Show OpenVPN OIDC prerequisites and exposed management port

backend/internal/tlsservice/tlsservice.go

@@ -51,6 +51,7 @@ type CertificateStatus struct {
 	NotBefore        time.Time `json:"not_before,omitempty"`
 	NotAfter         time.Time `json:"not_after,omitempty"`
 	Renewal          string    `json:"renewal_mode"`
+	DirectPortPublic bool      `json:"management_direct_public"`
 }
 
 func ValidDomain(domain string) bool {
@@ -222,6 +223,15 @@ func Status() CertificateStatus {
 	config := state.config
 	state.RUnlock()
 	status := CertificateStatus{Enabled: config.domain != "" && config.mode == "autocert", Domain: config.domain, Mode: config.mode, DNS: []string{}, HTTPAddr: config.httpAddr, HTTPSAddr: config.httpsAddr, Renewal: config.mode}
+	if config.mode == "nginx" {
+		listenAddress := os.Getenv("VPN_LISTEN_ADDR")
+		if listenAddress == "" {
+			listenAddress = ":18080"
+		}
+		if host, _, err := net.SplitHostPort(listenAddress); err == nil {
+			status.DirectPortPublic = host == "" || host == "0.0.0.0" || host == "::"
+		}
+	}
 	if desired, err := configFromEnvironment(config.dataDir); err == nil {
 		status.ConfiguredDomain = desired.domain
 		status.ConfiguredMode = desired.mode
@@ -233,7 +243,9 @@ func Status() CertificateStatus {
 		status.Domain = ""
 		if config.domain != "" {
 			readCertificate(filepath.Join("/etc/letsencrypt/live", config.domain, "fullchain.pem"), config.domain, &status)
-			if status.Valid { status.Domain = config.domain }
+			if status.Valid {
+				status.Domain = config.domain
+			}
 		}
 		return status
 	}