-direction 0
+keepalive 10 60
+persist-key
+persist-tun
+push "dhcp-option DNS 8.8.4.4"
+push "dhcp-option DNS 8.8.8.8"
+
+proto udp
+port 1194
+dev tun1194
+status /tmp/openvpn-status-1194.log
+EOF

bin/ovpn_run

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+#
+# Run the OpenVPN server normally
+#
+
+set -ex
+
+mkdir -p /dev/net
+if [ ! -c /dev/net/tun ]; then
+    mknod /dev/net/tun c 10 200
+fi
+
+iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
+
+openvpn --config "$OPENVPN/udp1194.conf"

bin/ovpn_status

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+#
+# Get OpenVPN server status
+#
+
+set -ex
+
+tail -F /tmp/openvpn-status-1194.log