sovereign

Commit graph

Autor	SHA1	Nachricht	Datum
Thomas Buck	183b80da8d	Remove Google Authenticator / Two-Factor Authentification	vor 6 Jahren
Thomas Buck	9a21653cba	VPN should redirect all traffic - fix for merged PR657	vor 6 Jahren
John Giannelos	264d61ec73	Fix nested iteration of `openvpn_clients`.	vor 6 Jahren
Óscar Nájera	8f0cc14f76	Fix: Ansible uses the value present in apt module state parameter	vor 6 Jahren
Alex Collins	2a231aa5dc	Minor fixes to OpenVPN set-up	vor 7 Jahren
David Young	bee212b96d	Add brackets to variables in openvpn task	vor 8 Jahren
Allen Riddell	c1511c057f	Remove unnecessary defaults from openvpn certificate	vor 8 Jahren
Sharif Nassar	73c30c313b	VPN - enforce TLS min version on the client	vor 8 Jahren
Allen Riddell	9e71d9067f	Add openvpn default vars to role	vor 8 Jahren
Mike Ashley	3d68705341	Add leading 0 to octal file permissions This is done to suppress warnings from ansible-lint.	vor 8 Jahren
Yannik Sembritzki	66cb39bb46	Only add iptables rules if they don't already exist	vor 8 Jahren
Yannik Sembritzki	fd9dd1b21e	Only add iptables rules if they don't already exist	vor 8 Jahren
Yannik Sembritzki	d2821753a7	DRY in openvpn role and allow other rc.local tasks	vor 8 Jahren
Yannik Sembritzki	9ffe86b36d	DRY in openvpn role and allow other rc.local tasks	vor 8 Jahren
Mike Ashley	1011d76866	Fix systemd configuration of OpenVPN server The server was not starting. As a result, the dnsmasq service failed to start, and the playbook thus failed to run when using the vpn role. This patch corrects the configuration per instructions from https://help.ubuntu.com/community/OpenVPN. OpenVPN PAM configuration moved up to reduce server bouncing as the playbook runs. The dependency on service (re)starts between openvpn and dnsmasq works but feels brittle.	vor 8 Jahren
Sebastian Kriems	fe536873b7	ufw tasks shall have the ufw tag resolves #453 Conflicts: roles/common/tasks/ufw.yml	vor 9 Jahren
Filipp Frizzy	7cb76741e7	update openvpn server config Change default network buffer size Should increase tcp tunnel speed for openvpn < 2.3.9 https://community.openvpn.net/openvpn/ticket/461	vor 9 Jahren
Allen Riddell	3346c4aede	Remove reference to Google's DNS servers Per discussion on #429 (after the merge). This project is about encouraging users to run services themselves and not rely on for-profit corporations such as Google.	vor 9 Jahren
Allen Riddell	43f3840b3b	Comment copyediting	vor 9 Jahren
Filipp Frizzy	fc374682f6	up comments in openvpn config template add additional comment about `tun-mtu` parameter in openvpn config template	vor 9 Jahren
Filipp Frizzy	3024d03552	comment out google dns in openvpn config template	vor 9 Jahren
Filipp Frizzy	da10178f4b	add new settings into openvpn config template - google dns setting for client - verb level - mtu - TLS settings	vor 9 Jahren
Sebastian Kriems	968abba197	ufw tasks shall have the ufw tag resolves #453	vor 9 Jahren
Filipp Frizzy	309bdc7f60	update openvpn server config Change default network buffer size Should increase tcp tunnel speed for openvpn < 2.3.9 https://community.openvpn.net/openvpn/ticket/461	vor 9 Jahren
Allen Riddell	22cd611e90	Remove reference to Google's DNS servers Per discussion on #429 (after the merge). This project is about encouraging users to run services themselves and not rely on for-profit corporations such as Google.	vor 9 Jahren
Allen Riddell	6cc6756ce1	Comment copyediting	vor 9 Jahren
Filipp Frizzy	39d8983452	up comments in openvpn config template add additional comment about `tun-mtu` parameter in openvpn config template	vor 9 Jahren
Filipp Frizzy	68b4bf7954	comment out google dns in openvpn config template	vor 9 Jahren
Filipp Frizzy	3cca3c61d4	add new settings into openvpn config template - google dns setting for client - verb level - mtu - TLS settings	vor 9 Jahren
Alex Payne	372f84473f	init.d -> systemctl	vor 9 Jahren
Alex Payne	d010a0cda5	Formatting.	vor 9 Jahren
Laurent Arnoud	21e0110684	Ignore copy tasks	vor 9 Jahren
Manfred Touron	16c93ea486	Using more verbose 'dependencies' tag (#393)	vor 9 Jahren
Manfred Touron	b49f3a6586	Tagged 'deps' aptitude tasks	vor 9 Jahren
Joshua Lund	7ffee7da9f	Use native Ansible modules in the OpenVPN role to seed the serial and database files.	vor 10 Jahren
Lorenzo Villani	d5ecf673d3	Calm OCD by sorting almost every with_items block in alphabetical order	vor 10 Jahren
Justin Plock	ea0b288818	Moved ufw firewall rules into individual roles	vor 10 Jahren
Joshua Lund	64883159e9	* Update OpenVPN role to generate self-contained "unified" .ovpn profiles * The role now generates .ovpn profiles with embedded CA, certificate, key, and HMAC firewall key information. These .ovpn profiles are compatible with OpenVPN for iOS and Android, and only a single file needs to be transferred to your mobile device. * Added explicit route information to the .ovpn profile	vor 10 Jahren
Justin Plock	921ae6957e	Optional 2FA support for OpenVPN (requires uncommenting on the server and pushing new client configs)	vor 10 Jahren
Joshua Lund	4ed07a1e0a	* Made the OpenVPN port and protocol (tcp/udp) configurable * Added 'cipher' and 'auth' lines to the generated client configs	vor 11 Jahren
Joshua Lund	fac6ceb3a9	Use gathered facts to determine the correct network interface in the OpenVPN role	vor 11 Jahren
Luke Cyca	69fc8b7eb0	Enable openvpn role in vagrant, plus: * Removed unicode char from task name (ansible 1.3 doesn’t like it) * Use ansible sysctl module instead of lineinfile * Wait for only 5 seconds (for fully automated deploy)	vor 11 Jahren
Joshua Lund	1b81d7a7e6	Updated the OpenVPN role so certificate expiration is handled correctly. The number of days that a certificate will be considered valid is now a user-controlled variable and is set to five years by default. (Fixes Issue #87)	vor 11 Jahren
Ben Ford	588582aa25	Generate a config file for each client generated * Add an openvpn_server variable * Move ${openvpn_client}.{key,csr,crt} to ${openvpn_client}/client.{key,csr,crt} * Generate ${openvpn_client}/${openvpn_server}.ovpn config file * Copy over a self contained directory of file per client that can be imported by networkmanager in ubuntu or run directly with `sudo openvpn ${openvpn_server}.ovpn	vor 11 Jahren
Joshua Lund	93ebde0d95	* Completely refactored the VPN role * OpenVPN setup is now fully automated. No configuration changes are necessary (though the defaults can easily be modified) and all manual command line steps have been eliminated. * Removed the dependency on easy-rsa in favor of pure OpenSSL and OpenVPN commands that are executed by Ansible * Improved the security of the OpenVPN configuration * Increased the default key size to 2048 * RSA keys are only readable by root * The cipher and authentication digest are now configurable. If your client supports it, you can use AES-256-CBC and SHA256 instead of BF-CBC (Blowfish) and SHA1 which are the defaults. Or you can be a really cool, paranoid, crypto hipster and use CAMELLIA-256-CBC and SHA512 with an RSA key size of 4096. * Enabled "HMAC firewall" functionality using the tls-auth option and automated the generation of the 'ta' key that it depends on * The OpenVPN daemon becomes an unprivileged user after it starts * Automated the retrieval of the files that clients will need in order to connect to OpenVPN * A pause prompt outputs basic configuration information after the role has finished running * Variables are referenced using the new Ansible variable format (e.g. {{ var }} instead of $var) * Added a flush_handlers command to the role that ensures OpenVPN will restart prior to dnsmasq (fixes issue #63) * Fixed two bugs that were preventing packet forwarding for IPv4 from being enabled correctly	vor 11 Jahren
Greg Karékinian	1e9a560ff6	Comment defaults That way the default values will not be applied by mistake. The user needs to uncomment the lines from `vars/users.yml` and set them. Also renamed openvpn variables. Refs #39	vor 11 Jahren
Greg Karékinian	58dddc55d1	Remove variables from roles Refs #39	vor 11 Jahren
Greg Karékinian	894808b50c	Fix trailing whitespace	vor 11 Jahren
Alex Payne	080d38986c	first commit	vor 11 Jahren

44 Commits (c41cd737fdd2d9cd9c0e9d66a23d8903470bd0c1)