OpenVPN:Web Admin

Two web UIs run on this VPS for managing and monitoring OpenVPN. Both listen only on the VPN address 10.8.0.1 — they are not exposed via Caddy or the public internet.

Access (connect to VPN first)

UI	URL	Purpose
ovpn-admin	http://10.8.0.1:8085	Create / revoke / download `.ovpn`, CCD/static IPs, live connection flags
openvpn-monitor	http://10.8.0.1:8086	Live clients, session history, traffic charts

There is no login on either UI. Anyone connected to the VPN can reach them.

Services

Component	How it runs
ovpn-admin	systemd `ovpn-admin.service` → `/opt/ovpn-admin/ovpn-admin`
openvpn-monitor	Docker Compose in `/var/www/openvpn-monitor` (`docker-compose.vpn-only.yml`)
OpenVPN management	`127.0.0.1:8989` (localhost only)
Status log	`/var/log/openvpn-status.log` (`status-version 1`)
Status log perms	`openvpn-status-perms.service` sets mode `644` after OpenVPN start

Useful commands:

systemctl status ovpn-admin openvpn-server@server
docker compose -f /var/www/openvpn-monitor/docker-compose.vpn-only.yml ps
journalctl -u ovpn-admin -f
tail -f /var/log/ovpn-admin-easyrsa.log

Creating a client (preferred: UI)

Connect to VPN and open http://10.8.0.1:8085
Add user → enter a client name (letters, numbers, underscore)
Download the .ovpn (Show config / download)
Optional: set a static IP under CCD (see caveats below)

Downloaded profiles are full-tunnel by default (redirect-gateway + host DNS), with tls-crypt matching the server.

Backup create path (CLI)

[/root/openvpn-install.sh /root/openvpn-install.sh] remains available if the UI cannot create a cert:

bash /root/openvpn-install.sh
# choose "Add a new client"

CCD / static IPs

Existing CCD files live in /etc/openvpn/ccd/:

Client	Address
StrawberryNAS	`10.8.0.2`
jb-rpi2-webserver	`10.8.0.3`
jb-rpi-homeassistant	`10.8.0.4` (uses `push-reset` + custom routes)

The UI CCD editor can rewrite these files to a simpler ifconfig-push … 255.255.255.0 form. After editing NAS/Pi CCD in the UI, verify:

https://plex.jb-vpn.uk and https://dsm.jb-vpn.uk still work

Client still gets the expected 10.8.0.x address

Dynamic pool remains 10.8.0.51–10.8.0.254.

Revoke

Revoke in the UI. The Easy-RSA wrapper syncs pki/crl.pem → /etc/openvpn/server/crl.pem. Revoked clients fail on next reconnect (sessions are not force-killed).

Layout on disk

/opt/ovpn-admin/
  ovpn-admin                 # binary
  easyrsa-wrapper            # injects --batch/--days=3650; syncs CRL
  templates/client.conf.tpl  # tls-crypt full-tunnel client template

/etc/openvpn/server/easy-rsa/pki/ta.key  → symlink to ../tc.key  (for ovpn-admin TLS template field)

/var/www/openvpn-monitor/    # farggus/openvpn-monitor checkout + compose
/root/backups/openvpn-*/     # PKI/CCD backups taken before install

Do not

Add a public Caddy site for these ports

Bind the UIs to 0.0.0.0 / the public NIC

Remove openvpn-install.sh (kept as backup)

Smoke-check after OpenVPN restart

# Live clients via management
(echo status; sleep 0.2; echo quit) | nc -w 2 127.0.0.1 8989

# Admin + monitor
curl -s http://10.8.0.1:8085/api/users/list | head
curl -s http://10.8.0.1:8086/api/clients | head