Testing & CI

This URL works for all releases, not just the latest one.

 * Add an openvpn_server variable
 * Move ${openvpn_client}.{key,csr,crt} to
   ${openvpn_client}/client.{key,csr,crt}
 * Generate ${openvpn_client}/${openvpn_server}.ovpn config file
 * Copy over a self contained directory of file per client that can be
   imported by networkmanager in ubuntu or run directly with `sudo
   openvpn ${openvpn_server}.ovpn

because it's not available in a stable ansible release yet

added SHA check for tarsnap

Ignore ufw error resulting from known bug on Debian 7

In order to check the version of the linux distribution we need to
set `gather_facts` to True.

Closes #73.

(No more "Removing leading '/' from member names" warnings)

Improved idempotency and removed ip detection

Increase message size limit to 50MB (from default of 10MB)

Update README with ufw instead of ferm

Replace ferm with ufw

ref(fail2ban): add missing var to user.yml

fix(tarsnap): rotate script fails on error

Fix SSL certificate for ZNC so that it begins with a private key

Scripts used to rotate tarsnap backups exit when a command fails
Cron will catch that return code is not zero and will send message to root

No more silent failure

Add server_ip_address to vars/user.yml

Completely refactored the VPN role

  * OpenVPN setup is now fully automated. No configuration changes
    are necessary (though the defaults can easily be modified) and
    all manual command line steps have been eliminated.

  * Removed the dependency on easy-rsa in favor of pure OpenSSL and
    OpenVPN commands that are executed by Ansible

  * Improved the security of the OpenVPN configuration
    * Increased the default key size to 2048
    * RSA keys are only readable by root
    * The cipher and authentication digest are now configurable. If
      your client supports it, you can use AES-256-CBC and SHA256
      instead of BF-CBC (Blowfish) and SHA1 which are the defaults.
      Or you can be a really cool, paranoid, crypto hipster and
      use CAMELLIA-256-CBC and SHA512 with an RSA key size of 4096.
    * Enabled "HMAC firewall" functionality using the tls-auth option
      and automated the generation of the 'ta' key that it depends on
    * The OpenVPN daemon becomes an unprivileged user after it starts

  * Automated the retrieval of the files that clients will need in
    order to connect to OpenVPN

  * A pause prompt outputs basic configuration information after the
    role has finished running

  * Variables are referenced using the new Ansible variable format
    (e.g. {{ var }} instead of $var)

  * Added a flush_handlers command to the role that ensures OpenVPN
    will restart prior to dnsmasq (fixes issue #63)

  * Fixed two bugs that were preventing packet forwarding for IPv4
    from being enabled correctly

fix(apticron): apticron emails are sent to root

Instead of sending email to {{ admin_email }} we send them to root user.
These emails will be redirected to the appropriate user via
mail_virtual_aliases variables

Cron job to monitor RBL listings

add(tarsnap): Script to rotate backups

fix(gitignore): absolute path for user.yml file

.gitignore contained complete path to /vars/user.yml but we want to ignore the
locale version inside local vars directory

add(apticron): configure email

add(fail2ban): Add server IP address to ignore IP

Apticron is configured to send email to {{ admin_email }}

ignoreip field inside /etc/fail2ban/jail.local is populated with
server_ip_address variable

Add tasks to install script/tarsnap configuration file and a cronjob to run
the backup job
Number of hourly/daily/weekly/monthly backups kept can be configure from the
tarsnap.sh script

Thanks to this script, we don't use all the backups which save space on
tarsnap server and thus reduce the price to pay

Don't open unused ports

Sovereign does not currently use jabber/xmpp or insecure smtp.

Skip a2enmod and a2ensite tasks if not required