Add mobile configuration & load keys from paths

tasks/network.yml

@@ -1,3 +1,24 @@
+- name: load private key into var
+  set_fact:
+    vpn_server_key: '{{ lookup("file", "files/wireguard/server.key" ) }}'
+
+- name: load public key into var
+  set_fact:
+    vpn_server_public_key: '{{ lookup("file", "files/wireguard/server.pub" ) }}'
+
+# this should eventually be replaced with using the
+# PrivateKeyFile/PresharedKeyFile options
+- name: load preshared keys into variables
+  set_fact:
+    vpn_peers: '{{ vpn_peers | combine({item.key: item.value|combine({"preshared_key": lookup("file", item.value.preshared_key_source_path )})})}}'
+  with_dict: '{{ vpn_peers }}'
+
+- name: load mobile private_key
+  set_fact:
+    vpn_peers: '{{ vpn_peers | combine({item.key: item.value|combine({"private_key": lookup("file", item.value.private_key_source_path )})})}}'
+  with_dict: '{{ vpn_peers }}'
+  when: item.key == "mobile"
+
 - name: copy network configuration files
   become: true
   template:
@@ -7,10 +28,7 @@
     group: systemd-network
     mode: '0640'
   loop:
-    - {
-        src: 'templates/network/br0.netdev.j2',
-        dest: '/etc/systemd/network/br0.netdev',
-      }
+    - { src: 'templates/network/br0.netdev.j2', dest: '/etc/systemd/network/br0.netdev' }
     - {
         src: 'templates/network/br0.network.j2',
         dest: '/etc/systemd/network/br0.network',
@@ -19,15 +37,19 @@
         src: 'templates/network/enp5s0.network.j2',
         dest: '/etc/systemd/network/enp5s0.network',
       }
-    - {
-        src: 'templates/network/wg0.netdev.j2',
-        dest: '/etc/systemd/network/wg0.netdev',
-      }
+    - { src: 'templates/network/wg0.netdev.j2', dest: '/etc/systemd/network/wg0.netdev' }
     - {
         src: 'templates/network/wg0.network.j2',
         dest: '/etc/systemd/network/wg0.network',
       }
 
+- name: copy mobile configuration
+  template:
+    src: 'mobile.wireguard.j2'
+    dest: '/tmp/mobile.wireguard.conf'
+    mode: '0600'
+  when: copy_mobile_conf
+
 - name: create wireguard directories
   become: true
   file:
@@ -49,24 +71,30 @@
     group: systemd-network
     mode: '0640'
   loop:
-    - {
-        src: 'files/wireguard/server.pub',
-        dest: '{{ vpn_server_public_key_path }}',
-      }
-    - {
-        src: 'files/wireguard/server.key',
-        dest: '{{ vpn_server_key_path }}',
-      }
+    - { src: 'files/wireguard/server.pub', dest: '{{ vpn_server_public_key_path }}' }
+    - { src: 'files/wireguard/server.key', dest: '{{ vpn_server_key_path }}' }
+
+- name: copy mobile wireguard credentials
+  become: true
+  copy:
+    src: '{{ item.src }}'
+    dest: '{{ item.dest }}'
+    owner: root
+    group: systemd-network
+    mode: '0640'
+  loop:
+    - { src: 'files/wireguard/mobile.pub', dest: '{{ vpn_server_public_key_path }}' }
+    - { src: 'files/wireguard/mobile.key', dest: '{{ vpn_server_key_path }}' }
 
 - name: copy wireguard preshared keys
   become: true
   copy:
-    src: '{{ item.preshared_key_source_path }}'
-    dest: '{{ item.preshared_key_path }}'
+    src: '{{ item.value.preshared_key_source_path }}'
+    dest: '{{ item.value.preshared_key_path }}'
     owner: root
     group: systemd-network
     mode: '0640'
-  loop: '{{ vpn_peers }}'
+  with_dict: '{{ vpn_peers }}'
 
 - name: restart systemd-networkd
   become: true

tasks/nginx.yml

@@ -7,26 +7,15 @@
     group: root
     mode: '0644'
   loop:
-    - {
-        src: 'templates/nginx/default.j2',
-        dest: '/etc/nginx/sites-available/default',
-      }
-    - {
-        src: 'templates/nginx/gitlab.j2',
-        dest: '/etc/nginx/sites-available/gitlab',
-      }
-    - {
-        src: 'templates/nginx/sentry.j2',
-        dest: '/etc/nginx/sites-available/sentry',
-      }
-    - {
-        src: 'templates/nginx/vpn.j2',
-        dest: '/etc/nginx/sites-available/vpn',
-      }
+    - { src: 'templates/nginx/default.j2', dest: '/etc/nginx/sites-available/default' }
+    - { src: 'templates/nginx/gitlab.j2', dest: '/etc/nginx/sites-available/gitlab' }
+    - { src: 'templates/nginx/sentry.j2', dest: '/etc/nginx/sites-available/sentry' }
+    - { src: 'templates/nginx/vpn.j2', dest: '/etc/nginx/sites-available/vpn' }
     - {
         src: 'templates/nginx/newsreader.j2',
         dest: '/etc/nginx/sites-available/newsreader',
       }
+  notify: restart nginx
 
 - name: create configuration links
   become: true
@@ -47,12 +36,8 @@
         src: '/etc/nginx/sites-available/sentry',
         dest: '/etc/nginx/sites-enabled/sentry',
       }
-    - {
-        src: '/etc/nginx/sites-available/vpn',
-        dest: '/etc/nginx/sites-enabled/vpn',
-      }
+    - { src: '/etc/nginx/sites-available/vpn', dest: '/etc/nginx/sites-enabled/vpn' }
     - {
         src: '/etc/nginx/sites-available/newsreader',
         dest: '/etc/nginx/sites-enabled/newsreader',
       }
-  notify: restart nginx

tasks/openvpn.yml

@@ -1,112 +0,0 @@
-- name: create openvpn server directory
-  become: true
-  file:
-    path: '{{ item.path }}'
-    state: directory
-    mode: '{{ item.mode }}'
-    owner: root
-    group: root
-  loop:
-    - {
-        path: '/etc/openvpn/server',
-        mode: '0744',
-      }
-    - {
-        path: '/etc/openvpn/client',
-        mode: '0744'
-      }
-    - {
-        path: '/etc/openvpn/easy-rsa',
-        mode: '0744',
-      }
-    - {
-        path: '/etc/openvpn/easy-rsa/keys',
-        mode: '0700',
-      }
-
-- name: copy openvpn credentials
-  become: true
-  copy:
-    src: '{{ item.src }}'
-    dest: '{{ item.dest }}'
-    mode: '{{ item.mode }}'
-    owner: root
-    group: root
-  loop:
-    - {
-        src: 'files/openvpn/ca.crt',
-        dest: '/etc/openvpn/easy-rsa/keys/ca.crt',
-        mode: '0644'
-      }
-    - {
-        src: 'files/openvpn/server.crt',
-        dest: '/etc/openvpn/easy-rsa/keys/server.crt',
-        mode: '0644'
-      }
-    - {
-        src: 'files/openvpn/server.csr',
-        dest: '/etc/openvpn/easy-rsa/keys/server.csr',
-        mode: '0644'
-      }
-    - {
-        src: 'files/openvpn/server.key',
-        dest: '/etc/openvpn/easy-rsa/keys/server.key',
-        mode: '0600'
-      }
-    - {
-        src: 'files/openvpn/dh2048.pem',
-        dest: '/etc/openvpn/easy-rsa/keys/dh2048.pem',
-        mode: '0644'
-      }
-    - {
-        src: 'files/openvpn/ta.key',
-        dest: '/etc/openvpn/easy-rsa/keys/ta.key',
-        mode: '0600'
-      }
-
-- name: copy openvpn configuration files
-  become: true
-  template:
-    src: '{{ item.src }}'
-    dest: '{{ item.dest }}'
-    owner: root
-    group: root
-  loop:
-    - {
-        src: 'templates/openvpn/server-lan.j2',
-        dest: '/etc/openvpn/server/server-lan.conf',
-      }
-    - {
-        src: 'templates/openvpn/server-mobile.j2',
-        dest: '/etc/openvpn/server/server-mobile.conf',
-      }
-
-- name: link openvpn configuration files
-  become: true
-  file:
-    src: '{{ item.src }}'
-    dest: '{{ item.dest }}'
-    state: link
-  loop:
-    - {
-        src: '/etc/openvpn/server/server-lan.conf',
-        dest: '/etc/openvpn/server-lan.conf',
-      }
-    - {
-        src: '/etc/openvpn/server/server-mobile.conf',
-        dest: '/etc/openvpn/server-mobile.conf',
-      }
-
-- name: restart openvpn lan server
-  become: true
-  systemd:
-    name: openvpn@server-lan
-    state: restarted
-    enabled: true
-
-- name: restart openvpn mobile server
-  become: true
-  systemd:
-    name: openvpn@server-mobile
-    state: restarted
-    enabled: true