[feature] Automatically create management VPN

[nemesifier]

This feature can be enabled by default, users should be able to disable it with a configuration variable, we should guide users to do this choice in the beginning of the tutorial.

If enabled, we should install openvpn, we should create a VPN server object (if no VPN server object exist yet), we should place a default working configuration for a layer 3 VPN (routed), then create a VPN-client template based on it and flag this template as default.
We should then take the openvpn server configuration just saved into OpenWISP and deploy it in the linux filesystem, enable the openvpn service and start it.

This way we'll get a basic management VPN working out of the box for new installations, which coupled with other features (#195 #199 #200) will make this role a lot more powerful and helpful for the community.

[stktyagi]

Hi,

I would like to work on this issue and have read the contribution guidelines. Just real quick,

Should the OpenVPN service be restarted on every playbook run, or only when config changes?

[cbeaujoin-stellar]

Like https://github.com/openwisp/docker-openwisp/blob/7603dc2723f064cda35d0693b9813c2591cb6d1a/images/common/utils.sh#L250 ?

[asmodehn]

I have been working on it for a little while, and here is my current concern:

To access CA and VPN server details from openwisp server, it seems the best (only ?) way is through the webAPI.
However, to do that we need to login... even just to know how many VPN servers are known by openwisp...
We know the default login on the first installation. However the user will change that login and further ansible runs will not know the password, which means multiple playbook runs will fail.

Unless we pass it through a variable or so, but dealing with login credential over multiple runs is a whole other topic...
Maybe we should first add some tasks at the end of the role to login + verify (via getting a token ?) that the openwisp installation is accessible//running as expected ? Once we know how to manage login over multiple ansible runs, it will be simpler to add extra configuration steps.

OR I am looking at this the wrong way, and there are/should be other ways to set this up without going through the webAPI ?

[pandafy]

@asmodehn I'd implement it like we create default SSH template on a new installation. You can review the Python script in load_initial_data.py

Once the VPN object is created on OpenWISP, we can download the VPN configuration using UUID and key (like Device configuration). Hence, the ansible task can download the configuration at /etc/openvpn/, uncompress the tarball and restart the OpenVPN service.

The goal would be to make OpenWISP easy to use out-of-box on new installation. It will not perform this task if there are VPN objects already present on the VM.