Commit Graph

29 Commits (347f864abb8c502152e9c7ad74dc438ced206d3e)

Author SHA1 Message Date
Jack Ivanov 347f864abb
Ansible upgrade 6.1 (#14500)
* linting

* update ansible

* linters
2 years ago
dependabot[bot] 7203f33f2e
Bump ansible-core from 2.11.3 to 2.12.1 (#14375)
* Bump ansible-core from 2.11.3 to 2.12.1

Bumps [ansible-core](https://github.com/ansible/ansible) from 2.11.3 to 2.12.1.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/compare/v2.11.3...v2.12.1)

---
updated-dependencies:
- dependency-name: ansible-core
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update requirements.txt

* python and cache for actions

* switch to python 3.8

* wait for lxc network

* no point to support 18.04 in tests

* cipher fix for openssl_privatekey

* cipher fix for openssl_privatekey

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jack Ivanov <17044561+jackivanov@users.noreply.github.com>
2 years ago
Jack Ivanov 8c560719a5
skip pre tasks in update-users (#1921) 3 years ago
Jack Ivanov 498cf46391 Block link-local networks. Block traffic from SSH tunnels to VPN clients (#1458) 5 years ago
Jack Ivanov 25513cf925 Refactoring, Linting and additional tests (#1397)
* Refactoring, Linting and additional tests

* Vultr: Undefined variable and deprecation notes fix

* Travis-CI enable linters

* Azure: Update python requirements

* Update main.yml

* Update install.sh

* Add missing roles to ansible-lint

* Linting for skipped roles

* add .ansible-lint config
5 years ago
Jack Ivanov c4ea88000b Refactoring to support roles inclusion (#1365) 5 years ago
Jack Ivanov 273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
5 years ago
Jack Ivanov bcba905547 ssh tunneling fixes (#1127) 6 years ago
Jack Ivanov e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
6 years ago
Jack Ivanov ee6db37428 Change the P12 and SSH passwords only for new users (#550) 7 years ago
Jack Ivanov 58d5a06e87 delete tasks and move to roles (#519) 7 years ago
Ruben Jongejan 07ddb5863b improved readability with native yaml (#530) 7 years ago
Jack Ivanov bd348af9c2 Implementing blocks and additional fail hints #487 (#497)
change the troubleshooting url
7 years ago
Jack Ivanov a7b06058cb remove the proxy role #440 (#457)
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
7 years ago
Jack Ivanov bf75a1bb03 move generating of the known_hosts file to local_action (#425) 7 years ago
Jack Ivanov 6facb6cb4f FreeBSD / HardenedBSD (#262)
* FreeBSD draft

ifconfig fix

Pre-tasks fixes

fix hardcoded IP

some refactoring

disable system-based tags

disable freebsd tags

FreeBSD vpn role

add defaults

ssh role freebsd

default fix

dns_adblocking freebsd

ubuntu dict fix

* HardenedBSD

update-users BSD

* Rebuild the kernel

docs changing
7 years ago
Jack Ivanov d7d976784c Fixes #207 7 years ago
Jack Ivanov 2a7dd88a3c Changed to ECDSA #102 7 years ago
Jack Ivanov 35faf4bca7 Local openssl tasks (#169)
* Draft

works with ECDSA

RSA support for Windows

* update-users with local_openssl_tasks

* move prompts to the algo script

* additional directory for SSH keys

* move easyrsa_p12_export_password to pre_tasks

* update-users testing

* Fix hardcoded vars

* Delete the CA key

* Hardcoded IP. Fixes #219

* Some fixes
7 years ago
Jack Ivanov 37ec574d8d IP_subject_alt_name is not declared for localhost. Fixed #149 8 years ago
Jack Ivanov d50bd43988 Fix SSH keys permissions 8 years ago
Jack Ivanov 44bc3ead48 set AllowTcpForwarding to local 8 years ago
Jack Ivanov 00e4bcc1ec security role and SSH fixes #77 8 years ago
Jack Ivanov 8c5f80bf8f linting 8 years ago
Jack Ivanov 57b6c96ba8 SSH fingerprints #77 8 years ago
Jack Ivanov 0945f54366 SSH user-management #77 8 years ago
Jack Ivanov c19908c9b1 ssh fixes 8 years ago
Dan Guido 27421070b9 linting 8 years ago
Jack Ivanov 1dcfe18055 SSH tunneling role #77 8 years ago