pyrschtjag/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add nginx, sshd, ssl roles

Browse Source
This commit is contained in:
pyrschtjag
2026-09-20 22:14:56 +00:00
parent ba9e1a664f
commit c640406c10
131 changed files with 1535 additions and 780 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/openvpn/files/liqueur/ccd/liqueur/matr10
+1
View File
@@ -0,0 +1 @@
iroute 192.168.1.0 255.255.255.0
roles/openvpn/files/liqueur/ccd/liqueur/mur89
+7
View File
@@ -0,0 +1,7 @@
iroute 10.1.0.0 255.255.255.0
iroute 10.2.0.0 255.255.255.0
iroute 10.3.0.0 255.255.255.0
iroute 10.4.0.0 255.255.255.0
iroute 10.10.0.0 255.255.255.0
iroute 10.11.0.0 255.255.255.0
iroute 10.12.0.0 255.255.255.0
roles/openvpn/tasks/configure-client.yml
+19
View File
@@ -0,0 +1,19 @@
---
- name: render openvpn client config
ansible.builtin.template:
src: "{{ item }}"
dest: "/etc/openvpn/{{ item | basename | regex_replace('\\.j2$', '') }}"
owner: root
group: root
mode: '0600'
loop: "{{ query('fileglob', role_path + '/templates/' + inventory_hostname + '/*.conf.j2') }}"
register: openvpn_client_configs
- name: restart openvpn client
ansible.builtin.systemd_service:
name: "openvpn@{{ item.item | basename | regex_replace('\\.conf\\.j2$', '') }}"
state: restarted
enabled: true
daemon_reload: true
loop: "{{ openvpn_client_configs.results }}"
when: item.changed
roles/openvpn/tasks/configure-server.yml
+27
View File
@@ -0,0 +1,27 @@
---
- name: deploy ccd files
ansible.builtin.copy:
src: "{{ role_path }}/files/{{ inventory_hostname }}/ccd/"
dest: /etc/openvpn/ccd/
owner: root
group: root
mode: '0644'
- name: render openvpn config
ansible.builtin.template:
src: "{{ item }}"
dest: "/etc/openvpn/{{ item | basename | regex_replace('\\.j2$', '') }}"
owner: root
group: root
mode: '0600'
loop: "{{ query('ansible.builtin.fileglob', role_path + '/templates/' + inventory_hostname + '/*.conf.j2') }}"
register: openvpn_configs
- name: restart openvpn
ansible.builtin.systemd_service:
name: "openvpn@{{ item.item | basename | regex_replace('\\.conf\\.j2$', '') }}"
state: restarted
enabled: true
daemon_reload: true
loop: "{{ openvpn_configs.results }}"
when: item.changed
roles/openvpn/tasks/install.yml
+6
View File
@@ -0,0 +1,6 @@
---
- name: install openvpn
ansible.builtin.apt:
name: openvpn
state: latest
update_cache: true
roles/openvpn/tasks/main.yml
+11
View File
@@ -0,0 +1,11 @@
---
- name: include install
ansible.builtin.include_tasks: install.yml
- name: include server configuration
ansible.builtin.include_tasks: configure-server.yml
when: openvpn_role == 'server'
- name: include client configuration
ansible.builtin.include_tasks: configure-client.yml
when: openvpn_role == 'client'
roles/openvpn/templates/liqueur/absinthe.conf.j2
+27
View File
@@ -0,0 +1,27 @@
port 1195
proto tcp
dev tap0
dev-type tap
server-bridge nogw
client-to-client
keepalive 10 60
cipher AES-256-GCM
auth SHA256
persist-key
persist-tun
status openvpn-tap0-status.log
verb 6
tun-mtu 1500
mssfix 1300
<ca>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/ca.crt') }}
</ca>
<cert>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/issued/server.crt') }}
</cert>
<key>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/private/server.key') }}
</key>
<dh>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/dh.pem') }}
</dh>
roles/openvpn/templates/liqueur/liqueur.conf.j2
+44
View File
@@ -0,0 +1,44 @@
port 1194
proto tcp
dev tun0
server 172.168.0.0 255.255.255.0
topology subnet
ifconfig-pool-persist ipp.txt
route 10.1.0.0 255.255.255.0
route 10.2.0.0 255.255.255.0
route 10.3.0.0 255.255.255.0
route 10.4.0.0 255.255.255.0
route 10.10.0.0 255.255.255.0
route 10.11.0.0 255.255.255.0
route 10.12.0.0 255.255.255.0
route 192.168.1.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "route 10.1.0.0 255.255.255.0"
push "route 10.2.0.0 255.255.255.0"
push "route 10.3.0.0 255.255.255.0"
push "route 10.4.0.0 255.255.255.0"
push "route 10.10.0.0 255.255.255.0"
push "route 10.11.0.0 255.255.255.0"
push "route 10.12.0.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd/liqueur
keepalive 10 60
cipher AES-256-GCM
auth SHA256
persist-key
persist-tun
status openvpn-status.log
verb 3
tun-mtu 1500
mssfix 1300
<ca>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/ca.crt') }}
</ca>
<cert>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/issued/server.crt') }}
</cert>
<key>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/private/server.key') }}
</key>
<dh>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/dh.pem') }}
</dh>
roles/openvpn/templates/router/ltrefilov.conf.j2
+24
View File
@@ -0,0 +1,24 @@
client
dev tap0
dev-type tap
proto tcp
remote 127.0.0.1 1195
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-256-GCM
tun-mtu 1500
mssfix 1300
verb 3
<ca>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/ca.crt') }}
</ca>
<cert>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/issued/ltrefilov.crt') }}
</cert>
<key>
{{ lookup('file', '/etc/easy-rsa/pki/tap0/private/ltrefilov.key') }}
</key>
roles/openvpn/templates/router/mur89.conf.j2
+21
View File
@@ -0,0 +1,21 @@
client
dev tun0
proto tcp
remote 127.0.0.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-256-GCM
verb 3
<ca>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/ca.crt') }}
</ca>
<cert>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/issued/mur89.crt') }}
</cert>
<key>
{{ lookup('file', '/etc/easy-rsa/pki/tun0/private/mur89.key') }}
</key>