Skip to content

Commit 40a3646

Browse files
dtapiacldtapiacl
committed
(role/openvpn) add openvpn role and install
1 parent d92db4c commit 40a3646

16 files changed

+676
-0
lines changed

‎hieradata/node/vpn01.cp.lsst.org.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
nm::connections:
3+
enp65s0f0:
4+
content:
5+
connection:
6+
id: "enp65s0f0"
7+
uuid: "682a815d-eedf-a30b-774c-aae04c2d5ccb"
8+
type: "ethernet"
9+
interface-name: "enp65s0f0"
10+
ethernet: {}
11+
ipv4:
12+
address1: "139.229.160.82/24,139.229.160.254"
13+
dns: "139.229.160.53;139.229.160.54;139.229.160.55;"
14+
dns-search: "cp.lsst.org;"
15+
method: "manual"
16+
ipv6:
17+
method: "disabled"
18+
proxy: {}
19+
enp65s0f1:
20+
content:
21+
connection:
22+
id: "enp65s0f1"
23+
uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
24+
type: "ethernet"
25+
autoconnect: "false"
26+
interface-name: "enp65s0f1"
27+
ethernet: {}
28+
ipv4:
29+
method: "disabled"
30+
ipv6:
31+
method: "disabled"
32+
enp12s0f4u1u2c2:
33+
content:
34+
connection:
35+
id: "enp12s0f4u1u2c2"
36+
uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
37+
type: "ethernet"
38+
autoconnect: "false"
39+
interface-name: "enp12s0f4u1u2c2"
40+
ethernet: {}
41+
ipv4:
42+
method: "disabled"
43+
ipv6:
44+
method: "disabled"

‎hieradata/node/vpn01.dev.lsst.org.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
nm::connections:
3+
ens192:
4+
content:
5+
connection:
6+
id: "ens192"
7+
uuid: "03da7500-2101-c722-2438-d0d006c28c73"
8+
type: "ethernet"
9+
interface-name: "ens192"
10+
ethernet: {}
11+
ipv4:
12+
address1: "139.229.134.64/24,139.229.134.254"
13+
dns: "139.229.134.53;139.229.134.54;139.229.134.55;"
14+
dns-search: "dev.lsst.org;"
15+
method: "manual"
16+
ipv6:
17+
method: "disabled"
18+
proxy: {}

‎hieradata/node/vpn01.ls.lsst.org.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
nm::connections:
3+
enp129s0f1:
4+
content:
5+
connection:
6+
id: "enp129s0f1"
7+
uuid: "46d19ce1-bcab-7e77-6fc7-b730b26c54b1"
8+
type: "ethernet"
9+
interface-name: "enp129s0f1"
10+
ethernet: {}
11+
ipv4:
12+
address1: "139.229.138.20/24,139.229.138.254"
13+
dns: "139.229.135.53;139.229.135.54;139.229.135.55;"
14+
dns-search: "ls.lsst.org;"
15+
method: "manual"
16+
ipv6:
17+
method: "disabled"
18+
proxy: {}
19+
enp129s0f0:
20+
content:
21+
connection:
22+
id: "enp129s0f0"
23+
uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
24+
type: "ethernet"
25+
autoconnect: "false"
26+
interface-name: "enp129s0f0"
27+
ethernet: {}
28+
ipv4:
29+
method: "disabled"
30+
ipv6:
31+
method: "disabled"
32+
eno1np0:
33+
content:
34+
connection:
35+
id: "eno1np0"
36+
uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
37+
type: "ethernet"
38+
autoconnect: "false"
39+
interface-name: "eno1np0"
40+
ethernet: {}
41+
ipv4:
42+
method: "disabled"
43+
ipv6:
44+
method: "disabled"
45+
eno1np1:
46+
content:
47+
connection:
48+
id: "eno1np1"
49+
uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
50+
type: "ethernet"
51+
autoconnect: "false"
52+
interface-name: "eno1np1"
53+
ethernet: {}
54+
ipv4:
55+
method: "disabled"
56+
ipv6:
57+
method: "disabled"
58+
enp4s0f3u2u2c2:
59+
content:
60+
connection:
61+
id: "enp4s0f3u2u2c2"
62+
uuid: "de9904c8-9577-1a17-36b1-34b94132f06a"
63+
type: "ethernet"
64+
autoconnect: "false"
65+
interface-name: "enp4s0f3u2u2c2"
66+
ethernet: {}
67+
ipv4:
68+
method: "disabled"
69+
ipv6:
70+
method: "disabled"

‎hieradata/node/vpn02.cp.lsst.org.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
nm::connections:
3+
ens192:
4+
content:
5+
connection:
6+
id: "ens192"
7+
uuid: "51e4ccf4-1dd1-3081-9b28-0aa1291b79ac"
8+
type: "ethernet"
9+
interface-name: "ens192"
10+
ethernet: {}
11+
ipv4:
12+
address1: "139.229.160.83/24,139.229.160.254"
13+
dns: "139.229.160.53;139.229.160.54;139.229.160.55;"
14+
dns-search: "cp.lsst.org;"
15+
method: "manual"
16+
ipv6:
17+
method: "disabled"
18+
proxy: {}

‎hieradata/node/vpn02.dev.lsst.org.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
nm::connections:
3+
ens192:
4+
content:
5+
connection:
6+
id: "ens192"
7+
uuid: "03da7500-2101-c722-2438-d0d006c28c73"
8+
type: "ethernet"
9+
interface-name: "ens192"
10+
ethernet: {}
11+
ipv4:
12+
address1: "139.229.134.99/24,139.229.134.254"
13+
dns: "139.229.134.53;139.229.134.54;139.229.134.55;"
14+
dns-search: "dev.lsst.org;"
15+
method: "manual"
16+
ipv6:
17+
method: "disabled"
18+
proxy: {}

‎hieradata/node/vpn02.ls.lsst.org.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
nm::connections:
3+
ens192:
4+
content:
5+
connection:
6+
id: "ens192"
7+
uuid: "36e2d4c8-3d89-49c8-95f0-048af8c5fe28"
8+
type: "ethernet"
9+
interface-name: "ens192"
10+
ethernet: {}
11+
ipv4:
12+
address1: "139.229.138.21/24,139.229.138.254"
13+
dns: "139.229.135.53;139.229.135.54;139.229.135.55;"
14+
dns-search: "ls.lsst.org;"
15+
method: "manual"
16+
ipv6:
17+
method: "disabled"
18+
proxy: {}

‎hieradata/role/openvpn.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
classes:
3+
- "profile::core::common"
4+
- "profile::core::openvpn"
5+
6+
profile::core::openvpn::version: "2.14.3_5936bcd7"
7+
profile::core::openvpn::cluster: "vpn.%{::site}.lsst.org"

‎site/profile/manifests/core/openvpn.pp‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# @summary
2+
# Installs openvpn connect server.
3+
#
4+
# @param version
5+
# Sets version lock for openvpn package.
6+
#
7+
# @param cluster
8+
# Generates an additional certificate for vpn round robin setup.
9+
#
10+
class profile::core::openvpn (
11+
String[1] $version,
12+
String[1] $cluster,
13+
) {
14+
include yum::plugin::versionlock
15+
include profile::core::letsencrypt
16+
17+
yumrepo { 'as-repo-rhel9':
18+
ensure => 'present',
19+
name => 'openvpn-access-server',
20+
descr => 'OpenVPN Access Server',
21+
baseurl => 'http://as-repository.openvpn.net/as/yum/rhel9/',
22+
gpgkey => 'https://as-repository.openvpn.net/as-repo-public.gpg',
23+
gpgcheck => '1',
24+
enabled => '1',
25+
}
26+
27+
package { 'openvpn-as':
28+
ensure => $version,
29+
require => Yumrepo['as-repo-rhel9'],
30+
notify => Yum::Versionlock['openvpn-as'],
31+
}
32+
33+
yum::versionlock { 'openvpn-as':
34+
ensure => 'present',
35+
version => $version,
36+
release => '1.el9',
37+
arch => 'x86_64',
38+
}
39+
40+
# Host FQDN
41+
$fqdn = fact('networking.fqdn')
42+
43+
# Signed Certificate Location
44+
$le_root = "/etc/letsencrypt/live/${fqdn}"
45+
46+
# Generate and sign certificate
47+
letsencrypt::certonly { $fqdn:
48+
plugin => 'dns-route53',
49+
manage_cron => true,
50+
}
51+
52+
# Generate an additional certificate for round robin setup.
53+
letsencrypt::certonly { $cluster:
54+
plugin => 'dns-route53',
55+
manage_cron => true,
56+
}
57+
58+
# Create symbolic links for certificates
59+
file { '/usr/local/openvpn_as/etc/web-ssl/server.crt':
60+
ensure => 'link',
61+
target => "${le_root}/cert.pem",
62+
force => true,
63+
require => Letsencrypt::Certonly[$fqdn],
64+
}
65+
66+
file { '/usr/local/openvpn_as/etc/web-ssl/server.key':
67+
ensure => 'link',
68+
target => "${le_root}/privkey.pem",
69+
force => true,
70+
require => Letsencrypt::Certonly[$fqdn],
71+
}
72+
73+
file { '/usr/local/openvpn_as/etc/web-ssl/ca.crt':
74+
ensure => 'link',
75+
target => "${le_root}/fullchain.pem",
76+
force => true,
77+
require => Letsencrypt::Certonly[$fqdn],
78+
}
79+
80+
# Manage OpenVPN Access Server service
81+
service { 'openvpnas':
82+
ensure => 'running',
83+
enable => true,
84+
require => Package['openvpn-as'],
85+
}
86+
}

‎spec/classes/core/openvpn_spec.rb‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'profile::core::openvpn' do
6+
on_supported_os.each do |os, os_facts|
7+
next unless os =~ %r{almalinux-9-x86_64}
8+
9+
context "on #{os}" do
10+
let(:facts) { os_facts }
11+
12+
context 'with default parameters' do
13+
let(:params) do
14+
{
15+
version: '2.14.2_40b190d8',
16+
cluster: 'vpn.%{::site}.lsst.org',
17+
}
18+
end
19+
20+
it { is_expected.to compile.with_all_deps }
21+
22+
it { is_expected.to contain_class('profile::core::letsencrypt') }
23+
24+
it do
25+
is_expected.to contain_package('openvpn-as').with(
26+
ensure: '2.14.2_40b190d8',
27+
require: 'Yumrepo[as-repo-rhel9]'
28+
)
29+
end
30+
31+
it do
32+
is_expected.to contain_letsencrypt__certonly('vpn.%{::site}.lsst.org').with(
33+
plugin: 'dns-route53',
34+
manage_cron: true
35+
)
36+
end
37+
38+
it do
39+
is_expected.to contain_yumrepo('as-repo-rhel9').with(
40+
ensure: 'present',
41+
name: 'openvpn-access-server',
42+
descr: 'OpenVPN Access Server',
43+
baseurl: 'http://as-repository.openvpn.net/as/yum/rhel9/',
44+
gpgkey: 'https://as-repository.openvpn.net/as-repo-public.gpg',
45+
gpgcheck: '1',
46+
enabled: '1'
47+
)
48+
end
49+
50+
it do
51+
is_expected.to contain_file('/usr/local/openvpn_as/etc/web-ssl/server.crt').with(
52+
ensure: 'link'
53+
)
54+
end
55+
56+
it do
57+
is_expected.to contain_file('/usr/local/openvpn_as/etc/web-ssl/server.key').with(
58+
ensure: 'link'
59+
)
60+
end
61+
62+
it do
63+
is_expected.to contain_file('/usr/local/openvpn_as/etc/web-ssl/ca.crt').with(
64+
ensure: 'link'
65+
)
66+
end
67+
68+
it do
69+
is_expected.to contain_service('openvpnas').with(
70+
ensure: 'running',
71+
enable: true,
72+
require: 'Package[openvpn-as]'
73+
)
74+
end
75+
end
76+
end
77+
end
78+
end

0 commit comments

Comments
 (0)