Valdras Gate - VPN Gateway

• One-command backup. sudo ov_backup produces a single archive of everything your gateway has - users, certs, revocation list, configs, email settings - plus ready-to-paste scp commands for copying it off the box. No more hand-rolled tar.
• One-command restore. sudo ov_restore <archive> brings a fresh gateway up to the exact state of the old one. Refuses to touch anything if the archive is incomplete or has been tampered with.
• Revoked users stay revoked. The revocation list travels with the backup. After a restore, every previously revoked profile is rejected on first connection attempt - no silent regression of access.
• Side-by-side counters. Both tools print a matching summary block (users, issued certs, revoked profiles) so you can verify nothing was lost by eye-balling the two outputs.

• Drop-in upgrade from v1.0.2. No client-side changes if the Elastic IP is moved to the new gateway.
• All user CLI commands (ov_user_add, ov_user_delete, ov_user_list, ov_user_list_expired) keep the same arguments and behaviour.
• Archives produced by ov_backup on v1.0.3 are restorable on any v1.0.3+ gateway. Restoring onto v1.0.2 or older is not supported.

No in-place upgrade. Launch a new instance from the v1.0.3 AMI and restore the old v1.0.2 gateway's state onto it. Following this procedure preserves every user, certificate, revocation, and configuration setting - no profiles need to be reissued.

1. Backup the old gateway

SSH into the old v1.0.2 gateway as ec2-user and run:

sudo tar -czhf backup.tar.gz \ -C / \ opt/0x4447/db/users.db \ opt/0x4447/configs/dns.conf \ opt/0x4447/configs/email.conf \ opt/0x4447/configs/mutt_ses.conf \ opt/0x4447/templates/vpn_profile_email.txt \ usr/share/easy-rsa/pki \ etc/openvpn/server sudo chown ec2-user:ec2-user backup.tar.gz chmod 600 backup.tar.gz

This captures everything operator-unique: the user database, the CA private key and every client certificate, the operational CRL (so revoked users stay revoked), the TLS-auth PSK, the SES email credentials, and the split-DNS configuration. The -h flag dereferences the symlinks inside easy-rsa/pki/ so the archive is self-contained.

scp the file off the box. Treat it as a master secret - it contains the CA private key, every user's private key, and your SES SMTP credentials. Encrypt at rest, transfer over SSH only, never email it, never commit it to git.

2. Launch the v1.0.3 instance

Launch a new EC2 instance from the v1.0.3 AMI in the same VPC. Same security group, same subnet, same instance type as before is fine.

Wait for first boot to finish before restoring. First boot generates a throwaway CA and seeds /etc/openvpn/udp-server.conf with DNS push lines for the new VPC's resolvers. Confirm completion by checking that /opt/0x4447/.done exists.

3. Restore onto the new gateway

scp backup.tar.gz to the new instance (/home/ec2-user/), SSH in, and run:

sudo ov_restore backup.tar.gz

ov_restore runs three pre-flight checks (whitelist, presence, CA-cert sanity) before touching the filesystem. On success it stops the service, extracts the archive, re-asserts permissions on every secret file, re-applies the saved split-DNS rules, restarts the service, and prints a restore summary. If any pre-flight fails, nothing is written and the tool aborts with a specific error.

Delete the archive once you are done: rm -f backup.tar.gz.

4. Move the IP

Reassign the Elastic IP from the old gateway to the new one before users reconnect. Existing .ovpn profiles bake in the public IP at issue time - same IP means every existing profile keeps working with no client-side change. Different IP means every profile must be reissued with ov_user_add.

5. Verify

sudo ov_user_list

The user list must match the old gateway. Then verify the CRL survived the restore:

sudo openssl crl -in /etc/openvpn/server/crl.pem -text -noout | grep -c 'Serial Number'

The count must match the number of users you have revoked over the lifetime of the old gateway. A zero or low count means revoked users will reconnect - investigate before moving on.

Finally, connect a test client using an .ovpn profile issued by the old gateway and confirm it authenticates. If you have a revoked profile on hand, confirm it is rejected.

Once everything checks out, stop and terminate the old instance.