.

roles/opnsense/tasks/openvpn-clients.yml

@@ -0,0 +1,64 @@
+---
+# OpenVPN client instances and TLS static keys.
+#
+# Prerequisites — must be done manually in OPNsense WebUI before running:
+#   - Import CA certificates:     System → Trust → Authorities
+#   - Import client certificates: System → Trust → Certificates
+#     (includes the private key — decrypt it first if encrypted)
+#
+# After running — set manually in WebUI per client under
+# VPN → OpenVPN → Clients → Edit → Custom options:
+#   ncp-disable
+#   tls-version-min 1.2
+#   tls-cipher <cipher>
+#   cipher <cipher>
+#   reneg-bytes <n>
+#   reneg-pkts <n>
+#
+# Known limitation: oxlorg.opnsense resolves the tls-crypt key by matching
+# the END of the API value string, which has the format:
+#   "<name> [<mode> (<description>)]"
+# Since the name is at the beginning, matching by name alone does not work.
+# Workaround: pass the full value string as the key parameter, e.g.:
+#   key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]"
+
+- name: Configure OpenVPN static (tls-crypt) keys
+  oxlorg.opnsense.openvpn_static_key:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    name: "{{ item.name }}"
+    mode: "{{ item.mode | default('crypt') }}"
+    key: "{{ item.key }}"
+    state: "{{ item.state | default('present') }}"
+  loop: "{{ opnsense_openvpn_static_keys }}"
+  no_log: true
+
+- name: Configure OpenVPN clients
+  oxlorg.opnsense.openvpn_client:
+    firewall: "{{ opnsense_firewall }}"
+    api_key: "{{ opnsense_api_key }}"
+    api_secret: "{{ opnsense_api_secret }}"
+    ssl_verify: "{{ opnsense_ssl_verify }}"
+    api_port: "{{ opnsense_api_port }}"
+    name: "{{ item.name }}"
+    remote: "{{ item.remote }}"
+    protocol: "{{ item.protocol | default('udp') }}"
+    mode: "{{ item.mode | default('tun') }}"
+    ca: "{{ item.ca | default(omit) }}"
+    certificate: "{{ item.certificate | default(omit) }}"
+    key: "{{ item.key | default(omit) }}"
+    authentication: "{{ item.authentication | default(omit) }}"
+    verify_remote_certificate: "{{ item.verify_remote_certificate | default(false) }}"
+    username: "{{ item.username | default(omit) }}"
+    password: "{{ item.password | default(omit) }}"
+    keepalive_interval: "{{ item.keepalive_interval | default(omit) }}"
+    keepalive_timeout: "{{ item.keepalive_timeout | default(omit) }}"
+    renegotiate_time: "{{ item.renegotiate_time | default(omit) }}"
+    log_level: "{{ item.log_level | default(3) }}"
+    enabled: "{{ item.enabled | default(true) }}"
+    state: "{{ item.state | default('present') }}"
+  loop: "{{ opnsense_openvpn_clients }}"
+  no_log: true