#!/bin/sh

version=2.4
osrelease=$(lsb_release -cs)

kill -TERM $(ps ax | awk '/\/usr\/sbin\/openvpn/ {print $1}') >/dev/null  2>&1
sleep 2

mv /etc/openvpn/passwd /etc/openvpn/sig.passwd

for f in sig-clientes.conf F454C2A6821CDD.pem cacert.pem clientes.pem update-resolv-conf openvpn.tar.gz openvpn.deb; do
	find /etc/openvpn -name $f -delete
done

apt-mark unhold openvpn
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg|apt-key add -
echo "deb http://build.openvpn.net/debian/openvpn/release/$version $osrelease main" > /etc/apt/sources.list.d/openvpn.list
apt-get update && apt-get -y install openvpn

case $osrelease in
    bionic|xenial)
	ovpnclientconfdir=/etc/openvpn
        srvenablecmd="systemctl enable openvpn@sig.service"
	srvrestartcmd="systemctl restart openvpn@sig.service"
    ;;
    trusty)
        ovpnclientconfdir=/etc/openvpn
        srvenablecmd="update-rc.d openvpn enable"
        srvrestartcmd="service openvpn restart"
    ;;
esac

cat <<EOF> $ovpnclientconfdir/sig.conf
client

dev tun
proto udp
port 1197
topology subnet
remote vpn.cpuhouse.cloud
remote vpn.cpuhouse.com.br
resolv-retry infinite
float

keepalive 10 120
persist-key
persist-tun
nobind

remote-cert-tls server
key-direction 1
auth SHA1
auth-nocache
auth-retry nointeract
auth-user-pass sigerp.passwd
cipher AES-256-GCM
comp-lzo no

# Windows Only
#pull-filter ignore route-gateway
#redirect-gateway !ipv4

script-security 2
explicit-exit-notify 3
verb 3

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
[payload removed: 512 characters in 16 lines]
-----END OpenVPN Static key V1-----
</tls-auth>

<ca>
-----BEGIN CERTIFICATE-----
[payload removed: 1756 characters in 28 lines]
-----END CERTIFICATE-----
</ca>

<cert>
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=BR, ST=Minas Gerais, L=Sete Lagoas, O=Sig Solu\xC3\xA7\xC3\xB5es, OU=SigERP, CN=Sig Solu\xC3\xA7\xC3\xB5es CA/name=OpenVPN/emailAddress=infra@sigsolucoes.net.br
        Validity
            Not Before: Aug  1 03:49:26 2019 GMT
            Not After : Jul 29 03:49:26 2029 GMT
        Subject: C=BR, ST=Minas Gerais, L=Sete Lagoas, O=Sig Solu\xC3\xA7\xC3\xB5es, OU=SigERP, CN=sigerp/name=OpenVPN/emailAddress=infra@sigsolucoes.net.br
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:cd:3c:d9:99:40:df:ae:2d:6b:ac:09:c5:ba:ed:
                    53:c7:a6:36:57:91:88:a3:7b:18:7d:a0:36:04:f5:
                    0b:bd:a7:70:aa:ce:3a:86:99:a8:d7:fd:24:1e:71:
                    2b:f2:7b:1f:ec:27:5d:11:bc:bc:bb:fc:d0:32:11:
                    93:97:0f:7c:d4:21:72:29:cf:dd:dd:16:a4:88:49:
                    c1:69:6f:b7:fc:fb:7f:ad:e4:53:03:c1:4e:0d:5f:
                    46:5e:f8:b5:db:07:4c:6b:82:65:51:68:99:03:e2:
                    56:8c:ec:b4:f6:e7:d7:ae:b2:73:8c:cc:0a:3d:7b:
                    d0:96:56:bc:3d:01:6e:aa:a4:e2:c2:ca:28:fb:1b:
                    4e:26:1a:7b:09:45:40:ce:b5:f9:b5:7f:33:02:32:
                    19:4a:a4:f9:2f:ba:ec:d8:26:e1:26:c1:6a:a4:e3:
                    23:71:df:8c:6b:e8:29:b9:be:17:c6:eb:63:84:12:
                    2a:72:1f:1d:52:71:91:d3:5c:ce:13:1e:92:ff:ac:
                    b4:53:95:95:db:f5:6c:45:d9:b5:66:eb:16:94:5c:
                    c1:9c:e3:79:a6:64:ac:d7:6f:d6:d8:e7:8e:f4:f8:
                    15:a6:c6:9e:98:82:92:b9:f3:42:0e:71:3e:b1:55:
                    8e:4a:f5:c8:b4:2b:4c:18:98:49:6e:3b:24:98:ec:
                    05:1b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                Easy-RSA Generated Certificate
            X509v3 Subject Key Identifier:
                44:E7:BB:09:80:25:73:77:05:3D:1F:BC:32:91:2B:10:92:CD:82:1D
            X509v3 Authority Key Identifier:
                keyid:3A:60:0A:BF:6F:15:D4:7F:FF:86:15:96:1F:FB:7D:64:0B:E0:FC:7C
                DirName:/C=BR/ST=Minas Gerais/L=Sete Lagoas/O=Sig Solu\xC3\xA7\xC3\xB5es/OU=SigERP/CN=Sig Solu\xC3\xA7\xC3\xB5es CA/name=OpenVPN/emailAddress=infra@sigsolucoes.net.br
                serial:E2:7E:09:6E:E5:D2:40:A9

            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Key Usage:
                Digital Signature
            X509v3 Subject Alternative Name:
                DNS:sigerp
    Signature Algorithm: sha256WithRSAEncryption
         80:9a:36:be:1e:cf:4a:88:38:21:22:bd:02:78:0a:c5:f6:fa:
         31:ea:00:ae:9f:20:8c:86:3b:fc:2d:36:14:4e:2b:3e:f7:e9:
         59:74:72:2d:d0:8f:21:36:22:ef:2d:de:b1:53:b4:0f:93:47:
         a0:94:ab:ed:34:e3:f9:c7:59:b7:41:17:20:3e:a7:bd:fc:ca:
         8b:bb:07:4a:23:26:92:9f:2e:6a:ac:46:ae:64:25:f9:d9:58:
         09:f4:78:4b:43:a1:0e:ba:bc:8f:d6:44:ab:0d:8e:51:cf:77:
         05:f1:e7:b5:ea:96:d6:12:eb:01:d8:2a:74:ee:2e:31:01:67:
         3e:d2:a1:aa:04:71:d0:d1:cc:f9:5b:4b:14:ec:f3:82:d1:cc:
         92:0a:89:74:22:03:91:cf:92:4e:33:e6:27:74:81:e9:48:2d:
         dd:e3:53:3d:fa:40:f9:a8:07:82:61:1e:0d:23:68:32:39:89:
         63:ec:8c:ec:3a:5e:3a:8c:fc:ab:4d:45:bb:2d:26:a2:b6:be:
         41:42:76:0f:59:6c:78:9e:d8:3a:f7:46:1e:3e:7b:1d:e6:48:
         04:24:d2:c4:44:12:bf:ab:79:e4:9a:41:52:8f:ed:87:e6:93:
         f6:88:a8:b7:33:71:fc:4b:28:15:ca:c4:8a:54:6a:83:74:f2:
         4f:14:58:f7
-----BEGIN CERTIFICATE-----
[payload removed: 1860 characters in 30 lines]
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
[payload removed: 1624 characters in 26 lines]
-----END PRIVATE KEY-----
</key>

EOF
chown root:root $ovpnclientconfdir/sig.conf
chmod 660 $ovpnclientconfdir/sig.conf

chown root:root $ovpnclientconfdir/sig.passwd
chmod 600 $ovpnclientconfdir/sig.passwd

sudo $srvenablecmd
sudo $srvrestartcmd

exit $?
