--- - name: Install StrongSwan hosts: vpn-host gather_facts: false remote_user: root vars_files: - config.cfg tasks: - name: Wait for port 22 to become available local_action: "wait_for port=22 host={{ inventory_hostname }}" #- name: Updating apt-get #raw: apt-get update -qq #- name: Install python2.7 for Ansible #raw: apt-get install -qq -y python2.7 #- name: Install StrongSwan #apt: name=strongswan state=latest update_cache=yes #- name: Enable strongswan #service: name=strongswan enabled=yes #- name: Enable packet forwarding for IPv4 #sysctl: name=net.ipv4.ip_forward value=1 #- name: Do not accept ICMP redirects (prevent MITM attacks) #sysctl: name=net.ipv4.conf.all.accept_redirects value=0 #- name: Do not send ICMP redirects (we are not a router) #sysctl: name=net.ipv4.conf.all.send_redirects value=0 #- name: Configure iptables so IPSec traffic can traverse the tunnel #iptables: table=nat chain=POSTROUTING source=10.0.0.0/24 jump=MASQUERADE #- name: Setup the ipsec.conf file from our template #template: src=ipsec.conf.j2 dest=/etc/ipsec.conf owner=root group=root mode=644 #notify: #- restart strongswan #- name: Setup the ipsec.secrets file with users and passwords #template: src=ipsec.secrets.j2 dest=/etc/ipsec.secrets owner=root group=root mode=600 #notify: #- restart strongswan #- name: Install git #apt: name=git state=latest - name: Fetch easy-rsa-ipsec repo git: repo=git://github.com/ValdikSS/easy-rsa-ipsec.git dest="{{ easyrsa_dir }}" - name: Setup the vars file from our template template: src=easy-rsa.vars.j2 dest={{ easyrsa_dir }}/easyrsa3/vars - name: Ensure the pki directory is not exist file: dest={{ easyrsa_dir }}/easyrsa3/pki state=absent when: easyrsa_reinit_existent == True - name: Build the pki enviroments shell: | ./easyrsa init-pki touch '{{ easyrsa_dir }}/easyrsa3/pki/pki_initialized' args: chdir: '{{ easyrsa_dir }}/easyrsa3/' creates: '{{ easyrsa_dir }}/easyrsa3/pki/pki_initialized' - name: Build the CA pair shell: | ./easyrsa build-ca nopass touch {{ easyrsa_dir }}/easyrsa3/pki/ca_initialized args: chdir: '{{ easyrsa_dir }}/easyrsa3/' creates: '{{ easyrsa_dir }}/easyrsa3/pki/ca_initialized' notify: - restart strongswan - name: Build the server pair shell: | ./easyrsa build-server-full {{ server_name }} nopass touch '{{ easyrsa_dir }}/easyrsa3/pki/server_initialized' args: chdir: '{{ easyrsa_dir }}/easyrsa3/' creates: '{{ easyrsa_dir }}/easyrsa3/pki/server_initialized' notify: - restart strongswan - name: Build the client's pair shell: | ./easyrsa build-client-full {{ item }} nopass touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized' args: chdir: '{{ easyrsa_dir }}/easyrsa3/' creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_initialized' with_items: "{{ users }}" - name: Build the client's p12 shell: | ./easyrsa export-p12 {{ item }} nopass touch '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_p12_initialized' args: chdir: '{{ easyrsa_dir }}/easyrsa3/' creates: '{{ easyrsa_dir }}/easyrsa3/pki/{{ item }}_p12_initialized' with_items: "{{ users }}" - name: Make the CA cert to the strongswan directory copy: remote_src=True src='{{ easyrsa_dir }}/easyrsa3/pki/ca.crt' dest=/etc/ipsec.d/cacerts/ca.crt owner=root group=root mode=0600 notify: - restart strongswan - name: Make the server cert to the strongswan directory copy: remote_src=True src='{{ easyrsa_dir }}/easyrsa3/pki/issued/{{ server_name }}.crt' dest=/etc/ipsec.d/certs/{{ server_name }}.crt owner=root group=root mode=0600 notify: - restart strongswan - name: Make the server key to the strongswan directory copy: remote_src=True src='{{ easyrsa_dir }}/easyrsa3/pki/private/{{ server_name }}.key' dest=/etc/ipsec.d/private/{{ server_name }}.key owner=root group=root mode=0600 notify: - restart strongswan - name: restart strongswan service: name=strongswan state=restarted handlers: - name: restart strongswan service: name=strongswan state=restarted