add nginx, sshd, ssl roles

roles/easy-rsa/tasks/client-certs.yml

@@ -0,0 +1,18 @@
+---
+- name: ensure local output directory exists
+  ansible.builtin.file:
+    path: "{{ openvpn_client_bundle_dir }}/{{ item.0.name }}"
+    state: directory
+    mode: '0700'
+  loop: "{{ openvpn_instances | subelements('clients') }}"
+  delegate_to: localhost
+  become: false
+
+- name: render standalone client bundles
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/client-certs/{{ item.0.name }}.conf.j2"
+    dest: "{{ openvpn_client_bundle_dir }}/{{ item.0.name }}/{{ item.1.name }}.ovpn"
+    mode: '0600'
+  loop: "{{ openvpn_instances | subelements('clients') }}"
+  delegate_to: localhost
+  become: false

roles/easy-rsa/tasks/configure.yml

@@ -0,0 +1,82 @@
+---
+- name: prepare list of client certificates
+  ansible.builtin.set_fact:
+    cert_list: "{{ cert_list | default([]) + [ {'instance': item.0.name, 'pki_dir': item.0.pki_dir, 'client': item.1} ] }}"
+  loop: "{{ openvpn_instances | subelements('clients') }}"
+
+- name: ensure local PKI directories exist
+  ansible.builtin.file:
+    path: "{{ item.pki_dir }}"
+    state: directory
+    mode: '0700'
+  loop: "{{ openvpn_instances }}"
+
+- name: init pki if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch init-pki
+    creates: "{{ item.pki_dir }}/private"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: build ca if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch build-ca nopass
+    creates: "{{ item.pki_dir }}/ca.crt"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+    EASYRSA_REQ_CN: "CA-{{ item.name }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: build server cert if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch build-server-full server nopass
+    creates: "{{ item.pki_dir }}/issued/server.crt"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: generate dh params if missing
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa gen-dh
+    creates: "{{ item.pki_dir }}/dh.pem"
+  environment:
+    EASYRSA_PKI: "{{ item.pki_dir }}"
+  loop: "{{ openvpn_instances }}"
+
+- name: check client certificates validity
+  ansible.builtin.command:
+    cmd: "openssl x509 -checkend 2592000 -in {{ item.pki_dir }}/issued/{{ item.client.name }}.crt"
+  register: cert_check
+  failed_when: false
+  changed_when: false
+  loop: "{{ cert_list }}"
+
+- name: remove old cert file before reissue
+  ansible.builtin.file:
+    path: "{{ item.item.pki_dir }}/issued/{{ item.item.client.name }}.crt"
+    state: absent
+  loop: "{{ cert_check.results }}"
+  when: item.rc != 0
+
+- name: remove old req file before reissue
+  ansible.builtin.file:
+    path: "{{ item.item.pki_dir }}/reqs/{{ item.item.client.name }}.req"
+    state: absent
+  loop: "{{ cert_check.results }}"
+  when: item.rc != 0
+
+- name: remove old key file before reissue
+  ansible.builtin.file:
+    path: "{{ item.item.pki_dir }}/private/{{ item.item.client.name }}.key"
+    state: absent
+  loop: "{{ cert_check.results }}"
+  when: item.rc != 0
+
+- name: issue or renew client certificates
+  ansible.builtin.command:
+    cmd: /opt/easy-rsa/easyrsa --batch build-client-full "{{ item.item.client.name }}" nopass
+  environment:
+    EASYRSA_PKI: "{{ item.item.pki_dir }}"
+  when: item.rc != 0
+  loop: "{{ cert_check.results }}"

roles/easy-rsa/tasks/install.yml

@@ -0,0 +1,35 @@
+---
+- name: get latest easy-rsa release info
+  ansible.builtin.uri:
+    url: https://api.github.com/repos/OpenVPN/easy-rsa/releases/latest
+    return_content: true
+  register: easyrsa_release
+  run_once: true
+  check_mode: false
+
+- name: set current easy-rsa version
+  ansible.builtin.set_fact:
+    easyrsa_version: "{{ easyrsa_release.json.tag_name | replace('v', '') }}"
+    easyrsa_asset_url: "{{ easyrsa_release.json.assets | selectattr('name', 'search', 'EasyRSA.*\\.tgz') | map(attribute='browser_download_url') | first }}"
+
+- name: check easy-rsa installed version
+  ansible.builtin.command: /opt/easy-rsa/easyrsa version
+  register: easyrsa_current_version
+  changed_when: false
+  failed_when: false
+
+- name: ensure easy-rsa directory exists
+  ansible.builtin.file:
+    path: /opt/easy-rsa
+    state: directory
+    mode: '0755'
+  check_mode: false
+
+- name: update easy-rsa
+  ansible.builtin.unarchive:
+    src: "{{ easyrsa_asset_url }}"
+    dest: /opt/easy-rsa
+    remote_src: true
+    extra_opts:
+      - --strip-components=1
+  when: easyrsa_version not in (easyrsa_current_version.stdout | default(''))

roles/easy-rsa/tasks/main.yml

@@ -0,0 +1,9 @@
+---
+- name: include install
+  ansible.builtin.include_tasks: install.yml
+
+- name: include configure
+  ansible.builtin.include_tasks: configure.yml
+
+- name: include client-certs.yml
+  ansible.builtin.include_tasks: client-certs.yml