Planning an OpenVPN maintenance window without losing the host

Restarting the VPN service ends every session using it, so the window has to be built around conversations rather than around the package manager. Users need enough notice to finish sensitive work, and you need a way back in that does not depend on the tunnel you are about to stop. Everything else in the playbook exists to make those two facts manageable. Skip either one and a routine update becomes an outage with no exit.

The order below is deliberate: each stage produces something the next stage needs, and any stage can end the change before it starts.

Capture the service that exists before changing it

Read the installed unit rather than the one you remember writing: systemctl cat [email protected] prints the unit and any drop-ins, and systemctl show [email protected] -p ExecStart -p User -p WorkingDirectory shows what actually runs and as whom. Query the binary that unit names, because openvpn --version from a shell may resolve to a different build. Record the profile path and every file it references.

Note the listening sockets as well: ss -lunp | grep 1194 tells you which address and protocol the daemon owns today. If the answer is not what the profile suggests, a drop-in or an environment file is overriding it, and the upgrade will inherit that surprise.

Assemble a recovery set someone else could use

The recovery set has to be usable by a colleague at 03:00 without your context. Include the effective configuration with every referenced file, the trust and revocation material under the PKI owner's control, the per-client assignments and hooks, and the exact package versions installed today. A copy of one filename is not a configuration. Store it somewhere the on-call operator can reach without the VPN.

Access controls apply to that set too, because it contains private keys or backend credentials. Do not rebuild the CA or reissue identities just because a package version changed.

Rehearse on a pilot listener with a real client

Run the candidate release on a separate listener with its own port and address plan, not beside the production instance on the same socket. Connect with the client engines your users actually run, including the awkward one. Check address assignment, pushed DNS, one application that matters, and one path that should stay blocked. Custom hooks must run in the service's real privilege and filesystem context, since a root shell proves nothing about them.

Read the release notes for behaviour changes rather than only for new features. Cipher and TLS defaults move between versions, and a profile that still parses can still fail a handshake. If the upgrade needs profile or certificate changes, stage that as its own step instead of bundling it into the package update.

Cut over once, from a path outside the tunnel

Start the window from a console or a management network that does not traverse the service. Confirm users were told and a second operator knows how to roll back. Apply the prepared change through its owner, then restart with sudo systemctl restart [email protected] and follow the journal with journalctl -u openvpn-server@office -b -f. A reload is enough when only unit definitions changed; a changed profile needs the process restarted.

Expect every client to reconnect, and expect some application sessions not to resume. Coordinate a clean pause with the workloads that cannot tolerate that.

Accept or roll back, then tell users what changed

Acceptance is a fresh login plus a real operation plus the restrictions still in place. An active unit and a green status line are process facts. If the criteria fail inside the window, roll back with the prepared method, not by restoring a single file and hoping; a changed binary or service policy survives a configuration restore. Preserve any revocation or authorization change made during the window so the rollback does not undo security work.

Record the versions, profile changes and acceptance results for the next operator, retire the pilot listener, and tell users which profile to use now. A window that ends without that note gets re-litigated at the next update.