1 files changed, 45 insertions, 0 deletions
diff --git a/roles/common/templates/etc/ipsec.conf.j2 b/roles/common/templates/etc/ipsec.conf.j2
new file mode 100644
index 0000000..eaa9a08
--- /dev/null
+++ b/roles/common/templates/etc/ipsec.conf.j2
@@ -0,0 +1,45 @@
+# {{ ansible_managed }}
+# Do NOT edit this file directly!
+
+config setup
+    charondebug = "dmn 0, lib 0, cfg 0, ike 0, enc 0, net 0"
+
+conn %default
+    keyexchange    = ikev2
+    keyingtries    = %forever
+    ike            = aes256gcm16-prfsha384-ecp384!
+    esp            = aes256gcm16-ecp384!
+{% if 'NATed' not in group_names %}
+    mobike         = no
+{% endif %}
+{% if 'DynDNS' in group_names %}
+    leftallowany   = yes
+{% endif %}
+    leftauth       = pubkey
+    left           = %defaultroute
+    leftsubnet     = {{ ipsec[inventory_hostname_short] | ansible.utils.ipv4 }}/32
+    leftid         = {{ inventory_hostname }}
+    leftsigkey     = {{ inventory_hostname_short }}.pem
+    leftfirewall   = no
+    lefthostaccess = yes
+    rightauth      = pubkey
+    auto           = route
+    dpdaction      = hold
+    inactivity     = 30m
+    modeconfig     = push
+
+{% for host in groups.all | difference([inventory_hostname]) | sort %}
+
+conn {{ hostvars[host].inventory_hostname_short }}
+    right         = {{ hostvars[host].inventory_hostname }}
+{% if 'DynDNS' in hostvars[host].group_names %}
+    rightallowany = yes
+{% endif %}
+    rightsigkey   = {{ hostvars[host].inventory_hostname_short }}.pem
+    rightsubnet   = {{ ipsec[ hostvars[host].inventory_hostname_short ] | ansible.utils.ipv4 }}/32
+    reqid         = {{ ipsec[ hostvars[host].inventory_hostname_short ].replace(":",".").split(".")[-1] }}
+{% if 'NATed' not in group_names and 'NATed' in hostvars[host].group_names %}
+    mobike        = yes
+{% endif %}
+
+{%- endfor %}