claude generated first pass

openvpn/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+: "${RADIUS_SECRET:?RADIUS_SECRET must be set in .env}"
+
+# pam_radius format: server[:port]  secret  timeout
+# 60s timeout leaves room for the user to approve a Duo push.
+printf '127.0.0.1:1812\t%s\t60\n' "$RADIUS_SECRET" > /etc/pam_radius_auth.conf
+chmod 600 /etc/pam_radius_auth.conf
+
+mkdir -p /var/lib/openvpn
+[ -c /dev/net/tun ] || { mkdir -p /dev/net; mknod /dev/net/tun c 10 200; }
+
+exec openvpn --cd /etc/openvpn --config server.conf