fix openvpn things
[awsible] / roles / msca-openvpn / templates / user-server.conf.j2
1 {{ ansible_managed|comment }}
2 # Mode: {{ vpn_mode }}
3 # Subnet: {{ vpn_subnet }}
4 # L3
5 daemon
6 port 1195
7 dev tun
8 proto tcp-server
9 user openvpn
10 group openvpn
11 tcp-nodelay
12 persist-tun
13 persist-key
14 cipher AES-256-CBC
15 keepalive 30 90
16 management 127.0.0.1 31339
17
18 server {{ vpn_subnet }} 255.255.255.0
19 topology subnet
20
21 max-clients 64
22
23 verb 3
24 log /var/log/openvpn/openvpn.log
25 status-version 3
26 status /var/log/openvpn/status.log
27 client-connect /etc/openvpn/scripts/event-log.sh
28
29 tmp-dir /dev/shm
30 {% if phase|default() == 'prod' %}
31 auth-user-pass-verify /etc/openvpn/scripts/auth.py via-env
32 {% endif %}
33
34 tls-server
35 tls-version-min 1.2
36 key-direction 0
37 dh /etc/openvpn/keys/dh.pem
38 ca /etc/openvpn/keys/ca.{{ ca_name|lower }}.crt
39 crl-verify /etc/openvpn/keys/crl.{{ ca_name|lower }}.pem
40 cert /etc/openvpn/keys/{{ vpc_region }}.{{ ca_name|lower }}.crt
41 key /etc/openvpn/keys/{{ vpc_region }}.{{ ca_name|lower }}.key
42 <tls-auth>
43 {{ ta_secret }}
44 </tls-auth>
45
46 script-security 2