Merge pull request #1 from TheMardy/setup

Setup

README.MD

@@ -1,6 +1,7 @@
 # Multiplatform OpenVPN for Docker
 
 [![Version](https://img.shields.io/github/v/tag/themardy/docker-openvpn?label=version&style=flat-square)](https://github.com/TheMardy/docker-openvpn/releases)
+![Travis (.org)](https://img.shields.io/travis/themardy/docker-openvpn)
 [![Actions Status](https://github.com/themardy/docker-openvpn/workflows/build/badge.svg)](https://github.com/themardy/docker-openvpn/actions)
 [![Docker Stars](https://img.shields.io/docker/stars/themardy/openvpn.svg)](https://hub.docker.com/r/themardy/openvpn/)
 [![Docker Pulls](https://img.shields.io/docker/pulls/themardy/openvpn.svg)](https://hub.docker.com/r/themardy/openvpn/)
@@ -21,10 +22,79 @@ Original Credits: [kylemanna/docker-openvpn](https://github.com/kylemanna/docker
 | linux/386  | -  |
 | linux/ppc64le  | -  |
 
-Please [raise an issue 💬](https://github.com/TheMardy/docker-openvpn/issues) if you are able to test an untested platform 🙌
+Please [raise an issue 💬](https://github.com/TheMardy/docker-openvpn/issues) if you are able to test an untested platform 🙏
 
-# Original Readme:
-## Quick Start
+## Quick Start with docker-compose
+
+* Add a new service in docker-compose.yml
+
+```yaml
+version: '2'
+services:
+  openvpn:
+    cap_add:
+     - NET_ADMIN
+    image: themardy/openvpn
+    container_name: openvpn
+    ports:
+     - "1194:1194/udp"
+    restart: always
+    volumes:
+     - ./openvpn-data/conf:/etc/openvpn
+```
+
+
+* Initialize the configuration files and certificates
+
+```bash
+docker-compose run --rm openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM
+docker-compose run --rm openvpn ovpn_initpki
+```
+
+* Fix ownership (depending on how to handle your backups, this may not be needed)
+
+```bash
+sudo chown -R $(whoami): ./openvpn-data
+```
+
+* Start OpenVPN server process
+
+```bash
+docker-compose up -d openvpn
+```
+
+* You can access the container logs with
+
+```bash
+docker-compose logs -f
+```
+
+* Generate a client certificate
+
+```bash
+export CLIENTNAME="your_client_name"
+# with a passphrase (recommended)
+docker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME
+# without a passphrase (not recommended)
+docker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME nopass
+```
+
+* Retrieve the client configuration with embedded certificates
+
+```bash
+docker-compose run --rm openvpn ovpn_getclient $CLIENTNAME > $CLIENTNAME.ovpn
+```
+
+* Revoke a client certificate
+
+```bash
+# Keep the corresponding crt, key and req files.
+docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME
+# Remove the corresponding crt, key and req files.
+docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME remove
+```
+
+## Quick Start with docker run
 
 * Pick a name for the `$OVPN_DATA` data volume container. It's recommended to
   use the `ovpn-data-` prefix to operate seamlessly with the reference systemd
@@ -58,19 +128,15 @@ Please [raise an issue 💬](https://github.com/TheMardy/docker-openvpn/issues)
 ### More Reading
 
 Miscellaneous write-ups for advanced configurations are available on the
-[Wiki](../../wiki).
+[Wiki](https://github.com/TheMardy/docker-openvpn/wiki/).
 
 ### Systemd Init Scripts
 
 A `systemd` init script is available to manage the OpenVPN container.  It will
 start the container on system boot, restart the container if it exits
 unexpectedly, and pull updates from Docker Hub to keep itself up to date.
 
-Please refer to the [Wiki](../../wiki) to learn more.
-
-### Docker Compose
-
-If you prefer to use `docker-compose` please refer to the [Wiki](../../wiki).
+Please refer to the [Wiki](https://github.com/TheMardy/docker-openvpn/wiki/) to learn more.
 
 ## Debugging Tips
 
@@ -88,108 +154,6 @@ If you prefer to use `docker-compose` please refer to the [Wiki](../../wiki).
         $ dig google.com  # won't use the search directives in resolv.conf
         $ nslookup google.com # will use search
 
-* Consider setting up a [systemd service](/docs/systemd.md) for automatic
+* Consider setting up a [systemd service](https://github.com/TheMardy/docker-openvpn/wiki/Systemd-Service) for automatic
   start-up at boot time and restart in the event the OpenVPN daemon or Docker
-  crashes.
-
-## How Does It Work?
-
-Initialize the volume container using the `themardy/openvpn` image with the
-included scripts to automatically generate:
-
-- Diffie-Hellman parameters
-- a private key
-- a self-certificate matching the private key for the OpenVPN server
-- an EasyRSA CA key and certificate
-- a TLS auth key from HMAC security
-
-The OpenVPN server is started with the default run cmd of `ovpn_run`
-
-The configuration is located in `/etc/openvpn`, and the Dockerfile
-declares that directory as a volume. It means that you can start another
-container with the `-v` argument, and access the configuration.
-The volume also holds the PKI keys and certs so that it could be backed up.
-
-To generate a client certificate, `themardy/openvpn` uses EasyRSA via the
-`easyrsa` command in the container's path.  The `EASYRSA_*` environmental
-variables place the PKI CA under `/etc/openvpn/pki`.
-
-Conveniently, `themardy/openvpn` comes with a script called `ovpn_getclient`,
-which dumps an inline OpenVPN client configuration file.  This single file can
-then be given to a client for access to the VPN.
-
-To enable Two Factor Authentication for clients (a.k.a. OTP) see the [Wiki](../../wiki).
-
-## OpenVPN Details
-
-We use `tun` mode, because it works on the widest range of devices.
-`tap` mode, for instance, does not work on Android, except if the device
-is rooted.
-
-The topology used is `net30`, because it works on the widest range of OS.
-`p2p`, for instance, does not work on Windows.
-
-The UDP server uses`192.168.255.0/24` for dynamic clients by default.
-
-The client profile specifies `redirect-gateway def1`, meaning that after
-establishing the VPN connection, all traffic will go through the VPN.
-This might cause problems if you use local DNS recursors which are not
-directly reachable, since you will try to reach them through the VPN
-and they might not answer to you. If that happens, use public DNS
-resolvers like those of Google (8.8.4.4 and 8.8.8.8) or OpenDNS
-(208.67.222.222 and 208.67.220.220).
-
-
-## Security Discussion
-
-The Docker container runs its own EasyRSA PKI Certificate Authority.  This was
-chosen as a good way to compromise on security and convenience.  The container
-runs under the assumption that the OpenVPN container is running on a secure
-host, that is to say that an adversary does not have access to the PKI files
-under `/etc/openvpn/pki`.  This is a fairly reasonable compromise because if an
-adversary had access to these files, the adversary could manipulate the
-function of the OpenVPN server itself (sniff packets, create a new PKI CA, MITM
-packets, etc).
-
-* The certificate authority key is kept in the container by default for
-  simplicity.  It's highly recommended to secure the CA key with some
-  passphrase to protect against a filesystem compromise.  A more secure system
-  would put the EasyRSA PKI CA on an offline system (can use the same Docker
-  image and the script [`ovpn_copy_server_files`](/docs/paranoid.md) to accomplish this).
-* It would be impossible for an adversary to sign bad or forged certificates
-  without first cracking the key's passphase should the adversary have root
-  access to the filesystem.
-* The EasyRSA `build-client-full` command will generate and leave keys on the
-  server, again possible to compromise and steal the keys.  The keys generated
-  need to be signed by the CA which the user hopefully configured with a passphrase
-  as described above.
-* Assuming the rest of the Docker container's filesystem is secure, TLS + PKI
-  security should prevent any malicious host from using the VPN.
-
-
-## Benefits of Running Inside a Docker Container
-
-### The Entire Daemon and Dependencies are in the Docker Image
-
-This means that it will function correctly (after Docker itself is setup) on
-all distributions Linux distributions such as: Ubuntu, Arch, Debian, Fedora,
-etc.  Furthermore, an old stable server can run a bleeding edge OpenVPN server
-without having to install/muck with library dependencies (i.e. run latest
-OpenVPN with latest OpenSSL on Ubuntu 12.04 LTS).
-
-### It Doesn't Stomp All Over the Server's Filesystem
-
-Everything for the Docker container is contained in two images: the ephemeral
-run time image (themardy/openvpn) and the `$OVPN_DATA` data volume. To remove
-it, remove the corresponding containers, `$OVPN_DATA` data volume and Docker
-image and it's completely removed.  This also makes it easier to run multiple
-servers since each lives in the bubble of the container (of course multiple IPs
-or separate ports are needed to communicate with the world).
-
-### Some (arguable) Security Benefits
-
-At the simplest level compromising the container may prevent additional
-compromise of the server.  There are many arguments surrounding this, but the
-take away is that it certainly makes it more difficult to break out of the
-container.  People are actively working on Linux containers to make this more
-of a guarantee in the future.
+  crashes.

bin/ovpn_genconfig

@@ -285,7 +285,7 @@ fi
 
 # Apply defaults. If dns servers were not defined with -n, use google nameservers
 set +u
-[ -z "$OVPN_DNS_SERVERS" ] && OVPN_DNS_SERVERS=("8.8.8.8" "8.8.4.4")
+[ -z "$OVPN_DNS_SERVERS" ] && OVPN_DNS_SERVERS=("1.1.1.1" "1.0.0.1")
 [ -z "$OVPN_PROTO" ] && OVPN_PROTO=udp
 [ -z "$OVPN_PORT" ] && OVPN_PORT=1194
 set -u