From d1ea7aaff25e17b8759cd40100b8bb9ec8962cac Mon Sep 17 00:00:00 2001
From: Chewbaccalakis <nick@trochalakis.com>
Date: Thu, 16 Jul 2026 01:14:20 -0700
Subject: [PATCH] fix reverse dns

---
 openvpn/entrypoint.sh    | 15 +++++++++++++++
 openvpn/learn-address.sh | 10 ++++++++--
 openvpn/server.conf      |  5 +++--
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/openvpn/entrypoint.sh b/openvpn/entrypoint.sh
index 4657cc4..8737ea6 100644
--- a/openvpn/entrypoint.sh
+++ b/openvpn/entrypoint.sh
@@ -11,4 +11,19 @@ chmod 600 /etc/pam_radius_auth.conf
 mkdir -p /var/lib/openvpn
 [ -c /dev/net/tun ] || { mkdir -p /dev/net; mknod /dev/net/tun c 10 200; }
 
+# OpenVPN does NOT pass its inherited environment to hook scripts — it
+# builds a clean env for them. Hand learn-address.sh its settings via a
+# file it sources (the hook runs as nobody after the privilege drop).
+sq() { printf '%s' "$1" | sed "s/'/'\\\\''/g"; }
+if [ -n "${TECHNITIUM_ADMIN_PASSWORD:-}" ] && [ -n "${VPN_DNS_ZONE:-}" ]; then
+  {
+    printf "TECHNITIUM_ADMIN_PASSWORD='%s'\n" "$(sq "$TECHNITIUM_ADMIN_PASSWORD")"
+    printf "VPN_DNS_ZONE='%s'\n" "$(sq "$VPN_DNS_ZONE")"
+  } > /etc/openvpn/learn-address.env
+  chown nobody:nogroup /etc/openvpn/learn-address.env
+  chmod 400 /etc/openvpn/learn-address.env
+else
+  rm -f /etc/openvpn/learn-address.env
+fi
+
 exec openvpn --cd /etc/openvpn --config server.conf
diff --git a/openvpn/learn-address.sh b/openvpn/learn-address.sh
index 1b1dc02..a51e61f 100644
--- a/openvpn/learn-address.sh
+++ b/openvpn/learn-address.sh
@@ -10,10 +10,16 @@
 OP="$1"; ADDR="$2"; CN="${3:-}"
 
 API="http://127.0.0.1:5380/api"
-[ -n "${TECHNITIUM_ADMIN_PASSWORD:-}" ] || exit 0
-[ -n "${VPN_DNS_ZONE:-}" ] || exit 0
 
 log() { echo "learn-address: $*"; }
+log "invoked: op=$OP addr=$ADDR cn=${CN:-<none>}"
+
+# OpenVPN gives hooks a clean environment — settings come from the file
+# the entrypoint writes, not from the container env.
+[ -f /etc/openvpn/learn-address.env ] && . /etc/openvpn/learn-address.env
+
+[ -n "${TECHNITIUM_ADMIN_PASSWORD:-}" ] || { log "TECHNITIUM_ADMIN_PASSWORD not available; skipping"; exit 0; }
+[ -n "${VPN_DNS_ZONE:-}" ] || { log "VPN_DNS_ZONE not in env; skipping"; exit 0; }
 
 TOKEN=$(curl -sf -m 5 -G "$API/user/login" \
   --data-urlencode "user=admin" \
diff --git a/openvpn/server.conf b/openvpn/server.conf
index 35f45c3..e7406b9 100644
--- a/openvpn/server.conf
+++ b/openvpn/server.conf
@@ -73,8 +73,9 @@ persist-tun
 
 # Register each client as <username>.$VPN_DNS_ZONE (A + PTR) in Technitium
 # on connect, clean up on disconnect. Invoked via sh so the mounted script
-# needs no exec bit; env (TECHNITIUM_ADMIN_PASSWORD, VPN_DNS_ZONE) comes
-# from the container environment.
+# needs no exec bit. NOTE: openvpn runs hooks with a clean environment, so
+# the script sources /etc/openvpn/learn-address.env (written by the
+# entrypoint from the container env) rather than reading env vars directly.
 script-security 2
 learn-address "/bin/sh /etc/openvpn/learn-address.sh"