infra/ansible/playbooks/openvpn-laptop.yml

- name: Configure OpenVPN laptop access through ru-vps
  hosts: ru-vps
  gather_facts: true
  become: true
  vars:
    laptop_profile_name: ada-x1
    laptop_openvpn_dir: /etc/openvpn/homelab-laptop
    laptop_openvpn_config: /etc/openvpn/homelab-laptop/server.conf
    laptop_openvpn_key: /etc/openvpn/homelab-laptop/static.key
    laptop_openvpn_service: homelab-openvpn-laptop
    laptop_openvpn_port: 9443
    laptop_openvpn_interface: tun1
    laptop_openvpn_site_interface: tun0
    laptop_openvpn_network_cidr: 10.79.0.0/30
    laptop_openvpn_server_ip: 10.79.0.1
    laptop_openvpn_client_ip: 10.79.0.2
    laptop_openvpn_remote: 157.22.231.198
    laptop_openvpn_client_config_local: "{{ playbook_dir }}/../generated/{{ laptop_profile_name }}.ovpn"
    laptop_openvpn_home_routes:
      - network: 192.168.1.5
        netmask: 255.255.255.255
      - network: 192.168.1.6
        netmask: 255.255.255.254
      - network: 192.168.1.8
        netmask: 255.255.255.248
      - network: 192.168.1.16
        netmask: 255.255.255.240
      - network: 192.168.1.32
        netmask: 255.255.255.248
      - network: 192.168.1.40
        netmask: 255.255.255.255

  tasks:
    - name: Install OpenVPN packages
      ansible.builtin.apt:
        name:
          - openvpn
          - iptables
        state: present
        update_cache: true

    - name: Ensure laptop OpenVPN config directory exists
      ansible.builtin.file:
        path: "{{ laptop_openvpn_dir }}"
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Generate laptop static key if missing
      ansible.builtin.command: "openvpn --genkey secret {{ laptop_openvpn_key }}"
      args:
        creates: "{{ laptop_openvpn_key }}"
      no_log: true

    - name: Enable IPv4 forwarding on ru-vps
      ansible.posix.sysctl:
        name: net.ipv4.ip_forward
        value: "1"
        state: present
        reload: true

    - name: Allow laptop OpenVPN TCP in UFW
      ansible.builtin.command: "ufw allow {{ laptop_openvpn_port }}/tcp"
      register: ufw_allow_laptop_openvpn
      changed_when: "'Rule added' in ufw_allow_laptop_openvpn.stdout or 'Rules updated' in ufw_allow_laptop_openvpn.stdout"
      failed_when: false

    - name: Render laptop OpenVPN server config
      ansible.builtin.copy:
        dest: "{{ laptop_openvpn_config }}"
        owner: root
        group: root
        mode: "0600"
        content: |
          dev {{ laptop_openvpn_interface }}
          ifconfig {{ laptop_openvpn_server_ip }} {{ laptop_openvpn_client_ip }}
          secret {{ laptop_openvpn_key }}
          cipher AES-256-CBC
          auth SHA256
          proto tcp-server
          port {{ laptop_openvpn_port }}
          persist-key
          persist-tun
          verb 3
          keepalive 10 60
      notify: restart laptop openvpn

    - name: Render laptop OpenVPN up script
      ansible.builtin.copy:
        dest: "{{ laptop_openvpn_dir }}/up.sh"
        owner: root
        group: root
        mode: "0700"
        content: |
          #!/bin/sh
          iptables -t nat -C POSTROUTING -s {{ laptop_openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ laptop_openvpn_site_interface }} -j MASQUERADE 2>/dev/null || \
            iptables -t nat -A POSTROUTING -s {{ laptop_openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ laptop_openvpn_site_interface }} -j MASQUERADE
      notify: restart laptop openvpn

    - name: Render laptop OpenVPN down script
      ansible.builtin.copy:
        dest: "{{ laptop_openvpn_dir }}/down.sh"
        owner: root
        group: root
        mode: "0700"
        content: |
          #!/bin/sh
          iptables -t nat -D POSTROUTING -s {{ laptop_openvpn_network_cidr }} -d {{ homelab_lan_cidr }} -o {{ laptop_openvpn_site_interface }} -j MASQUERADE 2>/dev/null || true
      notify: restart laptop openvpn

    - name: Render laptop OpenVPN systemd service
      ansible.builtin.copy:
        dest: "/etc/systemd/system/{{ laptop_openvpn_service }}.service"
        owner: root
        group: root
        mode: "0644"
        content: |
          [Unit]
          Description=HomeLab OpenVPN laptop access
          After=network-online.target homelab-openvpn.service
          Wants=network-online.target
          Requires=homelab-openvpn.service

          [Service]
          Type=simple
          ExecStartPre={{ laptop_openvpn_dir }}/up.sh
          ExecStart=/usr/sbin/openvpn --config {{ laptop_openvpn_config }}
          ExecStopPost={{ laptop_openvpn_dir }}/down.sh
          Restart=on-failure
          RestartSec=5

          [Install]
          WantedBy=multi-user.target
      notify:
        - reload systemd
        - restart laptop openvpn

    - name: Flush handlers before starting laptop OpenVPN
      ansible.builtin.meta: flush_handlers

    - name: Enable and start laptop OpenVPN
      ansible.builtin.systemd:
        name: "{{ laptop_openvpn_service }}"
        state: started
        enabled: true

    - name: Read laptop static key for client profile
      ansible.builtin.slurp:
        src: "{{ laptop_openvpn_key }}"
      register: laptop_openvpn_static_key_raw
      no_log: true

    - name: Ensure local generated directory exists
      ansible.builtin.file:
        path: "{{ playbook_dir }}/../generated"
        state: directory
        mode: "0700"
      become: false
      delegate_to: localhost

    - name: Write local laptop OpenVPN profile
      ansible.builtin.copy:
        dest: "{{ laptop_openvpn_client_config_local }}"
        mode: "0600"
        content: |
          client
          dev tun
          proto tcp-client
          remote {{ laptop_openvpn_remote }} {{ laptop_openvpn_port }}
          ifconfig {{ laptop_openvpn_client_ip }} {{ laptop_openvpn_server_ip }}
          cipher AES-256-CBC
          auth SHA256
          persist-key
          persist-tun
          resolv-retry infinite
          nobind
          verb 3
          {% for route in laptop_openvpn_home_routes %}
          route {{ route.network }} {{ route.netmask }}
          {% endfor %}
          <secret>
          {{ laptop_openvpn_static_key_raw.content | b64decode }}
          </secret>
      become: false
      delegate_to: localhost
      no_log: true

  handlers:
    - name: reload systemd
      ansible.builtin.systemd:
        daemon_reload: true

    - name: restart laptop openvpn
      ansible.builtin.systemd:
        name: "{{ laptop_openvpn_service }}"
        state: restarted