claude generated first pass

openvpn/server.conf

@@ -0,0 +1,65 @@
+# OpenVPN road-warrior endpoint — RackNerd hub
+# Auth chain: client cert (offline CA) + user/pass -> PAM -> RADIUS
+#             -> Duo Auth Proxy (127.0.0.1:1812) -> LDAPS to the DCs.
+
+port 1194
+proto udp4
+dev tun0
+topology subnet
+
+server 172.31.8.0 255.255.255.0
+ifconfig-pool-persist /var/lib/openvpn/ipp.txt
+
+# Split tunnel: only the AD sites + transfer net ride the VPN.
+push "route 192.168.20.0 255.255.255.0"
+push "route 192.168.7.0 255.255.255.0"
+push "route 172.31.255.0 255.255.255.0"
+
+# All client DNS goes to Unbound on this box (block-outside-dns stops
+# Windows from leaking AD lookups to the local LAN resolver).
+push "dhcp-option DNS 172.31.8.1"
+push "dhcp-option DOMAIN ad.atlashorizon.net"
+push "dhcp-option DOMAIN-SEARCH ad.atlashorizon.net"
+push "dhcp-option DOMAIN-SEARCH ad.calliecorner.net"
+push "dhcp-option DOMAIN-SEARCH ad.oswaldtheotter.net"
+push "dhcp-option DOMAIN-SEARCH ad.trochalakis.net"
+push "block-outside-dns"
+
+# PKI — issued from the offline CA, see pki/README.md
+ca   /etc/openvpn/pki/ca.crt
+cert /etc/openvpn/pki/server.crt
+key  /etc/openvpn/pki/server.key
+dh none
+tls-crypt /etc/openvpn/pki/ta.key
+# Enable once you publish a CRL from the offline CA (revoked laptops etc.):
+;crl-verify /etc/openvpn/pki/crl.pem
+
+remote-cert-tls client
+tls-version-min 1.2
+data-ciphers AES-256-GCM:CHACHA20-POLY1305
+auth SHA256
+
+# User auth via Duo (password only = push; "password,123456" = passcode)
+plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
+verify-client-cert require
+username-as-common-name
+hand-window 120        # allow time for the Duo push round-trip
+reneg-sec 0            # no mid-session TLS renegotiation (would re-prompt Duo)
+auth-gen-token 43200   # reconnects within 12h reuse a token instead of a new push
+
+keepalive 10 60
+explicit-exit-notify 1
+
+# wg0 MTU is 1420; keep the client tunnel small enough that client->site
+# packets never fragment inside the WireGuard leg.
+tun-mtu 1400
+mssfix 1360
+
+user nobody
+group nogroup
+persist-key
+persist-tun
+
+status /var/lib/openvpn/status.log 30
+management 127.0.0.1 7505
+verb 3