Unverified Commit da625310 authored by Dmitriy Safronov's avatar Dmitriy Safronov Committed by GitHub
Browse files

tighten directory access rights, disable global service (#3) 



Signed-off-by: default avatarDmitriy Safronov <zimniy@cyberbrain.pw>
parent 96dbcb05

tasks/main.yml

+18 −2
Original line number Diff line number Diff line
@@ -3,9 +3,17 @@ 
    name: openvpn

    state: present



- name: Create OpenVPN config directory (+ccd)

- name: Disable global openvpn service

  ansible.builtin.systemd:

    state: stopped

    enabled: false

    masked: true

    daemon_reload: true

    name: "openvpn.service"



- name: Create OpenVPN config directory

  ansible.builtin.file:

    path: "/etc/openvpn/{{ openvpn_server.name }}/ccd"

    path: "/etc/openvpn/{{ openvpn_server.name }}"

    state: directory

    mode: '0700'

    owner: root
@@ -165,6 +173,14 @@ 
        line: "crl-verify /etc/openvpn/{{ openvpn_server.name }}/crl.pem"

      changed_when: false



- name: Create OpenVPN client config directory

  ansible.builtin.file:

    path: "/etc/openvpn/{{ openvpn_server.name }}/ccd"

    state: directory

    mode: '0700'

    owner: root

    group: root



- name: Set client config directory location in temporary config

  ansible.builtin.lineinfile:

    path: "/etc/openvpn/{{ openvpn_server.name }}/conf.tmp"