Archive Legacy Setup And Add Ansible Control Plane

2026-07-08 12:47:37 +03:00
parent 841d56380b
commit 4bafa7d09e
203 changed files with 1663 additions and 11 deletions
@@ -0,0 +1,22 @@
+---
+openvpn_interface: tun0
+openvpn_listen_port: 8443
+openvpn_proto_server: tcp-server
+openvpn_proto_client: tcp-client
+openvpn_config_dir: /etc/openvpn/homelab
+openvpn_config_path: /etc/openvpn/homelab/homelab.conf
+openvpn_static_key_path: /etc/openvpn/homelab/static.key
+openvpn_service_name: homelab-openvpn
+openvpn_home_routes:
+  - network: 192.168.1.5
+    netmask: 255.255.255.255
+  - network: 192.168.1.6
+    netmask: 255.255.255.254
+  - network: 192.168.1.8
+    netmask: 255.255.255.248
+  - network: 192.168.1.16
+    netmask: 255.255.255.240
+  - network: 192.168.1.32
+    netmask: 255.255.255.248
+  - network: 192.168.1.40
+    netmask: 255.255.255.255
@@ -0,0 +1,6 @@
+---
+- name: restart openvpn
+  ansible.builtin.systemd:
+    name: "{{ openvpn_service_name }}"
+    state: restarted
+    enabled: true
@@ -0,0 +1,105 @@
+---
+- name: Install OpenVPN packages
+  ansible.builtin.apt:
+    name:
+      - openvpn
+      - iptables
+      - iproute2
+      - netcat-openbsd
+    state: present
+    update_cache: true
+
+- name: Ensure OpenVPN config directory exists
+  ansible.builtin.file:
+    path: "{{ openvpn_config_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate static key on server if missing
+  ansible.builtin.command: "openvpn --genkey secret {{ openvpn_static_key_path }}"
+  args:
+    creates: "{{ openvpn_static_key_path }}"
+  when: openvpn_role == 'server'
+  no_log: true
+
+- name: Read static key from server
+  ansible.builtin.slurp:
+    src: "{{ openvpn_static_key_path }}"
+  register: openvpn_static_key_raw
+  when: openvpn_role == 'server'
+  no_log: true
+
+- name: Copy static key to all peers
+  ansible.builtin.copy:
+    dest: "{{ openvpn_static_key_path }}"
+    content: "{{ hostvars['ru-vps'].openvpn_static_key_raw.content | b64decode }}"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: restart openvpn
+
+- name: Enable IPv4 forwarding on gateway
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+  when: openvpn_role == 'gateway'
+
+- name: Allow OpenVPN TCP in UFW on server
+  ansible.builtin.command: "ufw allow {{ openvpn_listen_port }}/tcp"
+  register: ufw_allow_openvpn
+  changed_when: "'Rule added' in ufw_allow_openvpn.stdout or 'Rules updated' in ufw_allow_openvpn.stdout"
+  failed_when: false
+  when: openvpn_role == 'server'
+
+- name: Render OpenVPN config
+  ansible.builtin.template:
+    src: homelab.conf.j2
+    dest: "{{ openvpn_config_path }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart openvpn
+
+- name: Render OpenVPN gateway up script
+  ansible.builtin.template:
+    src: up.sh.j2
+    dest: "{{ openvpn_config_dir }}/up.sh"
+    owner: root
+    group: root
+    mode: "0700"
+  notify: restart openvpn
+  when: openvpn_role == 'gateway'
+
+- name: Render OpenVPN gateway down script
+  ansible.builtin.template:
+    src: down.sh.j2
+    dest: "{{ openvpn_config_dir }}/down.sh"
+    owner: root
+    group: root
+    mode: "0700"
+  notify: restart openvpn
+  when: openvpn_role == 'gateway'
+
+- name: Render OpenVPN systemd service
+  ansible.builtin.template:
+    src: homelab-openvpn.service.j2
+    dest: "/etc/systemd/system/{{ openvpn_service_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart openvpn
+
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Enable and start OpenVPN
+  ansible.builtin.systemd:
+    name: "{{ openvpn_service_name }}"
+    state: started
+    enabled: true
@@ -0,0 +1,2 @@
+#!/bin/sh
+iptables -t nat -D POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE 2>/dev/null || true
@@ -0,0 +1,13 @@
+[Unit]
+Description=HomeLab OpenVPN {{ openvpn_role }}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/sbin/openvpn --config {{ openvpn_config_path }}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,26 @@
+dev {{ openvpn_interface }}
+ifconfig {{ openvpn_local_ip }} {{ openvpn_peer_ip }}
+secret {{ openvpn_static_key_path }}
+cipher AES-256-CBC
+auth SHA256
+persist-key
+persist-tun
+verb 3
+keepalive 10 60
+{% if openvpn_role == 'server' %}
+proto {{ openvpn_proto_server }}
+port {{ openvpn_listen_port }}
+{% for route in openvpn_home_routes %}
+route {{ route.network }} {{ route.netmask }}
+{% endfor %}
+{% endif %}
+{% if openvpn_role == 'gateway' %}
+proto {{ openvpn_proto_client }}
+remote 157.22.231.198 {{ openvpn_listen_port }}
+resolv-retry infinite
+nobind
+route-nopull
+script-security 2
+up /etc/openvpn/homelab/up.sh
+down /etc/openvpn/homelab/down.sh
+{% endif %}
@@ -0,0 +1,3 @@
+#!/bin/sh
+iptables -t nat -C POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE 2>/dev/null || \
+  iptables -t nat -A POSTROUTING -s {{ openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o eth0 -j MASQUERADE