Return mixed creds

Author: pablomendezroyo

src/src/openvpn/openvpnConfig.ts

@@ -1,78 +1,52 @@
 import fs from "fs";
-import { shell, shellArgs } from "../utils/shell";
+import { shell } from "../utils/shell";
 import { directoryIsEmptyOrEnoent } from "../utils/fs";
 import { PKI_PATH, PROXY_ARP_PATH } from "../params";
 import { logs } from "../logs";
-import { getContainerIP } from "../utils/getDockerContainerIp";
 
-type OvpnGenConfigFlags = {
-  c: string; // Enable traffic among the clients connected to the VPN (Boolean, no value)
-  d: string; // Disable default route (disables NAT without '-N'). Only specific traffic will go through the VPN (Boolean, no value)
-  u: string; // Hostname the clients will use to connect to the VPN
-  s: string; // Subnet the server will use to assign IPs to the clients
-  p: string; // Route to push to the client
-  n: string; // DNS server (BIND)
-  // There are more flags available, but we don't need them here
-};
-
-/**
- * Initializes the OpenVPN configuration
- * This function MUST be called before starting the openvpn binary
- */
-export async function initalizeOpenVpnConfig(hostname: string): Promise<void> {
-  const vpnContainerDomain = "vpn.dappnode";
-  // Replicate environment used in entrypoint.sh
+export async function initalizeOpenVpnConfig(hostname: string): Promise<string> {
   const openVpnEnv = {
+    ...process.env,
     OVPN_CN: hostname,
-    EASYRSA_REQ_CN: hostname
+    EASYRSA_REQ_CN: hostname,
   };
-  let genConfigFlags: OvpnGenConfigFlags;
-
-  logs.info("Initializing OpenVPN configuration");
-
-  // Check current IP range
-  const containerIp = await getContainerIP(vpnContainerDomain);
 
-  // If container IP is inside 172.33.0.0/16 --> generate credentials A
-  if (containerIp && containerIp.startsWith("172.33.")) {
-    logs.info("Generating credentials for IP range 172.33.0.0/16");
-    genConfigFlags = {
-      c: "",
-      d: "",
-      u: `udp://"${hostname}"`,
-      s: "172.33.8.0/22",
-      p: `"route 172.33.0.0 255.255.0.0"`,
-      n: `"172.33.1.2"`
-    };
-
-    // Else (default, but it should be 10.20.0.0/24) --> generate credentials B
-  } else {
-    logs.info("Generating credentials for IP range 10.20.0.0/24");
-    genConfigFlags = {
-      c: "",
-      d: "",
-      u: `udp://"${hostname}"`,
-      s: "10.20.0.240/28",
-      p: `"route 10.20.0.0 255.255.255.0"`,
-      n: `"10.20.0.2"`
-    };
-  }
+  logs.info("Initializing OpenVPN configuration (both subnets + both DNS)");
 
-  // Initialize config and PKI
-  const output = await shellArgs(
+  // Build the full ovpn_genconfig command with multiple -s, -p, -n flags:
+  const genCmd = [
     "ovpn_genconfig",
-    genConfigFlags,
-    { env: { ...process.env, ...openVpnEnv } }
-  );
-
-  logs.info(`OpenVPN configuration output:\n\n${output}\n\n`);
-
-  // Check if PKI is initalized already, if not use hostname as CN
-  if (directoryIsEmptyOrEnoent(PKI_PATH))
-    await shell("ovpn_initpki nopass", {
-      env: { ...process.env, ...openVpnEnv }
+    "-c",               // client-to-client
+    "-d",               // disable default route
+    "-u", `udp://"${hostname}"`,
+    "-s", "10.20.0.0/24",
+    "-s", "172.33.0.0/16",
+    "-p", "route 10.20.0.0 255.255.255.0",
+    "-p", "route 172.33.0.0 255.255.0.0",
+    "-n", "10.20.0.2",
+    "-n", "172.33.1.2",
+  ].join(" ");
+
+  // Generate server configuration
+  const genOutput = await shell(genCmd, { env: openVpnEnv });
+  logs.info(`ovpn_genconfig output:\n${genOutput}`);
+
+  // Initialize the PKI if needed
+  if (directoryIsEmptyOrEnoent(PKI_PATH)) {
+    const initPkiOutput = await shell("ovpn_initpki nopass", {
+      env: openVpnEnv,
     });
+    logs.info(`ovpn_initpki output:\n${initPkiOutput}`);
+  }
 
-  // Enable Proxy ARP (needs privileges)
+  // Enable proxy ARP
   fs.writeFileSync(PROXY_ARP_PATH, "1");
+
+  // Finally, generate and return the client bundle
+  const clientConfig = await shell(`ovpn_getclient "${hostname}"`, {
+    env: openVpnEnv,
+  });
+  logs.info(`Generated client configuration for ${hostname}`);
+
+  return clientConfig;
 }