Upstart_openvpn-connection.conf

author "Mariusz Kaczmarczyk <[email protected]>"
description "OpenVPN single connection instance"
usage "CONN=<connection_name>"
version "1.2"

instance $CONN

start on openvpn-init-connections
stop on openvpn-stop-connections

respawn
respawn limit 3 15

normal exit 0

console output

# defaults
env ARGFILE_DIR='/run/openvpn'
env ARGFILE_EXT='.args'
env ARGFILE_MODE='0600'
env CONFIG_DIR='/etc/openvpn'
env CONFIG_EXT='.conf'
env CONFIG_PROHIBIT_REGEXP='^[[:blank:]]*(daemon|group|syslog|user|writepid)([[:blank:]]|$)'
env DEFAULTS_FILE='/etc/default/openvpn'
env OMIT_SENDSIGS=0
env OMIT_SENDSIGS_DIR='/run/sendsigs.omit.d'
env OMIT_SENDSIGS_ARGS=''
env OPENVPN_EXEC='/usr/sbin/openvpn'
env OPENVPN_GID='openvpn'
env OPENVPN_UID='openvpn'
env OPT_ARGS=''
env PIDFILE_EXT='.pid'
env STATUS_ARGS=''
env STATUS_DIR='/run/openvpn'
env STATUS_DIR_MODE=0730
env STATUS_EXT='.status'
env STATUS_REFRESH=10
env STATUS_VERSION=3
env SYSLOG_ID='openvpn'

pre-start script
    # load global defaults file
    if [ -f "${DEFAULTS_FILE}" ]; then
        . "${DEFAULTS_FILE}"
    fi
    # load connection-specific defaults file
    CONN_DEFAULTS_FILE="${DEFAULTS_FILE}.d/${CONN}"
    if [ -f "${CONN_DEFAULTS_FILE}" ]; then
        . "${CONN_DEFAULTS_FILE}"
    fi
    # check if connection file exists
    CONN_FILE="${CONFIG_DIR}/${CONN}${CONFIG_EXT}"
    if ! [ -f "${CONN_FILE}" ]; then
        exit 2
    fi
    # check for prohibited stanzas in connection file
    CONFIG_PROHIBIT_MATCH=$(grep -E -i "${CONFIG_PROHIBIT_REGEXP}" "${CONN_FILE}" || true)
    if [ -n "${CONFIG_PROHIBIT_MATCH}" ]; then
        echo "OpenVPN: prohibited config directives in file: ${CONN_FILE}" >&2
        echo "${CONFIG_PROHIBIT_MATCH}" >&2
        exit 3
    fi
    # setup status file and refresh period
    if ! [ -d "${STATUS_DIR}" ]; then
        install -g "${OPENVPN_GID}" -m "${STATUS_DIR_MODE}" -d "${STATUS_DIR}"
    fi
    STATUS_FILE="${STATUS_DIR}/${CONN}${STATUS_EXT}"
    if [ -n "${STATUS_REFRESH}" ] && [ -d "${STATUS_DIR}" ] && [ "${STATUS_REFRESH}" -gt 0 ]; then
        STATUS_ARGS="--status ${STATUS_FILE} ${STATUS_REFRESH} --status-version ${STATUS_VERSION}"
    fi
    # avoid killing connections on shutdown if desired
    OMIT_SENDSIGS_PIDFILE="${OMIT_SENDSIGS_DIR}/openvpn.${CONN}${PIDFILE_EXT}"
    if [ "${OMIT_SENDSIGS}" -gt 0 ]; then
        OMIT_SENDSIGS_ARGS="--writepid ${OMIT_SENDSIGS_PIDFILE}"
    fi
    rm --force "${OMIT_SENDSIGS_PIDFILE}" 2>/dev/null || true
    # save arguments for exec to protected argfile
    # this is awkward but necessary workaround - Upstart's cannot pass variables between job phases
    echo "--cd ${CONFIG_DIR} --config ${CONN_FILE} ${SYSLOG_ID:+--syslog ${SYSLOG_ID}/${CONN}} ${OPENVPN_GID:+--group ${OPENVPN_GID}} ${OPENVPN_UID:+--user ${OPENVPN_UID}} ${OMIT_SENDSIGS_ARGS} ${STATUS_ARGS} ${OPT_ARGS}" >"${ARGFILE_DIR}/${CONN}${ARGFILE_EXT}"
    chmod --quiet "${ARGFILE_MODE}" "${ARGFILE_DIR}/${CONN}${ARGFILE_EXT}"
end script

script
    # ensure argfile exists
    if ! [ -f "${ARGFILE_DIR}/${CONN}${ARGFILE_EXT}" ]; then
        exit 1
    fi
    # ready to exec
    # run OpenVPN daemon with args from argfile
    exec "${OPENVPN_EXEC}" $(cat "${ARGFILE_DIR}/${CONN}${ARGFILE_EXT}")
end script