Dim innactive panes

Remove broken pipe
2023-12-19 15:21:20 +01:00 · 2023-12-19 15:19:33 +01:00 · 2023-12-16 09:25:43 +01:00 · 2023-12-14 20:12:21 +01:00 · 2023-11-22 07:29:03 +01:00 · 2023-11-22 07:27:26 +01:00
45 changed files with 1670 additions and 385 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -0,0 +1,132 @@
+---
+kind: pipeline
+type: docker
+name: Lint the chart
+trigger:
+  event:
+    - push
+
+environment:
+  KIND_VERSION: v0.20.0
+  HELM_VERSION: v3.12.1
+  KUBECTL_VERSION: v1.28.3
+  CT_VERSION: 3.10.1
+
+steps:
+  # ---------------------------------------------------------------------
+  # -- Prepare dependencies
+  # ---------------------------------------------------------------------
+
+  - name: Download dependencies
+    image: ghcr.io/allanger/dumb-downloader:latest
+    commands:
+      - mkdir .bin
+      # -- Download kind
+      - dudo -l "https://kind.sigs.k8s.io/dl/{{ version }}/kind-{{ os }}-{{ arch }}" -d .bin/kind -p $KIND_VERSION
+      - chmod +x .bin/kind
+
+  - name: Check changed charts
+    image: quay.io/helmpack/chart-testing
+    volumes:
+      - name: dockersock
+        path: /var/run
+    commands:
+      - export KUBECONFIG=$PWD/kubeconfig
+      - git fetch origin
+      - |
+        if [[ -n "$(ct list-changed --chart-dirs . --target-branch main)" ]]; then
+          touch .changed
+        fi
+
+  - name: Lint changed charts
+    image: quay.io/helmpack/chart-testing
+    volumes:
+      - name: dockersock
+        path: /var/run
+    commands:
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+        ct lint --target-branch main --validate-maintainers=false --chart-dirs .
+        fi
+
+  - name: Test changed charts
+    image: quay.io/helmpack/chart-testing
+    volumes:
+      - name: dockersock
+        path: /var/run
+    commands:
+      - export PATH=$PWD/.bin:$PATH
+      - apk update && apk add docker
+      - kind create cluster --config kind.yaml
+      - sed -i -E -e 's/localhost|0\.0\.0\.0/docker/g' ~/.kube/config
+      - kubectl get storageclass
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+          ct install --target-branch main --chart-dirs .
+          ct install --target-branch main --chart-dirs . --upgrade
+        fi
+
+services:
+  - name: docker
+    image: docker:dind
+    privileged: true
+    volumes:
+      - name: dockersock
+        path: /var/run
+
+volumes:
+  - name: dockersock
+    temp: {}
+---
+# ----------------------------------------------
+# -- Build an image and push it to the registry
+# ----------------------------------------------
+kind: pipeline
+type: docker
+name: Build the builder
+
+trigger:
+  event:
+    - push
+  branch:
+    - main
+
+steps:
+  - name: Build openvpn xor amd64
+    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:555262114ea81f6f286010474527f419b56d33a3
+    privileged: true
+    environment:
+      GITEA_TOKEN:
+        from_secret: GITEA_TOKEN
+      CONTAINERFILE: ./containerfiles/Containerfile-XOR
+      CUSTOM_TAG: v2.6.5-XOR-4.0.0beta08
+    commands:
+      - build-container
+
+  - name: Build openvpn amd64
+    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:555262114ea81f6f286010474527f419b56d33a3
+    privileged: true
+    environment:
+      GITEA_TOKEN:
+        from_secret: GITEA_TOKEN
+      CONTAINERFILE: ./containerfiles/Containerfile
+      CUSTOM_TAG: v2.6.8
+    commands:
+      - build-container
+
+  - name: Publish the Helm chart
+    image: alpine/helm
+    depends_on:
+      - Build openvpn xor amd64
+      - Build openvpn amd64
+    environment:
+      GITEA_TOKEN:
+        from_secret: GITEA_TOKEN
+    commands:
+      - cd helm
+      - helm plugin install https://github.com/chartmuseum/helm-push
+      - helm package . -d chart-package
+      - helm repo add  --username allanger --password $GITEA_TOKEN openvpn https://git.badhouseplants.net/api/packages/allanger/helm
+      - helm cm-push "./chart-package/$(ls chart-package)" openvpn
--- a/.travis.yml
+++ b/.travis.yml
@ -1,33 +0,0 @@
-# Disallowing packages: openvpn
-# If you require these packages, please review the package approval process at: https://github.com/travis-ci/apt-package-whitelist#package-approval-process
-#addons:
-#    apt:
-#        sources:
-#            - ubuntu-toolchain-r-test
-#        packages:
-#            - openvpn
-
-services:
-    - docker
-
-before_install:
-    - docker --version
-
-install:
-    - git clone https://github.com/docker-library/official-images.git official-images
-
-# Assist with ci test debugging:
-#   - DEBUG=1
-before_script:
-    - image="kylemanna/openvpn"
-    - docker build -t "$image" .
-    - docker inspect "$image"
-    - docker run --rm "$image" openvpn --version || true # why does it return 1?
-    - docker run --rm "$image" openssl version
-
-script:
-    - official-images/test/run.sh "$image"
-    - test/run.sh "$image"
-
-after_script:
-    - docker images
--- a/.woodpecker/.check-workflow.yml
+++ b/.woodpecker/.check-workflow.yml
@ -0,0 +1,18 @@
+---
+steps:
+  deps:
+    name: Download dependencies
+    image: alpine
+    commands:
+      - echo 1
+  mail:
+    image: deblan/woodpecker-email
+    settings:
+      from.address: noreply@github.com
+      from.name: John Smith
+      host: smtp.mailgun.org
+      username: 
+        from_secret: check
+      password: 12345
+      recipients:
+        - octocat@github.com
--- a/.woodpecker/.test.yml
+++ b/.woodpecker/.test.yml
@ -0,0 +1,82 @@
+---
+clone:
+  git:
+    image: woodpeckerci/plugin-git
+    settings:
+      partial: false
+steps:
+  deps:
+    name: Download dependencies
+    image: ghcr.io/allanger/dumb-downloader:latest
+    environment:
+      KIND_VERSION: v0.20.0
+      HELM_VERSION: v3.12.1
+      KUBECTL_VERSION: v1.28.3
+      CT_VERSION: 3.10.1
+    commands:
+      - mkdir .bin
+      # -- Download kind
+      - dudo -l "https://kind.sigs.k8s.io/dl/{{ version }}/kind-{{ os }}-{{ arch }}" -d .bin/kind -p $KIND_VERSION
+      - chmod +x .bin/kind
+
+  changed:
+    name: Check changed charts
+    image: quay.io/helmpack/chart-testing
+    commands:
+      - git fetch origin
+      - ls -la
+      - ct help
+      - ct lint --chart-dirs . --target-branch main --print-config --debug
+      - |
+        if [[ -n "$(ct list-changed --chart-dirs . --target-branch main)" ]]; then
+          touch .changed
+        fi
+
+  lint:
+    name: Lint charts
+    image: quay.io/helmpack/chart-testing
+    commands:
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+          ct lint --target-branch main --validate-maintainers=false --chart-dirs .
+        fi
+
+  test:
+    name: Test charts
+    image: quay.io/helmpack/chart-testing
+    environment:
+      - DOCKER_HOST=tcp://docker:2375
+    commands:
+      - export PATH=$PWD/.bin:$PATH
+      - apk update && apk add docker curl bash
+      - curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
+      - k3d cluster create test --api-port 16443 --k3s-arg="kubelet-args=\"--allowed-unsafe-sysctls=net.ipv4.ip_forward\""@all
+      - sed -i -E -e 's/localhost|0\.0\.0\.0/docker/g' ~/.kube/config
+      - kubectl get storageclass
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+          ct install --target-branch main --chart-dirs .
+          ct install --target-branch main --chart-dirs . --upgrade
+        fi
+
+services:
+  docker:
+    image: docker:dind
+    commands:
+      - echo "1" >  /proc/sys/net/ipv4/ip_forward
+      - dockerd -H tcp://0.0.0.0:2375 --tls=false
+    privileged: true
+    ports:
+      - 2375
+      - 16443
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 500Mi
+            cpu: 500m
+          limits:
+            memory: 1000Mi
+            cpu: 1000m
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -25,11 +25,11 @@ In an effort to not repeat bugs (and break less popular features), unit tests ar
 The style of the repo follows that of the Linux kernel, in particular:

 * Pull requests should be rebased to small atomic commits so that the merged history is more coherent
-* The subject of the commit should be in the form "<subsystem>: <subject>"
+* The subject of the commit should be in the form "`<subsystem>: <subject>`"
 * More details in the body
 * Match surrounding coding style (line wrapping, spaces, etc)

-More details in the [SubmittingPatches](https://www.kernel.org/doc/Documentation/SubmittingPatches) document included with the Linux kernel.  In particular the following sections:
+More details in the [SubmittingPatches](https://www.kernel.org/doc/html/latest/process/submitting-patches.html) document included with the Linux kernel.  In particular the following sections:

 * `2) Describe your changes`
 * `3) Separate your changes`
--- a/79
+++ b/79
@ -0,0 +1,79 @@
+FROM ghcr.io/allanger/dumb-downloader as dudo
+ENV OPENVPN_VERSION=2.6.5
+ENV TUNNELBLICK_VERSION=4.0.0beta08
+ENV EASYRSA_VERSION=3.1.5
+RUN apt update && apt install gnupg tar -y
+RUN mkdir /output
+# ------------------------------------------------------
+# -- Downlaod OpenVPN
+# ------------------------------------------------------
+RUN dudo -l "https://keys.openpgp.org/vks/v1/by-fingerprint/F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7" -d security-openvpn-net.asc -p DUMMY
+RUN gpg --import security-openvpn-net.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz.asc" -d /tmp/openvpn.asc -p $OPENVPN_VERSION
+# ------------------------------------------------------
+# -- I should fix it later
+# ------------------------------------------------------
+# RUN gpg  --no-tty --verify /tmp/openvpn.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz " -d /tmp/openvpn.tar.gz -p $OPENVPN_VERSION
+RUN tar -xf /tmp/openvpn.tar.gz  -C /tmp && rm -f /tmp/openvpn.tar.gz
+RUN mv /tmp/openvpn-$OPENVPN_VERSION /output/openvpn
+# ------------------------------------------------------
+# -- Download Tunnelblick
+# ------------------------------------------------------
+RUN dudo -l "https://github.com/Tunnelblick/Tunnelblick/archive/refs/tags/v{{ version }}.tar.gz" -d /tmp/tunnelblick.tar.gz -p $TUNNELBLICK_VERSION
+RUN tar -xf /tmp/tunnelblick.tar.gz  -C /tmp && rm -f /tmp/tunnelblick.tar.gz
+RUN mv /tmp/Tunnelblick-$TUNNELBLICK_VERSION /output/tunnelblick
+
+FROM ubuntu as builder
+# ------------------------------------------------------
+# -- TODO: Define it only once
+# ------------------------------------------------------
+ENV OPENVPN_VERSION=2.6.5
+ENV TUNNELBLICK_VERSION=v4.0.0beta08
+COPY --from=dudo /output /src
+RUN apt-get update &&\
+      apt-get install -y wget tar unzip build-essential \
+      libssl-dev iproute2 liblz4-dev liblzo2-dev \
+      libpam0g-dev libpkcs11-helper1-dev libsystemd-dev \
+      easy-rsa iptables pkg-config libcap-ng-dev
+RUN cp /src/tunnelblick/third_party/sources/openvpn/openvpn-$OPENVPN_VERSION/patches/*.diff /src/openvpn
+WORKDIR /src/openvpn
+RUN for patch in $(find -type f | grep diff); do\
+        patch -p1 < $patch;\
+    done
+RUN ./configure --disable-systemd --enable-async-push --enable-iproute2
+RUN make && make install
+RUN mkdir /output
+RUN cp $(which openvpn) /output/
+
+# ------------------------------------------------------
+# -- Final container
+# ------------------------------------------------------
+FROM ubuntu:22.04
+LABEL maintainer="allanger <allanger@zohomail.com>"
+COPY --from=builder /output /src
+# -------------------------------------------------------
+# -- Prepare system deps
+# -------------------------------------------------------
+RUN apt update && apt install openvpn easy-rsa iptables -y && \
+  mv /src/openvpn $(which openvpn)
+
+# Needed by scripts
+ENV OPENVPN /etc/openvpn
+
+# Prevents refused client connection because of an expired CRL
+ENV EASYRSA_CRL_DAYS 3650
+
+VOLUME ["/etc/openvpn"]
+
+# Internally uses port 1194, remap if needed using `docker run -p 443:1194/tcp`
+EXPOSE 1194
+
+CMD ["ovpn_run"]
+
+COPY --chmod='755' ./bin /usr/local/bin
+# -----------------------------------------------------------
+# -- Add support for OTP authentication using a PAM module
+# -- I have no idea how it works yet
+# -----------------------------------------------------------
+COPY ./otp/openvpn /etc/pam.d/
--- a/31
+++ b/31
@ -1,31 +0,0 @@
-# Original credit: https://github.com/jpetazzo/dockvpn
-
-# Smallest base image
-FROM alpine:3.5
-
-MAINTAINER Kyle Manna <kyle@kylemanna.com>
-
-RUN echo "http://dl-4.alpinelinux.org/alpine/edge/community/" >> /etc/apk/repositories && \
-    echo "http://dl-4.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories && \
-    apk add --update openvpn iptables bash easy-rsa openvpn-auth-pam google-authenticator pamtester && \
-    ln -s /usr/share/easy-rsa/easyrsa /usr/local/bin && \
-    rm -rf /tmp/* /var/tmp/* /var/cache/apk/* /var/cache/distfiles/*
-
-# Needed by scripts
-ENV OPENVPN /etc/openvpn
-ENV EASYRSA /usr/share/easy-rsa
-ENV EASYRSA_PKI $OPENVPN/pki
-ENV EASYRSA_VARS_FILE $OPENVPN/vars
-
-VOLUME ["/etc/openvpn"]
-
-# Internally uses port 1194/udp, remap using `docker run -p 443:1194/tcp`
-EXPOSE 1194/udp
-
-CMD ["ovpn_run"]
-
-ADD ./bin /usr/local/bin
-RUN chmod a+x /usr/local/bin/*
-
-# Add support for OTP authentication using a PAM module
-ADD ./otp/openvpn /etc/pam.d/
--- a/Makefile.in
+++ b/Makefile.in
--- a/README.md
+++ b/README.md
@ -1,46 +1,62 @@
 # OpenVPN for Docker

-[![Build Status](https://travis-ci.org/kylemanna/docker-openvpn.svg)](https://travis-ci.org/kylemanna/docker-openvpn)
-[![Docker Stars](https://img.shields.io/docker/stars/kylemanna/openvpn.svg)](https://hub.docker.com/r/kylemanna/openvpn/)
-[![Docker Pulls](https://img.shields.io/docker/pulls/kylemanna/openvpn.svg)](https://hub.docker.com/r/kylemanna/openvpn/)
-[![ImageLayers](https://images.microbadger.com/badges/image/kylemanna/openvpn.svg)](https://microbadger.com/#/images/kylemanna/openvpn)
-
-
-OpenVPN server in a Docker container complete with an EasyRSA PKI CA.
-
-Extensively tested on [Digital Ocean $5/mo node](http://bit.ly/1C7cKr3) and has
-a corresponding [Digital Ocean Community Tutorial](http://bit.ly/1AGUZkq).
+OpenVPN server in a Docker container complete with an EasyRSA PKI CA, with support for the [Tunnelblick obfuscation patch](https://tunnelblick.net/cOpenvpn_xorpatch.html). Based on [kylemanna's docker-openvpn image](https://github.com/kylemanna/docker-openvpn).

 #### Upstream Links

-* Docker Registry @ [kylemanna/openvpn](https://hub.docker.com/r/kylemanna/openvpn/)
-* GitHub @ [kylemanna/docker-openvpn](https://github.com/kylemanna/docker-openvpn)
+* Docker Registry @ [lawtancool/docker-openvpn-xor](https://hub.docker.com/r/lawtancool/docker-openvpn-xor)
+* GitHub @ [lawtancool/docker-openvpn-xor](https://github.com/lawtancool/docker-openvpn-xor)
+
+#### Clients with support for the Tunnelblick obfuscation patch
+* Windows: https://github.com/lawtancool/openvpn-windows-xor
+* Android: https://github.com/lawtancool/ics-openvpn-xor
+* macOS: https://tunnelblick.net/

 ## Quick Start

-* Pick a name for the `$OVPN_DATA` data volume container, it will be created automatically.
+* Pick a name for the `$OVPN_DATA` data volume container. It's recommended to
+  use the `ovpn-data-` prefix to operate seamlessly with the reference systemd
+  service.  Users are encourage to replace `example` with a descriptive name of
+  their choosing.

-        OVPN_DATA="ovpn-data"
+      OVPN_DATA="ovpn-data-example"

-* Initialize the `$OVPN_DATA` container that will hold the configuration files and certificates
+* Initialize the `$OVPN_DATA` container that will hold the configuration files
+  and certificates.  The container will prompt for a passphrase to protect the
+  private key used by the newly generated certificate authority.

-        docker volume create --name $OVPN_DATA
-        docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM
-        docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki
+      docker volume create --name $OVPN_DATA
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm lawtancool/docker-openvpn-xor ovpn_genconfig -u udp://VPN.SERVERNAME.COM
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it lawtancool/docker-openvpn-xor ovpn_initpki

 * Start OpenVPN server process

-        docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
+      docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN lawtancool/docker-openvpn-xor

 * Generate a client certificate without a passphrase

-        docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn easyrsa build-client-full CLIENTNAME nopass
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it lawtancool/docker-openvpn-xor ovpn_genclientcert CLIENTNAME nopass

 * Retrieve the client configuration with embedded certificates

-        docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm lawtancool/docker-openvpn-xor ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn

-## Docker Compose
+## Next Steps
+
+### More Reading
+
+Miscellaneous write-ups for advanced configurations are available in the
+[docs](docs) folder.
+
+### Systemd Init Scripts
+
+A `systemd` init script is available to manage the OpenVPN container.  It will
+start the container on system boot, restart the container if it exits
+unexpectedly, and pull updates from Docker Hub to keep itself up to date.
+
+Please refer to the [systemd documentation](docs/systemd.md) to learn more.
+
+### Docker Compose

 If you prefer to use `docker-compose` please refer to the [documentation](docs/docker-compose.md).

@ -48,7 +64,7 @@ If you prefer to use `docker-compose` please refer to the [documentation](docs/d

 * Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").

-        docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 kylemanna/openvpn
+        docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 lawtancool/docker-openvpn-xor

 * Test using a client that has openvpn installed correctly

@ -66,7 +82,7 @@ If you prefer to use `docker-compose` please refer to the [documentation](docs/d

 ## How Does It Work?

-Initialize the volume container using the `kylemanna/openvpn` image with the
+Initialize the volume container using the `lawtancool/docker-openvpn-xor` image with the
 included scripts to automatically generate:

 - Diffie-Hellman parameters
@ -82,11 +98,11 @@ declares that directory as a volume. It means that you can start another
 container with the `-v` argument, and access the configuration.
 The volume also holds the PKI keys and certs so that it could be backed up.

-To generate a client certificate, `kylemanna/openvpn` uses EasyRSA via the
+To generate a client certificate, `lawtancool/docker-openvpn-xor` uses EasyRSA via the
 `easyrsa` command in the container's path.  The `EASYRSA_*` environmental
 variables place the PKI CA under `/etc/openvpn/pki`.

-Conveniently, `kylemanna/openvpn` comes with a script called `ovpn_getclient`,
+Conveniently, `lawtancool/docker-openvpn-xor` comes with a script called `ovpn_getclient`,
 which dumps an inline OpenVPN client configuration file.  This single file can
 then be given to a client for access to the VPN.

@ -152,7 +168,7 @@ OpenVPN with latest OpenSSL on Ubuntu 12.04 LTS).
 ### It Doesn't Stomp All Over the Server's Filesystem

 Everything for the Docker container is contained in two images: the ephemeral
-run time image (kylemanna/openvpn) and the `$OVPN_DATA` data volume. To remove
+run time image (lawtancool/docker-openvpn-xor) and the `$OVPN_DATA` data volume. To remove
 it, remove the corresponding containers, `$OVPN_DATA` data volume and Docker
 image and it's completely removed.  This also makes it easier to run multiple
 servers since each lives in the bubble of the container (of course multiple IPs
@ -174,12 +190,6 @@ of a guarantee in the future.
  volume for re-use across containers
 * Addition of tls-auth for HMAC security

-## Originally Tested On
-
-* Docker hosts:
-  * server a [Digital Ocean](https://www.digitalocean.com/?refcode=d19f7fe88c94) Droplet with 512 MB RAM running Ubuntu 14.04
-* Clients
-  * Android App OpenVPN Connect 1.1.14 (built 56)
-     * OpenVPN core 3.0 android armv7a thumb2 32-bit
-  * OS X Mavericks with Tunnelblick 3.4beta26 (build 3828) using openvpn-2.3.4
-  * ArchLinux OpenVPN pkg 2.3.4-1
+## Differences from kylemanna/openvpn
+* Based on Ubuntu instead of Alpine
+* Compiles OpenVPN 2.5.0 from source, applying the [Tunnelblick obfuscation patches](https://github.com/Tunnelblick/Tunnelblick/tree/master/third_party/sources/openvpn/openvpn-2.5.0/patches)
--- a/bin/ovpn_genclientcert
+++ b/bin/ovpn_genclientcert
@ -0,0 +1,18 @@
+#!/bin/bash
+
+#
+# Generate a client certificate with EasyRSA
+#
+
+if [ "$DEBUG" == "1" ]; then
+  set -x
+fi
+
+CLIENTNAME=$1
+PASSWORD=$2
+
+set -e
+
+source "$OPENVPN/ovpn_env.sh"
+
+/usr/share/easy-rsa/easyrsa build-client-full $CLIENTNAME $PASSWORD
--- a/bin/ovpn_genconfig
+++ b/bin/ovpn_genconfig
@ -7,7 +7,6 @@
 TMP_PUSH_CONFIGFILE=$(mktemp -t vpn_push.XXXXXXX)
 TMP_ROUTE_CONFIGFILE=$(mktemp -t vpn_route.XXXXXXX)
 TMP_EXTRA_CONFIGFILE=$(mktemp -t vpn_extra.XXXXXXX)
-TMP_EXTRA_CLIENT_CONFIGFILE=$(mktemp -t vpn_extra_client.XXXXXXX)

 #Traceback on Error and Exit come from https://docwhat.org/tracebacks-in-bash/
 set -eu
@ -46,7 +45,6 @@ on_exit() {
  rm -f $TMP_PUSH_CONFIGFILE
  rm -f $TMP_ROUTE_CONFIGFILE
  rm -f $TMP_EXTRA_CONFIGFILE
-  rm -f $TMP_EXTRA_CLIENT_CONFIGFILE
  local _ec="$?"
  if [[ $_ec != 0 && "${_showed_traceback}" != t ]]; then
    traceback 1
@ -95,10 +93,12 @@ usage() {
    echo "optional arguments:"
    echo " -2    Enable two factor authentication using Google Authenticator."
    echo " -a    Authenticate  packets with HMAC using the given message digest algorithm (auth)."
+    echo " -b    Disable 'push block-outside-dns'"
    echo " -c    Enable client-to-client option"
    echo " -C    A list of allowable TLS ciphers delimited by a colon (cipher)."
-    echo " -d    Disable NAT routing and default route"
+    echo " -d    Disable default route"
    echo " -D    Do not push dns servers"
+    echo " -k    Set keepalive. Default: '10 60'"
    echo " -m    Set client MTU"
    echo " -N    Configure NAT to access external server network"
    echo " -t    Use TAP device (instead of TUN device)"
@ -119,7 +119,7 @@ process_push_config() {
  local ovpn_push_config=''
  ovpn_push_config="$1"
  echo "Processing PUSH Config: '${ovpn_push_config}'"
-  [[ -n "$ovpn_push_config" ]] && echo "push $ovpn_push_config" >> "$TMP_PUSH_CONFIGFILE"
+  [[ -n "$ovpn_push_config" ]] && echo "push \"$ovpn_push_config\"" >> "$TMP_PUSH_CONFIGFILE"
 }

 process_extra_config() {
@ -127,14 +127,6 @@ process_extra_config() {
  ovpn_extra_config="$1"
  echo "Processing Extra Config: '${ovpn_extra_config}'"
  [[ -n "$ovpn_extra_config" ]] && echo "$ovpn_extra_config" >> "$TMP_EXTRA_CONFIGFILE"
-
-}
-
-process_extra_client_config() {
-  local ovpn_extra_config=''
-  ovpn_extra_config="$1"
-  echo "Processing Extra Client Config: '${ovpn_extra_config}'"
-  [[ -n "$ovpn_extra_config" ]] && echo "$ovpn_extra_config" >> "$TMP_EXTRA_CLIENT_CONFIGFILE"
 }

 if [ "${DEBUG:-}" == "1" ]; then
@ -150,35 +142,52 @@ if [ -z "${EASYRSA_PKI:-}" ]; then
    export EASYRSA_PKI="$OPENVPN/pki"
 fi

-OVPN_ENV=${OPENVPN}/ovpn_env.sh
-OVPN_SERVER=192.168.255.0/24
+OVPN_AUTH=''
+OVPN_CIPHER=''
+OVPN_CLIENT_TO_CLIENT=''
+OVPN_CN=''
+OVPN_COMP_LZO=0
 OVPN_DEFROUTE=1
-OVPN_NAT=0
-OVPN_DNS=1
 OVPN_DEVICE="tun"
 OVPN_DEVICEN=0
-OVPN_DNS_SERVERS=("8.8.8.8" "8.8.4.4")
-TMP_DNS_SERVERS=()
+OVPN_DISABLE_PUSH_BLOCK_DNS=0
+OVPN_DNS=1
+OVPN_DNS_SERVERS=()
+OVPN_ENV=${OPENVPN}/ovpn_env.sh
+OVPN_EXTRA_CLIENT_CONFIG=()
+OVPN_EXTRA_SERVER_CONFIG=()
+OVPN_FRAGMENT=''
+OVPN_KEEPALIVE="10 60"
+OVPN_MTU=''
+OVPN_NAT=0
+OVPN_PORT=''
+OVPN_PROTO=''
+OVPN_PUSH=()
+OVPN_ROUTES=()
+OVPN_SERVER=192.168.255.0/24
+OVPN_SERVER_URL=''
 OVPN_TLS_CIPHER=''
-OVPN_CIPHER=''
-OVPN_AUTH=''
-OVPN_EXTRA_CONFIG=''
-CUSTOM_ROUTE_CONFIG=''

-# Import defaults if present
+# Import existing configuration if present
 [ -r "$OVPN_ENV" ] && source "$OVPN_ENV"

 # Parse arguments
-while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
+while getopts ":a:e:E:C:T:r:s:du:bcp:n:k:DNm:f:tz2" opt; do
    case $opt in
        a)
            OVPN_AUTH="$OPTARG"
            ;;
        e)
-            process_extra_config "$OPTARG"
+            mapfile -t TMP_EXTRA_SERVER_CONFIG <<< "$OPTARG"
+            for i in "${TMP_EXTRA_SERVER_CONFIG[@]}"; do
+              OVPN_EXTRA_SERVER_CONFIG+=("$i")
+            done
            ;;
        E)
-            process_extra_client_config "$OPTARG"
+            mapfile -t TMP_EXTRA_CLIENT_CONFIG <<< "$OPTARG"
+            for i in "${TMP_EXTRA_CLIENT_CONFIG[@]}"; do
+              OVPN_EXTRA_CLIENT_CONFIG+=("$i")
+            done
            ;;
        C)
            OVPN_CIPHER="$OPTARG"
@ -187,26 +196,38 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
            OVPN_TLS_CIPHER="$OPTARG"
            ;;
        r)
-            CUSTOM_ROUTE_CONFIG=1
-            process_route_config "$OPTARG"
+            mapfile -t TMP_ROUTES <<< "$OPTARG"
+            for i in "${TMP_ROUTES[@]}"; do
+              OVPN_ROUTES+=("$i")
+            done
            ;;
        s)
-            OVPN_SERVER=$OPTARG
+            OVPN_SERVER="$OPTARG"
            ;;
        d)
            OVPN_DEFROUTE=0
+            OVPN_DISABLE_PUSH_BLOCK_DNS=1
            ;;
        u)
-            OVPN_SERVER_URL=$OPTARG
+            OVPN_SERVER_URL="$OPTARG"
+            ;;
+        b)
+            OVPN_DISABLE_PUSH_BLOCK_DNS=1
            ;;
        c)
            OVPN_CLIENT_TO_CLIENT=1
            ;;
        p)
-            process_push_config "$OPTARG"
+            mapfile -t TMP_PUSH <<< "$OPTARG"
+            for i in "${TMP_PUSH[@]}"; do
+              OVPN_PUSH+=("$i")
+            done
            ;;
        n)
-            TMP_DNS_SERVERS+=("$OPTARG")
+            mapfile -t TMP_DNS_SERVERS <<< "$OPTARG"
+            for i in "${TMP_DNS_SERVERS[@]}"; do
+              OVPN_DNS_SERVERS+=("$i")
+            done
            ;;
        D)
            OVPN_DNS=0
@ -214,8 +235,11 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
        N)
            OVPN_NAT=1
            ;;
+        k)
+            OVPN_KEEPALIVE="$OPTARG"
+            ;;
        m)
-            OVPN_MTU=$OPTARG
+            OVPN_MTU="$OPTARG"
            ;;
        t)
            OVPN_DEVICE="tap"
@ -227,7 +251,7 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
            OVPN_OTP_AUTH=1
            ;;
        f)
-            OVPN_FRAGMENT=$OPTARG
+            OVPN_FRAGMENT="$OPTARG"
            ;;
        \?)
            set +x
@ -247,9 +271,6 @@ done
 # Create ccd directory for static routes
 [ ! -d "${OPENVPN:-}/ccd" ] && mkdir -p ${OPENVPN:-}/ccd

-# if dns servers were not defined with -n, use google nameservers
-[ ${#TMP_DNS_SERVERS[@]} -gt 0 ] && OVPN_DNS_SERVERS=("${TMP_DNS_SERVERS[@]}")
-
 # Server name is in the form "udp://vpn.example.com:1194"
 if [[ "${OVPN_SERVER_URL:-}" =~ ^((udp|tcp|udp6|tcp6)://)?([0-9a-zA-Z\.\-]+)(:([0-9]+))?$ ]]; then
    OVPN_PROTO=${BASH_REMATCH[2]};
@ -262,24 +283,13 @@ else
    exit 1
 fi

-# Apply defaults
+# Apply defaults. If dns servers were not defined with -n, use google nameservers
+set +u
+[ -z "$OVPN_DNS_SERVERS" ] && OVPN_DNS_SERVERS=("8.8.8.8" "8.8.4.4")
 [ -z "$OVPN_PROTO" ] && OVPN_PROTO=udp
 [ -z "$OVPN_PORT" ] && OVPN_PORT=1194
-[ -z "$CUSTOM_ROUTE_CONFIG" ] && process_route_config "192.168.254.0/24"
-
-# Save extra client config from temp file only if temp file is not empty
-if [ -s "$TMP_EXTRA_CLIENT_CONFIGFILE" ]; then
-  OVPN_ADDITIONAL_CLIENT_CONFIG=$(cat $TMP_EXTRA_CLIENT_CONFIGFILE)
-fi
-
-export OVPN_SERVER OVPN_ROUTES OVPN_DEFROUTE
-export OVPN_SERVER_URL OVPN_ENV OVPN_PROTO OVPN_CN OVPN_PORT
-export OVPN_CLIENT_TO_CLIENT OVPN_PUSH OVPN_NAT OVPN_DNS OVPN_MTU OVPN_DEVICE
-export OVPN_TLS_CIPHER OVPN_CIPHER OVPN_AUTH
-export OVPN_COMP_LZO
-export OVPN_OTP_AUTH
-export OVPN_FRAGMENT
-export OVPN_ADDITIONAL_CLIENT_CONFIG
+set -u
+[ "${#OVPN_ROUTES[@]}" == "0" ] && [ "$OVPN_DEFROUTE" == "1" ] && OVPN_ROUTES+=("192.168.254.0/24")

 # Preserve config
 if [ -f "$OVPN_ENV" ]; then
@ -288,17 +298,10 @@ if [ -f "$OVPN_ENV" ]; then
    mv "$OVPN_ENV" "$bak_env"
 fi

-# Like `export | grep OVPN_ > "$OVPN_ENV"` but handles multiline variables
-set +u
-while read var ; do
-  eval value=\$$var
-  if [ -n "$value" ]; then
-    echo "declare -x $var=\"$value\"" >> "$OVPN_ENV"
-  else
-    echo "declare -x $var" >> "$OVPN_ENV"
-  fi
-done < <(export | egrep -o '(OVPN_[^=]+)')
-set -u
+# Save the current OVPN_ vars to the ovpn_env.sh file
+(set | grep '^OVPN_') | while read -r var; do
+  echo "declare -x $var"  >> "$OVPN_ENV"
+done

 conf=${OPENVPN:-}/openvpn.conf
 if [ -f "$conf" ]; then
@ -307,6 +310,13 @@ if [ -f "$conf" ]; then
    mv "$conf" "$bak"
 fi

+# Echo extra client configurations
+if [ ${#OVPN_EXTRA_CLIENT_CONFIG[@]} -gt 0 ]; then
+  for i in "${OVPN_EXTRA_CLIENT_CONFIG[@]}"; do
+    echo "Processing Extra Client Config: $i"
+  done
+fi
+
 cat > "$conf" <<EOF
 server $(getroute $OVPN_SERVER)
 verb 3
@ -314,9 +324,9 @@ key $EASYRSA_PKI/private/${OVPN_CN}.key
 ca $EASYRSA_PKI/ca.crt
 cert $EASYRSA_PKI/issued/${OVPN_CN}.crt
 dh $EASYRSA_PKI/dh.pem
-tls-auth $EASYRSA_PKI/ta.key
-key-direction 0
-keepalive 10 60
+tls-crypt $EASYRSA_PKI/ta.key
+#key-direction 0
+keepalive $OVPN_KEEPALIVE
 persist-key
 persist-tun

@ -330,39 +340,62 @@ user nobody
 group nogroup
 EOF

-#This was in the heredoc, we use the new function instead
-process_push_config "block-outside-dns"
+if [ "${OVPN_DISABLE_PUSH_BLOCK_DNS}" == "1" ]; then
+  echo "Disable default push of 'block-outside-dns'"
+else
+  process_push_config "block-outside-dns"
+fi

 [ -n "$OVPN_TLS_CIPHER" ] && echo "tls-cipher $OVPN_TLS_CIPHER" >> "$conf"
 [ -n "$OVPN_CIPHER" ] && echo "cipher $OVPN_CIPHER" >> "$conf"
 [ -n "$OVPN_AUTH" ] && echo "auth $OVPN_AUTH" >> "$conf"

 [ -n "${OVPN_CLIENT_TO_CLIENT:-}" ] && echo "client-to-client" >> "$conf"
-[ -n "${OVPN_COMP_LZO:-}" ] && echo "comp-lzo" >> "$conf"
+[ "$OVPN_COMP_LZO" == "1" ] && echo "comp-lzo" >> "$conf"
+[ "$OVPN_COMP_LZO" == "0" ] && echo "comp-lzo no" >> "$conf"

 [ -n "${OVPN_FRAGMENT:-}" ] && echo "fragment $OVPN_FRAGMENT" >> "$conf"

+# Append route commands
+if [ ${#OVPN_ROUTES[@]} -gt 0 ]; then
+  for i in "${OVPN_ROUTES[@]}"; do
+    process_route_config "$i"
+  done
+  echo -e "\n### Route Configurations Below" >> "$conf"
+  cat $TMP_ROUTE_CONFIGFILE >> "$conf"
+fi
+
+# Append push commands
 [ "$OVPN_DNS" == "1" ] && for i in "${OVPN_DNS_SERVERS[@]}"; do
  process_push_config "dhcp-option DNS $i"
 done

-# Append route commands
-echo -e "\n### Route Configurations Below" >> "$conf"
-cat $TMP_ROUTE_CONFIGFILE >> "$conf"
+if [ "$OVPN_COMP_LZO" == "0" ]; then
+    process_push_config "comp-lzo no"
+fi
+
+[ ${#OVPN_PUSH[@]} -gt 0 ] && for i in "${OVPN_PUSH[@]}"; do
+  process_push_config "$i"
+done

-# Append push commands
 echo -e "\n### Push Configurations Below" >> "$conf"
 cat $TMP_PUSH_CONFIGFILE >> "$conf"

-# Optional OTP authentication support
+# Append optional OTP authentication support
 if [ -n "${OVPN_OTP_AUTH:-}" ]; then
    echo -e "\n\n# Enable OTP+PAM for user authentication" >> "$conf"
    echo "plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn" >> "$conf"
    echo "reneg-sec 0" >> "$conf"
 fi

-echo -e "\n### Extra Configurations Below" >> "$conf"
-cat $TMP_EXTRA_CONFIGFILE >> "$conf"
+# Append extra server configurations
+if [ ${#OVPN_EXTRA_SERVER_CONFIG[@]} -gt 0 ]; then
+  for i in "${OVPN_EXTRA_SERVER_CONFIG[@]}"; do
+    process_extra_config "$i"
+  done
+  echo -e "\n### Extra Configurations Below" >> "$conf"
+  cat $TMP_EXTRA_CONFIGFILE >> "$conf"
+fi

 set +e

--- a/bin/ovpn_getclient
+++ b/bin/ovpn_getclient
@ -35,7 +35,6 @@ get_client_config() {
 client
 nobind
 dev $OVPN_DEVICE
-key-direction 1
 remote-cert-tls server

 remote $OVPN_CN $OVPN_PORT $OVPN_PROTO"
@ -45,8 +44,9 @@ remote $OVPN_CN $OVPN_PORT $OVPN_PROTO"
    if [ "$OVPN_PROTO" == "tcp6" ]; then
        echo "remote $OVPN_CN $OVPN_PORT tcp"
    fi
-    echo "$OVPN_ADDITIONAL_CLIENT_CONFIG
-"
+    for i in "${OVPN_EXTRA_CLIENT_CONFIG[@]}"; do
+      echo "$i"
+    done
    if [ "$mode" == "combined" ]; then
        echo "
 <key>
@ -58,17 +58,18 @@ $(openssl x509 -in $EASYRSA_PKI/issued/${cn}.crt)
 <ca>
 $(cat $EASYRSA_PKI/ca.crt)
 </ca>
-<tls-auth>
+#key-direction 1
+<tls-crypt>
 $(cat $EASYRSA_PKI/ta.key)
-</tls-auth>
-key-direction 1
+</tls-crypt>
 "
    elif [ "$mode" == "separated" ]; then
        echo "
 key ${cn}.key
 ca ca.crt
 cert ${cn}.crt
-tls-auth ta.key 1
+tls-crypt ta.key
+#tls-auth ta.key 1
 "
    fi

@ -97,12 +98,12 @@ tls-auth ta.key 1
        echo "auth-nocache"
    fi

-    if [ -n "$OVPN_COMP_LZO" ]; then
+    if [ "$OVPN_COMP_LZO" == "1" ]; then
        echo "comp-lzo"
    fi

    if [ -n "$OVPN_OTP_AUTH" ]; then
-	echo reneg-sec 0
+        echo reneg-sec 0
    fi
 }

@ -124,9 +125,9 @@ case "$parm" in
        get_client_config "combined" > "$dir/${cn}-combined.ovpn"
        ;;
    *)
-        echo "This script can produce the client configuration in to formats:" >&2
+        echo "This script can produce the client configuration in two formats:" >&2
        echo "    1. combined (default): All needed configuration and cryptographic material is in one file (Use \"combined-save\" to write the configuration file in the same path as the separated parameter does)." >&2
        echo "    2. separated: Separated files." >&2
-        echo "Please specific one of those options as second parameter." >&2
+        echo "Please specify one of those options as second parameter." >&2
        ;;
 esac
--- a/bin/ovpn_initpki
+++ b/bin/ovpn_initpki
@ -15,15 +15,9 @@ source "$OPENVPN/ovpn_env.sh"
 # Specify "nopass" as arg[2] to make the CA insecure (not recommended!)
 nopass=$1

-# Provides a sufficient warning before erasing pre-existing files
-easyrsa init-pki
-
-# CA always has a password for protection in event server is compromised. The
-# password is only needed to sign client/server certificates.  No password is
-# needed for normal OpenVPN operation.
-easyrsa build-ca $nopass
-
-easyrsa gen-dh
+/usr/share/easy-rsa/easyrsa init-pki
+/usr/share/easy-rsa/easyrsa build-ca $nopass
+/usr/share/easy-rsa/easyrsa gen-dh
 openvpn --genkey --secret $EASYRSA_PKI/ta.key

 # Was nice to autoset, but probably a bad idea in practice, users should
@ -37,4 +31,7 @@ openvpn --genkey --secret $EASYRSA_PKI/ta.key
 #fi

 # For a server key with a password, manually init; this is autopilot
-easyrsa build-server-full "$OVPN_CN" nopass
+/usr/share/easy-rsa/easyrsa build-server-full "$OVPN_CN" nopass
+
+# Generate the CRL for client/server certificates revocation.
+/usr/share/easy-rsa/easyrsa gen-crl
--- a/bin/ovpn_listclients
+++ b/bin/ovpn_listclients
@ -15,6 +15,8 @@ cd "$EASYRSA_PKI"

 if [ -e crl.pem ]; then
    cat ca.crt crl.pem > cacheck.pem
+else
+    cat ca.crt > cacheck.pem
 fi

 echo "name,begin,end,status"
@ -26,20 +28,27 @@ for name in issued/*.crt; do
    name=${name%.crt}
    name=${name#issued/}
    if [ "$name" != "$OVPN_CN" ]; then
-    if [ -e crl.pem ]; then
-        if openssl verify -crl_check -CAfile cacheck.pem $path &> /dev/null; then
-	status="VALID"
+        # check for revocation or expiration
+        command="openssl verify -crl_check -CAfile cacheck.pem $path"
+        result=$($command)
+        if [ $(echo "$result" | wc -l) == 1 ] && [ "$(echo "$result" | grep ": OK")" ]; then
+            status="VALID"
        else
-	status="REVOKED"
+            result=$(echo "$result" | tail -n 1 | grep error | cut -d" " -f2)
+            case $result in
+                10)
+                    status="EXPIRED"
+                    ;;
+                23)
+                    status="REVOKED"
+                    ;;
+                *)
+                    status="INVALID"
+            esac
        fi
-    else
-        status="VALID"
-    fi
-
        echo "$name,$begin,$end,$status"
    fi
 done

-if [ -e crl.pem ]; then
-    rm cacheck.pem
-fi
+# Clean
+rm cacheck.pem
--- a/bin/ovpn_revokeclient
+++ b/bin/ovpn_revokeclient
@ -0,0 +1,62 @@
+#!/bin/bash
+
+#
+# Revoke a client certificate
+#
+
+if [ "$DEBUG" == "1" ]; then
+    set -x
+fi
+
+set -e
+
+if [ -z "$OPENVPN" ]; then
+    export OPENVPN="$PWD"
+fi
+if ! source "$OPENVPN/ovpn_env.sh"; then
+    echo "Could not source $OPENVPN/ovpn_env.sh."
+    exit 1
+fi
+if [ -z "$EASYRSA_PKI" ]; then
+    export EASYRSA_PKI="$OPENVPN/pki"
+fi
+
+cn="$1"
+parm="$2"
+
+if [ ! -f "$EASYRSA_PKI/private/${cn}.key" ]; then
+    echo "Unable to find \"${cn}\", please try again or generate the key first" >&2
+    exit 1
+fi
+
+revoke_client_certificate(){
+    # Download EasyRSA because Ubuntu doesn't have it as a CLI command
+    /usr/share/easy-rsa/easyrsa revoke "$1"
+    echo "Generating the Certificate Revocation List :"
+    /usr/share/easy-rsa/easyrsa gen-crl
+    cp -f "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
+    chmod 644 "$OPENVPN/crl.pem"
+}
+
+remove_files(){
+    rm -v "$EASYRSA_PKI/issued/${1}.crt"
+    rm -v "$EASYRSA_PKI/private/${1}.key"
+    rm -v "$EASYRSA_PKI/reqs/${1}.req"
+}
+
+case "$parm" in
+    "remove")
+        revoke_client_certificate "$cn"
+        remove_files "$cn"
+        ;;
+    "" | "keep")
+        revoke_client_certificate "$cn"
+        ;;
+    *)
+        echo "When revoking a client certificate, this script let you choose if you want to remove the corresponding crt, key and req files." >&2
+        echo "Pease note that the removal of those files is required if you want to generate a new client certificate using the revoked certificate's CN." >&2
+        echo "    1. keep (default): Keep the files." >&2
+        echo "    2. remove: Remove the files." >&2
+        echo "Please specify one of those options as second parameter." >&2
+        ;;
+esac
--- a/bin/ovpn_run
+++ b/bin/ovpn_run
@ -74,13 +74,14 @@ if [ "$OVPN_DEFROUTE" != "0" ] || [ "$OVPN_NAT" == "1" ] ; then
 	setupIptablesAndRouting
 fi

-# Use a hacky hardlink as the CRL Needs to be readable by the user/group
+# Use a copy of crl.pem as the CRL Needs to be readable by the user/group
 # OpenVPN is running as.  Only pass arguments to OpenVPN if it's found.
-if [ -r "$EASYRSA_PKI/crl.pem" ]; then
-    if [ ! -r "$OPENVPN/crl.pem" ]; then
-        ln "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
-        chmod 644 "$OPENVPN/crl.pem"
-    fi
+if [ "$EASYRSA_PKI/crl.pem" -nt "$OPENVPN/crl.pem" ]; then
+    cp -f "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
+    chmod 644 "$OPENVPN/crl.pem"
+fi
+
+if [ -r "$OPENVPN/crl.pem" ]; then
    addArg "--crl-verify" "$OPENVPN/crl.pem"
 fi

@ -90,6 +91,7 @@ if [ $? = 0 ]; then
    # If this fails, ensure the docker container is run with --privileged
    # Could be side stepped with `ip netns` madness to drop privileged flag

+    sysctl -w net.ipv6.conf.all.disable_ipv6=0 || echo "Failed to enable IPv6 support"
    sysctl -w net.ipv6.conf.default.forwarding=1 || echo "Failed to enable IPv6 Forwarding default"
    sysctl -w net.ipv6.conf.all.forwarding=1 || echo "Failed to enable IPv6 Forwarding"
 fi
--- a/containerfiles/Containerfile
+++ b/containerfiles/Containerfile
@ -0,0 +1,67 @@
+FROM ghcr.io/allanger/dumb-downloader as dudo
+ENV OPENVPN_VERSION=2.6.8
+RUN apt update && apt install gnupg tar -y
+RUN mkdir /output
+# ------------------------------------------------------
+# -- Downlaod OpenVPN
+# ------------------------------------------------------
+RUN dudo -l "https://keys.openpgp.org/vks/v1/by-fingerprint/F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7" -d security-openvpn-net.asc -p DUMMY
+RUN gpg --import security-openvpn-net.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz.asc" -d /tmp/openvpn.asc -p $OPENVPN_VERSION
+# ------------------------------------------------------
+# -- I should fix it later
+# ------------------------------------------------------
+# RUN gpg  --no-tty --verify /tmp/openvpn.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz " -d /tmp/openvpn.tar.gz -p $OPENVPN_VERSION
+RUN tar -xf /tmp/openvpn.tar.gz  -C /tmp && rm -f /tmp/openvpn.tar.gz
+RUN mv /tmp/openvpn-$OPENVPN_VERSION /output/openvpn
+
+FROM ubuntu as builder
+# ------------------------------------------------------
+# -- TODO: Define it only once
+# ------------------------------------------------------
+ENV OPENVPN_VERSION=2.6.8
+COPY --from=dudo /output /src
+RUN apt-get update &&\
+      apt-get install -y wget tar unzip build-essential \
+      libssl-dev iproute2 liblz4-dev liblzo2-dev \
+      libpam0g-dev libpkcs11-helper1-dev libsystemd-dev \
+      easy-rsa iptables pkg-config libcap-ng-dev
+WORKDIR /src/openvpn
+RUN ./configure --disable-systemd --enable-async-push --enable-iproute2
+RUN make && make install
+RUN mkdir /output
+RUN cp $(which openvpn) /output/
+
+# ------------------------------------------------------
+# -- Final container
+# ------------------------------------------------------
+FROM ubuntu:22.04
+LABEL maintainer="allanger <allanger@zohomail.com>"
+COPY --from=builder /output /src
+# -------------------------------------------------------
+# -- Prepare system deps
+# -------------------------------------------------------
+RUN apt update && apt install openvpn easy-rsa iptables -y && \
+  mv /src/openvpn $(which openvpn)
+
+# Needed by scripts
+ENV OPENVPN /etc/openvpn
+
+# Prevents refused client connection because of an expired CRL
+ENV EASYRSA_CRL_DAYS 3650
+
+VOLUME ["/etc/openvpn"]
+
+# Internally uses port 1194, remap if needed using `docker run -p 443:1194/tcp`
+EXPOSE 1194
+
+CMD ["ovpn_run"]
+
+COPY --chmod='755' ./bin /usr/local/bin
+# -----------------------------------------------------------
+# -- Add support for OTP authentication using a PAM module
+# -- I have no idea how it works yet
+# -----------------------------------------------------------
+WORKDIR /etc/openvpn
+COPY ./otp/openvpn /etc/pam.d/
--- a/containerfiles/Containerfile-XOR
+++ b/containerfiles/Containerfile-XOR
@ -0,0 +1,79 @@
+FROM ghcr.io/allanger/dumb-downloader as dudo
+ENV OPENVPN_VERSION=2.6.5
+ENV TUNNELBLICK_VERSION=4.0.0beta08
+RUN apt update && apt install gnupg tar -y
+RUN mkdir /output
+# ------------------------------------------------------
+# -- Downlaod OpenVPN
+# ------------------------------------------------------
+RUN dudo -l "https://keys.openpgp.org/vks/v1/by-fingerprint/F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7" -d security-openvpn-net.asc -p DUMMY
+RUN gpg --import security-openvpn-net.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz.asc" -d /tmp/openvpn.asc -p $OPENVPN_VERSION
+# ------------------------------------------------------
+# -- I should fix it later
+# ------------------------------------------------------
+# RUN gpg  --no-tty --verify /tmp/openvpn.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz " -d /tmp/openvpn.tar.gz -p $OPENVPN_VERSION
+RUN tar -xf /tmp/openvpn.tar.gz  -C /tmp && rm -f /tmp/openvpn.tar.gz
+RUN mv /tmp/openvpn-$OPENVPN_VERSION /output/openvpn
+# ------------------------------------------------------
+# -- Download Tunnelblick
+# ------------------------------------------------------
+RUN dudo -l "https://github.com/Tunnelblick/Tunnelblick/archive/refs/tags/v{{ version }}.tar.gz" -d /tmp/tunnelblick.tar.gz -p $TUNNELBLICK_VERSION
+RUN tar -xf /tmp/tunnelblick.tar.gz  -C /tmp && rm -f /tmp/tunnelblick.tar.gz
+RUN mv /tmp/Tunnelblick-$TUNNELBLICK_VERSION /output/tunnelblick
+
+FROM ubuntu as builder
+# ------------------------------------------------------
+# -- TODO: Define it only once
+# ------------------------------------------------------
+ENV OPENVPN_VERSION=2.6.5
+ENV TUNNELBLICK_VERSION=v4.0.0beta08
+COPY --from=dudo /output /src
+RUN apt-get update &&\
+      apt-get install -y wget tar unzip build-essential \
+      libssl-dev iproute2 liblz4-dev liblzo2-dev \
+      libpam0g-dev libpkcs11-helper1-dev libsystemd-dev \
+      easy-rsa iptables pkg-config libcap-ng-dev
+RUN cp /src/tunnelblick/third_party/sources/openvpn/openvpn-$OPENVPN_VERSION/patches/*.diff /src/openvpn
+WORKDIR /src/openvpn
+RUN for patch in $(find -type f | grep diff); do\
+        patch -p1 < $patch;\
+    done
+RUN ./configure --disable-systemd --enable-async-push --enable-iproute2
+RUN make && make install
+RUN mkdir /output
+RUN cp $(which openvpn) /output/
+
+# ------------------------------------------------------
+# -- Final container
+# ------------------------------------------------------
+FROM ubuntu:22.04
+LABEL maintainer="allanger <allanger@zohomail.com>"
+COPY --from=builder /output /src
+# -------------------------------------------------------
+# -- Prepare system deps
+# -------------------------------------------------------
+RUN apt update && apt install openvpn easy-rsa iptables -y && \
+  mv /src/openvpn $(which openvpn)
+
+# Needed by scripts
+ENV OPENVPN /etc/openvpn
+
+# Prevents refused client connection because of an expired CRL
+ENV EASYRSA_CRL_DAYS 3650
+
+VOLUME ["/etc/openvpn"]
+
+# Internally uses port 1194, remap if needed using `docker run -p 443:1194/tcp`
+EXPOSE 1194
+
+CMD ["ovpn_run"]
+
+COPY --chmod='755' ./bin /usr/local/bin
+# -----------------------------------------------------------
+# -- Add support for OTP authentication using a PAM module
+# -- I have no idea how it works yet
+# -----------------------------------------------------------
+WORKDIR /etc/openvpn
+COPY ./otp/openvpn /etc/pam.d/
--- a/docs/clients.md
+++ b/docs/clients.md
@ -11,10 +11,12 @@ Note that some client software might be picky about which configuration format i

 ## Client List

-See an overview of the configured clients, including revocation status:
+See an overview of the configured clients, including revocation and expiration status:

    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn ovpn_listclients

+ The output is generated using `openssl verify`. Error codes from the verification process different from `X509_V_ERR_CERT_HAS_EXPIRED` or `X509_V_ERR_CERT_REVOKED` will show the status `INVALID`.
+
 ## Batch Mode

 If you have more than a few clients, you will want to generate and update your client configuration in batch. For this task the script [`ovpn_getclient_all`](/bin/ovpn_getclient_all) was written, which writes out the configuration for each client to a separate directory called `clients/$cn`.
@ -34,9 +36,12 @@ After doing so, you will find the following files in each of the `$cn` directori

 ## Revoking Client Certificates

-Revoke `client1`'s certificate and generate the certificate revocation list (CRL):
+Revoke `client1`'s certificate and generate the certificate revocation list (CRL) using [`ovpn_revokeclient`](/bin/ovpn_revokeclient) script :

-    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn easyrsa revoke client1
-    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn easyrsa gen-crl
+    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn ovpn_revokeclient client1

 The OpenVPN server will read this change every time a client connects (no need to restart server) and deny clients access using revoked certificates.
+
+You can optionally pass `remove` as second parameter to ovpn_revokeclient to remove the corresponding crt, key and req files :
+
+    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn ovpn_revokeclient client1 remove
--- a/docs/debug.md
+++ b/docs/debug.md
@ -4,8 +4,8 @@ Random things I do to debug the containers.

 ## Login Shells

-* Create a shell in the running docker container (aka namespace) with [nsenter](https://github.com/jpetazzo/nsenter)
-* If you don't have nsenter/docker-enter, you can mount the data container and modify it with
+* Create a shell in the running docker container with `docker exec`.
+* To modify the data, you can also mount the data container and modify it with

        docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn bash -l

--- a/docs/docker-compose.md
+++ b/docs/docker-compose.md
@ -59,10 +59,19 @@ docker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME nopass
 docker-compose run --rm openvpn ovpn_getclient $CLIENTNAME > $CLIENTNAME.ovpn
 ```

+* Revoke a client certificate
+
+```bash
+# Keep the corresponding crt, key and req files.
+docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME
+# Remove the corresponding crt, key and req files.
+docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME remove
+```
+
 ## Debugging Tips

 * Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").

 ```bash
-docker-compose run -e DEBUG=1 openvpn
+docker-compose run -e DEBUG=1 -p 1194:1194/udp openvpn
 ```
--- a/docs/faqs.md
+++ b/docs/faqs.md
@ -2,9 +2,9 @@

 ## How do I edit `openvpn.conf`?

-Use a Docker image with a text editor pre-installed (i.e. Ubuntu) and connect the volume container:
+Use a Docker image with an editor and connect the volume container:

-    docker run -v $OVPN_DATA:/etc/openvpn --rm -it ubuntu vi /etc/openvpn/openvpn.conf
+    docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn vi /etc/openvpn/openvpn.conf


 ## Why not keep everything in one image?
--- a/docs/paranoid.md
+++ b/docs/paranoid.md
@ -1,6 +1,6 @@
 # Advanced security

-## Keep the CA root key save
+## Keep the CA root key safe
 As mentioned in the [backup section](/docs/backup.md), there are good reasons to not generate the CA and/or leave it on the server. This document describes how you can generate the CA and all your certificates on a secure machine and then copy only the needed files (which never includes the CA root key obviously ;) ) to the server(s) and clients.

 Execute the following commands. Note that you might want to change the volume `$PWD` or use a data docker container for this.
@ -13,7 +13,7 @@ The [`ovpn_copy_server_files`](/bin/ovpn_copy_server_files) script puts all the

 ## Crypto Hardening

-If you want to select the cyphers used by OpenVPN the following parameters of the `ovpn_genconfig` might interest you:
+If you want to select the ciphers used by OpenVPN the following parameters of the `ovpn_genconfig` might interest you:

    -T    Encrypt packets with the given cipher algorithm instead of the default one (tls-cipher).
    -C    A list of allowable TLS ciphers delimited by a colon (cipher).
--- a/docs/systemd.md
+++ b/docs/systemd.md
@ -15,11 +15,17 @@ are harmless for those not using IPv6.
 To use and enable automatic start by systemd:

 1. Create a Docker volume container named `ovpn-data-NAME` where `NAME` is the
-   user's choice to describe the use of the container.  In the example
-   configuration given in the [README](/README.md) `NAME=data`.
-2. Initialize the data container according to the [docker-openvpn
-   README](/README.md), but don't start the container. Stop the Docker
-   container if started.
+   user's choice to describe the use of the container.  In this example
+   configuration, `NAME=example`.
+   
+        OVPN_DATA="ovpn-data-example"
+        docker volume create --name $OVPN_DATA
+   
+2. Initialize the data container, but don't start the container :
+   
+       docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM
+       docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki
+   
 3. Download the [docker-openvpn@.service](https://raw.githubusercontent.com/kylemanna/docker-openvpn/master/init/docker-openvpn%40.service)
   file to `/etc/systemd/system`:

@ -27,11 +33,11 @@ To use and enable automatic start by systemd:

 4. Enable and start the service with:

-        systemctl enable --now docker-openvpn@NAME.service
+        systemctl enable --now docker-openvpn@example.service

 5. Verify service start-up with:

-        systemctl status docker-openvpn@NAME.service
-        journalctl --unit docker-openvpn@NAME.service
+        systemctl status docker-openvpn@example.service
+        journalctl --unit docker-openvpn@example.service

 For more information, see the [systemd manual pages](https://www.freedesktop.org/software/systemd/man/index.html).
--- a/docs/tcp.md
+++ b/docs/tcp.md
@ -29,3 +29,17 @@ This allows you to use UDP most of the time, but fall back to TCP on the rare oc

 Note that you will need to configure client connections manually. At this time it is not possible to generate a client config that will automatically fall back to the TCP connection.

+## Forward HTTP/HTTPS connection to another TCP port
+You might run into cases where you want your OpenVPN server listening on TCP port 443 to allow connection behind a restricted network, but you already have a webserver on your host running on that port. OpenVPN has a built-in option named `port-share` that allow you to proxy incoming traffic that isn't OpenVPN protocol to another host and port.
+
+First, change the listening port of your existing webserver (for instance from 443 to 4433).
+
+Then initialize the data container by specifying the TCP protocol, port 443 and the port-share option:
+
+    docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig \
+    -u tcp://VPN.SERVERNAME.COM:443 \
+    -e 'port-share VPN.SERVERNAME.COM 4433'
+    
+Then proceed to initialize the pki, create your users and start the container as usual.
+    
+This will proxy all non OpenVPN traffic incoming on TCP port 443 to TCP port 4433 on the same host. This is currently only designed to work with HTTP or HTTPS protocol.
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@ -0,0 +1,22 @@
+---
+apiVersion: v2
+name: openvpn
+description: A Helm chart for deploying OpenVPN
+type: application
+version: 1.0.8
+appVersion: 2.6.5
+
+sources:
+  - https://git.badhouseplants.net/allanger/container-openvpn-xor
+  - https://github.com/kylemanna/docker-openvpn
+  - https://github.com/lawtancool/docker-openvpn-xor
+
+maintainers:
+  - name: allanger
+    email: allanger@zohomail.com
+    url: https://badhouseplants.net
+
+keywords:
+  - OpenVPN
+  - VPN
+  - xor
--- a/helm/LICENSE
+++ b/helm/LICENSE
@ -0,0 +1,17 @@
+Permission is hereby granted, without written agreement and without
+license or royalty fees, to use, copy, modify, and distribute this
+software and its documentation for any purpose, provided that the
+above copyright notice and the following two paragraphs appear in
+all copies of this software.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR
+DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN
+IF THE COPYRIGHT HOLDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGE.
+
+THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING,
+BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO
+PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
--- a/helm/README.md
+++ b/helm/README.md
@ -0,0 +1,9 @@
+# helm-openvpn
+
+A helm chart to deploy openvpn
+## K8s reqs:
+--allowed-unsafe-sysctls=net.ipv4.ip_forward
+## How it works?
+
+1. It's generating the openvpn configuration if it's not generated yet. It's an `ininContainer` that really runs only once.
+
--- a/helm/templates/NOTES.txt
+++ b/helm/templates/NOTES.txt
@ -0,0 +1 @@
+1. Get the application URL by running these commands:
--- a/helm/templates/_helpers.tpl
+++ b/helm/templates/_helpers.tpl
@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "openvpn-chart.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "openvpn-chart.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "openvpn-chart.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "openvpn-chart.labels" -}}
+helm.sh/chart: {{ include "openvpn-chart.chart" . }}
+{{ include "openvpn-chart.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "openvpn-chart.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "openvpn-chart.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "openvpn-chart.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "openvpn-chart.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
--- a/helm/templates/deployment.yaml
+++ b/helm/templates/deployment.yaml
@ -0,0 +1,128 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}
+  labels:
+    {{- include "openvpn-chart.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "openvpn-chart.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "openvpn-chart.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: pvc-openvpn
+          persistentVolumeClaim:
+            claimName: {{ include "openvpn-chart.fullname" . }}
+        - name: pki-scripts
+          configMap:
+            name: {{ include "openvpn-chart.fullname" . }}-pki-scripts
+      securityContext:
+          sysctls:
+            - name: net.ipv4.ip_forward
+              value: "1"
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: "/etc/openvpn"
+              name: pvc-openvpn
+            - mountPath: /scripts
+              name: pki-scripts
+          env:
+            - name: OVPN_SERVER
+              value: "{{ .Values.openvpn.proto }}://{{ .Values.openvpn.host }}:{{ .Values.openvpn.port }}"
+            - name: OPENVPN
+              value: "/etc/openvpn"
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+      initContainers:
+        # ----------------------------------------------------------------------
+        # -- This init container is generating the basic configuration
+        # ----------------------------------------------------------------------
+        - name: 0-ovpn-genconfig
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - mountPath: "/etc/openvpn"
+              name: pvc-openvpn
+          env:
+            - name: OVPN_SERVER_URL
+              value: "{{ .Values.openvpn.proto }}://{{ .Values.openvpn.host }}:{{ .Values.openvpn.port }}"
+            - name: OVPN_DATA
+              value: "/etc/openvpn"
+            - name: OPENVPN
+              value: "/etc/openvpn"
+          command: 
+            - sh
+            - -c 
+            - 'if ! [ -f "/etc/openvpn/ovpn_env.sh" ]; then ovpn_genconfig -u $OVPN_SERVER_URL && touch /etc/openvpn/.init; fi'
+        - name: 1-ovpn-initpki
+          env:
+            - name: OVPN_DATA
+              value: /etc/openvpn
+            - name: OPENVPN
+              value: "/etc/openvpn"
+            - name: EASYRSA_REQ_CN
+              value: {{ .Values.easyrsa.cn }}
+            - name: EASYRSA_REQ_COUNTRY
+              value: {{ .Values.easyrsa.country }}
+            - name: EASYRSA_REQ_PROVINCE
+              value: {{ .Values.easyrsa.province }}
+            - name: EASYRSA_REQ_CITY
+              value: {{ .Values.easyrsa.city }}
+            - name: EASYRSA_REQ_ORG
+              value: {{ .Values.easyrsa.org }}
+            - name: EASYRSA_REQ_EMAIL
+              value: {{ .Values.easyrsa.email }}
+            - name: EASYRSA_REQ_OU
+              value: {{ .Values.easyrsa.ou }}
+            - name: EASYRSA_ALGO
+              value: {{ .Values.easyrsa.algo }}
+            - name: EASYRSA_DIGEST
+              value: {{ .Values.easyrsa.digest }}
+            - name: EASYRSA_BATCH
+              value: "yes" 
+            - name: OVPN_SERVER_URL
+              value: "{{ .Values.openvpn.proto }}://{{ .Values.openvpn.host }}:{{ .Values.openvpn.port }}"
+          volumeMounts:
+            - mountPath: "/etc/openvpn"
+              name: pvc-openvpn
+            - mountPath: /scripts
+              name: pki-scripts
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: 
+            - bash
+            - /scripts/init_pki.sh
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
--- a/helm/templates/pki-generate-scripts.yaml
+++ b/helm/templates/pki-generate-scripts.yaml
@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-pki-scripts
+  labels:
+    {{- include "openvpn-chart.labels" . | nindent 4 }}
+data:
+  init_pki.sh: |
+    if [ ! -d /etc/openvpn/pki ]; then
+      source "$OPENVPN/ovpn_env.sh"
+      OVPN_DIR=/etc/openvpn
+      PKI_DIR=$OVPN_DIR/pki
+      cd $OVPN_DIR
+      export EASYRSA_BATCH=yes
+      unset EASYRSA_VARS_FILE
+      /usr/share/easy-rsa/easyrsa init-pki
+      /usr/share/easy-rsa/easyrsa build-ca nopass
+      /usr/share/easy-rsa/easyrsa build-server-full {{ .Values.openvpn.host }} nopass
+      /usr/share/easy-rsa/easyrsa gen-dh
+      cd $PKI_DIR
+      openvpn --genkey tls-crypt-v2-server private/{{ .Values.openvpn.host }}.pem
+      openvpn --genkey secret > ta.key
+    fi
+  gen_client.sh: |
+    source "$OPENVPN/ovpn_env.sh"
+    CLIENTNAME=$1
+    PASSWORD=$2
+    OVPN_DIR=/etc/openvpn
+    cd $OVPN_DIR
+    /usr/share/easy-rsa/easyrsa build-client-full $CLIENTNAME $PASSWORD
--- a/helm/templates/pvc.yaml
+++ b/helm/templates/pvc.yaml
@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}
+  labels:
+    {{- include "openvpn-chart.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.storage.class }}
+  {{- if (eq "-" .Values.storage.class) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: "{{ .Values.storage.class }}"
+  {{- end }}
+  {{- end }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.size }}
--- a/helm/templates/service.yaml
+++ b/helm/templates/service.yaml
@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}
+  labels:
+    {{- include "openvpn-chart.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      {{- if .Values.service.nodePort }}
+      nodePort: {{ int .Values.service.nodePort }}
+      {{- end}}
+      targetPort: {{ .Values.service.port | default 1194 }}
+      protocol: {{ .Values.service.protocol | default "UDP" | quote }}
+      name: openvpn
+  selector:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
--- a/helm/templates/tests/test-connection.yaml
+++ b/helm/templates/tests/test-connection.yaml
@ -0,0 +1,200 @@
+
+{{- $version := semver .Capabilities.KubeVersion.Version }}
+{{- if .Values.tests.enabled }}
+# ---------------------------------------------------------------------
+# -- Test that CRDs are installed
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test-script
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "6"
+data:
+  get_config.sh: |-
+    #!/bin/bash
+    kubectl rollout status deployment/{{ include "openvpn-chart.fullname" . }}
+    kubectl exec deployment/{{ include "openvpn-chart.fullname" . }} -- ovpn_genclientcert test nopass
+    kubectl exec deployment/{{ include "openvpn-chart.fullname" . }} -- ovpn_getclient test > /data/test.ovpn
+  test_connection.sh : |-
+    sed -i "s/127.0.0.1/{{ include "openvpn-chart.fullname" . }}/g" /data/test.ovpn
+    mkdir -p /dev/net
+    mknod /dev/net/tun c 10 200
+    chmod 600 /dev/net/tun
+    openvpn --config /data/test.ovpn --daemon --log-append /tmp/ovpnlog
+    tail -n0 -f /tmp/ovpnlog | sed '/Initialization Sequence Completed/ q'
+    
+--- 
+# ---------------------------------------------------------------------
+# -- Prepare roles and bindings to access k8s resources from the test
+# ---------------------------------------------------------------------
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test-role
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "1"
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "1"
+automountServiceAccountToken: true
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-rb
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "1"
+subjects:
+- kind: ServiceAccount
+  name: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "openvpn-chart.fullname" . }}-test-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "7"
+  labels:
+    {{- include "openvpn-chart.labels" . | nindent 4 }}
+spec:
+  storageClassName: {{ .Values.storage.class }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 512Mi
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "7"
+spec:
+  serviceAccountName: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  automountServiceAccountToken: true
+  volumes:
+    - name: test-script
+      configMap:
+        name: {{ include "openvpn-chart.fullname" . }}-test-script
+    - name: data
+      persistentVolumeClaim:
+        claimName: {{ include "openvpn-chart.fullname" . }}-test
+  containers:
+    - name: tester
+      image: alpine/k8s:{{ $version.Major }}.{{ $version.Minor }}.{{ $version.Patch }}
+      volumeMounts:
+        - name: test-script
+          readOnly: true
+          mountPath: /get_config.sh
+          subPath: get_config.sh
+        - name: data
+          readOnly: false
+          mountPath: /data
+      command: 
+        - bash
+      args:
+        - -e
+        - /get_config.sh
+  restartPolicy: Never
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test-connection
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "7"
+spec:
+  serviceAccountName: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  automountServiceAccountToken: true
+  volumes:
+    - name: data
+      persistentVolumeClaim:
+        claimName: {{ include "openvpn-chart.fullname" . }}-test
+    - name: test-script
+      configMap:
+        name: {{ include "openvpn-chart.fullname" . }}-test-script
+  containers:
+    - name: tester
+      image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+      imagePullPolicy: {{ .Values.image.pullPolicy }}
+      volumeMounts:
+        - name: data
+          readOnly: false
+          mountPath: /data
+        - name: test-script
+          readOnly: true
+          mountPath: /test_connection.sh
+          subPath: test_connection.sh
+      command: 
+        - bash
+      args:
+        - -e
+        - /test_connection.sh
+      securityContext:
+        capabilities:
+          add:
+            - NET_ADMIN
+
+  restartPolicy: Never
+
+{{- end }}
--- a/helm/values.yaml
+++ b/helm/values.yaml
@ -0,0 +1,89 @@
+# Default values for openvpn-chart.
+image:
+  repository: git.badhouseplants.net/allanger/container-openvpn
+  pullPolicy: Always
+  # -------------------------------------------
+  # -- TODO: Switch to proper versions
+  # -------------------------------------------
+  # tag: ""
+# -----------------------------
+# -- Open VPN configuration
+# -----------------------------
+openvpn:
+  proto: tcp
+  host: 127.0.0.1
+  port: 1194
+# ---------------------------------------
+# -- Deploy OpenVPN admin
+# -- https://github.com/flant/ovpn-admin
+# ---------------------------------------
+openvpn_admin:
+  enabled: true
+# -----------------------------
+# -- Easy RSA configuration
+# -----------------------------
+easyrsa:
+  cn: .  # --  EASYRSA_REQ_CN
+  country: .  # --  EASYRSA_REQ_COUNTRY
+  province: .  # --  EASYRSA_REQ_PROVINCE
+  city: .  # --  EASYRSA_REQ_CITY
+  org: .  # --  EASYRSA_REQ_ORG
+  email: .  # --  EASYRSA_REQ_EMAIL
+  ou: Community  # --  EASYRSA_REQ_OU
+  algo: ec  # --  EASYRSA_ALGO
+  digest: sha512  # --  EASYRSA_DIGEST
+replicaCount: 1
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+storage:
+  class: ""
+  size: 1Gi
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+podAnnotations: {}
+podSecurityContext: {}
+# fsGroup: 2000
+
+securityContext: {}
+# capabilities:
+#   drop:
+#   - ALL
+# readOnlyRootFilesystem: true
+# runAsNonRoot: true
+# runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 1194
+  protocol: TCP
+resources: {}
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+nodeSelector: {}
+tolerations: []
+affinity: {}
+tests:
+  enabled: false
+  cleanup: true
--- a/init/docker-openvpn@.service
+++ b/init/docker-openvpn@.service
@ -33,8 +33,8 @@
 [Unit]
 Description=OpenVPN Docker Container
 Documentation=https://github.com/kylemanna/docker-openvpn
-After=network.target docker.socket
-Requires=docker.socket
+After=network.target docker.service
+Requires=docker.service

 [Service]
 RestartSec=10
@ -64,7 +64,7 @@ ExecStartPre=-/usr/bin/docker pull $IMG
 ExecStartPre=/bin/sh -c 'test -z "$IP6_PREFIX" && exit 0; sysctl net.ipv6.conf.all.forwarding=1'

 # Main process
-ExecStart=/usr/bin/docker run --rm --privileged -v ${DATA_VOL}:/etc/openvpn --name ${NAME} -p ${PORT} ${IMG} ovpn_run $ARGS
+ExecStart=/usr/bin/docker run --rm --cap-add=NET_ADMIN -v ${DATA_VOL}:/etc/openvpn --name ${NAME} -p ${PORT} ${IMG} ovpn_run $ARGS

 # IPv6: Add static route for IPv6 after it starts up
 ExecStartPost=/bin/sh -c 'test -z "${IP6_PREFIX}" && exit 0; sleep 1; ip route replace ${IP6_PREFIX} via $(docker inspect -f "{{ .NetworkSettings.GlobalIPv6Address }}" $NAME ) dev docker0'
--- a/init/upstart.init
+++ b/init/upstart.init
@ -4,5 +4,5 @@ start on filesystem and started docker
 stop on runlevel [!2345]
 respawn
 script
-  exec docker run -v ovpn-data:/etc/openvpn --rm -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
+  exec docker run -v ovpn-data-example:/etc/openvpn --rm -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
 end script
--- a/kind.yaml
+++ b/kind.yaml
@ -0,0 +1,21 @@
+apiVersion: kind.x-k8s.io/v1alpha4
+kind: Cluster
+name: test
+networking:
+  apiServerAddress: "0.0.0.0"
+  apiServerPort: 16443
+kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+          allowed-unsafe-sysctls: net.ipv4.ip_forward
+nodes:
+  - role: control-plane
+    kubeadmConfigPatches:
+      - |
+        kind: ClusterConfiguration
+        apiServer:
+          certSANs:
+          - "docker"
+  - role: worker
--- a/otp/openvpn
+++ b/otp/openvpn
@ -1,6 +1,6 @@
 # Uses google authenticator library as PAM module using a single folder for all users tokens
 # User root is required to stick with an hardcoded user when trying to determine user id and allow unexisting system users
-# See https://github.com/google/google-authenticator/tree/master/libpam#secretpathtosecretfile--usersome-user
+# See https://github.com/google/google-authenticator-libpam#usersome-user
 auth required pam_google_authenticator.so secret=/etc/openvpn/otp/${USER}.google_authenticator user=root

 # Accept any user since we're dealing with virtual users there's no need to have a system account (pam_unix.so)
--- a/test/config.sh
+++ b/test/config.sh
@ -7,11 +7,13 @@ testAlias+=(

 imageTests+=(
 	[openvpn]='
-		paranoid
+	paranoid
        conf_options
+        client
        basic
        dual-proto
        otp
 	iptables
+	revocation
 	'
 )
--- a/test/tests/client/container.sh
+++ b/test/tests/client/container.sh
@ -0,0 +1,84 @@
+#!/bin/bash
+
+SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
+SERVER_CONF="/etc/openvpn/openvpn.conf"
+TEST1_OVPN="/etc/openvpn/test1.ovpn"
+
+# Function to fail
+abort() { cat <<< "$@" 1>&2; exit 1; }
+
+# Check a config (haystack) for a given line (needle) exit with error if not
+# found.
+test_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -q "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match not found: ${needle}"
+    fi
+}
+
+# Check a config (haystack) for absence of given line (needle) exit with error
+# if found.
+test_not_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -vq "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match found: ${needle}"
+    fi
+}
+
+
+#
+# Generate openvpn.config file
+#
+
+ovpn_genconfig \
+    -u udp://$SERV_IP \
+    -m 1337 \
+
+
+EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
+
+easyrsa build-client-full test1 nopass 2>/dev/null
+
+ovpn_getclient test1 > "${TEST1_OVPN}"
+
+
+#
+# Simple test cases
+#
+
+# 1. client MTU
+test_config "${TEST1_OVPN}" "^tun-mtu\s\+1337"
+
+
+#
+# Test udp client with tcp fallback
+#
+ovpn_genconfig -u udp://$SERV_IP -E "remote $SERV_IP 443 tcp" -E "remote vpn.example.com 443 tcp"
+# nopass is insecure
+EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
+easyrsa build-client-full client-fallback nopass
+ovpn_getclient client-fallback > "${TEST1_OVPN}"
+
+test_config "${TEST1_OVPN}" "^remote\s\+$SERV_IP\s\+443\s\+tcp"
+test_config "${TEST1_OVPN}" "^remote\s\+vpn.example.com\s\+443\s\+tcp"
+
+
+#
+# Test non-defroute config
+#
+ovpn_genconfig -d -u udp://$SERV_IP -r "172.33.33.0/24" -r "172.34.34.0/24"
+# nopass is insecure
+EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
+easyrsa build-client-full non-defroute nopass
+ovpn_getclient non-defroute > "${TEST1_OVPN}"
+
+# The '!' inverts the match to test that the string isn't present
+test_not_config "${TEST1_OVPN}" "^redirect-gateway\s\+def1"
--- a/test/tests/client/run.sh
+++ b/test/tests/client/run.sh
@ -0,0 +1 @@
+../run-bash-in-container.sh
--- a/test/tests/conf_options/container.sh
+++ b/test/tests/conf_options/container.sh
@ -1,8 +1,37 @@
 #!/bin/bash

+SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
+SERVER_CONF="/etc/openvpn/openvpn.conf"
+TEST1_OVPN="/etc/openvpn/test1.ovpn"
+
 # Function to fail
 abort() { cat <<< "$@" 1>&2; exit 1; }

+# Check a config (haystack) for a given line (needle) exit with error if not found.
+test_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -q "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match not found: ${needle}"
+    fi
+}
+
+# Check a config (haystack) for absence of given line (needle) exit with error
+# if found.
+test_not_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -vq "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match found: ${needle}"
+    fi
+}
+

 #
 # Generate openvpn.config file
@ -12,183 +41,76 @@ management localhost 7505
 max-clients 10
 EOF

-SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
-ovpn_genconfig -u udp://$SERV_IP -f 1400 -e "$MULTILINE_EXTRA_SERVER_CONF" -e 'duplicate-cn' -e 'topology subnet' -p 'route 172.22.22.0 255.255.255.0'
+ovpn_genconfig \
+    -u udp://$SERV_IP \
+    -f 1400 \
+    -k '60 300' \
+    -e "$MULTILINE_EXTRA_SERVER_CONF" \
+    -e 'duplicate-cn' \
+    -e 'topology subnet' \
+    -p 'route 172.22.22.0 255.255.255.0' \
+
+# Run ovpn_genconfig a second time with no arguments to test its repeatability.
+ovpn_genconfig

 #
-# grep for config lines from openvpn.conf
-# add more tests for more configs as required
+# Simple test cases
 #

 # 1. verb config
-CONFIG_REQUIRED_VERB="verb 3"
-CONFIG_MATCH_VERB=$(busybox grep verb /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^verb\s\+3"

 # 2. fragment config
-CONFIG_REQUIRED_FRAGMENT="fragment 1400"
-CONFIG_MATCH_FRAGMENT=$(busybox grep fragment /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^fragment\s\+1400"

 ## Tests for extra configs
 # 3. management config
-CONFIG_REQUIRED_MANAGEMENT="^management localhost 7505"
-CONFIG_MATCH_MANAGEMENT=$(busybox grep management /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^management\s\+localhost\s\+7505"

 # 4. max-clients config
-CONFIG_REQUIRED_MAX_CLIENTS="^max-clients 10"
-CONFIG_MATCH_MAX_CLIENTS=$(busybox grep max-clients /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^max-clients\s\+10"

 # 5. duplicate-cn config
-CONFIG_REQUIRED_DUPCN="^duplicate-cn"
-CONFIG_MATCH_DUPCN=$(busybox grep duplicate-cn /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^duplicate-cn"

 # 6. topology config
-CONFIG_REQUIRED_TOPOLOGY="^topology subnet"
-CONFIG_MATCH_TOPOLOGY=$(busybox grep 'topology subnet' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^topology\s\+subnet"

 ## Tests for push config
 # 7. push route
-CONFIG_REQUIRED_PUSH_ROUTE="^push route 172.22.22.0 255.255.255.0"
-CONFIG_MATCH_PUSH_ROUTE=$(busybox grep 'push route 172.22.22.0 255.255.255.0' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" '^push\s\+"route\s\+172.22.22.0\s\+255.255.255.0"'

 ## Test for default
 # 8. Should see default route if none provided
-CONFIG_REQUIRED_DEFAULT_ROUTE="^route 192.168.254.0 255.255.255.0"
-CONFIG_MATCH_DEFAULT_ROUTE=$(busybox grep 'route 192.168.254.0 255.255.255.0' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^route\s\+192.168.254.0\s\+255.255.255.0"

 # 9. Should see a push of 'block-outside-dns' by default
-CONFIG_REQUIRED_DEFAULT_ROUTE="^push block-outside-dns"
-CONFIG_MATCH_DEFAULT_ROUTE=$(busybox grep 'push block-outside-dns' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" '^push\s\+"block-outside-dns"'

 # 10. Should see a push of 'dhcp-option DNS' by default
-CONFIG_REQUIRED_DEFAULT_DNS_1="^push dhcp-option DNS 8.8.8.8"
-CONFIG_MATCH_DEFAULT_DNS_1=$(busybox grep 'push dhcp-option DNS 8.8.8.8' /etc/openvpn/openvpn.conf)
-CONFIG_REQUIRED_DEFAULT_DNS_2="^push dhcp-option DNS 8.8.4.4"
-CONFIG_MATCH_DEFAULT_DNS_2=$(busybox grep 'push dhcp-option DNS 8.8.4.4' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" '^push\s\+"dhcp-option\s\+DNS\s\+8.8.8.8"'
+test_config "${SERVER_CONF}" '^push\s\+"dhcp-option\s\+DNS\s\+8.8.4.4"'
+
+## Test for keepalive
+# 11. keepalive config
+test_config "${SERVER_CONF}" '^keepalive\s\+60\s\+300'


 #
-# Tests
+# More elaborate route tests
 #

-if [[ $CONFIG_MATCH_VERB =~ $CONFIG_REQUIRED_VERB ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_VERB == $CONFIG_MATCH_VERB"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_VERB != $CONFIG_MATCH_VERB"
-fi
-
-if [[ $CONFIG_MATCH_FRAGMENT =~ $CONFIG_REQUIRED_FRAGMENT ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_FRAGMENT == $CONFIG_MATCH_FRAGMENT"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_FRAGMENT != $CONFIG_MATCH_FRAGMENT"
-fi
-
-if [[ $CONFIG_MATCH_MANAGEMENT =~ $CONFIG_REQUIRED_MANAGEMENT ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_MANAGEMENT == $CONFIG_MATCH_MANAGEMENT"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_MANAGEMENT != $CONFIG_MATCH_MANAGEMENT"
-fi
-
-
-if [[ $CONFIG_MATCH_MAX_CLIENTS =~ $CONFIG_REQUIRED_MAX_CLIENTS ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_MAX_CLIENTS == $CONFIG_MATCH_MAX_CLIENTS"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_MAX_CLIENTS != $CONFIG_MATCH_MAX_CLIENTS"
-fi
-
-if [[ $CONFIG_MATCH_DUPCN =~ $CONFIG_REQUIRED_DUPCN ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DUPCN == $CONFIG_MATCH_DUPCN"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DUPCN != $CONFIG_MATCH_DUPCN"
-fi
-
-if [[ $CONFIG_MATCH_TOPOLOGY =~ $CONFIG_REQUIRED_TOPOLOGY ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_TOPOLOGY == $CONFIG_MATCH_TOPOLOGY"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_TOPOLOGY != $CONFIG_MATCH_TOPOLOGY"
-fi
-
-if [[ $CONFIG_MATCH_PUSH_ROUTE =~ $CONFIG_REQUIRED_PUSH_ROUTE ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_PUSH_ROUTE == $CONFIG_MATCH_PUSH_ROUTE"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_PUSH_ROUTE != $CONFIG_MATCH_PUSH_ROUTE"
-fi
-
-if [[ $CONFIG_MATCH_DEFAULT_ROUTE =~ $CONFIG_REQUIRED_DEFAULT_ROUTE ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DEFAULT_ROUTE == $CONFIG_MATCH_DEFAULT_ROUTE"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_ROUTE != $CONFIG_MATCH_DEFAULT_ROUTE"
-fi
-
-if [[ $CONFIG_MATCH_DEFAULT_DNS_1 =~ $CONFIG_REQUIRED_DEFAULT_DNS_1 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DEFAULT_DNS_1 == $CONFIG_MATCH_DEFAULT_DNS_1"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_DNS_1 != $CONFIG_MATCH_DEFAULT_DNS_1"
-fi
-
-if [[ $CONFIG_MATCH_DEFAULT_DNS_2 =~ $CONFIG_REQUIRED_DEFAULT_DNS_2 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DEFAULT_DNS_2 == $CONFIG_MATCH_DEFAULT_DNS_2"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_DNS_2 != $CONFIG_MATCH_DEFAULT_DNS_2"
-fi
-
-SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
 ovpn_genconfig -u udp://$SERV_IP -r "172.33.33.0/24" -r "172.34.34.0/24"

-CONFIG_REQUIRED_ROUTE_1="^route 172.33.33.0 255.255.255.0"
-CONFIG_MATCH_ROUTE_1=$(busybox grep 'route 172.33.33.0 255.255.255.0' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^route\s\+172.33.33.0\s\+255.255.255.0"
+test_config "${SERVER_CONF}" "^route\s\+172.34.34.0\s\+255.255.255.0"

-CONFIG_REQUIRED_ROUTE_2="^route 172.34.34.0 255.255.255.0"
-CONFIG_MATCH_ROUTE_2=$(busybox grep 'route 172.34.34.0 255.255.255.0' /etc/openvpn/openvpn.conf)

-if [[ $CONFIG_MATCH_ROUTE_1 =~ $CONFIG_REQUIRED_ROUTE_1 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_ROUTE_1 == $CONFIG_MATCH_ROUTE_1"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_ROUTE_1 != $CONFIG_MATCH_ROUTE_1"
-fi
+#
+# Block outside DNS test
+#

-if [[ $CONFIG_MATCH_ROUTE_2 =~ $CONFIG_REQUIRED_ROUTE_2 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_ROUTE_2 == $CONFIG_MATCH_ROUTE_2"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_ROUTE_2 != $CONFIG_MATCH_ROUTE_2"
-fi
+ovpn_genconfig -u udp://$SERV_IP -b

-# Test generated client config
-
-# gen udp client with tcp fallback
-ovpn_genconfig -u udp://$SERV_IP -E "remote $SERV_IP 443 tcp" -E "remote vpn.example.com 443 tcp"
-# nopass is insecure
-EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
-easyrsa build-client-full client-fallback nopass
-ovpn_getclient client-fallback | tee /etc/openvpn/config-fallback.ovpn
-
-CONFIG_REQUIRED_TCP_REMOTE="^remote $SERV_IP 443 tcp"
-CONFIG_MATCH_TCP_REMOTE=$(busybox grep "remote $SERV_IP 443 tcp" /etc/openvpn/config-fallback.ovpn)
-
-CONFIG_REQUIRED_TCP_REMOTE_2="^remote vpn.example.com 443 tcp"
-CONFIG_MATCH_TCP_REMOTE_2=$(busybox grep "remote vpn.example.com 443 tcp" /etc/openvpn/config-fallback.ovpn)
-
-if [[ $CONFIG_MATCH_TCP_REMOTE =~ $CONFIG_REQUIRED_TCP_REMOTE ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_TCP_REMOTE == $CONFIG_MATCH_TCP_REMOTE"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_TCP_REMOTE != $CONFIG_MATCH_TCP_REMOTE"
-fi
-
-if [[ $CONFIG_MATCH_TCP_REMOTE_2 =~ $CONFIG_REQUIRED_TCP_REMOTE_2 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_TCP_REMOTE_2 == $CONFIG_MATCH_TCP_REMOTE_2"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_TCP_REMOTE_2 != $CONFIG_MATCH_TCP_REMOTE_2"
-fi
+test_not_config "${SERVER_CONF}" '^push "block-outside-dns"'
+cat ${SERVER_CONF} >&1
--- a/test/tests/revocation/run.sh
+++ b/test/tests/revocation/run.sh
@ -0,0 +1,101 @@
+#!/bin/bash
+set -e
+
+[ -n "${DEBUG+x}" ] && set -x
+
+OVPN_DATA="basic-data"
+CLIENT1="travis-client1"
+CLIENT2="travis-client2"
+IMG="kylemanna/openvpn"
+NAME="ovpn-test"
+CLIENT_DIR="$(readlink -f "$(dirname "$BASH_SOURCE")/../../client")"
+SERV_IP="$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)"
+
+#
+# Initialize openvpn configuration and pki.
+#
+docker volume create --name $OVPN_DATA
+docker run --rm -v $OVPN_DATA:/etc/openvpn $IMG ovpn_genconfig -u udp://$SERV_IP
+docker run --rm -v $OVPN_DATA:/etc/openvpn -it -e "EASYRSA_BATCH=1" -e "EASYRSA_REQ_CN=Travis-CI Test CA" $IMG ovpn_initpki nopass
+
+#
+# Fire up the server.
+#
+sudo iptables -N DOCKER || echo 'Firewall already configured'
+sudo iptables -I FORWARD 1 -j DOCKER
+docker run -d -v $OVPN_DATA:/etc/openvpn --cap-add=NET_ADMIN --privileged -p 1194:1194/udp --name $NAME $IMG
+
+
+#
+# Test that easy_rsa generate CRLs with 'next publish' set to 3650 days.
+#
+crl_next_update="$(docker exec $NAME openssl crl -nextupdate -noout -in /etc/openvpn/crl.pem | cut -d'=' -f2 | tr -d 'GMT')"
+crl_next_update="$(date -u -d "$crl_next_update" "+%s")"
+now="$(docker exec $NAME date "+%s")"
+crl_remain="$(( $crl_next_update - $now ))"
+crl_remain="$(( $crl_remain / 86400 ))"
+if (( $crl_remain < 3649 )); then
+    echo "easy_rsa CRL next publish set to less than 3650 days." >&2
+    exit 2
+fi
+
+#
+# Generate a first client certificate and configuration using $CLIENT1 as CN then revoke it.
+#
+docker exec -it $NAME easyrsa build-client-full $CLIENT1 nopass
+docker exec -it $NAME ovpn_getclient $CLIENT1 > $CLIENT_DIR/config.ovpn
+docker exec -it $NAME bash -c "echo 'yes' | ovpn_revokeclient $CLIENT1 remove"
+
+#
+# Test that openvpn client can't connect using $CLIENT1 config.
+#
+if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
+    echo "Client was able to connect after revocation test #1." >&2
+    exit 2
+fi
+
+#
+# Generate and revoke a second client certificate using $CLIENT2 as CN, then test for failed client connection.
+#
+docker exec -it $NAME easyrsa build-client-full $CLIENT2 nopass
+docker exec -it $NAME ovpn_getclient $CLIENT2 > $CLIENT_DIR/config.ovpn
+docker exec -it $NAME bash -c "echo 'yes' | ovpn_revokeclient $CLIENT2 remove"
+
+if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
+    echo "Client was able to connect after revocation test #2." >&2
+    exit 2
+fi
+
+#
+# Restart the server
+#
+docker stop $NAME && docker start $NAME
+
+#
+# Test for failed connection using $CLIENT2 config again.
+#
+if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
+    echo "Client was able to connect after revocation test #3." >&2
+    exit 2
+fi
+
+#
+# Stop the server and clean up
+#
+docker kill $NAME && docker rm $NAME
+docker volume rm $OVPN_DATA
+sudo iptables -D FORWARD 1
+
+#
+# Celebrate
+#
+cat <<EOF
+ ___________
+< it worked >
+ -----------
+        \   ^__^
+         \  (oo)\_______
+            (__)\       )\/\\
+                ||----w |
+                ||     ||
+EOF
				`@ -0,0 +1 @@`
				`1. Get the application URL by running these commands:`