init ui

2025-04-04 21:23:31 +03:00 · 2024-05-15 18:36:45 +08:00 · 2024-05-15 18:36:45 +08:00 · 85c5d460a2
commit 85c5d460a2
parent 1a484a642f
22 changed files with 1137 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,21 @@
+server/
+.idea
+.DS_Store
+*.iml
+venv
+.terraform
+*egg-info
+dist
+*.aws.yml
+dist.zip
+*.dynamo
+all-in.json
+all-out.json
+node_modules
+/tmp
+*.pyc
+.pip
+*.tar.bz2
+yarn.lock
+.vscode
+test.*
--- a/openvpn_ui/init.py
+++ b/openvpn_ui/init.py
--- a/openvpn_ui/admin.yaml
+++ b/openvpn_ui/admin.yaml
@ -0,0 +1,129 @@
+openapi: 3.0.2
+info:
+  title: OpenVPN Admin API
+  description: API for managing OpenVPN and clients
+  version: 0.0.1
+paths:
+  /clients:
+    get:
+      tags:
+        - client
+      summary: List all clients
+      operationId: get_client_clients_get
+      parameters:
+        - description: VPN client name
+          required: false
+          schema:
+            title: Client Name
+            type: string
+            description: VPN client name
+          name: client_name
+          in: query
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Response Get Client Clients Get
+        '422':
+          description: Validation Error
+
+    post:
+      tags:
+        - client
+      summary: Add a new client
+      operationId: post_client_clients_post
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PostClientRequest'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: { }
+        '422':
+          description: Validation Error
+
+  /openvpn/config:
+    get:
+      tags:
+        - openvpn
+      summary: Get OpenVPN configuration
+      operationId: get_openvpn_openvpn_config_get
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Response Get Openvpn Openvpn Config Get
+                type: string
+    put:
+      tags:
+        - openvpn
+      summary: Update OpenVPN configuration
+      operationId: put_openvpn_openvpn_config_put
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/PutOpenvpnRequest'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: { }
+        '422':
+          description: Validation Error
+    post:
+      tags:
+        - openvpn
+      summary: Init OpenVPN
+      operationId: post_openvpn_openvpn_config_post
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Response Post Openvpn Openvpn Config Post
+                type: string
+components:
+  schemas:
+    PostClientRequest:
+      title: PostClientRequest
+      required:
+        - name
+      type: object
+      properties:
+        name:
+          title: Name
+          type: string
+      description: |-
+        NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+
+        Do not edit the class manually.
+
+        PostClientRequest - a model defined in OpenAPI
+
+            name: The name of this PostClientRequest.
+    PutOpenvpnRequest:
+      title: PutOpenvpnRequest
+      type: object
+      properties:
+        config:
+          title: Config
+          type: string
+      description: |-
+        NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+
+        Do not edit the class manually.
+
+        PutOpenvpnRequest - a model defined in OpenAPI
+
+            config: The config of this PutOpenvpnRequest [Optional].
--- a/openvpn_ui/apis/init.py
+++ b/openvpn_ui/apis/init.py
@ -0,0 +1,3 @@
+from openvpn_ui.vpn.vpn_command import VpnCommand
+
+command = VpnCommand()
--- a/openvpn_ui/apis/client_api.py
+++ b/openvpn_ui/apis/client_api.py
@ -0,0 +1,71 @@
+# coding: utf-8
+import os
+from typing import Dict, List, Any  # noqa: F401
+
+from fastapi import (  # noqa: F401
+    APIRouter,
+    Body,
+    Cookie,
+    Depends,
+    Form,
+    Header,
+    Path,
+    Query,
+    Response,
+    Security,
+    status,
+)
+from starlette.responses import FileResponse
+
+from models.extra_models import TokenModel  # noqa: F401
+
+from openvpn_ui.apis import command
+from openvpn_ui.models.post_client_request import PostClientRequest
+
+router = APIRouter()
+
+
+@router.get(
+    "/clients",
+    responses={
+        200: {"description": "OK"},
+    },
+    tags=["client"],
+    summary="List all clients",
+    response_model_by_alias=True,
+)
+async def get_client(
+        client_name: str = Query(None, description="VPN client name"),
+) -> Any:
+    try:
+        file_path = command.install_dir
+        if client_name:
+            client_name = f"{client_name.strip('.ovpn')}.ovpn"
+            file_location = file_path + client_name
+            return FileResponse(file_location, filename=client_name,
+                                media_type="application/octet-stream")
+        else:
+            exists = []
+            for root, dirs, files in os.walk(file_path):
+                if root == file_path:
+                    for f in files:
+                        if f.endswith("ovpn"):
+                            exists.append(f)
+            return {"existing client": exists}
+    except FileNotFoundError:
+        return {"error": "File not found"}
+
+
+@router.post(
+    "/clients",
+    responses={
+        200: {"description": "OK"},
+    },
+    tags=["client"],
+    summary="Add a new client",
+    response_model_by_alias=True,
+)
+async def post_client(
+        post_client_request: PostClientRequest = Body(None, description=""),
+) -> str:
+    return command.create_client(post_client_request.name)
--- a/openvpn_ui/apis/openvpn_api.py
+++ b/openvpn_ui/apis/openvpn_api.py
@ -0,0 +1,50 @@
+# coding: utf-8
+
+from typing import Dict, List  # noqa: F401
+
+
+from fastapi import (  # noqa: F401
+    APIRouter,
+    Body,
+    Cookie,
+    Depends,
+    Form,
+    Header,
+    Path,
+    Query,
+    Response,
+    Security,
+    status,
+)
+
+from openvpn_ui.apis import command
+
+router = APIRouter()
+
+
+@router.get(
+    "/openvpn/config",
+    responses={
+        200: {"description": "OK"},
+    },
+    tags=["openvpn"],
+    summary="Get OpenVPN configuration",
+    response_model_by_alias=True,
+)
+async def get_openvpn(
+) -> str:
+    return command.get_vpn_status()
+
+
+@router.post(
+    "/openvpn/config",
+    responses={
+        200: {"description": "OK"},
+    },
+    tags=["openvpn"],
+    summary="Init OpenVPN",
+    response_model_by_alias=True,
+)
+async def post_openvpn(
+) -> str:
+    return command.install_vpn()
--- a/openvpn_ui/apis/security_api.py
+++ b/openvpn_ui/apis/security_api.py
@ -0,0 +1,17 @@
+# coding: utf-8
+
+from fastapi import Depends, Security  # noqa: F401
+from fastapi.openapi.models import OAuthFlowImplicit, OAuthFlows  # noqa: F401
+from fastapi.security import (  # noqa: F401
+    HTTPAuthorizationCredentials,
+    HTTPBasic,
+    HTTPBasicCredentials,
+    HTTPBearer,
+    OAuth2,
+    OAuth2AuthorizationCodeBearer,
+    OAuth2PasswordBearer,
+    SecurityScopes,
+)
+from fastapi.security.api_key import APIKeyCookie, APIKeyHeader, APIKeyQuery  # noqa: F401
+
+
--- a/openvpn_ui/app.py
+++ b/openvpn_ui/app.py
@ -0,0 +1,39 @@
+# coding: utf-8
+
+import os
+from fastapi import FastAPI
+from fastapi.openapi.docs import get_swagger_ui_html
+from starlette.middleware.cors import CORSMiddleware
+from starlette.staticfiles import StaticFiles
+
+project_dir = os.path.dirname(__file__)
+app = FastAPI(
+    title="OpenVPN Admin API",
+    description="API for managing OpenVPN and clients",
+    version="0.0.1",
+    docs_url=None,
+    openapi_url="/api/openapi.json"
+)
+
+
+# static files
+app.mount('/static', StaticFiles(
+    directory=f"{project_dir}/resource/static/swagger-ui"), name='static')
+
+
+@app.get("/api/docs", include_in_schema=False)
+async def custom_swagger_ui_html():
+    return get_swagger_ui_html(
+        openapi_url="/api/openapi.json",
+        title="Swagger UI",
+        swagger_js_url="/static/swagger-ui-bundle.js",
+        swagger_css_url="/static/swagger-ui.css",
+    )
+
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
--- a/openvpn_ui/bin/openvpn-install.sh
+++ b/openvpn_ui/bin/openvpn-install.sh
@ -0,0 +1,560 @@
+#!/bin/bash
+#
+# https://github.com/Nyr/openvpn-install
+#
+# Copyright (c) 2013 Nyr. Released under the MIT License.
+
+
+# Detect Debian users running the script with "sh" instead of bash
+if readlink /proc/$$/exe | grep -q "dash"; then
+	echo 'This installer needs to be run with "bash", not "sh".'
+	exit
+fi
+
+# Discard stdin. Needed when running from an one-liner which includes a newline
+# read -N 999999 -t 0.001
+
+# Detect OS
+# $os_version variables aren't always in use, but are kept here for convenience
+if grep -qs "ubuntu" /etc/os-release; then
+	os="ubuntu"
+	os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
+	group_name="nogroup"
+elif [[ -e /etc/debian_version ]]; then
+	os="debian"
+	os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
+	group_name="nogroup"
+elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
+	os="centos"
+	os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
+	group_name="nobody"
+elif [[ -e /etc/fedora-release ]]; then
+	os="fedora"
+	os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
+	group_name="nobody"
+else
+	echo "This installer seems to be running on an unsupported distribution.
+Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
+	exit
+fi
+
+if [[ "$os" == "ubuntu" && "$os_version" -lt 2204 ]]; then
+	echo "Ubuntu 22.04 or higher is required to use this installer.
+This version of Ubuntu is too old and unsupported."
+	exit
+fi
+
+if [[ "$os" == "debian" ]]; then
+	if grep -q '/sid' /etc/debian_version; then
+		echo "Debian Testing and Debian Unstable are unsupported by this installer."
+		exit
+	fi
+	if [[ "$os_version" -lt 11 ]]; then
+		echo "Debian 11 or higher is required to use this installer.
+This version of Debian is too old and unsupported."
+		exit
+	fi
+fi
+
+if [[ "$os" == "centos" && "$os_version" -lt 9 ]]; then
+	os_name=$(sed 's/ release.*//' /etc/almalinux-release /etc/rocky-release /etc/centos-release 2>/dev/null | head -1)
+	echo "$os_name 9 or higher is required to use this installer.
+This version of $os_name is too old and unsupported."
+	exit
+fi
+
+# Detect environments where $PATH does not include the sbin directories
+if ! grep -q sbin <<< "$PATH"; then
+	echo '$PATH does not include sbin. Try using "su -" instead of "su".'
+	exit
+fi
+
+if [[ "$EUID" -ne 0 ]]; then
+	echo "This installer needs to be run with superuser privileges."
+	exit
+fi
+
+if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
+	echo "The system does not have the TUN device available.
+TUN needs to be enabled before running this installer."
+	exit
+fi
+
+new_client () {
+	# Generates the custom client.ovpn
+	{
+	cat /etc/openvpn/server/client-common.txt
+	echo "<ca>"
+	cat /etc/openvpn/server/easy-rsa/pki/ca.crt
+	echo "</ca>"
+	echo "<cert>"
+	sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
+	echo "</cert>"
+	echo "<key>"
+	cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
+	echo "</key>"
+	echo "<tls-crypt>"
+	sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
+	echo "</tls-crypt>"
+	} > ~/"$client".ovpn
+}
+
+if [[ ! -e /etc/openvpn/server/server.conf ]]; then
+	# Detect some Debian minimal setups where neither wget nor curl are installed
+	if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
+		echo "Wget is required to use this installer."
+		read -n1 -r -p "Press any key to install Wget and continue..."
+		apt-get update
+		apt-get install -y wget
+	fi
+	clear
+	echo 'Welcome to this OpenVPN road warrior installer!'
+	# If system has a single IPv4, it is selected automatically. Else, ask the user
+	if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
+		ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
+	else
+		number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
+		echo
+		echo "Which IPv4 address should be used?"
+		ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
+		read -p "IPv4 address [1]: " ip_number
+		until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
+			echo "$ip_number: invalid selection."
+			read -p "IPv4 address [1]: " ip_number
+		done
+		[[ -z "$ip_number" ]] && ip_number="1"
+		ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
+	fi
+	# If $ip is a private IP address, the server must be behind NAT
+	if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
+		echo
+		echo "This server is behind NAT. What is the public IPv4 address or hostname?"
+		# Get public IP and sanitize with grep
+		get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
+		read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
+		# If the checkip service is unavailable and user didn't provide input, ask again
+		until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
+			echo "Invalid input."
+			read -p "Public IPv4 address / hostname: " public_ip
+		done
+		[[ -z "$public_ip" ]] && public_ip="$get_public_ip"
+	fi
+	# If system has a single IPv6, it is selected automatically
+	if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
+		ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
+	fi
+	# If system has multiple IPv6, ask the user to select one
+	if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
+		number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
+		echo
+		echo "Which IPv6 address should be used?"
+		ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
+		read -p "IPv6 address [1]: " ip6_number
+		until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
+			echo "$ip6_number: invalid selection."
+			read -p "IPv6 address [1]: " ip6_number
+		done
+		[[ -z "$ip6_number" ]] && ip6_number="1"
+		ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
+	fi
+	echo
+	echo "Which protocol should OpenVPN use?"
+	echo "   1) UDP (recommended)"
+	echo "   2) TCP"
+	read -p "Protocol [1]: " protocol
+	until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
+		echo "$protocol: invalid selection."
+		read -p "Protocol [1]: " protocol
+	done
+	case "$protocol" in
+		1|"")
+		protocol=udp
+		;;
+		2)
+		protocol=tcp
+		;;
+	esac
+	echo
+	echo "What port should OpenVPN listen to?"
+	read -p "Port [1194]: " port
+	until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
+		echo "$port: invalid port."
+		read -p "Port [1194]: " port
+	done
+	[[ -z "$port" ]] && port="1194"
+	echo
+	echo "Select a DNS server for the clients:"
+	echo "   1) Current system resolvers"
+	echo "   2) Google"
+	echo "   3) 1.1.1.1"
+	echo "   4) OpenDNS"
+	echo "   5) Quad9"
+	echo "   6) AdGuard"
+	read -p "DNS server [1]: " dns
+	until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
+		echo "$dns: invalid selection."
+		read -p "DNS server [1]: " dns
+	done
+	echo
+	echo "Enter a name for the first client:"
+	read -p "Name [client]: " unsanitized_client
+	# Allow a limited set of characters to avoid conflicts
+	client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
+	[[ -z "$client" ]] && client="client"
+	echo
+	echo "OpenVPN installation is ready to begin."
+	# Install a firewall if firewalld or iptables are not already available
+	if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
+		if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
+			firewall="firewalld"
+			# We don't want to silently enable firewalld, so we give a subtle warning
+			# If the user continues, firewalld will be installed and enabled during setup
+			echo "firewalld, which is required to manage routing tables, will also be installed."
+		elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
+			# iptables is way less invasive than firewalld so no warning is given
+			firewall="iptables"
+		fi
+	fi
+	read -n1 -r -p "Press any key to continue..."
+	# If running inside a container, disable LimitNPROC to prevent conflicts
+	if systemd-detect-virt -cq; then
+		mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
+		echo "[Service]
+LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
+	fi
+	if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
+		apt-get update
+		apt-get install -y --no-install-recommends openvpn openssl ca-certificates $firewall
+	elif [[ "$os" = "centos" ]]; then
+		dnf install -y epel-release
+		dnf install -y openvpn openssl ca-certificates tar $firewall
+	else
+		# Else, OS must be Fedora
+		dnf install -y openvpn openssl ca-certificates tar $firewall
+	fi
+	# If firewalld was just installed, enable it
+	if [[ "$firewall" == "firewalld" ]]; then
+		systemctl enable --now firewalld.service
+	fi
+	# Get easy-rsa
+	easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.7/EasyRSA-3.1.7.tgz'
+	mkdir -p /etc/openvpn/server/easy-rsa/
+	{ wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
+	chown -R root:root /etc/openvpn/server/easy-rsa/
+	cd /etc/openvpn/server/easy-rsa/
+	# Create the PKI, set up the CA and the server and client certificates
+	./easyrsa --batch init-pki
+	./easyrsa --batch build-ca nopass
+	./easyrsa --batch --days=3650 build-server-full server nopass
+	./easyrsa --batch --days=3650 build-client-full "$client" nopass
+	./easyrsa --batch --days=3650 gen-crl
+	# Move the stuff we need
+	cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
+	# CRL is read with each client connection, while OpenVPN is dropped to nobody
+	chown nobody:"$group_name" /etc/openvpn/server/crl.pem
+	# Without +x in the directory, OpenVPN can't run a stat() on the CRL file
+	chmod o+x /etc/openvpn/server/
+	# Generate key for tls-crypt
+	openvpn --genkey secret /etc/openvpn/server/tc.key
+	# Create the DH parameters file using the predefined ffdhe2048 group
+	echo '-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
+	# Generate server.conf
+	echo "local $ip
+port $port
+proto $protocol
+dev tun
+ca ca.crt
+cert server.crt
+key server.key
+dh dh.pem
+auth SHA512
+tls-crypt tc.key
+topology subnet
+server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
+	# IPv6
+	if [[ -z "$ip6" ]]; then
+		echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
+	else
+		echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
+		echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
+	fi
+	echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
+	# DNS
+	case "$dns" in
+		1|"")
+			# Locate the proper resolv.conf
+			# Needed for systems running systemd-resolved
+			if grep '^nameserver' "/etc/resolv.conf" | grep -qv '127.0.0.53' ; then
+				resolv_conf="/etc/resolv.conf"
+			else
+				resolv_conf="/run/systemd/resolve/resolv.conf"
+			fi
+			# Obtain the resolvers from resolv.conf and use them for OpenVPN
+			grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -v '127.0.0.53' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
+				echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf
+			done
+		;;
+		2)
+			echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
+			echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
+		;;
+		3)
+			echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
+			echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
+		;;
+		4)
+			echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
+			echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
+		;;
+		5)
+			echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
+			echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
+		;;
+		6)
+			echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
+			echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
+		;;
+	esac
+	echo 'push "block-outside-dns"' >> /etc/openvpn/server/server.conf
+	echo "keepalive 10 120
+user nobody
+group $group_name
+persist-key
+persist-tun
+verb 3
+crl-verify crl.pem" >> /etc/openvpn/server/server.conf
+	if [[ "$protocol" = "udp" ]]; then
+		echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
+	fi
+	# Enable net.ipv4.ip_forward for the system
+	echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
+	# Enable without waiting for a reboot or service restart
+	echo 1 > /proc/sys/net/ipv4/ip_forward
+	if [[ -n "$ip6" ]]; then
+		# Enable net.ipv6.conf.all.forwarding for the system
+		echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
+		# Enable without waiting for a reboot or service restart
+		echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
+	fi
+	if systemctl is-active --quiet firewalld.service; then
+		# Using both permanent and not permanent rules to avoid a firewalld
+		# reload.
+		# We don't use --add-service=openvpn because that would only work with
+		# the default port and protocol.
+		firewall-cmd --add-port="$port"/"$protocol"
+		firewall-cmd --zone=trusted --add-source=10.8.0.0/24
+		firewall-cmd --permanent --add-port="$port"/"$protocol"
+		firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
+		# Set NAT for the VPN subnet
+		firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
+		firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
+		if [[ -n "$ip6" ]]; then
+			firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
+			firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
+			firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
+			firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
+		fi
+	else
+		# Create a service to set up persistent iptables rules
+		iptables_path=$(command -v iptables)
+		ip6tables_path=$(command -v ip6tables)
+		# nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
+		# if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
+		if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
+			iptables_path=$(command -v iptables-legacy)
+			ip6tables_path=$(command -v ip6tables-legacy)
+		fi
+		echo "[Unit]
+Before=network.target
+[Service]
+Type=oneshot
+ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
+ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
+ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
+ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
+ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
+ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
+ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
+ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
+		if [[ -n "$ip6" ]]; then
+			echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
+ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
+ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
+ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
+ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
+ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
+		fi
+		echo "RemainAfterExit=yes
+[Install]
+WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
+		systemctl enable --now openvpn-iptables.service
+	fi
+	# If SELinux is enabled and a custom port was selected, we need this
+	if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
+		# Install semanage if not already present
+		if ! hash semanage 2>/dev/null; then
+				dnf install -y policycoreutils-python-utils
+		fi
+		semanage port -a -t openvpn_port_t -p "$protocol" "$port"
+	fi
+	# If the server is behind NAT, use the correct IP address
+	[[ -n "$public_ip" ]] && ip="$public_ip"
+	# client-common.txt is created so we have a template to add further users later
+	echo "client
+dev tun
+proto $protocol
+remote $ip $port
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+remote-cert-tls server
+auth SHA512
+ignore-unknown-option block-outside-dns
+verb 3" > /etc/openvpn/server/client-common.txt
+	# Enable and start the OpenVPN service
+	systemctl enable --now openvpn-server@server.service
+	# Generates the custom client.ovpn
+	new_client
+	echo
+	echo "Finished!"
+	echo
+	echo "The client configuration is available in:" ~/"$client.ovpn"
+	echo "New clients can be added by running this script again."
+else
+	clear
+	echo "OpenVPN is already installed."
+	echo
+	echo "Select an option:"
+	echo "   1) Add a new client"
+	echo "   2) Revoke an existing client"
+	echo "   3) Remove OpenVPN"
+	echo "   4) Exit"
+	read -p "Option: " option
+	until [[ "$option" =~ ^[1-4]$ ]]; do
+		echo "$option: invalid selection."
+		read -p "Option: " option
+	done
+	case "$option" in
+		1)
+			echo
+			echo "Provide a name for the client:"
+			read -p "Name: " unsanitized_client
+			client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
+			while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
+				echo "$client: invalid name."
+				read -p "Name: " unsanitized_client
+				client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
+			done
+			cd /etc/openvpn/server/easy-rsa/
+			./easyrsa --batch --days=3650 build-client-full "$client" nopass
+			# Generates the custom client.ovpn
+			new_client
+			echo
+			echo "$client added. Configuration available in:" ~/"$client.ovpn"
+			exit
+		;;
+		2)
+			# This option could be documented a bit better and maybe even be simplified
+			# ...but what can I say, I want some sleep too
+			number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
+			if [[ "$number_of_clients" = 0 ]]; then
+				echo
+				echo "There are no existing clients!"
+				exit
+			fi
+			echo
+			echo "Select the client to revoke:"
+			tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
+			read -p "Client: " client_number
+			until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
+				echo "$client_number: invalid selection."
+				read -p "Client: " client_number
+			done
+			client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
+			echo
+			read -p "Confirm $client revocation? [y/N]: " revoke
+			until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
+				echo "$revoke: invalid selection."
+				read -p "Confirm $client revocation? [y/N]: " revoke
+			done
+			if [[ "$revoke" =~ ^[yY]$ ]]; then
+				cd /etc/openvpn/server/easy-rsa/
+				./easyrsa --batch revoke "$client"
+				./easyrsa --batch --days=3650 gen-crl
+				rm -f /etc/openvpn/server/crl.pem
+				cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
+				# CRL is read with each client connection, when OpenVPN is dropped to nobody
+				chown nobody:"$group_name" /etc/openvpn/server/crl.pem
+				echo
+				echo "$client revoked!"
+			else
+				echo
+				echo "$client revocation aborted!"
+			fi
+			exit
+		;;
+		3)
+			echo
+			read -p "Confirm OpenVPN removal? [y/N]: " remove
+			until [[ "$remove" =~ ^[yYnN]*$ ]]; do
+				echo "$remove: invalid selection."
+				read -p "Confirm OpenVPN removal? [y/N]: " remove
+			done
+			if [[ "$remove" =~ ^[yY]$ ]]; then
+				port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
+				protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
+				if systemctl is-active --quiet firewalld.service; then
+					ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
+					# Using both permanent and not permanent rules to avoid a firewalld reload.
+					firewall-cmd --remove-port="$port"/"$protocol"
+					firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
+					firewall-cmd --permanent --remove-port="$port"/"$protocol"
+					firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
+					firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
+					firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
+					if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
+						ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
+						firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
+						firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
+						firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
+						firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
+					fi
+				else
+					systemctl disable --now openvpn-iptables.service
+					rm -f /etc/systemd/system/openvpn-iptables.service
+				fi
+				if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
+					semanage port -d -t openvpn_port_t -p "$protocol" "$port"
+				fi
+				systemctl disable --now openvpn-server@server.service
+				rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
+				rm -f /etc/sysctl.d/99-openvpn-forward.conf
+				if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
+					rm -rf /etc/openvpn/server
+					apt-get remove --purge -y openvpn
+				else
+					# Else, OS must be CentOS or Fedora
+					dnf remove -y openvpn
+					rm -rf /etc/openvpn/server
+				fi
+				echo
+				echo "OpenVPN removed!"
+			else
+				echo
+				echo "OpenVPN removal aborted!"
+			fi
+			exit
+		;;
+		4)
+			exit
+		;;
+	esac
+fi
--- a/openvpn_ui/bin/run_http_server.sh
+++ b/openvpn_ui/bin/run_http_server.sh
@ -0,0 +1,4 @@
+set -e
+export PYTHONPATH="."
+export TOKEN="test"
+python3.10 openvpn_ui/main.py
--- a/openvpn_ui/main.py
+++ b/openvpn_ui/main.py
@ -0,0 +1,13 @@
+# coding: utf-8
+
+import uvicorn
+
+from openvpn_ui.apis.client_api import router as client_api
+from openvpn_ui.apis.openvpn_api import router as vpn_api
+from openvpn_ui.app import app
+
+app.include_router(client_api)
+app.include_router(vpn_api)
+
+if __name__ == "__main__":
+    uvicorn.run("main:app", host='0.0.0.0', port=8080, reload=True)
--- a/openvpn_ui/models/init.py
+++ b/openvpn_ui/models/init.py
--- a/openvpn_ui/models/extra_models.py
+++ b/openvpn_ui/models/extra_models.py
@ -0,0 +1,8 @@
+# coding: utf-8
+
+from pydantic import BaseModel
+
+class TokenModel(BaseModel):
+    """Defines a token model."""
+
+    sub: str
--- a/openvpn_ui/models/post_client_request.py
+++ b/openvpn_ui/models/post_client_request.py
@ -0,0 +1,24 @@
+# coding: utf-8
+
+from __future__ import annotations
+from datetime import date, datetime  # noqa: F401
+
+import re  # noqa: F401
+from typing import Any, Dict, List, Optional  # noqa: F401
+
+from pydantic import AnyUrl, BaseModel, EmailStr, Field, validator  # noqa: F401
+
+
+class PostClientRequest(BaseModel):
+    """NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+
+    Do not edit the class manually.
+
+    PostClientRequest - a model defined in OpenAPI
+
+        name: The name of this PostClientRequest.
+    """
+
+    name: str = Field(alias="name")
+
+PostClientRequest.update_forward_refs()
--- a/openvpn_ui/models/put_openvpn_request.py
+++ b/openvpn_ui/models/put_openvpn_request.py
@ -0,0 +1,24 @@
+# coding: utf-8
+
+from __future__ import annotations
+from datetime import date, datetime  # noqa: F401
+
+import re  # noqa: F401
+from typing import Any, Dict, List, Optional  # noqa: F401
+
+from pydantic import AnyUrl, BaseModel, EmailStr, Field, validator  # noqa: F401
+
+
+class PutOpenvpnRequest(BaseModel):
+    """NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+
+    Do not edit the class manually.
+
+    PutOpenvpnRequest - a model defined in OpenAPI
+
+        config: The config of this PutOpenvpnRequest [Optional].
+    """
+
+    config: Optional[str] = Field(alias="config", default=None)
+
+PutOpenvpnRequest.update_forward_refs()
--- a/openvpn_ui/readme.md
+++ b/openvpn_ui/readme.md
@ -0,0 +1,38 @@
+# open vpn admin
+
+Simple web UI to manage OpenVPN users.
+
+swagger ui <> python <> [openvpn-install.sh](https://github.com/Nyr/openvpn-install/blob/master/README.md)
+
+# usage
+
+- run server
+
+```commandline
+Install python3.10
+
+cd project-path
+pip install -r -i https://mirrors.aliyun.com/pypi/simple/ requirements.txt
+openvpn_ui/bin/run_http_server.sh
+```
+
+- access swagger ui
+
+```commandline
+http://0.0.0.0:8080/api/docs
+```
+
+# develop
+
+```commandline
+docker run -it -v /Users/songgs/_git/openvpn-install:/app -p 8080:8080 --cap-add=NET_ADMIN python:3.10.14-bullseye bash
+
+pip install -r -i https://mirrors.aliyun.com/pypi/simple/ requirements.txt
+sed -i 's/deb.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list
+```
+
+```commandline
+!! comment this line in openvpn-install.sh
+# Discard stdin. Needed when running from an one-liner which includes a newline
+read -N 999999 -t 0.001
+```
--- a/openvpn_ui/requirements.txt
+++ b/openvpn_ui/requirements.txt
@ -0,0 +1,20 @@
+# -i https://mirrors.aliyun.com/pypi/simple/
+certifi==2022.12.7
+chardet==4.0.0
+click==7.1.2
+dnspython==2.1.0
+fastapi==0.95.2
+idna==2.10
+itsdangerous==1.1.0
+Jinja2==2.11.3
+MarkupSafe==2.0.1
+promise==2.3
+pydantic==1.8.2
+python-dotenv==0.17.1
+python-multipart==0.0.5
+requests==2.25.1
+six==1.16.0
+starlette==0.27.0
+typing-extensions==3.10.0.0
+urllib3==1.26.5
+uvicorn==0.13.4
--- a/openvpn_ui/resource/static/swagger-ui/swagger-ui-bundle.js
+++ b/openvpn_ui/resource/static/swagger-ui/swagger-ui-bundle.js
--- a/openvpn_ui/resource/static/swagger-ui/swagger-ui.css
+++ b/openvpn_ui/resource/static/swagger-ui/swagger-ui.css
--- a/openvpn_ui/resource/static/swagger-ui/swagger.html
+++ b/openvpn_ui/resource/static/swagger-ui/swagger.html
@ -0,0 +1,30 @@
+
+    <!DOCTYPE html>
+    <html>
+    <head>
+    <link type="text/css" rel="stylesheet" href="https://cbec-business-lopzjdhfib.cn-shanghai.fcapp.run/static/swagger-ui.css">
+    <link rel="shortcut icon" href="https://fastapi.tiangolo.com/img/favicon.png">
+    <title>Space - Swagger UI</title>
+    </head>
+    <body>
+    <div id="swagger-ui">
+    </div>
+    <script src="https://cbec-business-lopzjdhfib.cn-shanghai.fcapp.run/static/swagger-ui-bundle.js"></script>
+    <!-- `SwaggerUIBundle` is now available on the page -->
+    <script>
+    const ui = SwaggerUIBundle({
+        url: 'https://cbec-business-lopzjdhfib.cn-shanghai.fcapp.run/api/openapi.json',
+        oauth2RedirectUrl: 'https://cbec-business-lopzjdhfib.cn-shanghai.fcapp.run/docs/oauth2-redirect',
+<!--        oauth2RedirectUrl: window.location.origin + '/docs/oauth2-redirect',-->
+        dom_id: '#swagger-ui',
+        presets: [
+        SwaggerUIBundle.presets.apis,
+        SwaggerUIBundle.SwaggerUIStandalonePreset
+        ],
+        layout: "BaseLayout",
+        deepLinking: true
+    })
+    </script>
+    </body>
+    </html>
+    
--- a/openvpn_ui/vpn/init.py
+++ b/openvpn_ui/vpn/init.py
--- a/openvpn_ui/vpn/vpn_command.py
+++ b/openvpn_ui/vpn/vpn_command.py
@ -0,0 +1,79 @@
+import os
+import shutil
+import subprocess
+from functools import cached_property
+from typing import Union
+
+
+class VpnCommand:
+    @cached_property
+    def install_dir(self) -> str:
+        return os.path.dirname(__file__).replace("openvpn-ui/http_server/vpn", "").replace(
+            r"openvpn-ui\\http_server\\vpn", "")
+
+    @cached_property
+    def install_file(self) -> str:
+        return self.install_dir + "/bin/openvpn-install.sh"
+
+    def get_vpn_status(self, file_path="/etc/openvpn/server/server.conf") -> str:
+        if os.path.exists(file_path):
+            return "OpenVPN has been installed"
+        return f"Please install OpenVPN: {self.install_file}"
+
+    def install_vpn(self) -> str:
+        return self.create_client("default")
+
+    def create_client(self, name) -> str:
+        result = self.install_cmd(name, "1")
+        if isinstance(result, str):
+            return result
+        if result:
+            new_client = f"~/{name.strip('.ovpn')}.ovpn"
+            # move vpn file
+            if os.path.exists(new_client):
+                shutil.copy(new_client, self.install_dir)
+            return name + " has been created"
+        return name + " failed to create"
+
+    def revoke_client(self, name) -> str:
+        result = self.install_cmd(name, "2")
+        if isinstance(result, str):
+            return result
+        if result:
+            new_client = f"{name.strip('.ovpn')}.ovpn"
+            # move vpn file
+            if os.path.exists(new_client):
+                shutil.rmtree(self.install_dir + new_client)
+            return name + " has been revoked"
+        return name + " failed to revoke"
+
+    def install_cmd(self, name: str, option: str,
+                    file_path="/etc/openvpn/server/server.conf") -> Union[bool, str]:
+        if self.get_vpn_status(file_path) != "OpenVPN has been installed":
+            return "Please install OpenVPN"
+
+        name = name.strip('.ovpn')
+        new_client = f"~/{name}.ovpn"
+        # 创建一个Popen对象，指定shell脚本路径，并设置stdin参数为subprocess.PIPE
+        # 这样我们就可以通过stdin管道向脚本发送输入
+        process = subprocess.Popen(
+            ['bash', self.install_file], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE, text=True)
+        # 示例交互式输入列表
+        input_line = f"{option}\n{name}\n"
+        process.stdin.write(input_line)
+        process.stdin.flush()  # 刷新缓冲区，确保输入立即发送到子进程
+        print(input_line, self.install_file, new_client)
+        # 等待脚本执行完成并获取stdout/stderr输出
+        try:
+            stdout_data, stderr_data = process.communicate(timeout=5)
+            print(stdout_data, stderr_data)
+        except Exception as e:
+            with open('a.txt', "w") as f:
+                f.write(str(vars(process)))
+                f.write(str(vars(e)))
+            return False
+        # 输出脚本执行结果和状态
+        print("shell output: ", new_client, stdout_data, stderr_data,
+              process.returncode, process.stderr)
+        return True