edgd1er
commented
2 years ago There are three kind of kill switches in the container:
- when the openvpn is stopped or down, unbound, dante and tinyproxy are stopped. (/etc/services/openvpn/down)
- if openvpn is running but is returning an unconnected status, exit with status 1 is thrown stopping the container ( healthcheck.sh Line 63.). checks are every 5 minutes.
- Healthcheck: based on status returned by nordvpn api (every 5 min), if needed you can overwrite healthcheck with yours.(eg: write a file)
HEALTHCHECK --interval=5m --timeout=20s --start-period=1m \ CMD if test $( curl -m 10 -s https://api.nordvpn.com/vpn/check/full | jq -r '.["status"]' ) = "Protected" ; then exit 0; else exit 1; fi
if you need to know openvpn status from another context, you may run echo "state" | socat -s - unix-connect:/run/openvpn.sock | sed -n '2p'
I could add a file with status, but I'm afraid writing a file every minute or so, would increase disk wearness, especially of running on a Raspberry pi. also this feature would be available based on an ENV var like EXIT_WHEN_IP_NOTEXPECTED. based on checks logic, the file would never be set to 0 or just before the container stop. that would be a good check of the defined controls.
Not a big issue though, I'll see when I have time to implement it.
alpe12
I could really use a file that says wheter vpn is working as intended or not. One way to do it would be to add it to check_openvpn() on healthcheck.sh. Something like: Save 1 to a file if it's working and 0 if it's not. This way I could mount that file on my system and access the vpn status from my other scripts.
Ideally it should only write to this file if there's an environment variable enabling this feature. So that the people that don't need it won't have unnecessary writes to their drives.
Thanks, anyway. :)
PS: I know there is an EXIT_WHEN_IP_NOTEXPECTED option. But for my use-case I need it disabled.