feat: road-warrior OpenVPN profile for the phone (Android, static key)

playbooks/openvpn-phone.yml (make openvpn-phone) stands up a separate point-to-point static-key instance on ru-vps: tcp/9444, tun2, 10.80.0.0/30, homelab-openvpn-phone unit, NAT 10.80.0.0/30 -> LAN via tun0. The client profile (with the secret) lands in ansible/generated/ada-phone.ovpn (gitignored). Android client: "OpenVPN for Android" (Arne Schwabe) — the official OpenVPN Connect does not support static-key configs. - homelab_vpn_client_routes in group_vars/all/main.yml: shared surgical route list for both road-warrior profiles; not the whole /24, since the phone's home network is almost certainly 192.168.1.0/24 too - openvpn-laptop.yml reuses that list instead of its own literal copy - both playbooks: local profile write moved from `become: false` to `vars: {ansible_connection: local, ansible_become: false}` — the keyword did not suppress the inherited ansible_become on delegate_to: localhost Deployed and verified on ru-vps 2026-09-03: service active, tun2 up, ufw 9444/tcp, NAT rule present, make openvpn-phone idempotent (changed=0 on rerun), 192.168.1.30:8082 reachable from ru-vps. openvpn-laptop.yml is still not applied on the live host. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG
2026-09-03 09:33:18 +03:00
parent 05d8c748ab
commit 4b54e44116
5 changed files with 258 additions and 15 deletions
@@ -0,0 +1,212 @@
+---
+# ============================================================================
+# Road-warrior OpenVPN профиль для телефона (Android).
+#
+# Отдельный point-to-point static-key инстанс на ru-vps (порт 9444/tcp, tun2,
+# сеть 10.80.0.0/30), параллельный тоннелю site-to-site (tun0, homelab-openvpn)
+# и профилю ноутбука (tun1, openvpn-laptop.yml). Клиент подключается один за
+# раз — static key не мультиплексируется.
+#
+# КЛИЕНТ
+#   Приложение «OpenVPN for Android» (Arne Schwabe, F-Droid/Play). Официальный
+#   OpenVPN Connect static-key конфиги НЕ поддерживает — на Android нужен
+#   именно этот клиент.
+#
+# ЧТО ДЕЛАЕТ
+#   Ставит openvpn на ru-vps, генерит static key (один раз), открывает
+#   9444/tcp в UFW, поднимает systemd-юнит homelab-openvpn-phone, NAT'ит
+#   10.80.0.0/30 -> LAN через tun0, кладёт готовый профиль в
+#   ansible/generated/ada-phone.ovpn (mode 0600, содержит секрет).
+#
+# ЗАПУСК
+#   make openvpn-phone
+# ============================================================================
+- name: Configure OpenVPN phone access through ru-vps
+  hosts: ru-vps
+  gather_facts: true
+  become: true
+  vars:
+    phone_profile_name: ada-phone
+    phone_openvpn_dir: /etc/openvpn/homelab-phone
+    phone_openvpn_config: /etc/openvpn/homelab-phone/server.conf
+    phone_openvpn_key: /etc/openvpn/homelab-phone/static.key
+    phone_openvpn_service: homelab-openvpn-phone
+    phone_openvpn_port: 9444
+    phone_openvpn_interface: tun2
+    phone_openvpn_site_interface: tun0
+    phone_openvpn_network_cidr: 10.80.0.0/30
+    phone_openvpn_server_ip: 10.80.0.1
+    phone_openvpn_client_ip: 10.80.0.2
+    phone_openvpn_remote: 157.22.231.198
+    phone_openvpn_client_config_local: "{{ playbook_dir }}/../generated/{{ phone_profile_name }}.ovpn"
+    phone_openvpn_routes: "{{ homelab_vpn_client_routes }}"
+
+  tasks:
+    - name: Install OpenVPN packages
+      ansible.builtin.apt:
+        name:
+          - openvpn
+          - iptables
+        state: present
+        update_cache: true
+
+    - name: Ensure phone OpenVPN config directory exists
+      ansible.builtin.file:
+        path: "{{ phone_openvpn_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Generate phone static key if missing
+      ansible.builtin.command: "openvpn --genkey secret {{ phone_openvpn_key }}"
+      args:
+        creates: "{{ phone_openvpn_key }}"
+      no_log: true
+
+    - name: Enable IPv4 forwarding on ru-vps
+      ansible.posix.sysctl:
+        name: net.ipv4.ip_forward
+        value: "1"
+        state: present
+        reload: true
+
+    - name: Allow phone OpenVPN TCP in UFW
+      ansible.builtin.command: "ufw allow {{ phone_openvpn_port }}/tcp"
+      register: ufw_allow_phone_openvpn
+      changed_when: "'Rule added' in ufw_allow_phone_openvpn.stdout or 'Rules updated' in ufw_allow_phone_openvpn.stdout"
+      failed_when: false
+
+    - name: Render phone OpenVPN server config
+      ansible.builtin.copy:
+        dest: "{{ phone_openvpn_config }}"
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          dev {{ phone_openvpn_interface }}
+          ifconfig {{ phone_openvpn_server_ip }} {{ phone_openvpn_client_ip }}
+          secret {{ phone_openvpn_key }}
+          cipher AES-256-CBC
+          auth SHA256
+          proto tcp-server
+          port {{ phone_openvpn_port }}
+          persist-key
+          persist-tun
+          verb 3
+          keepalive 10 60
+      notify: restart phone openvpn
+
+    - name: Render phone OpenVPN up script
+      ansible.builtin.copy:
+        dest: "{{ phone_openvpn_dir }}/up.sh"
+        owner: root
+        group: root
+        mode: "0700"
+        content: |
+          #!/bin/sh
+          iptables -t nat -C POSTROUTING -s {{ phone_openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ phone_openvpn_site_interface }} -j MASQUERADE 2>/dev/null || \
+            iptables -t nat -A POSTROUTING -s {{ phone_openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ phone_openvpn_site_interface }} -j MASQUERADE
+      notify: restart phone openvpn
+
+    - name: Render phone OpenVPN down script
+      ansible.builtin.copy:
+        dest: "{{ phone_openvpn_dir }}/down.sh"
+        owner: root
+        group: root
+        mode: "0700"
+        content: |
+          #!/bin/sh
+          iptables -t nat -D POSTROUTING -s {{ phone_openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ phone_openvpn_site_interface }} -j MASQUERADE 2>/dev/null || true
+      notify: restart phone openvpn
+
+    - name: Render phone OpenVPN systemd service
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/{{ phone_openvpn_service }}.service"
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=HomeLab OpenVPN phone access
+          After=network-online.target homelab-openvpn.service
+          Wants=network-online.target
+          Requires=homelab-openvpn.service
+
+          [Service]
+          Type=simple
+          ExecStartPre={{ phone_openvpn_dir }}/up.sh
+          ExecStart=/usr/sbin/openvpn --config {{ phone_openvpn_config }}
+          ExecStopPost={{ phone_openvpn_dir }}/down.sh
+          Restart=on-failure
+          RestartSec=5
+
+          [Install]
+          WantedBy=multi-user.target
+      notify:
+        - reload systemd
+        - restart phone openvpn
+
+    - name: Flush handlers before starting phone OpenVPN
+      ansible.builtin.meta: flush_handlers
+
+    - name: Enable and start phone OpenVPN
+      ansible.builtin.systemd:
+        name: "{{ phone_openvpn_service }}"
+        state: started
+        enabled: true
+
+    - name: Read phone static key for client profile
+      ansible.builtin.slurp:
+        src: "{{ phone_openvpn_key }}"
+      register: phone_openvpn_static_key_raw
+      no_log: true
+
+    - name: Ensure local generated directory exists
+      ansible.builtin.file:
+        path: "{{ playbook_dir }}/../generated"
+        state: directory
+        mode: "0700"
+      delegate_to: localhost
+      vars:
+        ansible_connection: local
+        ansible_become: false
+
+    - name: Write local phone OpenVPN profile
+      ansible.builtin.copy:
+        dest: "{{ phone_openvpn_client_config_local }}"
+        mode: "0600"
+        content: |
+          client
+          dev tun
+          proto tcp-client
+          remote {{ phone_openvpn_remote }} {{ phone_openvpn_port }}
+          ifconfig {{ phone_openvpn_client_ip }} {{ phone_openvpn_server_ip }}
+          cipher AES-256-CBC
+          auth SHA256
+          persist-key
+          persist-tun
+          resolv-retry infinite
+          nobind
+          verb 3
+          {% for route in phone_openvpn_routes %}
+          route {{ route.network }} {{ route.netmask }}
+          {% endfor %}
+          <secret>
+          {{ phone_openvpn_static_key_raw.content | b64decode }}
+          </secret>
+      delegate_to: localhost
+      vars:
+        ansible_connection: local
+        ansible_become: false
+      no_log: true
+
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: restart phone openvpn
+      ansible.builtin.systemd:
+        name: "{{ phone_openvpn_service }}"
+        state: restarted