---
# Common task for configuring redirector with full encryption
# Shared across all providers

- name: Install required packages for redirector
  apt:
    name:
      - nginx
      - certbot
      - python3-certbot-nginx
      - socat
      - netcat-openbsd
      - secure-delete
    state: present
    update_cache: yes

- name: Create directories for operational scripts
  file:
    path: "{{ item }}"
    state: directory
    mode: '0700'
    owner: root
    group: root
  with_items:
    - /opt/c2
    - /opt/shell-handler

- name: Copy clean-logs.sh script
  copy:
    src: "../files/clean-logs.sh"
    dest: /opt/c2/clean-logs.sh
    mode: '0700'
    owner: root
    group: root

- name: Copy shell handler script
  copy:
    src: "../files/persistent-listener.sh"
    dest: /opt/shell-handler/persistent-listener.sh
    mode: '0700'
    owner: root
    group: root

- name: Configure shell handler script with C2 IP
  replace:
    path: /opt/shell-handler/persistent-listener.sh
    regexp: 'C2_HOST="127.0.0.1"'
    replace: 'C2_HOST="{{ c2_ip }}"'

- name: Configure shell handler script with listening port
  replace:
    path: /opt/shell-handler/persistent-listener.sh
    regexp: 'LISTEN_PORT=4444'
    replace: 'LISTEN_PORT={{ shell_handler_port }}'

- name: Create shell handler service
  template:
    src: "../templates/shell-handler.service.j2"
    dest: /etc/systemd/system/shell-handler.service
    mode: '0644'
    owner: root
    group: root

- name: Configure NGINX for zero-logging if enabled
  template:
    src: "../templates/nginx.conf.j2"
    dest: /etc/nginx/nginx.conf
    mode: '0644'
    owner: root
    group: root
  when: zero_logs | bool

# Configure nginx for dual HTTP/HTTPS with complete encryption
- name: Configure NGINX for secure C2 redirection
  template:
    content: |
      # HTTP server - redirects all to HTTPS
      server {
          listen 80;
          listen [::]:80;
          server_name {{ redirector_subdomain }}.{{ domain }};
          
          # Force redirect to HTTPS for all traffic
          return 301 https://$host$request_uri;
      }

      # HTTPS server - handles both HTTP and MTLS C2 traffic
      server {
          listen 443 ssl;
          listen [::]:443 ssl;
          server_name {{ redirector_subdomain }}.{{ domain }};
          
          # SSL Configuration
          ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem;
          ssl_protocols TLSv1.2 TLSv1.3;
          ssl_prefer_server_ciphers on;
          ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
          ssl_session_timeout 1d;
          ssl_session_cache shared:SSL:10m;
          
          # Root directory
          root /var/www/html;
          index index.html;
          
          # Primary location for legitimate website traffic
          location / {
              try_files $uri $uri/ =404;
          }
          
          # HTTP C2 paths (still over HTTPS)
          location /ajax/ {
              proxy_pass http://{{ c2_ip }}:8888;
              proxy_http_version 1.1;
              proxy_set_header Host $host;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "upgrade";
          }
          
          # MTLS/TCP passthrough for direct Sliver communication
          location /mtls/ {
              proxy_pass https://{{ c2_ip }}:443;
              proxy_http_version 1.1;
              proxy_set_header Host $host;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "upgrade";
              proxy_ssl_verify off;
          }
          
          # Static resources that redirect to C2
          location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ {
              proxy_pass http://{{ c2_ip }}:8888;
              proxy_http_version 1.1;
              proxy_set_header Host $host;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Real-IP $remote_addr;
          }
          
          # Security headers
          add_header X-Content-Type-Options "nosniff" always;
          add_header X-Frame-Options "SAMEORIGIN" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header Referrer-Policy "no-referrer" always;
          add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" always;
          
          # Disable logging if zero-logs is enabled
          {% if zero_logs | default(true) | bool %}
          access_log off;
          error_log /dev/null crit;
          {% endif %}
      }

      # Catch-all server block
      server {
          listen 80 default_server;
          listen [::]:80 default_server;
          listen 443 ssl default_server;
          listen [::]:443 ssl default_server;
          
          # Self-signed cert for catch-all
          ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
          ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
          
          # Redirect unknown traffic to a legitimate-looking site
          return 301 https://www.google.com;
          
          # Disable logs
          access_log off;
          error_log /dev/null crit;
      }
    dest: /etc/nginx/sites-available/default
    mode: '0644'
    owner: root
    group: root

- name: Create legitimate-looking index.html
  template:
    src: "../templates/redirector-index.html.j2"
    dest: /var/www/html/index.html
    mode: '0644'
    owner: www-data
    group: www-data

- name: Create SSL certificate setup instructions
  template:
    content: |
      #!/bin/bash
      # Let's Encrypt Certificate Setup Script
      # Run this after setting up DNS records pointing to this server

      # Replace these with your actual values if needed
      DOMAIN="{{ domain }}"
      SUBDOMAIN="{{ redirector_subdomain }}"
      EMAIL="admin@${DOMAIN}"

      echo "================================================"
      echo "Let's Encrypt Certificate Setup"
      echo "================================================"
      echo
      echo "Before running this script, make sure:"
      echo "1. DNS records are set up correctly"
      echo "   - ${SUBDOMAIN}.${DOMAIN} points to $(curl -s ifconfig.me)"
      echo "2. Port 80 is open to the internet"
      echo
      echo "Run the following command to get your certificate:"
      echo "certbot --nginx -d ${SUBDOMAIN}.${DOMAIN} --non-interactive --agree-tos -m ${EMAIL}"
      echo
      echo "================================================"
    dest: /opt/c2/setup-cert.sh
    mode: '0700'
    owner: root
    group: root

# Add stream module configuration for pure TCP forwarding
- name: Configure NGINX stream module for TCP traffic
  template:
    content: |
      # TCP stream configuration for MTLS
      stream {
          # TCP forwarding for MTLS
          server {
              listen 31337;
              proxy_pass {{ c2_ip }}:31337;
          }
          
          # Additional C2 ports
          server {
              listen 50051;
              proxy_pass {{ c2_ip }}:50051;
          }
      }
    dest: /etc/nginx/modules-enabled/stream.conf
    mode: '0644'
    owner: root
    group: root
  notify:
    - restart nginx

- name: Start and enable shell handler service
  systemd:
    name: shell-handler
    state: started
    enabled: yes
    daemon_reload: yes

- name: Set up cron job for log cleaning if zero-logs enabled
  cron:
    name: "Clean logs"
    minute: "0"
    hour: "*/6"
    job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
  when: zero_logs | bool