From: Oleg Broytman <phd@phdru.name>
Date: Tue, 28 Jul 2026 14:41:08 +0000 (+0300)
Subject: Feat(openvpn): Allow passwordless sudo for client-connect scripts
X-Git-Url: https://git.phdru.name/?a=commitdiff_plain;h=021c742eba9f2d578137684d6feacef66b6a75fe;p=ansible.git

Feat(openvpn): Allow passwordless sudo for client-connect scripts

Allow passwordless sudo for client-connect
and client-disconnect scripts.
---

diff --git a/playbooks/roles/openvpn/tasks/main.yaml b/playbooks/roles/openvpn/tasks/main.yaml
index eeb3b49..c84af83 100644
--- a/playbooks/roles/openvpn/tasks/main.yaml
+++ b/playbooks/roles/openvpn/tasks/main.yaml
@@ -45,12 +45,12 @@
     insertafter: '^#AUTOSTART="home office"$'
   when: ansible_facts.os_family == 'Debian'
 
-- name: Allow passwordless sudo for up/down scripts
+- name: Allow passwordless sudo for scripts
   become: true
   copy:
     content: |
       Defaults !admin_flag
-      openvpn	ALL=(root:root) NOPASSWD: /etc/openvpn/up, NOPASSWD: /etc/openvpn/down
+      openvpn	ALL=(root:root) NOPASSWD: /etc/openvpn/up, NOPASSWD: /etc/openvpn/down, NOPASSWD: /etc/openvpn/client-connect, NOPASSWD: /etc/openvpn/client-disconnect
     dest: /etc/sudoers.d/openvpn
     owner: root
     group: "{% if ansible_facts.os_family == 'Debian' %}sudo{% elif ansible_facts.os_family == 'RedHat' %}root{% endif %}"