---
- name: Create and configure AWS EC2 instance for C2 Server
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    ssh_user: "kali"

  tasks:
    - block:
        - name: Select a random AWS region
          set_fact:
            selected_aws_region: "{{ aws_region_choices | random }}"
        
        - name: Set AMI ID based on region
          set_fact:
            aws_ami: "{{ ami_map[selected_aws_region] }}"
        
        - name: Create an EC2 key pair
          amazon.aws.ec2_key:
            access_key: "{{ aws_access_key }}"
            secret_key: "{{ aws_secret_key }}"
            name: "{{ instance_label }}"
            region: "{{ selected_aws_region }}"
            state: present
          register: key_pair

        - name: Save private key locally
          copy:
            content: "{{ key_pair.key.private_key }}"
            dest: "~/.ssh/{{ instance_label }}.pem"
            mode: "0600"
          when: key_pair.changed

        - name: Check if a security group with required properties already exists
          amazon.aws.ec2_security_group_info:
            filters:
              group-name: "security-sg"
            region: "{{ selected_aws_region }}"
            aws_access_key: "{{ aws_access_key }}"
            aws_secret_key: "{{ aws_secret_key }}"
          register: existing_sg
          ignore_errors: yes

        - name: Create a security group for the instance if it doesn't exist
          amazon.aws.ec2_group:
            name: "security-sg"
            description: "Completely open security group for instance {{ instance_label }}"
            region: "{{ selected_aws_region }}"
            aws_access_key: "{{ aws_access_key }}"
            aws_secret_key: "{{ aws_secret_key }}"
            rules:
              - proto: -1  # Allow all protocols
                cidr_ip: "0.0.0.0/0"  # Open to all IPv4 addresses
            rules_egress:
              - proto: -1
                cidr_ip: "0.0.0.0/0"
          when: existing_sg.security_groups | length == 0
          register: c2_sg_result

        - name: Launch EC2 instance
          amazon.aws.ec2_instance:
            aws_access_key: "{{ aws_access_key | default(omit) }}"
            aws_secret_key: "{{ aws_secret_key | default(omit) }}"
            region: "{{ selected_aws_region }}"
            name: "{{ instance_label }}"
            image_id: "{{ aws_ami }}"
            instance_type: "{{ aws_instance_type }}"
            key_name: "{{ instance_label }}"
            security_groups:
              - "security-sg"
            wait: no
            volumes:
              - device_name: "/dev/xvda"
                ebs:
                  volume_size: 100
                  delete_on_termination: true
          register: ec2_instance

        - name: Set instance_id fact for cleanup
          set_fact:
            instance_id: "{{ ec2_instance.instance_ids[0] | default('') }}"
          when: ec2_instance.instances is defined and ec2_instance.instances | length > 0

        - name: Wait for EC2 instance to reach running state
          amazon.aws.ec2_instance_info:
            aws_access_key: "{{ aws_access_key | default(omit) }}"
            aws_secret_key: "{{ aws_secret_key | default(omit) }}"
            region: "{{ selected_aws_region }}"
            instance_ids: "{{ ec2_instance.instance_ids }}"
          register: instance_info
          retries: 10
          delay: 30
          until: instance_info.instances[0].state.name == "running"

        - name: Fetch the public IP of the instance
          command: >
            aws ec2 describe-instances
            --filters "Name=tag:Name,Values={{ instance_label }}"
            "Name=instance-state-name,Values=running"
            --query "Reservations[*].Instances[*].PublicIpAddress"
            --output text
          register: instance_ip_result
          environment:
            AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
            AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
            AWS_DEFAULT_REGION: "{{ selected_aws_region }}"
          retries: 3
          delay: 200
          until: instance_ip_result.stdout is not none and instance_ip_result.stdout != ""

        - name: Set instance_public_ip variable
          ansible.builtin.set_fact:
            instance_public_ip: "{{ instance_ip_result.stdout | trim }}"
          when: instance_ip_result is defined and instance_ip_result.stdout != ""

        - name: Add EC2 instance to inventory
          add_host:
            name: "{{ instance_label }}"
            ansible_host: "{{ instance_public_ip }}"
            ansible_user: kali
            ansible_ssh_private_key_file: "{{ private_key_path }}.pem"
            ansible_ssh_common_args: '-o IdentitiesOnly=yes'

        - name: Pause for 300 seconds to allow instance initialization
          ansible.builtin.pause:
            seconds: 300

        - name: Validate SSH connection with retries
          block:
            - name: Attempt SSH connection
              ansible.builtin.command:
                cmd: ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -i "{{ private_key_path }}.pem" kali@{{ instance_public_ip }} echo "SSH connection successful"
              delay: 100  # Adjust delay if needed
              retries: 2
              register: ssh_validation_result
              ignore_errors: yes

            - name: Fail if SSH validation fails
              ansible.builtin.fail:
                msg: "SSH connection validation failed. Check instance settings, SSH key, and security group."
              when: (ssh_validation_result is not defined or ssh_validation_result.rc != 0)

- name: Configure AWS EC2 instance
  hosts: "{{ instance_label }}"
  gather_facts: true
  tasks:

        - name: Set a custom MOTD
          template:
            src: motd-aws.j2
            dest: /etc/motd
            owner: root
            group: root
            mode: '0644'
          become: true
          vars:
            letsencrypt_email: "{{ letsencrypt_email }}"
            mail_hostname: "{{ mail_hostname }}"
            domain: "{{ domain }}"
            gophish_admin_domain: "{{ gophish_admin_domain }}"
            gophish_site_domain: "{{ gophish_site_domain }}"

        - name: Hush Default Login Message
          become: true
          ansible.builtin.shell: |
            rm -rf '/usr/bin/kali-motd'
            
        - name: Update apt package list
          ansible.builtin.apt:
            update_cache: yes
          become: true

        - name: Install base utilities and tools via apt
          become: true
          ansible.builtin.apt:
            name:
              - git
              - wget
              - curl
              - unzip
              - python3-pip
              - python3-venv
              - tmux
              - pipx
              - nmap
              - tcpdump
              - hydra
              - john
              - hashcat
              - sqlmap
              - gobuster
              - dirb
              - enum4linux
              - dnsenum
              - seclists
              - responder
              - golang
              - proxychains
              - tor
              - crackmapexec
              - jq
              - unzip
              - postfix
              - certbot
              - opendkim
              - opendkim-tools
              - dovecot-core
              - dovecot-imapd
              - dovecot-pop3d
              - dovecot-sieve
              - dovecot-managesieved
              - yq
            state: present

        - name: Ensure pipx path is configured
          ansible.builtin.shell: |
            pipx ensurepath
          become: true
          args:
            executable: /bin/bash
        
        - name: Create Tools dir
          ansible.builtin.shell: |
            mkdir /home/kali/Tools

        - name: Install tools via pipx
          ansible.builtin.shell: |
            export PATH=$PATH:/root/.local/bin
            pipx ensurepath
            pipx install git+https://github.com/Pennyw0rth/NetExec
            pipx install git+https://github.com/blacklanternsecurity/TREVORspray
            pipx install impacket
          become: true
          args:
            executable: /bin/bash

        - name: Download Kerbrute
          ansible.builtin.shell: |
            mkdir -p /home/kali/Tools/Kerbrute
            wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64 -O /home/kali/Tools/Kerbrute/kerbrute
            chmod +x /home/kali/Tools/Kerbrute/kerbrute
          become: true
          args:
            executable: /bin/bash

        - name: Clone SharpCollection nightly builds
          ansible.builtin.git:
            repo: https://github.com/Flangvik/SharpCollection.git
            dest: /home/kali/Tools/SharpCollection
            version: master

        - name: Clone PEASS-ng
          ansible.builtin.git:
            repo: https://github.com/carlospolop/PEASS-ng.git
            dest: /home/kali/Tools/PEASS-ng

        - name: Clone MailSniper
          ansible.builtin.git:
            repo: https://github.com/dafthack/MailSniper.git
            dest: /home/kali/Tools/MailSniper

        - name: Clone Inveigh
          ansible.builtin.git:
            repo: https://github.com/Kevin-Robertson/Inveigh.git
            dest: /home/kali/Tools/Inveigh

        - name: Install Sliver C2 server
          ansible.builtin.shell: |
            curl https://sliver.sh/install | bash
            systemctl enable sliver
            systemctl start sliver
          become: true

        - name: Install Metasploit Framework (Nightly Build)
          ansible.builtin.shell: |
            curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > /home/kali/Tools/msfinstall
            chmod 755 /home/kali/Tools/msfinstall
            /home/kali/Tools/msfinstall
          become: true
          args:
            executable: /bin/bash

        - name: Grab GoPhish
          ansible.builtin.shell: |
            curl -L "$(curl -s https://api.github.com/repos/gophish/gophish/releases/latest | jq -r '.assets[] | select(.browser_download_url | contains("linux-64bit.zip")) | .browser_download_url')" -o /home/kali/Tools/gophish.zip
            unzip /home/kali/Tools/gophish.zip -d /home/kali/Tools/gophish
            rm -rf /home/kali/Tools/gophish.zip
            chmod +x /home/kali/Tools/gophish

        - name: Deploy Gophish config.json with custom admin port
          become: true
          template:
            src: gophish-config.j2
            dest: /home/kali/Tools/gophish/config.json
            owner: kali
            group: kali
            mode: '0644'
          vars:
            gophish_admin_port: "{{ gophish_admin_port }}"
            domain: "{{ domain }}"

        - name: Configure Postfix main.cf
          lineinfile:
            path: /etc/postfix/main.cf
            regexp: "{{ item.regexp }}"
            line: "{{ item.line }}"
          with_items:
            - { regexp: '^myhostname', line: "myhostname = mail.{{ domain }}" }
            - { regexp: '^mydomain', line: "mydomain = {{ domain }}" }
            - { regexp: '^myorigin', line: "myorigin = $mydomain" }
            - { regexp: '^inet_interfaces', line: "inet_interfaces = all" }
            - { regexp: '^inet_protocols', line: "inet_protocols = ipv4" }
            - { regexp: '^smtpd_banner', line: "smtpd_banner = $myhostname ESMTP $mail_name" }
            - { regexp: '^mynetworks', line: "mynetworks = 127.0.0.0/8 [::1]/128" }
            - { regexp: '^relay_domains', line: "relay_domains = $mydestination" }
            - { regexp: '^smtpd_tls_cert_file', line: "smtpd_tls_cert_file = /etc/letsencrypt/live/{{ domain }}/fullchain.pem" }
            - { regexp: '^smtpd_tls_key_file', line: "smtpd_tls_key_file = /etc/letsencrypt/live/{{ domain }}/privkey.pem" }
            - { regexp: '^smtpd_tls_security_level', line: "smtpd_tls_security_level = encrypt" }
            - { regexp: '^smtpd_tls_session_cache_database', line: "smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache" }
            - { regexp: '^smtp_tls_session_cache_database', line: "smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache" }
            - { regexp: '^smtpd_use_tls', line: "smtpd_use_tls = yes" }
            - { regexp: '^smtpd_tls_auth_only', line: "smtpd_tls_auth_only = yes" }
            - { regexp: '^milter_default_action', line: "milter_default_action = accept" }
            - { regexp: '^milter_protocol', line: "milter_protocol = 6" }
            - { regexp: '^smtpd_milters', line: "smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
            - { regexp: '^non_smtpd_milters', line: "non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
          become: true

        - name: Configure OpenDKIM
          lineinfile:
            path: /etc/opendkim.conf
            regexp: "{{ item.regexp }}"
            line: "{{ item.line }}"
          with_items:
            - { regexp: '^Domain', line: "Domain   {{ domain }}" }
            - { regexp: '^KeyFile', line: "KeyFile /etc/opendkim/keys/{{ domain }}/mail.private" }
            - { regexp: '^Selector', line: "Selector mail" }
            - { regexp: '^Socket', line: "Socket   local:/var/spool/postfix/opendkim/opendkim.sock" }
            - { regexp: '^Syslog', line: "Syslog   yes" }
            - { regexp: '^UMask', line: "UMask    002" }
            - { regexp: '^Mode', line: "Mode     sv" }
          become: true

        - name: Create DKIM directory
          file:
            path: /etc/opendkim/keys/{{ domain }}
            state: directory
            owner: opendkim
            group: opendkim
            mode: 0700
          become: true

        - name: Generate DKIM keys
          command: >
            opendkim-genkey -D /etc/opendkim/keys/{{ domain }} -d {{ domain }} -s mail
          args:
            creates: /etc/opendkim/keys/{{ domain }}/mail.private
          become: true

        - name: Set permissions for DKIM keys
          file:
            path: /etc/opendkim/keys/{{ domain }}/mail.private
            owner: opendkim
            group: opendkim
            mode: 0600
          become: true

        - name: Configure OpenDKIM TrustedHosts
          copy:
            content: |
              127.0.0.1
              ::1
              localhost
              {{ domain }}
            dest: /etc/opendkim/TrustedHosts
            owner: opendkim
            group: opendkim
            mode: 0644
          become: true

        - name: Enable submission port (587) in master.cf
          blockinfile:
            path: /etc/postfix/master.cf
            insertafter: '^#submission'
            block: |
              submission     inet  n       -       y       -       -       smtpd
                -o syslog_name=postfix/submission
                -o smtpd_tls_security_level=encrypt
                -o smtpd_sasl_auth_enable=yes
                -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
                -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
          become: true

        - name: Configure Dovecot for Postfix SASL
          blockinfile:
            path: /etc/dovecot/conf.d/10-master.conf
            insertafter: '^service auth {'
            block: |
              # Postfix smtp-auth
              unix_listener /var/spool/postfix/private/auth {
                mode = 0660
                user = postfix
                group = postfix
              }
          become: true

        - name: Set Dovecot auth_mechanisms
          lineinfile:
            path: /etc/dovecot/conf.d/10-auth.conf
            regexp: '^auth_mechanisms'
            line: 'auth_mechanisms = plain login'
          become: true

        - name: Create Dovecot password file for SASL authentication
          file:
            path: /etc/dovecot/passwd
            state: touch
            mode: '0600'
            owner: dovecot
            group: dovecot
          become: true

        - name: Add SMTP auth user to Dovecot
          lineinfile:
            path: /etc/dovecot/passwd
            line: "{{ smtp_auth_user }}:{{ smtp_auth_pass | password_hash('sha512_crypt') }}"
          become: true

        - name: Disable system auth and use passwd-file
          lineinfile:
            path: /etc/dovecot/conf.d/10-auth.conf
            regexp: '^!include auth-system.conf.ext'
            line: '#!include auth-system.conf.ext'
          become: true

        - name: Add auth-passwdfile configuration
          blockinfile:
            path: /etc/dovecot/conf.d/10-auth.conf
            insertafter: '^auth_mechanisms ='
            block: |
              passdb {
                driver = passwd-file
                args = scheme=sha512_crypt /etc/dovecot/passwd
              }
              userdb {
                driver = static
                args = uid=vmail gid=vmail home=/var/vmail/%u
              }
          become: true

        - name: Create vmail group
          group:
            name: vmail
            gid: 5000
            state: present
          become: true

        - name: Create vmail user
          user:
            name: vmail
            uid: 5000
            group: vmail
            create_home: no
          become: true

        - name: Restart Postfix
          service:
            name: postfix
            state: restarted
          become: true

        - name: Restart Dovecot
          service:
            name: dovecot
            state: restarted
          become: true