| --- |
| - hosts: {{ instance_name }} |
| gather_facts: False |
| connection: ssh |
| user: ubuntu |
| sudo: yes |
| vars: |
| ca_crt: {{ ca_crt }} |
| server_crt: {{ server_crt }} |
| server_key: {{ server_key }} |
| server_network: {{ server_network }} |
| is_persistent: {{ is_persistent }} |
| vpn_subnet: {{ vpn_subnet }} |
| clients_can_see_each_other: {{ clients_can_see_each_other }} |
| dh: {{ dh }} |
| |
| tasks: |
| - name: install openvpn |
| apt: name=openvpn state=present update_cache=yes |
| |
| - name: stop openvpn |
| shell: killall openvpn || true |
| |
| - name: make sure /opt/openvpn exists |
| file: path=/opt/openvpn state=directory |
| |
| - name: get server key |
| copy: src=/opt/openvpn/easyrsa3/pki/private/server.key dest=/opt/openvpn/server.key |
| |
| - name: get server crt |
| copy: src=/opt/openvpn/easyrsa3/pki/issued/server.crt dest=/opt/openvpn/server.crt |
| |
| - name: get ca crt |
| copy: src=/opt/openvpn/easyrsa3/pki/ca.crt dest=/opt/openvpn/ca.crt |
| |
| - name: get dh |
| copy: src=/opt/openvpn/easyrsa3/pki/dh.pem dest=/opt/openvpn/dh.pem |
| |
| - name: erase config |
| shell: rm -f server.conf |
| |
| - name: erase auth script |
| shell: rm -f auth.sh |
| |
| - name: write auth script |
| shell: echo "exit 0" > auth.sh |
| |
| - name: write base config |
| shell: |
| | |
| printf "script-security 3 system |
| port 1194 |
| proto udp |
| dev tun |
| ca /opt/openvpn/ca.crt |
| cert /opt/openvpn/server.crt |
| key /opt/openvpn/server.key |
| dh /opt/openvpn/dh.pem |
| server {{ server_network }} {{ vpn_subnet }} |
| ifconfig-pool-persist ipp.txt |
| comp-lzo |
| status openvpn-status.log |
| verb 3 |
| auth-user-pass-verify auth.sh via-file |
| client-cert-not-required |
| username-as-common-name |
| " > server.conf |
| |
| - name: write persistent config |
| shell: |
| | |
| printf "\nkeepalive 10 60 |
| persist-tun |
| persist-key" >> server.conf |
| when: {{ is_persistent }} |
| |
| - name: start openvpn |
| shell: openvpn server.conf & |