Commit Graph

53 Commits

Author SHA1 Message Date
dependabot[bot]
4e739b518f
Bump ansible from 2.9.20 to 4.4.0 (#14272)
* Bump ansible from 2.9.20 to 4.4.0

Bumps [ansible](https://github.com/ansible/ansible) from 2.9.20 to 4.4.0.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/commits)

---
updated-dependencies:
- dependency-name: ansible
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* ansible core

* aadd vagrant and fix jinja

* bool variable fix

* ec2 task deprecation

* bool fix

* azure requirements fix

* cloudscale fix

* scaleway fix

* openstack fixes

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jack Ivanov <e601809@gmail.com>
Co-authored-by: Jack Ivanov <17044561+jackivanov@users.noreply.github.com>
2021-10-31 12:58:35 +03:00
David Myers
728b8aae06
Install required version of jinja2 earlier (#14206) 2021-05-26 13:36:18 +03:00
Jack Ivanov
8c560719a5
skip pre tasks in update-users (#1921) 2020-12-08 13:23:24 +03:00
Jack Ivanov
2abbf22196
Alternative Ingress IP (#1605)
* Separate ingress IP draft

* task name fix

* placeholder
2020-01-31 11:24:29 +01:00
Jack Ivanov
d635c76b50
Change default SSH port and introduce cloud-init support (#1636)
* Change default SSH port

* Iptables to ansible_ssh_port

* Add Scaleway

* permissions and groups fixes

* update firewall docs

* SSH fixes

* add missing cloudinit to cloud-azure

* remove ansible_ssh_user from the tests

* congrats message fix
2020-01-07 14:28:19 +01:00
Jack Ivanov
dfd979eb68
Windows SSH key permissions workaround (#1584)
* Windows SSH key permissions workaround

* Ensure Ansible is not being run in a world writable directory

* linting
2019-11-01 09:57:20 +01:00
Jack Ivanov
8bdd99c05d Refactor to support Ansible 2.8 (#1549)
* bump ansible to 2.8.3

* DigitalOcean: move to the latest modules

* Add Hetzner Cloud

* Scaleway and Lightsail fixes

* lint missing roles

* Update roles/cloud-hetzner/tasks/main.yml

Add api_token

Co-Authored-By: phaer <phaer@phaer.org>

* Update roles/cloud-hetzner/tasks/main.yml

Add api_token

Co-Authored-By: phaer <phaer@phaer.org>

* Try to run apt until succeeded

* Scaleway modules upgrade

* GCP: Refactoring, remove deprecated modules

* Doc updates (#1552)

* Update README.md

Adding links and mentions of Exoscale aka CloudStack and Hetzner Cloud.

* Update index.md

Add the Hetzner Cloud to the docs index

* Remove link to Win 10 IPsec instructions

* Delete client-windows.md

Unnecessary since the deprecation of IPsec for Win10.

* Update deploy-from-ansible.md

Added sections and required variables for CloudStack and Hetzner Cloud.

* Update deploy-from-ansible.md

Added sections for CloudStack and Hetzner, added req variables and examples, mentioned environment variables, and added links to the provider role section.

* Update deploy-from-ansible.md

Cosmetic changes to links, fix typo.

* Update GCE variables

* Update deploy-from-script-or-cloud-init-to-localhost.md

Fix a finer point, and make variables list more readable.

* update azure requirements

* Python3 draft

* set LANG=c to the p12 password generation task

* Update README

* Install cloud requirements to the existing venv

* FreeBSD fix

* env->.env fixes

* lightsail_region_facts fix

* yaml syntax fix

* Update README for Python 3 (#1564)

* Update README for Python 3

* Remove tabs and tweak instructions

* Remove cosmetic command indentation

* Update README.md

* Update README for Python 3 (#1565)

* DO fix for "found unpermitted parameters: id"

* Verify Python version

* Remove ubuntu 16.04 from readme

* Revert back DigitalOcean module

* Update deploy-from-script-or-cloud-init-to-localhost.md

* env to .env
2019-09-28 08:10:20 +08:00
Jack Ivanov
561afe18f9
Remove WireGuard pki from tmpfs (#1547) 2019-08-13 17:36:07 +02:00
Jack Ivanov
38d8a6d0e2 Deprecate IKEv2 for Windows (#1521)
* Windows to WireGuard

* Add note about WireGuard

* change wireguard faq

* Clarify Windows instructions

* Correct Wireguard description

* Update README.md
2019-07-31 11:28:33 -04:00
Jack Ivanov
090a60d48d PKI to tmpfs (#1496)
* PKI to tmpfs

* Fixes
- diskutil to full path
- unmount and eject fixes

* Umount fix

* run diskutil info only on Darwin kernels

* fix shell tasks
2019-07-10 12:31:25 -04:00
Jack Ivanov
8602a697cc
dnscrypt-proxy as a dns adblocker (#1480)
* Move DNS adblocking to dnscrypt-proxy

* Update docs

* remove unneeded variable dnscrypt_proxy_version

* Update to the latest dnscrypt-proxy version

* install.sh fix

* spelling
2019-06-19 17:31:43 +02:00
Jack Ivanov
d6a1fb91bd
WIP: Facts definition fix (#1415)
Facts definition fix
2019-05-01 11:51:06 +02:00
Jack Ivanov
25513cf925 Refactoring, Linting and additional tests (#1397)
* Refactoring, Linting and additional tests

* Vultr: Undefined variable and deprecation notes fix

* Travis-CI enable linters

* Azure: Update python requirements

* Update main.yml

* Update install.sh

* Add missing roles to ansible-lint

* Linting for skipped roles

* add .ansible-lint config
2019-04-26 11:48:28 -04:00
Jack Ivanov
c4ea88000b Refactoring to support roles inclusion (#1365) 2019-04-08 16:20:34 -04:00
Les Aker
9b89801b8a skip generation of SSH keypair when deploying locally (#1348) 2019-03-11 13:29:39 +01:00
Jack Ivanov
273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
2019-03-10 13:16:34 -04:00
Jack Ivanov
7e7476ec6b
Update cloud-pre.yml 2019-03-06 13:04:20 +01:00
Jack Ivanov
ec56203b87
Support for custom domain names in the endpoint (#1337) 2019-02-25 17:58:09 +01:00
Jack Ivanov
a66d8f0069 on-build python venvs (#1199) 2018-11-22 13:04:58 -05:00
David Myers
65b0239625 Display the invocation environment to aid debugging (#1108) 2018-09-07 16:25:57 +02:00
Jack Ivanov
e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
2018-08-27 10:05:45 -04:00
Jack Ivanov
d27b849f24 Ubuntu1804 (#925)
- Fixes #897 #944 #956

Work in progress. Lightsail is not ready for Ubuntu 18.04 yet

- [x] DigitalOcean
~~- [ ] Amazon Lightsail~~
- [x] Amazon EC2
- [x] Microsoft Azure
- [x] Google Compute Engine
- [x] Scaleway
- [x] OpenStack (DreamCompute optimised)
2018-05-24 07:08:14 -07:00
Jack Ivanov
35e526a5a3 IPv6 fixes (#930) 2018-05-08 13:55:17 -07:00
Micah R Ledbetter
e944ee993a Embed certs into Windows deployment scripts (#840)
- Obviate need to copy separate script and certificate files
- Allow execution from any directory, not just the script's parent
  directory (no assumption of any particular working directory)
- Fix docs that neglected to mention copying cacert.pem
- Fix docs that incorrectly referred to the user cert store

As part of this work, rewrite the windows_client.ps1.j2 deployment
script template

- Add comment-based help
- Require admin privileges
- Use a Param() block
- Use parameter sets with -Add and -Remove switches
- Add the -GetInstalledCerts switch, to list any Algo certificates
  installed the machine's cert store
- Add the -SaveCerts switch, to save the embedded certificates to files
- Put Jinja2 variables inside Powershell variables,
- Use native Powershell cmdlets rather than shell out to certutil.exe
- Add a playbook to regenerate the windows_USER.ps1 scripts
2018-03-28 11:20:43 -07:00
Jack Ivanov
bb094a7b16 More debug for travis 2018-03-27 19:28:48 +03:00
Jack Ivanov
02427910de Ansible 2.4, Lightsail, Scaleway, DreamCompute (OpenStack) integration (#804)
* Move to ansible-2.4.3

* Add Lightsail support #623

* Fixing the EC2 deployment

* Scaleway integration #623

* OpenStack cloud provider (DreamCompute optimised) #623

* Remove the security role

* Enable unattended-upgrades for clouds

* New requirements to make Azure and GCE work
2018-03-02 07:55:54 -05:00
Paul.W Harvey
e891d5c43b Generate stronger p12_export_password (#654) (#657)
This buys us an extra 16bits of password guessing entropy by expanding the characterset from hex to [a-zA-Z0-9_@]
2017-09-29 16:04:45 +02:00
Paul.W Harvey
dd43e1e47e Use openssl to generate better quality p12_export_password (#655)
We're already doing it this way for CA_password, and ansible's to_uuid is problematic as it uses uuid v5 under the hood (#654)
2017-08-29 08:32:12 -05:00
Ruben Jongejan
e9e6c6e383 cleaner syntax for local actions (#536)
* refactored local actions to cleaner syntax

* openssl commands folded

* removed unnecessary local_action's
2017-05-17 02:30:04 -04:00
Jack Ivanov
d10a86b331 Revert "define local_dns if dns tag used (#531)" (#532)
This reverts commit 627b7d5d9b.
2017-05-08 22:12:49 +02:00
Jack Ivanov
627b7d5d9b define local_dns if dns tag used (#531) 2017-05-08 16:10:59 -04:00
Christopher J. Pilkington
27f9cda361 Add additional delay for ec2 instance prior to ssh (#527)
* Add additional delay for ec2 instance prior to ssh

* Add 10 second delay to all, rather than to cloud-ec2
2017-05-07 12:35:27 -04:00
Jack Ivanov
451394100d Some enhances in the compat ciphers (#464)
raise the IntegrityCheckMethod to SHA384

Move Windows to ECDSA

Increase IntegrityCheckMethod
2017-04-23 16:00:37 -04:00
Jack Ivanov
a7b06058cb remove the proxy role #440 (#457)
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
2017-04-20 18:00:17 -04:00
Andy Boutte
aa0aadd66e Removing update to ~/.ssh/config #400 (#435) 2017-04-17 22:01:42 -04:00
Jack Ivanov
16329fe088 Instance size (#404)
* Escaping Special Characters #388

* Make instance sizes more flexible to edit #355
2017-04-16 10:19:47 -04:00
Jack Ivanov
25e0e9085d move back to RSA 2017-04-10 07:22:40 +02:00
Jack Ivanov
95e0134f21 1. Disable SSH key deploying if installation on existing server
2. Move to the ed25519 algorithm
3. Delete unneeded option RSAAuthentication
Fixes #272
2017-04-09 20:41:45 +02:00
Casey Lang
9b76282a37 Check for creation of private key during its generation (#322)
This task was previously checking for the public key even though it is
in place to generate the private key. A simple switch to the `creates`
arg resolves the issue.
2017-03-31 13:25:39 -04:00
Jack Ivanov
9daec9be9e fix ssh tasks 2017-03-19 21:45:21 +03:00
Jack Ivanov
4de4229e82 Fix hardcoded names 2017-03-18 12:41:26 +03:00
Jack Ivanov
6facb6cb4f FreeBSD / HardenedBSD (#262)
* FreeBSD draft

ifconfig fix

Pre-tasks fixes

fix hardcoded IP

some refactoring

disable system-based tags

disable freebsd tags

FreeBSD vpn role

add defaults

ssh role freebsd

default fix

dns_adblocking freebsd

ubuntu dict fix

* HardenedBSD

update-users BSD

* Rebuild the kernel

docs changing
2017-03-18 12:22:07 +03:00
Jack Ivanov
f7da2e3888 EC2 dynamic enventory. Fixes #73 2017-03-05 23:19:15 +03:00
Jack Ivanov
eba04b3c91 ssh_config fix 2017-02-28 22:22:06 +03:00
Jack Ivanov
1cca3b1093 Ensure that ssh keys and configs are exist Fixes #250 (#254) 2017-02-28 20:05:22 +03:00
Jack Ivanov
d23c952a4e Add the algo ssh key to any server (prevent fails when a user wants to update-users on a server deployed by algo but not with the algo ssh key) 2017-01-14 19:38:21 +03:00
Jack Ivanov
1d07200c74 generating ssh-keys #152 #151 #112 2016-12-17 14:54:44 +03:00
Jack Ivanov
275663264a ipv6 option is available in ansible 2.2; Fixed #158 2016-12-13 21:12:51 +03:00
Jack Ivanov
bb90bb26a6 a fix for ipv6 provisioning on DO #158 2016-12-13 09:08:12 +03:00
Jack Ivanov
d558781473 dirty fix #148 2016-12-12 18:13:58 +03:00