Commit graph

419 commits

Author SHA1 Message Date
Luvpreet Singh
6233642c66 fix(update-users): changed generate p12 password task (#1289)
Changed task's module to generic python format for python2 and python3.
2019-01-25 16:36:44 -05:00
Jack Ivanov
7a6daff1ff IPv6 fix (#1302) 2019-01-18 23:39:08 -05:00
Angel Montes de Oca
44ab95f12b Include Algo generated password (#1272)
I change a line to Include the Algo generated password so the users do not need to manually enter the password when installing on Windows 10 computers.
2019-01-08 08:48:05 +01:00
David Myers
5981bb9cad Replace 'max_mss' with 'reduce_mtu' (#1253) 2018-12-20 09:21:04 -05:00
Jack Ivanov
955a986c21
IPv6 forwarding fixes (#1256) 2018-12-18 13:59:25 +01:00
Jack Ivanov
a6cd89564d
Fixes #1246 2018-12-10 16:37:36 +01:00
Federico G. Schwindt
a4f2c97fd2 Fix ipv4 address missing on reboot (#1245) 2018-12-10 06:57:15 +01:00
David Myers
66681521c1 Increase memory limit for dnsmasq (#1228)
* Increase memory limit for dnsmasq

* Increase memory limit for dnsmasq further
2018-12-03 12:32:23 -05:00
David Myers
8d23f715d7 Run adblock.sh at a random time (#1227) 2018-12-03 15:33:36 +01:00
David Myers
22395f5f84 Add p12 password back to mobileconfigs (#1218) 2018-11-26 16:58:34 +01:00
Jack Ivanov
a66d8f0069 on-build python venvs (#1199) 2018-11-22 13:04:58 -05:00
Jack Ivanov
9187d8e637 dnscrypt-proxy apparmor fix (#1210)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Apparmor profile for dnscrypt-proxy didn't work at all

## Motivation and Context
Fixes #1155

## How Has This Been Tested?
Deployed to DigitalOcean, checked that the dnscrypt-proxy binary is in enforce mode

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] All new and existing tests passed.
2018-11-22 13:04:37 -05:00
Jack Ivanov
45b00ee994
BSD StrongSwan fixes (#1207) 2018-11-20 19:20:24 +01:00
Jack Ivanov
66d30e3005
WireGuard update-users fix (#1183) 2018-11-12 18:03:31 +01:00
TC1977
a76642c4d5 Update mobileconfig.j2 (#1197)
Adds "Algo VPN" to the organization in the "Profiles" menu of "General Settings". (The type still shows up as "Unknown" in the "VPN" menu, because that seems to be governed by the "VPNSubType" string, which must be empty according to the [developer reference](https://developer.apple.com/enterprise/documentation/Configuration-Profile-Reference.pdf) Maybe this can help clear the way for #1101.
2018-11-12 10:21:54 +01:00
zuccs
2b2d90a8a9 Fix typo (#1165) 2018-11-05 16:35:01 +01:00
datew0
30446d0363 Set disk size depending on server plan (#1159)
Scaleway`s START1-XS does not start with a disk size of 50GB.
2018-11-02 12:38:54 +01:00
Jack Ivanov
399d47233a
add region (#1182) 2018-11-01 20:59:14 +01:00
Jack Ivanov
3468d27e61 Lightsail back (#1157) 2018-10-22 16:49:18 -04:00
Jack Ivanov
fbc7b29456 WireGuard update-users fix (#1154) 2018-10-22 16:49:09 -04:00
Jack Ivanov
efc8dc7620
add tags for the wireguard qr code task. variables fix (#1147) 2018-10-14 10:22:45 +03:00
Jack Ivanov
bcba905547 ssh tunneling fixes (#1127) 2018-10-07 17:33:55 -07:00
David Myers
d90ba3d11a Allow more flexible DNSCrypt configuration (#1120)
* Allow more flexible DNSCrypt configuration

* Correct permissions on files changed in #1120

I'm not sure why using BBEdit over SMB makes every file executable.

* Put the public resolvers cache file in /tmp.
2018-10-04 18:12:48 -04:00
Jack Ivanov
1442586682 WireGuard: Generate QR codes (#1129)
* WireGuard: Generate QR codes

* Update client-android.md
2018-09-29 22:25:02 -04:00
Jack Ivanov
dbd68aa97d WireGuard BSD (#1083)
* WireGuard BSD

* Remove unneeded config option

* Enable PersistentKeepalive for NAT and Firewall Traversal Persistence

* Install dnscrypt-proxy from repositories
2018-09-27 04:18:12 -04:00
Jack Ivanov
6c0753e3b8 GCE: Static external ip (optional) (#1125) 2018-09-27 04:18:00 -04:00
Jack Ivanov
eb2224cde1
install generic linux headers (#1124) 2018-09-21 20:05:11 +03:00
James
14234344eb Use gateway ip address for wireguard interface (#1115) 2018-09-18 10:43:41 +03:00
Jack Ivanov
4a42fbea35 Move to the ARM deployment schema (#1107) 2018-09-16 20:19:29 -04:00
David Myers
d95df710a5 Add an unattended reboot option (#1082) 2018-09-02 15:26:06 -04:00
Jack Ivanov
91a9dfd983 invoke dns encryption from main playbook instead of meta-dependencies (#1097) 2018-09-02 14:52:59 -04:00
Jack Ivanov
e860b78d80
Scaleway authentication fix (#1088) 2018-08-29 16:05:07 +03:00
Jack Ivanov
e8947f318b Large refactor to support Ansible 2.5 (#976)
* Refactoring, booleans declaration and update users fix

* Make server_name more FQDN compatible

* Rename variables

* Define the default value for store_cakey

* Skip a prompt about the SSH user if deploying to localhost

* Disable reboot for non-cloud deployments

* Enable EC2 volume encryption by default

* Add default server value (localhost) for the local installation

Delete empty files

* Add default region to aws_region_facts

* Update docs

* EC2 credentials fix

* Warnings fix

* Update deploy-from-ansible.md

* Fix a typo

* Remove lightsail from the docs

* Disable EC2 encryption by default

* rename droplet to server

* Disable dependencies

* Disable tls_cipher_suite

* Convert wifi-exclude to a string. Update-users fix

* SSH access congrats fix

* 16.04 > 18.04

* Dont ask for the credentials if specified in the environment vars

* GCE server name fix
2018-08-27 10:05:45 -04:00
Jack Ivanov
53d1113881 Split up unattended upgrades (#1041) 2018-08-08 00:25:59 -04:00
David Myers
b86ebe20d7 Prevent DNS rebinding (#1049) 2018-08-08 00:25:33 -04:00
Fabian Foerg
3ddd0ac30f Run dnsmasq as the dnsmasq user (#1029)
* Run dnsmasq as the dnsmasq user

There is a task that checks whether the dnsmasq user exists.
However, dnsmasq is configured to run as user "nobody" instead.
This change lets dnsmasq run as user "dnsmasq".

* remove dnsmasq user task
2018-07-30 09:01:49 -04:00
bghost
60a99faaf8 Update PPA for dnscrypt-proxy to 'bionic' (#1039) 2018-07-30 08:56:01 +03:00
Jack Ivanov
ca59eeb5c3 Explicitly allow traffic between clients if enabled (#1028) 2018-07-20 10:31:27 -04:00
Jack Ivanov
952e759af4
Revert "Update dnscrypt-proxy.toml.j2 (#1022)" (#1030)
This reverts commit e6281bc7df.
2018-07-20 09:48:59 +03:00
adamluk
e6281bc7df Update dnscrypt-proxy.toml.j2 (#1022) 2018-07-12 17:03:36 +03:00
Jack Ivanov
07a6bbe652
Move max_mss to config.cfg (#1015)
* Move max_mss to config.cfg

* Add docs about max_mss

* Update troubleshooting.md
2018-07-03 09:06:45 +03:00
Jack Ivanov
d1c58f0d28
apt_repository fix (#1017) 2018-07-02 16:33:31 +03:00
Jack Ivanov
4ca8c03e3c New default cipher suite (#991)
* New ciphers enabled

* Update CHANGELOG.md

* Switch ecparam to secp384r1

* Change CertificateType to ECDSA384
2018-06-27 11:22:45 -04:00
Jack Ivanov
b061df6631
Move DNSCrypt proxy fallback_resolver to systemd resolved (#1011) 2018-06-26 13:11:09 +03:00
Emir Beganović
2f142f6dcc Remove duplicate dict key (enable_ipv6) (#999)
Warning in yaml file:
` [WARNING]: While constructing a mapping from /root/algo/roles/cloud-scaleway/tasks/main.yml, line 73, column 11, found a duplicate dict key (enable_ipv6). Using last defined value only.`
2018-06-25 13:40:51 +03:00
Jack Ivanov
ffb5a1f737 WireGuard: disable SaveConfig, update-users fix (#985)
- Disables SaveConfig. SaveConfig totally breaks the idea of configuration management and it breaks update-users
- WireGuard update-users fix. Mentioned in https://github.com/trailofbits/algo/issues/980#issuecomment-393720561
2018-06-01 10:06:03 -04:00
Jack Ivanov
aee043977f explicit installation of linux headers (#975) 2018-05-29 21:43:06 -07:00
Jack Ivanov
2d9a36d13a Scaleway: enable ipv6 and switch to local boot (#974)
- Enables IPv6 on Scaleway
- Adds local boot on scaleway
- Fixes #966
2018-05-28 12:16:06 -07:00
Jack Ivanov
d56f50180b Extra line and better DNS configuration for WireGuard (#968)
- Adds an extra line after the if statement. Jinja2 trims such blocks by default in Ansible. Fixes #965
- More appropriate way to configure DNS servers
- Removes `DNS` option from the wireguard server config
- Fixes dnscrypt-proxy restart
2018-05-25 10:37:13 -07:00
Jack Ivanov
3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
2018-05-24 08:15:27 -07:00