still allow people to override them in defaults.yml

use the world-wide pool by default, but specify north-america in
user.yml. Also, documentation. This way Sovereign will still behave the
same, but the NTP servers can be changed when desired.

* Added 'cipher' and 'auth' lines to the generated client configs

Remove all configuration for MySQL and configure PostgreSQL as the main
database.

All *_mysql_* options have been changed to *_db_* options.

Postgres requires the database user to have a password in order to
connect via localhost. The db_admin_password option is used to set the
password of the admin user (usually postgres).

Signed-off-by: PajamaSoft <support@pajamasoft.com>

Signed-off-by: PajamaSoft <support@pajamasoft.com>

Use the changed `mail_virtual_users` structure to ensure directories and
sieve rules are created for each defined account.

Added friendly_networks variable to denote whitelisted networks

correctly. The number of days that a certificate will be considered
valid is now a user-controlled variable and is set to five years by
default. (Fixes Issue #87)

 * Add an openvpn_server variable
 * Move ${openvpn_client}.{key,csr,crt} to
   ${openvpn_client}/client.{key,csr,crt}
 * Generate ${openvpn_client}/${openvpn_server}.ovpn config file
 * Copy over a self contained directory of file per client that can be
   imported by networkmanager in ubuntu or run directly with `sudo
   openvpn ${openvpn_server}.ovpn

Add server_ip_address to vars/user.yml

  * OpenVPN setup is now fully automated. No configuration changes
    are necessary (though the defaults can easily be modified) and
    all manual command line steps have been eliminated.

  * Removed the dependency on easy-rsa in favor of pure OpenSSL and
    OpenVPN commands that are executed by Ansible

  * Improved the security of the OpenVPN configuration
    * Increased the default key size to 2048
    * RSA keys are only readable by root
    * The cipher and authentication digest are now configurable. If
      your client supports it, you can use AES-256-CBC and SHA256
      instead of BF-CBC (Blowfish) and SHA1 which are the defaults.
      Or you can be a really cool, paranoid, crypto hipster and
      use CAMELLIA-256-CBC and SHA512 with an RSA key size of 4096.
    * Enabled "HMAC firewall" functionality using the tls-auth option
      and automated the generation of the 'ta' key that it depends on
    * The OpenVPN daemon becomes an unprivileged user after it starts

  * Automated the retrieval of the files that clients will need in
    order to connect to OpenVPN

  * A pause prompt outputs basic configuration information after the
    role has finished running

  * Variables are referenced using the new Ansible variable format
    (e.g. {{ var }} instead of $var)

  * Added a flush_handlers command to the role that ensures OpenVPN
    will restart prior to dnsmasq (fixes issue #63)

  * Fixed two bugs that were preventing packet forwarding for IPv4
    from being enabled correctly

ignoreip field inside /etc/fail2ban/jail.local is populated with
server_ip_address variable

That way it's more convenient to uncomment an entire paragraph.

Refs #39

That way the default values will not be applied by mistake. The user
needs to uncomment the lines from `vars/users.yml` and set them.

Also renamed openvpn variables.

Refs #39

That way we can override all the config from a central location. The
`user.yml` file overrides `defaults.yml`. `user.yml` was added to
`.gitignore` in order to allow a user to change it without having to
worry about merges. It's easy to do a diff to see what changed between
the defaults and your own settings.

Needs documentation, this is just a proposal.

Refs #39