---
# OpenVPN client instances and TLS static keys.
#
# Prerequisites — must be done manually in OPNsense WebUI before running:
#   - Import CA certificates:     System → Trust → Authorities
#   - Import client certificates: System → Trust → Certificates
#     (includes the private key — decrypt it first if encrypted)
#
# After running — set manually in WebUI per client under
# VPN → OpenVPN → Clients → Edit → Custom options:
#   ncp-disable
#   tls-version-min 1.2
#   tls-cipher <cipher>
#   cipher <cipher>
#   reneg-bytes <n>
#   reneg-pkts <n>
#
# Known limitation: oxlorg.opnsense resolves the tls-crypt key by matching
# the END of the API value string, which has the format:
#   "<name> [<mode> (<description>)]"
# Since the name is at the beginning, matching by name alone does not work.
# Workaround: pass the full value string as the key parameter, e.g.:
#   key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]"

- name: Configure OpenVPN static (tls-crypt) keys
  oxlorg.opnsense.openvpn_static_key:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    name: "{{ item.name }}"
    mode: "{{ item.mode | default('crypt') }}"
    key: "{{ item.key }}"
    state: "{{ item.state | default('present') }}"
  loop: "{{ opnsense_openvpn_static_keys }}"
  no_log: true

- name: Configure OpenVPN clients
  oxlorg.opnsense.openvpn_client:
    firewall: "{{ opnsense_firewall }}"
    api_key: "{{ opnsense_api_key }}"
    api_secret: "{{ opnsense_api_secret }}"
    ssl_verify: "{{ opnsense_ssl_verify }}"
    api_port: "{{ opnsense_api_port }}"
    name: "{{ item.name }}"
    remote: "{{ item.remote }}"
    protocol: "{{ item.protocol | default('udp') }}"
    mode: "{{ item.mode | default('tun') }}"
    ca: "{{ item.ca | default(omit) }}"
    certificate: "{{ item.certificate | default(omit) }}"
    key: "{{ item.key | default(omit) }}"
    authentication: "{{ item.authentication | default(omit) }}"
    verify_remote_certificate: "{{ item.verify_remote_certificate | default(false) }}"
    username: "{{ item.username | default(omit) }}"
    password: "{{ item.password | default(omit) }}"
    keepalive_interval: "{{ item.keepalive_interval | default(omit) }}"
    keepalive_timeout: "{{ item.keepalive_timeout | default(omit) }}"
    renegotiate_time: "{{ item.renegotiate_time | default(omit) }}"
    log_level: "{{ item.log_level | default(3) }}"
    enabled: "{{ item.enabled | default(true) }}"
    state: "{{ item.state | default('present') }}"
  loop: "{{ opnsense_openvpn_clients }}"
  no_log: true