Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make LDAP client certificates optional/configurable and add new options for Bridge interface #52

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

Make LDAP client certificates optional/configurable and add new options for Bridge interface #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1b0e041
LDAP: make TLS client certificates optional and configurable
Nov 14, 2016
c675c46
Make bridge interface more configurable
Nov 25, 2016
60d7e2f
Make backwards compatible with no bridge ports defined
Jan 17, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,12 +91,15 @@ openvpn_simple_auth_password: password
# the network configuration is changed;
# if this happens just run the playbook again
openvpn_bridge:
ports: "eth0 tap0"
address: 10.0.0.1
netmask: 255.255.255.0
network: 10.0.0.0
broadcast: 10.0.0.255
dhcp_start: 10.0.0.2
dhcp_end: 10.0.0.254
script:
- post-up ip route add <...>
openvpn_server_options:
- "dev-type tap"
- "tls-server"
Expand Down
4 changes: 4 additions & 0 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,10 @@ openvpn_use_pam_users: [] # If empty use system users
# LDAP authentication and configuration (optional)
openvpn_use_ldap: no
openvpn_ldap_tlsenable: 'no'
openvpn_ldap_tls_cacert: '/etc/ssl/ca-cert.pem'
openvpn_ldap_tls_use_clientcert: 'no'
openvpn_ldap_tls_clientcert: '/etc/ssl/client-cert.pem'
openvpn_ldap_tls_clientkey: '/etc/ssl/client-key.pem'
openvpn_ldap_follow_referrals: 'no'

# Use simple authentication (default is disabled)
Expand Down
7 changes: 4 additions & 3 deletions templates/auth-ldap.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,16 @@
FollowReferrals {{ openvpn_ldap_follow_referrals }}

# TLS CA Certificate File
TLSCACertFile /etc/ssl/ca-cert.pem
TLSCACertFile {{ openvpn_ldap_tls_cacert }}

# TLS CA Certificate Directory
TLSCACertDir /etc/ssl/certs

{% if openvpn_ldap_tls_use_clientcert != 'no' -%}
# Client Certificate and key
# If TLS client authentication is required
TLSCertFile /etc/ssl/client-cert.pem
TLSKeyFile /etc/ssl/client-key.pem
TLSCertFile {{ openvpn_ldap_tls_clientcert }}
TLSKeyFile {{ openvpn_ldap_tls_clientkey }}{% endif -%}

# Cipher Suite
# The defaults are usually fine here
Expand Down
7 changes: 6 additions & 1 deletion templates/bridge-interface.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,14 @@ iface {{ openvpn_dev }} inet manual
# Bridge
auto br-{{ openvpn_dev }}
iface br-{{ openvpn_dev }} inet static
bridge_ports {{ openvpn_dev }}
bridge_ports {% if 'ports' in openvpn_bridge %}{{ openvpn_bridge.ports }}
Copy link
Contributor

@nemesifier nemesifier Jan 17, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(this is just a style related comment)
even if it would be long, I would prefer having everything on oneline, the resulting configuration would look more readable, although I would have to test it, which I haven't yet. Have you tested it and if yes does the resulting configuration file look ok and works?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know that the formatting is ugly this way, but otherwise you have the next line either indented one tabstop too much, or on the same line. If there was any way to force a newline character, i'd put it as a oneliner, too! =)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

{% else %}{{ openvpn_dev }}
{% endif -%}
Copy link
Contributor

@nemesifier nemesifier Jan 17, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure the - at the end is ok? Shouldn't it be {% endif %}, or is it a jinja2 feature I don't know?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The - removes the whitespace/newline, depending on where you put it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

bridge_stp off
address {{openvpn_bridge.address}}
netmask {{openvpn_bridge.netmask}}
network {{openvpn_bridge.network}}
broadcast {{openvpn_bridge.broadcast}}
{% for line in openvpn_bridge.script -%}
{{ line }}
{% endfor %}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given this structure, the dict openvpn_bridge must contain a script list element. If that's truly a requirement, fine as-is, otherwise a |default([]) would come in handy here.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@conorsch you are right, I was not thinking about it. Yes, keeping backward compatibility is better, I would prefer it, what do you think @jangrewe?