# OpenVPN road-warrior endpoint — RackNerd hub
# Auth chain: client cert (offline CA) + user/pass -> PAM -> RADIUS
#             -> Duo Auth Proxy (127.0.0.1:1812) -> LDAPS to the DCs.

port 1194
proto udp4
dev tun0
topology subnet

server 172.31.8.0 255.255.255.0
ifconfig-pool-persist /var/lib/openvpn/ipp.txt

# Split tunnel: only the AD sites + transfer net ride the VPN.
push "route 192.168.20.0 255.255.255.0"
push "route 192.168.7.0 255.255.255.0"
push "route 172.31.255.0 255.255.255.0"

# All client DNS goes to Technitium on this box (block-outside-dns stops
# Windows from leaking AD lookups to the local LAN resolver).
push "dhcp-option DNS 172.31.8.1"
push "dhcp-option DOMAIN ad.atlashorizon.net"
push "dhcp-option DOMAIN-SEARCH ad.atlashorizon.net"
push "dhcp-option DOMAIN-SEARCH ad.calliecorner.net"
push "dhcp-option DOMAIN-SEARCH ad.oswaldtheotter.net"
push "dhcp-option DOMAIN-SEARCH ad.trochalakis.net"
push "block-outside-dns"

# PKI — issued from the offline CA, see pki/README.md
ca   /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/server.crt
key  /etc/openvpn/pki/server.key
dh none
tls-crypt /etc/openvpn/pki/ta.key
# Enable once you publish a CRL from the offline CA (revoked laptops etc.):
;crl-verify /etc/openvpn/pki/crl.pem

remote-cert-tls client
tls-version-min 1.2
data-ciphers AES-256-GCM:CHACHA20-POLY1305
auth SHA256

# User auth via Duo (password only = push; "password,123456" = passcode)
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
verify-client-cert require
username-as-common-name
hand-window 120        # allow time for the Duo push round-trip
reneg-sec 0            # no mid-session TLS renegotiation (would re-prompt Duo)
auth-gen-token 43200   # reconnects within 12h reuse a token instead of a new push

keepalive 10 60
explicit-exit-notify 1

# wg0 MTU is 1420; keep the client tunnel small enough that client->site
# packets never fragment inside the WireGuard leg.
tun-mtu 1400
mssfix 1360

user nobody
group nogroup
persist-key
persist-tun

status /var/lib/openvpn/status.log 30
management 127.0.0.1 7505
verb 3