Access Private Server with GitHub Actions (VPN connection)

Today I will talk about GitHub Actions. This feature of GitHub helps you to create CI/CD pipeline for your repository.

First, I will give brief information. Then, I will move on to details of accessing servers that can be connected via VPN.

GitHub Action

This is a feature of GitHub that helps you to create CI/CD pipelines. You can find the documentation of it by using this link.

In simple, I can explain it to you like this. When a programmer pushes something to the repository, there might be an error whose test is missed by the programmer. Or, you want to deploy the new version of the repository to your server immediately and save an amount of time that is usually wasted to update files in the server. Or, you may want to create a more dynamic workspace for your developers to speed up!

These problems can be solved by using GitHub Actions. Also, there are some other options. Jenkins is one of the best options for this operation. You may want to take a look at it.

Connecting to VPN

I know that you have some information about GitHub Action. So, I cut it short.

Let’s move on to some real deals…

If you want to access your VPN server by using GitHub Action, you need to give some information to GitHub. Save those pieces of information on your secrets. This is very important because they are really important. If you make them secret, no one will find out about them.

List of needed secrects

VPN_USERNAME : VPN user name

VPN_PASSWORD : VPN password

USER_KEY : <key> Inside .ovpn file just

here is the user key do not take “<key></key>”

</key>

SERVER_HOST : IP address of server for SSH connection

SERVER_USERNAME : username for SSH

SSH_PRIVATE_KEY : classic ssh key for GitHub which is created inside of server you want to access

You can find your user key inside the .ovpn file. After saving these components to your repository as a secret. We can move on next step.

Save your client.ovpn file inside .github/workflows directory .ovpn file name can vary, you can change it if you want. You may think that could be a security problem. In my opinion, If you want to access a private server by using GitHub Action, this means that you are working inside of a private repository. And collaborators can see this kind of thinks, it is a team. If you want to make it more secure, of course, there are some ways to do it. You can save all components of your .ovpn file as a secret, then give them to the .yml file.

First part of main.yml :

name: GitHub Action

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Install OpenVPN
        run: |
          sudo apt update
          sudo apt install -y openvpn openvpn-systemd-resolved
      - name: Connect to VPN
        uses: "kota65535/github-openvpn-connect-action@v2"
        with:
          config_file: .github/workflows/client.ovpn
          username: ${{ secrets.OVPN_USERNAME }}
          password: ${{ secrets.OVPN_PASSWORD }}
          client_key: ${{ secrets.USER_KEY }}

To access VPN I used kota65535/github-openvpn-connect-action@v2, I saved the link, check it if you want.

If your credentials are true, this will connect to your VPN. It will run in background.

Now we have to connect server with SSH :

      - name: Use SSH
        uses: appleboy/ssh-action@master
        with: 
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd go/to/directory
            git pull

To access server with SSH I used appleboy/ssh-action@master. Again, I added link for you to check it out.

Full Code :

name: GitHub Action

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Install OpenVPN
        run: |
          sudo apt update
          sudo apt install -y openvpn openvpn-systemd-resolved
      - name: Connect to VPN
        uses: "kota65535/github-openvpn-connect-action@v2"
        with:
          config_file: .github/workflows/client.ovpn
          username: ${{ secrets.OVPN_USERNAME }}
          password: ${{ secrets.OVPN_PASSWORD }}
          client_key: ${{ secrets.USER_KEY }}
      - name: Use SSH
        uses: appleboy/ssh-action@master
        with: 
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd go/to/directory
            git pull

Note :

If your VPN’s password is changing always for high security, this .yml file will not help you to automate. Your solution will be different from this. This is just for static passwords.

Thank you for reading.