handler "openvpn pack clients" not executed, zip archives not created about stouts.openvpn

[splendido]

I also had no zip files created but then got it working.

The task "openvpn pack clients" relies on the openvpn_clients list.
In case your're using PAM as I do, you have to fill both the list of clients and pam users:

vars:
    openvpn_unified_client_profiles: no # default value
    openvpn_clients: [client_1, client_2, client_3]
    openvpn_use_pam: yes
    openvpn_use_pam_users:
    - { name: client_1, pwd: 'xxxxxx'}
    - { name: client_2, pwd: 'yyyyyy'}
    - { name: client_3, pwd: 'zzzzzz'}

[nkakouros]

@apiening Did @splendido's suggestion solve it for you?

[apiening]

I don't use PAM, so @splendido's suggestion does not apply in my case.
But I have openvpn_clients: of course.
The problem still persists for me, but as a workaround I copied over the task which packs the client archives into my playbook like this:

- name: openvpn pack clients
    command: zip -j {{item.item}}.zip {{item.item}}.crt {{item.item}}.key {{item.item}}.ovpn ca.crt {{openvpn_tls_key if openvpn_tls_auth else ''}}
    when: item.changed
    with_items: "{{openvpn_clients_changed.results}}"
    args:
      chdir: "{{ openvpn_keydir }}"

I still don't understand why it is not triggered in the first place.

[nkakouros]

The task has become:

- name: Pack clients
  command: >-
    zip -j
      {{ item.item }}.zip
      {{ item.item }}.crt
      {{ item.item }}.key
      {{ item.item }}.ovpn
      ca.crt
      {{ openvpn_tls_key if openvpn_tls_auth else '' }}
  loop: "{{ openvpn_clients_changed.results }}"
  args:
    chdir: "{{ openvpn_keydir }}"
    creates: "{{ item.item }}.zip"

There is no condition, only that the clients are newly created. Have you updated the role recently?

[apiening]

I've installed the role with ansible-galaxy install stouts.openvpn and I tried that again but I get the message [WARNING]: - stouts.openvpn (2.4.0) is already installed - use --force to change version to unspecified.
It looks like the git version is newer (2.4.1) so I tried a ansible-galaxy install git+https://github.com/Stouts/Stouts.openvpn.git which results in the same warning message.
Should I just use the --force option to update the role or is a manual git checkout required to update the role to the latest sources?

[nkakouros]

Try ansible-galaxy install git+https://github.com/Stouts/Stouts.openvpn.git,develop. There are many changes that have not been tagged in a new version yet.

[apiening]

With the latest version from git,develop it does work for me.
I had to adapt my playbook because EasyRSA is not handled by this role anymore.
However I have the issue that the ta.key is not included in the zip-files.
But that's another issue.
Closing this one.