From 021c742eba9f2d578137684d6feacef66b6a75fe Mon Sep 17 00:00:00 2001 From: Oleg Broytman Date: Tue, 28 Jul 2026 17:41:08 +0300 Subject: [PATCH] Feat(openvpn): Allow passwordless sudo for client-connect scripts Allow passwordless sudo for client-connect and client-disconnect scripts. --- playbooks/roles/openvpn/tasks/main.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/roles/openvpn/tasks/main.yaml b/playbooks/roles/openvpn/tasks/main.yaml index eeb3b49..c84af83 100644 --- a/playbooks/roles/openvpn/tasks/main.yaml +++ b/playbooks/roles/openvpn/tasks/main.yaml @@ -45,12 +45,12 @@ insertafter: '^#AUTOSTART="home office"$' when: ansible_facts.os_family == 'Debian' -- name: Allow passwordless sudo for up/down scripts +- name: Allow passwordless sudo for scripts become: true copy: content: | Defaults !admin_flag - openvpn ALL=(root:root) NOPASSWD: /etc/openvpn/up, NOPASSWD: /etc/openvpn/down + openvpn ALL=(root:root) NOPASSWD: /etc/openvpn/up, NOPASSWD: /etc/openvpn/down, NOPASSWD: /etc/openvpn/client-connect, NOPASSWD: /etc/openvpn/client-disconnect dest: /etc/sudoers.d/openvpn owner: root group: "{% if ansible_facts.os_family == 'Debian' %}sudo{% elif ansible_facts.os_family == 'RedHat' %}root{% endif %}" -- 2.47.3