|
36 | 36 | when: openvpn.allow_floating_client_ip |
37 | 37 | notify: Restart OpenVPN. |
38 | 38 |
|
39 | | -- name: Replace OpenVPN server tls-cipher. |
40 | | - ansible.builtin.lineinfile: |
41 | | - path: /etc/openvpn/server.conf |
42 | | - search_string: 'tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256' |
43 | | - line: "tls-cipher {{ openvpn.tls_cipher }}" |
44 | | - owner: root |
45 | | - group: root |
46 | | - mode: '0644' |
47 | | - when: openvpn.tls_cipher | length > 0 |
48 | | - notify: Restart OpenVPN. |
49 | | - |
50 | 39 | - name: Replace OpenVPN client IP range. |
51 | 40 | ansible.builtin.lineinfile: |
52 | 41 | path: /etc/openvpn/server.conf |
|
58 | 47 | when: openvpn.ipv4_settings | length > 0 |
59 | 48 | notify: Restart OpenVPN. |
60 | 49 |
|
61 | | -- name: Replace OpenVPN cipher on the server. |
62 | | - ansible.builtin.lineinfile: |
63 | | - path: /etc/openvpn/server.conf |
64 | | - search_string: 'cipher AES-128-GCM' |
65 | | - line: "cipher {{ openvpn.cipher }}" |
66 | | - owner: root |
67 | | - group: root |
68 | | - mode: '0644' |
| 50 | +- name: Set a different server cipher. |
69 | 51 | when: openvpn.cipher | length > 0 |
70 | | - |
71 | | -- name: Replace OpenVPN ncp-ciphers on the server. |
72 | | - ansible.builtin.lineinfile: |
73 | | - path: /etc/openvpn/server.conf |
74 | | - search_string: 'ncp-ciphers AES-128-GCM' |
75 | | - line: "ncp-ciphers {{ openvpn.cipher }}" |
76 | | - owner: root |
77 | | - group: root |
78 | | - mode: '0644' |
79 | | - when: openvpn.cipher | length > 0 |
80 | | - notify: Restart OpenVPN. |
| 52 | + block: |
| 53 | + - name: Replace OpenVPN cipher on the server. |
| 54 | + ansible.builtin.lineinfile: |
| 55 | + path: /etc/openvpn/server.conf |
| 56 | + search_string: 'cipher AES-128-GCM' |
| 57 | + line: "cipher {{ openvpn.cipher }}" |
| 58 | + owner: root |
| 59 | + group: root |
| 60 | + mode: '0644' |
| 61 | + |
| 62 | + - name: Replace OpenVPN ncp-ciphers on the server. |
| 63 | + ansible.builtin.lineinfile: |
| 64 | + path: /etc/openvpn/server.conf |
| 65 | + search_string: 'ncp-ciphers AES-128-GCM' |
| 66 | + line: "ncp-ciphers {{ openvpn.cipher }}" |
| 67 | + owner: root |
| 68 | + group: root |
| 69 | + mode: '0644' |
| 70 | + notify: Restart OpenVPN. |
81 | 71 |
|
82 | 72 | # Push routes |
83 | | -- name: Remove default push-route. |
84 | | - ansible.builtin.lineinfile: |
85 | | - path: /etc/openvpn/server.conf |
86 | | - search_string: 'redirect-gateway' |
87 | | - state: absent |
88 | | - owner: root |
89 | | - group: root |
90 | | - mode: '0644' |
| 73 | +- name: Set up ipv4 push routes. |
91 | 74 | when: openvpn.push_routes_ipv4 | length > 0 |
92 | | - |
93 | | -- name: Add ipv4 push routes comment for readability. |
94 | | - ansible.builtin.lineinfile: |
95 | | - path: /etc/openvpn/server.conf |
96 | | - line: "# ipv4 push routes" |
97 | | - when: openvpn.push_routes_ipv4 | length > 0 |
98 | | - |
99 | | -- name: Add ipv4 push routes to the VPN. |
100 | | - ansible.builtin.lineinfile: |
101 | | - path: /etc/openvpn/server.conf |
102 | | - line: 'push "route {{ item }}"' |
103 | | - with_items: "{{ openvpn.push_routes_ipv4 }}" |
104 | | - when: openvpn.push_routes_ipv4 | length > 0 |
105 | | - notify: Restart OpenVPN. |
106 | | - |
107 | | -- name: Add ipv6 push routes comment for readability. |
108 | | - ansible.builtin.lineinfile: |
109 | | - path: /etc/openvpn/server.conf |
110 | | - line: "# ipv6 push routes" |
| 75 | + block: |
| 76 | + - name: Remove default push-route. |
| 77 | + ansible.builtin.lineinfile: |
| 78 | + path: /etc/openvpn/server.conf |
| 79 | + search_string: 'redirect-gateway' |
| 80 | + state: absent |
| 81 | + owner: root |
| 82 | + group: root |
| 83 | + mode: '0644' |
| 84 | + |
| 85 | + - name: Add ipv4 push routes comment for readability. |
| 86 | + ansible.builtin.lineinfile: |
| 87 | + path: /etc/openvpn/server.conf |
| 88 | + line: "# ipv4 push routes" |
| 89 | + |
| 90 | + - name: Add ipv4 push routes to the VPN. |
| 91 | + ansible.builtin.lineinfile: |
| 92 | + path: /etc/openvpn/server.conf |
| 93 | + line: 'push "route {{ item }}"' |
| 94 | + with_items: "{{ openvpn.push_routes_ipv4 }}" |
| 95 | + notify: Restart OpenVPN. |
| 96 | + |
| 97 | +- name: Set up ipv6 push routes. |
111 | 98 | when: |
112 | 99 | - openvpn.push_routes_ipv6 | length > 0 |
113 | 100 | - openvpn.ipv6_support == "y" |
114 | | - |
115 | | -- name: Add ipv6 push routes to the VPN. |
116 | | - ansible.builtin.lineinfile: |
117 | | - path: /etc/openvpn/server.conf |
118 | | - line: 'push "route-ipv6 {{ item }}"' |
119 | | - with_items: "{{ openvpn.push_routes_ipv6 }}" |
120 | | - when: |
121 | | - - openvpn.push_routes_ipv6 | length > 0 |
122 | | - - openvpn.ipv6_support == "y" |
123 | | - notify: Restart OpenVPN. |
| 101 | + block: |
| 102 | + - name: Add ipv6 push routes comment for readability. |
| 103 | + ansible.builtin.lineinfile: |
| 104 | + path: /etc/openvpn/server.conf |
| 105 | + line: "# ipv6 push routes" |
| 106 | + |
| 107 | + - name: Add ipv6 push routes to the VPN. |
| 108 | + ansible.builtin.lineinfile: |
| 109 | + path: /etc/openvpn/server.conf |
| 110 | + line: 'push "route-ipv6 {{ item }}"' |
| 111 | + with_items: "{{ openvpn.push_routes_ipv6 }}" |
| 112 | + notify: Restart OpenVPN. |
| 113 | + |
| 114 | +# You can use a 'DEFAULT' file in the specified directory to provide client-specifig config, such as managed push routes |
| 115 | +- name: Set up client config directory. |
| 116 | + when: openvpn.client_config_dir | length > 0 |
| 117 | + block: |
| 118 | + - name: Create client config directory if it doesn't exist. |
| 119 | + ansible.builtin.file: |
| 120 | + path: "{{ openvpn.client_config_dir }}" |
| 121 | + state: directory |
| 122 | + owner: root |
| 123 | + group: root |
| 124 | + mode: '0755' |
| 125 | + |
| 126 | + - name: Add client config directory to config if path is provided. |
| 127 | + ansible.builtin.lineinfile: |
| 128 | + path: /etc/openvpn/server.conf |
| 129 | + line: "client-config-dir {{ openvpn.client_config_dir }}" |
124 | 130 |
|
125 | 131 | # PAM integration |
126 | 132 | - name: Ensure the OpenVPN PAM config is in place. |
|
133 | 139 | when: openvpn.pam.enabled |
134 | 140 |
|
135 | 141 | # PAM integration using LDAP |
136 | | -- name: Ensure the OpenVPN PAM config for LDAP is in place. |
137 | | - ansible.builtin.template: |
138 | | - src: "{{ openvpn.ldap.config_template }}" |
139 | | - dest: /etc/pam.d/openvpn |
140 | | - mode: "0644" |
141 | | - owner: root |
142 | | - group: root |
143 | | - when: openvpn.ldap.enabled |
144 | | - |
145 | | -- name: Ensure the OpenVPN LDAP config directory exists. |
146 | | - ansible.builtin.file: |
147 | | - path: /etc/openvpn/ldap |
148 | | - state: directory |
149 | | - mode: '0755' |
150 | | - |
151 | | -- name: Ensure the pam-ldap config for OpenVPN is in place. |
152 | | - ansible.builtin.template: |
153 | | - src: openvpn.ldap.j2 |
154 | | - dest: /etc/openvpn/ldap/ldap |
155 | | - mode: "0644" |
156 | | - owner: root |
157 | | - group: root |
| 142 | +- name: Set up PAM integration with LDAP. |
158 | 143 | when: openvpn.ldap.enabled |
| 144 | + block: |
| 145 | + - name: Ensure the OpenVPN PAM config for LDAP is in place. |
| 146 | + ansible.builtin.template: |
| 147 | + src: "{{ openvpn.ldap.config_template }}" |
| 148 | + dest: /etc/pam.d/openvpn |
| 149 | + mode: "0644" |
| 150 | + owner: root |
| 151 | + group: root |
| 152 | + |
| 153 | + - name: Ensure the OpenVPN LDAP config directory exists. |
| 154 | + ansible.builtin.file: |
| 155 | + path: /etc/openvpn/ldap |
| 156 | + state: directory |
| 157 | + mode: '0755' |
| 158 | + |
| 159 | + - name: Ensure the pam-ldap config for OpenVPN is in place. |
| 160 | + ansible.builtin.template: |
| 161 | + src: openvpn.ldap.j2 |
| 162 | + dest: /etc/openvpn/ldap/ldap |
| 163 | + mode: "0644" |
| 164 | + owner: root |
| 165 | + group: root |
159 | 166 |
|
160 | 167 | # Enable PAM in OpenVPN |
161 | 168 | - name: Add PAM integration config to OpenVPN. |
|
168 | 175 | notify: Restart OpenVPN. |
169 | 176 |
|
170 | 177 | # Tweak client config template |
171 | | -- name: Replace OpenVPN client tls-cipher. |
172 | | - ansible.builtin.lineinfile: |
173 | | - path: /etc/openvpn/client-template.txt |
174 | | - search_string: 'tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256' |
175 | | - line: "tls-cipher {{ openvpn.tls_cipher }}" |
176 | | - owner: root |
177 | | - group: root |
178 | | - mode: '0644' |
| 178 | +- name: Set a different TLS cipher for client template and server. |
179 | 179 | when: openvpn.tls_cipher | length > 0 |
180 | | - |
181 | | -- name: Replace OpenVPN client cipher. |
182 | | - ansible.builtin.lineinfile: |
183 | | - path: /etc/openvpn/client-template.txt |
184 | | - search_string: 'cipher AES-128-GCM' |
185 | | - line: "cipher {{ openvpn.cipher }}" |
186 | | - owner: root |
187 | | - group: root |
188 | | - mode: '0644' |
189 | | - when: openvpn.cipher | length > 0 |
| 180 | + block: |
| 181 | + - name: Replace OpenVPN client tls-cipher. |
| 182 | + ansible.builtin.lineinfile: |
| 183 | + path: /etc/openvpn/client-template.txt |
| 184 | + search_string: 'tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256' |
| 185 | + line: "tls-cipher {{ openvpn.tls_cipher }}" |
| 186 | + owner: root |
| 187 | + group: root |
| 188 | + mode: '0644' |
| 189 | + |
| 190 | + - name: Replace OpenVPN client cipher. |
| 191 | + ansible.builtin.lineinfile: |
| 192 | + path: /etc/openvpn/client-template.txt |
| 193 | + search_string: 'cipher AES-128-GCM' |
| 194 | + line: "cipher {{ openvpn.cipher }}" |
| 195 | + owner: root |
| 196 | + group: root |
| 197 | + mode: '0644' |
| 198 | + |
| 199 | + - name: Replace OpenVPN server tls-cipher. |
| 200 | + ansible.builtin.lineinfile: |
| 201 | + path: /etc/openvpn/server.conf |
| 202 | + search_string: 'tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256' |
| 203 | + line: "tls-cipher {{ openvpn.tls_cipher }}" |
| 204 | + owner: root |
| 205 | + group: root |
| 206 | + mode: '0644' |
| 207 | + notify: Restart OpenVPN. |
190 | 208 |
|
191 | 209 | # Only works when openvpn.port_choice == '1' because otherwise port will not be 1194 and regexp will not match |
192 | 210 | - name: Use FQDN as OpenVPN server remote in client config. |
|
0 commit comments