openvpn-container/init-pki.sh

#!/bin/bash

set -euo pipefail

export EASYRSA_PKI=/openvpn/pki

EASYRSA=/usr/share/easy-rsa/3/easyrsa

mkdir -p /openvpn/state

# --------------------------------------------------------
# CA
# --------------------------------------------------------

if [ ! -f "${EASYRSA_PKI}/ca.crt" ]; then

  echo "Initializing PKI..."

  "${EASYRSA}" \
    --batch \
    init-pki

  echo "Generating CA..."

  EASYRSA_REQ_CN="OpenVPN Homelab CA" \
    "${EASYRSA}" \
    --batch \
    build-ca \
    nopass

fi

# --------------------------------------------------------
# Certificat serveur
# --------------------------------------------------------

if [ ! -f "${EASYRSA_PKI}/issued/server.crt" ]; then

  echo "Generating server certificate..."

  "${EASYRSA}" \
    --batch \
    build-server-full \
    server \
    nopass

fi

# --------------------------------------------------------
# tls-crypt
# --------------------------------------------------------

if [ ! -f "${EASYRSA_PKI}/tls-crypt.key" ]; then

  echo "Generating tls-crypt key..."

  openvpn \
    --genkey secret \
    "${EASYRSA_PKI}/tls-crypt.key"

fi

# --------------------------------------------------------
# CRL
# --------------------------------------------------------

echo "Generating CRL..."

EASYRSA_CRL_DAYS=3650 \
  "${EASYRSA}" \
  --batch \
  gen-crl

# --------------------------------------------------------
# Permissions
#
# OpenVPN passe en nobody après l'initialisation.
# --------------------------------------------------------

chown -R 65534:65534 /openvpn/state

chmod 755 "${EASYRSA_PKI}"
chmod 755 "${EASYRSA_PKI}/issued"
chmod 711 "${EASYRSA_PKI}/private"

chmod 644 \
  "${EASYRSA_PKI}/ca.crt" \
  "${EASYRSA_PKI}/issued/server.crt" \
  "${EASYRSA_PKI}/crl.pem"

chmod 600 \
  "${EASYRSA_PKI}/private/server.key" \
  "${EASYRSA_PKI}/tls-crypt.key"

chown 65534:65534 \
  "${EASYRSA_PKI}/ca.crt" \
  "${EASYRSA_PKI}/issued/server.crt" \
  "${EASYRSA_PKI}/crl.pem" \
  "${EASYRSA_PKI}/private/server.key" \
  "${EASYRSA_PKI}/tls-crypt.key"

echo "PKI ready."