Skip to content

Commit c4ea880

Browse files
jackivanovdguido
jackivanov
authored and
dguido
committed
Refactoring to support roles inclusion (trailofbits#1365)
1 parent 8af0efa commit c4ea880

File tree

25 files changed

+860
-950
lines changed

25 files changed

+860
-950
lines changed

‎ansible.cfg‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ pipelining = True
44
retry_files_enabled = False
55
host_key_checking = False
66
timeout = 60
7-
stdout_callback = full_skip
7+
stdout_callback = default
8+
display_skipped_hosts = no
89

910
[paramiko_connection]
1011
record_host_keys = False

‎cloud.yml‎

Lines changed: 6 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -2,48 +2,20 @@
22
- name: Provision the server
33
hosts: localhost
44
tags: always
5+
become: false
56
vars_files:
67
- config.cfg
78

8-
pre_tasks:
9+
tasks:
910
- block:
1011
- name: Local pre-tasks
1112
import_tasks: playbooks/cloud-pre.yml
12-
tags: always
13-
rescue:
14-
- debug: var=fail_hint
15-
tags: always
16-
- fail:
17-
tags: always
1813

19-
roles:
20-
- role: cloud-digitalocean
21-
when: algo_provider == "digitalocean"
22-
- role: cloud-ec2
23-
when: algo_provider == "ec2"
24-
- role: cloud-vultr
25-
when: algo_provider == "vultr"
26-
- role: cloud-gce
27-
when: algo_provider == "gce"
28-
- role: cloud-azure
29-
when: algo_provider == "azure"
30-
- role: cloud-lightsail
31-
when: algo_provider == "lightsail"
32-
- role: cloud-scaleway
33-
when: algo_provider == "scaleway"
34-
- role: cloud-openstack
35-
when: algo_provider == "openstack"
36-
- role: local
37-
when: algo_provider == "local"
14+
- name: Include a provisioning role
15+
include_role:
16+
name: "{{ 'local' if algo_provider == 'local' else 'cloud-' + algo_provider }}"
3817

39-
post_tasks:
40-
- block:
4118
- name: Local post-tasks
4219
import_tasks: playbooks/cloud-post.yml
43-
become: false
44-
tags: cloud
4520
rescue:
46-
- debug: var=fail_hint
47-
tags: always
48-
- fail:
49-
tags: always
21+
- include_tasks: playbooks/rescue.yml

‎config.cfg‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@ ipsec_enabled: true
2525
# https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration
2626
strongswan_log_level: 2
2727

28+
# rightsourceip for ipsec
29+
# ipv4
30+
strongswan_network: 10.19.48.0/24
31+
# ipv6
32+
strongswan_network_ipv6: 'fd9d:bc11:4020::/48'
33+
2834
# Deploy WireGuard
2935
wireguard_enabled: true
3036
wireguard_port: 51820
@@ -33,6 +39,22 @@ wireguard_port: 51820
3339
# See: https://www.wireguard.com/quickstart/#nat-and-firewall-traversal-persistence
3440
wireguard_PersistentKeepalive: 0
3541

42+
# WireGuard network configuration
43+
_wireguard_network_ipv4:
44+
subnet: 10.19.49.0
45+
prefix: 24
46+
gateway: 10.19.49.1
47+
clients_range: 10.19.49
48+
clients_start: 2
49+
_wireguard_network_ipv6:
50+
subnet: 'fd9d:bc11:4021::'
51+
prefix: 48
52+
gateway: 'fd9d:bc11:4021::1'
53+
clients_range: 'fd9d:bc11:4021::'
54+
clients_start: 2
55+
wireguard_network_ipv4: "{{ _wireguard_network_ipv4['subnet'] }}/{{ _wireguard_network_ipv4['prefix'] }}"
56+
wireguard_network_ipv6: "{{ _wireguard_network_ipv6['subnet'] }}/{{ _wireguard_network_ipv6['prefix'] }}"
57+
3658
# Reduce the MTU of the VPN tunnel
3759
# Some cloud and internet providers use a smaller MTU (Maximum Transmission
3860
# Unit) than the normal value of 1500 and if you don't reduce the MTU of your

‎input.yml‎

Lines changed: 98 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -25,115 +25,118 @@
2525
- config.cfg
2626

2727
tasks:
28-
- pause:
29-
prompt: |
30-
What provider would you like to use?
31-
{% for p in providers_map %}
32-
{{ loop.index }}. {{ p['name']}}
33-
{% endfor %}
34-
35-
Enter the number of your desired provider
36-
register: _algo_provider
37-
when: provider is undefined
38-
39-
- name: Set facts based on the input
40-
set_fact:
41-
algo_provider: "{{ provider | default(providers_map[_algo_provider.user_input|default(omit)|int - 1]['alias']) }}"
42-
43-
- pause:
44-
prompt: |
45-
Name the vpn server
46-
[algo]
47-
register: _algo_server_name
48-
when:
49-
- server_name is undefined
50-
- algo_provider != "local"
5128
- block:
5229
- pause:
5330
prompt: |
54-
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to cellular networks?
55-
[y/N]
56-
register: _ondemand_cellular
57-
when: ondemand_cellular is undefined
31+
What provider would you like to use?
32+
{% for p in providers_map %}
33+
{{ loop.index }}. {{ p['name']}}
34+
{% endfor %}
5835
59-
- pause:
60-
prompt: |
61-
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to Wi-Fi?
62-
[y/N]
63-
register: _ondemand_wifi
64-
when: ondemand_wifi is undefined
36+
Enter the number of your desired provider
37+
register: _algo_provider
38+
when: provider is undefined
39+
40+
- name: Set facts based on the input
41+
set_fact:
42+
algo_provider: "{{ provider | default(providers_map[_algo_provider.user_input|default(omit)|int - 1]['alias']) }}"
6543

6644
- pause:
6745
prompt: |
68-
List the names of any trusted Wi-Fi networks where macOS/iOS IPsec clients should not use "Connect On Demand"
69-
(e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
70-
register: _ondemand_wifi_exclude
46+
Name the vpn server
47+
[algo]
48+
register: _algo_server_name
7149
when:
72-
- ondemand_wifi_exclude is undefined
73-
- (ondemand_wifi|default(false)|bool) or
74-
(booleans_map[_ondemand_wifi.user_input|default(omit)]|default(false))
50+
- server_name is undefined
51+
- algo_provider != "local"
52+
- block:
53+
- pause:
54+
prompt: |
55+
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to cellular networks?
56+
[y/N]
57+
register: _ondemand_cellular
58+
when: ondemand_cellular is undefined
59+
60+
- pause:
61+
prompt: |
62+
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to Wi-Fi?
63+
[y/N]
64+
register: _ondemand_wifi
65+
when: ondemand_wifi is undefined
66+
67+
- pause:
68+
prompt: |
69+
List the names of any trusted Wi-Fi networks where macOS/iOS IPsec clients should not use "Connect On Demand"
70+
(e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
71+
register: _ondemand_wifi_exclude
72+
when:
73+
- ondemand_wifi_exclude is undefined
74+
- (ondemand_wifi|default(false)|bool) or
75+
(booleans_map[_ondemand_wifi.user_input|default(omit)]|default(false))
76+
77+
- pause:
78+
prompt: |
79+
Do you want the VPN to support Windows 10 or Linux Desktop clients? (enables compatible ciphers and key exchange, less secure)
80+
[y/N]
81+
register: _windows
82+
when: windows is undefined
83+
84+
- pause:
85+
prompt: |
86+
Do you want to retain the CA key? (required to add users in the future, but less secure)
87+
[y/N]
88+
register: _store_cakey
89+
when: store_cakey is undefined
90+
when: ipsec_enabled
7591

7692
- pause:
7793
prompt: |
78-
Do you want the VPN to support Windows 10 or Linux Desktop clients? (enables compatible ciphers and key exchange, less secure)
94+
Do you want to install an ad blocking DNS resolver on this VPN server?
7995
[y/N]
80-
register: _windows
81-
when: windows is undefined
96+
register: _local_dns
97+
when: local_dns is undefined
8298

8399
- pause:
84100
prompt: |
85-
Do you want to retain the CA key? (required to add users in the future, but less secure)
101+
Do you want each user to have their own account for SSH tunneling?
86102
[y/N]
87-
register: _store_cakey
88-
when: store_cakey is undefined
89-
when: ipsec_enabled
90-
91-
- pause:
92-
prompt: |
93-
Do you want to install an ad blocking DNS resolver on this VPN server?
94-
[y/N]
95-
register: _local_dns
96-
when: local_dns is undefined
97-
98-
- pause:
99-
prompt: |
100-
Do you want each user to have their own account for SSH tunneling?
101-
[y/N]
102-
register: _ssh_tunneling
103-
when: ssh_tunneling is undefined
103+
register: _ssh_tunneling
104+
when: ssh_tunneling is undefined
104105

105-
- name: Set facts based on the input
106-
set_fact:
107-
algo_server_name: >-
108-
{% if server_name is defined %}{% set _server = server_name %}
109-
{%- elif _algo_server_name.user_input is defined and _algo_server_name.user_input != "" %}{% set _server = _algo_server_name.user_input %}
110-
{%- else %}{% set _server = defaults['server_name'] %}{% endif -%}
111-
{{ _server | regex_replace('(?!\.)(\W|_)', '-') }}
112-
algo_ondemand_cellular: >-
113-
{% if ondemand_cellular is defined %}{{ ondemand_cellular | bool }}
114-
{%- elif _ondemand_cellular.user_input is defined and _ondemand_cellular.user_input != "" %}{{ booleans_map[_ondemand_cellular.user_input] | default(defaults['ondemand_cellular']) }}
115-
{%- else %}false{% endif %}
116-
algo_ondemand_wifi: >-
117-
{% if ondemand_wifi is defined %}{{ ondemand_wifi | bool }}
118-
{%- elif _ondemand_wifi.user_input is defined and _ondemand_wifi.user_input != "" %}{{ booleans_map[_ondemand_wifi.user_input] | default(defaults['ondemand_wifi']) }}
119-
{%- else %}false{% endif %}
120-
algo_ondemand_wifi_exclude: >-
121-
{% if ondemand_wifi_exclude is defined %}{{ ondemand_wifi_exclude | b64encode }}
122-
{%- elif _ondemand_wifi_exclude.user_input is defined and _ondemand_wifi_exclude.user_input != "" %}{{ _ondemand_wifi_exclude.user_input | b64encode }}
123-
{%- else %}{{ '_null' | b64encode }}{% endif %}
124-
algo_local_dns: >-
125-
{% if local_dns is defined %}{{ local_dns | bool }}
126-
{%- elif _local_dns.user_input is defined and _local_dns.user_input != "" %}{{ booleans_map[_local_dns.user_input] | default(defaults['local_dns']) }}
127-
{%- else %}false{% endif %}
128-
algo_ssh_tunneling: >-
129-
{% if ssh_tunneling is defined %}{{ ssh_tunneling | bool }}
130-
{%- elif _ssh_tunneling.user_input is defined and _ssh_tunneling.user_input != "" %}{{ booleans_map[_ssh_tunneling.user_input] | default(defaults['ssh_tunneling']) }}
131-
{%- else %}false{% endif %}
132-
algo_windows: >-
133-
{% if windows is defined %}{{ windows | bool }}
134-
{%- elif _windows.user_input is defined and _windows.user_input != "" %}{{ booleans_map[_windows.user_input] | default(defaults['windows']) }}
135-
{%- else %}false{% endif %}
136-
algo_store_cakey: >-
137-
{% if store_cakey is defined %}{{ store_cakey | bool }}
138-
{%- elif _store_cakey.user_input is defined and _store_cakey.user_input != "" %}{{ booleans_map[_store_cakey.user_input] | default(defaults['store_cakey']) }}
139-
{%- else %}false{% endif %}
106+
- name: Set facts based on the input
107+
set_fact:
108+
algo_server_name: >-
109+
{% if server_name is defined %}{% set _server = server_name %}
110+
{%- elif _algo_server_name.user_input is defined and _algo_server_name.user_input != "" %}{% set _server = _algo_server_name.user_input %}
111+
{%- else %}{% set _server = defaults['server_name'] %}{% endif -%}
112+
{{ _server | regex_replace('(?!\.)(\W|_)', '-') }}
113+
algo_ondemand_cellular: >-
114+
{% if ondemand_cellular is defined %}{{ ondemand_cellular | bool }}
115+
{%- elif _ondemand_cellular.user_input is defined and _ondemand_cellular.user_input != "" %}{{ booleans_map[_ondemand_cellular.user_input] | default(defaults['ondemand_cellular']) }}
116+
{%- else %}false{% endif %}
117+
algo_ondemand_wifi: >-
118+
{% if ondemand_wifi is defined %}{{ ondemand_wifi | bool }}
119+
{%- elif _ondemand_wifi.user_input is defined and _ondemand_wifi.user_input != "" %}{{ booleans_map[_ondemand_wifi.user_input] | default(defaults['ondemand_wifi']) }}
120+
{%- else %}false{% endif %}
121+
algo_ondemand_wifi_exclude: >-
122+
{% if ondemand_wifi_exclude is defined %}{{ ondemand_wifi_exclude | b64encode }}
123+
{%- elif _ondemand_wifi_exclude.user_input is defined and _ondemand_wifi_exclude.user_input != "" %}{{ _ondemand_wifi_exclude.user_input | b64encode }}
124+
{%- else %}{{ '_null' | b64encode }}{% endif %}
125+
algo_local_dns: >-
126+
{% if local_dns is defined %}{{ local_dns | bool }}
127+
{%- elif _local_dns.user_input is defined and _local_dns.user_input != "" %}{{ booleans_map[_local_dns.user_input] | default(defaults['local_dns']) }}
128+
{%- else %}false{% endif %}
129+
algo_ssh_tunneling: >-
130+
{% if ssh_tunneling is defined %}{{ ssh_tunneling | bool }}
131+
{%- elif _ssh_tunneling.user_input is defined and _ssh_tunneling.user_input != "" %}{{ booleans_map[_ssh_tunneling.user_input] | default(defaults['ssh_tunneling']) }}
132+
{%- else %}false{% endif %}
133+
algo_windows: >-
134+
{% if windows is defined %}{{ windows | bool }}
135+
{%- elif _windows.user_input is defined and _windows.user_input != "" %}{{ booleans_map[_windows.user_input] | default(defaults['windows']) }}
136+
{%- else %}false{% endif %}
137+
algo_store_cakey: >-
138+
{% if store_cakey is defined %}{{ store_cakey | bool }}
139+
{%- elif _store_cakey.user_input is defined and _store_cakey.user_input != "" %}{{ booleans_map[_store_cakey.user_input] | default(defaults['store_cakey']) }}
140+
{%- else %}false{% endif %}
141+
rescue:
142+
- include_tasks: playbooks/rescue.yml

‎playbooks/rescue.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
- debug:
3+
var: fail_hint
4+
5+
- fail:

0 commit comments

Comments
 (0)