Add openvpn setup

tasks/nginx.yml

@@ -0,0 +1,50 @@
+- name: copy nginx configuration files
+  become: true
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: root
+    mode: '0644'
+  loop:
+    - {
+        src: 'templates/nginx/default.j2',
+        dest: '/etc/nginx/sites-available/default',
+      }
+    - {
+        src: 'templates/nginx/gitlab.j2',
+        dest: '/etc/nginx/sites-available/gitlab',
+      }
+    - {
+        src: 'templates/nginx/sentry.j2',
+        dest: '/etc/nginx/sites-available/sentry',
+      }
+    - {
+        src: 'templates/nginx/vpn.j2',
+        dest: '/etc/nginx/sites-available/vpn',
+      }
+
+- name: create configuration links
+  become: true
+  file:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    state: link
+  loop:
+    - {
+        src: '/etc/nginx/sites-available/default',
+        dest: '/etc/nginx/sites-enabled/default',
+      }
+    - {
+        src: '/etc/nginx/sites-available/gitlab',
+        dest: '/etc/nginx/sites-enabled/gitlab',
+      }
+    - {
+        src: '/etc/nginx/sites-available/sentry',
+        dest: '/etc/nginx/sites-enabled/sentry',
+      }
+    - {
+        src: '/etc/nginx/sites-available/vpn',
+        dest: '/etc/nginx/sites-enabled/vpn',
+      }
+  notify: restart nginx

tasks/openvpn.yml

@@ -0,0 +1,112 @@
+- name: create openvpn server directory
+  become: true
+  file:
+    path: '{{ item }}'
+    state: directory
+    mode: '{{ item.mode }}'
+    owner: root
+    group: root
+  loop:
+    - {
+        path: '/etc/openvpn/server',
+        mode: '0744',
+      }
+    - {
+        path: '/etc/openvpn/client',
+        mode: '0744'
+      }
+    - {
+        path: '/etc/openvpn/easy-rsa',
+        mode: '0744',
+      }
+    - {
+        path: '/etc/openvpn/easy-rsa/keys',
+        mode: '0700',
+      }
+
+- name: copy openvpn credentials
+  become: true
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    mode: '{{ item.mode }}'
+    owner: root
+    group: root
+  loop:
+    - {
+        src: 'files/openvpn/ca.crt',
+        dest: '/etc/openvpn/easy-rsa/keys/ca.crt',
+        mode: '0644'
+      }
+    - {
+        src: 'files/openvpn/server.crt',
+        dest: '/etc/openvpn/easy-rsa/keys/server.crt',
+        mode: '0644'
+      }
+    - {
+        src: 'files/openvpn/server.csr',
+        dest: '/etc/openvpn/easy-rsa/keys/server.csr',
+        mode: '0644'
+      }
+    - {
+        src: 'files/openvpn/server.key',
+        dest: '/etc/openvpn/easy-rsa/keys/server.key',
+        mode: '0600'
+      }
+    - {
+        src: 'files/openvpn/dh2048.pem',
+        dest: '/etc/openvpn/easy-rsa/keys/dh2048.pem',
+        mode: '0644'
+      }
+    - {
+        src: 'files/openvpn/ta.key',
+        dest: '/etc/openvpn/easy-rsa/keys/ta.key',
+        mode: '0600'
+      }
+
+- name: copy openvpn configuration files
+  become: true
+  template:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: root
+  loop:
+    - {
+        src: 'templates/openvpn/server-lan.j2',
+        dest: '/etc/openvpn/server/server-lan.conf',
+      }
+    - {
+        src: 'templates/openvpn/server-mobile.j2',
+        dest: '/etc/openvpn/server/server-mobile.conf',
+      }
+
+- name: link openvpn configuration files
+  become: true
+  file:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    state: link
+  loop:
+    - {
+        src: '/etc/openvpn/server/server-lan.conf',
+        dest: '/etc/openvpn/server-lan.conf',
+      }
+    - {
+        src: '/etc/openvpn/server/server-mobile.conf',
+        dest: '/etc/openvpn/server-mobile.conf',
+      }
+
+- name: restart openvpn lan server
+  become: true
+  systemd:
+    name: openvpn@server-lan
+    state: restarted
+    enabled: true
+
+- name: restart openvpn mobile server
+  become: true
+  systemd:
+    name: openvpn@server-mobile
+    state: restarted
+    enabled: true

tasks/radicale.yml

@@ -0,0 +1,47 @@
+- name: install radicale
+  pip:
+    name: radicale
+    state: present
+    extra_args: --user
+
+- name: copy radicale password file
+  become: true
+  copy:
+    src: 'files/radicale/radicale_users'
+    dest: '/etc/radicale/users'
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: create radicale nginx directory
+  become: true
+  file:
+    path: '/etc/nginx/radicale'
+    state: directory
+    owner: root
+    group: root
+
+- name: copy radicale nginx password file
+  become: true
+  copy:
+    src: 'files/radicale/radicale_htpasswd'
+    dest: '/etc/nginx/radicale/htpasswd'
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: copy radicale template
+  become: true
+  template:
+    src: 'templates/radicale.j2'
+    dest: '/etc/radicale/config'
+    owner: root
+    group: root
+    mode: '0600'
+
+- name: restart radicale service
+  become: true
+  systemd:
+    name: radicale
+    state: restarted
+    enabled: true

tasks/setup.yml

@@ -1,8 +1,9 @@
 - name: copy firewall template
+  become: true
   template:
     src: 'templates/nftables.j2'
     dest: '/etc/nftables.conf'
     owner: root
     group: root
-    mode: '0600'
+    mode: '0644'
   notify: restart nftables