zachfi / puppet-openvpn

openvpn module for puppet

OpenVPN

A Puppet module to manage the OpenVPN client and server.

Supported Platforms

• CentOS
• Debian
• FreeBSD
• OpenBSD
• Ubuntu

Usage

Server Setup

The configuration for the OpenVPN server can be accomplished using the openvpn::server class.

class { "openvpn::server":
  server => "10.0.0.0 255.255.255.0",
  route  => [
    "10.0.1.0 255.255.255.0",
    "10.0.2.0 255.255.255.0",
    "10.0.3.0 255.255.255.0",
    ],
  dns => '10.0.0.10',
  crl => 'mysite/crl.pem',
}

To include pushing IPv6 routes, the route_ipv6 and the server_ipv6 parameters have been added to the openvpn::server class.

class { "openvpn::server":
  server_ipv6 => "10.0.0.0 255.255.255.0",
  route_ipv6  => [
    "fc00::/64",
    ],
  dns => 'fc00::',
  crl => 'mysite/crl.pem',
}

Basic Client Setup

Clients can be configured using the openvpn::client defined type. Multiple connections can be specified if you have multiple locations to connect to.

openvpn::client { "node_${hostname}_dc1":
  server => "vpn.dc1.example.com",
  cert   => "node_${hostname}";
}

openvpn::client { "node_${hostname}_office":
  server => "vpn.office.example.com",
  cert   => "node_${hostname}";
}

Client Specific Configurations

Clients can have a more specific and static configuration. For example, if you wanted to specify the IP address a specific client should use, something like the following will work for this purpose.

openvpn::server::csc { "srv1.example.com":
  content => "ifconfig-push 10.0.0.50 10.0.0.51",
}

puppet-openvpn's Issues

Should test on Puppet4

There is at least one error I know of when running this module in a Puppet4 environment. Testing should be updated to ensure compatibility.

Service not started correctly on Ubuntu Xenial

On Ubuntu Xenial, starting the openvpn service is not sufficient to connect a client, the SystemD unit openvpn@<connection name> needs to be started, where connection name is the name of the .conf file in /etc/openvpn

missing $openssl param

Commit 5763986 removed the $openssl param, but it's still referenced in manifests/server.pp.

Missing License file

Modulefile mentions apache 2.0 but no license file is present.

allow override of config file name

https://github.com/xaque208/puppet-openvpn/blob/master/manifests/client.pp#L27

file { "${openvpn_dir}/${server}.conf":

sane default good, sane default with configurable parameter even better :)

Seeking New Ownership

For many years, Puppet has been the core of my infrastructure needs. That has changed in the last 9 months, and I've begun a new path that I hope will carry me as long as Puppet has.

For those that may still benefit from any of this code, you all deserve maintainers that will give it the attention required, and that is no longer me. And if I'm being honest, it hasn't been me for longer than I'm ready to admit.

So, for those few, I request that if anyone wants this to persist, fork it and make a new. I plan to archive all of the Puppet repos under my name in the coming month and collapse all of my puppet related infrastructure. Expect no more releases from me. Any coordination/communication of forks should happen quickly.

Thank you for all the collaboration over the years. It has been a real privilege.

new Forge release?

https://forge.puppet.com/zleslie/openvpn points to this repo as it's "Project URL".

Version 1.1.5 released Apr 4th 2016

you appear to have cut a few releases since then:

are you planning on releasing to Forge? I prefer the simpler experience of this module over https://forge.puppet.com/puppet/openvpn