GitLab Pipeline中OpenVPN启动失败问题求助

问题描述 #

在GitLab Pipeline中尝试通过OpenVPN连接服务器拉取项目时，执行openvpn --config /etc/openvpn/client.conf --daemon后直接报错退出，无详细错误日志输出。

现有.gitlab-ci.yml配置 #

image: cypress/base:10

stages:
  - deployment

deploy:
  stage: deployment

  before_script:
    ## VPN
  - which openvpn || (apt-get update -y -qq && apt-get install -y -qq openvpn) # Install openvpn if not available.
  - cat <<< $CLIENT_OVPN > /etc/openvpn/client.conf # Move vpn config from gitlab variable to config file.
  - cat <<< $VPN_U > /etc/openvpn/pass.txt # Move vpn user from gitlab variable to pass file.
  - cat <<< $VPN_P >> /etc/openvpn/pass.txt # Move vpn password from gitlab variable to pass file.
  - cat <<< \"auth-user-pass /etc/openvpn/pass.txt\" >> /etc/openvpn/client.conf # Tell vpn config to use password file.
  - cat <<< \"log /etc/openvpn/client.log\" >> /etc/openvpn/client.conf # Tell vpn config to use log file.
  - openvpn --config /etc/openvpn/client.conf --daemon # Start openvpn with config as a deamon.
  - sleep 30s # Wait for some time so the vpn can connect before doing anything else.
  - cat /etc/openvpn/client.log # Print the vpn log.
  - ping -c \"server IP\" <IP> # Ping the server I want to deploy to. If not available this stops the deployment process.    
   ##
   ## SSH
   ## Inspiration for gitlab from https://docs.gitlab.com/ee/ci/ssh_keys/
   ## Inpsiration for new key from https://www.thomas-krenn.com/de/wiki/OpenSSH_Public_Key_Authentifizierung_unter_Ubuntu
   ##
  - which ssh-agent || (apt-get update -y -qq && apt-get install openssh-client -y -qq) # Install ssh-agent if not available.
  - eval $(ssh-agent -s) # Run ssh-agent.
  - mkdir -p ~/.ssh # Create ssh directory.
  - cat <<< $SSH_PRIVATE_KEY > ~/.ssh/id_rsa # Move ssh key from gitlab variable to file.
  - chmod 700 ~/.ssh/id_rsa  # Set permissions so only I am allowed to access my ssh key.
  - ssh-add # Add the key (no params -> default file name assumed).
  - cat <<< $SSH_KNOWN_HOSTS_DMS > ~/.ssh/known_hosts # Add the servers SSH Key to known_hosts prevent man in the middle attack.
  script:
    - ssh root@\"server IP\" \"cd ../var/www/html/\"projetct-name\" && git checkout master && git pull && exit\"
  only:
  - main

错误输出 #

$ cat <<< $CLIENT_OVPN > /etc/openvpn/client.conf
$ cat <<< $VPN_U > /etc/openvpn/pass.txt
$ cat <<< $VPN_P >> /etc/openvpn/pass.txt
$ cat <<< \"auth-user-pass /etc/openvpn/pass.txt\" >> /etc/openvpn/client.conf
$ cat <<< \"log /etc/openvpn/client.log\" >> /etc/openvpn/client.conf
$ openvpn --config /etc/openvpn/client.conf --daemon
Cleaning up project directory and file based variables

ERROR: Job failed: exit code 1

排查与解决步骤 #

1. 修复配置文件写入的转义错误 #

cat <<< \"xxx\"的写法会导致写入client.conf的内容包含多余引号，OpenVPN无法识别正确配置项。替换为以下两种正确写法之一：

# 方法1：使用echo直接写入
- echo "auth-user-pass /etc/openvpn/pass.txt" >> /etc/openvpn/client.conf
- echo "log /etc/openvpn/client.log" >> /etc/openvpn/client.conf

# 方法2：使用EOF批量写入
- cat <<EOF >> /etc/openvpn/client.conf
auth-user-pass /etc/openvpn/pass.txt
log /etc/openvpn/client.log
EOF

2. 设置正确的文件权限 #

OpenVPN对配置文件、密码文件的权限有严格要求，需设置只读权限避免报错：

- chmod 600 /etc/openvpn/client.conf
- chmod 600 /etc/openvpn/pass.txt

3. 前台运行OpenVPN获取详细错误 #

去掉--daemon参数，让OpenVPN前台运行，直接查看启动时的错误信息（比如配置格式错误、证书缺失、网络问题等）：

- openvpn --config /etc/openvpn/client.conf
# 暂时注释sleep、ping等后续步骤，优先排查启动错误

4. 验证GitLab变量的正确性 #

确保CLIENT_OVPN、VPN_U、VPN_P等项目变量配置无误：

• CLIENT_OVPN需包含完整的OpenVPN客户端配置（含证书、密钥、远程服务器地址等），无多余换行或格式错误
• VPN_U和VPN_P为纯文本用户名/密码，特殊字符需提前转义

5. 开启容器网络权限 #

GitLab Runner容器默认无创建VPN隧道的权限，需在配置中添加特权模式：

deploy:
  stage: deployment
  privileged: true # 启用特权模式以创建网络接口

6. 修复SSH命令的语法错误 #

原script中的SSH命令存在引号嵌套错误，且路径使用../易出问题，修正为：

- ssh root@<server-IP> "cd /var/www/html/project-name && git checkout master && git pull"

（注意修正项目名称拼写错误projetct-name→project-name）

优化后的完整配置示例 #

image: cypress/base:10

stages:
  - deployment

deploy:
  stage: deployment
  privileged: true
  before_script:
    # VPN配置
    - which openvpn || (apt-get update -y -qq && apt-get install -y -qq openvpn)
    - cat <<< "$CLIENT_OVPN" > /etc/openvpn/client.conf
    - echo "$VPN_U" > /etc/openvpn/pass.txt
    - echo "$VPN_P" >> /etc/openvpn/pass.txt
    - cat <<EOF >> /etc/openvpn/client.conf
auth-user-pass /etc/openvpn/pass.txt
log /etc/openvpn/client.log
EOF
    - chmod 600 /etc/openvpn/client.conf
    - chmod 600 /etc/openvpn/pass.txt
    # 先前台运行排查错误，确认正常后再改回后台
    # - openvpn --config /etc/openvpn/client.conf
    - openvpn --config /etc/openvpn/client.conf --daemon
    - sleep 30s
    - cat /etc/openvpn/client.log
    - ping -c 3 <server-IP>
    # SSH配置
    - which ssh-agent || (apt-get update -y -qq && apt-get install openssh-client -y -qq)
    - eval $(ssh-agent -s)
    - mkdir -p ~/.ssh
    - cat <<< "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
    - chmod 700 ~/.ssh/id_rsa
    - chmod 600 ~/.ssh/known_hosts
    - ssh-add ~/.ssh/id_rsa
    - cat <<< "$SSH_KNOWN_HOSTS_DMS" >> ~/.ssh/known_hosts
  script:
    - ssh root@<server-IP> "cd /var/www/html/project-name && git checkout master && git pull"
  only:
    - main

内容的提问来源于stack exchange，提问作者Rodrigo Freitas