class site_openvpn { # parse hiera config $ip_address = hiera('ip_address') $interface = getvar("$::{ip_address}_interface") #$gateway_address = hiera('gateway_address') $openvpn_config = hiera('openvpn') $openvpn_gateway_address = $openvpn_config['gateway_address'] $openvpn_tcp_network_prefix = '10.1.0' $openvpn_tcp_netmask = '255.255.248.0' $openvpn_tcp_cidr = '21' $openvpn_udp_network_prefix = '10.2.0' $openvpn_udp_netmask = '255.255.248.0' $openvpn_udp_cidr = '21' $x509_config = hiera('x509') # deploy ca + server keys include site_openvpn::keys # create 2 openvpn config files, one for tcp, one for udp site_openvpn::server_config { 'tcp_config': port => '1194', proto => 'tcp', local => $openvpn_gateway_address, server => "${openvpn_tcp_network_prefix.0} ${openvpn_tcp_netmask}", push => "\"dhcp-option DNS ${openvpn_tcp_network_prefix}.1\"", management => '127.0.0.1 1000' } site_openvpn::server_config { 'udp_config': port => '1194', proto => 'udp', server => "${openvpn_udp_network_prefix.0} ${openvpn_udp_netmask}", push => "\"dhcp-option DNS ${openvpn_udp_network_prefix}.1\"", local => $openvpn_gateway_address, management => '127.0.0.1 1001' } # add second IP on given interface file { '/usr/local/bin/leap_add_second_ip.sh': content => "#!/bin/sh ip addr show dev $interface | grep -q ${openvpn_gateway_address}/24 || ip addr add ${openvpn_gateway_address}/24 dev $interface /bin/echo 1 > /proc/sys/net/ipv4/ip_forward ", mode => '0755', } exec { '/usr/local/bin/leap_add_second_ip.sh': subscribe => File['/usr/local/bin/leap_add_second_ip.sh'], } cron { 'leap_add_second_ip.sh': command => "/usr/local/bin/leap_add_second_ip.sh", user => 'root', special => 'reboot', } # setup the resolver to listen on the vpn IP include site_openvpn::resolver include site_shorewall::eip package { 'openvpn': ensure => installed; } service { 'openvpn': ensure => running, hasrestart => true, hasstatus => true, require => Exec['concat_/etc/default/openvpn']; } file { '/etc/openvpn': ensure => directory, require => Package['openvpn']; } file { '/etc/openvpn/keys': ensure => directory, require => Package['openvpn']; } concat { '/etc/default/openvpn': owner => root, group => root, mode => 644, warn => true, notify => Service['openvpn']; } concat::fragment { 'openvpn.default.header': content => template('openvpn/etc-default-openvpn.erb'), target => '/etc/default/openvpn', order => 01; } concat::fragment { "openvpn.default.autostart.${name}": content => 'AUTOSTART=all', target => '/etc/default/openvpn', order => 10; } }