example42/puppet-openvpn — pull request #8 by Freeaqingme (2013-09-19 22:06:01+00:00)
Title: Cert creation & several improvements

Hi @example42,

I wanted to implement cert creation and the ability to define what clients can connect, this meant that I had to break some BC here and there. Because I was breaking BC already, I figured I might change some defaults here and there as well. What I have not yet implemented is cert distribution; my current setup is masterless. But I'm sure someone could do it ;)

```
openvpn::tunnel { 'main':
dev => 'tap',
server => '172.31.253.0 255.255.255.0',
easyrsa_email => 'devops@organization',
clients => {
'node42.fqdn' => { pushReset => true },
'node314159.fqdn' => {}
}
}
```
Some changes:
- As discussed in my last PR, $openvpn::package_src has been changed into package_repo.
- The keysize of the DH, CA- and Server/Client-Certs can now be configured. This used to be 1024 in the template, as this is considered insecure, I've set the default to 4096. With the default lifetime of 10 years this should be ok.
- If a key size of <2048 bits is defined, a notice will be given.
- The recommended protocol to use with OpenVPN is UDP, not TCP. Changed that default, allowed openvpn::tunnel to use variable from openvpn::init.
- Allowed to use multiple 'push' and 'route' options in the tunnel config file.
- Put the value for the 'push'-directive between quotes, as the OpenVPN manual specifies.
- Enabled LZO compression by default.
- CCD files are automatically created and can be configured through the clients option.
- I'm not sure what assumptions are made regarding parser options and versions. I felt obliged to use some futureparser-only functionality in openvpn::tunnel.

There may be a few more commits to come, so I'd suggest not to merge just yet. I can also imagine you're not comfortable breaking BC, if so, this may be a good moment to port it to stdmod ;)

I would however be interested to hear what you think about this PR.