main.yml

---
- name: Add the official OpenVPN APT key
  apt_key:
    id: E158C569
    data: "{{ item }}"
  with_file: openvpn_signing.key

- name: Add the official OpenVPN repository
  apt_repository:
    repo: 'deb https://build.openvpn.net/debian/openvpn/stable {{ ansible_lsb.codename }} main'
    state: present

- name: Install OpenVPN and its dependencies from APT
  apt:
    name: "{{ item }}"
  with_items:
    - openvpn
    - udev

- name: Generate RSA keys for the CA and Server
  command: openssl genrsa -out {{ item }}.key {{ openvpn_key_size }}
  args:
    chdir: "{{ openvpn_path }}"
    creates: "{{ item }}.key"
  with_items:
    - ca
    - server

- name: Create directories for clients
  file:
    path: "{{ openvpn_path}}/{{ item }}"
    state: directory
  with_items: "{{ openvpn_clients }}"

- name: Generate RSA keys for the clients
  command: openssl genrsa -out client.key {{ openvpn_key_size }}
  args:
    chdir: "{{ openvpn_path }}/{{ item }}"
    creates: client.key
  with_items: "{{ openvpn_clients }}"

- name: Set the proper permissions on all RSA keys
  file:
    path: "{{ openvpn_path }}"
    recurse: yes
    state: directory
    owner: root
    group: root
    mode: 0600

- name: Generate CA certificate
  command: openssl req -nodes -batch -new -x509 -key {{ openvpn_ca }}.key -out {{ openvpn_ca }}.crt -days {{ openvpn_days_valid }} -subj "{{ openvpn_request_subject }}/CN=ca-certificate"
  args:
    creates: "{{ openvpn_ca }}.crt"

- name: Generate a random server common name
  shell: grep -v -P "[\x80-\xFF]" /usr/share/dict/american-english-huge | sed -e "s/'//" | shuf -n 2 | xargs | sed -e 's/ /./g' | cut -c 1-64 > {{ openvpn_server_common_name_file }}
  args:
    creates: "{{ openvpn_server_common_name_file }}"

- name: Set permissions on the OpenVPN server common name file
  file:
    path: "{{ openvpn_server_common_name_file }}"
    owner: root
    group: root
    mode: 0600

- name: Register the OpenVPN server common name
  command: cat {{ openvpn_server_common_name_file }}
  register: openvpn_server_common_name

- name: Generate the OpenSSL configuration that will be used for the Server certificate's req and ca commands
  # Properly sets the attributes that are described here:
  # https://openvpn.net/index.php/open-source/documentation/howto.html#mitm
  #
  # This is required for the 'remote-cert-tls server|client' option to
  # work, which is a recommended practice to help mitigate MITM attacks
  template:
    src: openssl-certificate.cnf.j2
    dest: "{{ openvpn_path }}/openssl-certificate.cnf"

- name: Seed a blank database file that will be used when generating the Server's certificate
  file:
    path: "{{ openvpn_path }}/index.txt"
    state: touch

- name: Seed a serial file that will be used when generating the Server's certificate
  copy:
    content: "01"
    dest: "{{ openvpn_path }}/serial"

- name: Generate CSR for the Server
  command: openssl req -batch -extensions server -new -key server.key -out server.csr -config {{ openvpn_path }}/openssl-certificate.cnf
  args:
    chdir: "{{ openvpn_path }}"
    creates: server.csr

- name: Generate certificate for the Server
  command: openssl ca -batch -extensions server -in server.csr -out server.crt -config openssl-certificate.cnf
  args:
    chdir: "{{ openvpn_path }}"
    creates: server.crt

- name: Generate CSRs for the clients
  command: openssl req -new -extensions client -key client.key -out client.csr -subj "{{ openvpn_request_subject }}/CN={{ item }}" -config {{ openvpn_path }}/openssl-certificate.cnf
  args:
    chdir: "{{ openvpn_path }}/{{ item }}"
    creates: client.csr
  with_items: "{{ openvpn_clients }}"

- name: Generate certificates for the clients
  command: openssl x509 -extensions client -CA {{ openvpn_ca }}.crt -CAkey {{ openvpn_ca }}.key -CAcreateserial -req -days {{ openvpn_days_valid }} -in client.csr -out client.crt -extfile {{ openvpn_path }}/openssl-certificate.cnf
  args:
    chdir: "{{ openvpn_path }}/{{ item }}"
    creates: client.crt
  with_items: "{{ openvpn_clients }}"

- name: Generate HMAC firewall key
  command: openvpn --genkey --secret {{ openvpn_hmac_firewall }}
  args:
    creates: "{{ openvpn_hmac_firewall }}"

- name: Register CA certificate contents
  command: cat ca.crt
  args:
    chdir: "{{ openvpn_path }}"
  register: openvpn_ca_contents

- name: Register client certificate contents
  command: cat client.crt
  args:
    chdir: "{{ openvpn_path }}/{{ item }}"
  with_items: "{{ openvpn_clients }}"
  register: openvpn_client_certificates

- name: Register client key contents
  command: cat client.key
  args:
    chdir: "{{ openvpn_path }}/{{ item }}"
  with_items: "{{ openvpn_clients }}"
  register: openvpn_client_keys

- name: Register HMAC firewall contents
  command: cat ta.key
  args:
    chdir: "{{ openvpn_path }}"
  register: openvpn_hmac_firewall_contents

- name: Create the client configuration profiles that will be used when connecting directly
  template:
    src: client-direct.ovpn.j2
    dest: "{{ openvpn_path }}/{{ item[0] }}/{{ openvpn_direct_profile_filename }}"
  with_together:
    - "{{ openvpn_clients }}"
    - "{{ openvpn_client_certificates.results }}"
    - "{{ openvpn_client_keys.results }}"
  loop_control:
    label: "{{ item[0] }}"

- name: Create the client configuration profiles that will be used when connecting directly via UDP
  template:
    src: client-direct-udp.ovpn.j2
    dest: "{{ openvpn_path }}/{{ item[0] }}/{{ openvpn_direct_udp_profile_filename }}"
  with_together:
    - "{{ openvpn_clients }}"
    - "{{ openvpn_client_certificates.results }}"
    - "{{ openvpn_client_keys.results }}"
  loop_control:
    label: "{{ item[0] }}"

- name: Create the client configuration profiles that will be used when connecting via sslh
  template:
    src: client-sslh.ovpn.j2
    dest: "{{ openvpn_path }}/{{ item[0] }}/{{ openvpn_sslh_profile_filename }}"
  with_together:
    - "{{ openvpn_clients }}"
    - "{{ openvpn_client_certificates.results }}"
    - "{{ openvpn_client_keys.results }}"
  loop_control:
    label: "{{ item[0] }}"

- name: Create the client configuration profiles that will be used when connecting via stunnel
  template:
    src: client-stunnel.ovpn.j2
    dest: "{{ openvpn_path }}/{{ item[0] }}/{{ openvpn_stunnel_profile_filename }}"
  with_together:
    - "{{ openvpn_clients }}"
    - "{{ openvpn_client_certificates.results }}"
    - "{{ openvpn_client_keys.results }}"
  loop_control:
    label: "{{ item[0] }}"

- name: Create the combined client configuration profiles that will be used to connect from the fastest to the most compatible
  template:
    src: client-combined.ovpn.j2
    dest: "{{ openvpn_path }}/{{ item[0] }}/{{ openvpn_combined_profile_filename }}"
  with_together:
    - "{{ openvpn_clients }}"
    - "{{ openvpn_client_certificates.results }}"
    - "{{ openvpn_client_keys.results }}"
  loop_control:
    label: "{{ item[0] }}"

- name: Allow OpenVPN through the firewall
  command: "{{ item }}"
  with_items: "{{ openvpn_firewall_rules }}"

- name: Copy OpenVPN configuration file into place
  template:
    src: etc_openvpn_server.conf.j2
    dest: /etc/openvpn/server.conf

- name: Copy OpenVPN UDP configuration file into place
  template:
    src: etc_openvpn_server_udp.conf.j2
    dest: /etc/openvpn/server-udp.conf
  notify: Restart OpenVPN

- name: Copy the ca.crt and ta.key files that clients will need in order to connect to the OpenVPN server
  command: cp {{ openvpn_path }}/{{ item[1] }} {{ openvpn_path }}/{{ item[0] }}
  with_nested:
    - "{{ openvpn_clients }}"
    - ["ca.crt", "ta.key"]

- name: Create the OpenVPN Gateway directory
  file:
    path: "{{ openvpn_gateway_location }}"
    owner: www-data
    group: www-data
    mode: 0750
    state: directory

- name: Generate the Markdown OpenVPN instructions
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  with_items:
    - { src: "instructions.md.j2",         dest: "{{ openvpn_markdown_instructions }}" }
    - { src: "stunnel-instructions.md.j2", dest: "{{ openvpn_stunnel_markdown_instructions }}" }

- name: Convert the Markdown OpenVPN instructions into HTML and surround them with the header and footer template
  shell: markdown {{ item.md }} | cat {{ streisand_header_template }} - {{ streisand_footer_template }} > {{ item.html }}
  with_items:
    - { md: "{{ openvpn_markdown_instructions }}",         html: "{{ openvpn_html_instructions }}" }
    - { md: "{{ openvpn_stunnel_markdown_instructions }}", html: "{{ openvpn_stunnel_html_instructions }}" }

- name: Copy the client files to the OpenVPN Gateway directory
  command: cp --recursive {{ openvpn_path }}/{{ item }} {{ openvpn_gateway_location }}
  args:
    creates: "{{ openvpn_gateway_location }}/{{ item }}/ca.crt"
  with_items: "{{ openvpn_clients }}"