Fix Archlinux support

Author: Valantin

data/family/Archlinux.yaml

@@ -1,8 +1,12 @@
 openvpn::etc_directory: '/etc'
 openvpn::additional_packages: ['easy-rsa']
-openvpn::easyrsa_source: '/usr/share/easy-rsa/'
-openvpn::group: 'nobody'
+openvpn::easyrsa_source: '/etc/easy-rsa/'
+openvpn::group: 'network'
 openvpn::ldap_auth_plugin_location: ~
-openvpn::pam_module_path: ~
-openvpn::link_openssl_cnf: true
+openvpn::pam_module_path: /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so
+openvpn::link_openssl_cnf: false
 openvpn::namespecific_rclink: false
+openvpn::server_directory: '/etc/openvpn/server'
+openvpn::server_service_name: 'openvpn-server'
+openvpn::server::user: 'openvpn'
+openvpn::server::group: 'network'

manifests/ca.pp

@@ -86,6 +86,14 @@
     require => File["${server_directory}/${name}/easy-rsa"],
   }
 
+  if $facts['os']['family'] == 'Archlinux' {
+    file { "${server_directory}/${name}/easy-rsa/easyrsa":
+      ensure  => link,
+      target  => '/bin/easyrsa',
+      require => File["${server_directory}/${name}/easy-rsa"],
+    }
+  }
+
   case $openvpn::easyrsa_version {
     '3.0': {
       file { "${server_directory}/${name}/easy-rsa/vars":
@@ -173,6 +181,38 @@
         creates  => "${server_directory}/${name}/crl.pem",
         provider => 'shell',
       }
+
+      if $facts['os']['family'] == 'Archlinux' {
+        file { [
+            "${server_directory}/${name}/easy-rsa/keys/issued",
+            "${server_directory}/${name}/easy-rsa/keys/issued/${common_name}.crt",
+          ]:
+            mode    => '0640',
+            owner   => 'openvpn',
+            group   => $openvpn::group,
+            require => Exec["generate server cert ${name}"],
+        }
+
+        file { [
+            "${server_directory}/${name}/easy-rsa/keys/private",
+            "${server_directory}/${name}/easy-rsa/keys/private/${common_name}.key",
+          ]:
+            mode    => '0640',
+            owner   => 'openvpn',
+            group   => $openvpn::group,
+            require => Exec["generate server cert ${name}"],
+        }
+
+        file { [
+            "${server_directory}/${name}/easy-rsa/keys",
+            "${server_directory}/${name}/easy-rsa/keys/dh.pem",
+          ]:
+            mode    => '0640',
+            owner   => 'openvpn',
+            group   => $openvpn::group,
+            require => Exec["generate dh param ${name}"],
+        }
+      }
     }
     default: {
       fail("unexepected value for EasyRSA version, got '${openvpn::easyrsa_version}', expect 3.0.")

manifests/install.pp

@@ -9,6 +9,13 @@
     ensure_packages($openvpn::additional_packages)
   }
 
+  if $facts['os']['family'] == 'Archlinux' {
+    File {
+      owner  => $openvpn::server::user,
+      group  => $openvpn::server::group,
+    }
+  }
+
   file {
     ["${openvpn::etc_directory}/openvpn", "${openvpn::etc_directory}/openvpn/keys", '/var/log/openvpn',]:
       ensure  => directory,

manifests/server.pp

@@ -469,6 +469,12 @@
   # Template might need script directory
   $_script_dir = "${server_directory}/${name}/scripts"
 
+  if $facts['os']['family'] == 'Archlinux' {
+    $set_user_group = false
+  } else {
+    $set_user_group = true
+  }
+
   file { "${server_directory}/${name}.conf":
     owner   => root,
     group   => 0,

spec/acceptance/openvpn_spec.rb

@@ -335,6 +335,7 @@
         scp_to(hosts_as('vpnclienta'), "#{server_name}-vpnclienta.tar.gz", '/tmp')
         on(hosts_as('vpnclienta'), "tar xvfz /tmp/#{server_name}-vpnclienta.tar.gz -C #{client_directory}")
         on(hosts_as('vpnclienta'), "cp -a #{client_directory}/#{server_name}-vpnclienta/* #{client_directory}/")
+        on(hosts_as('vpnclienta'), "chown openvpn:network -R #{client_directory}/client/vpnclienta") if default[:platform].start_with?('archlinux')
         on(hosts_as('vpnclienta'), "systemctl enable #{client_service}@#{server_name}-vpnclienta")
         on(hosts_as('vpnclienta'), "systemctl restart #{client_service}@#{server_name}-vpnclienta")
       end

templates/server.erb

@@ -74,8 +74,10 @@ tls-client
 <% if @compression -%>
 <%= @compression %>
 <% end -%>
+<% if @set_user_group %>
 group <%= @group_to_set %>
 user <%= @user %>
+<% end -%>
 <% if @logfile -%>
 log-append <%= @logfile %>
 <% end -%>