Changes between Version 20 and Version 21 of UnprivilegedUser

Timestamp:

12/05/23 18:11:23 (5 months ago)

Author:

grzeg0rz

Comment:

Updates to rootless openvpn in podman section - updates in configuration to match recent openvpn updates, ensuring this section of article results in functional installation

UnprivilegedUser

@@ -300 +300 @@
 
 [Link]
-MTUBytes=1500
+MTUBytes=1389
 EOF
 
@@ -319 +319 @@
 tls-auth /server/ssl/ta.key 0
 server 10.254.254.0 255.255.255.0
+client-config-dir /server/ccd
+status /server/status/openvpn-status.log
+log-append  /server/status/openvpn.log
+explicit-exit-notify 1
+ccd-exclusive
+# Below was manually calculated, since openvpn is not allowed to update tun device
+link-mtu 1442
+ifconfig-noexec
 }}}
 
@@ -335 +343 @@
 User=openvpn
 Group=openvpn
+
 DeviceAllow=/dev/null rw
 DeviceAllow=/dev/net/tun rw
 DeviceAllow=/dev/fuse rw
+
 WorkingDirectory=/opt/openvpn
-ExecStart=/usr/bin/podman run --rm --name openvpn -v /opt/openvpn/server:/server --network="host" -p 37898:37898 --device /dev/net/tun --device /dev/null archlinux:latest /usr/bin/bash /server/entrypoint.sh
+
+ExecStartPre=/usr/bin/bash -c 'if [ -n "$(podman ps | grep openvpn | head -n 1)" ]; then podman stop -t 0 -i openvpn; fi'
+ExecStartPre=/usr/bin/bash -c 'if [ -n "$(podman ps -a | grep openvpn | head -n 1)" ]; then podman rm -i openvpn; fi'
+ExecStart=/usr/bin/podman run --rm --name openvpn -v /opt/openvpn/server:/server -v /run/systemd/resolve/resolv.conf:/etc/resolv.conf --network="host" -p 37898:37898 --device /dev/net/tun --device /dev/null archlinux:latest /usr/bin/bash /server/entrypoint.sh
+
 ExecStop=/usr/bin/podman stop -t 0 openvpn
 ProtectSystem=true
@@ -358 +372 @@
 
 pacman -Sy --noconfirm openvpn net-tools nano
-
-# we have done all required network configuration so openvpn does not have to
-cp -p /usr/bin/ip /usr/bin/ip.bak
-echo "#!/bin/bash" > /usr/bin/ip
-echo 'echo "$@" >> /tmp/ip_res' >> /usr/bin/ip
-echo "exit 0" >> /usr/bin/ip
-chmod ugo+x /usr/bin/ip
-
-openvpn --cd /server --config /server/server.conf
+openvpn --cd /server --config /server/openvpn.conf
 
 EOF