ysk-server-core 1.0.0

package/dist/hosting/vpn/openvpn-conf.js

@@ -0,0 +1,89 @@
+/**
+ * Pure OpenVPN conf builders (no host I/O).
+ */
+import { ovpnAccessPushLines } from './access-mode.js';
+export function buildOpenVpnServerConf(input) {
+    const net = input.serverNet ?? '10.8.0.0 255.255.255.0';
+    const dns = input.dns ?? '1.1.1.1';
+    const statusPath = input.statusPath ?? '/run/openvpn-server/ysk-status.log';
+    const mode = input.accessMode ?? 'full';
+    const accessPushes = ovpnAccessPushLines(mode, {
+        lanCidrs: input.lanCidrs,
+        customCidrs: input.customCidrs,
+        vpnNetCidr: '10.8.0.0/24',
+    });
+    const lines = [
+        '# YSK-managed OpenVPN server',
+        `port ${input.port}`,
+        `proto ${input.proto}`,
+        'dev tun',
+        `ca ${input.caPath}`,
+        `cert ${input.certPath}`,
+        `key ${input.keyPath}`,
+        `dh ${input.dhPath}`,
+        `tls-crypt ${input.taPath}`,
+        `server ${net}`,
+        'topology subnet',
+        `client-config-dir ${input.ccdDir}`,
+        'keepalive 10 120',
+        'persist-key',
+        'persist-tun',
+        'user nobody',
+        'group nogroup',
+        'verb 3',
+        `status ${statusPath} 5`,
+        'status-version 2',
+        // access mode pushes
+        ...accessPushes,
+    ];
+    if (mode === 'full') {
+        lines.push(`push "dhcp-option DNS ${dns}"`);
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+export function buildOpenVpnClientOvpn(input) {
+    return [
+        '# YSK OpenVPN client — import into OpenVPN Connect / openvpn CLI',
+        'client',
+        'dev tun',
+        `proto ${input.proto}`,
+        `remote ${input.remote} ${input.port}`,
+        'resolv-retry infinite',
+        'nobind',
+        'persist-key',
+        'persist-tun',
+        'remote-cert-tls server',
+        'verb 3',
+        '<ca>',
+        input.caCrt.trim(),
+        '</ca>',
+        '<cert>',
+        input.clientCrt.trim(),
+        '</cert>',
+        '<key>',
+        input.clientKey.trim(),
+        '</key>',
+        '<tls-crypt>',
+        input.taKey.trim(),
+        '</tls-crypt>',
+        '',
+    ].join('\n');
+}
+/** Next client IP in 10.8.0.0/24 (server .1). Returns dotted IP for ifconfig-push. */
+export function nextOpenVpnClientIp(used) {
+    const taken = new Set(used.map((a) => {
+        const m = a.match(/10\.8\.0\.(\d+)/);
+        return m ? Number(m[1]) : 0;
+    }));
+    for (let i = 2; i < 254; i++) {
+        if (!taken.has(i))
+            return `10.8.0.${i}`;
+    }
+    throw new Error('no free OpenVPN client addresses');
+}
+export function openVpnClientUnitName(id) {
+    const short = id.replace(/[^a-z0-9]/gi, '').slice(0, 12).toLowerCase() || 'x';
+    return `ysk-ovpn-c-${short}`;
+}
+//# sourceMappingURL=openvpn-conf.js.map

package/dist/hosting/vpn/openvpn-conf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openvpn-conf.js","sourceRoot":"","sources":["../../../src/hosting/vpn/openvpn-conf.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,UAAU,sBAAsB,CAAC,KAgBtC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,wBAAwB,CAAC;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,oCAAoC,CAAC;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;IACxC,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG;QACZ,8BAA8B;QAC9B,QAAQ,KAAK,CAAC,IAAI,EAAE;QACpB,SAAS,KAAK,CAAC,KAAK,EAAE;QACtB,SAAS;QACT,MAAM,KAAK,CAAC,MAAM,EAAE;QACpB,QAAQ,KAAK,CAAC,QAAQ,EAAE;QACxB,OAAO,KAAK,CAAC,OAAO,EAAE;QACtB,MAAM,KAAK,CAAC,MAAM,EAAE;QACpB,aAAa,KAAK,CAAC,MAAM,EAAE;QAC3B,UAAU,GAAG,EAAE;QACf,iBAAiB;QACjB,qBAAqB,KAAK,CAAC,MAAM,EAAE;QACnC,kBAAkB;QAClB,aAAa;QACb,aAAa;QACb,aAAa;QACb,eAAe;QACf,QAAQ;QACR,UAAU,UAAU,IAAI;QACxB,kBAAkB;QAClB,qBAAqB;QACrB,GAAG,YAAY;KAChB,CAAC;IACF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAQtC;IACC,OAAO;QACL,kEAAkE;QAClE,QAAQ;QACR,SAAS;QACT,SAAS,KAAK,CAAC,KAAK,EAAE;QACtB,UAAU,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE;QACtC,uBAAuB;QACvB,QAAQ;QACR,aAAa;QACb,aAAa;QACb,wBAAwB;QACxB,QAAQ;QACR,MAAM;QACN,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;QAClB,OAAO;QACP,QAAQ;QACR,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;QACtB,SAAS;QACT,OAAO;QACP,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;QACtB,QAAQ;QACR,aAAa;QACb,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;QAClB,cAAc;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CACH,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,UAAU,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC;IAC9E,OAAO,cAAc,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/hosting/vpn/openvpn-ops.d.ts

@@ -0,0 +1,72 @@
+/**
+ * OpenVPN server/client host operations (PKI + conf + units).
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import { openVpnClientUnitName } from './openvpn-conf.js';
+import type { VpnAccessMode, VpnServerPeer } from './types.js';
+export type OvpnServerState = {
+    listenPort: number;
+    proto: 'udp' | 'tcp';
+    endpoint: string;
+    dns: string;
+    /** Client traffic policy */
+    accessMode?: VpnAccessMode;
+    lanCidrs?: string[];
+    customCidrs?: string[];
+    peers: Array<{
+        id: string;
+        name: string;
+        address: string;
+        createdAt: string;
+    }>;
+    updatedAt: string;
+};
+export declare function ovpnServerDir(dataDir: string): string;
+export declare function loadOvpnServer(dataDir: string): OvpnServerState | null;
+export declare function saveOvpnServer(dataDir: string, state: OvpnServerState): void;
+export declare function listOvpnPeers(dataDir: string): VpnServerPeer[];
+/**
+ * Bootstrap CA + server certs + dh + tls-crypt under dataDir, write server conf, start unit.
+ */
+export declare function ensureOpenVpnServer(host: HostExecutor, dataDir: string, input: {
+    listenPort?: number;
+    proto?: 'udp' | 'tcp';
+    endpoint?: string;
+    dns?: string;
+    accessMode?: VpnAccessMode;
+    lanCidrs?: string[];
+    customCidrs?: string[];
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    requiresExecute?: boolean;
+}>;
+export declare function addOvpnPeer(host: HostExecutor, dataDir: string, nameRaw: string): Promise<{
+    ok: boolean;
+    peer?: VpnServerPeer;
+    config?: string;
+    notes: string[];
+    blocked?: boolean;
+    requiresExecute?: boolean;
+}>;
+/** Re-apply current server endpoint to every stored .ovpn (download / QR source). */
+export declare function rewriteAllOvpnClientRemotes(dataDir: string): number;
+export declare function getOvpnPeerConfig(dataDir: string, peerId: string): {
+    config: string;
+    filename: string;
+} | null;
+export declare function deleteOvpnPeer(host: HostExecutor, dataDir: string, peerId: string): Promise<{
+    ok: boolean;
+    notes: string[];
+}>;
+export declare function isOvpnServerActive(host: HostExecutor): Promise<boolean>;
+/** Client up via openvpn --config + systemd unit template */
+export declare function openvpnClientUp(host: HostExecutor, confPath: string, unitName: string): Promise<{
+    ok: boolean;
+    notes: string[];
+}>;
+export declare function openvpnClientDown(host: HostExecutor, unitName: string): Promise<void>;
+export declare function openvpnClientIsUp(host: HostExecutor, unitName: string): Promise<boolean>;
+export { openVpnClientUnitName };
+//# sourceMappingURL=openvpn-ops.d.ts.map

package/dist/hosting/vpn/openvpn-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openvpn-ops.d.ts","sourceRoot":"","sources":["../../../src/hosting/vpn/openvpn-ops.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAIL,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAe/D,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAaF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAQtE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAK5E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAW9D;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IACL,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqNzF;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IACT,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC,CAoHD;AAED,qFAAqF;AACrF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsBnE;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmB7C;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAiB3C;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAW7E;AAED,6DAA6D;AAC7D,wBAAsB,eAAe,CACnC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmC3C;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/hosting/vpn/openvpn-ops.js

@@ -0,0 +1,500 @@
+/**
+ * OpenVPN server/client host operations (PKI + conf + units).
+ */
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, } from 'node:fs';
+import { join } from 'node:path';
+import { tl } from 'ysk-server-shared';
+import { buildOpenVpnClientOvpn, buildOpenVpnServerConf, nextOpenVpnClientIp, openVpnClientUnitName, } from './openvpn-conf.js';
+import { sanitizePeerName } from './wireguard-conf.js';
+import { DEFAULT_VPN_LAN_CIDRS } from './types.js';
+import { buildVpnNatShell, needsInternetNat, normalizeVpnCidrList, parseAccessMode, } from './access-mode.js';
+import { applyOvpnRemote, formatVpnEndpoint, guessPublicEndpoint, parseVpnEndpoint, } from './endpoint.js';
+function newId() {
+    return randomBytes(8).toString('hex');
+}
+async function binExists(host, bin) {
+    const r = await host.runCommand(['bash', '-c', `command -v ${bin} >/dev/null 2>&1`], {
+        timeoutMs: 5_000,
+    });
+    return r.exitCode === 0;
+}
+export function ovpnServerDir(dataDir) {
+    return join(dataDir, 'vpn', 'server', 'openvpn');
+}
+export function loadOvpnServer(dataDir) {
+    const p = join(ovpnServerDir(dataDir), 'server.json');
+    if (!existsSync(p))
+        return null;
+    try {
+        return JSON.parse(readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveOvpnServer(dataDir, state) {
+    const dir = ovpnServerDir(dataDir);
+    mkdirSync(dir, { recursive: true });
+    state.updatedAt = new Date().toISOString();
+    writeFileSync(join(dir, 'server.json'), JSON.stringify(state, null, 2), 'utf8');
+}
+export function listOvpnPeers(dataDir) {
+    const state = loadOvpnServer(dataDir);
+    if (!state)
+        return [];
+    return state.peers.map((p) => ({
+        id: p.id,
+        name: p.name,
+        engine: 'openvpn',
+        address: p.address,
+        publicKey: '',
+        createdAt: p.createdAt,
+    }));
+}
+/**
+ * Bootstrap CA + server certs + dh + tls-crypt under dataDir, write server conf, start unit.
+ */
+export async function ensureOpenVpnServer(host, dataDir, input) {
+    const notes = [];
+    if (!host.executeEnabled() || !host.isRoot()) {
+        return {
+            ok: false,
+            blocked: true,
+            requiresExecute: !host.executeEnabled(),
+            notes: [tl('notes.vpn.needExecuteServer')],
+        };
+    }
+    if (!(await binExists(host, 'openvpn')) || !(await binExists(host, 'openssl'))) {
+        return { ok: false, notes: [tl('notes.vpn.needInstall', { engine: 'OpenVPN' })] };
+    }
+    const dir = ovpnServerDir(dataDir);
+    const pki = join(dir, 'pki');
+    mkdirSync(join(pki, 'issued'), { recursive: true });
+    mkdirSync(join(pki, 'private'), { recursive: true });
+    mkdirSync(join(dir, 'ccd'), { recursive: true });
+    let state = loadOvpnServer(dataDir);
+    if (!state) {
+        state = {
+            listenPort: input.listenPort ?? 1194,
+            proto: input.proto === 'tcp' ? 'tcp' : 'udp',
+            endpoint: input.endpoint?.trim() || '',
+            dns: input.dns?.trim() || '1.1.1.1',
+            accessMode: parseAccessMode(input.accessMode ?? 'full'),
+            lanCidrs: normalizeVpnCidrList(input.lanCidrs ?? [...DEFAULT_VPN_LAN_CIDRS]),
+            customCidrs: normalizeVpnCidrList(input.customCidrs ?? []),
+            peers: [],
+            updatedAt: new Date().toISOString(),
+        };
+    }
+    else {
+        if (input.listenPort)
+            state.listenPort = input.listenPort;
+        if (input.proto)
+            state.proto = input.proto;
+        if (input.endpoint != null)
+            state.endpoint = input.endpoint.trim();
+        if (input.dns != null)
+            state.dns = input.dns.trim() || state.dns;
+        if (input.accessMode != null)
+            state.accessMode = parseAccessMode(input.accessMode);
+        if (input.lanCidrs != null)
+            state.lanCidrs = normalizeVpnCidrList(input.lanCidrs);
+        if (input.customCidrs != null)
+            state.customCidrs = normalizeVpnCidrList(input.customCidrs);
+        if (!state.accessMode)
+            state.accessMode = 'full';
+        if (!state.lanCidrs?.length)
+            state.lanCidrs = [...DEFAULT_VPN_LAN_CIDRS];
+    }
+    // Normalize / autofill public endpoint (reject "51820:1194" style typos)
+    let ep = parseVpnEndpoint(state.endpoint, state.listenPort);
+    if (!ep.ok) {
+        const guessed = await guessPublicEndpoint(host, state.listenPort);
+        if (guessed) {
+            state.endpoint = guessed;
+            ep = parseVpnEndpoint(state.endpoint, state.listenPort);
+            notes.push(tl('notes.vpn.endpointAutofilled', { endpoint: state.endpoint }));
+        }
+        else {
+            state.endpoint = '';
+            notes.push(tl('notes.vpn.setEndpointHint'));
+        }
+    }
+    else {
+        state.endpoint = formatVpnEndpoint(ep.host, ep.port) || `${ep.host}:${ep.port}`;
+    }
+    const caKey = join(pki, 'private', 'ca.key');
+    const caCrt = join(pki, 'ca.crt');
+    const srvKey = join(pki, 'private', 'server.key');
+    const srvCrt = join(pki, 'issued', 'server.crt');
+    const dh = join(pki, 'dh.pem');
+    const ta = join(pki, 'ta.key');
+    // Generate PKI once
+    if (!existsSync(caCrt) || !existsSync(srvCrt) || !existsSync(dh) || !existsSync(ta)) {
+        const pkiScript = [
+            'set -euo pipefail',
+            `mkdir -p ${JSON.stringify(join(pki, 'private'))} ${JSON.stringify(join(pki, 'issued'))}`,
+            `openssl genrsa -out ${JSON.stringify(caKey)} 2048`,
+            `openssl req -new -x509 -days 3650 -key ${JSON.stringify(caKey)} -out ${JSON.stringify(caCrt)} -subj '/CN=YSK-OpenVPN-CA'`,
+            `openssl genrsa -out ${JSON.stringify(srvKey)} 2048`,
+            `openssl req -new -key ${JSON.stringify(srvKey)} -out ${JSON.stringify(join(pki, 'server.csr'))} -subj '/CN=ysk-openvpn-server'`,
+            `openssl x509 -req -in ${JSON.stringify(join(pki, 'server.csr'))} -CA ${JSON.stringify(caCrt)} -CAkey ${JSON.stringify(caKey)} -CAcreateserial -out ${JSON.stringify(srvCrt)} -days 3650`,
+            // 2048 dh is slow; 2048 still preferred for security
+            `openssl dhparam -out ${JSON.stringify(dh)} 2048`,
+            `openvpn --genkey secret ${JSON.stringify(ta)}`,
+            `chmod 600 ${JSON.stringify(caKey)} ${JSON.stringify(srvKey)} ${JSON.stringify(ta)}`,
+        ].join('\n');
+        notes.push(tl('notes.vpn.ovpnPkiStart'));
+        const pkiRun = await host.runCommand(['bash', '-c', pkiScript], { timeoutMs: 600_000 });
+        if (pkiRun.exitCode !== 0) {
+            notes.push(tl('notes.vpn.applyFailed', {
+                detail: (pkiRun.stderr || pkiRun.stdout || '').slice(0, 300),
+            }));
+            return { ok: false, notes };
+        }
+        notes.push(tl('notes.vpn.ovpnPkiDone'));
+    }
+    saveOvpnServer(dataDir, state);
+    // Rewrite client .ovpn remote lines so download/QR never keep a bad host
+    const rewritten = rewriteAllOvpnClientRemotes(dataDir);
+    if (rewritten > 0) {
+        notes.push(tl('notes.vpn.ovpnClientsRewritten', { n: String(rewritten) }));
+    }
+    const accessMode = parseAccessMode(state.accessMode ?? 'full');
+    const lanCidrs = normalizeVpnCidrList(state.lanCidrs ?? [...DEFAULT_VPN_LAN_CIDRS]);
+    const customCidrs = normalizeVpnCidrList(state.customCidrs ?? []);
+    const confBody = buildOpenVpnServerConf({
+        port: state.listenPort,
+        proto: state.proto,
+        dns: state.dns,
+        caPath: caCrt,
+        certPath: srvCrt,
+        keyPath: srvKey,
+        dhPath: dh,
+        taPath: ta,
+        ccdDir: join(dir, 'ccd'),
+        statusPath: '/run/openvpn-server/ysk-status.log',
+        accessMode,
+        lanCidrs,
+        customCidrs,
+    });
+    const enableNat = needsInternetNat(accessMode, customCidrs);
+    const natShell = buildVpnNatShell({
+        sourceCidr: '10.8.0.0/24',
+        tunnelIfaceHint: 'tun0',
+        enableNat,
+        lanCidrs,
+        mark: 'YSK-VPN-OVPN',
+    });
+    // Prefer /etc/openvpn/server/ysk.conf (Debian openvpn-server@.service)
+    const confPath = '/etc/openvpn/server/ysk.conf';
+    const natScriptPath = '/usr/local/lib/ysk-server/vpn-nat-ovpn.sh';
+    const apply = await host.runCommand([
+        'bash',
+        '-c',
+        [
+            'mkdir -p /etc/openvpn/server /var/log/openvpn /run/openvpn-server /usr/local/lib/ysk-server',
+            'mkdir -p /etc/systemd/system/openvpn-server@ysk.service.d /etc/systemd/system/openvpn@ysk.service.d',
+            // Status file must be writable by openvpn (nobody) — prepare before start
+            'touch /run/openvpn-server/ysk-status.log /var/log/openvpn/ysk-status.log 2>/dev/null || true',
+            'chown nobody:nogroup /run/openvpn-server /run/openvpn-server/ysk-status.log 2>/dev/null || true',
+            'chown nobody:nogroup /var/log/openvpn /var/log/openvpn/ysk-status.log 2>/dev/null || true',
+            'chmod 755 /run/openvpn-server /var/log/openvpn 2>/dev/null || true',
+            'chmod 644 /run/openvpn-server/ysk-status.log /var/log/openvpn/ysk-status.log 2>/dev/null || true',
+            `cat > ${JSON.stringify(confPath)} <<'YSKOVPN'`,
+            confBody,
+            'YSKOVPN',
+            'chmod 600 /etc/openvpn/server/ysk.conf',
+            // Durable NAT/forward script — every host, reboot-safe via systemd ExecStartPost
+            `cat > ${JSON.stringify(natScriptPath)} <<'YSKNAT'`,
+            '#!/bin/bash',
+            '# YSK-managed OpenVPN NAT/forward (regenerated on VPN apply)',
+            'set +e',
+            'sleep 0.4',
+            natShell,
+            'YSKNAT',
+            `chmod 755 ${JSON.stringify(natScriptPath)}`,
+            // Drop-in: re-apply after openvpn starts (tun up) on every boot/restart
+            `cat > /etc/systemd/system/openvpn-server@ysk.service.d/ysk-nat.conf <<'EOF'`,
+            '[Service]',
+            'ExecStartPost=/usr/local/lib/ysk-server/vpn-nat-ovpn.sh',
+            'EOF',
+            `cat > /etc/systemd/system/openvpn@ysk.service.d/ysk-nat.conf <<'EOF'`,
+            '[Service]',
+            'ExecStartPost=/usr/local/lib/ysk-server/vpn-nat-ovpn.sh',
+            'EOF',
+            'systemctl daemon-reload',
+            // unit name varies: openvpn-server@ysk or openvpn@server
+            'if systemctl list-unit-files 2>/dev/null | grep -q openvpn-server@.service; then',
+            '  systemctl enable openvpn-server@ysk 2>/dev/null || true',
+            '  systemctl restart openvpn-server@ysk',
+            'elif systemctl list-unit-files 2>/dev/null | grep -q "openvpn@.service"; then',
+            '  # Legacy openvpn@ cannot use /run/openvpn-server — patch conf status path',
+            `  sed -i 's|/run/openvpn-server/ysk-status.log|/var/log/openvpn/ysk-status.log|g' ${JSON.stringify(confPath)}`,
+            '  ln -sfn /etc/openvpn/server/ysk.conf /etc/openvpn/ysk.conf 2>/dev/null || cp /etc/openvpn/server/ysk.conf /etc/openvpn/ysk.conf',
+            '  systemctl enable openvpn@ysk 2>/dev/null || true',
+            '  systemctl restart openvpn@ysk',
+            'else',
+            '  openvpn --config /etc/openvpn/server/ysk.conf --daemon ysk-openvpn',
+            'fi',
+            // Immediate apply (also covers non-systemd path)
+            'sleep 0.6',
+            JSON.stringify(natScriptPath),
+            // Verify tun0 forward exists before UFW reject (product health)
+            'iptables -S FORWARD 2>/dev/null | grep -q "YSK-VPN-OVPN" || { echo "YSK-VPN: FORWARD mark missing after NAT apply" >&2; iptables -L FORWARD -n | head -15 >&2; exit 1; }',
+        ].join('\n'),
+    ], { timeoutMs: 60_000 });
+    if (apply.exitCode !== 0) {
+        notes.push(tl('notes.vpn.applyFailed', {
+            detail: (apply.stderr || apply.stdout || '').slice(0, 240),
+        }));
+        return { ok: false, notes };
+    }
+    notes.push(tl('notes.vpn.ovpnServerActive', {
+        port: String(state.listenPort),
+        proto: state.proto,
+    }));
+    if (enableNat) {
+        notes.push(tl('notes.vpn.accessFullNat'));
+    }
+    else {
+        notes.push(tl('notes.vpn.accessLanOnly'));
+    }
+    notes.push(tl('notes.vpn.ovpnNatDurable'));
+    notes.push(tl('notes.vpn.accessReconnectHint'));
+    return { ok: true, notes };
+}
+export async function addOvpnPeer(host, dataDir, nameRaw) {
+    if (!host.executeEnabled() || !host.isRoot()) {
+        return {
+            ok: false,
+            blocked: true,
+            requiresExecute: !host.executeEnabled(),
+            notes: [tl('notes.vpn.needExecuteServer')],
+        };
+    }
+    let state = loadOvpnServer(dataDir);
+    if (!state) {
+        const ens = await ensureOpenVpnServer(host, dataDir, {});
+        if (!ens.ok) {
+            return {
+                ok: false,
+                notes: ens.notes,
+                blocked: ens.blocked,
+                requiresExecute: ens.requiresExecute,
+            };
+        }
+        state = loadOvpnServer(dataDir);
+    }
+    if (!state)
+        return { ok: false, notes: [tl('notes.vpn.serverMissing')] };
+    const dir = ovpnServerDir(dataDir);
+    const pki = join(dir, 'pki');
+    const caKey = join(pki, 'private', 'ca.key');
+    const caCrt = join(pki, 'ca.crt');
+    const ta = join(pki, 'ta.key');
+    if (!existsSync(caCrt)) {
+        return { ok: false, notes: [tl('notes.vpn.serverMissing')] };
+    }
+    const id = newId();
+    const name = sanitizePeerName(nameRaw);
+    const address = nextOpenVpnClientIp(state.peers.map((p) => p.address));
+    const clientKey = join(pki, 'private', `${id}.key`);
+    const clientCsr = join(pki, `${id}.csr`);
+    const clientCrt = join(pki, 'issued', `${id}.crt`);
+    const gen = await host.runCommand([
+        'bash',
+        '-c',
+        [
+            'set -euo pipefail',
+            `openssl genrsa -out ${JSON.stringify(clientKey)} 2048`,
+            `openssl req -new -key ${JSON.stringify(clientKey)} -out ${JSON.stringify(clientCsr)} -subj ${JSON.stringify(`/CN=${name}`)}`,
+            `openssl x509 -req -in ${JSON.stringify(clientCsr)} -CA ${JSON.stringify(caCrt)} -CAkey ${JSON.stringify(caKey)} -CAcreateserial -out ${JSON.stringify(clientCrt)} -days 3650`,
+            `chmod 600 ${JSON.stringify(clientKey)}`,
+            // CCD fixed IP
+            `echo "ifconfig-push ${address} 255.255.255.0" > ${JSON.stringify(join(dir, 'ccd', name))}`,
+        ].join('\n'),
+    ], { timeoutMs: 60_000 });
+    if (gen.exitCode !== 0) {
+        return {
+            ok: false,
+            notes: [
+                tl('notes.vpn.applyFailed', {
+                    detail: (gen.stderr || gen.stdout || '').slice(0, 200),
+                }),
+            ],
+        };
+    }
+    state.peers.push({ id, name, address, createdAt: new Date().toISOString() });
+    saveOvpnServer(dataDir, state);
+    mkdirSync(join(dir, 'clients'), { recursive: true });
+    writeFileSync(join(dir, 'clients', `${id}.json`), JSON.stringify({
+        id,
+        name,
+        address,
+        clientKey,
+        clientCrt,
+        createdAt: new Date().toISOString(),
+    }, null, 2), 'utf8');
+    const ep = parseVpnEndpoint(state.endpoint, state.listenPort);
+    const config = buildOpenVpnClientOvpn({
+        remote: ep.host,
+        port: ep.port,
+        proto: state.proto,
+        caCrt: readFileSync(caCrt, 'utf8'),
+        clientCrt: readFileSync(clientCrt, 'utf8'),
+        clientKey: readFileSync(clientKey, 'utf8'),
+        taKey: readFileSync(ta, 'utf8'),
+    });
+    writeFileSync(join(dir, 'clients', `${id}.ovpn`), config, 'utf8');
+    return {
+        ok: true,
+        peer: {
+            id,
+            name,
+            engine: 'openvpn',
+            address,
+            publicKey: '',
+            createdAt: new Date().toISOString(),
+        },
+        config,
+        notes: [
+            tl('notes.vpn.peerCreated', { name }),
+            !ep.ok ? tl('notes.vpn.setEndpointHint') : '',
+        ].filter(Boolean),
+    };
+}
+/** Re-apply current server endpoint to every stored .ovpn (download / QR source). */
+export function rewriteAllOvpnClientRemotes(dataDir) {
+    const state = loadOvpnServer(dataDir);
+    if (!state)
+        return 0;
+    const ep = parseVpnEndpoint(state.endpoint, state.listenPort);
+    const clientsDir = join(ovpnServerDir(dataDir), 'clients');
+    if (!existsSync(clientsDir))
+        return 0;
+    let n = 0;
+    for (const peer of state.peers) {
+        const path = join(clientsDir, `${peer.id}.ovpn`);
+        if (!existsSync(path))
+            continue;
+        try {
+            const prev = readFileSync(path, 'utf8');
+            const next = applyOvpnRemote(prev, ep.host, ep.port);
+            if (next !== prev) {
+                writeFileSync(path, next, 'utf8');
+                n++;
+            }
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return n;
+}
+export function getOvpnPeerConfig(dataDir, peerId) {
+    const ovpn = join(ovpnServerDir(dataDir), 'clients', `${peerId}.ovpn`);
+    const meta = join(ovpnServerDir(dataDir), 'clients', `${peerId}.json`);
+    if (!existsSync(ovpn))
+        return null;
+    let name = peerId;
+    try {
+        if (existsSync(meta)) {
+            name = JSON.parse(readFileSync(meta, 'utf8')).name || peerId;
+        }
+    }
+    catch {
+        /* */
+    }
+    const raw = readFileSync(ovpn, 'utf8');
+    const state = loadOvpnServer(dataDir);
+    const port = state?.listenPort ?? 1194;
+    const ep = parseVpnEndpoint(state?.endpoint, port);
+    // Always emit live endpoint — never serve stale remote 51820 …
+    const config = applyOvpnRemote(raw, ep.host, ep.port);
+    return { config, filename: `${name}.ovpn` };
+}
+export async function deleteOvpnPeer(host, dataDir, peerId) {
+    const state = loadOvpnServer(dataDir);
+    if (!state)
+        return { ok: false, notes: [tl('notes.vpn.serverMissing')] };
+    const peer = state.peers.find((p) => p.id === peerId);
+    if (!peer)
+        return { ok: false, notes: [tl('notes.vpn.peerNotFound')] };
+    state.peers = state.peers.filter((p) => p.id !== peerId);
+    saveOvpnServer(dataDir, state);
+    const dir = ovpnServerDir(dataDir);
+    try {
+        rmSync(join(dir, 'clients', `${peerId}.ovpn`), { force: true });
+        rmSync(join(dir, 'clients', `${peerId}.json`), { force: true });
+        rmSync(join(dir, 'ccd', peer.name), { force: true });
+    }
+    catch {
+        /* */
+    }
+    void host;
+    return { ok: true, notes: [tl('notes.vpn.peerRemoved')] };
+}
+export async function isOvpnServerActive(host) {
+    if (!host.executeEnabled())
+        return false;
+    const r = await host.runCommand([
+        'bash',
+        '-c',
+        'systemctl is-active --quiet openvpn-server@ysk || systemctl is-active --quiet openvpn@ysk || pgrep -f "openvpn.*ysk.conf" >/dev/null',
+    ], { timeoutMs: 8_000 });
+    return r.exitCode === 0;
+}
+/** Client up via openvpn --config + systemd unit template */
+export async function openvpnClientUp(host, confPath, unitName) {
+    const unitFile = `/etc/systemd/system/${unitName}.service`;
+    const script = [
+        'set -euo pipefail',
+        `mkdir -p /etc/openvpn/client`,
+        `cp ${JSON.stringify(confPath)} /etc/openvpn/client/${unitName}.ovpn`,
+        `chmod 600 /etc/openvpn/client/${unitName}.ovpn`,
+        `cat > ${JSON.stringify(unitFile)} <<'EOF'`,
+        '[Unit]',
+        'Description=YSK OpenVPN client',
+        'After=network-online.target',
+        'Wants=network-online.target',
+        '[Service]',
+        'Type=simple',
+        `ExecStart=/usr/sbin/openvpn --config /etc/openvpn/client/${unitName}.ovpn`,
+        'Restart=on-failure',
+        '[Install]',
+        'WantedBy=multi-user.target',
+        'EOF',
+        'systemctl daemon-reload',
+        `systemctl enable ${unitName} 2>/dev/null || true`,
+        `systemctl restart ${unitName}`,
+    ].join('\n');
+    const r = await host.runCommand(['bash', '-c', script], { timeoutMs: 45_000 });
+    if (r.exitCode !== 0) {
+        return {
+            ok: false,
+            notes: [
+                tl('notes.vpn.clientUpFailed', {
+                    detail: (r.stderr || r.stdout || '').slice(0, 240),
+                }),
+            ],
+        };
+    }
+    return { ok: true, notes: [] };
+}
+export async function openvpnClientDown(host, unitName) {
+    await host.runCommand([
+        'bash',
+        '-c',
+        `systemctl stop ${unitName} 2>/dev/null || true; systemctl disable ${unitName} 2>/dev/null || true`,
+    ], { timeoutMs: 20_000 });
+}
+export async function openvpnClientIsUp(host, unitName) {
+    const r = await host.runCommand(['systemctl', 'is-active', '--quiet', unitName], {
+        timeoutMs: 5_000,
+    });
+    return r.exitCode === 0;
+}
+export { openVpnClientUnitName };
+//# sourceMappingURL=openvpn-ops.js.map