---
# Common task for configuring C2 server
# Shared across all providers

- name: Update apt cache
  apt:
    update_cache: yes

- name: Set a custom MOTD
  template:
    src: "../templates/motd.j2" 
    dest: /etc/motd
    owner: root
    group: root
    mode: '0644'

- name: Install base utilities and tools via apt
  apt:
    name:
      - git
      - wget
      - curl
      - unzip
      - python3-pip
      - python3-venv
      - tmux
      - pipx
      - nmap
      - tcpdump
      - hydra
      - john
      - hashcat
      - sqlmap
      - gobuster
      - dirb
      - enum4linux
      - dnsenum
      - seclists
      - responder
      - golang
      - proxychains
      - tor
      - crackmapexec
      - jq
      - unzip
      - postfix
      - certbot
      - opendkim
      - opendkim-tools
      - dovecot-core
      - dovecot-imapd
      - dovecot-pop3d
      - dovecot-sieve
      - dovecot-managesieved
      - yq
    state: present

- name: Copy operational scripts
  copy:
    src: "{{ item }}"
    dest: "/root/Tools/{{ item }}"
    mode: '0700'
    owner: root
    group: root
  with_items:
    - clean-logs.sh
    - secure-exit.sh
    - serve-beacons.sh

- name: Create operational directories
  file:
    path: "{{ item }}"
    state: directory
    mode: '0700'
    owner: root
    group: root
  with_items:
    - /root/Tools
    - /root/Tools/beacons
    - /root/Tools/payloads

- name: Create Havoc service file
  copy:
    content: |
      [Unit]
      Description=Havoc C2 Server
      After=network.target
      
      [Service]
      Type=simple
      User=root
      Group=root
      WorkingDirectory=/root/Tools/havoc/Teamserver
      ExecStart=/root/Tools/havoc/Teamserver/havoc server -d
      Restart=always
      RestartSec=10
      
      # Security measures
      PrivateTmp=true
      ProtectHome=false
      NoNewPrivileges=true
      
      # Hide process information
      StandardOutput=null
      StandardError=null
      
      [Install]
      WantedBy=multi-user.target
    dest: /etc/systemd/system/havoc.service
    mode: '0644'
    owner: root
    group: root

- name: Set up cron job for log cleaning if zero-logs enabled
  cron:
    name: "Clean logs"
    minute: "0"
    hour: "*/6"
    job: "/root/Tools/clean-logs.sh > /dev/null 2>&1"
  when: zero_logs | bool

- name: Install Let's Encrypt certificate if domain specified
  shell: |
    certbot certonly --standalone -d {{ c2_subdomain }}.{{ domain }} --non-interactive --agree-tos -m {{ letsencrypt_email }}
  args:
    creates: /etc/letsencrypt/live/{{ c2_subdomain }}.{{ domain }}/fullchain.pem
  when: domain != "example.com"

- name: Configure and start beacon server
  shell: |
    sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /root/Tools/serve-havoc-payloads.sh
    chmod +x /root/Tools/serve-havoc-payloads.sh
    # Check if beacon server is already running
    if ! pgrep -f "/root/Tools/serve-havoc-payloads.sh" > /dev/null; then
      nohup /root/Tools/serve-havoc-payloads.sh > /dev/null 2>&1 &
    fi