Commit Graph

31 Commits

Author SHA1 Message Date
Jack Ivanov
347f864abb
Ansible upgrade 6.1 (#14500)
* linting

* update ansible

* linters
2022-07-30 15:01:24 +03:00
Jack Ivanov
8c560719a5
skip pre tasks in update-users (#1921) 2020-12-08 13:23:24 +03:00
David Myers
b5bb64d07a
Allow more users (#1895) 2020-10-31 20:26:12 +03:00
David Myers
8894dd0848
Discontinue use of the WireGuard PPA (#1855)
* Discontinue use of the WireGuard PPA

* Add instructions to update the system

* Change reboot instruction
2020-08-06 19:09:15 +03:00
Jack Ivanov
c14ff0d611
Ubuntu 20.04 support (#1782)
* ubuntu 20.04 support

* purge snapd for 20.04

* strongswan-starter fix
2020-05-10 13:48:30 +03:00
Jack Ivanov
1e8a9c5cf1
Generate mobileconfigs for WireGuard (#1698)
* Generate mobileconfigs for WireGuard

* add xmllint to wireguard profiles

* Enable onDemand prompts for WireGuard

* linting
2020-02-12 08:31:44 +01:00
David Myers
5737317dae Allow WireGuard to listen on port 53 (#1594)
* Allow WireGuard to listen on port 53

* Use a variable for the port to avoid

* Add comment to config.cfg
2019-10-30 08:38:39 +01:00
Jack Ivanov
61729ac9b5
Update client.conf.j2 (#1580) 2019-09-12 12:52:10 +02:00
Jack Ivanov
090a60d48d PKI to tmpfs (#1496)
* PKI to tmpfs

* Fixes
- diskutil to full path
- unmount and eject fixes

* Umount fix

* run diskutil info only on Darwin kernels

* fix shell tasks
2019-07-10 12:31:25 -04:00
Jack Ivanov
8602a697cc
dnscrypt-proxy as a dns adblocker (#1480)
* Move DNS adblocking to dnscrypt-proxy

* Update docs

* remove unneeded variable dnscrypt_proxy_version

* Update to the latest dnscrypt-proxy version

* install.sh fix

* spelling
2019-06-19 17:31:43 +02:00
elreydetoda
146cbc71ce Adding preshared key support (#1465)
* adding preshared key generation

* adding preshared folder

* Update client.conf.j2

adding preshared key options

* adding preshared keys to server template

* making sure private preshared is right

* making sure preshared keygen working for main.yml

* changing private to preshared for name

* changing to preshared dir instead of public
2019-06-05 08:31:16 +02:00
shapiro125
72c8e9e244 Add IPv6 support to DNS (#1425)
* Add ipv6

* Add ipv6

* add ipv6

* add ipv6

* Switching out ipv6 address with local_service_ipv6 variable from #1429

* Fixing variable error
2019-05-20 13:17:39 +02:00
Jack Ivanov
5904546a48
Randomly generated IP address for the local dns resolver (#1429)
* generate service IPs dynamically

* update cloud-init tests

* exclude ipsec and wireguard ranges from the random service ip

* Update docs

* @davidemyers: update wireguard docs for linux

* Move to netaddr filter

* AllowedIPs fix

* WireGuard IPs fix
2019-05-17 14:49:29 +02:00
Jack Ivanov
25513cf925 Refactoring, Linting and additional tests (#1397)
* Refactoring, Linting and additional tests

* Vultr: Undefined variable and deprecation notes fix

* Travis-CI enable linters

* Azure: Update python requirements

* Update main.yml

* Update install.sh

* Add missing roles to ansible-lint

* Linting for skipped roles

* add .ansible-lint config
2019-04-26 11:48:28 -04:00
Jack Ivanov
c4ea88000b Refactoring to support roles inclusion (#1365) 2019-04-08 16:20:34 -04:00
Jack Ivanov
cf4d5b47a9
IPv6 range to AllowedIPs only when ipv6_support (#1388) 2019-04-06 13:44:13 +03:00
Jack Ivanov
273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
2019-03-10 13:16:34 -04:00
Jack Ivanov
216cd09dcf
Disable wireguard PersistentKeepalive by default (#1338) 2019-02-25 17:56:19 +01:00
David Myers
5981bb9cad Replace 'max_mss' with 'reduce_mtu' (#1253) 2018-12-20 09:21:04 -05:00
Jack Ivanov
66d30e3005
WireGuard update-users fix (#1183) 2018-11-12 18:03:31 +01:00
Jack Ivanov
fbc7b29456 WireGuard update-users fix (#1154) 2018-10-22 16:49:09 -04:00
Jack Ivanov
efc8dc7620
add tags for the wireguard qr code task. variables fix (#1147) 2018-10-14 10:22:45 +03:00
Jack Ivanov
1442586682 WireGuard: Generate QR codes (#1129)
* WireGuard: Generate QR codes

* Update client-android.md
2018-09-29 22:25:02 -04:00
Jack Ivanov
dbd68aa97d WireGuard BSD (#1083)
* WireGuard BSD

* Remove unneeded config option

* Enable PersistentKeepalive for NAT and Firewall Traversal Persistence

* Install dnscrypt-proxy from repositories
2018-09-27 04:18:12 -04:00
James
14234344eb Use gateway ip address for wireguard interface (#1115) 2018-09-18 10:43:41 +03:00
Jack Ivanov
e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
2018-08-27 10:05:45 -04:00
Jack Ivanov
53d1113881 Split up unattended upgrades (#1041) 2018-08-08 00:25:59 -04:00
Jack Ivanov
d1c58f0d28
apt_repository fix (#1017) 2018-07-02 16:33:31 +03:00
Jack Ivanov
ffb5a1f737 WireGuard: disable SaveConfig, update-users fix (#985)
- Disables SaveConfig. SaveConfig totally breaks the idea of configuration management and it breaks update-users
- WireGuard update-users fix. Mentioned in https://github.com/trailofbits/algo/issues/980#issuecomment-393720561
2018-06-01 10:06:03 -04:00
Jack Ivanov
d56f50180b Extra line and better DNS configuration for WireGuard (#968)
- Adds an extra line after the if statement. Jinja2 trims such blocks by default in Ansible. Fixes #965
- More appropriate way to configure DNS servers
- Removes `DNS` option from the wireguard server config
- Fixes dnscrypt-proxy restart
2018-05-25 10:37:13 -07:00
Jack Ivanov
3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
2018-05-24 08:15:27 -07:00