Editing OpenVPN:Web Admin

Two web UIs run on this VPS for managing and monitoring OpenVPN. Both listen only on the VPN address <code>10.8.0.1</code> — they are '''not''' exposed via Caddy or the public internet.

== Access (connect to VPN first) ==

{| class="wikitable"
|-
| UI || URL || Purpose
|-
| '''ovpn-admin''' || http://10.8.0.1:8085 || Create / revoke / download <code>.ovpn</code>, CCD/static IPs, live connection flags
|-
| '''openvpn-monitor''' || http://10.8.0.1:8086 || Live clients, session history, traffic charts
|}

There is '''no login''' on either UI. Anyone connected to the VPN can reach them.

== Services ==

{| class="wikitable"
|-
| Component || How it runs
|-
| ovpn-admin || systemd <code>ovpn-admin.service</code> → <code>/opt/ovpn-admin/ovpn-admin</code>
|-
| openvpn-monitor || Docker Compose in <code>/var/www/openvpn-monitor</code> (<code>docker-compose.vpn-only.yml</code>)
|-
| OpenVPN management || <code>127.0.0.1:8989</code> (localhost only)
|-
| Status log || <code>/var/log/openvpn-status.log</code> (<code>status-version 1</code>)
|-
| Status log perms || <code>openvpn-status-perms.service</code> sets mode <code>644</code> after OpenVPN start
|}

Useful commands:

<pre class="lang-bash">
systemctl status ovpn-admin openvpn-server@server
docker compose -f /var/www/openvpn-monitor/docker-compose.vpn-only.yml ps
journalctl -u ovpn-admin -f
tail -f /var/log/ovpn-admin-easyrsa.log
</pre>

== Creating a client (preferred: UI) ==

# Connect to VPN and open http://10.8.0.1:8085
# '''Add user''' → enter a client name (letters, numbers, underscore)
# Download the <code>.ovpn</code> (Show config / download)
# Optional: set a static IP under CCD (see caveats below)

Downloaded profiles are '''full-tunnel''' by default (<code>redirect-gateway</code> + host DNS), with <code>tls-crypt</code> matching the server.

== Backup create path (CLI) ==

[/root/openvpn-install.sh <code>/root/openvpn-install.sh</code>] remains available if the UI cannot create a cert:

<pre class="lang-bash">
bash /root/openvpn-install.sh
# choose "Add a new client"
</pre>

== CCD / static IPs ==

Existing CCD files live in <code>/etc/openvpn/ccd/</code>:

{| class="wikitable"
|-
| Client || Address
|-
| StrawberryNAS || <code>10.8.0.2</code>
|-
| jb-rpi2-webserver || <code>10.8.0.3</code>
|-
| jb-rpi-homeassistant || <code>10.8.0.4</code> (uses <code>push-reset</code> + custom routes)
|}

The UI CCD editor can rewrite these files to a simpler <code>ifconfig-push … 255.255.255.0</code> form. After editing NAS/Pi CCD in the UI, verify:

* https://plex.jb-vpn.uk and https://dsm.jb-vpn.uk still work

* Client still gets the expected <code>10.8.0.x</code> address

Dynamic pool remains <code>10.8.0.51</code>–<code>10.8.0.254</code>.

== Revoke ==

Revoke in the UI. The Easy-RSA wrapper syncs <code>pki/crl.pem</code> → <code>/etc/openvpn/server/crl.pem</code>. Revoked clients fail on '''next reconnect''' (sessions are not force-killed).

== Layout on disk ==

<pre>
/opt/ovpn-admin/
  ovpn-admin                 # binary
  easyrsa-wrapper            # injects --batch/--days=3650; syncs CRL
  templates/client.conf.tpl  # tls-crypt full-tunnel client template

/etc/openvpn/server/easy-rsa/pki/ta.key  → symlink to ../tc.key  (for ovpn-admin TLS template field)

/var/www/openvpn-monitor/    # farggus/openvpn-monitor checkout + compose
/root/backups/openvpn-*/     # PKI/CCD backups taken before install
</pre>

== Related Documentation ==

* [[OpenVPN:User Management|OpenVPN:User Management]]

* [[OpenVPN:Server Configuration|OpenVPN:Server Configuration]]

* [[Documentation:Certificate-Management|OpenVPN:Certificate Management]]

* [[Services:Current Services|Services:Current Services]]

== Do not ==

* Add a public Caddy site for these ports

* Bind the UIs to <code>0.0.0.0</code> / the public NIC

* Remove <code>openvpn-install.sh</code> (kept as backup)

== Smoke-check after OpenVPN restart ==

<pre class="lang-bash">
# Live clients via management
(echo status; sleep 0.2; echo quit) | nc -w 2 127.0.0.1 8989

# Admin + monitor
curl -s http://10.8.0.1:8085/api/users/list | head
curl -s http://10.8.0.1:8086/api/clients | head
</pre>

[[Category:Documentation]]
[[Category:Documentation/OpenVPN]]