/etc/openvpn/start.sh: line 321: OPENVPN_OPTS: unbound variable

[himred]

Since the latest release, I get this error and the container stays down ....
Here is my docker-compose that always worked like a charm for many years

 torrent:
  image: haugene/transmission-openvpn
  container_name: torrent
  hostname: torrent
  cap_add:
    - NET_ADMIN
  devices:
    - /dev/net/tun
  restart: always

  dns:
    - 8.8.8.8
    - 8.8.4.4

  volumes:
    - /etc/localtime:/etc/localtime:ro
    - tor_data:/data
    - tor_scripts:/scripts

  logging:
    driver: "json-file"
    options:
      max-size: "50m"
      max-file: "2"

  environment:
    - OPENVPN_PROVIDER=NORDVPN
    - OPENVPN_USERNAME=***********
    - OPENVPN_PASSWORD=**********
    - NORDVPN_COUNTRY=nl
    - NORDVPN_PROTOCOL=udp
    - HEALTH_CHECK_HOST=8.8.8.8
    - LOCAL_NETWORK=192.168.56.0/24
    - NORDVPN_CATEGORY=legacy_p2p

volumes:
  data:
  tor_data:
  tor_scripts:

The countainer output is:

Starting container with revision: f9cb4dea2da1a3aa63bd3945e0162c9b8a9789a4
Creating TUN device /dev/net/tun
Using OpenVPN provider: NORDVPN
Running with VPN_CONFIG_SOURCE auto
Provider NORDVPN has a bundled setup script. Defaulting to internal config
Executing setup script for NORDVPN
INFO: OVPN: Checking curl installation
INFO: OVPN: DNS resolution ok
INFO: OVPN: ok, configurations download site reachable
INFO: OVPN: Removing existing configs in /etc/openvpn/nordvpn
Checking NORDPVN API responses
INFO: OVPN:Selecting the best server...
INFO: OVPN: Searching for country : nl (153)
INFO: OVPN: Searching for group: legacy_p2p
INFO: OVPN:Searching for technology: openvpn_udp
INFO: OVPN: Best server : nl821.nordvpn.com, load: 9
INFO: OVPN: Downloading config: nl821.nordvpn.com.ovpn
INFO: OVPN: Downloading from: https://downloads.nordcdn.com/configs/files/ovpn_udp/servers/nl821.nordvpn.com.udp.ovpn
Starting OpenVPN using config nl821.nordvpn.com.ovpn
Modifying /etc/openvpn/nordvpn/nl821.nordvpn.com.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 192.168.56.0/24 via 192.168.56.254 dev eth0
/etc/openvpn/start.sh: line 321: OPENVPN_OPTS: unbound variable

[Solamain]

try adding - OPENVPN_OPTS= just after the - OPENVPN_PASSWORD line in the compose file.

[himred]

Unfortunately, that does not help, now I have:

adding route to local network 192.168.56.0/24 via 192.168.56.254 dev eth0
Options error: the --route-pre-down directive should have at most 1 parameter.  To pass a list of arguments as one of the parameters, try enclosing them in double quotes ("").
Use --help for more information.

[Solamain]

Sorry, try it without the double quotes, just have OPENVPN_OPTS=
Have been up working server side for 19 hours now and missed a coffee break. lol

[himred]

It worked, thank you for your help !

[Solamain]

Always glad to chip in when and where I can.

[haugene]

Thanks for reporting this. It seems to be related to the NordVpn config script setting the -u option:

docker-transmission-openvpn/openvpn/nordvpn/configure-openvpn.sh

Line 22 in f9cb4de

set -e -u -o pipefail

Tested locally by just echoing an unset variable in my shell:

$ echo $OPENVPN_OPTS

$ set -u
$ echo $OPENVPN_OPTS
bash: OPENVPN_OPTS: unbound variable

[haugene]

Two options here. Remove the -u from the NordVpn config script, or add OPENVPN_OPTS= as an empty default value in the Dockerfile. It seems to be quite deliberately added in #2142 as a best practice, ref: https://github.com/haugene/docker-transmission-openvpn/pull/2142/files#r780641741

So I guess we should add this to the Dockerfile as well 👍

[haugene]

This should be fixed through aba1e29

If you pull the latest image again it should run fine without you setting it in your docker-compose 👍

[himred]

Thanks haugene, it's fixed now.

[haugene]

Great, glad to hear it worked as expected. If you mark one of the replies as a solution then this discussion will get the nice green check mark for others who might come looking for answers :)

[himred]

Unfortunately, I dont have this option available

[haugene]

According to this you should have a check mark option on the comments, but it's no big deal 👍

[martdj]

I have the same error. Adding OPENVPN_OPTS= didn't solve it for me, but if I read this thread well, this shouldn't have been necessary anymore anyway. Any idea what could be wrong? This is my log:
Starting container with revision: 1103172
TRANSMISSION_HOME is currently set to: /config/transmission-home
Creating TUN device /dev/net/tun
Using OpenVPN provider: NORDVPN
Running with VPN_CONFIG_SOURCE auto
Provider NORDVPN has a bundled setup script. Defaulting to internal config
Executing setup script for NORDVPN
/etc/openvpn/nordvpn/..
INFO: OVPN: Checking curl installation
INFO: OVPN: DNS resolution ok
INFO: OVPN: ok, configurations download site reachable
INFO: OVPN: Removing existing configs in /etc/openvpn/nordvpn
Checking NORDPVN API responses
INFO: OVPN:Selecting the best server...
INFO: OVPN: Searching for country : GB (227)
INFO: OVPN: Searching for group: legacy_p2p
INFO: OVPN:Searching for technology: openvpn_tcp
INFO: OVPN: Best server : uk2085.nordvpn.com, load: 17
Best server : uk2085.nordvpn.com
INFO: OVPN: Downloading config: uk2085.nordvpn.com.ovpn
INFO: OVPN: Downloading from: https://downloads.nordcdn.com/configs/files/ovpn_tcp/servers/uk2085.nordvpn.com.tcp.ovpn
OVPN: NORDVPN: selected: uk2085.nordvpn.com, VPN_PROVIDER_HOME: /etc/openvpn/nordvpn
Starting OpenVPN using config uk2085.nordvpn.com.ovpn
Modifying /etc/openvpn/nordvpn/uk2085.nordvpn.com.ovpn for best behaviour in this container
Modification: Point auth-user-pass option to the username/password file
Modification: Change ca certificate path
Modification: Change ping options
Modification: Update/set resolv-retry to 15 seconds
Modification: Change tls-crypt keyfile path
Modification: Set output verbosity to 3
Modification: Remap SIGUSR1 signal to SIGTERM, avoid OpenVPN restart loop
Modification: Updating status for config failure detection
Setting OpenVPN credentials...
adding route to local network 192.168.7.0/24 via 10.88.0.1 dev eth0
/etc/openvpn/start.sh: line 342: OPENVPN_OPTS: unbound variable

[edgd1er]

Nordvpn as far as I remember is sending low ping value, to have a better resilience to inactivity, OPENVPN_OPTS should be set to --inactive 3600 --ping 10 --ping-exit 60 --pull-filter ignore "ping"

If you do not wish to overwrite pushed settings, then a space should be enough to start the container. I have to tested it though.

OPENVPN_OPTS=' '

[martdj]

Thanks for the help. Adding the space or the options you gave gives me this error:
Options error: the --route-pre-down directive should have at most 1 parameter. To pass a list of arguments as one of the parameters, try enclosing them in double quotes ("").

I don't know if there's something wrong with my environment variables. These are the variables I use:
PUID=498
PGID=498
TZ=Europe/Amsterdam
OPENVPN_PROVIDER=NORDVPN
OPENVPN_USERNAME=***
OPENVPN_PASSWORD=***
OPENVPN_OPTS='--inactive 3600 --ping 10 --ping-exit 60 --pull-filter ignore "ping"'
LOCAL_NETWORK=192.168.7.0/24
TRANSMISSION_DOWNLOAD_DIR=/downloads
TRANSMISSION_INCOMPLETE_DIR=/downloads/incomplete
TRANSMISSION_WEB_UI=flood-for-transmission
TRANSMISSION_RPC_USERNAME=***
TRANSMISSION_RPC_PASSWORD=***
NORDVPN_COUNTRY=GB
NORDVPN_CATEGORY=legacy_p2p

[martdj]

Realised that if I simply add the OPENVPN_OPTS environment variable in the docker run statement, it does work. It's just the env-file where it gives problems

[wildoracle]

1. How did you know what to enter for the PUID and PGID?
2. I'm running in Synology and Container Manager it won't allow me to enter empty values in any fields. I've tried using double quote but didn't seem to fix anything.
3. I also have the "--route-pre-down" error in my logs and have no idea how to fix it.
4. How did you know what to enter for OPENVPN_OPTS?
5. How did you know what to enter for TRANSMISSION_WEB_UI?

[martdj]

These questions are more related to containers in general than to this particular container image, but let me try to give some answers:

1. the PUID/PGID are dependent on your host and the permissions you have on your host. The most important thing is that the uid/gid you choose has R/W permissions on a persistent volumes of the container. I created a special transmission user on my host, but you can use a generic user and, for example, assign 1000/1000 as PUID/PGID
2. I don't know what it looks like on a Synology. This is my run command:
   /usr/bin/podman run -it --privileged --name transmission-vpn -v /shared/download/:/data -v /local/transmission/transmission-home:/config/transmission-home --env-file=/local/transmission/env_file -e OPENVPN_OPTS=" " --log-driver json-file --log-opt max-size=10m -p 127.0.0.1:9091:9091 haugene/transmission-openvpn
3. For me the fix was to add empty OPENVPN_OPTS. See above
4. See the answer from edgd1er.
5. That's the url where you want to be able to access your transmssion. I have nginx as reverse proxy in front, so the address points to my nginx.

[wildoracle]

[wildoracle]

Narrowing down the problem, I've noticed that if I wrap my settings for OPENVPN_OPTS in ' ' (like in the screenshot) I get the --route-pre-down error.
If I leave the ' ' out, I get the error posted just above. AUTH_FAILED. I'll doublecheck my NORD password.

[wildoracle]

THANK YOU ALL! I got this thing working now and staying connected!
For the SYNOLOGY users out there, hopefully these two tips help:

1. you DO have to include LOCAL_NETWORK and for me that's 192.168.1.0/24 because my local IP of the Synology is 192.168.1.144
2. you DON'T want to use single or double quotes in the OPENVPN_OPTS settings. What worked for me is what @edgd1er shared: --inactive 3600 --ping 10 --ping-exit 60 --pull-filter ignore "ping"

[wildoracle]

Now that I have it working, I'd rather not break anything, but I am getting this warning:

[wildoracle]

I haven't been able to find out how to use the auth-nocache option but I was able to use the .txt file method and then None in my environment variables. Here's a screenshot, since for SYNOLOGY users the specific formatting seems to matter (as mentioend above)

[wildoracle]

Also, I found this link helpful for Synology users trying to figure out their PUID and PGID values:
https://mariushosting.com/synology-find-uid-userid-and-gid-groupid-in-5-seconds/