30 lines
1.1 KiB
Bash
30 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
: "${RADIUS_SECRET:?RADIUS_SECRET must be set in .env}"
|
|
|
|
# pam_radius format: server[:port] secret timeout
|
|
# 60s timeout leaves room for the user to approve a Duo push.
|
|
printf '127.0.0.1:1812\t%s\t60\n' "$RADIUS_SECRET" > /etc/pam_radius_auth.conf
|
|
chmod 600 /etc/pam_radius_auth.conf
|
|
|
|
mkdir -p /var/lib/openvpn
|
|
[ -c /dev/net/tun ] || { mkdir -p /dev/net; mknod /dev/net/tun c 10 200; }
|
|
|
|
# OpenVPN does NOT pass its inherited environment to hook scripts — it
|
|
# builds a clean env for them. Hand learn-address.sh its settings via a
|
|
# file it sources (the hook runs as nobody after the privilege drop).
|
|
sq() { printf '%s' "$1" | sed "s/'/'\\\\''/g"; }
|
|
if [ -n "${TECHNITIUM_ADMIN_PASSWORD:-}" ] && [ -n "${VPN_DNS_ZONE:-}" ]; then
|
|
{
|
|
printf "TECHNITIUM_ADMIN_PASSWORD='%s'\n" "$(sq "$TECHNITIUM_ADMIN_PASSWORD")"
|
|
printf "VPN_DNS_ZONE='%s'\n" "$(sq "$VPN_DNS_ZONE")"
|
|
} > /etc/openvpn/learn-address.env
|
|
chown nobody:nogroup /etc/openvpn/learn-address.env
|
|
chmod 400 /etc/openvpn/learn-address.env
|
|
else
|
|
rm -f /etc/openvpn/learn-address.env
|
|
fi
|
|
|
|
exec openvpn --cd /etc/openvpn --config server.conf
|