add nginx, sshd, ssl roles

2026-09-20 22:14:56 +00:00
parent ba9e1a664f
commit c640406c10
131 changed files with 1535 additions and 780 deletions
@@ -0,0 +1,27 @@
+port 1195
+proto tcp
+dev tap0
+dev-type tap
+server-bridge nogw
+client-to-client
+keepalive 10 60
+cipher AES-256-GCM
+auth SHA256
+persist-key
+persist-tun
+status openvpn-tap0-status.log
+verb 6
+tun-mtu 1500
+mssfix 1300
+<ca>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/ca.crt') }}
+</ca>
+<cert>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/issued/server.crt') }}
+</cert>
+<key>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/private/server.key') }}
+</key>
+<dh>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/dh.pem') }}
+</dh>
@@ -0,0 +1,44 @@
+port 1194
+proto tcp
+dev tun0
+server 172.168.0.0 255.255.255.0
+topology subnet
+ifconfig-pool-persist ipp.txt
+route 10.1.0.0 255.255.255.0
+route 10.2.0.0 255.255.255.0
+route 10.3.0.0 255.255.255.0
+route 10.4.0.0 255.255.255.0
+route 10.10.0.0 255.255.255.0
+route 10.11.0.0 255.255.255.0
+route 10.12.0.0 255.255.255.0
+route 192.168.1.0 255.255.255.0
+push "route 192.168.1.0 255.255.255.0"
+push "route 10.1.0.0 255.255.255.0"
+push "route 10.2.0.0 255.255.255.0"
+push "route 10.3.0.0 255.255.255.0"
+push "route 10.4.0.0 255.255.255.0"
+push "route 10.10.0.0 255.255.255.0"
+push "route 10.11.0.0 255.255.255.0"
+push "route 10.12.0.0 255.255.255.0"
+client-config-dir /etc/openvpn/ccd/liqueur
+keepalive 10 60
+cipher AES-256-GCM
+auth SHA256
+persist-key
+persist-tun
+status openvpn-status.log
+verb 3
+tun-mtu 1500
+mssfix 1300
+<ca>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/ca.crt') }}
+</ca>
+<cert>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/issued/server.crt') }}
+</cert>
+<key>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/private/server.key') }}
+</key>
+<dh>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/dh.pem') }}
+</dh>
@@ -0,0 +1,24 @@
+client
+dev tap0
+dev-type tap
+proto tcp
+remote 127.0.0.1 1195
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+remote-cert-tls server
+auth SHA256
+cipher AES-256-GCM
+tun-mtu 1500
+mssfix 1300
+verb 3
+<ca>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/ca.crt') }}
+</ca>
+<cert>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/issued/ltrefilov.crt') }}
+</cert>
+<key>
+{{ lookup('file', '/etc/easy-rsa/pki/tap0/private/ltrefilov.key') }}
+</key>
@@ -0,0 +1,21 @@
+client
+dev tun0
+proto tcp
+remote 127.0.0.1 1194
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+remote-cert-tls server
+auth SHA256
+cipher AES-256-GCM
+verb 3
+<ca>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/ca.crt') }}
+</ca>
+<cert>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/issued/mur89.crt') }}
+</cert>
+<key>
+{{ lookup('file', '/etc/easy-rsa/pki/tun0/private/mur89.key') }}
+</key>