Commit Graph

42 Commits

Author SHA1 Message Date
Jack Ivanov
090a60d48d PKI to tmpfs (#1496)
* PKI to tmpfs

* Fixes
- diskutil to full path
- unmount and eject fixes

* Umount fix

* run diskutil info only on Darwin kernels

* fix shell tasks
2019-07-10 12:31:25 -04:00
Jack Ivanov
634c609626
Don't set CA facts if IPsec is disabled (#1446)
* Don't set CA facts if ipsec is disabled

* localhost update-users fix
2019-05-30 07:20:45 +02:00
TC1977
ecb4e555b4 Update users: add server pick-list (#1441)
* Pick server to update from menu

* Command instead of shell

* Move to find module

Switched to the find module, and made the whole block dependent on server being undefined.

* Change names

* users.yml update
- Add assert to check if any servers found
- Set server_list as a proper list

* Change 'Build string' to 'Build list'
2019-05-21 17:17:58 +02:00
Jack Ivanov
d6a1fb91bd
WIP: Facts definition fix (#1415)
Facts definition fix
2019-05-01 11:51:06 +02:00
Jack Ivanov
25513cf925 Refactoring, Linting and additional tests (#1397)
* Refactoring, Linting and additional tests

* Vultr: Undefined variable and deprecation notes fix

* Travis-CI enable linters

* Azure: Update python requirements

* Update main.yml

* Update install.sh

* Add missing roles to ansible-lint

* Linting for skipped roles

* add .ansible-lint config
2019-04-26 11:48:28 -04:00
Jack Ivanov
c4ea88000b Refactoring to support roles inclusion (#1365) 2019-04-08 16:20:34 -04:00
Jack Ivanov
273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
2019-03-10 13:16:34 -04:00
Jack Ivanov
7a6daff1ff IPv6 fix (#1302) 2019-01-18 23:39:08 -05:00
Jack Ivanov
a66d8f0069 on-build python venvs (#1199) 2018-11-22 13:04:58 -05:00
Jack Ivanov
bcba905547 ssh tunneling fixes (#1127) 2018-10-07 17:33:55 -07:00
Jack Ivanov
e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
2018-08-27 10:05:45 -04:00
Jack Ivanov
ffb5a1f737 WireGuard: disable SaveConfig, update-users fix (#985)
- Disables SaveConfig. SaveConfig totally breaks the idea of configuration management and it breaks update-users
- WireGuard update-users fix. Mentioned in https://github.com/trailofbits/algo/issues/980#issuecomment-393720561
2018-06-01 10:06:03 -04:00
Jack Ivanov
02427910de Ansible 2.4, Lightsail, Scaleway, DreamCompute (OpenStack) integration (#804)
* Move to ansible-2.4.3

* Add Lightsail support #623

* Fixing the EC2 deployment

* Scaleway integration #623

* OpenStack cloud provider (DreamCompute optimised) #623

* Remove the security role

* Enable unattended-upgrades for clouds

* New requirements to make Azure and GCE work
2018-03-02 07:55:54 -05:00
Jack Ivanov
6ae113a38f update-users fix (#591) 2017-06-08 10:27:35 -04:00
Jack Ivanov
ee6db37428 Change the P12 and SSH passwords only for new users (#550) 2017-05-21 22:28:18 -04:00
Jack Ivanov
58d5a06e87 delete tasks and move to roles (#519) 2017-05-08 16:34:45 -04:00
Jack Ivanov
bd348af9c2 Implementing blocks and additional fail hints #487 (#497)
change the troubleshooting url
2017-04-29 10:48:25 -04:00
Jack Ivanov
a7b06058cb remove the proxy role #440 (#457)
* remove the proxy role #440

* Separate facts. Make roles more independent from each other

move openssl to local tasks

move unneeded tasks
2017-04-20 18:00:17 -04:00
Jack Ivanov
f300fdb60b Fixes #410 2017-04-15 16:33:22 +02:00
Josh Soref
84bbcb88d0 Spelling fixes (#342)
* spelling: algorithm

* spelling: bertrand

* spelling: between

* spelling: checking

* spelling: conjunction

* spelling: contributor

* spelling: delimited

* spelling: fashion

* spelling: droplet

* spelling: javascript

* spelling: nameserver

* spelling: obligatory

* spelling: official

* spelling: overridden

* spelling: overwrite

* spelling: parameter

* spelling: suppressing
2017-04-02 19:14:38 -04:00
Jack Ivanov
6facb6cb4f FreeBSD / HardenedBSD (#262)
* FreeBSD draft

ifconfig fix

Pre-tasks fixes

fix hardcoded IP

some refactoring

disable system-based tags

disable freebsd tags

FreeBSD vpn role

add defaults

ssh role freebsd

default fix

dns_adblocking freebsd

ubuntu dict fix

* HardenedBSD

update-users BSD

* Rebuild the kernel

docs changing
2017-03-18 12:22:07 +03:00
Jack Ivanov
237fcc7a7f additional variables 2017-03-05 10:58:42 +03:00
Jack Ivanov
98558c43d2 disable unneeded task 2017-02-26 12:15:22 +03:00
Jack Ivanov
9a5801f434 contgrats fix in update-users #243 2017-02-15 18:49:42 +03:00
Jack Ivanov
35faf4bca7 Local openssl tasks (#169)
* Draft

works with ECDSA

RSA support for Windows

* update-users with local_openssl_tasks

* move prompts to the algo script

* additional directory for SSH keys

* move easyrsa_p12_export_password to pre_tasks

* update-users testing

* Fix hardcoded vars

* Delete the CA key

* Hardcoded IP. Fixes #219

* Some fixes
2017-02-03 14:24:02 -05:00
Jack Ivanov
abf94989fc the password for the CA private key #75 2016-12-15 13:33:29 +03:00
Jack Ivanov
f1715c4e0b random password for the p12 certificates #135 2016-12-14 18:49:47 +03:00
Jack Ivanov
03c805cb87 reorganize the wait_for functions #159 2016-12-13 21:58:45 +03:00
Jack Ivanov
3d53dde6ca Fixed. #137 2016-12-06 20:14:08 +03:00
Jack Ivanov
105cb601e4 Add the SSH role to the users-update playbook #92 fixed 2016-10-06 20:39:53 +03:00
Jack Ivanov
8c5f80bf8f linting 2016-08-25 23:59:16 +03:00
Jack Ivanov
0945f54366 SSH user-management #77 2016-08-25 23:30:27 +03:00
Evgeniy Ivanov
cd706dbf82 Update-users fixed #52 2016-08-18 21:49:20 +03:00
Evgeniy Ivanov
9eaaf63fa0 server_name fixes 2016-08-18 12:36:54 +03:00
Evgeniy Ivanov
7085a594fc p12 moved into playbooks 2016-08-18 11:16:22 +03:00
Dan Guido
f538ffe4e8 linting 2016-08-15 23:32:44 -04:00
jack
e729f0d303 Roles and Google cloud 2016-08-14 20:03:23 +03:00
jack
917b7d6138 Modify user-management function 2016-08-11 23:54:29 +03:00
Defunct
e0527d7d27 EC2 Support 2016-07-31 18:59:40 +00:00
Dan Guido
d58a7b484d miscelllaneous cleanups 2016-07-30 13:26:30 -04:00
Evgeniy Ivanov
172845408c server name fixed 2016-07-28 00:29:39 +03:00
Evgeniy Ivanov
13f11514b7 User management 2016-07-28 00:27:11 +03:00