Update to Ubuntu 24.04 and harden init script

- Base image ubuntu:24.04 (OpenVPN 2.6), install iproute2 explicitly,
  clear apt lists, exec-form CMD so signals reach the script
- Init script: fail fast if VPN_IP is unset or no default gateway,
  use "ip route replace" so restarts don't fail, quote variables,
  make LOCAL_NET and DNS_SERVER configurable (same defaults)

Note: OpenVPN 2.6 ignores "cipher" for negotiation. Client configs
using "cipher aes-128-cbc" need:
  data-ciphers AES-128-GCM:AES-128-CBC
  data-ciphers-fallback AES-128-CBC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -1,10 +1,13 @@
-FROM ubuntu:22.04
+FROM ubuntu:24.04
 
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 
-RUN apt-get update && apt-get -y install openvpn && apt-get clean
+RUN apt-get update \
+    && apt-get -y install --no-install-recommends openvpn iproute2 ca-certificates \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
 
-ADD openvpn_init.sh /sbin/
+COPY openvpn_init.sh /sbin/
 RUN chmod +x /sbin/openvpn_init.sh
 
-CMD /sbin/openvpn_init.sh
+CMD ["/sbin/openvpn_init.sh"]

openvpn_init.sh

@@ -1,23 +1,36 @@
 #!/bin/sh
 
-set -e 
+set -eu
 
 umask 002
 
-VPN_GW=$(/sbin/ip route | awk '/default/ { print $3 }')
-echo Saving gate $VPN_GW 
-echo DELETING DEFAULT GW
+: "${VPN_IP:?VPN_IP must be set to the VPN server address}"
+LOCAL_NET="${LOCAL_NET:-192.168.0.0/16}"
+DNS_SERVER="${DNS_SERVER:-8.8.8.8}"
+
+VPN_GW=$(ip route | awk '/^default/ { print $3; exit }')
+if [ -z "$VPN_GW" ]; then
+    echo "No default gateway found" >&2
+    exit 1
+fi
+echo "Saving gateway $VPN_GW"
+
+echo "Deleting default gateway"
 ip route del default
-echo SETTING $VPN_IP as the only ip to get routed through $VPN_GW 
-ip route add $VPN_IP via $VPN_GW
-echo Adding 192.168.0.0/16 to the route
-ip route add 192.168.0.0/16 via $VPN_GW
-echo "nameserver 8.8.8.8" > /etc/resolv.conf
-echo Starting openvpn
+
+echo "Routing only $VPN_IP through $VPN_GW"
+ip route replace "$VPN_IP" via "$VPN_GW"
+
+echo "Routing $LOCAL_NET through $VPN_GW"
+ip route replace "$LOCAL_NET" via "$VPN_GW"
+
+echo "nameserver $DNS_SERVER" > /etc/resolv.conf
+
 ip route
+echo "Starting openvpn"
 cd /vpn
 
-until openvpn vpn; do
+until openvpn --config vpn; do
     echo "Openvpn crashed, respawning"
     sleep 10
-done 
+done