<commit_before>{% set openvpn = salt["pillar.get"]("openvpn") %}

openvpn:
  pkg.installed:
    - pkgs:
      - openvpn

  service.running:
    - enable: True
    - reload: True
    - watch:
      - file: /etc/openvpn/server.conf
      - file: /etc/openvpn/server-https.conf
      - file: /etc/openvpn/keys/ca.crt
      - file: /etc/openvpn/keys/dh.pem
      - file: /etc/openvpn/keys/server.key
      - file: /etc/openvpn/keys/server.crt
      - file: /etc/openvpn/keys/ta.key
      {% for user in openvpn.users %}
      - file: /etc/openvpn/ccd/{{ user }}
      {% endfor %}
    - require:
      - pkg: openvpn
      - pkg: duo-openvpn
      - file: /etc/openvpn/server.conf
      - file: /etc/openvpn/server-https.conf
      - file: /etc/openvpn/keys/ca.crt
      - file: /etc/openvpn/keys/crl.pem
      - file: /etc/openvpn/keys/dh.pem
      - file: /etc/openvpn/keys/server.key
      - file: /etc/openvpn/keys/server.crt
      - file: /etc/openvpn/keys/ta.key
      {% for user in openvpn.users %}
      - file: /etc/openvpn/ccd/{{ user }}
      {% endfor %}

duo-openvpn:
  pkg.installed:
    - sources:
      - duo-openvpn: salt://openvpn/packages/duo_openvpn-2.1.0_amd64.deb
    - require:
      - pkg: openvpn


/etc/openvpn/server.conf:
  file.managed:
    - source: salt://openvpn/configs/server.conf.jinja
    - template: jinja
    - context:
      port: 1194
      protocol: udp
      bind: {{ salt["pillar.get"]("vpn0_internal_network") }}
      device: tun0
      management: 4646
    - user: root
    - group: root
    - mode: 644
    - requires:
      - pkg: duo-openvpn
      - pkg: openvpn


/etc/openvpn/server-https.conf:
  file.managed:
    - source: salt://openvpn/configs/server.conf.jinja
    - template: jinja
    - context:
      port: 443
      protocol: tcp
      bind: {{ salt["pillar.get"]("vpn1_internal_network") }}
      device: tun1
      management: 4647
    - user: root
    - group: root
    - mode: 644
    - requires:
      - pkg: duo-openvpn
      - pkg: openvpn


/etc/openvpn/keys:
  file.directory:
    - user: root
    - group: root
    - mode: 755
    - requires:
      - pkg: openvpn


/etc/openvpn/keys/ca.crt:
  file.managed:
    - contents_pillar: psf-ca:ca.crt
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/crl.pem:
  file.managed:
    - contents_pillar: psf-ca:crl.pem
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/dh.pem:
  file.managed:
    - contents_pillar: openvpn:dh.pem
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/server.crt:
  file.managed:
    - contents_pillar: openvpn_keys:server.crt
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys



/etc/openvpn/keys/server.key:
  file.managed:
    - contents_pillar: openvpn_keys:server.key
    - user: root
    - group: root
    - mode: 600
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/ta.key:
  file.managed:
    - contents_pillar: openvpn_keys:ta.key
    - user: root
    - group: root
    - mode: 600
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/ccd:
  file.directory:
    - user: root
    - group: root
    - mode: 755
    - requires:
      - pkg: openvpn


{% for user in openvpn.users %}
/etc/openvpn/ccd/{{ user }}:
  file.managed:
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/ccd
{% endfor %}


/etc/sysctl.d/10-ip-forwarding.conf:
  file.managed:
    - source: salt://openvpn/configs/10-ip-forwarding.conf
    - user: root
    - group: root
    - mode: 644


/etc/diamond/collectors/OpenVPNCollector.conf:
  file.managed:
    - source: salt://monitoring/client/configs/Collector.conf.jinja
    - template: jinja
    - context:
      collector:
        enabled: True
        instances: "tcp://127.0.0.1:4646?primary,tcp://127.0.0.1:4647?https"
    - use:
      - file: /etc/diamond/diamond.conf
    - watch_in:
      - service: diamond<commit_msg>Fix the OpenVPN collector<commit_after>{% set openvpn = salt["pillar.get"]("openvpn") %}

openvpn:
  pkg.installed:
    - pkgs:
      - openvpn

  service.running:
    - enable: True
    - reload: True
    - watch:
      - file: /etc/openvpn/server.conf
      - file: /etc/openvpn/server-https.conf
      - file: /etc/openvpn/keys/ca.crt
      - file: /etc/openvpn/keys/dh.pem
      - file: /etc/openvpn/keys/server.key
      - file: /etc/openvpn/keys/server.crt
      - file: /etc/openvpn/keys/ta.key
      {% for user in openvpn.users %}
      - file: /etc/openvpn/ccd/{{ user }}
      {% endfor %}
    - require:
      - pkg: openvpn
      - pkg: duo-openvpn
      - file: /etc/openvpn/server.conf
      - file: /etc/openvpn/server-https.conf
      - file: /etc/openvpn/keys/ca.crt
      - file: /etc/openvpn/keys/crl.pem
      - file: /etc/openvpn/keys/dh.pem
      - file: /etc/openvpn/keys/server.key
      - file: /etc/openvpn/keys/server.crt
      - file: /etc/openvpn/keys/ta.key
      {% for user in openvpn.users %}
      - file: /etc/openvpn/ccd/{{ user }}
      {% endfor %}

duo-openvpn:
  pkg.installed:
    - sources:
      - duo-openvpn: salt://openvpn/packages/duo_openvpn-2.1.0_amd64.deb
    - require:
      - pkg: openvpn


/etc/openvpn/server.conf:
  file.managed:
    - source: salt://openvpn/configs/server.conf.jinja
    - template: jinja
    - context:
      port: 1194
      protocol: udp
      bind: {{ salt["pillar.get"]("vpn0_internal_network") }}
      device: tun0
      management: 4646
    - user: root
    - group: root
    - mode: 644
    - requires:
      - pkg: duo-openvpn
      - pkg: openvpn


/etc/openvpn/server-https.conf:
  file.managed:
    - source: salt://openvpn/configs/server.conf.jinja
    - template: jinja
    - context:
      port: 443
      protocol: tcp
      bind: {{ salt["pillar.get"]("vpn1_internal_network") }}
      device: tun1
      management: 4647
    - user: root
    - group: root
    - mode: 644
    - requires:
      - pkg: duo-openvpn
      - pkg: openvpn


/etc/openvpn/keys:
  file.directory:
    - user: root
    - group: root
    - mode: 755
    - requires:
      - pkg: openvpn


/etc/openvpn/keys/ca.crt:
  file.managed:
    - contents_pillar: psf-ca:ca.crt
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/crl.pem:
  file.managed:
    - contents_pillar: psf-ca:crl.pem
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/dh.pem:
  file.managed:
    - contents_pillar: openvpn:dh.pem
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/server.crt:
  file.managed:
    - contents_pillar: openvpn_keys:server.crt
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/keys



/etc/openvpn/keys/server.key:
  file.managed:
    - contents_pillar: openvpn_keys:server.key
    - user: root
    - group: root
    - mode: 600
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/keys/ta.key:
  file.managed:
    - contents_pillar: openvpn_keys:ta.key
    - user: root
    - group: root
    - mode: 600
    - requires:
      - file: /etc/openvpn/keys


/etc/openvpn/ccd:
  file.directory:
    - user: root
    - group: root
    - mode: 755
    - requires:
      - pkg: openvpn


{% for user in openvpn.users %}
/etc/openvpn/ccd/{{ user }}:
  file.managed:
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/openvpn/ccd
{% endfor %}


/etc/sysctl.d/10-ip-forwarding.conf:
  file.managed:
    - source: salt://openvpn/configs/10-ip-forwarding.conf
    - user: root
    - group: root
    - mode: 644


/etc/diamond/collectors/OpenVPNCollector.conf:
  file.managed:
    - source: salt://monitoring/client/configs/Collector.conf.jinja
    - template: jinja
    - context:
        collector:
          enabled: True
          instances: "tcp://127.0.0.1:4646?primary,tcp://127.0.0.1:4647?https"
    - use:
      - file: /etc/diamond/diamond.conf
    - watch_in:
      - service: diamond
{'fraction_non_alphanumeric': 0.14607558139534885, 'fraction_numerical': 0.020348837209302327, 'mean_word_length': 1.8650242886884107, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 4, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6683375', 'n_tokens_mistral': 3447, 'n_tokens_neox': 3217, 'n_words': 550}