diff --git a/xos/synchronizers/vpn/steps/roles/openvpn/handlers/main.yml b/xos/synchronizers/vpn/steps/roles/openvpn/handlers/main.yml
new file mode 100644
index 0000000..8725e29
--- /dev/null
+++ b/xos/synchronizers/vpn/steps/roles/openvpn/handlers/main.yml
@@ -0,0 +1,4 @@
+---
+
+- name: restart openvpn
+  shell: (kill -9 $(cat {{ pki_dir }}/pid) || true) && (openvpn {{ pki_dir }}/server.conf &)
diff --git a/xos/synchronizers/vpn/steps/roles/openvpn/tasks/main.yml b/xos/synchronizers/vpn/steps/roles/openvpn/tasks/main.yml
new file mode 100644
index 0000000..47093b2
--- /dev/null
+++ b/xos/synchronizers/vpn/steps/roles/openvpn/tasks/main.yml
@@ -0,0 +1,38 @@
+---
+
+- name: install openvpn
+  apt: name=openvpn state=present update_cache=yes
+
+- name: make sure /opt/openvpn exists
+  file: path=/opt/openvpn state=directory
+
+- name: make sure directory for this server exists
+  file: path={{ pki_dir }} state=directory
+
+- name: get server key
+  copy: src={{ pki_dir }}/private/server.key dest={{ pki_dir }}/server.key
+  notify:
+  - restart openvpn
+
+- name: get server crt
+  copy: src={{ pki_dir }}/issued/server.crt dest={{ pki_dir }}/server.crt
+  notify:
+  - restart openvpn
+
+- name: get ca crt
+  copy: src={{ pki_dir }}/ca.crt dest={{ pki_dir }}/ca.crt
+  notify:
+  - restart openvpn
+
+- name: get crl
+  copy: src={{ pki_dir }}/crl.pem dest={{ pki_dir }}/crl.pem
+
+- name: get dh
+  copy: src={{ pki_dir }}/dh.pem dest={{ pki_dir }}/dh.pem
+  notify:
+  - restart openvpn
+
+- name: write config
+  template: src=server.conf.j2 dest={{ pki_dir }}/server.conf owner=root group=root
+  notify:
+  - restart openvpn
diff --git a/xos/synchronizers/vpn/templates/server.conf.j2 b/xos/synchronizers/vpn/steps/roles/openvpn/templates/server.conf.j2
similarity index 100%
rename from xos/synchronizers/vpn/templates/server.conf.j2
rename to xos/synchronizers/vpn/steps/roles/openvpn/templates/server.conf.j2
diff --git a/xos/synchronizers/vpn/steps/sync_vpntenant.yaml b/xos/synchronizers/vpn/steps/sync_vpntenant.yaml
index 1b9f338..e36f51b 100644
--- a/xos/synchronizers/vpn/steps/sync_vpntenant.yaml
+++ b/xos/synchronizers/vpn/steps/sync_vpntenant.yaml
@@ -13,36 +13,5 @@
     protocol: {{ protocol }}
     pki_dir: {{ pki_dir }}
 
-  tasks:
-  - name: install openvpn
-    apt: name=openvpn state=present update_cache=yes
-
-  - name: stop openvpn
-    shell: kill -9 $(cat {{ pki_dir }}/pid) || true
-
-  - name: make sure /opt/openvpn exists
-    file: path=/opt/openvpn state=directory
-
-  - name: make sure directory for this server exists
-    file: path={{ pki_dir }} state=directory
-
-  - name: get server key
-    copy: src={{ pki_dir }}/private/server.key dest={{ pki_dir }}/server.key
-
-  - name: get server crt
-    copy: src={{ pki_dir }}/issued/server.crt dest={{ pki_dir }}/server.crt
-
-  - name: get ca crt
-    copy: src={{ pki_dir }}/ca.crt dest={{ pki_dir }}/ca.crt
-
-  - name: get crl
-    copy: src={{ pki_dir }}/crl.pem dest={{ pki_dir }}/crl.pem
-
-  - name: get dh
-    copy: src={{ pki_dir }}/dh.pem dest={{ pki_dir }}/dh.pem
-
-  - name: write config
-    template: src=/opt/xos/synchronizers/vpn/templates/server.conf.j2 dest={{ pki_dir }}/server.conf owner=root group=root
-
-  - name: start openvpn
-    shell: openvpn {{ pki_dir }}/server.conf &
+  roles:
+    - openvpn