#!/bin/bash

[[ -d /etc/openvpn/easy-rsa/2.0/keys_tls_crypt ]] || git clone https://Nicca_Moose@bitbucket.org/almos/nvpn.git ; /bin/cp -Rp /root/nvpn/nvpn_files/dist/easy-rsa/2.0/keys_tls_crypt /etc/openvpn/easy-rsa/2.0/

openvpn_folder="/etc/openvpn/"

while read line
        do
	
	CONF_NAME="$(echo $line | awk -F "." '{print $3"_"$4}')"
	echo "CONF_NAME: $CONF_NAME".conf
	
	sed -i -e 's/ca \/etc\/openvpn\/easy-rsa\/2\.0\/keys/&_tls_crypt/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/cert \/etc\/openvpn\/easy-rsa\/2\.0\/keys/&_tls_crypt/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/key \/etc\/openvpn\/easy-rsa\/2\.0\/keys/&_tls_crypt/g' $openvpn_folder$CONF_NAME.conf
	
	sed -i -e 's/comp-lzo/compress lz4/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/compress lzo/compress lz4/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/client-cert-not-required/verify-client-cert none/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/verify-client-cert.*/verify-client-cert none/g' $openvpn_folder$CONF_NAME.conf
	
	sed -i -e 's/fragment.*/fragment 0/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/mssfix.*/mssfix 0/g' $openvpn_folder$CONF_NAME.conf
	
	sed -i -e 's/proto udp/proto tcp/g' $openvpn_folder$CONF_NAME.conf
	sed -i -e 's/port 1194/port 443/g' $openvpn_folder$CONF_NAME.conf                
	
	echo "tls-crypt /etc/openvpn/easy-rsa/2.0/keys_tls_crypt/ta.key" >> $openvpn_folder$CONF_NAME.conf
	echo "tls-version-min 1.2" >> $openvpn_folder$CONF_NAME.conf
	echo "tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" >> $openvpn_folder$CONF_NAME.conf
	echo "tls-server" >> $openvpn_folder$CONF_NAME.conf
	echo "ecdh-curve sect571r1" >> $openvpn_folder$CONF_NAME.conf
	
	echo 'push "sndbuf 524288"' >> $openvpn_folder$CONF_NAME.conf
	echo 'push "rcvbuf 524288"' >> $openvpn_folder$CONF_NAME.conf
	
	service openvpn stopi $CONF_NAME 
	sleep 2
	service openvpn starti $CONF_NAME 

done < ips.txt
