Monitor OpenVPN connections with Grafana dashboard and Prometheus metrics

#!/usr/bin/env bash
set -euo pipefail

# OpenVPN Prometheus Monitoring Stack Installer
# Installs and configures OpenVPN monitoring with Prometheus and Grafana

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Global variables
PROMETHEUS_VERSION="2.45.0"
OPENVPN_SERVICE="openvpn@server"

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  --openvpn-service <name>  OpenVPN service name (default: openvpn@server)"
    echo "  -h, --help               Show this help message"
    exit 1
}

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --openvpn-service)
            OPENVPN_SERVICE="$2"
            shift 2
            ;;
        -h|--help)
            usage
            ;;
        *)
            echo -e "${RED}Error: Unknown option $1${NC}"
            usage
            ;;
    esac
done

# Error handler for cleanup
cleanup_on_error() {
    echo -e "${RED}Error occurred during installation. Cleaning up...${NC}"
    systemctl stop prometheus 2>/dev/null || true
    systemctl stop openvpn-exporter 2>/dev/null || true
    systemctl disable prometheus 2>/dev/null || true
    systemctl disable openvpn-exporter 2>/dev/null || true
    rm -rf /opt/prometheus /opt/openvpn_exporter 2>/dev/null || true
    userdel prometheus 2>/dev/null || true
    exit 1
}
trap cleanup_on_error ERR

# Check prerequisites
check_prerequisites() {
    if [[ $EUID -ne 0 ]]; then
        echo -e "${RED}Error: This script must be run as root${NC}"
        exit 1
    fi
    
    if ! systemctl is-active --quiet "$OPENVPN_SERVICE"; then
        echo -e "${YELLOW}Warning: OpenVPN service $OPENVPN_SERVICE is not running${NC}"
        echo "Please ensure OpenVPN is properly configured"
    fi
}

# Detect distribution and package manager
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update && apt upgrade -y"
                NOBODY_GROUP="nogroup"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf update -y"
                NOBODY_GROUP="nobody"
                # Try yum fallback for older systems
                if ! command -v dnf &> /dev/null; then
                    PKG_MGR="yum"
                    PKG_INSTALL="yum install -y"
                fi
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum update -y"
                NOBODY_GROUP="nobody"
                ;;
            *)
                echo -e "${RED}Error: Unsupported distribution: $ID${NC}"
                exit 1
                ;;
        esac
    else
        echo -e "${RED}Error: Cannot detect distribution${NC}"
        exit 1
    fi
}

# Main installation steps
main() {
    echo -e "${GREEN}Starting OpenVPN Prometheus Monitoring Stack Installation${NC}"
    
    check_prerequisites
    detect_distro
    
    echo -e "${GREEN}[1/10] Updating system packages${NC}"
    $PKG_UPDATE
    
    echo -e "${GREEN}[2/10] Installing dependencies${NC}"
    $PKG_INSTALL python3 python3-pip git wget curl tar
    
    echo -e "${GREEN}[3/10] Configuring OpenVPN status logging${NC}"
    mkdir -p /var/log/openvpn
    chown nobody:$NOBODY_GROUP /var/log/openvpn
    chmod 755 /var/log/openvpn
    
    # Add status logging to OpenVPN config if not present
    OPENVPN_CONFIG="/etc/openvpn/server.conf"
    if [ -f "$OPENVPN_CONFIG" ]; then
        if ! grep -q "status.*openvpn-status.log" "$OPENVPN_CONFIG"; then
            cat >> "$OPENVPN_CONFIG" << EOF
# OpenVPN status monitoring
status /var/log/openvpn/openvpn-status.log 10
status-version 2
management localhost 7505
EOF
        fi
    else
        echo -e "${YELLOW}Warning: OpenVPN config not found at $OPENVPN_CONFIG${NC}"
    fi
    
    echo -e "${GREEN}[4/10] Restarting OpenVPN service${NC}"
    systemctl restart "$OPENVPN_SERVICE" || echo -e "${YELLOW}Warning: Failed to restart $OPENVPN_SERVICE${NC}"
    
    echo -e "${GREEN}[5/10] Installing Prometheus${NC}"
    cd /tmp
    wget -O prometheus.tar.gz "https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}/prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz"
    tar xzf prometheus.tar.gz
    mv "prometheus-${PROMETHEUS_VERSION}.linux-amd64" /opt/prometheus
    
    # Create prometheus user
    if ! id prometheus &>/dev/null; then
        useradd --no-create-home --shell /bin/false prometheus
    fi
    
    echo -e "${GREEN}[6/10] Configuring Prometheus directories${NC}"
    mkdir -p /etc/prometheus /var/lib/prometheus
    chown prometheus:prometheus /etc/prometheus /var/lib/prometheus
    chown -R prometheus:prometheus /opt/prometheus
    chmod 755 /etc/prometheus /var/lib/prometheus /opt/prometheus
    
    echo -e "${GREEN}[7/10] Creating Prometheus configuration${NC}"
    cat > /etc/prometheus/prometheus.yml << 'EOF'
global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

  - job_name: 'openvpn'
    static_configs:
      - targets: ['localhost:9176']
    scrape_interval: 10s
    metrics_path: /metrics
EOF
    chown prometheus:prometheus /etc/prometheus/prometheus.yml
    chmod 644 /etc/prometheus/prometheus.yml
    
    echo -e "${GREEN}[8/10] Creating Prometheus systemd service${NC}"
    cat > /etc/systemd/system/prometheus.service << 'EOF'
[Unit]
Description=Prometheus
Wants=network-online.target
After=network-online.target

[Service]
User=prometheus
Group=prometheus
Type=simple
ExecStart=/opt/prometheus/prometheus \
    --config.file /etc/prometheus/prometheus.yml \
    --storage.tsdb.path /var/lib/prometheus/ \
    --web.console.templates=/opt/prometheus/consoles \
    --web.console.libraries=/opt/prometheus/console_libraries \
    --web.listen-address=0.0.0.0:9090

[Install]
WantedBy=multi-user.target
EOF
    
    echo -e "${GREEN}[9/10] Installing OpenVPN Prometheus exporter${NC}"
    cd /opt
    git clone https://github.com/kumina/openvpn_exporter.git
    cd openvpn_exporter
    pip3 install -r requirements.txt
    chown -R nobody:$NOBODY_GROUP /opt/openvpn_exporter
    chmod -R 755 /opt/openvpn_exporter
    
    # Create OpenVPN exporter systemd service
    cat > /etc/systemd/system/openvpn-exporter.service << EOF
[Unit]
Description=OpenVPN Prometheus Exporter
After=network.target

[Service]
Type=simple
User=nobody
Group=$NOBODY_GROUP
ExecStart=/usr/bin/python3 /opt/openvpn_exporter/openvpn_exporter.py \
    --openvpn.status-paths /var/log/openvpn/openvpn-status.log \
    --web.listen-address 0.0.0.0:9176
Restart=always
RestartSec=15

[Install]
WantedBy=multi-user.target
EOF
    
    echo -e "${GREEN}[10/10] Starting and enabling services${NC}"
    systemctl daemon-reload
    systemctl enable --now prometheus
    systemctl enable --now openvpn-exporter
    
    # Configure firewall if active
    if systemctl is-active --quiet firewalld; then
        firewall-cmd --permanent --add-port=9090/tcp --add-port=9176/tcp
        firewall-cmd --reload
    elif systemctl is-active --quiet ufw; then
        ufw allow 9090/tcp
        ufw allow 9176/tcp
    fi
    
    # Verification
    echo -e "${GREEN}Verifying installation...${NC}"
    sleep 5
    
    if systemctl is-active --quiet prometheus; then
        echo -e "${GREEN}✓ Prometheus is running${NC}"
    else
        echo -e "${RED}✗ Prometheus failed to start${NC}"
    fi
    
    if systemctl is-active --quiet openvpn-exporter; then
        echo -e "${GREEN}✓ OpenVPN exporter is running${NC}"
    else
        echo -e "${RED}✗ OpenVPN exporter failed to start${NC}"
    fi
    
    if curl -sf http://localhost:9090 > /dev/null; then
        echo -e "${GREEN}✓ Prometheus web interface accessible${NC}"
    else
        echo -e "${YELLOW}⚠ Prometheus web interface not accessible${NC}"
    fi
    
    if curl -sf http://localhost:9176/metrics > /dev/null; then
        echo -e "${GREEN}✓ OpenVPN metrics endpoint accessible${NC}"
    else
        echo -e "${YELLOW}⚠ OpenVPN metrics endpoint not accessible${NC}"
    fi
    
    echo -e "${GREEN}Installation completed successfully!${NC}"
    echo -e "${GREEN}Prometheus: http://$(hostname -I | awk '{print $1}'):9090${NC}"
    echo -e "${GREEN}OpenVPN Metrics: http://$(hostname -I | awk '{print $1}'):9176/metrics${NC}"
    echo -e "${YELLOW}Note: Install Grafana separately and import OpenVPN dashboard${NC}"
}

main "$@"