feat: metadata store (CN→email) and .ovpn config builder

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openvpncertupdate.py

@@ -207,6 +207,56 @@ def copy_crl(pki_dir: str, dest_path: str) -> None:
     os.chmod(dest_path, 0o644)
 
 
+# ============================================================
+# === METADATA ===
+# ============================================================
+
+_METADATA_FILE = "openvpncertupdate-metadata.json"
+
+
+def load_metadata(pki_dir: str) -> dict[str, str]:
+    p = os.path.join(pki_dir, _METADATA_FILE)
+    if not os.path.exists(p):
+        return {}
+    with open(p) as fh:
+        return json.load(fh)
+
+
+def save_email(pki_dir: str, cn: str, email_addr: str) -> None:
+    data = load_metadata(pki_dir)
+    data[cn] = email_addr
+    with open(os.path.join(pki_dir, _METADATA_FILE), "w") as fh:
+        json.dump(data, fh, indent=2)
+
+
+def get_email(pki_dir: str, cn: str) -> str:
+    return load_metadata(pki_dir).get(cn, "")
+
+
+# ============================================================
+# === CONFIG ===
+# ============================================================
+
+
+def build_ovpn(
+    cn: str,
+    pki_dir: str,
+    template_path: str,
+    output_base_dir: str,
+    config_name: str,
+) -> str:
+    """Concat template + inline file. Return absolute path to written .ovpn."""
+    inline_path = os.path.join(pki_dir, "inline", "private", f"{cn}.inline")
+    template_content = Path(template_path).read_text()
+    inline_content   = Path(inline_path).read_text()
+    today = date.today().strftime("%Y-%m-%d")
+    out_dir = Path(output_base_dir) / f"{cn}_{today}"
+    out_dir.mkdir(parents=True, exist_ok=True)
+    out_file = out_dir / config_name
+    out_file.write_text(template_content + "\n" + inline_content)
+    return str(out_file.resolve())
+
+
 # (remaining sections added in later tasks)
 # ============================================================