Dustin C. Hatch
42b8d2e54f
The *dch-vpn-server* role configures strongSwan to act as an IPsec responder for `vpn.pyrocufflink.net` and provide an IKEv2/IPsec VPN for remote access clients, as well as the reverse VPN to FireMon.
40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
- name: ensure pyrocufflink vpn connection is configured
|
|
copy:
|
|
src=vpn.pyrocufflink.net.ipsec.conf
|
|
dest=/etc/strongswan/ipsec.d/conns/vpn.pyrocufflink.net.conf
|
|
mode=0644
|
|
notify: restart strongswan
|
|
- name: ensure pyrocufflink vpn secret is configured
|
|
copy:
|
|
src=vpn.pyrocufflink.net.secret
|
|
dest=/etc/strongswan/ipsec.secrets.d/vpn.pyrocufflink.net
|
|
mode=0600
|
|
notify: restart strongswan
|
|
|
|
- name: ensure dch ca certificates are installed
|
|
copy:
|
|
src={{ item }}
|
|
dest=/etc/strongswan/ipsec.d/cacerts/{{ item|basename }}
|
|
mode=0644
|
|
with_items:
|
|
- certs/dch-root-ca.crt
|
|
- certs/dch-ca.crt
|
|
notify: restart strongswan
|
|
- name: ensure vpn server certificate is installed
|
|
copy:
|
|
src=certs/vpn.pyrocufflink.net.cer
|
|
dest=/etc/strongswan/ipsec.d/certs/
|
|
mode=0644
|
|
notify: restart strongswan
|
|
- name: ensure vpn server private key is installed
|
|
copy:
|
|
src=certs/vpn.pyrocufflink.net.key
|
|
dest=/etc/strongswan/ipsec.d/private/
|
|
mode=0400
|
|
notify: restart strongswan
|
|
|
|
- name: ensure strongswan is running
|
|
service:
|
|
name=strongswan
|
|
state=started
|