DRY in openvpn role and allow other rc.local tasks

roles/vpn/files/rc.local

+#!/bin/sh -e
+#
+# rc.local
+#
+# This script is executed at the end of each multiuser runlevel.
+# Make sure that the script will "exit 0" on success or any other
+# value on error.
+#
+# In order to enable or disable this script just change the execution
+# bits.
+#
+
+exit 0

roles/vpn/tasks/openvpn.yml

   command: openssl dhparam -out {{ openvpn_dhparam }} {{ openvpn_key_size }}
            creates={{ openvpn_dhparam }}
 
-- name: Copy rc.local with firewall and dnsmasq rules into place
-  template: src=etc_rc.local dest=/etc/rc.local
+- name: Add empty rc.local if it doesn't exist
+  copy: src=rc.local dest=/etc/rc.local mode=700 owner=root group=root force=no
+
+- name: custom rc.local file with iptables rules
+  template: src=rc.local_ansible_openvpn dest=/etc/rc.local_ansible_openvpn mode=700 owner=root group=root
+
+- name: Ensure custom rc.local file is included in rc.local
+  lineinfile: dest=/etc/rc.local line='bash /etc/rc.local_ansible_openvpn' insertbefore='exit 0'
+
+- name: Run custom rc file
+  command: bash /etc/rc.local_ansible_openvpn
+  changed_when: False
 
 - name: Enable IPv4 traffic forwarding
   sysctl: name=net.ipv4.ip_forward value=1
 
-- name: Allow OpenVPN through the firewall
-  command: "{{ item }}"
-  with_items:
-    - iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-    - iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
-    - iptables -A FORWARD -j REJECT
-    - iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o {{ ansible_default_ipv4.interface }} -j MASQUERADE
-
 - name: Allow OpenVPN through ufw
   ufw: rule=allow port={{ openvpn_port }} proto={{ openvpn_protocol }}
   tags: ufw

roles/vpn/templates/etc_rc.local → roles/vpn/templates/rc.local_ansible_openvpn

 #!/bin/sh -e
+# {{ ansible_managed }}
 #
-# rc.local
-#
-# This script is executed at the end of each multiuser runlevel.
-# Make sure that the script will "exit 0" on success or any other
-# value on error.
-#
-# In order to enable or disable this script just change the execution
-# bits.
+# This script should be included in your rc.local
 #
 
 iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT