Skip to content

[fix] Fixed OpenVPN CRL access and cron logging #693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nemesifier merged 2 commits into from
Sep 14, 2026
Merged

[fix] Fixed OpenVPN CRL access and cron logging #693

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
242c13a
[fix] Fixed OpenVPN CRL access and cron logging
pandafy Sep 11, 2026
2121761
[chores:fix] Added inline comment for output re-direction
pandafy Sep 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions images/openwisp_openvpn/openvpn.crontab
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
*/1 * * * * sh /openvpn.sh
*/5 * * * * sh /revokelist.sh
# Forward cron output to PID 1 so it is collected by Docker's logging driver.
*/1 * * * * sh /openvpn.sh >>/proc/1/fd/1 2>>/proc/1/fd/2

@nemesifier nemesifier Sep 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you please clarify the redirections?

*/5 * * * * sh /revokelist.sh >>/proc/1/fd/1 2>>/proc/1/fd/2
10 changes: 8 additions & 2 deletions images/openwisp_openvpn/openvpn_utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,12 @@ crl_download_to() {
curl_download --silent --fail --retry 10 --retry-delay 5 --retry-max-time 300 \
--output "$output_path" \
"${DASHBOARD_INTERNAL}/admin/pki/ca/x509/ca/${CA_UUID}.crl"
test -s "$output_path"
test -s "$output_path" || return 1
# The CRL is public data (revoked certificate serial numbers), and OpenVPN
# re-reads it from disk on every TLS session after dropping privileges to
# the unprivileged "user"/"group" from openvpn.conf, so it must stay
# world-readable regardless of mktemp's default 0600 mode.
chmod 644 -- "$output_path"
}

crl_download() {
Expand Down Expand Up @@ -209,6 +214,7 @@ init_send_network_topology() {
fi
(
crontab -l
echo "*/$TOPOLOGY_UPDATE_INTERVAL * * * * TOPOLOGY_UUID=$TOPOLOGY_UUID TOPOLOGY_KEY=$TOPOLOGY_KEY sh /send-topology.sh"
# Forward the generated job's output to PID 1 so Docker can collect it.
echo "*/$TOPOLOGY_UPDATE_INTERVAL * * * * TOPOLOGY_UUID=$TOPOLOGY_UUID TOPOLOGY_KEY=$TOPOLOGY_KEY sh /send-topology.sh >>/proc/1/fd/1 2>>/proc/1/fd/2"
) | crontab -
}