From c47cc90181d1ca8b885924a6208f2bd41a096034 Mon Sep 17 00:00:00 2001
From: Quentin McGaw <quentin.mcgaw@gmail.com>
Date: Sun, 3 May 2026 02:20:33 +0000
Subject: [PATCH] chore(ci): test protonvpn OpenVPN with port forwarding

---
 .github/workflows/ci.yml | 13 ++++++++++---
 ci/cmd/main.go           |  2 ++
 ci/internal/protonvpn.go | 23 +++++++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77eae270..b55d15fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,7 +78,7 @@ jobs:
         github.event_name == 'release' ||
         (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
       )
-    needs: [verify]
+    needs: [ verify ]
     runs-on: ubuntu-latest
     environment: secrets
     steps:
@@ -95,13 +95,20 @@ jobs:
         run: go build -C ./ci -o runner ./cmd/main.go
 
       - name: Run Gluetun container with Mullvad configuration
-        run: echo -e "${{ secrets.MULLVAD_WIREGUARD_PRIVATE_KEY }}\n${{ secrets.MULLVAD_WIREGUARD_ADDRESS }}" | ./ci/runner mullvad
+        run: echo -e "${{ secrets.MULLVAD_WIREGUARD_PRIVATE_KEY }}\n${{
+          secrets.MULLVAD_WIREGUARD_ADDRESS }}" | ./ci/runner mullvad
 
       - name: Run Gluetun container with ProtonVPN Wireguard and port forwarding
           configuration
         run: echo -e "${{ secrets.PROTONVPN_WIREGUARD_PRIVATE_KEY }}" | ./ci/runner
           protonvpn-wireguard-port-forwarding
 
+      - name: Run Gluetun container with ProtonVPN OpenVPN and port forwarding
+          configuration
+        run: echo -e "${{ secrets.PROTONVPN_OPENVPN_USER }}\n${{
+          secrets.PROTONVPN_OPENVPN_PASSWORD }}" | ./ci/runner
+          protonvpn-openvpn-port-forwarding
+
   codeql:
     runs-on: ubuntu-latest
     permissions:
@@ -127,7 +134,7 @@ jobs:
         github.event_name == 'release' ||
         (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
       )
-    needs: [verify, verify-private, codeql]
+    needs: [ verify, verify-private, codeql ]
     permissions:
       actions: read
       contents: read
diff --git a/ci/cmd/main.go b/ci/cmd/main.go
index ec7c0646..fffd4d5b 100644
--- a/ci/cmd/main.go
+++ b/ci/cmd/main.go
@@ -25,6 +25,8 @@ func main() {
 		err = internal.MullvadTest(ctx, logger)
 	case "protonvpn-wireguard-port-forwarding":
 		err = internal.ProtonVPNWireguardPortForwardingTest(ctx, logger)
+	case "protonvpn-openvpn-port-forwarding":
+		err = internal.ProtonVPNOpenVPNPortForwardingTest(ctx, logger)
 	default:
 		err = fmt.Errorf("unknown command: %s", os.Args[1])
 	}
diff --git a/ci/internal/protonvpn.go b/ci/internal/protonvpn.go
index 4e4f24c5..b22d0422 100644
--- a/ci/internal/protonvpn.go
+++ b/ci/internal/protonvpn.go
@@ -27,3 +27,26 @@ func ProtonVPNWireguardPortForwardingTest(ctx context.Context, logger Logger) er
 	const timeout = 80 * time.Second
 	return runContainerTest(ctx, env, []*regexp.Regexp{successRegexp, portForwardingRegexp}, timeout, logger)
 }
+
+func ProtonVPNOpenVPNPortForwardingTest(ctx context.Context, logger Logger) error {
+	expectedSecrets := []string{
+		"OpenVPN username",
+		"OpenVPN password",
+	}
+	secrets, err := readSecrets(ctx, expectedSecrets, logger)
+	if err != nil {
+		return fmt.Errorf("reading secrets: %w", err)
+	}
+
+	env := []string{
+		"VPN_SERVICE_PROVIDER=protonvpn",
+		"VPN_TYPE=openvpn",
+		"LOG_LEVEL=debug",
+		"SERVER_COUNTRIES=United States",
+		"OPENVPN_USER=" + secrets[0],
+		"OPENVPN_PASSWORD=" + secrets[1],
+		"VPN_PORT_FORWARDING=on",
+	}
+	const timeout = 80 * time.Second
+	return runContainerTest(ctx, env, []*regexp.Regexp{successRegexp, portForwardingRegexp}, timeout, logger)
+}