wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-04-22 17:17:14 +02:00
Code Issues Projects Releases Wiki Activity
algo/algo
Jack Ivanov 29de003b2d inplemented #109
2016-11-03 18:05:56 +03:00

278 lines
8.1 KiB
Bash
Executable file
Raw Blame History

#!/usr/bin/env bash
set -e
SKIP_TAGS="_null"
additional_roles () {
read -p "
Do you want to apply security enhancements?
[y/N]: " -r security_enabled
security_enabled=${security_enabled:-n}
if [[ "$security_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" security"; fi
read -p "
Do you want to install an HTTP proxy to block ads and decrease traffic usage while surfing?
[y/N]: " -r proxy_enabled
proxy_enabled=${proxy_enabled:-n}
if [[ "$proxy_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" proxy"; fi
read -p "
Do you want to install a local DNS resolver to block ads while surfing?
[y/N]: " -r dns_enabled
dns_enabled=${dns_enabled:-n}
if [[ "$dns_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" dns"; EXTRA_VARS+=" local_dns=Y"; fi
read -p "
Do you want to use auditd for security monitoring (see config.cfg)?
[y/N]: " -r logging_enabled
logging_enabled=${logging_enabled:-n}
if [[ "$logging_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" logging"; fi
read -p "
Do you want each user to have their own account for SSH tunneling?
[y/N]: " -r ssh_tunneling_enabled
ssh_tunneling_enabled=${ssh_tunneling_enabled:-n}
if [[ "$ssh_tunneling_enabled" =~ ^(y|Y)$ ]]; then ROLES+=" ssh_tunneling"; fi
read -p "
Do you want to enable VPN always when connected to Wi-Fi?
[y/N]: " -r OnDemandEnabled_WIFI
OnDemandEnabled_WIFI=${OnDemandEnabled_WIFI:-n}
if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_WIFI=Y"; fi
if [[ "$OnDemandEnabled_WIFI" =~ ^(y|Y)$ ]]; then
read -p "
Do you want to exclude trust Wi-Fi networks from VPN usage? (eg: Your home network. Comma-separated value, eg: HomeMeganet,OfficeSuperWifi,AlgoWiFi)
: " -r OnDemandEnabled_WIFI_ECXLUDE
OnDemandEnabled_WIFI_ECXLUDE=${OnDemandEnabled_WIFI_ECXLUDE:-_null}
EXTRA_VARS+=" OnDemandEnabled_WIFI_ECXLUDE=$OnDemandEnabled_WIFI_ECXLUDE"
fi
read -p "
Do you want to enable VPN always when connected to the cellular network?
[y/N]: " -r OnDemandEnabled_Cellular
OnDemandEnabled_Cellular=${OnDemandEnabled_Cellular:-n}
if [[ "$OnDemandEnabled_Cellular" =~ ^(y|Y)$ ]]; then EXTRA_VARS+=" OnDemandEnabled_Cellular=Y"; fi
}
deploy () {
ansible-playbook deploy.yml -t "${ROLES// /,}" -e "${EXTRA_VARS}" --skip-tags "${SKIP_TAGS// /,}"
}
digitalocean () {
read -p "
Enter your API token (https://cloud.digitalocean.com/settings/api/tokens):
: " -rs do_access_token
read -p "
Enter an existing SSH key name (https://cloud.digitalocean.com/settings/security):
: " -r do_ssh_name
read -p "
Name the vpn server:
[algo.local]: " -r do_server_name
do_server_name=${do_server_name:-algo.local}
read -p "
What region should the server be located in?
1. Amsterdam (Datacenter 2)
2. Amsterdam (Datacenter 3)
3. Frankfurt
4. London
5. New York (Datacenter 1)
6. New York (Datacenter 2)
7. New York (Datacenter 3)
8. San Francisco (Datacenter 1)
9. San Francisco (Datacenter 2)
10. Singapore
11. Toronto
12. Bangalore
Enter the number of your desired region:
[7]: " -r region
region=${region:-7}
case "$region" in
1) do_region="ams2" ;;
2) do_region="ams3" ;;
3) do_region="fra1" ;;
4) do_region="lon1" ;;
5) do_region="nyc1" ;;
6) do_region="nyc2" ;;
7) do_region="nyc3" ;;
8) do_region="sfo1" ;;
9) do_region="sfo2" ;;
10) do_region="sgp1" ;;
11) do_region="tor1" ;;
12) do_region="blr1" ;;
esac
ROLES="digitalocean vpn cloud"
EXTRA_VARS="do_access_token=$do_access_token do_ssh_name=$do_ssh_name do_server_name=$do_server_name do_region=$do_region"
}
ec2 () {
read -p "
Enter your aws_access_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached
[AKIA...]: " -rs aws_access_key
read -p "
Enter your aws_secret_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
Note: Make sure to use either your root key (recommended) or an IAM user with an acceptable policy attached
[ABCD...]: " -rs aws_secret_key
read -e -p "
Enter the local path to your SSH public key:
: " -i "~/.ssh/id_rsa.pub" -r ssh_public_key
read -p "
Name the vpn server:
[algo]: " -r aws_server_name
aws_server_name=${aws_server_name:-algo}
read -p "
What region should the server be located in?
1. us-east-1 US East (N. Virginia)
2. us-east-2 US East (Ohio)
3. us-west-1 US West (N. California)
4. us-west-2 US West (Oregon)
5. ap-south-1 Asia Pacific (Mumbai)
6. ap-northeast-2 Asia Pacific (Seoul)
7. ap-southeast-1 Asia Pacific (Singapore)
8. ap-southeast-2 Asia Pacific (Sydney)
9. ap-northeast-1 Asia Pacific (Tokyo)
10. eu-central-1 EU (Frankfurt)
11. eu-west-1 EU (Ireland)
12. sa-east-1 South America (São Paulo)
Enter the number of your desired region:
[1]: " -r aws_region
aws_region=${aws_region:-1}
case "$aws_region" in
1) region="us-east-1" ;;
2) region="us-east-2" ;;
3) region="us-west-1" ;;
4) region="us-west-2" ;;
5) region="ap-south-1" ;;
6) region="ap-northeast-2" ;;
7) region="ap-southeast-1" ;;
8) region="ap-southeast-2" ;;
9) region="ap-northeast-1" ;;
10) region="eu-central-1" ;;
11) region="eu-west-1" ;;
12) region="sa-east-1" ;;
esac
ROLES="ec2 vpn cloud"
EXTRA_VARS="aws_access_key=$aws_access_key aws_secret_key=$aws_secret_key aws_server_name=$aws_server_name ssh_public_key=$ssh_public_key region=$region"
}
gce () {
read -p "
Enter the local path to your credentials JSON file (https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts):
: " -r credentials_file
read -e -p "
Enter the local path to your SSH public key:
: " -i "~/.ssh/id_rsa.pub" -r ssh_public_key
read -p "
Name the vpn server:
[algo]: " -r server_name
server_name=${server_name:-algo}
read -p "
What zone should the server be located in?
1. Central US (Iowa A)
2. Central US (Iowa B)
3. Central US (Iowa C)
4. Central US (Iowa F)
5. Eastern US (South Carolina B)
6. Eastern US (South Carolina C)
7. Eastern US (South Carolina D)
8. Western Europe (Belgium B)
9. Western Europe (Belgium C)
10. Western Europe (Belgium D)
11. East Asia (Taiwan A)
12. East Asia (Taiwan B)
13. East Asia (Taiwan C)
Please choose the number of your zone. Press enter for default (#8) zone.
[8]: " -r region
region=${region:-8}
case "$region" in
1) zone="us-central1-a" ;;
2) zone="us-central1-b" ;;
3) zone="us-central1-c" ;;
4) zone="us-central1-f" ;;
5) zone="us-east1-b" ;;
6) zone="us-east1-c" ;;
7) zone="us-east1-d" ;;
8) zone="europe-west1-b" ;;
9) zone="europe-west1-c" ;;
10) zone="europe-west1-d" ;;
11) zone="asia-east1-a" ;;
12) zone="asia-east1-b" ;;
13) zone="asia-east1-c" ;;
esac
ROLES="gce vpn cloud"
EXTRA_VARS="credentials_file=$credentials_file server_name=$server_name ssh_public_key=$ssh_public_key zone=$zone"
}
non_cloud () {
read -p "
Enter IP address of your server: (use localhost for local installation)
: " -r server_ip
read -p "
What user should we use to login on the server? (ignore if you're deploying to localhost)
[root]: " -r server_user
server_user=${server_user:-root}
read -p "
Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)
: " -r IP_subject
ROLES="local vpn"
EXTRA_VARS="server_ip=$server_ip server_user=$server_user IP_subject_alt_name=$IP_subject"
SKIP_TAGS+=" cloud"
}
algo_provisioning () {
echo -n "
What provider would you like to use?
1. DigitalOcean
2. Amazon EC2
3. Google Compute Engine
4. Install to existing Ubuntu server
Enter the number of your desired provider
: "
read -r N
case "$N" in
1) digitalocean; ;;
2) ec2; ;;
3) gce; ;;
4) non_cloud; ;;
*) exit 1 ;;
esac
additional_roles
deploy
}
user_management () {
ansible-playbook users.yml
}
case "$1" in
update-users) user_management ;;
*) algo_provisioning ;;
esac
Reference in a new issue View git blame Copy permalink