apiVersion: v1
data:
  client.conf.tpl: |
    client
    dev tun
    {{- range $server := .Hosts }}
    remote {{ $server.Host }} {{ $server.Port }} {{ $server.Protocol }}
    {{- end }}
    nobind
    persist-key
    persist-tun
    remote-cert-tls server
    tls-version-min 1.2
    verb 3

    <ca>
    {{ .CA -}}
    </ca>
    <cert>
    {{ .Cert -}}
    </cert>
    <key>
    {{ .Key -}}
    </key>
    <tls-crypt>
    {{ .TLS -}}
    </tls-crypt>
  entrypoint.sh: |
    #!/bin/sh
    set -eu

    # These rules live in the pod's network namespace, not the node's. VPN clients
    # may reach the home LAN, but not this pod (ovpn-admin has no auth of its own),
    # the pod network or the service network.
    iptables -F INPUT
    iptables -F FORWARD
    iptables -t nat -F POSTROUTING
    iptables -A INPUT -i tun0 -j DROP
    iptables -A FORWARD -i tun0 -d "$CLUSTER_CIDR" -j DROP
    iptables -A FORWARD -i tun0 -d "$SERVICE_CIDR" -j DROP
    iptables -t nat -A POSTROUTING -s "$VPN_NETWORK" -o eth0 -j MASQUERADE

    if [ "$(cat /proc/sys/net/ipv4/ip_forward)" != 1 ]; then
      echo "net.ipv4.ip_forward is disabled in the pod network namespace" >&2
      exit 1
    fi

    mkdir -p /dev/net
    [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200

    for f in ca.crt issued/server.crt private/server.key ta.key crl.pem; do
      until [ -f "/etc/openvpn/certs/pki/$f" ]; do
        echo "waiting for $f from ovpn-admin"
        sleep 2
      done
    done

    exec openvpn --config /etc/openvpn/openvpn.conf
  openvpn.conf: |
    # After editing this ConfigMap, bump openvpn.whyredfire.dev/config-revision
    # on the Deployment to restart it.
    port 1194
    proto udp
    dev tun0
    topology subnet
    server 10.8.0.0 255.255.255.0
    client-config-dir /etc/openvpn/ccd
    management 127.0.0.1 8989

    # Written by ovpn-admin from the PKI it keeps in Kubernetes Secrets.
    ca /etc/openvpn/certs/pki/ca.crt
    cert /etc/openvpn/certs/pki/issued/server.crt
    key /etc/openvpn/certs/pki/private/server.key
    crl-verify /etc/openvpn/certs/pki/crl.pem
    tls-crypt /etc/openvpn/certs/pki/ta.key
    dh none
    tls-version-min 1.2
    remote-cert-tls client

    # Split tunnel: only the home LAN goes through the VPN.
    push "route 192.168.2.0 255.255.255.0"
    push "dhcp-option DNS 192.168.2.1"

    # DCO would need the ovpn kernel module on the node; plain tun keeps the pod self-contained.
    disable-dco
    keepalive 10 60
    persist-key
    persist-tun
    explicit-exit-notify 1
    user nobody
    group nogroup
    status /tmp/openvpn-status.log
    verb 3
kind: ConfigMap
metadata:
  name: openvpn
  namespace: openvpn