Archive Legacy Setup And Add Ansible Control Plane

ansible/roles/openvpn_gateway/tasks/main.yml

@@ -0,0 +1,105 @@
+---
+- name: Install OpenVPN packages
+  ansible.builtin.apt:
+    name:
+      - openvpn
+      - iptables
+      - iproute2
+      - netcat-openbsd
+    state: present
+    update_cache: true
+
+- name: Ensure OpenVPN config directory exists
+  ansible.builtin.file:
+    path: "{{ openvpn_config_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Generate static key on server if missing
+  ansible.builtin.command: "openvpn --genkey secret {{ openvpn_static_key_path }}"
+  args:
+    creates: "{{ openvpn_static_key_path }}"
+  when: openvpn_role == 'server'
+  no_log: true
+
+- name: Read static key from server
+  ansible.builtin.slurp:
+    src: "{{ openvpn_static_key_path }}"
+  register: openvpn_static_key_raw
+  when: openvpn_role == 'server'
+  no_log: true
+
+- name: Copy static key to all peers
+  ansible.builtin.copy:
+    dest: "{{ openvpn_static_key_path }}"
+    content: "{{ hostvars['ru-vps'].openvpn_static_key_raw.content | b64decode }}"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: restart openvpn
+
+- name: Enable IPv4 forwarding on gateway
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true
+  when: openvpn_role == 'gateway'
+
+- name: Allow OpenVPN TCP in UFW on server
+  ansible.builtin.command: "ufw allow {{ openvpn_listen_port }}/tcp"
+  register: ufw_allow_openvpn
+  changed_when: "'Rule added' in ufw_allow_openvpn.stdout or 'Rules updated' in ufw_allow_openvpn.stdout"
+  failed_when: false
+  when: openvpn_role == 'server'
+
+- name: Render OpenVPN config
+  ansible.builtin.template:
+    src: homelab.conf.j2
+    dest: "{{ openvpn_config_path }}"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart openvpn
+
+- name: Render OpenVPN gateway up script
+  ansible.builtin.template:
+    src: up.sh.j2
+    dest: "{{ openvpn_config_dir }}/up.sh"
+    owner: root
+    group: root
+    mode: "0700"
+  notify: restart openvpn
+  when: openvpn_role == 'gateway'
+
+- name: Render OpenVPN gateway down script
+  ansible.builtin.template:
+    src: down.sh.j2
+    dest: "{{ openvpn_config_dir }}/down.sh"
+    owner: root
+    group: root
+    mode: "0700"
+  notify: restart openvpn
+  when: openvpn_role == 'gateway'
+
+- name: Render OpenVPN systemd service
+  ansible.builtin.template:
+    src: homelab-openvpn.service.j2
+    dest: "/etc/systemd/system/{{ openvpn_service_name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart openvpn
+
+- name: Reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Enable and start OpenVPN
+  ansible.builtin.systemd:
+    name: "{{ openvpn_service_name }}"
+    state: started
+    enabled: true