git.squeep.com Git - awsible/blob - roles/msca-openvpn/templates/vpc-server.conf.j2

   1 {{ ansible_managed|comment }}
   2 # Mode: {{ vpn_mode }}
   3 # Subnet: {{ vpn_subnet }}
   4 # L3
   5 daemon
   6 port 1194
   7 dev tap
   8 proto udp
   9 user openvpn
  10 group openvpn
  11 tcp-nodelay
  12 persist-tun
  13 persist-key
  14 cipher AES-256-CBC
  15 keepalive 30 90
  16 management 127.0.0.1 31337
  17
  18 server {{ vpn_subnet }} 255.255.255.0
  19 topology subnet
  20
  21 max-clients 64
  22
  23 verb 3
  24 log /var/log/openvpn/openvpn-vpc.log
  25 status-version 3
  26 status /var/log/openvpn/status-vpc.log
  27 client-connect "/etc/openvpn/scripts/event-log.sh"
  28 client-disconnect "/etc/openvpn/scripts/event-log.sh"
  29
  30 tmp-dir /dev/shm
  31
  32 tls-server
  33 tls-version-min 1.2
  34 key-direction 0
  35 dh /etc/openvpn/keys/dh.pem
  36 ca /etc/openvpn/keys/ca.{{ ca_name|lower }}.crt
  37 crl-verify /etc/openvpn/keys/crl.{{ ca_name|lower }}.pem
  38 cert /etc/openvpn/keys/{{ vpc_region }}.{{ ca_name|lower }}.crt
  39 key /etc/openvpn/keys/{{ vpc_region }}.{{ ca_name|lower }}.key
  40 <tls-auth>
  41 {{ ta_secret }}
  42 </tls-auth>
  43
  44 script-security 2