diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2016-05-24 17:11:11 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2016-05-24 17:12:10 +0200 |
| commit | 1af3c572eedb0eaddcdc5c9c41d98ff59bb7b2c9 (patch) | |
| tree | 6af69fd639a051b483528b03959985ab806b2c1c /roles/common/templates | |
| parent | 61ee02ffb5402d93eae59001b91197957a8dcfe2 (diff) | |
IPSec: replace (self-signed) X.509 certs by their raw pubkey for authentication.
There is no need to bother with X.509 cruft here.
Diffstat (limited to 'roles/common/templates')
| -rw-r--r-- | roles/common/templates/etc/ipsec.conf.j2 | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/roles/common/templates/etc/ipsec.conf.j2 b/roles/common/templates/etc/ipsec.conf.j2 index 4d6aa68..938f6b8 100644 --- a/roles/common/templates/etc/ipsec.conf.j2 +++ b/roles/common/templates/etc/ipsec.conf.j2 @@ -18,7 +18,8 @@ conn %default leftauth = pubkey left = %defaultroute leftsubnet = {{ ipsec[inventory_hostname_short] | ipv4 }}/32 - leftcert = {{ inventory_hostname_short }}.pem + leftid = {{ inventory_hostname }} + leftsigkey = {{ inventory_hostname_short }}.pem leftfirewall = yes lefthostaccess = yes rightauth = pubkey @@ -34,7 +35,7 @@ conn {{ hostvars[host].inventory_hostname_short }} {% if 'DynDNS' in hostvars[host].group_names %} rightallowany = yes {% endif %} - rightcert = {{ hostvars[host].inventory_hostname_short }}.pem + rightsigkey = {{ hostvars[host].inventory_hostname_short }}.pem rightsubnet = {{ ipsec[ hostvars[host].inventory_hostname_short ] | ipv4 }}/32 {% if 'NATed' not in group_names and 'NATed' in hostvars[host].group_names %} mobike = yes |