Git initial commit

roles/vpn/tasks/clients.yml

@@ -0,0 +1,57 @@
+---
+- name: install client ovpn configs
+  template:
+    src: etc/openvpn/client/client.ovpn.j2
+    dest: "{{ vpn_home }}/client/{{ client }}.ovpn"
+    mode: 0600
+    owner: root
+    group: vpn
+  loop: "{{ vpn_clients_active }}"
+  loop_control:
+    loop_var: client
+    label: "{{ client }}"
+
+- name: find abstent clients ovpn config
+  find:
+    paths: "{{ vpn_home }}/client/"
+    pattern: "{{ client }}.*"
+  loop: "{{ vpn_clients_passive }}"
+  loop_control:
+    loop_var: client
+    label: "{{ client }}"
+  register: absent_clients
+
+- name: remove absent clients ovpn config
+  file:
+    state: absent
+    path: "{{ client }}"
+  loop: "{{ absent_clients.results | json_query('[*].files[*].path') | flatten }}"
+  loop_control:
+    loop_var: client
+    label: "{{ client | basename }}"
+  when: absent_clients.results | length > 0
+
+- name: setup OpenVPN config folder for each vpn client
+  file:
+    state: directory
+    path: "/home/{{ user }}/.openvpn"
+    mode: 0700
+    owner: "{{ user }}"
+    group: "{{ user }}"
+  loop: "{{ vpn_clients_active | map('regex_replace','\\.[^\\.]+$','') | list | unique }}"
+  loop_control:
+    loop_var: user
+    label: "{{ user }}"
+
+- name: rollout .ovpn single-file config for active clients
+  copy:
+    src: "{{ vpn_home }}/client/{{ client }}.ovpn"
+    dest: "/home/{{ client.split('.')[0] }}/.openvpn/"
+    mode: 0400
+    owner: "{{ client.split('.')[0] }}"
+    group: "{{ client.split('.')[0] }}"
+  loop: "{{ vpn_clients_active }}"
+  loop_control:
+    loop_var: client
+    label: "{{ client }}"
+  

roles/vpn/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+- name: install openvpn and recommendations
+  apt:
+    update_cache: yes
+    state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
+    install_recommends: yes
+    pkg:
+      - "openvpn"
+
+- name: setup sysctl config for openvpn
+  lineinfile:
+    path: "{{ sysctl_conf }}"
+    regexp: '^#?{{ configline.split("=")[0] }}='
+    line: "{{ configline }}"
+    backrefs: yes
+    owner: root
+    group: root
+    mode: 0644
+  loop: "{{ sysctl_configs }}"
+  loop_control:
+    loop_var: configline
+    label: "{{ configline }}"
+  notify: restart sysctl
+
+# run in a block only when for every vpn_client user there is a certificate
+# otherwise ignore ...
+# It is better to have a matching config (dependency currently only to vpn)
+# then to catch spectacular cases.
+- block:
+  - include_tasks: server.yml
+  - include_tasks: clients.yml
+  when: vpn_clients | difference(easy_rsa_clients) | length == 0

roles/vpn/tasks/server.yml

@@ -0,0 +1,78 @@
+---
+- name: find installed openvpn clients
+  find:
+    paths: "{{ vpn_home }}/client/"
+    patterns: "*.crt"
+  register: easyrsa_key_file
+
+#- name: Setup default OpenVPN configuration
+#  shell: 
+#    cmd: "gunzip -c {{ vpn_doc_examples }}/server.conf.gz > {{ vpn_home }}/server.conf"
+#    creates: "{{ vpn_home }}/server.conf"
+
+- name: Setup default OpenVPN configuration
+  copy: 
+    src: "{{ vpn_doc_examples }}/server.conf"
+    dest: "{{ vpn_home }}/server.conf"
+    owner: root
+    group: root
+    force: no
+
+- name: find server TLS-Auth key
+  find:
+    paths: "{{ vpn_home }}/server/"
+    patterns: "ta.key"
+  register: tlsauth_key_files
+
+- name: generate TLS-Auth key
+  command: "openvpn --genkey --secret {{ vpn_tlsauth_key_file }}"
+  when: tlsauth_key_files.matched == 0
+
+- name: install easy-rsa CA and server certs
+  copy:
+    src: "{{ easy_rsa_home }}/pki/{{ item }}"
+    dest: "{{ vpn_home }}/server/"
+    mode: 0600
+    owner: root
+    group: root
+  loop:
+    - "ca.crt"
+    - "dh.pem"
+    - "private/{{ vpn_server }}.key"
+    - "issued/{{ vpn_server }}.crt"
+
+- name: setup OpenVPN configuration
+  lineinfile:
+    path: "{{ vpn_home }}/server.conf"
+    regexp: '^;?{{ configline.split(" ")[0] }}{% if configline.split(" ") | length > 1 %} {% endif %}'
+    line: "{{ configline }}"
+    owner: root
+    group: root
+    mode: 0644
+  loop: "{{ vpn_server_conf }}"
+  loop_control:
+    loop_var: configline
+    label: "{{ configline }}"
+  notify: restart openvpn
+
+- name: off-setup OpenVPN configuration
+  lineinfile:
+    path: "{{ vpn_home }}/server.conf"
+    regexp: '^{{ configline.split(" ")[0] }}{% if configline.split(" ") | length > 1 %} {% endif %}'
+    line: ";{{ configline }}"
+    backrefs: yes
+    owner: root
+    group: root
+    mode: 0644
+  loop: "{{ vpn_server_conf_off }}"
+  loop_control:
+    loop_var: configline
+    label: ";{{ configline }}"
+  notify: restart openvpn
+
+- name: enable openvpn@server systemd unit
+  systemd:
+    name: openvpn@server
+    enabled: yes
+    daemon_reload: yes
+    state: started