[ISSUE] openvpn: should it include a runit service?

[ISSUE] openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 1792 bytes --]

New issue by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834

Description:
<!--
  if you are creating a bug report or package request, please fill out one of the forms here:
  https://github.com/void-linux/void-packages/issues/new/choose

  Don't request an update of a package, We have a script for that:
  https://repo-default.voidlinux.org/void-updates/void-updates.txt
  However, a quality pull request may help.
-->
### OpenVPN - a debate whether to include a runit service
As many of you might know, OpenVPN can be run either as a server or a client. 

When run as a server, it needs some kind of a trigger that will start it at boot time. The current OpenVPN package does not, however, include a runit service.

When run as a client, it can be either started on boot which would typically require a runit service or it can be executed with the simple command `openvpn /etc/openvpn/yourconfig.conf`. 

In the first two cases, I believe it is justifiable and reasonable to include a runit service. A few years ago, such a proposal wasn't upheld (https://github.com/void-linux/void-packages/pull/17906#issuecomment-569937899). I believe now's a good time to re-address this issue. 

In my opinion, if Void aims to be as good of an option for a desktop as for a server, we require this change to happen. Of course, you can create the appropriate _run_ file manually in _/etc/sv/openvpn_ and you're good to go. However, such an approach seems to be particularly confusing for new users and it is also inconsistent with the fact that many other daemon servers DO have runit services that come along with them.

Therefore, I'd like to raise the question from the heading: should the openvpn package come with a runit service?

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 744 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953063448

Comment:
Might make sense to include example services for client and server, resembling `usr/lib/systemd/system/openvpn-client@.service` and `usr/lib/systemd/system/openvpn-server@.service` so users don't blindly enable the service just because they want to use openvpn as a client. 

We've made bad experiences with shipping ready to use system services for things that should most likely not run as the system services, see pipewire and pulseaudio experiences, where unexpected users started to enable those services without knowing that the preferred method of starting them is through some other means. 

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 743 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953063448

Comment:
Might make sense to include example services for client and server, resembling `usr/lib/systemd/system/openvpn-client@.service` and `usr/lib/systemd/system/openvpn-server@.service` so users don't blindly enable the service just because they want to use openvpn as a client. 

We've had bad experiences with shipping ready to use system services for things that should most likely not run as the system services, see pipewire and pulseaudio experiences, where unexpected users started to enable those services without knowing that the preferred method of starting them is through some other means. 

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 758 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953063448

Comment:
Might make sense to include example services for client and server, resembling `usr/lib/systemd/system/openvpn-client@.service` and `usr/lib/systemd/system/openvpn-server@.service` so users don't blindly enable the service just because they want to use openvpn as a client. 

We've had bad experiences with shipping ready to use system services for things that should most likely not run as the system services, as example the pipewire and pulseaudio system services, where unexpected users started to enable those services without knowing that the preferred method of starting them is through some other means. 

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 954 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953063448

Comment:
Might make sense to include example services for client and server, resembling `usr/lib/systemd/system/openvpn-client@.service` and `usr/lib/systemd/system/openvpn-server@.service` so users don't blindly enable the service just because they want to use openvpn as a client. 

We've had bad experiences with shipping ready to use system services for things that should most likely not run as the system services, as example the pipewire and pulseaudio system services, where unexpected users started to enable those services without knowing that the preferred method of starting them is through some other means.

pipewire ships the example service as `/usr/share/examples/sv/pipewire`: https://github.com/void-linux/void-packages/blob/f574870935ed5c4f122c5ba84417f449dd4ca863/srcpkgs/pipewire/template#L61.

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 953 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953063448

Comment:
Might make sense to include example services for client and server, resembling `usr/lib/systemd/system/openvpn-client@.service` and `usr/lib/systemd/system/openvpn-server@.service` so users don't blindly enable the service just because they want to use openvpn as a client. 

We've had bad experiences with shipping ready to use system services for things that should most likely not run as the system services, as example the pipewire and pulseaudio system services, where unexpected users started to enable those services without knowing that the preferred method of starting them is through some other means.

pipewire ships the example service as `/usr/share/examples/sv/pipewire`: https://github.com/void-linux/void-packages/blob/f574870935ed5c4f122c5ba84417f449dd4ca863/srcpkgs/pipewire/template#L61

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 1242 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953082771

Comment:
Enabling OpenVPN through `ln -sv /etc/sv/openvpn /var/service` would do nothing by default as /etc/openvpn does not even exist in Void's OpenVPN package. 

You would have to either 
```
mkdir -p /etc/openvpn
cp /usr/share/examples/openvpn/client.conf /etc/openvpn/openvpn.conf # modify the default script
vim /etc/openvpn/openvpn.conf
# or
cp /path/to/your/config.conf /etc/openvpn/openvpn.conf
```
With no user intervention, OpenVPN won't run. If you have another path pointing to a client/server configuration, you can point to it by:
`echo "CONF_FILE=/path/to/vpn.conf > /etc/sv/openvpn/conf`

As for the pipewire and pulseaudio analogy - I think these are completely different cases as the preferred method for them is, like you say, to be run by a user.

In an OpenVPN config file, you can specify both the user and the group that the process should be run by. As a matter of fact, you can run the process as an unprivileged user (on Debian, for instance, you just insert these lines in your openvpn config):

_/etc/openvpn/openvpn.conf_
```
user nobody
group nogroup
```

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 1351 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953082771

Comment:
Enabling OpenVPN through `ln -sv /etc/sv/openvpn /var/service` would do nothing by default as /etc/openvpn does not even exist in Void's OpenVPN package. 

You would have to either 
```
mkdir -p /etc/openvpn
chmod 755 /etc/openvpn
cp /usr/share/examples/openvpn/client.conf /etc/openvpn/openvpn.conf
chmod 600 /etc/openvpn/openvpn.conf
vim /etc/openvpn/openvpn.conf # modify the default script
# or
cp /path/to/your/config.conf /etc/openvpn/openvpn.conf # if you have a tailor-made config for yourself
```
With no user intervention, OpenVPN won't run. If you have another path pointing to a client/server configuration, you can point to it by:
`echo "CONF_FILE=/path/to/vpn.conf > /etc/sv/openvpn/conf`

As for the pipewire and pulseaudio analogy - I think these are completely different cases as the preferred method for them is, like you say, to be run by a user.

In an OpenVPN config file, you can specify both the user and the group that the process should be run by. As a matter of fact, you can run the process as an unprivileged user (on Debian, for instance, you just insert these lines in your openvpn config):

_/etc/openvpn/openvpn.conf_
```
user nobody
group nogroup
```

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 190 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953087651

Comment:
runit would restart the service once a second.

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 189 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953087651

Comment:
runit would restart the service every second.

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 176 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953089211

Comment:
Oh, this I didn't know about :(

Re: openvpn: should it include a runit service?

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 384 bytes --]

New comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953090114

Comment:
> As for the pipewire and pulseaudio analogy - I think these are completely different cases as the preferred method for them is, like you say, to be run by a user.

Depends, many users probably just use NetworkManager to handle their VPN.

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 189 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953091146

Comment:
Sure :) What about the server side, though? 

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 319 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
Correct me if I'm wrong but what you suggested could also work. Namely, to supply a runnit server somewhere in /usr/share/openvpn. So that you could easily copy it to /etc/sv

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 320 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
Correct me if I'm wrong but what you suggested could also work. Namely, to supply a runnit service somewhere in /usr/share/openvpn. So that you could easily copy it to /etc/sv

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 332 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
Correct me if I'm wrong but what you suggested could also work. Namely, to supply a runnit service somewhere in /usr/share/examples/sv/openvpn. So that you could easily copy it to /etc/sv

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 189 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953091146

Comment:
Sure :) What about the server side, though? 

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 336 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
I support the idea of supplying a runnit service somewhere in /usr/share/examples/sv/openvpn so that you could easily copy it to /etc/sv. For a regular user that would save a lot of trouble. 

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 406 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
I support the idea of supplying a runnit service somewhere in /usr/share/examples/sv/openvpn so that you could easily copy it to /etc/sv. For a regular user that would save a lot of trouble. 

From the perspective of someone who has a say in it, is it doable?

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 405 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
I second the idea of supplying a runnit service somewhere in /usr/share/examples/sv/openvpn so that you could easily copy it to /etc/sv. For a regular user that would save a lot of trouble. 

From the perspective of someone who has a say in it, is it doable?

Re: openvpn: should it include a runit service?

[slymattz]

[-- Attachment #1: Type: text/plain, Size: 514 bytes --]

New comment by slymattz on void-packages repository

https://github.com/void-linux/void-packages/issues/48834#issuecomment-1953092461

Comment:
I second the idea of supplying a runnit service somewhere in /usr/share/examples/sv/openvpn so that you could easily copy it to /etc/sv. For a regular user that would save a lot of trouble. 

If you guys were to decide for it, do you think it would be necessary to have two directories, i.e. _openvpn-client_, _openvpn-server_ or perhaps one _openvpn_ should suffice?