Show HN: Use Ansible to Run a “friends and Family” OpenVPN Server on Digital Ocean

That said, if I was going to pick one protocol out of the selection offered by streisand, it would be l2tp/ipsec instead of openvpn (assuming you're hosting on digital ocean. The networks on AWS and GCE are more restrictive and you can't serve l2tp/ipsec from there). I found this to be easier to set up (the client-side software is already included in most operating systems) and to have the best performance.

I posted this elsewhere but it bears repeating. This project is designed to be simple, auditable, and disposable, and have the minimum attack surface and maintenance costs.

Other tools are great, but the cost of swapping certificates and IP addresses and zone files can weigh you down.

Streisand would do well to have numerous playbooks that remix roles for smaller services (if they don't already).

Both even use Ansible.

I have a VPS and I use it for webhosting for myself and some friends. I've thought about (in some cases tried) and then decided against setting up my own mail server, my own irc bouncer, my own xmpp server and my own cloud storage. Each time, the killer was basically "I could do this, but it would take too long to figure out and it would probably not be super secure at the end.

At the very least, a project like Sovereign (written using something as declarative and idempotent as Ansible) would be great to look through and see how it manages certain things.

And that doesn't detract from your project, OP - I like that your focus is tight and your setup instructions detailed. I'm far more likely to actually try installing a small project like yours than a behemoth that will change who knows what throughout my system.

I'd be interested in something like this with a strong focus on security.