diff --git a/roles/nginx/README.md b/roles/nginx/README.md index c12df574c..75f05d4c6 100644 --- a/roles/nginx/README.md +++ b/roles/nginx/README.md @@ -10,7 +10,7 @@ 2. Without PHP available via FastCGI, any function at all for PHP-based applications validates NGINX. -3. Current state of IIAB App/Service migrations as of 2020-02-16: +3. Current state of IIAB App/Service migrations as of 2020-02-17: 1. These support "Native" NGINX but ***NOT*** Apache * Admin Console @@ -40,10 +40,10 @@ 4. These each run their own web server or non-web / backend services, e.g. off of their own [unique port(s)](https://github.com/iiab/iiab/wiki/IIAB-Networking#list-of-ports--services) (IIAB home pages link directly to these destinations). In future we'd like mnemonic URL's for all of these: (e.g. http://box/calibre, http://box/archive, http://box/kalite) * calibre (menu goes directly to port 8080) [*] - * internetarchive (menu goes directly to port 4244, [PR #2120](https://github.com/iiab/iiab/pull/2120)) + * internetarchive (menu goes directly to port 4244, [PR #2120](https://github.com/iiab/iiab/pull/2120)) [*] * kalite (menu goes directly to ports 8006-8008) [*] * minetest [*] - * openvpn [*] + * openvpn * pbx [*] -[*] The 5 above starred roles could use improvement, as of 2020-02-16. +[*] The 5 above starred roles could use improvement, as of 2020-02-17. diff --git a/roles/openvpn/tasks/enable-or-disable.yml b/roles/openvpn/tasks/enable-or-disable.yml new file mode 100644 index 000000000..9d6a48a3e --- /dev/null +++ b/roles/openvpn/tasks/enable-or-disable.yml @@ -0,0 +1,80 @@ +# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not +# been working with systemd service names that contained the "@" character. + +#- name: Enable the OpenVPN tunnel at boot time (debuntu) +# shell: systemctl enable openvpn@xscenet.service +# when: openvpn_enabled and not stat.exists is defined and is_debuntu + +#- name: Enable the OpenVPN tunnel at boot time (debuntu) +# shell: update-rc.d openvpn enable +# when: openvpn_enabled and not stat.exists is defined and is_debuntu + +#- name: Start the OpenVPN tunnel now +# shell: systemctl start openvpn@xscenet.service +# when: openvpn_enabled and not stat.exists is defined and not installing + +# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY +# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate +# properly to xscenet.net (monitoring ncat's erroneous handle parameter by +# observing "systemctl status openvpn@xscenet" helped trace the [primary?] +# bug to roles/openvpn/templates/announcer [far better now if not perfect?]) +# Earlier "./runrole openvpn" had to be run twice to transmit +# /etc/iiab/openvpn_handle to xscenet.net -- and +# "systemctl restart openvpn@xscenet" was failing completely (no matter how +# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net + +# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot, +# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079) +# changes most all instances below from CHILD service "openvpn@xscenet" to +# PARENT service "openpvn". See these critical files to understand why: +# +# /etc/default/openvpn implies AUTOSTART="all" +# /etc/init.d/openvpn has AUTOSTART="all" +# /etc/openvpn/xscenet.conf our VPN connection +# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf +# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn +# e.g. when "systemctl enable openvpn" + +- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel) + systemd: + name: openvpn + daemon_reload: yes + enabled: yes + state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead? + when: openvpn_enabled | bool + +- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?) + lineinfile: + path: /etc/crontab + # CONSIDER "restart" not just "start" if something stronger is confirmed needed? + line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null" + when: openvpn_enabled and openvpn_cron_enabled + +- name: Remove hourly cron job for OpenVPN (typically for CentOS only?) + lineinfile: + path: /etc/crontab + regexp: "openvpn@xscenet" + # Potentially DANGEROUS as others use systemctl too: + #regexp: ".*/usr/bin/systemctl*" + state: absent + when: not openvpn_enabled or not openvpn_cron_enabled + +- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel) + systemd: + name: openvpn + enabled: no + state: stopped + when: not openvpn_enabled + +#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu) +# shell: systemctl disable openvpn@xscenet.service +# when: not openvpn_enabled and not is_debuntu + +#- name: Stop starting the OpenVPN tunnel at boot time (debuntu) +# shell: update-rc.d openvpn disable +# when: not openvpn_enabled and is_debuntu + +#- name: Stop OpenVPN tunnel immediately +# shell: systemctl stop openvpn@xscenet.service +# ignore_errors: True +# when: not openvpn_enabled and not installing diff --git a/roles/openvpn/tasks/install.yml b/roles/openvpn/tasks/install.yml new file mode 100644 index 000000000..025f3b9c4 --- /dev/null +++ b/roles/openvpn/tasks/install.yml @@ -0,0 +1,115 @@ +- name: Install OpenVPN and Nmap packages + package: + name: + - openvpn + - nmap + state: present + +# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle +- name: Install Ncat package (if Debian > 9 or Ubuntu > 18) + package: + name: ncat + state: present + when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18) + +- name: Install ssh public keys for remote support (if openvpn_install) + lineinfile: + line: "{{ item.pubkey }}" + regexp: "{{ item.regexp }}" + path: /root/.ssh/authorized_keys + with_items: + - regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody + pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=" + - regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$" + pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal" + - regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$" + pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank" + +# CLARIF: plus signs (+) in public keys cause duplicate key additions (above) +# and failure during removal (below) as "+" has a special meaning as +# interpreted in a Python regexp, as implemented by Ansible's lineinfile module: +# https://docs.python.org/2/library/re.html + +# WORKAROUND: the tail end of each public key (after the last plus sign) is +# being used (instead of the full key) as an abbreviated regexp for now. +# A backslash in front of each plus sign (+) would also work. + +# - name: Remove those ssh public keys, if not openvpn_enabled +# lineinfile: +# regexp: "{{ item }}" +# path: /root/.ssh/authorized_keys +# state: absent +# with_items: +# - "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" +# - "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$" +# - "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$" +# when: not openvpn_enabled + +- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts' + file: + path: "{{ item }}" + state: directory + with_items: + - /etc/openvpn/keys + - /etc/openvpn/scripts + +- name: Configure OpenVPN (BACKS UP FILES IF CHANGED) + template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: "{{ item.mode }}" + backup: yes + with_items: + - { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' } + - { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' } + - { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' } + - { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' } + - { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' } + - { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' } + - { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' } + - { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' } + - { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' } + - { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' } + +- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install + copy: + src: "{{ iiab_dir }}/iiab-support" + dest: /usr/bin/ + mode: '0755' + +- name: Symlink /usr/bin/iiab-support-on -> /usr/bin/iiab-support + file: + src: /usr/bin/iiab-support + path: /usr/bin/iiab-support-on + state: link + +- name: Symlink /usr/bin/iiab-support-off -> /usr/bin/iiab-remote-off + file: + src: /usr/bin/iiab-remote-off + path: /usr/bin/iiab-support-off + state: link + +- name: Symlink /usr/bin/iiab-vpn-on -> /usr/bin/iiab-remote-on + file: + src: /usr/bin/iiab-remote-on + path: /usr/bin/iiab-vpn-on + state: link + +- name: Symlink /usr/bin/iiab-vpn-off -> /usr/bin/iiab-remote-off + file: + src: /usr/bin/iiab-remote-off + path: /usr/bin/iiab-vpn-off + state: link + + +# RECORD OpenVPN AS INSTALLED + +- name: "Set 'openvpn_installed: True'" + set_fact: + openvpn_installed: True + +- name: "Add 'openvpn_installed: True' to {{ iiab_state_file }}" + lineinfile: + path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml + regexp: '^openvpn_installed' + line: 'openvpn_installed: True' diff --git a/roles/openvpn/tasks/main.yml b/roles/openvpn/tasks/main.yml index c0273eb83..2c880b464 100644 --- a/roles/openvpn/tasks/main.yml +++ b/roles/openvpn/tasks/main.yml @@ -1,213 +1,39 @@ -# TO DO: WRAP 12 OR 13 STANZAS BELOW INTO install.yml, conditioned by... -# 'when: openvpn_installed is undefined' -# -# BEWARE: 4th stanza (ssh pubkey deletions) is already conditioned by... -# 'when: not openvpn_install' (revise?) - -- name: Install OpenVPN and Nmap packages - package: - name: - - openvpn - - nmap - state: present - -# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle -- name: Install Ncat package (if Debian > 9 or Ubuntu > 18) - package: - name: ncat - state: present - when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18) - -- name: Install ssh public keys for remote support (if openvpn_install) - lineinfile: - line: "{{ item.pubkey }}" - regexp: "{{ item.regexp }}" - path: /root/.ssh/authorized_keys - with_items: - - regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody - pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=" - - regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$" - pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal" - - regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$" - pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank" - -# CLARIF: plus signs (+) in public keys cause duplicate key additions (above) -# and failure during removal (below) as "+" has a special meaning as -# interpreted in a Python regexp, as implemented by Ansible's lineinfile module: -# https://docs.python.org/2/library/re.html - -# WORKAROUND: the tail end of each public key (after the last plus sign) is -# being used (instead of the full key) as an abbreviated regexp for now. -# A backslash in front of each plus sign (+) would also work. - -- name: Remove those ssh public keys (if openvpn_install is False) - lineinfile: - regexp: "{{ item }}" - path: /root/.ssh/authorized_keys - state: absent - with_items: - - "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" - - "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$" - - "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$" - when: not openvpn_install - -- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts' - file: - path: "{{ item }}" - state: directory - with_items: - - /etc/openvpn/keys - - /etc/openvpn/scripts - -- name: Configure OpenVPN (BACKS UP FILES IF CHANGED) - template: - src: "{{ item.src }}" - dest: "{{ item.dest }}" - mode: "{{ item.mode }}" - backup: yes - with_items: - - { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' } - - { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' } - - { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' } - - { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' } - - { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' } - - { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' } - - { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' } - - { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' } - - { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' } - - { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' } - -- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install - copy: - src: "{{ iiab_dir }}/iiab-support" - dest: /usr/bin/ - mode: '0755' - -- name: Symlink /usr/bin/iiab-support-on -> /usr/bin/iiab-support - file: - src: /usr/bin/iiab-support - path: /usr/bin/iiab-support-on - state: link - -- name: Symlink /usr/bin/iiab-support-off -> /usr/bin/iiab-remote-off - file: - src: /usr/bin/iiab-remote-off - path: /usr/bin/iiab-support-off - state: link - -- name: Symlink /usr/bin/iiab-vpn-on -> /usr/bin/iiab-remote-on - file: - src: /usr/bin/iiab-remote-on - path: /usr/bin/iiab-vpn-on - state: link - -- name: Symlink /usr/bin/iiab-vpn-off -> /usr/bin/iiab-remote-off - file: - src: /usr/bin/iiab-remote-off - path: /usr/bin/iiab-vpn-off - state: link +# Run 'sudo iiab-support' to turn on OpenVPN without hassle. GENERAL TIPS: +# http://FAQ.IIAB.IO -> "How can I remotely manage my Internet-in-a-Box?" -# RECORD OpenVPN AS INSTALLED +# "How do i fail a task in Ansible if the variable contains a boolean value? +# I want to perform input validation for Ansible playbooks" +# https://stackoverflow.com/questions/46664127/how-do-i-fail-a-task-in-ansible-if-the-variable-contains-a-boolean-value-i-want/46667499#46667499 -- name: "Set 'openvpn_installed: True'" - set_fact: - openvpn_installed: True +# We assume 0-init/tasks/validate_vars.yml has DEFINITELY been run, so no need +# to re-check whether vars are defined here. As Ansible vars cannot be unset: +# https://serverfault.com/questions/856729/how-to-destroy-delete-unset-a-variable-value-in-ansible -- name: "Add 'openvpn_installed: True' to {{ iiab_state_file }}" - lineinfile: - path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml - regexp: '^openvpn_installed' - line: 'openvpn_installed: True' +- name: Assert that "openvpn_install is sameas true" (boolean not string etc) + assert: + that: openvpn_install is sameas true + fail_msg: "PLEASE SET 'openvpn_install: True' e.g. IN: /etc/iiab/local_vars.yml" + quiet: yes + +- name: Assert that "openvpn_enabled | type_debug == 'bool'" (boolean not string etc) + assert: + that: openvpn_enabled | type_debug == 'bool' + fail_msg: "PLEASE GIVE VARIABLE 'openvpn_enabled' A PROPER (UNQUOTED) ANSIBLE BOOLEAN VALUE e.g. IN: /etc/iiab/local_vars.yml" + quiet: yes -# TO DO: WRAP COMMENTS + 4 ACTIVE STANZAS BELOW INTO enable-or-disable.yml... +- name: Install OpenVPN if 'openvpn_installed' not defined, e.g. in {{ iiab_state_file }} # /etc/iiab/iiab_state.yml + include_tasks: install.yml + when: openvpn_installed is undefined -# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not -# been working with systemd service names that contained the "@" character. -#- name: Enable the OpenVPN tunnel at boot time (debuntu) -# shell: systemctl enable openvpn@xscenet.service -# when: openvpn_enabled and not stat.exists is defined and is_debuntu - -#- name: Enable the OpenVPN tunnel at boot time (debuntu) -# shell: update-rc.d openvpn enable -# when: openvpn_enabled and not stat.exists is defined and is_debuntu - -#- name: Start the OpenVPN tunnel now -# shell: systemctl start openvpn@xscenet.service -# when: openvpn_enabled and not stat.exists is defined and not installing - -# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY -# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate -# properly to xscenet.net (monitoring ncat's erroneous handle parameter by -# observing "systemctl status openvpn@xscenet" helped trace the [primary?] -# bug to roles/openvpn/templates/announcer [far better now if not perfect?]) -# Earlier "./runrole openvpn" had to be run twice to transmit -# /etc/iiab/openvpn_handle to xscenet.net -- and -# "systemctl restart openvpn@xscenet" was failing completely (no matter how -# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net - -# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot, -# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079) -# changes most all instances below from CHILD service "openvpn@xscenet" to -# PARENT service "openpvn". See these critical files to understand why: -# -# /etc/default/openvpn implies AUTOSTART="all" -# /etc/init.d/openvpn has AUTOSTART="all" -# /etc/openvpn/xscenet.conf our VPN connection -# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf -# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn -# e.g. when "systemctl enable openvpn" - -- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel) - systemd: - name: openvpn - daemon_reload: yes - enabled: yes - state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead? - when: openvpn_enabled | bool - -- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?) - lineinfile: - path: /etc/crontab - # CONSIDER "restart" not just "start" if something stronger is confirmed needed? - line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null" - when: openvpn_enabled and openvpn_cron_enabled - -- name: Remove hourly cron job for OpenVPN (typically for CentOS only?) - lineinfile: - path: /etc/crontab - regexp: "openvpn@xscenet" - # Potentially DANGEROUS as others use systemctl too: - #regexp: ".*/usr/bin/systemctl*" - state: absent - when: not openvpn_enabled or not openvpn_cron_enabled - -- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel) - systemd: - name: openvpn - enabled: no - state: stopped - when: not openvpn_enabled - -#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu) -# shell: systemctl disable openvpn@xscenet.service -# when: not openvpn_enabled and not is_debuntu - -#- name: Stop starting the OpenVPN tunnel at boot time (debuntu) -# shell: update-rc.d openvpn disable -# when: not openvpn_enabled and is_debuntu - -#- name: Stop OpenVPN tunnel immediately -# shell: systemctl stop openvpn@xscenet.service -# ignore_errors: True -# when: not openvpn_enabled and not installing +- include_tasks: enable-or-disable.yml - name: Add 'openvpn' variable values to {{ iiab_ini_file }} ini_file: - path: "{{ iiab_ini_file }}" + path: "{{ iiab_ini_file }}" # /etc/iiab/iiab.ini section: openvpn option: "{{ item.option }}" value: "{{ item.value | string }}" @@ -216,16 +42,16 @@ value: OpenVPN - option: description value: '"OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections."' - - option: enabled - value: "{{ openvpn_enabled }}" # openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle) - - option: handle + - option: openvpn_handle value: "{{ openvpn_handle }}" - - option: cron_enabled + - option: openvpn_cron_enabled value: "{{ openvpn_cron_enabled }}" - - option: server + - option: openvpn_server value: "{{ openvpn_server }}" - - option: server_virtual_ip + - option: openvpn_server_virtual_ip value: "{{ openvpn_server_virtual_ip }}" - - option: server_port + - option: openvpn_server_port value: "{{ openvpn_server_port }}" + - option: openvpn_enabled + value: "{{ openvpn_enabled }}"