wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-04-23 17:51:25 +02:00
Code Issues Projects Releases Wiki Activity
1097 commits 5 branches 2 tags 10 MiB
Commit graph

403 commits

Author SHA1 Message Date
Christian Clauss
571daf4464
Fix typos discovered by codespell (#14325) 2021-12-14 00:30:09 +03:00
David Myers
4bed66f19e
Fix tests (#14319) 2021-10-31 13:21:04 +03:00
Dan Hipschman
d06869e1eb
Make it easier to use NextDNS or other private DNS server (#14288) 2021-10-31 13:13:43 +03:00
dependabot[bot]
4e739b518f
Bump ansible from 2.9.20 to 4.4.0 (#14272) 
* Bump ansible from 2.9.20 to 4.4.0

Bumps [ansible](https://github.com/ansible/ansible) from 2.9.20 to 4.4.0.
- [Release notes](https://github.com/ansible/ansible/releases)
- [Commits](https://github.com/ansible/ansible/commits)

---
updated-dependencies:
- dependency-name: ansible
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* ansible core

* aadd vagrant and fix jinja

* bool variable fix

* ec2 task deprecation

* bool fix

* azure requirements fix

* cloudscale fix

* scaleway fix

* openstack fixes

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jack Ivanov <e601809@gmail.com>
Co-authored-by: Jack Ivanov <17044561+jackivanov@users.noreply.github.com>
 2021-10-31 12:58:35 +03:00
Jack Ivanov
1c6702d3ef
azure regions (#14277) 2021-08-14 19:27:43 +03:00
Glenn Schlereth
4464be8259
Added support for EC2 Spot instances (#14248) 
If new instance_market_type config.cfg variable specifies 'spot' instead of 'on-demand' then
the stack.yml creates a LaunchTemplate resource using spot option. The create EC2 Instance command
uses that LaunchTemplate.
 2021-08-14 15:26:17 +03:00
David Myers
e431f21cbb
Move the dnscrypt-proxy cache file (#14235) 2021-08-14 15:12:54 +03:00
Chad Duffey
ec1fa3bb57
update Azure venv - new versions of msrestazure & azure-cli-core to resolve errors (#14109) 
https://github.com/trailofbits/algo/issues/1881 

I needed the update to azure-cli-core as suggested by @benzin1984 but the new version didn't work for me without an update to msrestazure as well. 

Dependency changes:
msrestazure==0.6.4
azure-cli-core==2.16.0
 2021-08-14 15:07:26 +03:00
Wes Mills
99473ef104
Add and sort multiple new Azure regions (#14233) 
## Description
Azure has added several regions, some net-new and others moved from standalone cloud instances into general Azure.

## Motivation and Context
Azure Germany, in particular, will soon not be a standalone cloud and I wanted to use Algo to deploy into that region.

## How Has This Been Tested?
Exported Azure regions through az CLI and did JSON transform into the main.yml in my local repo; successfully deployed Algo on a VM in germanywestcentral.

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- Breaking change (fix or feature that would cause existing functionality to not work as expected)

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [] My change requires a change to the documentation.
- [] I have updated the documentation accordingly.
- [] I have added tests to cover my changes.
- [] All new and existing tests passed.
 2021-08-14 15:06:58 +03:00
Jack Ivanov
8c560719a5
skip pre tasks in update-users (#1921) 2020-12-08 13:23:24 +03:00
Jack Ivanov
ebec20ed36
Multiple Azure fixes (#1908) 
* Multiple Azure fixes

* back to azure daily
 2020-10-31 22:40:09 +03:00
David Myers
b5bb64d07a
Allow more users (#1895) 2020-10-31 20:26:12 +03:00
Squirrel
060b401880
add linode as one of cloud providers (#1590) 
* add linode as one of cloud providers

* add Linode into cloud provider list

* fix code style

* install requirements of ansible linode module

* Update prompts.yml

- Make the regions list more readable
- Assign us-east as the default region

* remove prompt of asking root password

* roles/common: Add sshd tasks

* cloud-linode/tasks: Fix LINODE_API_TOKEN env lookup

* docs: Add Linode to Ansible deploy docs

* docs: Add cloud-linode

* config: Use Ubuntu 20.04 on Linode

* README: syntax

* Linode stackscript support

* Linode stackscript fix

* linting

Co-authored-by: Jack Ivanov <17044561+jackivanov@users.noreply.github.com>
Co-authored-by: William Woodruff <william@yossarian.net>
Co-authored-by: William Woodruff <william.woodruff@trailofbits.com>
Co-authored-by: Jack Ivanov <e601809@gmail.com>
 2020-08-23 11:41:27 +03:00
David Myers
b1d1491a66
Clarify AWS prompts (#1861) 2020-08-08 14:10:14 +03:00
Jack Ivanov
8b2b57deda
Install dnscrypt-proxy from ubuntu repos (#1859) 2020-08-07 20:15:13 +03:00
David Myers
8894dd0848
Discontinue use of the WireGuard PPA (#1855) 
* Discontinue use of the WireGuard PPA

* Add instructions to update the system

* Change reboot instruction
 2020-08-06 19:09:15 +03:00
Jack Ivanov
c14ff0d611
Ubuntu 20.04 support (#1782) 
* ubuntu 20.04 support

* purge snapd for 20.04

* strongswan-starter fix
 2020-05-10 13:48:30 +03:00
David Myers
eeda23be97
Initial support for Ubuntu 20.04 (#1770) 2020-04-25 19:42:07 +03:00
Wade Winright
e29615bc05
Modified script to handle more types of blocklists (#1771) 
Added/modified script to better handle multiple types of blocklists available to drop in to the BLOCKLIST_URLS.
 2020-04-25 19:36:43 +03:00
Saravanan Palanisamy
02fe2f7dd5
use ca_password from variable(--extra-vars) - non-interactive installation using ansible playbook (#1774) 
* use ca_password from variable

* add tests to cover the changes

* update tests - PR #1774
 2020-04-25 19:32:16 +03:00
Jack Ivanov
27de76048c
ipv6 nat fix (#1775) 2020-04-25 19:31:47 +03:00
aleks
4f1b9270be
relax CA constraints for client (the client equivalent of PR #1675) (#1768) 
* relax CA constraints for client (the client equivalent of PR #1675)

* fixing incorrectly hard-coded output file path
 2020-04-18 17:03:29 +03:00
David Myers
3f3138f555
Fix IPsec DNS when WireGuard uses port 53 (#1719) 
* Fix IPsec DNS when WireGuard uses port 53

* Change ACCEPT to RETURN
 2020-02-25 07:43:25 +01:00
Jack Ivanov
28d95eace2
Update main.yml (#1727) 2020-02-18 16:20:27 +01:00
Jack Ivanov
1e8a9c5cf1
Generate mobileconfigs for WireGuard (#1698) 
* Generate mobileconfigs for WireGuard

* add xmllint to wireguard profiles

* Enable onDemand prompts for WireGuard

* linting
 2020-02-12 08:31:44 +01:00
Jack Ivanov
dcfed41ae8 Apply netplan for digitalocean only (#1723) 2020-02-10 11:01:20 +01:00
Austin Dworaczyk Wiltshire
027b1b8497
Update dnscrypt-proxy cache settings for improved performance and privacy. (#1714) 
These values match those recommended by the author of DNSCrypt-proxy

See:
https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Caching#dns-cache
https://00f.net/2019/11/03/stop-using-low-dns-ttls/
 2020-02-04 07:08:11 +01:00
Jack Ivanov
2abbf22196
Alternative Ingress IP (#1605) 
* Separate ingress IP draft

* task name fix

* placeholder
 2020-01-31 11:24:29 +01:00
Jack Ivanov
0efa4eaf91 Ca certificate name constraints (#1675) 
* X.509 Name Constraints

* nameConstraints to a random generated uuid

* Second level domain

* nameConstraints fixes

* critical in nameConstraints lost after last refactoring
 2020-01-25 20:08:55 +07:00
Jack Ivanov
eb40ade096
scaleway region fix (#1678) 2020-01-08 11:11:41 +01:00
Jack Ivanov
d635c76b50
Change default SSH port and introduce cloud-init support (#1636) 
* Change default SSH port

* Iptables to ansible_ssh_port

* Add Scaleway

* permissions and groups fixes

* update firewall docs

* SSH fixes

* add missing cloudinit to cloud-azure

* remove ansible_ssh_user from the tests

* congrats message fix
 2020-01-07 14:28:19 +01:00
Julien Bachmann
43aafdfce1 fixed code to work with python3.7 (#1608) 
* fixed code to work with python3.7

* removed trailing whitespaces and re-run ansible-linter
 2019-11-06 08:25:35 +01:00
David Myers
5737317dae Allow WireGuard to listen on port 53 (#1594) 
* Allow WireGuard to listen on port 53

* Use a variable for the port to avoid

* Add comment to config.cfg
 2019-10-30 08:38:39 +01:00
Jack Ivanov
8bdd99c05d Refactor to support Ansible 2.8 (#1549) 
* bump ansible to 2.8.3

* DigitalOcean: move to the latest modules

* Add Hetzner Cloud

* Scaleway and Lightsail fixes

* lint missing roles

* Update roles/cloud-hetzner/tasks/main.yml

Add api_token

Co-Authored-By: phaer <phaer@phaer.org>

* Update roles/cloud-hetzner/tasks/main.yml

Add api_token

Co-Authored-By: phaer <phaer@phaer.org>

* Try to run apt until succeeded

* Scaleway modules upgrade

* GCP: Refactoring, remove deprecated modules

* Doc updates (#1552)

* Update README.md

Adding links and mentions of Exoscale aka CloudStack and Hetzner Cloud.

* Update index.md

Add the Hetzner Cloud to the docs index

* Remove link to Win 10 IPsec instructions

* Delete client-windows.md

Unnecessary since the deprecation of IPsec for Win10.

* Update deploy-from-ansible.md

Added sections and required variables for CloudStack and Hetzner Cloud.

* Update deploy-from-ansible.md

Added sections for CloudStack and Hetzner, added req variables and examples, mentioned environment variables, and added links to the provider role section.

* Update deploy-from-ansible.md

Cosmetic changes to links, fix typo.

* Update GCE variables

* Update deploy-from-script-or-cloud-init-to-localhost.md

Fix a finer point, and make variables list more readable.

* update azure requirements

* Python3 draft

* set LANG=c to the p12 password generation task

* Update README

* Install cloud requirements to the existing venv

* FreeBSD fix

* env->.env fixes

* lightsail_region_facts fix

* yaml syntax fix

* Update README for Python 3 (#1564)

* Update README for Python 3

* Remove tabs and tweak instructions

* Remove cosmetic command indentation

* Update README.md

* Update README for Python 3 (#1565)

* DO fix for "found unpermitted parameters: id"

* Verify Python version

* Remove ubuntu 16.04 from readme

* Revert back DigitalOcean module

* Update deploy-from-script-or-cloud-init-to-localhost.md

* env to .env
 2019-09-28 08:10:20 +08:00
Jack Ivanov
61729ac9b5
Update client.conf.j2 (#1580) 2019-09-12 12:52:10 +02:00
Squirrel
1ca8ee5554 Generates a password by native module (#1576) 
* use password module to generate password

* fix variable reference

* reduce character set to meet origin design

*  CA and p12 password chanes

- Move the CA_password generation task to the native lookup plugin
- Get rid of unneeded tasks
 2019-09-06 10:55:57 +02:00
Jack Ivanov
c6f45ead69
Allow OnDemand to be toggled later (#1557) 2019-09-06 09:33:36 +02:00
Jack Ivanov
95eddccfb7
EC2: Enable EBS single step encryption by default (#1556) 
* EC2: EBS single step encryption by default

* return back the encryption variable
 2019-08-26 17:25:29 +02:00
Jack Ivanov
fe7755e6a0
Allow to unblock smb and netbios in config.cfg (#1558) 2019-08-21 12:03:10 +02:00
Julien Bachmann
3dc08c94cf New cloud provider CloudStack (#1420) 
* clean commits from branch cloud-cloudstack w/ proper committer email/name

* fixed ansible-lint errors

* corrected typo in prompted message

* standalone cloudstack zones module

* added missing environment variables

* remove `_cloudstack_zones` default variable

* Move to Ubuntu 19.04

* Update cloud-cloudstack.md

* Update cloud-cloudstack.md

Markdown doesn't render `<your account>`

* Update prompts.yml

* Update main.yml
 2019-08-15 15:23:10 +02:00
Jack Ivanov
211d1b2cab
Google Cloud: remove sshguard (#1548) 
* Google Cloud: remove sshguard

* Remove whitespace
 2019-08-15 09:27:54 +02:00
Jack Ivanov
38d8a6d0e2 Deprecate IKEv2 for Windows (#1521) 
* Windows to WireGuard

* Add note about WireGuard

* change wireguard faq

* Clarify Windows instructions

* Correct Wireguard description

* Update README.md
 2019-07-31 11:28:33 -04:00
Jack Ivanov
545ad480a4
Add tags to EC2 encrypted images (#1530) 2019-07-27 15:47:17 +02:00
Jack Ivanov
090a60d48d PKI to tmpfs (#1496) 
* PKI to tmpfs

* Fixes
- diskutil to full path
- unmount and eject fixes

* Umount fix

* run diskutil info only on Darwin kernels

* fix shell tasks
 2019-07-10 12:31:25 -04:00
Jack Ivanov
f986811d64
remove pycrypto from the gce role (#1489) 
pycrypto is dead
 2019-07-04 18:00:15 +02:00
Jack Ivanov
0e6554943f
Add default IPv6 routes to the windows powershell script (#1501) 2019-06-24 20:32:08 +02:00
Daniel Néri
14ee323eca Fix outdated task name in DNS role (#1499) 2019-06-24 14:10:20 +02:00
TC1977
8462f0fb6c Unattended upgrade fixes (#1485) 
* Keep custom dnscrypt-proxy conffile when upgrading

* Unattended upgrade tuning
- Upgrade the 50unattended-upgrades file with latest options
- Keep the common unattended upgrade options in one file
- Enable removing of unused kernels and dependencies to save some space
 2019-06-24 10:23:34 +02:00
Jack Ivanov
6f58093a06
Update azure regions 
Closes #1492
 2019-06-21 16:01:41 +02:00
Jack Ivanov
8602a697cc
dnscrypt-proxy as a dns adblocker (#1480) 
* Move DNS adblocking to dnscrypt-proxy

* Update docs

* remove unneeded variable dnscrypt_proxy_version

* Update to the latest dnscrypt-proxy version

* install.sh fix

* spelling
 2019-06-19 17:31:43 +02:00