Commit Graph

31 Commits (master)

Author SHA1 Message Date
Jack Ivanov 347f864abb
Ansible upgrade 6.1 (#14500)
* linting

* update ansible

* linters
2 years ago
Jack Ivanov 8c560719a5
skip pre tasks in update-users (#1921) 4 years ago
David Myers b5bb64d07a
Allow more users (#1895) 4 years ago
David Myers 8894dd0848
Discontinue use of the WireGuard PPA (#1855)
* Discontinue use of the WireGuard PPA

* Add instructions to update the system

* Change reboot instruction
4 years ago
Jack Ivanov c14ff0d611
Ubuntu 20.04 support (#1782)
* ubuntu 20.04 support

* purge snapd for 20.04

* strongswan-starter fix
4 years ago
Jack Ivanov 1e8a9c5cf1
Generate mobileconfigs for WireGuard (#1698)
* Generate mobileconfigs for WireGuard

* add xmllint to wireguard profiles

* Enable onDemand prompts for WireGuard

* linting
4 years ago
David Myers 5737317dae Allow WireGuard to listen on port 53 (#1594)
* Allow WireGuard to listen on port 53

* Use a variable for the port to avoid

* Add comment to config.cfg
5 years ago
Jack Ivanov 61729ac9b5
Update client.conf.j2 (#1580) 5 years ago
Jack Ivanov 090a60d48d PKI to tmpfs (#1496)
* PKI to tmpfs

* Fixes
- diskutil to full path
- unmount and eject fixes

* Umount fix

* run diskutil info only on Darwin kernels

* fix shell tasks
5 years ago
Jack Ivanov 8602a697cc
dnscrypt-proxy as a dns adblocker (#1480)
* Move DNS adblocking to dnscrypt-proxy

* Update docs

* remove unneeded variable dnscrypt_proxy_version

* Update to the latest dnscrypt-proxy version

* install.sh fix

* spelling
5 years ago
elreydetoda 146cbc71ce Adding preshared key support (#1465)
* adding preshared key generation

* adding preshared folder

* Update client.conf.j2

adding preshared key options

* adding preshared keys to server template

* making sure private preshared is right

* making sure preshared keygen working for main.yml

* changing private to preshared for name

* changing to preshared dir instead of public
5 years ago
shapiro125 72c8e9e244 Add IPv6 support to DNS (#1425)
* Add ipv6

* Add ipv6

* add ipv6

* add ipv6

* Switching out ipv6 address with local_service_ipv6 variable from #1429

* Fixing variable error
5 years ago
Jack Ivanov 5904546a48
Randomly generated IP address for the local dns resolver (#1429)
* generate service IPs dynamically

* update cloud-init tests

* exclude ipsec and wireguard ranges from the random service ip

* Update docs

* @davidemyers: update wireguard docs for linux

* Move to netaddr filter

* AllowedIPs fix

* WireGuard IPs fix
5 years ago
Jack Ivanov 25513cf925 Refactoring, Linting and additional tests (#1397)
* Refactoring, Linting and additional tests

* Vultr: Undefined variable and deprecation notes fix

* Travis-CI enable linters

* Azure: Update python requirements

* Update main.yml

* Update install.sh

* Add missing roles to ansible-lint

* Linting for skipped roles

* add .ansible-lint config
5 years ago
Jack Ivanov c4ea88000b Refactoring to support roles inclusion (#1365) 5 years ago
Jack Ivanov cf4d5b47a9
IPv6 range to AllowedIPs only when ipv6_support (#1388) 5 years ago
Jack Ivanov 273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
5 years ago
Jack Ivanov 216cd09dcf
Disable wireguard PersistentKeepalive by default (#1338) 5 years ago
David Myers 5981bb9cad Replace 'max_mss' with 'reduce_mtu' (#1253) 6 years ago
Jack Ivanov 66d30e3005
WireGuard update-users fix (#1183) 6 years ago
Jack Ivanov fbc7b29456 WireGuard update-users fix (#1154) 6 years ago
Jack Ivanov efc8dc7620
add tags for the wireguard qr code task. variables fix (#1147) 6 years ago
Jack Ivanov 1442586682 WireGuard: Generate QR codes (#1129)
* WireGuard: Generate QR codes

* Update client-android.md
6 years ago
Jack Ivanov dbd68aa97d WireGuard BSD (#1083)
* WireGuard BSD

* Remove unneeded config option

* Enable PersistentKeepalive for NAT and Firewall Traversal Persistence

* Install dnscrypt-proxy from repositories
6 years ago
James 14234344eb Use gateway ip address for wireguard interface (#1115) 6 years ago
Jack Ivanov e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
6 years ago
Jack Ivanov 53d1113881 Split up unattended upgrades (#1041) 6 years ago
Jack Ivanov d1c58f0d28
apt_repository fix (#1017) 6 years ago
Jack Ivanov ffb5a1f737 WireGuard: disable SaveConfig, update-users fix (#985)
- Disables SaveConfig. SaveConfig totally breaks the idea of configuration management and it breaks update-users
- WireGuard update-users fix. Mentioned in https://github.com/trailofbits/algo/issues/980#issuecomment-393720561
6 years ago
Jack Ivanov d56f50180b Extra line and better DNS configuration for WireGuard (#968)
- Adds an extra line after the if statement. Jinja2 trims such blocks by default in Ansible. Fixes #965
- More appropriate way to configure DNS servers
- Removes `DNS` option from the wireguard server config
- Fixes dnscrypt-proxy restart
6 years ago
Jack Ivanov 3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
6 years ago