Feat(openvpn): Allow passwordless sudo for client-connect scripts

Allow passwordless sudo for client-connect
and client-disconnect scripts.

diff --git a/playbooks/roles/openvpn/tasks/main.yaml b/playbooks/roles/openvpn/tasks/main.yaml
index eeb3b49169ac159da5a428f86da87ac6a01fac44..c84af837930d2f4f5f8ec78c6044e173b931d5fc 100644 (file)
--- a/playbooks/roles/openvpn/tasks/main.yaml
+++ b/playbooks/roles/openvpn/tasks/main.yaml
@@ -45,12 +45,12 @@
     insertafter: '^#AUTOSTART="home office"$'
   when: ansible_facts.os_family == 'Debian'
 
     insertafter: '^#AUTOSTART="home office"$'
   when: ansible_facts.os_family == 'Debian'
 

-- name: Allow passwordless sudo for up/down scripts
+- name: Allow passwordless sudo for scripts

   become: true
   copy:
     content: |
       Defaults !admin_flag
   become: true
   copy:
     content: |
       Defaults !admin_flag

-      openvpn  ALL=(root:root) NOPASSWD: /etc/openvpn/up, NOPASSWD: /etc/openvpn/down
+      openvpn  ALL=(root:root) NOPASSWD: /etc/openvpn/up, NOPASSWD: /etc/openvpn/down, NOPASSWD: /etc/openvpn/client-connect, NOPASSWD: /etc/openvpn/client-disconnect

     dest: /etc/sudoers.d/openvpn
     owner: root
     group: "{% if ansible_facts.os_family == 'Debian' %}sudo{% elif ansible_facts.os_family == 'RedHat' %}root{% endif %}"
     dest: /etc/sudoers.d/openvpn
     owner: root
     group: "{% if ansible_facts.os_family == 'Debian' %}sudo{% elif ansible_facts.os_family == 'RedHat' %}root{% endif %}"