ovpn-admin: Linux OpenVPN User Management with a Go Backend

ovpn-admin's OpenVPN administration boundary

ovpn-admin solves a specific administrative problem: managing OpenVPN users after the VPN service itself is configured. Its documented functions include adding and deleting users, generating certificates, revoking and restoring certificates, rotating certificates, and producing client configuration files. It can also assign a per-user client-config directory, or CCD, and can synchronize certificates and CCD data between master and slave servers.

The intended user is an experienced system administrator working in a private environment protected by network policy. The project README explicitly says that the implementation is not designed with security as its primary concern and does not strictly check every user-supplied parameter. That warning changes the adoption decision. ovpn-admin is an operations interface for a trusted administrator, not a general-purpose self-service VPN portal.

The interface also exposes operational information. The README describes Prometheus metrics covering certificate expiration dates, connected and total users, and details about active connections. Connection status updates every 28 seconds. The repository includes a Vue.js frontend and Go backend, with Kubernetes-related files and Helm charts in the tree, but the core product remains a file-dependent Linux administration tool.

Certificate, CCD, and OpenVPN management flow

The documented mechanism is file-based administration around Easy-RSA and OpenVPN. ovpn-admin reads the Easy-RSA index and certificate directory through configurable paths. When an administrator adds a user, the project generates the user's certificate material. Deleting, revoking, restoring, and rotating users act on that certificate state. The README also describes generation of ready-to-user configuration files from a template.

CCD support is optional. With the relevant flags enabled, ovpn-admin can write or manage files for individual users in the OpenVPN client-config directory. Static user addressing requires the administrator to provide the actual OpenVPN network, such as the documented `--ovpn.network="172.16.100.0/24"` setting. A custom `client.conf.tpl` can change the generated client configuration. The README specifically mentions editing `ovpn-admin/templates/client.conf.tpl` and uncommenting `redirect-gateway def1` when all user traffic should pass through the VPN.

OpenVPN connections are observed through management interfaces configured with `--mgmt=ALIAS=HOST:PORT`. Multiple management endpoints can be supplied. The server address is configured through `--ovpn.server=HOST:PORT:PROTOCOL`, which can also contain multiple values. This makes ovpn-admin suitable for more than one OpenVPN endpoint, but the project still depends on the administrator supplying correct endpoints, routes, and paths.

Docker startup and the bundled example topology

The shortest documented startup path uses Docker and the repository's `start.sh` script. The README requires Docker and `docker-compose`. Clone the repository, enter its directory, and run the script:

git clone https://github.com/palark/ovpn-admin.git
cd ovpn-admin
./start.sh

The repository includes `docker-compose.yaml`. It defines an `openvpn` service and an `ovpn-admin` service. The OpenVPN container runs a configure script, adds `NET_ADMIN`, exposes port `7777` for OpenVPN and port `8080` for ovpn-admin, and mounts `easyrsa_master` and `ccd_master`. The ovpn-admin service uses the OpenVPN container's network namespace, mounts the same certificate and CCD directories, and receives paths such as `/mnt/easyrsa`, `/mnt/easyrsa/pki/index.txt`, and `/mnt/ccd` through the container configuration.

The compose file also sets `OVPN_NETWORK` to `192.168.100.0/24`, enables CCD and password authentication, and points `OVPN_SERVER` at `127.0.0.1:7777:tcp`. These values are an example topology, not universal defaults. Before starting, the README indicates that needed parameters should be configured in advance.

Building ovpn-admin from the Go and Vue.js source tree

For a source build, the README requires Linux with Go, `packr2`, Node.js, and npm installed. The repository's module declaration specifies Go 1.24.0, while the build scripts and frontend directory provide the project-specific build path. The documented sequence is:

git clone https://github.com/palark/ovpn-admin.git
cd ovpn-admin
./bootstrap.sh
./build.sh
./ovpn-admin

`bootstrap.sh` prepares the build dependencies, `build.sh` builds the application, and the final command starts the binary. The README warns that all necessary parameters must be configured in advance. The usage output defaults to listening on `0.0.0.0:8080`, but changing that behavior requires explicit `--listen.host` and `--listen.port` values or their environment variable equivalents.

The source route is more involved than the Docker route. It assumes a Linux build host and a working frontend toolchain, and it does not remove the runtime dependency on `bash`, coreutils, and `easy-rsa`. The README states that ovpn-admin calls these components externally, so a binary-only deployment without the required system files and utilities will fail.

Metrics, authentication, Kubernetes, and replication constraints

Additional password authentication is optional. The documentation requires `--auth` and `--auth.db="/etc/easyrsa/pki/users.db"`, plus the external `openvpn-user` executable in `$PATH` with execute permission. The compose example enables `OVPN_AUTH` and sets `OVPN_AUTH_DB_PATH` to the mounted Easy-RSA user database. The README does not describe password policy details, recovery behavior, or database backup procedures, so those points require administrator verification.

Master and slave mode is another optional feature. The master URL, Basic Auth credentials, synchronization frequency, and token are configurable through the documented `--master.*` flags. The README states that master-replica synchronization does not work with `--storage.backend=kubernetes.secrets`, and that the feature is marked as work in progress. That is a direct incompatibility, not an edge case to infer around.

Kubernetes Secrets storage is described as experimental. The repository contains `kubernetes.go` and a `charts/` directory, but the README does not claim production readiness for that backend. The usage output also includes flags for a Kubernetes LoadBalancer in front of OpenVPN and for a custom client configuration template. These features should be treated as integration points requiring review, not as evidence that ovpn-admin is a general Kubernetes VPN operator.

Platform limits, maintenance signals, and upgrade cost

The project supports Linux only because it depends on external calls to `bash`, coreutils, and `easy-rsa`. The README says it was tested with OpenVPN server versions 2.4 and 2.5, using `tls-auth` mode only. It also says it was not tested with Easy-RSA newer than 3.0.8. These are meaningful adoption boundaries because certificate and OpenVPN compatibility can affect whether user operations work correctly.

The repository is not archived. Its last push was on 2026-10-12. That repository status does not establish that every dependency or integration path remains compatible. The module uses Go 1.24.0 and includes Kubernetes client libraries at version 0.34.3, while the README's external tool requirements can change independently.

The project is licensed under Apache-2.0. The license permits use and modification under its terms, but deployment still requires attention to the licenses of linked dependencies and the external tools installed on the host. Upgrade cost is higher than a single web application because certificate formats, Easy-RSA behavior, OpenVPN management interfaces, mounted files, and Kubernetes integration all need rechecking after an upgrade.

Why a conventional OpenVPN configuration may be preferable

The clearest alternative is to manage OpenVPN users and certificates directly with Easy-RSA plus OpenVPN-native configuration and operational tooling. That approach avoids adding ovpn-admin's HTTP interface and its file dependencies, but it also means handling certificate issuance, revocation, CCD files, client templates, connection inventory, and Prometheus exposure as separate administrative tasks.

ovpn-admin is different because it combines those operations in one Go and Vue.js application and adds master/slave synchronization. The trade-off is the README's explicit security boundary: parameter validation is incomplete, and the application is intended for experienced administrators in private environments. An organization that needs self-service account registration, strong tenant isolation, or exposure to untrusted users should not treat the convenience of the UI as a substitute for an access-control design.

For a small private deployment with a capable Linux administrator, the UI can reduce repetitive certificate work. For a public or multi-tenant VPN service, the absence of documented security hardening in the project description is a reason to choose a different design or conduct an independent security review first.

Editorial conclusion

Adopt ovpn-admin for an experienced Linux team operating a private OpenVPN installation with Docker, shared certificate files, and trusted administrative access. Do not choose it as a security-hardened public portal without first addressing its explicit parameter-validation warning. Verify Easy-RSA compatibility, OpenVPN versions, storage mode, management-interface access, and the exact certificate paths before deploying.

Frequently asked questions

Official sources

1. Issues
2. License: Apache-2.0
3. palark/ovpn-admin on GitHub
4. README
5. Releases