From c5c33986da7360cba773c058cf07ff1ff234da91 Mon Sep 17 00:00:00 2001 From: Dmitry Date: Thu, 3 Sep 2026 10:09:20 +0300 Subject: [PATCH] fix(openvpn-phone): add to the client profile for ics-openvpn "OpenVPN for Android" fails at "Building configuration" ("Used 101 tries to get current version of the profile") for a `client`-mode profile with no block. The earlier tls-client p2p profile had no CA either but the app treated it as a custom tunnel; `client` mode makes the CA mandatory in the app's config builder. Inline the server's self-signed certificate as (it is its own trust anchor); peer-fingerprint still does the actual verification. Server config unchanged. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG --- ansible/playbooks/openvpn-phone.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/ansible/playbooks/openvpn-phone.yml b/ansible/playbooks/openvpn-phone.yml index e93af19..dd031a3 100644 --- a/ansible/playbooks/openvpn-phone.yml +++ b/ansible/playbooks/openvpn-phone.yml @@ -302,6 +302,15 @@ state: started enabled: true + - name: Read the server certificate for the profile CA block + # client-режим ics-openvpn отказывается собирать конфиг без . + # Серверный самоподписанный сертификат сам себе trust anchor; реальную + # проверку всё равно делает peer-fingerprint. + ansible.builtin.slurp: + src: "{{ phone_openvpn_server_cert }}" + register: phone_openvpn_server_cert_raw + no_log: true + - name: Read the client certificate for the profile ansible.builtin.slurp: src: "{{ phone_openvpn_client_cert }}" @@ -342,6 +351,9 @@ resolv-retry infinite nobind verb 3 + + {{ phone_openvpn_server_cert_raw.content | b64decode | trim }} + {{ phone_openvpn_client_cert_raw.content | b64decode | trim }}