Try and fix the handling of the dh and ta.key files.

tasks/openvpn.yml

@@ -101,38 +101,23 @@
     - name: Fix the ta.key file permissions
       file: dest={{ openvpn_conf_dir }}/ta.key owner=root group=root mode=0400 
 
+    - name: Fetch both the ta and the dh files from the master node
+      fetch:
+        src: "{{ item }}"
+        dest: .tmp/openvpn_secrets
+      with_items:
+        - '{{ openvpn_conf_dir }}/ta.key'
+        - '{{ openvpn_conf_dir }}/dh2048.pem'
+
   when: openvpn_is_master_host | bool or not openvpn_ha | bool
   tags: [ 'openvpn', 'openvpn_conf' ]
 
 - block:
-    - name: Get the dh file from the master host
+    - name: Install the dh and ta.key files
-      synchronize:
+      copy: src=.tmp/openvpn_secrets/{{ openvpn_conf_dir }}/{{ item }} dest={{ openvpn_conf_dir }}/{{ item }} owner=root group=root mode=0400 force=yes
-        src: '{{ openvpn_conf_dir }}/dh2048.pem'
+      with_items:
-        #dest: 'rsync://root@{{ ansible_fqdn }}/{{ openvpn_conf_dir }}/dh2048.pem'
+        - 'ta.key'
-        dest: '/{{ openvpn_conf_dir }}/dh2048.pem'
+        - 'dh2048.pem'
-      delegate_to: '{{ openvpn_master_host }}'
-      ignore_errors: True
-      
-    - name: Relax the ta.key file permissions so that it can be copied around
-      file: dest={{ openvpn_conf_dir }}/ta.key owner=root group=root mode=0444
-      delegate_to: '{{ openvpn_master_host }}'
-      ignore_errors: True
-
-    - name: Get the ta key from the master host
-      synchronize:
-        src: '{{ openvpn_conf_dir }}/ta.key'
-        #dest: 'rsync://root@{{ ansible_fqdn }}/{{ openvpn_conf_dir }}/ta.key'
-        dest: '/{{ openvpn_conf_dir }}/ta.key'
-      delegate_to: '{{ openvpn_master_host }}'
-      ignore_errors: True
-
-    - name: Fix the ta.key file permissions
-      file: dest={{ openvpn_conf_dir }}/ta.key owner=root group=root mode=0400 
-
-    - name: Fix the ta.key file permissions on the master host
-      file: dest={{ openvpn_conf_dir }}/ta.key owner=root group=root mode=0400 
-      delegate_to: '{{ openvpn_master_host }}'
-      ignore_errors: True
 
   when:
     - openvpn_ha | bool