cli

Overview ¶

Command go-openvpn-cli is a minimal CLI for the go-openvpn VPN client.

It brings up a Linux TUN interface with the routes and DNS pushed by the server. The authentication method follows the profile: a client certificate, a username and password from -auth-user-pass, or the AWS Client VPN SAML/CRV1 flow when the profile asks for it.

Usage:

go-openvpn-cli -config <path.ovpn> [-auth-user-pass <mode-0600-file>]
go-openvpn-cli -config <path.ovpn> [-saml-token-file <mode-0600-file>]
go-openvpn-cli -relay <token> [-relay-endpoint <wss://...>] [-agent-id <uuid>]

Flags:

-config          Path to the .ovpn profile file.
                 Required for direct (non-relay) mode.
                 Optional in relay mode — the app always sends the profile inside
                 the phase2 payload; -config is only used as a fallback if the
                 payload carries no ovpn_config.
-auth-user-pass  Read a username and password from a mode-0600 file: the
                 username on the first line, the password on the second,
                 as OpenVPN's own --auth-user-pass file form.
-saml-token-file Read a base64-encoded SAMLResponse from a mode-0600 file.
-saml-token-fd   Read it from an open descriptor (0 means standard input).
-relay            Relay organisation identifier/token. The public demo value
                  is "default"; use a token file for private bearer tokens.
-relay-token-file / -relay-token-fd
                  Optionally read a private relay token outside argv.
-relay-endpoint  Relay WebSocket URL (default: wss://ws.relay.openlawsvpn.com).
-agent-id        Stable UUID for this agent (default: random, changes on restart).
-hostname        Human-readable label shown in the app (default: os.Hostname).
-daemon          Fork to background after the tunnel is up; foreground process
                 exits 0 once the VPN is established, 1 on failure.
-pidfile         Write the daemon PID to this file (only used with -daemon).
-logfile         Redirect daemon stdout+stderr to this file (only with -daemon;
                 default: /dev/null).

Daemon mode ¶

With -daemon the CLI daemonizes after the tunnel is established:

• The foreground process blocks until the VPN is up, then prints the daemon PID and exits 0. The shell prompt / CI step returns immediately.
• The background process keeps the tunnel alive, handling reconnects and rekeying.
• Use -pidfile to record the PID for later cleanup (sudo kill $(cat pidfile)).
• Use -logfile to capture background diagnostics.

Example:

sudo go-openvpn-cli -relay default -daemon \
  -pidfile /tmp/go-openvpn.pid \
  -logfile /tmp/go-openvpn.log
# returns once the tunnel is up; VPN runs in background

Build as a fully static binary:

CGO_ENABLED=0 go build -o go-openvpn-cli ./cmd/cli