mirror of https://github.com/trailofbits/algo
role for local installation
parent
a470bf071e
commit
fc162728d3
@ -1,89 +0,0 @@
|
||||
# vim:ft=ansible:
|
||||
- hosts: localhost
|
||||
gather_facts: False
|
||||
vars_files:
|
||||
- config.cfg
|
||||
|
||||
vars_prompt:
|
||||
- name: "server_ip"
|
||||
prompt: "Enter IP address of your server: (use localhost for local installation)\n"
|
||||
default: localhost
|
||||
private: no
|
||||
|
||||
- name: "server_user"
|
||||
prompt: "What user should we use to login on the server? (ignore if you're deploying to localhost):\n"
|
||||
default: "root"
|
||||
private: no
|
||||
|
||||
- name: "dns_enabled"
|
||||
prompt: "Do you want to install a local DNS resolver to block ads while surfing? (y/n):\n"
|
||||
default: "y"
|
||||
private: no
|
||||
|
||||
- name: "proxy_enabled"
|
||||
prompt: "Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing? (y/n):\n"
|
||||
default: "y"
|
||||
private: no
|
||||
|
||||
- name: "auditd_enabled"
|
||||
prompt: "Do you want to use auditd for security monitoring (see config.cfg)? (y/n):\n"
|
||||
default: "y"
|
||||
private: no
|
||||
|
||||
- name: "ssh_tunneling_enabled"
|
||||
prompt: "Do you want each user to have their own account for SSH tunneling? (y/n):\n"
|
||||
default: "y"
|
||||
private: no
|
||||
|
||||
- name: "security_enabled"
|
||||
prompt: "Do you want to enable the security role? (y/n):\n"
|
||||
default: "y"
|
||||
private: no
|
||||
|
||||
- name: "easyrsa_p12_export_password"
|
||||
prompt: "Enter a password for p12 certificates and SSH private keys: (minimum five characters)\n"
|
||||
default: "vpnpw"
|
||||
private: yes
|
||||
|
||||
- name: "IP_subject"
|
||||
prompt: "Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)\n"
|
||||
private: no
|
||||
|
||||
tasks:
|
||||
- name: Add the server to the vpn-host group
|
||||
add_host:
|
||||
hostname: "{{ server_ip }}"
|
||||
groupname: vpn-host
|
||||
ansible_ssh_user: "{{ server_user }}"
|
||||
ansible_python_interpreter: "/usr/bin/python2.7"
|
||||
dns_enabled: "{{ dns_enabled }}"
|
||||
proxy_enabled: "{{ proxy_enabled }}"
|
||||
ssh_tunneling_enabled: "{{ ssh_tunneling_enabled }}"
|
||||
security_enabled: "{{ security_enabled }}"
|
||||
auditd_enabled: " {{ auditd_enabled }}"
|
||||
easyrsa_p12_export_password: "{{ easyrsa_p12_export_password }}"
|
||||
IP_subject: "{{ IP_subject }}"
|
||||
|
||||
- name: Post-provisioning tasks
|
||||
hosts: vpn-host
|
||||
gather_facts: false
|
||||
become: true
|
||||
vars_files:
|
||||
- config.cfg
|
||||
|
||||
pre_tasks:
|
||||
- name: Install prerequisites
|
||||
raw: sudo apt-get update -qq && sudo apt-get install -qq -y python2.7
|
||||
- name: Configure defaults
|
||||
raw: sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1
|
||||
- set_fact:
|
||||
IP_subject_alt_name: "{{ IP_subject }}"
|
||||
|
||||
roles:
|
||||
- common
|
||||
- { role: security, when: security_enabled is defined and security_enabled == "y" }
|
||||
- { role: proxy, when: proxy_enabled is defined and proxy_enabled == "y" }
|
||||
- { role: dns_adblocking , when: dns_enabled is defined and dns_enabled == "y" }
|
||||
- { role: logging, when: auditd_enabled is defined and auditd_enabled == "y" }
|
||||
- { role: ssh_tunneling, when: ssh_tunneling_enabled is defined and ssh_tunneling_enabled == "y" }
|
||||
- vpn
|
@ -0,0 +1,12 @@
|
||||
- name: Add the instance to an inventory group
|
||||
add_host:
|
||||
name: "{{ server_ip }}"
|
||||
groups: vpn-host
|
||||
ansible_ssh_user: "{{ server_user }}"
|
||||
ansible_python_interpreter: "/usr/bin/python2.7"
|
||||
easyrsa_p12_export_password: "{{ easyrsa_p12_export_password }}"
|
||||
cloud_provider: local
|
||||
|
||||
- name: Waiting for SSH to become available
|
||||
local_action: "wait_for port=22 host={{ server_ip }} timeout=320"
|
||||
when: server_ip != "localhost"
|
Loading…
Reference in New Issue