101 lines
3.3 KiB
YAML
101 lines
3.3 KiB
YAML
---
|
|
- name: Include vars for {{ ansible_os_family }}
|
|
include_vars: "{{ ansible_os_family }}.yml"
|
|
|
|
- name: Install packages for openvpn
|
|
package: name="{{ openvpn_packages }}" state=latest update_cache=yes
|
|
|
|
- name: Install OpenVSwitch
|
|
include_role:
|
|
name: openvswitch
|
|
when:
|
|
- openvpn_bridge_type == "ovs"
|
|
|
|
#- openvswitch_bridge:
|
|
# bridge: "{{ openvpn_bridge }}"
|
|
# parent: "{{ openvpn_bridgemaster }}"
|
|
# vlan: "{{ openvpn_vlan }}"
|
|
# state: present
|
|
# when:
|
|
# - openvpn_bridge_type == "ovs"
|
|
|
|
# Doesn't work !!
|
|
#- name: try nmcli add bridge - conn_name only & ip4 gw4 mode
|
|
# nmcli:
|
|
# type: bridge
|
|
# conn_name: '{{ openvpn_bridge }}'
|
|
# ip4: '{{ openvpn_bridge_ip }}/24'
|
|
# state: present
|
|
# when:
|
|
# - openvpn_bridge_type == "bridge"
|
|
|
|
- name: Make server config directory
|
|
file: path=/etc/openvpn/server state=directory owner=root group=root mode=0750
|
|
|
|
- name: Install vpn-up.sh script
|
|
template: src=etc/openvpn/server/vpn-up-down.sh.j2 dest=/etc/openvpn/server/vpn-up.sh owner=root group=root mode=0755
|
|
- name: Install vpn-down.sh link
|
|
file: src=vpn-up.sh dest=/etc/openvpn/server/vpn-down.sh state=link force=yes
|
|
# setsebool openvpn_run_unconfined on
|
|
- name: Set boolean selinux flag for scripts
|
|
seboolean:
|
|
name: openvpn_run_unconfined
|
|
state: yes
|
|
persistent: yes
|
|
# chcon -t openvpn_unconfined_script_exec_t vpn-up.sh
|
|
- name: Set selinux context to vpn-up.sh script
|
|
sefcontext:
|
|
target: '/etc/openvpn/server/vpn-up.sh'
|
|
setype: openvpn_unconfined_script_exec_t
|
|
state: present
|
|
|
|
# openssl pkcs12 -in PFXFILE -cacerts -nokeys -out ca.pem
|
|
# openssl pkcs12 -in PFXFILE -nokeys -clcerts -out cert.pem
|
|
# openssl pkcs12 -in PFXFILE -nocerts -nodes -out key.pem
|
|
# openssl dhparam -out dh2048.pem 2048
|
|
# source vars
|
|
# ./pkitool Client1
|
|
|
|
# Need more step to generate certificat files
|
|
- name: Install Certificat files
|
|
copy: src=etc/openvpn/server/easy-rsa/2.0/keys/{{ item }} dest=/etc/openvpn/server/{{ item }} owner=root group=root mode=0600
|
|
with_items:
|
|
- ca.crt
|
|
- dh2048.pem
|
|
- server.crt
|
|
- server.key
|
|
- ta.key
|
|
|
|
- name: Install openvpn configuration files
|
|
template: src=etc/openvpn/server/config.conf.j2 dest=/etc/openvpn/server/{{ openvpn_vpn_name }}.{{ item.proto }}.conf owner=root group=root mode=0644
|
|
with_items:
|
|
- '{{ openvpn_subnets }}'
|
|
notify: Restart openvpn-server-{{ item.proto }}
|
|
|
|
- name: Enable openvpn services
|
|
service: name="openvpn-server@{{ openvpn_vpn_name }}.{{ item.proto }}" enabled=yes
|
|
with_items:
|
|
- '{{ openvpn_subnets }}'
|
|
|
|
- name: Install Personnal OpenVPN config file for firewalld
|
|
template: src=etc/firewalld/services/openvpn.xml dest=/etc/firewalld/services/openvpn-{{ openvpn_vpn_name | regex_replace('\.','_') }}.xml owner=root group=root mode=0644
|
|
register: result
|
|
|
|
- name: reload firewalld to refresh service list
|
|
command: firewall-cmd --reload
|
|
when: result is changed
|
|
|
|
- name: Open Firewalld
|
|
firewalld:
|
|
service: openvpn-{{ openvpn_vpn_name | regex_replace('\.','_') }}
|
|
permanent: true
|
|
state: enabled
|
|
immediate: true
|
|
|
|
# firewall-cmd --reload
|
|
# firewall-cmd --add-service openvpn --permanent
|
|
# firewall-cmd --add-service openvpn-tcp --permanent
|
|
# firewall-cmd --zone=external --change-interface=eth0
|
|
# firewall-cmd --add-service=openvpn --zone=external --permanent
|
|
# firewall-cmd --add-service=openvpn-tcp --zone=external --permanent
|
|
|