algo/algo

#!/usr/bin/env bash

set -e

SKIP_TAGS="_null"

additional_roles () {

read -p "
Do you want to enable VPN Always-On when connected to the cellular network?
[y/N]: " -r OnDemandEnabled_Cellular
OnDemandEnabled_Cellular=${OnDemandEnabled_Cellular:-n}
if [[ "$OnDemandEnabled_Cellular" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_Cellular=Y"; fi

read -p "
Do you want to enable VPN Always-On when connected to Wi-Fi?
[y/N]: " -r OnDemandEnabled_WIFI
OnDemandEnabled_WIFI=${OnDemandEnabled_WIFI:-n}
if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_WIFI=Y"; fi

if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then
  read -p "
Do you want to exclude trusted Wi-Fi networks from using the VPN? (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
: " -r OnDemandEnabled_WIFI_ECXLUDE
  OnDemandEnabled_WIFI_ECXLUDE=${OnDemandEnabled_WIFI_ECXLUDE:-_null}
  EXTRA_VARS+=" OnDemandEnabled_WIFI_ECXLUDE=$OnDemandEnabled_WIFI_ECXLUDE"
fi

read -p "
Do you want to install a local DNS resolver to block ads while surfing?
[y/N]: " -r dns_enabled
dns_enabled=${dns_enabled:-n}
if [[ "$dns_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" dns"; EXTRA_VARS+=" local_dns=Y"; fi

read -p "
Do you want each user to have their own account for SSH tunneling?
[y/N]: " -r ssh_tunneling_enabled
ssh_tunneling_enabled=${ssh_tunneling_enabled:-n}
if [[ "$ssh_tunneling_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" ssh_tunneling"; fi

read -p "
Do you want to apply operating system security enhancements on the server?
[y/N]: " -r security_enabled
security_enabled=${security_enabled:-n}
if [[ "$security_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" security"; fi

read -p "
Do you want to use auditd for security monitoring? (requires configurationg in config.cfg)
[y/N]: " -r logging_enabled
logging_enabled=${logging_enabled:-n}
if [[ "$logging_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" logging"; fi

read -p "
Do you want the VPN to support Windows 10 clients? (requires RSA certificates and key exchange, less secure)
[y/N]: " -r Win10_Enabled
Win10_Enabled=${Win10_Enabled:-n}
if [[ "$Win10_Enabled" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" Win10_Enabled=Y"; fi

}

deploy () {

  ansible-playbook deploy.yml -t "${ROLES// /,}" -e "${EXTRA_VARS}" --skip-tags "${SKIP_TAGS// /,}"

}

azure () {
  read -p "
Enter your azure secret (https://docs.ansible.com/ansible/guide_azure.html#authenticating-with-azure)
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
[...]: " -rs azure_secret

  read -p "

Enter your azure tenant (https://docs.ansible.com/ansible/guide_azure.html#authenticating-with-azure)
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
[...]: " -rs azure_tenant

  read -p "

Enter your azure client_id (https://docs.ansible.com/ansible/guide_azure.html#authenticating-with-azure)
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
[...]: " -rs azure_client_id

  read -p "

Enter your azure subscription_id (https://docs.ansible.com/ansible/guide_azure.html#authenticating-with-azure)
You can skip this step if you want to use your defaults credentials from ~/.azure/credentials
[...]: " -rs azure_subscription_id


  read -p "
Name the vpn server:
[algo]: " -r azure_server_name
  azure_server_name=${azure_server_name:-algo}

  read -p "
  What region should the server be located in?
    1.  South Central US
    2.  Central US
    3.  North Europe
    4.  West Europe
    5.  Southeast Asia
    6.  Japan West
    7.  Japan East
    8.  Australia Southeast
    9.  Australia East
    10. Canada Central
    11. West US 2
    12. West Central US
    13. UK South
    14. UK West
Enter the number of your desired region:
[1]: " -r azure_region
  azure_region=${azure_region:-1}

  case "$azure_region" in
    1) region="southcentralus" ;;
    2) region="centralus" ;;
    3) region="northeurope" ;;
    4) region="westeurope" ;;
    5) region="southeastasia" ;;
    6) region="japanwest" ;;
    7) region="japaneast" ;;
    8) region="australiasoutheast" ;;
    9) region="australiaeast" ;;
    10) region="canadacentral" ;;
    11) region="westus2" ;;
    12) region="westcentralus" ;;
    13) region="uksouth" ;;
    14) region="ukwest" ;;
  esac

  ROLES="azure vpn cloud"
  EXTRA_VARS="azure_secret=$azure_secret azure_tenant=$azure_tenant azure_client_id=$azure_client_id azure_subscription_id=$azure_subscription_id azure_server_name=$azure_server_name ssh_public_key=$ssh_public_key region=$region"
}

digitalocean () {
  read -p "
Enter your API token (https://cloud.digitalocean.com/settings/api/tokens):
[pasted values will not be displayed]
: " -rs do_access_token

  read -p "
Name the vpn server:
[algo.local]: " -r do_server_name
  do_server_name=${do_server_name:-algo.local}

  read -p "
  What region should the server be located in?
    1.  Amsterdam        (Datacenter 2)
    2.  Amsterdam        (Datacenter 3)
    3.  Frankfurt
    4.  London
    5.  New York         (Datacenter 1)
    6.  New York         (Datacenter 2)
    7.  New York         (Datacenter 3)
    8.  San Francisco    (Datacenter 1)
    9.  San Francisco    (Datacenter 2)
    10. Singapore
    11. Toronto
    12. Bangalore
Enter the number of your desired region:
[7]: " -r region
  region=${region:-7}

  case "$region" in
    1) do_region="ams2" ;;
    2) do_region="ams3" ;;
    3) do_region="fra1" ;;
    4) do_region="lon1" ;;
    5) do_region="nyc1" ;;
    6) do_region="nyc2" ;;
    7) do_region="nyc3" ;;
    8) do_region="sfo1" ;;
    9) do_region="sfo2" ;;
    10) do_region="sgp1" ;;
    11) do_region="tor1" ;;
    12) do_region="blr1" ;;
  esac

ROLES="digitalocean vpn cloud"
EXTRA_VARS="do_access_token=$do_access_token do_ssh_name=$do_ssh_name do_server_name=$do_server_name do_region=$do_region"
}

ec2 () {
  read -p "
Enter your aws_access_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached
[pasted values will not be displayed]
[AKIA...]: " -rs aws_access_key

  read -p "
Enter your aws_secret_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached
[pasted values will not be displayed]
[ABCD...]: " -rs aws_secret_key

read -p "
Name the vpn server:
[algo]: " -r aws_server_name
  aws_server_name=${aws_server_name:-algo}

  read -p "
  What region should the server be located in?
    1.   us-east-1           US East (N. Virginia)
    2.   us-east-2           US East (Ohio)
    3.   us-west-1           US West (N. California)
    4.   us-west-2           US West (Oregon)
    5.   ap-south-1          Asia Pacific (Mumbai)
    6.   ap-northeast-2      Asia Pacific (Seoul)
    7.   ap-southeast-1      Asia Pacific (Singapore)
    8.   ap-southeast-2      Asia Pacific (Sydney)
    9.   ap-northeast-1      Asia Pacific (Tokyo)
    10.   eu-central-1        EU (Frankfurt)
    11.  eu-west-1           EU (Ireland)
    12.  sa-east-1           South America (São Paulo)
    13.  ca-central-1        Canada (Central)
Enter the number of your desired region:
[1]: " -r aws_region
  aws_region=${aws_region:-1}

  case "$aws_region" in
    1) region="us-east-1" ;;
    2) region="us-east-2" ;;
    3) region="us-west-1" ;;
    4) region="us-west-2" ;;
    5) region="ap-south-1" ;;
    6) region="ap-northeast-2" ;;
    7) region="ap-southeast-1" ;;
    8) region="ap-southeast-2" ;;
    9) region="ap-northeast-1" ;;
    10) region="eu-central-1" ;;
    11) region="eu-west-1" ;;
    12) region="sa-east-1" ;;
    13) region="ca-central-1" ;;
  esac

  ROLES="ec2 vpn cloud"
  EXTRA_VARS="aws_access_key=$aws_access_key aws_secret_key=$aws_secret_key aws_server_name=$aws_server_name ssh_public_key=$ssh_public_key region=$region"
}

gce () {
  read -p "
Enter the local path to your credentials JSON file (https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts):
: " -r credentials_file

  read -p "
Name the vpn server:
[algo]: " -r server_name
  server_name=${server_name:-algo}

  read -p "
  What zone should the server be located in?
    1. Central US       (Iowa A)
    2. Central US       (Iowa B)
    3. Central US       (Iowa C)
    4. Central US       (Iowa F)
    5. Eastern US       (South Carolina B)
    6. Eastern US       (South Carolina C)
    7. Eastern US       (South Carolina D)
    8. Western Europe   (Belgium B)
    9. Western Europe   (Belgium C)
    10. Western Europe  (Belgium D)
    11. East Asia       (Taiwan A)
    12. East Asia       (Taiwan B)
    13. East Asia       (Taiwan C)
Please choose the number of your zone. Press enter for default (#8) zone.
[8]: " -r region
  region=${region:-8}

  case "$region" in
    1) zone="us-central1-a" ;;
    2) zone="us-central1-b" ;;
    3) zone="us-central1-c" ;;
    4) zone="us-central1-f" ;;
    5) zone="us-east1-b" ;;
    6) zone="us-east1-c" ;;
    7) zone="us-east1-d" ;;
    8) zone="europe-west1-b" ;;
    9) zone="europe-west1-c" ;;
    10) zone="europe-west1-d" ;;
    11) zone="asia-east1-a" ;;
    12) zone="asia-east1-b" ;;
    13) zone="asia-east1-c" ;;
  esac

  ROLES="gce vpn cloud"
  EXTRA_VARS="credentials_file=$credentials_file server_name=$server_name ssh_public_key=$ssh_public_key zone=$zone"
}

non_cloud () {
  read -p "
Enter IP address of your server: (use localhost for local installation)
: " -r server_ip

  read -p "
What user should we use to login on the server? (ignore if you're deploying to localhost)
[root]: " -r server_user
  server_user=${server_user:-root}

  read -p "
Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)
: " -r IP_subject

  ROLES="local vpn"
  EXTRA_VARS="server_ip=$server_ip server_user=$server_user IP_subject_alt_name=$IP_subject"
  SKIP_TAGS+=" cloud update-alternatives"
}

algo_provisioning () {
  echo -n "
  What provider would you like to use?
    1. DigitalOcean
    2. Amazon EC2
    3. Google Compute Engine
    4. Microsoft Azure
    5. Install to existing Ubuntu server

Enter the number of your desired provider
: "

  read -r N

  case "$N" in
    1) digitalocean; ;;
    2) ec2; ;;
    3) gce; ;;
    4) azure; ;;
    5) non_cloud; ;;
    *) exit 1 ;;
  esac

  additional_roles
  deploy
}

user_management () {
  ansible-playbook users.yml
}

case "$1" in
  update-users) user_management ;;
  *) algo_provisioning ;;
esac