#!/bin/bash
set -Eeuo pipefail
umask 077

fatal() { echo "FATAL: $*" >&2; exit 1; }
warn() { echo "WARN: $*"; }
info() { echo "INFO: $*"; }

usage() {
cat<<EOF
Syntax: $0 client-name
Revoke a client's certificate

Arguments:

    client-name         Unique name for client
EOF
exit 1
}

if [[ "$#" -ne 1 ]]; then
    usage
fi

client_name="$1"
shift

[[ ${#client_name} -le 64 && $client_name =~ ^[A-Za-z0-9][A-Za-z0-9_.-]*$ ]] ||
    fatal "client-name may contain only letters, numbers, dot, underscore and dash"

export EASYRSA='/etc/openvpn/easy-rsa'
export EASYRSA_PKI="$EASYRSA/keys"
SERVER_CFG='/etc/openvpn/server.conf'
SERVER_CCD='/etc/openvpn/server.ccd'

"$EASYRSA/easyrsa" --batch revoke "$client_name"
"$EASYRSA/easyrsa" gen-crl
cp "$EASYRSA_PKI/crl.pem" "$EASYRSA_PKI/crl.jail/etc/openvpn"
chown nobody:nogroup "$EASYRSA_PKI/crl.jail/etc/openvpn/crl.pem"
chmod +r "$EASYRSA_PKI/crl.jail/etc/openvpn/crl.pem"

escaped_client_name=${client_name//./\\.}
sed -i "\\|^# subnet behind a client: $escaped_client_name$|,+2d" \
    "$SERVER_CFG"
rm -f "$EASYRSA_PKI/$client_name.ovpn" "$SERVER_CCD/$client_name"
info "revoked $EASYRSA_PKI/$client_name.ovpn"
