| # openvpn server.conf - {{ ansible_managed }} |
| # |
| {# |
| SPDX-FileCopyrightText: © 2022 Open Networking Foundation <support@opennetworking.org> |
| SPDX-License-Identifier: Apache-2.0 |
| #} |
| |
| # accounts and privilege dropping |
| user nobody |
| group {{ openvpn_groupname }} |
| persist-key |
| persist-tun |
| |
| # security |
| tls-server |
| tls-version-min 1.3 |
| cipher AES-256-GCM |
| auth SHA256 |
| |
| # CA |
| ca {{ openvpn_conf_dir }}/server/chain.pem |
| crl-verify {{ openvpn_conf_dir }}/server/ca.crl |
| |
| # openVPN server |
| cert {{ openvpn_conf_dir }}/server/openvpn_server.pem |
| key {{ openvpn_conf_dir }}/server/openvpn_server.key |
| dh {{ openvpn_conf_dir }}/server/dh.pem |
| |
| # shared auth |
| tls-auth {{ openvpn_conf_dir }}/server/ta.key 0 |
| |
| # must connect with a verified client cert |
| opt-verify |
| remote-cert-tls client |
| verify-client-cert require |
| tls-cert-profile preferred |
| |
| # Connection |
| dev openvpn |
| dev-type tun |
| local {{ openvpn_listen_ip }} |
| port 1194 |
| proto udp |
| keepalive 10 120 |
| max-clients 100 |
| opt-verify |
| |
| # IP config |
| topology subnet |
| server {{ openvpn_subnet_cidr | ipaddr('network') }} {{ openvpn_subnet_cidr | ipaddr('netmask') }} |
| |
| # DHCP config |
| {% for dnsserv in openvpn_dns_servers %} |
| push "dhcp-option DNS {{ dnsserv }}" |
| {% endfor %} |
| |
| # routes |
| {% for route in openvpn_routes %} |
| push "route {{ route | ipaddr('network') }} {{ route | ipaddr('netmask') }}" |
| {% endfor %} |
| |
| # notify clients on server restart |
| explicit-exit-notify 1 |
| |
| # logging |
| verb 4 |
| mute 20 |
| status {{ openvpn_log_dir }}/status.log |
| ifconfig-pool-persist {{ openvpn_log_dir }}/ipp.txt |