external/iiab
1
0
Fork 0
mirror of https://github.com/iiab/iiab.git synced 2025-02-13 19:52:06 +00:00
Code Issues Releases Wiki Activity
iiab/roles/openvpn/tasks/main.yml
A Holt 801080bfb5
Update main.yml
2019-10-09 12:34:08 -04:00

224 lines
9.6 KiB
YAML
Raw Blame History

- name: Install OpenVPN and Nmap packages
package:
name:
- openvpn
- nmap
state: present
tags:
- download
- name: Install Ncat package
package:
name:
- ncat
state: present
when: need_ncat | bool
tags:
- download
- name: Install ssh public keys for remote support (if openvpn_install)
lineinfile:
line: "{{ item.pubkey }}"
regexp: "{{ item.regexp }}"
path: /root/.ssh/authorized_keys
#backup: yes
when: openvpn_install | bool
with_items:
- regexp: "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$" # Tim Moody
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhlQIh8ZPx4awdM0O6QNcPbx3qIZ39FHjF2YJ2SX3z7iLnYiz03Ek6Bux9P4HvaVAqlApiz2I68Vq8TfU2s/+LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s="
- regexp: "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxAmjU7VojyK+0Pjp2p8CCGTNBtE565A/L8IVbAT8MIucRE9LN1g5LjGnOHUShFJpwuTR1JLX2r9EDRMsf9MmyTgUAnuyP005giWVHXLPtjyjTzbsJ1DEtXRytulmF+GlCOaqPWNde6EOmReqPHbmjIQpRZ/Sc8hziS4jVSQuBA9EhaBmZ62CPqK33mPJvnpwMtdd6nHXAcXsZhStd3NhVDm27+B3sHI6mr2w7ExdBXE5DKiZL2po8n2y4hJYZreJopbjcQmv4oWdDWvPu5I92xDgYCsqcE7zSrv1um+tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal"
- regexp: "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
pubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApHPly+EA1M4bispl3AulTLjyYCjcJzh6s779K3epDkqh600a+fHsdIiddWCAfIonRq+9MJyOiaNQ+WYLOuajI1IiFZWFt45xDAiyCUnyuT+ytAX+IA3TgTwgTZPfzDOzI8rDRV9Sgl+LZLfPno7T3qxcGx2l51bRk+koRK+Txpph//M3jGvsFmTKhjvfxgEIUmMH9SkASxEdyqASr0+/+uLR92MnT+8CT1pOYYoJyZp9Lta5eGqJvbEmd3Dn7MXqD3vXE57o4rBJ0bR3q5LK59WVNxNQbulJ9z5V7aTJ4AbBFQWxm0fH0gBx+heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank"
# CLARIF: plus signs (+) in public keys cause duplicate key additions (above)
# and failure during removal (below) as "+" has a special meaning as
# interpreted in a Python regexp, as implemented by Ansible's lineinfile module:
# https://docs.python.org/2/library/re.html
# WORKAROUND: the tail end of each public key (after the last plus sign) is
# being used (instead of the full key) as an abbreviated regexp for now.
# A backslash in front of each plus sign (+) would also work.
- name: Remove those ssh public keys (if openvpn_install is False)
lineinfile:
regexp: "{{ item }}"
path: /root/.ssh/authorized_keys
state: absent
#backup: yes
when: not openvpn_install
with_items:
- "LvCSAAcfYIdZPR4ePVpVUZ/IbkGjpQSoRMa5HuVjMO3cZNR27ptqjNjq2husJOyhMFCOBTzo4thioGyTpBr4u3s=$"
- "tUM4hl009fbXY4Yy3bAadWL1CquVrZmKfBBWhyhz8zLD6TQ== ghunt@ip-192-168-123-123.ec2.internal$"
- "heOMXXNU6skxdPh2fcHh0bzQcaCSQ== holt@crank$"
- name: 'Create dirs: /etc/openvpn/keys, /etc/openvpn/scripts'
file:
path: "{{ item }}"
state: directory
owner: root
group: root
mode: 0755
with_items:
- /etc/openvpn/keys
- /etc/openvpn/scripts
- name: Configure OpenVPN (BACKS UP FILES IF CHANGED)
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: root
group: root
mode: "{{ item.mode }}"
backup: yes
with_items:
- { src: 'ca.crt', dest: '/etc/openvpn/keys/ca.crt', mode: '0644' }
- { src: 'client1.crt', dest: '/etc/openvpn/keys/client1.crt', mode: '0644' }
- { src: 'client1.key', dest: '/etc/openvpn/keys/client1.key', mode: '0600' }
- { src: 'announce', dest: '/etc/openvpn/scripts/announce', mode: '0755' }
- { src: 'announcer.j2', dest: '/etc/openvpn/scripts/announcer', mode: '0755' }
- { src: 'silence', dest: '/etc/openvpn/scripts/silence', mode: '0755' }
- { src: 'xscenet.conf.j2', dest: '/etc/openvpn/xscenet.conf', mode: '0644' }
- { src: 'openvpn_handle.j2', dest: '/etc/iiab/openvpn_handle', mode: '0644' }
- { src: 'iiab-remote-on.j2', dest: '/usr/bin/iiab-remote-on', mode: '0755' }
- { src: 'iiab-remote-off', dest: '/usr/bin/iiab-remote-off', mode: '0755' }
# 2019-10-09: Not recommended for over a year & no longer in use
# - { src: 'iiab-handle.j2', dest: '/usr/bin/iiab-handle', mode: '0755' }
- name: Copy /opt/iiab/iiab/iiab-support to /usr/bin/iiab-support, in case git tree deleted e.g. on a smaller IIAB install
copy:
src: "{{ iiab_dir }}/iiab-support"
path: /usr/bin/
mode: 0755
- name: Create iiab-support-on (symlink to iiab-support for now)
file:
src: /usr/bin/iiab-support
path: /usr/bin/iiab-support-on
state: link
- name: Create iiab-support-off (symlink to iiab-remote-off for now)
file:
src: /usr/bin/iiab-remote-off
path: /usr/bin/iiab-support-off
state: link
- name: Create iiab-vpn-on (symlink to iiab-remote-on for now)
file:
src: /usr/bin/iiab-remote-on
path: /usr/bin/iiab-vpn-on
state: link
- name: Create iiab-vpn-off (symlink to iiab-remote-off for now)
file:
src: /usr/bin/iiab-remote-off
path: /usr/bin/iiab-vpn-off
state: link
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
# been working with systemd service names that contained the "@" character.
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
# shell: systemctl enable openvpn@xscenet.service
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
# shell: update-rc.d openvpn enable
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
#- name: Start the OpenVPN tunnel now
# shell: systemctl start openvpn@xscenet.service
# when: openvpn_enabled and not stat.exists is defined and not installing
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
# Earlier "./runrole openvpn" had to be run twice to transmit
# /etc/iiab/openvpn_handle to xscenet.net -- and
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
# changes most all instances below from CHILD service "openvpn@xscenet" to
# PARENT service "openpvn". See these critical files to understand why:
#
# /etc/default/openvpn implies AUTOSTART="all"
# /etc/init.d/openvpn has AUTOSTART="all"
# /etc/openvpn/xscenet.conf our VPN connection
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
# e.g. when "systemctl enable openvpn"
- name: Enable & (Re)Start PARENT service openvpn, which (re)starts CHILD service openvpn@xscenet (& actual tunnel)
systemd:
name: openvpn
daemon_reload: yes
enabled: yes
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
when: openvpn_enabled | bool
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
lineinfile:
path: /etc/crontab
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
when: openvpn_enabled and openvpn_cron_enabled
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
lineinfile:
path: /etc/crontab
regexp: "openvpn@xscenet"
# Potentially DANGEROUS as others use systemctl too:
#regexp: ".*/usr/bin/systemctl*"
state: absent
when: not openvpn_enabled or not openvpn_cron_enabled
- name: Disable & Stop PARENT service openvpn, which stops CHILD service openvpn@xscenet (& actual tunnel)
systemd:
name: openvpn
enabled: no
state: stopped
when: not openvpn_enabled
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
# shell: systemctl disable openvpn@xscenet.service
# when: not openvpn_enabled and not is_debuntu
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
# shell: update-rc.d openvpn disable
# when: not openvpn_enabled and is_debuntu
#- name: Stop OpenVPN tunnel immediately
# shell: systemctl stop openvpn@xscenet.service
# ignore_errors: True
# when: not openvpn_enabled and not installing
- name: Add 'openvpn' variable values to {{ iiab_ini_file }}
ini_file:
path: "{{ iiab_ini_file }}"
section: openvpn
option: "{{ item.option }}"
value: "{{ item.value }}"
with_items:
- option: name
value: OpenVPN
- option: description
value: "OpenVPN enables live/remote support by connecting machines anywhere on the Internet, via a middleman server, using Virtual Private Network (VPN) techniques to create secure connections."
- option: enabled
value: "{{ openvpn_enabled }}"
# openvpn_handle variable can no longer be left completely undefined of August 2018 (EMPTY STRING "" IS TOLERATED, in which case OpenVPN server should use /etc/iiab/uuid in lieu of the handle)
- option: handle
value: "{{ openvpn_handle }}"
- option: cron_enabled
value: "{{ openvpn_cron_enabled }}"
- option: server
value: "{{ openvpn_server }}"
- option: server_virtual_ip
value: "{{ openvpn_server_virtual_ip }}"
- option: server_port
value: "{{ openvpn_server_port }}"
Reference in a new issue View git blame Copy permalink