[fix] Fixed OpenVPN CRL access and cron logging

[pandafy]

Checklist

• I have read the OpenWISP Contributing Guidelines and OpenWISP Anti AI Spam Policy.
• I have manually tested the changes proposed in this pull request.
• N/A I have written new test cases for new code and/or updated existing tests for changes to existing code.
• N/A I have updated the documentation.

Reference to Existing Issue

N/A

Description of Changes

Bug:
OpenVPN could not read the refreshed CRL after switching to its unprivileged user because the file permissions were restrictive.

Fix:
Updated the CRL permissions so OpenVPN can read it. Forwarded cron output to the container logs for better observability.

Screenshot

N/A

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: a2f3b452-dc68-4f81-9f59-e49b7e36b6d0

📥 Commits

Reviewing files that changed from the base of the PR and between 474f453 and 2121761.

📒 Files selected for processing (2)

• images/openwisp_openvpn/openvpn.crontab
• images/openwisp_openvpn/openvpn_utils.sh

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: CI Build
• GitHub Check: Analyze (python)

🧰 Additional context used

📓 Path-based instructions (1)

Flag potential security vulnerabilities Flag obvious performance regressions, such as heavy loops, repeated I/O, or unoptimized queries Flag unused or redundant code Flag outdated or incorrect comments/docstrings Ensure new code handles err...

⚙️ CodeRabbit configuration file

Files:

• images/openwisp_openvpn/openvpn_utils.sh
• images/openwisp_openvpn/openvpn.crontab

🔇 Additional comments (2)

images/openwisp_openvpn/openvpn_utils.sh (1)

129-134: LGTM!

Also applies to: 217-218

images/openwisp_openvpn/openvpn.crontab (1)

1-3: LGTM!

---

📝 Walkthrough

Walkthrough

OpenVPN cron commands now forward standard output and standard error to the container’s PID 1 file descriptors. CRL downloads now fail when the output file is empty and set downloaded files to mode 0644.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: nemesifier

Merge Risk: ⚪ Minimal · up to 21217

The changes safely reject unusable CRL downloads, allow OpenVPN to read refreshed CRLs, and forward scheduled-job output to container logs.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Ui Changes, Regression Test, Docs	❌ Error	The PR changes runtime OpenVPN code to fix a CRL permission bug, but it adds no regression test. The existing CI test (tests/scripts/openvpn.sh, executed by TestOpenVPN) is unchanged and checks CR…	Add and run a regression test for the changed CRL behavior. The test must verify that a refreshed CRL is readable by the OpenVPN unprivileged user, or at minimum verify the resulting file mode is 0644 and that the refresh path preserves t…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the required [fix] prefix and accurately describes the CRL access and cron logging changes.
Description check	✅ Passed	The description includes all template sections, completed checklist items, relevant change details, and N/A entries for tests, documentation, issue reference, and screenshot where applicable.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Ui Changes, Regression Test, Docs

Explanation

The PR changes runtime OpenVPN code to fix a CRL permission bug, but it adds no regression test. The existing CI test (tests/scripts/openvpn.sh, executed by TestOpenVPN) is unchanged and checks CRL contents and refresh behavior, not the required 0644 mode or unprivileged OpenVPN access. No UI change or documented-feature change requires screenshots or documentation updates.

Resolution

Add and run a regression test for the changed CRL behavior. The test must verify that a refreshed CRL is readable by the OpenVPN unprivileged user, or at minimum verify the resulting file mode is 0644 and that the refresh path preserves that mode. Update the test invocation if needed so CI executes it.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}

[nemesifier]

can you please clarify the redirections?

[openwisp-companion]

Proposed change log entry:

[fix] Fixed OpenVPN CRL access and cron logging

Updated OpenVPN CRL file permissions to world-readable so that OpenVPN
can successfully read the refreshed certificate revocation list after
dropping privileges. Forwarded cron job output to PID 1 to ensure logs
are properly collected by the Docker container logging driver.