70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
---
|
||
- name: 'openvpn | copy vars'
|
||
template:
|
||
src: "../data/openvpn/vars.j2"
|
||
dest: "/etc/openvpn/{{ ansible_hostname }}/easy-rsa/vars"
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | cleanup everything'
|
||
command: "./easyrsa init-pki"
|
||
args:
|
||
chdir: /etc/openvpn/{{ ansible_hostname }}/easy-rsa
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | create random file'
|
||
command: "dd if=/dev/urandom of=pki/.rnd bs=256 count=1"
|
||
args:
|
||
chdir: /etc/openvpn/{{ ansible_hostname }}/easy-rsa
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | generate certificates'
|
||
command: "{{ item }}"
|
||
args:
|
||
chdir: /etc/openvpn/{{ ansible_hostname }}/easy-rsa
|
||
environment:
|
||
EASYRSA_BATCH: 1
|
||
with_items:
|
||
- ./easyrsa build-ca nopass
|
||
- ./easyrsa gen-dh
|
||
- ./easyrsa build-server-full {{ ansible_hostname }} nopass
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | copy certificates'
|
||
copy:
|
||
src: "{{ item }}"
|
||
dest: "/etc/openvpn/{{ ansible_hostname }}/keys"
|
||
remote_src: yes
|
||
with_items:
|
||
- /etc/openvpn/{{ ansible_hostname }}/easy-rsa/pki/dh.pem
|
||
- /etc/openvpn/{{ ansible_hostname }}/easy-rsa/pki/private/{{ ansible_hostname }}.key
|
||
- /etc/openvpn/{{ ansible_hostname }}/easy-rsa/pki/issued/{{ ansible_hostname }}.crt
|
||
- /etc/openvpn/{{ ansible_hostname }}/easy-rsa/pki/ca.crt
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | generate ta.key'
|
||
command: "openvpn --genkey --secret /etc/openvpn/{{ ansible_hostname }}/keys/ta.key"
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | chmod ta.key'
|
||
file:
|
||
path: "/etc/openvpn/{{ ansible_hostname }}/keys/ta.key"
|
||
owner: root
|
||
group: root
|
||
mode: 0644
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | configure ifconfig-pool-persist'
|
||
template:
|
||
src: "../data/openvpn/ipp.txt.j2"
|
||
dest: "/etc/openvpn/{{ ansible_hostname }}/ipp.txt"
|
||
when: openvpn_client is defined
|
||
tags: ['openvpn', 'openvpn_server']
|
||
|
||
- name: 'openvpn | copy server configuration'
|
||
template:
|
||
src: "../data/openvpn/server.conf.j2"
|
||
dest: "/etc/openvpn/{{ ansible_hostname }}.conf"
|
||
tags: ['openvpn', 'openvpn_server']
|
||
notify: openvpn-restart
|
||
|