---

- hosts: localhost
  gather_facts: False
  vars_files:
    - config.cfg
  vars_prompt:

    - name: "server_ip"
      prompt: "Enter IP address of your server: (use localhost for local installation)\n"
      default: localhost
      private: no

    - name: "server_user"
      prompt: "What user should we use to login on the server? (ignore if you're deploying to localhost):\n"
      default: "root"
      private: no

    - name: "ssh_tunneling_enabled"
      prompt: "Do you want each user to have their own account for SSH tunneling? (y/n):\n"
      default: "n"
      private: no

    - name: "IP_subject"
      prompt: "Enter public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)\n"
      private: no

    - name: "easyrsa_CA_password"
      prompt: "Enter the password for the private CA key:\n"
      private: yes

  tasks:
    - name: Add the server to the vpn-host group
      add_host:
        hostname: "{{ server_ip }}"
        groupname: vpn-host
        ansible_ssh_user: "{{ server_user }}"
        ansible_python_interpreter: "/usr/bin/python2.7"
        ssh_tunneling_enabled: "{{ ssh_tunneling_enabled }}"
        easyrsa_CA_password: "{{ easyrsa_CA_password }}"
        IP_subject: "{{ IP_subject }}"

    - name: Wait until SSH becomes ready...
      local_action:
        module: wait_for
        port: 22
        host: "{{ server_ip }}"
        search_regex: "OpenSSH"
        delay: 10
        timeout: 320
        state: present
      become: false

- name: User management
  hosts: vpn-host
  gather_facts: false
  become: true
  vars_files:
    - config.cfg

  pre_tasks:
    - set_fact:
        IP_subject_alt_name: "{{ IP_subject }}"

  roles:
    - { role: ssh_tunneling, tags: [ 'ssh_tunneling' ], when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }

  tasks:

    - name: Gather Facts
      setup:

    - set_fact:
        easyrsa_p12_export_password: "{{ (ansible_date_time.iso8601_basic|sha1|to_uuid).split('-')[0] }}"

    - name: Build the client's pair
      shell: >
        ./easyrsa gen-req {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" -subj "/CN={{ item }}" &&
        ./easyrsa --subject-alt-name='DNS:{{ item }}' sign-req client {{ item }} nopass -- -passin pass:"{{ easyrsa_CA_password }}" &&
        touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
      args:
        chdir: '{{ easyrsa_dir }}/easyrsa3/'
        creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized'
      with_items: "{{ users }}"

    - name: Build the client's p12
      shell: >
        openssl pkcs12 -in {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt -inkey {{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.key -export -name {{ item }} -out /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 -certfile {{ easyrsa_dir }}/easyrsa3//pki/ca.crt -passout pass:{{ easyrsa_p12_export_password }}
      args:
        chdir: '{{ easyrsa_dir }}/easyrsa3/'
      with_items: "{{ users }}"

    - name: Get active users
      shell: >
        grep ^V pki/index.txt | grep -v "{{ IP_subject_alt_name }}" | awk '{print $5}' | sed 's/\/CN=//g'
      args:
        chdir: '{{ easyrsa_dir }}/easyrsa3/'
      register: valid_certs

    - name: Revoke non-existing users
      shell: >
        openssl ec -in pki/private/ca.key -out pki/private/ca.key -passin pass:"{{ easyrsa_CA_password }}" -passout pass:"" &&
        ipsec pki --signcrl --cacert {{ easyrsa_dir }}/easyrsa3//pki/ca.crt --cakey {{ easyrsa_dir }}/easyrsa3/pki/private/ca.key --reason superseded --cert {{ easyrsa_dir }}/easyrsa3//pki/issued/{{ item }}.crt > /etc/ipsec.d/crls/{{ item }}.der &&
        ./easyrsa revoke {{ item }} &&
        openssl ec -aes256 -in pki/private/ca.key -out pki/private/ca.key -passin pass:"" -passout pass:"{{ easyrsa_CA_password }}" &&
        ipsec rereadcrls
      args:
        chdir: '{{ easyrsa_dir }}/easyrsa3/'
      when: item not in users
      with_items: "{{ valid_certs.stdout_lines }}"

    - name: Register p12 PayloadContent
      shell: >
        cat /{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 | base64
      register:  PayloadContent
      with_items: "{{ users }}"

    - name: Register CA PayloadContent
      shell: >
        cat /{{ easyrsa_dir }}/easyrsa3/pki/ca.crt | base64
      register:  PayloadContentCA

    - name: Build the mobileconfigs
      template: src=roles/vpn/templates/mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600
      with_together:
        - "{{ users }}"
        - "{{ PayloadContent.results }}"
      no_log: True

    - name: Fetch users P12
      fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.p12 dest=configs/{{ IP_subject_alt_name }}_{{ item }}.p12 flat=yes
      with_items: "{{ users }}"

    - name: Fetch users mobileconfig
      fetch: src=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item }}.mobileconfig dest=configs/{{ IP_subject_alt_name }}_{{ item }}.mobileconfig flat=yes
      with_items: "{{ users }}"

    - name: Fetch server CA certificate
      fetch: src=/{{ easyrsa_dir }}/easyrsa3/pki/ca.crt dest=configs/{{ IP_subject_alt_name }}_ca.crt flat=yes

    # SSH

    - name: SSH | Get active system users
      shell: >
        getent group algo | cut -f4 -d: | sed "s/,/\n/g"
      register: valid_users
      when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y"

    - name: SSH | Delete non-existing users
      user:
        name: "{{ item }}"
        state: absent
        remove: yes
        force: yes
      when: item not in users and ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y"
      with_items: "{{ valid_users.stdout_lines | default('null') }}"

    - name: SSH | Fetch users SSH private keys
      fetch: src='/var/jail/{{ item }}/.ssh/id_rsa' dest=configs/{{ IP_subject_alt_name }}_{{ item }}.ssh.pem flat=yes
      when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y"
      with_items: "{{ users }}"

  post_tasks:
    - debug: msg="{{ congrats.split('\n') }}"
      tags: always