{"id":13395277,"url":"https://github.com/robbintt/popup-openvpn","last_synced_at":"2025-03-13T20:32:00.545Z","repository":{"id":71065705,"uuid":"74561499","full_name":"robbintt/popup-openvpn","owner":"robbintt","description":"Make a self hosted OpenVPN server in 15 minutes","archived":false,"fork":false,"pushed_at":"2017-05-16T03:00:10.000Z","size":33,"stargazers_count":808,"open_issues_count":16,"forks_count":28,"subscribers_count":19,"default_branch":"master","last_synced_at":"2024-07-31T17:23:48.316Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/robbintt.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"license.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-11-23T09:32:18.000Z","updated_at":"2024-04-29T21:36:32.000Z","dependencies_parsed_at":"2023-03-10T23:30:17.453Z","dependency_job_id":null,"html_url":"https://github.com/robbintt/popup-openvpn","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robbintt%2Fpopup-openvpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robbintt%2Fpopup-openvpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robbintt%2Fpopup-openvpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robbintt%2Fpopup-openvpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/robbintt","download_url":"https://codeload.github.com/robbintt/popup-openvpn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243478344,"owners_count":20297238,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T17:01:48.867Z","updated_at":"2025-03-13T20:32:00.166Z","avatar_url":"https://github.com/robbintt.png","language":"Shell","funding_links":[],"categories":["Shell","\u003ca id=\"7cf7e8a30b73997985f20698eaf6b0c9\"\u003e\u003c/a\u003eOpenVPN","DevOps Utilities"],"sub_categories":["\u003ca id=\"8ea8f890cf767c3801b5e7951fca3570\"\u003e\u003c/a\u003e公网访问局域网"],"readme":"\n### Popup OpenVPN\n\nMake a self hosted VPN in 15 minutes.\n\nIf you can 'kind of run a server', then you can manage this.\n\nGive all your non-technical friends a free VPN!\n\n\n#### Why?\n\nCompanies like verizon, AT\u0026T, and Comcast already have developed tools to sell police bulk access to your data without a warrant. Isn't this illegal spying? Not if your internet provider does it as a service!\n\nDo you want every corrupt government contractor to have access to your browser history?  Right now, they often do.\n\n\n#### Installation Guide\n\n1. [Make an account and get a $10 free credit at digital ocean](https://m.do.co/c/a4d54c9e5004)\n    - skip this step if you have an account already\n    - disclaimer: I get some free credit when you use this link. Thanks!\n\n2. Add your `SSH key` to `Digital Ocean`\n    1. Enter the digital ocean web interface\n    2. go to `settings-\u003esecurity-\u003eSSH keys`\n    3. Paste your key, found by default `$HOME/.ssh/id_rsa.pub`\n        - tip: make a key with `ssh-keygen`\n        - danger: `ssh-keygen` WILL overwrite your current key without warning\n    4. On server creation, the key will be added in server's `root` user's `authorized_keys`\n    5. `ansible` uses the default SSH key: `~/.ssh/id_rsa.pub`\n        - you can manually set a key as a command line argument in `manage.sh`\n\n3. Create a new server on Digital Ocean\n    1. Choose the `Ubuntu 16.04.1 x64` base image \n    2. Use the $5 option\n    3. Choose a datacenter near you for low latency.\n    4. Check your preferred `ssh key` under `Add your SSH keys`\n    5. Choose a hostname like `popup-openvpn`\n    6. Do not check `use IPv6`\n    7. Notes\n        - You will have 1 terabyte of monthly transfer\n        - They call a `server` a `droplet`\n\n4. Configure this repo for your users\n    1. Clone this repository on your local computer\n        - `git clone --recursive https://github.com/robbintt/popup-openvpn.git`\n    1. Configuration files: \n        - `hosts` \n        - `group_vars/all`\n    2. Add the IP address of the server to your `hosts` file\n        - The `IP address` is available in your digital ocean dashboard\n        - In the `[vpnservers]` section, replace the default 1.2.3.4 with your server's IP address\n    3. Add each of the following to your `group_vars/all`\n        - You need at least one user and password\n        - `user` \n            - any username is fine in user\n        - `password`\n            - use a strong password\n        - `openvpn_client` \n            - any name is fine -- the default is `myvpn1` etc.\n        - **Replace or delete the example users and passwords entirely**\n    4. You can add as many openvpn_client sections and user/passwords as you wish\n    5. IMPORTANT: Delete any extra user lines and unnecessary example certificates, e.g. `myvpn3`, `myvpn4`\n\n5. It's time to automatically set things up!!\n    1. Install `ansible` locally\n        - Follow the [official installation guide](http://docs.ansible.com/ansible/intro_installation.html) for your system\n        - Optional: do this using your preferred method\n    2. execute: `manage.sh`\n        - The ansible script should run without any errors\n        - (The restarter role fails if it doesn't need to restart or something)\n    3. **When you run this playbook for the first time, you will need to restart the server before you can connect.**\n        - todo - just restart the server every time the playbook is run or something\n        - future - troubleshoot this issue in stouts or OpenVPN\n    4. To reconfigure or update your server you may run `manage.sh` again\n\n6. email the .ovpn files to all your users\n    - The ansible playbook transferred the .ovpn files to the computer you ran ansible from\n    - Each ovpn file is stored in `./openvpn_files/` (inside the `popup-openvpn` project directory)\n    - Each user only needs the ovpn file generated for them. They also need their username and password\n    - You will open this file in your `OpenVPN Client`\n\n7. Install a client on each of your devices.  You will need: `user`, `password`, `.ovpn file`\n    1. Client Recommendations\n        - macOS: [Tunnelblick](https://tunnelblick.net/)\n            - option: use `brew cask` to install\n        - iOS (iPhone/iPad) App Store: [`OpenVPN Connect`](https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8) by OpenVPN Technologies\n        - Android/Google Play store: [`OpenVPN Connect`](https://play.google.com/store/apps/details?id=net.openvpn.openvpn) by OpenVPN Technologies\n    2. You will need to follow the client specific instructions\n        - iOS | [`OpenVPN`](https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8)\n            - You're going to want to go through [this set-up process](https://vikingvpn.com/connection-guides/ios) for iOS file syncing for the most secure way to share you `.ovpn` files. While you can send the file(s) through email, _this is not recommended as email is often unencrypted_, and will be assuming you don't have a prior end-to-end encryption system set up. The guide for iTunes sync in that VikingVPN link is rather outdated, so please refer to [this official support page for file syncing in iTunes 12.x (most recent version as or writing)](https://support.apple.com/kb/PH19463).\n            - Note: to connect you'll want to go through the OpenVPN app, sign in, and connect in-app after importing your `.ovpn` profile(s).\n        - TODO: Assemble more links for client instructions\n    3. All your users need to do this step for all their devices\n    4. Linux\n        - Arch has a [good guide](https://wiki.archlinux.org/index.php/OpenVPN#DNS) for this. Find a better way.\n\n\n8. Maintaining your server\n    - TODO\n\n\n#### Requirements\n\n- Server: Digital Ocean Ubuntu 16.04.1 Release\n- Local `~/.ssh/id_rsa.pub` private key deployed to remote root `authorized_keys`\n    - This is done through Digital Ocean on droplet deployment\n\n\n#### Future\n\n1. Use ansible vault to encrypt group_vars/all\n1. Make a workflow for adding a new user and client certificate \"for a friend\"\n1. Add an automatic updates tool. \n1. Test this guide from very beginning to very end.\n    - Beginning: Create a Digital Ocean Account\n    - End: Install the ovpn cert and put the password in on all your devices\n    - Very End: Maintaining your server\n1. Deploy to the world at large (reddit? digital ocean article?)\n\n\n#### Stouts.openvpn\n\nThe [Stouts.openvpn](https://github.com/Stouts/Stouts.openvpn) repo is included as a subrepo in `/roles/Stoutsopenvpn`. \n\n\n### References\n\nSome useful links and additions.\n\n\n#### Using Ansible Vault\n\nYou might use this to encrypt your `group_vars/all`\n\n- Encrypt a file: `ansible-vault encrypt foo.yml bar.yml baz.yml`\n- Decrypt a file: `ansible-vault decrypt foo.yml bar.yml baz.yml`\n- View file contents: `ansible-vault view foo.yml`\n- Run Playbook w/ Vault password: `ansible-playbook site.yml --ask-vault-pass`\n    - This is managed in `manage.sh` in this script\n\n\n##### Links\n\n- [Manually building an ovpn file with certs and keys inside](https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-14-04)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frobbintt%2Fpopup-openvpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frobbintt%2Fpopup-openvpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frobbintt%2Fpopup-openvpn/lists"}