From f0366562aa344544b85e68b7ac7d0dac434ca945 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 14:10:57 +0300 Subject: [PATCH 1/7] google and azure --- README.md | 3 +++ config.cfg | 3 --- run | 6 ++++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index c1b1f98..c3cc5f0 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,9 @@ Algo (short for "Al Gore", the **V**ice **P**resident of **N**etworks everywhere * python >= 2.6 * [dopy=0.3.5](https://github.com/Wiredcraft/dopy) * [boto](https://github.com/boto/boto) +* [azure >= 0.7.1](https://github.com/Azure/azure-sdk-for-python) +* [apache-libcloud](https://github.com/apache/libcloud) +* [libcloud](https://curl.haxx.se/docs/caextract.html) (for Mac OS) * SHell or BASH * libselinux-python (for RedHat based distros) diff --git a/config.cfg b/config.cfg index bfd3aa2..c17bbf4 100644 --- a/config.cfg +++ b/config.cfg @@ -30,6 +30,3 @@ users: # auditd options # email for auditd actions: auditd_action_mail_acct: email@example.com - - - diff --git a/run b/run index 5283717..bf754c6 100755 --- a/run +++ b/run @@ -5,7 +5,7 @@ algo_provisioning () { What provider would you like to use? 1. DigitalOcean 2. Amazon EC2 - 3. Local installation (non-cloud or a server already deployed) + 0. Local installation (non-cloud or a server already deployed) Enter the number of your desired provider : " @@ -15,7 +15,9 @@ algo_provisioning () { case "$N" in 1) CLOUD="digitalocean" ;; 2) CLOUD="ec2" ;; - 3) CLOUD="non-cloud" ;; + 3) CLOUD="azure" ;; + 4) CLOUD="google_cloud" ;; + 0) CLOUD="non-cloud" ;; *) exit 1 ;; esac From 97865f40ec5442fabcb56859cecabcb3361f9e01 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 14:11:48 +0300 Subject: [PATCH 2/7] google and azure --- run | 2 ++ 1 file changed, 2 insertions(+) diff --git a/run b/run index bf754c6..6041d90 100755 --- a/run +++ b/run @@ -5,6 +5,8 @@ algo_provisioning () { What provider would you like to use? 1. DigitalOcean 2. Amazon EC2 + 3. Azure + 4. Google-cloud 0. Local installation (non-cloud or a server already deployed) Enter the number of your desired provider From 3870956f0a8dc7f37ffa16d9907a528814c0eab4 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 14:13:23 +0300 Subject: [PATCH 3/7] google and azure --- azure.yml | 99 ++++++++++++++++++++++++++++ google_cloud.yml | 99 ++++++++++++++++++++++++++++ roles/azure/handlers/main.yml | 0 roles/azure/tasks/main.yml | 45 +++++++++++++ roles/google_cloud/handlers/main.yml | 0 roles/google_cloud/tasks/main.yml | 13 ++++ 6 files changed, 256 insertions(+) create mode 100644 azure.yml create mode 100644 google_cloud.yml create mode 100644 roles/azure/handlers/main.yml create mode 100644 roles/azure/tasks/main.yml create mode 100644 roles/google_cloud/handlers/main.yml create mode 100644 roles/google_cloud/tasks/main.yml diff --git a/azure.yml b/azure.yml new file mode 100644 index 0000000..5e35b77 --- /dev/null +++ b/azure.yml @@ -0,0 +1,99 @@ +- name: Configure the server and install required software + hosts: localhost + gather_facts: false + + vars: + regions: + "1": "East US" + "2": "West US" + "3": "South Central US" + "4": "North Europe" + "5": "East Asia" + "6": "Japan East" + "7": "West Europe" + "8": "Southeast Asia" + "9": "Japan West" + "10": "North Central US" + "11": "Central US" + "12": "Brazil South" + "13": "East US 2" + "14": "Australia Southeast" + "15": "Australia East" + + #vars_prompt: + #- name: "azure_subscription_id" + #prompt: "Enter your subscription ID (https://blogs.msdn.microsoft.com/mschray/2015/05/13/getting-your-azure-guid-subscription-id/):\n" + #private: yes + + #- name: "management_cert_path" + #prompt: "Enter the local path to your management cert [ex: ~/.ssh/id_rsa.pub] (https://azure.microsoft.com/en-us/documentation/articles/azure-api-management-certs/):\n" + #private: no + + #- name: "ssh_public_key" + #prompt: "Enter the local path to your SSH public key [ex: ~/.ssh/id_rsa.pub] :\n" + #private: no + + #- name: "region" + #prompt: > + #What region should the server be located in? + #1. East US + #2. West US + #3. South Central US + #4. North Europe + #5. East Asia + #6. Japan East + #7. West Europe + #8. Southeast Asia + #9. Japan West + #10. North Central US + #11. Central US + #12. Brazil South + #13. East US 2 + #14. Australia Southeast + #15. Australia East + #Enter the number of your desired region: + #default: "7" + #private: no + + #- name: "azure_server_name" + #prompt: "Name the vpn server:\n" + #default: "algo.local" + #private: no + + #- name: "dns_enabled" + #prompt: "Do you want to use a local DNS resolver to block ads while surfing? (Y or N):\n" + #default: "Y" + #private: no + + #- name: "auditd_enabled" + #prompt: "Do you want to use auditd ? (Y or N):\n" + #default: "Y" + #private: no + + roles: + - azure + +- name: Post-provisioning tasks + hosts: vpn-host + gather_facts: false + become: true + vars_files: + - config.cfg + + pre_tasks: + - name: Install prerequisites + raw: sudo apt-get update -qq && sudo apt-get install -qq -y python2.7 + - name: Configure defaults + raw: sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1 + + roles: + - common + - security + - features + - vpn + - { role: logging, when: auditd_enabled is defined and auditd_enabled == 'Y' } + + + + + diff --git a/google_cloud.yml b/google_cloud.yml new file mode 100644 index 0000000..80da93b --- /dev/null +++ b/google_cloud.yml @@ -0,0 +1,99 @@ +- name: Configure the server and install required software + hosts: localhost + gather_facts: false + + vars: + regions: + "1": "East US" + "2": "West US" + "3": "South Central US" + "4": "North Europe" + "5": "East Asia" + "6": "Japan East" + "7": "West Europe" + "8": "Southeast Asia" + "9": "Japan West" + "10": "North Central US" + "11": "Central US" + "12": "Brazil South" + "13": "East US 2" + "14": "Australia Southeast" + "15": "Australia East" + + #vars_prompt: + #- name: "azure_subscription_id" + #prompt: "Enter your subscription ID (https://blogs.msdn.microsoft.com/mschray/2015/05/13/getting-your-azure-guid-subscription-id/):\n" + #private: yes + + #- name: "management_cert_path" + #prompt: "Enter the local path to your management cert [ex: ~/.ssh/id_rsa.pub] (https://azure.microsoft.com/en-us/documentation/articles/azure-api-management-certs/):\n" + #private: no + + #- name: "ssh_public_key" + #prompt: "Enter the local path to your SSH public key [ex: ~/.ssh/id_rsa.pub] :\n" + #private: no + + #- name: "region" + #prompt: > + #What region should the server be located in? + #1. East US + #2. West US + #3. South Central US + #4. North Europe + #5. East Asia + #6. Japan East + #7. West Europe + #8. Southeast Asia + #9. Japan West + #10. North Central US + #11. Central US + #12. Brazil South + #13. East US 2 + #14. Australia Southeast + #15. Australia East + #Enter the number of your desired region: + #default: "7" + #private: no + + #- name: "azure_server_name" + #prompt: "Name the vpn server:\n" + #default: "algo.local" + #private: no + + #- name: "dns_enabled" + #prompt: "Do you want to use a local DNS resolver to block ads while surfing? (Y or N):\n" + #default: "Y" + #private: no + + #- name: "auditd_enabled" + #prompt: "Do you want to use auditd ? (Y or N):\n" + #default: "Y" + #private: no + + roles: + - google_cloud + +- name: Post-provisioning tasks + hosts: vpn-host + gather_facts: false + become: true + vars_files: + - config.cfg + + pre_tasks: + - name: Install prerequisites + raw: sudo apt-get update -qq && sudo apt-get install -qq -y python2.7 + - name: Configure defaults + raw: sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1 + + roles: + - common + - security + - features + - vpn + - { role: logging, when: auditd_enabled is defined and auditd_enabled == 'Y' } + + + + + diff --git a/roles/azure/handlers/main.yml b/roles/azure/handlers/main.yml new file mode 100644 index 0000000..e69de29 diff --git a/roles/azure/tasks/main.yml b/roles/azure/tasks/main.yml new file mode 100644 index 0000000..b17811c --- /dev/null +++ b/roles/azure/tasks/main.yml @@ -0,0 +1,45 @@ +- local_action: + module: azure + name: my-virtual-machine + role_size: Small + image: b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu_DAILY_BUILD-precise-12_04_3-LTS-amd64-server-20131205-en-us-30GB + location: 'East US' + user: ubuntu + ssh_cert_path: "/home/jack/.ssh/upwork.pub" + storage_account: my-storage-account + wait: yes + subscription_id: "02e68d20-1a39-4faa-aa35-6bdd0238b54e" + management_cert_path: "/home/jack/ownCloud/Clouds/azure/manage.cer" + + +#- name: "Creating a virtual machine..." + #azure: + #subscription_id: "02e68d20-1a39-4faa-aa35-6bdd0238b54e" + #name: "algo-vpn" + #role_size: Small + #image: b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-16_04-LTS-amd64-server-20160721-en-us-30GB + #location: "West Europe" + #user: ubuntu + #ssh_cert_path: "/home/jack/.ssh/upwork.pub" + #storage_account: 'algo.vpn' + #management_cert_path: "/home/jack/ownCloud/Clouds/azure/manage.cer" + #wait: yes + #state: present + #register: azure_vm + +- debug: msg="{{ azure_vm }}" + +#- name: Add the droplet to an inventory group + #add_host: + #name: "{{ do.droplet.ip_address }}" + #groups: vpn-host + #ansible_ssh_user: root + #ansible_python_interpreter: "/usr/bin/python2.7" + #do_access_token: "{{ do_access_token }}" + #do_droplet_id: "{{ do.droplet.id }}" + #dns_enabled: "{{ dns_enabled }}" + #auditd_enabled: " {{ auditd_enabled }}" + +#- name: Wait for SSH to become available + #local_action: "wait_for port=22 host={{ do.droplet.ip_address }} timeout=320" + diff --git a/roles/google_cloud/handlers/main.yml b/roles/google_cloud/handlers/main.yml new file mode 100644 index 0000000..e69de29 diff --git a/roles/google_cloud/tasks/main.yml b/roles/google_cloud/tasks/main.yml new file mode 100644 index 0000000..ed3b6f3 --- /dev/null +++ b/roles/google_cloud/tasks/main.yml @@ -0,0 +1,13 @@ +- name: Launch instances + gce: + instance_names: dev + zone: us-central1-b + machine_type: n1-standard-1 + image: debian-7-wheezy + service_account_email: e601809@gmail.com + credentials_file: '/home/jack/ownCloud/Clouds/Google/My First Project-72e386228f5e.json' + project_id: algo-833@storied-bearing-140310.iam.gserviceaccount.com + register: google_vm + +- debug: msg="{{ google_vm }}" + From 89758aaec97653b1e7d813f8bc6ec315c7478a77 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 16:36:50 +0300 Subject: [PATCH 4/7] Google Cloud Engine #27 --- google_cloud.yml | 114 ++++++++++++++---------------- roles/google_cloud/tasks/main.yml | 32 ++++++--- run | 4 +- 3 files changed, 79 insertions(+), 71 deletions(-) diff --git a/google_cloud.yml b/google_cloud.yml index 80da93b..504f82f 100644 --- a/google_cloud.yml +++ b/google_cloud.yml @@ -3,72 +3,64 @@ gather_facts: false vars: - regions: - "1": "East US" - "2": "West US" - "3": "South Central US" - "4": "North Europe" - "5": "East Asia" - "6": "Japan East" - "7": "West Europe" - "8": "Southeast Asia" - "9": "Japan West" - "10": "North Central US" - "11": "Central US" - "12": "Brazil South" - "13": "East US 2" - "14": "Australia Southeast" - "15": "Australia East" + zones: + "1": "us-central1-a" + "2": "us-central1-b" + "3": "us-central1-c" + "4": "us-central1-f" + "5": "us-east1-b" + "6": "us-east1-c" + "7": "us-east1-d" + "8": "europe-west1-b" + "9": "europe-west1-c" + "10": "europe-west1-d" + "11": "asia-east1-a" + "12": "asia-east1-b" + "13": "asia-east1-c" - #vars_prompt: - #- name: "azure_subscription_id" - #prompt: "Enter your subscription ID (https://blogs.msdn.microsoft.com/mschray/2015/05/13/getting-your-azure-guid-subscription-id/):\n" - #private: yes + vars_prompt: + - name: "credentials_file" + prompt: "Enter the local path to your credentials JSON file [ex: ~/gogle_cloud.json] (https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts):\n" + private: no + + - name: "ssh_public_key" + prompt: "Enter the local path to your SSH public key [ex: ~/.ssh/id_rsa.pub] :\n" + private: no - #- name: "management_cert_path" - #prompt: "Enter the local path to your management cert [ex: ~/.ssh/id_rsa.pub] (https://azure.microsoft.com/en-us/documentation/articles/azure-api-management-certs/):\n" - #private: no + - name: "zone" + prompt: > + What zone should the server be located in? + 1. Central US (Iowa A) + 2. Central US (Iowa B) + 3. Central US (Iowa C) + 4. Central US (Iowa F) + 5. Eastern US (South Carolina B) + 6. Eastern US (South Carolina C) + 7. Eastern US (South Carolina D) + 8. Western Europe (Belgium B) + 9. Western Europe (Belgium C) + 10. Western Europe (Belgium D) + 11. East Asia (Taiwan A) + 12. East Asia (Taiwan B) + 13. East Asia (Taiwan C) + Please choose the number of your zone. Press enter for default (#8) zone. + default: "8" + private: no - #- name: "ssh_public_key" - #prompt: "Enter the local path to your SSH public key [ex: ~/.ssh/id_rsa.pub] :\n" - #private: no - - #- name: "region" - #prompt: > - #What region should the server be located in? - #1. East US - #2. West US - #3. South Central US - #4. North Europe - #5. East Asia - #6. Japan East - #7. West Europe - #8. Southeast Asia - #9. Japan West - #10. North Central US - #11. Central US - #12. Brazil South - #13. East US 2 - #14. Australia Southeast - #15. Australia East - #Enter the number of your desired region: - #default: "7" - #private: no + - name: "server_name" + prompt: "Name the vpn server:\n" + default: "algo" + private: no - #- name: "azure_server_name" - #prompt: "Name the vpn server:\n" - #default: "algo.local" - #private: no + - name: "dns_enabled" + prompt: "Do you want to use a local DNS resolver to block ads while surfing? (Y or N):\n" + default: "Y" + private: no - #- name: "dns_enabled" - #prompt: "Do you want to use a local DNS resolver to block ads while surfing? (Y or N):\n" - #default: "Y" - #private: no - - #- name: "auditd_enabled" - #prompt: "Do you want to use auditd ? (Y or N):\n" - #default: "Y" - #private: no + - name: "auditd_enabled" + prompt: "Do you want to use auditd ? (Y or N):\n" + default: "Y" + private: no roles: - google_cloud diff --git a/roles/google_cloud/tasks/main.yml b/roles/google_cloud/tasks/main.yml index ed3b6f3..34ec713 100644 --- a/roles/google_cloud/tasks/main.yml +++ b/roles/google_cloud/tasks/main.yml @@ -1,13 +1,29 @@ -- name: Launch instances +- set_fact: + credentials_file_lookup: "{{ lookup('file', '{{ credentials_file }}') }}" + ssh_public_key_lookup: "{{ lookup('file', '{{ ssh_public_key }}') }}" + +- name: "Creating a droplet..." gce: - instance_names: dev - zone: us-central1-b + instance_names: "{{ server_name }}" + zone: "{{ zones[zone] }}" machine_type: n1-standard-1 - image: debian-7-wheezy - service_account_email: e601809@gmail.com - credentials_file: '/home/jack/ownCloud/Clouds/Google/My First Project-72e386228f5e.json' - project_id: algo-833@storied-bearing-140310.iam.gserviceaccount.com + image: ubuntu-1604 + service_account_email: "{{ credentials_file_lookup.client_email }}" + credentials_file: "{{ credentials_file }}" + project_id: "{{ credentials_file_lookup.project_id }}" + metadata: '{"sshKeys":"root:{{ ssh_public_key_lookup }}"}' register: google_vm -- debug: msg="{{ google_vm }}" +- name: Add the droplet to an inventory group + add_host: + name: "{{ google_vm.instance_data[0].public_ip}}" + groups: vpn-host + ansible_ssh_user: ubuntu + ansible_python_interpreter: "/usr/bin/python2.7" + dns_enabled: "{{ dns_enabled }}" + auditd_enabled: " {{ auditd_enabled }}" + +- name: Wait for SSH to become available + local_action: "wait_for port=22 host={{ google_vm.instance_data[0].public_ip }} timeout=320" + diff --git a/run b/run index 6041d90..187e598 100755 --- a/run +++ b/run @@ -9,8 +9,8 @@ algo_provisioning () { 4. Google-cloud 0. Local installation (non-cloud or a server already deployed) - Enter the number of your desired provider - : " +Enter the number of your desired provider +: " read N From 42e6067e4dd2f91ce01dc0df220e9c101a05085f Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 16:51:24 +0300 Subject: [PATCH 5/7] Firewall | Google Cloud Engine #27 --- roles/google_cloud/tasks/main.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/roles/google_cloud/tasks/main.yml b/roles/google_cloud/tasks/main.yml index 34ec713..dbe5c6c 100644 --- a/roles/google_cloud/tasks/main.yml +++ b/roles/google_cloud/tasks/main.yml @@ -10,7 +10,7 @@ image: ubuntu-1604 service_account_email: "{{ credentials_file_lookup.client_email }}" credentials_file: "{{ credentials_file }}" - project_id: "{{ credentials_file_lookup.project_id }}" + project_id: "{{ credentials_file_lookup.project_id }}" metadata: '{"sshKeys":"root:{{ ssh_public_key_lookup }}"}' register: google_vm @@ -22,8 +22,22 @@ ansible_python_interpreter: "/usr/bin/python2.7" dns_enabled: "{{ dns_enabled }}" auditd_enabled: " {{ auditd_enabled }}" + +- name: Firewall configured + local_action: + module: gce_net + name: "{{ google_vm.instance_data[0].network }}" + fwname: "algo-ikev2" + allowed: "udp:500,4500;tcp:22" + state: "present" + src_range: 0.0.0.0/0 + service_account_email: "{{ credentials_file_lookup.client_email }}" + credentials_file: "{{ credentials_file }}" + project_id: "{{ credentials_file_lookup.project_id }}" - name: Wait for SSH to become available local_action: "wait_for port=22 host={{ google_vm.instance_data[0].public_ip }} timeout=320" + + From e729f0d303eaa1c9b6a786056c62a1fcb5322337 Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 20:03:23 +0300 Subject: [PATCH 6/7] Roles and Google cloud --- README.md | 1 + digitalocean.yml | 2 +- roles/azure/tasks/main.yml | 44 - roles/features/tasks/main.yml | 2 +- run | 6 +- templates/000-default.conf.j2 | 11 - templates/10-loopback-services.cfg.j2 | 9 - templates/10periodic.j2 | 4 - templates/20-ipv6.cfg.j2 | 6 - templates/50unattended-upgrades.j2 | 59 - templates/CIS.conf.j2 | 15 - templates/adblock.sh | 50 - templates/audit.rules.j2 | 101 -- templates/auditd.conf.j2 | 32 - templates/dnsmasq.conf.j2 | 669 -------- templates/easy-rsa.vars.j2 | 198 --- templates/ipsec.conf.j2 | 34 - templates/ipsec.secrets.j2 | 2 - templates/mobileconfig.j2 | 144 -- templates/pagespeed.conf.j2 | 369 ----- templates/ports.conf.j2 | 13 - templates/privoxy_config.j2 | 2107 ------------------------- templates/rsyslog.conf.j2 | 61 - templates/usr.sbin.dnsmasq.j2 | 68 - templates/usr.sbin.privoxy.j2 | 15 - users.yml | 2 +- 26 files changed, 6 insertions(+), 4018 deletions(-) delete mode 100644 templates/000-default.conf.j2 delete mode 100644 templates/10-loopback-services.cfg.j2 delete mode 100644 templates/10periodic.j2 delete mode 100644 templates/20-ipv6.cfg.j2 delete mode 100644 templates/50unattended-upgrades.j2 delete mode 100644 templates/CIS.conf.j2 delete mode 100644 templates/adblock.sh delete mode 100644 templates/audit.rules.j2 delete mode 100644 templates/auditd.conf.j2 delete mode 100644 templates/dnsmasq.conf.j2 delete mode 100644 templates/easy-rsa.vars.j2 delete mode 100644 templates/ipsec.conf.j2 delete mode 100644 templates/ipsec.secrets.j2 delete mode 100644 templates/mobileconfig.j2 delete mode 100644 templates/pagespeed.conf.j2 delete mode 100644 templates/ports.conf.j2 delete mode 100644 templates/privoxy_config.j2 delete mode 100644 templates/rsyslog.conf.j2 delete mode 100644 templates/usr.sbin.dnsmasq.j2 delete mode 100644 templates/usr.sbin.privoxy.j2 diff --git a/README.md b/README.md index c3cc5f0..6829131 100644 --- a/README.md +++ b/README.md @@ -33,6 +33,7 @@ Algo (short for "Al Gore", the **V**ice **P**resident of **N**etworks everywhere * [azure >= 0.7.1](https://github.com/Azure/azure-sdk-for-python) * [apache-libcloud](https://github.com/apache/libcloud) * [libcloud](https://curl.haxx.se/docs/caextract.html) (for Mac OS) +* [six](https://github.com/JioCloud/python-six) * SHell or BASH * libselinux-python (for RedHat based distros) diff --git a/digitalocean.yml b/digitalocean.yml index 51bf1f2..ecd6262 100644 --- a/digitalocean.yml +++ b/digitalocean.yml @@ -94,7 +94,7 @@ register: droplet_info - name: IPv6 configured - template: src=20-ipv6.cfg.j2 dest=/etc/network/interfaces.d/20-ipv6.cfg owner=root group=root mode=0644 + template: src=roles/digitalocean/templates/20-ipv6.cfg.j2 dest=/etc/network/interfaces.d/20-ipv6.cfg owner=root group=root mode=0644 with_items: "{{ droplet_info.json.droplet.networks.v6 }}" notify: - reload eth0 diff --git a/roles/azure/tasks/main.yml b/roles/azure/tasks/main.yml index b17811c..8b13789 100644 --- a/roles/azure/tasks/main.yml +++ b/roles/azure/tasks/main.yml @@ -1,45 +1 @@ -- local_action: - module: azure - name: my-virtual-machine - role_size: Small - image: b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu_DAILY_BUILD-precise-12_04_3-LTS-amd64-server-20131205-en-us-30GB - location: 'East US' - user: ubuntu - ssh_cert_path: "/home/jack/.ssh/upwork.pub" - storage_account: my-storage-account - wait: yes - subscription_id: "02e68d20-1a39-4faa-aa35-6bdd0238b54e" - management_cert_path: "/home/jack/ownCloud/Clouds/azure/manage.cer" - - -#- name: "Creating a virtual machine..." - #azure: - #subscription_id: "02e68d20-1a39-4faa-aa35-6bdd0238b54e" - #name: "algo-vpn" - #role_size: Small - #image: b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-16_04-LTS-amd64-server-20160721-en-us-30GB - #location: "West Europe" - #user: ubuntu - #ssh_cert_path: "/home/jack/.ssh/upwork.pub" - #storage_account: 'algo.vpn' - #management_cert_path: "/home/jack/ownCloud/Clouds/azure/manage.cer" - #wait: yes - #state: present - #register: azure_vm - -- debug: msg="{{ azure_vm }}" - -#- name: Add the droplet to an inventory group - #add_host: - #name: "{{ do.droplet.ip_address }}" - #groups: vpn-host - #ansible_ssh_user: root - #ansible_python_interpreter: "/usr/bin/python2.7" - #do_access_token: "{{ do_access_token }}" - #do_droplet_id: "{{ do.droplet.id }}" - #dns_enabled: "{{ dns_enabled }}" - #auditd_enabled: " {{ auditd_enabled }}" - -#- name: Wait for SSH to become available - #local_action: "wait_for port=22 host={{ do.droplet.ip_address }} timeout=320" diff --git a/roles/features/tasks/main.yml b/roles/features/tasks/main.yml index b305b80..8045981 100644 --- a/roles/features/tasks/main.yml +++ b/roles/features/tasks/main.yml @@ -93,7 +93,7 @@ - restart dnsmasq - name: Adblock script created - copy: src=templates/adblock.sh dest=/opt/adblock.sh owner=root group=root mode=755 + template: src=adblock.sh dest=/opt/adblock.sh owner=root group=root mode=755 when: dns_enabled is defined and dns_enabled == "Y" - name: Adblock script added to cron diff --git a/run b/run index 187e598..f4cf9ad 100755 --- a/run +++ b/run @@ -5,8 +5,7 @@ algo_provisioning () { What provider would you like to use? 1. DigitalOcean 2. Amazon EC2 - 3. Azure - 4. Google-cloud + 3. Google-cloud 0. Local installation (non-cloud or a server already deployed) Enter the number of your desired provider @@ -17,8 +16,7 @@ Enter the number of your desired provider case "$N" in 1) CLOUD="digitalocean" ;; 2) CLOUD="ec2" ;; - 3) CLOUD="azure" ;; - 4) CLOUD="google_cloud" ;; + 3) CLOUD="google_cloud" ;; 0) CLOUD="non-cloud" ;; *) exit 1 ;; esac diff --git a/templates/000-default.conf.j2 b/templates/000-default.conf.j2 deleted file mode 100644 index 7aa917b..0000000 --- a/templates/000-default.conf.j2 +++ /dev/null @@ -1,11 +0,0 @@ - - - Order deny,allow - Allow from all - - RewriteEngine On - RewriteRule ^(.*)$ http://%{HTTP_HOST}$1 [NC,P] - ProxyPass / http://$1 - ProxyPassReverse / http://$1 - ProxyPreserveHost On - diff --git a/templates/10-loopback-services.cfg.j2 b/templates/10-loopback-services.cfg.j2 deleted file mode 100644 index c5c47e4..0000000 --- a/templates/10-loopback-services.cfg.j2 +++ /dev/null @@ -1,9 +0,0 @@ -auto lo:100 -iface lo:100 inet static - address 172.16.0.1 - netmask 255.255.255.255 - -iface lo:100 inet6 static - address FCAA::1 - netmask 64 - autoconf 0 diff --git a/templates/10periodic.j2 b/templates/10periodic.j2 deleted file mode 100644 index 7587020..0000000 --- a/templates/10periodic.j2 +++ /dev/null @@ -1,4 +0,0 @@ -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "7"; -APT::Periodic::Unattended-Upgrade "1"; \ No newline at end of file diff --git a/templates/20-ipv6.cfg.j2 b/templates/20-ipv6.cfg.j2 deleted file mode 100644 index 7db27bb..0000000 --- a/templates/20-ipv6.cfg.j2 +++ /dev/null @@ -1,6 +0,0 @@ -iface eth0 inet6 static - address {{ item.ip_address }} - netmask {{ item.netmask }} - gateway {{ item.gateway }} - autoconf 0 - dns-nameservers 2001:4860:4860::8844 2001:4860:4860::8888 diff --git a/templates/50unattended-upgrades.j2 b/templates/50unattended-upgrades.j2 deleted file mode 100644 index 5f8fb15..0000000 --- a/templates/50unattended-upgrades.j2 +++ /dev/null @@ -1,59 +0,0 @@ -// Automatically upgrade packages from these (origin:archive) pairs -Unattended-Upgrade::Allowed-Origins { - "${distro_id}:${distro_codename}-security"; - "${distro_id}:${distro_codename}-updates"; -// "${distro_id}:${distro_codename}-proposed"; -// "${distro_id}:${distro_codename}-backports"; -}; - -// List of packages to not update (regexp are supported) -Unattended-Upgrade::Package-Blacklist { -// "vim"; -// "libc6"; -// "libc6-dev"; -// "libc6-i686"; -}; - -// This option allows you to control if on a unclean dpkg exit -// unattended-upgrades will automatically run -// dpkg --force-confold --configure -a -// The default is true, to ensure updates keep getting installed -//Unattended-Upgrade::AutoFixInterruptedDpkg "false"; - -// Split the upgrade into the smallest possible chunks so that -// they can be interrupted with SIGUSR1. This makes the upgrade -// a bit slower but it has the benefit that shutdown while a upgrade -// is running is possible (with a small delay) -//Unattended-Upgrade::MinimalSteps "true"; - -// Install all unattended-upgrades when the machine is shuting down -// instead of doing it in the background while the machine is running -// This will (obviously) make shutdown slower -//Unattended-Upgrade::InstallOnShutdown "true"; - -// Send email to this address for problems or packages upgrades -// If empty or unset then no email is sent, make sure that you -// have a working mail setup on your system. A package that provides -// 'mailx' must be installed. E.g. "user@example.com" -//Unattended-Upgrade::Mail "root"; - -// Set this value to "true" to get emails only on errors. Default -// is to always send a mail if Unattended-Upgrade::Mail is set -//Unattended-Upgrade::MailOnlyOnError "true"; - -// Do automatic removal of new unused dependencies after the upgrade -// (equivalent to apt-get autoremove) -//Unattended-Upgrade::Remove-Unused-Dependencies "false"; - -// Automatically reboot *WITHOUT CONFIRMATION* -// if the file /var/run/reboot-required is found after the upgrade -//Unattended-Upgrade::Automatic-Reboot "false"; - -// If automatic reboot is enabled and needed, reboot at the specific -// time instead of immediately -// Default: "now" -//Unattended-Upgrade::Automatic-Reboot-Time "02:00"; - -// Use apt bandwidth limit feature, this example limits the download -// speed to 70kb/sec -//Acquire::http::Dl-Limit "70"; diff --git a/templates/CIS.conf.j2 b/templates/CIS.conf.j2 deleted file mode 100644 index 96b3a59..0000000 --- a/templates/CIS.conf.j2 +++ /dev/null @@ -1,15 +0,0 @@ -*.emerg :omusrmsg:* -mail.* -/var/log/mail -mail.info -/var/log/mail.info -mail.warning -/var/log/mail.warn -mail.err /var/log/mail.err -news.crit -/var/log/news/news.crit -news.err -/var/log/news/news.err -news.notice -/var/log/news/news.notice -*.=warning;*.=err -/var/log/warn -*.crit /var/log/warn -*.*;mail.none;news.none -/var/log/messages -local0,local1.* -/var/log/localmessages -local2,local3.* -/var/log/localmessages -local4,local5.* -/var/log/localmessages -local6,local7.* -/var/log/localmessages \ No newline at end of file diff --git a/templates/adblock.sh b/templates/adblock.sh deleted file mode 100644 index a6a8858..0000000 --- a/templates/adblock.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/sh -#Block ads, malware, etc. - -# Redirect endpoint -ENDPOINT_IP4="0.0.0.0" -ENDPOINT_IP6="::" -IPV6="Y" - -#Delete the old block.hosts to make room for the updates -rm -f /etc/block.hosts - -echo 'Downloading hosts lists...' -#Download and process the files needed to make the lists (enable/add more, if you want) -wget -qO- http://www.mvps.org/winhelp2002/hosts.txt| awk -v r="$ENDPOINT_IP4" '{sub(/^0.0.0.0/, r)} $0 ~ "^"r' > /tmp/block.build.list -wget -qO- "http://adaway.org/hosts.txt"|awk -v r="$ENDPOINT_IP4" '{sub(/^127.0.0.1/, r)} $0 ~ "^"r' >> /tmp/block.build.list -wget -qO- http://www.malwaredomainlist.com/hostslist/hosts.txt|awk -v r="$ENDPOINT_IP4" '{sub(/^127.0.0.1/, r)} $0 ~ "^"r' >> /tmp/block.build.list -wget -qO- "http://hosts-file.net/.\ad_servers.txt"|awk -v r="$ENDPOINT_IP4" '{sub(/^127.0.0.1/, r)} $0 ~ "^"r' >> /tmp/block.build.list - -#Add black list, if non-empty -if [ -s "/etc/black.list" ] -then - echo 'Adding blacklist...' - awk -v r="$ENDPOINT_IP4" '/^[^#]/ { print r,$1 }' /etc/black.list >> /tmp/block.build.list -fi - -#Sort the download/black lists -awk '{sub(/\r$/,"");print $1,$2}' /tmp/block.build.list|sort -u > /tmp/block.build.before - -#Filter (if applicable) -if [ -s "/etc/white.list" ] -then - #Filter the blacklist, supressing whitelist matches - # This is relatively slow =-( - echo 'Filtering white list...' - egrep -v "^[[:space:]]*$" /etc/white.list | awk '/^[^#]/ {sub(/\r$/,"");print $1}' | grep -vf - /tmp/block.build.before > /etc/block.hosts -else - cat /tmp/block.build.before > /etc/block.hosts -fi - -if [ "$IPV6" = "Y" ] -then - safe_pattern=$(printf '%s\n' "$ENDPOINT_IP4" | sed 's/[[\.*^$(){}?+|/]/\\&/g') - safe_addition=$(printf '%s\n' "$ENDPOINT_IP6" | sed 's/[\&/]/\\&/g') - echo 'Adding ipv6 support...' - sed -i -re "s/^(${safe_pattern}) (.*)$/\1 \2\n${safe_addition} \2/g" /etc/block.hosts -fi - -service dnsmasq restart - -exit 0 diff --git a/templates/audit.rules.j2 b/templates/audit.rules.j2 deleted file mode 100644 index 3464e2a..0000000 --- a/templates/audit.rules.j2 +++ /dev/null @@ -1,101 +0,0 @@ -# This file contains the auditctl rules that are loaded -# whenever the audit daemon is started via the initscripts. -# The rules are simply the parameters that would be passed -# to auditctl. -# -# First rule - delete all --D - -# Increase the buffers to survive stress events. -# Make this bigger for busy systems --b 320 - -# Feel free to add below this line. See auditctl man page - -# Record Events That Modify Date and Time Information -{% if ansible_architecture == "x86_64" %} --a always,exit -F arch=b64 -S clock_settime -k time-change --a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change -{% endif %} --a always,exit -F arch=b32 -S clock_settime -k time-change --a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change --w /etc/localtime -p wa -k time-change - -# Record Events That Modify User/Group Information --w /etc/group -p wa -k identity --w /etc/passwd -p wa -k identity --w /etc/gshadow -p wa -k identity --w /etc/shadow -p wa -k identity --w /etc/security/opasswd -p wa -k identity - -# Record Events That Modify the System's Network Environment -{% if ansible_architecture == "x86_64" %} --a exit,always -F arch=b64 -S sethostname -S setdomainname -k system-locale -{% endif %} --a exit,always -F arch=b32 -S sethostname -S setdomainname -k system-locale --w /etc/issue -p wa -k system-locale --w /etc/issue.net -p wa -k system-locale --w /etc/hosts -p wa -k system-locale --w /etc/network/interfaces -p wa -k system-locale - -# Collect Login and Logout Events --w /var/log/faillog -p wa -k logins --w /var/log/lastlog -p wa -k logins --w /var/log/tallylog -p wa -k logins - -# Collect Session Initiation Information --w /var/run/utmp -p wa -k session --w /var/log/wtmp -p wa -k session --w /var/log/btmp -p wa -k session - -# Collect Discretionary Access Control Permission Modification Events -{% if ansible_architecture == "x86_64" %} --a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod --a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod --a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod -{% endif %} --a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod --a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod --a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod - -# Collect Unsuccessful Unauthorized Access Attempts to Files -{% if ansible_architecture == "x86_64" %} --a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access --a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access -{% endif %} --a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access --a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access - -# Collect Use of Privileged Commands -{% if privileged_programs is defined and privileged_programs.stdout_lines|length > 0 %} -{{ privileged_programs.stdout }} -{% endif %} - -# Collect Successful File System Mounts -{% if ansible_architecture == "x86_64" %} --a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295 -k mounts -{% endif %} --a always,exit -F arch=b32 -S mount -F auid>=500 -F auid!=4294967295 -k mounts - -# Collect File Deletion Events by User -{% if ansible_architecture == "x86_64" %} --a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete -{% endif %} --a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete - -# Collect Changes to System Administration Scope --w /etc/sudoers -p wa -k scope - -# Collect System Administrator Actions (sudolog) --w /var/log/sudo.log -p wa -k actions - -# Collect Kernel Module Loading and Unloading -{% if ansible_architecture == "x86_64" %} --a always,exit -F arch=b64 -S init_module -S delete_module -k modules -{% endif %} --a always,exit -F arch=b32 -S init_module -S delete_module -k modules --w /sbin/insmod -p x -k modules --w /sbin/rmmod -p x -k modules --w /sbin/modprobe -p x -k modules - --e 2 diff --git a/templates/auditd.conf.j2 b/templates/auditd.conf.j2 deleted file mode 100644 index 24aac73..0000000 --- a/templates/auditd.conf.j2 +++ /dev/null @@ -1,32 +0,0 @@ -# -# This file controls the configuration of the audit daemon -# - -log_file = /var/log/audit/audit.log -log_format = RAW -log_group = root -priority_boost = 4 -flush = INCREMENTAL -freq = 20 -num_logs = 5 -disp_qos = lossy -dispatcher = /sbin/audispd -name_format = NONE -##name = mydomain -max_log_file = 10 -max_log_file_action = keep_logs -space_left = 75 -space_left_action = email -action_mail_acct = {{ auditd_action_mail_acct }} -admin_space_left = 50 -admin_space_left_action = email -disk_full_action = SUSPEND -disk_error_action = SUSPEND -##tcp_listen_port = -tcp_listen_queue = 5 -tcp_max_per_addr = 1 -##tcp_client_ports = 1024-65535 -tcp_client_max_idle = 0 -enable_krb5 = no -krb5_principal = auditd -##krb5_key_file = /etc/audit/audit.key \ No newline at end of file diff --git a/templates/dnsmasq.conf.j2 b/templates/dnsmasq.conf.j2 deleted file mode 100644 index d28cfac..0000000 --- a/templates/dnsmasq.conf.j2 +++ /dev/null @@ -1,669 +0,0 @@ -# Configuration file for dnsmasq. -# -# Format is one option per line, legal options are the same -# as the long options legal on the command line. See -# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details. - -# Listen on this specific port instead of the standard DNS port -# (53). Setting this to zero completely disables DNS function, -# leaving only DHCP and/or TFTP. -#port=5353 - -# The following two options make you a better netizen, since they -# tell dnsmasq to filter out queries which the public DNS cannot -# answer, and which load the servers (especially the root servers) -# unnecessarily. If you have a dial-on-demand link they also stop -# these requests from bringing up the link unnecessarily. - -# Never forward plain names (without a dot or domain part) -#domain-needed -# Never forward addresses in the non-routed address spaces. -#bogus-priv - -# Uncomment these to enable DNSSEC validation and caching: -# (Requires dnsmasq to be built with DNSSEC option.) -#conf-file=%%PREFIX%%/share/dnsmasq/trust-anchors.conf -#dnssec - -# Replies which are not DNSSEC signed may be legitimate, because the domain -# is unsigned, or may be forgeries. Setting this option tells dnsmasq to -# check that an unsigned reply is OK, by finding a secure proof that a DS -# record somewhere between the root and the domain does not exist. -# The cost of setting this is that even queries in unsigned domains will need -# one or more extra DNS queries to verify. -#dnssec-check-unsigned - -# Uncomment this to filter useless windows-originated DNS requests -# which can trigger dial-on-demand links needlessly. -# Note that (amongst other things) this blocks all SRV requests, -# so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk. -# This option only affects forwarding, SRV records originating for -# dnsmasq (via srv-host= lines) are not suppressed by it. -#filterwin2k - -# Change this line if you want dns to get its upstream servers from -# somewhere other that /etc/resolv.conf -#resolv-file= - -# By default, dnsmasq will send queries to any of the upstream -# servers it knows about and tries to favour servers to are known -# to be up. Uncommenting this forces dnsmasq to try each query -# with each server strictly in the order they appear in -# /etc/resolv.conf -#strict-order - -# If you don't want dnsmasq to read /etc/resolv.conf or any other -# file, getting its servers from this file instead (see below), then -# uncomment this. -#no-resolv - -# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv -# files for changes and re-read them then uncomment this. -#no-poll - -# Add other name servers here, with domain specs if they are for -# non-public domains. -#server=/localnet/192.168.0.1 - -# Example of routing PTR queries to nameservers: this will send all -# address->name queries for 192.168.3/24 to nameserver 10.1.2.3 -#server=/3.168.192.in-addr.arpa/10.1.2.3 - -# Add local-only domains here, queries in these domains are answered -# from /etc/hosts or DHCP only. -#local=/localnet/ - -# Add domains which you want to force to an IP address here. -# The example below send any host in double-click.net to a local -# web-server. -#address=/double-click.net/127.0.0.1 - -# --address (and --server) work with IPv6 addresses too. -#address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83 - -# Add the IPs of all queries to yahoo.com, google.com, and their -# subdomains to the vpn and search ipsets: -#ipset=/yahoo.com/google.com/vpn,search - -# You can control how dnsmasq talks to a server: this forces -# queries to 10.1.2.3 to be routed via eth1 -# server=10.1.2.3@eth1 -server=8.8.8.8 -server=8.8.4.4 - -# and this sets the source (ie local) address used to talk to -# 10.1.2.3 to 192.168.1.1 port 55 (there must be a interface with that -# IP on the machine, obviously). -# server=10.1.2.3@192.168.1.1#55 - -# If you want dnsmasq to change uid and gid to something other -# than the default, edit the following lines. -user=nobody -group=nogroup - -# If you want dnsmasq to listen for DHCP and DNS requests only on -# specified interfaces (and the loopback) give the name of the -# interface (eg eth0) here. -# Repeat the line for more than one interface. -#interface=lo -# Or you can specify which interface _not_ to listen on -#except-interface= -# Or which to listen on by address (remember to include 127.0.0.1 if -# you use this.) -listen-address=172.16.0.1,127.0.0.1,FCAA::1 -# If you want dnsmasq to provide only DNS service on an interface, -# configure it as shown above, and then use the following line to -# disable DHCP and TFTP on it. -#no-dhcp-interface= - -# On systems which support it, dnsmasq binds the wildcard address, -# even when it is listening on only some interfaces. It then discards -# requests that it shouldn't reply to. This has the advantage of -# working even when interfaces come and go and change address. If you -# want dnsmasq to really bind only the interfaces it is listening on, -# uncomment this option. About the only time you may need this is when -# running another nameserver on the same machine. -bind-interfaces - -# If you don't want dnsmasq to read /etc/hosts, uncomment the -# following line. -#no-hosts -# or if you want it to read another file, as well as /etc/hosts, use -# this. -addn-hosts=/etc/block.hosts - -# Set this (and domain: see below) if you want to have a domain -# automatically added to simple names in a hosts-file. -#expand-hosts - -# Set the domain for dnsmasq. this is optional, but if it is set, it -# does the following things. -# 1) Allows DHCP hosts to have fully qualified domain names, as long -# as the domain part matches this setting. -# 2) Sets the "domain" DHCP option thereby potentially setting the -# domain of all systems configured by DHCP -# 3) Provides the domain part for "expand-hosts" -#domain=thekelleys.org.uk - -# Set a different domain for a particular subnet -#domain=wireless.thekelleys.org.uk,192.168.2.0/24 - -# Same idea, but range rather then subnet -#domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200 - -# Uncomment this to enable the integrated DHCP server, you need -# to supply the range of addresses available for lease and optionally -# a lease time. If you have more than one network, you will need to -# repeat this for each network on which you want to supply DHCP -# service. -#dhcp-range=192.168.0.50,192.168.0.150,12h - -# This is an example of a DHCP range where the netmask is given. This -# is needed for networks we reach the dnsmasq DHCP server via a relay -# agent. If you don't know what a DHCP relay agent is, you probably -# don't need to worry about this. -#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h - -# This is an example of a DHCP range which sets a tag, so that -# some DHCP options may be set only for this network. -#dhcp-range=set:red,192.168.0.50,192.168.0.150 - -# Use this DHCP range only when the tag "green" is set. -#dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h - -# Specify a subnet which can't be used for dynamic address allocation, -# is available for hosts with matching --dhcp-host lines. Note that -# dhcp-host declarations will be ignored unless there is a dhcp-range -# of some type for the subnet in question. -# In this case the netmask is implied (it comes from the network -# configuration on the machine running dnsmasq) it is possible to give -# an explicit netmask instead. -#dhcp-range=192.168.0.0,static - -# Enable DHCPv6. Note that the prefix-length does not need to be specified -# and defaults to 64 if missing/ -#dhcp-range=1234::2, 1234::500, 64, 12h - -# Do Router Advertisements, BUT NOT DHCP for this subnet. -#dhcp-range=1234::, ra-only - -# Do Router Advertisements, BUT NOT DHCP for this subnet, also try and -# add names to the DNS for the IPv6 address of SLAAC-configured dual-stack -# hosts. Use the DHCPv4 lease to derive the name, network segment and -# MAC address and assume that the host will also have an -# IPv6 address calculated using the SLAAC alogrithm. -#dhcp-range=1234::, ra-names - -# Do Router Advertisements, BUT NOT DHCP for this subnet. -# Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.) -#dhcp-range=1234::, ra-only, 48h - -# Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA -# so that clients can use SLAAC addresses as well as DHCP ones. -#dhcp-range=1234::2, 1234::500, slaac - -# Do Router Advertisements and stateless DHCP for this subnet. Clients will -# not get addresses from DHCP, but they will get other configuration information. -# They will use SLAAC for addresses. -#dhcp-range=1234::, ra-stateless - -# Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses -# from DHCPv4 leases. -#dhcp-range=1234::, ra-stateless, ra-names - -# Do router advertisements for all subnets where we're doing DHCPv6 -# Unless overriden by ra-stateless, ra-names, et al, the router -# advertisements will have the M and O bits set, so that the clients -# get addresses and configuration from DHCPv6, and the A bit reset, so the -# clients don't use SLAAC addresses. -#enable-ra - -# Supply parameters for specified hosts using DHCP. There are lots -# of valid alternatives, so we will give examples of each. Note that -# IP addresses DO NOT have to be in the range given above, they just -# need to be on the same network. The order of the parameters in these -# do not matter, it's permissible to give name, address and MAC in any -# order. - -# Always allocate the host with Ethernet address 11:22:33:44:55:66 -# The IP address 192.168.0.60 -#dhcp-host=11:22:33:44:55:66,192.168.0.60 - -# Always set the name of the host with hardware address -# 11:22:33:44:55:66 to be "fred" -#dhcp-host=11:22:33:44:55:66,fred - -# Always give the host with Ethernet address 11:22:33:44:55:66 -# the name fred and IP address 192.168.0.60 and lease time 45 minutes -#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m - -# Give a host with Ethernet address 11:22:33:44:55:66 or -# 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume -# that these two Ethernet interfaces will never be in use at the same -# time, and give the IP address to the second, even if it is already -# in use by the first. Useful for laptops with wired and wireless -# addresses. -#dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60 - -# Give the machine which says its name is "bert" IP address -# 192.168.0.70 and an infinite lease -#dhcp-host=bert,192.168.0.70,infinite - -# Always give the host with client identifier 01:02:02:04 -# the IP address 192.168.0.60 -#dhcp-host=id:01:02:02:04,192.168.0.60 - -# Always give the Infiniband interface with hardware address -# 80:00:00:48:fe:80:00:00:00:00:00:00:f4:52:14:03:00:28:05:81 the -# ip address 192.168.0.61. The client id is derived from the prefix -# ff:00:00:00:00:00:02:00:00:02:c9:00 and the last 8 pairs of -# hex digits of the hardware address. -#dhcp-host=id:ff:00:00:00:00:00:02:00:00:02:c9:00:f4:52:14:03:00:28:05:81,192.168.0.61 - -# Always give the host with client identifier "marjorie" -# the IP address 192.168.0.60 -#dhcp-host=id:marjorie,192.168.0.60 - -# Enable the address given for "judge" in /etc/hosts -# to be given to a machine presenting the name "judge" when -# it asks for a DHCP lease. -#dhcp-host=judge - -# Never offer DHCP service to a machine whose Ethernet -# address is 11:22:33:44:55:66 -#dhcp-host=11:22:33:44:55:66,ignore - -# Ignore any client-id presented by the machine with Ethernet -# address 11:22:33:44:55:66. This is useful to prevent a machine -# being treated differently when running under different OS's or -# between PXE boot and OS boot. -#dhcp-host=11:22:33:44:55:66,id:* - -# Send extra options which are tagged as "red" to -# the machine with Ethernet address 11:22:33:44:55:66 -#dhcp-host=11:22:33:44:55:66,set:red - -# Send extra options which are tagged as "red" to -# any machine with Ethernet address starting 11:22:33: -#dhcp-host=11:22:33:*:*:*,set:red - -# Give a fixed IPv6 address and name to client with -# DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2 -# Note the MAC addresses CANNOT be used to identify DHCPv6 clients. -# Note also the they [] around the IPv6 address are obilgatory. -#dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5] - -# Ignore any clients which are not specified in dhcp-host lines -# or /etc/ethers. Equivalent to ISC "deny unknown-clients". -# This relies on the special "known" tag which is set when -# a host is matched. -#dhcp-ignore=tag:!known - -# Send extra options which are tagged as "red" to any machine whose -# DHCP vendorclass string includes the substring "Linux" -#dhcp-vendorclass=set:red,Linux - -# Send extra options which are tagged as "red" to any machine one -# of whose DHCP userclass strings includes the substring "accounts" -#dhcp-userclass=set:red,accounts - -# Send extra options which are tagged as "red" to any machine whose -# MAC address matches the pattern. -#dhcp-mac=set:red,00:60:8C:*:*:* - -# If this line is uncommented, dnsmasq will read /etc/ethers and act -# on the ethernet-address/IP pairs found there just as if they had -# been given as --dhcp-host options. Useful if you keep -# MAC-address/host mappings there for other purposes. -#read-ethers - -# Send options to hosts which ask for a DHCP lease. -# See RFC 2132 for details of available options. -# Common options can be given to dnsmasq by name: -# run "dnsmasq --help dhcp" to get a list. -# Note that all the common settings, such as netmask and -# broadcast address, DNS server and default route, are given -# sane defaults by dnsmasq. You very likely will not need -# any dhcp-options. If you use Windows clients and Samba, there -# are some options which are recommended, they are detailed at the -# end of this section. - -# Override the default route supplied by dnsmasq, which assumes the -# router is the same machine as the one running dnsmasq. -#dhcp-option=3,1.2.3.4 - -# Do the same thing, but using the option name -#dhcp-option=option:router,1.2.3.4 - -# Override the default route supplied by dnsmasq and send no default -# route at all. Note that this only works for the options sent by -# default (1, 3, 6, 12, 28) the same line will send a zero-length option -# for all other option numbers. -#dhcp-option=3 - -# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5 -#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5 - -# Send DHCPv6 option. Note [] around IPv6 addresses. -#dhcp-option=option6:dns-server,[1234::77],[1234::88] - -# Send DHCPv6 option for namservers as the machine running -# dnsmasq and another. -#dhcp-option=option6:dns-server,[::],[1234::88] - -# Ask client to poll for option changes every six hours. (RFC4242) -#dhcp-option=option6:information-refresh-time,6h - -# Set option 58 client renewal time (T1). Defaults to half of the -# lease time if not specified. (RFC2132) -#dhcp-option=option:T1:1m - -# Set option 59 rebinding time (T2). Defaults to 7/8 of the -# lease time if not specified. (RFC2132) -#dhcp-option=option:T2:2m - -# Set the NTP time server address to be the same machine as -# is running dnsmasq -#dhcp-option=42,0.0.0.0 - -# Set the NIS domain name to "welly" -#dhcp-option=40,welly - -# Set the default time-to-live to 50 -#dhcp-option=23,50 - -# Set the "all subnets are local" flag -#dhcp-option=27,1 - -# Send the etherboot magic flag and then etherboot options (a string). -#dhcp-option=128,e4:45:74:68:00:00 -#dhcp-option=129,NIC=eepro100 - -# Specify an option which will only be sent to the "red" network -# (see dhcp-range for the declaration of the "red" network) -# Note that the tag: part must precede the option: part. -#dhcp-option = tag:red, option:ntp-server, 192.168.1.1 - -# The following DHCP options set up dnsmasq in the same way as is specified -# for the ISC dhcpcd in -# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt -# adapted for a typical dnsmasq installation where the host running -# dnsmasq is also the host running samba. -# you may want to uncomment some or all of them if you use -# Windows clients and Samba. -#dhcp-option=19,0 # option ip-forwarding off -#dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s) -#dhcp-option=45,0.0.0.0 # netbios datagram distribution server -#dhcp-option=46,8 # netbios node type - -# Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave. -#dhcp-option=252,"\n" - -# Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client -# probably doesn't support this...... -#dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com - -# Send RFC-3442 classless static routes (note the netmask encoding) -#dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8 - -# Send vendor-class specific options encapsulated in DHCP option 43. -# The meaning of the options is defined by the vendor-class so -# options are sent only when the client supplied vendor class -# matches the class given here. (A substring match is OK, so "MSFT" -# matches "MSFT" and "MSFT 5.0"). This example sets the -# mtftp address to 0.0.0.0 for PXEClients. -#dhcp-option=vendor:PXEClient,1,0.0.0.0 - -# Send microsoft-specific option to tell windows to release the DHCP lease -# when it shuts down. Note the "i" flag, to tell dnsmasq to send the -# value as a four-byte integer - that's what microsoft wants. See -# http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true -#dhcp-option=vendor:MSFT,2,1i - -# Send the Encapsulated-vendor-class ID needed by some configurations of -# Etherboot to allow is to recognise the DHCP server. -#dhcp-option=vendor:Etherboot,60,"Etherboot" - -# Send options to PXELinux. Note that we need to send the options even -# though they don't appear in the parameter request list, so we need -# to use dhcp-option-force here. -# See http://syslinux.zytor.com/pxe.php#special for details. -# Magic number - needed before anything else is recognised -#dhcp-option-force=208,f1:00:74:7e -# Configuration file name -#dhcp-option-force=209,configs/common -# Path prefix -#dhcp-option-force=210,/tftpboot/pxelinux/files/ -# Reboot time. (Note 'i' to send 32-bit value) -#dhcp-option-force=211,30i - -# Set the boot filename for netboot/PXE. You will only need -# this is you want to boot machines over the network and you will need -# a TFTP server; either dnsmasq's built in TFTP server or an -# external one. (See below for how to enable the TFTP server.) -#dhcp-boot=pxelinux.0 - -# The same as above, but use custom tftp-server instead machine running dnsmasq -#dhcp-boot=pxelinux,server.name,192.168.1.100 - -# Boot for Etherboot gPXE. The idea is to send two different -# filenames, the first loads gPXE, and the second tells gPXE what to -# load. The dhcp-match sets the gpxe tag for requests from gPXE. -#dhcp-match=set:gpxe,175 # gPXE sends a 175 option. -#dhcp-boot=tag:!gpxe,undionly.kpxe -#dhcp-boot=mybootimage - -# Encapsulated options for Etherboot gPXE. All the options are -# encapsulated within option 175 -#dhcp-option=encap:175, 1, 5b # priority code -#dhcp-option=encap:175, 176, 1b # no-proxydhcp -#dhcp-option=encap:175, 177, string # bus-id -#dhcp-option=encap:175, 189, 1b # BIOS drive code -#dhcp-option=encap:175, 190, user # iSCSI username -#dhcp-option=encap:175, 191, pass # iSCSI password - -# Test for the architecture of a netboot client. PXE clients are -# supposed to send their architecture as option 93. (See RFC 4578) -#dhcp-match=peecees, option:client-arch, 0 #x86-32 -#dhcp-match=itanics, option:client-arch, 2 #IA64 -#dhcp-match=hammers, option:client-arch, 6 #x86-64 -#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64 - -# Do real PXE, rather than just booting a single file, this is an -# alternative to dhcp-boot. -#pxe-prompt="What system shall I netboot?" -# or with timeout before first available action is taken: -#pxe-prompt="Press F8 for menu.", 60 - -# Available boot services. for PXE. -#pxe-service=x86PC, "Boot from local disk" - -# Loads /pxelinux.0 from dnsmasq TFTP server. -#pxe-service=x86PC, "Install Linux", pxelinux - -# Loads /pxelinux.0 from TFTP server at 1.2.3.4. -# Beware this fails on old PXE ROMS. -#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4 - -# Use bootserver on network, found my multicast or broadcast. -#pxe-service=x86PC, "Install windows from RIS server", 1 - -# Use bootserver at a known IP address. -#pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4 - -# If you have multicast-FTP available, -# information for that can be passed in a similar way using options 1 -# to 5. See page 19 of -# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf - - -# Enable dnsmasq's built-in TFTP server -#enable-tftp - -# Set the root directory for files available via FTP. -#tftp-root=/var/ftpd - -# Do not abort if the tftp-root is unavailable -#tftp-no-fail - -# Make the TFTP server more secure: with this set, only files owned by -# the user dnsmasq is running as will be send over the net. -#tftp-secure - -# This option stops dnsmasq from negotiating a larger blocksize for TFTP -# transfers. It will slow things down, but may rescue some broken TFTP -# clients. -#tftp-no-blocksize - -# Set the boot file name only when the "red" tag is set. -#dhcp-boot=tag:red,pxelinux.red-net - -# An example of dhcp-boot with an external TFTP server: the name and IP -# address of the server are given after the filename. -# Can fail with old PXE ROMS. Overridden by --pxe-service. -#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3 - -# If there are multiple external tftp servers having a same name -# (using /etc/hosts) then that name can be specified as the -# tftp_servername (the third option to dhcp-boot) and in that -# case dnsmasq resolves this name and returns the resultant IP -# addresses in round robin fasion. This facility can be used to -# load balance the tftp load among a set of servers. -#dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name - -# Set the limit on DHCP leases, the default is 150 -#dhcp-lease-max=150 - -# The DHCP server needs somewhere on disk to keep its lease database. -# This defaults to a sane location, but if you want to change it, use -# the line below. -#dhcp-leasefile=/var/lib/misc/dnsmasq.leases - -# Set the DHCP server to authoritative mode. In this mode it will barge in -# and take over the lease for any client which broadcasts on the network, -# whether it has a record of the lease or not. This avoids long timeouts -# when a machine wakes up on a new network. DO NOT enable this if there's -# the slightest chance that you might end up accidentally configuring a DHCP -# server for your campus/company accidentally. The ISC server uses -# the same option, and this URL provides more information: -# http://www.isc.org/files/auth.html -#dhcp-authoritative - -# Run an executable when a DHCP lease is created or destroyed. -# The arguments sent to the script are "add" or "del", -# then the MAC address, the IP address and finally the hostname -# if there is one. -#dhcp-script=/bin/echo - -# Set the cachesize here. -#cache-size=150 - -# If you want to disable negative caching, uncomment this. -#no-negcache - -# Normally responses which come from /etc/hosts and the DHCP lease -# file have Time-To-Live set as zero, which conventionally means -# do not cache further. If you are happy to trade lower load on the -# server for potentially stale date, you can set a time-to-live (in -# seconds) here. -#local-ttl= - -# If you want dnsmasq to detect attempts by Verisign to send queries -# to unregistered .com and .net hosts to its sitefinder service and -# have dnsmasq instead return the correct NXDOMAIN response, uncomment -# this line. You can add similar lines to do the same for other -# registries which have implemented wildcard A records. -#bogus-nxdomain=64.94.110.11 - -# If you want to fix up DNS results from upstream servers, use the -# alias option. This only works for IPv4. -# This alias makes a result of 1.2.3.4 appear as 5.6.7.8 -#alias=1.2.3.4,5.6.7.8 -# and this maps 1.2.3.x to 5.6.7.x -#alias=1.2.3.0,5.6.7.0,255.255.255.0 -# and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40 -#alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0 - -# Change these lines if you want dnsmasq to serve MX records. - -# Return an MX record named "maildomain.com" with target -# servermachine.com and preference 50 -#mx-host=maildomain.com,servermachine.com,50 - -# Set the default target for MX records created using the localmx option. -#mx-target=servermachine.com - -# Return an MX record pointing to the mx-target for all local -# machines. -#localmx - -# Return an MX record pointing to itself for all local machines. -#selfmx - -# Change the following lines if you want dnsmasq to serve SRV -# records. These are useful if you want to serve ldap requests for -# Active Directory and other windows-originated DNS requests. -# See RFC 2782. -# You may add multiple srv-host lines. -# The fields are ,,,, -# If the domain part if missing from the name (so that is just has the -# service and protocol sections) then the domain given by the domain= -# config option is used. (Note that expand-hosts does not need to be -# set for this to work.) - -# A SRV record sending LDAP for the example.com domain to -# ldapserver.example.com port 389 -#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389 - -# A SRV record sending LDAP for the example.com domain to -# ldapserver.example.com port 389 (using domain=) -#domain=example.com -#srv-host=_ldap._tcp,ldapserver.example.com,389 - -# Two SRV records for LDAP, each with different priorities -#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1 -#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2 - -# A SRV record indicating that there is no LDAP server for the domain -# example.com -#srv-host=_ldap._tcp.example.com - -# The following line shows how to make dnsmasq serve an arbitrary PTR -# record. This is useful for DNS-SD. (Note that the -# domain-name expansion done for SRV records _does_not -# occur for PTR records.) -#ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services" - -# Change the following lines to enable dnsmasq to serve TXT records. -# These are used for things like SPF and zeroconf. (Note that the -# domain-name expansion done for SRV records _does_not -# occur for TXT records.) - -#Example SPF. -#txt-record=example.com,"v=spf1 a -all" - -#Example zeroconf -#txt-record=_http._tcp.example.com,name=value,paper=A4 - -# Provide an alias for a "local" DNS name. Note that this _only_ works -# for targets which are names from DHCP or /etc/hosts. Give host -# "bert" another name, bertrand -#cname=bertand,bert - -# For debugging purposes, log each DNS query as it passes through -# dnsmasq. -#log-queries - -# Log lots of extra information about DHCP transactions. -#log-dhcp - -# Include another lot of configuration options. -#conf-file=/etc/dnsmasq.more.conf -#conf-dir=/etc/dnsmasq.d - -# Include all the files in a directory except those ending in .bak -#conf-dir=/etc/dnsmasq.d,.bak - -# Include all files in a directory which end in .conf -#conf-dir=/etc/dnsmasq.d/,*.conf -# diff --git a/templates/easy-rsa.vars.j2 b/templates/easy-rsa.vars.j2 deleted file mode 100644 index f46993f..0000000 --- a/templates/easy-rsa.vars.j2 +++ /dev/null @@ -1,198 +0,0 @@ -# Easy-RSA 3 parameter settings - -# NOTE: If you installed Easy-RSA from your distro's package manager, don't edit -# this file in place -- instead, you should copy the entire easy-rsa directory -# to another location so future upgrades don't wipe out your changes. - -# HOW TO USE THIS FILE -# -# vars.example contains built-in examples to Easy-RSA settings. You MUST name -# this file 'vars' if you want it to be used as a configuration file. If you do -# not, it WILL NOT be automatically read when you call easyrsa commands. -# -# It is not necessary to use this config file unless you wish to change -# operational defaults. These defaults should be fine for many uses without the -# need to copy and edit the 'vars' file. -# -# All of the editable settings are shown commented and start with the command -# 'set_var' -- this means any set_var command that is uncommented has been -# modified by the user. If you're happy with a default, there is no need to -# define the value to its default. - -# NOTES FOR WINDOWS USERS -# -# Paths for Windows *MUST* use forward slashes, or optionally double-esscaped -# backslashes (single forward slashes are recommended.) This means your path to -# the openssl binary might look like this: -# "C:/Program Files/OpenSSL-Win32/bin/openssl.exe" - -# A little housekeeping: DON'T EDIT THIS SECTION -# -# Easy-RSA 3.x doesn't source into the environment directly. -# Complain if a user tries to do this: -if [ -z "$EASYRSA_CALLER" ]; then - echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2 - echo "This is no longer necessary and is disallowed. See the section called" >&2 - echo "'How to use this file' near the top comments for more details." >&2 - return 1 -fi - -# DO YOUR EDITS BELOW THIS POINT - -# This variable should point to the top level of the easy-rsa tree. By default, -# this is taken to be the directory you are currently in. - -set_var EASYRSA "{{ easyrsa_dir }}/easyrsa3/" - -# If your OpenSSL command is not in the system PATH, you will need to define the -# path to it here. Normally this means a full path to the executable, otherwise -# you could have left it undefined here and the shown default would be used. -# -# Windows users, remember to use paths with forward-slashes (or escaped -# back-slashes.) Windows users should declare the full path to the openssl -# binary here if it is not in their system PATH. - -#set_var EASYRSA_OPENSSL "openssl" -# -# This sample is in Windows syntax -- edit it for your path if not using PATH: -#set_var EASYRSA_OPENSSL "C:/Program Files/OpenSSL-Win32/bin/openssl.exe" - -# Edit this variable to point to your soon-to-be-created key directory. -# -# WARNING: init-pki will do a rm -rf on this directory so make sure you define -# it correctly! (Interactive mode will prompt before acting.) - -set_var EASYRSA_PKI "$EASYRSA/pki" - -# Define X509 DN mode. -# This is used to adjust what elements are included in the Subject field as the DN -# (this is the "Distinguished Name.") -# Note that in cn_only mode the Organizational fields further below aren't used. -# -# Choices are: -# cn_only - use just a CN value -# org - use the "traditional" Country/Province/City/Org/OU/email/CN format - -set_var EASYRSA_DN "cn_only" - -# Organizational fields (used with 'org' mode and ignored in 'cn_only' mode.) -# These are the default values for fields which will be placed in the -# certificate. Don't leave any of these fields blank, although interactively -# you may omit any specific field by typing the "." symbol (not valid for -# email.) - -#set_var EASYRSA_REQ_COUNTRY "US" -#set_var EASYRSA_REQ_PROVINCE "California" -#set_var EASYRSA_REQ_CITY "San Francisco" -#set_var EASYRSA_REQ_ORG "Copyleft Certificate Co" -#set_var EASYRSA_REQ_EMAIL "me@example.net" -#set_var EASYRSA_REQ_OU "My Organizational Unit" - -# Choose a size in bits for your keypairs. The recommended value is 2048. Using -# 2048-bit keys is considered more than sufficient for many years into the -# future. Larger keysizes will slow down TLS negotiation and make key/DH param -# generation take much longer. Values up to 4096 should be accepted by most -# software. Only used when the crypto alg is rsa (see below.) - -# set_var EASYRSA_KEY_SIZE 2048 - -# The default crypto mode is rsa; ec can enable elliptic curve support. -# Note that not all software supports ECC, so use care when enabling it. -# Choices for crypto alg are: (each in lower-case) -# * rsa -# * ec - -set_var EASYRSA_ALGO ec - -# Define the named curve, used in ec mode only: - -set_var EASYRSA_CURVE prime256v1 - -# In how many days should the root CA key expire? - -set_var EASYRSA_CA_EXPIRE {{ easyrsa_ca_expire }} - -# In how many days should certificates expire? - -set_var EASYRSA_CERT_EXPIRE {{ easyrsa_cert_expire }} - -# How many days until the next CRL publish date? Note that the CRL can still be -# parsed after this timeframe passes. It is only used for an expected next -# publication date. - -#set_var EASYRSA_CRL_DAYS 180 - -# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default -# is "no" to discourage use of deprecated extensions. If you require this -# feature to use with --ns-cert-type, set this to "yes" here. This support -# should be replaced with the more modern --remote-cert-tls feature. If you do -# not use --ns-cert-type in your configs, it is safe (and recommended) to leave -# this defined to "no". When set to "yes", server-signed certs get the -# nsCertType=server attribute, and also get any NS_COMMENT defined below in the -# nsComment field. - -#set_var EASYRSA_NS_SUPPORT "no" - -# When NS_SUPPORT is set to "yes", this field is added as the nsComment field. -# Set this blank to omit it. With NS_SUPPORT set to "no" this field is ignored. - -#set_var EASYRSA_NS_COMMENT "Easy-RSA Generated Certificate" - -# A temp file used to stage cert extensions during signing. The default should -# be fine for most users; however, some users might want an alternative under a -# RAM-based FS, such as /dev/shm or /tmp on some systems. - -#set_var EASYRSA_TEMP_FILE "$EASYRSA_PKI/extensions.temp" - -# !! -# NOTE: ADVANCED OPTIONS BELOW THIS POINT -# PLAY WITH THEM AT YOUR OWN RISK -# !! - -# Broken shell command aliases: If you have a largely broken shell that is -# missing any of these POSIX-required commands used by Easy-RSA, you will need -# to define an alias to the proper path for the command. The symptom will be -# some form of a 'command not found' error from your shell. This means your -# shell is BROKEN, but you can hack around it here if you really need. These -# shown values are not defaults: it is up to you to know what you're doing if -# you touch these. -# -#alias awk="/alt/bin/awk" -#alias cat="/alt/bin/cat" - -# X509 extensions directory: -# If you want to customize the X509 extensions used, set the directory to look -# for extensions here. Each cert type you sign must have a matching filename, -# and an optional file named 'COMMON' is included first when present. Note that -# when undefined here, default behaviour is to look in $EASYRSA_PKI first, then -# fallback to $EASYRSA for the 'x509-types' dir. You may override this -# detection with an explicit dir here. -# -#set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types" - -# OpenSSL config file: -# If you need to use a specific openssl config file, you can reference it here. -# Normally this file is auto-detected from a file named openssl-1.0.cnf from the -# EASYRSA_PKI or EASYRSA dir (in that order.) NOTE that this file is Easy-RSA -# specific and you cannot just use a standard config file, so this is an -# advanced feature. - -set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-1.0.cnf" - -# Default CN: -# This is best left alone. Interactively you will set this manually, and BATCH -# callers are expected to set this themselves. - -set_var EASYRSA_REQ_CN "{{ ansible_ssh_host }}" - -# Cryptographic digest to use. -# Do not change this default unless you understand the security implications. -# Valid choices include: md5, sha1, sha256, sha224, sha384, sha512 - -#set_var EASYRSA_DIGEST "sha256" - -# Batch mode. Leave this disabled unless you intend to call Easy-RSA explicitly -# in batch mode without any user input, confirmation on dangerous operations, -# or most output. Setting this to any non-blank string enables batch mode. - -set_var EASYRSA_BATCH "{{ ansible_ssh_host }}" diff --git a/templates/ipsec.conf.j2 b/templates/ipsec.conf.j2 deleted file mode 100644 index 8bb6181..0000000 --- a/templates/ipsec.conf.j2 +++ /dev/null @@ -1,34 +0,0 @@ -config setup - uniqueids = never # allow multiple connections per user - charondebug="ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2, mgr 2" - -conn %default - dpdaction=clear - dpddelay=35s - dpdtimeout=300s - rekey=no - keyexchange=ikev2 - ike=aes128gcm16-sha2_256-prfsha256-ecp256! - esp=aes128gcm16-sha2_256-ecp256! - compress=yes - fragmentation=yes - - left=%any - leftauth=pubkey - leftid={{ ansible_ssh_host }} - leftcert={{ ansible_ssh_host }}.crt - leftsendcert=always - leftsubnet=0.0.0.0/0,::/0 - - right=%any - rightauth=pubkey - rightsourceip={{ vpn_network }},{{ vpn_network_ipv6 }} -{% if service_dns is defined and service_dns == "N" %} - rightdns={% for host in dns_servers %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %} -{% else %} - rightdns=172.16.0.1 -{% endif %} - - -conn ikev2-pubkey - auto=add diff --git a/templates/ipsec.secrets.j2 b/templates/ipsec.secrets.j2 deleted file mode 100644 index cc208a5..0000000 --- a/templates/ipsec.secrets.j2 +++ /dev/null @@ -1,2 +0,0 @@ -: ECDSA {{ ansible_ssh_host }}.key - diff --git a/templates/mobileconfig.j2 b/templates/mobileconfig.j2 deleted file mode 100644 index d1a235c..0000000 --- a/templates/mobileconfig.j2 +++ /dev/null @@ -1,144 +0,0 @@ - - - - - PayloadContent - - - IKEv2 - - AuthenticationMethod - Certificate - ChildSecurityAssociationParameters - - DiffieHellmanGroup - 19 - EncryptionAlgorithm - AES-128-GCM - IntegrityAlgorithm - SHA2-256 - LifeTimeInMinutes - 1440 - - DeadPeerDetectionRate - Medium - DisableMOBIKE - 0 - DisableRedirect - 0 - EnableCertificateRevocationCheck - 0 - EnablePFS - - IKESecurityAssociationParameters - - DiffieHellmanGroup - 19 - EncryptionAlgorithm - AES-128-GCM - IntegrityAlgorithm - SHA2-256 - LifeTimeInMinutes - 1440 - - LocalIdentifier - {{ item.0 }} - PayloadCertificateUUID - 1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 - CertificateType - ECDSA256 - ServerCertificateIssuerCommonName - {{ ansible_ssh_host }} - RemoteAddress - {{ ansible_ssh_host }} - RemoteIdentifier - {{ ansible_ssh_host }} - UseConfigurationAttributeInternalIPSubnet - 0 - - IPv4 - - OverridePrimary - 1 - - PayloadDescription - Configures VPN settings - PayloadDisplayName - VPN - PayloadIdentifier - com.apple.vpn.managed.D247A30B-6023-4C8E-B3E3-FF1910A65E53 - PayloadType - com.apple.vpn.managed - PayloadUUID - D247A30B-6023-4C8E-B3E3-FF1910A65E53 - PayloadVersion - 1 - Proxies - - HTTPEnable - 0 - HTTPSEnable - 0 - - UserDefinedName - {{ ansible_ssh_host }} IKEv2 - VPNType - IKEv2 - - - Password - {{ easyrsa_p12_export_password }} - PayloadCertificateFileName - {{ item.0 }}.p12 - PayloadContent - - {{ item.1.stdout }} - - PayloadDescription - Adds a PKCS#12-formatted certificate - PayloadDisplayName - {{ item.0 }}.p12 - PayloadIdentifier - com.apple.security.pkcs12.1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 - PayloadType - com.apple.security.pkcs12 - PayloadUUID - 1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 - PayloadVersion - 1 - - - PayloadCertificateFileName - ca.crt - PayloadContent - - {{ PayloadContentCA.stdout }} - - PayloadDescription - Adds a CA root certificate - PayloadDisplayName - {{ ansible_ssh_host }} - PayloadIdentifier - com.apple.security.root.32EA3AAA-D19E-43EF-B357-608218745A38 - PayloadType - com.apple.security.root - PayloadUUID - 32EA3AAA-D19E-43EF-B357-608218745A38 - PayloadVersion - 1 - - - PayloadDisplayName - {{ ansible_ssh_host }} IKEv2 - PayloadIdentifier - donut.local.37CA79B1-FC6A-421F-960A-90F91FC983BE - PayloadRemovalDisallowed - - PayloadType - Configuration - PayloadUUID - 743B04A8-5725-45A2-B1BB-836F8C16DB0A - PayloadVersion - 1 - - diff --git a/templates/pagespeed.conf.j2 b/templates/pagespeed.conf.j2 deleted file mode 100644 index 3b89b75..0000000 --- a/templates/pagespeed.conf.j2 +++ /dev/null @@ -1,369 +0,0 @@ - - # Turn on mod_pagespeed. To completely disable mod_pagespeed, you - # can set this to "off". - ModPagespeed on - - # We want VHosts to inherit global configuration. - # If this is not included, they'll be independent (except for inherently - # global options), at least for backwards compatibility. - ModPagespeedInheritVHostConfig on - - # Direct Apache to send all HTML output to the mod_pagespeed - # output handler. - AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html - - # If you want mod_pagespeed process XHTML as well, please uncomment this - # line. - # AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER application/xhtml+xml - - # The ModPagespeedFileCachePath directory must exist and be writable - # by the apache user (as specified by the User directive). - ModPagespeedFileCachePath "/var/cache/mod_pagespeed/" - - # LogDir is needed to store various logs, including the statistics log - # required for the console. - ModPagespeedLogDir "/var/log/pagespeed" - - # The locations of SSL Certificates is distribution-dependent. - ModPagespeedSslCertDirectory "/etc/ssl/certs" - - - # If you want, you can use one or more memcached servers as the store for - # the mod_pagespeed cache. - # ModPagespeedMemcachedServers localhost:11211 - - # A portion of the cache can be kept in memory only, to reduce load on disk - # (or memcached) from many small files. - # ModPagespeedCreateSharedMemoryMetadataCache "/var/cache/mod_pagespeed/" 51200 - - # Override the mod_pagespeed 'rewrite level'. The default level - # "CoreFilters" uses a set of rewrite filters that are generally - # safe for most web pages. Most sites should not need to change - # this value and can instead fine-tune the configuration using the - # ModPagespeedDisableFilters and ModPagespeedEnableFilters - # directives, below. Valid values for ModPagespeedRewriteLevel are - # PassThrough, CoreFilters and TestingCoreFilters. - # - ModPagespeedRewriteLevel CoreFilters - - ModPagespeedEnableFilters combine_heads - ModPagespeedEnableFilters combine_javascript - ModPagespeedEnableFilters convert_jpeg_to_webp - ModPagespeedEnableFilters convert_png_to_jpeg - ModPagespeedEnableFilters inline_preview_images - ModPagespeedEnableFilters make_google_analytics_async - ModPagespeedEnableFilters move_css_above_scripts - ModPagespeedEnableFilters move_css_to_head - ModPagespeedEnableFilters resize_mobile_images - ModPagespeedEnableFilters sprite_images - - ModPagespeedEnableFilters defer_iframe - ModPagespeedEnableFilters defer_javascript - ModPagespeedEnableFilters lazyload_images - - # Explicitly disables specific filters. This is useful in - # conjuction with ModPagespeedRewriteLevel. For instance, if one - # of the filters in the CoreFilters needs to be disabled for a - # site, that filter can be added to - # ModPagespeedDisableFilters. This directive contains a - # comma-separated list of filter names, and can be repeated. - # - # ModPagespeedDisableFilters rewrite_images - - # Explicitly enables specific filters. This is useful in - # conjuction with ModPagespeedRewriteLevel. For instance, filters - # not included in the CoreFilters may be enabled using this - # directive. This directive contains a comma-separated list of - # filter names, and can be repeated. - # - # ModPagespeedEnableFilters rewrite_javascript,rewrite_css - # ModPagespeedEnableFilters collapse_whitespace,elide_attributes - - # Explicitly forbids the enabling of specific filters using either query - # parameters or request headers. This is useful, for example, when we do - # not want the filter to run for performance or security reasons. This - # directive contains a comma-separated list of filter names, and can be - # repeated. - # - # ModPagespeedForbidFilters rewrite_images - - # How long mod_pagespeed will wait to return an optimized resource - # (per flush window) on first request before giving up and returning the - # original (unoptimized) resource. After this deadline is exceeded the - # original resource is returned and the optimization is pushed to the - # background to be completed for future requests. Increasing this value will - # increase page latency, but might reduce load time (for instance on a - # bandwidth-constrained link where it's worth waiting for image - # compression to complete). If the value is less than or equal to zero - # mod_pagespeed will wait indefinitely for the rewrite to complete before - # returning. - # - # ModPagespeedRewriteDeadlinePerFlushMs 10 - - # ModPagespeedDomain - # authorizes rewriting of JS, CSS, and Image files found in this - # domain. By default only resources with the same origin as the - # HTML file are rewritten. For example: - # - ModPagespeedDomain * - # - # This will allow resources found on http://cdn.myhost.com to be - # rewritten in addition to those in the same domain as the HTML. - # - # Other domain-related directives (like ModPagespeedMapRewriteDomain - # and ModPagespeedMapOriginDomain) can also authorize domains. - # - # Wildcards (* and ?) are allowed in the domain specification. Be - # careful when using them as if you rewrite domains that do not - # send you traffic, then the site receiving the traffic will not - # know how to serve the rewritten content. - - # If you use downstream caches such as varnish or proxy_cache for caching - # HTML, you can configure pagespeed to work with these caches correctly - # using the following directives. Note that the values for - # ModPagespeedDownstreamCachePurgeLocationPrefix and - # ModPagespeedDownstreamCacheRebeaconingKey are deliberately left empty here - # in order to force the webmaster to choose appropriate value for these. - # - # ModPagespeedDownstreamCachePurgeLocationPrefix - # ModPagespeedDownstreamCachePurgeMethod PURGE - # ModPagespeedDownstreamCacheRewrittenPercentageThreshold 95 - # ModPagespeedDownstreamCacheRebeaconingKey - - # Other defaults (cache sizes and thresholds): - # - # ModPagespeedFileCacheSizeKb 102400 - # ModPagespeedFileCacheCleanIntervalMs 3600000 - # ModPagespeedLRUCacheKbPerProcess 1024 - # ModPagespeedLRUCacheByteLimit 16384 - # ModPagespeedCssFlattenMaxBytes 102400 - # ModPagespeedCssInlineMaxBytes 2048 - # ModPagespeedCssImageInlineMaxBytes 0 - # ModPagespeedImageInlineMaxBytes 3072 - # ModPagespeedJsInlineMaxBytes 2048 - # ModPagespeedCssOutlineMinBytes 3000 - # ModPagespeedJsOutlineMinBytes 3000 - # ModPagespeedMaxCombinedCssBytes -1 - # ModPagespeedMaxCombinedJsBytes 92160 - - # Limit the number of inodes in the file cache. Set to 0 for no limit. - # The default value if this paramater is not specified is 0 (no limit). - ModPagespeedFileCacheInodeLimit 500000 - - # Bound the number of images that can be rewritten at any one time; this - # avoids overloading the CPU. Set this to 0 to remove the bound. - # - # ModPagespeedImageMaxRewritesAtOnce 8 - - # You can also customize the number of threads per Apache process - # mod_pagespeed will use to do resource optimization. Plain - # "rewrite threads" are used to do short, latency-sensitive work, - # while "expensive rewrite threads" are used for actual optimization - # work that's more computationally expensive. If you live these unset, - # or use values <= 0 the defaults will be used, which is 1 for both - # values when using non-threaded MPMs (e.g. prefork) and 4 for both - # on threaded MPMs (e.g. worker and event). These settings can only - # be changed globally, and not per virtual host. - # - # ModPagespeedNumRewriteThreads 4 - # ModPagespeedNumExpensiveRewriteThreads 4 - - # Randomly drop rewrites (*) to increase the chance of optimizing - # frequently fetched resources and decrease the chance of optimizing - # infrequently fetched resources. This can reduce CPU load. The default - # value of this parameter is 0 (no drops). 90 means that a resourced - # fetched once has a 10% probability of being optimized while a resource - # that is fetched 50 times has a 99.65% probability of being optimized. - # - # (*) Currently only CSS files and images are randomly dropped. Images - # within CSS files are not randomly dropped. - # - # ModPagespeedRewriteRandomDropPercentage 90 - - # Many filters modify the URLs of resources in HTML files. This is typically - # harmless but pages whose Javascript expects to read or modify the original - # URLs may break. The following parameters prevent filters from modifying - # URLs of their respective types. - # - # ModPagespeedJsPreserveURLs on - # ModPagespeedImagePreserveURLs on - # ModPagespeedCssPreserveURLs on - - # When PreserveURLs is on, it is still possible to enable browser-specific - # optimizations (for example, webp images can be served to browsers that - # will accept them). They'll be served with Vary: Accept or Vary: - # User-Agent headers as appropriate. Note that this may require configuring - # reverse proxy caches such as varnish to handle these headers properly. - # - # ModPagespeedFilters in_place_optimize_for_browser - - # Internet Explorer has difficulty caching resources with Vary: headers. - # They will either be uncached (older IE) or require revalidation. See: - # http://blogs.msdn.com/b/ieinternals/archive/2009/06/17/vary-header-prevents-caching-in-ie.aspx - # As a result we serve them as Cache-Control: private instead by default. - # If you are using a reverse proxy or CDN configured to cache content with - # the Vary: Accept header you should turn this setting off. - # - # ModPagespeedPrivateNotVaryForIE on - - # Settings for image optimization: - # - # Lossy image recompression quality (0 to 100, -1 just strips metadata): - # ModPagespeedImageRecompressionQuality 85 - # - # Jpeg recompression quality (0 to 100, -1 uses ImageRecompressionQuality): - # ModPagespeedJpegRecompressionQuality -1 - # ModPagespeedJpegRecompressionQualityForSmallScreens 70 - - ModPagespeedJpegRecompressionQuality 75 - - # - # WebP recompression quality (0 to 100, -1 uses ImageRecompressionQuality): - # ModPagespeedWebpRecompressionQuality 80 - # ModPagespeedWebpRecompressionQualityForSmallScreens 70 - # - # Timeout for conversions to WebP format, in - # milliseconds. Negative values mean no timeout is applied. The - # default value is -1: - # ModPagespeedWebpTimeoutMs 5000 - # - # Percent of original image size below which optimized images are retained: - # ModPagespeedImageLimitOptimizedPercent 100 - # - # Percent of original image area below which image resizing will be - # attempted: - # ModPagespeedImageLimitResizeAreaPercent 100 - - # Settings for inline preview images - # - # Setting this to n restricts preview images to the first n images found on - # the page. The default of -1 means preview images can appear anywhere on - # the page (if those images appear above the fold). - # ModPagespeedMaxInlinedPreviewImagesIndex -1 - - # Sets the minimum size in bytes of any image for which a low quality image - # is generated. - # ModPagespeedMinImageSizeLowResolutionBytes 3072 - - # The maximum URL size is generally limited to about 2k characters - # due to IE: See http://support.microsoft.com/kb/208427/EN-US. - # Apache servers by default impose a further limitation of about - # 250 characters per URL segment (text between slashes). - # mod_pagespeed circumvents this limitation, but if you employ - # proxy servers in your path you may need to re-impose it by - # overriding the setting here. The default setting is 1024 - # characters. - # - # ModPagespeedMaxSegmentLength 250 - - # Uncomment this if you want to prevent mod_pagespeed from combining files - # (e.g. CSS files) across paths - # - # ModPagespeedCombineAcrossPaths off - - # Renaming JavaScript URLs can sometimes break them. With this - # option enabled, mod_pagespeed uses a simple heuristic to decide - # not to rename JavaScript that it thinks is introspective. - # - # You can uncomment this to let mod_pagespeed rename all JS files. - # - # ModPagespeedAvoidRenamingIntrospectiveJavascript off - - # Certain common JavaScript libraries are available from Google, which acts - # as a CDN and allows you to benefit from browser caching if a new visitor - # to your site previously visited another site that makes use of the same - # libraries as you do. Enable the following filter to turn on this feature. - # - # ModPagespeedEnableFilters canonicalize_javascript_libraries - - # The following line configures a library that is recognized by - # canonicalize_javascript_libraries. This will have no effect unless you - # enable this filter (generally by uncommenting the last line in the - # previous stanza). The format is: - # ModPagespeedLibrary bytes md5 canonical_url - # Where bytes and md5 are with respect to the *minified* JS; use - # js_minify --print_size_and_hash to obtain this data. - # Note that we can register multiple hashes for the same canonical url; - # we do this if there are versions available that have already been minified - # with more sophisticated tools. - # - # Additional library configuration can be found in - # pagespeed_libraries.conf included in the distribution. You should add - # new entries here, though, so that file can be automatically upgraded. - # ModPagespeedLibrary 43 1o978_K0_LNE5_ystNklf http://www.modpagespeed.com/rewrite_javascript.js - - # Explicitly tell mod_pagespeed to load some resources from disk. - # This will speed up load time and update frequency. - # - # This should only be used for static resources which do not need - # specific headers set or other processing by Apache. - # - # Both URL and filesystem path should specify directories and - # filesystem path must be absolute (for now). - # - # ModPagespeedLoadFromFile "http://example.com/static/" "/var/www/static/" - - - # Enables server-side instrumentation and statistics. If this rewriter is - # enabled, then each rewritten HTML page will have instrumentation javacript - # added that sends latency beacons to /mod_pagespeed_beacon. These - # statistics can be accessed at /mod_pagespeed_statistics. You must also - # enable the mod_pagespeed_statistics and mod_pagespeed_beacon handlers - # below. - # - # ModPagespeedEnableFilters add_instrumentation - - # The add_instrumentation filter sends a beacon after the page onload - # handler is called. The user might navigate to a new URL before this. If - # you enable the following directive, the beacon is sent as part of an - # onbeforeunload handler, for pages where navigation happens before the - # onload event. - # - # ModPagespeedReportUnloadTime on - - # Uncomment the following line so that ModPagespeed will not cache or - # rewrite resources with Vary: in the header, e.g. Vary: User-Agent. - # Note that ModPagespeed always respects Vary: headers on html content. - # ModPagespeedRespectVary on - - # Uncomment the following line if you want to disable statistics entirely. - # - # ModPagespeedStatistics off - - # These handlers are central entry-points into the admin pages. - # By default, pagespeed_admin and pagespeed_global_admin present - # the same data, and differ only when - # ModPagespeedUsePerVHostStatistics is enabled. In that case, - # /pagespeed_global_admin sees aggregated data across all vhosts, - # and the /pagespeed_admin sees data only for a particular vhost. - # - # You may insert other "Allow from" lines to add hosts you want to - # allow to look at generated statistics. Another possibility is - # to comment out the "Order" and "Allow" options from the config - # file, to allow any client that can reach your server to access - # and change server state, such as statistics, caches, and - # messages. This might be appropriate in an experimental setup. - - Order allow,deny - Allow from localhost - Allow from 127.0.0.1 - SetHandler pagespeed_admin - - - Order allow,deny - Allow from localhost - Allow from 127.0.0.1 - SetHandler pagespeed_global_admin - - - # Enable logging of mod_pagespeed statistics, needed for the console. - ModPagespeedStatisticsLogging on - - # Page /mod_pagespeed_message lets you view the latest messages from - # mod_pagespeed, regardless of log-level in your httpd.conf - # ModPagespeedMessageBufferSize is the maximum number of bytes you would - # like to dump to your /mod_pagespeed_message page at one time, - # its default value is 100k bytes. - # Set it to 0 if you want to disable this feature. - ModPagespeedMessageBufferSize 100000 - diff --git a/templates/ports.conf.j2 b/templates/ports.conf.j2 deleted file mode 100644 index 2618436..0000000 --- a/templates/ports.conf.j2 +++ /dev/null @@ -1,13 +0,0 @@ -# If you just change the port or add more ports here, you will likely also -# have to change the VirtualHost statement in -# /etc/apache2/sites-enabled/000-default.conf - -Listen 172.16.0.1:8080 - - - Listen 172.16.0.1:443 - - - - Listen 172.16.0.1:443 - diff --git a/templates/privoxy_config.j2 b/templates/privoxy_config.j2 deleted file mode 100644 index dd55f0f..0000000 --- a/templates/privoxy_config.j2 +++ /dev/null @@ -1,2107 +0,0 @@ -# Sample Configuration File for Privoxy -# -# Id: config,v -# -# Copyright (C) 2001-2014 Privoxy Developers http://www.privoxy.org/ -# -#################################################################### -# # -# Table of Contents # -# # -# I. INTRODUCTION # -# II. FORMAT OF THE CONFIGURATION FILE # -# # -# 1. LOCAL SET-UP DOCUMENTATION # -# 2. CONFIGURATION AND LOG FILE LOCATIONS # -# 3. DEBUGGING # -# 4. ACCESS CONTROL AND SECURITY # -# 5. FORWARDING # -# 6. MISCELLANEOUS # -# 7. WINDOWS GUI OPTIONS # -# # -#################################################################### -# -# -# I. INTRODUCTION -# =============== -# -# This file holds Privoxy's main configuration. Privoxy detects -# configuration changes automatically, so you don't have to restart -# it unless you want to load a different configuration file. -# -# The configuration will be reloaded with the first request after -# the change was done, this request itself will still use the old -# configuration, though. In other words: it takes two requests -# before you see the result of your changes. Requests that are -# dropped due to ACL don't trigger reloads. -# -# When starting Privoxy on Unix systems, give the location of this -# file as last argument. On Windows systems, Privoxy will look for -# this file with the name 'config.txt' in the current working -# directory of the Privoxy process. -# -# -# II. FORMAT OF THE CONFIGURATION FILE -# ==================================== -# -# Configuration lines consist of an initial keyword followed by a -# list of values, all separated by whitespace (any number of spaces -# or tabs). For example, -# -# actionsfile default.action -# -# Indicates that the actionsfile is named 'default.action'. -# -# The '#' indicates a comment. Any part of a line following a '#' is -# ignored, except if the '#' is preceded by a '\'. -# -# Thus, by placing a # at the start of an existing configuration -# line, you can make it a comment and it will be treated as if it -# weren't there. This is called "commenting out" an option and can -# be useful. Removing the # again is called "uncommenting". -# -# Note that commenting out an option and leaving it at its default -# are two completely different things! Most options behave very -# differently when unset. See the "Effect if unset" explanation in -# each option's description for details. -# -# Long lines can be continued on the next line by using a `\' as the -# last character. -# -# -# 1. LOCAL SET-UP DOCUMENTATION -# ============================== -# -# If you intend to operate Privoxy for more users than just -# yourself, it might be a good idea to let them know how to reach -# you, what you block and why you do that, your policies, etc. -# -# -# 1.1. user-manual -# ================= -# -# Specifies: -# -# Location of the Privoxy User Manual. -# -# Type of value: -# -# A fully qualified URI -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# http://www.privoxy.org/version/user-manual/ will be used, -# where version is the Privoxy version. -# -# Notes: -# -# The User Manual URI is the single best source of information -# on Privoxy, and is used for help links from some of the -# internal CGI pages. The manual itself is normally packaged -# with the binary distributions, so you probably want to set -# this to a locally installed copy. -# -# Examples: -# -# The best all purpose solution is simply to put the full local -# PATH to where the User Manual is located: -# -# user-manual /usr/share/doc/privoxy/user-manual -# -# The User Manual is then available to anyone with access to -# Privoxy, by following the built-in URL: http:// -# config.privoxy.org/user-manual/ (or the shortcut: http://p.p/ -# user-manual/). -# -# If the documentation is not on the local system, it can be -# accessed from a remote server, as: -# -# user-manual http://example.com/privoxy/user-manual/ -# -# WARNING!!! -# -# If set, this option should be the first option in the -# config file, because it is used while the config file is -# being read. -# -user-manual /usr/share/doc/privoxy/user-manual -# -# 1.2. trust-info-url -# ==================== -# -# Specifies: -# -# A URL to be displayed in the error page that users will see if -# access to an untrusted page is denied. -# -# Type of value: -# -# URL -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# No links are displayed on the "untrusted" error page. -# -# Notes: -# -# The value of this option only matters if the experimental -# trust mechanism has been activated. (See trustfile below.) -# -# If you use the trust mechanism, it is a good idea to write up -# some on-line documentation about your trust policy and to -# specify the URL(s) here. Use multiple times for multiple URLs. -# -# The URL(s) should be added to the trustfile as well, so users -# don't end up locked out from the information on why they were -# locked out in the first place! -# -#trust-info-url http://www.example.com/why_we_block.html -#trust-info-url http://www.example.com/what_we_allow.html -# -# 1.3. admin-address -# =================== -# -# Specifies: -# -# An email address to reach the Privoxy administrator. -# -# Type of value: -# -# Email address -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# No email address is displayed on error pages and the CGI user -# interface. -# -# Notes: -# -# If both admin-address and proxy-info-url are unset, the whole -# "Local Privoxy Support" box on all generated pages will not be -# shown. -# -#admin-address privoxy-admin@example.com -# -# 1.4. proxy-info-url -# ==================== -# -# Specifies: -# -# A URL to documentation about the local Privoxy setup, -# configuration or policies. -# -# Type of value: -# -# URL -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# No link to local documentation is displayed on error pages and -# the CGI user interface. -# -# Notes: -# -# If both admin-address and proxy-info-url are unset, the whole -# "Local Privoxy Support" box on all generated pages will not be -# shown. -# -# This URL shouldn't be blocked ;-) -# -#proxy-info-url http://www.example.com/proxy-service.html -# -# 2. CONFIGURATION AND LOG FILE LOCATIONS -# ======================================== -# -# Privoxy can (and normally does) use a number of other files for -# additional configuration, help and logging. This section of the -# configuration file tells Privoxy where to find those other files. -# -# The user running Privoxy, must have read permission for all -# configuration files, and write permission to any files that would -# be modified, such as log files and actions files. -# -# -# 2.1. confdir -# ============= -# -# Specifies: -# -# The directory where the other configuration files are located. -# -# Type of value: -# -# Path name -# -# Default value: -# -# /etc/privoxy (Unix) or Privoxy installation dir (Windows) -# -# Effect if unset: -# -# Mandatory -# -# Notes: -# -# No trailing "/", please. -# -confdir /etc/privoxy -# -# 2.2. templdir -# ============== -# -# Specifies: -# -# An alternative directory where the templates are loaded from. -# -# Type of value: -# -# Path name -# -# Default value: -# -# unset -# -# Effect if unset: -# -# The templates are assumed to be located in confdir/template. -# -# Notes: -# -# Privoxy's original templates are usually overwritten with each -# update. Use this option to relocate customized templates that -# should be kept. As template variables might change between -# updates, you shouldn't expect templates to work with Privoxy -# releases other than the one they were part of, though. -# -#templdir . -# -# 2.3. temporary-directory -# ========================= -# -# Specifies: -# -# A directory where Privoxy can create temporary files. -# -# Type of value: -# -# Path name -# -# Default value: -# -# unset -# -# Effect if unset: -# -# No temporary files are created, external filters don't work. -# -# Notes: -# -# To execute external filters, Privoxy has to create temporary -# files. This directive specifies the directory the temporary -# files should be written to. -# -# It should be a directory only Privoxy (and trusted users) can -# access. -# -#temporary-directory . -# -# 2.4. logdir -# ============ -# -# Specifies: -# -# The directory where all logging takes place (i.e. where the -# logfile is located). -# -# Type of value: -# -# Path name -# -# Default value: -# -# /var/log/privoxy (Unix) or Privoxy installation dir (Windows) -# -# Effect if unset: -# -# Mandatory -# -# Notes: -# -# No trailing "/", please. -# -logdir /var/log/privoxy -# -# 2.5. actionsfile -# ================= -# -# Specifies: -# -# The actions file(s) to use -# -# Type of value: -# -# Complete file name, relative to confdir -# -# Default values: -# -# match-all.action # Actions that are applied to all sites and maybe overruled later on. -# -# default.action # Main actions file -# -# user.action # User customizations -# -# Effect if unset: -# -# No actions are taken at all. More or less neutral proxying. -# -# Notes: -# -# Multiple actionsfile lines are permitted, and are in fact -# recommended! -# -# The default values are default.action, which is the "main" -# actions file maintained by the developers, and user.action, -# where you can make your personal additions. -# -# Actions files contain all the per site and per URL -# configuration for ad blocking, cookie management, privacy -# considerations, etc. -# -actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on. -actionsfile default.action # Main actions file -actionsfile user.action # User customizations -# -# 2.6. filterfile -# ================ -# -# Specifies: -# -# The filter file(s) to use -# -# Type of value: -# -# File name, relative to confdir -# -# Default value: -# -# default.filter (Unix) or default.filter.txt (Windows) -# -# Effect if unset: -# -# No textual content filtering takes place, i.e. all +filter{name} -# actions in the actions files are turned neutral. -# -# Notes: -# -# Multiple filterfile lines are permitted. -# -# The filter files contain content modification rules that use -# regular expressions. These rules permit powerful changes on -# the content of Web pages, and optionally the headers as well, -# e.g., you could try to disable your favorite JavaScript -# annoyances, re-write the actual displayed text, or just have -# some fun playing buzzword bingo with web pages. -# -# The +filter{name} actions rely on the relevant filter (name) -# to be defined in a filter file! -# -# A pre-defined filter file called default.filter that contains -# a number of useful filters for common problems is included in -# the distribution. See the section on the filter action for a -# list. -# -# It is recommended to place any locally adapted filters into a -# separate file, such as user.filter. -# -filterfile default.filter -filterfile user.filter # User customizations -# -# 2.7. logfile -# ============= -# -# Specifies: -# -# The log file to use -# -# Type of value: -# -# File name, relative to logdir -# -# Default value: -# -# Unset (commented out). When activated: logfile (Unix) or -# privoxy.log (Windows). -# -# Effect if unset: -# -# No logfile is written. -# -# Notes: -# -# The logfile is where all logging and error messages are -# written. The level of detail and number of messages are set -# with the debug option (see below). The logfile can be useful -# for tracking down a problem with Privoxy (e.g., it's not -# blocking an ad you think it should block) and it can help you -# to monitor what your browser is doing. -# -# Depending on the debug options below, the logfile may be a -# privacy risk if third parties can get access to it. As most -# users will never look at it, Privoxy only logs fatal errors by -# default. -# -# For most troubleshooting purposes, you will have to change -# that, please refer to the debugging section for details. -# -# Any log files must be writable by whatever user Privoxy is -# being run as (on Unix, default user id is "privoxy"). -# -# To prevent the logfile from growing indefinitely, it is -# recommended to periodically rotate or shorten it. Many -# operating systems support log rotation out of the box, some -# require additional software to do it. For details, please -# refer to the documentation for your operating system. -# -logfile logfile -# -# 2.8. trustfile -# =============== -# -# Specifies: -# -# The name of the trust file to use -# -# Type of value: -# -# File name, relative to confdir -# -# Default value: -# -# Unset (commented out). When activated: trust (Unix) or -# trust.txt (Windows) -# -# Effect if unset: -# -# The entire trust mechanism is disabled. -# -# Notes: -# -# The trust mechanism is an experimental feature for building -# white-lists and should be used with care. It is NOT -# recommended for the casual user. -# -# If you specify a trust file, Privoxy will only allow access to -# sites that are specified in the trustfile. Sites can be listed -# in one of two ways: -# -# Prepending a ~ character limits access to this site only (and -# any sub-paths within this site), e.g. ~www.example.com allows -# access to ~www.example.com/features/news.html, etc. -# -# Or, you can designate sites as trusted referrers, by -# prepending the name with a + character. The effect is that -# access to untrusted sites will be granted -- but only if a -# link from this trusted referrer was used to get there. The -# link target will then be added to the "trustfile" so that -# future, direct accesses will be granted. Sites added via this -# mechanism do not become trusted referrers themselves (i.e. -# they are added with a ~ designation). There is a limit of 512 -# such entries, after which new entries will not be made. -# -# If you use the + operator in the trust file, it may grow -# considerably over time. -# -# It is recommended that Privoxy be compiled with the -# --disable-force, --disable-toggle and --disable-editor -# options, if this feature is to be used. -# -# Possible applications include limiting Internet access for -# children. -# -#trustfile trust -# -# 3. DEBUGGING -# ============= -# -# These options are mainly useful when tracing a problem. Note that -# you might also want to invoke Privoxy with the --no-daemon command -# line option when debugging. -# -# -# 3.1. debug -# =========== -# -# Specifies: -# -# Key values that determine what information gets logged. -# -# Type of value: -# -# Integer values -# -# Default value: -# -# 0 (i.e.: only fatal errors (that cause Privoxy to exit) are -# logged) -# -# Effect if unset: -# -# Default value is used (see above). -# -# Notes: -# -# The available debug levels are: -# -# debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. -# debug 2 # show each connection status -# debug 4 # show I/O status -# debug 8 # show header parsing -# debug 16 # log all data written to the network -# debug 32 # debug force feature -# debug 64 # debug regular expression filters -# debug 128 # debug redirects -# debug 256 # debug GIF de-animation -# debug 512 # Common Log Format -# debug 1024 # Log the destination for requests Privoxy didn't let through, and the reason why. -# debug 2048 # CGI user interface -# debug 4096 # Startup banner and warnings. -# debug 8192 # Non-fatal errors -# debug 32768 # log all data read from the network -# debug 65536 # Log the applying actions -# -# To select multiple debug levels, you can either add them or -# use multiple debug lines. -# -# A debug level of 1 is informative because it will show you -# each request as it happens. 1, 1024, 4096 and 8192 are -# recommended so that you will notice when things go wrong. The -# other levels are probably only of interest if you are hunting -# down a specific problem. They can produce a hell of an output -# (especially 16). -# -# If you are used to the more verbose settings, simply enable -# the debug lines below again. -# -# If you want to use pure CLF (Common Log Format), you should -# set "debug 512" ONLY and not enable anything else. -# -# Privoxy has a hard-coded limit for the length of log messages. -# If it's reached, messages are logged truncated and marked with -# "... [too long, truncated]". -# -# Please don't file any support requests without trying to -# reproduce the problem with increased debug level first. Once -# you read the log messages, you may even be able to solve the -# problem on your own. -# -#debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. -#debug 1024 # Actions that are applied to all sites and maybe overruled later on. -#debug 4096 # Startup banner and warnings -#debug 8192 # Non-fatal errors -# -# 3.2. single-threaded -# ===================== -# -# Specifies: -# -# Whether to run only one server thread. -# -# Type of value: -# -# 1 or 0 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Multi-threaded (or, where unavailable: forked) operation, i.e. -# the ability to serve multiple requests simultaneously. -# -# Notes: -# -# This option is only there for debugging purposes. It will -# drastically reduce performance. -# -#single-threaded 1 -# -# 3.3. hostname -# ============== -# -# Specifies: -# -# The hostname shown on the CGI pages. -# -# Type of value: -# -# Text -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# The hostname provided by the operating system is used. -# -# Notes: -# -# On some misconfigured systems resolving the hostname fails or -# takes too much time and slows Privoxy down. Setting a fixed -# hostname works around the problem. -# -# In other circumstances it might be desirable to show a -# hostname other than the one returned by the operating system. -# For example if the system has several different hostnames and -# you don't want to use the first one. -# -# Note that Privoxy does not validate the specified hostname -# value. -# -#hostname hostname.example.org -# -# 4. ACCESS CONTROL AND SECURITY -# =============================== -# -# This section of the config file controls the security-relevant -# aspects of Privoxy's configuration. -# -# -# 4.1. listen-address -# ==================== -# -# Specifies: -# -# The address and TCP port on which Privoxy will listen for -# client requests. -# -# Type of value: -# -# [IP-Address]:Port -# -# [Hostname]:Port -# -# Default value: -# -# 127.0.0.1:8118 -# -# Effect if unset: -# -# Bind to 127.0.0.1 (IPv4 localhost), port 8118. This is -# suitable and recommended for home users who run Privoxy on the -# same machine as their browser. -# -# Notes: -# -# You will need to configure your browser(s) to this proxy -# address and port. -# -# If you already have another service running on port 8118, or -# if you want to serve requests from other machines (e.g. on -# your local network) as well, you will need to override the -# default. -# -# You can use this statement multiple times to make Privoxy -# listen on more ports or more IP addresses. Suitable if your -# operating system does not support sharing IPv6 and IPv4 -# protocols on the same socket. -# -# If a hostname is used instead of an IP address, Privoxy will -# try to resolve it to an IP address and if there are multiple, -# use the first one returned. -# -# If the address for the hostname isn't already known on the -# system (for example because it's in /etc/hostname), this may -# result in DNS traffic. -# -# If the specified address isn't available on the system, or if -# the hostname can't be resolved, Privoxy will fail to start. -# -# IPv6 addresses containing colons have to be quoted by -# brackets. They can only be used if Privoxy has been compiled -# with IPv6 support. If you aren't sure if your version supports -# it, have a look at http://config.privoxy.org/show-status. -# -# Some operating systems will prefer IPv6 to IPv4 addresses even -# if the system has no IPv6 connectivity which is usually not -# expected by the user. Some even rely on DNS to resolve -# localhost which mean the "localhost" address used may not -# actually be local. -# -# It is therefore recommended to explicitly configure the -# intended IP address instead of relying on the operating -# system, unless there's a strong reason not to. -# -# If you leave out the address, Privoxy will bind to all IPv4 -# interfaces (addresses) on your machine and may become -# reachable from the Internet and/or the local network. Be aware -# that some GNU/Linux distributions modify that behaviour -# without updating the documentation. Check for non-standard -# patches if your Privoxy version behaves differently. -# -# If you configure Privoxy to be reachable from the network, -# consider using access control lists (ACL's, see below), and/or -# a firewall. -# -# If you open Privoxy to untrusted users, you will also want to -# make sure that the following actions are disabled: -# enable-edit-actions and enable-remote-toggle -# -# Example: -# -# Suppose you are running Privoxy on a machine which has the -# address 192.168.0.1 on your local private network -# (192.168.0.0) and has another outside connection with a -# different address. You want it to serve requests from inside -# only: -# -# listen-address 192.168.0.1:8118 -# -# Suppose you are running Privoxy on an IPv6-capable machine and -# you want it to listen on the IPv6 address of the loopback -# device: -# -# listen-address [::1]:8118 -# -# -listen-address 172.16.0.1:8118 -# -# 4.2. toggle -# ============ -# -# Specifies: -# -# Initial state of "toggle" status -# -# Type of value: -# -# 1 or 0 -# -# Default value: -# -# 1 -# -# Effect if unset: -# -# Act as if toggled on -# -# Notes: -# -# If set to 0, Privoxy will start in "toggled off" mode, i.e. -# mostly behave like a normal, content-neutral proxy with both -# ad blocking and content filtering disabled. See -# enable-remote-toggle below. -# -toggle 1 -# -# 4.3. enable-remote-toggle -# ========================== -# -# Specifies: -# -# Whether or not the web-based toggle feature may be used -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# The web-based toggle feature is disabled. -# -# Notes: -# -# When toggled off, Privoxy mostly acts like a normal, -# content-neutral proxy, i.e. doesn't block ads or filter -# content. -# -# Access to the toggle feature can not be controlled separately -# by "ACLs" or HTTP authentication, so that everybody who can -# access Privoxy (see "ACLs" and listen-address above) can -# toggle it for all users. So this option is not recommended for -# multi-user environments with untrusted users. -# -# Note that malicious client side code (e.g Java) is also -# capable of using this option. -# -# As a lot of Privoxy users don't read documentation, this -# feature is disabled by default. -# -# Note that you must have compiled Privoxy with support for this -# feature, otherwise this option has no effect. -# -enable-remote-toggle 0 -# -# 4.4. enable-remote-http-toggle -# =============================== -# -# Specifies: -# -# Whether or not Privoxy recognizes special HTTP headers to -# change its behaviour. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Privoxy ignores special HTTP headers. -# -# Notes: -# -# When toggled on, the client can change Privoxy's behaviour by -# setting special HTTP headers. Currently the only supported -# special header is "X-Filter: No", to disable filtering for the -# ongoing request, even if it is enabled in one of the action -# files. -# -# This feature is disabled by default. If you are using Privoxy -# in a environment with trusted clients, you may enable this -# feature at your discretion. Note that malicious client side -# code (e.g Java) is also capable of using this feature. -# -# This option will be removed in future releases as it has been -# obsoleted by the more general header taggers. -# -enable-remote-http-toggle 0 -# -# 4.5. enable-edit-actions -# ========================= -# -# Specifies: -# -# Whether or not the web-based actions file editor may be used -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# The web-based actions file editor is disabled. -# -# Notes: -# -# Access to the editor can not be controlled separately by -# "ACLs" or HTTP authentication, so that everybody who can -# access Privoxy (see "ACLs" and listen-address above) can -# modify its configuration for all users. -# -# This option is not recommended for environments with untrusted -# users and as a lot of Privoxy users don't read documentation, -# this feature is disabled by default. -# -# Note that malicious client side code (e.g Java) is also -# capable of using the actions editor and you shouldn't enable -# this options unless you understand the consequences and are -# sure your browser is configured correctly. -# -# Note that you must have compiled Privoxy with support for this -# feature, otherwise this option has no effect. -# -enable-edit-actions 0 -# -# 4.6. enforce-blocks -# ==================== -# -# Specifies: -# -# Whether the user is allowed to ignore blocks and can "go there -# anyway". -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Blocks are not enforced. -# -# Notes: -# -# Privoxy is mainly used to block and filter requests as a -# service to the user, for example to block ads and other junk -# that clogs the pipes. Privoxy's configuration isn't perfect -# and sometimes innocent pages are blocked. In this situation it -# makes sense to allow the user to enforce the request and have -# Privoxy ignore the block. -# -# In the default configuration Privoxy's "Blocked" page contains -# a "go there anyway" link to adds a special string (the force -# prefix) to the request URL. If that link is used, Privoxy will -# detect the force prefix, remove it again and let the request -# pass. -# -# Of course Privoxy can also be used to enforce a network -# policy. In that case the user obviously should not be able to -# bypass any blocks, and that's what the "enforce-blocks" option -# is for. If it's enabled, Privoxy hides the "go there anyway" -# link. If the user adds the force prefix by hand, it will not -# be accepted and the circumvention attempt is logged. -# -# Examples: -# -# enforce-blocks 1 -# -enforce-blocks 0 -# -# 4.7. ACLs: permit-access and deny-access -# ========================================= -# -# Specifies: -# -# Who can access what. -# -# Type of value: -# -# src_addr[:port][/src_masklen] [dst_addr[:port][/dst_masklen]] -# -# Where src_addr and dst_addr are IPv4 addresses in dotted -# decimal notation or valid DNS names, port is a port number, -# and src_masklen and dst_masklen are subnet masks in CIDR -# notation, i.e. integer values from 2 to 30 representing the -# length (in bits) of the network address. The masks and the -# whole destination part are optional. -# -# If your system implements RFC 3493, then src_addr and dst_addr -# can be IPv6 addresses delimeted by brackets, port can be a -# number or a service name, and src_masklen and dst_masklen can -# be a number from 0 to 128. -# -# Default value: -# -# Unset -# -# If no port is specified, any port will match. If no -# src_masklen or src_masklen is given, the complete IP address -# has to match (i.e. 32 bits for IPv4 and 128 bits for IPv6). -# -# Effect if unset: -# -# Don't restrict access further than implied by listen-address -# -# Notes: -# -# Access controls are included at the request of ISPs and -# systems administrators, and are not usually needed by -# individual users. For a typical home user, it will normally -# suffice to ensure that Privoxy only listens on the localhost -# (127.0.0.1) or internal (home) network address by means of the -# listen-address option. -# -# Please see the warnings in the FAQ that Privoxy is not -# intended to be a substitute for a firewall or to encourage -# anyone to defer addressing basic security weaknesses. -# -# Multiple ACL lines are OK. If any ACLs are specified, Privoxy -# only talks to IP addresses that match at least one -# permit-access line and don't match any subsequent deny-access -# line. In other words, the last match wins, with the default -# being deny-access. -# -# If Privoxy is using a forwarder (see forward below) for a -# particular destination URL, the dst_addr that is examined is -# the address of the forwarder and NOT the address of the -# ultimate target. This is necessary because it may be -# impossible for the local Privoxy to determine the IP address -# of the ultimate target (that's often what gateways are used -# for). -# -# You should prefer using IP addresses over DNS names, because -# the address lookups take time. All DNS names must resolve! You -# can not use domain patterns like "*.org" or partial domain -# names. If a DNS name resolves to multiple IP addresses, only -# the first one is used. -# -# Some systems allow IPv4 clients to connect to IPv6 server -# sockets. Then the client's IPv4 address will be translated by -# the system into IPv6 address space with special prefix -# ::ffff:0:0/96 (so called IPv4 mapped IPv6 address). Privoxy -# can handle it and maps such ACL addresses automatically. -# -# Denying access to particular sites by ACL may have undesired -# side effects if the site in question is hosted on a machine -# which also hosts other sites (most sites are). -# -# Examples: -# -# Explicitly define the default behavior if no ACL and -# listen-address are set: "localhost" is OK. The absence of a -# dst_addr implies that all destination addresses are OK: -# -# permit-access localhost -# -# Allow any host on the same class C subnet as www.privoxy.org -# access to nothing but www.example.com (or other domains hosted -# on the same system): -# -# permit-access www.privoxy.org/24 www.example.com/32 -# -# Allow access from any host on the 26-bit subnet 192.168.45.64 -# to anywhere, with the exception that 192.168.45.73 may not -# access the IP address behind www.dirty-stuff.example.com: -# -# permit-access 192.168.45.64/26 -# deny-access 192.168.45.73 www.dirty-stuff.example.com -# -# Allow access from the IPv4 network 192.0.2.0/24 even if -# listening on an IPv6 wild card address (not supported on all -# platforms): -# -# permit-access 192.0.2.0/24 -# -# This is equivalent to the following line even if listening on -# an IPv4 address (not supported on all platforms): -# -# permit-access [::ffff:192.0.2.0]/120 -# -# -# 4.8. buffer-limit -# ================== -# -# Specifies: -# -# Maximum size of the buffer for content filtering. -# -# Type of value: -# -# Size in Kbytes -# -# Default value: -# -# 4096 -# -# Effect if unset: -# -# Use a 4MB (4096 KB) limit. -# -# Notes: -# -# For content filtering, i.e. the +filter and +deanimate-gif -# actions, it is necessary that Privoxy buffers the entire -# document body. This can be potentially dangerous, since a -# server could just keep sending data indefinitely and wait for -# your RAM to exhaust -- with nasty consequences. Hence this -# option. -# -# When a document buffer size reaches the buffer-limit, it is -# flushed to the client unfiltered and no further attempt to -# filter the rest of the document is made. Remember that there -# may be multiple threads running, which might require up to -# buffer-limit Kbytes each, unless you have enabled -# "single-threaded" above. -# -buffer-limit 4096 -# -# 4.9. enable-proxy-authentication-forwarding -# ============================================ -# -# Specifies: -# -# Whether or not proxy authentication through Privoxy should -# work. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Proxy authentication headers are removed. -# -# Notes: -# -# Privoxy itself does not support proxy authentication, but can -# allow clients to authenticate against Privoxy's parent proxy. -# -# By default Privoxy (3.0.21 and later) don't do that and remove -# Proxy-Authorization headers in requests and Proxy-Authenticate -# headers in responses to make it harder for malicious sites to -# trick inexperienced users into providing login information. -# -# If this option is enabled the headers are forwarded. -# -# Enabling this option is not recommended if there is no parent -# proxy that requires authentication or if the local network -# between Privoxy and the parent proxy isn't trustworthy. If -# proxy authentication is only required for some requests, it is -# recommended to use a client header filter to remove the -# authentication headers for requests where they aren't needed. -# -enable-proxy-authentication-forwarding 0 -# -# 5. FORWARDING -# ============== -# -# This feature allows routing of HTTP requests through a chain of -# multiple proxies. -# -# Forwarding can be used to chain Privoxy with a caching proxy to -# speed up browsing. Using a parent proxy may also be necessary if -# the machine that Privoxy runs on has no direct Internet access. -# -# Note that parent proxies can severely decrease your privacy level. -# For example a parent proxy could add your IP address to the -# request headers and if it's a caching proxy it may add the "Etag" -# header to revalidation requests again, even though you configured -# Privoxy to remove it. It may also ignore Privoxy's header time -# randomization and use the original values which could be used by -# the server as cookie replacement to track your steps between -# visits. -# -# Also specified here are SOCKS proxies. Privoxy supports the SOCKS -# 4 and SOCKS 4A protocols. -# -# -# 5.1. forward -# ============= -# -# Specifies: -# -# To which parent HTTP proxy specific requests should be routed. -# -# Type of value: -# -# target_pattern http_parent[:port] -# -# where target_pattern is a URL pattern that specifies to which -# requests (i.e. URLs) this forward rule shall apply. Use / to -# denote "all URLs". http_parent[:port] is the DNS name or IP -# address of the parent HTTP proxy through which the requests -# should be forwarded, optionally followed by its listening port -# (default: 8000). Use a single dot (.) to denote "no -# forwarding". -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# Don't use parent HTTP proxies. -# -# Notes: -# -# If http_parent is ".", then requests are not forwarded to -# another HTTP proxy but are made directly to the web servers. -# -# http_parent can be a numerical IPv6 address (if RFC 3493 is -# implemented). To prevent clashes with the port delimiter, the -# whole IP address has to be put into brackets. On the other -# hand a target_pattern containing an IPv6 address has to be put -# into angle brackets (normal brackets are reserved for regular -# expressions already). -# -# Multiple lines are OK, they are checked in sequence, and the -# last match wins. -# -# Examples: -# -# Everything goes to an example parent proxy, except SSL on port -# 443 (which it doesn't handle): -# -# forward / parent-proxy.example.org:8080 -# forward :443 . -# -# Everything goes to our example ISP's caching proxy, except for -# requests to that ISP's sites: -# -# forward / caching-proxy.isp.example.net:8000 -# forward .isp.example.net . -# -# Parent proxy specified by an IPv6 address: -# -# forward / [2001:DB8::1]:8000 -# -# Suppose your parent proxy doesn't support IPv6: -# -# forward / parent-proxy.example.org:8000 -# forward ipv6-server.example.org . -# forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> . -forward / 172.16.0.1:8080 -forward :443 . -# -# -# 5.2. forward-socks4, forward-socks4a, forward-socks5 and forward-socks5t -# ========================================================================= -# -# Specifies: -# -# Through which SOCKS proxy (and optionally to which parent HTTP -# proxy) specific requests should be routed. -# -# Type of value: -# -# target_pattern socks_proxy[:port] http_parent[:port] -# -# where target_pattern is a URL pattern that specifies to which -# requests (i.e. URLs) this forward rule shall apply. Use / to -# denote "all URLs". http_parent and socks_proxy are IP -# addresses in dotted decimal notation or valid DNS names ( -# http_parent may be "." to denote "no HTTP forwarding"), and -# the optional port parameters are TCP ports, i.e. integer -# values from 1 to 65535 -# -# Default value: -# -# Unset -# -# Effect if unset: -# -# Don't use SOCKS proxies. -# -# Notes: -# -# Multiple lines are OK, they are checked in sequence, and the -# last match wins. -# -# The difference between forward-socks4 and forward-socks4a is -# that in the SOCKS 4A protocol, the DNS resolution of the -# target hostname happens on the SOCKS server, while in SOCKS 4 -# it happens locally. -# -# With forward-socks5 the DNS resolution will happen on the -# remote server as well. -# -# forward-socks5t works like vanilla forward-socks5 but lets -# Privoxy additionally use Tor-specific SOCKS extensions. -# Currently the only supported SOCKS extension is optimistic -# data which can reduce the latency for the first request made -# on a newly created connection. -# -# socks_proxy and http_parent can be a numerical IPv6 address -# (if RFC 3493 is implemented). To prevent clashes with the port -# delimiter, the whole IP address has to be put into brackets. -# On the other hand a target_pattern containing an IPv6 address -# has to be put into angle brackets (normal brackets are -# reserved for regular expressions already). -# -# If http_parent is ".", then requests are not forwarded to -# another HTTP proxy but are made (HTTP-wise) directly to the -# web servers, albeit through a SOCKS proxy. -# -# Examples: -# -# From the company example.com, direct connections are made to -# all "internal" domains, but everything outbound goes through -# their ISP's proxy by way of example.com's corporate SOCKS 4A -# gateway to the Internet. -# -# forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080 -# forward .example.com . -# -# A rule that uses a SOCKS 4 gateway for all destinations but no -# HTTP parent looks like this: -# -# forward-socks4 / socks-gw.example.com:1080 . -# -# To chain Privoxy and Tor, both running on the same system, you -# would use something like: -# -# forward-socks5t / 127.0.0.1:9050 . -# -# Note that if you got Tor through one of the bundles, you may -# have to change the port from 9050 to 9150 (or even another -# one). For details, please check the documentation on the Tor -# website. -# -# The public Tor network can't be used to reach your local -# network, if you need to access local servers you therefore -# might want to make some exceptions: -# -# forward 192.168.*.*/ . -# forward 10.*.*.*/ . -# forward 127.*.*.*/ . -# -# Unencrypted connections to systems in these address ranges -# will be as (un)secure as the local network is, but the -# alternative is that you can't reach the local network through -# Privoxy at all. Of course this may actually be desired and -# there is no reason to make these exceptions if you aren't sure -# you need them. -# -# If you also want to be able to reach servers in your local -# network by using their names, you will need additional -# exceptions that look like this: -# -# forward localhost/ . -# -# -# 5.3. forwarded-connect-retries -# =============================== -# -# Specifies: -# -# How often Privoxy retries if a forwarded connection request -# fails. -# -# Type of value: -# -# Number of retries. -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Connections forwarded through other proxies are treated like -# direct connections and no retry attempts are made. -# -# Notes: -# -# forwarded-connect-retries is mainly interesting for socks4a -# connections, where Privoxy can't detect why the connections -# failed. The connection might have failed because of a DNS -# timeout in which case a retry makes sense, but it might also -# have failed because the server doesn't exist or isn't -# reachable. In this case the retry will just delay the -# appearance of Privoxy's error message. -# -# Note that in the context of this option, "forwarded -# connections" includes all connections that Privoxy forwards -# through other proxies. This option is not limited to the HTTP -# CONNECT method. -# -# Only use this option, if you are getting lots of -# forwarding-related error messages that go away when you try -# again manually. Start with a small value and check Privoxy's -# logfile from time to time, to see how many retries are usually -# needed. -# -# Examples: -# -# forwarded-connect-retries 1 -# -forwarded-connect-retries 0 -# -# 6. MISCELLANEOUS -# ================= -# -# 6.1. accept-intercepted-requests -# ================================= -# -# Specifies: -# -# Whether intercepted requests should be treated as valid. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Only proxy requests are accepted, intercepted requests are -# treated as invalid. -# -# Notes: -# -# If you don't trust your clients and want to force them to use -# Privoxy, enable this option and configure your packet filter -# to redirect outgoing HTTP connections into Privoxy. -# -# Note that intercepting encrypted connections (HTTPS) isn't -# supported. -# -# Make sure that Privoxy's own requests aren't redirected as -# well. Additionally take care that Privoxy can't intentionally -# connect to itself, otherwise you could run into redirection -# loops if Privoxy's listening port is reachable by the outside -# or an attacker has access to the pages you visit. -# -# Examples: -# -# accept-intercepted-requests 1 -# -accept-intercepted-requests 0 -# -# 6.2. allow-cgi-request-crunching -# ================================= -# -# Specifies: -# -# Whether requests to Privoxy's CGI pages can be blocked or -# redirected. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Privoxy ignores block and redirect actions for its CGI pages. -# -# Notes: -# -# By default Privoxy ignores block or redirect actions for its -# CGI pages. Intercepting these requests can be useful in -# multi-user setups to implement fine-grained access control, -# but it can also render the complete web interface useless and -# make debugging problems painful if done without care. -# -# Don't enable this option unless you're sure that you really -# need it. -# -# Examples: -# -# allow-cgi-request-crunching 1 -# -allow-cgi-request-crunching 0 -# -# 6.3. split-large-forms -# ======================= -# -# Specifies: -# -# Whether the CGI interface should stay compatible with broken -# HTTP clients. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# The CGI form generate long GET URLs. -# -# Notes: -# -# Privoxy's CGI forms can lead to rather long URLs. This isn't a -# problem as far as the HTTP standard is concerned, but it can -# confuse clients with arbitrary URL length limitations. -# -# Enabling split-large-forms causes Privoxy to divide big forms -# into smaller ones to keep the URL length down. It makes -# editing a lot less convenient and you can no longer submit all -# changes at once, but at least it works around this browser -# bug. -# -# If you don't notice any editing problems, there is no reason -# to enable this option, but if one of the submit buttons -# appears to be broken, you should give it a try. -# -# Examples: -# -# split-large-forms 1 -# -split-large-forms 0 -# -# 6.4. keep-alive-timeout -# ======================== -# -# Specifies: -# -# Number of seconds after which an open connection will no -# longer be reused. -# -# Type of value: -# -# Time in seconds. -# -# Default value: -# -# None -# -# Effect if unset: -# -# Connections are not kept alive. -# -# Notes: -# -# This option allows clients to keep the connection to Privoxy -# alive. If the server supports it, Privoxy will keep the -# connection to the server alive as well. Under certain -# circumstances this may result in speed-ups. -# -# By default, Privoxy will close the connection to the server if -# the client connection gets closed, or if the specified timeout -# has been reached without a new request coming in. This -# behaviour can be changed with the connection-sharing option. -# -# This option has no effect if Privoxy has been compiled without -# keep-alive support. -# -# Note that a timeout of five seconds as used in the default -# configuration file significantly decreases the number of -# connections that will be reused. The value is used because -# some browsers limit the number of connections they open to a -# single host and apply the same limit to proxies. This can -# result in a single website "grabbing" all the connections the -# browser allows, which means connections to other websites -# can't be opened until the connections currently in use time -# out. -# -# Several users have reported this as a Privoxy bug, so the -# default value has been reduced. Consider increasing it to 300 -# seconds or even more if you think your browser can handle it. -# If your browser appears to be hanging, it probably can't. -# -# Examples: -# -# keep-alive-timeout 300 -# -keep-alive-timeout 5 -# -# 6.5. tolerate-pipelining -# ========================= -# -# Specifies: -# -# Whether or not pipelined requests should be served. -# -# Type of value: -# -# 0 or 1. -# -# Default value: -# -# None -# -# Effect if unset: -# -# If Privoxy receives more than one request at once, it -# terminates the client connection after serving the first one. -# -# Notes: -# -# Privoxy currently doesn't pipeline outgoing requests, thus -# allowing pipelining on the client connection is not guaranteed -# to improve the performance. -# -# By default Privoxy tries to discourage clients from pipelining -# by discarding aggressively pipelined requests, which forces -# the client to resend them through a new connection. -# -# This option lets Privoxy tolerate pipelining. Whether or not -# that improves performance mainly depends on the client -# configuration. -# -# If you are seeing problems with pages not properly loading, -# disabling this option could work around the problem. -# -# Examples: -# -# tolerate-pipelining 1 -# -tolerate-pipelining 1 -# -# 6.6. default-server-timeout -# ============================ -# -# Specifies: -# -# Assumed server-side keep-alive timeout if not specified by the -# server. -# -# Type of value: -# -# Time in seconds. -# -# Default value: -# -# None -# -# Effect if unset: -# -# Connections for which the server didn't specify the keep-alive -# timeout are not reused. -# -# Notes: -# -# Enabling this option significantly increases the number of -# connections that are reused, provided the keep-alive-timeout -# option is also enabled. -# -# While it also increases the number of connections problems -# when Privoxy tries to reuse a connection that already has been -# closed on the server side, or is closed while Privoxy is -# trying to reuse it, this should only be a problem if it -# happens for the first request sent by the client. If it -# happens for requests on reused client connections, Privoxy -# will simply close the connection and the client is supposed to -# retry the request without bothering the user. -# -# Enabling this option is therefore only recommended if the -# connection-sharing option is disabled. -# -# It is an error to specify a value larger than the -# keep-alive-timeout value. -# -# This option has no effect if Privoxy has been compiled without -# keep-alive support. -# -# Examples: -# -# default-server-timeout 60 -# -#default-server-timeout 60 -# -# 6.7. connection-sharing -# ======================== -# -# Specifies: -# -# Whether or not outgoing connections that have been kept alive -# should be shared between different incoming connections. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# None -# -# Effect if unset: -# -# Connections are not shared. -# -# Notes: -# -# This option has no effect if Privoxy has been compiled without -# keep-alive support, or if it's disabled. -# -# Notes: -# -# Note that reusing connections doesn't necessary cause -# speedups. There are also a few privacy implications you should -# be aware of. -# -# If this option is effective, outgoing connections are shared -# between clients (if there are more than one) and closing the -# browser that initiated the outgoing connection does no longer -# affect the connection between Privoxy and the server unless -# the client's request hasn't been completed yet. -# -# If the outgoing connection is idle, it will not be closed -# until either Privoxy's or the server's timeout is reached. -# While it's open, the server knows that the system running -# Privoxy is still there. -# -# If there are more than one client (maybe even belonging to -# multiple users), they will be able to reuse each others -# connections. This is potentially dangerous in case of -# authentication schemes like NTLM where only the connection is -# authenticated, instead of requiring authentication for each -# request. -# -# If there is only a single client, and if said client can keep -# connections alive on its own, enabling this option has next to -# no effect. If the client doesn't support connection -# keep-alive, enabling this option may make sense as it allows -# Privoxy to keep outgoing connections alive even if the client -# itself doesn't support it. -# -# You should also be aware that enabling this option increases -# the likelihood of getting the "No server or forwarder data" -# error message, especially if you are using a slow connection -# to the Internet. -# -# This option should only be used by experienced users who -# understand the risks and can weight them against the benefits. -# -# Examples: -# -# connection-sharing 1 -# -#connection-sharing 1 -# -# 6.8. socket-timeout -# ==================== -# -# Specifies: -# -# Number of seconds after which a socket times out if no data is -# received. -# -# Type of value: -# -# Time in seconds. -# -# Default value: -# -# None -# -# Effect if unset: -# -# A default value of 300 seconds is used. -# -# Notes: -# -# The default is quite high and you probably want to reduce it. -# If you aren't using an occasionally slow proxy like Tor, -# reducing it to a few seconds should be fine. -# -# Examples: -# -# socket-timeout 300 -# -socket-timeout 300 -# -# 6.9. max-client-connections -# ============================ -# -# Specifies: -# -# Maximum number of client connections that will be served. -# -# Type of value: -# -# Positive number. -# -# Default value: -# -# 128 -# -# Effect if unset: -# -# Connections are served until a resource limit is reached. -# -# Notes: -# -# Privoxy creates one thread (or process) for every incoming -# client connection that isn't rejected based on the access -# control settings. -# -# If the system is powerful enough, Privoxy can theoretically -# deal with several hundred (or thousand) connections at the -# same time, but some operating systems enforce resource limits -# by shutting down offending processes and their default limits -# may be below the ones Privoxy would require under heavy load. -# -# Configuring Privoxy to enforce a connection limit below the -# thread or process limit used by the operating system makes -# sure this doesn't happen. Simply increasing the operating -# system's limit would work too, but if Privoxy isn't the only -# application running on the system, you may actually want to -# limit the resources used by Privoxy. -# -# If Privoxy is only used by a single trusted user, limiting the -# number of client connections is probably unnecessary. If there -# are multiple possibly untrusted users you probably still want -# to additionally use a packet filter to limit the maximal -# number of incoming connections per client. Otherwise a -# malicious user could intentionally create a high number of -# connections to prevent other users from using Privoxy. -# -# Obviously using this option only makes sense if you choose a -# limit below the one enforced by the operating system. -# -# One most POSIX-compliant systems Privoxy can't properly deal -# with more than FD_SETSIZE file descriptors at the same time -# and has to reject connections if the limit is reached. This -# will likely change in a future version, but currently this -# limit can't be increased without recompiling Privoxy with a -# different FD_SETSIZE limit. -# -# Examples: -# -# max-client-connections 256 -# -#max-client-connections 256 -# -# 6.10. handle-as-empty-doc-returns-ok -# ===================================== -# -# Specifies: -# -# The status code Privoxy returns for pages blocked with -# +handle-as-empty-document. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Privoxy returns a status 403(forbidden) for all blocked pages. -# -# Effect if set: -# -# Privoxy returns a status 200(OK) for pages blocked with -# +handle-as-empty-document and a status 403(Forbidden) for all -# other blocked pages. -# -# Notes: -# -# This directive was added as a work-around for Firefox bug -# 492459: "Websites are no longer rendered if SSL requests for -# JavaScripts are blocked by a proxy." -# (https://bugzilla.mozilla.org/show_bug.cgi?id=492459), the bug -# has been fixed for quite some time, but this directive is also -# useful to make it harder for websites to detect whether or not -# resources are being blocked. -# -#handle-as-empty-doc-returns-ok 1 -# -# 6.11. enable-compression -# ========================= -# -# Specifies: -# -# Whether or not buffered content is compressed before delivery. -# -# Type of value: -# -# 0 or 1 -# -# Default value: -# -# 0 -# -# Effect if unset: -# -# Privoxy does not compress buffered content. -# -# Effect if set: -# -# Privoxy compresses buffered content before delivering it to -# the client, provided the client supports it. -# -# Notes: -# -# This directive is only supported if Privoxy has been compiled -# with FEATURE_COMPRESSION, which should not to be confused with -# FEATURE_ZLIB. -# -# Compressing buffered content is mainly useful if Privoxy and -# the client are running on different systems. If they are -# running on the same system, enabling compression is likely to -# slow things down. If you didn't measure otherwise, you should -# assume that it does and keep this option disabled. -# -# Privoxy will not compress buffered content below a certain -# length. -# -#enable-compression 1 -# -# 6.12. compression-level -# ======================== -# -# Specifies: -# -# The compression level that is passed to the zlib library when -# compressing buffered content. -# -# Type of value: -# -# Positive number ranging from 0 to 9. -# -# Default value: -# -# 1 -# -# Notes: -# -# Compressing the data more takes usually longer than -# compressing it less or not compressing it at all. Which level -# is best depends on the connection between Privoxy and the -# client. If you can't be bothered to benchmark it for yourself, -# you should stick with the default and keep compression -# disabled. -# -# If compression is disabled, the compression level is -# irrelevant. -# -# Examples: -# -# # Best speed (compared to the other levels) -# compression-level 1 -# -# # Best compression -# compression-level 9 -# -# # No compression. Only useful for testing as the added header -# # slightly increases the amount of data that has to be sent. -# # If your benchmark shows that using this compression level -# # is superior to using no compression at all, the benchmark -# # is likely to be flawed. -# compression-level 0 -# -# -#compression-level 1 -# -# 6.13. client-header-order -# ========================== -# -# Specifies: -# -# The order in which client headers are sorted before forwarding -# them. -# -# Type of value: -# -# Client header names delimited by spaces or tabs -# -# Default value: -# -# None -# -# Notes: -# -# By default Privoxy leaves the client headers in the order they -# were sent by the client. Headers are modified in-place, new -# headers are added at the end of the already existing headers. -# -# The header order can be used to fingerprint client requests -# independently of other headers like the User-Agent. -# -# This directive allows to sort the headers differently to -# better mimic a different User-Agent. Client headers will be -# emitted in the order given, headers whose name isn't -# explicitly specified are added at the end. -# -# Note that sorting headers in an uncommon way will make -# fingerprinting actually easier. Encrypted headers are not -# affected by this directive. -# -#client-header-order Host \ -# Accept \ -# Accept-Language \ -# Accept-Encoding \ -# Proxy-Connection \ -# Referer \ -# Cookie \ -# DNT \ -# If-Modified-Since \ -# Cache-Control \ -# Content-Length \ -# Content-Type -# -# -# 7. WINDOWS GUI OPTIONS -# ======================= -# -# Privoxy has a number of options specific to the Windows GUI -# interface: -# -# -# -# If "activity-animation" is set to 1, the Privoxy icon will animate -# when "Privoxy" is active. To turn off, set to 0. -# -#activity-animation 1 -# -# -# -# If "log-messages" is set to 1, Privoxy copies log messages to the -# console window. The log detail depends on the debug directive. -# -#log-messages 1 -# -# -# -# If "log-buffer-size" is set to 1, the size of the log buffer, i.e. -# the amount of memory used for the log messages displayed in the -# console window, will be limited to "log-max-lines" (see below). -# -# Warning: Setting this to 0 will result in the buffer to grow -# infinitely and eat up all your memory! -# -#log-buffer-size 1 -# -# -# -# log-max-lines is the maximum number of lines held in the log -# buffer. See above. -# -#log-max-lines 200 -# -# -# -# If "log-highlight-messages" is set to 1, Privoxy will highlight -# portions of the log messages with a bold-faced font: -# -#log-highlight-messages 1 -# -# -# -# The font used in the console window: -# -#log-font-name Comic Sans MS -# -# -# -# Font size used in the console window: -# -#log-font-size 8 -# -# -# -# "show-on-task-bar" controls whether or not Privoxy will appear as -# a button on the Task bar when minimized: -# -#show-on-task-bar 0 -# -# -# -# If "close-button-minimizes" is set to 1, the Windows close button -# will minimize Privoxy instead of closing the program (close with -# the exit option on the File menu). -# -#close-button-minimizes 1 -# -# -# -# The "hide-console" option is specific to the MS-Win console -# version of Privoxy. If this option is used, Privoxy will -# disconnect from and hide the command console. -# -#hide-console -# -# -# diff --git a/templates/rsyslog.conf.j2 b/templates/rsyslog.conf.j2 deleted file mode 100644 index 2551380..0000000 --- a/templates/rsyslog.conf.j2 +++ /dev/null @@ -1,61 +0,0 @@ -# /etc/rsyslog.conf Configuration file for rsyslog. -# -# For more information see -# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html -# -# Default logging rules can be found in /etc/rsyslog.d/50-default.conf - -# -################# -#### MODULES #### -################# - -module(load="imuxsock") # provides support for local system logging -module(load="imklog") # provides kernel logging support -#module(load="immark") # provides --MARK-- message capability - -# provides UDP syslog reception -#module(load="imudp") -#input(type="imudp" port="514") - -# provides TCP syslog reception -#module(load="imtcp") -#input(type="imtcp" port="514") - -# Enable non-kernel facility klog messages -$KLogPermitNonKernelFacility on - -########################### -#### GLOBAL DIRECTIVES #### -########################### - -# -# Use traditional timestamp format. -# To enable high precision timestamps, comment out the following line. -# -$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat - -# Filter duplicated messages -$RepeatedMsgReduction on - -# -# Set the default permissions for all log files. -# -$FileOwner syslog -$FileGroup adm -$FileCreateMode 0640 -$DirCreateMode 0755 -$Umask 0022 -$PrivDropToUser syslog -$PrivDropToGroup syslog - -# -# Where to place spool and state files -# -$WorkDirectory /var/spool/rsyslog - -# -# Include all config files in /etc/rsyslog.d/ -# -$IncludeConfig /etc/rsyslog.d/*.conf - diff --git a/templates/usr.sbin.dnsmasq.j2 b/templates/usr.sbin.dnsmasq.j2 deleted file mode 100644 index 9b2c34b..0000000 --- a/templates/usr.sbin.dnsmasq.j2 +++ /dev/null @@ -1,68 +0,0 @@ -# ------------------------------------------------------------------ -# -# Copyright (C) 2009 John Dong -# Copyright (C) 2010 Canonical Ltd. -# -# This program is free software; you can redistribute it and/or -# modify it under the terms of version 2 of the GNU General Public -# License published by the Free Software Foundation. -# -# ------------------------------------------------------------------ - -@{TFTP_DIR}=/var/tftp /srv/tftpboot - -#include - -/usr/sbin/dnsmasq { - #include - #include - #include - - capability net_bind_service, - capability setgid, - capability setuid, - capability dac_override, - capability net_admin, # for DHCP server - capability net_raw, # for DHCP server ping checks - network inet raw, - - signal (receive) peer=/usr/sbin/libvirtd, - ptrace (readby) peer=/usr/sbin/libvirtd, - - /etc/dnsmasq.conf r, - /etc/dnsmasq.d/ r, - /etc/dnsmasq.d/* r, - /etc/ethers r, - /etc/NetworkManager/dnsmasq.d/ r, - /etc/NetworkManager/dnsmasq.d/* r, - /etc/block.hosts r, - - /usr/sbin/dnsmasq mr, - - /{,var/}run/*dnsmasq*.pid w, - /{,var/}run/dnsmasq-forwarders.conf r, - /{,var/}run/dnsmasq/ r, - /{,var/}run/dnsmasq/* rw, - - /var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage - - # for the read-only TFTP server - @{TFTP_DIR}/ r, - @{TFTP_DIR}/** r, - - # libvirt config, lease and hosts files for dnsmasq - /var/lib/libvirt/dnsmasq/ r, - /var/lib/libvirt/dnsmasq/* r, - /var/lib/libvirt/dnsmasq/*.leases rw, - - # libvirt pid files for dnsmasq - /{,var/}run/libvirt/network/ r, - /{,var/}run/libvirt/network/*.pid rw, - - # NetworkManager integration - /{,var/}run/nm-dns-dnsmasq.conf r, - /{,var/}run/sendsigs.omit.d/*dnsmasq.pid w, - /{,var/}run/NetworkManager/dnsmasq.conf r, - /{,var/}run/NetworkManager/dnsmasq.pid w, - -} diff --git a/templates/usr.sbin.privoxy.j2 b/templates/usr.sbin.privoxy.j2 deleted file mode 100644 index 5f8d9dd..0000000 --- a/templates/usr.sbin.privoxy.j2 +++ /dev/null @@ -1,15 +0,0 @@ -#include - -/usr/sbin/privoxy { - #include - #include - - capability setgid, - capability setuid, - - /etc/privoxy/* r, - /etc/privoxy/templates/* r, - /run/privoxy.pid w, - /var/log/privoxy/logfile w, - -} diff --git a/users.yml b/users.yml index f995cd4..e2060a4 100644 --- a/users.yml +++ b/users.yml @@ -82,7 +82,7 @@ register: PayloadContentCA - name: Build the mobileconfigs - template: src=mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600 + template: src=roles/vpn/templates/mobileconfig.j2 dest=/{{ easyrsa_dir }}/easyrsa3//pki/private/{{ item.0 }}.mobileconfig mode=0600 with_together: - "{{ users }}" - "{{ PayloadContent.results }}" From 7a8d58783f6e92adec7fc2e0f18d462d1f821c1a Mon Sep 17 00:00:00 2001 From: jack Date: Sun, 14 Aug 2016 20:03:33 +0300 Subject: [PATCH 7/7] Roles and Google cloud --- roles/common/templates/10periodic.j2 | 4 + .../common/templates/50unattended-upgrades.j2 | 59 + roles/digitalocean/templates/20-ipv6.cfg.j2 | 6 + roles/features/templates/000-default.conf.j2 | 11 + .../templates/10-loopback-services.cfg.j2 | 9 + roles/features/templates/adblock.sh | 50 + roles/features/templates/dnsmasq.conf.j2 | 669 ++++++ roles/features/templates/pagespeed.conf.j2 | 369 +++ roles/features/templates/ports.conf.j2 | 13 + roles/features/templates/privoxy_config.j2 | 2107 +++++++++++++++++ roles/features/templates/usr.sbin.dnsmasq.j2 | 68 + roles/features/templates/usr.sbin.privoxy.j2 | 15 + roles/logging/templates/audit.rules.j2 | 101 + roles/logging/templates/auditd.conf.j2 | 32 + roles/security/templates/CIS.conf.j2 | 15 + roles/security/templates/rsyslog.conf.j2 | 61 + roles/vpn/templates/easy-rsa.vars.j2 | 198 ++ roles/vpn/templates/ipsec.conf.j2 | 34 + roles/vpn/templates/ipsec.secrets.j2 | 2 + roles/vpn/templates/mobileconfig.j2 | 144 ++ 20 files changed, 3967 insertions(+) create mode 100644 roles/common/templates/10periodic.j2 create mode 100644 roles/common/templates/50unattended-upgrades.j2 create mode 100644 roles/digitalocean/templates/20-ipv6.cfg.j2 create mode 100644 roles/features/templates/000-default.conf.j2 create mode 100644 roles/features/templates/10-loopback-services.cfg.j2 create mode 100644 roles/features/templates/adblock.sh create mode 100644 roles/features/templates/dnsmasq.conf.j2 create mode 100644 roles/features/templates/pagespeed.conf.j2 create mode 100644 roles/features/templates/ports.conf.j2 create mode 100644 roles/features/templates/privoxy_config.j2 create mode 100644 roles/features/templates/usr.sbin.dnsmasq.j2 create mode 100644 roles/features/templates/usr.sbin.privoxy.j2 create mode 100644 roles/logging/templates/audit.rules.j2 create mode 100644 roles/logging/templates/auditd.conf.j2 create mode 100644 roles/security/templates/CIS.conf.j2 create mode 100644 roles/security/templates/rsyslog.conf.j2 create mode 100644 roles/vpn/templates/easy-rsa.vars.j2 create mode 100644 roles/vpn/templates/ipsec.conf.j2 create mode 100644 roles/vpn/templates/ipsec.secrets.j2 create mode 100644 roles/vpn/templates/mobileconfig.j2 diff --git a/roles/common/templates/10periodic.j2 b/roles/common/templates/10periodic.j2 new file mode 100644 index 0000000..7587020 --- /dev/null +++ b/roles/common/templates/10periodic.j2 @@ -0,0 +1,4 @@ +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Download-Upgradeable-Packages "1"; +APT::Periodic::AutocleanInterval "7"; +APT::Periodic::Unattended-Upgrade "1"; \ No newline at end of file diff --git a/roles/common/templates/50unattended-upgrades.j2 b/roles/common/templates/50unattended-upgrades.j2 new file mode 100644 index 0000000..5f8fb15 --- /dev/null +++ b/roles/common/templates/50unattended-upgrades.j2 @@ -0,0 +1,59 @@ +// Automatically upgrade packages from these (origin:archive) pairs +Unattended-Upgrade::Allowed-Origins { + "${distro_id}:${distro_codename}-security"; + "${distro_id}:${distro_codename}-updates"; +// "${distro_id}:${distro_codename}-proposed"; +// "${distro_id}:${distro_codename}-backports"; +}; + +// List of packages to not update (regexp are supported) +Unattended-Upgrade::Package-Blacklist { +// "vim"; +// "libc6"; +// "libc6-dev"; +// "libc6-i686"; +}; + +// This option allows you to control if on a unclean dpkg exit +// unattended-upgrades will automatically run +// dpkg --force-confold --configure -a +// The default is true, to ensure updates keep getting installed +//Unattended-Upgrade::AutoFixInterruptedDpkg "false"; + +// Split the upgrade into the smallest possible chunks so that +// they can be interrupted with SIGUSR1. This makes the upgrade +// a bit slower but it has the benefit that shutdown while a upgrade +// is running is possible (with a small delay) +//Unattended-Upgrade::MinimalSteps "true"; + +// Install all unattended-upgrades when the machine is shuting down +// instead of doing it in the background while the machine is running +// This will (obviously) make shutdown slower +//Unattended-Upgrade::InstallOnShutdown "true"; + +// Send email to this address for problems or packages upgrades +// If empty or unset then no email is sent, make sure that you +// have a working mail setup on your system. A package that provides +// 'mailx' must be installed. E.g. "user@example.com" +//Unattended-Upgrade::Mail "root"; + +// Set this value to "true" to get emails only on errors. Default +// is to always send a mail if Unattended-Upgrade::Mail is set +//Unattended-Upgrade::MailOnlyOnError "true"; + +// Do automatic removal of new unused dependencies after the upgrade +// (equivalent to apt-get autoremove) +//Unattended-Upgrade::Remove-Unused-Dependencies "false"; + +// Automatically reboot *WITHOUT CONFIRMATION* +// if the file /var/run/reboot-required is found after the upgrade +//Unattended-Upgrade::Automatic-Reboot "false"; + +// If automatic reboot is enabled and needed, reboot at the specific +// time instead of immediately +// Default: "now" +//Unattended-Upgrade::Automatic-Reboot-Time "02:00"; + +// Use apt bandwidth limit feature, this example limits the download +// speed to 70kb/sec +//Acquire::http::Dl-Limit "70"; diff --git a/roles/digitalocean/templates/20-ipv6.cfg.j2 b/roles/digitalocean/templates/20-ipv6.cfg.j2 new file mode 100644 index 0000000..7db27bb --- /dev/null +++ b/roles/digitalocean/templates/20-ipv6.cfg.j2 @@ -0,0 +1,6 @@ +iface eth0 inet6 static + address {{ item.ip_address }} + netmask {{ item.netmask }} + gateway {{ item.gateway }} + autoconf 0 + dns-nameservers 2001:4860:4860::8844 2001:4860:4860::8888 diff --git a/roles/features/templates/000-default.conf.j2 b/roles/features/templates/000-default.conf.j2 new file mode 100644 index 0000000..7aa917b --- /dev/null +++ b/roles/features/templates/000-default.conf.j2 @@ -0,0 +1,11 @@ + + + Order deny,allow + Allow from all + + RewriteEngine On + RewriteRule ^(.*)$ http://%{HTTP_HOST}$1 [NC,P] + ProxyPass / http://$1 + ProxyPassReverse / http://$1 + ProxyPreserveHost On + diff --git a/roles/features/templates/10-loopback-services.cfg.j2 b/roles/features/templates/10-loopback-services.cfg.j2 new file mode 100644 index 0000000..c5c47e4 --- /dev/null +++ b/roles/features/templates/10-loopback-services.cfg.j2 @@ -0,0 +1,9 @@ +auto lo:100 +iface lo:100 inet static + address 172.16.0.1 + netmask 255.255.255.255 + +iface lo:100 inet6 static + address FCAA::1 + netmask 64 + autoconf 0 diff --git a/roles/features/templates/adblock.sh b/roles/features/templates/adblock.sh new file mode 100644 index 0000000..a6a8858 --- /dev/null +++ b/roles/features/templates/adblock.sh @@ -0,0 +1,50 @@ +#!/bin/sh +#Block ads, malware, etc. + +# Redirect endpoint +ENDPOINT_IP4="0.0.0.0" +ENDPOINT_IP6="::" +IPV6="Y" + +#Delete the old block.hosts to make room for the updates +rm -f /etc/block.hosts + +echo 'Downloading hosts lists...' +#Download and process the files needed to make the lists (enable/add more, if you want) +wget -qO- http://www.mvps.org/winhelp2002/hosts.txt| awk -v r="$ENDPOINT_IP4" '{sub(/^0.0.0.0/, r)} $0 ~ "^"r' > /tmp/block.build.list +wget -qO- "http://adaway.org/hosts.txt"|awk -v r="$ENDPOINT_IP4" '{sub(/^127.0.0.1/, r)} $0 ~ "^"r' >> /tmp/block.build.list +wget -qO- http://www.malwaredomainlist.com/hostslist/hosts.txt|awk -v r="$ENDPOINT_IP4" '{sub(/^127.0.0.1/, r)} $0 ~ "^"r' >> /tmp/block.build.list +wget -qO- "http://hosts-file.net/.\ad_servers.txt"|awk -v r="$ENDPOINT_IP4" '{sub(/^127.0.0.1/, r)} $0 ~ "^"r' >> /tmp/block.build.list + +#Add black list, if non-empty +if [ -s "/etc/black.list" ] +then + echo 'Adding blacklist...' + awk -v r="$ENDPOINT_IP4" '/^[^#]/ { print r,$1 }' /etc/black.list >> /tmp/block.build.list +fi + +#Sort the download/black lists +awk '{sub(/\r$/,"");print $1,$2}' /tmp/block.build.list|sort -u > /tmp/block.build.before + +#Filter (if applicable) +if [ -s "/etc/white.list" ] +then + #Filter the blacklist, supressing whitelist matches + # This is relatively slow =-( + echo 'Filtering white list...' + egrep -v "^[[:space:]]*$" /etc/white.list | awk '/^[^#]/ {sub(/\r$/,"");print $1}' | grep -vf - /tmp/block.build.before > /etc/block.hosts +else + cat /tmp/block.build.before > /etc/block.hosts +fi + +if [ "$IPV6" = "Y" ] +then + safe_pattern=$(printf '%s\n' "$ENDPOINT_IP4" | sed 's/[[\.*^$(){}?+|/]/\\&/g') + safe_addition=$(printf '%s\n' "$ENDPOINT_IP6" | sed 's/[\&/]/\\&/g') + echo 'Adding ipv6 support...' + sed -i -re "s/^(${safe_pattern}) (.*)$/\1 \2\n${safe_addition} \2/g" /etc/block.hosts +fi + +service dnsmasq restart + +exit 0 diff --git a/roles/features/templates/dnsmasq.conf.j2 b/roles/features/templates/dnsmasq.conf.j2 new file mode 100644 index 0000000..d28cfac --- /dev/null +++ b/roles/features/templates/dnsmasq.conf.j2 @@ -0,0 +1,669 @@ +# Configuration file for dnsmasq. +# +# Format is one option per line, legal options are the same +# as the long options legal on the command line. See +# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details. + +# Listen on this specific port instead of the standard DNS port +# (53). Setting this to zero completely disables DNS function, +# leaving only DHCP and/or TFTP. +#port=5353 + +# The following two options make you a better netizen, since they +# tell dnsmasq to filter out queries which the public DNS cannot +# answer, and which load the servers (especially the root servers) +# unnecessarily. If you have a dial-on-demand link they also stop +# these requests from bringing up the link unnecessarily. + +# Never forward plain names (without a dot or domain part) +#domain-needed +# Never forward addresses in the non-routed address spaces. +#bogus-priv + +# Uncomment these to enable DNSSEC validation and caching: +# (Requires dnsmasq to be built with DNSSEC option.) +#conf-file=%%PREFIX%%/share/dnsmasq/trust-anchors.conf +#dnssec + +# Replies which are not DNSSEC signed may be legitimate, because the domain +# is unsigned, or may be forgeries. Setting this option tells dnsmasq to +# check that an unsigned reply is OK, by finding a secure proof that a DS +# record somewhere between the root and the domain does not exist. +# The cost of setting this is that even queries in unsigned domains will need +# one or more extra DNS queries to verify. +#dnssec-check-unsigned + +# Uncomment this to filter useless windows-originated DNS requests +# which can trigger dial-on-demand links needlessly. +# Note that (amongst other things) this blocks all SRV requests, +# so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk. +# This option only affects forwarding, SRV records originating for +# dnsmasq (via srv-host= lines) are not suppressed by it. +#filterwin2k + +# Change this line if you want dns to get its upstream servers from +# somewhere other that /etc/resolv.conf +#resolv-file= + +# By default, dnsmasq will send queries to any of the upstream +# servers it knows about and tries to favour servers to are known +# to be up. Uncommenting this forces dnsmasq to try each query +# with each server strictly in the order they appear in +# /etc/resolv.conf +#strict-order + +# If you don't want dnsmasq to read /etc/resolv.conf or any other +# file, getting its servers from this file instead (see below), then +# uncomment this. +#no-resolv + +# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv +# files for changes and re-read them then uncomment this. +#no-poll + +# Add other name servers here, with domain specs if they are for +# non-public domains. +#server=/localnet/192.168.0.1 + +# Example of routing PTR queries to nameservers: this will send all +# address->name queries for 192.168.3/24 to nameserver 10.1.2.3 +#server=/3.168.192.in-addr.arpa/10.1.2.3 + +# Add local-only domains here, queries in these domains are answered +# from /etc/hosts or DHCP only. +#local=/localnet/ + +# Add domains which you want to force to an IP address here. +# The example below send any host in double-click.net to a local +# web-server. +#address=/double-click.net/127.0.0.1 + +# --address (and --server) work with IPv6 addresses too. +#address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83 + +# Add the IPs of all queries to yahoo.com, google.com, and their +# subdomains to the vpn and search ipsets: +#ipset=/yahoo.com/google.com/vpn,search + +# You can control how dnsmasq talks to a server: this forces +# queries to 10.1.2.3 to be routed via eth1 +# server=10.1.2.3@eth1 +server=8.8.8.8 +server=8.8.4.4 + +# and this sets the source (ie local) address used to talk to +# 10.1.2.3 to 192.168.1.1 port 55 (there must be a interface with that +# IP on the machine, obviously). +# server=10.1.2.3@192.168.1.1#55 + +# If you want dnsmasq to change uid and gid to something other +# than the default, edit the following lines. +user=nobody +group=nogroup + +# If you want dnsmasq to listen for DHCP and DNS requests only on +# specified interfaces (and the loopback) give the name of the +# interface (eg eth0) here. +# Repeat the line for more than one interface. +#interface=lo +# Or you can specify which interface _not_ to listen on +#except-interface= +# Or which to listen on by address (remember to include 127.0.0.1 if +# you use this.) +listen-address=172.16.0.1,127.0.0.1,FCAA::1 +# If you want dnsmasq to provide only DNS service on an interface, +# configure it as shown above, and then use the following line to +# disable DHCP and TFTP on it. +#no-dhcp-interface= + +# On systems which support it, dnsmasq binds the wildcard address, +# even when it is listening on only some interfaces. It then discards +# requests that it shouldn't reply to. This has the advantage of +# working even when interfaces come and go and change address. If you +# want dnsmasq to really bind only the interfaces it is listening on, +# uncomment this option. About the only time you may need this is when +# running another nameserver on the same machine. +bind-interfaces + +# If you don't want dnsmasq to read /etc/hosts, uncomment the +# following line. +#no-hosts +# or if you want it to read another file, as well as /etc/hosts, use +# this. +addn-hosts=/etc/block.hosts + +# Set this (and domain: see below) if you want to have a domain +# automatically added to simple names in a hosts-file. +#expand-hosts + +# Set the domain for dnsmasq. this is optional, but if it is set, it +# does the following things. +# 1) Allows DHCP hosts to have fully qualified domain names, as long +# as the domain part matches this setting. +# 2) Sets the "domain" DHCP option thereby potentially setting the +# domain of all systems configured by DHCP +# 3) Provides the domain part for "expand-hosts" +#domain=thekelleys.org.uk + +# Set a different domain for a particular subnet +#domain=wireless.thekelleys.org.uk,192.168.2.0/24 + +# Same idea, but range rather then subnet +#domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200 + +# Uncomment this to enable the integrated DHCP server, you need +# to supply the range of addresses available for lease and optionally +# a lease time. If you have more than one network, you will need to +# repeat this for each network on which you want to supply DHCP +# service. +#dhcp-range=192.168.0.50,192.168.0.150,12h + +# This is an example of a DHCP range where the netmask is given. This +# is needed for networks we reach the dnsmasq DHCP server via a relay +# agent. If you don't know what a DHCP relay agent is, you probably +# don't need to worry about this. +#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h + +# This is an example of a DHCP range which sets a tag, so that +# some DHCP options may be set only for this network. +#dhcp-range=set:red,192.168.0.50,192.168.0.150 + +# Use this DHCP range only when the tag "green" is set. +#dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h + +# Specify a subnet which can't be used for dynamic address allocation, +# is available for hosts with matching --dhcp-host lines. Note that +# dhcp-host declarations will be ignored unless there is a dhcp-range +# of some type for the subnet in question. +# In this case the netmask is implied (it comes from the network +# configuration on the machine running dnsmasq) it is possible to give +# an explicit netmask instead. +#dhcp-range=192.168.0.0,static + +# Enable DHCPv6. Note that the prefix-length does not need to be specified +# and defaults to 64 if missing/ +#dhcp-range=1234::2, 1234::500, 64, 12h + +# Do Router Advertisements, BUT NOT DHCP for this subnet. +#dhcp-range=1234::, ra-only + +# Do Router Advertisements, BUT NOT DHCP for this subnet, also try and +# add names to the DNS for the IPv6 address of SLAAC-configured dual-stack +# hosts. Use the DHCPv4 lease to derive the name, network segment and +# MAC address and assume that the host will also have an +# IPv6 address calculated using the SLAAC alogrithm. +#dhcp-range=1234::, ra-names + +# Do Router Advertisements, BUT NOT DHCP for this subnet. +# Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.) +#dhcp-range=1234::, ra-only, 48h + +# Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA +# so that clients can use SLAAC addresses as well as DHCP ones. +#dhcp-range=1234::2, 1234::500, slaac + +# Do Router Advertisements and stateless DHCP for this subnet. Clients will +# not get addresses from DHCP, but they will get other configuration information. +# They will use SLAAC for addresses. +#dhcp-range=1234::, ra-stateless + +# Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses +# from DHCPv4 leases. +#dhcp-range=1234::, ra-stateless, ra-names + +# Do router advertisements for all subnets where we're doing DHCPv6 +# Unless overriden by ra-stateless, ra-names, et al, the router +# advertisements will have the M and O bits set, so that the clients +# get addresses and configuration from DHCPv6, and the A bit reset, so the +# clients don't use SLAAC addresses. +#enable-ra + +# Supply parameters for specified hosts using DHCP. There are lots +# of valid alternatives, so we will give examples of each. Note that +# IP addresses DO NOT have to be in the range given above, they just +# need to be on the same network. The order of the parameters in these +# do not matter, it's permissible to give name, address and MAC in any +# order. + +# Always allocate the host with Ethernet address 11:22:33:44:55:66 +# The IP address 192.168.0.60 +#dhcp-host=11:22:33:44:55:66,192.168.0.60 + +# Always set the name of the host with hardware address +# 11:22:33:44:55:66 to be "fred" +#dhcp-host=11:22:33:44:55:66,fred + +# Always give the host with Ethernet address 11:22:33:44:55:66 +# the name fred and IP address 192.168.0.60 and lease time 45 minutes +#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m + +# Give a host with Ethernet address 11:22:33:44:55:66 or +# 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume +# that these two Ethernet interfaces will never be in use at the same +# time, and give the IP address to the second, even if it is already +# in use by the first. Useful for laptops with wired and wireless +# addresses. +#dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60 + +# Give the machine which says its name is "bert" IP address +# 192.168.0.70 and an infinite lease +#dhcp-host=bert,192.168.0.70,infinite + +# Always give the host with client identifier 01:02:02:04 +# the IP address 192.168.0.60 +#dhcp-host=id:01:02:02:04,192.168.0.60 + +# Always give the Infiniband interface with hardware address +# 80:00:00:48:fe:80:00:00:00:00:00:00:f4:52:14:03:00:28:05:81 the +# ip address 192.168.0.61. The client id is derived from the prefix +# ff:00:00:00:00:00:02:00:00:02:c9:00 and the last 8 pairs of +# hex digits of the hardware address. +#dhcp-host=id:ff:00:00:00:00:00:02:00:00:02:c9:00:f4:52:14:03:00:28:05:81,192.168.0.61 + +# Always give the host with client identifier "marjorie" +# the IP address 192.168.0.60 +#dhcp-host=id:marjorie,192.168.0.60 + +# Enable the address given for "judge" in /etc/hosts +# to be given to a machine presenting the name "judge" when +# it asks for a DHCP lease. +#dhcp-host=judge + +# Never offer DHCP service to a machine whose Ethernet +# address is 11:22:33:44:55:66 +#dhcp-host=11:22:33:44:55:66,ignore + +# Ignore any client-id presented by the machine with Ethernet +# address 11:22:33:44:55:66. This is useful to prevent a machine +# being treated differently when running under different OS's or +# between PXE boot and OS boot. +#dhcp-host=11:22:33:44:55:66,id:* + +# Send extra options which are tagged as "red" to +# the machine with Ethernet address 11:22:33:44:55:66 +#dhcp-host=11:22:33:44:55:66,set:red + +# Send extra options which are tagged as "red" to +# any machine with Ethernet address starting 11:22:33: +#dhcp-host=11:22:33:*:*:*,set:red + +# Give a fixed IPv6 address and name to client with +# DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2 +# Note the MAC addresses CANNOT be used to identify DHCPv6 clients. +# Note also the they [] around the IPv6 address are obilgatory. +#dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5] + +# Ignore any clients which are not specified in dhcp-host lines +# or /etc/ethers. Equivalent to ISC "deny unknown-clients". +# This relies on the special "known" tag which is set when +# a host is matched. +#dhcp-ignore=tag:!known + +# Send extra options which are tagged as "red" to any machine whose +# DHCP vendorclass string includes the substring "Linux" +#dhcp-vendorclass=set:red,Linux + +# Send extra options which are tagged as "red" to any machine one +# of whose DHCP userclass strings includes the substring "accounts" +#dhcp-userclass=set:red,accounts + +# Send extra options which are tagged as "red" to any machine whose +# MAC address matches the pattern. +#dhcp-mac=set:red,00:60:8C:*:*:* + +# If this line is uncommented, dnsmasq will read /etc/ethers and act +# on the ethernet-address/IP pairs found there just as if they had +# been given as --dhcp-host options. Useful if you keep +# MAC-address/host mappings there for other purposes. +#read-ethers + +# Send options to hosts which ask for a DHCP lease. +# See RFC 2132 for details of available options. +# Common options can be given to dnsmasq by name: +# run "dnsmasq --help dhcp" to get a list. +# Note that all the common settings, such as netmask and +# broadcast address, DNS server and default route, are given +# sane defaults by dnsmasq. You very likely will not need +# any dhcp-options. If you use Windows clients and Samba, there +# are some options which are recommended, they are detailed at the +# end of this section. + +# Override the default route supplied by dnsmasq, which assumes the +# router is the same machine as the one running dnsmasq. +#dhcp-option=3,1.2.3.4 + +# Do the same thing, but using the option name +#dhcp-option=option:router,1.2.3.4 + +# Override the default route supplied by dnsmasq and send no default +# route at all. Note that this only works for the options sent by +# default (1, 3, 6, 12, 28) the same line will send a zero-length option +# for all other option numbers. +#dhcp-option=3 + +# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5 +#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5 + +# Send DHCPv6 option. Note [] around IPv6 addresses. +#dhcp-option=option6:dns-server,[1234::77],[1234::88] + +# Send DHCPv6 option for namservers as the machine running +# dnsmasq and another. +#dhcp-option=option6:dns-server,[::],[1234::88] + +# Ask client to poll for option changes every six hours. (RFC4242) +#dhcp-option=option6:information-refresh-time,6h + +# Set option 58 client renewal time (T1). Defaults to half of the +# lease time if not specified. (RFC2132) +#dhcp-option=option:T1:1m + +# Set option 59 rebinding time (T2). Defaults to 7/8 of the +# lease time if not specified. (RFC2132) +#dhcp-option=option:T2:2m + +# Set the NTP time server address to be the same machine as +# is running dnsmasq +#dhcp-option=42,0.0.0.0 + +# Set the NIS domain name to "welly" +#dhcp-option=40,welly + +# Set the default time-to-live to 50 +#dhcp-option=23,50 + +# Set the "all subnets are local" flag +#dhcp-option=27,1 + +# Send the etherboot magic flag and then etherboot options (a string). +#dhcp-option=128,e4:45:74:68:00:00 +#dhcp-option=129,NIC=eepro100 + +# Specify an option which will only be sent to the "red" network +# (see dhcp-range for the declaration of the "red" network) +# Note that the tag: part must precede the option: part. +#dhcp-option = tag:red, option:ntp-server, 192.168.1.1 + +# The following DHCP options set up dnsmasq in the same way as is specified +# for the ISC dhcpcd in +# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt +# adapted for a typical dnsmasq installation where the host running +# dnsmasq is also the host running samba. +# you may want to uncomment some or all of them if you use +# Windows clients and Samba. +#dhcp-option=19,0 # option ip-forwarding off +#dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s) +#dhcp-option=45,0.0.0.0 # netbios datagram distribution server +#dhcp-option=46,8 # netbios node type + +# Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave. +#dhcp-option=252,"\n" + +# Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client +# probably doesn't support this...... +#dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com + +# Send RFC-3442 classless static routes (note the netmask encoding) +#dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8 + +# Send vendor-class specific options encapsulated in DHCP option 43. +# The meaning of the options is defined by the vendor-class so +# options are sent only when the client supplied vendor class +# matches the class given here. (A substring match is OK, so "MSFT" +# matches "MSFT" and "MSFT 5.0"). This example sets the +# mtftp address to 0.0.0.0 for PXEClients. +#dhcp-option=vendor:PXEClient,1,0.0.0.0 + +# Send microsoft-specific option to tell windows to release the DHCP lease +# when it shuts down. Note the "i" flag, to tell dnsmasq to send the +# value as a four-byte integer - that's what microsoft wants. See +# http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true +#dhcp-option=vendor:MSFT,2,1i + +# Send the Encapsulated-vendor-class ID needed by some configurations of +# Etherboot to allow is to recognise the DHCP server. +#dhcp-option=vendor:Etherboot,60,"Etherboot" + +# Send options to PXELinux. Note that we need to send the options even +# though they don't appear in the parameter request list, so we need +# to use dhcp-option-force here. +# See http://syslinux.zytor.com/pxe.php#special for details. +# Magic number - needed before anything else is recognised +#dhcp-option-force=208,f1:00:74:7e +# Configuration file name +#dhcp-option-force=209,configs/common +# Path prefix +#dhcp-option-force=210,/tftpboot/pxelinux/files/ +# Reboot time. (Note 'i' to send 32-bit value) +#dhcp-option-force=211,30i + +# Set the boot filename for netboot/PXE. You will only need +# this is you want to boot machines over the network and you will need +# a TFTP server; either dnsmasq's built in TFTP server or an +# external one. (See below for how to enable the TFTP server.) +#dhcp-boot=pxelinux.0 + +# The same as above, but use custom tftp-server instead machine running dnsmasq +#dhcp-boot=pxelinux,server.name,192.168.1.100 + +# Boot for Etherboot gPXE. The idea is to send two different +# filenames, the first loads gPXE, and the second tells gPXE what to +# load. The dhcp-match sets the gpxe tag for requests from gPXE. +#dhcp-match=set:gpxe,175 # gPXE sends a 175 option. +#dhcp-boot=tag:!gpxe,undionly.kpxe +#dhcp-boot=mybootimage + +# Encapsulated options for Etherboot gPXE. All the options are +# encapsulated within option 175 +#dhcp-option=encap:175, 1, 5b # priority code +#dhcp-option=encap:175, 176, 1b # no-proxydhcp +#dhcp-option=encap:175, 177, string # bus-id +#dhcp-option=encap:175, 189, 1b # BIOS drive code +#dhcp-option=encap:175, 190, user # iSCSI username +#dhcp-option=encap:175, 191, pass # iSCSI password + +# Test for the architecture of a netboot client. PXE clients are +# supposed to send their architecture as option 93. (See RFC 4578) +#dhcp-match=peecees, option:client-arch, 0 #x86-32 +#dhcp-match=itanics, option:client-arch, 2 #IA64 +#dhcp-match=hammers, option:client-arch, 6 #x86-64 +#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64 + +# Do real PXE, rather than just booting a single file, this is an +# alternative to dhcp-boot. +#pxe-prompt="What system shall I netboot?" +# or with timeout before first available action is taken: +#pxe-prompt="Press F8 for menu.", 60 + +# Available boot services. for PXE. +#pxe-service=x86PC, "Boot from local disk" + +# Loads /pxelinux.0 from dnsmasq TFTP server. +#pxe-service=x86PC, "Install Linux", pxelinux + +# Loads /pxelinux.0 from TFTP server at 1.2.3.4. +# Beware this fails on old PXE ROMS. +#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4 + +# Use bootserver on network, found my multicast or broadcast. +#pxe-service=x86PC, "Install windows from RIS server", 1 + +# Use bootserver at a known IP address. +#pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4 + +# If you have multicast-FTP available, +# information for that can be passed in a similar way using options 1 +# to 5. See page 19 of +# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf + + +# Enable dnsmasq's built-in TFTP server +#enable-tftp + +# Set the root directory for files available via FTP. +#tftp-root=/var/ftpd + +# Do not abort if the tftp-root is unavailable +#tftp-no-fail + +# Make the TFTP server more secure: with this set, only files owned by +# the user dnsmasq is running as will be send over the net. +#tftp-secure + +# This option stops dnsmasq from negotiating a larger blocksize for TFTP +# transfers. It will slow things down, but may rescue some broken TFTP +# clients. +#tftp-no-blocksize + +# Set the boot file name only when the "red" tag is set. +#dhcp-boot=tag:red,pxelinux.red-net + +# An example of dhcp-boot with an external TFTP server: the name and IP +# address of the server are given after the filename. +# Can fail with old PXE ROMS. Overridden by --pxe-service. +#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3 + +# If there are multiple external tftp servers having a same name +# (using /etc/hosts) then that name can be specified as the +# tftp_servername (the third option to dhcp-boot) and in that +# case dnsmasq resolves this name and returns the resultant IP +# addresses in round robin fasion. This facility can be used to +# load balance the tftp load among a set of servers. +#dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name + +# Set the limit on DHCP leases, the default is 150 +#dhcp-lease-max=150 + +# The DHCP server needs somewhere on disk to keep its lease database. +# This defaults to a sane location, but if you want to change it, use +# the line below. +#dhcp-leasefile=/var/lib/misc/dnsmasq.leases + +# Set the DHCP server to authoritative mode. In this mode it will barge in +# and take over the lease for any client which broadcasts on the network, +# whether it has a record of the lease or not. This avoids long timeouts +# when a machine wakes up on a new network. DO NOT enable this if there's +# the slightest chance that you might end up accidentally configuring a DHCP +# server for your campus/company accidentally. The ISC server uses +# the same option, and this URL provides more information: +# http://www.isc.org/files/auth.html +#dhcp-authoritative + +# Run an executable when a DHCP lease is created or destroyed. +# The arguments sent to the script are "add" or "del", +# then the MAC address, the IP address and finally the hostname +# if there is one. +#dhcp-script=/bin/echo + +# Set the cachesize here. +#cache-size=150 + +# If you want to disable negative caching, uncomment this. +#no-negcache + +# Normally responses which come from /etc/hosts and the DHCP lease +# file have Time-To-Live set as zero, which conventionally means +# do not cache further. If you are happy to trade lower load on the +# server for potentially stale date, you can set a time-to-live (in +# seconds) here. +#local-ttl= + +# If you want dnsmasq to detect attempts by Verisign to send queries +# to unregistered .com and .net hosts to its sitefinder service and +# have dnsmasq instead return the correct NXDOMAIN response, uncomment +# this line. You can add similar lines to do the same for other +# registries which have implemented wildcard A records. +#bogus-nxdomain=64.94.110.11 + +# If you want to fix up DNS results from upstream servers, use the +# alias option. This only works for IPv4. +# This alias makes a result of 1.2.3.4 appear as 5.6.7.8 +#alias=1.2.3.4,5.6.7.8 +# and this maps 1.2.3.x to 5.6.7.x +#alias=1.2.3.0,5.6.7.0,255.255.255.0 +# and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40 +#alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0 + +# Change these lines if you want dnsmasq to serve MX records. + +# Return an MX record named "maildomain.com" with target +# servermachine.com and preference 50 +#mx-host=maildomain.com,servermachine.com,50 + +# Set the default target for MX records created using the localmx option. +#mx-target=servermachine.com + +# Return an MX record pointing to the mx-target for all local +# machines. +#localmx + +# Return an MX record pointing to itself for all local machines. +#selfmx + +# Change the following lines if you want dnsmasq to serve SRV +# records. These are useful if you want to serve ldap requests for +# Active Directory and other windows-originated DNS requests. +# See RFC 2782. +# You may add multiple srv-host lines. +# The fields are ,,,, +# If the domain part if missing from the name (so that is just has the +# service and protocol sections) then the domain given by the domain= +# config option is used. (Note that expand-hosts does not need to be +# set for this to work.) + +# A SRV record sending LDAP for the example.com domain to +# ldapserver.example.com port 389 +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389 + +# A SRV record sending LDAP for the example.com domain to +# ldapserver.example.com port 389 (using domain=) +#domain=example.com +#srv-host=_ldap._tcp,ldapserver.example.com,389 + +# Two SRV records for LDAP, each with different priorities +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1 +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2 + +# A SRV record indicating that there is no LDAP server for the domain +# example.com +#srv-host=_ldap._tcp.example.com + +# The following line shows how to make dnsmasq serve an arbitrary PTR +# record. This is useful for DNS-SD. (Note that the +# domain-name expansion done for SRV records _does_not +# occur for PTR records.) +#ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services" + +# Change the following lines to enable dnsmasq to serve TXT records. +# These are used for things like SPF and zeroconf. (Note that the +# domain-name expansion done for SRV records _does_not +# occur for TXT records.) + +#Example SPF. +#txt-record=example.com,"v=spf1 a -all" + +#Example zeroconf +#txt-record=_http._tcp.example.com,name=value,paper=A4 + +# Provide an alias for a "local" DNS name. Note that this _only_ works +# for targets which are names from DHCP or /etc/hosts. Give host +# "bert" another name, bertrand +#cname=bertand,bert + +# For debugging purposes, log each DNS query as it passes through +# dnsmasq. +#log-queries + +# Log lots of extra information about DHCP transactions. +#log-dhcp + +# Include another lot of configuration options. +#conf-file=/etc/dnsmasq.more.conf +#conf-dir=/etc/dnsmasq.d + +# Include all the files in a directory except those ending in .bak +#conf-dir=/etc/dnsmasq.d,.bak + +# Include all files in a directory which end in .conf +#conf-dir=/etc/dnsmasq.d/,*.conf +# diff --git a/roles/features/templates/pagespeed.conf.j2 b/roles/features/templates/pagespeed.conf.j2 new file mode 100644 index 0000000..3b89b75 --- /dev/null +++ b/roles/features/templates/pagespeed.conf.j2 @@ -0,0 +1,369 @@ + + # Turn on mod_pagespeed. To completely disable mod_pagespeed, you + # can set this to "off". + ModPagespeed on + + # We want VHosts to inherit global configuration. + # If this is not included, they'll be independent (except for inherently + # global options), at least for backwards compatibility. + ModPagespeedInheritVHostConfig on + + # Direct Apache to send all HTML output to the mod_pagespeed + # output handler. + AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html + + # If you want mod_pagespeed process XHTML as well, please uncomment this + # line. + # AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER application/xhtml+xml + + # The ModPagespeedFileCachePath directory must exist and be writable + # by the apache user (as specified by the User directive). + ModPagespeedFileCachePath "/var/cache/mod_pagespeed/" + + # LogDir is needed to store various logs, including the statistics log + # required for the console. + ModPagespeedLogDir "/var/log/pagespeed" + + # The locations of SSL Certificates is distribution-dependent. + ModPagespeedSslCertDirectory "/etc/ssl/certs" + + + # If you want, you can use one or more memcached servers as the store for + # the mod_pagespeed cache. + # ModPagespeedMemcachedServers localhost:11211 + + # A portion of the cache can be kept in memory only, to reduce load on disk + # (or memcached) from many small files. + # ModPagespeedCreateSharedMemoryMetadataCache "/var/cache/mod_pagespeed/" 51200 + + # Override the mod_pagespeed 'rewrite level'. The default level + # "CoreFilters" uses a set of rewrite filters that are generally + # safe for most web pages. Most sites should not need to change + # this value and can instead fine-tune the configuration using the + # ModPagespeedDisableFilters and ModPagespeedEnableFilters + # directives, below. Valid values for ModPagespeedRewriteLevel are + # PassThrough, CoreFilters and TestingCoreFilters. + # + ModPagespeedRewriteLevel CoreFilters + + ModPagespeedEnableFilters combine_heads + ModPagespeedEnableFilters combine_javascript + ModPagespeedEnableFilters convert_jpeg_to_webp + ModPagespeedEnableFilters convert_png_to_jpeg + ModPagespeedEnableFilters inline_preview_images + ModPagespeedEnableFilters make_google_analytics_async + ModPagespeedEnableFilters move_css_above_scripts + ModPagespeedEnableFilters move_css_to_head + ModPagespeedEnableFilters resize_mobile_images + ModPagespeedEnableFilters sprite_images + + ModPagespeedEnableFilters defer_iframe + ModPagespeedEnableFilters defer_javascript + ModPagespeedEnableFilters lazyload_images + + # Explicitly disables specific filters. This is useful in + # conjuction with ModPagespeedRewriteLevel. For instance, if one + # of the filters in the CoreFilters needs to be disabled for a + # site, that filter can be added to + # ModPagespeedDisableFilters. This directive contains a + # comma-separated list of filter names, and can be repeated. + # + # ModPagespeedDisableFilters rewrite_images + + # Explicitly enables specific filters. This is useful in + # conjuction with ModPagespeedRewriteLevel. For instance, filters + # not included in the CoreFilters may be enabled using this + # directive. This directive contains a comma-separated list of + # filter names, and can be repeated. + # + # ModPagespeedEnableFilters rewrite_javascript,rewrite_css + # ModPagespeedEnableFilters collapse_whitespace,elide_attributes + + # Explicitly forbids the enabling of specific filters using either query + # parameters or request headers. This is useful, for example, when we do + # not want the filter to run for performance or security reasons. This + # directive contains a comma-separated list of filter names, and can be + # repeated. + # + # ModPagespeedForbidFilters rewrite_images + + # How long mod_pagespeed will wait to return an optimized resource + # (per flush window) on first request before giving up and returning the + # original (unoptimized) resource. After this deadline is exceeded the + # original resource is returned and the optimization is pushed to the + # background to be completed for future requests. Increasing this value will + # increase page latency, but might reduce load time (for instance on a + # bandwidth-constrained link where it's worth waiting for image + # compression to complete). If the value is less than or equal to zero + # mod_pagespeed will wait indefinitely for the rewrite to complete before + # returning. + # + # ModPagespeedRewriteDeadlinePerFlushMs 10 + + # ModPagespeedDomain + # authorizes rewriting of JS, CSS, and Image files found in this + # domain. By default only resources with the same origin as the + # HTML file are rewritten. For example: + # + ModPagespeedDomain * + # + # This will allow resources found on http://cdn.myhost.com to be + # rewritten in addition to those in the same domain as the HTML. + # + # Other domain-related directives (like ModPagespeedMapRewriteDomain + # and ModPagespeedMapOriginDomain) can also authorize domains. + # + # Wildcards (* and ?) are allowed in the domain specification. Be + # careful when using them as if you rewrite domains that do not + # send you traffic, then the site receiving the traffic will not + # know how to serve the rewritten content. + + # If you use downstream caches such as varnish or proxy_cache for caching + # HTML, you can configure pagespeed to work with these caches correctly + # using the following directives. Note that the values for + # ModPagespeedDownstreamCachePurgeLocationPrefix and + # ModPagespeedDownstreamCacheRebeaconingKey are deliberately left empty here + # in order to force the webmaster to choose appropriate value for these. + # + # ModPagespeedDownstreamCachePurgeLocationPrefix + # ModPagespeedDownstreamCachePurgeMethod PURGE + # ModPagespeedDownstreamCacheRewrittenPercentageThreshold 95 + # ModPagespeedDownstreamCacheRebeaconingKey + + # Other defaults (cache sizes and thresholds): + # + # ModPagespeedFileCacheSizeKb 102400 + # ModPagespeedFileCacheCleanIntervalMs 3600000 + # ModPagespeedLRUCacheKbPerProcess 1024 + # ModPagespeedLRUCacheByteLimit 16384 + # ModPagespeedCssFlattenMaxBytes 102400 + # ModPagespeedCssInlineMaxBytes 2048 + # ModPagespeedCssImageInlineMaxBytes 0 + # ModPagespeedImageInlineMaxBytes 3072 + # ModPagespeedJsInlineMaxBytes 2048 + # ModPagespeedCssOutlineMinBytes 3000 + # ModPagespeedJsOutlineMinBytes 3000 + # ModPagespeedMaxCombinedCssBytes -1 + # ModPagespeedMaxCombinedJsBytes 92160 + + # Limit the number of inodes in the file cache. Set to 0 for no limit. + # The default value if this paramater is not specified is 0 (no limit). + ModPagespeedFileCacheInodeLimit 500000 + + # Bound the number of images that can be rewritten at any one time; this + # avoids overloading the CPU. Set this to 0 to remove the bound. + # + # ModPagespeedImageMaxRewritesAtOnce 8 + + # You can also customize the number of threads per Apache process + # mod_pagespeed will use to do resource optimization. Plain + # "rewrite threads" are used to do short, latency-sensitive work, + # while "expensive rewrite threads" are used for actual optimization + # work that's more computationally expensive. If you live these unset, + # or use values <= 0 the defaults will be used, which is 1 for both + # values when using non-threaded MPMs (e.g. prefork) and 4 for both + # on threaded MPMs (e.g. worker and event). These settings can only + # be changed globally, and not per virtual host. + # + # ModPagespeedNumRewriteThreads 4 + # ModPagespeedNumExpensiveRewriteThreads 4 + + # Randomly drop rewrites (*) to increase the chance of optimizing + # frequently fetched resources and decrease the chance of optimizing + # infrequently fetched resources. This can reduce CPU load. The default + # value of this parameter is 0 (no drops). 90 means that a resourced + # fetched once has a 10% probability of being optimized while a resource + # that is fetched 50 times has a 99.65% probability of being optimized. + # + # (*) Currently only CSS files and images are randomly dropped. Images + # within CSS files are not randomly dropped. + # + # ModPagespeedRewriteRandomDropPercentage 90 + + # Many filters modify the URLs of resources in HTML files. This is typically + # harmless but pages whose Javascript expects to read or modify the original + # URLs may break. The following parameters prevent filters from modifying + # URLs of their respective types. + # + # ModPagespeedJsPreserveURLs on + # ModPagespeedImagePreserveURLs on + # ModPagespeedCssPreserveURLs on + + # When PreserveURLs is on, it is still possible to enable browser-specific + # optimizations (for example, webp images can be served to browsers that + # will accept them). They'll be served with Vary: Accept or Vary: + # User-Agent headers as appropriate. Note that this may require configuring + # reverse proxy caches such as varnish to handle these headers properly. + # + # ModPagespeedFilters in_place_optimize_for_browser + + # Internet Explorer has difficulty caching resources with Vary: headers. + # They will either be uncached (older IE) or require revalidation. See: + # http://blogs.msdn.com/b/ieinternals/archive/2009/06/17/vary-header-prevents-caching-in-ie.aspx + # As a result we serve them as Cache-Control: private instead by default. + # If you are using a reverse proxy or CDN configured to cache content with + # the Vary: Accept header you should turn this setting off. + # + # ModPagespeedPrivateNotVaryForIE on + + # Settings for image optimization: + # + # Lossy image recompression quality (0 to 100, -1 just strips metadata): + # ModPagespeedImageRecompressionQuality 85 + # + # Jpeg recompression quality (0 to 100, -1 uses ImageRecompressionQuality): + # ModPagespeedJpegRecompressionQuality -1 + # ModPagespeedJpegRecompressionQualityForSmallScreens 70 + + ModPagespeedJpegRecompressionQuality 75 + + # + # WebP recompression quality (0 to 100, -1 uses ImageRecompressionQuality): + # ModPagespeedWebpRecompressionQuality 80 + # ModPagespeedWebpRecompressionQualityForSmallScreens 70 + # + # Timeout for conversions to WebP format, in + # milliseconds. Negative values mean no timeout is applied. The + # default value is -1: + # ModPagespeedWebpTimeoutMs 5000 + # + # Percent of original image size below which optimized images are retained: + # ModPagespeedImageLimitOptimizedPercent 100 + # + # Percent of original image area below which image resizing will be + # attempted: + # ModPagespeedImageLimitResizeAreaPercent 100 + + # Settings for inline preview images + # + # Setting this to n restricts preview images to the first n images found on + # the page. The default of -1 means preview images can appear anywhere on + # the page (if those images appear above the fold). + # ModPagespeedMaxInlinedPreviewImagesIndex -1 + + # Sets the minimum size in bytes of any image for which a low quality image + # is generated. + # ModPagespeedMinImageSizeLowResolutionBytes 3072 + + # The maximum URL size is generally limited to about 2k characters + # due to IE: See http://support.microsoft.com/kb/208427/EN-US. + # Apache servers by default impose a further limitation of about + # 250 characters per URL segment (text between slashes). + # mod_pagespeed circumvents this limitation, but if you employ + # proxy servers in your path you may need to re-impose it by + # overriding the setting here. The default setting is 1024 + # characters. + # + # ModPagespeedMaxSegmentLength 250 + + # Uncomment this if you want to prevent mod_pagespeed from combining files + # (e.g. CSS files) across paths + # + # ModPagespeedCombineAcrossPaths off + + # Renaming JavaScript URLs can sometimes break them. With this + # option enabled, mod_pagespeed uses a simple heuristic to decide + # not to rename JavaScript that it thinks is introspective. + # + # You can uncomment this to let mod_pagespeed rename all JS files. + # + # ModPagespeedAvoidRenamingIntrospectiveJavascript off + + # Certain common JavaScript libraries are available from Google, which acts + # as a CDN and allows you to benefit from browser caching if a new visitor + # to your site previously visited another site that makes use of the same + # libraries as you do. Enable the following filter to turn on this feature. + # + # ModPagespeedEnableFilters canonicalize_javascript_libraries + + # The following line configures a library that is recognized by + # canonicalize_javascript_libraries. This will have no effect unless you + # enable this filter (generally by uncommenting the last line in the + # previous stanza). The format is: + # ModPagespeedLibrary bytes md5 canonical_url + # Where bytes and md5 are with respect to the *minified* JS; use + # js_minify --print_size_and_hash to obtain this data. + # Note that we can register multiple hashes for the same canonical url; + # we do this if there are versions available that have already been minified + # with more sophisticated tools. + # + # Additional library configuration can be found in + # pagespeed_libraries.conf included in the distribution. You should add + # new entries here, though, so that file can be automatically upgraded. + # ModPagespeedLibrary 43 1o978_K0_LNE5_ystNklf http://www.modpagespeed.com/rewrite_javascript.js + + # Explicitly tell mod_pagespeed to load some resources from disk. + # This will speed up load time and update frequency. + # + # This should only be used for static resources which do not need + # specific headers set or other processing by Apache. + # + # Both URL and filesystem path should specify directories and + # filesystem path must be absolute (for now). + # + # ModPagespeedLoadFromFile "http://example.com/static/" "/var/www/static/" + + + # Enables server-side instrumentation and statistics. If this rewriter is + # enabled, then each rewritten HTML page will have instrumentation javacript + # added that sends latency beacons to /mod_pagespeed_beacon. These + # statistics can be accessed at /mod_pagespeed_statistics. You must also + # enable the mod_pagespeed_statistics and mod_pagespeed_beacon handlers + # below. + # + # ModPagespeedEnableFilters add_instrumentation + + # The add_instrumentation filter sends a beacon after the page onload + # handler is called. The user might navigate to a new URL before this. If + # you enable the following directive, the beacon is sent as part of an + # onbeforeunload handler, for pages where navigation happens before the + # onload event. + # + # ModPagespeedReportUnloadTime on + + # Uncomment the following line so that ModPagespeed will not cache or + # rewrite resources with Vary: in the header, e.g. Vary: User-Agent. + # Note that ModPagespeed always respects Vary: headers on html content. + # ModPagespeedRespectVary on + + # Uncomment the following line if you want to disable statistics entirely. + # + # ModPagespeedStatistics off + + # These handlers are central entry-points into the admin pages. + # By default, pagespeed_admin and pagespeed_global_admin present + # the same data, and differ only when + # ModPagespeedUsePerVHostStatistics is enabled. In that case, + # /pagespeed_global_admin sees aggregated data across all vhosts, + # and the /pagespeed_admin sees data only for a particular vhost. + # + # You may insert other "Allow from" lines to add hosts you want to + # allow to look at generated statistics. Another possibility is + # to comment out the "Order" and "Allow" options from the config + # file, to allow any client that can reach your server to access + # and change server state, such as statistics, caches, and + # messages. This might be appropriate in an experimental setup. + + Order allow,deny + Allow from localhost + Allow from 127.0.0.1 + SetHandler pagespeed_admin + + + Order allow,deny + Allow from localhost + Allow from 127.0.0.1 + SetHandler pagespeed_global_admin + + + # Enable logging of mod_pagespeed statistics, needed for the console. + ModPagespeedStatisticsLogging on + + # Page /mod_pagespeed_message lets you view the latest messages from + # mod_pagespeed, regardless of log-level in your httpd.conf + # ModPagespeedMessageBufferSize is the maximum number of bytes you would + # like to dump to your /mod_pagespeed_message page at one time, + # its default value is 100k bytes. + # Set it to 0 if you want to disable this feature. + ModPagespeedMessageBufferSize 100000 + diff --git a/roles/features/templates/ports.conf.j2 b/roles/features/templates/ports.conf.j2 new file mode 100644 index 0000000..2618436 --- /dev/null +++ b/roles/features/templates/ports.conf.j2 @@ -0,0 +1,13 @@ +# If you just change the port or add more ports here, you will likely also +# have to change the VirtualHost statement in +# /etc/apache2/sites-enabled/000-default.conf + +Listen 172.16.0.1:8080 + + + Listen 172.16.0.1:443 + + + + Listen 172.16.0.1:443 + diff --git a/roles/features/templates/privoxy_config.j2 b/roles/features/templates/privoxy_config.j2 new file mode 100644 index 0000000..dd55f0f --- /dev/null +++ b/roles/features/templates/privoxy_config.j2 @@ -0,0 +1,2107 @@ +# Sample Configuration File for Privoxy +# +# Id: config,v +# +# Copyright (C) 2001-2014 Privoxy Developers http://www.privoxy.org/ +# +#################################################################### +# # +# Table of Contents # +# # +# I. INTRODUCTION # +# II. FORMAT OF THE CONFIGURATION FILE # +# # +# 1. LOCAL SET-UP DOCUMENTATION # +# 2. CONFIGURATION AND LOG FILE LOCATIONS # +# 3. DEBUGGING # +# 4. ACCESS CONTROL AND SECURITY # +# 5. FORWARDING # +# 6. MISCELLANEOUS # +# 7. WINDOWS GUI OPTIONS # +# # +#################################################################### +# +# +# I. INTRODUCTION +# =============== +# +# This file holds Privoxy's main configuration. Privoxy detects +# configuration changes automatically, so you don't have to restart +# it unless you want to load a different configuration file. +# +# The configuration will be reloaded with the first request after +# the change was done, this request itself will still use the old +# configuration, though. In other words: it takes two requests +# before you see the result of your changes. Requests that are +# dropped due to ACL don't trigger reloads. +# +# When starting Privoxy on Unix systems, give the location of this +# file as last argument. On Windows systems, Privoxy will look for +# this file with the name 'config.txt' in the current working +# directory of the Privoxy process. +# +# +# II. FORMAT OF THE CONFIGURATION FILE +# ==================================== +# +# Configuration lines consist of an initial keyword followed by a +# list of values, all separated by whitespace (any number of spaces +# or tabs). For example, +# +# actionsfile default.action +# +# Indicates that the actionsfile is named 'default.action'. +# +# The '#' indicates a comment. Any part of a line following a '#' is +# ignored, except if the '#' is preceded by a '\'. +# +# Thus, by placing a # at the start of an existing configuration +# line, you can make it a comment and it will be treated as if it +# weren't there. This is called "commenting out" an option and can +# be useful. Removing the # again is called "uncommenting". +# +# Note that commenting out an option and leaving it at its default +# are two completely different things! Most options behave very +# differently when unset. See the "Effect if unset" explanation in +# each option's description for details. +# +# Long lines can be continued on the next line by using a `\' as the +# last character. +# +# +# 1. LOCAL SET-UP DOCUMENTATION +# ============================== +# +# If you intend to operate Privoxy for more users than just +# yourself, it might be a good idea to let them know how to reach +# you, what you block and why you do that, your policies, etc. +# +# +# 1.1. user-manual +# ================= +# +# Specifies: +# +# Location of the Privoxy User Manual. +# +# Type of value: +# +# A fully qualified URI +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# http://www.privoxy.org/version/user-manual/ will be used, +# where version is the Privoxy version. +# +# Notes: +# +# The User Manual URI is the single best source of information +# on Privoxy, and is used for help links from some of the +# internal CGI pages. The manual itself is normally packaged +# with the binary distributions, so you probably want to set +# this to a locally installed copy. +# +# Examples: +# +# The best all purpose solution is simply to put the full local +# PATH to where the User Manual is located: +# +# user-manual /usr/share/doc/privoxy/user-manual +# +# The User Manual is then available to anyone with access to +# Privoxy, by following the built-in URL: http:// +# config.privoxy.org/user-manual/ (or the shortcut: http://p.p/ +# user-manual/). +# +# If the documentation is not on the local system, it can be +# accessed from a remote server, as: +# +# user-manual http://example.com/privoxy/user-manual/ +# +# WARNING!!! +# +# If set, this option should be the first option in the +# config file, because it is used while the config file is +# being read. +# +user-manual /usr/share/doc/privoxy/user-manual +# +# 1.2. trust-info-url +# ==================== +# +# Specifies: +# +# A URL to be displayed in the error page that users will see if +# access to an untrusted page is denied. +# +# Type of value: +# +# URL +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# No links are displayed on the "untrusted" error page. +# +# Notes: +# +# The value of this option only matters if the experimental +# trust mechanism has been activated. (See trustfile below.) +# +# If you use the trust mechanism, it is a good idea to write up +# some on-line documentation about your trust policy and to +# specify the URL(s) here. Use multiple times for multiple URLs. +# +# The URL(s) should be added to the trustfile as well, so users +# don't end up locked out from the information on why they were +# locked out in the first place! +# +#trust-info-url http://www.example.com/why_we_block.html +#trust-info-url http://www.example.com/what_we_allow.html +# +# 1.3. admin-address +# =================== +# +# Specifies: +# +# An email address to reach the Privoxy administrator. +# +# Type of value: +# +# Email address +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# No email address is displayed on error pages and the CGI user +# interface. +# +# Notes: +# +# If both admin-address and proxy-info-url are unset, the whole +# "Local Privoxy Support" box on all generated pages will not be +# shown. +# +#admin-address privoxy-admin@example.com +# +# 1.4. proxy-info-url +# ==================== +# +# Specifies: +# +# A URL to documentation about the local Privoxy setup, +# configuration or policies. +# +# Type of value: +# +# URL +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# No link to local documentation is displayed on error pages and +# the CGI user interface. +# +# Notes: +# +# If both admin-address and proxy-info-url are unset, the whole +# "Local Privoxy Support" box on all generated pages will not be +# shown. +# +# This URL shouldn't be blocked ;-) +# +#proxy-info-url http://www.example.com/proxy-service.html +# +# 2. CONFIGURATION AND LOG FILE LOCATIONS +# ======================================== +# +# Privoxy can (and normally does) use a number of other files for +# additional configuration, help and logging. This section of the +# configuration file tells Privoxy where to find those other files. +# +# The user running Privoxy, must have read permission for all +# configuration files, and write permission to any files that would +# be modified, such as log files and actions files. +# +# +# 2.1. confdir +# ============= +# +# Specifies: +# +# The directory where the other configuration files are located. +# +# Type of value: +# +# Path name +# +# Default value: +# +# /etc/privoxy (Unix) or Privoxy installation dir (Windows) +# +# Effect if unset: +# +# Mandatory +# +# Notes: +# +# No trailing "/", please. +# +confdir /etc/privoxy +# +# 2.2. templdir +# ============== +# +# Specifies: +# +# An alternative directory where the templates are loaded from. +# +# Type of value: +# +# Path name +# +# Default value: +# +# unset +# +# Effect if unset: +# +# The templates are assumed to be located in confdir/template. +# +# Notes: +# +# Privoxy's original templates are usually overwritten with each +# update. Use this option to relocate customized templates that +# should be kept. As template variables might change between +# updates, you shouldn't expect templates to work with Privoxy +# releases other than the one they were part of, though. +# +#templdir . +# +# 2.3. temporary-directory +# ========================= +# +# Specifies: +# +# A directory where Privoxy can create temporary files. +# +# Type of value: +# +# Path name +# +# Default value: +# +# unset +# +# Effect if unset: +# +# No temporary files are created, external filters don't work. +# +# Notes: +# +# To execute external filters, Privoxy has to create temporary +# files. This directive specifies the directory the temporary +# files should be written to. +# +# It should be a directory only Privoxy (and trusted users) can +# access. +# +#temporary-directory . +# +# 2.4. logdir +# ============ +# +# Specifies: +# +# The directory where all logging takes place (i.e. where the +# logfile is located). +# +# Type of value: +# +# Path name +# +# Default value: +# +# /var/log/privoxy (Unix) or Privoxy installation dir (Windows) +# +# Effect if unset: +# +# Mandatory +# +# Notes: +# +# No trailing "/", please. +# +logdir /var/log/privoxy +# +# 2.5. actionsfile +# ================= +# +# Specifies: +# +# The actions file(s) to use +# +# Type of value: +# +# Complete file name, relative to confdir +# +# Default values: +# +# match-all.action # Actions that are applied to all sites and maybe overruled later on. +# +# default.action # Main actions file +# +# user.action # User customizations +# +# Effect if unset: +# +# No actions are taken at all. More or less neutral proxying. +# +# Notes: +# +# Multiple actionsfile lines are permitted, and are in fact +# recommended! +# +# The default values are default.action, which is the "main" +# actions file maintained by the developers, and user.action, +# where you can make your personal additions. +# +# Actions files contain all the per site and per URL +# configuration for ad blocking, cookie management, privacy +# considerations, etc. +# +actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on. +actionsfile default.action # Main actions file +actionsfile user.action # User customizations +# +# 2.6. filterfile +# ================ +# +# Specifies: +# +# The filter file(s) to use +# +# Type of value: +# +# File name, relative to confdir +# +# Default value: +# +# default.filter (Unix) or default.filter.txt (Windows) +# +# Effect if unset: +# +# No textual content filtering takes place, i.e. all +filter{name} +# actions in the actions files are turned neutral. +# +# Notes: +# +# Multiple filterfile lines are permitted. +# +# The filter files contain content modification rules that use +# regular expressions. These rules permit powerful changes on +# the content of Web pages, and optionally the headers as well, +# e.g., you could try to disable your favorite JavaScript +# annoyances, re-write the actual displayed text, or just have +# some fun playing buzzword bingo with web pages. +# +# The +filter{name} actions rely on the relevant filter (name) +# to be defined in a filter file! +# +# A pre-defined filter file called default.filter that contains +# a number of useful filters for common problems is included in +# the distribution. See the section on the filter action for a +# list. +# +# It is recommended to place any locally adapted filters into a +# separate file, such as user.filter. +# +filterfile default.filter +filterfile user.filter # User customizations +# +# 2.7. logfile +# ============= +# +# Specifies: +# +# The log file to use +# +# Type of value: +# +# File name, relative to logdir +# +# Default value: +# +# Unset (commented out). When activated: logfile (Unix) or +# privoxy.log (Windows). +# +# Effect if unset: +# +# No logfile is written. +# +# Notes: +# +# The logfile is where all logging and error messages are +# written. The level of detail and number of messages are set +# with the debug option (see below). The logfile can be useful +# for tracking down a problem with Privoxy (e.g., it's not +# blocking an ad you think it should block) and it can help you +# to monitor what your browser is doing. +# +# Depending on the debug options below, the logfile may be a +# privacy risk if third parties can get access to it. As most +# users will never look at it, Privoxy only logs fatal errors by +# default. +# +# For most troubleshooting purposes, you will have to change +# that, please refer to the debugging section for details. +# +# Any log files must be writable by whatever user Privoxy is +# being run as (on Unix, default user id is "privoxy"). +# +# To prevent the logfile from growing indefinitely, it is +# recommended to periodically rotate or shorten it. Many +# operating systems support log rotation out of the box, some +# require additional software to do it. For details, please +# refer to the documentation for your operating system. +# +logfile logfile +# +# 2.8. trustfile +# =============== +# +# Specifies: +# +# The name of the trust file to use +# +# Type of value: +# +# File name, relative to confdir +# +# Default value: +# +# Unset (commented out). When activated: trust (Unix) or +# trust.txt (Windows) +# +# Effect if unset: +# +# The entire trust mechanism is disabled. +# +# Notes: +# +# The trust mechanism is an experimental feature for building +# white-lists and should be used with care. It is NOT +# recommended for the casual user. +# +# If you specify a trust file, Privoxy will only allow access to +# sites that are specified in the trustfile. Sites can be listed +# in one of two ways: +# +# Prepending a ~ character limits access to this site only (and +# any sub-paths within this site), e.g. ~www.example.com allows +# access to ~www.example.com/features/news.html, etc. +# +# Or, you can designate sites as trusted referrers, by +# prepending the name with a + character. The effect is that +# access to untrusted sites will be granted -- but only if a +# link from this trusted referrer was used to get there. The +# link target will then be added to the "trustfile" so that +# future, direct accesses will be granted. Sites added via this +# mechanism do not become trusted referrers themselves (i.e. +# they are added with a ~ designation). There is a limit of 512 +# such entries, after which new entries will not be made. +# +# If you use the + operator in the trust file, it may grow +# considerably over time. +# +# It is recommended that Privoxy be compiled with the +# --disable-force, --disable-toggle and --disable-editor +# options, if this feature is to be used. +# +# Possible applications include limiting Internet access for +# children. +# +#trustfile trust +# +# 3. DEBUGGING +# ============= +# +# These options are mainly useful when tracing a problem. Note that +# you might also want to invoke Privoxy with the --no-daemon command +# line option when debugging. +# +# +# 3.1. debug +# =========== +# +# Specifies: +# +# Key values that determine what information gets logged. +# +# Type of value: +# +# Integer values +# +# Default value: +# +# 0 (i.e.: only fatal errors (that cause Privoxy to exit) are +# logged) +# +# Effect if unset: +# +# Default value is used (see above). +# +# Notes: +# +# The available debug levels are: +# +# debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. +# debug 2 # show each connection status +# debug 4 # show I/O status +# debug 8 # show header parsing +# debug 16 # log all data written to the network +# debug 32 # debug force feature +# debug 64 # debug regular expression filters +# debug 128 # debug redirects +# debug 256 # debug GIF de-animation +# debug 512 # Common Log Format +# debug 1024 # Log the destination for requests Privoxy didn't let through, and the reason why. +# debug 2048 # CGI user interface +# debug 4096 # Startup banner and warnings. +# debug 8192 # Non-fatal errors +# debug 32768 # log all data read from the network +# debug 65536 # Log the applying actions +# +# To select multiple debug levels, you can either add them or +# use multiple debug lines. +# +# A debug level of 1 is informative because it will show you +# each request as it happens. 1, 1024, 4096 and 8192 are +# recommended so that you will notice when things go wrong. The +# other levels are probably only of interest if you are hunting +# down a specific problem. They can produce a hell of an output +# (especially 16). +# +# If you are used to the more verbose settings, simply enable +# the debug lines below again. +# +# If you want to use pure CLF (Common Log Format), you should +# set "debug 512" ONLY and not enable anything else. +# +# Privoxy has a hard-coded limit for the length of log messages. +# If it's reached, messages are logged truncated and marked with +# "... [too long, truncated]". +# +# Please don't file any support requests without trying to +# reproduce the problem with increased debug level first. Once +# you read the log messages, you may even be able to solve the +# problem on your own. +# +#debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. +#debug 1024 # Actions that are applied to all sites and maybe overruled later on. +#debug 4096 # Startup banner and warnings +#debug 8192 # Non-fatal errors +# +# 3.2. single-threaded +# ===================== +# +# Specifies: +# +# Whether to run only one server thread. +# +# Type of value: +# +# 1 or 0 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Multi-threaded (or, where unavailable: forked) operation, i.e. +# the ability to serve multiple requests simultaneously. +# +# Notes: +# +# This option is only there for debugging purposes. It will +# drastically reduce performance. +# +#single-threaded 1 +# +# 3.3. hostname +# ============== +# +# Specifies: +# +# The hostname shown on the CGI pages. +# +# Type of value: +# +# Text +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# The hostname provided by the operating system is used. +# +# Notes: +# +# On some misconfigured systems resolving the hostname fails or +# takes too much time and slows Privoxy down. Setting a fixed +# hostname works around the problem. +# +# In other circumstances it might be desirable to show a +# hostname other than the one returned by the operating system. +# For example if the system has several different hostnames and +# you don't want to use the first one. +# +# Note that Privoxy does not validate the specified hostname +# value. +# +#hostname hostname.example.org +# +# 4. ACCESS CONTROL AND SECURITY +# =============================== +# +# This section of the config file controls the security-relevant +# aspects of Privoxy's configuration. +# +# +# 4.1. listen-address +# ==================== +# +# Specifies: +# +# The address and TCP port on which Privoxy will listen for +# client requests. +# +# Type of value: +# +# [IP-Address]:Port +# +# [Hostname]:Port +# +# Default value: +# +# 127.0.0.1:8118 +# +# Effect if unset: +# +# Bind to 127.0.0.1 (IPv4 localhost), port 8118. This is +# suitable and recommended for home users who run Privoxy on the +# same machine as their browser. +# +# Notes: +# +# You will need to configure your browser(s) to this proxy +# address and port. +# +# If you already have another service running on port 8118, or +# if you want to serve requests from other machines (e.g. on +# your local network) as well, you will need to override the +# default. +# +# You can use this statement multiple times to make Privoxy +# listen on more ports or more IP addresses. Suitable if your +# operating system does not support sharing IPv6 and IPv4 +# protocols on the same socket. +# +# If a hostname is used instead of an IP address, Privoxy will +# try to resolve it to an IP address and if there are multiple, +# use the first one returned. +# +# If the address for the hostname isn't already known on the +# system (for example because it's in /etc/hostname), this may +# result in DNS traffic. +# +# If the specified address isn't available on the system, or if +# the hostname can't be resolved, Privoxy will fail to start. +# +# IPv6 addresses containing colons have to be quoted by +# brackets. They can only be used if Privoxy has been compiled +# with IPv6 support. If you aren't sure if your version supports +# it, have a look at http://config.privoxy.org/show-status. +# +# Some operating systems will prefer IPv6 to IPv4 addresses even +# if the system has no IPv6 connectivity which is usually not +# expected by the user. Some even rely on DNS to resolve +# localhost which mean the "localhost" address used may not +# actually be local. +# +# It is therefore recommended to explicitly configure the +# intended IP address instead of relying on the operating +# system, unless there's a strong reason not to. +# +# If you leave out the address, Privoxy will bind to all IPv4 +# interfaces (addresses) on your machine and may become +# reachable from the Internet and/or the local network. Be aware +# that some GNU/Linux distributions modify that behaviour +# without updating the documentation. Check for non-standard +# patches if your Privoxy version behaves differently. +# +# If you configure Privoxy to be reachable from the network, +# consider using access control lists (ACL's, see below), and/or +# a firewall. +# +# If you open Privoxy to untrusted users, you will also want to +# make sure that the following actions are disabled: +# enable-edit-actions and enable-remote-toggle +# +# Example: +# +# Suppose you are running Privoxy on a machine which has the +# address 192.168.0.1 on your local private network +# (192.168.0.0) and has another outside connection with a +# different address. You want it to serve requests from inside +# only: +# +# listen-address 192.168.0.1:8118 +# +# Suppose you are running Privoxy on an IPv6-capable machine and +# you want it to listen on the IPv6 address of the loopback +# device: +# +# listen-address [::1]:8118 +# +# +listen-address 172.16.0.1:8118 +# +# 4.2. toggle +# ============ +# +# Specifies: +# +# Initial state of "toggle" status +# +# Type of value: +# +# 1 or 0 +# +# Default value: +# +# 1 +# +# Effect if unset: +# +# Act as if toggled on +# +# Notes: +# +# If set to 0, Privoxy will start in "toggled off" mode, i.e. +# mostly behave like a normal, content-neutral proxy with both +# ad blocking and content filtering disabled. See +# enable-remote-toggle below. +# +toggle 1 +# +# 4.3. enable-remote-toggle +# ========================== +# +# Specifies: +# +# Whether or not the web-based toggle feature may be used +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# The web-based toggle feature is disabled. +# +# Notes: +# +# When toggled off, Privoxy mostly acts like a normal, +# content-neutral proxy, i.e. doesn't block ads or filter +# content. +# +# Access to the toggle feature can not be controlled separately +# by "ACLs" or HTTP authentication, so that everybody who can +# access Privoxy (see "ACLs" and listen-address above) can +# toggle it for all users. So this option is not recommended for +# multi-user environments with untrusted users. +# +# Note that malicious client side code (e.g Java) is also +# capable of using this option. +# +# As a lot of Privoxy users don't read documentation, this +# feature is disabled by default. +# +# Note that you must have compiled Privoxy with support for this +# feature, otherwise this option has no effect. +# +enable-remote-toggle 0 +# +# 4.4. enable-remote-http-toggle +# =============================== +# +# Specifies: +# +# Whether or not Privoxy recognizes special HTTP headers to +# change its behaviour. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Privoxy ignores special HTTP headers. +# +# Notes: +# +# When toggled on, the client can change Privoxy's behaviour by +# setting special HTTP headers. Currently the only supported +# special header is "X-Filter: No", to disable filtering for the +# ongoing request, even if it is enabled in one of the action +# files. +# +# This feature is disabled by default. If you are using Privoxy +# in a environment with trusted clients, you may enable this +# feature at your discretion. Note that malicious client side +# code (e.g Java) is also capable of using this feature. +# +# This option will be removed in future releases as it has been +# obsoleted by the more general header taggers. +# +enable-remote-http-toggle 0 +# +# 4.5. enable-edit-actions +# ========================= +# +# Specifies: +# +# Whether or not the web-based actions file editor may be used +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# The web-based actions file editor is disabled. +# +# Notes: +# +# Access to the editor can not be controlled separately by +# "ACLs" or HTTP authentication, so that everybody who can +# access Privoxy (see "ACLs" and listen-address above) can +# modify its configuration for all users. +# +# This option is not recommended for environments with untrusted +# users and as a lot of Privoxy users don't read documentation, +# this feature is disabled by default. +# +# Note that malicious client side code (e.g Java) is also +# capable of using the actions editor and you shouldn't enable +# this options unless you understand the consequences and are +# sure your browser is configured correctly. +# +# Note that you must have compiled Privoxy with support for this +# feature, otherwise this option has no effect. +# +enable-edit-actions 0 +# +# 4.6. enforce-blocks +# ==================== +# +# Specifies: +# +# Whether the user is allowed to ignore blocks and can "go there +# anyway". +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Blocks are not enforced. +# +# Notes: +# +# Privoxy is mainly used to block and filter requests as a +# service to the user, for example to block ads and other junk +# that clogs the pipes. Privoxy's configuration isn't perfect +# and sometimes innocent pages are blocked. In this situation it +# makes sense to allow the user to enforce the request and have +# Privoxy ignore the block. +# +# In the default configuration Privoxy's "Blocked" page contains +# a "go there anyway" link to adds a special string (the force +# prefix) to the request URL. If that link is used, Privoxy will +# detect the force prefix, remove it again and let the request +# pass. +# +# Of course Privoxy can also be used to enforce a network +# policy. In that case the user obviously should not be able to +# bypass any blocks, and that's what the "enforce-blocks" option +# is for. If it's enabled, Privoxy hides the "go there anyway" +# link. If the user adds the force prefix by hand, it will not +# be accepted and the circumvention attempt is logged. +# +# Examples: +# +# enforce-blocks 1 +# +enforce-blocks 0 +# +# 4.7. ACLs: permit-access and deny-access +# ========================================= +# +# Specifies: +# +# Who can access what. +# +# Type of value: +# +# src_addr[:port][/src_masklen] [dst_addr[:port][/dst_masklen]] +# +# Where src_addr and dst_addr are IPv4 addresses in dotted +# decimal notation or valid DNS names, port is a port number, +# and src_masklen and dst_masklen are subnet masks in CIDR +# notation, i.e. integer values from 2 to 30 representing the +# length (in bits) of the network address. The masks and the +# whole destination part are optional. +# +# If your system implements RFC 3493, then src_addr and dst_addr +# can be IPv6 addresses delimeted by brackets, port can be a +# number or a service name, and src_masklen and dst_masklen can +# be a number from 0 to 128. +# +# Default value: +# +# Unset +# +# If no port is specified, any port will match. If no +# src_masklen or src_masklen is given, the complete IP address +# has to match (i.e. 32 bits for IPv4 and 128 bits for IPv6). +# +# Effect if unset: +# +# Don't restrict access further than implied by listen-address +# +# Notes: +# +# Access controls are included at the request of ISPs and +# systems administrators, and are not usually needed by +# individual users. For a typical home user, it will normally +# suffice to ensure that Privoxy only listens on the localhost +# (127.0.0.1) or internal (home) network address by means of the +# listen-address option. +# +# Please see the warnings in the FAQ that Privoxy is not +# intended to be a substitute for a firewall or to encourage +# anyone to defer addressing basic security weaknesses. +# +# Multiple ACL lines are OK. If any ACLs are specified, Privoxy +# only talks to IP addresses that match at least one +# permit-access line and don't match any subsequent deny-access +# line. In other words, the last match wins, with the default +# being deny-access. +# +# If Privoxy is using a forwarder (see forward below) for a +# particular destination URL, the dst_addr that is examined is +# the address of the forwarder and NOT the address of the +# ultimate target. This is necessary because it may be +# impossible for the local Privoxy to determine the IP address +# of the ultimate target (that's often what gateways are used +# for). +# +# You should prefer using IP addresses over DNS names, because +# the address lookups take time. All DNS names must resolve! You +# can not use domain patterns like "*.org" or partial domain +# names. If a DNS name resolves to multiple IP addresses, only +# the first one is used. +# +# Some systems allow IPv4 clients to connect to IPv6 server +# sockets. Then the client's IPv4 address will be translated by +# the system into IPv6 address space with special prefix +# ::ffff:0:0/96 (so called IPv4 mapped IPv6 address). Privoxy +# can handle it and maps such ACL addresses automatically. +# +# Denying access to particular sites by ACL may have undesired +# side effects if the site in question is hosted on a machine +# which also hosts other sites (most sites are). +# +# Examples: +# +# Explicitly define the default behavior if no ACL and +# listen-address are set: "localhost" is OK. The absence of a +# dst_addr implies that all destination addresses are OK: +# +# permit-access localhost +# +# Allow any host on the same class C subnet as www.privoxy.org +# access to nothing but www.example.com (or other domains hosted +# on the same system): +# +# permit-access www.privoxy.org/24 www.example.com/32 +# +# Allow access from any host on the 26-bit subnet 192.168.45.64 +# to anywhere, with the exception that 192.168.45.73 may not +# access the IP address behind www.dirty-stuff.example.com: +# +# permit-access 192.168.45.64/26 +# deny-access 192.168.45.73 www.dirty-stuff.example.com +# +# Allow access from the IPv4 network 192.0.2.0/24 even if +# listening on an IPv6 wild card address (not supported on all +# platforms): +# +# permit-access 192.0.2.0/24 +# +# This is equivalent to the following line even if listening on +# an IPv4 address (not supported on all platforms): +# +# permit-access [::ffff:192.0.2.0]/120 +# +# +# 4.8. buffer-limit +# ================== +# +# Specifies: +# +# Maximum size of the buffer for content filtering. +# +# Type of value: +# +# Size in Kbytes +# +# Default value: +# +# 4096 +# +# Effect if unset: +# +# Use a 4MB (4096 KB) limit. +# +# Notes: +# +# For content filtering, i.e. the +filter and +deanimate-gif +# actions, it is necessary that Privoxy buffers the entire +# document body. This can be potentially dangerous, since a +# server could just keep sending data indefinitely and wait for +# your RAM to exhaust -- with nasty consequences. Hence this +# option. +# +# When a document buffer size reaches the buffer-limit, it is +# flushed to the client unfiltered and no further attempt to +# filter the rest of the document is made. Remember that there +# may be multiple threads running, which might require up to +# buffer-limit Kbytes each, unless you have enabled +# "single-threaded" above. +# +buffer-limit 4096 +# +# 4.9. enable-proxy-authentication-forwarding +# ============================================ +# +# Specifies: +# +# Whether or not proxy authentication through Privoxy should +# work. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Proxy authentication headers are removed. +# +# Notes: +# +# Privoxy itself does not support proxy authentication, but can +# allow clients to authenticate against Privoxy's parent proxy. +# +# By default Privoxy (3.0.21 and later) don't do that and remove +# Proxy-Authorization headers in requests and Proxy-Authenticate +# headers in responses to make it harder for malicious sites to +# trick inexperienced users into providing login information. +# +# If this option is enabled the headers are forwarded. +# +# Enabling this option is not recommended if there is no parent +# proxy that requires authentication or if the local network +# between Privoxy and the parent proxy isn't trustworthy. If +# proxy authentication is only required for some requests, it is +# recommended to use a client header filter to remove the +# authentication headers for requests where they aren't needed. +# +enable-proxy-authentication-forwarding 0 +# +# 5. FORWARDING +# ============== +# +# This feature allows routing of HTTP requests through a chain of +# multiple proxies. +# +# Forwarding can be used to chain Privoxy with a caching proxy to +# speed up browsing. Using a parent proxy may also be necessary if +# the machine that Privoxy runs on has no direct Internet access. +# +# Note that parent proxies can severely decrease your privacy level. +# For example a parent proxy could add your IP address to the +# request headers and if it's a caching proxy it may add the "Etag" +# header to revalidation requests again, even though you configured +# Privoxy to remove it. It may also ignore Privoxy's header time +# randomization and use the original values which could be used by +# the server as cookie replacement to track your steps between +# visits. +# +# Also specified here are SOCKS proxies. Privoxy supports the SOCKS +# 4 and SOCKS 4A protocols. +# +# +# 5.1. forward +# ============= +# +# Specifies: +# +# To which parent HTTP proxy specific requests should be routed. +# +# Type of value: +# +# target_pattern http_parent[:port] +# +# where target_pattern is a URL pattern that specifies to which +# requests (i.e. URLs) this forward rule shall apply. Use / to +# denote "all URLs". http_parent[:port] is the DNS name or IP +# address of the parent HTTP proxy through which the requests +# should be forwarded, optionally followed by its listening port +# (default: 8000). Use a single dot (.) to denote "no +# forwarding". +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# Don't use parent HTTP proxies. +# +# Notes: +# +# If http_parent is ".", then requests are not forwarded to +# another HTTP proxy but are made directly to the web servers. +# +# http_parent can be a numerical IPv6 address (if RFC 3493 is +# implemented). To prevent clashes with the port delimiter, the +# whole IP address has to be put into brackets. On the other +# hand a target_pattern containing an IPv6 address has to be put +# into angle brackets (normal brackets are reserved for regular +# expressions already). +# +# Multiple lines are OK, they are checked in sequence, and the +# last match wins. +# +# Examples: +# +# Everything goes to an example parent proxy, except SSL on port +# 443 (which it doesn't handle): +# +# forward / parent-proxy.example.org:8080 +# forward :443 . +# +# Everything goes to our example ISP's caching proxy, except for +# requests to that ISP's sites: +# +# forward / caching-proxy.isp.example.net:8000 +# forward .isp.example.net . +# +# Parent proxy specified by an IPv6 address: +# +# forward / [2001:DB8::1]:8000 +# +# Suppose your parent proxy doesn't support IPv6: +# +# forward / parent-proxy.example.org:8000 +# forward ipv6-server.example.org . +# forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> . +forward / 172.16.0.1:8080 +forward :443 . +# +# +# 5.2. forward-socks4, forward-socks4a, forward-socks5 and forward-socks5t +# ========================================================================= +# +# Specifies: +# +# Through which SOCKS proxy (and optionally to which parent HTTP +# proxy) specific requests should be routed. +# +# Type of value: +# +# target_pattern socks_proxy[:port] http_parent[:port] +# +# where target_pattern is a URL pattern that specifies to which +# requests (i.e. URLs) this forward rule shall apply. Use / to +# denote "all URLs". http_parent and socks_proxy are IP +# addresses in dotted decimal notation or valid DNS names ( +# http_parent may be "." to denote "no HTTP forwarding"), and +# the optional port parameters are TCP ports, i.e. integer +# values from 1 to 65535 +# +# Default value: +# +# Unset +# +# Effect if unset: +# +# Don't use SOCKS proxies. +# +# Notes: +# +# Multiple lines are OK, they are checked in sequence, and the +# last match wins. +# +# The difference between forward-socks4 and forward-socks4a is +# that in the SOCKS 4A protocol, the DNS resolution of the +# target hostname happens on the SOCKS server, while in SOCKS 4 +# it happens locally. +# +# With forward-socks5 the DNS resolution will happen on the +# remote server as well. +# +# forward-socks5t works like vanilla forward-socks5 but lets +# Privoxy additionally use Tor-specific SOCKS extensions. +# Currently the only supported SOCKS extension is optimistic +# data which can reduce the latency for the first request made +# on a newly created connection. +# +# socks_proxy and http_parent can be a numerical IPv6 address +# (if RFC 3493 is implemented). To prevent clashes with the port +# delimiter, the whole IP address has to be put into brackets. +# On the other hand a target_pattern containing an IPv6 address +# has to be put into angle brackets (normal brackets are +# reserved for regular expressions already). +# +# If http_parent is ".", then requests are not forwarded to +# another HTTP proxy but are made (HTTP-wise) directly to the +# web servers, albeit through a SOCKS proxy. +# +# Examples: +# +# From the company example.com, direct connections are made to +# all "internal" domains, but everything outbound goes through +# their ISP's proxy by way of example.com's corporate SOCKS 4A +# gateway to the Internet. +# +# forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080 +# forward .example.com . +# +# A rule that uses a SOCKS 4 gateway for all destinations but no +# HTTP parent looks like this: +# +# forward-socks4 / socks-gw.example.com:1080 . +# +# To chain Privoxy and Tor, both running on the same system, you +# would use something like: +# +# forward-socks5t / 127.0.0.1:9050 . +# +# Note that if you got Tor through one of the bundles, you may +# have to change the port from 9050 to 9150 (or even another +# one). For details, please check the documentation on the Tor +# website. +# +# The public Tor network can't be used to reach your local +# network, if you need to access local servers you therefore +# might want to make some exceptions: +# +# forward 192.168.*.*/ . +# forward 10.*.*.*/ . +# forward 127.*.*.*/ . +# +# Unencrypted connections to systems in these address ranges +# will be as (un)secure as the local network is, but the +# alternative is that you can't reach the local network through +# Privoxy at all. Of course this may actually be desired and +# there is no reason to make these exceptions if you aren't sure +# you need them. +# +# If you also want to be able to reach servers in your local +# network by using their names, you will need additional +# exceptions that look like this: +# +# forward localhost/ . +# +# +# 5.3. forwarded-connect-retries +# =============================== +# +# Specifies: +# +# How often Privoxy retries if a forwarded connection request +# fails. +# +# Type of value: +# +# Number of retries. +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Connections forwarded through other proxies are treated like +# direct connections and no retry attempts are made. +# +# Notes: +# +# forwarded-connect-retries is mainly interesting for socks4a +# connections, where Privoxy can't detect why the connections +# failed. The connection might have failed because of a DNS +# timeout in which case a retry makes sense, but it might also +# have failed because the server doesn't exist or isn't +# reachable. In this case the retry will just delay the +# appearance of Privoxy's error message. +# +# Note that in the context of this option, "forwarded +# connections" includes all connections that Privoxy forwards +# through other proxies. This option is not limited to the HTTP +# CONNECT method. +# +# Only use this option, if you are getting lots of +# forwarding-related error messages that go away when you try +# again manually. Start with a small value and check Privoxy's +# logfile from time to time, to see how many retries are usually +# needed. +# +# Examples: +# +# forwarded-connect-retries 1 +# +forwarded-connect-retries 0 +# +# 6. MISCELLANEOUS +# ================= +# +# 6.1. accept-intercepted-requests +# ================================= +# +# Specifies: +# +# Whether intercepted requests should be treated as valid. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Only proxy requests are accepted, intercepted requests are +# treated as invalid. +# +# Notes: +# +# If you don't trust your clients and want to force them to use +# Privoxy, enable this option and configure your packet filter +# to redirect outgoing HTTP connections into Privoxy. +# +# Note that intercepting encrypted connections (HTTPS) isn't +# supported. +# +# Make sure that Privoxy's own requests aren't redirected as +# well. Additionally take care that Privoxy can't intentionally +# connect to itself, otherwise you could run into redirection +# loops if Privoxy's listening port is reachable by the outside +# or an attacker has access to the pages you visit. +# +# Examples: +# +# accept-intercepted-requests 1 +# +accept-intercepted-requests 0 +# +# 6.2. allow-cgi-request-crunching +# ================================= +# +# Specifies: +# +# Whether requests to Privoxy's CGI pages can be blocked or +# redirected. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Privoxy ignores block and redirect actions for its CGI pages. +# +# Notes: +# +# By default Privoxy ignores block or redirect actions for its +# CGI pages. Intercepting these requests can be useful in +# multi-user setups to implement fine-grained access control, +# but it can also render the complete web interface useless and +# make debugging problems painful if done without care. +# +# Don't enable this option unless you're sure that you really +# need it. +# +# Examples: +# +# allow-cgi-request-crunching 1 +# +allow-cgi-request-crunching 0 +# +# 6.3. split-large-forms +# ======================= +# +# Specifies: +# +# Whether the CGI interface should stay compatible with broken +# HTTP clients. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# The CGI form generate long GET URLs. +# +# Notes: +# +# Privoxy's CGI forms can lead to rather long URLs. This isn't a +# problem as far as the HTTP standard is concerned, but it can +# confuse clients with arbitrary URL length limitations. +# +# Enabling split-large-forms causes Privoxy to divide big forms +# into smaller ones to keep the URL length down. It makes +# editing a lot less convenient and you can no longer submit all +# changes at once, but at least it works around this browser +# bug. +# +# If you don't notice any editing problems, there is no reason +# to enable this option, but if one of the submit buttons +# appears to be broken, you should give it a try. +# +# Examples: +# +# split-large-forms 1 +# +split-large-forms 0 +# +# 6.4. keep-alive-timeout +# ======================== +# +# Specifies: +# +# Number of seconds after which an open connection will no +# longer be reused. +# +# Type of value: +# +# Time in seconds. +# +# Default value: +# +# None +# +# Effect if unset: +# +# Connections are not kept alive. +# +# Notes: +# +# This option allows clients to keep the connection to Privoxy +# alive. If the server supports it, Privoxy will keep the +# connection to the server alive as well. Under certain +# circumstances this may result in speed-ups. +# +# By default, Privoxy will close the connection to the server if +# the client connection gets closed, or if the specified timeout +# has been reached without a new request coming in. This +# behaviour can be changed with the connection-sharing option. +# +# This option has no effect if Privoxy has been compiled without +# keep-alive support. +# +# Note that a timeout of five seconds as used in the default +# configuration file significantly decreases the number of +# connections that will be reused. The value is used because +# some browsers limit the number of connections they open to a +# single host and apply the same limit to proxies. This can +# result in a single website "grabbing" all the connections the +# browser allows, which means connections to other websites +# can't be opened until the connections currently in use time +# out. +# +# Several users have reported this as a Privoxy bug, so the +# default value has been reduced. Consider increasing it to 300 +# seconds or even more if you think your browser can handle it. +# If your browser appears to be hanging, it probably can't. +# +# Examples: +# +# keep-alive-timeout 300 +# +keep-alive-timeout 5 +# +# 6.5. tolerate-pipelining +# ========================= +# +# Specifies: +# +# Whether or not pipelined requests should be served. +# +# Type of value: +# +# 0 or 1. +# +# Default value: +# +# None +# +# Effect if unset: +# +# If Privoxy receives more than one request at once, it +# terminates the client connection after serving the first one. +# +# Notes: +# +# Privoxy currently doesn't pipeline outgoing requests, thus +# allowing pipelining on the client connection is not guaranteed +# to improve the performance. +# +# By default Privoxy tries to discourage clients from pipelining +# by discarding aggressively pipelined requests, which forces +# the client to resend them through a new connection. +# +# This option lets Privoxy tolerate pipelining. Whether or not +# that improves performance mainly depends on the client +# configuration. +# +# If you are seeing problems with pages not properly loading, +# disabling this option could work around the problem. +# +# Examples: +# +# tolerate-pipelining 1 +# +tolerate-pipelining 1 +# +# 6.6. default-server-timeout +# ============================ +# +# Specifies: +# +# Assumed server-side keep-alive timeout if not specified by the +# server. +# +# Type of value: +# +# Time in seconds. +# +# Default value: +# +# None +# +# Effect if unset: +# +# Connections for which the server didn't specify the keep-alive +# timeout are not reused. +# +# Notes: +# +# Enabling this option significantly increases the number of +# connections that are reused, provided the keep-alive-timeout +# option is also enabled. +# +# While it also increases the number of connections problems +# when Privoxy tries to reuse a connection that already has been +# closed on the server side, or is closed while Privoxy is +# trying to reuse it, this should only be a problem if it +# happens for the first request sent by the client. If it +# happens for requests on reused client connections, Privoxy +# will simply close the connection and the client is supposed to +# retry the request without bothering the user. +# +# Enabling this option is therefore only recommended if the +# connection-sharing option is disabled. +# +# It is an error to specify a value larger than the +# keep-alive-timeout value. +# +# This option has no effect if Privoxy has been compiled without +# keep-alive support. +# +# Examples: +# +# default-server-timeout 60 +# +#default-server-timeout 60 +# +# 6.7. connection-sharing +# ======================== +# +# Specifies: +# +# Whether or not outgoing connections that have been kept alive +# should be shared between different incoming connections. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# None +# +# Effect if unset: +# +# Connections are not shared. +# +# Notes: +# +# This option has no effect if Privoxy has been compiled without +# keep-alive support, or if it's disabled. +# +# Notes: +# +# Note that reusing connections doesn't necessary cause +# speedups. There are also a few privacy implications you should +# be aware of. +# +# If this option is effective, outgoing connections are shared +# between clients (if there are more than one) and closing the +# browser that initiated the outgoing connection does no longer +# affect the connection between Privoxy and the server unless +# the client's request hasn't been completed yet. +# +# If the outgoing connection is idle, it will not be closed +# until either Privoxy's or the server's timeout is reached. +# While it's open, the server knows that the system running +# Privoxy is still there. +# +# If there are more than one client (maybe even belonging to +# multiple users), they will be able to reuse each others +# connections. This is potentially dangerous in case of +# authentication schemes like NTLM where only the connection is +# authenticated, instead of requiring authentication for each +# request. +# +# If there is only a single client, and if said client can keep +# connections alive on its own, enabling this option has next to +# no effect. If the client doesn't support connection +# keep-alive, enabling this option may make sense as it allows +# Privoxy to keep outgoing connections alive even if the client +# itself doesn't support it. +# +# You should also be aware that enabling this option increases +# the likelihood of getting the "No server or forwarder data" +# error message, especially if you are using a slow connection +# to the Internet. +# +# This option should only be used by experienced users who +# understand the risks and can weight them against the benefits. +# +# Examples: +# +# connection-sharing 1 +# +#connection-sharing 1 +# +# 6.8. socket-timeout +# ==================== +# +# Specifies: +# +# Number of seconds after which a socket times out if no data is +# received. +# +# Type of value: +# +# Time in seconds. +# +# Default value: +# +# None +# +# Effect if unset: +# +# A default value of 300 seconds is used. +# +# Notes: +# +# The default is quite high and you probably want to reduce it. +# If you aren't using an occasionally slow proxy like Tor, +# reducing it to a few seconds should be fine. +# +# Examples: +# +# socket-timeout 300 +# +socket-timeout 300 +# +# 6.9. max-client-connections +# ============================ +# +# Specifies: +# +# Maximum number of client connections that will be served. +# +# Type of value: +# +# Positive number. +# +# Default value: +# +# 128 +# +# Effect if unset: +# +# Connections are served until a resource limit is reached. +# +# Notes: +# +# Privoxy creates one thread (or process) for every incoming +# client connection that isn't rejected based on the access +# control settings. +# +# If the system is powerful enough, Privoxy can theoretically +# deal with several hundred (or thousand) connections at the +# same time, but some operating systems enforce resource limits +# by shutting down offending processes and their default limits +# may be below the ones Privoxy would require under heavy load. +# +# Configuring Privoxy to enforce a connection limit below the +# thread or process limit used by the operating system makes +# sure this doesn't happen. Simply increasing the operating +# system's limit would work too, but if Privoxy isn't the only +# application running on the system, you may actually want to +# limit the resources used by Privoxy. +# +# If Privoxy is only used by a single trusted user, limiting the +# number of client connections is probably unnecessary. If there +# are multiple possibly untrusted users you probably still want +# to additionally use a packet filter to limit the maximal +# number of incoming connections per client. Otherwise a +# malicious user could intentionally create a high number of +# connections to prevent other users from using Privoxy. +# +# Obviously using this option only makes sense if you choose a +# limit below the one enforced by the operating system. +# +# One most POSIX-compliant systems Privoxy can't properly deal +# with more than FD_SETSIZE file descriptors at the same time +# and has to reject connections if the limit is reached. This +# will likely change in a future version, but currently this +# limit can't be increased without recompiling Privoxy with a +# different FD_SETSIZE limit. +# +# Examples: +# +# max-client-connections 256 +# +#max-client-connections 256 +# +# 6.10. handle-as-empty-doc-returns-ok +# ===================================== +# +# Specifies: +# +# The status code Privoxy returns for pages blocked with +# +handle-as-empty-document. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Privoxy returns a status 403(forbidden) for all blocked pages. +# +# Effect if set: +# +# Privoxy returns a status 200(OK) for pages blocked with +# +handle-as-empty-document and a status 403(Forbidden) for all +# other blocked pages. +# +# Notes: +# +# This directive was added as a work-around for Firefox bug +# 492459: "Websites are no longer rendered if SSL requests for +# JavaScripts are blocked by a proxy." +# (https://bugzilla.mozilla.org/show_bug.cgi?id=492459), the bug +# has been fixed for quite some time, but this directive is also +# useful to make it harder for websites to detect whether or not +# resources are being blocked. +# +#handle-as-empty-doc-returns-ok 1 +# +# 6.11. enable-compression +# ========================= +# +# Specifies: +# +# Whether or not buffered content is compressed before delivery. +# +# Type of value: +# +# 0 or 1 +# +# Default value: +# +# 0 +# +# Effect if unset: +# +# Privoxy does not compress buffered content. +# +# Effect if set: +# +# Privoxy compresses buffered content before delivering it to +# the client, provided the client supports it. +# +# Notes: +# +# This directive is only supported if Privoxy has been compiled +# with FEATURE_COMPRESSION, which should not to be confused with +# FEATURE_ZLIB. +# +# Compressing buffered content is mainly useful if Privoxy and +# the client are running on different systems. If they are +# running on the same system, enabling compression is likely to +# slow things down. If you didn't measure otherwise, you should +# assume that it does and keep this option disabled. +# +# Privoxy will not compress buffered content below a certain +# length. +# +#enable-compression 1 +# +# 6.12. compression-level +# ======================== +# +# Specifies: +# +# The compression level that is passed to the zlib library when +# compressing buffered content. +# +# Type of value: +# +# Positive number ranging from 0 to 9. +# +# Default value: +# +# 1 +# +# Notes: +# +# Compressing the data more takes usually longer than +# compressing it less or not compressing it at all. Which level +# is best depends on the connection between Privoxy and the +# client. If you can't be bothered to benchmark it for yourself, +# you should stick with the default and keep compression +# disabled. +# +# If compression is disabled, the compression level is +# irrelevant. +# +# Examples: +# +# # Best speed (compared to the other levels) +# compression-level 1 +# +# # Best compression +# compression-level 9 +# +# # No compression. Only useful for testing as the added header +# # slightly increases the amount of data that has to be sent. +# # If your benchmark shows that using this compression level +# # is superior to using no compression at all, the benchmark +# # is likely to be flawed. +# compression-level 0 +# +# +#compression-level 1 +# +# 6.13. client-header-order +# ========================== +# +# Specifies: +# +# The order in which client headers are sorted before forwarding +# them. +# +# Type of value: +# +# Client header names delimited by spaces or tabs +# +# Default value: +# +# None +# +# Notes: +# +# By default Privoxy leaves the client headers in the order they +# were sent by the client. Headers are modified in-place, new +# headers are added at the end of the already existing headers. +# +# The header order can be used to fingerprint client requests +# independently of other headers like the User-Agent. +# +# This directive allows to sort the headers differently to +# better mimic a different User-Agent. Client headers will be +# emitted in the order given, headers whose name isn't +# explicitly specified are added at the end. +# +# Note that sorting headers in an uncommon way will make +# fingerprinting actually easier. Encrypted headers are not +# affected by this directive. +# +#client-header-order Host \ +# Accept \ +# Accept-Language \ +# Accept-Encoding \ +# Proxy-Connection \ +# Referer \ +# Cookie \ +# DNT \ +# If-Modified-Since \ +# Cache-Control \ +# Content-Length \ +# Content-Type +# +# +# 7. WINDOWS GUI OPTIONS +# ======================= +# +# Privoxy has a number of options specific to the Windows GUI +# interface: +# +# +# +# If "activity-animation" is set to 1, the Privoxy icon will animate +# when "Privoxy" is active. To turn off, set to 0. +# +#activity-animation 1 +# +# +# +# If "log-messages" is set to 1, Privoxy copies log messages to the +# console window. The log detail depends on the debug directive. +# +#log-messages 1 +# +# +# +# If "log-buffer-size" is set to 1, the size of the log buffer, i.e. +# the amount of memory used for the log messages displayed in the +# console window, will be limited to "log-max-lines" (see below). +# +# Warning: Setting this to 0 will result in the buffer to grow +# infinitely and eat up all your memory! +# +#log-buffer-size 1 +# +# +# +# log-max-lines is the maximum number of lines held in the log +# buffer. See above. +# +#log-max-lines 200 +# +# +# +# If "log-highlight-messages" is set to 1, Privoxy will highlight +# portions of the log messages with a bold-faced font: +# +#log-highlight-messages 1 +# +# +# +# The font used in the console window: +# +#log-font-name Comic Sans MS +# +# +# +# Font size used in the console window: +# +#log-font-size 8 +# +# +# +# "show-on-task-bar" controls whether or not Privoxy will appear as +# a button on the Task bar when minimized: +# +#show-on-task-bar 0 +# +# +# +# If "close-button-minimizes" is set to 1, the Windows close button +# will minimize Privoxy instead of closing the program (close with +# the exit option on the File menu). +# +#close-button-minimizes 1 +# +# +# +# The "hide-console" option is specific to the MS-Win console +# version of Privoxy. If this option is used, Privoxy will +# disconnect from and hide the command console. +# +#hide-console +# +# +# diff --git a/roles/features/templates/usr.sbin.dnsmasq.j2 b/roles/features/templates/usr.sbin.dnsmasq.j2 new file mode 100644 index 0000000..9b2c34b --- /dev/null +++ b/roles/features/templates/usr.sbin.dnsmasq.j2 @@ -0,0 +1,68 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2009 John Dong +# Copyright (C) 2010 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +@{TFTP_DIR}=/var/tftp /srv/tftpboot + +#include + +/usr/sbin/dnsmasq { + #include + #include + #include + + capability net_bind_service, + capability setgid, + capability setuid, + capability dac_override, + capability net_admin, # for DHCP server + capability net_raw, # for DHCP server ping checks + network inet raw, + + signal (receive) peer=/usr/sbin/libvirtd, + ptrace (readby) peer=/usr/sbin/libvirtd, + + /etc/dnsmasq.conf r, + /etc/dnsmasq.d/ r, + /etc/dnsmasq.d/* r, + /etc/ethers r, + /etc/NetworkManager/dnsmasq.d/ r, + /etc/NetworkManager/dnsmasq.d/* r, + /etc/block.hosts r, + + /usr/sbin/dnsmasq mr, + + /{,var/}run/*dnsmasq*.pid w, + /{,var/}run/dnsmasq-forwarders.conf r, + /{,var/}run/dnsmasq/ r, + /{,var/}run/dnsmasq/* rw, + + /var/lib/misc/dnsmasq.leases rw, # Required only for DHCP server usage + + # for the read-only TFTP server + @{TFTP_DIR}/ r, + @{TFTP_DIR}/** r, + + # libvirt config, lease and hosts files for dnsmasq + /var/lib/libvirt/dnsmasq/ r, + /var/lib/libvirt/dnsmasq/* r, + /var/lib/libvirt/dnsmasq/*.leases rw, + + # libvirt pid files for dnsmasq + /{,var/}run/libvirt/network/ r, + /{,var/}run/libvirt/network/*.pid rw, + + # NetworkManager integration + /{,var/}run/nm-dns-dnsmasq.conf r, + /{,var/}run/sendsigs.omit.d/*dnsmasq.pid w, + /{,var/}run/NetworkManager/dnsmasq.conf r, + /{,var/}run/NetworkManager/dnsmasq.pid w, + +} diff --git a/roles/features/templates/usr.sbin.privoxy.j2 b/roles/features/templates/usr.sbin.privoxy.j2 new file mode 100644 index 0000000..5f8d9dd --- /dev/null +++ b/roles/features/templates/usr.sbin.privoxy.j2 @@ -0,0 +1,15 @@ +#include + +/usr/sbin/privoxy { + #include + #include + + capability setgid, + capability setuid, + + /etc/privoxy/* r, + /etc/privoxy/templates/* r, + /run/privoxy.pid w, + /var/log/privoxy/logfile w, + +} diff --git a/roles/logging/templates/audit.rules.j2 b/roles/logging/templates/audit.rules.j2 new file mode 100644 index 0000000..3464e2a --- /dev/null +++ b/roles/logging/templates/audit.rules.j2 @@ -0,0 +1,101 @@ +# This file contains the auditctl rules that are loaded +# whenever the audit daemon is started via the initscripts. +# The rules are simply the parameters that would be passed +# to auditctl. +# +# First rule - delete all +-D + +# Increase the buffers to survive stress events. +# Make this bigger for busy systems +-b 320 + +# Feel free to add below this line. See auditctl man page + +# Record Events That Modify Date and Time Information +{% if ansible_architecture == "x86_64" %} +-a always,exit -F arch=b64 -S clock_settime -k time-change +-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change +{% endif %} +-a always,exit -F arch=b32 -S clock_settime -k time-change +-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change +-w /etc/localtime -p wa -k time-change + +# Record Events That Modify User/Group Information +-w /etc/group -p wa -k identity +-w /etc/passwd -p wa -k identity +-w /etc/gshadow -p wa -k identity +-w /etc/shadow -p wa -k identity +-w /etc/security/opasswd -p wa -k identity + +# Record Events That Modify the System's Network Environment +{% if ansible_architecture == "x86_64" %} +-a exit,always -F arch=b64 -S sethostname -S setdomainname -k system-locale +{% endif %} +-a exit,always -F arch=b32 -S sethostname -S setdomainname -k system-locale +-w /etc/issue -p wa -k system-locale +-w /etc/issue.net -p wa -k system-locale +-w /etc/hosts -p wa -k system-locale +-w /etc/network/interfaces -p wa -k system-locale + +# Collect Login and Logout Events +-w /var/log/faillog -p wa -k logins +-w /var/log/lastlog -p wa -k logins +-w /var/log/tallylog -p wa -k logins + +# Collect Session Initiation Information +-w /var/run/utmp -p wa -k session +-w /var/log/wtmp -p wa -k session +-w /var/log/btmp -p wa -k session + +# Collect Discretionary Access Control Permission Modification Events +{% if ansible_architecture == "x86_64" %} +-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod +{% endif %} +-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod + +# Collect Unsuccessful Unauthorized Access Attempts to Files +{% if ansible_architecture == "x86_64" %} +-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access +-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access +{% endif %} +-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access +-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access + +# Collect Use of Privileged Commands +{% if privileged_programs is defined and privileged_programs.stdout_lines|length > 0 %} +{{ privileged_programs.stdout }} +{% endif %} + +# Collect Successful File System Mounts +{% if ansible_architecture == "x86_64" %} +-a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295 -k mounts +{% endif %} +-a always,exit -F arch=b32 -S mount -F auid>=500 -F auid!=4294967295 -k mounts + +# Collect File Deletion Events by User +{% if ansible_architecture == "x86_64" %} +-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete +{% endif %} +-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete + +# Collect Changes to System Administration Scope +-w /etc/sudoers -p wa -k scope + +# Collect System Administrator Actions (sudolog) +-w /var/log/sudo.log -p wa -k actions + +# Collect Kernel Module Loading and Unloading +{% if ansible_architecture == "x86_64" %} +-a always,exit -F arch=b64 -S init_module -S delete_module -k modules +{% endif %} +-a always,exit -F arch=b32 -S init_module -S delete_module -k modules +-w /sbin/insmod -p x -k modules +-w /sbin/rmmod -p x -k modules +-w /sbin/modprobe -p x -k modules + +-e 2 diff --git a/roles/logging/templates/auditd.conf.j2 b/roles/logging/templates/auditd.conf.j2 new file mode 100644 index 0000000..24aac73 --- /dev/null +++ b/roles/logging/templates/auditd.conf.j2 @@ -0,0 +1,32 @@ +# +# This file controls the configuration of the audit daemon +# + +log_file = /var/log/audit/audit.log +log_format = RAW +log_group = root +priority_boost = 4 +flush = INCREMENTAL +freq = 20 +num_logs = 5 +disp_qos = lossy +dispatcher = /sbin/audispd +name_format = NONE +##name = mydomain +max_log_file = 10 +max_log_file_action = keep_logs +space_left = 75 +space_left_action = email +action_mail_acct = {{ auditd_action_mail_acct }} +admin_space_left = 50 +admin_space_left_action = email +disk_full_action = SUSPEND +disk_error_action = SUSPEND +##tcp_listen_port = +tcp_listen_queue = 5 +tcp_max_per_addr = 1 +##tcp_client_ports = 1024-65535 +tcp_client_max_idle = 0 +enable_krb5 = no +krb5_principal = auditd +##krb5_key_file = /etc/audit/audit.key \ No newline at end of file diff --git a/roles/security/templates/CIS.conf.j2 b/roles/security/templates/CIS.conf.j2 new file mode 100644 index 0000000..96b3a59 --- /dev/null +++ b/roles/security/templates/CIS.conf.j2 @@ -0,0 +1,15 @@ +*.emerg :omusrmsg:* +mail.* -/var/log/mail +mail.info -/var/log/mail.info +mail.warning -/var/log/mail.warn +mail.err /var/log/mail.err +news.crit -/var/log/news/news.crit +news.err -/var/log/news/news.err +news.notice -/var/log/news/news.notice +*.=warning;*.=err -/var/log/warn +*.crit /var/log/warn +*.*;mail.none;news.none -/var/log/messages +local0,local1.* -/var/log/localmessages +local2,local3.* -/var/log/localmessages +local4,local5.* -/var/log/localmessages +local6,local7.* -/var/log/localmessages \ No newline at end of file diff --git a/roles/security/templates/rsyslog.conf.j2 b/roles/security/templates/rsyslog.conf.j2 new file mode 100644 index 0000000..2551380 --- /dev/null +++ b/roles/security/templates/rsyslog.conf.j2 @@ -0,0 +1,61 @@ +# /etc/rsyslog.conf Configuration file for rsyslog. +# +# For more information see +# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html +# +# Default logging rules can be found in /etc/rsyslog.d/50-default.conf + +# +################# +#### MODULES #### +################# + +module(load="imuxsock") # provides support for local system logging +module(load="imklog") # provides kernel logging support +#module(load="immark") # provides --MARK-- message capability + +# provides UDP syslog reception +#module(load="imudp") +#input(type="imudp" port="514") + +# provides TCP syslog reception +#module(load="imtcp") +#input(type="imtcp" port="514") + +# Enable non-kernel facility klog messages +$KLogPermitNonKernelFacility on + +########################### +#### GLOBAL DIRECTIVES #### +########################### + +# +# Use traditional timestamp format. +# To enable high precision timestamps, comment out the following line. +# +$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat + +# Filter duplicated messages +$RepeatedMsgReduction on + +# +# Set the default permissions for all log files. +# +$FileOwner syslog +$FileGroup adm +$FileCreateMode 0640 +$DirCreateMode 0755 +$Umask 0022 +$PrivDropToUser syslog +$PrivDropToGroup syslog + +# +# Where to place spool and state files +# +$WorkDirectory /var/spool/rsyslog + +# +# Include all config files in /etc/rsyslog.d/ +# +$IncludeConfig /etc/rsyslog.d/*.conf + diff --git a/roles/vpn/templates/easy-rsa.vars.j2 b/roles/vpn/templates/easy-rsa.vars.j2 new file mode 100644 index 0000000..f46993f --- /dev/null +++ b/roles/vpn/templates/easy-rsa.vars.j2 @@ -0,0 +1,198 @@ +# Easy-RSA 3 parameter settings + +# NOTE: If you installed Easy-RSA from your distro's package manager, don't edit +# this file in place -- instead, you should copy the entire easy-rsa directory +# to another location so future upgrades don't wipe out your changes. + +# HOW TO USE THIS FILE +# +# vars.example contains built-in examples to Easy-RSA settings. You MUST name +# this file 'vars' if you want it to be used as a configuration file. If you do +# not, it WILL NOT be automatically read when you call easyrsa commands. +# +# It is not necessary to use this config file unless you wish to change +# operational defaults. These defaults should be fine for many uses without the +# need to copy and edit the 'vars' file. +# +# All of the editable settings are shown commented and start with the command +# 'set_var' -- this means any set_var command that is uncommented has been +# modified by the user. If you're happy with a default, there is no need to +# define the value to its default. + +# NOTES FOR WINDOWS USERS +# +# Paths for Windows *MUST* use forward slashes, or optionally double-esscaped +# backslashes (single forward slashes are recommended.) This means your path to +# the openssl binary might look like this: +# "C:/Program Files/OpenSSL-Win32/bin/openssl.exe" + +# A little housekeeping: DON'T EDIT THIS SECTION +# +# Easy-RSA 3.x doesn't source into the environment directly. +# Complain if a user tries to do this: +if [ -z "$EASYRSA_CALLER" ]; then + echo "You appear to be sourcing an Easy-RSA 'vars' file." >&2 + echo "This is no longer necessary and is disallowed. See the section called" >&2 + echo "'How to use this file' near the top comments for more details." >&2 + return 1 +fi + +# DO YOUR EDITS BELOW THIS POINT + +# This variable should point to the top level of the easy-rsa tree. By default, +# this is taken to be the directory you are currently in. + +set_var EASYRSA "{{ easyrsa_dir }}/easyrsa3/" + +# If your OpenSSL command is not in the system PATH, you will need to define the +# path to it here. Normally this means a full path to the executable, otherwise +# you could have left it undefined here and the shown default would be used. +# +# Windows users, remember to use paths with forward-slashes (or escaped +# back-slashes.) Windows users should declare the full path to the openssl +# binary here if it is not in their system PATH. + +#set_var EASYRSA_OPENSSL "openssl" +# +# This sample is in Windows syntax -- edit it for your path if not using PATH: +#set_var EASYRSA_OPENSSL "C:/Program Files/OpenSSL-Win32/bin/openssl.exe" + +# Edit this variable to point to your soon-to-be-created key directory. +# +# WARNING: init-pki will do a rm -rf on this directory so make sure you define +# it correctly! (Interactive mode will prompt before acting.) + +set_var EASYRSA_PKI "$EASYRSA/pki" + +# Define X509 DN mode. +# This is used to adjust what elements are included in the Subject field as the DN +# (this is the "Distinguished Name.") +# Note that in cn_only mode the Organizational fields further below aren't used. +# +# Choices are: +# cn_only - use just a CN value +# org - use the "traditional" Country/Province/City/Org/OU/email/CN format + +set_var EASYRSA_DN "cn_only" + +# Organizational fields (used with 'org' mode and ignored in 'cn_only' mode.) +# These are the default values for fields which will be placed in the +# certificate. Don't leave any of these fields blank, although interactively +# you may omit any specific field by typing the "." symbol (not valid for +# email.) + +#set_var EASYRSA_REQ_COUNTRY "US" +#set_var EASYRSA_REQ_PROVINCE "California" +#set_var EASYRSA_REQ_CITY "San Francisco" +#set_var EASYRSA_REQ_ORG "Copyleft Certificate Co" +#set_var EASYRSA_REQ_EMAIL "me@example.net" +#set_var EASYRSA_REQ_OU "My Organizational Unit" + +# Choose a size in bits for your keypairs. The recommended value is 2048. Using +# 2048-bit keys is considered more than sufficient for many years into the +# future. Larger keysizes will slow down TLS negotiation and make key/DH param +# generation take much longer. Values up to 4096 should be accepted by most +# software. Only used when the crypto alg is rsa (see below.) + +# set_var EASYRSA_KEY_SIZE 2048 + +# The default crypto mode is rsa; ec can enable elliptic curve support. +# Note that not all software supports ECC, so use care when enabling it. +# Choices for crypto alg are: (each in lower-case) +# * rsa +# * ec + +set_var EASYRSA_ALGO ec + +# Define the named curve, used in ec mode only: + +set_var EASYRSA_CURVE prime256v1 + +# In how many days should the root CA key expire? + +set_var EASYRSA_CA_EXPIRE {{ easyrsa_ca_expire }} + +# In how many days should certificates expire? + +set_var EASYRSA_CERT_EXPIRE {{ easyrsa_cert_expire }} + +# How many days until the next CRL publish date? Note that the CRL can still be +# parsed after this timeframe passes. It is only used for an expected next +# publication date. + +#set_var EASYRSA_CRL_DAYS 180 + +# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default +# is "no" to discourage use of deprecated extensions. If you require this +# feature to use with --ns-cert-type, set this to "yes" here. This support +# should be replaced with the more modern --remote-cert-tls feature. If you do +# not use --ns-cert-type in your configs, it is safe (and recommended) to leave +# this defined to "no". When set to "yes", server-signed certs get the +# nsCertType=server attribute, and also get any NS_COMMENT defined below in the +# nsComment field. + +#set_var EASYRSA_NS_SUPPORT "no" + +# When NS_SUPPORT is set to "yes", this field is added as the nsComment field. +# Set this blank to omit it. With NS_SUPPORT set to "no" this field is ignored. + +#set_var EASYRSA_NS_COMMENT "Easy-RSA Generated Certificate" + +# A temp file used to stage cert extensions during signing. The default should +# be fine for most users; however, some users might want an alternative under a +# RAM-based FS, such as /dev/shm or /tmp on some systems. + +#set_var EASYRSA_TEMP_FILE "$EASYRSA_PKI/extensions.temp" + +# !! +# NOTE: ADVANCED OPTIONS BELOW THIS POINT +# PLAY WITH THEM AT YOUR OWN RISK +# !! + +# Broken shell command aliases: If you have a largely broken shell that is +# missing any of these POSIX-required commands used by Easy-RSA, you will need +# to define an alias to the proper path for the command. The symptom will be +# some form of a 'command not found' error from your shell. This means your +# shell is BROKEN, but you can hack around it here if you really need. These +# shown values are not defaults: it is up to you to know what you're doing if +# you touch these. +# +#alias awk="/alt/bin/awk" +#alias cat="/alt/bin/cat" + +# X509 extensions directory: +# If you want to customize the X509 extensions used, set the directory to look +# for extensions here. Each cert type you sign must have a matching filename, +# and an optional file named 'COMMON' is included first when present. Note that +# when undefined here, default behaviour is to look in $EASYRSA_PKI first, then +# fallback to $EASYRSA for the 'x509-types' dir. You may override this +# detection with an explicit dir here. +# +#set_var EASYRSA_EXT_DIR "$EASYRSA/x509-types" + +# OpenSSL config file: +# If you need to use a specific openssl config file, you can reference it here. +# Normally this file is auto-detected from a file named openssl-1.0.cnf from the +# EASYRSA_PKI or EASYRSA dir (in that order.) NOTE that this file is Easy-RSA +# specific and you cannot just use a standard config file, so this is an +# advanced feature. + +set_var EASYRSA_SSL_CONF "$EASYRSA/openssl-1.0.cnf" + +# Default CN: +# This is best left alone. Interactively you will set this manually, and BATCH +# callers are expected to set this themselves. + +set_var EASYRSA_REQ_CN "{{ ansible_ssh_host }}" + +# Cryptographic digest to use. +# Do not change this default unless you understand the security implications. +# Valid choices include: md5, sha1, sha256, sha224, sha384, sha512 + +#set_var EASYRSA_DIGEST "sha256" + +# Batch mode. Leave this disabled unless you intend to call Easy-RSA explicitly +# in batch mode without any user input, confirmation on dangerous operations, +# or most output. Setting this to any non-blank string enables batch mode. + +set_var EASYRSA_BATCH "{{ ansible_ssh_host }}" diff --git a/roles/vpn/templates/ipsec.conf.j2 b/roles/vpn/templates/ipsec.conf.j2 new file mode 100644 index 0000000..8bb6181 --- /dev/null +++ b/roles/vpn/templates/ipsec.conf.j2 @@ -0,0 +1,34 @@ +config setup + uniqueids = never # allow multiple connections per user + charondebug="ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2, mgr 2" + +conn %default + dpdaction=clear + dpddelay=35s + dpdtimeout=300s + rekey=no + keyexchange=ikev2 + ike=aes128gcm16-sha2_256-prfsha256-ecp256! + esp=aes128gcm16-sha2_256-ecp256! + compress=yes + fragmentation=yes + + left=%any + leftauth=pubkey + leftid={{ ansible_ssh_host }} + leftcert={{ ansible_ssh_host }}.crt + leftsendcert=always + leftsubnet=0.0.0.0/0,::/0 + + right=%any + rightauth=pubkey + rightsourceip={{ vpn_network }},{{ vpn_network_ipv6 }} +{% if service_dns is defined and service_dns == "N" %} + rightdns={% for host in dns_servers %}{{ host }}{% if not loop.last %},{% endif %}{% endfor %} +{% else %} + rightdns=172.16.0.1 +{% endif %} + + +conn ikev2-pubkey + auto=add diff --git a/roles/vpn/templates/ipsec.secrets.j2 b/roles/vpn/templates/ipsec.secrets.j2 new file mode 100644 index 0000000..cc208a5 --- /dev/null +++ b/roles/vpn/templates/ipsec.secrets.j2 @@ -0,0 +1,2 @@ +: ECDSA {{ ansible_ssh_host }}.key + diff --git a/roles/vpn/templates/mobileconfig.j2 b/roles/vpn/templates/mobileconfig.j2 new file mode 100644 index 0000000..d1a235c --- /dev/null +++ b/roles/vpn/templates/mobileconfig.j2 @@ -0,0 +1,144 @@ + + + + + PayloadContent + + + IKEv2 + + AuthenticationMethod + Certificate + ChildSecurityAssociationParameters + + DiffieHellmanGroup + 19 + EncryptionAlgorithm + AES-128-GCM + IntegrityAlgorithm + SHA2-256 + LifeTimeInMinutes + 1440 + + DeadPeerDetectionRate + Medium + DisableMOBIKE + 0 + DisableRedirect + 0 + EnableCertificateRevocationCheck + 0 + EnablePFS + + IKESecurityAssociationParameters + + DiffieHellmanGroup + 19 + EncryptionAlgorithm + AES-128-GCM + IntegrityAlgorithm + SHA2-256 + LifeTimeInMinutes + 1440 + + LocalIdentifier + {{ item.0 }} + PayloadCertificateUUID + 1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 + CertificateType + ECDSA256 + ServerCertificateIssuerCommonName + {{ ansible_ssh_host }} + RemoteAddress + {{ ansible_ssh_host }} + RemoteIdentifier + {{ ansible_ssh_host }} + UseConfigurationAttributeInternalIPSubnet + 0 + + IPv4 + + OverridePrimary + 1 + + PayloadDescription + Configures VPN settings + PayloadDisplayName + VPN + PayloadIdentifier + com.apple.vpn.managed.D247A30B-6023-4C8E-B3E3-FF1910A65E53 + PayloadType + com.apple.vpn.managed + PayloadUUID + D247A30B-6023-4C8E-B3E3-FF1910A65E53 + PayloadVersion + 1 + Proxies + + HTTPEnable + 0 + HTTPSEnable + 0 + + UserDefinedName + {{ ansible_ssh_host }} IKEv2 + VPNType + IKEv2 + + + Password + {{ easyrsa_p12_export_password }} + PayloadCertificateFileName + {{ item.0 }}.p12 + PayloadContent + + {{ item.1.stdout }} + + PayloadDescription + Adds a PKCS#12-formatted certificate + PayloadDisplayName + {{ item.0 }}.p12 + PayloadIdentifier + com.apple.security.pkcs12.1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 + PayloadType + com.apple.security.pkcs12 + PayloadUUID + 1FB2907D-14D3-4BAB-A472-B304F4B7F7D9 + PayloadVersion + 1 + + + PayloadCertificateFileName + ca.crt + PayloadContent + + {{ PayloadContentCA.stdout }} + + PayloadDescription + Adds a CA root certificate + PayloadDisplayName + {{ ansible_ssh_host }} + PayloadIdentifier + com.apple.security.root.32EA3AAA-D19E-43EF-B357-608218745A38 + PayloadType + com.apple.security.root + PayloadUUID + 32EA3AAA-D19E-43EF-B357-608218745A38 + PayloadVersion + 1 + + + PayloadDisplayName + {{ ansible_ssh_host }} IKEv2 + PayloadIdentifier + donut.local.37CA79B1-FC6A-421F-960A-90F91FC983BE + PayloadRemovalDisallowed + + PayloadType + Configuration + PayloadUUID + 743B04A8-5725-45A2-B1BB-836F8C16DB0A + PayloadVersion + 1 + +