mirror of
https://github.com/iiab/iiab.git
synced 2025-03-09 15:40:17 +00:00
Modularize roles/openvpn
This commit is contained in:
root
parent
46ee174962
commit
5decddac72
4 changed files with 229 additions and 209 deletions
|
|
@ -10,7 +10,7 @@
|
|||
|
||||
2. Without PHP available via FastCGI, any function at all for PHP-based applications validates NGINX.
|
||||
|
||||
3. Current state of IIAB App/Service migrations as of 2020-02-16:
|
||||
3. Current state of IIAB App/Service migrations as of 2020-02-17:
|
||||
|
||||
1. These support "Native" NGINX but ***NOT*** Apache
|
||||
* Admin Console
|
||||
|
|
@ -40,10 +40,10 @@
|
|||
|
||||
4. These each run their own web server or non-web / backend services, e.g. off of their own [unique port(s)](https://github.com/iiab/iiab/wiki/IIAB-Networking#list-of-ports--services) (IIAB home pages link directly to these destinations). In future we'd like mnemonic URL's for all of these: (e.g. http://box/calibre, http://box/archive, http://box/kalite)
|
||||
* calibre (menu goes directly to port 8080) [*]
|
||||
* internetarchive (menu goes directly to port 4244, [PR #2120](https://github.com/iiab/iiab/pull/2120))
|
||||
* internetarchive (menu goes directly to port 4244, [PR #2120](https://github.com/iiab/iiab/pull/2120)) [*]
|
||||
* kalite (menu goes directly to ports 8006-8008) [*]
|
||||
* minetest [*]
|
||||
* openvpn [*]
|
||||
* openvpn
|
||||
* pbx [*]
|
||||
|
||||
[*] The 5 above starred roles could use improvement, as of 2020-02-16.
|
||||
[*] The 5 above starred roles could use improvement, as of 2020-02-17.
|
||||
|
|
|
|||
80
roles/openvpn/tasks/enable-or-disable.yml
Normal file
80
roles/openvpn/tasks/enable-or-disable.yml
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
|
||||
# been working with systemd service names that contained the "@" character.
|
||||
|
||||
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
||||
# shell: systemctl enable openvpn@xscenet.service
|
||||
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
||||
|
||||
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
||||
# shell: update-rc.d openvpn enable
|
||||
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
||||
|
||||
#- name: Start the OpenVPN tunnel now
|
||||
# shell: systemctl start openvpn@xscenet.service
|
||||
# when: openvpn_enabled and not stat.exists is defined and not installing
|
||||
|
||||
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
|
||||
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
|
||||
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
|
||||
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
|
||||
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
|
||||
# Earlier "./runrole openvpn" had to be run twice to transmit
|
||||
# /etc/iiab/openvpn_handle to xscenet.net -- and
|
||||
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
|
||||
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
|
||||
|
||||
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
|
||||
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
|
||||
# changes most all instances below from CHILD service "openvpn@xscenet" to
|
||||
# PARENT service "openpvn". See these critical files to understand why:
|
||||
#
|
||||
# /etc/default/openvpn implies AUTOSTART="all"
|
||||
# /etc/init.d/openvpn has AUTOSTART="all"
|
||||
# /etc/openvpn/xscenet.conf our VPN connection
|
||||
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
|
||||
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
|
||||
# e.g. when "systemctl enable openvpn"
|
||||
|
||||
- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel)
|
||||
systemd:
|
||||
name: openvpn
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
|
||||
when: openvpn_enabled | bool
|
||||
|
||||
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
|
||||
lineinfile:
|
||||
path: /etc/crontab
|
||||
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
|
||||
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
|
||||
when: openvpn_enabled and openvpn_cron_enabled
|
||||
|
||||
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
|
||||
lineinfile:
|
||||
path: /etc/crontab
|
||||
regexp: "openvpn@xscenet"
|
||||
# Potentially DANGEROUS as others use systemctl too:
|
||||
#regexp: ".*/usr/bin/systemctl*"
|
||||
state: absent
|
||||
when: not openvpn_enabled or not openvpn_cron_enabled
|
||||
|
||||
- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel)
|
||||
systemd:
|
||||
name: openvpn
|
||||
enabled: no
|
||||
state: stopped
|
||||
when: not openvpn_enabled
|
||||
|
||||
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
|
||||
# shell: systemctl disable openvpn@xscenet.service
|
||||
# when: not openvpn_enabled and not is_debuntu
|
||||
|
||||
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
|
||||
# shell: update-rc.d openvpn disable
|
||||
# when: not openvpn_enabled and is_debuntu
|
||||
|
||||
#- name: Stop OpenVPN tunnel immediately
|
||||
# shell: systemctl stop openvpn@xscenet.service
|
||||
# ignore_errors: True
|
||||
# when: not openvpn_enabled and not installing
|
||||
115
roles/openvpn/tasks/install.yml
Normal file
115
roles/openvpn/tasks/install.yml
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
- name: Install OpenVPN and Nmap packages
|
||||
package:
|
||||
name:
|
||||
- openvpn
|
||||
- nmap
|
||||
state: present
|
||||
|
||||
# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle
|
||||
- name: Install Ncat package (if Debian > 9 or Ubuntu > 18)
|
||||
package:
|
||||
name: ncat
|
||||
state: present
|
||||
when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18)
|
||||
|
||||
- name: Install ssh public keys for remote support (if openvpn_install)
|
||||
lineinfile:
|
||||
line: "{{ item.pubkey }}"
|
||||
regexp: "{{ item.regexp }}"
|
||||
path: /root/.ssh/authorized_keys
|
||||
with_items:
|
||||
- regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody
|
||||
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s="
|
||||
- regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
|
||||
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal"
|
||||
- regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
|
||||
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank"
|
||||
|
||||
# CLARIF: plus signs (+) in public keys cause duplicate key additions (above)
|
||||
# and failure during removal (below) as "+" has a special meaning as
|
||||
# interpreted in a Python regexp, as implemented by Ansible's lineinfile module:
|
||||
# https://docs.python.org/2/library/re.html
|
||||
|
||||
# WORKAROUND: the tail end of each public key (after the last plus sign) is
|
||||
# being used (instead of the full key) as an abbreviated regexp for now.
|
||||
# A backslash in front of each plus sign (+) would also work.
|
||||
|
||||
# - name: Remove those ssh public keys, if not openvpn_enabled
|
||||
# lineinfile:
|
||||
# regexp: "{{ item }}"
|
||||
# path: /root/.ssh/authorized_keys
|
||||
# state: absent
|
||||
# with_items:
|
||||
# - "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$"
|
||||
# - "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
|
||||
# - "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
|
||||
# when: not openvpn_enabled
|
||||
|
||||
- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts'
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
with_items:
|
||||
- /etc/openvpn/keys
|
||||
- /etc/openvpn/scripts
|
||||
|
||||
- name: Configure OpenVPN (BACKS UP FILES IF CHANGED)
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: "{{ item.mode }}"
|
||||
backup: yes
|
||||
with_items:
|
||||
- { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' }
|
||||
- { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' }
|
||||
- { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' }
|
||||
- { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' }
|
||||
- { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' }
|
||||
- { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' }
|
||||
- { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' }
|
||||
- { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' }
|
||||
- { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' }
|
||||
- { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' }
|
||||
|
||||
- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install
|
||||
copy:
|
||||
src: "{{ iiab_dir }}/iiab-support"
|
||||
dest: /usr/bin/
|
||||
mode: '0755'
|
||||
|
||||
- name: Symlink /usr/bin/iiab-support-on -> /usr/bin/iiab-support
|
||||
file:
|
||||
src: /usr/bin/iiab-support
|
||||
path: /usr/bin/iiab-support-on
|
||||
state: link
|
||||
|
||||
- name: Symlink /usr/bin/iiab-support-off -> /usr/bin/iiab-remote-off
|
||||
file:
|
||||
src: /usr/bin/iiab-remote-off
|
||||
path: /usr/bin/iiab-support-off
|
||||
state: link
|
||||
|
||||
- name: Symlink /usr/bin/iiab-vpn-on -> /usr/bin/iiab-remote-on
|
||||
file:
|
||||
src: /usr/bin/iiab-remote-on
|
||||
path: /usr/bin/iiab-vpn-on
|
||||
state: link
|
||||
|
||||
- name: Symlink /usr/bin/iiab-vpn-off -> /usr/bin/iiab-remote-off
|
||||
file:
|
||||
src: /usr/bin/iiab-remote-off
|
||||
path: /usr/bin/iiab-vpn-off
|
||||
state: link
|
||||
|
||||
|
||||
# RECORD OpenVPN AS INSTALLED
|
||||
|
||||
- name: "Set 'openvpn_installed: True'"
|
||||
set_fact:
|
||||
openvpn_installed: True
|
||||
|
||||
- name: "Add 'openvpn_installed: True' to {{ iiab_state_file }}"
|
||||
lineinfile:
|
||||
path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml
|
||||
regexp: '^openvpn_installed'
|
||||
line: 'openvpn_installed: True'
|
||||
|
|
@ -1,213 +1,38 @@
|
|||
# TO DO: WRAP 12 OR 13 STANZAS BELOW INTO install.yml, conditioned by...
|
||||
# 'when: openvpn_installed is undefined'
|
||||
#
|
||||
# BEWARE: 4th stanza (ssh pubkey deletions) is already conditioned by...
|
||||
# 'when: not openvpn_install' (revise?)
|
||||
|
||||
- name: Install OpenVPN and Nmap packages
|
||||
package:
|
||||
name:
|
||||
- openvpn
|
||||
- nmap
|
||||
state: present
|
||||
|
||||
# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle
|
||||
- name: Install Ncat package (if Debian > 9 or Ubuntu > 18)
|
||||
package:
|
||||
name: ncat
|
||||
state: present
|
||||
when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18)
|
||||
|
||||
- name: Install ssh public keys for remote support (if openvpn_install)
|
||||
lineinfile:
|
||||
line: "{{ item.pubkey }}"
|
||||
regexp: "{{ item.regexp }}"
|
||||
path: /root/.ssh/authorized_keys
|
||||
with_items:
|
||||
- regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody
|
||||
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s="
|
||||
- regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
|
||||
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal"
|
||||
- regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
|
||||
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank"
|
||||
|
||||
# CLARIF: plus signs (+) in public keys cause duplicate key additions (above)
|
||||
# and failure during removal (below) as "+" has a special meaning as
|
||||
# interpreted in a Python regexp, as implemented by Ansible's lineinfile module:
|
||||
# https://docs.python.org/2/library/re.html
|
||||
|
||||
# WORKAROUND: the tail end of each public key (after the last plus sign) is
|
||||
# being used (instead of the full key) as an abbreviated regexp for now.
|
||||
# A backslash in front of each plus sign (+) would also work.
|
||||
|
||||
- name: Remove those ssh public keys (if openvpn_install is False)
|
||||
lineinfile:
|
||||
regexp: "{{ item }}"
|
||||
path: /root/.ssh/authorized_keys
|
||||
state: absent
|
||||
with_items:
|
||||
- "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$"
|
||||
- "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
|
||||
- "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
|
||||
when: not openvpn_install
|
||||
|
||||
- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts'
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
with_items:
|
||||
- /etc/openvpn/keys
|
||||
- /etc/openvpn/scripts
|
||||
|
||||
- name: Configure OpenVPN (BACKS UP FILES IF CHANGED)
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: "{{ item.mode }}"
|
||||
backup: yes
|
||||
with_items:
|
||||
- { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' }
|
||||
- { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' }
|
||||
- { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' }
|
||||
- { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' }
|
||||
- { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' }
|
||||
- { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' }
|
||||
- { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' }
|
||||
- { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' }
|
||||
- { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' }
|
||||
- { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' }
|
||||
|
||||
- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install
|
||||
copy:
|
||||
src: "{{ iiab_dir }}/iiab-support"
|
||||
dest: /usr/bin/
|
||||
mode: '0755'
|
||||
|
||||
- name: Symlink /usr/bin/iiab-support-on -> /usr/bin/iiab-support
|
||||
file:
|
||||
src: /usr/bin/iiab-support
|
||||
path: /usr/bin/iiab-support-on
|
||||
state: link
|
||||
|
||||
- name: Symlink /usr/bin/iiab-support-off -> /usr/bin/iiab-remote-off
|
||||
file:
|
||||
src: /usr/bin/iiab-remote-off
|
||||
path: /usr/bin/iiab-support-off
|
||||
state: link
|
||||
|
||||
- name: Symlink /usr/bin/iiab-vpn-on -> /usr/bin/iiab-remote-on
|
||||
file:
|
||||
src: /usr/bin/iiab-remote-on
|
||||
path: /usr/bin/iiab-vpn-on
|
||||
state: link
|
||||
|
||||
- name: Symlink /usr/bin/iiab-vpn-off -> /usr/bin/iiab-remote-off
|
||||
file:
|
||||
src: /usr/bin/iiab-remote-off
|
||||
path: /usr/bin/iiab-vpn-off
|
||||
state: link
|
||||
# PLEASE RUN 'sudo iiab-support' TO TURN THIS ON IN A FRIENDLY WAY !
|
||||
|
||||
|
||||
# RECORD OpenVPN AS INSTALLED
|
||||
# "How do i fail a task in Ansible if the variable contains a boolean value?
|
||||
# I want to perform input validation for Ansible playbooks"
|
||||
# https://stackoverflow.com/questions/46664127/how-do-i-fail-a-task-in-ansible-if-the-variable-contains-a-boolean-value-i-want/46667499#46667499
|
||||
|
||||
- name: "Set 'openvpn_installed: True'"
|
||||
set_fact:
|
||||
openvpn_installed: True
|
||||
# We assume 0-init/tasks/validate_vars.yml has DEFINITELY been run, so no need
|
||||
# to re-check whether vars are defined here. As Ansible vars cannot be unset:
|
||||
# https://serverfault.com/questions/856729/how-to-destroy-delete-unset-a-variable-value-in-ansible
|
||||
|
||||
- name: "Add 'openvpn_installed: True' to {{ iiab_state_file }}"
|
||||
lineinfile:
|
||||
path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml
|
||||
regexp: '^openvpn_installed'
|
||||
line: 'openvpn_installed: True'
|
||||
- name: Assert that "openvpn_install is sameas true" (boolean not string etc)
|
||||
assert:
|
||||
that: openvpn_install is sameas true
|
||||
fail_msg: "PLEASE SET 'openvpn_install: True' e.g. IN: /etc/iiab/local_vars.yml"
|
||||
quiet: yes
|
||||
|
||||
- name: Assert that "openvpn_enabled | type_debug == 'bool'" (boolean not string etc)
|
||||
assert:
|
||||
that: openvpn_enabled | type_debug == 'bool'
|
||||
fail_msg: "PLEASE GIVE VARIABLE 'openvpn_enabled' A PROPER (UNQUOTED) ANSIBLE BOOLEAN VALUE e.g. IN: /etc/iiab/local_vars.yml"
|
||||
quiet: yes
|
||||
|
||||
|
||||
# TO DO: WRAP COMMENTS + 4 ACTIVE STANZAS BELOW INTO enable-or-disable.yml...
|
||||
- name: Install OpenVPN if 'openvpn_installed' not defined, e.g. in {{ iiab_state_file }} # /etc/iiab/iiab_state.yml
|
||||
include_tasks: install.yml
|
||||
when: openvpn_installed is undefined
|
||||
|
||||
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
|
||||
# been working with systemd service names that contained the "@" character.
|
||||
|
||||
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
||||
# shell: systemctl enable openvpn@xscenet.service
|
||||
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
||||
|
||||
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
||||
# shell: update-rc.d openvpn enable
|
||||
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
||||
|
||||
#- name: Start the OpenVPN tunnel now
|
||||
# shell: systemctl start openvpn@xscenet.service
|
||||
# when: openvpn_enabled and not stat.exists is defined and not installing
|
||||
|
||||
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
|
||||
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
|
||||
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
|
||||
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
|
||||
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
|
||||
# Earlier "./runrole openvpn" had to be run twice to transmit
|
||||
# /etc/iiab/openvpn_handle to xscenet.net -- and
|
||||
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
|
||||
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
|
||||
|
||||
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
|
||||
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
|
||||
# changes most all instances below from CHILD service "openvpn@xscenet" to
|
||||
# PARENT service "openpvn". See these critical files to understand why:
|
||||
#
|
||||
# /etc/default/openvpn implies AUTOSTART="all"
|
||||
# /etc/init.d/openvpn has AUTOSTART="all"
|
||||
# /etc/openvpn/xscenet.conf our VPN connection
|
||||
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
|
||||
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
|
||||
# e.g. when "systemctl enable openvpn"
|
||||
|
||||
- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel)
|
||||
systemd:
|
||||
name: openvpn
|
||||
daemon_reload: yes
|
||||
enabled: yes
|
||||
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
|
||||
when: openvpn_enabled | bool
|
||||
|
||||
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
|
||||
lineinfile:
|
||||
path: /etc/crontab
|
||||
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
|
||||
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
|
||||
when: openvpn_enabled and openvpn_cron_enabled
|
||||
|
||||
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
|
||||
lineinfile:
|
||||
path: /etc/crontab
|
||||
regexp: "openvpn@xscenet"
|
||||
# Potentially DANGEROUS as others use systemctl too:
|
||||
#regexp: ".*/usr/bin/systemctl*"
|
||||
state: absent
|
||||
when: not openvpn_enabled or not openvpn_cron_enabled
|
||||
|
||||
- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel)
|
||||
systemd:
|
||||
name: openvpn
|
||||
enabled: no
|
||||
state: stopped
|
||||
when: not openvpn_enabled
|
||||
|
||||
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
|
||||
# shell: systemctl disable openvpn@xscenet.service
|
||||
# when: not openvpn_enabled and not is_debuntu
|
||||
|
||||
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
|
||||
# shell: update-rc.d openvpn disable
|
||||
# when: not openvpn_enabled and is_debuntu
|
||||
|
||||
#- name: Stop OpenVPN tunnel immediately
|
||||
# shell: systemctl stop openvpn@xscenet.service
|
||||
# ignore_errors: True
|
||||
# when: not openvpn_enabled and not installing
|
||||
- include_tasks: enable-or-disable.yml
|
||||
|
||||
|
||||
- name: Add 'openvpn' variable values to {{ iiab_ini_file }}
|
||||
ini_file:
|
||||
path: "{{ iiab_ini_file }}"
|
||||
path: "{{ iiab_ini_file }}" # /etc/iiab/iiab.ini
|
||||
section: openvpn
|
||||
option: "{{ item.option }}"
|
||||
value: "{{ item.value | string }}"
|
||||
|
|
@ -216,16 +41,16 @@
|
|||
value: OpenVPN
|
||||
- option: description
|
||||
value: '"OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections."'
|
||||
- option: enabled
|
||||
value: "{{ openvpn_enabled }}"
|
||||
# openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle)
|
||||
- option: handle
|
||||
- option: openvpn_handle
|
||||
value: "{{ openvpn_handle }}"
|
||||
- option: cron_enabled
|
||||
- option: openvpn_cron_enabled
|
||||
value: "{{ openvpn_cron_enabled }}"
|
||||
- option: server
|
||||
- option: openvpn_server
|
||||
value: "{{ openvpn_server }}"
|
||||
- option: server_virtual_ip
|
||||
- option: openvpn_server_virtual_ip
|
||||
value: "{{ openvpn_server_virtual_ip }}"
|
||||
- option: server_port
|
||||
- option: openvpn_server_port
|
||||
value: "{{ openvpn_server_port }}"
|
||||
- option: openvpn_enabled
|
||||
value: "{{ openvpn_enabled }}"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue