mirror of
https://github.com/iiab/iiab.git
synced 2025-03-09 15:40:17 +00:00
80 lines
3.7 KiB
YAML
80 lines
3.7 KiB
YAML
# FIXED SOMETIME PRIOR TO AUGUST 2018: earlier versions of Ansible had not
|
|
# been working with systemd service names that contained the "@" character.
|
|
|
|
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
|
# shell: systemctl enable openvpn@xscenet.service
|
|
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
|
|
|
#- name: Enable the OpenVPN tunnel at boot time (debuntu)
|
|
# shell: update-rc.d openvpn enable
|
|
# when: openvpn_enabled and not stat.exists is defined and is_debuntu
|
|
|
|
#- name: Start the OpenVPN tunnel now
|
|
# shell: systemctl start openvpn@xscenet.service
|
|
# when: openvpn_enabled and not stat.exists is defined and not installing
|
|
|
|
# AUGUST 2018: Unexplainably, stanza below had to be placed underneath ANY
|
|
# "lineinfile: ... state: absent" stanza to make openvpn_handle propagate
|
|
# properly to xscenet.net (monitoring ncat's erroneous handle parameter by
|
|
# observing "systemctl status openvpn@xscenet" helped trace the [primary?]
|
|
# bug to roles/openvpn/templates/announcer [far better now if not perfect?])
|
|
# Earlier "./runrole openvpn" had to be run twice to transmit
|
|
# /etc/iiab/openvpn_handle to xscenet.net -- and
|
|
# "systemctl restart openvpn@xscenet" was failing completely (no matter how
|
|
# many times it was run) to transmit /etc/iiab/openvpn_handle to xscenet.net
|
|
|
|
# 2018-09-02: OpenVPN had been starting tunnels by accident after reboot,
|
|
# with new IIAB installs. Fix below (https://github.com/iiab/iiab/pull/1079)
|
|
# changes most all instances below from CHILD service "openvpn@xscenet" to
|
|
# PARENT service "openpvn". See these critical files to understand why:
|
|
#
|
|
# /etc/default/openvpn implies AUTOSTART="all"
|
|
# /etc/init.d/openvpn has AUTOSTART="all"
|
|
# /etc/openvpn/xscenet.conf our VPN connection
|
|
# /etc/network/if-up.d/openvpn appears to auto-start xscenet.conf
|
|
# /lib/systemd/systemd-sysv-install sets /etc/rc*.d/S|K01openvpn
|
|
# e.g. when "systemctl enable openvpn"
|
|
|
|
- name: Enable & (Re)Start PARENT 'openvpn' system service, which (re)starts CHILD service 'openvpn@xscenet' (& actual tunnel)
|
|
systemd:
|
|
name: openvpn
|
|
daemon_reload: yes
|
|
enabled: yes
|
|
state: restarted # 2018-09-02: Should we be concerned that "systemctl status openvpn" often shows "active (exited)" ? If so we might consider "state: started" or "state: reloaded" instead?
|
|
when: openvpn_enabled
|
|
|
|
- name: Enable hourly cron job for OpenVPN (starts CHILD service openvpn@xscenet, typically for CentOS only?)
|
|
lineinfile:
|
|
path: /etc/crontab
|
|
# CONSIDER "restart" not just "start" if something stronger is confirmed needed?
|
|
line: "25 * * * * root (/usr/bin/systemctl start openvpn@xscenet.service) > /dev/null"
|
|
when: openvpn_enabled and openvpn_cron_enabled
|
|
|
|
- name: Remove hourly cron job for OpenVPN (typically for CentOS only?)
|
|
lineinfile:
|
|
path: /etc/crontab
|
|
regexp: "openvpn@xscenet"
|
|
# Potentially DANGEROUS as others use systemctl too:
|
|
#regexp: ".*/usr/bin/systemctl*"
|
|
state: absent
|
|
when: not openvpn_enabled or not openvpn_cron_enabled
|
|
|
|
- name: Disable & Stop PARENT 'openvpn' system service, which stops CHILD service 'openvpn@xscenet' (& actual tunnel)
|
|
systemd:
|
|
name: openvpn
|
|
enabled: no
|
|
state: stopped
|
|
when: not openvpn_enabled
|
|
|
|
#- name: Stop starting the OpenVPN tunnel at boot time (not debuntu)
|
|
# shell: systemctl disable openvpn@xscenet.service
|
|
# when: not openvpn_enabled and not is_debuntu
|
|
|
|
#- name: Stop starting the OpenVPN tunnel at boot time (debuntu)
|
|
# shell: update-rc.d openvpn disable
|
|
# when: not openvpn_enabled and is_debuntu
|
|
|
|
#- name: Stop OpenVPN tunnel immediately
|
|
# shell: systemctl stop openvpn@xscenet.service
|
|
# ignore_errors: True
|
|
# when: not openvpn_enabled and not installing
|