#!/usr/bin/env bash set -e SKIP_TAGS="_null" additional_roles () { read -p " Do you want to apply security enhancements? [y/N]: " -r security_enabled security_enabled=${security_enabled:-n} if [[ "$security_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" security"; fi read -p " Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing? [y/N]: " -r proxy_enabled proxy_enabled=${proxy_enabled:-n} if [[ "$proxy_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" proxy"; fi read -p " Do you want to install a local DNS resolver to block ads while surfing? [y/N]: " -r dns_enabled dns_enabled=${dns_enabled:-n} if [[ "$dns_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" dns"; EXTRA_VARS+=" local_dns=Y"; fi read -p " Do you want to use auditd for security monitoring (see config.cfg)? [y/N]: " -r logging_enabled logging_enabled=${logging_enabled:-n} if [[ "$logging_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" logging"; fi read -p " Do you want each user to have their own account for SSH tunneling? [y/N]: " -r ssh_tunneling_enabled ssh_tunneling_enabled=${ssh_tunneling_enabled:-n} if [[ "$ssh_tunneling_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" ssh_tunneling"; fi read -p " Do you want to enable VPN always when connected to Wi-Fi? [y/N]: " -r OnDemandEnabled_WIFI OnDemandEnabled_WIFI=${OnDemandEnabled_WIFI:-n} if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_WIFI=Y"; fi if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then read -p " Do you want to exclude trust Wi-Fi networks from VPN usage? (eg: Your home network. Comma-separated value, eg: HomeMeganet,OfficeSuperWifi,AlgoWiFi) : " -r OnDemandEnabled_WIFI_ECXLUDE OnDemandEnabled_WIFI_ECXLUDE=${OnDemandEnabled_WIFI_ECXLUDE:-_null} EXTRA_VARS+=" OnDemandEnabled_WIFI_ECXLUDE=$OnDemandEnabled_WIFI_ECXLUDE" fi read -p " Do you want to enable VPN always when connected to the cellular network? [y/N]: " -r OnDemandEnabled_Cellular OnDemandEnabled_Cellular=${OnDemandEnabled_Cellular:-n} if [[ "$OnDemandEnabled_Cellular" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_Cellular=Y"; fi } deploy () { ansible-playbook deploy.yml -t "${ROLES// /,}" -e "${EXTRA_VARS}" --skip-tags "${SKIP_TAGS// /,}" } digitalocean () { read -p " Enter your API token (https://cloud.digitalocean.com/settings/api/tokens): : " -rs do_access_token read -p " Enter an existing SSH key name (https://cloud.digitalocean.com/settings/security): : " -r do_ssh_name read -p " Name the vpn server: [algo.local]: " -r do_server_name do_server_name=${do_server_name:-algo.local} read -p " What region should the server be located in? 1. Amsterdam (Datacenter 2) 2. Amsterdam (Datacenter 3) 3. Frankfurt 4. London 5. New York (Datacenter 1) 6. New York (Datacenter 2) 7. New York (Datacenter 3) 8. San Francisco (Datacenter 1) 9. San Francisco (Datacenter 2) 10. Singapore 11. Toronto 12. Bangalore Enter the number of your desired region: [7]: " -r region region=${region:-7} case "$region" in 1) do_region="ams2" ;; 2) do_region="ams3" ;; 3) do_region="fra1" ;; 4) do_region="lon1" ;; 5) do_region="nyc1" ;; 6) do_region="nyc2" ;; 7) do_region="nyc3" ;; 8) do_region="sfo1" ;; 9) do_region="sfo2" ;; 10) do_region="sgp1" ;; 11) do_region="tor1" ;; 12) do_region="blr1" ;; esac ROLES="digitalocean vpn cloud" EXTRA_VARS="do_access_token=$do_access_token do_ssh_name=$do_ssh_name do_server_name=$do_server_name do_region=$do_region" } ec2 () { read -p " Enter your aws_access_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html) Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached [AKIA...]: " -rs aws_access_key read -p " Enter your aws_secret_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html) Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached [ABCD...]: " -rs aws_secret_key read -e -p " Enter the local path to your SSH public key: : " -i "~/.ssh/id_rsa.pub" -r ssh_public_key read -p " Name the vpn server: [algo]: " -r aws_server_name aws_server_name=${aws_server_name:-algo} read -p " What region should the server be located in? 1. us-east-1 US East (N. Virginia) 2. us-east-2 US East (Ohio) 3. us-west-1 US West (N. California) 4. us-west-2 US West (Oregon) 5. ap-south-1 Asia Pacific (Mumbai) 6. ap-northeast-2 Asia Pacific (Seoul) 7. ap-southeast-1 Asia Pacific (Singapore) 8. ap-southeast-2 Asia Pacific (Sydney) 9. ap-northeast-1 Asia Pacific (Tokyo) 10. eu-central-1 EU (Frankfurt) 11. eu-west-1 EU (Ireland) 12. sa-east-1 South America (São Paulo) Enter the number of your desired region: [1]: " -r aws_region aws_region=${aws_region:-1} case "$aws_region" in 1) region="us-east-1" ;; 2) region="us-east-2" ;; 3) region="us-west-1" ;; 4) region="us-west-2" ;; 5) region="ap-south-1" ;; 6) region="ap-northeast-2" ;; 7) region="ap-southeast-1" ;; 8) region="ap-southeast-2" ;; 9) region="ap-northeast-1" ;; 10) region="eu-central-1" ;; 11) region="eu-west-1" ;; 12) region="sa-east-1" ;; esac ROLES="ec2 vpn cloud" EXTRA_VARS="aws_access_key=$aws_access_key aws_secret_key=$aws_secret_key aws_server_name=$aws_server_name ssh_public_key=$ssh_public_key region=$region" } gce () { read -p " Enter the local path to your credentials JSON file (https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts): : " -r credentials_file read -e -p " Enter the local path to your SSH public key: : " -i "~/.ssh/id_rsa.pub" -r ssh_public_key read -p " Name the vpn server: [algo]: " -r server_name server_name=${server_name:-algo} read -p " What zone should the server be located in? 1. Central US (Iowa A) 2. Central US (Iowa B) 3. Central US (Iowa C) 4. Central US (Iowa F) 5. Eastern US (South Carolina B) 6. Eastern US (South Carolina C) 7. Eastern US (South Carolina D) 8. Western Europe (Belgium B) 9. Western Europe (Belgium C) 10. Western Europe (Belgium D) 11. East Asia (Taiwan A) 12. East Asia (Taiwan B) 13. East Asia (Taiwan C) Please choose the number of your zone. Press enter for default (#8) zone. [8]: " -r region region=${region:-8} case "$region" in 1) zone="us-central1-a" ;; 2) zone="us-central1-b" ;; 3) zone="us-central1-c" ;; 4) zone="us-central1-f" ;; 5) zone="us-east1-b" ;; 6) zone="us-east1-c" ;; 7) zone="us-east1-d" ;; 8) zone="europe-west1-b" ;; 9) zone="europe-west1-c" ;; 10) zone="europe-west1-d" ;; 11) zone="asia-east1-a" ;; 12) zone="asia-east1-b" ;; 13) zone="asia-east1-c" ;; esac ROLES="gce vpn cloud" EXTRA_VARS="credentials_file=$credentials_file server_name=$server_name ssh_public_key=$ssh_public_key zone=$zone" } non_cloud () { read -p " Enter IP address of your server: (use localhost for local installation) : " -r server_ip read -p " What user should we use to login on the server? (ignore if you're deploying to localhost) [root]: " -r server_user server_user=${server_user:-root} read -p " Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate) : " -r IP_subject ROLES="local vpn" EXTRA_VARS="server_ip=$server_ip server_user=$server_user IP_subject_alt_name=$IP_subject" SKIP_TAGS+=" cloud" } algo_provisioning () { echo -n " What provider would you like to use? 1. DigitalOcean 2. Amazon EC2 3. Google Compute Engine 4. Install to existing Ubuntu server Enter the number of your desired provider : " read -r N case "$N" in 1) digitalocean; ;; 2) ec2; ;; 3) gce; ;; 4) non_cloud; ;; *) exit 1 ;; esac additional_roles deploy } user_management () { ansible-playbook users.yml } case "$1" in update-users) user_management ;; *) algo_provisioning ;; esac