external/iiab
1
0
Fork 0
mirror of https://github.com/iiab/iiab.git synced 2025-02-12 19:22:24 +00:00
Code Issues Releases Wiki Activity

Merge pull request #2257 from holta/openvpn3

Browse source 
Modularize OpenVPN
This commit is contained in:
A Holt 2020-02-16 23:48:12 -05:00 committed by GitHub
commit e59823de3f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 230 additions and 209 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
roles/nginx/README.md
View file

@ -10,7 +10,7 @@
2. Without PHP available via FastCGI, any function at all for PHP-based applications validates NGINX. 2. Without PHP available via FastCGI, any function at all for PHP-based applications validates NGINX.
3. Current state of IIAB App/Service migrations as of 2020-02-16: 3. Current state of IIAB App/Service migrations as of 2020-02-17:
1. These support "Native" NGINX but ***NOT*** Apache 1. These support "Native" NGINX but ***NOT*** Apache
* Admin Console * Admin Console
@ -40,10 +40,10 @@
4. These each run their own web server or non-web / backend services, e.g. off of their own [unique port(s)](https://github.com/iiab/iiab/wiki/IIAB-Networking#list-of-ports--services) (IIAB home pages link directly to these destinations). In future we'd like mnemonic URL's for all of these: (e.g. http://box/calibre, http://box/archive, http://box/kalite) 4. These each run their own web server or non-web / backend services, e.g. off of their own [unique port(s)](https://github.com/iiab/iiab/wiki/IIAB-Networking#list-of-ports--services) (IIAB home pages link directly to these destinations). In future we'd like mnemonic URL's for all of these: (e.g. http://box/calibre, http://box/archive, http://box/kalite)
* calibre (menu goes directly to port 8080) [*] * calibre (menu goes directly to port 8080) [*]
* internetarchive (menu goes directly to port 4244, [PR #2120](https://github.com/iiab/iiab/pull/2120)) * internetarchive (menu goes directly to port 4244, [PR #2120](https://github.com/iiab/iiab/pull/2120)) [*]
* kalite (menu goes directly to ports 8006-8008) [*] * kalite (menu goes directly to ports 8006-8008) [*]
* minetest [*] * minetest [*]
* openvpn [*] * openvpn
* pbx [*] * pbx [*]
[*] The 5 above starred roles could use improvement, as of 2020-02-16. [*] The 5 above starred roles could use improvement, as of 2020-02-17.

80
roles/openvpn/tasks/enable-or-disable.yml Normal file
View file

@ -0,0 +1,80 @@
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
# been working with systemd service names that contained the "@" character.
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
# shell: systemctl enable openvpn@xscenet.service
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
# shell: update-rc.d openvpn enable
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
#- name: Start the OpenVPN tunnel now
# shell: systemctl start openvpn@xscenet.service
# when: openvpn_enabled and not stat.exists is defined and not installing
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
# Earlier "./runrole openvpn" had to be run twice to transmit
# /etc/iiab/openvpn_handle to xscenet.net -- and
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
# changes most all instances below from CHILD service "openvpn@xscenet" to
# PARENT service "openpvn". See these critical files to understand why:
#
# /etc/default/openvpn implies AUTOSTART="all"
# /etc/init.d/openvpn has AUTOSTART="all"
# /etc/openvpn/xscenet.conf our VPN connection
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
# e.g. when "systemctl enable openvpn"
- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel)
systemd:
name: openvpn
daemon_reload: yes
enabled: yes
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
when: openvpn_enabled | bool
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
lineinfile:
path: /etc/crontab
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
when: openvpn_enabled and openvpn_cron_enabled
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
lineinfile:
path: /etc/crontab
regexp: "openvpn@xscenet"
# Potentially DANGEROUS as others use systemctl too:
#regexp: ".*/usr/bin/systemctl*"
state: absent
when: not openvpn_enabled or not openvpn_cron_enabled
- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel)
systemd:
name: openvpn
enabled: no
state: stopped
when: not openvpn_enabled
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
# shell: systemctl disable openvpn@xscenet.service
# when: not openvpn_enabled and not is_debuntu
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
# shell: update-rc.d openvpn disable
# when: not openvpn_enabled and is_debuntu
#- name: Stop OpenVPN tunnel immediately
# shell: systemctl stop openvpn@xscenet.service
# ignore_errors: True
# when: not openvpn_enabled and not installing

115
roles/openvpn/tasks/install.yml Normal file
View file

@ -0,0 +1,115 @@
- name: Install OpenVPN and Nmap packages
package:
name:
- openvpn
- nmap
state: present
# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle
- name: Install Ncat package (if Debian > 9 or Ubuntu > 18)
package:
name: ncat
state: present
when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18)
- name: Install ssh public keys for remote support (if openvpn_install)
lineinfile:
line: "{{ item.pubkey }}"
regexp: "{{ item.regexp }}"
path: /root/.ssh/authorized_keys
with_items:
- regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s="
- regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal"
- regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank"
# CLARIF: plus signs (+) in public keys cause duplicate key additions (above)
# and failure during removal (below) as "+" has a special meaning as
# interpreted in a Python regexp, as implemented by Ansible's lineinfile module:
# https://docs.python.org/2/library/re.html
# WORKAROUND: the tail end of each public key (after the last plus sign) is
# being used (instead of the full key) as an abbreviated regexp for now.
# A backslash in front of each plus sign (+) would also work.
# - name: Remove those ssh public keys, if not openvpn_enabled
# lineinfile:
# regexp: "{{ item }}"
# path: /root/.ssh/authorized_keys
# state: absent
# with_items:
# - "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$"
# - "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
# - "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
# when: not openvpn_enabled
- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts'
file:
path: "{{ item }}"
state: directory
with_items:
- /etc/openvpn/keys
- /etc/openvpn/scripts
- name: Configure OpenVPN (BACKS UP FILES IF CHANGED)
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
backup: yes
with_items:
- { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' }
- { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' }
- { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' }
- { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' }
- { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' }
- { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' }
- { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' }
- { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' }
- { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' }
- { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' }
- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install
copy:
src: "{{ iiab_dir }}/iiab-support"
dest: /usr/bin/
mode: '0755'
- name: Symlink /usr/bin/iiab-support-on -> /usr/bin/iiab-support
file:
src: /usr/bin/iiab-support
path: /usr/bin/iiab-support-on
state: link
- name: Symlink /usr/bin/iiab-support-off -> /usr/bin/iiab-remote-off
file:
src: /usr/bin/iiab-remote-off
path: /usr/bin/iiab-support-off
state: link
- name: Symlink /usr/bin/iiab-vpn-on -> /usr/bin/iiab-remote-on
file:
src: /usr/bin/iiab-remote-on
path: /usr/bin/iiab-vpn-on
state: link
- name: Symlink /usr/bin/iiab-vpn-off -> /usr/bin/iiab-remote-off
file:
src: /usr/bin/iiab-remote-off
path: /usr/bin/iiab-vpn-off
state: link
# RECORD OpenVPN AS INSTALLED
- name: "Set 'openvpn_installed: True'"
set_fact:
openvpn_installed: True
- name: "Add 'openvpn_installed: True' to {{ iiab_state_file }}"
lineinfile:
path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml
regexp: '^openvpn_installed'
line: 'openvpn_installed: True'

236
roles/openvpn/tasks/main.yml
View file

@ -1,213 +1,39 @@
# TO DO: WRAP 12 OR 13 STANZAS BELOW INTO install.yml, conditioned by... # Run 'sudo iiab-support' to turn on OpenVPN without hassle. GENERAL TIPS:
# 'when: openvpn_installed is undefined' # http://FAQ.IIAB.IO -> "How can I remotely manage my Internet-in-a-Box?"
#
# BEWARE: 4th stanza (ssh pubkey deletions) is already conditioned by...
# 'when: not openvpn_install' (revise?)
- name: Install OpenVPN and Nmap packages
package:
name:
- openvpn
- nmap
state: present
# Newer versions of NMap do not include NCat, needed to announce /etc/iiab/openvpn_handle
- name: Install Ncat package (if Debian > 9 or Ubuntu > 18)
package:
name: ncat
state: present
when: is_debuntu and not (is_debian_8 or is_debian_9 or is_ubuntu_16 or is_ubuntu_17 or is_ubuntu_18)
- name: Install ssh public keys for remote support (if openvpn_install)
lineinfile:
line: "{{ item.pubkey }}"
regexp: "{{ item.regexp }}"
path: /root/.ssh/authorized_keys
with_items:
- regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s="
- regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal"
- regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank"
# CLARIF: plus signs (+) in public keys cause duplicate key additions (above)
# and failure during removal (below) as "+" has a special meaning as
# interpreted in a Python regexp, as implemented by Ansible's lineinfile module:
# https://docs.python.org/2/library/re.html
# WORKAROUND: the tail end of each public key (after the last plus sign) is
# being used (instead of the full key) as an abbreviated regexp for now.
# A backslash in front of each plus sign (+) would also work.
- name: Remove those ssh public keys (if openvpn_install is False)
lineinfile:
regexp: "{{ item }}"
path: /root/.ssh/authorized_keys
state: absent
with_items:
- "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$"
- "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
- "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
when: not openvpn_install
- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts'
file:
path: "{{ item }}"
state: directory
with_items:
- /etc/openvpn/keys
- /etc/openvpn/scripts
- name: Configure OpenVPN (BACKS UP FILES IF CHANGED)
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
backup: yes
with_items:
- { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' }
- { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' }
- { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' }
- { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' }
- { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' }
- { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' }
- { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' }
- { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' }
- { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' }
- { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' }
- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install
copy:
src: "{{ iiab_dir }}/iiab-support"
dest: /usr/bin/
mode: '0755'
- name: Symlink /usr/bin/iiab-support-on -> /usr/bin/iiab-support
file:
src: /usr/bin/iiab-support
path: /usr/bin/iiab-support-on
state: link
- name: Symlink /usr/bin/iiab-support-off -> /usr/bin/iiab-remote-off
file:
src: /usr/bin/iiab-remote-off
path: /usr/bin/iiab-support-off
state: link
- name: Symlink /usr/bin/iiab-vpn-on -> /usr/bin/iiab-remote-on
file:
src: /usr/bin/iiab-remote-on
path: /usr/bin/iiab-vpn-on
state: link
- name: Symlink /usr/bin/iiab-vpn-off -> /usr/bin/iiab-remote-off
file:
src: /usr/bin/iiab-remote-off
path: /usr/bin/iiab-vpn-off
state: link
# RECORD OpenVPN AS INSTALLED # "How do i fail a task in Ansible if the variable contains a boolean value?
# I want to perform input validation for Ansible playbooks"
# https://stackoverflow.com/questions/46664127/how-do-i-fail-a-task-in-ansible-if-the-variable-contains-a-boolean-value-i-want/46667499#46667499
- name: "Set 'openvpn_installed: True'" # We assume 0-init/tasks/validate_vars.yml has DEFINITELY been run, so no need
set_fact: # to re-check whether vars are defined here. As Ansible vars cannot be unset:
openvpn_installed: True # https://serverfault.com/questions/856729/how-to-destroy-delete-unset-a-variable-value-in-ansible
- name: "Add 'openvpn_installed: True' to {{ iiab_state_file }}" - name: Assert that "openvpn_install is sameas true" (boolean not string etc)
lineinfile: assert:
path: "{{ iiab_state_file }}" # /etc/iiab/iiab_state.yml that: openvpn_install is sameas true
regexp: '^openvpn_installed' fail_msg: "PLEASE SET 'openvpn_install: True' e.g. IN: /etc/iiab/local_vars.yml"
line: 'openvpn_installed: True' quiet: yes
- name: Assert that "openvpn_enabled | type_debug == 'bool'" (boolean not string etc)
assert:
that: openvpn_enabled | type_debug == 'bool'
fail_msg: "PLEASE GIVE VARIABLE 'openvpn_enabled' A PROPER (UNQUOTED) ANSIBLE BOOLEAN VALUE e.g. IN: /etc/iiab/local_vars.yml"
quiet: yes
# TO DO: WRAP COMMENTS + 4 ACTIVE STANZAS BELOW INTO enable-or-disable.yml... - name: Install OpenVPN if 'openvpn_installed' not defined, e.g. in {{ iiab_state_file }} # /etc/iiab/iiab_state.yml
include_tasks: install.yml
when: openvpn_installed is undefined
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
# been working with systemd service names that contained the "@" character.
#- name: Enable the OpenVPN tunnel at boot time (debuntu) - include_tasks: enable-or-disable.yml
# shell: systemctl enable openvpn@xscenet.service
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
# shell: update-rc.d openvpn enable
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
#- name: Start the OpenVPN tunnel now
# shell: systemctl start openvpn@xscenet.service
# when: openvpn_enabled and not stat.exists is defined and not installing
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
# Earlier "./runrole openvpn" had to be run twice to transmit
# /etc/iiab/openvpn_handle to xscenet.net -- and
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
# changes most all instances below from CHILD service "openvpn@xscenet" to
# PARENT service "openpvn". See these critical files to understand why:
#
# /etc/default/openvpn implies AUTOSTART="all"
# /etc/init.d/openvpn has AUTOSTART="all"
# /etc/openvpn/xscenet.conf our VPN connection
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
# e.g. when "systemctl enable openvpn"
- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel)
systemd:
name: openvpn
daemon_reload: yes
enabled: yes
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
when: openvpn_enabled | bool
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
lineinfile:
path: /etc/crontab
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
when: openvpn_enabled and openvpn_cron_enabled
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
lineinfile:
path: /etc/crontab
regexp: "openvpn@xscenet"
# Potentially DANGEROUS as others use systemctl too:
#regexp: ".*/usr/bin/systemctl*"
state: absent
when: not openvpn_enabled or not openvpn_cron_enabled
- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel)
systemd:
name: openvpn
enabled: no
state: stopped
when: not openvpn_enabled
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
# shell: systemctl disable openvpn@xscenet.service
# when: not openvpn_enabled and not is_debuntu
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
# shell: update-rc.d openvpn disable
# when: not openvpn_enabled and is_debuntu
#- name: Stop OpenVPN tunnel immediately
# shell: systemctl stop openvpn@xscenet.service
# ignore_errors: True
# when: not openvpn_enabled and not installing
- name: Add 'openvpn' variable values to {{ iiab_ini_file }} - name: Add 'openvpn' variable values to {{ iiab_ini_file }}
ini_file: ini_file:
path: "{{ iiab_ini_file }}" path: "{{ iiab_ini_file }}" # /etc/iiab/iiab.ini
section: openvpn section: openvpn
option: "{{ item.option }}" option: "{{ item.option }}"
value: "{{ item.value | string }}" value: "{{ item.value | string }}"
@ -216,16 +42,16 @@
value: OpenVPN value: OpenVPN
- option: description - option: description
value: '"OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections."' value: '"OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections."'
- option: enabled
value: "{{ openvpn_enabled }}"
# openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle) # openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle)
- option: handle - option: openvpn_handle
value: "{{ openvpn_handle }}" value: "{{ openvpn_handle }}"
- option: cron_enabled - option: openvpn_cron_enabled
value: "{{ openvpn_cron_enabled }}" value: "{{ openvpn_cron_enabled }}"
- option: server - option: openvpn_server
value: "{{ openvpn_server }}" value: "{{ openvpn_server }}"
- option: server_virtual_ip - option: openvpn_server_virtual_ip
value: "{{ openvpn_server_virtual_ip }}" value: "{{ openvpn_server_virtual_ip }}"
- option: server_port - option: openvpn_server_port
value: "{{ openvpn_server_port }}" value: "{{ openvpn_server_port }}"
- option: openvpn_enabled
value: "{{ openvpn_enabled }}"