#!/bin/bash

set -euo pipefail

NAME="${1:?Usage: create-client.sh CLIENT_NAME VPN_HOST [PORT]}"
HOST="${2:?Usage: create-client.sh CLIENT_NAME VPN_HOST [PORT]}"
PORT="${3:-1194}"

export EASYRSA_PKI=/openvpn/pki

EASYRSA=/usr/share/easy-rsa/3/easyrsa

# --------------------------------------------------------
# Certificat client
# --------------------------------------------------------

if [ ! -f "${EASYRSA_PKI}/issued/${NAME}.crt" ]; then

  echo "Generating certificate for ${NAME}..." >&2

  "${EASYRSA}" \
    --batch \
    build-client-full \
    "${NAME}" \
    nopass \
    >&2

fi

# --------------------------------------------------------
# Profil .ovpn autonome
# --------------------------------------------------------

cat <<EOF
client

dev tun
proto udp4

remote ${HOST} ${PORT}

resolv-retry infinite
nobind

persist-key
persist-tun

remote-cert-tls server
verify-x509-name server name

auth-nocache

tls-version-min 1.2

data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-256-GCM

auth SHA256

verb 3

<ca>
EOF

awk '/-----BEGIN CERTIFICATE-----/{p=1} p' \
  "${EASYRSA_PKI}/ca.crt"

cat <<EOF
</ca>

<cert>
EOF

awk '/-----BEGIN CERTIFICATE-----/{p=1} p' \
  "${EASYRSA_PKI}/issued/${NAME}.crt"

cat <<EOF
</cert>

<key>
EOF

cat "${EASYRSA_PKI}/private/${NAME}.key"

cat <<EOF
</key>

<tls-crypt>
EOF

cat "${EASYRSA_PKI}/tls-crypt.key"

cat <<EOF
</tls-crypt>
EOF