{"id":14984407,"url":"https://github.com/aovpn/ansible-role-openvpn","last_synced_at":"2025-04-10T20:12:15.442Z","repository":{"id":244712853,"uuid":"816039029","full_name":"aovpn/ansible-role-openvpn","owner":"aovpn","description":"Ansible role to install and configure OpenVPN server","archived":false,"fork":false,"pushed_at":"2024-12-15T13:32:40.000Z","size":314,"stargazers_count":18,"open_issues_count":9,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-24T17:52:51.837Z","etag":null,"topics":["ansible","ansible-role","openvpn","playbook","role"],"latest_commit_sha":null,"homepage":"","language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aovpn.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-16T22:20:19.000Z","updated_at":"2024-12-23T11:05:07.000Z","dependencies_parsed_at":"2024-06-21T15:06:20.077Z","dependency_job_id":"ecf3c4e5-6a2c-4130-99e3-cbb2ca732541","html_url":"https://github.com/aovpn/ansible-role-openvpn","commit_stats":{"total_commits":308,"total_committers":53,"mean_commits":5.811320754716981,"dds":0.4383116883116883,"last_synced_commit":"9f65f871f22ae483501711a8dbb98f9fa525bdf3"},"previous_names":["aovpn/ansible-role-openvpn"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aovpn%2Fansible-role-openvpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aovpn%2Fansible-role-openvpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aovpn%2Fansible-role-openvpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aovpn%2Fansible-role-openvpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aovpn","download_url":"https://codeload.github.com/aovpn/ansible-role-openvpn/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248288361,"owners_count":21078903,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role","openvpn","playbook","role"],"created_at":"2024-09-24T14:08:59.661Z","updated_at":"2025-04-10T20:12:15.419Z","avatar_url":"https://github.com/aovpn.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"OpenVPN\n=========\nThis role installs OpenVPN from default repositories, configures it as a server, sets up networking and firewalls (primarily firewalld, ufw and iptables - best effort), and generates client configuration files. It also optionally supports LDAP authentication.\n\nSupported Operating Systems:\n- Ubuntu 24.04 and higher\n- CentOS 9 and higher\n- Debian 11 and higher\n\n# Requirements\nOpenVPN must be available as a package in yum/dnf/apt! For CentOS users, this role will run `yum install epel-release` to ensure OpenVPN is available.\n\nUbuntu Precise has a [weird bug](https://bugs.launchpad.net/ubuntu/+source/iptables-persistent/+bug/1002078) that might cause the `iptables-persistent` installation to fail. There is a [workaround](https://forum.linode.com/viewtopic.php?p=58233#p58233).\n\n## Ansible Core 2.10 and Higher\nWith Ansible 2.10, modules have been moved into collections. Aside from Ansible's built-in modules, additional collections are required for certain module like seboolean (now ansible.posix.seboolean). The required collections are:\n\n- ansible.posix\n- community.general (if using ufw)\n\nInstallation:\n```bash\nansible-galaxy collection install ansible.posix\nansible-galaxy collection install community.general\n```\nIf you're using a standard Ansible distribution, you won't need to install any additional collections.\n\n# Support Notes/Expectations\nThis role is supported by a group of enthusiasts on a best-effort basis. Feel free to open an issue and contribute a related pull request with a fix.\n\n# Role Variables\n## Role options\nThese options change how the role works. This is a catch-all group, specific groups are broken out below.\n\n| Variable | Type | Choices | Default | Comment |\n|------------------------------|---------|-------------|-------------------|-------------------------------------------------------------------------------|\n| clients | list | | [] | List of clients (kinda users) to add to OpenVPN |\n| openvpn_base_dir | string | | /etc/openvpn | Path where your OpenVPN config will be stored |\n| openvpn_client_config_no_log | boolean | true, false | true | Prevent client configuration files to be logged to stdout by Ansible |\n| openvpn_key_dir | string | | /etc/openvpn/keys | Path where your server private keys and CA will be stored |\n| openvpn_ovpn_dir | string | | /etc/openvpn | Path where your client configurations will be stored |\n| openvpn_revoke_these_certs | list | | [] | List of client certificates to revoke. |\n| openvpn_selinux_module | string | | my-openvpn-server | Set the SELinux module name |\n| openvpn_service_name | string | | openvpn | Name of the service. Used by systemctl to start the service |\n| openvpn_sync_certs | boolean | true, false | false | Revoke certificates not explicitly defined in 'clients' |\n| openvpn_uninstall | boolean | true, false | false | Set to true to uninstall the OpenVPN service |\n| openvpn_use_ldap | boolean | true, false | false | Active LDAP backend for authentication. Client certificate not needed anymore |\n\n### Config fetching\nChange these options if you need to adjust how the configs are download to your local system\n\n| Variable | Type | Choices | Default | Comment |\n|-------------------------------------|---------|-------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------|\n| openvpn_fetch_client_configs | boolean | true, false | true | Download generated client configurations to the local system |\n| openvpn_fetch_client_configs_dir | string | | /tmp/ansible | If openvpn_fetch_client_configs is true, the local directory to download the client config files into |\n| openvpn_fetch_client_configs_suffix | string | | \"\" | If openvpn_fetch_client_configs is true, the suffix to append to the downloaded client config files before the trailing `.ovpn` extension |\n\n### Firewall\nChange these options if you need to force a particular firewall or change how the playbook interacts with the firewall.\n\n| Variable | Type | Choices | Default | Comment |\n|----------------------------------|---------|--------------------------------|----------|-------------------------------------------------------------------------------------------------------------|\n| firewalld_default_interface_zone | string | | public | Firewalld zone where the \"ansible_default_ipv4.interface\" will be pushed into |\n| iptables_service | string | | iptables | Override the iptables service name |\n| manage_firewall_rules | boolean | true, false | true | Allow playbook to manage iptables |\n| openvpn_firewall | string | auto, firewalld, ufw, iptables | auto | The firewall software to configure network rules. \"auto\" will attempt to detect it by inspecting the system |\n## OpenVPN Config Options\nThese options change how OpenVPN itself works.\n### Networking\n| Variable | Type | Choices | Default | Comment |\n|-----------------------------|--------------|-------------------|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|\n| openvpn_client_register_dns | boolean | true, false | true | Add `register-dns` option to client config (Windows only). |\n| openvpn_client_to_client | boolean | true, false | false | Set to true if you want clients to access each other. |\n| openvpn_custom_dns | list[string] | | [] | List of DNS servers, only applied if `openvpn_set_dns` is set to true |\n| openvpn_dualstack | boolean | | true | Whether or not to use a dualstack (IPv4 + v6) socket |\n| openvpn_keepalive_ping | int | | 5 | Set `keepalive` ping interval seconds. |\n| openvpn_keepalive_timeout | int | | 30 | Set `keepalive` timeout seconds |\n| openvpn_local | string | | `unset` | Local host name or IP address for bind. If specified, OpenVPN will bind to this address only. If unspecified, OpenVPN will bind to all interfaces. |\n| openvpn_port | int | | 1194 | The port you want OpenVPN to run on. If you have different ports on different servers, I suggest you set the port in your inventory file. |\n| openvpn_proto | string | udp, tcp | udp | The protocol you want OpenVPN to use |\n| openvpn_redirect_gateway | boolean | true, false | true | OpenVPN gateway push |\n| openvpn_resolv_retry | int/string | any int, infinite | 5 | Hostname resolv failure retry seconds. Set \"infinite\" to retry indefinitely in case of poor connection or laptop sleep mode recovery etc. |\n| openvpn_server_hostname | string | | `{{ inventory_hostname }}` | The server name to place in the client configuration file |\n| openvpn_server_ipv6_network | string | | `unset` | If set, the network address and prefix of an IPv6 network to assign to clients. If True, IPv4 still used too. |\n| openvpn_server_netmask | string | | 255.255.255.0 | Netmask of the private network |\n| openvpn_server_network | string | | 10.9.0.0 | Private network used by OpenVPN service |\n| openvpn_set_dns | boolean | true, false | true | Will push DNS to the client (Cloudflare and Google) |\n| openvpn_tun_mtu | int | | `unset` | Set `tun-mtu` value. Empty for default. |\n### Security\n| Variable | Type | Choices | Default | Comment |\n|------------------------------------|---------|-------------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| openvpn_auth_alg | string | | SHA256 | Set `auth` authentication algoritm. |\n| openvpn_ca_key | dict | | `unset` | Contain \"crt\" and \"key\". If not set, CA cert and key will be automatically generated on the target system. |\n| openvpn_cipher | string | | AES-256-CBC | Set `cipher` option for server and client. |\n| openvpn_crl_path | string | | `unset` | Define a path to the CRL file for server revocation check. |\n| openvpn_duplicate_cn | boolean | true, false | false | Add `duplicate-cn` option to server config - this allows clients to connect multiple times with the one key. NOTE: client ip addresses won't be static anymore! |\n| openvpn_rsa_bits | int | | 2048 | Number of bits used to protect generated certificates |\n| openvpn_script_security | int | | 1 | Set openvpn script security option |\n| openvpn_tls_auth_key | string | | `unset` | Single item with a pre-generated TLS authentication key. |\n| openvpn_use_crl | boolean | true, false | false | Configure OpenVPN server to honor certificate revocation list. |\n| openvpn_use_1_3_tls | boolean | true, false | false | Require a minimum version of TLS 1.3 (TLS 1.2 used by default) |\n| openvpn_use_pregenerated_dh_params | boolean | true, false | false | DH params are generted with the install by default |\n| openvpn_verify_cn | boolean | true, false | false | Check that the CN of the certificate match the FQDN |\n| tls_auth_required | boolean | true, false | true | Ask the client to push the generated ta.key of the server during the connection |\n### Operations\n| Variable | Type | Choices | Default | Comment |\n|------------------------------------|---------|-------------|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| openvpn_addl_client_options | list | | empty | List of user-defined client options that are not already present in the client template. (e.g. `- mssfix 1400`) |\n| openvpn_addl_server_options | list | | empty | List of user-defined server options that are not already present in the server template. (e.g. `- ping-timer-rem`) |\n| openvpn_compression | string | | lzo | Set `compress` compression option. Empty for no compression. |\n| openvpn_config_file | string | | openvpn_{{ openvpn\\_proto }}\\_{{ openvpn_port }} | The config file name you want to use (set in vars/main.yml) |\n| openvpn_enable_management | boolean | true, false | false | |\n| openvpn_ifconfig_pool_persist_file | string | | ipp.txt | |\n| openvpn_management_bind | string | | /var/run/openvpn/management unix | The interface to bind on for the management interface. Can be unix or TCP socket. |\n| openvpn_management_client_user | string | | root | Use this user when using a Unix socket for management interface. |\n| openvpn_push | list | | empty | Set here a list of string that will be inserted into the config file as `push \"\"`. E.g `- route 10.20.30.0 255.255.255.0` will generate push \"route 10.20.30.0 255.255.255.0\" |\n| openvpn_script_client_connect | string | | `unset` | Path to your openvpn client-connect script |\n| openvpn_script_client_disconnect | string | | `unset` | Path to your openvpn client-disconnect script |\n| openvpn_script_down | string | | `unset` | Path to your openvpn down script |\n| openvpn_script_up | string | | `unset` | Path to your openvpn up script |\n| openvpn_service_group | string | | nogroup | Set the openvpn service group. |\n| openvpn_service_user | string | | nobody | Set the openvpn service user. |\n| openvpn_status_version | int | 1, 2, 3 | 1 | Define the formatting of the openvpn-status.log file where are listed current client connection |\n| openvpn_topology | string | | `unset` | the \"topology\" keyword will be set in the server config with the specified value. |\n\n### OpenVPN custom client config (server pushed)\n| Variable | Type | Choices | Default | Comment |\n|---------------------------|---------|---------|---------|------------------------------------------------------|\n| openvpn_client_config | Boolean | | false | Set to true if enable client configuration directory |\n| openvpn_client_config_dir | string | | ccd | Path of `client-config-dir` |\n| openvpn_client_configs | dict | | {} | Dict of settings custom client configs |\n\n## Logrotate\nSet your own custom logrotate options.\n\n| Variable | Type | Choices | Default | Comment |\n|--------------------------|--------|---------|-------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|\n| openvpn_log_dir | string | | /var/log | Set location of openvpn log files. This parameter is a part of `log-append` configuration value. |\n| openvpn_log_file | string | | openvpn.log | Set log filename. This parameter is a part of `log-append` configuration value. |\n| openvpn_logrotate_config | string | | rotate 4\u003cbr /\u003eweekly\u003cbr /\u003emissingok\u003cbr /\u003enotifempty\u003cbr /\u003esharedscripts\u003cbr /\u003ecopytruncate\u003cbr /\u003edelaycompress | Configure logrotate script. |\n\n## Packaging\nThis role pulls in a bunch of different packages. Override the names as necessary.\n\n| Variable | Type | Choices | Default | Comment |\n|----------------------------------|--------|---------|---------------------|-----------------------------------------------------------------------------|\n| epel_package_name | string | | epel-release | Name of the epel-release package to install from the package manager |\n| iptables_persistent_package_name | string | | iptables-persistent | Name of the iptables-persistent package to install from the package manager |\n| iptables_services_package_name | string | | iptables-services | Name of the iptables-services package to install from the package manager |\n| openssl_package_name | string | | openssl | Name of the openssl package to install from the package manager |\n| openvpn_ldap_plugin_package_name | string | | openvpn-auth-ldap | Name of the openvpn-auth-ldap package to install from the package manager |\n| openvpn_package_name | string | | openvpn | Name of the openvpn package to install from the package manager |\n| python_firewall_package_name | string | | python-firewall | Name of the python-firewall package to install from the package manager |\n\n## LDAP object\n| Variable | Type | Choices | Default | Comment |\n|---------------------|--------|---------------------------|-----------------------------------------|----------------------------------------------------------------------------------------------|\n| ldap | dict | | | Dictionary that contain LDAP configuration |\n| url | string | | ldap://host.example.com | Address of you LDAP backend with syntax ldap[s]://host[:port] |\n| anonymous_bind | string | False , True | False | This is not an Ansible boolean but a string that will be pushed into the configuration file. |\n| bind_dn | string | | uid=Manager,ou=People,dc=example,dc=com | Bind DN used if \"anonymous_bind\" set to \"False\" |\n| bind_password | string | | mysecretpassword | Password of the bind_dn user |\n| tls_enable | string | yes , no | no | Force TLS encryption. Not necessary with ldaps addresses |\n| tls_ca_cert_file | string | | /etc/openvpn/auth/ca.pem | Path to the CA ldap backend. This must have been pushed before |\n| tls_cert_file | string | | | Path to client authentication certificate |\n| tls_key_file | string | | | Path to client authentication key |\n| base_dn | string | | ou=People,dc=example,dc=com | Base DN where the backend will look for valid user |\n| search_filter | string | | (\u0026(uid=%u)(accountStatus=active)) | Filter the ldap search |\n| require_group | string | False , True | | This is not an Ansible boolean but a string that will be pushed into the configuration file. |\n| group_base_dn | string | | ou=Groups,dc=example,dc=com | Precise the group to look for. Required if require_group is set to \"True\" |\n| group_search_filter | string | | ((cn=developers)(cn=artists)) | Precise valid groups |\n| verify_client_cert | string | none , optional , require | client-cert-not-required | In OpenVPN 2.4+ `client-cert-not-required` is deprecated. Use `verify-client-cert` instead. |\n\n# Dependencies\nDoes not depend on any other roles\n\n# How to use\n## Example Playbook\nAssume you've cloned this repository into the `ansible-role-openvpn` directory. Navigate to the directory one level above this using `..`. In this parent directory, create a new playbook named `ovpn.yaml`.\n```yaml\n---\n- hosts: all\n gather_facts: true\n become: true\n roles:\n - role: ansible-role-openvpn\n openvpn_port: 4300\n openvpn_sync_certs: true\n clients:\n - myclient1\n - myclient2\n```\n\n\u003e **Note:** As the role will need to know the remote used platform (32 or 64 bits), you must set `gather_facts` to `true` in your play.\n\nEach client listed in the playbook will have a separate configuration generated with unique certificates. Ensure you add as many clients as you have users.\n\n## Apply Playbook\nSSH key-based authentication is assumed. If using password authentication, add `-kK` to the command.\n```bash\nansible-playbook -u USERNAME -i ip.add.re.ss, ./ovpn.yaml\n```\nWhere:\n- USERNAME — replace USERNAME with your SSH username.\n- ip.add.re.ss — replace ip.add.re.ss with the IP address (or DNS name) of your OpenVPN server, followed by a comma.\n\n## Configuration files for clients\nClient configuration files are copied to the machine where you ran the ansible-playbook command. By default, you'll find them in the `/tmp/ansible` directory.\n\n## More examples\nMore examples will be provided in future documentation, which will be linked here. Stay tuned!\n\n# Contributing\n\nContributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are **greatly appreciated**.\n\nCheck out our [contributing guide](CONTRIBUTING.md) to get started.\n\nDon't forget to give the project a star! Thanks again!\n\n# License\nMIT\n\n# Author Information\nInitially written by Kyle Lexmond\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faovpn%2Fansible-role-openvpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faovpn%2Fansible-role-openvpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faovpn%2Fansible-role-openvpn/lists"}