Initial commit: Ansible role for Hysteria2 VPN server deployment.

Includes install/update/uninstall playbooks, Makefile, vault-based SSH credentials, per-server and global HTML export with QR codes.
2026-07-01 02:02:58 +03:00
commit df19816039
28 changed files with 2027 additions and 0 deletions
@@ -0,0 +1,102 @@
+---
+- name: Check for saved passwords from previous install
+  ansible.builtin.stat:
+    path: "{{ hysteria2_output_dir }}/{{ hysteria2_output_name }}/server-info.yml"
+  register: _hysteria2_saved_info
+  delegate_to: localhost
+  become: false
+  tags:
+    - install
+    - update
+    - export
+
+- name: Load saved user passwords from local export
+  when: _hysteria2_saved_info.stat.exists
+  block:
+    - name: Read server-info.yml
+      ansible.builtin.slurp:
+        path: "{{ hysteria2_output_dir }}/{{ hysteria2_output_name }}/server-info.yml"
+      register: _hysteria2_saved_info_raw
+      delegate_to: localhost
+      become: false
+
+    - name: Parse saved passwords into lookup dict
+      ansible.builtin.set_fact:
+        _hysteria2_saved_passwords: >-
+          {{
+            dict(
+              (_hysteria2_saved_info_raw.content | b64decode | from_yaml).users
+              | map(attribute='name')
+              | zip(
+                  (_hysteria2_saved_info_raw.content | b64decode | from_yaml).users
+                  | map(attribute='password')
+                )
+            )
+          }}
+  tags:
+    - install
+    - update
+    - export
+
+- name: Resolve user list with optional fixed passwords
+  ansible.builtin.set_fact:
+    hysteria2_resolved_users: "{{ hysteria2_resolved_users | default([]) + [ _entry ] }}"
+  vars:
+    _username: "{{ item if item is string else item.name }}"
+    _password: >-
+      {{
+        (
+          item.password if item is mapping
+        ) | default('', true)
+      }}
+    _entry:
+      name: "{{ _username }}"
+      password: "{{ _password }}"
+  loop: "{{ hysteria2_users }}"
+  loop_control:
+    label: "{{ item if item is string else item.name }}"
+  tags:
+    - install
+    - update
+    - export
+
+- name: Generate missing user passwords with pwgen
+  ansible.builtin.command:
+    cmd: "pwgen -s {{ hysteria2_password_length }} 1"
+  register: _hysteria2_pwgen
+  changed_when: false
+  when: item.password | length == 0
+  loop: "{{ hysteria2_resolved_users }}"
+  loop_control:
+    label: "{{ item.name }}"
+    index_var: _hysteria2_user_idx
+  tags:
+    - install
+    - update
+    - export
+
+- name: Apply generated passwords
+  ansible.builtin.set_fact:
+    hysteria2_resolved_users: "{{ hysteria2_resolved_users | default([]) + [ _entry ] }}"
+  vars:
+    _generated: >-
+      {{
+        _hysteria2_pwgen.results[_hysteria2_user_idx].stdout | default('')
+        if (
+          item.password | length == 0
+          and not (_hysteria2_pwgen.results[_hysteria2_user_idx].skipped | default(false))
+        )
+        else item.password
+      }}
+    _entry:
+      name: "{{ item.name }}"
+      password: "{{ _generated }}"
+  loop: "{{ hysteria2_resolved_users }}"
+  loop_control:
+    label: "{{ item.name }}"
+    index_var: _hysteria2_user_idx
+  when: _hysteria2_pwgen is defined
+  tags:
+    - install
+    - update
+    - export