# AtlasHorizon VPN — client profile template.
# ONE profile for everyone: paste ca.crt and ta.key (from the offline CA,
# see openvpn/pki/README.md) into the inline blocks below and distribute.
# No per-user certificates — identity is AD user/pass + Duo.
#
# Login: AD username; password field takes either
#   ADpassword              -> Duo push
#   ADpassword,123456       -> appended Duo passcode (offline fallback)
#
# Connect Before Logon (Windows): install OpenVPN Connect v3 machine-wide
# with CBL enabled (MSI: OVPNCONNECTOR_CBL=true or enable in app settings),
# import this profile for all users.

client
dev tun
proto udp
remote vpn.atlashorizon.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun

remote-cert-tls server
tls-version-min 1.2
data-ciphers AES-256-GCM:CHACHA20-POLY1305
auth SHA256

auth-user-pass
auth-retry interact
hand-window 120
verb 3

<ca>
# ----- paste ca.crt -----
</ca>
<tls-crypt>
# ----- paste ta.key -----
</tls-crypt>