From 26f997e5cec943ccb86817defe4c8db7ce361a12 Mon Sep 17 00:00:00 2001 From: Vlad Doloman Date: Wed, 24 Jun 2026 11:07:54 +0300 Subject: [PATCH] docs: update CLAUDE.md for CLI mode, new symbols, and TUI key bindings Co-Authored-By: Claude Sonnet 4.6 --- CLAUDE.md | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 8c7636d..4764cc4 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,17 +4,34 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co ## What this is -`openvpncertupdate` is a single-file Python + curses TUI tool for managing OpenVPN user certificates via EasyRSA 3.2.x. It lists expiring/expired certs, re-issues them with fresh keys, creates new certs, and delivers configs via Cryptgeon (one-time password URL) and email. +`openvpncertupdate` is a single-file Python + curses TUI tool for managing OpenVPN user certificates via EasyRSA 3.2.x. It lists expiring/expired certs, re-issues them with fresh keys, creates new certs, and delivers configs via Cryptgeon (one-time password URL) and email. It also supports a non-interactive CLI mode for scripting and cron use. ## Running ```bash pip install -r requirements.txt # just: cryptography>=41 -python3 openvpncertupdate.py +python3 openvpncertupdate.py # interactive TUI +python3 openvpncertupdate.py --create CN --email user@example.com +python3 openvpncertupdate.py --reissue CN [--email user@example.com] +python3 openvpncertupdate.py --revoke CN +python3 openvpncertupdate.py --gen-crl ``` Edit the `SETTINGS` block at the top of `openvpncertupdate.py` before first run. +### CLI flags + +| Flag | Effect | +|---|---| +| `--create CN` | Issue new cert (requires `--email`) | +| `--reissue CN` | Revoke + reissue cert (`--email` optional, falls back to stored) | +| `--revoke CN` | Revoke cert and regenerate CRL | +| `--gen-crl` | Regenerate and copy CRL only | +| `--email EMAIL` | Recipient address | +| `--send-email` | Force email delivery | +| `--no-send-email` | Skip email; print URL to stdout | +| `--show-eml` | Print base64-encoded `.eml` to stdout (implies `--no-send-email` unless `--send-email` also given) | + ## Tests ```bash @@ -28,17 +45,18 @@ python3 -m pytest tests/test_pki.py::test_sorted_ascending -v # single test | Section | Key symbols | |---|---| | SETTINGS | all-caps constants | -| PKI | `CertInfo`, `load_expiring_certs()`, `_parse_index_line()` | +| PKI | `CertInfo`, `load_expiring_certs()`, `load_all_certs()`, `_parse_index_line()` | | PASSWORD | `generate_password()` | | EASYRSA | `EasyRSAError`, `revoke_issued()`, `build_client_full()`, `gen_crl()`, `copy_crl()` | | METADATA | `load_metadata()`, `save_email()`, `get_email()` | -| CONFIG | `build_ovpn()` → `vpn-configs/_/` | +| CONFIG | `build_ovpn()` → `vpn-configs/__/CONFIG_NAME` | | CRYPTGEON | `CryptgeonError`, `create_note()` | -| MAILER | `send_email()` | +| MAILER | `build_mime_message()`, `send_email()` | | TUI WIDGETS | `InputField`, `clamp()`, `draw_box()`, `init_colors()`, `COLOR_*` | | TUI DIALOGS | `show_confirm()`, `show_cert_form()`, `CertFormResult` | | TUI SCREEN | `show_main_screen()`, `Action`, `ScreenResult` | | APP | `CursesApp` | +| CLI | `CliRunner`, `_build_parser()` | | ENTRY POINT | `main()` | ## Re-issue workflow @@ -47,6 +65,17 @@ python3 -m pytest tests/test_pki.py::test_sorted_ascending -v # single test 2. `build-client-full --passout=pass:` — generates new key + cert 3. CRL **not** auto-updated during renewal; use "Regenerate CRL" menu item or `r` hotkey +## TUI key bindings + +| Key | Action | +|---|---| +| `↑`/`↓` | Navigate list | +| `Space` | Toggle checkbox selection | +| `Enter` | Confirm / open selected item | +| `r` | Revoke selected cert | +| `A` | Toggle between expiring-only and all-certs view | +| `q`/`Esc` | Quit | + ## Key constraints - EasyRSA called with `--batch`; `--passin=pass:` omitted when `CA_PASSPHRASE=""`