rakasatria/ovpn-radius

<explanation>

1. Identify the project type and purpose

• This is a Go‑based OpenVPN server plugin that provides RADIUS authentication and accounting by wrapping FreeRADIUS’s RadClient.

• It is primarily an “open‑source tool”/plugin designed to be invoked by OpenVPN to delegate user authentication and session accounting to a RADIUS server, while also maintaining a local SQLite session log and writing diagnostic logs.

2. Analyze the file structure

• Top‑level files:

– README.md, LICENSE, .gitignore, .vscode (editor settings).

• src/ directory:

– main.go: plugin entrypoint, parses commands (“auth”, “acct”, “stop”) from OpenVPN.

– config.go + config.json: defines and holds plugin settings (RADIUS server addresses, secrets, OpenVPN server info, log file path).

– database.go: encapsulates SQLite storage for session/accounting data.

– go.mod, go.sum: Go module metadata.

• No separate frontend/backend—this is a single binary invoked by the OpenVPN server.

3. Examine the README for additional insights

• README outlines installation and integration steps—copying binary and config.json into /etc/openvpn/plugin, creating an SQLite database folder, and log file placement.

• It shows the OpenVPN server.conf hooks (auth-user-pass-verify, client-connect, client-disconnect).

• Mentions the existing “Radius Authentication and Accounting Diagram” which you will refine.

4. How to create the system design diagram

a. Main components

1. OpenVPN Server

2. OVPN‑Radius Plugin (binary + config.json)

3. RADIUS Server (Auth port 1812, Acct port 1813)

4. Local SQLite Database (session/accounting store)

5. Log File (plugin diagnostics)

6. FreeRADIUS RadClient library (embedded within plugin)

b. Relationships and interactions

– OpenVPN Server → invokes → Plugin (auth, acct start/update, acct stop)

– Plugin → sends Access‑Request/Accounting‑Request → RADIUS Server

– RADIUS Server → responds Access‑Accept/Accounting‑Response → Plugin → returns status to OpenVPN

– Plugin → writes session records → SQLite DB

– Plugin → writes logs → log file on disk

c. Architectural patterns and principles

– Single responsibility: plugin has clear separation of config parsing, RADIUS communication, database persistence, and logging.

– Adapter/wrapper: RadClient library is wrapped by Go code to present a uniform interface to OpenVPN.

– External hook pattern: plugin receives command and environment via OpenVPN hook calls.

d. Key technologies/frameworks

– Go standard library for CLI and JSON parsing

– github.com/freeradius/radclient (C library binding)

– mattn/go-sqlite3 or similar driver for database.go

– OpenVPN’s plugin API (executes external binaries via server.conf directives)

5. Guidelines for tailoring the diagram (open‑source plugin/tool)

• Emphasize core functionality: illustrate how the plugin bridges OpenVPN and RADIUS.

• Show integration points: OpenVPN hook commands, plugin binary location, config.json loading.

• Highlight extensibility: if someone wanted to swap RADIUS for LDAP, note that config.json could be extended or adapter layer replaced.

• Depict deployment details: folders (/etc/openvpn/plugin, /etc/openvpn/plugin/db, /var/log/openvpn/), configuration files, and permissions.

6. Diagram drawing instructions

• Components: draw each major service/component in its own box or shape.

– Use rectangles for “servers” (OpenVPN, RADIUS), cylinders for “storage” (SQLite DB), document icons for config.json, and a file icon for the log file.

• Data flows: use directional arrows labeled with the request/response types:

– “auth” → Access‑Request → RADIUS

– “acct_start/update/stop” → Accounting‑Request → RADIUS

– DB writes → “INSERT session record”

– Log writes → “append to log file”

• Color coding:

– Network calls (OpenVPN ↔ Plugin ↔ RADIUS) in blue

– Storage interactions (Plugin ↔ SQLite) in green

– File operations (Plugin ↔ log file, config.json) in orange

• Labels & legends:

– Clearly label ports (1812, 1813) on the RADIUS server.

– Annotate plugin commands (“auth”, “acct”, “stop”) on arrows from OpenVPN.

– Show config.json being loaded at plugin startup.

• Layout tips:

– Place OpenVPN server on the left, RADIUS server on the right, plugin in the middle.

– Put local storage (DB, log) below the plugin.

– Keep arrows straight and avoid crossings.

7. Detail & completeness

• Include every file or config that plays a role: config.json schema, database file path, log file path, hook directives from server.conf.

• Capture environment assumptions: Ubuntu 20.04/22.04, file system paths, permissions.

• Make the diagram self‑explanatory so a new engineer can trace the entire auth/accounting flow end‑to‑end.

By following these steps and including the specified shapes, colors, labels, and arrows, you will produce a comprehensive, accurate system design diagram that reflects the OVPN‑Radius plugin’s architecture and integration points.