fix(health): use TCP dialing instead of ping

- `HEALTH_TARGET_ADDRESS` to replace `HEALTH_ADDRESS_TO_PING`
- Remove `github.com/go-ping/ping` dependency
- Dial TCP the target address, appending `:443` if port is not set

.devcontainer/devcontainer.json

@@ -8,7 +8,7 @@
         "vscode"
     ],
     "shutdownAction": "stopCompose",
-    "postCreateCommand": "source ~/.windows.sh && go mod download && go mod tidy",
+    "postCreateCommand": "~/.windows.sh && go mod download && go mod tidy",
     "workspaceFolder": "/workspace",
     "extensions": [
         "golang.go",

.github/ISSUE_TEMPLATE/bug.yml

@@ -11,7 +11,9 @@ body:
     id: urgent
     attributes:
       label: Is this urgent?
-      description: Is this a critical bug, or do you need this fixed urgently?
+      description: |
+        Is this a critical bug, or do you need this fixed urgently?
+        If this is urgent, note you can use one of the [image tags available](https://github.com/qdm12/gluetun/wiki/Docker-image-tags) if that can help.
       options:
         - "No"
         - "Yes"
@@ -38,6 +40,7 @@ body:
     attributes:
       label: VPN service provider
       options:
+        - Custom
         - Cyberghost
         - ExpressVPN
         - FastestVPN

.github/labels.yml

@@ -14,6 +14,14 @@
   color: "795548"
   description: ""
 
+# Priority
+- name: "🚨 Urgent"
+  color: "d5232f"
+  description: ""
+- name: "💤 Low priority"
+  color: "4285f4"
+  description: ""
+
 # VPN providers
 - name: ":cloud: Cyberghost"
   color: "cfe8d4"
@@ -39,6 +47,9 @@
 - name: ":cloud: NordVPN"
   color: "cfe8d4"
   description: ""
+- name: ":cloud: Perfect Privacy"
+  color: "cfe8d4"
+  description: ""
 - name: ":cloud: PIA"
   color: "cfe8d4"
   description: ""

.github/workflows/ci.yml

@@ -1,6 +1,24 @@
 name: CI
 on:
+  release:
+    types:
+      - published
   push:
+    branches:
+      - master
+    paths:
+      - .github/workflows/ci.yml
+      - cmd/**
+      - internal/**
+      - pkg/**
+      - .dockerignore
+      - .golangci.yml
+      - Dockerfile
+      - go.mod
+      - go.sum
+  pull_request:
+    branches:
+      - master
     paths:
       - .github/workflows/ci.yml
       - cmd/**
@@ -14,11 +32,17 @@ on:
 
 jobs:
   verify:
+    # Only run if it's a push event or if it's a PR from this repository, and it is not dependabot.
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      (github.event_name == 'push' ||
+      github.event_name == 'release' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository))
     runs-on: ubuntu-latest
     env:
       DOCKER_BUILDKIT: "1"
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v2.4.0
 
       - name: Linting
         run: docker build --target lint .
@@ -44,18 +68,23 @@ jobs:
       - name: Build final image
         run: docker build -t final-image .
 
-      - name: Image security analysis
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: final-image
+      # - name: Image security analysis
+      #   uses: snyk/actions/docker@master
+      #   env:
+      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      #   with:
+      #     image: final-image
 
   publish:
+    # Only run if it's a push event or if it's a PR from this repository
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'release' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
     needs: [verify]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v2.4.0
 
       - uses: docker/setup-qemu-action@v1
       - uses: docker/setup-buildx-action@v1
@@ -65,35 +94,51 @@ jobs:
           username: qmcgaw
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - name: Set variables
-        id: vars
-        env:
-          EVENT_NAME: ${{ github.event_name }}
+      - name: Check for semver tag
+        id: semvercheck
         run: |
-          BRANCH=${GITHUB_REF#refs/heads/}
-          TAG=${GITHUB_REF#refs/tags/}
-          echo ::set-output name=commit::$(git rev-parse --short HEAD)
-          echo ::set-output name=created::$(date -u +%Y-%m-%dT%H:%M:%SZ)
-          if [ "$TAG" != "$GITHUB_REF" ]; then
-            echo ::set-output name=version::$TAG
-            echo ::set-output name=platforms::linux/amd64,linux/386,linux/arm64,linux/arm/v6,linux/arm/v7,linux/ppc64le
-          elif [ "$BRANCH" = "master" ]; then
-            echo ::set-output name=version::latest
-            echo ::set-output name=platforms::linux/amd64,linux/386,linux/arm64,linux/arm/v6,linux/arm/v7,linux/ppc64le
+          if [[ ${{ github.ref }} =~ ^refs\/tags\/v0\.[0-9]+\.[0-9]+$ ]]; then
+            MATCH=true
           else
-            echo ::set-output name=version::$BRANCH
-            echo ::set-output name=platforms::linux/amd64,linux/386,linux/arm64,linux/arm/v6,linux/arm/v7,linux/ppc64le
+            MATCH=false
           fi
+          if [[ ${{ github.ref }} =~ ^refs\/tags\/v[1-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            MATCH=$MATCH_nonzero
+          fi
+          echo ::set-output name=match::$MATCH
+
+      # extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          flavor: |
+            latest=${{ github.ref == 'refs/heads/master' }}
+          images: |
+            qmcgaw/gluetun
+            qmcgaw/private-internet-access
+          tags: |
+            type=ref,event=branch,enable=${{ github.ref != 'refs/heads/master' }}
+            type=ref,event=pr
+            type=ref,event=tag,enable=${{ !startsWith(steps.semvercheck.outputs.match, 'true') }}
+            type=semver,pattern=v{{major}}.{{minor}}.{{patch}},enable=${{ startsWith(steps.semvercheck.outputs.match, 'true') }}
+            type=semver,pattern=v{{major}}.{{minor}},enable=${{ startsWith(steps.semvercheck.outputs.match, 'true') }}
+            type=semver,pattern=v{{major}},enable=${{ startsWith(steps.semvercheck.outputs.match, 'true_nonzero') }}
+            type=raw,value=latest,enable=${{ !startsWith(steps.semvercheck.outputs.match, 'true') }}
+
+      - name: Short commit
+        id: shortcommit
+        run: echo "::set-output name=value::$(git rev-parse --short HEAD)"
 
       - name: Build and push final image
-        uses: docker/build-push-action@v2.6.1
+        uses: docker/build-push-action@v2.7.0
         with:
-          platforms: ${{ steps.vars.outputs.platforms }}
+          platforms: linux/amd64,linux/386,linux/arm64,linux/arm/v6,linux/arm/v7,linux/ppc64le
+          labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            CREATED=${{ steps.vars.outputs.created }}
-            COMMIT=${{ steps.vars.outputs.commit }}
-            VERSION=${{ steps.vars.outputs.version }}
-          tags: |
-            qmcgaw/gluetun:${{ steps.vars.outputs.version }}
-            qmcgaw/private-internet-access:${{ steps.vars.outputs.version }}
+            CREATED=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
+            COMMIT=${{ steps.shortcommit.outputs.value }}
+            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
+          tags: ${{ steps.meta.outputs.tags }}
           push: true

.github/workflows/dependabot.yml

@@ -0,0 +1,37 @@
+name: Dependabot
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - .github/workflows/dependabot.yml
+      - cmd/**
+      - internal/**
+      - pkg/**
+      - .dockerignore
+      - .golangci.yml
+      - Dockerfile
+      - go.mod
+      - go.sum
+
+jobs:
+  verify:
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_BUILDKIT: "1"
+    steps:
+      - uses: actions/checkout@v2.4.0
+
+      - name: Build test image
+        run: docker build --target test -t test-container .
+
+      - name: Run tests in test container
+        run: |
+          touch coverage.txt
+          docker run --rm \
+          -v "$(pwd)/coverage.txt:/tmp/gobuild/coverage.txt" \
+          test-container
+
+      - name: Build final image
+        run: docker build -t final-image .

.github/workflows/dockerhub-description.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.3.4
+        uses: actions/checkout@v2.4.0
       - name: Docker Hub Description
         uses: peter-evans/dockerhub-description@v2
         with:

.github/workflows/fork.yml

@@ -0,0 +1,40 @@
+name: Fork
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - .github/workflows/fork.yml
+      - cmd/**
+      - internal/**
+      - pkg/**
+      - .dockerignore
+      - .golangci.yml
+      - Dockerfile
+      - go.mod
+      - go.sum
+
+jobs:
+  verify:
+    if: github.event.pull_request.head.repo.full_name != github.repository && github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_BUILDKIT: "1"
+    steps:
+      - uses: actions/checkout@v2.4.0
+
+      - name: Linting
+        run: docker build --target lint .
+
+      - name: Build test image
+        run: docker build --target test -t test-container .
+
+      - name: Run tests in test container
+        run: |
+          touch coverage.txt
+          docker run --rm \
+          -v "$(pwd)/coverage.txt:/tmp/gobuild/coverage.txt" \
+          test-container
+
+      - name: Build final image
+        run: docker build -t final-image .

.github/workflows/labels.yml

@@ -9,7 +9,7 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v2.4.0
       - uses: crazy-max/ghaction-github-labeler@v3
         with:
           yaml-file: .github/labels.yml

.github/workflows/misspell.yml

@@ -8,7 +8,7 @@ jobs:
   misspell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v2.4.0
       - uses: reviewdog/action-misspell@v1
         with:
           locale: "US"

.golangci.yml

@@ -27,12 +27,23 @@ issues:
     - text: "mnd: Magic number: 0400*"
       linters:
         - gomnd
+    - text: "variable 'mssFix' is only used in the if-statement*"
+      path: "openvpnconf.go"
+      linters:
+        - ifshort
+    - text: "variable 'auth' is only used in the if-statement*"
+      path: "openvpnconf.go"
+      linters:
+        - ifshort
 linters:
   enable:
     # - cyclop
     # - errorlint
+    # - ireturn
+    # - varnamelen
     # - wrapcheck
     - asciicheck
+    - bidichk
     - bodyclose
     - dogsled
     - dupl
@@ -56,7 +67,7 @@ linters:
     - gomoddirectives
     - goprintffuncname
     - gosec
-    - importas
+    - ifshort
     - importas
     - lll
     - makezero
@@ -64,6 +75,7 @@ linters:
     - nakedret
     - nestif
     - nilerr
+    - nilnil
     - noctx
     - nolintlint
     - prealloc
@@ -73,6 +85,7 @@ linters:
     - revive
     - rowserrcheck
     - sqlclosecheck
+    - tenv
     - thelper
     - tparallel
     - unconvert

Dockerfile

@@ -1,8 +1,8 @@
-ARG ALPINE_VERSION=3.14
-ARG GO_ALPINE_VERSION=3.14
+ARG ALPINE_VERSION=3.15
+ARG GO_ALPINE_VERSION=3.15
 ARG GO_VERSION=1.17
 ARG XCPUTRANSLATE_VERSION=v0.6.0
-ARG GOLANGCI_LINT_VERSION=v1.42.1
+ARG GOLANGCI_LINT_VERSION=v1.43.0
 ARG BUILDPLATFORM=linux/amd64
 
 FROM --platform=${BUILDPLATFORM} qmcgaw/xcputranslate:${XCPUTRANSLATE_VERSION} AS xcputranslate
@@ -102,7 +102,7 @@ ENV VPNSP=pia \
     ISP= \
     OWNED=no \
     # # Private Internet Access only:
-    PIA_ENCRYPTION=strong \
+    PIA_ENCRYPTION= \
     PORT_FORWARDING=off \
     PORT_FORWARDING_STATUS_FILE="/tmp/gluetun/forwarded_port" \
     # # Cyberghost only:
@@ -126,7 +126,7 @@ ENV VPNSP=pia \
     LOG_LEVEL=info \
     # Health
     HEALTH_SERVER_ADDRESS=127.0.0.1:9999 \
-    HEALTH_ADDRESS_TO_PING=github.com \
+    HEALTH_TARGET_ADDRESS=github.com:443 \
     HEALTH_VPN_DURATION_INITIAL=6s \
     HEALTH_VPN_DURATION_ADDITION=5s \
     # DNS over TLS
@@ -143,12 +143,12 @@ ENV VPNSP=pia \
     BLOCK_ADS=off \
     UNBLOCK= \
     DNS_UPDATE_PERIOD=24h \
-    DNS_PLAINTEXT_ADDRESS=1.1.1.1 \
+    DNS_PLAINTEXT_ADDRESS=127.0.0.1 \
     DNS_KEEP_NAMESERVER=off \
     # HTTP proxy
     HTTPPROXY= \
     HTTPPROXY_LOG=off \
-    HTTPPROXY_PORT=8888 \
+    HTTPPROXY_LISTENING_ADDRESS=":8888" \
     HTTPPROXY_USER= \
     HTTPPROXY_PASSWORD= \
     HTTPPROXY_USER_SECRETFILE=/run/secrets/httpproxy_user \
@@ -156,7 +156,7 @@ ENV VPNSP=pia \
     # Shadowsocks
     SHADOWSOCKS=off \
     SHADOWSOCKS_LOG=off \
-    SHADOWSOCKS_ADDRESS=":8388" \
+    SHADOWSOCKS_LISTENING_ADDRESS=":8388" \
     SHADOWSOCKS_PASSWORD= \
     SHADOWSOCKS_PASSWORD_SECRETFILE=/run/secrets/shadowsocks_password \
     SHADOWSOCKS_CIPHER=chacha20-ietf-poly1305 \
@@ -170,17 +170,20 @@ ENV VPNSP=pia \
     TZ= \
     PUID= \
     PGID=
-ENTRYPOINT ["/entrypoint"]
+ENTRYPOINT ["/gluetun-entrypoint"]
 EXPOSE 8000/tcp 8888/tcp 8388/tcp 8388/udp
-HEALTHCHECK --interval=5s --timeout=5s --start-period=10s --retries=1 CMD /entrypoint healthcheck
+HEALTHCHECK --interval=5s --timeout=5s --start-period=10s --retries=1 CMD /gluetun-entrypoint healthcheck
 ARG TARGETPLATFORM
 RUN apk add --no-cache --update -l apk-tools && \
     apk add --no-cache --update -X "https://dl-cdn.alpinelinux.org/alpine/v3.12/main" openvpn==2.4.11-r0 && \
     mv /usr/sbin/openvpn /usr/sbin/openvpn2.4 && \
     apk del openvpn && \
     apk add --no-cache --update openvpn ca-certificates iptables ip6tables unbound tzdata && \
+    mv /usr/sbin/openvpn /usr/sbin/openvpn2.5 && \
+    # Fix vulnerability issue
+    apk add --no-cache --update busybox && \
     rm -rf /var/cache/apk/* /etc/unbound/* /usr/sbin/unbound-* /etc/openvpn/*.sh /usr/lib/openvpn/plugins/openvpn-plugin-down-root.so && \
     deluser openvpn && \
     deluser unbound && \
     mkdir /gluetun
-COPY --from=build /tmp/gobuild/entrypoint /entrypoint
+COPY --from=build /tmp/gobuild/entrypoint /gluetun-entrypoint

README.md

@@ -1,11 +1,11 @@
 # Gluetun VPN client
 
 *Lightweight swiss-knife-like VPN client to tunnel to Cyberghost, ExpressVPN, FastestVPN,
-HideMyAss, IPVanish, IVPN, Mullvad, NordVPN, Privado, Private Internet Access, PrivateVPN,
+HideMyAss, IPVanish, IVPN, Mullvad, NordVPN, Perfect Privacy, Privado, Private Internet Access, PrivateVPN,
 ProtonVPN, PureVPN, Surfshark, TorGuard, VPNUnlimited, VyprVPN, WeVPN and Windscribe VPN servers
 using Go, OpenVPN or Wireguard, iptables, DNS over TLS, ShadowSocks and an HTTP proxy*
 
-**ANNOUNCEMENT**: Wireguard is now supported for all providers supporting it!
+**ANNOUNCEMENT**: Large settings refactor merged on 2022-06-01, please file issues if you find any problem!
 
 ![Title image](https://raw.githubusercontent.com/qdm12/gluetun/master/title.svg)
 
@@ -61,13 +61,13 @@ using Go, OpenVPN or Wireguard, iptables, DNS over TLS, ShadowSocks and an HTTP
 
 ## Features
 
-- Based on Alpine 3.14 for a small Docker image of 31MB
-- Supports: **Cyberghost**, **ExpressVPN**, **FastestVPN**, **HideMyAss**, **IPVanish**, **IVPN**, **Mullvad**, **NordVPN**, **Privado**, **Private Internet Access**, **PrivateVPN**, **ProtonVPN**, **PureVPN**,  **Surfshark**, **TorGuard**, **VPNUnlimited**, **Vyprvpn**, **WeVPN**, **Windscribe** servers
+- Based on Alpine 3.15 for a small Docker image of 29MB
+- Supports: **Cyberghost**, **ExpressVPN**, **FastestVPN**, **HideMyAss**, **IPVanish**, **IVPN**, **Mullvad**, **NordVPN**, **Perfect Privacy**, **Privado**, **Private Internet Access**, **PrivateVPN**, **ProtonVPN**, **PureVPN**,  **Surfshark**, **TorGuard**, **VPNUnlimited**, **Vyprvpn**, **WeVPN**, **Windscribe** servers
 - Supports OpenVPN for all providers listed
-- Supports Wireguard
+- Supports Wireguard both kernelspace and userspace
   - For **Mullvad**, **Ivpn** and **Windscribe**
-  - For **Torguard**, **VPN Unlimited** and **WeVPN** using [the custom provider](https://github.com/qdm12/gluetun/wiki/Environment-variables#custom)
-  - For custom Wireguard configurations using [the custom provider](https://github.com/qdm12/gluetun/wiki/Environment-variables#custom)
+  - For **Torguard**, **VPN Unlimited** and **WeVPN** using [the custom provider](https://github.com/qdm12/gluetun/wiki/Custom-provider)
+  - For custom Wireguard configurations using [the custom provider](https://github.com/qdm12/gluetun/wiki/Custom-provider)
   - More in progress, see [#134](https://github.com/qdm12/gluetun/issues/134)
 - DNS over TLS baked in with service provider(s) of your choice
 - DNS fine blocking of malicious/ads/surveillance hostnames and IP addresses, with live update every 24 hours
@@ -89,7 +89,7 @@ using Go, OpenVPN or Wireguard, iptables, DNS over TLS, ShadowSocks and an HTTP
 
 Go to the [Wiki](https://github.com/qdm12/gluetun/wiki)!
 
-[🐛 Found a bug in the Wiki?!](https://github.com/qdm12/gluetun/issues/new?assignees=&labels=%F0%9F%93%84+Wiki+issue&template=wiki+issue.md&title=Wiki+issue%3A+)
+[🐛 Found a bug in the Wiki?!](https://github.com/qdm12/gluetun/issues/new?assignees=&labels=%F0%9F%93%84+Wiki+issue&template=wiki+issue.yml&title=Wiki+issue%3A+)
 
 Here's a docker-compose.yml for the laziest:
 
@@ -98,6 +98,8 @@ version: "3"
 services:
   gluetun:
     image: qmcgaw/gluetun
+    # container_name: gluetun
+    # line above must be uncommented to allow external containers to connect. See https://github.com/qdm12/gluetun/wiki/Connect-a-container-to-gluetun#external-container-to-gluetun
     cap_add:
       - NET_ADMIN
     ports:

cmd/gluetun/main.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
-	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -17,7 +16,11 @@ import (
 	"github.com/qdm12/dns/pkg/unbound"
 	"github.com/qdm12/gluetun/internal/alpine"
 	"github.com/qdm12/gluetun/internal/cli"
-	"github.com/qdm12/gluetun/internal/configuration"
+	"github.com/qdm12/gluetun/internal/configuration/sources"
+	"github.com/qdm12/gluetun/internal/configuration/sources/env"
+	"github.com/qdm12/gluetun/internal/configuration/sources/files"
+	"github.com/qdm12/gluetun/internal/configuration/sources/mux"
+	"github.com/qdm12/gluetun/internal/configuration/sources/secrets"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/dns"
 	"github.com/qdm12/gluetun/internal/firewall"
@@ -37,7 +40,6 @@ import (
 	"github.com/qdm12/gluetun/internal/vpn"
 	"github.com/qdm12/golibs/command"
 	"github.com/qdm12/golibs/logging"
-	"github.com/qdm12/golibs/params"
 	"github.com/qdm12/goshutdown"
 	"github.com/qdm12/goshutdown/goroutine"
 	"github.com/qdm12/goshutdown/group"
@@ -77,12 +79,16 @@ func main() {
 	tun := tun.New()
 	netLinker := netlink.New()
 	cli := cli.New()
-	env := params.New()
 	cmder := command.NewCmder()
 
+	envReader := env.New(logger)
+	filesReader := files.New()
+	secretsReader := secrets.New()
+	muxReader := mux.New(envReader, filesReader, secretsReader)
+
 	errorCh := make(chan error)
 	go func() {
-		errorCh <- _main(ctx, buildInfo, args, logger, env, tun, netLinker, cmder, cli)
+		errorCh <- _main(ctx, buildInfo, args, logger, muxReader, tun, netLinker, cmder, cli)
 	}()
 
 	select {
@@ -122,17 +128,17 @@ var (
 
 //nolint:gocognit,gocyclo
 func _main(ctx context.Context, buildInfo models.BuildInformation,
-	args []string, logger logging.ParentLogger, env params.Interface,
+	args []string, logger logging.ParentLogger, source sources.Source,
 	tun tun.Interface, netLinker netlink.NetLinker, cmder command.RunStarter,
 	cli cli.CLIer) error {
 	if len(args) > 1 { // cli operation
 		switch args[1] {
 		case "healthcheck":
-			return cli.HealthCheck(ctx, env, logger)
+			return cli.HealthCheck(ctx, source, logger)
 		case "clientkey":
 			return cli.ClientKey(args[2:])
 		case "openvpnconfig":
-			return cli.OpenvpnConfig(logger, env)
+			return cli.OpenvpnConfig(logger, source)
 		case "update":
 			return cli.Update(ctx, args[2:], logger)
 		case "format-servers":
@@ -142,23 +148,49 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 		}
 	}
 
+	announcementExp, err := time.Parse(time.RFC3339, "2021-02-15T00:00:00Z")
+	if err != nil {
+		return err
+	}
+	splashSettings := gosplash.Settings{
+		User:         "qdm12",
+		Repository:   "gluetun",
+		Emails:       []string{"quentin.mcgaw@gmail.com"},
+		Version:      buildInfo.Version,
+		Commit:       buildInfo.Commit,
+		BuildDate:    buildInfo.Created,
+		Announcement: "Large settings parsing refactoring merged on 2022-01-06, please report any issue!",
+		AnnounceExp:  announcementExp,
+		// Sponsor information
+		PaypalUser:    "qmcgaw",
+		GithubSponsor: "qdm12",
+	}
+	for _, line := range gosplash.MakeLines(splashSettings) {
+		fmt.Println(line)
+	}
+
+	allSettings, err := source.Read()
+	if err != nil {
+		return err
+	}
+
 	// TODO run this in a loop or in openvpn to reload from file without restarting
 	storageLogger := logger.NewChild(logging.Settings{Prefix: "storage: "})
 	storage, err := storage.New(storageLogger, constants.ServersData)
 	if err != nil {
 		return err
 	}
+
 	allServers := storage.GetServers()
 
-	var allSettings configuration.Settings
-	err = allSettings.Read(env, allServers,
-		logger.NewChild(logging.Settings{Prefix: "configuration: "}))
+	err = allSettings.Validate(allServers)
 	if err != nil {
 		return err
 	}
-	logger.PatchLevel(allSettings.Log.Level)
 
-	puid, pgid := allSettings.System.PUID, allSettings.System.PGID
+	logger.PatchLevel(*allSettings.Log.Level)
+
+	puid, pgid := int(*allSettings.System.PUID), int(*allSettings.System.PGID)
 
 	const clientTimeout = 15 * time.Second
 	httpClient := &http.Client{Timeout: clientTimeout}
@@ -172,27 +204,6 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 	dnsConf := unbound.NewConfigurator(nil, cmder, dnsCrypto,
 		"/etc/unbound", "/usr/sbin/unbound", cacertsPath)
 
-	announcementExp, err := time.Parse(time.RFC3339, "2021-10-02T00:00:00Z")
-	if err != nil {
-		return err
-	}
-	splashSettings := gosplash.Settings{
-		User:         "qdm12",
-		Repository:   "gluetun",
-		Emails:       []string{"quentin.mcgaw@gmail.com"},
-		Version:      buildInfo.Version,
-		Commit:       buildInfo.Commit,
-		BuildDate:    buildInfo.Created,
-		Announcement: "Wireguard is now supported for Mullvad, IVPN and Windscribe!",
-		AnnounceExp:  announcementExp,
-		// Sponsor information
-		PaypalUser:    "qmcgaw",
-		GithubSponsor: "qdm12",
-	}
-	for _, line := range gosplash.MakeLines(splashSettings) {
-		fmt.Println(line)
-	}
-
 	err = printVersions(ctx, logger, []printVersionElement{
 		{name: "Alpine", getVersion: alpineConf.Version},
 		{name: "OpenVPN 2.4", getVersion: ovpnConf.Version24},
@@ -225,15 +236,15 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 	}
 	// set it for Unbound
 	// TODO remove this when migrating to qdm12/dns v2
-	allSettings.DNS.Unbound.Username = nonRootUsername
+	allSettings.DNS.DoT.Unbound.Username = nonRootUsername
 	allSettings.VPN.OpenVPN.ProcUser = nonRootUsername
 
 	if err := os.Chown("/etc/unbound", puid, pgid); err != nil {
 		return err
 	}
 
-	firewallLogLevel := allSettings.Log.Level
-	if allSettings.Firewall.Debug {
+	firewallLogLevel := *allSettings.Log.Level
+	if *allSettings.Firewall.Debug {
 		firewallLogLevel = logging.LevelDebug
 	}
 	routingLogger := logger.NewChild(logging.Settings{
@@ -292,7 +303,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 		}
 	}
 
-	if allSettings.Firewall.Enabled {
+	if *allSettings.Firewall.Enabled {
 		err := firewallConf.SetEnabled(ctx, true) // disabled by default
 		if err != nil {
 			return err
@@ -361,7 +372,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 	vpnLooper := vpn.NewLoop(allSettings.VPN, allSettings.Firewall.VPNInputPorts,
 		allServers, ovpnConf, netLinker, firewallConf, routingConf, portForwardLooper,
 		cmder, publicIPLooper, unboundLooper, vpnLogger, httpClient,
-		buildInfo, allSettings.VersionInformation)
+		buildInfo, *allSettings.Version.Enabled)
 	vpnHandler, vpnCtx, vpnDone := goshutdown.NewGoRoutineHandler(
 		"vpn", goroutine.OptionTimeout(time.Second))
 	go vpnLooper.Run(vpnCtx, vpnDone)
@@ -388,15 +399,15 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 	go httpProxyLooper.Run(httpProxyCtx, httpProxyDone)
 	otherGroupHandler.Add(httpProxyHandler)
 
-	shadowsocksLooper := shadowsocks.NewLooper(allSettings.ShadowSocks,
+	shadowsocksLooper := shadowsocks.NewLooper(allSettings.Shadowsocks,
 		logger.NewChild(logging.Settings{Prefix: "shadowsocks: "}))
 	shadowsocksHandler, shadowsocksCtx, shadowsocksDone := goshutdown.NewGoRoutineHandler(
 		"shadowsocks proxy", goroutine.OptionTimeout(defaultShutdownTimeout))
 	go shadowsocksLooper.Run(shadowsocksCtx, shadowsocksDone)
 	otherGroupHandler.Add(shadowsocksHandler)
 
-	controlServerAddress := ":" + strconv.Itoa(int(allSettings.ControlServer.Port))
-	controlServerLogging := allSettings.ControlServer.Log
+	controlServerAddress := fmt.Sprintf(":%d", *allSettings.ControlServer.Port)
+	controlServerLogging := *allSettings.ControlServer.Log
 	httpServerHandler, httpServerCtx, httpServerDone := goshutdown.NewGoRoutineHandler(
 		"http server", goroutine.OptionTimeout(defaultShutdownTimeout))
 	httpServer := server.New(httpServerCtx, controlServerAddress, controlServerLogging,

go.mod

@@ -3,18 +3,19 @@ module github.com/qdm12/gluetun
 go 1.17
 
 require (
-	github.com/breml/rootcerts v0.1.0
+	github.com/breml/rootcerts v0.2.1
 	github.com/fatih/color v1.13.0
-	github.com/go-ping/ping v0.0.0-20210911151512-381826476871
 	github.com/golang/mock v1.6.0
 	github.com/qdm12/dns v1.11.0
 	github.com/qdm12/golibs v0.0.0-20210822203818-5c568b0777b6
 	github.com/qdm12/goshutdown v0.3.0
 	github.com/qdm12/gosplash v0.1.0
-	github.com/qdm12/ss-server v0.3.0
+	github.com/qdm12/gotree v0.2.0
+	github.com/qdm12/govalid v0.1.0
+	github.com/qdm12/ss-server v0.4.0
 	github.com/qdm12/updated v0.0.0-20210603204757-205acfe6937e
 	github.com/stretchr/testify v1.7.0
-	github.com/vishvananda/netlink v1.1.0
+	github.com/vishvananda/netlink v1.1.1-0.20211129163951-9ada19101fc5
 	golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c
 	golang.zx2c4.com/wireguard v0.0.0-20210805125648-3957e9b9dd19
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20210803171230-4253848d036c
@@ -24,7 +25,6 @@ require (
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/google/go-cmp v0.5.5 // indirect
-	github.com/google/uuid v1.2.0 // indirect
 	github.com/josharian/native v0.0.0-20200817173448-b6b71def0850 // indirect
 	github.com/mattn/go-colorable v0.1.9 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
@@ -34,11 +34,10 @@ require (
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 // indirect
-	github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df // indirect
+	github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae // indirect
 	go4.org/intern v0.0.0-20210108033219-3eb7198706b2 // indirect
 	go4.org/unsafe/assume-no-moving-gc v0.0.0-20201222180813-1025295fd063 // indirect
 	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 // indirect
 	golang.org/x/net v0.0.0-20210504132125-bbd867fde50d // indirect
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
 	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
 )

go.sum

@@ -4,8 +4,8 @@ github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/g
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/breml/rootcerts v0.1.0 h1:jf/F4MHeXBi7FVAHrPq+/MBmPlGXTbUAyR977bZ0j4E=
-github.com/breml/rootcerts v0.1.0/go.mod h1:24FDtzYMpqIeYC7QzaE8VPRQaFZU5TIUDlyk8qwjD88=
+github.com/breml/rootcerts v0.2.1 h1:GZMVDXOs945764NFck0vtHSjktKYubOFM0kjf5HAuwc=
+github.com/breml/rootcerts v0.2.1/go.mod h1:24FDtzYMpqIeYC7QzaE8VPRQaFZU5TIUDlyk8qwjD88=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -32,8 +32,6 @@ github.com/go-openapi/spec v0.17.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsd
 github.com/go-openapi/strfmt v0.17.0/go.mod h1:P82hnJI0CXkErkXi8IKjPbNBM6lV6+5pLP5l494TcyU=
 github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
 github.com/go-openapi/validate v0.17.0/go.mod h1:Uh4HdOzKt19xGIGm1qHf/ofbX1YQ4Y+MYsct2VUrAJ4=
-github.com/go-ping/ping v0.0.0-20210911151512-381826476871 h1:wtjTfjwAR/BYYMJ+QOLI/3J/qGEI0fgrkZvgsEWK2/Q=
-github.com/go-ping/ping v0.0.0-20210911151512-381826476871/go.mod h1:xIFjORFzTxqIV/tDVGO4eDy/bLuSyawEeojSm3GfRGk=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
@@ -47,8 +45,6 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.2.0 h1:qJYtXnJRWmpe7m/3XlyhrsLrEURqHRM2kxzoxXqyUDs=
-github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gotify/go-api-client/v2 v2.0.4/go.mod h1:VKiah/UK20bXsr0JObE1eBVLW44zbBouzjuri9iwjFU=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
@@ -115,8 +111,12 @@ github.com/qdm12/goshutdown v0.3.0 h1:pqBpJkdwlZlfTEx4QHtS8u8CXx6pG0fVo6S1N0MpSE
 github.com/qdm12/goshutdown v0.3.0/go.mod h1:EqZ46No00kCTZ5qzdd3qIzY6ayhMt24QI8Mh8LVQYmM=
 github.com/qdm12/gosplash v0.1.0 h1:Sfl+zIjFZFP7b0iqf2l5UkmEY97XBnaKkH3FNY6Gf7g=
 github.com/qdm12/gosplash v0.1.0/go.mod h1:+A3fWW4/rUeDXhY3ieBzwghKdnIPFJgD8K3qQkenJlw=
-github.com/qdm12/ss-server v0.3.0 h1:BfKv4OU6dYb2KcDMYpTc7LIuO2jB73g3JCzy988GrLI=
-github.com/qdm12/ss-server v0.3.0/go.mod h1:ug+nWfuzKw/h5fxL1B6e9/OhkVuWJX4i2V1Pf0pJU1o=
+github.com/qdm12/gotree v0.2.0 h1:+58ltxkNLUyHtATFereAcOjBVfY6ETqRex8XK90Fb/c=
+github.com/qdm12/gotree v0.2.0/go.mod h1:1SdFaqKZuI46U1apbXIf25pDMNnrPuYLEqMF/qL4lY4=
+github.com/qdm12/govalid v0.1.0 h1:UIFVmuaAg0Q+h0GeyfcFEZ5sQ5KJPvRQwycC1/cqDN8=
+github.com/qdm12/govalid v0.1.0/go.mod h1:CyS/OEQdOvunBgrtIsW93fjd4jBkwZPBjGSpxq3NwA4=
+github.com/qdm12/ss-server v0.4.0 h1:lMMYfDGc9P86Lyvd3+p8lK4hhgHUKDzjZC91FqJYkDU=
+github.com/qdm12/ss-server v0.4.0/go.mod h1:AY0p4huvPUPW+/CiWsJcDgT6sneDryk26VXSccPNCxY=
 github.com/qdm12/updated v0.0.0-20210603204757-205acfe6937e h1:4q+uFLawkaQRq3yARYLsjJPZd2wYwxn4g6G/5v0xW1g=
 github.com/qdm12/updated v0.0.0-20210603204757-205acfe6937e/go.mod h1:UvJRGkZ9XL3/D7e7JiTTVLm1F3Cymd3/gFpD6frEpBo=
 github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 h1:f/FNXud6gA3MNr8meMVVGxhp+QBTqY91tM8HjEuMjGg=
@@ -130,10 +130,10 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/vishvananda/netlink v1.1.0 h1:1iyaYNBLmP6L0220aDnYQpo1QEV4t4hJ+xEEhhJH8j0=
-github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df h1:OviZH7qLw/7ZovXvuNyL3XQl8UFofeikI1NW1Gypu7k=
-github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
+github.com/vishvananda/netlink v1.1.1-0.20211129163951-9ada19101fc5 h1:b/k/BVWzWRS5v6AB0gf2ckFSbFsHN5jR0HoNso1pN+w=
+github.com/vishvananda/netlink v1.1.1-0.20211129163951-9ada19101fc5/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
+github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae h1:4hwBBUfQCFe3Cym0ZtKyq7L16eZUtYKs+BaHDN6mAns=
+github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/yl2chen/cidranger v1.0.2/go.mod h1:9U1yz7WPYDwf0vpNWFaeRh0bjwz5RVgRy/9UEQfHl0g=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -172,7 +172,6 @@ golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210504132125-bbd867fde50d h1:nTDGCTeAu2LhcsHTRzjyIUbZHCJ4QePArsm27Hka0UM=
 golang.org/x/net v0.0.0-20210504132125-bbd867fde50d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
@@ -185,7 +184,6 @@ golang.org/x/sys v0.0.0-20190221075227-b4e8571b14e0/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -193,7 +191,9 @@ golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201118182958-a01c418693c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -205,7 +205,6 @@ golang.org/x/sys v0.0.0-20210123111255-9b0068b26619/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210309040221-94ec62e08169/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

internal/cli/formatservers.go

@@ -26,7 +26,7 @@ var (
 func (c *CLI) FormatServers(args []string) error {
 	var format, output string
 	var cyberghost, expressvpn, fastestvpn, hideMyAss, ipvanish, ivpn, mullvad,
-		nordvpn, pia, privado, privatevpn, protonvpn, purevpn, surfshark,
+		nordvpn, perfectPrivacy, pia, privado, privatevpn, protonvpn, purevpn, surfshark,
 		torguard, vpnUnlimited, vyprvpn, wevpn, windscribe bool
 	flagSet := flag.NewFlagSet("markdown", flag.ExitOnError)
 	flagSet.StringVar(&format, "format", "markdown", "Format to use which can be: 'markdown'")
@@ -39,6 +39,7 @@ func (c *CLI) FormatServers(args []string) error {
 	flagSet.BoolVar(&ivpn, "ivpn", false, "Format IVPN servers")
 	flagSet.BoolVar(&mullvad, "mullvad", false, "Format Mullvad servers")
 	flagSet.BoolVar(&nordvpn, "nordvpn", false, "Format Nordvpn servers")
+	flagSet.BoolVar(&perfectPrivacy, "perfectprivacy", false, "Format Perfect Privacy servers")
 	flagSet.BoolVar(&pia, "pia", false, "Format Private Internet Access servers")
 	flagSet.BoolVar(&privado, "privado", false, "Format Privado servers")
 	flagSet.BoolVar(&privatevpn, "privatevpn", false, "Format Private VPN servers")
@@ -83,6 +84,8 @@ func (c *CLI) FormatServers(args []string) error {
 		formatted = currentServers.Mullvad.ToMarkdown()
 	case nordvpn:
 		formatted = currentServers.Nordvpn.ToMarkdown()
+	case perfectPrivacy:
+		formatted = currentServers.Perfectprivacy.ToMarkdown()
 	case pia:
 		formatted = currentServers.Pia.ToMarkdown()
 	case privado:

internal/cli/healthcheck.go

@@ -6,23 +6,26 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/qdm12/gluetun/internal/configuration"
+	"github.com/qdm12/gluetun/internal/configuration/sources"
 	"github.com/qdm12/gluetun/internal/healthcheck"
-	"github.com/qdm12/golibs/params"
 )
 
 type HealthChecker interface {
-	HealthCheck(ctx context.Context, env params.Interface, warner configuration.Warner) error
+	HealthCheck(ctx context.Context, source sources.Source, warner Warner) error
 }
 
-func (c *CLI) HealthCheck(ctx context.Context, env params.Interface,
-	warner configuration.Warner) error {
+func (c *CLI) HealthCheck(ctx context.Context, source sources.Source, warner Warner) error {
 	// Extract the health server port from the configuration.
-	config := configuration.Health{}
-	err := config.Read(env, warner)
+	config, err := source.ReadHealth()
 	if err != nil {
 		return err
 	}
+
+	err = config.Validate()
+	if err != nil {
+		return err
+	}
+
 	_, port, err := net.SplitHostPort(config.ServerAddress)
 	if err != nil {
 		return err

internal/cli/openvpnconfig.go

@@ -5,15 +5,14 @@ import (
 	"strings"
 	"time"
 
-	"github.com/qdm12/gluetun/internal/configuration"
+	"github.com/qdm12/gluetun/internal/configuration/sources"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/provider"
 	"github.com/qdm12/gluetun/internal/storage"
-	"github.com/qdm12/golibs/params"
 )
 
 type OpenvpnConfigMaker interface {
-	OpenvpnConfig(logger OpenvpnConfigLogger, env params.Interface) error
+	OpenvpnConfig(logger OpenvpnConfigLogger, source sources.Source) error
 }
 
 type OpenvpnConfigLogger interface {
@@ -21,19 +20,23 @@ type OpenvpnConfigLogger interface {
 	Warn(s string)
 }
 
-func (c *CLI) OpenvpnConfig(logger OpenvpnConfigLogger, env params.Interface) error {
+func (c *CLI) OpenvpnConfig(logger OpenvpnConfigLogger, source sources.Source) error {
 	storage, err := storage.New(logger, constants.ServersData)
 	if err != nil {
 		return err
 	}
 	allServers := storage.GetServers()
 
-	var allSettings configuration.Settings
-	err = allSettings.Read(env, allServers, logger)
+	allSettings, err := source.Read()
 	if err != nil {
 		return err
 	}
-	providerConf := provider.New(allSettings.VPN.Provider.Name, allServers, time.Now)
+
+	if err = allSettings.Validate(allServers); err != nil {
+		return err
+	}
+
+	providerConf := provider.New(*allSettings.VPN.Provider.Name, allServers, time.Now)
 	connection, err := providerConf.GetConnection(allSettings.VPN.Provider.ServerSelection)
 	if err != nil {
 		return err

internal/cli/update.go

@@ -6,11 +6,13 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
-	"github.com/qdm12/gluetun/internal/configuration"
+	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/storage"
@@ -18,7 +20,9 @@ import (
 )
 
 var (
-	ErrModeUnspecified         = errors.New("at least one of -enduser or -maintainers must be specified")
+	ErrModeUnspecified         = errors.New("at least one of -enduser or -maintainer must be specified")
+	ErrDNSAddress              = errors.New("DNS address is not valid")
+	ErrNoProviderSpecified     = errors.New("no provider was specified")
 	ErrNewStorage              = errors.New("cannot create storage")
 	ErrUpdateServerInformation = errors.New("cannot update server information")
 	ErrWriteToFile             = errors.New("cannot write updated information to file")
@@ -34,43 +38,51 @@ type UpdaterLogger interface {
 	Error(s string)
 }
 
+func boolPtr(b bool) *bool { return &b }
+
 func (c *CLI) Update(ctx context.Context, args []string, logger UpdaterLogger) error {
-	options := configuration.Updater{CLI: true}
+	options := settings.Updater{CLI: boolPtr(true)}
 	var endUserMode, maintainerMode, updateAll bool
+	var dnsAddress, csvProviders string
 	flagSet := flag.NewFlagSet("update", flag.ExitOnError)
 	flagSet.BoolVar(&endUserMode, "enduser", false, "Write results to /gluetun/servers.json (for end users)")
 	flagSet.BoolVar(&maintainerMode, "maintainer", false,
 		"Write results to ./internal/storage/servers.json to modify the program (for maintainers)")
-	flagSet.StringVar(&options.DNSAddress, "dns", "8.8.8.8", "DNS resolver address to use")
+	flagSet.StringVar(&dnsAddress, "dns", "8.8.8.8", "DNS resolver address to use")
 	flagSet.BoolVar(&updateAll, "all", false, "Update servers for all VPN providers")
-	flagSet.BoolVar(&options.Cyberghost, "cyberghost", false, "Update Cyberghost servers")
-	flagSet.BoolVar(&options.Expressvpn, "expressvpn", false, "Update ExpressVPN servers")
-	flagSet.BoolVar(&options.Fastestvpn, "fastestvpn", false, "Update FastestVPN servers")
-	flagSet.BoolVar(&options.HideMyAss, "hidemyass", false, "Update HideMyAss servers")
-	flagSet.BoolVar(&options.Ipvanish, "ipvanish", false, "Update IpVanish servers")
-	flagSet.BoolVar(&options.Ivpn, "ivpn", false, "Update IVPN servers")
-	flagSet.BoolVar(&options.Mullvad, "mullvad", false, "Update Mullvad servers")
-	flagSet.BoolVar(&options.Nordvpn, "nordvpn", false, "Update Nordvpn servers")
-	flagSet.BoolVar(&options.PIA, "pia", false, "Update Private Internet Access post-summer 2020 servers")
-	flagSet.BoolVar(&options.Privado, "privado", false, "Update Privado servers")
-	flagSet.BoolVar(&options.Privatevpn, "privatevpn", false, "Update Private VPN servers")
-	flagSet.BoolVar(&options.Protonvpn, "protonvpn", false, "Update Protonvpn servers")
-	flagSet.BoolVar(&options.Purevpn, "purevpn", false, "Update Purevpn servers")
-	flagSet.BoolVar(&options.Surfshark, "surfshark", false, "Update Surfshark servers")
-	flagSet.BoolVar(&options.Torguard, "torguard", false, "Update Torguard servers")
-	flagSet.BoolVar(&options.VPNUnlimited, "vpnunlimited", false, "Update VPN Unlimited servers")
-	flagSet.BoolVar(&options.Vyprvpn, "vyprvpn", false, "Update Vyprvpn servers")
-	flagSet.BoolVar(&options.Wevpn, "wevpn", false, "Update WeVPN servers")
-	flagSet.BoolVar(&options.Windscribe, "windscribe", false, "Update Windscribe servers")
+	flagSet.StringVar(&csvProviders, "providers", "", "CSV string of VPN providers to update server data for")
 	if err := flagSet.Parse(args); err != nil {
 		return err
 	}
+
 	if !endUserMode && !maintainerMode {
 		return ErrModeUnspecified
 	}
 
+	options.DNSAddress = net.ParseIP(dnsAddress)
+	if options.DNSAddress == nil {
+		return fmt.Errorf("%w: %s", ErrDNSAddress, dnsAddress)
+	}
+
 	if updateAll {
-		options.EnableAll()
+		for _, provider := range constants.AllProviders() {
+			if provider == constants.Custom {
+				continue
+			}
+			options.Providers = append(options.Providers, provider)
+		}
+	} else {
+		if csvProviders == "" {
+			return ErrNoProviderSpecified
+		}
+		options.Providers = strings.Split(csvProviders, ",")
+	}
+
+	options.SetDefaults()
+
+	err := options.Validate()
+	if err != nil {
+		return fmt.Errorf("options validation failed: %w", err)
 	}
 
 	const clientTimeout = 10 * time.Second

internal/cli/warner.go

@@ -0,0 +1,5 @@
+package cli
+
+type Warner interface {
+	Warn(s string)
+}

internal/configuration/configuration.go

@@ -1,3 +0,0 @@
-// Package configuration reads initial settings from environment variables
-// and secret files.
-package configuration

internal/configuration/constants.go

@@ -1,6 +0,0 @@
-package configuration
-
-const (
-	lastIndent = "|--"
-	indent     = "   "
-)

internal/configuration/custom.go

@@ -1,95 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"net"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-var (
-	errCustomNotSupported    = errors.New("custom provider is not supported")
-	errCustomExtractFromFile = errors.New("cannot extract configuration from file")
-)
-
-func (settings *Provider) readCustom(r reader, vpnType string) (err error) {
-	settings.Name = constants.Custom
-
-	switch vpnType {
-	case constants.OpenVPN:
-		return settings.ServerSelection.OpenVPN.readCustom(r)
-	case constants.Wireguard:
-		return settings.ServerSelection.Wireguard.readCustom(r)
-	default:
-		return fmt.Errorf("%w: for VPN type %s", errCustomNotSupported, vpnType)
-	}
-}
-
-func (settings *OpenVPNSelection) readCustom(r reader) (err error) {
-	configFile, err := r.env.Get("OPENVPN_CUSTOM_CONFIG", params.CaseSensitiveValue(), params.Compulsory())
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_CUSTOM_CONFIG: %w", err)
-	}
-	settings.ConfFile = configFile
-
-	// For display and consistency purposes only,
-	// these values are not actually used since the file is re-read
-	// before each OpenVPN start.
-	_, connection, err := r.ovpnExt.Data(configFile)
-	if err != nil {
-		return fmt.Errorf("%w: %s", errCustomExtractFromFile, err)
-	}
-	settings.TCP = connection.Protocol == constants.TCP
-
-	return nil
-}
-
-func (settings *OpenVPN) readCustom(r reader) (err error) {
-	settings.ConfFile, err = r.env.Path("OPENVPN_CUSTOM_CONFIG",
-		params.Compulsory(), params.CaseSensitiveValue())
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_CUSTOM_CONFIG: %w", err)
-	}
-
-	return nil
-}
-
-func (settings *WireguardSelection) readCustom(r reader) (err error) {
-	settings.PublicKey, err = r.env.Get("WIREGUARD_PUBLIC_KEY",
-		params.CaseSensitiveValue(), params.Compulsory())
-	if err != nil {
-		return fmt.Errorf("environment variable WIREGUARD_PUBLIC_KEY: %w", err)
-	}
-
-	settings.EndpointIP, err = readWireguardEndpointIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.EndpointPort, err = r.env.Port("WIREGUARD_ENDPOINT_PORT", params.Compulsory(),
-		params.RetroKeys([]string{"WIREGUARD_PORT"}, r.onRetroActive))
-	if err != nil {
-		return fmt.Errorf("environment variable WIREGUARD_ENDPOINT_PORT: %w", err)
-	}
-
-	return nil
-}
-
-// readWireguardEndpointIP reads and parses the server endpoint IP
-// address from the environment variable WIREGUARD_ENDPOINT_IP.
-func readWireguardEndpointIP(env params.Interface) (endpointIP net.IP, err error) {
-	s, err := env.Get("WIREGUARD_ENDPOINT_IP", params.Compulsory())
-	if err != nil {
-		return nil, fmt.Errorf("environment variable WIREGUARD_ENDPOINT_IP: %w", err)
-	}
-
-	endpointIP = net.ParseIP(s)
-	if endpointIP == nil {
-		return nil, fmt.Errorf("environment variable WIREGUARD_ENDPOINT_IP: %w: %s",
-			ErrInvalidIP, s)
-	}
-
-	return endpointIP, nil
-}

internal/configuration/cyberghost.go

@@ -1,47 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-func (settings *Provider) readCyberghost(r reader) (err error) {
-	settings.Name = constants.Cyberghost
-	servers := r.servers.GetCyberghost()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY",
-		constants.CyberghostCountryChoices(servers),
-		params.RetroKeys([]string{"REGION"}, r.onRetroActive))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.CyberghostHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
-}
-
-func (settings *OpenVPN) readCyberghost(r reader) (err error) {
-	settings.ClientKey, err = readClientKey(r)
-	if err != nil {
-		return fmt.Errorf("%w: %s", errClientKey, err)
-	}
-
-	settings.ClientCrt, err = readClientCertificate(r)
-	if err != nil {
-		return fmt.Errorf("%w: %s", errClientCert, err)
-	}
-
-	return nil
-}

internal/configuration/dns.go

@@ -1,117 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"strings"
-	"time"
-
-	"github.com/qdm12/dns/pkg/blacklist"
-	"github.com/qdm12/dns/pkg/unbound"
-	"github.com/qdm12/golibs/params"
-)
-
-// DNS contains settings to configure Unbound for DNS over TLS operation.
-type DNS struct { //nolint:maligned
-	Enabled          bool
-	PlaintextAddress net.IP
-	KeepNameserver   bool
-	UpdatePeriod     time.Duration
-	Unbound          unbound.Settings
-	BlacklistBuild   blacklist.BuilderSettings
-}
-
-func (settings *DNS) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *DNS) lines() (lines []string) {
-	lines = append(lines, lastIndent+"DNS:")
-
-	if settings.PlaintextAddress != nil {
-		lines = append(lines, indent+lastIndent+"Plaintext address: "+settings.PlaintextAddress.String())
-	}
-
-	if settings.KeepNameserver {
-		lines = append(lines, indent+lastIndent+"Keep nameserver (disabled blocking): yes")
-	}
-
-	if !settings.Enabled {
-		return lines
-	}
-
-	lines = append(lines, indent+lastIndent+"DNS over TLS:")
-
-	lines = append(lines, indent+indent+lastIndent+"Unbound:")
-	for _, line := range settings.Unbound.Lines() {
-		lines = append(lines, indent+indent+indent+line)
-	}
-
-	lines = append(lines, indent+indent+lastIndent+"Blacklist:")
-	for _, line := range settings.BlacklistBuild.Lines(indent, lastIndent) {
-		lines = append(lines, indent+indent+indent+line)
-	}
-
-	if settings.UpdatePeriod > 0 {
-		lines = append(lines, indent+indent+lastIndent+"Update: every "+settings.UpdatePeriod.String())
-	}
-
-	return lines
-}
-
-var (
-	ErrUnboundSettings   = errors.New("failed getting Unbound settings")
-	ErrBlacklistSettings = errors.New("failed getting DNS blacklist settings")
-)
-
-func (settings *DNS) read(r reader) (err error) {
-	settings.Enabled, err = r.env.OnOff("DOT", params.Default("on"))
-	if err != nil {
-		return fmt.Errorf("environment variable DOT: %w", err)
-	}
-
-	// Plain DNS settings
-	if err := settings.readDNSPlaintext(r.env); err != nil {
-		return err
-	}
-	settings.KeepNameserver, err = r.env.OnOff("DNS_KEEP_NAMESERVER", params.Default("off"))
-	if err != nil {
-		return fmt.Errorf("environment variable DNS_KEEP_NAMESERVER: %w", err)
-	}
-
-	// DNS over TLS external settings
-	if err := settings.readBlacklistBuilding(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrBlacklistSettings, err)
-	}
-
-	settings.UpdatePeriod, err = r.env.Duration("DNS_UPDATE_PERIOD", params.Default("24h"))
-	if err != nil {
-		return fmt.Errorf("environment variable DNS_UPDATE_PERIOD: %w", err)
-	}
-
-	// Unbound settings
-	if err := settings.readUnbound(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrUnboundSettings, err)
-	}
-
-	return nil
-}
-
-var (
-	ErrDNSAddressNotAnIP = errors.New("DNS plaintext address is not an IP address")
-)
-
-func (settings *DNS) readDNSPlaintext(env params.Interface) error {
-	s, err := env.Get("DNS_PLAINTEXT_ADDRESS", params.Default("1.1.1.1"))
-	if err != nil {
-		return fmt.Errorf("environment variable DNS_PLAINTEXT_ADDRESS: %w", err)
-	}
-
-	settings.PlaintextAddress = net.ParseIP(s)
-	if settings.PlaintextAddress == nil {
-		return fmt.Errorf("%w: %s", ErrDNSAddressNotAnIP, s)
-	}
-
-	return nil
-}

internal/configuration/dns_test.go

@@ -1,76 +0,0 @@
-package configuration
-
-import (
-	"net"
-	"testing"
-	"time"
-
-	"github.com/qdm12/dns/pkg/blacklist"
-	"github.com/qdm12/dns/pkg/provider"
-	"github.com/qdm12/dns/pkg/unbound"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_DNS_Lines(t *testing.T) {
-	t.Parallel()
-	testCases := map[string]struct {
-		settings DNS
-		lines    []string
-	}{
-		"disabled DOT": {
-			settings: DNS{
-				PlaintextAddress: net.IP{1, 1, 1, 1},
-			},
-			lines: []string{
-				"|--DNS:",
-				"   |--Plaintext address: 1.1.1.1",
-			},
-		},
-		"enabled DOT": {
-			settings: DNS{
-				Enabled:        true,
-				KeepNameserver: true,
-				Unbound: unbound.Settings{
-					Providers: []provider.Provider{
-						provider.Cloudflare(),
-					},
-				},
-				BlacklistBuild: blacklist.BuilderSettings{
-					BlockMalicious:    true,
-					BlockAds:          true,
-					BlockSurveillance: true,
-				},
-				UpdatePeriod: time.Hour,
-			},
-			lines: []string{
-				"|--DNS:",
-				"   |--Keep nameserver (disabled blocking): yes",
-				"   |--DNS over TLS:",
-				"      |--Unbound:",
-				"          |--DNS over TLS providers:",
-				"              |--Cloudflare",
-				"          |--Listening port: 0",
-				"          |--Access control:",
-				"              |--Allowed:",
-				"          |--Caching: disabled",
-				"          |--IPv4 resolution: disabled",
-				"          |--IPv6 resolution: disabled",
-				"          |--Verbosity level: 0/5",
-				"          |--Verbosity details level: 0/4",
-				"          |--Validation log level: 0/2",
-				"          |--Username: ",
-				"      |--Blacklist:",
-				"         |--Blocked categories: malicious, surveillance, ads",
-				"      |--Update: every 1h0m0s",
-			},
-		},
-	}
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			lines := testCase.settings.lines()
-			assert.Equal(t, testCase.lines, lines)
-		})
-	}
-}

internal/configuration/dnsblacklist.go

@@ -1,87 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-
-	"github.com/qdm12/golibs/params"
-	"inet.af/netaddr"
-)
-
-func (settings *DNS) readBlacklistBuilding(r reader) (err error) {
-	settings.BlacklistBuild.BlockMalicious, err = r.env.OnOff("BLOCK_MALICIOUS", params.Default("on"))
-	if err != nil {
-		return fmt.Errorf("environment variable BLOCK_MALICIOUS: %w", err)
-	}
-
-	settings.BlacklistBuild.BlockSurveillance, err = r.env.OnOff("BLOCK_SURVEILLANCE", params.Default("on"),
-		params.RetroKeys([]string{"BLOCK_NSA"}, r.onRetroActive))
-	if err != nil {
-		return fmt.Errorf("environment variable BLOCK_SURVEILLANCE (or BLOCK_NSA): %w", err)
-	}
-
-	settings.BlacklistBuild.BlockAds, err = r.env.OnOff("BLOCK_ADS", params.Default("off"))
-	if err != nil {
-		return fmt.Errorf("environment variable BLOCK_ADS: %w", err)
-	}
-
-	if err := settings.readPrivateAddresses(r.env); err != nil {
-		return err
-	}
-
-	return settings.readBlacklistUnblockedHostnames(r)
-}
-
-var (
-	ErrInvalidPrivateAddress = errors.New("private address is not a valid IP or CIDR range")
-)
-
-func (settings *DNS) readPrivateAddresses(env params.Interface) (err error) {
-	privateAddresses, err := env.CSV("DOT_PRIVATE_ADDRESS")
-	if err != nil {
-		return fmt.Errorf("environment variable DOT_PRIVATE_ADDRESS: %w", err)
-	} else if len(privateAddresses) == 0 {
-		return nil
-	}
-
-	ips := make([]netaddr.IP, 0, len(privateAddresses))
-	ipPrefixes := make([]netaddr.IPPrefix, 0, len(privateAddresses))
-
-	for _, address := range privateAddresses {
-		ip, err := netaddr.ParseIP(address)
-		if err == nil {
-			ips = append(ips, ip)
-			continue
-		}
-
-		ipPrefix, err := netaddr.ParseIPPrefix(address)
-		if err == nil {
-			ipPrefixes = append(ipPrefixes, ipPrefix)
-			continue
-		}
-
-		return fmt.Errorf("%w: %s", ErrInvalidPrivateAddress, address)
-	}
-
-	settings.BlacklistBuild.AddBlockedIPs = append(settings.BlacklistBuild.AddBlockedIPs, ips...)
-	settings.BlacklistBuild.AddBlockedIPPrefixes = append(settings.BlacklistBuild.AddBlockedIPPrefixes, ipPrefixes...)
-
-	return nil
-}
-
-func (settings *DNS) readBlacklistUnblockedHostnames(r reader) (err error) {
-	hostnames, err := r.env.CSV("UNBLOCK")
-	if err != nil {
-		return fmt.Errorf("environment variable UNBLOCK: %w", err)
-	} else if len(hostnames) == 0 {
-		return nil
-	}
-	for _, hostname := range hostnames {
-		if !r.regex.MatchHostname(hostname) {
-			return fmt.Errorf("%w: %s", ErrInvalidHostname, hostname)
-		}
-	}
-
-	settings.BlacklistBuild.AllowedHosts = append(settings.BlacklistBuild.AllowedHosts, hostnames...)
-	return nil
-}

internal/configuration/expressvpn.go

@@ -1,40 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readExpressvpn(r reader) (err error) {
-	settings.Name = constants.Expressvpn
-	servers := r.servers.GetExpressvpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.ExpressvpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.ExpressvpnCountriesChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.ExpressvpnCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.OpenVPN.TCP, err = readOpenVPNProtocol(r)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

internal/configuration/fastestvpn.go

@@ -1,30 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readFastestvpn(r reader) (err error) {
-	settings.Name = constants.Fastestvpn
-	servers := r.servers.GetFastestvpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.FastestvpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.FastestvpnCountriesChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
-}

internal/configuration/firewall.go

@@ -1,99 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"net"
-	"strings"
-
-	"github.com/qdm12/golibs/params"
-)
-
-// Firewall contains settings to customize the firewall operation.
-type Firewall struct {
-	VPNInputPorts   []uint16
-	InputPorts      []uint16
-	OutboundSubnets []net.IPNet
-	Enabled         bool
-	Debug           bool
-}
-
-func (settings *Firewall) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *Firewall) lines() (lines []string) {
-	if !settings.Enabled {
-		lines = append(lines, lastIndent+"Firewall: disabled ⚠️")
-		return lines
-	}
-
-	lines = append(lines, lastIndent+"Firewall:")
-
-	if settings.Debug {
-		lines = append(lines, indent+lastIndent+"Debug: on")
-	}
-
-	if len(settings.VPNInputPorts) > 0 {
-		lines = append(lines, indent+lastIndent+"VPN input ports: "+
-			strings.Join(uint16sToStrings(settings.VPNInputPorts), ", "))
-	}
-
-	if len(settings.InputPorts) > 0 {
-		lines = append(lines, indent+lastIndent+"Input ports: "+
-			strings.Join(uint16sToStrings(settings.InputPorts), ", "))
-	}
-
-	if len(settings.OutboundSubnets) > 0 {
-		lines = append(lines, indent+lastIndent+"Outbound subnets: "+
-			strings.Join(ipNetsToStrings(settings.OutboundSubnets), ", "))
-	}
-
-	return lines
-}
-
-func (settings *Firewall) read(r reader) (err error) {
-	settings.Enabled, err = r.env.OnOff("FIREWALL", params.Default("on"))
-	if err != nil {
-		return fmt.Errorf("environment variable FIREWALL: %w", err)
-	}
-
-	settings.Debug, err = r.env.OnOff("FIREWALL_DEBUG", params.Default("off"))
-	if err != nil {
-		return fmt.Errorf("environment variable FIREWALL_DEBUG: %w", err)
-	}
-
-	if err := settings.readVPNInputPorts(r.env); err != nil {
-		return err
-	}
-
-	if err := settings.readInputPorts(r.env); err != nil {
-		return err
-	}
-
-	return settings.readOutboundSubnets(r)
-}
-
-func (settings *Firewall) readVPNInputPorts(env params.Interface) (err error) {
-	settings.VPNInputPorts, err = readCSVPorts(env, "FIREWALL_VPN_INPUT_PORTS")
-	if err != nil {
-		return fmt.Errorf("environment variable FIREWALL_VPN_INPUT_PORTS: %w", err)
-	}
-	return nil
-}
-
-func (settings *Firewall) readInputPorts(env params.Interface) (err error) {
-	settings.InputPorts, err = readCSVPorts(env, "FIREWALL_INPUT_PORTS")
-	if err != nil {
-		return fmt.Errorf("environment variable FIREWALL_INPUT_PORTS: %w", err)
-	}
-	return nil
-}
-
-func (settings *Firewall) readOutboundSubnets(r reader) (err error) {
-	retroOption := params.RetroKeys([]string{"EXTRA_SUBNETS"}, r.onRetroActive)
-	settings.OutboundSubnets, err = readCSVIPNets(r.env, "FIREWALL_OUTBOUND_SUBNETS", retroOption)
-	if err != nil {
-		return fmt.Errorf("environment variable FIREWALL_OUTBOUND_SUBNETS: %w", err)
-	}
-	return nil
-}

internal/configuration/health.go

@@ -1,72 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/qdm12/gluetun/internal/models"
-	"github.com/qdm12/golibs/params"
-)
-
-// Health contains settings for the healthcheck and health server.
-type Health struct {
-	ServerAddress string
-	AddressToPing string
-	VPN           HealthyWait
-}
-
-func (settings *Health) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *Health) lines() (lines []string) {
-	lines = append(lines, lastIndent+"Health:")
-
-	lines = append(lines, indent+lastIndent+"Server address: "+settings.ServerAddress)
-
-	lines = append(lines, indent+lastIndent+"Address to ping: "+settings.AddressToPing)
-
-	lines = append(lines, indent+lastIndent+"VPN:")
-	for _, line := range settings.VPN.lines() {
-		lines = append(lines, indent+indent+line)
-	}
-
-	return lines
-}
-
-// Read is to be used for the healthcheck query mode.
-func (settings *Health) Read(env params.Interface, warner Warner) (err error) {
-	reader := newReader(env, models.AllServers{}, warner) // note: no need for servers data
-	return settings.read(reader)
-}
-
-func (settings *Health) read(r reader) (err error) {
-	var warning string
-	settings.ServerAddress, warning, err = r.env.ListeningAddress(
-		"HEALTH_SERVER_ADDRESS", params.Default("127.0.0.1:9999"))
-	if warning != "" {
-		r.warner.Warn("environment variable HEALTH_SERVER_ADDRESS: " + warning)
-	}
-	if err != nil {
-		return fmt.Errorf("environment variable HEALTH_SERVER_ADDRESS: %w", err)
-	}
-
-	settings.AddressToPing, err = r.env.Get("HEALTH_ADDRESS_TO_PING", params.Default("github.com"))
-	if err != nil {
-		return fmt.Errorf("environment variable HEALTH_ADDRESS_TO_PING: %w", err)
-	}
-
-	retroKeyOption := params.RetroKeys([]string{"HEALTH_OPENVPN_DURATION_INITIAL"}, r.onRetroActive)
-	settings.VPN.Initial, err = r.env.Duration("HEALTH_VPN_DURATION_INITIAL", params.Default("6s"), retroKeyOption)
-	if err != nil {
-		return fmt.Errorf("environment variable HEALTH_VPN_DURATION_INITIAL: %w", err)
-	}
-
-	retroKeyOption = params.RetroKeys([]string{"HEALTH_OPENVPN_DURATION_ADDITION"}, r.onRetroActive)
-	settings.VPN.Addition, err = r.env.Duration("HEALTH_VPN_DURATION_ADDITION", params.Default("5s"), retroKeyOption)
-	if err != nil {
-		return fmt.Errorf("environment variable HEALTH_VPN_DURATION_ADDITION: %w", err)
-	}
-
-	return nil
-}

internal/configuration/health_test.go

@@ -1,272 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/golang/mock/gomock"
-	"github.com/qdm12/golibs/params/mock_params"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_Health_String(t *testing.T) {
-	t.Parallel()
-
-	health := Health{
-		ServerAddress: "a",
-		AddressToPing: "b",
-	}
-	const expected = `|--Health:
-   |--Server address: a
-   |--Address to ping: b
-   |--VPN:
-      |--Initial duration: 0s`
-
-	s := health.String()
-
-	assert.Equal(t, expected, s)
-}
-
-func Test_Health_lines(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		settings Health
-		lines    []string
-	}{
-		"empty": {
-			lines: []string{
-				"|--Health:",
-				"   |--Server address: ",
-				"   |--Address to ping: ",
-				"   |--VPN:",
-				"      |--Initial duration: 0s",
-			},
-		},
-		"filled settings": {
-			settings: Health{
-				ServerAddress: "address:9999",
-				AddressToPing: "github.com",
-				VPN: HealthyWait{
-					Initial:  time.Second,
-					Addition: time.Minute,
-				},
-			},
-			lines: []string{
-				"|--Health:",
-				"   |--Server address: address:9999",
-				"   |--Address to ping: github.com",
-				"   |--VPN:",
-				"      |--Initial duration: 1s",
-				"      |--Addition duration: 1m0s",
-			},
-		},
-	}
-
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			lines := testCase.settings.lines()
-
-			assert.Equal(t, testCase.lines, lines)
-		})
-	}
-}
-
-func Test_Health_read(t *testing.T) {
-	t.Parallel()
-
-	errDummy := errors.New("dummy")
-
-	type stringCall struct {
-		call bool
-		s    string
-		err  error
-	}
-
-	type stringCallWithWarning struct {
-		call    bool
-		s       string
-		warning string
-		err     error
-	}
-
-	type durationCall struct {
-		call     bool
-		duration time.Duration
-		err      error
-	}
-
-	testCases := map[string]struct {
-		serverAddress stringCallWithWarning
-		addressToPing stringCall
-		vpnInitial    durationCall
-		vpnAddition   durationCall
-		expected      Health
-		err           error
-	}{
-		"success": {
-			serverAddress: stringCallWithWarning{
-				call: true,
-				s:    "127.0.0.1:9999",
-			},
-			addressToPing: stringCall{
-				call: true,
-				s:    "1.2.3.4",
-			},
-			vpnInitial: durationCall{
-				call:     true,
-				duration: time.Second,
-			},
-			vpnAddition: durationCall{
-				call:     true,
-				duration: time.Minute,
-			},
-			expected: Health{
-				ServerAddress: "127.0.0.1:9999",
-				AddressToPing: "1.2.3.4",
-				VPN: HealthyWait{
-					Initial:  time.Second,
-					Addition: time.Minute,
-				},
-			},
-		},
-		"listening address error": {
-			serverAddress: stringCallWithWarning{
-				call:    true,
-				s:       "127.0.0.1:9999",
-				warning: "warning",
-				err:     errDummy,
-			},
-			expected: Health{
-				ServerAddress: "127.0.0.1:9999",
-			},
-			err: errors.New("environment variable HEALTH_SERVER_ADDRESS: dummy"),
-		},
-		"address to ping error": {
-			serverAddress: stringCallWithWarning{
-				call: true,
-			},
-			addressToPing: stringCall{
-				call: true,
-				s:    "address",
-				err:  errDummy,
-			},
-			expected: Health{
-				AddressToPing: "address",
-			},
-			err: errors.New("environment variable HEALTH_ADDRESS_TO_PING: dummy"),
-		},
-		"initial error": {
-			serverAddress: stringCallWithWarning{
-				call: true,
-			},
-			addressToPing: stringCall{
-				call: true,
-			},
-			vpnInitial: durationCall{
-				call:     true,
-				duration: time.Second,
-				err:      errDummy,
-			},
-			expected: Health{
-				VPN: HealthyWait{
-					Initial: time.Second,
-				},
-			},
-			err: errors.New("environment variable HEALTH_VPN_DURATION_INITIAL: dummy"),
-		},
-		"addition error": {
-			serverAddress: stringCallWithWarning{
-				call: true,
-			},
-			addressToPing: stringCall{
-				call: true,
-			},
-			vpnInitial: durationCall{
-				call:     true,
-				duration: time.Second,
-			},
-			vpnAddition: durationCall{
-				call:     true,
-				duration: time.Minute,
-				err:      errDummy,
-			},
-			expected: Health{
-				VPN: HealthyWait{
-					Initial:  time.Second,
-					Addition: time.Minute,
-				},
-			},
-			err: errors.New("environment variable HEALTH_VPN_DURATION_ADDITION: dummy"),
-		},
-	}
-
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			ctrl := gomock.NewController(t)
-
-			env := mock_params.NewMockInterface(ctrl)
-			warner := NewMockWarner(ctrl)
-
-			if testCase.serverAddress.call {
-				value := testCase.serverAddress.s
-				warning := testCase.serverAddress.warning
-				err := testCase.serverAddress.err
-				env.EXPECT().ListeningAddress("HEALTH_SERVER_ADDRESS", gomock.Any()).
-					Return(value, warning, err)
-				if warning != "" {
-					warner.EXPECT().Warn("environment variable HEALTH_SERVER_ADDRESS: " + warning)
-				}
-			}
-
-			if testCase.addressToPing.call {
-				value := testCase.addressToPing.s
-				err := testCase.addressToPing.err
-				env.EXPECT().Get("HEALTH_ADDRESS_TO_PING", gomock.Any()).
-					Return(value, err)
-			}
-
-			if testCase.vpnInitial.call {
-				value := testCase.vpnInitial.duration
-				err := testCase.vpnInitial.err
-				env.EXPECT().
-					Duration("HEALTH_VPN_DURATION_INITIAL", gomock.Any()).
-					Return(value, err)
-			}
-
-			if testCase.vpnAddition.call {
-				value := testCase.vpnAddition.duration
-				err := testCase.vpnAddition.err
-				env.EXPECT().
-					Duration("HEALTH_VPN_DURATION_ADDITION", gomock.Any()).
-					Return(value, err)
-			}
-
-			r := reader{
-				env:    env,
-				warner: warner,
-			}
-
-			var health Health
-
-			err := health.read(r)
-
-			if testCase.err != nil {
-				require.Error(t, err)
-				assert.Equal(t, testCase.err.Error(), err.Error())
-			} else {
-				assert.NoError(t, err)
-			}
-
-			assert.Equal(t, testCase.expected, health)
-		})
-	}
-}

internal/configuration/healthwait_test.go

@@ -1,55 +0,0 @@
-package configuration
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_HealthyWait_String(t *testing.T) {
-	t.Parallel()
-
-	var healthyWait HealthyWait
-	const expected = "|--Initial duration: 0s"
-
-	s := healthyWait.String()
-
-	assert.Equal(t, expected, s)
-}
-
-func Test_HealthyWait_lines(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		settings HealthyWait
-		lines    []string
-	}{
-		"empty": {
-			lines: []string{
-				"|--Initial duration: 0s",
-			},
-		},
-		"filled settings": {
-			settings: HealthyWait{
-				Initial:  time.Second,
-				Addition: time.Minute,
-			},
-			lines: []string{
-				"|--Initial duration: 1s",
-				"|--Addition duration: 1m0s",
-			},
-		},
-	}
-
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			lines := testCase.settings.lines()
-
-			assert.Equal(t, testCase.lines, lines)
-		})
-	}
-}

internal/configuration/healthywait.go

@@ -1,30 +0,0 @@
-package configuration
-
-import (
-	"strings"
-	"time"
-)
-
-type HealthyWait struct {
-	// Initial is the initial duration to wait for the program
-	// to be healthy before taking action.
-	Initial time.Duration
-	// Addition is the duration to add to the Initial duration
-	// after Initial has expired to wait longer for the program
-	// to be healthy.
-	Addition time.Duration
-}
-
-func (settings *HealthyWait) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *HealthyWait) lines() (lines []string) {
-	lines = append(lines, lastIndent+"Initial duration: "+settings.Initial.String())
-
-	if settings.Addition > 0 {
-		lines = append(lines, lastIndent+"Addition duration: "+settings.Addition.String())
-	}
-
-	return lines
-}

internal/configuration/hidemyass.go

@@ -1,40 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readHideMyAss(r reader) (err error) {
-	settings.Name = constants.HideMyAss
-	servers := r.servers.GetHideMyAss()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.HideMyAssCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Regions, err = r.env.CSVInside("REGION", constants.HideMyAssCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable REGION: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.HideMyAssCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.HideMyAssHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
-}

internal/configuration/httpproxy.go

@@ -1,106 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"github.com/qdm12/golibs/params"
-)
-
-// HTTPProxy contains settings to configure the HTTP proxy.
-type HTTPProxy struct {
-	User     string
-	Password string
-	Port     uint16
-	Enabled  bool
-	Stealth  bool
-	Log      bool
-}
-
-func (settings *HTTPProxy) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *HTTPProxy) lines() (lines []string) {
-	if !settings.Enabled {
-		return nil
-	}
-
-	lines = append(lines, lastIndent+"HTTP proxy:")
-
-	lines = append(lines, indent+lastIndent+"Port: "+strconv.Itoa(int(settings.Port)))
-
-	if settings.User != "" {
-		lines = append(lines, indent+lastIndent+"Authentication: enabled")
-	}
-
-	if settings.Log {
-		lines = append(lines, indent+lastIndent+"Log: enabled")
-	}
-
-	if settings.Stealth {
-		lines = append(lines, indent+lastIndent+"Stealth: enabled")
-	}
-
-	return lines
-}
-
-func (settings *HTTPProxy) read(r reader) (err error) {
-	settings.Enabled, err = r.env.OnOff("HTTPPROXY", params.Default("off"),
-		params.RetroKeys([]string{"TINYPROXY", "PROXY"}, r.onRetroActive))
-	if err != nil {
-		return fmt.Errorf("environment variable HTTPPROXY (or TINYPROXY, PROXY): %w", err)
-	}
-
-	settings.User, err = r.getFromEnvOrSecretFile("HTTPPROXY_USER", false, // compulsory
-		[]string{"TINYPROXY_USER", "PROXY_USER"})
-	if err != nil {
-		return fmt.Errorf("environment variable HTTPPROXY_USER (or TINYPROXY_USER, PROXY_USER): %w", err)
-	}
-
-	settings.Password, err = r.getFromEnvOrSecretFile("HTTPPROXY_PASSWORD", false,
-		[]string{"TINYPROXY_PASSWORD", "PROXY_PASSWORD"})
-	if err != nil {
-		return fmt.Errorf("environment variable HTTPPROXY_PASSWORD (or TINYPROXY_PASSWORD, PROXY_PASSWORD): %w", err)
-	}
-
-	settings.Stealth, err = r.env.OnOff("HTTPPROXY_STEALTH", params.Default("off"))
-	if err != nil {
-		return fmt.Errorf("environment variable HTTPPROXY_STEALTH: %w", err)
-	}
-
-	if err := settings.readLog(r); err != nil {
-		return err
-	}
-
-	var warning string
-	settings.Port, warning, err = r.env.ListeningPort("HTTPPROXY_PORT", params.Default("8888"),
-		params.RetroKeys([]string{"TINYPROXY_PORT", "PROXY_PORT"}, r.onRetroActive))
-	if len(warning) > 0 {
-		r.warner.Warn(warning)
-	}
-	if err != nil {
-		return fmt.Errorf("environment variable HTTPPROXY_PORT (or TINYPROXY_PORT, PROXY_PORT): %w", err)
-	}
-
-	return nil
-}
-
-func (settings *HTTPProxy) readLog(r reader) error {
-	s, err := r.env.Get("HTTPPROXY_LOG",
-		params.RetroKeys([]string{"PROXY_LOG_LEVEL", "TINYPROXY_LOG"}, r.onRetroActive))
-	if err != nil {
-		return fmt.Errorf("environment variable HTTPPROXY_LOG (or TINYPROXY_LOG, PROXY_LOG_LEVEL): %w", err)
-	}
-
-	switch strings.ToLower(s) {
-	case "on":
-		settings.Log = true
-	// Retro compatibility
-	case "info", "connect", "notice":
-		settings.Log = true
-	}
-
-	return nil
-}

internal/configuration/ipvanish.go

@@ -1,35 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readIpvanish(r reader) (err error) {
-	settings.Name = constants.Ipvanish
-	servers := r.servers.GetIpvanish()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.IpvanishCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.IpvanishCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.IpvanishHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
-}

internal/configuration/ipvanish_test.go

@@ -1,170 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"net"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/gluetun/internal/models"
-	"github.com/qdm12/golibs/params/mock_params"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_Provider_readIpvanish(t *testing.T) {
-	t.Parallel()
-
-	var errDummy = errors.New("dummy test error")
-
-	type singleStringCall struct {
-		call  bool
-		value string
-		err   error
-	}
-
-	type sliceStringCall struct {
-		call   bool
-		values []string
-		err    error
-	}
-
-	testCases := map[string]struct {
-		targetIP  singleStringCall
-		countries sliceStringCall
-		cities    sliceStringCall
-		hostnames sliceStringCall
-		protocol  singleStringCall
-		settings  Provider
-		err       error
-	}{
-		"target IP error": {
-			targetIP: singleStringCall{call: true, value: "something", err: errDummy},
-			settings: Provider{
-				Name: constants.Ipvanish,
-			},
-			err: errors.New("environment variable OPENVPN_TARGET_IP: dummy test error"),
-		},
-		"countries error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ipvanish,
-			},
-			err: errors.New("environment variable COUNTRY: dummy test error"),
-		},
-		"cities error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ipvanish,
-			},
-			err: errors.New("environment variable CITY: dummy test error"),
-		},
-		"hostnames error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			hostnames: sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ipvanish,
-			},
-			err: errors.New("environment variable SERVER_HOSTNAME: dummy test error"),
-		},
-		"protocol error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			hostnames: sliceStringCall{call: true},
-			protocol:  singleStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ipvanish,
-			},
-			err: errors.New("environment variable OPENVPN_PROTOCOL: dummy test error"),
-		},
-		"default settings": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			hostnames: sliceStringCall{call: true},
-			protocol:  singleStringCall{call: true},
-			settings: Provider{
-				Name: constants.Ipvanish,
-			},
-		},
-		"set settings": {
-			targetIP:  singleStringCall{call: true, value: "1.2.3.4"},
-			countries: sliceStringCall{call: true, values: []string{"A", "B"}},
-			cities:    sliceStringCall{call: true, values: []string{"C", "D"}},
-			hostnames: sliceStringCall{call: true, values: []string{"E", "F"}},
-			protocol:  singleStringCall{call: true, value: constants.TCP},
-			settings: Provider{
-				Name: constants.Ipvanish,
-				ServerSelection: ServerSelection{
-					OpenVPN: OpenVPNSelection{
-						TCP: true,
-					},
-					TargetIP:  net.IPv4(1, 2, 3, 4),
-					Countries: []string{"A", "B"},
-					Cities:    []string{"C", "D"},
-					Hostnames: []string{"E", "F"},
-				},
-			},
-		},
-	}
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			ctrl := gomock.NewController(t)
-
-			servers := []models.IpvanishServer{{Hostname: "a"}}
-			allServers := models.AllServers{
-				Ipvanish: models.IpvanishServers{
-					Servers: servers,
-				},
-			}
-
-			env := mock_params.NewMockInterface(ctrl)
-			if testCase.targetIP.call {
-				env.EXPECT().Get("OPENVPN_TARGET_IP").
-					Return(testCase.targetIP.value, testCase.targetIP.err)
-			}
-			if testCase.countries.call {
-				env.EXPECT().CSVInside("COUNTRY", constants.IpvanishCountryChoices(servers)).
-					Return(testCase.countries.values, testCase.countries.err)
-			}
-			if testCase.cities.call {
-				env.EXPECT().CSVInside("CITY", constants.IpvanishCityChoices(servers)).
-					Return(testCase.cities.values, testCase.cities.err)
-			}
-			if testCase.hostnames.call {
-				env.EXPECT().CSVInside("SERVER_HOSTNAME", constants.IpvanishHostnameChoices(servers)).
-					Return(testCase.hostnames.values, testCase.hostnames.err)
-			}
-			if testCase.protocol.call {
-				env.EXPECT().Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
-					Return(testCase.protocol.value, testCase.protocol.err)
-			}
-
-			r := reader{
-				servers: allServers,
-				env:     env,
-			}
-
-			var settings Provider
-			err := settings.readIpvanish(r)
-
-			if testCase.err != nil {
-				require.Error(t, err)
-				assert.Equal(t, testCase.err.Error(), err.Error())
-			} else {
-				assert.NoError(t, err)
-			}
-
-			assert.Equal(t, testCase.settings, settings)
-		})
-	}
-}

internal/configuration/ivpn.go

@@ -1,73 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-func (settings *Provider) readIvpn(r reader) (err error) {
-	settings.Name = constants.Ivpn
-	servers := r.servers.GetIvpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.IvpnCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.IvpnCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.ISPs, err = r.env.CSVInside("ISP", constants.IvpnISPChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable ISP: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME", constants.IvpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	err = settings.ServerSelection.OpenVPN.readIVPN(r)
-	if err != nil {
-		return err
-	}
-
-	return settings.ServerSelection.Wireguard.readIVPN(r.env)
-}
-
-func (settings *OpenVPNSelection) readIVPN(r reader) (err error) {
-	settings.TCP, err = readOpenVPNProtocol(r)
-	if err != nil {
-		return err
-	}
-
-	settings.CustomPort, err = readOpenVPNCustomPort(r, openvpnPortValidation{
-		tcp:        settings.TCP,
-		allowedTCP: []uint16{80, 443, 1443},
-		allowedUDP: []uint16{53, 1194, 2049, 2050},
-	})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (settings *WireguardSelection) readIVPN(env params.Interface) (err error) {
-	settings.EndpointPort, err = readWireguardCustomPort(env,
-		[]uint16{2049, 2050, 53, 30587, 41893, 48574, 58237})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

internal/configuration/ivpn_test.go

@@ -1,274 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"net"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/gluetun/internal/models"
-	"github.com/qdm12/golibs/params/mock_params"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_Provider_readIvpn(t *testing.T) { //nolint:gocognit
-	t.Parallel()
-
-	var errDummy = errors.New("dummy test error")
-
-	type singleStringCall struct {
-		call  bool
-		value string
-		err   error
-	}
-
-	type portCall struct {
-		getCall   bool
-		getValue  string // "" or "0"
-		getErr    error
-		portCall  bool
-		portValue uint16
-		portErr   error
-	}
-
-	type sliceStringCall struct {
-		call   bool
-		values []string
-		err    error
-	}
-
-	testCases := map[string]struct {
-		targetIP    singleStringCall
-		countries   sliceStringCall
-		cities      sliceStringCall
-		isps        sliceStringCall
-		hostnames   sliceStringCall
-		protocol    singleStringCall
-		ovpnPort    portCall
-		ovpnOldPort portCall
-		wgPort      portCall
-		wgOldPort   portCall
-		settings    Provider
-		err         error
-	}{
-		"target IP error": {
-			targetIP: singleStringCall{call: true, value: "something", err: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable OPENVPN_TARGET_IP: dummy test error"),
-		},
-		"countries error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable COUNTRY: dummy test error"),
-		},
-		"cities error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable CITY: dummy test error"),
-		},
-		"isps error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			isps:      sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable ISP: dummy test error"),
-		},
-		"hostnames error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			isps:      sliceStringCall{call: true},
-			hostnames: sliceStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable SERVER_HOSTNAME: dummy test error"),
-		},
-		"openvpn protocol error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			isps:      sliceStringCall{call: true},
-			hostnames: sliceStringCall{call: true},
-			protocol:  singleStringCall{call: true, err: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable OPENVPN_PROTOCOL: dummy test error"),
-		},
-		"openvpn custom port error": {
-			targetIP:  singleStringCall{call: true},
-			countries: sliceStringCall{call: true},
-			cities:    sliceStringCall{call: true},
-			isps:      sliceStringCall{call: true},
-			hostnames: sliceStringCall{call: true},
-			protocol:  singleStringCall{call: true},
-			ovpnPort:  portCall{getCall: true, getErr: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable OPENVPN_PORT: dummy test error"),
-		},
-		"wireguard custom port error": {
-			targetIP:    singleStringCall{call: true},
-			countries:   sliceStringCall{call: true},
-			cities:      sliceStringCall{call: true},
-			isps:        sliceStringCall{call: true},
-			hostnames:   sliceStringCall{call: true},
-			protocol:    singleStringCall{call: true},
-			ovpnPort:    portCall{getCall: true, getValue: "0"},
-			ovpnOldPort: portCall{getCall: true, getValue: "0"},
-			wgPort:      portCall{getCall: true, getErr: errDummy},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-			err: errors.New("environment variable WIREGUARD_ENDPOINT_PORT: dummy test error"),
-		},
-		"default settings": {
-			targetIP:    singleStringCall{call: true},
-			countries:   sliceStringCall{call: true},
-			cities:      sliceStringCall{call: true},
-			isps:        sliceStringCall{call: true},
-			hostnames:   sliceStringCall{call: true},
-			protocol:    singleStringCall{call: true},
-			ovpnPort:    portCall{getCall: true, getValue: "0"},
-			ovpnOldPort: portCall{getCall: true, getValue: "0"},
-			wgPort:      portCall{getCall: true, getValue: "0"},
-			wgOldPort:   portCall{getCall: true, getValue: "0"},
-			settings: Provider{
-				Name: constants.Ivpn,
-			},
-		},
-		"set settings": {
-			targetIP:  singleStringCall{call: true, value: "1.2.3.4"},
-			countries: sliceStringCall{call: true, values: []string{"A", "B"}},
-			cities:    sliceStringCall{call: true, values: []string{"C", "D"}},
-			isps:      sliceStringCall{call: true, values: []string{"ISP 1"}},
-			hostnames: sliceStringCall{call: true, values: []string{"E", "F"}},
-			protocol:  singleStringCall{call: true, value: constants.TCP},
-			ovpnPort:  portCall{getCall: true, portCall: true, portValue: 443},
-			wgPort:    portCall{getCall: true, portCall: true, portValue: 2049},
-			settings: Provider{
-				Name: constants.Ivpn,
-				ServerSelection: ServerSelection{
-					OpenVPN: OpenVPNSelection{
-						TCP:        true,
-						CustomPort: 443,
-					},
-					Wireguard: WireguardSelection{
-						EndpointPort: 2049,
-					},
-					TargetIP:  net.IPv4(1, 2, 3, 4),
-					Countries: []string{"A", "B"},
-					Cities:    []string{"C", "D"},
-					ISPs:      []string{"ISP 1"},
-					Hostnames: []string{"E", "F"},
-				},
-			},
-		},
-	}
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			ctrl := gomock.NewController(t)
-
-			env := mock_params.NewMockInterface(ctrl)
-
-			servers := []models.IvpnServer{{Hostname: "a"}}
-			allServers := models.AllServers{
-				Ivpn: models.IvpnServers{
-					Servers: servers,
-				},
-			}
-
-			if testCase.targetIP.call {
-				env.EXPECT().Get("OPENVPN_TARGET_IP").
-					Return(testCase.targetIP.value, testCase.targetIP.err)
-			}
-			if testCase.countries.call {
-				env.EXPECT().CSVInside("COUNTRY", constants.IvpnCountryChoices(servers)).
-					Return(testCase.countries.values, testCase.countries.err)
-			}
-			if testCase.cities.call {
-				env.EXPECT().CSVInside("CITY", constants.IvpnCityChoices(servers)).
-					Return(testCase.cities.values, testCase.cities.err)
-			}
-			if testCase.isps.call {
-				env.EXPECT().CSVInside("ISP", constants.IvpnISPChoices(servers)).
-					Return(testCase.isps.values, testCase.isps.err)
-			}
-			if testCase.hostnames.call {
-				env.EXPECT().CSVInside("SERVER_HOSTNAME", constants.IvpnHostnameChoices(servers)).
-					Return(testCase.hostnames.values, testCase.hostnames.err)
-			}
-			if testCase.protocol.call {
-				env.EXPECT().Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP}, gomock.Any()).
-					Return(testCase.protocol.value, testCase.protocol.err)
-			}
-			if testCase.ovpnPort.getCall {
-				env.EXPECT().Get("OPENVPN_PORT", gomock.Any()).
-					Return(testCase.ovpnPort.getValue, testCase.ovpnPort.getErr)
-			}
-			if testCase.ovpnPort.portCall {
-				env.EXPECT().Port("OPENVPN_PORT").
-					Return(testCase.ovpnPort.portValue, testCase.ovpnPort.portErr)
-			}
-			if testCase.ovpnOldPort.getCall {
-				env.EXPECT().Get("PORT", gomock.Any()).
-					Return(testCase.ovpnOldPort.getValue, testCase.ovpnOldPort.getErr)
-			}
-			if testCase.ovpnOldPort.portCall {
-				env.EXPECT().Port("PORT").
-					Return(testCase.ovpnOldPort.portValue, testCase.ovpnOldPort.portErr)
-			}
-			if testCase.wgPort.getCall {
-				env.EXPECT().Get("WIREGUARD_ENDPOINT_PORT", gomock.Any()).
-					Return(testCase.wgPort.getValue, testCase.wgPort.getErr)
-			}
-			if testCase.wgPort.portCall {
-				env.EXPECT().Port("WIREGUARD_ENDPOINT_PORT").
-					Return(testCase.wgPort.portValue, testCase.wgPort.portErr)
-			}
-			if testCase.wgOldPort.getCall {
-				env.EXPECT().Get("WIREGUARD_PORT", gomock.Any()).
-					Return(testCase.wgOldPort.getValue, testCase.wgOldPort.getErr)
-			}
-			if testCase.wgOldPort.portCall {
-				env.EXPECT().Port("WIREGUARD_PORT").
-					Return(testCase.wgOldPort.portValue, testCase.wgOldPort.portErr)
-			}
-
-			r := reader{
-				servers: allServers,
-				env:     env,
-			}
-
-			var settings Provider
-			err := settings.readIvpn(r)
-
-			if testCase.err != nil {
-				require.Error(t, err)
-				assert.Equal(t, testCase.err.Error(), err.Error())
-			} else {
-				assert.NoError(t, err)
-			}
-
-			assert.Equal(t, testCase.settings, settings)
-		})
-	}
-}

internal/configuration/keys.go

@@ -1,29 +0,0 @@
-package configuration
-
-import (
-	"errors"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/gluetun/internal/openvpn/parse"
-)
-
-var (
-	errClientCert = errors.New("cannot read client certificate")
-	errClientKey  = errors.New("cannot read client key")
-)
-
-func readClientKey(r reader) (clientKey string, err error) {
-	b, err := r.getFromFileOrSecretFile("OPENVPN_CLIENTKEY", constants.ClientKey)
-	if err != nil {
-		return "", err
-	}
-	return parse.ExtractPrivateKey(b)
-}
-
-func readClientCertificate(r reader) (clientCertificate string, err error) {
-	b, err := r.getFromFileOrSecretFile("OPENVPN_CLIENTCRT", constants.ClientCertificate)
-	if err != nil {
-		return "", err
-	}
-	return parse.ExtractCert(b)
-}

internal/configuration/lines.go

@@ -1,22 +0,0 @@
-package configuration
-
-import (
-	"net"
-	"strconv"
-)
-
-func uint16sToStrings(uint16s []uint16) (strings []string) {
-	strings = make([]string, len(uint16s))
-	for i := range uint16s {
-		strings[i] = strconv.Itoa(int(uint16s[i]))
-	}
-	return strings
-}
-
-func ipNetsToStrings(ipNets []net.IPNet) (strings []string) {
-	strings = make([]string, len(ipNets))
-	for i := range ipNets {
-		strings[i] = ipNets[i].String()
-	}
-	return strings
-}

internal/configuration/log.go

@@ -1,30 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/golibs/logging"
-	"github.com/qdm12/golibs/params"
-)
-
-type Log struct {
-	Level logging.Level `json:"level"`
-}
-
-func (settings *Log) lines() (lines []string) {
-	lines = append(lines, lastIndent+"Log:")
-
-	lines = append(lines, indent+lastIndent+"Level: "+settings.Level.String())
-
-	return lines
-}
-
-func (settings *Log) read(env params.Interface) (err error) {
-	defaultLevel := logging.LevelInfo.String()
-	settings.Level, err = env.LogLevel("LOG_LEVEL", params.Default(defaultLevel))
-	if err != nil {
-		return fmt.Errorf("environment variable LOG_LEVEL: %w", err)
-	}
-
-	return nil
-}

internal/configuration/mullvad.go

@@ -1,77 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-func (settings *Provider) readMullvad(r reader) (err error) {
-	settings.Name = constants.Mullvad
-	servers := r.servers.GetMullvad()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.MullvadCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.MullvadCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME", constants.MullvadHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	settings.ServerSelection.ISPs, err = r.env.CSVInside("ISP", constants.MullvadISPChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable ISP: %w", err)
-	}
-
-	settings.ServerSelection.Owned, err = r.env.YesNo("OWNED", params.Default("no"))
-	if err != nil {
-		return fmt.Errorf("environment variable OWNED: %w", err)
-	}
-
-	err = settings.ServerSelection.OpenVPN.readMullvad(r)
-	if err != nil {
-		return err
-	}
-
-	return settings.ServerSelection.Wireguard.readMullvad(r.env)
-}
-
-func (settings *OpenVPNSelection) readMullvad(r reader) (err error) {
-	settings.TCP, err = readOpenVPNProtocol(r)
-	if err != nil {
-		return err
-	}
-
-	settings.CustomPort, err = readOpenVPNCustomPort(r, openvpnPortValidation{
-		tcp:        settings.TCP,
-		allowedTCP: []uint16{80, 443, 1401},
-		allowedUDP: []uint16{53, 1194, 1195, 1196, 1197, 1300, 1301, 1302, 1303, 1400},
-	})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (settings *WireguardSelection) readMullvad(env params.Interface) (err error) {
-	settings.EndpointPort, err = readWireguardCustomPort(env, nil)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

internal/configuration/nordvpn.go

@@ -1,58 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strconv"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-func (settings *Provider) readNordvpn(r reader) (err error) {
-	settings.Name = constants.Nordvpn
-	servers := r.servers.GetNordvpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Regions, err = r.env.CSVInside("REGION", constants.NordvpnRegionChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable REGION: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME", constants.NordvpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	settings.ServerSelection.Numbers, err = readNordVPNServerNumbers(r.env)
-	if err != nil {
-		return err
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
-}
-
-func readNordVPNServerNumbers(env params.Interface) (numbers []uint16, err error) {
-	const possiblePortsCount = 65537
-	possibilities := make([]string, possiblePortsCount)
-	for i := range possibilities {
-		possibilities[i] = fmt.Sprintf("%d", i)
-	}
-	possibilities[65536] = ""
-	values, err := env.CSVInside("SERVER_NUMBER", possibilities)
-	if err != nil {
-		return nil, err
-	}
-	numbers = make([]uint16, len(values))
-	for i := range values {
-		n, err := strconv.Atoi(values[i])
-		if err != nil {
-			return nil, err
-		}
-		numbers[i] = uint16(n)
-	}
-	return numbers, nil
-}

internal/configuration/openvpn.go

@@ -1,207 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"regexp"
-	"strconv"
-	"strings"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-// OpenVPN contains settings to configure the OpenVPN client.
-type OpenVPN struct {
-	User      string   `json:"user"`
-	Password  string   `json:"password"`
-	Verbosity int      `json:"verbosity"`
-	Flags     []string `json:"flags"`
-	MSSFix    uint16   `json:"mssfix"`
-	Root      bool     `json:"run_as_root"`
-	Cipher    string   `json:"cipher"`
-	Auth      string   `json:"auth"`
-	ConfFile  string   `json:"conf_file"`
-	Version   string   `json:"version"`
-	ClientCrt string   `json:"-"`                 // Cyberghost
-	ClientKey string   `json:"-"`                 // Cyberghost, VPNUnlimited
-	EncPreset string   `json:"encryption_preset"` // PIA
-	IPv6      bool     `json:"ipv6"`              // Mullvad
-	ProcUser  string   `json:"procuser"`          // Process username
-	Interface string   `json:"interface"`
-}
-
-func (settings *OpenVPN) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *OpenVPN) lines() (lines []string) {
-	lines = append(lines, lastIndent+"OpenVPN:")
-
-	lines = append(lines, indent+lastIndent+"Version: "+settings.Version)
-
-	lines = append(lines, indent+lastIndent+"Verbosity level: "+strconv.Itoa(settings.Verbosity))
-
-	lines = append(lines, indent+lastIndent+"Network interface: "+settings.Interface)
-
-	if len(settings.Flags) > 0 {
-		lines = append(lines, indent+lastIndent+"Flags: "+strings.Join(settings.Flags, " "))
-	}
-
-	if settings.Root {
-		lines = append(lines, indent+lastIndent+"Run as root: enabled")
-	}
-
-	if len(settings.Cipher) > 0 {
-		lines = append(lines, indent+lastIndent+"Custom cipher: "+settings.Cipher)
-	}
-	if len(settings.Auth) > 0 {
-		lines = append(lines, indent+lastIndent+"Custom auth algorithm: "+settings.Auth)
-	}
-
-	if settings.ConfFile != "" {
-		lines = append(lines, indent+lastIndent+"Configuration file: "+settings.ConfFile)
-	}
-
-	if settings.ClientKey != "" {
-		lines = append(lines, indent+lastIndent+"Client key is set")
-	}
-
-	if settings.ClientCrt != "" {
-		lines = append(lines, indent+lastIndent+"Client certificate is set")
-	}
-
-	if settings.IPv6 {
-		lines = append(lines, indent+lastIndent+"IPv6: enabled")
-	}
-
-	if settings.EncPreset != "" { // PIA only
-		lines = append(lines, indent+lastIndent+"Encryption preset: "+settings.EncPreset)
-	}
-
-	return lines
-}
-
-func (settings *OpenVPN) read(r reader, serviceProvider string) (err error) {
-	credentialsRequired := false
-	switch serviceProvider {
-	case constants.Custom:
-	case constants.VPNUnlimited:
-	default:
-		credentialsRequired = true
-	}
-
-	settings.User, err = r.getFromEnvOrSecretFile("OPENVPN_USER", credentialsRequired, []string{"USER"})
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_USER: %w", err)
-	}
-	// Remove spaces in user ID to simplify user's life, thanks @JeordyR
-	settings.User = strings.ReplaceAll(settings.User, " ", "")
-
-	if serviceProvider == constants.Mullvad {
-		settings.Password = "m"
-	} else {
-		settings.Password, err = r.getFromEnvOrSecretFile("OPENVPN_PASSWORD", credentialsRequired, []string{"PASSWORD"})
-		if err != nil {
-			return err
-		}
-	}
-
-	settings.Version, err = r.env.Inside("OPENVPN_VERSION",
-		[]string{constants.Openvpn24, constants.Openvpn25}, params.Default(constants.Openvpn25))
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_VERSION: %w", err)
-	}
-
-	settings.Verbosity, err = r.env.IntRange("OPENVPN_VERBOSITY", 0, 6, params.Default("1")) //nolint:gomnd
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_VERBOSITY: %w", err)
-	}
-
-	settings.Flags = []string{}
-	flagsStr, err := r.env.Get("OPENVPN_FLAGS")
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_FLAGS: %w", err)
-	}
-	if flagsStr != "" {
-		settings.Flags = strings.Fields(flagsStr)
-	}
-
-	settings.Root, err = r.env.YesNo("OPENVPN_ROOT", params.Default("yes"))
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_ROOT: %w", err)
-	}
-
-	settings.Cipher, err = r.env.Get("OPENVPN_CIPHER")
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_CIPHER: %w", err)
-	}
-
-	settings.Auth, err = r.env.Get("OPENVPN_AUTH")
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_AUTH: %w", err)
-	}
-
-	const maxMSSFix = 10000
-	mssFix, err := r.env.IntRange("OPENVPN_MSSFIX", 0, maxMSSFix, params.Default("0"))
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_MSSFIX: %w", err)
-	}
-	settings.MSSFix = uint16(mssFix)
-
-	settings.IPv6, err = r.env.OnOff("OPENVPN_IPV6", params.Default("off"))
-	if err != nil {
-		return fmt.Errorf("environment variable OPENVPN_IPV6: %w", err)
-	}
-
-	settings.Interface, err = readInterface(r.env)
-	if err != nil {
-		return err
-	}
-
-	switch serviceProvider {
-	case constants.Custom:
-		err = settings.readCustom(r) // read OPENVPN_CUSTOM_CONFIG
-	case constants.Cyberghost:
-		err = settings.readCyberghost(r)
-	case constants.PrivateInternetAccess:
-		settings.EncPreset, err = getPIAEncryptionPreset(r)
-	case constants.VPNUnlimited:
-		err = settings.readVPNUnlimited(r)
-	case constants.Wevpn:
-		err = settings.readWevpn(r)
-	}
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func readOpenVPNProtocol(r reader) (tcp bool, err error) {
-	protocol, err := r.env.Inside("OPENVPN_PROTOCOL", []string{constants.TCP, constants.UDP},
-		params.Default(constants.UDP), params.RetroKeys([]string{"PROTOCOL"}, r.onRetroActive))
-	if err != nil {
-		return false, fmt.Errorf("environment variable OPENVPN_PROTOCOL: %w", err)
-	}
-	return protocol == constants.TCP, nil
-}
-
-const openvpnIntfRegexString = `^.*[0-9]$`
-
-var openvpnIntfRegexp = regexp.MustCompile(openvpnIntfRegexString)
-var errInterfaceNameNotValid = errors.New("interface name is not valid")
-
-func readInterface(env params.Interface) (intf string, err error) {
-	intf, err = env.Get("OPENVPN_INTERFACE", params.Default("tun0"))
-	if err != nil {
-		return "", fmt.Errorf("environment variable OPENVPN_INTERFACE: %w", err)
-	}
-
-	if !openvpnIntfRegexp.MatchString(intf) {
-		return "", fmt.Errorf("%w: does not match regex %s: %s",
-			errInterfaceNameNotValid, openvpnIntfRegexString, intf)
-	}
-
-	return intf, nil
-}

internal/configuration/openvpn_test.go

@@ -1,39 +0,0 @@
-package configuration
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_OpenVPN_JSON(t *testing.T) {
-	t.Parallel()
-	in := OpenVPN{
-		Root:  true,
-		Flags: []string{},
-	}
-	data, err := json.MarshalIndent(in, "", "  ")
-	require.NoError(t, err)
-	assert.Equal(t, `{
-  "user": "",
-  "password": "",
-  "verbosity": 0,
-  "flags": [],
-  "mssfix": 0,
-  "run_as_root": true,
-  "cipher": "",
-  "auth": "",
-  "conf_file": "",
-  "version": "",
-  "encryption_preset": "",
-  "ipv6": false,
-  "procuser": "",
-  "interface": ""
-}`, string(data))
-	var out OpenVPN
-	err = json.Unmarshal(data, &out)
-	require.NoError(t, err)
-	assert.Equal(t, in, out)
-}

internal/configuration/privado.go

@@ -1,39 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readPrivado(r reader) (err error) {
-	settings.Name = constants.Privado
-	servers := r.servers.GetPrivado()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.PrivadoCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Regions, err = r.env.CSVInside("REGION", constants.PrivadoRegionChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable REGION: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.PrivadoCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME", constants.PrivadoHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	return nil
-}

internal/configuration/privateinternetaccess.go

@@ -1,75 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-func (settings *Provider) readPrivateInternetAccess(r reader) (err error) {
-	settings.Name = constants.PrivateInternetAccess
-	servers := r.servers.GetPia()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Regions, err = r.env.CSVInside("REGION", constants.PIAGeoChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable REGION: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME", constants.PIAHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	settings.ServerSelection.Names, err = r.env.CSVInside("SERVER_NAME", constants.PIANameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_NAME: %w", err)
-	}
-
-	settings.PortForwarding.Enabled, err = r.env.OnOff("PORT_FORWARDING", params.Default("off"))
-	if err != nil {
-		return fmt.Errorf("environment variable PORT_FORWARDING: %w", err)
-	}
-
-	if settings.PortForwarding.Enabled {
-		settings.PortForwarding.Filepath, err = r.env.Path("PORT_FORWARDING_STATUS_FILE",
-			params.Default("/tmp/gluetun/forwarded_port"), params.CaseSensitiveValue())
-		if err != nil {
-			return fmt.Errorf("environment variable PORT_FORWARDING_STATUS_FILE: %w", err)
-		}
-	}
-
-	return settings.ServerSelection.OpenVPN.readPrivateInternetAccess(r)
-}
-
-func (settings *OpenVPNSelection) readPrivateInternetAccess(r reader) (err error) {
-	settings.EncPreset, err = getPIAEncryptionPreset(r)
-	if err != nil {
-		return err
-	}
-
-	settings.CustomPort, err = readOpenVPNCustomPort(r, openvpnPortValidation{allAllowed: true})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func getPIAEncryptionPreset(r reader) (encryptionPreset string, err error) {
-	encryptionPreset, err = r.env.Inside("PIA_ENCRYPTION",
-		[]string{constants.PIAEncryptionPresetNone, constants.PIAEncryptionPresetNormal, constants.PIAEncryptionPresetStrong},
-		params.RetroKeys([]string{"ENCRYPTION"}, r.onRetroActive),
-		params.Default(constants.PIAEncryptionPresetStrong),
-	)
-	if err != nil {
-		return "", fmt.Errorf("environment variable PIA_ENCRYPTION: %w", err)
-	}
-
-	return encryptionPreset, nil
-}

internal/configuration/privatevpn.go

@@ -1,35 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readPrivatevpn(r reader) (err error) {
-	settings.Name = constants.Privatevpn
-	servers := r.servers.GetPrivatevpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.PrivatevpnCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.PrivatevpnCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.PrivatevpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
-}

internal/configuration/protonvpn.go

@@ -1,51 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-func (settings *Provider) readProtonvpn(r reader) (err error) {
-	settings.Name = constants.Protonvpn
-	servers := r.servers.GetProtonvpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.ProtonvpnCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Regions, err = r.env.CSVInside("REGION", constants.ProtonvpnRegionChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable REGION: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.ProtonvpnCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Names, err = r.env.CSVInside("SERVER_NAME", constants.ProtonvpnNameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_NAME: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME",
-		constants.ProtonvpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	settings.ServerSelection.FreeOnly, err = r.env.YesNo("FREE_ONLY", params.Default("no"))
-	if err != nil {
-		return fmt.Errorf("environment variable FREE_ONLY: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolAndPort(r)
-}

internal/configuration/provider.go

@@ -1,246 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"strings"
-
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params"
-)
-
-// Provider contains settings specific to a VPN provider.
-type Provider struct {
-	Name            string          `json:"name"`
-	ServerSelection ServerSelection `json:"server_selection"`
-	PortForwarding  PortForwarding  `json:"port_forwarding"`
-}
-
-func (settings *Provider) lines() (lines []string) {
-	if settings.Name == "" { // custom OpenVPN configuration
-		return nil
-	}
-
-	lines = append(lines, lastIndent+strings.Title(settings.Name)+" settings:")
-
-	for _, line := range settings.ServerSelection.toLines() {
-		lines = append(lines, indent+line)
-	}
-
-	if settings.PortForwarding.Enabled { // PIA
-		lines = append(lines, indent+lastIndent+"Port forwarding:")
-		for _, line := range settings.PortForwarding.lines() {
-			lines = append(lines, indent+indent+line)
-		}
-	}
-
-	return lines
-}
-
-var (
-	ErrInvalidVPNProvider = errors.New("invalid VPN provider")
-)
-
-func (settings *Provider) read(r reader, vpnType string) error {
-	err := settings.readVPNServiceProvider(r, vpnType)
-	if err != nil {
-		return err
-	}
-
-	switch settings.Name {
-	case constants.Custom:
-		err = settings.readCustom(r, vpnType)
-	case constants.Cyberghost:
-		err = settings.readCyberghost(r)
-	case constants.Expressvpn:
-		err = settings.readExpressvpn(r)
-	case constants.Fastestvpn:
-		err = settings.readFastestvpn(r)
-	case constants.HideMyAss:
-		err = settings.readHideMyAss(r)
-	case constants.Ipvanish:
-		err = settings.readIpvanish(r)
-	case constants.Ivpn:
-		err = settings.readIvpn(r)
-	case constants.Mullvad:
-		err = settings.readMullvad(r)
-	case constants.Nordvpn:
-		err = settings.readNordvpn(r)
-	case constants.Privado:
-		err = settings.readPrivado(r)
-	case constants.PrivateInternetAccess:
-		err = settings.readPrivateInternetAccess(r)
-	case constants.Privatevpn:
-		err = settings.readPrivatevpn(r)
-	case constants.Protonvpn:
-		err = settings.readProtonvpn(r)
-	case constants.Purevpn:
-		err = settings.readPurevpn(r)
-	case constants.Surfshark:
-		err = settings.readSurfshark(r)
-	case constants.Torguard:
-		err = settings.readTorguard(r)
-	case constants.VPNUnlimited:
-		err = settings.readVPNUnlimited(r)
-	case constants.Vyprvpn:
-		err = settings.readVyprvpn(r)
-	case constants.Wevpn:
-		err = settings.readWevpn(r)
-	case constants.Windscribe:
-		err = settings.readWindscribe(r)
-	default:
-		return fmt.Errorf("%w: %s", ErrInvalidVPNProvider, settings.Name)
-	}
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.VPN = vpnType
-	return nil
-}
-
-func (settings *Provider) readVPNServiceProvider(r reader, vpnType string) (err error) {
-	var allowedVPNServiceProviders []string
-	switch vpnType {
-	case constants.OpenVPN:
-		allowedVPNServiceProviders = []string{
-			constants.Custom,
-			"cyberghost", constants.Expressvpn, "fastestvpn", "hidemyass", "ipvanish",
-			"ivpn", "mullvad", "nordvpn",
-			"privado", "pia", "private internet access", "privatevpn", "protonvpn",
-			"purevpn", "surfshark", "torguard", constants.VPNUnlimited, "vyprvpn",
-			constants.Wevpn, "windscribe"}
-	case constants.Wireguard:
-		allowedVPNServiceProviders = []string{
-			constants.Custom, constants.Ivpn,
-			constants.Mullvad, constants.Windscribe,
-		}
-	}
-
-	vpnsp, err := r.env.Inside("VPNSP", allowedVPNServiceProviders,
-		params.Default("private internet access"))
-	if err != nil {
-		return fmt.Errorf("environment variable VPNSP: %w", err)
-	}
-	if vpnsp == "pia" { // retro compatibility
-		vpnsp = "private internet access"
-	}
-
-	if settings.isOpenVPNCustomConfig(r.env) { // retro compatibility
-		vpnsp = constants.Custom
-	}
-
-	settings.Name = vpnsp
-
-	return nil
-}
-
-func commaJoin(slice []string) string {
-	return strings.Join(slice, ", ")
-}
-
-func protoToString(tcp bool) string {
-	if tcp {
-		return constants.TCP
-	}
-	return constants.UDP
-}
-
-func readTargetIP(env params.Interface) (targetIP net.IP, err error) {
-	targetIP, err = readIP(env, "OPENVPN_TARGET_IP")
-	if err != nil {
-		return nil, fmt.Errorf("environment variable OPENVPN_TARGET_IP: %w", err)
-	}
-	return targetIP, nil
-}
-
-type openvpnPortValidation struct {
-	allAllowed bool
-	tcp        bool
-	allowedTCP []uint16
-	allowedUDP []uint16
-}
-
-func readOpenVPNCustomPort(r reader, validation openvpnPortValidation) (
-	port uint16, err error) {
-	port, err = readPortOrZero(r.env, "OPENVPN_PORT")
-	if err != nil {
-		return 0, fmt.Errorf("environment variable OPENVPN_PORT: %w", err)
-	} else if port == 0 {
-		// Try using old variable name
-		port, err = readPortOrZero(r.env, "PORT")
-		if err != nil {
-			r.onRetroActive("PORT", "OPENVPN_PORT")
-			return 0, fmt.Errorf("environment variable PORT: %w", err)
-		}
-	}
-
-	if port == 0 || validation.allAllowed {
-		return port, nil
-	}
-
-	if validation.tcp {
-		for _, allowedPort := range validation.allowedTCP {
-			if port == allowedPort {
-				return port, nil
-			}
-		}
-		return 0, fmt.Errorf(
-			"environment variable PORT: %w: port %d for TCP protocol, can only be one of %s",
-			ErrInvalidPort, port, portsToString(validation.allowedTCP))
-	}
-	for _, allowedPort := range validation.allowedUDP {
-		if port == allowedPort {
-			return port, nil
-		}
-	}
-	return 0, fmt.Errorf(
-		"environment variable PORT: %w: port %d for UDP protocol, can only be one of %s",
-		ErrInvalidPort, port, portsToString(validation.allowedUDP))
-}
-
-// note: set allowed to an empty slice to allow all valid ports
-func readWireguardCustomPort(env params.Interface, allowed []uint16) (port uint16, err error) {
-	port, err = readPortOrZero(env, "WIREGUARD_ENDPOINT_PORT")
-	if err != nil {
-		return 0, fmt.Errorf("environment variable WIREGUARD_ENDPOINT_PORT: %w", err)
-	} else if port == 0 {
-		port, _ = readPortOrZero(env, "WIREGUARD_PORT")
-		if err == nil {
-			return port, nil // 0 or WIREGUARD_PORT value
-		}
-		return 0, nil // default 0
-	}
-
-	if len(allowed) == 0 {
-		return port, nil
-	}
-
-	for i := range allowed {
-		if allowed[i] == port {
-			return port, nil
-		}
-	}
-
-	return 0, fmt.Errorf(
-		"environment variable WIREGUARD_PORT: %w: port %d, can only be one of %s",
-		ErrInvalidPort, port, portsToString(allowed))
-}
-
-func portsToString(ports []uint16) string {
-	slice := make([]string, len(ports))
-	for i := range ports {
-		slice[i] = fmt.Sprint(ports[i])
-	}
-	return strings.Join(slice, ", ")
-}
-
-// isOpenVPNCustomConfig is for retro compatibility to set VPNSP=custom
-// if OPENVPN_CUSTOM_CONFIG is set.
-func (settings Provider) isOpenVPNCustomConfig(env params.Interface) (ok bool) {
-	s, _ := env.Get("VPN_TYPE")
-	isOpenVPN := s == constants.OpenVPN
-	s, _ = env.Get("OPENVPN_CUSTOM_CONFIG")
-	return isOpenVPN && s != ""
-}

internal/configuration/provider_test.go

@@ -1,447 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/qdm12/gluetun/internal/constants"
-	"github.com/qdm12/golibs/params/mock_params"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-var errDummy = errors.New("dummy")
-
-func Test_Provider_lines(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		settings Provider
-		lines    []string
-	}{
-		"cyberghost": {
-			settings: Provider{
-				Name: constants.Cyberghost,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "El country"},
-				},
-			},
-			lines: []string{
-				"|--Cyberghost settings:",
-				"   |--Countries: a, El country",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"expressvpn": {
-			settings: Provider{
-				Name: constants.Expressvpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Hostnames: []string{"a", "b"},
-					Countries: []string{"c", "d"},
-					Cities:    []string{"e", "f"},
-				},
-			},
-			lines: []string{
-				"|--Expressvpn settings:",
-				"   |--Countries: c, d",
-				"   |--Cities: e, f",
-				"   |--Hostnames: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"fastestvpn": {
-			settings: Provider{
-				Name: constants.Fastestvpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Hostnames: []string{"a", "b"},
-					Countries: []string{"c", "d"},
-				},
-			},
-			lines: []string{
-				"|--Fastestvpn settings:",
-				"   |--Countries: c, d",
-				"   |--Hostnames: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"hidemyass": {
-			settings: Provider{
-				Name: constants.HideMyAss,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "b"},
-					Cities:    []string{"c", "d"},
-					Hostnames: []string{"e", "f"},
-				},
-			},
-			lines: []string{
-				"|--Hidemyass settings:",
-				"   |--Countries: a, b",
-				"   |--Cities: c, d",
-				"   |--Hostnames: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"ipvanish": {
-			settings: Provider{
-				Name: constants.Ipvanish,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "b"},
-					Cities:    []string{"c", "d"},
-					Hostnames: []string{"e", "f"},
-				},
-			},
-			lines: []string{
-				"|--Ipvanish settings:",
-				"   |--Countries: a, b",
-				"   |--Cities: c, d",
-				"   |--Hostnames: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"ivpn": {
-			settings: Provider{
-				Name: constants.Ivpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "b"},
-					Cities:    []string{"c", "d"},
-					Hostnames: []string{"e", "f"},
-				},
-			},
-			lines: []string{
-				"|--Ivpn settings:",
-				"   |--Countries: a, b",
-				"   |--Cities: c, d",
-				"   |--Hostnames: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"mullvad": {
-			settings: Provider{
-				Name: constants.Mullvad,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "b"},
-					Cities:    []string{"c", "d"},
-					ISPs:      []string{"e", "f"},
-					OpenVPN: OpenVPNSelection{
-						CustomPort: 1,
-					},
-				},
-			},
-			lines: []string{
-				"|--Mullvad settings:",
-				"   |--Countries: a, b",
-				"   |--Cities: c, d",
-				"   |--ISPs: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-				"      |--Custom port: 1",
-			},
-		},
-		"nordvpn": {
-			settings: Provider{
-				Name: constants.Nordvpn,
-				ServerSelection: ServerSelection{
-					VPN:     constants.OpenVPN,
-					Regions: []string{"a", "b"},
-					Numbers: []uint16{1, 2},
-				},
-			},
-			lines: []string{
-				"|--Nordvpn settings:",
-				"   |--Regions: a, b",
-				"   |--Numbers: 1, 2",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"privado": {
-			settings: Provider{
-				Name: constants.Privado,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Hostnames: []string{"a", "b"},
-				},
-			},
-			lines: []string{
-				"|--Privado settings:",
-				"   |--Hostnames: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"privatevpn": {
-			settings: Provider{
-				Name: constants.Privatevpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Hostnames: []string{"a", "b"},
-					Countries: []string{"c", "d"},
-					Cities:    []string{"e", "f"},
-				},
-			},
-			lines: []string{
-				"|--Privatevpn settings:",
-				"   |--Countries: c, d",
-				"   |--Cities: e, f",
-				"   |--Hostnames: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"protonvpn": {
-			settings: Provider{
-				Name: constants.Protonvpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "b"},
-					Regions:   []string{"c", "d"},
-					Cities:    []string{"e", "f"},
-					Names:     []string{"g", "h"},
-					Hostnames: []string{"i", "j"},
-				},
-			},
-			lines: []string{
-				"|--Protonvpn settings:",
-				"   |--Countries: a, b",
-				"   |--Regions: c, d",
-				"   |--Cities: e, f",
-				"   |--Hostnames: i, j",
-				"   |--Names: g, h",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"private internet access": {
-			settings: Provider{
-				Name: constants.PrivateInternetAccess,
-				ServerSelection: ServerSelection{
-					VPN:     constants.OpenVPN,
-					Regions: []string{"a", "b"},
-					OpenVPN: OpenVPNSelection{
-						CustomPort: 1,
-					},
-				},
-				PortForwarding: PortForwarding{
-					Enabled:  true,
-					Filepath: string("/here"),
-				},
-			},
-			lines: []string{
-				"|--Private Internet Access settings:",
-				"   |--Regions: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-				"      |--Custom port: 1",
-				"   |--Port forwarding:",
-				"      |--File path: /here",
-			},
-		},
-		"purevpn": {
-			settings: Provider{
-				Name: constants.Purevpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Regions:   []string{"a", "b"},
-					Countries: []string{"c", "d"},
-					Cities:    []string{"e", "f"},
-				},
-			},
-			lines: []string{
-				"|--Purevpn settings:",
-				"   |--Countries: c, d",
-				"   |--Regions: a, b",
-				"   |--Cities: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"surfshark": {
-			settings: Provider{
-				Name: constants.Surfshark,
-				ServerSelection: ServerSelection{
-					VPN:     constants.OpenVPN,
-					Regions: []string{"a", "b"},
-				},
-			},
-			lines: []string{
-				"|--Surfshark settings:",
-				"   |--Regions: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"torguard": {
-			settings: Provider{
-				Name: constants.Torguard,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Countries: []string{"a", "b"},
-					Cities:    []string{"c", "d"},
-					Hostnames: []string{"e"},
-				},
-			},
-			lines: []string{
-				"|--Torguard settings:",
-				"   |--Countries: a, b",
-				"   |--Cities: c, d",
-				"   |--Hostnames: e",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		constants.VPNUnlimited: {
-			settings: Provider{
-				Name: constants.VPNUnlimited,
-				ServerSelection: ServerSelection{
-					VPN:        constants.OpenVPN,
-					Countries:  []string{"a", "b"},
-					Cities:     []string{"c", "d"},
-					Hostnames:  []string{"e", "f"},
-					FreeOnly:   true,
-					StreamOnly: true,
-				},
-			},
-			lines: []string{
-				"|--Vpn Unlimited settings:",
-				"   |--Countries: a, b",
-				"   |--Cities: c, d",
-				"   |--Free servers only",
-				"   |--Stream servers only",
-				"   |--Hostnames: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"vyprvpn": {
-			settings: Provider{
-				Name: constants.Vyprvpn,
-				ServerSelection: ServerSelection{
-					VPN:     constants.OpenVPN,
-					Regions: []string{"a", "b"},
-				},
-			},
-			lines: []string{
-				"|--Vyprvpn settings:",
-				"   |--Regions: a, b",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-			},
-		},
-		"wevpn": {
-			settings: Provider{
-				Name: constants.Wevpn,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Cities:    []string{"a", "b"},
-					Hostnames: []string{"c", "d"},
-					OpenVPN: OpenVPNSelection{
-						CustomPort: 1,
-					},
-				},
-			},
-			lines: []string{
-				"|--Wevpn settings:",
-				"   |--Cities: a, b",
-				"   |--Hostnames: c, d",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-				"      |--Custom port: 1",
-			},
-		},
-		"windscribe": {
-			settings: Provider{
-				Name: constants.Windscribe,
-				ServerSelection: ServerSelection{
-					VPN:       constants.OpenVPN,
-					Regions:   []string{"a", "b"},
-					Cities:    []string{"c", "d"},
-					Hostnames: []string{"e", "f"},
-					OpenVPN: OpenVPNSelection{
-						CustomPort: 1,
-					},
-				},
-			},
-			lines: []string{
-				"|--Windscribe settings:",
-				"   |--Regions: a, b",
-				"   |--Cities: c, d",
-				"   |--Hostnames: e, f",
-				"   |--OpenVPN selection:",
-				"      |--Protocol: udp",
-				"      |--Custom port: 1",
-			},
-		},
-	}
-
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			lines := testCase.settings.lines()
-
-			assert.Equal(t, testCase.lines, lines)
-		})
-	}
-}
-
-func Test_readProtocol(t *testing.T) {
-	t.Parallel()
-
-	testCases := map[string]struct {
-		mockStr string
-		mockErr error
-		tcp     bool
-		err     error
-	}{
-		"error": {
-			mockErr: errDummy,
-			err:     errors.New("environment variable OPENVPN_PROTOCOL: dummy"),
-		},
-		"success": {
-			mockStr: "tcp",
-			tcp:     true,
-		},
-	}
-
-	for name, testCase := range testCases {
-		testCase := testCase
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			ctrl := gomock.NewController(t)
-
-			env := mock_params.NewMockInterface(ctrl)
-			env.EXPECT().
-				Inside("OPENVPN_PROTOCOL", []string{"tcp", "udp"}, gomock.Any(), gomock.Any()).
-				Return(testCase.mockStr, testCase.mockErr)
-			reader := reader{
-				env: env,
-			}
-
-			tcp, err := readOpenVPNProtocol(reader)
-
-			if testCase.err != nil {
-				require.Error(t, err)
-				assert.Equal(t, testCase.err.Error(), err.Error())
-			} else {
-				assert.NoError(t, err)
-			}
-
-			assert.Equal(t, testCase.tcp, tcp)
-		})
-	}
-}

internal/configuration/publicip.go

@@ -1,47 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/qdm12/golibs/params"
-)
-
-type PublicIP struct {
-	Period     time.Duration `json:"period"`
-	IPFilepath string        `json:"ip_filepath"`
-}
-
-func (settings *PublicIP) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *PublicIP) lines() (lines []string) {
-	if settings.Period == 0 {
-		lines = append(lines, lastIndent+"Public IP getter: disabled")
-		return lines
-	}
-
-	lines = append(lines, lastIndent+"Public IP getter:")
-	lines = append(lines, indent+lastIndent+"Fetch period: "+settings.Period.String())
-	lines = append(lines, indent+lastIndent+"IP file: "+settings.IPFilepath)
-
-	return lines
-}
-
-func (settings *PublicIP) read(r reader) (err error) {
-	settings.Period, err = r.env.Duration("PUBLICIP_PERIOD", params.Default("12h"))
-	if err != nil {
-		return fmt.Errorf("environment variable PUBLICIP_PERIOD: %w", err)
-	}
-
-	settings.IPFilepath, err = r.env.Path("PUBLICIP_FILE", params.CaseSensitiveValue(),
-		params.Default("/tmp/gluetun/ip"),
-		params.RetroKeys([]string{"IP_STATUS_FILE"}, r.onRetroActive))
-	if err != nil {
-		return fmt.Errorf("environment variable PUBLICIP_FILE (or IP_STATUS_FILE): %w", err)
-	}
-
-	return nil
-}

internal/configuration/purevpn.go

@@ -1,39 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-func (settings *Provider) readPurevpn(r reader) (err error) {
-	settings.Name = constants.Purevpn
-	servers := r.servers.GetPurevpn()
-
-	settings.ServerSelection.TargetIP, err = readTargetIP(r.env)
-	if err != nil {
-		return err
-	}
-
-	settings.ServerSelection.Regions, err = r.env.CSVInside("REGION", constants.PurevpnRegionChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable REGION: %w", err)
-	}
-
-	settings.ServerSelection.Countries, err = r.env.CSVInside("COUNTRY", constants.PurevpnCountryChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable COUNTRY: %w", err)
-	}
-
-	settings.ServerSelection.Cities, err = r.env.CSVInside("CITY", constants.PurevpnCityChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable CITY: %w", err)
-	}
-
-	settings.ServerSelection.Hostnames, err = r.env.CSVInside("SERVER_HOSTNAME", constants.PurevpnHostnameChoices(servers))
-	if err != nil {
-		return fmt.Errorf("environment variable SERVER_HOSTNAME: %w", err)
-	}
-
-	return settings.ServerSelection.OpenVPN.readProtocolOnly(r)
-}

internal/configuration/reader.go

@@ -1,134 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"net"
-	"strconv"
-	"strings"
-
-	"github.com/qdm12/gluetun/internal/models"
-	ovpnextract "github.com/qdm12/gluetun/internal/openvpn/extract"
-	"github.com/qdm12/golibs/params"
-	"github.com/qdm12/golibs/verification"
-)
-
-//go:generate mockgen -destination=warner_mock_test.go -package configuration . Warner
-
-type reader struct {
-	servers models.AllServers
-	env     params.Interface
-	warner  Warner
-	regex   verification.Regex
-	ovpnExt ovpnextract.Interface
-}
-
-type Warner interface {
-	Warn(s string)
-}
-
-func newReader(env params.Interface,
-	servers models.AllServers, warner Warner) reader {
-	return reader{
-		servers: servers,
-		env:     env,
-		warner:  warner,
-		regex:   verification.NewRegex(),
-		ovpnExt: ovpnextract.New(),
-	}
-}
-
-func (r *reader) onRetroActive(oldKey, newKey string) {
-	r.warner.Warn(
-		"You are using the old environment variable " + oldKey +
-			", please consider changing it to " + newKey)
-}
-
-var (
-	ErrInvalidPort = errors.New("invalid port")
-)
-
-func readCSVPorts(env params.Interface, key string) (ports []uint16, err error) {
-	s, err := env.Get(key)
-	if err != nil {
-		return nil, err
-	} else if s == "" {
-		return nil, nil
-	}
-
-	portsStr := strings.Split(s, ",")
-	ports = make([]uint16, len(portsStr))
-	for i, portStr := range portsStr {
-		portInt, err := strconv.Atoi(portStr)
-		if err != nil {
-			return nil, fmt.Errorf("%w: %s: %s", ErrInvalidPort, portStr, err)
-		} else if portInt <= 0 || portInt > 65535 {
-			return nil, fmt.Errorf("%w: %d: must be between 1 and 65535", ErrInvalidPort, portInt)
-		}
-		ports[i] = uint16(portInt)
-	}
-
-	return ports, nil
-}
-
-var (
-	ErrInvalidIPNet = errors.New("invalid IP network")
-)
-
-func readCSVIPNets(env params.Interface, key string, options ...params.OptionSetter) (
-	ipNets []net.IPNet, err error) {
-	s, err := env.Get(key, options...)
-	if err != nil {
-		return nil, err
-	} else if s == "" {
-		return nil, nil
-	}
-
-	ipNetsStr := strings.Split(s, ",")
-	ipNets = make([]net.IPNet, len(ipNetsStr))
-	for i, ipNetStr := range ipNetsStr {
-		_, ipNet, err := net.ParseCIDR(ipNetStr)
-		if err != nil {
-			return nil, fmt.Errorf("%w: %s: %s",
-				ErrInvalidIPNet, ipNetStr, err)
-		} else if ipNet == nil {
-			return nil, fmt.Errorf("%w: %s: subnet is nil", ErrInvalidIPNet, ipNetStr)
-		}
-		ipNets[i] = *ipNet
-	}
-
-	return ipNets, nil
-}
-
-var (
-	ErrInvalidIP = errors.New("invalid IP address")
-)
-
-func readIP(env params.Interface, key string) (ip net.IP, err error) {
-	s, err := env.Get(key)
-	if s == "" {
-		return nil, nil
-	} else if err != nil {
-		return nil, err
-	}
-
-	ip = net.ParseIP(s)
-	if ip == nil {
-		return nil, fmt.Errorf("%w: %s", ErrInvalidIP, s)
-	}
-
-	return ip, nil
-}
-
-func readPortOrZero(env params.Interface, key string) (port uint16, err error) {
-	s, err := env.Get(key, params.Default("0"))
-	if err != nil {
-		return 0, err
-	}
-
-	if s == "0" {
-		return 0, nil
-	}
-
-	return env.Port(key)
-}

internal/configuration/secrets.go

@@ -1,119 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/qdm12/golibs/params"
-)
-
-var (
-	ErrGetSecretFilepath = errors.New("cannot get secret file path from env")
-	ErrReadSecretFile    = errors.New("cannot read secret file")
-	ErrSecretFileIsEmpty = errors.New("secret file is empty")
-	ErrReadNonSecretFile = errors.New("cannot read non secret file")
-	ErrFilesDoNotExist   = errors.New("files do not exist")
-)
-
-func cleanSuffix(value string) string {
-	value = strings.TrimSuffix(value, "\n")
-	value = strings.TrimSuffix(value, "\r")
-	return value
-}
-
-func (r *reader) getFromEnvOrSecretFile(envKey string, compulsory bool, retroKeys []string) (value string, err error) {
-	envOptions := []params.OptionSetter{
-		params.Compulsory(), // to fallback on file reading
-		params.CaseSensitiveValue(),
-		params.Unset(),
-		params.RetroKeys(retroKeys, r.onRetroActive),
-	}
-	value, envErr := r.env.Get(envKey, envOptions...)
-	if envErr == nil {
-		value = cleanSuffix(value)
-		return value, nil
-	}
-
-	secretFilepathEnvKey := envKey + "_SECRETFILE"
-	defaultSecretFile := "/run/secrets/" + strings.ToLower(envKey)
-	filepath, err := r.env.Get(secretFilepathEnvKey,
-		params.CaseSensitiveValue(),
-		params.Default(defaultSecretFile),
-	)
-	if err != nil {
-		return "", fmt.Errorf("%w: environment variable %s: %s",
-			ErrGetSecretFilepath, secretFilepathEnvKey, err)
-	}
-
-	file, fileErr := os.OpenFile(filepath, os.O_RDONLY, 0)
-	if os.IsNotExist(fileErr) {
-		if compulsory {
-			return "", fmt.Errorf("environment variable %s: %w", envKey, envErr)
-		}
-		return "", nil
-	} else if fileErr != nil {
-		return "", fmt.Errorf("%w: %s: %s", ErrReadSecretFile, filepath, fileErr)
-	}
-
-	b, err := io.ReadAll(file)
-	if err != nil {
-		return "", fmt.Errorf("%w: %s: %s", ErrReadSecretFile, filepath, err)
-	}
-
-	value = string(b)
-	value = cleanSuffix(value)
-	if compulsory && value == "" {
-		return "", fmt.Errorf("%s: %w", filepath, ErrSecretFileIsEmpty)
-	}
-
-	return value, nil
-}
-
-// Tries to read from the secret file then the non secret file.
-func (r *reader) getFromFileOrSecretFile(secretName, filepath string) (
-	b []byte, err error) {
-	defaultSecretFile := "/run/secrets/" + strings.ToLower(secretName)
-	key := strings.ToUpper(secretName) + "_SECRETFILE"
-	secretFilepath, err := r.env.Get(key,
-		params.CaseSensitiveValue(),
-		params.Default(defaultSecretFile),
-	)
-	if err != nil {
-		return b, fmt.Errorf("environment variable %s: %w: %s", key, ErrGetSecretFilepath, err)
-	}
-
-	b, err = readFromFile(secretFilepath)
-	if err != nil && !os.IsNotExist(err) {
-		return b, fmt.Errorf("%w: %s", ErrReadSecretFile, err)
-	} else if err == nil {
-		return b, nil
-	}
-
-	// Secret file does not exist, try the non secret file
-	b, err = readFromFile(filepath)
-	if err != nil && !os.IsNotExist(err) {
-		return nil, fmt.Errorf("%w: %s", ErrReadSecretFile, err)
-	} else if err == nil {
-		return b, nil
-	}
-	return nil, fmt.Errorf("%w: %s and %s", ErrFilesDoNotExist, secretFilepath, filepath)
-}
-
-func readFromFile(filepath string) (b []byte, err error) {
-	file, err := os.Open(filepath)
-	if err != nil {
-		return nil, err
-	}
-	b, err = io.ReadAll(file)
-	if err != nil {
-		_ = file.Close()
-		return nil, err
-	}
-	if err := file.Close(); err != nil {
-		return nil, err
-	}
-	return b, nil
-}

internal/configuration/selection.go

@@ -1,188 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"net"
-
-	"github.com/qdm12/gluetun/internal/constants"
-)
-
-type ServerSelection struct { //nolint:maligned
-	// Common
-	VPN      string `json:"vpn"` // note: this is required
-	TargetIP net.IP `json:"target_ip,omitempty"`
-	// TODO comments
-	// Cyberghost, PIA, Protonvpn, Surfshark, Windscribe, Vyprvpn, NordVPN
-	Regions []string `json:"regions"`
-
-	// Expressvpn, Fastestvpn, HideMyAss, IPVanish, IVPN, Mullvad, PrivateVPN, Protonvpn, PureVPN, VPNUnlimited
-	Countries []string `json:"countries"`
-	// Expressvpn, HideMyAss, IPVanish, IVPN, Mullvad, PrivateVPN, Protonvpn, PureVPN, VPNUnlimited, WeVPN, Windscribe
-	Cities []string `json:"cities"`
-	// Expressvpn, Fastestvpn, HideMyAss, IPVanish, IVPN, PrivateVPN, Windscribe, Privado, Protonvpn, VPNUnlimited, WeVPN
-	Hostnames []string `json:"hostnames"`
-	Names     []string `json:"names"` // Protonvpn
-
-	// Mullvad
-	ISPs  []string `json:"isps"`
-	Owned bool     `json:"owned"`
-
-	// NordVPN
-	Numbers []uint16 `json:"numbers"`
-
-	// ProtonVPN
-	FreeOnly bool `json:"free_only"`
-
-	// VPNUnlimited
-	StreamOnly bool `json:"stream_only"`
-
-	// Surfshark
-	MultiHopOnly bool `json:"multihop_only"`
-
-	OpenVPN   OpenVPNSelection   `json:"openvpn"`
-	Wireguard WireguardSelection `json:"wireguard"`
-}
-
-func (selection ServerSelection) toLines() (lines []string) {
-	if selection.TargetIP != nil {
-		lines = append(lines, lastIndent+"Target IP address: "+selection.TargetIP.String())
-	}
-
-	if len(selection.Countries) > 0 {
-		lines = append(lines, lastIndent+"Countries: "+commaJoin(selection.Countries))
-	}
-
-	if len(selection.Regions) > 0 {
-		lines = append(lines, lastIndent+"Regions: "+commaJoin(selection.Regions))
-	}
-
-	if len(selection.Cities) > 0 {
-		lines = append(lines, lastIndent+"Cities: "+commaJoin(selection.Cities))
-	}
-
-	if len(selection.ISPs) > 0 {
-		lines = append(lines, lastIndent+"ISPs: "+commaJoin(selection.ISPs))
-	}
-
-	if selection.FreeOnly {
-		lines = append(lines, lastIndent+"Free servers only")
-	}
-
-	if selection.StreamOnly {
-		lines = append(lines, lastIndent+"Stream servers only")
-	}
-
-	if len(selection.Hostnames) > 0 {
-		lines = append(lines, lastIndent+"Hostnames: "+commaJoin(selection.Hostnames))
-	}
-
-	if len(selection.Names) > 0 {
-		lines = append(lines, lastIndent+"Names: "+commaJoin(selection.Names))
-	}
-
-	if len(selection.Numbers) > 0 {
-		numbersString := make([]string, len(selection.Numbers))
-		for i, numberUint16 := range selection.Numbers {
-			numbersString[i] = fmt.Sprint(numberUint16)
-		}
-		lines = append(lines, lastIndent+"Numbers: "+commaJoin(numbersString))
-	}
-
-	if selection.VPN == constants.OpenVPN {
-		lines = append(lines, selection.OpenVPN.lines()...)
-	} else { // wireguard
-		lines = append(lines, selection.Wireguard.lines()...)
-	}
-
-	return lines
-}
-
-type OpenVPNSelection struct {
-	ConfFile   string `json:"conf_file"`         // Custom configuration file path
-	TCP        bool   `json:"tcp"`               // UDP if TCP is false
-	CustomPort uint16 `json:"custom_port"`       // HideMyAss, Mullvad, PIA, ProtonVPN, WeVPN, Windscribe
-	EncPreset  string `json:"encryption_preset"` // PIA - needed to get the port number
-}
-
-func (settings *OpenVPNSelection) lines() (lines []string) {
-	lines = append(lines, lastIndent+"OpenVPN selection:")
-
-	if settings.ConfFile != "" {
-		lines = append(lines, indent+lastIndent+"Custom configuration file: "+settings.ConfFile)
-	}
-
-	lines = append(lines, indent+lastIndent+"Protocol: "+protoToString(settings.TCP))
-
-	if settings.CustomPort != 0 {
-		lines = append(lines, indent+lastIndent+"Custom port: "+fmt.Sprint(settings.CustomPort))
-	}
-
-	if settings.EncPreset != "" {
-		lines = append(lines, indent+lastIndent+"PIA encryption preset: "+settings.EncPreset)
-	}
-
-	return lines
-}
-
-func (settings *OpenVPNSelection) readProtocolOnly(r reader) (err error) {
-	settings.TCP, err = readOpenVPNProtocol(r)
-	return err
-}
-
-func (settings *OpenVPNSelection) readProtocolAndPort(r reader) (err error) {
-	settings.TCP, err = readOpenVPNProtocol(r)
-	if err != nil {
-		return err
-	}
-
-	settings.CustomPort, err = readOpenVPNCustomPort(r, openvpnPortValidation{allAllowed: true})
-	if err != nil {
-		return fmt.Errorf("environment variable PORT: %w", err)
-	}
-
-	return nil
-}
-
-type WireguardSelection struct {
-	// EndpointPort is a the server port to use for the VPN server.
-	// It is optional for Wireguard VPN providers IVPN, Mullvad
-	// and Windscribe, and compulsory for the others
-	EndpointPort uint16 `json:"port,omitempty"`
-	// PublicKey is the server public key.
-	// It is only used with VPN providers generating Wireguard
-	// configurations specific to each server and user.
-	PublicKey string `json:"publickey,omitempty"`
-	// EndpointIP is the server endpoint IP address.
-	// It is only used with VPN providers generating Wireguard
-	// configurations specific to each server and user.
-	EndpointIP net.IP `json:"endpoint_ip,omitempty"`
-}
-
-func (settings *WireguardSelection) lines() (lines []string) {
-	lines = append(lines, lastIndent+"Wireguard selection:")
-
-	if settings.PublicKey != "" {
-		lines = append(lines, indent+lastIndent+"Public key: "+settings.PublicKey)
-	}
-
-	if settings.EndpointIP != nil {
-		endpoint := settings.EndpointIP.String() + ":" + fmt.Sprint(settings.EndpointPort)
-		lines = append(lines, indent+lastIndent+"Server endpoint: "+endpoint)
-	} else if settings.EndpointPort != 0 {
-		lines = append(lines, indent+lastIndent+"Custom port: "+fmt.Sprint(settings.EndpointPort))
-	}
-
-	return lines
-}
-
-// PortForwarding contains settings for port forwarding.
-type PortForwarding struct {
-	Enabled  bool   `json:"enabled"`
-	Filepath string `json:"filepath"`
-}
-
-func (p *PortForwarding) lines() (lines []string) {
-	return []string{
-		lastIndent + "File path: " + p.Filepath,
-	}
-}

internal/configuration/server.go

@@ -1,50 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"github.com/qdm12/golibs/params"
-)
-
-// ControlServer contains settings to customize the control server operation.
-type ControlServer struct {
-	Port uint16
-	Log  bool
-}
-
-func (settings *ControlServer) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *ControlServer) lines() (lines []string) {
-	lines = append(lines, lastIndent+"HTTP control server:")
-
-	lines = append(lines, indent+lastIndent+"Listening port: "+strconv.Itoa(int(settings.Port)))
-
-	if settings.Log {
-		lines = append(lines, indent+lastIndent+"Logging: enabled")
-	}
-
-	return lines
-}
-
-func (settings *ControlServer) read(r reader) (err error) {
-	settings.Log, err = r.env.OnOff("HTTP_CONTROL_SERVER_LOG", params.Default("on"))
-	if err != nil {
-		return fmt.Errorf("environment variable HTTP_CONTROL_SERVER_LOG: %w", err)
-	}
-
-	var warning string
-	settings.Port, warning, err = r.env.ListeningPort(
-		"HTTP_CONTROL_SERVER_PORT", params.Default("8000"))
-	if len(warning) > 0 {
-		r.warner.Warn(warning)
-	}
-	if err != nil {
-		return fmt.Errorf("environment variable HTTP_CONTROL_SERVER_PORT: %w", err)
-	}
-
-	return nil
-}

internal/configuration/settings.go

@@ -1,125 +0,0 @@
-package configuration
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/qdm12/gluetun/internal/models"
-	"github.com/qdm12/golibs/params"
-)
-
-// Settings contains all settings for the program to run.
-type Settings struct {
-	VPN                VPN
-	System             System
-	DNS                DNS
-	Firewall           Firewall
-	HTTPProxy          HTTPProxy
-	ShadowSocks        ShadowSocks
-	Updater            Updater
-	PublicIP           PublicIP
-	VersionInformation bool
-	ControlServer      ControlServer
-	Health             Health
-	Log                Log
-}
-
-func (settings *Settings) String() string {
-	return strings.Join(settings.lines(), "\n")
-}
-
-func (settings *Settings) lines() (lines []string) {
-	lines = append(lines, "Settings summary below:")
-	lines = append(lines, settings.VPN.lines()...)
-	lines = append(lines, settings.DNS.lines()...)
-	lines = append(lines, settings.Firewall.lines()...)
-	lines = append(lines, settings.Log.lines()...)
-	lines = append(lines, settings.System.lines()...)
-	lines = append(lines, settings.HTTPProxy.lines()...)
-	lines = append(lines, settings.ShadowSocks.lines()...)
-	lines = append(lines, settings.Health.lines()...)
-	lines = append(lines, settings.ControlServer.lines()...)
-	lines = append(lines, settings.Updater.lines()...)
-	lines = append(lines, settings.PublicIP.lines()...)
-	if settings.VersionInformation {
-		lines = append(lines, lastIndent+"Github version information: enabled")
-	}
-	return lines
-}
-
-var (
-	ErrVPN           = errors.New("cannot read VPN settings")
-	ErrSystem        = errors.New("cannot read System settings")
-	ErrDNS           = errors.New("cannot read DNS settings")
-	ErrFirewall      = errors.New("cannot read firewall settings")
-	ErrHTTPProxy     = errors.New("cannot read HTTP proxy settings")
-	ErrShadowsocks   = errors.New("cannot read Shadowsocks settings")
-	ErrControlServer = errors.New("cannot read control server settings")
-	ErrUpdater       = errors.New("cannot read Updater settings")
-	ErrPublicIP      = errors.New("cannot read Public IP getter settings")
-	ErrHealth        = errors.New("cannot read health settings")
-	ErrLog           = errors.New("cannot read log settings")
-)
-
-// Read obtains all configuration options for the program and returns an error as soon
-// as an error is encountered reading them.
-func (settings *Settings) Read(env params.Interface, servers models.AllServers,
-	warner Warner) (err error) {
-	r := newReader(env, servers, warner)
-
-	settings.VersionInformation, err = r.env.OnOff("VERSION_INFORMATION", params.Default("on"))
-	if err != nil {
-		return fmt.Errorf("environment variable VERSION_INFORMATION: %w", err)
-	}
-
-	if err := settings.VPN.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrVPN, err)
-	}
-
-	if err := settings.System.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrSystem, err)
-	}
-
-	if err := settings.DNS.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrDNS, err)
-	}
-
-	if err := settings.Firewall.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrFirewall, err)
-	}
-
-	if err := settings.HTTPProxy.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrHTTPProxy, err)
-	}
-
-	if err := settings.ShadowSocks.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrShadowsocks, err)
-	}
-
-	if err := settings.ControlServer.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrControlServer, err)
-	}
-
-	if err := settings.Updater.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrUpdater, err)
-	}
-
-	if ip := settings.DNS.PlaintextAddress; ip != nil {
-		settings.Updater.DNSAddress = ip.String()
-	}
-
-	if err := settings.PublicIP.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrPublicIP, err)
-	}
-
-	if err := settings.Health.read(r); err != nil {
-		return fmt.Errorf("%w: %s", ErrHealth, err)
-	}
-
-	if err := settings.Log.read(r.env); err != nil {
-		return fmt.Errorf("%w: %s", ErrLog, err)
-	}
-
-	return nil
-}

internal/configuration/settings/dns.go

@@ -0,0 +1,82 @@
+package settings
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// DNS contains settings to configure DNS.
+type DNS struct {
+	// ServerAddress is the DNS server to use inside
+	// the Go program and for the system.
+	// It defaults to '127.0.0.1' to be used with the
+	// DoT server. It cannot be nil in the internal
+	// state.
+	ServerAddress net.IP
+	// KeepNameserver is true if the Docker DNS server
+	// found in /etc/resolv.conf should be kept.
+	// Note settings this to true will go around the
+	// DoT server blocking.
+	// It defaults to false and cannot be nil in the
+	// internal state.
+	KeepNameserver *bool
+	// DOT contains settings to configure the DoT
+	// server.
+	DoT DoT
+}
+
+func (d DNS) validate() (err error) {
+	err = d.DoT.validate()
+	if err != nil {
+		return fmt.Errorf("failed validating DoT settings: %w", err)
+	}
+
+	return nil
+}
+
+func (d *DNS) Copy() (copied DNS) {
+	return DNS{
+		ServerAddress:  helpers.CopyIP(d.ServerAddress),
+		KeepNameserver: helpers.CopyBoolPtr(d.KeepNameserver),
+		DoT:            d.DoT.copy(),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (d *DNS) mergeWith(other DNS) {
+	d.ServerAddress = helpers.MergeWithIP(d.ServerAddress, other.ServerAddress)
+	d.KeepNameserver = helpers.MergeWithBool(d.KeepNameserver, other.KeepNameserver)
+	d.DoT.mergeWith(other.DoT)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (d *DNS) overrideWith(other DNS) {
+	d.ServerAddress = helpers.OverrideWithIP(d.ServerAddress, other.ServerAddress)
+	d.KeepNameserver = helpers.OverrideWithBool(d.KeepNameserver, other.KeepNameserver)
+	d.DoT.overrideWith(other.DoT)
+}
+
+func (d *DNS) setDefaults() {
+	localhost := net.IPv4(127, 0, 0, 1) //nolint:gomnd
+	d.ServerAddress = helpers.DefaultIP(d.ServerAddress, localhost)
+	d.KeepNameserver = helpers.DefaultBool(d.KeepNameserver, false)
+	d.DoT.setDefaults()
+}
+
+func (d DNS) String() string {
+	return d.toLinesNode().String()
+}
+
+func (d DNS) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("DNS settings:")
+	node.Appendf("DNS server address to use: %s", d.ServerAddress)
+	node.Appendf("Keep existing nameserver(s): %s", helpers.BoolPtrToYesNo(d.KeepNameserver))
+	node.AppendNode(d.DoT.toLinesNode())
+	return node
+}

internal/configuration/settings/dnsblacklist.go

@@ -0,0 +1,138 @@
+package settings
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+
+	"github.com/qdm12/dns/pkg/blacklist"
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+	"inet.af/netaddr"
+)
+
+// DNSBlacklist is settings for the DNS blacklist building.
+type DNSBlacklist struct {
+	BlockMalicious       *bool
+	BlockAds             *bool
+	BlockSurveillance    *bool
+	AllowedHosts         []string
+	AddBlockedHosts      []string
+	AddBlockedIPs        []netaddr.IP
+	AddBlockedIPPrefixes []netaddr.IPPrefix
+}
+
+func (b *DNSBlacklist) setDefaults() {
+	b.BlockMalicious = helpers.DefaultBool(b.BlockMalicious, true)
+	b.BlockAds = helpers.DefaultBool(b.BlockAds, false)
+	b.BlockSurveillance = helpers.DefaultBool(b.BlockSurveillance, true)
+}
+
+var hostRegex = regexp.MustCompile(`^([a-zA-Z0-9]|[a-zA-Z0-9_][a-zA-Z0-9\-_]{0,61}[a-zA-Z0-9_])(\.([a-zA-Z0-9]|[a-zA-Z0-9_][a-zA-Z0-9\-_]{0,61}[a-zA-Z0-9]))*$`) //nolint:lll
+
+var (
+	ErrAllowedHostNotValid = errors.New("allowed host is not valid")
+	ErrBlockedHostNotValid = errors.New("blocked host is not valid")
+)
+
+func (b DNSBlacklist) validate() (err error) {
+	for _, host := range b.AllowedHosts {
+		if !hostRegex.MatchString(host) {
+			return fmt.Errorf("%w: %s", ErrAllowedHostNotValid, host)
+		}
+	}
+
+	for _, host := range b.AddBlockedHosts {
+		if !hostRegex.MatchString(host) {
+			return fmt.Errorf("%w: %s", ErrBlockedHostNotValid, host)
+		}
+	}
+
+	return nil
+}
+
+func (b DNSBlacklist) copy() (copied DNSBlacklist) {
+	return DNSBlacklist{
+		BlockMalicious:       helpers.CopyBoolPtr(b.BlockMalicious),
+		BlockAds:             helpers.CopyBoolPtr(b.BlockAds),
+		BlockSurveillance:    helpers.CopyBoolPtr(b.BlockSurveillance),
+		AllowedHosts:         helpers.CopyStringSlice(b.AllowedHosts),
+		AddBlockedHosts:      helpers.CopyStringSlice(b.AddBlockedHosts),
+		AddBlockedIPs:        helpers.CopyNetaddrIPsSlice(b.AddBlockedIPs),
+		AddBlockedIPPrefixes: helpers.CopyIPPrefixSlice(b.AddBlockedIPPrefixes),
+	}
+}
+
+func (b *DNSBlacklist) mergeWith(other DNSBlacklist) {
+	b.BlockMalicious = helpers.MergeWithBool(b.BlockMalicious, other.BlockMalicious)
+	b.BlockAds = helpers.MergeWithBool(b.BlockAds, other.BlockAds)
+	b.BlockSurveillance = helpers.MergeWithBool(b.BlockSurveillance, other.BlockSurveillance)
+	b.AllowedHosts = helpers.MergeStringSlices(b.AllowedHosts, other.AllowedHosts)
+	b.AddBlockedHosts = helpers.MergeStringSlices(b.AddBlockedHosts, other.AddBlockedHosts)
+	b.AddBlockedIPs = helpers.MergeNetaddrIPsSlices(b.AddBlockedIPs, other.AddBlockedIPs)
+	b.AddBlockedIPPrefixes = helpers.MergeIPPrefixesSlices(b.AddBlockedIPPrefixes, other.AddBlockedIPPrefixes)
+}
+
+func (b *DNSBlacklist) overrideWith(other DNSBlacklist) {
+	b.BlockMalicious = helpers.OverrideWithBool(b.BlockMalicious, other.BlockMalicious)
+	b.BlockAds = helpers.OverrideWithBool(b.BlockAds, other.BlockAds)
+	b.BlockSurveillance = helpers.OverrideWithBool(b.BlockSurveillance, other.BlockSurveillance)
+	b.AllowedHosts = helpers.OverrideWithStringSlice(b.AllowedHosts, other.AllowedHosts)
+	b.AddBlockedHosts = helpers.OverrideWithStringSlice(b.AddBlockedHosts, other.AddBlockedHosts)
+	b.AddBlockedIPs = helpers.OverrideWithNetaddrIPsSlice(b.AddBlockedIPs, other.AddBlockedIPs)
+	b.AddBlockedIPPrefixes = helpers.OverrideWithIPPrefixesSlice(b.AddBlockedIPPrefixes, other.AddBlockedIPPrefixes)
+}
+
+func (b DNSBlacklist) ToBlacklistFormat() (settings blacklist.BuilderSettings, err error) {
+	return blacklist.BuilderSettings{
+		BlockMalicious:       *b.BlockMalicious,
+		BlockAds:             *b.BlockAds,
+		BlockSurveillance:    *b.BlockSurveillance,
+		AllowedHosts:         b.AllowedHosts,
+		AddBlockedHosts:      b.AddBlockedHosts,
+		AddBlockedIPs:        b.AddBlockedIPs,
+		AddBlockedIPPrefixes: b.AddBlockedIPPrefixes,
+	}, nil
+}
+
+func (b DNSBlacklist) String() string {
+	return b.toLinesNode().String()
+}
+
+func (b DNSBlacklist) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("DNS filtering settings:")
+
+	node.Appendf("Block malicious: %s", helpers.BoolPtrToYesNo(b.BlockMalicious))
+	node.Appendf("Block ads: %s", helpers.BoolPtrToYesNo(b.BlockAds))
+	node.Appendf("Block surveillance: %s", helpers.BoolPtrToYesNo(b.BlockSurveillance))
+
+	if len(b.AllowedHosts) > 0 {
+		allowedHostsNode := node.Appendf("Allowed hosts:")
+		for _, host := range b.AllowedHosts {
+			allowedHostsNode.Appendf(host)
+		}
+	}
+
+	if len(b.AddBlockedHosts) > 0 {
+		blockedHostsNode := node.Appendf("Blocked hosts:")
+		for _, host := range b.AddBlockedHosts {
+			blockedHostsNode.Appendf(host)
+		}
+	}
+
+	if len(b.AddBlockedIPs) > 0 {
+		blockedIPsNode := node.Appendf("Blocked IP addresses:")
+		for _, ip := range b.AddBlockedIPs {
+			blockedIPsNode.Appendf(ip.String())
+		}
+	}
+
+	if len(b.AddBlockedIPPrefixes) > 0 {
+		blockedIPPrefixesNode := node.Appendf("Blocked IP networks:")
+		for _, ipNetwork := range b.AddBlockedIPPrefixes {
+			blockedIPPrefixesNode.Appendf(ipNetwork.String())
+		}
+	}
+
+	return node
+}

internal/configuration/settings/dot.go

@@ -0,0 +1,113 @@
+package settings
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// DoT contains settings to configure the DoT server.
+type DoT struct {
+	// Enabled is true if the DoT server should be running
+	// and used. It defaults to true, and cannot be nil
+	// in the internal state.
+	Enabled *bool
+	// UpdatePeriod is the period to update DNS block
+	// lists and cryptographic files for DNSSEC validation.
+	// It can be set to 0 to disable the update.
+	// It defaults to 24h and cannot be nil in
+	// the internal state.
+	UpdatePeriod *time.Duration
+	// Unbound contains settings to configure Unbound.
+	Unbound Unbound
+	// Blacklist contains settings to configure the filter
+	// block lists.
+	Blacklist DNSBlacklist
+}
+
+var (
+	ErrDoTUpdatePeriodTooShort = errors.New("update period is too short")
+)
+
+func (d DoT) validate() (err error) {
+	const minUpdatePeriod = 30 * time.Second
+	if *d.UpdatePeriod != 0 && *d.UpdatePeriod < minUpdatePeriod {
+		return fmt.Errorf("%w: %s must be bigger than %s",
+			ErrDoTUpdatePeriodTooShort, *d.UpdatePeriod, minUpdatePeriod)
+	}
+
+	err = d.Unbound.validate()
+	if err != nil {
+		return err
+	}
+
+	err = d.Blacklist.validate()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *DoT) copy() (copied DoT) {
+	return DoT{
+		Enabled:      helpers.CopyBoolPtr(d.Enabled),
+		UpdatePeriod: helpers.CopyDurationPtr(d.UpdatePeriod),
+		Unbound:      d.Unbound.copy(),
+		Blacklist:    d.Blacklist.copy(),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (d *DoT) mergeWith(other DoT) {
+	d.Enabled = helpers.MergeWithBool(d.Enabled, other.Enabled)
+	d.UpdatePeriod = helpers.MergeWithDuration(d.UpdatePeriod, other.UpdatePeriod)
+	d.Unbound.mergeWith(other.Unbound)
+	d.Blacklist.mergeWith(other.Blacklist)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (d *DoT) overrideWith(other DoT) {
+	d.Enabled = helpers.OverrideWithBool(d.Enabled, other.Enabled)
+	d.UpdatePeriod = helpers.OverrideWithDuration(d.UpdatePeriod, other.UpdatePeriod)
+	d.Unbound.overrideWith(other.Unbound)
+	d.Blacklist.overrideWith(other.Blacklist)
+}
+
+func (d *DoT) setDefaults() {
+	d.Enabled = helpers.DefaultBool(d.Enabled, true)
+	const defaultUpdatePeriod = 24 * time.Hour
+	d.UpdatePeriod = helpers.DefaultDuration(d.UpdatePeriod, defaultUpdatePeriod)
+	d.Unbound.setDefaults()
+	d.Blacklist.setDefaults()
+}
+
+func (d DoT) String() string {
+	return d.toLinesNode().String()
+}
+
+func (d DoT) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("DNS over TLS settings:")
+
+	node.Appendf("Enabled: %s", helpers.BoolPtrToYesNo(d.Enabled))
+	if !*d.Enabled {
+		return node
+	}
+
+	update := "disabled"
+	if *d.UpdatePeriod > 0 {
+		update = "every " + d.UpdatePeriod.String()
+	}
+	node.Appendf("Update period: %s", update)
+
+	node.AppendNode(d.Unbound.toLinesNode())
+	node.AppendNode(d.Blacklist.toLinesNode())
+
+	return node
+}

internal/configuration/settings/errors.go

@@ -0,0 +1,51 @@
+package settings
+
+import "errors"
+
+var (
+	ErrCityNotValid                    = errors.New("the city specified is not valid")
+	ErrControlServerPrivilegedPort     = errors.New("cannot use privileged port without running as root")
+	ErrCountryNotValid                 = errors.New("the country specified is not valid")
+	ErrFirewallZeroPort                = errors.New("cannot have a zero port to block")
+	ErrHostnameNotValid                = errors.New("the hostname specified is not valid")
+	ErrISPNotValid                     = errors.New("the ISP specified is not valid")
+	ErrNameNotValid                    = errors.New("the server name specified is not valid")
+	ErrOpenVPNClientCertMissing        = errors.New("client certificate is missing")
+	ErrOpenVPNClientCertNotValid       = errors.New("client certificate is not valid")
+	ErrOpenVPNClientKeyMissing         = errors.New("client key is missing")
+	ErrOpenVPNClientKeyNotValid        = errors.New("client key is not valid")
+	ErrOpenVPNConfigFile               = errors.New("custom configuration file error")
+	ErrOpenVPNCustomPortNotAllowed     = errors.New("custom endpoint port is not allowed")
+	ErrOpenVPNEncryptionPresetNotValid = errors.New("PIA encryption preset is not valid")
+	ErrOpenVPNInterfaceNotValid        = errors.New("interface name is not valid")
+	ErrOpenVPNMSSFixIsTooHigh          = errors.New("mssfix option value is too high")
+	ErrOpenVPNPasswordIsEmpty          = errors.New("password is empty")
+	ErrOpenVPNTCPNotSupported          = errors.New("TCP protocol is not supported")
+	ErrOpenVPNUserIsEmpty              = errors.New("user is empty")
+	ErrOpenVPNVerbosityIsOutOfBounds   = errors.New("verbosity value is out of bounds")
+	ErrOpenVPNVersionIsNotValid        = errors.New("version is not valid")
+	ErrPortForwardingEnabled           = errors.New("port forwarding cannot be enabled")
+	ErrPortForwardingFilepathNotValid  = errors.New("port forwarding filepath given is not valid")
+	ErrPublicIPFilepathNotValid        = errors.New("public IP address file path is not valid")
+	ErrPublicIPPeriodTooShort          = errors.New("public IP address check period is too short")
+	ErrRegionNotValid                  = errors.New("the region specified is not valid")
+	ErrServerAddressNotValid           = errors.New("server listening address is not valid")
+	ErrSystemPGIDNotValid              = errors.New("process group id is not valid")
+	ErrSystemPUIDNotValid              = errors.New("process user id is not valid")
+	ErrSystemTimezoneNotValid          = errors.New("timezone is not valid")
+	ErrVPNProviderNameNotValid         = errors.New("VPN provider name is not valid")
+	ErrVPNTypeNotValid                 = errors.New("VPN type is not valid")
+	ErrWireguardEndpointIPNotSet       = errors.New("endpoint IP is not set")
+	ErrWireguardEndpointPortNotAllowed = errors.New("endpoint port is not allowed")
+	ErrWireguardEndpointPortNotSet     = errors.New("endpoint port is not set")
+	ErrWireguardInterfaceAddressNotSet = errors.New("interface address is not set")
+	ErrWireguardInterfaceNotValid      = errors.New("interface name is not valid")
+	ErrWireguardPreSharedKeyNotSet     = errors.New("pre-shared key is not set")
+	ErrWireguardPreSharedKeyNotValid   = errors.New("pre-shared key is not valid")
+	ErrWireguardPrivateKeyNotSet       = errors.New("private key is not set")
+	ErrWireguardPrivateKeyNotValid     = errors.New("private key is not valid")
+	ErrWireguardPublicKeyNotSet        = errors.New("public key is not set")
+	ErrWireguardPublicKeyNotValid      = errors.New("public key is not valid")
+
+	ErrUpdaterPeriodTooSmall = errors.New("VPN server data updater period is too small")
+)

internal/configuration/settings/firewall.go

@@ -0,0 +1,117 @@
+package settings
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// Firewall contains settings to customize the firewall operation.
+type Firewall struct {
+	VPNInputPorts   []uint16
+	InputPorts      []uint16
+	OutboundSubnets []net.IPNet
+	Enabled         *bool
+	Debug           *bool
+}
+
+func (f Firewall) validate() (err error) {
+	if hasZeroPort(f.VPNInputPorts) {
+		return fmt.Errorf("VPN input ports: %w", ErrFirewallZeroPort)
+	}
+
+	if hasZeroPort(f.InputPorts) {
+		return fmt.Errorf("input ports: %w", ErrFirewallZeroPort)
+	}
+
+	return nil
+}
+
+func hasZeroPort(ports []uint16) (has bool) {
+	for _, port := range ports {
+		if port == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func (f *Firewall) copy() (copied Firewall) {
+	return Firewall{
+		VPNInputPorts:   helpers.CopyUint16Slice(f.VPNInputPorts),
+		InputPorts:      helpers.CopyUint16Slice(f.InputPorts),
+		OutboundSubnets: helpers.CopyIPNetSlice(f.OutboundSubnets),
+		Enabled:         helpers.CopyBoolPtr(f.Enabled),
+		Debug:           helpers.CopyBoolPtr(f.Debug),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+// It merges values of slices together, even if they
+// are set in the receiver settings.
+func (f *Firewall) mergeWith(other Firewall) {
+	f.VPNInputPorts = helpers.MergeUint16Slices(f.VPNInputPorts, other.VPNInputPorts)
+	f.InputPorts = helpers.MergeUint16Slices(f.InputPorts, other.InputPorts)
+	f.OutboundSubnets = helpers.MergeIPNetsSlices(f.OutboundSubnets, other.OutboundSubnets)
+	f.Enabled = helpers.MergeWithBool(f.Enabled, other.Enabled)
+	f.Debug = helpers.MergeWithBool(f.Debug, other.Debug)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (f *Firewall) overrideWith(other Firewall) {
+	f.VPNInputPorts = helpers.OverrideWithUint16Slice(f.VPNInputPorts, other.VPNInputPorts)
+	f.InputPorts = helpers.OverrideWithUint16Slice(f.InputPorts, other.InputPorts)
+	f.OutboundSubnets = helpers.OverrideWithIPNetsSlice(f.OutboundSubnets, other.OutboundSubnets)
+	f.Enabled = helpers.OverrideWithBool(f.Enabled, other.Enabled)
+	f.Debug = helpers.OverrideWithBool(f.Debug, other.Debug)
+}
+
+func (f *Firewall) setDefaults() {
+	f.Enabled = helpers.DefaultBool(f.Enabled, true)
+	f.Debug = helpers.DefaultBool(f.Debug, false)
+}
+
+func (f Firewall) String() string {
+	return f.toLinesNode().String()
+}
+
+func (f Firewall) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Firewall settings:")
+
+	node.Appendf("Enabled: %s", helpers.BoolPtrToYesNo(f.Enabled))
+	if !*f.Enabled {
+		return node
+	}
+
+	if *f.Debug {
+		node.Appendf("Debug mode: on")
+	}
+
+	if len(f.VPNInputPorts) > 0 {
+		vpnInputPortsNode := node.Appendf("VPN input ports:")
+		for _, port := range f.VPNInputPorts {
+			vpnInputPortsNode.Appendf("%d", port)
+		}
+	}
+
+	if len(f.InputPorts) > 0 {
+		inputPortsNode := node.Appendf("Input ports:")
+		for _, port := range f.InputPorts {
+			inputPortsNode.Appendf("%d", port)
+		}
+	}
+
+	if len(f.OutboundSubnets) > 0 {
+		outboundSubnets := node.Appendf("Outbound subnets:")
+		for _, subnet := range f.OutboundSubnets {
+			outboundSubnets.Appendf("%s", subnet)
+		}
+	}
+
+	return node
+}

internal/configuration/settings/health.go

@@ -0,0 +1,83 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+	"github.com/qdm12/govalid/address"
+)
+
+// Health contains settings for the healthcheck and health server.
+type Health struct {
+	// ServerAddress is the listening address
+	// for the health check server.
+	// It cannot be the empty string in the internal state.
+	ServerAddress string
+	// TargetAddress is the address (host or host:port)
+	// to TCP dial to periodically for the health check.
+	// It cannot be the empty string in the internal state.
+	TargetAddress string
+	VPN           HealthyWait
+}
+
+func (h Health) Validate() (err error) {
+	uid := os.Getuid()
+	_, err = address.Validate(h.ServerAddress,
+		address.OptionListening(uid))
+	if err != nil {
+		return fmt.Errorf("%w: %s",
+			ErrServerAddressNotValid, err)
+	}
+
+	err = h.VPN.validate()
+	if err != nil {
+		return fmt.Errorf("health VPN settings validation failed: %w", err)
+	}
+
+	return nil
+}
+
+func (h *Health) copy() (copied Health) {
+	return Health{
+		ServerAddress: h.ServerAddress,
+		TargetAddress: h.TargetAddress,
+		VPN:           h.VPN.copy(),
+	}
+}
+
+// MergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (h *Health) MergeWith(other Health) {
+	h.ServerAddress = helpers.MergeWithString(h.ServerAddress, other.ServerAddress)
+	h.TargetAddress = helpers.MergeWithString(h.TargetAddress, other.TargetAddress)
+	h.VPN.mergeWith(other.VPN)
+}
+
+// OverrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (h *Health) OverrideWith(other Health) {
+	h.ServerAddress = helpers.OverrideWithString(h.ServerAddress, other.ServerAddress)
+	h.TargetAddress = helpers.OverrideWithString(h.TargetAddress, other.TargetAddress)
+	h.VPN.overrideWith(other.VPN)
+}
+
+func (h *Health) SetDefaults() {
+	h.ServerAddress = helpers.DefaultString(h.ServerAddress, "127.0.0.1:9999")
+	h.TargetAddress = helpers.DefaultString(h.TargetAddress, "github.com:443")
+	h.VPN.setDefaults()
+}
+
+func (h Health) String() string {
+	return h.toLinesNode().String()
+}
+
+func (h Health) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Health settings:")
+	node.Appendf("Server listening address: %s", h.ServerAddress)
+	node.Appendf("Target address: %s", h.TargetAddress)
+	node.AppendNode(h.VPN.toLinesNode("VPN"))
+	return node
+}

internal/configuration/settings/healthywait.go

@@ -0,0 +1,66 @@
+package settings
+
+import (
+	"time"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+type HealthyWait struct {
+	// Initial is the initial duration to wait for the program
+	// to be healthy before taking action.
+	// It cannot be nil in the internal state.
+	Initial *time.Duration
+	// Addition is the duration to add to the Initial duration
+	// after Initial has expired to wait longer for the program
+	// to be healthy.
+	// It cannot be nil in the internal state.
+	Addition *time.Duration
+}
+
+func (h HealthyWait) validate() (err error) {
+	return nil
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (h *HealthyWait) copy() (copied HealthyWait) {
+	return HealthyWait{
+		Initial:  helpers.CopyDurationPtr(h.Initial),
+		Addition: helpers.CopyDurationPtr(h.Addition),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (h *HealthyWait) mergeWith(other HealthyWait) {
+	h.Initial = helpers.MergeWithDuration(h.Initial, other.Initial)
+	h.Addition = helpers.MergeWithDuration(h.Addition, other.Addition)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (h *HealthyWait) overrideWith(other HealthyWait) {
+	h.Initial = helpers.OverrideWithDuration(h.Initial, other.Initial)
+	h.Addition = helpers.OverrideWithDuration(h.Addition, other.Addition)
+}
+
+func (h *HealthyWait) setDefaults() {
+	const initialDurationDefault = 6 * time.Second
+	const additionDurationDefault = 5 * time.Second
+	h.Initial = helpers.DefaultDuration(h.Initial, initialDurationDefault)
+	h.Addition = helpers.DefaultDuration(h.Addition, additionDurationDefault)
+}
+
+func (h HealthyWait) String() string {
+	return h.toLinesNode("Health").String()
+}
+
+func (h HealthyWait) toLinesNode(kind string) (node *gotree.Node) {
+	node = gotree.New(kind + " wait durations:")
+	node.Appendf("Initial duration: %s", *h.Initial)
+	node.Appendf("Additional duration: %s", *h.Addition)
+	return node
+}

internal/configuration/settings/helpers/belong.go

@@ -0,0 +1,45 @@
+package helpers
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+func IsOneOf(value string, choices ...string) (ok bool) {
+	for _, choice := range choices {
+		if value == choice {
+			return true
+		}
+	}
+	return false
+}
+
+var ErrValueNotOneOf = errors.New("value is not one of the possible choices")
+
+func AreAllOneOf(values, choices []string) (err error) {
+	set := make(map[string]struct{}, len(choices))
+	for _, choice := range choices {
+		choice = strings.ToLower(choice)
+		set[choice] = struct{}{}
+	}
+
+	for _, value := range values {
+		_, ok := set[value]
+		if !ok {
+			return fmt.Errorf("%w: value %q, choices available are %s",
+				ErrValueNotOneOf, value, strings.Join(choices, ", "))
+		}
+	}
+
+	return nil
+}
+
+func Uint16IsOneOf(port uint16, choices []uint16) (ok bool) {
+	for _, choice := range choices {
+		if port == choice {
+			return true
+		}
+	}
+	return false
+}

internal/configuration/settings/helpers/copy.go

@@ -0,0 +1,190 @@
+package helpers
+
+import (
+	"net"
+	"time"
+
+	"github.com/qdm12/golibs/logging"
+	"inet.af/netaddr"
+)
+
+func CopyStringPtr(original *string) (copied *string) {
+	if original == nil {
+		return nil
+	}
+	copied = new(string)
+	*copied = *original
+	return copied
+}
+
+func CopyBoolPtr(original *bool) (copied *bool) {
+	if original == nil {
+		return nil
+	}
+	copied = new(bool)
+	*copied = *original
+	return copied
+}
+
+func CopyUint8Ptr(original *uint8) (copied *uint8) {
+	if original == nil {
+		return nil
+	}
+	copied = new(uint8)
+	*copied = *original
+	return copied
+}
+
+func CopyUint16Ptr(original *uint16) (copied *uint16) {
+	if original == nil {
+		return nil
+	}
+	copied = new(uint16)
+	*copied = *original
+	return copied
+}
+
+func CopyIntPtr(original *int) (copied *int) {
+	if original == nil {
+		return nil
+	}
+	copied = new(int)
+	*copied = *original
+	return copied
+}
+
+func CopyDurationPtr(original *time.Duration) (copied *time.Duration) {
+	if original == nil {
+		return nil
+	}
+	copied = new(time.Duration)
+	*copied = *original
+	return copied
+}
+
+func CopyLogLevelPtr(original *logging.Level) (copied *logging.Level) {
+	if original == nil {
+		return nil
+	}
+	copied = new(logging.Level)
+	*copied = *original
+	return copied
+}
+
+func CopyIP(original net.IP) (copied net.IP) {
+	if original == nil {
+		return nil
+	}
+	copied = make(net.IP, len(original))
+	copy(copied, original)
+	return copied
+}
+
+func CopyIPNet(original net.IPNet) (copied net.IPNet) {
+	if original.IP != nil {
+		copied.IP = make(net.IP, len(original.IP))
+		copy(copied.IP, original.IP)
+	}
+
+	if original.Mask != nil {
+		copied.Mask = make(net.IPMask, len(original.Mask))
+		copy(copied.Mask, original.Mask)
+	}
+
+	return copied
+}
+
+func CopyIPNetPtr(original *net.IPNet) (copied *net.IPNet) {
+	if original == nil {
+		return nil
+	}
+
+	copied = new(net.IPNet)
+	*copied = CopyIPNet(*original)
+	return copied
+}
+
+func CopyNetaddrIP(original netaddr.IP) (copied netaddr.IP) {
+	b, err := original.MarshalBinary()
+	if err != nil {
+		panic(err)
+	}
+
+	err = copied.UnmarshalBinary(b)
+	if err != nil {
+		panic(err)
+	}
+
+	return copied
+}
+
+func CopyIPPrefix(original netaddr.IPPrefix) (copied netaddr.IPPrefix) {
+	b, err := original.MarshalText()
+	if err != nil {
+		panic(err)
+	}
+
+	err = copied.UnmarshalText(b)
+	if err != nil {
+		panic(err)
+	}
+
+	return copied
+}
+
+func CopyStringSlice(original []string) (copied []string) {
+	if original == nil {
+		return nil
+	}
+
+	copied = make([]string, len(original))
+	copy(copied, original)
+	return copied
+}
+
+func CopyUint16Slice(original []uint16) (copied []uint16) {
+	if original == nil {
+		return nil
+	}
+
+	copied = make([]uint16, len(original))
+	copy(copied, original)
+	return copied
+}
+
+func CopyIPNetSlice(original []net.IPNet) (copied []net.IPNet) {
+	if original == nil {
+		return nil
+	}
+
+	copied = make([]net.IPNet, len(original))
+	for i := range original {
+		copied[i] = CopyIPNet(original[i])
+	}
+	return copied
+}
+
+func CopyIPPrefixSlice(original []netaddr.IPPrefix) (copied []netaddr.IPPrefix) {
+	if original == nil {
+		return nil
+	}
+
+	copied = make([]netaddr.IPPrefix, len(original))
+	for i := range original {
+		copied[i] = CopyIPPrefix(original[i])
+	}
+	return copied
+}
+
+func CopyNetaddrIPsSlice(original []netaddr.IP) (copied []netaddr.IP) {
+	if original == nil {
+		return nil
+	}
+
+	copied = make([]netaddr.IP, len(original))
+	for i := range original {
+		copied[i] = CopyNetaddrIP(original[i])
+	}
+
+	return copied
+}

internal/configuration/settings/helpers/default.go

@@ -0,0 +1,93 @@
+package helpers
+
+import (
+	"net"
+	"time"
+
+	"github.com/qdm12/golibs/logging"
+)
+
+func DefaultInt(existing *int, defaultValue int) (
+	result *int) {
+	if existing != nil {
+		return existing
+	}
+	result = new(int)
+	*result = defaultValue
+	return result
+}
+
+func DefaultUint8(existing *uint8, defaultValue uint8) (
+	result *uint8) {
+	if existing != nil {
+		return existing
+	}
+	result = new(uint8)
+	*result = defaultValue
+	return result
+}
+
+func DefaultUint16(existing *uint16, defaultValue uint16) (
+	result *uint16) {
+	if existing != nil {
+		return existing
+	}
+	result = new(uint16)
+	*result = defaultValue
+	return result
+}
+
+func DefaultBool(existing *bool, defaultValue bool) (
+	result *bool) {
+	if existing != nil {
+		return existing
+	}
+	result = new(bool)
+	*result = defaultValue
+	return result
+}
+
+func DefaultString(existing string, defaultValue string) (
+	result string) {
+	if existing != "" {
+		return existing
+	}
+	return defaultValue
+}
+
+func DefaultStringPtr(existing *string, defaultValue string) (result *string) {
+	if existing != nil {
+		return existing
+	}
+	result = new(string)
+	*result = defaultValue
+	return result
+}
+
+func DefaultDuration(existing *time.Duration,
+	defaultValue time.Duration) (result *time.Duration) {
+	if existing != nil {
+		return existing
+	}
+	result = new(time.Duration)
+	*result = defaultValue
+	return result
+}
+
+func DefaultLogLevel(existing *logging.Level,
+	defaultValue logging.Level) (result *logging.Level) {
+	if existing != nil {
+		return existing
+	}
+	result = new(logging.Level)
+	*result = defaultValue
+	return result
+}
+
+func DefaultIP(existing net.IP, defaultValue net.IP) (
+	result net.IP) {
+	if existing != nil {
+		return existing
+	}
+	return defaultValue
+}

internal/configuration/settings/helpers/files.go

@@ -0,0 +1,31 @@
+package helpers
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+var (
+	ErrFileDoesNotExist = errors.New("file does not exist")
+	ErrFileRead         = errors.New("cannot read file")
+	ErrFileClose        = errors.New("cannot close file")
+)
+
+func FileExists(path string) (err error) {
+	path = filepath.Clean(path)
+
+	f, err := os.Open(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("%w: %s", ErrFileDoesNotExist, path)
+	} else if err != nil {
+		return fmt.Errorf("%w: %s", ErrFileRead, err)
+	}
+
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("%w: %s", ErrFileClose, err)
+	}
+
+	return nil
+}

internal/configuration/settings/helpers/merge.go

@@ -0,0 +1,226 @@
+package helpers
+
+import (
+	"net"
+	"time"
+
+	"github.com/qdm12/golibs/logging"
+	"inet.af/netaddr"
+)
+
+func MergeWithBool(existing, other *bool) (result *bool) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = new(bool)
+	*result = *other
+	return result
+}
+
+func MergeWithString(existing, other string) (result string) {
+	if existing != "" {
+		return existing
+	}
+	return other
+}
+
+func MergeWithStringPtr(existing, other *string) (result *string) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = new(string)
+	*result = *other
+	return result
+}
+
+func MergeWithInt(existing, other *int) (result *int) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = new(int)
+	*result = *other
+	return result
+}
+
+func MergeWithUint8(existing, other *uint8) (result *uint8) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = new(uint8)
+	*result = *other
+	return result
+}
+
+func MergeWithUint16(existing, other *uint16) (result *uint16) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = new(uint16)
+	*result = *other
+	return result
+}
+
+func MergeWithIP(existing, other net.IP) (result net.IP) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = make(net.IP, len(other))
+	copy(result, other)
+	return result
+}
+
+func MergeWithDuration(existing, other *time.Duration) (result *time.Duration) {
+	if existing != nil {
+		return existing
+	}
+	return other
+}
+
+func MergeWithLogLevel(existing, other *logging.Level) (result *logging.Level) {
+	if existing != nil {
+		return existing
+	} else if other == nil {
+		return nil
+	}
+	result = new(logging.Level)
+	*result = *other
+	return result
+}
+
+func MergeStringSlices(a, b []string) (result []string) {
+	if a == nil && b == nil {
+		return nil
+	}
+
+	seen := make(map[string]struct{}, len(a)+len(b))
+	result = make([]string, 0, len(a)+len(b))
+	for _, s := range a {
+		if _, ok := seen[s]; ok {
+			continue // duplicate
+		}
+		result = append(result, s)
+		seen[s] = struct{}{}
+	}
+	for _, s := range b {
+		if _, ok := seen[s]; ok {
+			continue // duplicate
+		}
+		result = append(result, s)
+		seen[s] = struct{}{}
+	}
+	return result
+}
+
+func MergeUint16Slices(a, b []uint16) (result []uint16) {
+	if a == nil && b == nil {
+		return nil
+	}
+
+	seen := make(map[uint16]struct{}, len(a)+len(b))
+	result = make([]uint16, 0, len(a)+len(b))
+	for _, n := range a {
+		if _, ok := seen[n]; ok {
+			continue // duplicate
+		}
+		result = append(result, n)
+		seen[n] = struct{}{}
+	}
+	for _, n := range b {
+		if _, ok := seen[n]; ok {
+			continue // duplicate
+		}
+		result = append(result, n)
+		seen[n] = struct{}{}
+	}
+	return result
+}
+
+func MergeIPNetsSlices(a, b []net.IPNet) (result []net.IPNet) {
+	if a == nil && b == nil {
+		return nil
+	}
+
+	seen := make(map[string]struct{}, len(a)+len(b))
+	result = make([]net.IPNet, 0, len(a)+len(b))
+	for _, ipNet := range a {
+		key := ipNet.String()
+		if _, ok := seen[key]; ok {
+			continue // duplicate
+		}
+		result = append(result, ipNet)
+		seen[key] = struct{}{}
+	}
+	for _, ipNet := range b {
+		key := ipNet.String()
+		if _, ok := seen[key]; ok {
+			continue // duplicate
+		}
+		result = append(result, ipNet)
+		seen[key] = struct{}{}
+	}
+	return result
+}
+
+func MergeNetaddrIPsSlices(a, b []netaddr.IP) (result []netaddr.IP) {
+	if a == nil && b == nil {
+		return nil
+	}
+
+	seen := make(map[string]struct{}, len(a)+len(b))
+	result = make([]netaddr.IP, 0, len(a)+len(b))
+	for _, ip := range a {
+		key := ip.String()
+		if _, ok := seen[key]; ok {
+			continue // duplicate
+		}
+		result = append(result, ip)
+		seen[key] = struct{}{}
+	}
+	for _, ip := range b {
+		key := ip.String()
+		if _, ok := seen[key]; ok {
+			continue // duplicate
+		}
+		result = append(result, ip)
+		seen[key] = struct{}{}
+	}
+	return result
+}
+
+func MergeIPPrefixesSlices(a, b []netaddr.IPPrefix) (result []netaddr.IPPrefix) {
+	if a == nil && b == nil {
+		return nil
+	}
+
+	seen := make(map[string]struct{}, len(a)+len(b))
+	result = make([]netaddr.IPPrefix, 0, len(a)+len(b))
+	for _, ipPrefix := range a {
+		key := ipPrefix.String()
+		if _, ok := seen[key]; ok {
+			continue // duplicate
+		}
+		result = append(result, ipPrefix)
+		seen[key] = struct{}{}
+	}
+	for _, ipPrefix := range b {
+		key := ipPrefix.String()
+		if _, ok := seen[key]; ok {
+			continue // duplicate
+		}
+		result = append(result, ipPrefix)
+		seen[key] = struct{}{}
+	}
+	return result
+}

internal/configuration/settings/helpers/messages.go

@@ -0,0 +1,29 @@
+package helpers
+
+import (
+	"fmt"
+	"strings"
+)
+
+func ChoicesOrString(choices []string) string {
+	return strings.Join(
+		choices[:len(choices)-1], ", ") +
+		" or " + choices[len(choices)-1]
+}
+
+func PortChoicesOrString(ports []uint16) (s string) {
+	switch len(ports) {
+	case 0:
+		return "there is no allowed port"
+	case 1:
+		return "allowed port is " + fmt.Sprint(ports[0])
+	}
+
+	s = "allowed ports are "
+	portStrings := make([]string, len(ports))
+	for i := range ports {
+		portStrings[i] = fmt.Sprint(ports[i])
+	}
+	s += ChoicesOrString(portStrings)
+	return s
+}

internal/configuration/settings/helpers/obfuscate.go

@@ -0,0 +1,25 @@
+package helpers
+
+func ObfuscateWireguardKey(fullKey string) (obfuscatedKey string) {
+	const minKeyLength = 10
+	if len(fullKey) < minKeyLength {
+		return "(too short)"
+	}
+
+	lastIndex := len(fullKey) - 1
+	return fullKey[0:2] + "..." + fullKey[lastIndex-2:]
+}
+
+func ObfuscatePassword(password string) (obfuscatedPassword string) {
+	if password != "" {
+		return "[set]"
+	}
+	return "[not set]"
+}
+
+func ObfuscateData(data string) (obfuscated string) {
+	if data != "" {
+		return "[set]"
+	}
+	return "[not set]"
+}

internal/configuration/settings/helpers/override.go

@@ -0,0 +1,133 @@
+package helpers
+
+import (
+	"net"
+	"time"
+
+	"github.com/qdm12/golibs/logging"
+	"inet.af/netaddr"
+)
+
+func OverrideWithBool(existing, other *bool) (result *bool) {
+	if other == nil {
+		return existing
+	}
+	result = new(bool)
+	*result = *other
+	return result
+}
+
+func OverrideWithString(existing, other string) (result string) {
+	if other == "" {
+		return existing
+	}
+	return other
+}
+
+func OverrideWithStringPtr(existing, other *string) (result *string) {
+	if other == nil {
+		return existing
+	}
+	result = new(string)
+	*result = *other
+	return result
+}
+
+func OverrideWithInt(existing, other *int) (result *int) {
+	if other == nil {
+		return existing
+	}
+	result = new(int)
+	*result = *other
+	return result
+}
+
+func OverrideWithUint8(existing, other *uint8) (result *uint8) {
+	if other == nil {
+		return existing
+	}
+	result = new(uint8)
+	*result = *other
+	return result
+}
+
+func OverrideWithUint16(existing, other *uint16) (result *uint16) {
+	if other == nil {
+		return existing
+	}
+	result = new(uint16)
+	*result = *other
+	return result
+}
+
+func OverrideWithIP(existing, other net.IP) (result net.IP) {
+	if other == nil {
+		return existing
+	}
+	result = make(net.IP, len(other))
+	copy(result, other)
+	return result
+}
+
+func OverrideWithDuration(existing, other *time.Duration) (result *time.Duration) {
+	if other == nil {
+		return existing
+	}
+	result = new(time.Duration)
+	*result = *other
+	return result
+}
+
+func OverrideWithLogLevel(existing, other *logging.Level) (result *logging.Level) {
+	if other == nil {
+		return existing
+	}
+	result = new(logging.Level)
+	*result = *other
+	return result
+}
+
+func OverrideWithStringSlice(existing, other []string) (result []string) {
+	if other == nil {
+		return existing
+	}
+	result = make([]string, len(other))
+	copy(result, other)
+	return result
+}
+
+func OverrideWithUint16Slice(existing, other []uint16) (result []uint16) {
+	if other == nil {
+		return existing
+	}
+	result = make([]uint16, len(other))
+	copy(result, other)
+	return result
+}
+
+func OverrideWithIPNetsSlice(existing, other []net.IPNet) (result []net.IPNet) {
+	if other == nil {
+		return existing
+	}
+	result = make([]net.IPNet, len(other))
+	copy(result, other)
+	return result
+}
+
+func OverrideWithNetaddrIPsSlice(existing, other []netaddr.IP) (result []netaddr.IP) {
+	if other == nil {
+		return existing
+	}
+	result = make([]netaddr.IP, len(other))
+	copy(result, other)
+	return result
+}
+
+func OverrideWithIPPrefixesSlice(existing, other []netaddr.IPPrefix) (result []netaddr.IPPrefix) {
+	if other == nil {
+		return existing
+	}
+	result = make([]netaddr.IPPrefix, len(other))
+	copy(result, other)
+	return result
+}

internal/configuration/settings/helpers/pointers.go

@@ -0,0 +1,11 @@
+package helpers
+
+import "time"
+
+// StringPtr returns a pointer to the string value
+// passed as argument.
+func StringPtr(s string) *string { return &s }
+
+// DurationPtr returns a pointer to the duration value
+// passed as argument.
+func DurationPtr(d time.Duration) *time.Duration { return &d }

internal/configuration/settings/helpers/string.go

@@ -0,0 +1,15 @@
+package helpers
+
+func BoolPtrToYesNo(b *bool) string {
+	if *b {
+		return "yes"
+	}
+	return "no"
+}
+
+func TCPPtrToString(tcp *bool) string {
+	if *tcp {
+		return "TCP"
+	}
+	return "UDP"
+}

internal/configuration/settings/helpers_test.go

@@ -0,0 +1,4 @@
+package settings
+
+func boolPtr(b bool) *bool    { return &b }
+func uint8Ptr(n uint8) *uint8 { return &n }

internal/configuration/settings/httpproxy.go

@@ -0,0 +1,112 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+	"github.com/qdm12/govalid/address"
+)
+
+// HTTPProxy contains settings to configure the HTTP proxy.
+type HTTPProxy struct {
+	// User is the username to use for the HTTP proxy.
+	// It cannot be nil in the internal state.
+	User *string
+	// Password is the password to use for the HTTP proxy.
+	// It cannot be nil in the internal state.
+	Password *string
+	// ListeningAddress is the listening address
+	// of the HTTP proxy server.
+	// It cannot be the empty string in the internal state.
+	ListeningAddress string
+	// Enabled is true if the HTTP proxy server should run,
+	// and false otherwise. It cannot be nil in the
+	// internal state.
+	Enabled *bool
+	// Stealth is true if the HTTP proxy server should hide
+	// each request has been proxied to the destination.
+	// It cannot be nil in the internal state.
+	Stealth *bool
+	// Log is true if the HTTP proxy server should log
+	// each request/response. It cannot be nil in the
+	// internal state.
+	Log *bool
+}
+
+func (h HTTPProxy) validate() (err error) {
+	// Do not validate user and password
+
+	uid := os.Getuid()
+	_, err = address.Validate(h.ListeningAddress, address.OptionListening(uid))
+	if err != nil {
+		return fmt.Errorf("%w: %s",
+			ErrServerAddressNotValid, h.ListeningAddress)
+	}
+
+	return nil
+}
+
+func (h *HTTPProxy) copy() (copied HTTPProxy) {
+	return HTTPProxy{
+		User:             helpers.CopyStringPtr(h.User),
+		Password:         helpers.CopyStringPtr(h.Password),
+		ListeningAddress: h.ListeningAddress,
+		Enabled:          helpers.CopyBoolPtr(h.Enabled),
+		Stealth:          helpers.CopyBoolPtr(h.Stealth),
+		Log:              helpers.CopyBoolPtr(h.Log),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (h *HTTPProxy) mergeWith(other HTTPProxy) {
+	h.User = helpers.MergeWithStringPtr(h.User, other.User)
+	h.Password = helpers.MergeWithStringPtr(h.Password, other.Password)
+	h.ListeningAddress = helpers.MergeWithString(h.ListeningAddress, other.ListeningAddress)
+	h.Enabled = helpers.MergeWithBool(h.Enabled, other.Enabled)
+	h.Stealth = helpers.MergeWithBool(h.Stealth, other.Stealth)
+	h.Log = helpers.MergeWithBool(h.Log, other.Log)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (h *HTTPProxy) overrideWith(other HTTPProxy) {
+	h.User = helpers.OverrideWithStringPtr(h.User, other.User)
+	h.Password = helpers.OverrideWithStringPtr(h.Password, other.Password)
+	h.ListeningAddress = helpers.OverrideWithString(h.ListeningAddress, other.ListeningAddress)
+	h.Enabled = helpers.OverrideWithBool(h.Enabled, other.Enabled)
+	h.Stealth = helpers.OverrideWithBool(h.Stealth, other.Stealth)
+	h.Log = helpers.OverrideWithBool(h.Log, other.Log)
+}
+
+func (h *HTTPProxy) setDefaults() {
+	h.User = helpers.DefaultStringPtr(h.User, "")
+	h.Password = helpers.DefaultStringPtr(h.Password, "")
+	h.ListeningAddress = helpers.DefaultString(h.ListeningAddress, ":8888")
+	h.Enabled = helpers.DefaultBool(h.Enabled, false)
+	h.Stealth = helpers.DefaultBool(h.Stealth, false)
+	h.Log = helpers.DefaultBool(h.Log, false)
+}
+
+func (h HTTPProxy) String() string {
+	return h.toLinesNode().String()
+}
+
+func (h HTTPProxy) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("HTTP proxy settings:")
+	node.Appendf("Enabled: %s", helpers.BoolPtrToYesNo(h.Enabled))
+	if !*h.Enabled {
+		return node
+	}
+
+	node.Appendf("Listening address: %s", h.ListeningAddress)
+	node.Appendf("User: %s", *h.User)
+	node.Appendf("Password: %s", helpers.ObfuscatePassword(*h.Password))
+	node.Appendf("Stealth mode: %s", helpers.BoolPtrToYesNo(h.Stealth))
+	node.Appendf("Log: %s", helpers.BoolPtrToYesNo(h.Log))
+
+	return node
+}

internal/configuration/settings/log.go

@@ -0,0 +1,51 @@
+package settings
+
+import (
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/golibs/logging"
+	"github.com/qdm12/gotree"
+)
+
+// Log contains settings to configure the logger.
+type Log struct {
+	// Level is the log level of the logger.
+	// It cannot be nil in the internal state.
+	Level *logging.Level
+}
+
+func (l Log) validate() (err error) {
+	return nil
+}
+
+func (l *Log) copy() (copied Log) {
+	return Log{
+		Level: helpers.CopyLogLevelPtr(l.Level),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (l *Log) mergeWith(other Log) {
+	l.Level = helpers.MergeWithLogLevel(l.Level, other.Level)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (l *Log) overrideWith(other Log) {
+	l.Level = helpers.OverrideWithLogLevel(l.Level, other.Level)
+}
+
+func (l *Log) setDefaults() {
+	l.Level = helpers.DefaultLogLevel(l.Level, logging.LevelInfo)
+}
+
+func (l Log) String() string {
+	return l.toLinesNode().String()
+}
+
+func (l Log) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Log settings:")
+	node.Appendf("Log level: %s", l.Level.String())
+	return node
+}

internal/configuration/settings/openvpn.go

@@ -0,0 +1,320 @@
+package settings
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gluetun/internal/openvpn/parse"
+	"github.com/qdm12/gotree"
+)
+
+// OpenVPN contains settings to configure the OpenVPN client.
+type OpenVPN struct {
+	// Version is the OpenVPN version to run.
+	// It can only be "2.4" or "2.5".
+	Version string
+	// User is the OpenVPN authentication username.
+	// It cannot be an empty string in the internal state
+	// if OpenVPN is used.
+	User string
+	// Password is the OpenVPN authentication password.
+	// It cannot be an empty string in the internal state
+	// if OpenVPN is used.
+	Password string
+	// ConfFile is a custom OpenVPN configuration file path.
+	// It can be set to the empty string for it to be ignored.
+	// It cannot be nil in the internal state.
+	ConfFile *string
+	// Ciphers is a list of ciphers to use for OpenVPN,
+	// different from the ones specified by the VPN
+	// service provider configuration files.
+	Ciphers []string
+	// Auth is an auth algorithm to use in OpenVPN instead
+	// of the one specified by the VPN service provider.
+	// It cannot be nil in the internal state.
+	// It is ignored if it is set to the empty string.
+	Auth *string
+	// ClientCrt is the OpenVPN client certificate.
+	// This is notably used by Cyberghost.
+	// It can be set to the empty string to be ignored.
+	// It cannot be nil in the internal state.
+	ClientCrt *string
+	// ClientKey is the OpenVPN client key.
+	// This is used by Cyberghost and VPN Unlimited.
+	// It can be set to the empty string to be ignored.
+	// It cannot be nil in the internal state.
+	ClientKey *string
+	// PIAEncPreset is the encryption preset for
+	// Private Internet Access. It can be set to an
+	// empty string for other providers.
+	PIAEncPreset *string
+	// IPv6 is set to true if IPv6 routing should be
+	// set to be tunnel in OpenVPN, and false otherwise.
+	// It cannot be nil in the internal state.
+	IPv6 *bool // TODO automate like with Wireguard
+	// MSSFix is the value (1 to 10000) to set for the
+	// mssfix option for OpenVPN. It is ignored if set to 0.
+	// It cannot be nil in the internal state.
+	MSSFix *uint16
+	// Interface is the OpenVPN device interface name.
+	// It cannot be an empty string in the internal state.
+	Interface string
+	// Root is true if OpenVPN is to be run as root,
+	// and false otherwise. It cannot be nil in the
+	// internal state.
+	Root *bool
+	// ProcUser is the OpenVPN process OS username
+	// to use. It cannot be nil in the internal state.
+	// This is set and injected at runtime.
+	// TODO only use ProcUser and not Root field.
+	ProcUser string
+	// Verbosity is the OpenVPN verbosity level from 0 to 6.
+	// It cannot be nil in the internal state.
+	Verbosity *int
+	// Flags is a slice of additional flags to be passed
+	// to the OpenVPN program.
+	Flags []string
+}
+
+func (o OpenVPN) validate(vpnProvider string) (err error) {
+	// Validate version
+	validVersions := []string{constants.Openvpn24, constants.Openvpn25}
+	if !helpers.IsOneOf(o.Version, validVersions...) {
+		return fmt.Errorf("%w: %q can only be one of %s",
+			ErrOpenVPNVersionIsNotValid, o.Version, strings.Join(validVersions, ", "))
+	}
+
+	isCustom := vpnProvider == constants.Custom
+
+	if !isCustom && o.User == "" {
+		return ErrOpenVPNUserIsEmpty
+	}
+
+	if !isCustom && o.Password == "" {
+		return ErrOpenVPNPasswordIsEmpty
+	}
+
+	// Validate ConfFile
+	if isCustom {
+		if *o.ConfFile == "" {
+			return fmt.Errorf("%w: no file path specified", ErrOpenVPNConfigFile)
+		}
+		err := helpers.FileExists(*o.ConfFile)
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrOpenVPNConfigFile, err)
+		}
+	}
+
+	// Check client certificate
+	switch vpnProvider {
+	case
+		constants.Cyberghost,
+		constants.VPNUnlimited:
+		if *o.ClientCrt == "" {
+			return ErrOpenVPNClientCertMissing
+		}
+	}
+	if *o.ClientCrt != "" {
+		_, err = parse.ExtractCert([]byte(*o.ClientCrt))
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrOpenVPNClientCertNotValid, err)
+		}
+	}
+
+	// Check client key
+	switch vpnProvider {
+	case
+		constants.Cyberghost,
+		constants.VPNUnlimited,
+		constants.Wevpn:
+		if *o.ClientKey == "" {
+			return ErrOpenVPNClientKeyMissing
+		}
+	}
+	if *o.ClientKey != "" {
+		_, err = parse.ExtractPrivateKey([]byte(*o.ClientKey))
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrOpenVPNClientKeyNotValid, err)
+		}
+	}
+
+	// Validate MSSFix
+	const maxMSSFix = 10000
+	if *o.MSSFix > maxMSSFix {
+		return fmt.Errorf("%w: %d is over the maximum value of %d",
+			ErrOpenVPNMSSFixIsTooHigh, *o.MSSFix, maxMSSFix)
+	}
+
+	if !regexpInterfaceName.MatchString(o.Interface) {
+		return fmt.Errorf("%w: '%s' does not match regex '%s'",
+			ErrOpenVPNInterfaceNotValid, o.Interface, regexpInterfaceName)
+	}
+
+	// Validate Verbosity
+	if *o.Verbosity < 0 || *o.Verbosity > 6 {
+		return fmt.Errorf("%w: %d can only be between 0 and 5",
+			ErrOpenVPNVerbosityIsOutOfBounds, o.Verbosity)
+	}
+
+	return nil
+}
+
+func (o *OpenVPN) copy() (copied OpenVPN) {
+	return OpenVPN{
+		Version:      o.Version,
+		User:         o.User,
+		Password:     o.Password,
+		ConfFile:     helpers.CopyStringPtr(o.ConfFile),
+		Ciphers:      helpers.CopyStringSlice(o.Ciphers),
+		Auth:         helpers.CopyStringPtr(o.Auth),
+		ClientCrt:    helpers.CopyStringPtr(o.ClientCrt),
+		ClientKey:    helpers.CopyStringPtr(o.ClientKey),
+		PIAEncPreset: helpers.CopyStringPtr(o.PIAEncPreset),
+		IPv6:         helpers.CopyBoolPtr(o.IPv6),
+		MSSFix:       helpers.CopyUint16Ptr(o.MSSFix),
+		Interface:    o.Interface,
+		Root:         helpers.CopyBoolPtr(o.Root),
+		ProcUser:     o.ProcUser,
+		Verbosity:    helpers.CopyIntPtr(o.Verbosity),
+		Flags:        helpers.CopyStringSlice(o.Flags),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (o *OpenVPN) mergeWith(other OpenVPN) {
+	o.Version = helpers.MergeWithString(o.Version, other.Version)
+	o.User = helpers.MergeWithString(o.User, other.User)
+	o.Password = helpers.MergeWithString(o.Password, other.Password)
+	o.ConfFile = helpers.MergeWithStringPtr(o.ConfFile, other.ConfFile)
+	o.Ciphers = helpers.MergeStringSlices(o.Ciphers, other.Ciphers)
+	o.Auth = helpers.MergeWithStringPtr(o.Auth, other.Auth)
+	o.ClientCrt = helpers.MergeWithStringPtr(o.ClientCrt, other.ClientCrt)
+	o.ClientKey = helpers.MergeWithStringPtr(o.ClientKey, other.ClientKey)
+	o.PIAEncPreset = helpers.MergeWithStringPtr(o.PIAEncPreset, other.PIAEncPreset)
+	o.IPv6 = helpers.MergeWithBool(o.IPv6, other.IPv6)
+	o.MSSFix = helpers.MergeWithUint16(o.MSSFix, other.MSSFix)
+	o.Interface = helpers.MergeWithString(o.Interface, other.Interface)
+	o.Root = helpers.MergeWithBool(o.Root, other.Root)
+	o.ProcUser = helpers.MergeWithString(o.ProcUser, other.ProcUser)
+	o.Verbosity = helpers.MergeWithInt(o.Verbosity, other.Verbosity)
+	o.Flags = helpers.MergeStringSlices(o.Flags, other.Flags)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (o *OpenVPN) overrideWith(other OpenVPN) {
+	o.Version = helpers.OverrideWithString(o.Version, other.Version)
+	o.User = helpers.OverrideWithString(o.User, other.User)
+	o.Password = helpers.OverrideWithString(o.Password, other.Password)
+	o.ConfFile = helpers.OverrideWithStringPtr(o.ConfFile, other.ConfFile)
+	o.Ciphers = helpers.OverrideWithStringSlice(o.Ciphers, other.Ciphers)
+	o.Auth = helpers.OverrideWithStringPtr(o.Auth, other.Auth)
+	o.ClientCrt = helpers.OverrideWithStringPtr(o.ClientCrt, other.ClientCrt)
+	o.ClientKey = helpers.OverrideWithStringPtr(o.ClientKey, other.ClientKey)
+	o.PIAEncPreset = helpers.OverrideWithStringPtr(o.PIAEncPreset, other.PIAEncPreset)
+	o.IPv6 = helpers.OverrideWithBool(o.IPv6, other.IPv6)
+	o.MSSFix = helpers.OverrideWithUint16(o.MSSFix, other.MSSFix)
+	o.Interface = helpers.OverrideWithString(o.Interface, other.Interface)
+	o.Root = helpers.OverrideWithBool(o.Root, other.Root)
+	o.ProcUser = helpers.OverrideWithString(o.ProcUser, other.ProcUser)
+	o.Verbosity = helpers.OverrideWithInt(o.Verbosity, other.Verbosity)
+	o.Flags = helpers.OverrideWithStringSlice(o.Flags, other.Flags)
+}
+
+func (o *OpenVPN) setDefaults(vpnProvider string) {
+	o.Version = helpers.DefaultString(o.Version, constants.Openvpn25)
+	if vpnProvider == constants.Mullvad {
+		o.Password = "m"
+	}
+
+	o.ConfFile = helpers.DefaultStringPtr(o.ConfFile, "")
+	o.Auth = helpers.DefaultStringPtr(o.Auth, "")
+	o.ClientCrt = helpers.DefaultStringPtr(o.ClientCrt, "")
+	o.ClientKey = helpers.DefaultStringPtr(o.ClientKey, "")
+
+	var defaultEncPreset string
+	if vpnProvider == constants.PrivateInternetAccess {
+		defaultEncPreset = constants.PIAEncryptionPresetStrong
+	}
+	o.PIAEncPreset = helpers.DefaultStringPtr(o.PIAEncPreset, defaultEncPreset)
+
+	o.IPv6 = helpers.DefaultBool(o.IPv6, false)
+	o.MSSFix = helpers.DefaultUint16(o.MSSFix, 0)
+	o.Interface = helpers.DefaultString(o.Interface, "tun0")
+	o.Root = helpers.DefaultBool(o.Root, true)
+	o.ProcUser = helpers.DefaultString(o.ProcUser, "root")
+	o.Verbosity = helpers.DefaultInt(o.Verbosity, 1)
+}
+
+func (o OpenVPN) String() string {
+	return o.toLinesNode().String()
+}
+
+func (o OpenVPN) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("OpenVPN settings:")
+	node.Appendf("OpenVPN version: %s", o.Version)
+	node.Appendf("User: %s", helpers.ObfuscatePassword(o.User))
+	node.Appendf("Password: %s", helpers.ObfuscatePassword(o.Password))
+
+	if *o.ConfFile != "" {
+		node.Appendf("Custom configuration file: %s", *o.ConfFile)
+	}
+
+	if len(o.Ciphers) > 0 {
+		node.Appendf("Ciphers: %s", o.Ciphers)
+	}
+
+	if *o.Auth != "" {
+		node.Appendf("Auth: %s", *o.Auth)
+	}
+
+	if *o.ClientCrt != "" {
+		node.Appendf("Client crt: %s", helpers.ObfuscateData(*o.ClientCrt))
+	}
+
+	if *o.ClientKey != "" {
+		node.Appendf("Client key: %s", helpers.ObfuscateData(*o.ClientKey))
+	}
+
+	if *o.PIAEncPreset != "" {
+		node.Appendf("Private Internet Access encryption preset: %s", *o.PIAEncPreset)
+	}
+
+	node.Appendf("Tunnel IPv6: %s", helpers.BoolPtrToYesNo(o.IPv6))
+
+	if *o.MSSFix > 0 {
+		node.Appendf("MSS Fix: %d", *o.MSSFix)
+	}
+
+	if o.Interface != "" {
+		node.Appendf("Network interface: %s", o.Interface)
+	}
+
+	processUser := "root"
+	if !*o.Root {
+		processUser = "some non root user" // TODO
+		if o.ProcUser != "" {
+			processUser = o.ProcUser
+		}
+	}
+	node.Appendf("Run OpenVPN as: %s", processUser)
+
+	node.Appendf("Verbosity level: %d", *o.Verbosity)
+
+	if len(o.Flags) > 0 {
+		node.Appendf("Flags: %s", o.Flags)
+	}
+
+	return node
+}
+
+// WithDefaults is a shorthand using setDefaults.
+// It's used in unit tests in other packages.
+func (o OpenVPN) WithDefaults(provider string) OpenVPN {
+	o.setDefaults(provider)
+	return o
+}

internal/configuration/settings/openvpnselection.go

@@ -0,0 +1,170 @@
+package settings
+
+import (
+	"fmt"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gotree"
+)
+
+type OpenVPNSelection struct {
+	// ConfFile is the custom configuration file path.
+	// It can be set to an empty string to indicate to
+	// NOT use a custom configuration file.
+	// It cannot be nil in the internal state.
+	ConfFile *string
+	// TCP is true if the OpenVPN protocol is TCP,
+	// and false for UDP.
+	// It cannot be nil in the internal state.
+	TCP *bool
+	// CustomPort is the OpenVPN server endpoint port.
+	// It can be set to 0 to indicate no custom port should
+	// be used. It cannot be nil in the internal state.
+	CustomPort *uint16 // HideMyAss, Mullvad, PIA, ProtonVPN, WeVPN, Windscribe
+	// PIAEncPreset is the encryption preset for
+	// Private Internet Access. It can be set to an
+	// empty string for other providers.
+	PIAEncPreset *string
+}
+
+func (o OpenVPNSelection) validate(vpnProvider string) (err error) {
+	// Validate ConfFile
+	if confFile := *o.ConfFile; confFile != "" {
+		err := helpers.FileExists(confFile)
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrOpenVPNConfigFile, err)
+		}
+	}
+
+	// Validate TCP
+	if *o.TCP && helpers.IsOneOf(vpnProvider,
+		constants.Perfectprivacy,
+		constants.Privado,
+		constants.Vyprvpn,
+	) {
+		return fmt.Errorf("%w: for VPN service provider %s",
+			ErrOpenVPNTCPNotSupported, vpnProvider)
+	}
+
+	// Validate CustomPort
+	if *o.CustomPort != 0 {
+		switch vpnProvider {
+		// no restriction on port
+		case constants.Cyberghost, constants.HideMyAss,
+			constants.PrivateInternetAccess, constants.Privatevpn,
+			constants.Protonvpn, constants.Torguard:
+		// no custom port allowed
+		case constants.Expressvpn, constants.Fastestvpn,
+			constants.Ipvanish, constants.Nordvpn,
+			constants.Privado, constants.Purevpn,
+			constants.Surfshark, constants.VPNUnlimited,
+			constants.Vyprvpn:
+			return fmt.Errorf("%w: for VPN service provider %s",
+				ErrOpenVPNCustomPortNotAllowed, vpnProvider)
+		default:
+			var allowedTCP, allowedUDP []uint16
+			switch vpnProvider {
+			case constants.Ivpn:
+				allowedTCP = []uint16{80, 443, 1143}
+				allowedUDP = []uint16{53, 1194, 2049, 2050}
+			case constants.Mullvad:
+				allowedTCP = []uint16{80, 443, 1401}
+				allowedUDP = []uint16{53, 1194, 1195, 1196, 1197, 1300, 1301, 1302, 1303, 1400}
+			case constants.Perfectprivacy:
+				allowedTCP = []uint16{44, 443, 4433}
+				allowedUDP = []uint16{44, 443, 4433}
+			case constants.Wevpn:
+				allowedTCP = []uint16{53, 1195, 1199, 2018}
+				allowedUDP = []uint16{80, 1194, 1198}
+			case constants.Windscribe:
+				allowedTCP = []uint16{21, 22, 80, 123, 143, 443, 587, 1194, 3306, 8080, 54783}
+				allowedUDP = []uint16{53, 80, 123, 443, 1194, 54783}
+			}
+
+			if *o.TCP && !helpers.Uint16IsOneOf(*o.CustomPort, allowedTCP) {
+				return fmt.Errorf("%w: %d for VPN service provider %s; %s",
+					ErrOpenVPNCustomPortNotAllowed, o.CustomPort, vpnProvider,
+					helpers.PortChoicesOrString(allowedTCP))
+			} else if !*o.TCP && !helpers.Uint16IsOneOf(*o.CustomPort, allowedUDP) {
+				return fmt.Errorf("%w: %d for VPN service provider %s; %s",
+					ErrOpenVPNCustomPortNotAllowed, o.CustomPort, vpnProvider,
+					helpers.PortChoicesOrString(allowedUDP))
+			}
+		}
+	}
+
+	// Validate EncPreset
+	if vpnProvider == constants.PrivateInternetAccess {
+		validEncryptionPresets := []string{
+			constants.PIAEncryptionPresetNone,
+			constants.PIAEncryptionPresetNormal,
+			constants.PIAEncryptionPresetStrong,
+		}
+		if !helpers.IsOneOf(*o.PIAEncPreset, validEncryptionPresets...) {
+			return fmt.Errorf("%w: %s; valid presets are %s",
+				ErrOpenVPNEncryptionPresetNotValid, *o.PIAEncPreset,
+				helpers.ChoicesOrString(validEncryptionPresets))
+		}
+	}
+
+	return nil
+}
+
+func (o *OpenVPNSelection) copy() (copied OpenVPNSelection) {
+	return OpenVPNSelection{
+		ConfFile:     helpers.CopyStringPtr(o.ConfFile),
+		TCP:          helpers.CopyBoolPtr(o.TCP),
+		CustomPort:   helpers.CopyUint16Ptr(o.CustomPort),
+		PIAEncPreset: helpers.CopyStringPtr(o.PIAEncPreset),
+	}
+}
+
+func (o *OpenVPNSelection) mergeWith(other OpenVPNSelection) {
+	o.ConfFile = helpers.MergeWithStringPtr(o.ConfFile, other.ConfFile)
+	o.TCP = helpers.MergeWithBool(o.TCP, other.TCP)
+	o.CustomPort = helpers.MergeWithUint16(o.CustomPort, other.CustomPort)
+	o.PIAEncPreset = helpers.MergeWithStringPtr(o.PIAEncPreset, other.PIAEncPreset)
+}
+
+func (o *OpenVPNSelection) overrideWith(other OpenVPNSelection) {
+	o.ConfFile = helpers.OverrideWithStringPtr(o.ConfFile, other.ConfFile)
+	o.TCP = helpers.OverrideWithBool(o.TCP, other.TCP)
+	o.CustomPort = helpers.OverrideWithUint16(o.CustomPort, other.CustomPort)
+	o.PIAEncPreset = helpers.OverrideWithStringPtr(o.PIAEncPreset, other.PIAEncPreset)
+}
+
+func (o *OpenVPNSelection) setDefaults(vpnProvider string) {
+	o.ConfFile = helpers.DefaultStringPtr(o.ConfFile, "")
+	o.TCP = helpers.DefaultBool(o.TCP, false)
+	o.CustomPort = helpers.DefaultUint16(o.CustomPort, 0)
+
+	var defaultEncPreset string
+	if vpnProvider == constants.PrivateInternetAccess {
+		defaultEncPreset = constants.PIAEncryptionPresetStrong
+	}
+	o.PIAEncPreset = helpers.DefaultStringPtr(o.PIAEncPreset, defaultEncPreset)
+}
+
+func (o OpenVPNSelection) String() string {
+	return o.toLinesNode().String()
+}
+
+func (o OpenVPNSelection) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("OpenVPN server selection settings:")
+	node.Appendf("Protocol: %s", helpers.TCPPtrToString(o.TCP))
+
+	if *o.CustomPort != 0 {
+		node.Appendf("Custom port: %d", *o.CustomPort)
+	}
+
+	if *o.PIAEncPreset != "" {
+		node.Appendf("Private Internet Access encryption preset: %s", *o.PIAEncPreset)
+	}
+
+	if *o.ConfFile != "" {
+		node.Appendf("Custom configuration file: %s", *o.ConfFile)
+	}
+
+	return node
+}

internal/configuration/settings/portforward.go

@@ -0,0 +1,89 @@
+package settings
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gotree"
+)
+
+// PortForwarding contains settings for port forwarding.
+type PortForwarding struct {
+	// Enabled is true if port forwarding should be activated.
+	// It cannot be nil for the internal state.
+	Enabled *bool
+	// Filepath is the port forwarding status file path
+	// to use. It can be the empty string to indicate not
+	// to write to a file. It cannot be nil for the
+	// internal state
+	Filepath *string
+}
+
+func (p PortForwarding) validate(vpnProvider string) (err error) {
+	if !*p.Enabled {
+		return nil
+	}
+
+	// Validate Enabled
+	validProviders := []string{constants.PrivateInternetAccess}
+	if !helpers.IsOneOf(vpnProvider, validProviders...) {
+		return fmt.Errorf("%w: for provider %s, it is only available for %s",
+			ErrPortForwardingEnabled, vpnProvider, strings.Join(validProviders, ", "))
+	}
+
+	// Validate Filepath
+	if *p.Filepath != "" { // optional
+		_, err := filepath.Abs(*p.Filepath)
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrPortForwardingFilepathNotValid, err)
+		}
+	}
+
+	return nil
+}
+
+func (p *PortForwarding) copy() (copied PortForwarding) {
+	return PortForwarding{
+		Enabled:  helpers.CopyBoolPtr(p.Enabled),
+		Filepath: helpers.CopyStringPtr(p.Filepath),
+	}
+}
+
+func (p *PortForwarding) mergeWith(other PortForwarding) {
+	p.Enabled = helpers.MergeWithBool(p.Enabled, other.Enabled)
+	p.Filepath = helpers.MergeWithStringPtr(p.Filepath, other.Filepath)
+}
+
+func (p *PortForwarding) overrideWith(other PortForwarding) {
+	p.Enabled = helpers.OverrideWithBool(p.Enabled, other.Enabled)
+	p.Filepath = helpers.OverrideWithStringPtr(p.Filepath, other.Filepath)
+}
+
+func (p *PortForwarding) setDefaults() {
+	p.Enabled = helpers.DefaultBool(p.Enabled, false)
+	p.Filepath = helpers.DefaultStringPtr(p.Filepath, "/tmp/gluetun/forwarded_port")
+}
+
+func (p PortForwarding) String() string {
+	return p.toLinesNode().String()
+}
+
+func (p PortForwarding) toLinesNode() (node *gotree.Node) {
+	if !*p.Enabled {
+		return nil
+	}
+
+	node = gotree.New("Automatic port forwarding settings:")
+	node.Appendf("Enabled: yes")
+
+	filepath := *p.Filepath
+	if filepath == "" {
+		filepath = "[not set]"
+	}
+	node.Appendf("Forwarded port file path: %s", filepath)
+
+	return node
+}

internal/configuration/settings/portforward_test.go

@@ -0,0 +1,19 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_PortForwarding_String(t *testing.T) {
+	t.Parallel()
+
+	settings := PortForwarding{
+		Enabled: boolPtr(false),
+	}
+
+	s := settings.String()
+
+	assert.Empty(t, s)
+}

internal/configuration/settings/provider.go

@@ -0,0 +1,93 @@
+package settings
+
+import (
+	"fmt"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gluetun/internal/models"
+	"github.com/qdm12/gotree"
+)
+
+// Provider contains settings specific to a VPN provider.
+type Provider struct {
+	// Name is the VPN service provider name.
+	// It cannot be nil in the internal state.
+	Name *string
+	// ServerSelection is the settings to
+	// select the VPN server.
+	ServerSelection ServerSelection
+	// PortForwarding is the settings about port forwarding.
+	PortForwarding PortForwarding
+}
+
+// TODO v4 remove pointer for receiver (because of Surfshark).
+func (p *Provider) validate(vpnType string, allServers models.AllServers) (err error) {
+	// Validate Name
+	var validNames []string
+	if vpnType == constants.OpenVPN {
+		validNames = constants.AllProviders()
+		validNames = append(validNames, "pia") // Retro-compatibility
+	} else { // Wireguard
+		validNames = []string{
+			constants.Custom,
+			constants.Ivpn,
+			constants.Mullvad,
+			constants.Windscribe,
+		}
+	}
+	if !helpers.IsOneOf(*p.Name, validNames...) {
+		return fmt.Errorf("%w: %q can only be one of %s",
+			ErrVPNProviderNameNotValid, *p.Name, helpers.ChoicesOrString(validNames))
+	}
+
+	err = p.ServerSelection.validate(*p.Name, allServers)
+	if err != nil {
+		return fmt.Errorf("server selection settings validation failed: %w", err)
+	}
+
+	err = p.PortForwarding.validate(*p.Name)
+	if err != nil {
+		return fmt.Errorf("port forwarding settings validation failed: %w", err)
+	}
+
+	return nil
+}
+
+func (p *Provider) copy() (copied Provider) {
+	return Provider{
+		Name:            helpers.CopyStringPtr(p.Name),
+		ServerSelection: p.ServerSelection.copy(),
+		PortForwarding:  p.PortForwarding.copy(),
+	}
+}
+
+func (p *Provider) mergeWith(other Provider) {
+	p.Name = helpers.MergeWithStringPtr(p.Name, other.Name)
+	p.ServerSelection.mergeWith(other.ServerSelection)
+	p.PortForwarding.mergeWith(other.PortForwarding)
+}
+
+func (p *Provider) overrideWith(other Provider) {
+	p.Name = helpers.OverrideWithStringPtr(p.Name, other.Name)
+	p.ServerSelection.overrideWith(other.ServerSelection)
+	p.PortForwarding.overrideWith(other.PortForwarding)
+}
+
+func (p *Provider) setDefaults() {
+	p.Name = helpers.DefaultStringPtr(p.Name, constants.PrivateInternetAccess)
+	p.ServerSelection.setDefaults(*p.Name)
+	p.PortForwarding.setDefaults()
+}
+
+func (p Provider) String() string {
+	return p.toLinesNode().String()
+}
+
+func (p Provider) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("VPN provider settings:")
+	node.Appendf("Name: %s", *p.Name)
+	node.AppendNode(p.ServerSelection.toLinesNode())
+	node.AppendNode(p.PortForwarding.toLinesNode())
+	return node
+}

internal/configuration/settings/publicip.go

@@ -0,0 +1,89 @@
+package settings
+
+import (
+	"fmt"
+	"path/filepath"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// PublicIP contains settings for port forwarding.
+type PublicIP struct {
+	// Period is the period to get the public IP address.
+	// It can be set to 0 to disable periodic checking.
+	// It cannot be nil for the internal state.
+	// TODO change to value and add enabled field
+	Period *time.Duration
+	// IPFilepath is the public IP address status file path
+	// to use. It can be the empty string to indicate not
+	// to write to a file. It cannot be nil for the
+	// internal state
+	IPFilepath *string
+}
+
+func (p PublicIP) validate() (err error) {
+	const minPeriod = 5 * time.Second
+	if *p.Period < minPeriod {
+		return fmt.Errorf("%w: %s must be at least %s",
+			ErrPublicIPPeriodTooShort, p.Period, minPeriod)
+	}
+
+	if *p.IPFilepath != "" { // optional
+		_, err := filepath.Abs(*p.IPFilepath)
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrPublicIPFilepathNotValid, err)
+		}
+	}
+
+	return nil
+}
+
+func (p *PublicIP) copy() (copied PublicIP) {
+	return PublicIP{
+		Period:     helpers.CopyDurationPtr(p.Period),
+		IPFilepath: helpers.CopyStringPtr(p.IPFilepath),
+	}
+}
+
+func (p *PublicIP) mergeWith(other PublicIP) {
+	p.Period = helpers.MergeWithDuration(p.Period, other.Period)
+	p.IPFilepath = helpers.MergeWithStringPtr(p.IPFilepath, other.IPFilepath)
+}
+
+func (p *PublicIP) overrideWith(other PublicIP) {
+	p.Period = helpers.OverrideWithDuration(p.Period, other.Period)
+	p.IPFilepath = helpers.OverrideWithStringPtr(p.IPFilepath, other.IPFilepath)
+}
+
+func (p *PublicIP) setDefaults() {
+	const defaultPeriod = 12 * time.Hour
+	p.Period = helpers.DefaultDuration(p.Period, defaultPeriod)
+	p.IPFilepath = helpers.DefaultStringPtr(p.IPFilepath, "/tmp/gluetun/ip")
+}
+
+func (p PublicIP) String() string {
+	return p.toLinesNode().String()
+}
+
+func (p PublicIP) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Public IP settings:")
+
+	if *p.Period == 0 {
+		node.Appendf("Enabled: no")
+		return node
+	}
+
+	updatePeriod := "disabled"
+	if *p.Period > 0 {
+		updatePeriod = "every " + p.Period.String()
+	}
+	node.Appendf("Fetching: %s", updatePeriod)
+
+	if *p.IPFilepath != "" {
+		node.Appendf("IP file path: %s", *p.IPFilepath)
+	}
+
+	return node
+}

internal/configuration/settings/server.go

@@ -0,0 +1,71 @@
+package settings
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// ControlServer contains settings to customize the control server operation.
+type ControlServer struct {
+	// Port is the listening port to use.
+	// It can be set to 0 to bind to a random port.
+	// It cannot be nil in the internal state.
+	// TODO change to address
+	Port *uint16
+	// Log can be true or false to enable logging on requests.
+	// It cannot be nil in the internal state.
+	Log *bool
+}
+
+func (c ControlServer) validate() (err error) {
+	uid := os.Getuid()
+	const maxPrivilegedPort uint16 = 1023
+	if uid != 0 && *c.Port <= maxPrivilegedPort {
+		return fmt.Errorf("%w: %d when running with user ID %d",
+			ErrControlServerPrivilegedPort, *c.Port, uid)
+	}
+
+	return nil
+}
+
+func (c *ControlServer) copy() (copied ControlServer) {
+	return ControlServer{
+		Port: helpers.CopyUint16Ptr(c.Port),
+		Log:  helpers.CopyBoolPtr(c.Log),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (c *ControlServer) mergeWith(other ControlServer) {
+	c.Port = helpers.MergeWithUint16(c.Port, other.Port)
+	c.Log = helpers.MergeWithBool(c.Log, other.Log)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (c *ControlServer) overrideWith(other ControlServer) {
+	c.Port = helpers.MergeWithUint16(c.Port, other.Port)
+	c.Log = helpers.MergeWithBool(c.Log, other.Log)
+}
+
+func (c *ControlServer) setDefaults() {
+	const defaultPort = 8000
+	c.Port = helpers.DefaultUint16(c.Port, defaultPort)
+	c.Log = helpers.DefaultBool(c.Log, true)
+}
+
+func (c ControlServer) String() string {
+	return c.toLinesNode().String()
+}
+
+func (c ControlServer) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Control server settings:")
+	node.Appendf("Listening port: %d", *c.Port)
+	node.Appendf("Logging: %s", helpers.BoolPtrToYesNo(c.Log))
+	return node
+}

internal/configuration/settings/serverselection.go

@@ -0,0 +1,389 @@
+package settings
+
+import (
+	"fmt"
+	"net"
+	"strings"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gluetun/internal/models"
+	"github.com/qdm12/gotree"
+)
+
+type ServerSelection struct { //nolint:maligned
+	// VPN is the VPN type which can be 'openvpn'
+	// or 'wireguard'. It cannot be the empty string
+	// in the internal state.
+	VPN string
+	// TargetIP is the server endpoint IP address to use.
+	// It will override any IP address from the picked
+	// built-in server. It cannot be nil in the internal
+	// state, and can be set to an empty net.IP{} to indicate
+	// there is not target IP address to use.
+	TargetIP net.IP
+	// Counties is the list of countries to filter VPN servers with.
+	Countries []string
+	// Regions is the list of regions to filter VPN servers with.
+	Regions []string
+	// Cities is the list of cities to filter VPN servers with.
+	Cities []string
+	// ISPs is the list of ISP names to filter VPN servers with.
+	ISPs []string
+	// Names is the list of server names to filter VPN servers with.
+	Names []string
+	// Numbers is the list of server numbers to filter VPN servers with.
+	Numbers []uint16
+	// Hostnames is the list of hostnames to filter VPN servers with.
+	Hostnames []string
+	// OwnedOnly is true if only VPN provider owned servers
+	// should be filtered. This is used with Mullvad.
+	OwnedOnly *bool
+	// FreeOnly is true if only free VPN servers
+	// should be filtered. This is used with ProtonVPN.
+	FreeOnly *bool
+	// FreeOnly is true if only free VPN servers
+	// should be filtered. This is used with ProtonVPN.
+	StreamOnly *bool
+	// MultiHopOnly is true if only multihop VPN servers
+	// should be filtered. This is used with Surfshark.
+	MultiHopOnly *bool
+
+	// OpenVPN contains settings to select OpenVPN servers
+	// and the final connection.
+	OpenVPN OpenVPNSelection
+	// Wireguard contains settings to select Wireguard servers
+	// and the final connection.
+	Wireguard WireguardSelection
+}
+
+func (ss *ServerSelection) validate(vpnServiceProvider string,
+	allServers models.AllServers) (err error) {
+	switch ss.VPN {
+	case constants.OpenVPN, constants.Wireguard:
+	default:
+		return fmt.Errorf("%w: %s", ErrVPNTypeNotValid, ss.VPN)
+	}
+
+	var countryChoices, regionChoices, cityChoices,
+		ispChoices, nameChoices, hostnameChoices []string
+	switch vpnServiceProvider {
+	case constants.Custom:
+	case constants.Cyberghost:
+		servers := allServers.GetCyberghost()
+		countryChoices = constants.CyberghostCountryChoices(servers)
+		hostnameChoices = constants.CyberghostHostnameChoices(servers)
+	case constants.Expressvpn:
+		servers := allServers.GetExpressvpn()
+		countryChoices = constants.ExpressvpnCountriesChoices(servers)
+		cityChoices = constants.ExpressvpnCityChoices(servers)
+		hostnameChoices = constants.ExpressvpnHostnameChoices(servers)
+	case constants.Fastestvpn:
+		servers := allServers.GetFastestvpn()
+		countryChoices = constants.FastestvpnCountriesChoices(servers)
+		hostnameChoices = constants.FastestvpnHostnameChoices(servers)
+	case constants.HideMyAss:
+		servers := allServers.GetHideMyAss()
+		countryChoices = constants.HideMyAssCountryChoices(servers)
+		regionChoices = constants.HideMyAssRegionChoices(servers)
+		cityChoices = constants.HideMyAssCityChoices(servers)
+		hostnameChoices = constants.HideMyAssHostnameChoices(servers)
+	case constants.Ipvanish:
+		servers := allServers.GetIpvanish()
+		countryChoices = constants.IpvanishCountryChoices(servers)
+		cityChoices = constants.IpvanishCityChoices(servers)
+		hostnameChoices = constants.IpvanishHostnameChoices(servers)
+	case constants.Ivpn:
+		servers := allServers.GetIvpn()
+		countryChoices = constants.IvpnCountryChoices(servers)
+		cityChoices = constants.IvpnCityChoices(servers)
+		ispChoices = constants.IvpnISPChoices(servers)
+		hostnameChoices = constants.IvpnHostnameChoices(servers)
+	case constants.Mullvad:
+		servers := allServers.GetMullvad()
+		countryChoices = constants.MullvadCountryChoices(servers)
+		cityChoices = constants.MullvadCityChoices(servers)
+		ispChoices = constants.MullvadISPChoices(servers)
+		hostnameChoices = constants.MullvadHostnameChoices(servers)
+	case constants.Nordvpn:
+		servers := allServers.GetNordvpn()
+		regionChoices = constants.NordvpnRegionChoices(servers)
+		hostnameChoices = constants.NordvpnHostnameChoices(servers)
+	case constants.Perfectprivacy:
+		servers := allServers.GetPerfectprivacy()
+		cityChoices = constants.PerfectprivacyCityChoices(servers)
+	case constants.Privado:
+		servers := allServers.GetPrivado()
+		countryChoices = constants.PrivadoCountryChoices(servers)
+		regionChoices = constants.PrivadoRegionChoices(servers)
+		cityChoices = constants.PrivadoCityChoices(servers)
+		hostnameChoices = constants.PrivadoHostnameChoices(servers)
+	case constants.PrivateInternetAccess:
+		servers := allServers.GetPia()
+		regionChoices = constants.PIAGeoChoices(servers)
+		hostnameChoices = constants.PIAHostnameChoices(servers)
+		nameChoices = constants.PIANameChoices(servers)
+	case constants.Privatevpn:
+		servers := allServers.GetPrivatevpn()
+		countryChoices = constants.PrivatevpnCountryChoices(servers)
+		cityChoices = constants.PrivatevpnCityChoices(servers)
+		hostnameChoices = constants.PrivatevpnHostnameChoices(servers)
+	case constants.Protonvpn:
+		servers := allServers.GetProtonvpn()
+		countryChoices = constants.ProtonvpnCountryChoices(servers)
+		regionChoices = constants.ProtonvpnRegionChoices(servers)
+		cityChoices = constants.ProtonvpnCityChoices(servers)
+		nameChoices = constants.ProtonvpnNameChoices(servers)
+		hostnameChoices = constants.ProtonvpnHostnameChoices(servers)
+	case constants.Purevpn:
+		servers := allServers.GetPurevpn()
+		countryChoices = constants.PurevpnCountryChoices(servers)
+		regionChoices = constants.PurevpnRegionChoices(servers)
+		cityChoices = constants.PurevpnCityChoices(servers)
+		hostnameChoices = constants.PurevpnHostnameChoices(servers)
+	case constants.Surfshark:
+		servers := allServers.GetSurfshark()
+		countryChoices = constants.SurfsharkCountryChoices(servers)
+		cityChoices = constants.SurfsharkCityChoices(servers)
+		hostnameChoices = constants.SurfsharkHostnameChoices(servers)
+		regionChoices = constants.SurfsharkRegionChoices(servers)
+		// TODO v4 remove
+		regionChoices = append(regionChoices, constants.SurfsharkRetroLocChoices(servers)...)
+		if err := helpers.AreAllOneOf(ss.Regions, regionChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrRegionNotValid, err)
+		}
+		// Retro compatibility
+		// TODO remove in v4
+		*ss = surfsharkRetroRegion(*ss)
+	case constants.Torguard:
+		servers := allServers.GetTorguard()
+		countryChoices = constants.TorguardCountryChoices(servers)
+		cityChoices = constants.TorguardCityChoices(servers)
+		hostnameChoices = constants.TorguardHostnameChoices(servers)
+	case constants.VPNUnlimited:
+		servers := allServers.GetVPNUnlimited()
+		countryChoices = constants.VPNUnlimitedCountryChoices(servers)
+		cityChoices = constants.VPNUnlimitedCityChoices(servers)
+		hostnameChoices = constants.VPNUnlimitedHostnameChoices(servers)
+	case constants.Vyprvpn:
+		servers := allServers.GetVyprvpn()
+		regionChoices = constants.VyprvpnRegionChoices(servers)
+	case constants.Wevpn:
+		servers := allServers.GetWevpn()
+		cityChoices = constants.WevpnCityChoices(servers)
+		hostnameChoices = constants.WevpnHostnameChoices(servers)
+	case constants.Windscribe:
+		servers := allServers.GetWindscribe()
+		regionChoices = constants.WindscribeRegionChoices(servers)
+		cityChoices = constants.WindscribeCityChoices(servers)
+		hostnameChoices = constants.WindscribeHostnameChoices(servers)
+	default:
+		return fmt.Errorf("%w: %s", ErrVPNProviderNameNotValid, vpnServiceProvider)
+	}
+
+	err = validateServerFilters(*ss, countryChoices, regionChoices, cityChoices,
+		ispChoices, nameChoices, hostnameChoices)
+	if err != nil {
+		return err // already wrapped error
+	}
+
+	if ss.VPN == constants.OpenVPN {
+		err = ss.OpenVPN.validate(vpnServiceProvider)
+		if err != nil {
+			return fmt.Errorf("OpenVPN server selection settings validation failed: %w", err)
+		}
+	} else {
+		err = ss.Wireguard.validate(vpnServiceProvider)
+		if err != nil {
+			return fmt.Errorf("Wireguard server selection settings validation failed: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// validateServerFilters validates filters against the choices given as arguments.
+// Set an argument to nil to pass the check for a particular filter.
+func validateServerFilters(settings ServerSelection,
+	countryChoices, regionChoices, cityChoices, ispChoices,
+	nameChoices, hostnameChoices []string) (err error) {
+	if countryChoices != nil {
+		if err := helpers.AreAllOneOf(settings.Countries, countryChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrCountryNotValid, err)
+		}
+	}
+
+	if regionChoices != nil {
+		if err := helpers.AreAllOneOf(settings.Regions, regionChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrRegionNotValid, err)
+		}
+	}
+
+	if cityChoices != nil {
+		if err := helpers.AreAllOneOf(settings.Cities, cityChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrCityNotValid, err)
+		}
+	}
+
+	if ispChoices != nil {
+		if err := helpers.AreAllOneOf(settings.ISPs, ispChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrISPNotValid, err)
+		}
+	}
+
+	if hostnameChoices != nil {
+		if err := helpers.AreAllOneOf(settings.Hostnames, hostnameChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrHostnameNotValid, err)
+		}
+	}
+
+	if nameChoices != nil {
+		if err := helpers.AreAllOneOf(settings.Names, nameChoices); err != nil {
+			return fmt.Errorf("%w: %s", ErrNameNotValid, err)
+		}
+	}
+
+	return nil
+}
+
+func (ss *ServerSelection) copy() (copied ServerSelection) {
+	return ServerSelection{
+		VPN:          ss.VPN,
+		TargetIP:     helpers.CopyIP(ss.TargetIP),
+		Countries:    helpers.CopyStringSlice(ss.Countries),
+		Regions:      helpers.CopyStringSlice(ss.Regions),
+		Cities:       helpers.CopyStringSlice(ss.Cities),
+		ISPs:         helpers.CopyStringSlice(ss.ISPs),
+		Hostnames:    helpers.CopyStringSlice(ss.Hostnames),
+		Names:        helpers.CopyStringSlice(ss.Names),
+		Numbers:      helpers.CopyUint16Slice(ss.Numbers),
+		OwnedOnly:    helpers.CopyBoolPtr(ss.OwnedOnly),
+		FreeOnly:     helpers.CopyBoolPtr(ss.FreeOnly),
+		StreamOnly:   helpers.CopyBoolPtr(ss.StreamOnly),
+		MultiHopOnly: helpers.CopyBoolPtr(ss.MultiHopOnly),
+		OpenVPN:      ss.OpenVPN.copy(),
+		Wireguard:    ss.Wireguard.copy(),
+	}
+}
+
+func (ss *ServerSelection) mergeWith(other ServerSelection) {
+	ss.VPN = helpers.MergeWithString(ss.VPN, other.VPN)
+	ss.TargetIP = helpers.MergeWithIP(ss.TargetIP, other.TargetIP)
+	ss.Countries = helpers.MergeStringSlices(ss.Countries, other.Countries)
+	ss.Regions = helpers.MergeStringSlices(ss.Regions, other.Regions)
+	ss.Cities = helpers.MergeStringSlices(ss.Cities, other.Cities)
+	ss.ISPs = helpers.MergeStringSlices(ss.ISPs, other.ISPs)
+	ss.Hostnames = helpers.MergeStringSlices(ss.Hostnames, other.Hostnames)
+	ss.Names = helpers.MergeStringSlices(ss.Names, other.Names)
+	ss.Numbers = helpers.MergeUint16Slices(ss.Numbers, other.Numbers)
+	ss.OwnedOnly = helpers.MergeWithBool(ss.OwnedOnly, other.OwnedOnly)
+	ss.FreeOnly = helpers.MergeWithBool(ss.FreeOnly, other.FreeOnly)
+	ss.StreamOnly = helpers.MergeWithBool(ss.StreamOnly, other.StreamOnly)
+	ss.MultiHopOnly = helpers.MergeWithBool(ss.MultiHopOnly, other.MultiHopOnly)
+
+	ss.OpenVPN.mergeWith(other.OpenVPN)
+	ss.Wireguard.mergeWith(other.Wireguard)
+}
+
+func (ss *ServerSelection) overrideWith(other ServerSelection) {
+	ss.VPN = helpers.OverrideWithString(ss.VPN, other.VPN)
+	ss.TargetIP = helpers.OverrideWithIP(ss.TargetIP, other.TargetIP)
+	ss.Countries = helpers.OverrideWithStringSlice(ss.Countries, other.Countries)
+	ss.Regions = helpers.OverrideWithStringSlice(ss.Regions, other.Regions)
+	ss.Cities = helpers.OverrideWithStringSlice(ss.Cities, other.Cities)
+	ss.ISPs = helpers.OverrideWithStringSlice(ss.ISPs, other.ISPs)
+	ss.Hostnames = helpers.OverrideWithStringSlice(ss.Hostnames, other.Hostnames)
+	ss.Names = helpers.OverrideWithStringSlice(ss.Names, other.Names)
+	ss.Numbers = helpers.OverrideWithUint16Slice(ss.Numbers, other.Numbers)
+	ss.OwnedOnly = helpers.OverrideWithBool(ss.OwnedOnly, other.OwnedOnly)
+	ss.FreeOnly = helpers.OverrideWithBool(ss.FreeOnly, other.FreeOnly)
+	ss.StreamOnly = helpers.OverrideWithBool(ss.StreamOnly, other.StreamOnly)
+	ss.MultiHopOnly = helpers.OverrideWithBool(ss.MultiHopOnly, other.MultiHopOnly)
+	ss.OpenVPN.overrideWith(other.OpenVPN)
+	ss.Wireguard.overrideWith(other.Wireguard)
+}
+
+func (ss *ServerSelection) setDefaults(vpnProvider string) {
+	ss.VPN = helpers.DefaultString(ss.VPN, constants.OpenVPN)
+	ss.TargetIP = helpers.DefaultIP(ss.TargetIP, net.IP{})
+	ss.OwnedOnly = helpers.DefaultBool(ss.OwnedOnly, false)
+	ss.FreeOnly = helpers.DefaultBool(ss.FreeOnly, false)
+	ss.StreamOnly = helpers.DefaultBool(ss.StreamOnly, false)
+	ss.MultiHopOnly = helpers.DefaultBool(ss.MultiHopOnly, false)
+	ss.OpenVPN.setDefaults(vpnProvider)
+	ss.Wireguard.setDefaults()
+}
+
+func (ss ServerSelection) String() string {
+	return ss.toLinesNode().String()
+}
+
+func (ss ServerSelection) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Server selection settings:")
+	node.Appendf("VPN type: %s", ss.VPN)
+	if len(ss.TargetIP) > 0 {
+		node.Appendf("Target IP address: %s", ss.TargetIP)
+	}
+
+	if len(ss.Countries) > 0 {
+		node.Appendf("Countries: %s", strings.Join(ss.Countries, ", "))
+	}
+
+	if len(ss.Regions) > 0 {
+		node.Appendf("Regions: %s", strings.Join(ss.Regions, ", "))
+	}
+
+	if len(ss.Cities) > 0 {
+		node.Appendf("Cities: %s", strings.Join(ss.Cities, ", "))
+	}
+
+	if len(ss.ISPs) > 0 {
+		node.Appendf("ISPs: %s", strings.Join(ss.ISPs, ", "))
+	}
+
+	if len(ss.Names) > 0 {
+		node.Appendf("Server names: %s", strings.Join(ss.Names, ", "))
+	}
+
+	if len(ss.Numbers) > 0 {
+		numbersNode := node.Appendf("Server numbers:")
+		for _, number := range ss.Numbers {
+			numbersNode.Appendf("%d", number)
+		}
+	}
+
+	if len(ss.Hostnames) > 0 {
+		node.Appendf("Hostnames: %s", strings.Join(ss.Hostnames, ", "))
+	}
+
+	if *ss.OwnedOnly {
+		node.Appendf("Owned only servers: yes")
+	}
+
+	if *ss.FreeOnly {
+		node.Appendf("Free only servers: yes")
+	}
+
+	if *ss.StreamOnly {
+		node.Appendf("Stream only servers: yes")
+	}
+
+	if *ss.MultiHopOnly {
+		node.Appendf("Multi-hop only servers: yes")
+	}
+
+	if ss.VPN == constants.OpenVPN {
+		node.AppendNode(ss.OpenVPN.toLinesNode())
+	} else {
+		node.AppendNode(ss.Wireguard.toLinesNode())
+	}
+
+	return node
+}
+
+// WithDefaults is a shorthand using setDefaults.
+// It's used in unit tests in other packages.
+func (ss ServerSelection) WithDefaults(provider string) ServerSelection {
+	ss.setDefaults(provider)
+	return ss
+}

internal/configuration/settings/settings.go

@@ -0,0 +1,147 @@
+package settings
+
+import (
+	"fmt"
+
+	"github.com/qdm12/gluetun/internal/models"
+	"github.com/qdm12/gotree"
+)
+
+type Settings struct {
+	ControlServer ControlServer
+	DNS           DNS
+	Firewall      Firewall
+	Health        Health
+	HTTPProxy     HTTPProxy
+	Log           Log
+	PublicIP      PublicIP
+	Shadowsocks   Shadowsocks
+	System        System
+	Updater       Updater
+	Version       Version
+	VPN           VPN
+}
+
+// Validate validates all the settings and returns an error
+// if one of them is not valid.
+// TODO v4 remove pointer for receiver (because of Surfshark).
+func (s *Settings) Validate(allServers models.AllServers) (err error) {
+	nameToValidation := map[string]func() error{
+		"control server":  s.ControlServer.validate,
+		"dns":             s.DNS.validate,
+		"firewall":        s.Firewall.validate,
+		"health":          s.Health.Validate,
+		"http proxy":      s.HTTPProxy.validate,
+		"log":             s.Log.validate,
+		"public ip check": s.PublicIP.validate,
+		"shadowsocks":     s.Shadowsocks.validate,
+		"system":          s.System.validate,
+		"updater":         s.Updater.Validate,
+		"version":         s.Version.validate,
+		"VPN": func() error {
+			return s.VPN.validate(allServers)
+		},
+	}
+
+	for name, validation := range nameToValidation {
+		err = validation()
+		if err != nil {
+			return fmt.Errorf("failed validating %s settings: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+func (s *Settings) copy() (copied Settings) {
+	return Settings{
+		ControlServer: s.ControlServer.copy(),
+		DNS:           s.DNS.Copy(),
+		Firewall:      s.Firewall.copy(),
+		Health:        s.Health.copy(),
+		HTTPProxy:     s.HTTPProxy.copy(),
+		Log:           s.Log.copy(),
+		PublicIP:      s.PublicIP.copy(),
+		Shadowsocks:   s.Shadowsocks.copy(),
+		System:        s.System.copy(),
+		Updater:       s.Updater.copy(),
+		Version:       s.Version.copy(),
+		VPN:           s.VPN.copy(),
+	}
+}
+
+func (s *Settings) MergeWith(other Settings) {
+	s.ControlServer.mergeWith(other.ControlServer)
+	s.DNS.mergeWith(other.DNS)
+	s.Firewall.mergeWith(other.Firewall)
+	s.Health.MergeWith(other.Health)
+	s.HTTPProxy.mergeWith(other.HTTPProxy)
+	s.Log.mergeWith(other.Log)
+	s.PublicIP.mergeWith(other.PublicIP)
+	s.Shadowsocks.mergeWith(other.Shadowsocks)
+	s.System.mergeWith(other.System)
+	s.Updater.mergeWith(other.Updater)
+	s.Version.mergeWith(other.Version)
+	s.VPN.mergeWith(other.VPN)
+}
+
+func (s *Settings) OverrideWith(other Settings,
+	allServers models.AllServers) (err error) {
+	patchedSettings := s.copy()
+	patchedSettings.ControlServer.overrideWith(other.ControlServer)
+	patchedSettings.DNS.overrideWith(other.DNS)
+	patchedSettings.Firewall.overrideWith(other.Firewall)
+	patchedSettings.Health.OverrideWith(other.Health)
+	patchedSettings.HTTPProxy.overrideWith(other.HTTPProxy)
+	patchedSettings.Log.overrideWith(other.Log)
+	patchedSettings.PublicIP.overrideWith(other.PublicIP)
+	patchedSettings.Shadowsocks.overrideWith(other.Shadowsocks)
+	patchedSettings.System.overrideWith(other.System)
+	patchedSettings.Updater.overrideWith(other.Updater)
+	patchedSettings.Version.overrideWith(other.Version)
+	patchedSettings.VPN.overrideWith(other.VPN)
+	err = patchedSettings.Validate(allServers)
+	if err != nil {
+		return err
+	}
+	*s = patchedSettings
+	return nil
+}
+
+func (s *Settings) SetDefaults() {
+	s.ControlServer.setDefaults()
+	s.DNS.setDefaults()
+	s.Firewall.setDefaults()
+	s.Health.SetDefaults()
+	s.HTTPProxy.setDefaults()
+	s.Log.setDefaults()
+	s.PublicIP.setDefaults()
+	s.Shadowsocks.setDefaults()
+	s.System.setDefaults()
+	s.Updater.SetDefaults()
+	s.Version.setDefaults()
+	s.VPN.setDefaults()
+}
+
+func (s Settings) String() string {
+	return s.toLinesNode().String()
+}
+
+func (s Settings) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Settings summary:")
+
+	node.AppendNode(s.VPN.toLinesNode())
+	node.AppendNode(s.DNS.toLinesNode())
+	node.AppendNode(s.Firewall.toLinesNode())
+	node.AppendNode(s.Log.toLinesNode())
+	node.AppendNode(s.Health.toLinesNode())
+	node.AppendNode(s.Shadowsocks.toLinesNode())
+	node.AppendNode(s.HTTPProxy.toLinesNode())
+	node.AppendNode(s.ControlServer.toLinesNode())
+	node.AppendNode(s.System.toLinesNode())
+	node.AppendNode(s.PublicIP.toLinesNode())
+	node.AppendNode(s.Updater.toLinesNode())
+	node.AppendNode(s.Version.toLinesNode())
+
+	return node
+}

internal/configuration/settings/settings_test.go

@@ -0,0 +1,101 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Settings_String(t *testing.T) {
+	t.Parallel()
+
+	withDefaults := func(s Settings) Settings {
+		s.SetDefaults()
+		return s
+	}
+
+	testCases := map[string]struct {
+		settings Settings
+		s        string
+	}{
+		"default settings": {
+			settings: withDefaults(Settings{}),
+			s: `Settings summary:
+├── VPN settings:
+|   ├── VPN provider settings:
+|   |   ├── Name: private internet access
+|   |   └── Server selection settings:
+|   |       ├── VPN type: openvpn
+|   |       └── OpenVPN server selection settings:
+|   |           ├── Protocol: UDP
+|   |           └── Private Internet Access encryption preset: strong
+|   └── OpenVPN settings:
+|       ├── OpenVPN version: 2.5
+|       ├── User: [not set]
+|       ├── Password: [not set]
+|       ├── Private Internet Access encryption preset: strong
+|       ├── Tunnel IPv6: no
+|       ├── Network interface: tun0
+|       ├── Run OpenVPN as: root
+|       └── Verbosity level: 1
+├── DNS settings:
+|   ├── DNS server address to use: 127.0.0.1
+|   ├── Keep existing nameserver(s): no
+|   └── DNS over TLS settings:
+|       ├── Enabled: yes
+|       ├── Update period: every 24h0m0s
+|       ├── Unbound settings:
+|       |   ├── Authoritative servers:
+|       |   |   └── Cloudflare
+|       |   ├── Caching: yes
+|       |   ├── IPv6: no
+|       |   ├── Verbosity level: 1
+|       |   ├── Verbosity details level: 0
+|       |   ├── Validation log level: 0
+|       |   ├── System user: root
+|       |   └── Allowed networks:
+|       |       ├── 0.0.0.0/0
+|       |       └── ::/0
+|       └── DNS filtering settings:
+|           ├── Block malicious: yes
+|           ├── Block ads: no
+|           └── Block surveillance: yes
+├── Firewall settings:
+|   └── Enabled: yes
+├── Log settings:
+|   └── Log level: INFO
+├── Health settings:
+|   ├── Server listening address: 127.0.0.1:9999
+|   ├── Target address: github.com:443
+|   └── VPN wait durations:
+|       ├── Initial duration: 6s
+|       └── Additional duration: 5s
+├── Shadowsocks server settings:
+|   └── Enabled: no
+├── HTTP proxy settings:
+|   └── Enabled: no
+├── Control server settings:
+|   ├── Listening port: 8000
+|   └── Logging: yes
+├── OS Alpine settings:
+|   ├── Process UID: 1000
+|   └── Process GID: 1000
+├── Public IP settings:
+|   ├── Fetching: every 12h0m0s
+|   └── IP file path: /tmp/gluetun/ip
+└── Version settings:
+    └── Enabled: yes`,
+		},
+	}
+
+	for name, testCase := range testCases {
+		testCase := testCase
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			s := testCase.settings.String()
+
+			assert.Equal(t, testCase.s, s)
+		})
+	}
+}

internal/configuration/settings/shadowsocks.go

@@ -0,0 +1,68 @@
+package settings
+
+import (
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+	"github.com/qdm12/ss-server/pkg/tcpudp"
+)
+
+// Shadowsocks contains settings to configure the Shadowsocks server.
+type Shadowsocks struct {
+	// Enabled is true if the server should be running.
+	// It defaults to false, and cannot be nil in the internal state.
+	Enabled *bool
+	// Settings are settings for the TCP+UDP server.
+	tcpudp.Settings
+}
+
+func (s Shadowsocks) validate() (err error) {
+	return s.Settings.Validate()
+}
+
+func (s *Shadowsocks) copy() (copied Shadowsocks) {
+	return Shadowsocks{
+		Enabled:  helpers.CopyBoolPtr(s.Enabled),
+		Settings: s.Settings.Copy(),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (s *Shadowsocks) mergeWith(other Shadowsocks) {
+	s.Enabled = helpers.MergeWithBool(s.Enabled, other.Enabled)
+	s.Settings.MergeWith(other.Settings)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (s *Shadowsocks) overrideWith(other Shadowsocks) {
+	s.Enabled = helpers.OverrideWithBool(s.Enabled, other.Enabled)
+	s.Settings.OverrideWith(other.Settings)
+}
+
+func (s *Shadowsocks) setDefaults() {
+	s.Enabled = helpers.DefaultBool(s.Enabled, false)
+	s.Settings.SetDefaults()
+}
+
+func (s Shadowsocks) String() string {
+	return s.toLinesNode().String()
+}
+
+func (s Shadowsocks) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Shadowsocks server settings:")
+
+	node.Appendf("Enabled: %s", helpers.BoolPtrToYesNo(s.Enabled))
+	if !*s.Enabled {
+		return node
+	}
+
+	// TODO have ToLinesNode in qdm12/ss-server
+	node.Appendf("Listening address: %s", s.Address)
+	node.Appendf("Cipher: %s", s.CipherName)
+	node.Appendf("Password: %s", helpers.ObfuscatePassword(*s.Password))
+	node.Appendf("Log addresses: %s", helpers.BoolPtrToYesNo(s.LogAddresses))
+
+	return node
+}

internal/configuration/settings/surfshark_retro.go

@@ -0,0 +1,56 @@
+package settings
+
+import (
+	"strings"
+
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gluetun/internal/models"
+)
+
+func surfsharkRetroRegion(selection ServerSelection) (
+	updatedSelection ServerSelection) {
+	locationData := constants.SurfsharkLocationData()
+
+	retroToLocation := make(map[string]models.SurfsharkLocationData, len(locationData))
+	for _, data := range locationData {
+		if data.RetroLoc == "" {
+			continue
+		}
+		retroToLocation[strings.ToLower(data.RetroLoc)] = data
+	}
+
+	for i, region := range selection.Regions {
+		location, ok := retroToLocation[region]
+		if !ok {
+			continue
+		}
+		selection.Regions[i] = strings.ToLower(location.Region)
+		selection.Countries = append(selection.Countries, strings.ToLower(location.Country))
+		selection.Cities = append(selection.Cities, strings.ToLower(location.City)) // even empty string
+		selection.Hostnames = append(selection.Hostnames, location.Hostname)
+	}
+
+	selection.Regions = dedupSlice(selection.Regions)
+	selection.Countries = dedupSlice(selection.Countries)
+	selection.Cities = dedupSlice(selection.Cities)
+	selection.Hostnames = dedupSlice(selection.Hostnames)
+
+	return selection
+}
+
+func dedupSlice(slice []string) (deduped []string) {
+	if slice == nil {
+		return nil
+	}
+
+	deduped = make([]string, 0, len(slice))
+	seen := make(map[string]struct{}, len(slice))
+	for _, s := range slice {
+		if _, ok := seen[s]; !ok {
+			seen[s] = struct{}{}
+			deduped = append(deduped, s)
+		}
+	}
+
+	return deduped
+}

internal/configuration/settings/system.go

@@ -0,0 +1,61 @@
+package settings
+
+import (
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// System contains settings to configure system related elements.
+type System struct {
+	PUID     *uint16
+	PGID     *uint16
+	Timezone string
+}
+
+// Validate validates System settings.
+func (s System) validate() (err error) {
+	return nil
+}
+
+func (s *System) copy() (copied System) {
+	return System{
+		PUID:     helpers.CopyUint16Ptr(s.PUID),
+		PGID:     helpers.CopyUint16Ptr(s.PGID),
+		Timezone: s.Timezone,
+	}
+}
+
+func (s *System) mergeWith(other System) {
+	s.PUID = helpers.MergeWithUint16(s.PUID, other.PUID)
+	s.PGID = helpers.MergeWithUint16(s.PGID, other.PGID)
+	s.Timezone = helpers.MergeWithString(s.Timezone, other.Timezone)
+}
+
+func (s *System) overrideWith(other System) {
+	s.PUID = helpers.OverrideWithUint16(s.PUID, other.PUID)
+	s.PGID = helpers.OverrideWithUint16(s.PGID, other.PGID)
+	s.Timezone = helpers.OverrideWithString(s.Timezone, other.Timezone)
+}
+
+func (s *System) setDefaults() {
+	const defaultID = 1000
+	s.PUID = helpers.DefaultUint16(s.PUID, defaultID)
+	s.PGID = helpers.DefaultUint16(s.PGID, defaultID)
+}
+
+func (s System) String() string {
+	return s.toLinesNode().String()
+}
+
+func (s System) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("OS Alpine settings:")
+
+	node.Appendf("Process UID: %d", *s.PUID)
+	node.Appendf("Process GID: %d", *s.PGID)
+
+	if s.Timezone != "" {
+		node.Appendf("Timezone: %s", s.Timezone)
+	}
+
+	return node
+}

internal/configuration/settings/unbound.go

@@ -0,0 +1,193 @@
+package settings
+
+import (
+	"errors"
+	"fmt"
+	"net"
+
+	"github.com/qdm12/dns/pkg/provider"
+	"github.com/qdm12/dns/pkg/unbound"
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+	"inet.af/netaddr"
+)
+
+// Unbound is settings for the Unbound program.
+type Unbound struct {
+	Providers             []string
+	Caching               *bool
+	IPv6                  *bool
+	VerbosityLevel        *uint8
+	VerbosityDetailsLevel *uint8
+	ValidationLogLevel    *uint8
+	Username              string
+	Allowed               []netaddr.IPPrefix
+}
+
+func (u *Unbound) setDefaults() {
+	if len(u.Providers) == 0 {
+		u.Providers = []string{
+			provider.Cloudflare().String(),
+		}
+	}
+
+	u.Caching = helpers.DefaultBool(u.Caching, true)
+	u.IPv6 = helpers.DefaultBool(u.IPv6, false)
+
+	const defaultVerbosityLevel = 1
+	u.VerbosityLevel = helpers.DefaultUint8(u.VerbosityLevel, defaultVerbosityLevel)
+
+	const defaultVerbosityDetailsLevel = 0
+	u.VerbosityDetailsLevel = helpers.DefaultUint8(u.VerbosityDetailsLevel, defaultVerbosityDetailsLevel)
+
+	const defaultValidationLogLevel = 0
+	u.ValidationLogLevel = helpers.DefaultUint8(u.ValidationLogLevel, defaultValidationLogLevel)
+
+	if u.Allowed == nil {
+		u.Allowed = []netaddr.IPPrefix{
+			netaddr.IPPrefixFrom(netaddr.IPv4(0, 0, 0, 0), 0),
+			netaddr.IPPrefixFrom(netaddr.IPv6Raw([16]byte{}), 0),
+		}
+	}
+
+	u.Username = helpers.DefaultString(u.Username, "root")
+}
+
+var (
+	ErrUnboundVerbosityLevelNotValid        = errors.New("Unbound verbosity level is not valid")
+	ErrUnboundVerbosityDetailsLevelNotValid = errors.New("Unbound verbosity details level is not valid")
+	ErrUnboundValidationLogLevelNotValid    = errors.New("Unbound validation log level is not valid")
+)
+
+func (u Unbound) validate() (err error) {
+	for _, s := range u.Providers {
+		_, err := provider.Parse(s)
+		if err != nil {
+			return err
+		}
+	}
+
+	const maxVerbosityLevel = 5
+	if *u.VerbosityLevel > maxVerbosityLevel {
+		return fmt.Errorf("%w: %d must be between 0 and %d",
+			ErrUnboundVerbosityLevelNotValid,
+			*u.VerbosityLevel,
+			maxVerbosityLevel)
+	}
+
+	const maxVerbosityDetailsLevel = 4
+	if *u.VerbosityDetailsLevel > maxVerbosityDetailsLevel {
+		return fmt.Errorf("%w: %d must be between 0 and %d",
+			ErrUnboundVerbosityDetailsLevelNotValid,
+			*u.VerbosityDetailsLevel,
+			maxVerbosityDetailsLevel)
+	}
+
+	const maxValidationLogLevel = 2
+	if *u.ValidationLogLevel > maxValidationLogLevel {
+		return fmt.Errorf("%w: %d must be between 0 and %d",
+			ErrUnboundValidationLogLevelNotValid,
+			*u.ValidationLogLevel, maxValidationLogLevel)
+	}
+
+	return nil
+}
+
+func (u Unbound) copy() (copied Unbound) {
+	return Unbound{
+		Providers:             helpers.CopyStringSlice(u.Providers),
+		Caching:               helpers.CopyBoolPtr(u.Caching),
+		IPv6:                  helpers.CopyBoolPtr(u.IPv6),
+		VerbosityLevel:        helpers.CopyUint8Ptr(u.VerbosityLevel),
+		VerbosityDetailsLevel: helpers.CopyUint8Ptr(u.VerbosityDetailsLevel),
+		ValidationLogLevel:    helpers.CopyUint8Ptr(u.ValidationLogLevel),
+		Username:              u.Username,
+		Allowed:               helpers.CopyIPPrefixSlice(u.Allowed),
+	}
+}
+
+func (u *Unbound) mergeWith(other Unbound) {
+	u.Providers = helpers.MergeStringSlices(u.Providers, other.Providers)
+	u.Caching = helpers.MergeWithBool(u.Caching, other.Caching)
+	u.IPv6 = helpers.MergeWithBool(u.IPv6, other.IPv6)
+	u.VerbosityLevel = helpers.MergeWithUint8(u.VerbosityLevel, other.VerbosityLevel)
+	u.VerbosityDetailsLevel = helpers.MergeWithUint8(u.VerbosityDetailsLevel, other.VerbosityDetailsLevel)
+	u.ValidationLogLevel = helpers.MergeWithUint8(u.ValidationLogLevel, other.ValidationLogLevel)
+	u.Username = helpers.MergeWithString(u.Username, other.Username)
+	u.Allowed = helpers.MergeIPPrefixesSlices(u.Allowed, other.Allowed)
+}
+
+func (u *Unbound) overrideWith(other Unbound) {
+	u.Providers = helpers.OverrideWithStringSlice(u.Providers, other.Providers)
+	u.Caching = helpers.OverrideWithBool(u.Caching, other.Caching)
+	u.IPv6 = helpers.OverrideWithBool(u.IPv6, other.IPv6)
+	u.VerbosityLevel = helpers.OverrideWithUint8(u.VerbosityLevel, other.VerbosityLevel)
+	u.VerbosityDetailsLevel = helpers.OverrideWithUint8(u.VerbosityDetailsLevel, other.VerbosityDetailsLevel)
+	u.ValidationLogLevel = helpers.OverrideWithUint8(u.ValidationLogLevel, other.ValidationLogLevel)
+	u.Username = helpers.OverrideWithString(u.Username, other.Username)
+	u.Allowed = helpers.OverrideWithIPPrefixesSlice(u.Allowed, other.Allowed)
+}
+
+func (u Unbound) ToUnboundFormat() (settings unbound.Settings, err error) {
+	providers := make([]provider.Provider, len(u.Providers))
+	for i := range providers {
+		providers[i], err = provider.Parse(u.Providers[i])
+		if err != nil {
+			return settings, err
+		}
+	}
+
+	const port = 53
+
+	return unbound.Settings{
+		ListeningPort:         port,
+		IPv4:                  true,
+		Providers:             providers,
+		Caching:               *u.Caching,
+		IPv6:                  *u.IPv6,
+		VerbosityLevel:        *u.VerbosityLevel,
+		VerbosityDetailsLevel: *u.VerbosityDetailsLevel,
+		ValidationLogLevel:    *u.ValidationLogLevel,
+		AccessControl: unbound.AccessControlSettings{
+			Allowed: u.Allowed,
+		},
+		Username: u.Username,
+	}, nil
+}
+
+func (u Unbound) GetFirstPlaintextIPv4() (ipv4 net.IP, err error) {
+	s := u.Providers[0]
+	provider, err := provider.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.DNS().IPv4[0], nil
+}
+
+func (u Unbound) String() string {
+	return u.toLinesNode().String()
+}
+
+func (u Unbound) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Unbound settings:")
+
+	authServers := node.Appendf("Authoritative servers:")
+	for _, provider := range u.Providers {
+		authServers.Appendf(provider)
+	}
+
+	node.Appendf("Caching: %s", helpers.BoolPtrToYesNo(u.Caching))
+	node.Appendf("IPv6: %s", helpers.BoolPtrToYesNo(u.IPv6))
+	node.Appendf("Verbosity level: %d", *u.VerbosityLevel)
+	node.Appendf("Verbosity details level: %d", *u.VerbosityDetailsLevel)
+	node.Appendf("Validation log level: %d", *u.ValidationLogLevel)
+	node.Appendf("System user: %s", u.Username)
+
+	allowedNetworks := node.Appendf("Allowed networks:")
+	for _, network := range u.Allowed {
+		allowedNetworks.Appendf(network.String())
+	}
+
+	return node
+}

internal/configuration/settings/unbound_test.go

@@ -0,0 +1,43 @@
+package settings
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"inet.af/netaddr"
+)
+
+func Test_Unbound_JSON(t *testing.T) {
+	t.Parallel()
+
+	settings := Unbound{
+		Providers:             []string{"cloudflare"},
+		Caching:               boolPtr(true),
+		IPv6:                  boolPtr(false),
+		VerbosityLevel:        uint8Ptr(1),
+		VerbosityDetailsLevel: nil,
+		ValidationLogLevel:    uint8Ptr(0),
+		Username:              "user",
+		Allowed: []netaddr.IPPrefix{
+			netaddr.IPPrefixFrom(netaddr.IPv4(0, 0, 0, 0), 0),
+			netaddr.IPPrefixFrom(netaddr.IPv6Raw([16]byte{}), 0),
+		},
+	}
+
+	b, err := json.Marshal(settings)
+	require.NoError(t, err)
+
+	const expected = `{"Providers":["cloudflare"],"Caching":true,"IPv6":false,` +
+		`"VerbosityLevel":1,"VerbosityDetailsLevel":null,"ValidationLogLevel":0,` +
+		`"Username":"user","Allowed":["0.0.0.0/0","::/0"]}`
+
+	assert.Equal(t, expected, string(b))
+
+	var resultSettings Unbound
+	err = json.Unmarshal(b, &resultSettings)
+	require.NoError(t, err)
+
+	assert.Equal(t, settings, resultSettings)
+}

internal/configuration/settings/updater.go

@@ -0,0 +1,117 @@
+package settings
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gotree"
+)
+
+// Updater contains settings to configure the VPN
+// server information updater.
+type Updater struct {
+	// Period is the period for which the updater
+	// should run. It can be set to 0 to disable the
+	// updater. It cannot be nil in the internal state.
+	// TODO change to value and add Enabled field.
+	Period *time.Duration
+	// DNSAddress is the DNS server address to use
+	// to resolve VPN server hostnames to IP addresses.
+	// It cannot be nil in the internal state.
+	DNSAddress net.IP
+	// Providers is the list of VPN service providers
+	// to update server information for.
+	Providers []string
+	// CLI is to precise the updater is running in CLI
+	// mode. This is set automatically and cannot be set
+	// by settings sources. It cannot be nil in the
+	// internal state.
+	CLI *bool
+}
+
+func (u Updater) Validate() (err error) {
+	const minPeriod = time.Minute
+	if *u.Period > 0 && *u.Period < minPeriod {
+		return fmt.Errorf("%w: %d must be larger than %s",
+			ErrUpdaterPeriodTooSmall, *u.Period, minPeriod)
+	}
+
+	for i, provider := range u.Providers {
+		valid := false
+		for _, validProvider := range constants.AllProviders() {
+			if validProvider == constants.Custom {
+				continue
+			}
+
+			if provider == validProvider {
+				valid = true
+				break
+			}
+		}
+		if !valid {
+			return fmt.Errorf("%w: %s at index %d",
+				ErrVPNProviderNameNotValid, provider, i)
+		}
+	}
+
+	return nil
+}
+
+func (u *Updater) copy() (copied Updater) {
+	return Updater{
+		Period:     helpers.CopyDurationPtr(u.Period),
+		DNSAddress: helpers.CopyIP(u.DNSAddress),
+		Providers:  helpers.CopyStringSlice(u.Providers),
+		CLI:        u.CLI,
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (u *Updater) mergeWith(other Updater) {
+	u.Period = helpers.MergeWithDuration(u.Period, other.Period)
+	u.DNSAddress = helpers.MergeWithIP(u.DNSAddress, other.DNSAddress)
+	u.Providers = helpers.MergeStringSlices(u.Providers, other.Providers)
+	u.CLI = helpers.MergeWithBool(u.CLI, other.CLI)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (u *Updater) overrideWith(other Updater) {
+	u.Period = helpers.OverrideWithDuration(u.Period, other.Period)
+	u.DNSAddress = helpers.OverrideWithIP(u.DNSAddress, other.DNSAddress)
+	u.Providers = helpers.OverrideWithStringSlice(u.Providers, other.Providers)
+	u.CLI = helpers.MergeWithBool(u.CLI, other.CLI)
+}
+
+func (u *Updater) SetDefaults() {
+	u.Period = helpers.DefaultDuration(u.Period, 0)
+	u.DNSAddress = helpers.DefaultIP(u.DNSAddress, net.IPv4(1, 1, 1, 1))
+	u.CLI = helpers.DefaultBool(u.CLI, false)
+}
+
+func (u Updater) String() string {
+	return u.toLinesNode().String()
+}
+
+func (u Updater) toLinesNode() (node *gotree.Node) {
+	if *u.Period == 0 {
+		return nil
+	}
+
+	node = gotree.New("Server data updater settings:")
+	node.Appendf("Update period: %s", *u.Period)
+	node.Appendf("DNS address: %s", u.DNSAddress)
+	node.Appendf("Providers to update: %s", strings.Join(u.Providers, ", "))
+
+	if *u.CLI {
+		node.Appendf("CLI mode: enabled")
+	}
+
+	return node
+}

internal/configuration/settings/version.go

@@ -0,0 +1,53 @@
+package settings
+
+import (
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gotree"
+)
+
+// Version contains settings to configure the version
+// information fetcher.
+type Version struct {
+	// Enabled is true if the version information should
+	// be fetched from Github.
+	Enabled *bool
+}
+
+func (v Version) validate() (err error) {
+	return nil
+}
+
+func (v *Version) copy() (copied Version) {
+	return Version{
+		Enabled: helpers.CopyBoolPtr(v.Enabled),
+	}
+}
+
+// mergeWith merges the other settings into any
+// unset field of the receiver settings object.
+func (v *Version) mergeWith(other Version) {
+	v.Enabled = helpers.MergeWithBool(v.Enabled, other.Enabled)
+}
+
+// overrideWith overrides fields of the receiver
+// settings object with any field set in the other
+// settings.
+func (v *Version) overrideWith(other Version) {
+	v.Enabled = helpers.OverrideWithBool(v.Enabled, other.Enabled)
+}
+
+func (v *Version) setDefaults() {
+	v.Enabled = helpers.DefaultBool(v.Enabled, true)
+}
+
+func (v Version) String() string {
+	return v.toLinesNode().String()
+}
+
+func (v Version) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Version settings:")
+
+	node.Appendf("Enabled: %s", helpers.BoolPtrToYesNo(v.Enabled))
+
+	return node
+}

internal/configuration/settings/vpn.go

@@ -0,0 +1,98 @@
+package settings
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gluetun/internal/models"
+	"github.com/qdm12/gotree"
+)
+
+type VPN struct {
+	// Type is the VPN type and can only be
+	// 'openvpn' or 'wireguard'. It cannot be the
+	// empty string in the internal state.
+	Type      string
+	Provider  Provider
+	OpenVPN   OpenVPN
+	Wireguard Wireguard
+}
+
+// TODO v4 remove pointer for receiver (because of Surfshark).
+func (v *VPN) validate(allServers models.AllServers) (err error) {
+	// Validate Type
+	validVPNTypes := []string{constants.OpenVPN, constants.Wireguard}
+	if !helpers.IsOneOf(v.Type, validVPNTypes...) {
+		return fmt.Errorf("%w: %q and can only be one of %s",
+			ErrVPNTypeNotValid, v.Type, strings.Join(validVPNTypes, ", "))
+	}
+
+	err = v.Provider.validate(v.Type, allServers)
+	if err != nil {
+		return fmt.Errorf("provider settings validation failed: %w", err)
+	}
+
+	if v.Type == constants.OpenVPN {
+		err := v.OpenVPN.validate(*v.Provider.Name)
+		if err != nil {
+			return fmt.Errorf("OpenVPN settings validation failed: %w", err)
+		}
+	} else {
+		err := v.Wireguard.validate(*v.Provider.Name)
+		if err != nil {
+			return fmt.Errorf("Wireguard settings validation failed: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (v *VPN) copy() (copied VPN) {
+	return VPN{
+		Type:      v.Type,
+		Provider:  v.Provider.copy(),
+		OpenVPN:   v.OpenVPN.copy(),
+		Wireguard: v.Wireguard.copy(),
+	}
+}
+
+func (v *VPN) mergeWith(other VPN) {
+	v.Type = helpers.MergeWithString(v.Type, other.Type)
+	v.Provider.mergeWith(other.Provider)
+	v.OpenVPN.mergeWith(other.OpenVPN)
+	v.Wireguard.mergeWith(other.Wireguard)
+}
+
+func (v *VPN) overrideWith(other VPN) {
+	v.Type = helpers.OverrideWithString(v.Type, other.Type)
+	v.Provider.overrideWith(other.Provider)
+	v.OpenVPN.overrideWith(other.OpenVPN)
+	v.Wireguard.overrideWith(other.Wireguard)
+}
+
+func (v *VPN) setDefaults() {
+	v.Type = helpers.DefaultString(v.Type, constants.OpenVPN)
+	v.Provider.setDefaults()
+	v.OpenVPN.setDefaults(*v.Provider.Name)
+	v.Wireguard.setDefaults()
+}
+
+func (v VPN) String() string {
+	return v.toLinesNode().String()
+}
+
+func (v VPN) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("VPN settings:")
+
+	node.AppendNode(v.Provider.toLinesNode())
+
+	if v.Type == constants.OpenVPN {
+		node.AppendNode(v.OpenVPN.toLinesNode())
+	} else {
+		node.AppendNode(v.Wireguard.toLinesNode())
+	}
+
+	return node
+}

internal/configuration/settings/wireguard.go

@@ -0,0 +1,138 @@
+package settings
+
+import (
+	"fmt"
+	"net"
+	"regexp"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gotree"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// Wireguard contains settings to configure the Wireguard client.
+type Wireguard struct {
+	// PrivateKey is the Wireguard client peer private key.
+	// It cannot be nil in the internal state.
+	PrivateKey *string
+	// PreSharedKey is the Wireguard pre-shared key.
+	// It can be the empty string to indicate there
+	// is no pre-shared key.
+	// It cannot be nil in the internal state.
+	PreSharedKey *string
+	// Addresses are the Wireguard interface addresses.
+	Addresses []net.IPNet
+	// Interface is the name of the Wireguard interface
+	// to create. It cannot be the empty string in the
+	// internal state.
+	Interface string
+}
+
+var regexpInterfaceName = regexp.MustCompile(`^[a-zA-Z0-9_]+$`)
+
+// Validate validates Wireguard settings.
+// It should only be ran if the VPN type chosen is Wireguard.
+func (w Wireguard) validate(vpnProvider string) (err error) {
+	if !helpers.IsOneOf(vpnProvider,
+		constants.Custom,
+		constants.Ivpn,
+		constants.Mullvad,
+		constants.Windscribe,
+	) {
+		// do not validate for VPN provider not supporting Wireguard
+		return nil
+	}
+
+	// Validate PrivateKey
+	if *w.PrivateKey == "" {
+		return ErrWireguardPrivateKeyNotSet
+	}
+	_, err = wgtypes.ParseKey(*w.PrivateKey)
+	if err != nil {
+		return fmt.Errorf("%w: %s", ErrWireguardPrivateKeyNotValid, err)
+	}
+
+	// Validate PreSharedKey
+	if *w.PreSharedKey != "" { // Note: this is optional
+		_, err = wgtypes.ParseKey(*w.PreSharedKey)
+		if err != nil {
+			return fmt.Errorf("%w: %s", ErrWireguardPreSharedKeyNotValid, err)
+		}
+	}
+
+	// Validate Addresses
+	if len(w.Addresses) == 0 {
+		return ErrWireguardInterfaceAddressNotSet
+	}
+	for i, ipNet := range w.Addresses {
+		if ipNet.IP == nil || ipNet.Mask == nil {
+			return fmt.Errorf("%w: for address at index %d: %s",
+				ErrWireguardInterfaceAddressNotSet, i, ipNet.String())
+		}
+	}
+
+	// Validate interface
+	if !regexpInterfaceName.MatchString(w.Interface) {
+		return fmt.Errorf("%w: '%s' does not match regex '%s'",
+			ErrWireguardInterfaceNotValid, w.Interface, regexpInterfaceName)
+	}
+
+	return nil
+}
+
+func (w *Wireguard) copy() (copied Wireguard) {
+	return Wireguard{
+		PrivateKey:   helpers.CopyStringPtr(w.PrivateKey),
+		PreSharedKey: helpers.CopyStringPtr(w.PreSharedKey),
+		Addresses:    helpers.CopyIPNetSlice(w.Addresses),
+		Interface:    w.Interface,
+	}
+}
+
+func (w *Wireguard) mergeWith(other Wireguard) {
+	w.PrivateKey = helpers.MergeWithStringPtr(w.PrivateKey, other.PrivateKey)
+	w.PreSharedKey = helpers.MergeWithStringPtr(w.PreSharedKey, other.PreSharedKey)
+	w.Addresses = helpers.MergeIPNetsSlices(w.Addresses, other.Addresses)
+	w.Interface = helpers.MergeWithString(w.Interface, other.Interface)
+}
+
+func (w *Wireguard) overrideWith(other Wireguard) {
+	w.PrivateKey = helpers.OverrideWithStringPtr(w.PrivateKey, other.PrivateKey)
+	w.PreSharedKey = helpers.OverrideWithStringPtr(w.PreSharedKey, other.PreSharedKey)
+	w.Addresses = helpers.OverrideWithIPNetsSlice(w.Addresses, other.Addresses)
+	w.Interface = helpers.OverrideWithString(w.Interface, other.Interface)
+}
+
+func (w *Wireguard) setDefaults() {
+	w.PrivateKey = helpers.DefaultStringPtr(w.PrivateKey, "")
+	w.PreSharedKey = helpers.DefaultStringPtr(w.PreSharedKey, "")
+	w.Interface = helpers.DefaultString(w.Interface, "wg0")
+}
+
+func (w Wireguard) String() string {
+	return w.toLinesNode().String()
+}
+
+func (w Wireguard) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Wireguard settings:")
+
+	if *w.PrivateKey != "" {
+		s := helpers.ObfuscateWireguardKey(*w.PrivateKey)
+		node.Appendf("Private key: %s", s)
+	}
+
+	if *w.PreSharedKey != "" {
+		s := helpers.ObfuscateWireguardKey(*w.PreSharedKey)
+		node.Appendf("Pre-shared key: %s", s)
+	}
+
+	addressesNode := node.Appendf("Interface addresses:")
+	for _, address := range w.Addresses {
+		addressesNode.Appendf(address.String())
+	}
+
+	node.Appendf("Network interface: %s", w.Interface)
+
+	return node
+}

internal/configuration/settings/wireguardselection.go

@@ -0,0 +1,144 @@
+package settings
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings/helpers"
+	"github.com/qdm12/gluetun/internal/constants"
+	"github.com/qdm12/gotree"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+type WireguardSelection struct {
+	// EndpointIP is the server endpoint IP address.
+	// It is only used with VPN providers generating Wireguard
+	// configurations specific to each server and user.
+	// To indicate it should not be used, it should be set
+	// to the empty net.IP{} slice. It can never be nil
+	// in the internal state.
+	EndpointIP net.IP
+	// EndpointPort is a the server port to use for the VPN server.
+	// It is optional for VPN providers IVPN, Mullvad
+	// and Windscribe, and compulsory for the others.
+	// When optional, it can be set to 0 to indicate not use
+	// a custom endpoint port. It cannot be nil in the internal
+	// state.
+	EndpointPort *uint16
+	// PublicKey is the server public key.
+	// It is only used with VPN providers generating Wireguard
+	// configurations specific to each server and user.
+	PublicKey string
+}
+
+// Validate validates WireguardSelection settings.
+// It should only be ran if the VPN type chosen is Wireguard.
+func (w WireguardSelection) validate(vpnProvider string) (err error) {
+	// Validate EndpointIP
+	switch vpnProvider {
+	case constants.Ivpn, constants.Mullvad, constants.Windscribe: // endpoint IP addresses are baked in
+	case constants.Custom:
+		if len(w.EndpointIP) == 0 {
+			return ErrWireguardEndpointIPNotSet
+		}
+	default: // Providers not supporting Wireguard
+	}
+
+	// Validate EndpointPort
+	switch vpnProvider {
+	// EndpointPort is required
+	case constants.Custom:
+		if *w.EndpointPort == 0 {
+			return ErrWireguardEndpointPortNotSet
+		}
+	case constants.Ivpn, constants.Mullvad, constants.Windscribe:
+		// EndpointPort is optional and can be 0
+		if *w.EndpointPort == 0 {
+			break // no custom endpoint port set
+		}
+		if vpnProvider == constants.Mullvad {
+			break // no restriction on custom endpoint port value
+		}
+		var allowed []uint16
+		switch vpnProvider {
+		case constants.Ivpn:
+			allowed = []uint16{2049, 2050, 53, 30587, 41893, 48574, 58237}
+		case constants.Windscribe:
+			allowed = []uint16{53, 80, 123, 443, 1194, 65142}
+		}
+
+		if helpers.Uint16IsOneOf(*w.EndpointPort, allowed) {
+			break
+		}
+		return fmt.Errorf("%w: %d for VPN service provider %s; %s",
+			ErrWireguardEndpointPortNotAllowed, w.EndpointPort, vpnProvider,
+			helpers.PortChoicesOrString(allowed))
+	default: // Providers not supporting Wireguard
+	}
+
+	// Validate PublicKey
+	switch vpnProvider {
+	case constants.Ivpn, constants.Mullvad, constants.Windscribe: // public keys are baked in
+	case constants.Custom:
+		if w.PublicKey == "" {
+			return ErrWireguardPublicKeyNotSet
+		}
+	default: // Providers not supporting Wireguard
+	}
+	if w.PublicKey != "" {
+		_, err := wgtypes.ParseKey(w.PublicKey)
+		if err != nil {
+			return fmt.Errorf("%w: %s: %s",
+				ErrWireguardPublicKeyNotValid, w.PublicKey, err)
+		}
+	}
+
+	return nil
+}
+
+func (w *WireguardSelection) copy() (copied WireguardSelection) {
+	return WireguardSelection{
+		EndpointIP:   helpers.CopyIP(w.EndpointIP),
+		EndpointPort: helpers.CopyUint16Ptr(w.EndpointPort),
+		PublicKey:    w.PublicKey,
+	}
+}
+
+func (w *WireguardSelection) mergeWith(other WireguardSelection) {
+	w.EndpointIP = helpers.MergeWithIP(w.EndpointIP, other.EndpointIP)
+	w.EndpointPort = helpers.MergeWithUint16(w.EndpointPort, other.EndpointPort)
+	w.PublicKey = helpers.MergeWithString(w.PublicKey, other.PublicKey)
+}
+
+func (w *WireguardSelection) overrideWith(other WireguardSelection) {
+	w.EndpointIP = helpers.OverrideWithIP(w.EndpointIP, other.EndpointIP)
+	w.EndpointPort = helpers.OverrideWithUint16(w.EndpointPort, other.EndpointPort)
+	w.PublicKey = helpers.OverrideWithString(w.PublicKey, other.PublicKey)
+}
+
+func (w *WireguardSelection) setDefaults() {
+	w.EndpointIP = helpers.DefaultIP(w.EndpointIP, net.IP{})
+	w.EndpointPort = helpers.DefaultUint16(w.EndpointPort, 0)
+}
+
+func (w WireguardSelection) String() string {
+	return w.toLinesNode().String()
+}
+
+func (w WireguardSelection) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Wireguard selection settings:")
+
+	if len(w.EndpointIP) > 0 {
+		node.Appendf("Endpoint IP address: %s", w.EndpointIP)
+	}
+
+	if *w.EndpointPort != 0 {
+		node.Appendf("Endpoint port: %d", *w.EndpointPort)
+	}
+
+	if w.PublicKey != "" {
+		node.Appendf("Server public key: %s", w.PublicKey)
+	}
+
+	return node
+}