summaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'manifests')
-rw-r--r--manifests/client.pp135
-rw-r--r--manifests/config.pp33
-rw-r--r--manifests/init.pp62
-rw-r--r--manifests/install.pp30
-rw-r--r--manifests/server.pp127
-rw-r--r--manifests/service.pp24
6 files changed, 328 insertions, 83 deletions
diff --git a/manifests/client.pp b/manifests/client.pp
index 6abef5e..581eece 100644
--- a/manifests/client.pp
+++ b/manifests/client.pp
@@ -1,5 +1,89 @@
-# client.pp
-
+# == Define: openvpn::client
+#
+# This define creates the client certs for a specified openvpn server as well
+# as creating a tarball that can be directly imported into openvpn clients
+#
+#
+# === Parameters
+#
+# [*server*]
+# String. Name of the corresponding openvpn endpoint
+# Required
+#
+# [*compression*]
+# String. Which compression algorithim to use
+# Default: comp-lzo
+# Options: comp-lzo or '' (disable compression)
+#
+# [*dev*]
+# String. Device method
+# Default: tun
+# Options: tun (routed connections), tap (bridged connections)
+#
+# [*mute*]
+# Integer. Set log mute level
+# Default: 20
+#
+# [*mute_replay_warnings*]
+# Boolean. Silence duplicate packet warnings (common on wireless networks)
+# Default: true
+#
+# [*nobind*]
+# Boolean. Whether or not to bind to a specific port number
+# Default: true
+#
+# [*persist_key*]
+# Boolean. Try to retain access to resources that may be unavailable
+# because of privilege downgrades
+# Default: true
+#
+# [*persist_tun*]
+# Boolean. Try to retain access to resources that may be unavailable
+# because of privilege downgrades
+# Default: true
+#
+# [*port*]
+# Integer. The port the openvpn server service is running on
+# Default: 1194
+#
+# [*proto*]
+# String. What IP protocol is being used.
+# Default: tcp
+# Options: tcp or udp
+#
+# [*remote_host*]
+# String. The IP or hostname of the openvpn server service
+# Default: FQDN
+#
+# [*resolv_retry*]
+# Integer/String. How many seconds should the openvpn client try to resolve
+# the server's hostname
+# Default: infinite
+# Options: Integer or infinite
+#
+# [*verb*]
+# Integer. Level of logging verbosity
+# Default: 3
+#
+#
+# === Examples
+#
+# openvpn::client {
+# 'my_user':
+# server => 'contractors',
+# remote_host => 'vpn.mycompany.com'
+# }
+#
+# * Removal:
+# Manual process right now, todo for the future
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
define openvpn::client(
$server,
$compression = 'comp-lzo',
@@ -7,7 +91,6 @@ define openvpn::client(
$mute = '20',
$mute_replay_warnings = true,
$nobind = true,
- $ns_cert_type = 'server',
$persist_key = true,
$persist_tun = true,
$port = '1194',
@@ -16,41 +99,37 @@ define openvpn::client(
$resolv_retry = 'infinite',
$verb = '3',
) {
+
+ Openvpn::Server[$server] ->
+ Openvpn::Client[$name]
+
exec {
"generate certificate for ${name} in context of ${server}":
command => ". ./vars && ./pkitool ${name}",
cwd => "/etc/openvpn/${server}/easy-rsa",
creates => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
- provider => 'shell',
- require => Exec["generate server cert ${server}"];
+ provider => 'shell';
}
file {
- "/etc/openvpn/${server}/download-configs/${name}":
- ensure => directory,
- require => File["/etc/openvpn/${server}/download-configs"];
-
- "/etc/openvpn/${server}/download-configs/${name}/keys":
- ensure => directory,
- require => File["/etc/openvpn/${server}/download-configs/${name}"];
+ [ "/etc/openvpn/${server}/download-configs/${name}",
+ "/etc/openvpn/${server}/download-configs/${name}/keys"]:
+ ensure => directory;
"/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt":
ensure => link,
target => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
- require => [ Exec["generate certificate for ${name} in context of ${server}"],
- File["/etc/openvpn/${server}/download-configs/${name}/keys"] ];
+ require => Exec["generate certificate for ${name} in context of ${server}"];
"/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key":
ensure => link,
target => "/etc/openvpn/${server}/easy-rsa/keys/${name}.key",
- require => [ Exec["generate certificate for ${name} in context of ${server}"],
- File["/etc/openvpn/${server}/download-configs/${name}/keys"] ];
+ require => Exec["generate certificate for ${name} in context of ${server}"];
"/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt":
ensure => link,
target => "/etc/openvpn/${server}/easy-rsa/keys/ca.crt",
- require => [ Exec["generate certificate for ${name} in context of ${server}"],
- File["/etc/openvpn/${server}/download-configs/${name}/keys"] ];
+ require => Exec["generate certificate for ${name} in context of ${server}"];
"/etc/openvpn/${server}/download-configs/${name}/${name}.conf":
owner => root,
@@ -60,16 +139,16 @@ define openvpn::client(
notify => Exec["tar the thing ${server} with ${name}"];
}
- concat {
- "/etc/openvpn/${server}/client-configs/${name}":
- owner => root,
- group => root,
- mode => 644,
- warn => true,
- force => true,
- notify => Exec["tar the thing ${server} with ${name}"],
- require => [ File['/etc/openvpn'], File["/etc/openvpn/${server}/download-configs/${name}"] ];
- }
+# concat {
+# "/etc/openvpn/${server}/client-configs/${name}":
+# owner => root,
+# group => root,
+# mode => 644,
+# warn => true,
+# force => true,
+# notify => Exec["tar the thing ${server} with ${name}"],
+# require => [ File['/etc/openvpn'], File["/etc/openvpn/${server}/download-configs/${name}"] ];
+# }
exec {
"tar the thing ${server} with ${name}":
diff --git a/manifests/config.pp b/manifests/config.pp
new file mode 100644
index 0000000..9e7753d
--- /dev/null
+++ b/manifests/config.pp
@@ -0,0 +1,33 @@
+# == Class: openvpn::config
+#
+# This class sets up the openvpn enviornment as well as the default config file
+#
+#
+# === Examples
+#
+# This class should not be directly invoked
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+class openvpn::config {
+ include concat::setup
+
+ concat {
+ '/etc/default/openvpn':
+ owner => root,
+ group => root,
+ mode => 644,
+ warn => true;
+ }
+
+ concat::fragment {
+ 'openvpn.default.header':
+ content => template('openvpn/etc-default-openvpn.erb'),
+ target => '/etc/default/openvpn',
+ order => 01;
+ }
+} \ No newline at end of file
diff --git a/manifests/init.pp b/manifests/init.pp
index a3dd70c..173b9bd 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,45 +1,27 @@
-# openvpn.pp
-
+# == Class: openvpn
+#
+# This module installs the openvpn service, configures vpn endpoints, generates
+# client certificates, and generates client config files
+#
+#
+# === Examples
+#
+# * Installation:
+# class { 'openvpn': }
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
class openvpn {
- package {
- 'openvpn':
- ensure => installed;
- }
- service {
- 'openvpn':
- ensure => running,
- enable => true,
- hasrestart => true,
- hasstatus => true,
- require => Exec['concat_/etc/default/openvpn'];
- }
- file {
- '/etc/openvpn':
- ensure => directory,
- require => Package['openvpn'];
- }
- file {
- '/etc/openvpn/keys':
- ensure => directory,
- require => File['/etc/openvpn'];
- }
-
- include concat::setup
- concat {
- '/etc/default/openvpn':
- owner => root,
- group => root,
- mode => 644,
- warn => true,
- notify => Service['openvpn'];
- }
+ class {'openvpn::install': } ->
+ class {'openvpn::config': } ~>
+ class {'openvpn::service': } ->
+ Class['openvpn']
- concat::fragment {
- 'openvpn.default.header':
- content => template('openvpn/etc-default-openvpn.erb'),
- target => '/etc/default/openvpn',
- order => 01;
- }
}
diff --git a/manifests/install.pp b/manifests/install.pp
new file mode 100644
index 0000000..c22775d
--- /dev/null
+++ b/manifests/install.pp
@@ -0,0 +1,30 @@
+# == Class: openvpn
+#
+# This module installs the openvpn service, configures vpn endpoints, generates
+# client certificates, and generates client config files
+#
+#
+# === Examples
+#
+# This class should not be directly invoked
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+class openvpn::install {
+
+ package {
+ 'openvpn':
+ ensure => installed;
+ }
+
+ file {
+ [ '/etc/openvpn', '/etc/openvpn/keys' ]:
+ ensure => directory,
+ require => Package['openvpn'];
+ }
+} \ No newline at end of file
diff --git a/manifests/server.pp b/manifests/server.pp
index ad9351a..20dceed 100644
--- a/manifests/server.pp
+++ b/manifests/server.pp
@@ -1,5 +1,98 @@
-# server.pp
-
+# == Define: openvpn::server
+#
+# This define creates the openvpn server instance and ssl certificates
+#
+#
+# === Parameters
+#
+# [*country*]
+# String. Country to be used for the SSL certificate
+#
+# [*province*]
+# String. Province to be used for the SSL certificate
+#
+# [*city*]
+# String. City to be used for the SSL certificate
+#
+# [*organization*]
+# String. Organization to be used for the SSL certificate
+#
+# [*email*]
+# String. Email address to be used for the SSL certificate
+#
+# [*compression*]
+# String. Which compression algorithim to use
+# Default: comp-lzo
+# Options: comp-lzo or '' (disable compression)
+#
+# [*dev*]
+# String. Device method
+# Default: tun
+# Options: tun (routed connections), tap (bridged connections)
+#
+# [*group*]
+# String. User to drop privileges to after startup
+# Default: nobody
+#
+# [*ipp*]
+# Boolean. Persist ifconfig information to a file to retain client IP
+# addresses between sessions
+# Default: true
+#
+# [*local*]
+# String. Interface for openvpn to bind to.
+# Default: $::ipaddress_eth0
+# Options: An IP address or '' to bind to all ip addresses
+#
+# [*logfile*]
+# String. Logfile for this openvpn server
+# Default: "${name}/openvpn.log"
+#
+# [*port*]
+# Integer. The port the openvpn server service is running on
+# Default: 1194
+#
+# [*proto*]
+# String. What IP protocol is being used.
+# Default: tcp
+# Options: tcp or udp
+#
+# [*status_log*]
+# String. Logfile for periodic dumps of the vpn service status
+# Default: "${name}/openvpn-status.log"
+#
+# [*user*]
+# String. Group to drop privileges to after startup
+# Default: nobody
+#
+# [*server*]
+# String. Network to assign client addresses out of
+# Default: $::network_eth0 $::netmask_eth0
+#
+# [*push*]
+# Array. Options to push out to the client. This can include routes, DNS
+# servers, DNS search domains, and many other options.
+# Default: []
+#
+#
+# === Examples
+#
+# openvpn::client {
+# 'my_user':
+# server => 'contractors',
+# remote_host => 'vpn.mycompany.com'
+# }
+#
+# * Removal:
+# Manual process right now, todo for the future
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
define openvpn::server(
$country,
$province,
@@ -7,19 +100,23 @@ define openvpn::server(
$organization,
$email,
$compression = 'comp-lzo',
- $port = '1194',
- $proto = 'tcp',
+ $dev = 'tun0',
$group = 'nobody',
- $user = 'nobody',
+ $ipp = true,
+ $local = $::ipaddress_eth0,
$logfile = "${name}/openvpn.log",
+ $port = '1194',
+ $proto = 'tcp',
$status_log = "${name}/openvpn-status.log",
- $dev = 'tun0',
- $local = $::ipaddress_eth0,
- $ipp = false,
+ $user = 'nobody',
$server = "${::network_eth0} ${::netmask_eth0}",
$push = []
) {
- include openvpn
+
+ include openvpn
+ Class['openvpn::install'] ->
+ Openvpn::Server[$name] ~>
+ Class['openvpn::service']
$easyrsa_source = $::osfamily ? {
'RedHat' => '/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0',
@@ -33,22 +130,23 @@ define openvpn::server(
file {
["/etc/openvpn/${name}", "/etc/openvpn/${name}/client-configs", "/etc/openvpn/${name}/download-configs" ]:
- ensure => directory,
- require => Package['openvpn'];
+ ensure => directory;
}
exec {
"copy easy-rsa to openvpn config folder ${name}":
command => "/bin/cp -r ${easyrsa_source} /etc/openvpn/${name}/easy-rsa",
creates => "/etc/openvpn/${name}/easy-rsa",
- notify => Exec['fix_easyrsa_file_permissions'],
+ notify => Exec["fix_easyrsa_file_permissions_${name}"],
require => File["/etc/openvpn/${name}"];
}
+
exec {
- 'fix_easyrsa_file_permissions':
+ "fix_easyrsa_file_permissions_${name}":
refreshonly => true,
command => "/bin/chmod 755 /etc/openvpn/${name}/easy-rsa/*";
}
+
file {
"/etc/openvpn/${name}/easy-rsa/vars":
ensure => present,
@@ -109,7 +207,6 @@ define openvpn::server(
owner => root,
group => root,
mode => '0444',
- content => template('openvpn/server.erb'),
- notify => Service['openvpn'];
+ content => template('openvpn/server.erb');
}
}
diff --git a/manifests/service.pp b/manifests/service.pp
new file mode 100644
index 0000000..57d764d
--- /dev/null
+++ b/manifests/service.pp
@@ -0,0 +1,24 @@
+# == Class: openvpn::config
+#
+# This class maintains the openvpn service
+#
+#
+# === Examples
+#
+# This class should not be directly invoked
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+class openvpn::service {
+ service {
+ 'openvpn':
+ ensure => running,
+ enable => true,
+ hasrestart => true,
+ hasstatus => true;
+ }
+} \ No newline at end of file