wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-04-16 22:27:20 +02:00
Code Issues Projects Releases Wiki Activity

WireGuard BSD (#1083)

Browse source 
* WireGuard BSD

* Remove unneeded config option

* Enable PersistentKeepalive for NAT and Firewall Traversal Persistence

* Install dnscrypt-proxy from repositories
This commit is contained in:
Jack Ivanov 2018-09-27 11:18:12 +03:00 • committed by Dan Guido
parent 6c0753e3b8
commit dbd68aa97d
16 changed files with 123 additions and 130 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
cloud.yml
View file

@ -1,7 +1,7 @@
---
- name: Provision the server
hosts: localhost
tags: algo
tags: always
vars_files:
- config.cfg

2
input.yml
View file

@ -1,7 +1,7 @@
---
- name: Ask user for the input
hosts: localhost
tags: algo
tags: always
vars:
defaults:
server_name: algo

4
roles/common/tasks/facts.yml
View file

@ -23,4 +23,8 @@
- set_fact:
CA_password: "{{ CA_password.stdout }}"
IP_subject_alt_name: "{{ IP_subject_alt_name }}"
- name: Set IPv6 support as a fact
set_fact:
ipv6_support: "{% if ansible_default_ipv6['gateway'] is defined %}true{% else %}false{% endif %}"
tags: always

38
roles/dns_encryption/files/rc.dnscrypt-proxy.sh
View file

@ -1,38 +0,0 @@
#!/bin/sh
# PROVIDE: dnscrypt-proxy
# REQUIRE: LOGIN
# BEFORE: securelevel
# KEYWORD: shutdown
# Add the following lines to /etc/rc.conf to enable `dnscrypt-proxy':
#
# dnscrypt_proxy_enable="YES"
# dnscrypt_proxy_flags="<set as needed>"
#
# See rsync(1) for rsyncd_flags
#
. /etc/rc.subr
name="dnscrypt-proxy"
rcvar=dnscrypt_proxy_enable
load_rc_config "$name"
pidfile="/var/run/$name.pid"
start_cmd=dnscrypt_proxy_start
stop_postcmd=dnscrypt_proxy_stop
: ${dnscrypt_proxy_enable="NO"}
: ${dnscrypt_proxy_flags="-config /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml"}
dnscrypt_proxy_start() {
echo "Starting dnscrypt-proxy..."
touch ${pidfile}
/usr/sbin/daemon -cS -T dnscrypt-proxy -p ${pidfile} /usr/dnscrypt-proxy/freebsd-amd64/dnscrypt-proxy ${dnscrypt_proxy_flags}
}
dnscrypt_proxy_stop() {
[ -f ${pidfile} ] && rm ${pidfile}
}
run_rc_command "$1"

55
roles/dns_encryption/tasks/freebsd.yml
View file

@ -1,51 +1,10 @@
---
- name: FreeBSD | Ensure that the required directories exist
file:
path: "{{ item }}"
state: directory
with_items:
- "{{ config_prefix|default('/') }}etc/dnscrypt-proxy/"
- /usr/dnscrypt-proxy/
- name: Required tools installed
- name: Install dnscrypt-proxy
package:
name: gtar
name: dnscrypt-proxy2
- name: FreeBSD | Retrive the latest versions
uri:
url: https://api.github.com/repos/jedisct1/dnscrypt-proxy/releases/latest
register: dnscrypt_proxy_latest
ignore_errors: true
- name: FreeBSD | Set default dnscrypt-proxy assets
set_fact:
dnscrypt_proxy_latest:
json:
assets:
- name: "dnscrypt-proxy-freebsd_amd64-{{ dnscrypt_proxy_version }}.tar.gz"
browser_download_url: "https://github.com/jedisct1/dnscrypt-proxy/releases/download/{{ dnscrypt_proxy_version }}/dnscrypt-proxy-freebsd_amd64-{{ dnscrypt_proxy_version }}.tar.gz"
when: dnscrypt_proxy_latest.failed
- name: FreeBSD | Download the latest archive
get_url:
url: "{{ item['browser_download_url'] }}"
dest: "/tmp/dnscrypt-proxy-freebsd_amd64-{{ dnscrypt_proxy_version }}.tar.gz"
mode: '0755'
force: true
with_items: "{{ dnscrypt_proxy_latest['json']['assets'] }}"
no_log: true
when: '"freebsd_amd64" in item.name and not item.name.endswith("minisig")'
notify: restart dnscrypt-proxy
- name: FreeBSD | Extract the latest archive
unarchive:
remote_src: true
src: /tmp/dnscrypt-proxy-freebsd_amd64-{{ dnscrypt_proxy_version }}.tar.gz
dest: /usr/dnscrypt-proxy
- name: FreeBSD | Configure rc script
copy:
src: rc.dnscrypt-proxy.sh
dest: /usr/local/etc/rc.d/dnscrypt-proxy
mode: "0755"
notify: restart dnscrypt-proxy
- name: Enable mac_portacl
lineinfile:
path: /etc/rc.conf
line: 'dnscrypt_proxy_mac_portacl_enable="YES"'
when: listen_port|int == 53

2
roles/dns_encryption/templates/dnscrypt-proxy.toml.j2
View file

@ -151,7 +151,7 @@ tls_disable_session_tickets = true
## People in China may need to use 114.114.114.114:53 here.
## Other popular options include 8.8.8.8 and 1.1.1.1.
fallback_resolver = '127.0.0.53:53'
fallback_resolver = '{% if ansible_distribution == "FreeBSD" %}{{ ansible_dns.nameservers.0 }}:53{% else %}127.0.0.53:53{% endif %}'
## Never try to use the system DNS settings; unconditionally use the

6
roles/vpn/tasks/main.yml
View file

@ -1,11 +1,5 @@
---
- block:
- name: Include WireGuard role
include_role:
name: wireguard
tags: wireguard
when: wireguard_enabled and ansible_distribution == 'Ubuntu'
- name: Ensure that the strongswan group exist
group: name=strongswan state=present

40
roles/wireguard/files/wireguard.sh Normal file
View file

@ -0,0 +1,40 @@
#!/bin/sh
# PROVIDE: wireguard
# REQUIRE: LOGIN
# BEFORE: securelevel
# KEYWORD: shutdown
. /etc/rc.subr
name="wg"
rcvar=wg_enable
command="/usr/local/bin/wg-quick"
start_cmd=wg_up
stop_cmd=wg_down
status_cmd=wg_status
pidfile="/var/run/$name.pid"
load_rc_config "$name"
: ${wg_enable="NO"}
: ${wg_interface="wg0"}
wg_up() {
echo "Starting WireGuard..."
/usr/sbin/daemon -cS -p ${pidfile} ${command} up ${wg_interface}
}
wg_down() {
echo "Stopping WireGuard..."
${command} down ${wg_interface}
}
wg_status () {
not_running () {
echo "WireGuard is not running on $wg_interface" && exit 1
}
/usr/local/bin/wg show wg0 && echo "WireGuard is running on $wg_interface" || not_running
}
run_rc_command "$1"

2
roles/wireguard/handlers/main.yml
View file

@ -1,5 +1,5 @@
---
- name: restart wireguard
service:
name: "wg-quick@{{ wireguard_interface }}"
name: "{{ service_name }}"
state: restarted

16
roles/wireguard/tasks/freebsd.yml Normal file
View file

@ -0,0 +1,16 @@
---
- name: BSD | WireGuard installed
package:
name: wireguard
state: present
- set_fact:
service_name: wireguard
tags: always
- name: BSD | Configure rc script
copy:
src: wireguard.sh
dest: /usr/local/etc/rc.d/wireguard
mode: "0755"
notify: restart wireguard

6
roles/wireguard/tasks/keys.yml
View file

@ -1,7 +1,7 @@
---
- name: Delete the lock files
file:
dest: "/etc/wireguard/private_{{ item }}.lock"
dest: "{{ config_prefix|default('/') }}etc/wireguard/private_{{ item }}.lock"
state: absent
when: keys_clean_all|bool == True
with_items:
@ -12,7 +12,7 @@
command: wg genkey
register: wg_genkey
args:
creates: "/etc/wireguard/private_{{ item }}.lock"
creates: "{{ config_prefix|default('/') }}etc/wireguard/private_{{ item }}.lock"
with_items:
- "{{ users }}"
- "{{ IP_subject_alt_name }}"
@ -31,7 +31,7 @@
- name: Touch the lock file
file:
dest: "/etc/wireguard/private_{{ item }}.lock"
dest: "{{ config_prefix|default('/') }}etc/wireguard/private_{{ item }}.lock"
state: touch
with_items:
- "{{ users }}"

42
roles/wireguard/tasks/main.yml
View file

@ -1,27 +1,4 @@
---
- name: WireGuard repository configured
apt_repository:
repo: ppa:wireguard/wireguard
state: present
register: result
until: result is succeeded
retries: 10
delay: 3
- name: WireGuard installed
apt:
name: wireguard
state: present
update_cache: true
- name: Configure unattended-upgrades
copy:
src: 50-wireguard-unattended-upgrades
dest: /etc/apt/apt.conf.d/50-wireguard-unattended-upgrades
owner: root
group: root
mode: 0644
- name: Ensure the required directories exist
file:
dest: "{{ wireguard_config_path }}/{{ item }}"
@ -33,6 +10,16 @@
delegate_to: localhost
become: false
- name: Include tasks for Ubuntu
include_tasks: ubuntu.yml
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
tags: always
- name: Include tasks for FreeBSD
include_tasks: freebsd.yml
when: ansible_distribution == 'FreeBSD'
tags: always
- name: Generate keys
import_tasks: keys.yml
tags: update-users
@ -40,16 +27,11 @@
- name: WireGuard configured
template:
src: server.conf.j2
dest: "/etc/wireguard/{{ wireguard_interface }}.conf"
dest: "{{ config_prefix|default('/') }}etc/wireguard/{{ wireguard_interface }}.conf"
mode: "0600"
notify: restart wireguard
tags: update-users
- name: WireGuard reload-module-on-update
file:
dest: /etc/wireguard/.reload-module-on-update
state: touch
- name: WireGuard users config generated
template:
src: client.conf.j2
@ -62,7 +44,7 @@
- name: WireGuard enabled and started
service:
name: "wg-quick@{{ wireguard_interface }}"
name: "{{ service_name }}"
state: started
enabled: true

32
roles/wireguard/tasks/ubuntu.yml Normal file
View file

@ -0,0 +1,32 @@
---
- name: WireGuard repository configured
apt_repository:
repo: ppa:wireguard/wireguard
state: present
register: result
until: result is succeeded
retries: 10
delay: 3
- name: WireGuard installed
apt:
name: wireguard
state: present
update_cache: true
- name: WireGuard reload-module-on-update
file:
dest: /etc/wireguard/.reload-module-on-update
state: touch
- name: Configure unattended-upgrades
copy:
src: 50-wireguard-unattended-upgrades
dest: /etc/apt/apt.conf.d/50-wireguard-unattended-upgrades
owner: root
group: root
mode: 0644
- set_fact:
service_name: "wg-quick@{{ wireguard_interface }}"
tags: always

1
roles/wireguard/templates/client.conf.j2
View file

@ -9,3 +9,4 @@ DNS = {{ wireguard_dns_servers }}
PublicKey = {{ lookup('file', wireguard_config_path + '/public/' + IP_subject_alt_name) }}
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = {{ IP_subject_alt_name }}:{{ wireguard_port }}
PersistentKeepalive = 25

1
roles/wireguard/templates/server.conf.j2
View file

@ -5,7 +5,6 @@ Address = {{ wireguard_network_ipv4['gateway'] }}/{{ wireguard_network_ipv4['pre
ListenPort = {{ wireguard_port }}
PrivateKey = {{ lookup('file', wireguard_config_path + '/private/' + IP_subject_alt_name) }}
SaveConfig = false
Table = off
{% for u in users %}

4
server.yml
View file

@ -9,6 +9,7 @@
roles:
- role: common
tags: common
- role: dns_encryption
when: dns_encryption
tags: dns_encryption
@ -18,6 +19,9 @@
- role: ssh_tunneling
when: algo_ssh_tunneling
tags: ssh_tunneling
- role: wireguard
when: wireguard_enabled
tags: wireguard
- role: vpn
tags: vpn