basic configuration for openvpn server files

3 files changed, 111 insertions, 43 deletions

diff --git a/puppet/manifests/site.pp b/puppet/manifests/site.pp
index 98e683af..f7b7303f 100644
--- a/puppet/manifests/site.pp
+++ b/puppet/manifests/site.pp
@@ -1,19 +1,18 @@
-define print() {
-  notice("The value is: '${name}'")
-}
-
 node 'default' {
-  $concat_basedir =  '/var/lib/puppet/modules/concat'
+  # $concat_basedir =  '/var/lib/puppet/modules/concat'  # do we need this ?
   include concat::setup
 
   $services=hiera_array('services')
   notice("Services for $fqdn: $services")
 
   if 'eip' in $services {
+    include site_openvpn
+
     $tor=hiera('tor')
     notice("Tor enabled: $tor")
 
-    $openvpn_config=hiera('openvpn')
-    create_resources('site_openvpn::server_config', $openvpn_config)
+    $openvpn_configs=hiera('openvpn_server_configs')
+    create_resources('site_openvpn::server_config', $openvpn_configs)
+
   }
 }
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 7d63d569..c83b98c7 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -1,2 +1,43 @@
 class site_openvpn {
+  package {
+      "openvpn":
+          ensure => installed;
+  }
+  service {
+      "openvpn":
+          ensure     => running,
+          hasrestart => true,
+          hasstatus  => true,
+          require    => Exec["concat_/etc/default/openvpn"];
+  }
+  file {
+      "/etc/openvpn":
+          ensure  => directory,
+          require => Package["openvpn"];
+  }
+
+  include concat::setup
+
+  concat {
+      "/etc/default/openvpn":
+          owner  => root,
+          group  => root,
+          mode   => 644,
+          warn   => true,
+          notify => Service["openvpn"];
+  }
+
+  concat::fragment {
+      "openvpn.default.header":
+          content => template("openvpn/etc-default-openvpn.erb"),
+          target  => "/etc/default/openvpn",
+          order   => 01;
+  }
+
+  concat::fragment {                               
+    "openvpn.default.autostart.${name}":           
+        content => "AUTOSTART=all",                
+        target  => "/etc/default/openvpn",         
+        order   => 10;                             
+  }                                                
 }
diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index e0e8db4f..4a130d13 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -1,84 +1,112 @@
-define site_openvpn::server_config($port, $protocol) {
+define site_openvpn::server_config($port, $proto) {
   $openvpn_configname=$name
   notice("Creating OpenVPN $openvpn_configname:  
-    Port: $port, Protocol: $protocol")
+    Port: $port, Protocol: $proto")
+
+  file {                                           
+     "/etc/openvpn/${name}":                      
+         ensure  => directory,                    
+         require => Package["openvpn"];           
+  }                                                
+
+  concat {                                                                    
+    "/etc/openvpn/${openvpn_configname}.conf":                                            
+        owner   => root,                                                    
+        group   => root,                                                    
+        mode    => 644,                                                     
+        warn    => true,                                                    
+        require => File["/etc/openvpn"],                                    
+        notify  => Service["openvpn"];                                      
+  }      
 
-  $openvpn_server=$::fqdn
-  # we don't need a ca generated
-  #openvpn::server {
-  #  $openvpn_configname:
-  #      country      => hiera("country"),
-  #      province     => hiera("province"),
-  #      city         => hiera("city"),
-  #      organization => hiera("organization"),
-  #      email        => hiera("email");
-  #}
 
-  # configure server
-  # all config options need to be "hieraized"
 
   openvpn::option {
+    "ca ${openvpn_configname}":
+        key     => "ca",
+        value   => "/etc/openvpn/ca.crt",
+        #require => Exec["initca ${openvpn_configname}"],
+        server  => "${openvpn_configname}";
+    "cert ${openvpn_configname}":
+        key     => "cert",
+        value   => "/etc/openvpn/${openvpn_configname}/server.crt",
+        #require => Exec["generate server cert ${openvpn_configname}"],
+        server  => "${openvpn_configname}";
+    "key ${openvpn_configname}":
+        key     => "key",
+        value   => "/etc/openvpn/${openvpn_configname}/server.key",
+        #require => Exec["generate server cert ${openvpn_configname}"],
+        server  => "${openvpn_configname}";
+    "dh ${openvpn_configname}":
+        key     => "dh",
+        value   => "/etc/openvpn/dh1024.pem",
+        #require => Exec["generate dh param ${openvpn_configname}"],
+        server  => "${openvpn_configname}";
     "dev $openvpn_configname":
         key    => "dev",
         value  => "tun",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
+    "mode ${openvpn_configname}":            
+       key    => 'mode',      
+       value  => 'server',    
+       server => $openvpn_configname;       
     "script-security $openvpn_configname":
         key    => "script-security",
         value  => "3",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "daemon $openvpn_configname":
         key    => "daemon",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "keepalive $openvpn_configname":
         key    => "keepalive",
         value  => "10 60",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "ping-timer-rem $openvpn_configname":
         key    => "ping-timer-rem",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "persist-tun $openvpn_configname":
         key    => "persist-tun",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "persist-key $openvpn_configname":
         key    => "persist-key",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "proto $openvpn_configname":
         key    => "proto",
         value  => "$proto",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "cipher $openvpn_configname":
         key    => "cipher",
         value  => "BF-CBC",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "local $openvpn_configname":
         key    => "local",
         value  => $ipaddress,
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "tls-server $openvpn_configname":
         key    => "tls-server",
-        server => "$openvpn_server";
-    "server $openvpn_configname":
-        key    => "server",
-        value  => "$server",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
+    #"server $openvpn_configname":
+    #    key    => "server",
+    #    value  => "$server",
+    #    server => "$openvpn_configname";
     "lport $openvpn_configname":
         key    => "lport",
         value  => "$port",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "management $openvpn_configname":
         key    => "management",
         value  => "/var/run/openvpn-$openvpn_configname.sock unix",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "comp-lzo $openvpn_configname":
         key    => "comp-lzo",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
     "topology $openvpn_configname":
         key    => "topology",
         value  => "subnet",
-        server => "$openvpn_server";
-    "client-to-client $openvpn_configname":
-        key    => "client-to-client",
-        server => "$openvpn_server";
+        server => "$openvpn_configname";
+    #"client-to-client $openvpn_configname":
+    #    key    => "client-to-client",
+    #    server => "$openvpn_configname";
   }
 
 }