New role to configure openvpn networks

openvpn-node/defaults/main.yml

@@ -0,0 +1,18 @@
+dev_type: tun                 # available options: tap, tun
+vpn_proto: tcp                # available options: tcp, udp
+vpn_server:                   # needs to be filled on per-host basis
+is_server: no                 # Change to "yes" for host that is supposed to act as VPN server
+vpn_server_port: 1194         # default is 1194
+use_tls_key: false            # defines whether tls PSK is used to harden initial communication (openvpn --tls-auth)
+# TODO: Implement creation of tls_key file from variable value
+# tls_key_path:               # needs to be filled on per-group basis if use_tls_key is enabled. Expects path to TLS PSK
+enable_compresion: yes
+vpn_cipher: AES-256-CBC
+
+#### Fill following values in host/group vars
+# vpn_server:                 # VPN server address
+# vpn_service_name: vpn_client  # name under which vpn config is created and vpn service is started.
+# ca_cert:                    # Mutliline PEM encoded ca certficate
+# vpn_cert:                   # Mutliline PEM encoded host certficate
+# priv_key:                   # Mutliline PEM encoded private key
+####

openvpn-node/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: restart openvpn
+  systemd:
+    name: openvpn@{{ vpn_service_name }}
+    state: restarted

openvpn-node/tasks/main.yml

@@ -0,0 +1,19 @@
+- name: Install opvn
+  apt:
+    state: present
+    name: openvpn
+
+- name: Copy vpn config
+  template:
+    src: "{{ 'server.ovpn' if is_server else 'client.ovpn'}}"
+    dest: /etc/openvpn/{{ vpn_service_name }}.conf
+  notify:
+    - restart openvpn
+
+- name: Enable openvpn as a service
+  systemd:
+    name: openvpn@{{ vpn_service_name }}
+    enabled: true
+    state: started
+
+

openvpn-node/templates/client.ovpn

@@ -0,0 +1,34 @@
+client
+dev {{ dev_type }}
+proto {{ vpn_proto }}
+remote {{ vpn_server }} {{ vpn_server_port }}
+resolv-retry infinite
+nobind
+user nobody
+group nogroup
+persist-key
+persist-tun
+cipher {{ vpn_cipher }}
+
+<ca>
+{{ ca_cert }}
+</ca>
+
+<cert>
+{{ vpn_cert }}
+</cert>
+
+<key>
+{{ priv_key }}
+</key>
+remote-cert-tls server
+
+{% if use_tls_key %}
+tls-auth {{ tls_key_path }} 1
+{% endif %}
+
+{% if enable_compresion %}
+comp-lzo
+{%endif%}
+
+verb 3

openvpn-node/templates/server.ovpn

@@ -0,0 +1,38 @@
+port {{ vpn_server_port }}
+dev {{ dev_type }}
+proto {{ vpn_proto }}
+server {{ vpn_subnet }} {{ vpn_netmask }}
+ifconfig-pool-persist /var/log/openvpn/ipp.txt
+keepalive 10 120
+
+{% if use_tls_key %}
+tls-auth {{ tls_key_path }} 0
+{% endif %}
+
+cipher {{ vpn_cipher }}
+compress lz4-v2
+push "compress lz4-v2"
+user nobody
+group nogroup
+persist-key
+persist-tun
+status /var/log/openvpn/openvpn-status.log
+verb 3
+explicit-exit-notify 1
+
+<ca>
+{{ ca_cert }}
+</ca>
+
+<cert>
+{{ vpn_cert }}
+</cert>
+
+<key>
+{{ priv_key }}
+</key>
+
+<dh>
+{{ dh_params }}
+</dh>
+