Skip to content

Commit 65f9d04

Browse files
javascriptizer1javascriptizer1
committed
feat: openvpn playbook
0 parents  commit 65f9d04

File tree

12 files changed

+376
-0
lines changed

12 files changed

+376
-0
lines changed

‎.gitignore

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Ansible Tower ignore list
2+
3+
# IDEs
4+
.project
5+
.pydevproject
6+
.idea
7+
*.iml
8+
.vscode
9+
.DS_Store
10+
11+
# Environment variables
12+
.env
13+
Vagrantfile
14+
.vagrant
15+
16+
.coverage
17+
18+
# Ansible runtime and backups
19+
*.original
20+
*.tmp
21+
*.bkp
22+
*.retry
23+
*.*~
24+
25+
ovpn
26+
27+
# Try tyo avoid any plain-text passwords
28+
*pwd*
29+
*pass*
30+
*password*
31+
*.txt
32+
33+
# Exclude all binaries
34+
*.bin
35+
*.jar
36+
*.tar
37+
*.zip
38+
*.gzip
39+
*.tgz

‎inventories/group_vars/all.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
ansible_user: root
2+
ansible_become: true
3+
ansible_python_interpreter: /usr/bin/python3

‎inventories/inventory.ini

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[vpn]
2+
vpn ansible_ssh_host=127.0.0.1 ansible_ssh_user=root

‎playbook.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
- name: 'OpenVPN'
2+
hosts: vpn
3+
roles:
4+
- vpn
5+
tags:
6+
- vpn

‎roles/vpn/defaults/main.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
vpn_openvpn_dir: /etc/openvpn
2+
vpn_openvpn_easyrsa_dir: /usr/share/easy-rsa
3+
4+
vpn_openvpn_port: 1194
5+
vpn_openvpn_address: '{{ ansible_default_ipv4.address }}'
6+
7+
vpn_openvpn_clients:
8+
- javascriptizer1
9+
10+
vpn_host: '127.0.0.1'

‎roles/vpn/handlers/main.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
- name: restart openvpn
2+
service:
3+
name: openvpn
4+
state: restarted
5+
6+
- name: enable openvpn
7+
service:
8+
name: openvpn
9+
enabled: true
10+
state: started

‎roles/vpn/meta/main.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
galaxy_info:
2+
author: javascriptizer1
3+
description: OpenVPN Ansible role
4+
license: license (GPL-2.0-or-later, MIT, etc)
5+
min_ansible_version: '2.1'
6+
galaxy_tags: ['openvpn']
7+

‎roles/vpn/tasks/client.yaml

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
- name: Copy client crt to folder server in {{ vpn_openvpn_dir }}
2+
ansible.builtin.copy:
3+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/issued/{{ item }}.crt'
4+
dest: '{{ vpn_openvpn_dir }}/server/{{ item }}.crt'
5+
mode: '0644'
6+
remote_src: true
7+
with_items: '{{ vpn_openvpn_clients }}'
8+
9+
- name: Copy client key to folder server in {{ vpn_openvpn_dir }}
10+
ansible.builtin.copy:
11+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/private/{{ item }}.key'
12+
dest: '{{ vpn_openvpn_dir }}/server/{{ item }}.key'
13+
mode: '0644'
14+
remote_src: true
15+
with_items: '{{ vpn_openvpn_clients }}'
16+
17+
- name: Ensure exists - users {{ vpn_openvpn_dir }}
18+
ansible.builtin.file:
19+
path: '{{ vpn_openvpn_dir }}/users'
20+
state: directory
21+
mode: '0755'
22+
23+
- name: Copy files to users {{ vpn_openvpn_dir }}
24+
ansible.builtin.copy:
25+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/{{ item }}'
26+
dest: '{{ vpn_openvpn_dir }}/users/{{ item | basename }}'
27+
mode: '0644'
28+
remote_src: true
29+
with_items:
30+
- ca.crt
31+
- ta.key
32+
33+
- name: Copy client crt to folder users in {{ vpn_openvpn_dir }}
34+
ansible.builtin.copy:
35+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/issued/{{ item }}.crt'
36+
dest: '{{ vpn_openvpn_dir }}/users/{{ item }}.crt'
37+
mode: '0644'
38+
remote_src: true
39+
with_items: '{{ vpn_openvpn_clients }}'
40+
41+
- name: Copy client key to folder users in {{ vpn_openvpn_dir }}
42+
ansible.builtin.copy:
43+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/private/{{ item }}.key'
44+
dest: '{{ vpn_openvpn_dir }}/users/{{ item }}.key'
45+
mode: '0644'
46+
remote_src: true
47+
with_items: '{{ vpn_openvpn_clients }}'
48+
49+
- name: Register ca.crt
50+
ansible.builtin.slurp:
51+
src: '{{ vpn_openvpn_dir }}/ca.crt'
52+
register: vpn_openvpn_ca_cert
53+
54+
- name: Register ta.key
55+
ansible.builtin.slurp:
56+
src: '{{ vpn_openvpn_dir }}/ta.key'
57+
register: vpn_openvpn_ta_key
58+
59+
- name: Register client certs
60+
ansible.builtin.slurp:
61+
src: '{{ vpn_openvpn_dir }}/users/{{ item }}.crt'
62+
with_items: '{{ vpn_openvpn_clients }}'
63+
register: vpn_openvpn_client_certs
64+
65+
- name: Register client keys
66+
ansible.builtin.slurp:
67+
src: '{{ vpn_openvpn_dir }}/users/{{ item }}.key'
68+
with_items: '{{ vpn_openvpn_clients }}'
69+
register: vpn_openvpn_client_keys
70+
71+
- name: Generate client config
72+
ansible.builtin.template:
73+
src: client.ovpn.j2
74+
dest: '{{ vpn_openvpn_dir }}/users/{{ item.0.item }}-{{ inventory_hostname }}.ovpn'
75+
owner: root
76+
group: root
77+
mode: '0400'
78+
with_together:
79+
- '{{ vpn_openvpn_client_certs.results }}'
80+
- '{{ vpn_openvpn_client_keys.results }}'
81+
82+
- name: Fetch client config
83+
ansible.builtin.fetch:
84+
src: '{{ vpn_openvpn_dir }}/users/{{ item }}-{{ inventory_hostname }}.ovpn'
85+
dest: '{{ playbook_dir }}/ovpn/{{ inventory_hostname }}-{{ item }}.ovpn'
86+
flat: true
87+
with_items: '{{ vpn_openvpn_clients }}'

‎roles/vpn/tasks/main.yml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- import_tasks: server.yaml
2+
- import_tasks: client.yaml

‎roles/vpn/tasks/server.yaml

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
- name: Ensure apt list dir exists
2+
ansible.builtin.apt.file:
3+
path: /var/lib/apt/lists/
4+
state: directory
5+
mode: '0755'
6+
7+
- name: Update repositories cache
8+
ansible.builtin.apt:
9+
update_cache: true
10+
become: true
11+
12+
- name: Install openvpn easy-rsa
13+
ansible.builtin.apt:
14+
name:
15+
- openvpn
16+
- easy-rsa
17+
- iptables-persistent
18+
state: present
19+
become: true
20+
notify:
21+
- 'enable openvpn'
22+
23+
- name: Enable IPv4 forwarding
24+
ansible.posix.sysctl:
25+
name: net.ipv4.ip_forward
26+
value: '1'
27+
sysctl_set: true
28+
state: present
29+
reload: true
30+
ignoreerrors: true
31+
failed_when: false
32+
33+
- name: Create Ip tables NAT
34+
ansible.builtin.iptables:
35+
table: nat
36+
chain: POSTROUTING
37+
jump: MASQUERADE
38+
protocol: all
39+
source: '0.0.0.0/0'
40+
destination: '0.0.0.0/0'
41+
become: true
42+
43+
- name: Ensure exists - {{ vpn_openvpn_dir }}
44+
ansible.builtin.file:
45+
path: '{{ vpn_openvpn_dir }}/easy-rsa'
46+
state: directory
47+
mode: '0755'
48+
49+
- name: Create vars file
50+
ansible.builtin.copy:
51+
dest: '{{ vpn_openvpn_easyrsa_dir }}/vars'
52+
content: |
53+
set_var EASYRSA_ALGO "ec"
54+
set_var EASYRSA_DIGEST "sha512"
55+
mode: '0755'
56+
57+
- name: Easy-rsa init-pki
58+
ansible.builtin.command:
59+
cmd: '{{ vpn_openvpn_easyrsa_dir }}/easyrsa init-pki'
60+
chdir: '{{ vpn_openvpn_dir }}/easy-rsa'
61+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki'
62+
63+
- name: Easy-rsa build-ca
64+
ansible.builtin.command:
65+
cmd: '{{ vpn_openvpn_easyrsa_dir }}/easyrsa build-ca nopass'
66+
chdir: '{{ vpn_openvpn_dir }}/easy-rsa'
67+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki/ca.crt'
68+
environment:
69+
EASYRSA_BATCH: 'yes'
70+
71+
- name: Easy-rsa gen-dh
72+
ansible.builtin.command:
73+
cmd: '{{ vpn_openvpn_easyrsa_dir }}/easyrsa gen-dh'
74+
chdir: '{{ vpn_openvpn_dir }}/easy-rsa'
75+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki/dh.pem'
76+
77+
- name: Easy-rsa server nopass
78+
ansible.builtin.command:
79+
cmd: '{{ vpn_openvpn_easyrsa_dir }}/easyrsa build-server-full server nopass'
80+
chdir: '{{ vpn_openvpn_dir }}/easy-rsa'
81+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki/issued/server.crt'
82+
83+
- name: Easy-rsa client nopass
84+
ansible.builtin.command:
85+
cmd: '{{ vpn_openvpn_easyrsa_dir }}/easyrsa build-client-full {{ item }} nopass'
86+
chdir: '{{ vpn_openvpn_dir }}/easy-rsa'
87+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki/issued/{{ item }}.crt'
88+
with_items:
89+
- '{{ vpn_openvpn_clients }}'
90+
91+
- name: Easy-rsa gen-crl
92+
ansible.builtin.command:
93+
cmd: '{{ vpn_openvpn_easyrsa_dir }}/easyrsa gen-crl'
94+
chdir: '{{ vpn_openvpn_dir }}/easy-rsa'
95+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki/crl.pem'
96+
97+
- name: OpenVPN genkey
98+
ansible.builtin.command:
99+
cmd: 'openvpn --genkey --secret {{ vpn_openvpn_dir }}/easy-rsa/pki/ta.key'
100+
creates: '{{ vpn_openvpn_dir }}/easy-rsa/pki/ta.key'
101+
102+
- name: Copy files to folder server in {{ vpn_openvpn_dir }}
103+
ansible.builtin.copy:
104+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/{{ item }}'
105+
dest: '{{ vpn_openvpn_dir }}/server/{{ item | basename }}'
106+
mode: '0644'
107+
remote_src: true
108+
with_items:
109+
- ca.crt
110+
- dh.pem
111+
- ta.key
112+
- private/ca.key
113+
- private/server.key
114+
- issued/server.crt
115+
116+
- name: Copy files to {{ vpn_openvpn_dir }}
117+
ansible.builtin.copy:
118+
src: '{{ vpn_openvpn_dir }}/easy-rsa/pki/{{ item }}'
119+
dest: '{{ vpn_openvpn_dir }}/{{ item | basename }}'
120+
mode: '0644'
121+
remote_src: true
122+
with_items:
123+
- ca.crt
124+
- ta.key
125+
126+
- name: Place server.conf
127+
ansible.builtin.template:
128+
src: 'server.conf.j2'
129+
dest: '{{ vpn_openvpn_dir }}/server.conf'
130+
owner: root
131+
group: root
132+
mode: '0644'
133+
notify:
134+
- 'restart openvpn'

‎roles/vpn/templates/client.ovpn.j2

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
client
2+
3+
tls-client
4+
auth SHA256
5+
cipher AES-256-CBC
6+
remote-cert-tls server
7+
tls-version-min 1.2
8+
9+
proto udp
10+
remote {{ vpn_openvpn_address }} {{ vpn_openvpn_port }}
11+
dev tun
12+
13+
resolv-retry 5
14+
nobind
15+
keepalive 5 30
16+
persist-key
17+
persist-tun
18+
verb 3
19+
20+
route-method exe
21+
route-delay 2
22+
23+
key-direction 1
24+
<ca>
25+
{{ vpn_openvpn_ca_cert.content|b64decode }}
26+
</ca>
27+
28+
<tls-auth>
29+
{{ vpn_openvpn_ta_key.content|b64decode }}
30+
</tls-auth>
31+
32+
<cert>
33+
{{ item.0.content|b64decode }}
34+
</cert>
35+
36+
<key>
37+
{{ item.1.content|b64decode }}
38+
</key>

‎roles/vpn/templates/server.conf.j2

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
port {{ vpn_openvpn_port }}
2+
proto udp
3+
dev tun
4+
5+
ca {{ vpn_openvpn_dir }}/server/ca.cert
6+
cert {{ vpn_openvpn_dir }}/server/server.crt
7+
key {{ vpn_openvpn_dir }}/server/server.key
8+
dh {{ vpn_openvpn_dir }}/server/dh.pem
9+
10+
tls-auth {{ vpn_openvpn_dir }}/ta.key 0
11+
tls-server
12+
auth SHA256
13+
cipher AES-256-CBC
14+
tls-version-min 1.2
15+
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384:TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
16+
17+
server {{ vpn_host }} 255.255.255.0
18+
19+
topology subnet
20+
ifconfig-pool-persist ipp.txt
21+
push "redirect-gateway def1 bypass-dhcp"
22+
push "dhcp-option DNS 1.0.0.1"
23+
push "dhcp-option DNS 1.1.1.1"
24+
push "dhcp-option DNS 8.8.8.8"
25+
push "dhcp-option DNS 8.8.4.4"
26+
27+
keepalive 5 30
28+
persist-key
29+
persist-tun
30+
user nodoby
31+
group nogroup
32+
33+
status status_openvpn_udp_1194.log
34+
status-version 1
35+
log-append /var/log/openvpn/openvpn.log
36+
verb 3
37+
38+
script-security 1

0 commit comments

Comments
 (0)