2 Commits

Include renames

Author	SHA1	Message	Date
DmitryandClaude Sonnet 5	1f27756afd	fix(openvpn-phone): switch from static key to TLS peer-fingerprint ... The Android client ships OpenVPN 2.7, which refuses a --secret config ("Options error: No tls-client or tls-server option"; 2.8 drops it entirely). Rework the phone instance to a CA-less TLS point-to-point: two self-signed EC keypairs generated on ru-vps (server.* / client.*), each side pins the other by SHA256 with peer-fingerprint, data-ciphers AES-256-GCM. Everything else unchanged (tcp/9444, tun2, 10.80.0.0/30, NAT via tun0, systemd unit, shared homelab_vpn_client_routes). Verified on ru-vps 2026-09-03: openvpn 2.6.19 starts clean ("Using certificate fingerprint to verify peer"), listens on 9444, tun2 up, make openvpn-phone idempotent (changed=0 on rerun), make lint green. The regenerated ansible/generated/ada-phone.ovpn (self-contained cert+key, gitignored) was handed to the operator. openvpn-laptop.yml is left on static key — not deployed; needs the same TLS treatment when someone actually uses it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG	2026-09-03 09:44:19 +03:00
DmitryandClaude Sonnet 5	4b54e44116	feat: road-warrior OpenVPN profile for the phone (Android, static key) ... playbooks/openvpn-phone.yml (make openvpn-phone) stands up a separate point-to-point static-key instance on ru-vps: tcp/9444, tun2, 10.80.0.0/30, homelab-openvpn-phone unit, NAT 10.80.0.0/30 -> LAN via tun0. The client profile (with the secret) lands in ansible/generated/ada-phone.ovpn (gitignored). Android client: "OpenVPN for Android" (Arne Schwabe) — the official OpenVPN Connect does not support static-key configs. - homelab_vpn_client_routes in group_vars/all/main.yml: shared surgical route list for both road-warrior profiles; not the whole /24, since the phone's home network is almost certainly 192.168.1.0/24 too - openvpn-laptop.yml reuses that list instead of its own literal copy - both playbooks: local profile write moved from `become: false` to `vars: {ansible_connection: local, ansible_become: false}` — the keyword did not suppress the inherited ansible_become on delegate_to: localhost Deployed and verified on ru-vps 2026-09-03: service active, tun2 up, ufw 9444/tcp, NAT rule present, make openvpn-phone idempotent (changed=0 on rerun), 192.168.1.30:8082 reachable from ru-vps. openvpn-laptop.yml is still not applied on the live host. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG	2026-09-03 09:33:18 +03:00