VaKU/openvpncertupdate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update CLAUDE.md for CLI mode, new symbols, and TUI key bindings

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vlad Doloman
2026-06-24 11:07:54 +03:00
parent 6e4be8965d
commit 26f997e5ce
1 changed files with 34 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
CLAUDE.md
View File

@@ -4,17 +4,34 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
## What this is ## What this is
`openvpncertupdate` is a single-file Python + curses TUI tool for managing OpenVPN user certificates via EasyRSA 3.2.x. It lists expiring/expired certs, re-issues them with fresh keys, creates new certs, and delivers configs via Cryptgeon (one-time password URL) and email. `openvpncertupdate` is a single-file Python + curses TUI tool for managing OpenVPN user certificates via EasyRSA 3.2.x. It lists expiring/expired certs, re-issues them with fresh keys, creates new certs, and delivers configs via Cryptgeon (one-time password URL) and email. It also supports a non-interactive CLI mode for scripting and cron use.
## Running ## Running
```bash ```bash
pip install -r requirements.txt # just: cryptography>=41 pip install -r requirements.txt # just: cryptography>=41
python3 openvpncertupdate.py python3 openvpncertupdate.py # interactive TUI
python3 openvpncertupdate.py --create CN --email user@example.com
python3 openvpncertupdate.py --reissue CN [--email user@example.com]
python3 openvpncertupdate.py --revoke CN
python3 openvpncertupdate.py --gen-crl
``` ```
Edit the `SETTINGS` block at the top of `openvpncertupdate.py` before first run. Edit the `SETTINGS` block at the top of `openvpncertupdate.py` before first run.
### CLI flags
| Flag | Effect |
|---|---|
| `--create CN` | Issue new cert (requires `--email`) |
| `--reissue CN` | Revoke + reissue cert (`--email` optional, falls back to stored) |
| `--revoke CN` | Revoke cert and regenerate CRL |
| `--gen-crl` | Regenerate and copy CRL only |
| `--email EMAIL` | Recipient address |
| `--send-email` | Force email delivery |
| `--no-send-email` | Skip email; print URL to stdout |
| `--show-eml` | Print base64-encoded `.eml` to stdout (implies `--no-send-email` unless `--send-email` also given) |
## Tests ## Tests
```bash ```bash
@@ -28,17 +45,18 @@ python3 -m pytest tests/test_pki.py::test_sorted_ascending -v # single test
| Section | Key symbols | | Section | Key symbols |
|---|---| |---|---|
| SETTINGS | all-caps constants | | SETTINGS | all-caps constants |
| PKI | `CertInfo`, `load_expiring_certs()`, `_parse_index_line()` | | PKI | `CertInfo`, `load_expiring_certs()`, `load_all_certs()`, `_parse_index_line()` |
| PASSWORD | `generate_password()` | | PASSWORD | `generate_password()` |
| EASYRSA | `EasyRSAError`, `revoke_issued()`, `build_client_full()`, `gen_crl()`, `copy_crl()` | | EASYRSA | `EasyRSAError`, `revoke_issued()`, `build_client_full()`, `gen_crl()`, `copy_crl()` |
| METADATA | `load_metadata()`, `save_email()`, `get_email()` | | METADATA | `load_metadata()`, `save_email()`, `get_email()` |
| CONFIG | `build_ovpn()` → `vpn-configs/<CN>_<date>/<CONFIG_NAME>` | | CONFIG | `build_ovpn()` → `vpn-configs/<CN>_<YYYY-MM-DD>_<NN>/CONFIG_NAME` |
| CRYPTGEON | `CryptgeonError`, `create_note()` | | CRYPTGEON | `CryptgeonError`, `create_note()` |
| MAILER | `send_email()` | | MAILER | `build_mime_message()`, `send_email()` |
| TUI WIDGETS | `InputField`, `clamp()`, `draw_box()`, `init_colors()`, `COLOR_*` | | TUI WIDGETS | `InputField`, `clamp()`, `draw_box()`, `init_colors()`, `COLOR_*` |
| TUI DIALOGS | `show_confirm()`, `show_cert_form()`, `CertFormResult` | | TUI DIALOGS | `show_confirm()`, `show_cert_form()`, `CertFormResult` |
| TUI SCREEN | `show_main_screen()`, `Action`, `ScreenResult` | | TUI SCREEN | `show_main_screen()`, `Action`, `ScreenResult` |
| APP | `CursesApp` | | APP | `CursesApp` |
| CLI | `CliRunner`, `_build_parser()` |
| ENTRY POINT | `main()` | | ENTRY POINT | `main()` |
## Re-issue workflow ## Re-issue workflow
@@ -47,6 +65,17 @@ python3 -m pytest tests/test_pki.py::test_sorted_ascending -v # single test
2. `build-client-full <CN> --passout=pass:<pw>` — generates new key + cert 2. `build-client-full <CN> --passout=pass:<pw>` — generates new key + cert
3. CRL **not** auto-updated during renewal; use "Regenerate CRL" menu item or `r` hotkey 3. CRL **not** auto-updated during renewal; use "Regenerate CRL" menu item or `r` hotkey
## TUI key bindings
| Key | Action |
|---|---|
| `↑`/`↓` | Navigate list |
| `Space` | Toggle checkbox selection |
| `Enter` | Confirm / open selected item |
| `r` | Revoke selected cert |
| `A` | Toggle between expiring-only and all-certs view |
| `q`/`Esc` | Quit |
## Key constraints ## Key constraints
- EasyRSA called with `--batch`; `--passin=pass:<CA_PASSPHRASE>` omitted when `CA_PASSPHRASE=""` - EasyRSA called with `--batch`; `--passin=pass:<CA_PASSPHRASE>` omitted when `CA_PASSPHRASE=""`