Commit graph

22 commits

Author SHA1 Message Date
TC1977
8462f0fb6c Unattended upgrade fixes (#1485)
* Keep custom dnscrypt-proxy conffile when upgrading

* Unattended upgrade tuning
- Upgrade the 50unattended-upgrades file with latest options
- Keep the common unattended upgrade options in one file
- Enable removing of unused kernels and dependencies to save some space
2019-06-24 10:23:34 +02:00
Jack Ivanov
498cf46391 Block link-local networks. Block traffic from SSH tunnels to VPN clients (#1458) 2019-06-02 19:01:08 -04:00
Jack Ivanov
5904546a48
Randomly generated IP address for the local dns resolver (#1429)
* generate service IPs dynamically

* update cloud-init tests

* exclude ipsec and wireguard ranges from the random service ip

* Update docs

* @davidemyers: update wireguard docs for linux

* Move to netaddr filter

* AllowedIPs fix

* WireGuard IPs fix
2019-05-17 14:49:29 +02:00
adamluk
d996b1d02f Update 10-algo-lo100.network.j2 (#1369) 2019-03-25 08:55:38 +01:00
Jack Ivanov
273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
2019-03-10 13:16:34 -04:00
David Myers
d95df710a5 Add an unattended reboot option (#1082) 2018-09-02 15:26:06 -04:00
Jack Ivanov
53d1113881 Split up unattended upgrades (#1041) 2018-08-08 00:25:59 -04:00
Jack Ivanov
3488e660ad Add WireGuard support for Android (#910)
* WireGuard Implementation

* Update client-android.md

* Update README.md

* WireGuard unattended upgrades

* Update README.md

* reload-module-on-update and syntax fix

* SaveConfig to true

* Azure firewall. Fixes #962

* Update README.md

* Update client-android.md
2018-05-24 08:15:27 -07:00
Jack Ivanov
d27b849f24 Ubuntu1804 (#925)
- Fixes #897 #944 #956

Work in progress. Lightsail is not ready for Ubuntu 18.04 yet

- [x] DigitalOcean
~~- [ ] Amazon Lightsail~~
- [x] Amazon EC2
- [x] Microsoft Azure
- [x] Google Compute Engine
- [x] Scaleway
- [x] OpenStack (DreamCompute optimised)
2018-05-24 07:08:14 -07:00
Jack Ivanov
02427910de Ansible 2.4, Lightsail, Scaleway, DreamCompute (OpenStack) integration (#804)
* Move to ansible-2.4.3

* Add Lightsail support #623

* Fixing the EC2 deployment

* Scaleway integration #623

* OpenStack cloud provider (DreamCompute optimised) #623

* Remove the security role

* Enable unattended-upgrades for clouds

* New requirements to make Azure and GCE work
2018-03-02 07:55:54 -05:00
Jack Ivanov
05df4f0c04 unattended-upgrades moved to the security role 2016-08-28 22:11:39 +03:00
Jack Ivanov
00e4bcc1ec security role and SSH fixes #77 2016-08-26 00:35:07 +03:00
Jack Ivanov
c19908c9b1 ssh fixes 2016-08-25 23:03:20 +03:00
Dan Guido
2fcc3600fd Disable features in the Match block vs main config 2016-08-23 17:03:27 -04:00
Jack Ivanov
1dcfe18055 SSH tunneling role #77 2016-08-23 16:51:06 +03:00
Evgeniy Ivanov
ba50abce8a make local ip changeable #67 2016-08-21 13:29:53 +03:00
Evgeniy Ivanov
b593986b0c SFTP fixed 2016-08-20 16:22:54 +03:00
Evgeniy Ivanov
3fa75a081d new iptabes deployment #61 2016-08-20 16:22:14 +03:00
Evgeniy Ivanov
4a6602e877 RSAAuthentication no; Turn off SFTP; Turn off X11 forwarding; #51 2016-08-20 14:14:09 +03:00
Evgeniy Ivanov
16627783f5 Minor updates to the sshd_config #51 2016-08-18 21:35:47 +03:00
Evgeniy Ivanov
4f46cc221a Split the features role in two #49 2016-08-17 23:26:21 +03:00
jack
7a8d58783f Roles and Google cloud 2016-08-14 20:03:33 +03:00