65 lines
2.7 KiB
YAML
65 lines
2.7 KiB
YAML
---
|
|
# OpenVPN client instances and TLS static keys.
|
|
#
|
|
# Prerequisites — must be done manually in OPNsense WebUI before running:
|
|
# - Import CA certificates: System → Trust → Authorities
|
|
# - Import client certificates: System → Trust → Certificates
|
|
# (includes the private key — decrypt it first if encrypted)
|
|
#
|
|
# After running — set manually in WebUI per client under
|
|
# VPN → OpenVPN → Clients → Edit → Custom options:
|
|
# ncp-disable
|
|
# tls-version-min 1.2
|
|
# tls-cipher <cipher>
|
|
# cipher <cipher>
|
|
# reneg-bytes <n>
|
|
# reneg-pkts <n>
|
|
#
|
|
# Known limitation: oxlorg.opnsense resolves the tls-crypt key by matching
|
|
# the END of the API value string, which has the format:
|
|
# "<name> [<mode> (<description>)]"
|
|
# Since the name is at the beginning, matching by name alone does not work.
|
|
# Workaround: pass the full value string as the key parameter, e.g.:
|
|
# key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]"
|
|
|
|
- name: Configure OpenVPN static (tls-crypt) keys
|
|
oxlorg.opnsense.openvpn_static_key:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
name: "{{ item.name }}"
|
|
mode: "{{ item.mode | default('crypt') }}"
|
|
key: "{{ item.key }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
loop: "{{ opnsense_openvpn_static_keys }}"
|
|
no_log: true
|
|
|
|
- name: Configure OpenVPN clients
|
|
oxlorg.opnsense.openvpn_client:
|
|
firewall: "{{ opnsense_firewall }}"
|
|
api_key: "{{ opnsense_api_key }}"
|
|
api_secret: "{{ opnsense_api_secret }}"
|
|
ssl_verify: "{{ opnsense_ssl_verify }}"
|
|
api_port: "{{ opnsense_api_port }}"
|
|
name: "{{ item.name }}"
|
|
remote: "{{ item.remote }}"
|
|
protocol: "{{ item.protocol | default('udp') }}"
|
|
mode: "{{ item.mode | default('tun') }}"
|
|
ca: "{{ item.ca | default(omit) }}"
|
|
certificate: "{{ item.certificate | default(omit) }}"
|
|
key: "{{ item.key | default(omit) }}"
|
|
authentication: "{{ item.authentication | default(omit) }}"
|
|
verify_remote_certificate: "{{ item.verify_remote_certificate | default(false) }}"
|
|
username: "{{ item.username | default(omit) }}"
|
|
password: "{{ item.password | default(omit) }}"
|
|
keepalive_interval: "{{ item.keepalive_interval | default(omit) }}"
|
|
keepalive_timeout: "{{ item.keepalive_timeout | default(omit) }}"
|
|
renegotiate_time: "{{ item.renegotiate_time | default(omit) }}"
|
|
log_level: "{{ item.log_level | default(3) }}"
|
|
enabled: "{{ item.enabled | default(true) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
loop: "{{ opnsense_openvpn_clients }}"
|
|
no_log: true
|