Simple tool to manage your OpenVPN keys and certs in a deterministic way.
This tool was created to follow nix way to doing things, create config once and ensure that generated state will follow.
Any changes to config will be reflected by matching changes in generated state:
./pkiis updated./outis generated
| name | version |
|---|---|
| ruby | ^3 |
| easy_rsa | ^3.1 |
- fully deterministic
- can generate config for
openvpnsystem service (Linux) - can generate config for
OpenVPNclients as*.ovpn - can generate
Dockerfilefor client and server - includes simple
run_*.shscripts that just-works
{
"server": {
"name": "my-server-name",
"public": {
"ip": "my-domain-name.com",
"port": "1194"
},
"local": {
"ip": "0.0.0.0",
"port": "1194"
},
"vpn": {
"gateway": "172.16.0.1",
"netmask": "255.255.255.0",
"dhcp": {
"pool": {
"begin": "172.16.0.100",
"end": "172.16.0.254"
}
}
},
"crypto": {
"cipher": "CHACHA20-POLY1305"
}
},
"clients": [
{
"name": "my-client-name",
"vpn": {
"ip": "172.16.0.2"
}
}
]
}git clone https://github.com/fightingdreamer/ovpnc.git && cd ovpnc
# create default config.json
ruby ovpnc.rb config_init
# edit your config.json
# create needed CA, DH, certs and keys in `./pki` dir
# create `server` and `clients` ready to use configs in `./out` dir
ruby ovpnc.rb config_sync
# optionally edit your config.json here again
# push clients no longer present in config to revoke list
# generate keys/certs for new clients
# create `server` and `clients` ready to use configs
ruby ovpnc.rb config_sync# run openvpn server
cd ./out/servers/my-server-name
sh run_conf.sh
# run openvpn server in podman/docker
cd ./out/servers/my-server-name
sh run_container.sh# run openvpn client
cd ./out/servers/my-client-name
sh run_conf.sh
# run openvpn client in podman/docker
cd ./out/servers/my-client-name
sh run_container.sh
# run openvpn client from '*.ovpn' file
cd ./out/servers/my-client-name
sh run_ovpn.shThey using custom easy_rsa path, usually /usr/share/easy-rsa/easyrsa.
Ensure that /usr/share/easy-rsa/ in included in $PATH or symlink easyrsa manually to /usr/bin/easyrsa.