adrien/ansible-role-openvpn
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Externalize role

Browse source
This commit is contained in:
Adrien Reslinger 2018-10-08 19:35:16 +02:00
commit dbd8ed5949
Signed by: adrien
GPG key ID: DA7B27055C66D6DE
9 changed files with 272 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

59
templates/etc/openvpn/server/config.conf.j2 Normal file
View file

@ -0,0 +1,59 @@
port {{ item.port }}
{% if item.proto == "udp" %}
proto {{ item.proto }}
{% elif item.proto == "tcp" %}
proto tcp-server
{% endif %}
dev tap
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
mode server
tls-server
#user nobody
#group nobody
push "route-gateway {{ item.ip_server }}"
push "redirect-gateway def1"
#push "redirect-gateway def1 bypass-dhcp"
{% if item.dns is defined %}
push "dhcp-option DNS {{ item.dns }}"
{% endif %}
{% if item.domains is defined %}
{% for vpndomain in item.domains %}
push "dhcp-option DOMAIN {{ vpndomain }}"
{% endfor %}
{% endif %}
{% if item.routes is defined %}
{% for vpnroute in item.routes %}
push "route {{ vpnroute }}"
{% endfor %}
#push "route 0.0.0.0 128.0.0.0"
#push "route 128.0.0.0 128.0.0.0"
{% endif %}
client-to-client
keepalive 10 60
tls-auth ta.key 0
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
#comp-lzo
persist-key
persist-tun
{% if item.dhcp_range is defined %}
server-bridge {{ item.ip_server }} {{ item.netmask }} {{ item.dhcp_range}}
{% endif %}
status openvpn-status.log
#log-append openvpn.log
script-security 2
up /etc/openvpn/server/vpn-up.sh
down /etc/openvpn/server/vpn-down.sh
#cd /etc/openvpn/
#secret key
#ping-timer-rem
#replay-persist antireplay-{{ openvpn_vpn_name }}
verb 3
#route 172.16.0.0 255.255.255.0 172.16.255.2
#route 172.16.2.0 255.255.255.0 172.16.255.3
#ifconfig 172.16.100.10 255.255.255.0

21
templates/etc/openvpn/server/vpn-up-down.sh.j2 Normal file
View file

@ -0,0 +1,21 @@
#!/bin/bash
if [ $(echo "$0" | grep -c up) -eq 1 ]; then
while [ $(ip link show {{ openvpn_bridge }} | grep -c {{ openvpn_bridge }}) -eq 0 ]; do
sleep 5
done
/usr/sbin/ip link set up $1
{% if openvpn_bridge_type == "bridge" %}
/usr/sbin/brctl addif {{ openvpn_bridge }} $1
{% elif openvpn_bridge_type == "ovs" %}
/usr/bin/ovs-vsctl add-port {{ openvpn_bridge }} $1 tag={{ openvpn_vlan }} vlan_mode=native-tagged
{% endif %}
elif [ $(echo "$0" | grep -c down) -eq 1 ]; then
{% if openvpn_bridge_type == "bridge" %}
/usr/sbin/brctl delif {{ openvpn_bridge }} $1
{% elif openvpn_bridge_type == "ovs" %}
/usr/bin/ovs-vsctl del-port {{ openvpn_bridge }} $1
{% endif %}
/usr/sbin/ip link set down $1
fi
exit 0