From 07abfc97e9ab0c08d630df6dcad8e7d7c8a40135 Mon Sep 17 00:00:00 2001
From: Orazio <orazioedoardo@users.noreply.github.com>
Date: Thu, 14 Nov 2019 15:07:01 +0100
Subject: [PATCH 1/6] Added unattended installation, fixed some variables

---
 auto_install/install.sh | 509 ++++++++++++++++++++++++++++++++--------
 scripts/uninstall.sh    |  22 +-
 2 files changed, 418 insertions(+), 113 deletions(-)

diff --git a/auto_install/install.sh b/auto_install/install.sh
index b9087cc..da71a58 100755
--- a/auto_install/install.sh
+++ b/auto_install/install.sh
@@ -20,8 +20,10 @@ PKG_CACHE="/var/lib/apt/lists/"
 UPDATE_PKG_CACHE="${PKG_MANAGER} update"
 PKG_INSTALL="${PKG_MANAGER} --yes --no-install-recommends install"
 PKG_COUNT="${PKG_MANAGER} -s -o Debug::NoLocking=true upgrade | grep -c ^Inst || true"
+
 # Dependencies that are required by the script, regardless of the VPN protocol chosen
 BASE_DEPS=(git tar wget grep iptables-persistent dnsutils whiptail net-tools dhcpcd5)
+
 # Dependencies that where actually installed by the script. For example if the script requires
 # grep and dnsutils but dnsutils is already installed, we save grep here. This way when uninstalling
 # PiVPN we won't prompt to remove packages that may have been installed by the user for other reasons
@@ -43,6 +45,8 @@ screen_size=$(stty size 2>/dev/null || echo 24 80)
 rows=$(echo $screen_size | awk '{print $1}')
 columns=$(echo $screen_size | awk '{print $2}')
 
+runUnattended=false
+
 # Divide by two so the dialogs take up half of the screen, which looks nice.
 r=$(( rows / 2 ))
 c=$(( columns / 2 ))
@@ -51,7 +55,6 @@ r=$(( r < 20 ? 20 : r ))
 c=$(( c < 70 ? 70 : c ))
 
 # Find IP used to route to outside world
-IPv4dev=$(ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}')
 IPv4addr=$(ip route get 8.8.8.8| awk '{print $7}')
 IPv4gw=$(ip route get 8.8.8.8 | awk '{print $3}')
 
@@ -60,13 +63,26 @@ dhcpcdFile=/etc/dhcpcd.conf
 
 # Next see if we are on a tested and supported OS
 noOSSupport(){
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: Invalid OS detected"
+		echo "::: We have not been able to detect a supported OS."
+		echo "::: Currently this installer supports Raspbian (Buster) and Debian (Buster)."
+		exit 1
+	fi
+
 	whiptail --msgbox --backtitle "INVALID OS DETECTED" --title "Invalid OS" "We have not been able to detect a supported OS.
-Currently this installer supports Raspbian (Buster).
+Currently this installer supports Raspbian (Buster) and Debian (Buster).
 If you think you received this message in error, you can post an issue on the GitHub at https://github.com/pivpn/pivpn/issues." ${r} ${c}
 	exit 1
 }
 
 maybeOSSupport(){
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: Not Supported OS"
+		echo "::: You are on an OS that we have not tested but MAY work, continuing anyway..."
+		return
+	fi
+
 	if (whiptail --backtitle "Not Supported OS" --title "Not Supported OS" --yesno "You are on an OS that we have not tested but MAY work.
 Currently this installer supports Raspbian (Buster).
 Would you like to continue anyway?" ${r} ${c}) then
@@ -118,6 +134,12 @@ checkHostname(){
 ###Checks for hostname size
 	host_name=$(hostname -s)
 	if [[ ! ${#host_name} -le 28 ]]; then
+		if [ "${runUnattended}" = 'true' ]; then
+			echo "::: Your hostname is too long."
+			echo "::: Use 'hostnamectl set-hostname YOURHOSTNAME' to set a new hostname"
+			echo "::: It must be less then 28 characters long and it must not use special characters"
+			exit 1
+		fi
 		until [[ ${#host_name} -le 28 && $host_name  =~ ^[a-zA-Z0-9][a-zA-Z0-9-]{1,28}$ ]]; do
 			host_name=$(whiptail --inputbox "Your hostname is too long.\nEnter new hostname with less then 28 characters\nNo special characters allowed." \
 		   --title "Hostname too long" ${r} ${c} 3>&1 1>&2 2>&3)
@@ -156,6 +178,9 @@ verifyFreeDiskSpace(){
 	if ! [[ "${existing_free_kilobytes}" =~ ^([0-9])+$ ]]; then
 		echo "::: Unknown free disk space!"
 		echo "::: We were unable to determine available free disk space on this system."
+		if [ "${runUnattended}" = 'true' ]; then
+			exit 1
+		fi
 		echo "::: You may continue with the installation, however, it is not recommended."
 		read -r -p "::: If you are sure you want to continue, type YES and press enter :: " response
 		case $response in
@@ -255,6 +280,13 @@ installDependentPackages(){
 }
 
 welcomeDialogs(){
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: PiVPN Automated Installer"
+		echo "::: This installer will transform your Raspberry Pi into an OpenVPN or WireGuard server!"
+		echo "::: Initiating network interface"
+		return
+	fi
+
 	# Display the welcome dialog
 	whiptail --msgbox --backtitle "Welcome" --title "PiVPN Automated Installer" "This installer will transform your Raspberry Pi into an OpenVPN or WireGuard server!" ${r} ${c}
 
@@ -265,6 +297,27 @@ In the next section, you can choose to use your current network settings (DHCP)
 }
 
 chooseInterface(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$IPv4dev" ]; then
+			if [ "$(echo "${availableInterfaces}" | wc -l)" -eq 1 ]; then
+				IPv4dev="${availableInterfaces}"
+				echo "::: No interface specified, but only ${IPv4dev} is available, using it"
+			else
+				echo "::: No interface specified"
+				exit 1
+			fi
+		else
+			if ip -o link | grep -qw "${IPv4dev}"; then
+				echo "::: Using interface: ${IPv4dev}"
+			else
+				echo "::: Interface ${IPv4dev} does not exist"
+				exit 1
+			fi
+		fi
+		echo "IPv4dev=${IPv4dev}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	# Turn the available interfaces into an array so it can be used with a whiptail dialog
 	local interfacesArray=()
 	# Number of available interfaces
@@ -308,15 +361,82 @@ chooseInterface(){
 }
 
 avoidStaticIPv4Ubuntu() {
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: Since we think you are not using Raspbian, we will not configure a static IP for you."
+		return
+	fi
+
 	# If we are in Ubuntu then they need to have previously set their network, so just use what you have.
 	whiptail --msgbox --backtitle "IP Information" --title "IP Information" "Since we think you are not using Raspbian, we will not configure a static IP for you.
 If you are in Amazon then you can not configure a static IP anyway. Just ensure before this installer started you had set an elastic IP on your instance." ${r} ${c}
+
+}
+
+validIP(){
+	local ip=$1
+	local stat=1
+
+	if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
+		OIFS=$IFS
+		IFS='.'
+		ip=($ip)
+		IFS=$OIFS
+		[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
+		&& ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
+		stat=$?
+	fi
+	return $stat
 }
 
 getStaticIPv4Settings() {
-	local ipSettingsCorrect
 	# Grab their current DNS Server
-	IPv4dns=$(nslookup 127.0.0.1 | grep Server: | awk '{print $2}')
+	IPv4dns=$(grep nameserver /etc/resolv.conf | awk '{print $2}' | xargs)
+
+	if [ "${runUnattended}" = 'true' ]; then
+
+		local INVALID_STATIC_IPV4_SETTINGS=0
+
+		if [ -z "$IPv4addr" ]; then
+			echo "::: Missing static IP address"
+			INVALID_STATIC_IPV4_SETTINGS=1
+		fi
+
+		if [ -z "$IPv4gw" ]; then
+			echo "::: Missing static IP gateway"
+			INVALID_STATIC_IPV4_SETTINGS=1
+		fi
+
+		if [ "$INVALID_STATIC_IPV4_SETTINGS" -eq 1 ]; then
+			echo "::: Incomplete static IP settings"
+			exit 1
+		fi
+
+		if [ -z "$IPv4addr" ] && [ -z "$IPv4gw" ]; then
+			echo "::: No static IP settings, using current settings"
+			echo "::: Your static IPv4 address:    ${IPv4addr}"
+			echo "::: Your static IPv4 gateway:    ${IPv4gw}"
+		else
+			if validIP "${IPv4addr%/*}"; then
+				echo "::: Your static IPv4 address:    ${IPv4addr}"
+			else
+				echo "::: ${IPv4addr%/*} is not a valid IP address"
+				exit 1
+			fi
+
+			if validIP "${IPv4gw}"; then
+				echo "::: Your static IPv4 gateway:    ${IPv4gw}"
+			else
+				echo "::: ${IPv4gw} is not a valid IP address"
+				exit 1
+			fi
+		fi
+
+		echo "IPv4addr=${IPv4addr%/*}" >> /tmp/setupVars.conf
+		echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
+		return
+	fi
+
+	local ipSettingsCorrect
 	# Ask if the user wants to use DHCP settings as their static IP
 	if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Do you want to use your current network settings as a static address?
 					IP address:    ${IPv4addr}
@@ -399,6 +519,30 @@ setStaticIPv4(){
 }
 
 chooseUser(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$install_user" ]; then
+			if [ "$(awk -F':' 'BEGIN {count=0} $3>=1000 && $3<=60000 { count++ } END{ print count }' /etc/passwd)" -eq 1 ]; then
+				install_user="$(awk -F':' '$3>=1000 && $3<=60000 {print $1}' /etc/passwd)"
+				echo "::: No user specified, but only ${install_user} is available, using it"
+			else
+				echo "::: No user specified"
+				exit 1
+			fi
+		else
+			if awk -F':' '$3>=1000 && $3<=60000 {print $1}' /etc/passwd | grep -qw "${install_user}"; then
+				echo "::: ${install_user} will hold your ovpn configurations."
+			else
+				echo "::: User ${install_user} does not exist"
+				exit 1
+			fi
+		fi
+		install_home=$(grep -m1 "^${install_user}:" /etc/passwd | cut -d: -f6)
+		install_home=${install_home%/}
+		echo "install_user=${install_user}" >> /tmp/setupVars.conf
+		echo "install_home=${install_home}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	# Explain the local user
 	whiptail --msgbox --backtitle "Parsing User List" --title "Local Users" "Choose a local user that will hold your ovpn configurations." ${r} ${c}
 	# First, let's check if there is a user available.
@@ -519,16 +663,37 @@ cloneOrUpdateRepos(){
 }
 
 askWhichVPN(){
-	if (whiptail --backtitle "Setup PiVPN" --title "Installation mode" --yesno "WireGuard is a new kind of VPN that provides near-istantaneous connection speed, high performance, modern cryptography.\n\nIt's the recommended choise expecially if you use mobile devices where WireGuard is easier on battery than OpenVPN.\n\nOpenVPN is still available if you need the traditional, flexible, trusted VPN protocol. Or if you need features like TCP and custom search domain.\n\nChoose 'Yes' to use WireGuard of 'No' to use OpenVPN." ${r} ${c});
-	then
-		VPN="WireGuard"
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$VPN" ]; then
+			echo ":: No VPN protocol specified, using WireGuard"
+			VPN="wireguard"
+		else
+			VPN="${VPN,,}"
+			if [ "$VPN" = "wireguard" ]; then
+				echo "::: WireGuard will be installed"
+			elif [ "$VPN" = "openvpn" ]; then
+				echo "::: OpenVPN will be installed"
+			else
+				echo ":: $VPN is not a supported VPN protocol, please specify 'wireguard' or 'openvpn'"
+				exit 1
+			fi
+		fi
+	else
+		if (whiptail --backtitle "Setup PiVPN" --title "Installation mode" --yesno "WireGuard is a new kind of VPN that provides near-istantaneous connection speed, high performance, modern cryptography.\n\nIt's the recommended choise expecially if you use mobile devices where WireGuard is easier on battery than OpenVPN.\n\nOpenVPN is still available if you need the traditional, flexible, trusted VPN protocol. Or if you need features like TCP and custom search domain.\n\nChoose 'Yes' to use WireGuard of 'No' to use OpenVPN." ${r} ${c});
+		then
+			VPN="wireguard"
+		else
+			VPN="openvpn"
+		fi
+	fi
+
+	if [ "$VPN" = "wireguard" ]; then
 		pivpnPROTO="udp"
 		pivpnDEV="wg0"
-		pivpnNET="10.6.0.0/24"
-	else
-		VPN="OpenVPN"
+		pivpnNET="10.6.0.0"
+	elif [ "$VPN" = "openvpn" ]; then
 		pivpnDEV="tun0"
-		pivpnNET="10.8.0.0/24"
+		pivpnNET="10.8.0.0"
 	fi
 
 	echo "VPN=${VPN}" >> /tmp/setupVars.conf
@@ -654,42 +819,32 @@ Pin-Priority: 90" | $SUDO tee /etc/apt/preferences.d/limit-unstable > /dev/null
 	fi
 }
 
-validIP(){
-	local ip=$1
-	local stat=1
-
-	if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
-		OIFS=$IFS
-		IFS='.'
-		ip=($ip)
-		IFS=$OIFS
-		[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
-		&& ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
-		stat=$?
-	fi
-	return $stat
-}
-
-#Call this function to use a regex to check user input for a valid custom domain
-validDomain(){
-	local domain=$1
-	local stat=1
-
-	if [[ $domain =~ ^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.[a-zA-Z]{2,}$ ]]; then
-		stat=$?
-	fi
-  return $stat
-}
-
 askCustomProto(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$pivpnPROTO" ]; then
+			echo "::: No TCP/IP protocol specified, using the default protocol udp"
+			pivpnPROTO="udp"
+		else
+			pivpnPROTO="${pivpnPROTO,,}"
+			if [ "$pivpnPROTO" = "udp" ] || [ "$pivpnPROTO" = "tcp" ]; then
+				echo "::: Using the $pivpnPROTO protocol"
+			else
+				echo ":: $pivpnPROTO is not a supported TCP/IP protocol, please specify 'udp' or 'tcp'"
+				exit 1
+			fi
+		fi
+		echo "pivpnPROTO=${pivpnPROTO}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	# Set the available protocols into an array so it can be used with a whiptail dialog
-	if protocol=$(whiptail --title "Protocol" --radiolist \
+	if pivpnPROTO=$(whiptail --title "Protocol" --radiolist \
 		"Choose a protocol (press space to select). Please only choose TCP if you know why you need TCP." ${r} ${c} 2 \
 		"UDP" "" ON \
 		"TCP" "" OFF 3>&1 1>&2 2>&3)
 	then
 		# Convert option into lowercase (UDP->udp)
-		pivpnPROTO="${protocol,,}"
+		pivpnPROTO="${pivpnPROTO,,}"
 		echo "::: Using protocol: $pivpnPROTO"
 		echo "pivpnPROTO=${pivpnPROTO}" >> /tmp/setupVars.conf
 	else
@@ -699,13 +854,39 @@ askCustomProto(){
 }
 
 askCustomPort(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$pivpnPORT" ]; then
+			if [ "$VPN" = "wireguard" ]; then
+				echo "::: No port specified, using the default port 51820"
+				pivpnPORT=51820
+			elif [ "$VPN" = "openvpn" ]; then
+				if [ "$pivpnPROTO" = "udp" ]; then
+					echo "::: No port specified, using the default port 1194"
+					pivpnPORT=1194
+				elif [ "$pivpnPROTO" = "tcp" ]; then
+					echo "::: No port specified, using the default port 443"
+					pivpnPORT=443
+				fi
+			fi
+		else
+			if [[ "$pivpnPORT" =~ ^[0-9]+$ ]] && [ "$pivpnPORT" -ge 1 ] && [ "$pivpnPORT" -le 65535 ]; then
+				echo "::: Using port $pivpnPORT"
+			else
+				echo "::: $pivpnPORT is not a valid port, use a port within the range [1,65535] (inclusive)"
+				exit 1
+			fi
+		fi
+		echo "pivpnPORT=${pivpnPORT}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	until [[ $PORTNumCorrect = True ]]
 		do
 			portInvalid="Invalid"
 
-			if [ "$VPN" = "WireGuard" ]; then
+			if [ "$VPN" = "wireguard" ]; then
 				DEFAULT_PORT=51820
-			elif [ "$VPN" = "OpenVPN" ]; then
+			elif [ "$VPN" = "openvpn" ]; then
 				if [ "$pivpnPROTO" = "udp" ]; then
 					DEFAULT_PORT=1194
 				else
@@ -742,20 +923,48 @@ askCustomPort(){
 }
 
 askClientDNS(){
+	if [ "${runUnattended}" = 'true' ]; then
+
+		if [ -z "$pivpnDNS1" ] && [ -n "$pivpnDNS2" ]; then
+			pivpnDNS1="$pivpnDNS2"
+			unset pivpnDNS2
+		elif [ -z "$pivpnDNS1" ] && [ -z "$pivpnDNS2" ]; then
+			pivpnDNS1="8.8.8.8"
+			pivpnDNS2="8.8.4.4"
+			echo "::: No DNS provider specified, using Google DNS ($pivpnDNS1 $pivpnDNS2)"
+		fi
+
+		local INVALID_DNS_SETTINGS=0
+
+		if ! validIP "$pivpnDNS1"; then
+			INVALID_DNS_SETTINGS=1
+			echo "::: Invalid DNS $pivpnDNS1"
+		fi
+
+		if [ -n "$pivpnDNS2" ] && ! validIP "$pivpnDNS2"; then
+			INVALID_DNS_SETTINGS=1
+			echo "::: Invalid DNS $pivpnDNS2"
+		fi
+
+		if [ "$INVALID_DNS_SETTINGS" -eq 0 ]; then
+			echo "::: Using DNS $pivpnDNS1 $pivpnDNS2"
+		else
+			exit 1
+		fi
+
+		echo "pivpnDNS1=${pivpnDNS1}" >> /tmp/setupVars.conf
+		echo "pivpnDNS2=${pivpnDNS2}" >> /tmp/setupVars.conf
+		return
+	fi
 
 	# Detect and offer to use Pi-hole
 	if command -v pihole &>/dev/null; then
 		if (whiptail --backtitle "Setup PiVPN" --title "Pi-hole" --yesno "We have detected a Pi-hole installation, do you want to use it as the DNS server for the VPN, so you get ad blocking on the go?" ${r} ${c}); then
-			if [ "$VPN" = "WireGuard" ]; then
-				pivpnDEV="wg0"
-			elif [ "$VPN" = "OpenVPN" ]; then
-				pivpnDEV="tun0"
-			fi
-
 			pivpnDNS1="$IPv4addr"
-			echo "interface=$pivpnDNS" | $SUDO tee /etc/dnsmasq.d/02-pivpn.conf > /dev/null
+			echo "interface=$pivpnDEV" | $SUDO tee /etc/dnsmasq.d/02-pivpn.conf > /dev/null
 			$SUDO pihole restartdns
 			echo "pivpnDNS1=${pivpnDNS1}" >> /tmp/setupVars.conf
+			echo "pivpnDNS2=${pivpnDNS2}" >> /tmp/setupVars.conf
 			return
 		fi
 	fi
@@ -836,8 +1045,34 @@ askClientDNS(){
 	echo "pivpnDNS2=${pivpnDNS2}" >> /tmp/setupVars.conf
 }
 
+#Call this function to use a regex to check user input for a valid custom domain
+validDomain(){
+  local domain=$1
+  local stat=1
+
+  if [[ $domain =~ ^(([a-zA-Z0-9]{1,63}|([a-zA-Z0-9]{1,60}[-a-zA-Z0-9()]{0,2}[a-zA-Z0-9]{1,60}))\.){1,6}([a-zA-Z]{2,})$ ]]; then
+    stat=$?
+  fi
+  return $stat
+}
+
 #This procedure allows a user to specify a custom search domain if they have one.
 askCustomDomain(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -n "$pivpnDOMAIN" ]; then
+			if validDomain "$pivpnDOMAIN"; then
+				echo "::: Using custom domain $pivpnDOMAIN"
+			else
+				echo "::: Custom domain $pivpnDOMAIN is not valid"
+				exit 1
+			fi
+		else
+			echo "::: Skipping custom domain"
+		fi
+		echo "pivpnDOMAIN=${pivpnDOMAIN}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	DomainSettingsCorrect=False
 
 	if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Would you like to add a custom search domain? \n (This is only for advanced users who have their own domain)\n" ${r} ${c}); then
@@ -848,7 +1083,6 @@ askCustomDomain(){
 				if validDomain "$pivpnDOMAIN"; then
 					if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Are these settings correct?\n    Custom Search Domain: $pivpnDOMAIN" ${r} ${c}); then
 						DomainSettingsCorrect=True
-						echo "pivpnDOMAIN=${pivpnDOMAIN}" >> /tmp/setupVars.conf
 					else
 						# If the settings are wrong, the loop continues
 						DomainSettingsCorrect=False
@@ -862,10 +1096,9 @@ askCustomDomain(){
 				exit 1
 			fi
 		done
-
-	else
-		echo sleep 0.1
 	fi
+
+	echo "pivpnDOMAIN=${pivpnDOMAIN}" >> /tmp/setupVars.conf
 }
 
 askPublicIPOrDNS(){
@@ -877,6 +1110,24 @@ askPublicIPOrDNS(){
 		fi
 	fi
 
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$pivpnHOST" ]; then
+			echo "::: No IP or domain name specified, using public IP $IPv4pub"
+			pivpnHOST="$IPv4pub"
+		else
+			if validIP "$pivpnHOST"; then
+				echo "::: Using public IP $pivpnHOST"
+			elif validDomain "$pivpnHOST"; then
+				echo "::: Using domain name $pivpnHOST"
+			else
+				echo "::: $pivpnHOST is not a valid IP or domain name"
+				exit 1
+			fi
+		fi
+		echo "pivpnHOST=${pivpnHOST}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	METH=$(whiptail --title "Public IP or DNS" --radiolist "Will clients use a Public IP or DNS Name to connect to your server (press space to select)?" ${r} ${c} 2 \
 		"$IPv4pub" "Use this public IP" "ON" \
 		"DNS Entry" "Use a public DNS" "OFF" 3>&1 1>&2 2>&3)
@@ -911,6 +1162,28 @@ askPublicIPOrDNS(){
 }
 
 askEncryption(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$pivpnENCRYPT" ]; then
+			pivpnENCRYPT=2048
+			echo "::: Using a 2048 bit certificate"
+		else
+			if [ "$pivpnENCRYPT" -eq 2048 ] || [ "$pivpnENCRYPT" -eq 3072 ] || [ "$pivpnENCRYPT" -eq 4096 ]; then
+				echo "::: Using a ${pivpnENCRYPT}-bit certificate"
+			else
+				echo "::: ${pivpnENCRYPT} is not a valid certificate size, use 2048, 3072, or 4096"
+				exit 1
+			fi
+		fi
+
+		if [ -n "$DOWNLOAD_DH_PARAM" ]; then
+			echo "::: DH parameters will be downloaded from \"2 Ton Digital\""
+		fi
+
+		echo "pivpnENCRYPT=${pivpnENCRYPT}" >> /tmp/setupVars.conf
+		echo "DOWNLOAD_DH_PARAM=${DOWNLOAD_DH_PARAM}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	pivpnENCRYPT=$(whiptail --backtitle "Setup OpenVPN" --title "RSA certificate size" --radiolist \
 		"Choose the desired size of your certificate (press space to select):\nThis is a certificate that will be generated on your system. The larger the certificate, the more time this will take. For most applications, it is recommended to use 2048 bits. If you are paranoid about ... things... then grab a cup of joe and pick 4096 bits." ${r} ${c} 3 \
 			"2048" "Use a 2048-bit certificate (recommended level)" ON \
@@ -1020,6 +1293,10 @@ set_var EASYRSA_KEY_SIZE   ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null
 		$SUDO sed -i "s/proto udp/proto tcp/g" /etc/openvpn/server.conf
 	fi
 
+	if [ -z "$pivpnDOMAIN" ]; then
+		$SUDO sed -i "0,/\(.*dhcp-option.*\)/s//\push \"dhcp-option DOMAIN ${pivpnDOMAIN}\" \n&/" /etc/openvpn/server.conf
+	fi
+
 	# write out server certs to conf file
 	$SUDO sed -i "s/\(key \/etc\/openvpn\/easy-rsa\/pki\/private\/\).*/\1${SERVER_NAME}.key/" /etc/openvpn/server.conf
 	$SUDO sed -i "s/\(cert \/etc\/openvpn\/easy-rsa\/pki\/issued\/\).*/\1${SERVER_NAME}.crt/" /etc/openvpn/server.conf
@@ -1058,7 +1335,10 @@ confWireGuard(){
 		$SUDO chmod 700 /etc/wireguard
 	fi
 
-	whiptail --title "Server Information" --msgbox "The Server Keys and Pre-Shared key will now be generated." "${r}" "${c}"
+	if [ "${runUnattended}" = 'false' ]; then
+		whiptail --title "Server Information" --msgbox "The Server Keys and Pre-Shared key will now be generated." "${r}" "${c}"
+		return
+	fi
 	$SUDO mkdir /etc/wireguard/configs
 	$SUDO touch /etc/wireguard/configs/clients.txt
 	$SUDO mkdir /etc/wireguard/keys
@@ -1091,10 +1371,10 @@ confNetwork(){
 			USING_UFW=1
 			echo "::: Detected UFW is enabled."
 			echo "::: Adding UFW rules..."
-			$SUDO sed "/delete these required/i *nat\n:POSTROUTING ACCEPT [0:0]\n-I POSTROUTING -s $pivpnNET -o $IPv4dev -j MASQUERADE\nCOMMIT\n" -i /etc/ufw/before.rules
+			$SUDO sed "/delete these required/i *nat\n:POSTROUTING ACCEPT [0:0]\n-I POSTROUTING -s ${pivpnNET}\/24 -o ${IPv4dev} -j MASQUERADE\nCOMMIT\n" -i /etc/ufw/before.rules
 			# Insert rules at the beginning of the chain (in case there are other rules that may drop the traffic)
-			$SUDO ufw insert 1 allow "$pivpnPORT"/"$pivpnPROTO" >/dev/null
-			$SUDO ufw route insert 1 allow in on "$pivpnDEV" from "$pivpnNET" out on "$IPv4dev" to any >/dev/null
+			$SUDO ufw insert 1 allow "${pivpnPORT}"/"${pivpnPROTO}" >/dev/null
+			$SUDO ufw route insert 1 allow in on "${pivpnDEV}" from "${pivpnNET}/24" out on "${IPv4dev}" to any >/dev/null
 
 			$SUDO ufw reload >/dev/null
 			echo "::: UFW configuration completed."
@@ -1107,7 +1387,7 @@ confNetwork(){
 		# Now some checks to detect which rules we need to add. On a newly installed system all policies
 		# should be ACCEPT, so the only required rule would be the MASQUERADE one.
 
-		$SUDO iptables -t nat -I POSTROUTING -s "$pivpnNET" -o "$IPv4dev" -j MASQUERADE
+		$SUDO iptables -t nat -I POSTROUTING -s "${pivpnNET}/24" -o "${IPv4dev}" -j MASQUERADE
 
 		# Count how many rules are in the INPUT and FORWARD chain. When parsing input from
 		# iptables -S, '^-P' skips the policies and 'ufw-' skips ufw chains (in case ufw was found
@@ -1126,15 +1406,15 @@ confNetwork(){
 		# chain (using -I).
 
 		if [ "$INPUT_RULES_COUNT" -ne 0 ] || [ "$INPUT_POLICY" != "ACCEPT" ]; then
-			$SUDO iptables -I INPUT 1 -i "$IPv4dev" -p "$pivpnPROTO" --dport "$pivpnPORT" -j ACCEPT
+			$SUDO iptables -I INPUT 1 -i "${IPv4dev}" -p "${pivpnPROTO}" --dport "${pivpnPORT}" -j ACCEPT
 			INPUT_CHAIN_EDITED=1
 		else
 			INPUT_CHAIN_EDITED=0
 		fi
 
 		if [ "$FORWARD_RULES_COUNT" -ne 0 ] || [ "$FORWARD_POLICY" != "ACCEPT" ]; then
-			$SUDO iptables -I FORWARD 1 -d "$pivpnNET" -i "$IPv4dev" -o "$pivpnDEV" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-			$SUDO iptables -I FORWARD 2 -s "$pivpnNET" -i "$pivpnDEV" -o "$IPv4dev" -j ACCEPT
+			$SUDO iptables -I FORWARD 1 -d "${pivpnNET}/24" -i "${IPv4dev}" -o "${pivpnDEV}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+			$SUDO iptables -I FORWARD 2 -s "${pivpnNET}/24" -i "${pivpnDEV}" -o "${IPv4dev}" -j ACCEPT
 			FORWARD_CHAIN_EDITED=1
 		else
 			FORWARD_CHAIN_EDITED=0
@@ -1183,7 +1463,7 @@ installPiVPN(){
 	$SUDO mkdir -p /etc/pivpn/
 	askWhichVPN
 
-	if [ "$VPN" = "OpenVPN" ]; then
+	if [ "$VPN" = "openvpn" ]; then
 		installOpenVPN
 		askCustomProto
 		askCustomPort
@@ -1195,7 +1475,7 @@ installPiVPN(){
 		confOVPN
 		confNetwork
 		confLogging
-	elif [ "$VPN" = "WireGuard" ]; then
+	elif [ "$VPN" = "wireguard" ]; then
 		installWireGuard
 		askCustomPort
 		askClientDNS
@@ -1206,12 +1486,25 @@ installPiVPN(){
 }
 
 askUnattendedUpgrades(){
+	if [ "${runUnattended}" = 'true' ]; then
+		if [ -z "$UNATTUPG" ]; then
+			UNATTUPG=1
+			echo "::: No preference regarding unattended upgrades, assuming yes"
+		else
+			if [ "$UNATTUPG" -eq 1 ]; then
+				echo "::: Enabling unattended upgrades"
+			else
+				echo "::: Skipping unattended upgrades"
+			fi
+		fi
+		echo "UNATTUPG=${UNATTUPG}" >> /tmp/setupVars.conf
+		return
+	fi
+
 	whiptail --msgbox --backtitle "Security Updates" --title "Unattended Upgrades" "Since this server will have at least one port open to the internet, it is recommended you enable unattended-upgrades.\nThis feature will check daily for security package updates only and apply them when necessary.\nIt will NOT automatically reboot the server so to fully apply some updates you should periodically reboot." ${r} ${c}
 
 	if (whiptail --backtitle "Security Updates" --title "Unattended Upgrades" --yesno "Do you want to enable unattended upgrades of security patches to this server?" ${r} ${c}); then
 		UNATTUPG=1
-		PIVPN_DEPS=(unattended-upgrades)
-		installDependentPackages PIVPN_DEPS[@]
 	else
 		UNATTUPG=0
 	fi
@@ -1220,27 +1513,32 @@ askUnattendedUpgrades(){
 }
 
 confUnattendedUpgrades(){
-	cd /etc/apt/apt.conf.d
+	if [ "$UNATTUPG" -eq 1 ]; then
+		PIVPN_DEPS=(unattended-upgrades)
+		installDependentPackages PIVPN_DEPS[@]
 
-	if [ "$PLAT" = "Raspbian" ]; then
-		wget -qO- "$UNATTUPG_CONFIG" | $SUDO tar xz
-		$SUDO cp "unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" 50unattended-upgrades
-		$SUDO rm -rf "unattended-upgrades-$UNATTUPG_RELEASE"
+		cd /etc/apt/apt.conf.d
+
+		if [ "$PLAT" = "Raspbian" ]; then
+			wget -qO- "$UNATTUPG_CONFIG" | $SUDO tar xz
+			$SUDO cp "unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" 50unattended-upgrades
+			$SUDO rm -rf "unattended-upgrades-$UNATTUPG_RELEASE"
+		fi
+
+		# On architectures different from armv6l, where we install wireguard from source, enable
+		# automatic updates via the unstable repository
+		if [ "$VPN" = "wireguard" ] && [ "$(uname -m)" != "armv6l" ]; then
+			$SUDO sed -i '/Unattended-Upgrade::Origins-Pattern {/a"o=Debian,a=unstable";' 50unattended-upgrades
+		fi
+
+		# Add the remaining settings for all other distributions
+		echo "APT::Periodic::Enable \"1\";
+		APT::Periodic::Update-Package-Lists \"1\";
+		APT::Periodic::Download-Upgradeable-Packages \"1\";
+		APT::Periodic::Unattended-Upgrade \"1\";
+		APT::Periodic::AutocleanInterval \"7\";
+		APT::Periodic::Verbose \"0\";" | $SUDO tee 02periodic > /dev/null
 	fi
-
-	# On architectures different from armv6l, where we install wireguard from source, enable
-	# automatic updates via the unstable repository
-	if [ "$VPN" = "WireGuard" ] && [ "$(uname -m)" != "armv6l" ]; then
-		$SUDO sed -i '/Unattended-Upgrade::Origins-Pattern {/a"o=Debian,a=unstable";' 50unattended-upgrades
-	fi
-
-	# Add the remaining settings for all other distributions
-	echo "APT::Periodic::Enable \"1\";
-	APT::Periodic::Update-Package-Lists \"1\";
-	APT::Periodic::Download-Upgradeable-Packages \"1\";
-	APT::Periodic::Unattended-Upgrade \"1\";
-	APT::Periodic::AutocleanInterval \"7\";
-	APT::Periodic::Verbose \"0\";" | $SUDO tee 02periodic > /dev/null
 }
 
 installScripts(){
@@ -1253,18 +1551,26 @@ installScripts(){
 		$SUDO chmod 0755 /opt/pivpn
 	fi
 
-	FOLDER=$(tr '[:upper:]' '[:lower:]' <<< "$VPN")
 	$SUDO cp /etc/.pivpn/scripts/uninstall.sh /opt/pivpn/
-	$SUDO cp /etc/.pivpn/scripts/$FOLDER/*.sh /opt/pivpn/
+	$SUDO cp /etc/.pivpn/scripts/$VPN/*.sh /opt/pivpn/
 	$SUDO chmod 0755 /opt/pivpn/*.sh
-	$SUDO cp /etc/.pivpn/scripts/$FOLDER/pivpn /usr/local/bin/pivpn
+	$SUDO cp /etc/.pivpn/scripts/$VPN/pivpn /usr/local/bin/pivpn
 	$SUDO chmod 0755 /usr/local/bin/pivpn
-	$SUDO cp /etc/.pivpn/scripts/$FOLDER/bash-completion /etc/bash_completion.d/pivpn
+	$SUDO cp /etc/.pivpn/scripts/$VPN/bash-completion /etc/bash_completion.d/pivpn
 	. /etc/bash_completion.d/pivpn
 	echo " done."
 }
 
 displayFinalMessage(){
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: Installation Complete!"
+		echo "::: Now run 'pivpn add' to create the ovpn profiles.
+Run 'pivpn help' to see what else you can do!\n\nIf you run into any issue, please read all our documentation carefully.
+All incomplete posts or bug reports will be ignored or deleted.\n\nThank you for using PiVPN."
+		echo "::: It is strongly recommended you reboot after installation."
+		return
+	fi
+
 	# Final completion message to user
 	whiptail --msgbox --backtitle "Make it so." --title "Installation Complete!" "Now run 'pivpn add' to create the ovpn profiles.
 Run 'pivpn help' to see what else you can do!\n\nIf you run into any issue, please read all our documentation carefully.
@@ -1299,12 +1605,6 @@ main(){
 		fi
 	fi
 
-	# Check for supported distribution
-	distroCheck
-
-	# Checks for hostname Length
-	checkHostname
-
 	# Check arguments for the undocumented flags
 	for var in "$@"; do
 		case "$var" in
@@ -1313,8 +1613,19 @@ main(){
 		esac
 	done
 
+	# Check for supported distribution
+	distroCheck
+
+	# Checks for hostname Length
+	checkHostname
+
 	if [[ "${runUnattended}" == true ]]; then
 		echo "::: --unattended passed to install script, no whiptail dialogs will be displayed"
+		if [ -r "$1" ]; then
+			source "$1"
+		else
+			echo "::: Warning: can't open $1, using default settings..."
+		fi
 	fi
 
 	# Start the installer
@@ -1364,10 +1675,10 @@ main(){
 	# Start services
 	case ${PLAT} in
 		Debian|Raspbian)
-			if [ "$VPN" = "OpenVPN" ]; then
+			if [ "$VPN" = "openvpn" ]; then
 				$SUDO systemctl enable openvpn.service
 				$SUDO systemctl start openvpn.service
-			elif [ "$VPN" = "WireGuard" ]; then
+			elif [ "$VPN" = "wireguard" ]; then
 				$SUDO systemctl enable wg-quick@wg0.service
 				$SUDO systemctl start wg-quick@wg0.service
 			fi
@@ -1389,12 +1700,6 @@ main(){
 	echo "::: done."
 
 	displayFinalMessage
-
-	echo ":::"
-	echo "::: Installation Complete!"
-	echo "::: Now run 'pivpn add' to create an ovpn profile for each of your devices."
-	echo "::: Run 'pivpn help' to see what else you can do!"
-	echo "::: It is strongly recommended you reboot after installation."
 	echo ":::"
 }
 
diff --git a/scripts/uninstall.sh b/scripts/uninstall.sh
index 7027c65..1381192 100755
--- a/scripts/uninstall.sh
+++ b/scripts/uninstall.sh
@@ -42,10 +42,10 @@ removeAll(){
 	# Stopping and disabling services
 	echo "::: Stopping and disabling services..."
 
-	if [ "$VPN" = "WireGuard" ]; then
+	if [ "$VPN" = "wireguard" ]; then
 		systemctl stop wg-quick@wg0
 		systemctl disable wg-quick@wg0 &> /dev/null
-	elif [ "$VPN" = "OpenVPN" ]; then
+	elif [ "$VPN" = "openvpn" ]; then
 		systemctl stop openvpn
 		systemctl disable openvpn &> /dev/null
 	fi
@@ -53,19 +53,19 @@ removeAll(){
 	# Removing firewall rules.
 	echo "::: Removing firewall rules..."
 
-	if [ "$VPN" = "WireGuard" ]; then
-		pivpnDEV="wg0"
-		pivpnNET="10.6.0.0/24"
+	if [ "$VPN" = "wireguard" ]; then
 		pivpnPROTO="udp"
-	elif [ "$VPN" = "OpenVPN" ]; then
+		pivpnDEV="wg0"
+		pivpnNET="10.6.0.0"
+	elif [ "$VPN" = "openvpn" ]; then
 		pivpnDEV="tun0"
-		pivpnNET="10.8.0.0/24"
+		pivpnNET="10.8.0.0"
 	fi
 
 	if [ "$USING_UFW" -eq 1 ]; then
 
 		ufw delete allow "${pivpnPORT}"/"${pivpnPROTO}" > /dev/null
-		ufw route delete allow in on "$pivpnDEV" from "$pivpnNET" out on "${IPv4dev}" to any > /dev/null
+		ufw route delete allow in on "${pivpnDEV}" from "${pivpnNET}/24" out on "${IPv4dev}" to any > /dev/null
 		sed -z "s/*nat\n:POSTROUTING ACCEPT \[0:0\]\n-I POSTROUTING -s ${pivpnNET}\/24 -o ${IPv4dev} -j MASQUERADE\nCOMMIT\n\n//" -i /etc/ufw/before.rules
 		ufw reload &> /dev/null
 
@@ -76,11 +76,11 @@ removeAll(){
 		fi
 
 		if [ "$FORWARD_CHAIN_EDITED" -eq 1 ]; then
-			iptables -D FORWARD -d "$pivpnNET" -i "${IPv4dev}" -o "$pivpnDEV" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-			iptables -D FORWARD -s "$pivpnNET" -i "$pivpnDEV" -o "${IPv4dev}" -j ACCEPT
+			iptables -D FORWARD -d "${pivpnNET}/24" -i "${IPv4dev}" -o "${pivpnDEV}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+			iptables -D FORWARD -s "${pivpnNET}/24" -i "${pivpnDEV}/24" -o "${IPv4dev}" -j ACCEPT
 		fi
 
-		iptables -t nat -D POSTROUTING -s "$pivpnNET" -o "${IPv4dev}" -j MASQUERADE
+		iptables -t nat -D POSTROUTING -s "${pivpnNET}/24" -o "${IPv4dev}" -j MASQUERADE
 		iptables-save > /etc/iptables/rules.v4
 
 	fi

From 5cb8a053177205be796c9b46435e16ad8e45a55a Mon Sep 17 00:00:00 2001
From: Orazio <orazioedoardo@users.noreply.github.com>
Date: Thu, 14 Nov 2019 17:42:56 +0100
Subject: [PATCH 2/6] Minor unattended fixes, adjusted openvpn settings

---
 Default.txt             |  2 --
 auto_install/install.sh | 37 +++++++++++++++++++++++++++----------
 server_config.txt       |  2 +-
 3 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/Default.txt b/Default.txt
index d3a01c1..cb733db 100644
--- a/Default.txt
+++ b/Default.txt
@@ -4,8 +4,6 @@ proto udp
 remote IPv4pub 1194
 resolv-retry infinite
 nobind
-persist-key
-persist-tun
 key-direction 1
 remote-cert-tls server
 tls-version-min 1.2
diff --git a/auto_install/install.sh b/auto_install/install.sh
index da71a58..827c599 100755
--- a/auto_install/install.sh
+++ b/auto_install/install.sh
@@ -1175,7 +1175,10 @@ askEncryption(){
 			fi
 		fi
 
-		if [ -n "$DOWNLOAD_DH_PARAM" ]; then
+		if [ -z "$DOWNLOAD_DH_PARAM" ] || [ "$DOWNLOAD_DH_PARAM" -ne 1 ]; then
+			DOWNLOAD_DH_PARAM=0
+			echo "::: DH parameters will be generated locally"
+		else
 			echo "::: DH parameters will be downloaded from \"2 Ton Digital\""
 		fi
 
@@ -1246,7 +1249,11 @@ set_var EASYRSA_KEY_SIZE   ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null
 	${SUDOE} ./easyrsa --batch build-ca nopass
 	printf "\n::: CA Complete.\n"
 
-	whiptail --msgbox --backtitle "Setup OpenVPN" --title "Server Information" "The server key, Diffie-Hellman parameters, and HMAC key will now be generated." ${r} ${c}
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: The server key, Diffie-Hellman parameters, and HMAC key will now be generated."
+	else
+		whiptail --msgbox --backtitle "Setup OpenVPN" --title "Server Information" "The server key, Diffie-Hellman parameters, and HMAC key will now be generated." ${r} ${c}
+	fi
 
 	# Build the server
 	EASYRSA_CERT_EXPIRE=3650 ${SUDOE} ./easyrsa build-server-full ${SERVER_NAME} nopass
@@ -1335,9 +1342,10 @@ confWireGuard(){
 		$SUDO chmod 700 /etc/wireguard
 	fi
 
-	if [ "${runUnattended}" = 'false' ]; then
+	if [ "${runUnattended}" = 'true' ]; then
+		echo "::: The Server Keys and Pre-Shared key will now be generated."
+	else
 		whiptail --title "Server Information" --msgbox "The Server Keys and Pre-Shared key will now be generated." "${r}" "${c}"
-		return
 	fi
 	$SUDO mkdir /etc/wireguard/configs
 	$SUDO touch /etc/wireguard/configs/clients.txt
@@ -1564,9 +1572,13 @@ installScripts(){
 displayFinalMessage(){
 	if [ "${runUnattended}" = 'true' ]; then
 		echo "::: Installation Complete!"
-		echo "::: Now run 'pivpn add' to create the ovpn profiles.
-Run 'pivpn help' to see what else you can do!\n\nIf you run into any issue, please read all our documentation carefully.
-All incomplete posts or bug reports will be ignored or deleted.\n\nThank you for using PiVPN."
+		echo "::: Now run 'pivpn add' to create the ovpn profiles."
+		echo "::: Run 'pivpn help' to see what else you can do!"
+		echo
+		echo "::: If you run into any issue, please read all our documentation carefully."
+		echo "::: All incomplete posts or bug reports will be ignored or deleted."
+		echo
+		echo "::: Thank you for using PiVPN."
 		echo "::: It is strongly recommended you reboot after installation."
 		return
 	fi
@@ -1621,10 +1633,15 @@ main(){
 
 	if [[ "${runUnattended}" == true ]]; then
 		echo "::: --unattended passed to install script, no whiptail dialogs will be displayed"
-		if [ -r "$1" ]; then
-			source "$1"
+		if [ -z "$2" ]; then
+			echo "::: No configuration file passed, using default settings..."
 		else
-			echo "::: Warning: can't open $1, using default settings..."
+			if [ -r "$2" ]; then
+				source "$2"
+			else
+				echo "::: Can't open $2"
+				exit 1
+			fi
 		fi
 	fi
 
diff --git a/server_config.txt b/server_config.txt
index 93143b1..9ca16a4 100644
--- a/server_config.txt
+++ b/server_config.txt
@@ -17,7 +17,7 @@ push "block-outside-dns"
 # overriding but not wiping out the original default gateway.
 push "redirect-gateway def1"
 client-to-client
-keepalive 1800 3600
+keepalive 15 120
 remote-cert-tls client
 tls-version-min 1.2
 tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0

From d7ebb4cca99f10c8a707b3ecf5a0b531045d3de7 Mon Sep 17 00:00:00 2001
From: Orazio <orazioedoardo@users.noreply.github.com>
Date: Sat, 16 Nov 2019 14:58:58 +0100
Subject: [PATCH 3/6] Unattended installation

---
 auto_install/install.sh           | 101 +++++++++++++++++-------------
 scripts/openvpn/makeOVPN.sh       |  17 ++---
 scripts/openvpn/pivpnDebug.sh     |   2 +-
 scripts/uninstall.sh              |  33 ++++++----
 scripts/wireguard/pivpnDEBUG.sh   |   2 +-
 unattended_openvpn_example.conf   |  12 ++++
 unattended_wireguard_example.conf |   8 +++
 7 files changed, 108 insertions(+), 67 deletions(-)
 create mode 100644 unattended_openvpn_example.conf
 create mode 100644 unattended_wireguard_example.conf

diff --git a/auto_install/install.sh b/auto_install/install.sh
index 827c599..5e5f80a 100755
--- a/auto_install/install.sh
+++ b/auto_install/install.sh
@@ -679,7 +679,7 @@ askWhichVPN(){
 			fi
 		fi
 	else
-		if (whiptail --backtitle "Setup PiVPN" --title "Installation mode" --yesno "WireGuard is a new kind of VPN that provides near-istantaneous connection speed, high performance, modern cryptography.\n\nIt's the recommended choise expecially if you use mobile devices where WireGuard is easier on battery than OpenVPN.\n\nOpenVPN is still available if you need the traditional, flexible, trusted VPN protocol. Or if you need features like TCP and custom search domain.\n\nChoose 'Yes' to use WireGuard of 'No' to use OpenVPN." ${r} ${c});
+		if (whiptail --backtitle "Setup PiVPN" --title "Installation mode" --yesno "WireGuard is a new kind of VPN that provides near-istantaneous connection speed, high performance, modern cryptography.\n\nIt's the recommended choise expecially if you use mobile devices where WireGuard is easier on battery than OpenVPN.\n\nOpenVPN is still available if you need the traditional, flexible, trusted VPN protocol. Or if you need features like TCP and custom search domain.\n\nChoose 'Yes' to use WireGuard or 'No' to use OpenVPN." ${r} ${c});
 		then
 			VPN="wireguard"
 		else
@@ -1075,7 +1075,7 @@ askCustomDomain(){
 
 	DomainSettingsCorrect=False
 
-	if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Would you like to add a custom search domain? \n (This is only for advanced users who have their own domain)\n" ${r} ${c}); then
+	if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno --defaultno "Would you like to add a custom search domain? \n (This is only for advanced users who have their own domain)\n" ${r} ${c}); then
 
 		until [[ $DomainSettingsCorrect = True ]]
 		do
@@ -1217,16 +1217,27 @@ confOpenVPN(){
 	# Create a unique server name using the host name and UUID
 	SERVER_NAME="${host_name}_${NEW_UUID}"
 
+	# Backup the openvpn folder
+	OPENVPN_BACKUP="openvpn_$(date +%Y-%m-%d-%H%M%S).tar.gz"
+	echo "::: Backing up the openvpn folder to /etc/${OPENVPN_BACKUP}"
+	$SUDO tar czf "/etc/${OPENVPN_BACKUP}" /etc/openvpn
+
+	if [ -f /etc/openvpn/server.conf ]; then
+		$SUDO rm /etc/openvpn/server.conf
+	fi
+
 	# If easy-rsa exists, remove it
 	if [[ -d /etc/openvpn/easy-rsa/ ]]; then
 		$SUDO rm -rf /etc/openvpn/easy-rsa/
 	fi
 
 	# Get easy-rsa
-	wget -qO- "${easyrsaRel}" | $SUDO tar xz -C /etc/openvpn && $SUDO mv /etc/openvpn/EasyRSA-v${easyrsaVer} /etc/openvpn/easy-rsa
+	wget -qO- "${easyrsaRel}" | $SUDO tar xz -C /etc/openvpn
+	$SUDO mv /etc/openvpn/EasyRSA-v${easyrsaVer} /etc/openvpn/easy-rsa
 	# fix ownership
 	$SUDO chown -R root:root /etc/openvpn/easy-rsa
 	$SUDO mkdir /etc/openvpn/easy-rsa/pki
+	$SUDO chmod 700 /etc/openvpn/easy-rsa/pki
 
 	cd /etc/openvpn/easy-rsa || exit
 
@@ -1300,7 +1311,7 @@ set_var EASYRSA_KEY_SIZE   ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null
 		$SUDO sed -i "s/proto udp/proto tcp/g" /etc/openvpn/server.conf
 	fi
 
-	if [ -z "$pivpnDOMAIN" ]; then
+	if [ -n "$pivpnDOMAIN" ]; then
 		$SUDO sed -i "0,/\(.*dhcp-option.*\)/s//\push \"dhcp-option DOMAIN ${pivpnDOMAIN}\" \n&/" /etc/openvpn/server.conf
 	fi
 
@@ -1326,30 +1337,35 @@ confOVPN(){
 
 	# verify server name to strengthen security
 	$SUDO sed -i "s/SRVRNAME/${SERVER_NAME}/" /etc/openvpn/easy-rsa/pki/Default.txt
-
-	if [ ! -d "$install_home/ovpns" ]; then
-		$SUDO mkdir "$install_home/ovpns"
-	fi
-	$SUDO chmod 0750 "$install_home/ovpns"
-	$SUDO chown $install_user:$install_user "$install_home/ovpns"
 }
 
 confWireGuard(){
 	if [ -d /etc/wireguard ]; then
-		$SUDO rm -r /etc/wireguard
+		# Backup the wireguard folder
+		WIREGUARD_BACKUP="wireguard_$(date +%Y-%m-%d-%H%M%S).tar.gz"
+		echo "::: Backing up the wireguard folder to /etc/${WIREGUARD_BACKUP}"
+		$SUDO tar czf "/etc/${WIREGUARD_BACKUP}" /etc/wireguard
+
+		if [ -f /etc/wireguard/wg0.conf ]; then
+			$SUDO rm /etc/wireguard/wg0.conf
+		fi
+	else
+		# If compiled from source, the wireguard folder is not being created
 		$SUDO mkdir /etc/wireguard
-		$SUDO chown root:root /etc/wireguard
-		$SUDO chmod 700 /etc/wireguard
 	fi
 
+	# Ensure that only root is able to enter the wireguard folder
+	$SUDO chown root:root /etc/wireguard
+	$SUDO chmod 700 /etc/wireguard
+
 	if [ "${runUnattended}" = 'true' ]; then
 		echo "::: The Server Keys and Pre-Shared key will now be generated."
 	else
 		whiptail --title "Server Information" --msgbox "The Server Keys and Pre-Shared key will now be generated." "${r}" "${c}"
 	fi
-	$SUDO mkdir /etc/wireguard/configs
+	$SUDO mkdir -p /etc/wireguard/configs
 	$SUDO touch /etc/wireguard/configs/clients.txt
-	$SUDO mkdir /etc/wireguard/keys
+	$SUDO mkdir -p /etc/wireguard/keys
 
 	# Generate private key and derive public key from it
 	wg genkey | $SUDO tee /etc/wireguard/keys/server_priv &> /dev/null
@@ -1442,7 +1458,7 @@ confNetwork(){
 }
 
 confLogging() {
-  echo "if \$programname == 'ovpn-server' then /var/log/openvpn.log
+	echo "if \$programname == 'ovpn-server' then /var/log/openvpn.log
 if \$programname == 'ovpn-server' then stop" | $SUDO tee /etc/rsyslog.d/30-openvpn.conf > /dev/null
 
   echo "/var/log/openvpn.log
@@ -1459,7 +1475,7 @@ if \$programname == 'ovpn-server' then stop" | $SUDO tee /etc/rsyslog.d/30-openv
 	endscript
 }" | $SUDO tee /etc/logrotate.d/openvpn > /dev/null
 
-  # Restart the logging service
+	# Restart the logging service
 	case ${PLAT} in
 		Debian|Raspbian)
 			$SUDO systemctl restart rsyslog.service || true
@@ -1521,32 +1537,29 @@ askUnattendedUpgrades(){
 }
 
 confUnattendedUpgrades(){
-	if [ "$UNATTUPG" -eq 1 ]; then
-		PIVPN_DEPS=(unattended-upgrades)
-		installDependentPackages PIVPN_DEPS[@]
+	PIVPN_DEPS=(unattended-upgrades)
+	installDependentPackages PIVPN_DEPS[@]
 
-		cd /etc/apt/apt.conf.d
+	cd /etc/apt/apt.conf.d
 
-		if [ "$PLAT" = "Raspbian" ]; then
-			wget -qO- "$UNATTUPG_CONFIG" | $SUDO tar xz
-			$SUDO cp "unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" 50unattended-upgrades
-			$SUDO rm -rf "unattended-upgrades-$UNATTUPG_RELEASE"
-		fi
-
-		# On architectures different from armv6l, where we install wireguard from source, enable
-		# automatic updates via the unstable repository
-		if [ "$VPN" = "wireguard" ] && [ "$(uname -m)" != "armv6l" ]; then
-			$SUDO sed -i '/Unattended-Upgrade::Origins-Pattern {/a"o=Debian,a=unstable";' 50unattended-upgrades
-		fi
-
-		# Add the remaining settings for all other distributions
-		echo "APT::Periodic::Enable \"1\";
-		APT::Periodic::Update-Package-Lists \"1\";
-		APT::Periodic::Download-Upgradeable-Packages \"1\";
-		APT::Periodic::Unattended-Upgrade \"1\";
-		APT::Periodic::AutocleanInterval \"7\";
-		APT::Periodic::Verbose \"0\";" | $SUDO tee 02periodic > /dev/null
+	if [ "$PLAT" = "Raspbian" ]; then
+		wget -qO- "$UNATTUPG_CONFIG" | $SUDO tar xz
+		$SUDO cp "unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" 50unattended-upgrades
+		$SUDO rm -rf "unattended-upgrades-$UNATTUPG_RELEASE"
 	fi
+
+	# Enable automatic updates via the unstable repository when installing from debian package
+	if [ "$VPN" = "wireguard" ] && [ "$(uname -m)" != "armv6l" ]; then
+		$SUDO sed -i '/Unattended-Upgrade::Origins-Pattern {/a"o=Debian,a=unstable";' 50unattended-upgrades
+	fi
+
+	# Add the remaining settings for all other distributions
+	echo "APT::Periodic::Enable \"1\";
+	APT::Periodic::Update-Package-Lists \"1\";
+	APT::Periodic::Download-Upgradeable-Packages \"1\";
+	APT::Periodic::Unattended-Upgrade \"1\";
+	APT::Periodic::AutocleanInterval \"7\";
+	APT::Periodic::Verbose \"0\";" | $SUDO tee 02periodic > /dev/null
 }
 
 installScripts(){
@@ -1704,11 +1717,15 @@ main(){
 
 	# Ask if unattended-upgrades will be enabled
 	askUnattendedUpgrades
-	confUnattendedUpgrades
 
+	if [ "$UNATTUPG" -eq 1 ]; then
+		confUnattendedUpgrades
+	fi
+
+	# Save installation setting to the final location
 	echo "TO_INSTALL=(${TO_INSTALL[*]})" >> /tmp/setupVars.conf
-
 	$SUDO cp /tmp/setupVars.conf "$setupVars"
+
 	installScripts
 
 	# Ensure that cached writes reach persistent storage
diff --git a/scripts/openvpn/makeOVPN.sh b/scripts/openvpn/makeOVPN.sh
index d37769c..674732f 100755
--- a/scripts/openvpn/makeOVPN.sh
+++ b/scripts/openvpn/makeOVPN.sh
@@ -213,6 +213,7 @@ EOF
 #make sure ovpns dir exists
 if [ ! -d "$install_home/ovpns" ]; then
     mkdir "$install_home/ovpns"
+    chown "$install_user":"$install_user" "$install_home/ovpns"
     chmod 0750 "$install_home/ovpns"
 fi
 
@@ -339,16 +340,10 @@ if [ "$iOS" = "1" ]; then
     sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' < "issued/${NAME}${CRT}"
     echo "</cert>"
 
-    #Finally, append the TA Private Key
-    if [ -f /etc/pivpn/TWO_POINT_FOUR ]; then
-      echo "<tls-crypt>"
-      cat "${TA}"
-      echo "</tls-crypt>"
-    else
-      echo "<tls-auth>"
-      cat "${TA}"
-      echo "</tls-auth>"
-    fi
+    #Finally, append the tls Private Key
+    echo "<tls-auth>"
+    cat "${TA}"
+    echo "</tls-auth>"
 
 	} > "${NAME}${FILEEXT}"
 
@@ -401,7 +396,7 @@ fi
 
 # Copy the .ovpn profile to the home directory for convenient remote access
 cp "/etc/openvpn/easy-rsa/pki/$NAME$FILEEXT" "$install_home/ovpns/$NAME$FILEEXT"
-chown "$install_user" "$install_home/ovpns/$NAME$FILEEXT"
+chown "$install_user":"$install_user" "$install_home/ovpns/$NAME$FILEEXT"
 chmod 640 "/etc/openvpn/easy-rsa/pki/$NAME$FILEEXT"
 chmod 640 "$install_home/ovpns/$NAME$FILEEXT"
 printf "\n\n"
diff --git a/scripts/openvpn/pivpnDebug.sh b/scripts/openvpn/pivpnDebug.sh
index 348e7de..a205ba0 100755
--- a/scripts/openvpn/pivpnDebug.sh
+++ b/scripts/openvpn/pivpnDebug.sh
@@ -205,7 +205,7 @@ echo -e "::::      \e[4mSnippet of the server log\e[0m      ::::"
 tail -20 /var/log/openvpn.log > /tmp/snippet
 
 # Regular expession taken from https://superuser.com/a/202835, it will match invalid IPs
-# like 123.456.789.012 but it's fine because the log only contains valid ones.
+# like 123.456.789.012 but it's fine since the log only contains valid ones.
 declare -a IPS_TO_HIDE=($(grepcidr -v 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 /tmp/snippet | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | uniq))
 for IP in "${IPS_TO_HIDE[@]}"; do
     sed -i "s/$IP/REDACTED/g" /tmp/snippet
diff --git a/scripts/uninstall.sh b/scripts/uninstall.sh
index 1381192..646de20 100755
--- a/scripts/uninstall.sh
+++ b/scripts/uninstall.sh
@@ -67,6 +67,7 @@ removeAll(){
 		ufw delete allow "${pivpnPORT}"/"${pivpnPROTO}" > /dev/null
 		ufw route delete allow in on "${pivpnDEV}" from "${pivpnNET}/24" out on "${IPv4dev}" to any > /dev/null
 		sed -z "s/*nat\n:POSTROUTING ACCEPT \[0:0\]\n-I POSTROUTING -s ${pivpnNET}\/24 -o ${IPv4dev} -j MASQUERADE\nCOMMIT\n\n//" -i /etc/ufw/before.rules
+		iptables -t nat -D POSTROUTING -s "${pivpnNET}/24" -o "${IPv4dev}" -j MASQUERADE
 		ufw reload &> /dev/null
 
 	elif [ "$USING_UFW" -eq 0 ]; then
@@ -77,7 +78,7 @@ removeAll(){
 
 		if [ "$FORWARD_CHAIN_EDITED" -eq 1 ]; then
 			iptables -D FORWARD -d "${pivpnNET}/24" -i "${IPv4dev}" -o "${pivpnDEV}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-			iptables -D FORWARD -s "${pivpnNET}/24" -i "${pivpnDEV}/24" -o "${IPv4dev}" -j ACCEPT
+			iptables -D FORWARD -s "${pivpnNET}/24" -i "${pivpnDEV}" -o "${IPv4dev}" -j ACCEPT
 		fi
 
 		iptables -t nat -D POSTROUTING -s "${pivpnNET}/24" -o "${IPv4dev}" -j MASQUERADE
@@ -103,8 +104,6 @@ removeAll(){
 								rm /etc/apt/preferences.d/limit-unstable
 								$PKG_MANAGER update &> /dev/null
 							fi
-							rm -rf /etc/wireguard
-							rm -rf $install_home/configs
 
 						elif [ "${i}" = "wireguard-dkms" ]; then
 
@@ -123,12 +122,6 @@ removeAll(){
 							# so we remove the repository keys
 							apt-key remove E1CF20DDFFE4B89E802658F1E0B11894F66AEC98 80D15823B7FD1561F9F7BCDDDC30D7C23CBBABEE &> /dev/null
 
-						elif [ "${i}" = "openvpn" ]; then
-
-							rm -rf /var/log/*openvpn*
-							rm -rf /etc/openvpn
-							rm -rf $install_home/ovpns
-
 						elif [ "${i}" = "unattended-upgrades" ]; then
 
 							rm -rf /var/log/unattended-upgrades
@@ -158,7 +151,7 @@ removeAll(){
 	echo "::: Removing pivpn system files..."
 
 	if [ -f /etc/dnsmasq.d/02-pivpn.conf ]; then
-		rm /etc/dnsmasq.d/02-pivpn.conf
+		rm -f /etc/dnsmasq.d/02-pivpn.conf
 		pihole restartdns
 	fi
 
@@ -166,8 +159,24 @@ removeAll(){
 	rm -rf /etc/.pivpn
 	rm -rf /etc/pivpn
 	rm -rf /var/log/*pivpn*
-	rm /usr/local/bin/pivpn
-	rm /etc/bash_completion.d/pivpn
+	rm -f /usr/local/bin/pivpn
+	rm -f /etc/bash_completion.d/pivpn
+
+	echo ":::"
+	echo "::: Removing VPN configuration files..."
+
+	if [ "$VPN" = "wireguard" ]; then
+		rm -f /etc/wireguard/wg0.conf
+		rm -rf /etc/wireguard/configs
+		rm -rf /etc/wireguard/keys
+		rm -rf $install_home/configs
+	elif [ "$VPN" = "openvpn" ]; then
+		rm -rf /var/log/*openvpn*
+		rm -f /etc/openvpn/server.conf
+		rm -f /etc/openvpn/crl.pem
+		rm -rf /etc/openvpn/easy-rsa
+		rm -rf $install_home/ovpns
+	fi
 
 	echo ":::"
 	printf "::: Finished removing PiVPN from your system.\n"
diff --git a/scripts/wireguard/pivpnDEBUG.sh b/scripts/wireguard/pivpnDEBUG.sh
index bdd7f3e..b7c0311 100755
--- a/scripts/wireguard/pivpnDEBUG.sh
+++ b/scripts/wireguard/pivpnDEBUG.sh
@@ -24,7 +24,7 @@ printf "=============================================\n"
 echo -e "::::  \e[4mServer configuration shown below\e[0m   ::::"
 cd /etc/wireguard/keys
 cp ../wg0.conf ../wg0.tmp
-# Replace every key in the server configuration with just it's file name
+# Replace every key in the server configuration with just its file name
 for k in *; do
     sed "s#$(cat "$k")#$k#" -i ../wg0.tmp
 done
diff --git a/unattended_openvpn_example.conf b/unattended_openvpn_example.conf
new file mode 100644
index 0000000..6f96a74
--- /dev/null
+++ b/unattended_openvpn_example.conf
@@ -0,0 +1,12 @@
+IPv4dev=eth0
+install_user=pi
+VPN=openvpn
+pivpnPROTO=udp
+pivpnPORT=1194
+pivpnDNS1=8.8.8.8
+pivpnDNS2=8.8.4.4
+pivpnHOST=pivpn.example.com
+pivpnENCRYPT=2048
+pivpnDOMAIN=domain.example.com
+DOWNLOAD_DH_PARAM=0
+UNATTUPG=1
diff --git a/unattended_wireguard_example.conf b/unattended_wireguard_example.conf
new file mode 100644
index 0000000..4ed1752
--- /dev/null
+++ b/unattended_wireguard_example.conf
@@ -0,0 +1,8 @@
+IPv4dev=eth0
+install_user=pi
+VPN=wireguard
+pivpnPORT=51820
+pivpnDNS1=8.8.8.8
+pivpnDNS2=8.8.4.4
+pivpnHOST=pivpn.example.com
+UNATTUPG=1

From 8ab71601ffda62ec8fc575a6f76b824f83739762 Mon Sep 17 00:00:00 2001
From: Orazio <orazioedoardo@users.noreply.github.com>
Date: Sat, 16 Nov 2019 17:02:15 +0100
Subject: [PATCH 4/6] Automatically fetch latest WireGuard snapshot

---
 auto_install/install.sh | 10 ++++++----
 scripts/uninstall.sh    |  1 -
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/auto_install/install.sh b/auto_install/install.sh
index 5e5f80a..50bf3af 100755
--- a/auto_install/install.sh
+++ b/auto_install/install.sh
@@ -37,9 +37,6 @@ easyrsaRel="https://github.com/OpenVPN/easy-rsa/releases/download/v${easyrsaVer}
 UNATTUPG_RELEASE="1.14"
 UNATTUPG_CONFIG="https://github.com/mvo5/unattended-upgrades/archive/${UNATTUPG_RELEASE}.tar.gz"
 
-WG_SNAPSHOT="0.0.20191012"
-WG_SOURCE="https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${WG_SNAPSHOT}.tar.xz"
-
 # Find the rows and columns. Will default to 80x24 if it can not be detected.
 screen_size=$(stty size 2>/dev/null || echo 24 80)
 rows=$(echo $screen_size | awk '{print $1}')
@@ -738,9 +735,12 @@ Pin-Priority: 500" | $SUDO tee /etc/apt/preferences.d/limit-unstable > /dev/null
 	elif [ "$(uname -m)" = "armv6l" ]; then
 
 		echo "::: Installing WireGuard from source... "
-		PIVPN_DEPS=(checkinstall dkms libmnl-dev libelf-dev raspberrypi-kernel-headers build-essential pkg-config qrencode)
+		PIVPN_DEPS=(checkinstall dkms libmnl-dev libelf-dev raspberrypi-kernel-headers build-essential pkg-config qrencode jq)
 		installDependentPackages PIVPN_DEPS[@]
 
+		WG_SNAPSHOT="$(curl -s https://build.wireguard.com/distros.json | jq -r '."upstream-kmodtools"."version"')"
+		WG_SOURCE="https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${WG_SNAPSHOT}.tar.xz"
+
 		# Delete any leftover code
 		$SUDO rm -rf /usr/src/wireguard-*
 
@@ -804,6 +804,8 @@ Pin-Priority: 500" | $SUDO tee /etc/apt/preferences.d/limit-unstable > /dev/null
 			exit 1
 		fi
 
+		echo "WG_SNAPSHOT=${WG_SNAPSHOT}" >> /tmp/setupVars.conf
+
 	elif [ "$(uname -m)" = "x86_64" ] || [ "$(uname -m)" = "i686" ]; then
 
 		echo "::: Installing WireGuard from Debian package... "
diff --git a/scripts/uninstall.sh b/scripts/uninstall.sh
index 646de20..56ffbe7 100755
--- a/scripts/uninstall.sh
+++ b/scripts/uninstall.sh
@@ -2,7 +2,6 @@
 # PiVPN: Uninstall Script
 
 PKG_MANAGER="apt-get"
-WG_SNAPSHOT="0.0.20191012"
 setupVars="/etc/pivpn/setupVars.conf"
 
 if [ ! -f "${setupVars}" ]; then

From 34c10a81f3bf0c9dbde852075e7335145341bc7e Mon Sep 17 00:00:00 2001
From: Orazio <orazioedoardo@users.noreply.github.com>
Date: Sat, 16 Nov 2019 21:25:34 +0100
Subject: [PATCH 5/6] Renamed pivpnDOMAIN to pivpnSEARCHDOMAIN

---
 auto_install/install.sh         | 24 ++++++++++++------------
 unattended_openvpn_example.conf |  2 +-
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/auto_install/install.sh b/auto_install/install.sh
index 50bf3af..234ffe1 100755
--- a/auto_install/install.sh
+++ b/auto_install/install.sh
@@ -1061,17 +1061,17 @@ validDomain(){
 #This procedure allows a user to specify a custom search domain if they have one.
 askCustomDomain(){
 	if [ "${runUnattended}" = 'true' ]; then
-		if [ -n "$pivpnDOMAIN" ]; then
-			if validDomain "$pivpnDOMAIN"; then
-				echo "::: Using custom domain $pivpnDOMAIN"
+		if [ -n "$pivpnSEARCHDOMAIN" ]; then
+			if validDomain "$pivpnSEARCHDOMAIN"; then
+				echo "::: Using custom domain $pivpnSEARCHDOMAIN"
 			else
-				echo "::: Custom domain $pivpnDOMAIN is not valid"
+				echo "::: Custom domain $pivpnSEARCHDOMAIN is not valid"
 				exit 1
 			fi
 		else
 			echo "::: Skipping custom domain"
 		fi
-		echo "pivpnDOMAIN=${pivpnDOMAIN}" >> /tmp/setupVars.conf
+		echo "pivpnSEARCHDOMAIN=${pivpnSEARCHDOMAIN}" >> /tmp/setupVars.conf
 		return
 	fi
 
@@ -1081,16 +1081,16 @@ askCustomDomain(){
 
 		until [[ $DomainSettingsCorrect = True ]]
 		do
-			if pivpnDOMAIN=$(whiptail --inputbox "Enter Custom Domain\nFormat: mydomain.com" ${r} ${c} --title "Custom Domain" 3>&1 1>&2 2>&3); then
-				if validDomain "$pivpnDOMAIN"; then
-					if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Are these settings correct?\n    Custom Search Domain: $pivpnDOMAIN" ${r} ${c}); then
+			if pivpnSEARCHDOMAIN=$(whiptail --inputbox "Enter Custom Domain\nFormat: mydomain.com" ${r} ${c} --title "Custom Domain" 3>&1 1>&2 2>&3); then
+				if validDomain "$pivpnSEARCHDOMAIN"; then
+					if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Are these settings correct?\n    Custom Search Domain: $pivpnSEARCHDOMAIN" ${r} ${c}); then
 						DomainSettingsCorrect=True
 					else
 						# If the settings are wrong, the loop continues
 						DomainSettingsCorrect=False
 					fi
 				else
-					whiptail --msgbox --backtitle "Invalid Domain" --title "Invalid Domain" "Domain is invalid. Please try again.\n\n    DOMAIN:   $pivpnDOMAIN\n" ${r} ${c}
+					whiptail --msgbox --backtitle "Invalid Domain" --title "Invalid Domain" "Domain is invalid. Please try again.\n\n    DOMAIN:   $pivpnSEARCHDOMAIN\n" ${r} ${c}
 					DomainSettingsCorrect=False
 				fi
 			else
@@ -1100,7 +1100,7 @@ askCustomDomain(){
 		done
 	fi
 
-	echo "pivpnDOMAIN=${pivpnDOMAIN}" >> /tmp/setupVars.conf
+	echo "pivpnSEARCHDOMAIN=${pivpnSEARCHDOMAIN}" >> /tmp/setupVars.conf
 }
 
 askPublicIPOrDNS(){
@@ -1313,8 +1313,8 @@ set_var EASYRSA_KEY_SIZE   ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null
 		$SUDO sed -i "s/proto udp/proto tcp/g" /etc/openvpn/server.conf
 	fi
 
-	if [ -n "$pivpnDOMAIN" ]; then
-		$SUDO sed -i "0,/\(.*dhcp-option.*\)/s//\push \"dhcp-option DOMAIN ${pivpnDOMAIN}\" \n&/" /etc/openvpn/server.conf
+	if [ -n "$pivpnSEARCHDOMAIN" ]; then
+		$SUDO sed -i "0,/\(.*dhcp-option.*\)/s//\push \"dhcp-option DOMAIN ${pivpnSEARCHDOMAIN}\" \n&/" /etc/openvpn/server.conf
 	fi
 
 	# write out server certs to conf file
diff --git a/unattended_openvpn_example.conf b/unattended_openvpn_example.conf
index 6f96a74..2885d65 100644
--- a/unattended_openvpn_example.conf
+++ b/unattended_openvpn_example.conf
@@ -7,6 +7,6 @@ pivpnDNS1=8.8.8.8
 pivpnDNS2=8.8.4.4
 pivpnHOST=pivpn.example.com
 pivpnENCRYPT=2048
-pivpnDOMAIN=domain.example.com
+pivpnSEARCHDOMAIN=searchdomain.example.com
 DOWNLOAD_DH_PARAM=0
 UNATTUPG=1

From 1ff6f7e9e89a2f3e449325d457011aa013ed05ef Mon Sep 17 00:00:00 2001
From: Orazio <orazioedoardo@users.noreply.github.com>
Date: Mon, 18 Nov 2019 12:42:04 +0100
Subject: [PATCH 6/6] Removed trivial command output

---
 auto_install/install.sh       | 10 +++++-----
 scripts/openvpn/pivpnDebug.sh |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/auto_install/install.sh b/auto_install/install.sh
index 234ffe1..7f898e7 100755
--- a/auto_install/install.sh
+++ b/auto_install/install.sh
@@ -1222,7 +1222,7 @@ confOpenVPN(){
 	# Backup the openvpn folder
 	OPENVPN_BACKUP="openvpn_$(date +%Y-%m-%d-%H%M%S).tar.gz"
 	echo "::: Backing up the openvpn folder to /etc/${OPENVPN_BACKUP}"
-	$SUDO tar czf "/etc/${OPENVPN_BACKUP}" /etc/openvpn
+	$SUDO tar czf "/etc/${OPENVPN_BACKUP}" /etc/openvpn &> /dev/null
 
 	if [ -f /etc/openvpn/server.conf ]; then
 		$SUDO rm /etc/openvpn/server.conf
@@ -1346,7 +1346,7 @@ confWireGuard(){
 		# Backup the wireguard folder
 		WIREGUARD_BACKUP="wireguard_$(date +%Y-%m-%d-%H%M%S).tar.gz"
 		echo "::: Backing up the wireguard folder to /etc/${WIREGUARD_BACKUP}"
-		$SUDO tar czf "/etc/${WIREGUARD_BACKUP}" /etc/wireguard
+		$SUDO tar czf "/etc/${WIREGUARD_BACKUP}" /etc/wireguard &> /dev/null
 
 		if [ -f /etc/wireguard/wg0.conf ]; then
 			$SUDO rm /etc/wireguard/wg0.conf
@@ -1386,7 +1386,7 @@ ListenPort = ${pivpnPORT}" | $SUDO tee /etc/wireguard/wg0.conf &> /dev/null
 confNetwork(){
 	# Enable forwarding of internet traffic
 	$SUDO sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
-	$SUDO sysctl -p
+	$SUDO sysctl -p > /dev/null
 
 	# if ufw enabled, configure that (running as root because sometimes the executable is not in the user's $PATH, on Debian for example)
 	if $SUDO bash -c 'hash ufw' 2>/dev/null; then
@@ -1708,10 +1708,10 @@ main(){
 	case ${PLAT} in
 		Debian|Raspbian)
 			if [ "$VPN" = "openvpn" ]; then
-				$SUDO systemctl enable openvpn.service
+				$SUDO systemctl enable openvpn.service &> /dev/null
 				$SUDO systemctl start openvpn.service
 			elif [ "$VPN" = "wireguard" ]; then
-				$SUDO systemctl enable wg-quick@wg0.service
+				$SUDO systemctl enable wg-quick@wg0.service &> /dev/null
 				$SUDO systemctl start wg-quick@wg0.service
 			fi
 		;;
diff --git a/scripts/openvpn/pivpnDebug.sh b/scripts/openvpn/pivpnDebug.sh
index a205ba0..c3ce10d 100755
--- a/scripts/openvpn/pivpnDebug.sh
+++ b/scripts/openvpn/pivpnDebug.sh
@@ -184,7 +184,7 @@ else
     fi
 fi
 
-# grep -w (whole word) is used so port 111940 with now match when looking for 1194
+# grep -w (whole word) is used so port 11940 won't match when looking for 1194
 if netstat -uanpt | grep openvpn | grep -w "${pivpnPORT}" | grep -q "${pivpnPROTO}"; then
     echo ":: [OK] OpenVPN is listening on port ${pivpnPORT}/${pivpnPROTO}"
 else