#!/bin/bash
## https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto

HOSTNAME=$1

if [ -z "$HOSTNAME" ]; then
    echo "Caranya: $0 <nama-client>"
    echo "Contoh: $0 sugiana"
    exit 0
fi

cd /etc/openvpn/server

if [ ! -d easyrsa3-ca ]; then
    echo "Jalankan dulu build-server-cert.sh"
    exit 0
fi

if [ -f passphrase.txt ]; then
    passfile=$(realpath passphrase.txt)
else
    passfile=""
fi 

for arg in $@; do
    if [ $arg = "proxy" ]; then
        proxy="yes"
    fi
    if [ $arg = "login" ]; then
        login="yes"
    fi
    if [ $arg = "adduser" ]; then
        adduser="yes"
    fi
    if [[ $arg == pass=* ]]; then
        loginpass="${arg#pass=}"
    fi
done

if [ -n "$login" ]; then
    if [ -n "$adduser" ]; then
        if [ -z $loginpass ]; then
            loginpass=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 6)
        fi
    fi
fi

# Create config file
if [ ! -f client.ovpn ]; then
    echo "Dapatkan IP publik ..."
    cmd="curl -s -4 ifconfig.me"
    echo $cmd
    PUBLIC_IP=$(eval $cmd) || exit 1
    echo $PUBLIC_IP
    cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf client.ovpn
    sed '/^proto udp/s/^/;/' client.ovpn > client.ovpn.tmp 
    sed -e 's/^;proto tcp/proto tcp/g' client.ovpn.tmp > client.ovpn 
    sed -e 's/^remote my-server-1/remote '$PUBLIC_IP'/g' client.ovpn > client.ovpn.tmp
    sed '/^ns-cert-type server/s/^/;/' client.ovpn.tmp > client.ovpn
    sed '/^tls-auth ta.key 1/s/^/;/' client.ovpn > client.ovpn.tmp
    mv client.ovpn.tmp client.ovpn
fi

if [ ! -d easyrsa3-client ]; then
    cp -r easy-rsa/easyrsa3 easyrsa3-client
fi

cd easyrsa3-client
if [ ! -d pki ]; then
    ./easyrsa init-pki || exit 1
fi
./easyrsa --batch gen-req $HOSTNAME nopass || exit 1
cd ..

cd easyrsa3-ca
./easyrsa import-req ../easyrsa3-client/pki/reqs/$HOSTNAME.req $HOSTNAME
if [ -n "$passfile" ]; then
    ./easyrsa --batch --passin=file:$passfile sign client $HOSTNAME || exit 1
else
    ./easyrsa --batch sign client $HOSTNAME || exit 1
fi
cd ..

# Backup

TMP_DIR=$HOSTNAME-tmp
CLIENT_DIR=/etc/openvpn/client
mkdir -p $TMP_DIR $CLIENT_DIR
CLIENT_DIR_FULLPATH=`realpath $CLIENT_DIR`
BACKUP_FILE=$CLIENT_DIR_FULLPATH/$HOSTNAME.tgz

cp easyrsa3-client/pki/private/$HOSTNAME.key $TMP_DIR/client.key
cp easyrsa3-ca/pki/issued/$HOSTNAME.crt $TMP_DIR/client.crt
cp easyrsa3-ca/pki/ca.crt $TMP_DIR/
cp client.ovpn $TMP_DIR/

# Server mengizinkan proxy ?
if [ -n "$proxy" ]; then
    echo "route remote_host 255.255.255.255 net_gateway" >> $TMP_DIR/client.ovpn
    echo "route 0.0.0.0 0.0.0.0 vpn_gateway" >> $TMP_DIR/client.ovpn
    echo "redirect-gateway def1" >> $TMP_DIR/client.ovpn
fi

# Server mewajibkan login ?
if [ -n "$login" ]; then
    echo "auth-user-pass" >> $TMP_DIR/client.ovpn
    if [ -n "$adduser" ]; then
        echo "Buat user $HOSTNAME dengan password $loginpass"
        adduser --shell /bin/false --disabled-password --gecos "" $HOSTNAME
        echo "$HOSTNAME:$loginpass" | chpasswd
    fi
fi

cd $TMP_DIR
tar cfvz $BACKUP_FILE client.key client.crt ca.crt client.ovpn
cd ..
rm $TMP_DIR/client.key $TMP_DIR/client.crt $TMP_DIR/ca.crt $TMP_DIR/client.ovpn
rmdir $TMP_DIR
ls -l $BACKUP_FILE
cp -va $BACKUP_FILE /root/