✔ buying a dedicated server
✔ installing debian and 2 packages
✔ adding that machine to the list and running ansible that will handle everything from now

i forgot how to manage a pki ca

kind of shit that's so badly documented people sell books about it

and there's none of it in my bash/zsh history

update: i guessed things and it worked out fine. now i can talk about it.

first i had a very elaborate ansible playbook that would generate a key and csr on the vpn server,
then fetch, sign with the local ca, and upload the cert.

it got replaced by generating the key/cert locally and uploading it; it's much less steps and knowing that the ca host also has root an other servers it's not really problematic. (further automation was considered and abandoned later)

@CobaltVelvet (pointing back towards my earlier recommendation: Vault‘s CA can be used directly with OpenVPN, i.e. clients get their certificates with Vault instead of easy-pki or Ansible, plus Vault has a variety of authentication backends available; e.g. you could hand out certificates for certain servers or services based on GitHub groups, or LDAP logins etc. it’s tremendously helpful and trivial to use, honestly)