Skip to content

[pull] master from angristan:master #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 1 commit into from
Feb 13, 2026
Merged

[pull] master from angristan:master #113

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions openvpn-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3133,6 +3133,21 @@ verb 3"
run_cmd "Patching service file (RuntimeDirectory)" sed -i '/\[Service\]/a RuntimeDirectory=openvpn-server' /etc/systemd/system/openvpn-server@.service
fi

# AppArmor: Ubuntu 25.04+ ships an enforcing profile for OpenVPN
# (/etc/apparmor.d/openvpn) that doesn't allow the management unix socket
# in /run/openvpn-server/. Add a local override to permit this.
if [[ -f /etc/apparmor.d/openvpn ]]; then
log_info "Configuring AppArmor for OpenVPN..."
mkdir -p /etc/apparmor.d/local
if [[ ! -f /etc/apparmor.d/local/openvpn ]] || ! grep -q "openvpn-server" /etc/apparmor.d/local/openvpn; then
{
echo "# Allow OpenVPN management socket and status files in openvpn-server directory"
echo "/{,var/}run/openvpn-server/** rw,"
} >>/etc/apparmor.d/local/openvpn
fi
run_cmd "Reloading AppArmor profile" apparmor_parser -r /etc/apparmor.d/openvpn
fi

run_cmd "Reloading systemd" systemctl daemon-reload
run_cmd "Enabling OpenVPN service" systemctl enable openvpn-server@server
# In fingerprint mode, delay service start until first client is created
Expand Down Expand Up @@ -4487,6 +4502,14 @@ function removeOpenVPN() {
run_cmd "Removing sysctl config" rm -f /etc/sysctl.d/99-openvpn.conf
run_cmd "Removing OpenVPN logs" rm -rf /var/log/openvpn

# AppArmor local override
if [[ -f /etc/apparmor.d/local/openvpn ]]; then
run_cmd "Removing AppArmor local override" rm -f /etc/apparmor.d/local/openvpn
if [[ -f /etc/apparmor.d/openvpn ]]; then
run_cmd "Reloading AppArmor profile" apparmor_parser -r /etc/apparmor.d/openvpn 2>/dev/null || true
fi
fi

# Unbound
if [[ -e /etc/unbound/unbound.conf.d/openvpn.conf ]]; then
removeUnbound
Expand Down
Loading