ok, try this to handle the openvpn differences

playbooks/groups/unbound.yml

@@ -42,6 +42,9 @@
   - include: "{{ tasks }}/2fa_client.yml"
   - include: "{{ tasks }}/motd.yml"
   - include: "{{ tasks }}/openvpn_client.yml"
+    when: ansible_distribution_major_version != '7' 
+  - include: "{{ tasks }}/openvpn_client_7.yml"
+    when: ansible_distribution_major_version == '7' 
 
   handlers:
   - include: "{{ handlers }}/restart_services.yml"

tasks/openvpn_client.yml

@@ -10,7 +10,7 @@
   tags:
   - config
   notify:
-  - restart openvpn {{ ansible_distribution_major_version }}
+  - restart openvpn
 
 #- name: /etc/openvpn/crl.pem from vpn/openvpn/keys/crl.pem
 #  copy: src="{{ puppet_private }}/vpn/openvpn/keys/crl.pem" dest=/etc/openvpn/crl.pem mode=0644 owner=root group=root
@@ -24,30 +24,23 @@
   tags:
   - config
   notify:
-  - restart openvpn {{ ansible_distribution_major_version }}
+  - restart openvpn
 
 - name: /etc/openvpn/client.crt
   copy: src="{{ puppet_private }}/vpn/openvpn/keys/{{ inventory_hostname }}.crt" dest=/etc/openvpn/client.crt mode=0600 owner=root group=root
   tags:
   - config
   notify:
-  - restart openvpn {{ ansible_distribution_major_version }}
+  - restart openvpn
 
 - name: /etc/openvpn/client.key
   copy: src="{{ puppet_private }}/vpn/openvpn/keys/{{ inventory_hostname }}.key" dest=/etc/openvpn/client.key mode=0600 owner=root group=root
   tags:
   - config
   notify:
-  - restart openvpn {{ ansible_distribution_major_version }}
+  - restart openvpn
 
 - name: enable openvpn service for rhel 6
   service: name=openvpn state=running enabled=true
   tags:
   - service
-  when: is_rhel is defined and ansible_distribution_major_version != '7'
-
-- name: enable openvpn service for rhel 7 or fedora
-  service: name=openvpn@openvpn state=running enabled=true
-  tags:
-  - service
-  when: ansible_distribution_major_version != '6'

tasks/openvpn_client_7.yml

@@ -0,0 +1,46 @@
+---
+# openvpn - ftw - or something
+- name: install openvpn
+  yum: name=openvpn state=installed
+  tags:
+  - packages
+
+- name: /etc/openvpn/ca.crt from  vpn/openvpn/keys/ca.crt
+  copy: src="{{ puppet_private }}/vpn/openvpn/keys/ca.crt" dest=/etc/openvpn/ca.crt mode=0600 owner=root group=root
+  tags:
+  - config
+  notify:
+  - restart openvpn 7
+
+#- name: /etc/openvpn/crl.pem from vpn/openvpn/keys/crl.pem
+#  copy: src="{{ puppet_private }}/vpn/openvpn/keys/crl.pem" dest=/etc/openvpn/crl.pem mode=0644 owner=root group=root
+#  tags:
+#  - config
+#  notify:
+#  - restart openvpn
+
+- name: /etc/openvpn/openvpn.conf
+  copy: src="{{ files }}/openvpn/client.conf" dest=/etc/openvpn/openvpn.conf
+  tags:
+  - config
+  notify:
+  - restart openvpn 7
+
+- name: /etc/openvpn/client.crt
+  copy: src="{{ puppet_private }}/vpn/openvpn/keys/{{ inventory_hostname }}.crt" dest=/etc/openvpn/client.crt mode=0600 owner=root group=root
+  tags:
+  - config
+  notify:
+  - restart openvpn 7
+
+- name: /etc/openvpn/client.key
+  copy: src="{{ puppet_private }}/vpn/openvpn/keys/{{ inventory_hostname }}.key" dest=/etc/openvpn/client.key mode=0600 owner=root group=root
+  tags:
+  - config
+  notify:
+  - restart openvpn 7
+
+- name: enable openvpn service for rhel 7 or fedora
+  service: name=openvpn@openvpn state=running enabled=true
+  tags:
+  - service