# OpenVPN
set -euo pipefail
## OpenVPN
OPENVPN_DIR="/etc/openvpn/"
SERVER_DIR="${OPENVPN_DIR}server/"
CLIENT_DIR="${OPENVPN_DIR}ovpn/"
EASYRSA_DIR="${OPENVPN_DIR}easy-rsa/"
EASYRSA_VAR_FILE="${EASYRSA_DIR}vars"
install -d "${CLIENT_DIR}"
install -d -m 700 "${EASYRSA_DIR}"

### install
curl -fsSL \
  --retry 10 \
  --retry-delay 5 \
  --retry-connrefused \
  --retry-all-errors \
  https://swupdate.openvpn.net/repos/repo-public.gpg | gpg --dearmor > /etc/apt/keyrings/openvpn-repo-public.gpg
for i in {1..10}; do
  [[ -f "/etc/apt/keyrings/openvpn-repo-public.gpg" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/openvpn-repo-public.gpg] https://build.openvpn.net/debian/openvpn/stable ${UBUNTU_CODENAME}  main" > /etc/apt/sources.list.d/openvpn-aptrepo.list
### ${UBUNTU_CODENAME} ... included /etc/os-release
for i in {1..5}; do
  DEBIAN_FRONTEND=noninteractive apt update -y \
  && DEBIAN_FRONTEND=noninteractive apt install -y openvpn easy-rsa \
  && break
  [[ "$i" -eq 5 ]] && exit 1 || sleep 5
done

### init easyrsa
SETTING_CIPHERS="data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305"
SETTING_AUTH="auth SHA256"
SETTING_TLS_AUTH="tls-auth ta.key 0"
# functions
ovpn_header () {
    cat <<EOF
client
dev tun
proto udp
remote ${IPADDR} 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-client
key-direction 1
${SETTING_CIPHERS}
${SETTING_AUTH}
verb 3
EOF
}
make_ovpn () {
    local target=$1

    local ca_path="${EASYRSA_DIR}pki"
    local key_path="${EASYRSA_DIR}pki/private"
    local crt_path="${EASYRSA_DIR}pki/issued"
    local ta_key_path="${OPENVPN_DIR}ta.key"
    local output_file="${CLIENT_DIR}${target}.ovpn"

    {
        ovpn_header
        echo '<ca>'
        sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' "$ca_path/ca.crt"
        echo '</ca>'
        echo '<key>'
        cat "$key_path/$target.key"
        echo '</key>'
        echo '<cert>'
        sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' "$crt_path/$target.crt"
        echo '</cert>'
        echo '<tls-auth>'
        cat "$ta_key_path"
        echo '</tls-auth>'
    } > "$output_file"
    chmod 600 "$output_file"
}

#### server
cd "${OPENVPN_DIR}" && openvpn --genkey secret ta.key
cp -p ta.key "${SERVER_DIR}"

SERVER_CONF_PATH="${SERVER_DIR}server.conf"
cp -p /usr/share/doc/openvpn/examples/sample-config-files/server.conf "${SERVER_CONF_PATH}"
if grep -qE '^[;#]?[[:space:]]*data-ciphers[[:space:]]' "${SERVER_CONF_PATH}"; then
  sed -i -E "s|^[;#]?[[:space:]]*data-ciphers[[:space:]].*|${SETTING_CIPHERS}|" "${SERVER_CONF_PATH}"
else
  echo "${SETTING_CIPHERS}" >> "${SERVER_CONF_PATH}"
fi
if grep -qE '^[;#]?[[:space:]]*auth[[:space:]]' "${SERVER_CONF_PATH}"; then
  sed -i -E "s|^[;#]?[[:space:]]*auth[[:space:]].*|${SETTING_AUTH}|" "${SERVER_CONF_PATH}"
else
  echo "${SETTING_AUTH}" >> "${SERVER_CONF_PATH}"
fi
if grep -qE '^[;#]?[[:space:]]*tls-auth[[:space:]]' "${SERVER_CONF_PATH}"; then
  sed -i -E "s|^[;#]?[[:space:]]*tls-auth[[:space:]].*|${SETTING_TLS_AUTH}|" "${SERVER_CONF_PATH}"
else
  echo "${SETTING_TLS_AUTH}" >> "${SERVER_CONF_PATH}"
fi

ln -s /usr/share/easy-rsa/easyrsa "${EASYRSA_DIR}"
ln -s /usr/share/easy-rsa/x509-types "${EASYRSA_DIR}"
cp -p /usr/share/easy-rsa/openssl-easyrsa.cnf "${EASYRSA_DIR}"
cp -p /usr/share/easy-rsa/vars.example "${EASYRSA_VAR_FILE}"
sed -i "s/#set_var EASYRSA_CA_EXPIRE.*/set_var EASYRSA_CA_EXPIRE 7300/" "${EASYRSA_VAR_FILE}"
sed -i "s/#set_var EASYRSA_CERT_EXPIRE.*/set_var EASYRSA_CERT_EXPIRE 7300/" "${EASYRSA_VAR_FILE}"

export EASYRSA_BATCH=1
export EASYRSA_REQ_CN="${IPADDR}"

cd "${EASYRSA_DIR}"
./easyrsa --vars="${EASYRSA_VAR_FILE}" init-pki
for i in {1..10}; do
  [[ -d "${EASYRSA_DIR}pki" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done
./easyrsa --vars="${EASYRSA_VAR_FILE}" build-ca nopass
for i in {1..10}; do
  [[ -f "${EASYRSA_DIR}pki/ca.crt" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done
./easyrsa --vars="${EASYRSA_VAR_FILE}" gen-req server nopass
for i in {1..10}; do
  [[ -f "${EASYRSA_DIR}pki/reqs/server.req" && -f "${EASYRSA_DIR}pki/private/server.key" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done
./easyrsa --vars="${EASYRSA_VAR_FILE}" sign-req server server nopass
for i in {1..10}; do
  [[ -f "${EASYRSA_DIR}pki/issued/server.crt" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done
./easyrsa gen-dh
for i in {1..10}; do
  [[ -f "${EASYRSA_DIR}pki/dh.pem" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done

cp -p pki/ca.crt pki/private/server.key pki/issued/server.crt pki/dh.pem "${SERVER_DIR}"

for i in {1..5}; do
  DEBIAN_FRONTEND=noninteractive apt install -y iptables-persistent && break
  [[ "$i" -eq 5 ]] && exit 1 || sleep 5
done
for i in {1..10}; do
  [[ -d "/etc/iptables" ]] && break
  [[ "$i" -eq 10 ]] && exit 1 || sleep 3
done
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
iptables-save > /etc/iptables/rules.v4

systemctl --now enable openvpn-server@server.service

#### client
unset EASYRSA_REQ_CN
cd "${EASYRSA_DIR}"
for idx in {1..3}; do
    ./easyrsa --vars="${EASYRSA_VAR_FILE}" build-client-full client${idx} nopass
    for i in {1..10}; do
        [[ -f "${EASYRSA_DIR}pki/issued/client${idx}.crt" ]] && break
        [[ "$i" -eq 10 ]] && exit 1 || sleep 3
    done
    make_ovpn client${idx}
    for i in {1..10}; do
        [[ -f "${CLIENT_DIR}/client${idx}.ovpn" ]] && break
        [[ "$i" -eq 10 ]] && exit 1 || sleep 3
    done
done

## Other
cat > /etc/motd <<EOF
==========================================================

  HostIP:                ${IPADDR}

  ovpn file1:            ${CLIENT_DIR}client1.ovpn
  ovpn file2:            ${CLIENT_DIR}client2.ovpn
  ovpn file3:            ${CLIENT_DIR}client3.ovpn

  OpenVPN Server dir:    ${SERVER_DIR}
  Easyrsa dir:           ${EASYRSA_DIR}

  To delete this message: unlink /etc/motd
==========================================================
EOF