allanger/container-openvpn
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Activity
388 Commits 5 Branches 6 Tags
Commit Graph

388 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Christopher Bunn
8f09769fdd systemd: reduce container privilege by whitelisting NET_ADMIN capability 2017-07-10 20:10:39 -07:00
Kyle Manna
925b08fec4 Merge pull request #283 from buchdag/genconfig-fix 
Fix ovpn_genconfig repeatability issue
 2017-07-08 11:06:36 -07:00
Nicolas Duchon
7a29e8e39b Extra client config is now an array 2017-06-21 02:21:52 +02:00
Nicolas Duchon
16fbc4019d Fix ovpn_genconfig for repeatability 2017-06-21 02:21:52 +02:00
Nicolas Duchon
63a2449705 Add test for ovpn_genconfig repeatability 2017-06-21 01:03:49 +02:00
Kyle Manna
1b8374f818 Merge pull request #281 from buchdag/crl-expire 
Defaults easy_rsa CRL next update to 3650 days
 2017-06-17 09:15:27 -07:00
Nicolas Duchon
8d7bc7e2c5 Set CRL next update to 3650 days 2017-06-17 13:17:20 +02:00
Nicolas Duchon
e30ee8eecf Add CRL next update test 2017-06-17 13:17:08 +02:00
Kyle Manna
e00a72a3f6 Dockerfile: master branch follows alpine:latest 
The master branch will follow alpine:latest.  See `openvpn-2.x` branches
for more stability.

Related #267
 2017-05-26 12:25:43 -07:00
Kyle Manna
d974c0ac6a README: Mention passphrase prompt and systemd init 
* Enhance the documentation to mention that user interaction is
  necessary during the `ovpn_initpki`.
* Re-arrange the next steps part to point people to systemd init as well
  as docs directory.

Closes #266
 2017-05-20 08:44:22 -07:00
Kyle Manna
c0ed8d468d Dockerfile: Drop edge/community for google-authenticator 
* Use the primary repository now that google-authenticator is available
  from alpine:v3.5.

Related to #262
 2017-05-17 09:27:30 -07:00
Kyle Manna
2a9059aa36 tests: Clean-up client + conf_options 
Clean-up the mess that was here.  It's less error prone, shorter and
easier to read.
 2017-05-13 10:52:47 -07:00
Kyle Manna
074a07e40e genconfig: Fix missing MTU required argument 
This must have beeen broken for a long time.  Test case added to prevent
it from breaking again.

Closes #259
 2017-05-13 09:50:18 -07:00
Kyle Manna
8c9d88b316 tests: client: Add client config test suite 
* Test the client configuration to detect breakages
 2017-05-13 09:50:18 -07:00
Kyle Manna
78d612d181 Merge pull request #253 from chepurko/patch-1 2017-05-11 11:21:14 -07:00
Kyle Manna
6bff62eb79 Dockerfile: Swtich from dl-4 to dl-cdn.alpinelinux.org 
* At the time of this commit dl-4.alpinelinux.org was unreachable.
* Switch to the CDN instead of some hardcoded server.
 2017-05-11 11:20:40 -07:00
Alexander Chepurko
8f2f27486c Add quoting into test.sh push options. 2017-05-11 10:55:46 -07:00
Alexander Chepurko
3ee5479d78 Push options need to be quoted. 
Move the implementation to process_push_config.
 2017-05-11 10:55:46 -07:00
Kyle Manna
909744dd78 Merge pull request #251 from buchdag/buchdag-revoke1 
Fix certificate revocation
 2017-05-10 09:37:03 -07:00
Nicolas Duchon
5aea8b914c Update documentation 
Add ovpn_revokeclient usage to client.md and docker-compose.md
 2017-05-10 18:08:11 +02:00
Nicolas Duchon
a091bef13b Create a script to handle client revocation 
This script revoke the certificate corresponding to the commonName passed as first parameter, generate a new CRL, copies it to /etc/openvpn, make it readable by OpenVPN and optionally remove the crt, key and req file corresponding to the revoked certificate using "remove" as second parameter (removal of those files are required to generate a new client certificate using the revoked certificate's CN).
 2017-05-10 18:08:11 +02:00
Nicolas Duchon
59644d953d Replace hardlinking of crl.pem with a copy 
easyrsa gen-crl does not modify the crl.pem in place but rather remove the old file and create a new one, which means any hardlink to it will get broken again at each invocation of easyrsa gen-crl.

If hardlink to this file is not going to work anyway and we still need it to be readable by OpenVPN, we're better off copying it and chmod-ing it every time a new one is detected on container start, using the conditional expression file1 -nt file2.
 2017-05-10 18:08:11 +02:00
Nicolas Duchon
dcf3791d54 Generate a CRL during PKI initialization 2017-05-10 18:08:11 +02:00
Nicolas Duchon
76546e1823 Add client revocation test 2017-05-10 18:08:11 +02:00
Kyle Manna
f996bbaa8e README: Clarify volume naming convention 
* Use a better default that works with systemd service out of the box.
* Update upstart init script to follow convention.
 2017-05-10 08:14:51 -07:00
Kyle Manna
861ed05c48 Merge pull request #254 from buchdag/buchdag-systemd.md 
Clarify and complete systemd.md
 2017-05-06 07:04:18 -07:00
Kyle Manna
ce690e5ab1 ovpn_run: Explicitly enable ipv6 
On a recent build I ran in to the following error messages:

    Wed May  3 14:31:43 2017 /sbin/ip -6 addr add 2001:db8:0:4::1/64 dev tun0
    Wed May  3 14:31:43 2017 Linux ip -6 addr add failed: external program exited with error status: 2

This appears to be do to the fact that somewhere something defaulted the
kernel in the container to disable IPv6.  Not sure if this is my host or
the docker daemon.  Re-enable it explicitly for now until Docker gets
it's IPv6 act together.
 2017-05-03 07:48:15 -07:00
Nicolas Duchon
e4821ec709 Clarify and complete systemd.md 2017-05-02 22:24:37 +02:00
Kyle Manna
808e2448b1 Merge pull request #244 from DerEnderKeks/patch-1 
Removed double entry
 2017-05-02 10:48:14 -07:00
DerEnderKeks
fe2cdebea2 Removed double entry 
the removed line contained the same option as line 63
 2017-03-25 19:41:31 +01:00
Kyle Manna
892a3c9a1c Merge pull request #234 from slamont/master 
Add an option for setting different values for keepalive
 2017-03-09 20:30:49 -08:00
Sylvain Lamontagne
a3c96bc881 Add test for keepalive 2017-03-09 20:58:46 -05:00
Sylvain Lamontagne
22fcaf9477 Add configuration for keepalive 
* Add parameter to disable the push of block-outside-dns
* -d should really do what it was supposed to do
* Fix problem where comp-lzo would always be set regardless of the parameter
 2017-03-09 20:35:52 -05:00
Kyle Manna
d454a20e80 Merge pull request #231 from mediatemple/only_block_when_road_warrior 
Only block external dns when default route is pushed
 2017-03-07 16:24:34 -08:00
Nate Jones
c8ba567333 only block external dns when default route is pushed 2017-03-07 23:21:17 +00:00
Nate Jones
21ae2fcef4 fix block-external-dns tests 2017-03-07 23:20:50 +00:00
Kyle Manna
24944b0a11 Merge pull request #226 from vielmetti/patch-1 
Create Dockerfile.aarch64
 2017-02-24 09:06:58 -08:00
Edward Vielmetti
b74cbd5c74 Create Dockerfile.aarch64 
New Dockerfile to support aarch64 (ARMv8, arm64).
 2017-02-23 13:59:43 -05:00
Kyle Manna
93c3a0453d README: Fix docker-compose mention 
Previously rendered poorly on both GitHub and Docker Hub.
v2.1.0 		2017-02-23 08:01:08 -08:00
Kyle Manna
b868fa9093 Merge pull request #223 from outstand/extra-client-config 
Add -E flag for adding extra client config
 2017-02-19 09:34:09 -08:00
Ryan Schlesinger
fbb97918cf
Only load config from temp file if not empty 2017-02-18 14:09:19 -08:00
Ryan Schlesinger
e282e1eed0
Add -E flag for adding extra client config 2017-02-18 13:53:35 -08:00
Kyle Manna
5236365fe1 Merge pull request #222 from maxromanovsky/patch-1 
Docs: Fixed configuration restore instructions
 2017-02-18 07:09:28 -08:00
Max Romanovsky
a293af4246 Fixed configuration restore instructions 2017-02-18 15:29:01 +03:00
Kyle Manna
47de917de5 Merge pull request #219 from r0p0s3c/iptables 
move iptables/nat functionality to a function
 2017-02-16 13:37:19 -08:00
r0p0s3c
cbf9cbf433 fix permission on test script 2017-02-16 15:28:31 -05:00
r0p0s3c
4fd8296a62 add iptables test to list of tests 2017-02-16 15:09:22 -05:00
r0p0s3c
0e3f34effd add test for iptables rules customization functionality 2017-02-16 15:04:06 -05:00
r0p0s3c
e8b568a0b9 add additional documentation clarifying calling of function, purpose, and how to override it 2017-02-16 14:57:52 -05:00
r0p0s3c
a2adb59d69 move iptables/nat functionality to a function (setupIptablesAndRouting) 
This allows iptables rule update to be overridden by creating/supplying
that function in, for example, ovpn_env.sh
 2017-02-16 14:57:52 -05:00