iiab/roles/openvpn/tasks/main.yml

- name: Install OpenVPN and Nmap packages
  package:
    name: "{{ item }}"
    state: present
  with_items:
    - openvpn
    - nmap
  tags:
    - download

- name: Install ssh public keys for remote support (if openvpn_install)
  lineinfile:
    line: "{{ item.pubkey }}"
    regexp: "{{ item.regexp }}"
    path: /root/.ssh/authorized_keys
    #backup: yes
  when: openvpn_install
  with_items:
    - regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody
      pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s="
    - regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
      pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal"
    - regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
      pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank"

# CLARIF: plus signs (+) in public keys cause duplicate key additions (above)
# and failure during removal (below) as "+" has a special meaning as
# interpreted in a Python regexp, as implemented by Ansible's lineinfile module:
# https://docs.python.org/2/library/re.html

# WORKAROUND: the tail end of each public key (after the last plus sign) is
# being used (instead of the full key) as an abbreviated regexp for now.
# A backslash in front of each plus sign (+) would also work.

- name: Remove ssh public keys (if openvpn_install is False)
  lineinfile:
    regexp: "{{ item }}"
    path: /root/.ssh/authorized_keys
    state: absent
    #backup: yes
  when: not openvpn_install
  with_items:
    - "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$"
    - "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
    - "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"

- name: Create the directory for OpenVPN keys
  file:
    dest: /etc/openvpn/keys
    state: directory
    owner: root
    group: root
    mode: 0755

- name: Create the directory for scripts
  file:
    dest: /etc/openvpn/scripts
    state: directory
    owner: root
    group: root
    mode: 0755

# Comment out in future?  Might still be relevant for CentOS but unused for ~2 years as of August 2018:
- name: Create folder /usr/lib/iiab (not on path) for iiab executable up_wan
  file:
    path: /usr/lib/iiab
    state: directory

- name: Configure OpenVPN (BACKS UP FILES IF CHANGED)
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
    backup: yes
  with_items:
    - { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' }
    - { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' }
    - { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' }
    - { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' }
    - { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' }
    - { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' }
    - { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' }
    - { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' }
    - { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' }
    - { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' }
    # Comment out in future?  Not recommended as of August 2018:
    - { src: 'iiab-handle.j2', dest: '/usr/bin/iiab-handle', mode: '0755' }
    # Comment out in future?  Might still be relevant for CentOS but unused for ~2 years as of August 2018:
    - { src: 'up_wan', dest: '/usr/lib/iiab/up_wan', mode: '0755' }
    # Unused for ~2 years as of August 2018:
    #- { src: 'start.j2', dest: '/usr/lib/iiab/start', mode: '0755' }
    # Buggy & rarely used as of August 2018:
    #- { src: 'iiab-vpn.conf.in', dest: '/etc/openvpn/iiab-vpn.conf.in', mode: '0644' }
    # Buggy & rarely used as of August 2018:
    #- { src: 'iiab-vpn.j2', dest: '/usr/bin/iiab-vpn', mode: '0755' }

#- name: Save openvpn_handle variable into /etc/iiab/openvpn_handle (BACKS UP FILE IF CHANGED)
#  template:
#    src: openvpn_handle.j2
#    dest: /etc/iiab/openvpn_handle
#    owner: root
#    group: root
#    mode: 0644
#    backup: yes
#  when: openvpn_handle is defined

# up_wan was being installed twice (also above) and was unused for ~2 years
# as of August 2018: (see 15-openvpn below)
#- name: Put up_wan in place (debuntu)
#  template:
#    src: up_wan
#    dest: /usr/lib/iiab/up_wan
#  when: is_debuntu

# Comment out in future?  Contained serious bug (15-openvpn called
# up-wan instead of up_wan in /usr/lib/iiab/ as of August 2018) so
# evidently unused for ~2 years:
- name: Put dispatcher up for NM (not debuntu)
  template:
    src: 15-openvpn
    dest: /etc/NetworkManager/dispatcher.d/
  when: not is_debuntu

# Was buggy & unused for ~2 years as of August 2018:
#- name: Check for manually configured OpenVPN tunnel
#  stat:
#    path: /etc/openvpn/iiab-vpn.conf
#  register: stat


# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
# been working with systemd service names that contained the "@" character.

#- name: Enable the OpenVPN tunnel at boot time (debuntu)
#  shell: systemctl enable openvpn@xscenet.service
#  when: openvpn_enabled and not stat.exists is defined and is_debuntu

#- name: Enable the OpenVPN tunnel at boot time (debuntu)
#  shell: update-rc.d openvpn enable
#  when: openvpn_enabled and not stat.exists is defined and is_debuntu

#- name: Start the OpenVPN tunnel now
#  shell: systemctl start openvpn@xscenet.service
#  when: openvpn_enabled and not stat.exists is defined and not installing

# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
# Earlier "./runrole openvpn" had to be run twice to transmit
# /etc/iiab/openvpn_handle to xscenet.net -- and
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
- name: Enable & (Re)Start PARENT service openvpn, which (re)starts CHILD service openvpn@xscenet (& actual tunnel)
  systemd:
    name: openvpn
    daemon_reload: yes
    enabled: yes
    state: restarted
  when: openvpn_enabled

- name: Enable hourly cron job for OpenVPN (typically for CentOS only?)
  lineinfile:
    path: /etc/crontab
    line: "25 *  *  *  * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
  when: openvpn_enabled and openvpn_cron_enabled

- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
  lineinfile:
    path: /etc/crontab
    regexp: "openvpn@xscenet"
    # Potentially DANGEROUS as others use systemctl too:
    #regexp: ".*/usr/bin/systemctl*"
    state: absent
  when: not openvpn_enabled or not openvpn_cron_enabled

- name: Disable & Stop PARENT service openvpn, which stops CHILD service openvpn@xscenet (& actual tunnel)
  systemd:
    name: openvpn
    enabled: no
    state: stopped
  when: not openvpn_enabled

#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)    
#  shell: systemctl disable openvpn@xscenet.service
#  when: not openvpn_enabled and not is_debuntu

#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
#  shell: update-rc.d openvpn disable
#  when: not openvpn_enabled and is_debuntu

#- name: Stop OpenVPN tunnel immediately
#  shell: systemctl stop openvpn@xscenet.service
#  ignore_errors: True
#  when: not openvpn_enabled and not installing


- name: Add 'openvpn' to list of services at /etc/iiab/iiab.ini
  ini_file:
    dest: "{{ service_filelist }}"
    section: openvpn
    option: "{{ item.option }}"
    value: "{{ item.value }}"
  with_items:
  - option: name
    value: OpenVPN
  - option: description
    value: "OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections."
  - option: enabled
    value: "{{ openvpn_enabled }}"
# openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle)
  - option: handle
    value: "{{ openvpn_handle }}"
  - option: cron_enabled
    value: "{{ openvpn_cron_enabled }}"
  - option: server
    value: "{{ openvpn_server }}"
  - option: server_virtual_ip
    value: "{{ openvpn_server_virtual_ip }}"
  - option: server_port
    value: "{{ openvpn_server_port }}"