Simple OpenVPN+EasyRSA configuration bundler

bundle-conf

#!/usr/bin/env bash

set -e
panic() { echo $* >&2; exit 1; }

HOST="$(hostname)"

CLIENT="$1"

[ -z "$CLIENT" ] && panic "usage: ./bundle-conf [CLIENT]"

EZRSA="/etc/openvpn/easy-rsa"
CLIENT_CERT="$EZRSA/keys/$CLIENT.crt"
CLIENT_KEY="$EZRSA/keys/$CLIENT.key"
CONF="/etc/openvpn/easy-rsa/bundles/${HOST}-${CLIENT}.ovpn"


if [ ! -f "$CLIENT_CERT" ]; then
	echo - Generating client cert for $CLIENT
	cd $EZRSA
	source vars
	export EASY_RSA="${EASY_RSA:-.}"
	"$EASY_RSA/pkitool" --batch $1
else
	echo - Using existing key for $CLIENT
fi


[ ! -f $EZRSA/keys/$CLIENT.crt ] && panic "No client certificate found"
[ ! -f $EZRSA/keys/$CLIENT.key ] && panic "No client key found"

## Client configuration template
cat > "$CONF" <<EOF
client
dev tap0
proto udp
remote $HOST 1194
keepalive 5 30
resolv-retry infinite
cipher AES-256-CBC
nobind
persist-key
persist-tun
comp-lzo
verb 3
EOF

## Copy relevant keys
printf "<ca>\n" >> "$CONF"
cat $EZRSA/keys/ca.crt >> "$CONF"
printf "</ca>\n" >> "$CONF"

printf "<cert>\n" >> "$CONF"
cat $EZRSA/keys/$CLIENT.crt >> "$CONF"
printf "</cert>\n" >> "$CONF"

printf "<key>\n" >> "$CONF"
cat $EZRSA/keys/$CLIENT.key >> "$CONF"
printf "</key>\n" >> "$CONF"

echo " - Bundle stored in $CONF"