---
# AWS C2 Server Deployment Playbook

- name: Deploy AWS C2 server
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    # Default values
    ssh_user: "{{ ssh_user | default('kali') }}"
    aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
    instance_type: "{{ aws_instance_type | default('t2.medium') }}"
    deployment_id: "{{ deployment_id | default('') }}"
    c2_name: "{{ c2_name | default('s-' + deployment_id) }}"
    # Check for shared infrastructure
    use_shared_infra: "{{ not (c2_region is defined and redirector_region is defined and c2_region != redirector_region) }}"

  tasks:
    - name: Validate AWS credentials
      assert:
        that:
          - aws_access_key is defined and aws_access_key != ""
          - aws_secret_key is defined and aws_secret_key != ""
        fail_msg: "AWS credentials are required"

    # Load shared infrastructure state if available
    - name: Check for shared infrastructure state
      stat:
        path: "infrastructure_state.json"
      register: infra_state_file
      when: use_shared_infra | bool
      
    - name: Load shared infrastructure state
      include_vars:
        file: "infrastructure_state.json"
        name: shared_infra
      when: use_shared_infra | bool and infra_state_file.stat.exists | default(false)
      
    - name: Set region for C2
      set_fact:
        aws_c2_region: "{{ shared_infra.region | default(aws_region) }}"
      when: use_shared_infra | bool and infra_state_file.stat.exists | default(false)
        
    - name: Set default region for C2
      set_fact:
        aws_c2_region: "{{ c2_region | default(aws_region) }}"
      when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))
      
    - name: Set AMI ID for selected region
      set_fact:
        ami_id: "{{ ami_map[aws_c2_region] }}"
      when: ami_map is defined and aws_c2_region in ami_map

    - name: Create EC2 key pair
      amazon.aws.ec2_key:
        name: "{{ c2_name }}"
        region: "{{ aws_c2_region }}"
        state: present
      register: c2_key_pair

    - name: Save private key locally
      copy:
        content: "{{ c2_key_pair.key.private_key }}"
        dest: "~/.ssh/{{ c2_name }}.pem"
        mode: "0600"
      when: c2_key_pair.changed and c2_key_pair.key.private_key is defined

    # Create new infrastructure only if not using shared
    - name: Create VPC
      amazon.aws.ec2_vpc_net:
        name: "{{ c2_name }}-vpc"
        cidr_block: "10.0.0.0/16"
        region: "{{ aws_c2_region }}"
        tags:
          Name: "{{ c2_name }}-vpc"
          deployment_id: "{{ deployment_id }}"
        state: present
      register: vpc_result
      when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))

    - name: Create internet gateway for VPC
      amazon.aws.ec2_vpc_igw:
        vpc_id: "{{ vpc_result.vpc.id }}"
        region: "{{ aws_c2_region }}"
        state: present
        tags:
          Name: "{{ c2_name }}-igw"
          deployment_id: "{{ deployment_id }}"
      register: igw_result
      when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))

    - name: Create subnet in VPC
      amazon.aws.ec2_vpc_subnet:
        vpc_id: "{{ vpc_result.vpc.id }}"
        cidr: "10.0.1.0/24"
        region: "{{ aws_c2_region }}"
        az: "{{ aws_c2_region }}a"
        map_public: yes
        tags:
          Name: "{{ c2_name }}-subnet"
          deployment_id: "{{ deployment_id }}"
      register: subnet_result
      when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))

    - name: Create routing table for internet access
      amazon.aws.ec2_vpc_route_table:
        vpc_id: "{{ vpc_result.vpc.id }}"
        region: "{{ aws_c2_region }}"
        tags:
          Name: "{{ c2_name }}-rtb"
          deployment_id: "{{ deployment_id }}"
        routes:
          - dest: "0.0.0.0/0"
            gateway_id: "{{ igw_result.gateway_id }}"
        subnets:
          - "{{ subnet_result.subnet.id }}"
      register: route_table_result
      when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))

    # Set VPC ID based on shared or created
    - name: Set VPC ID from shared infrastructure
      set_fact:
        vpc_id: "{{ shared_infra.vpc_id }}"
        subnet_id: "{{ shared_infra.subnet_id }}"
      when: use_shared_infra | bool and infra_state_file.stat.exists | default(false)

    - name: Set VPC ID from created infrastructure
      set_fact:
        vpc_id: "{{ vpc_result.vpc.id }}"
        subnet_id: "{{ subnet_result.subnet.id }}"
      when: not (use_shared_infra | bool and infra_state_file.stat.exists | default(false))

    # Create security group
    - name: Create security group
      amazon.aws.ec2_security_group:
        name: "{{ c2_name }}-sg"
        description: "Security group for C2 {{ c2_name }}"
        vpc_id: "{{ vpc_id }}"
        region: "{{ aws_c2_region }}"
        rules:
          - proto: tcp
            ports:
              - 22
              - 80
              - 443
              - "{{ havoc_teamserver_port | default(40056) }}"
              - "{{ havoc_http_port | default(8080) }}"
              - "{{ gophish_admin_port | default(3333) }}"
            cidr_ip: 0.0.0.0/0
        rules_egress:
          - proto: -1
            cidr_ip: 0.0.0.0/0
        state: present
      register: security_group

    # Launch the C2 server
    - name: Launch C2 instance
      amazon.aws.ec2_instance:
        name: "{{ c2_name }}"
        key_name: "{{ c2_name }}"
        instance_type: "{{ instance_type | default('t2.medium') }}"
        vpc_subnet_id: "{{ subnet_id }}"
        security_groups:
          - "{{ security_group.group_id }}"
        image_id: "{{ ami_id }}"
        region: "{{ aws_c2_region }}"
        state: present
        wait: yes
        volumes:
          - device_name: "/dev/xvda"
            ebs:
              volume_size: 100
              delete_on_termination: true
        tags:
          Name: "{{ c2_name }}"
          deployment_id: "{{ deployment_id }}"
      register: c2_instance

    - name: Set c2_ip for later use
      set_fact:
        c2_ip: "{{ c2_instance.instances[0].public_ip_address }}"
        c2_instance_id: "{{ c2_instance.instances[0].instance_id }}"

    - name: Wait for C2 instance initialization
      pause:
        seconds: 180
      when: c2_instance.changed

    - name: Wait for C2 SSH to be available
      wait_for:
        host: "{{ c2_ip }}"
        port: 22
        delay: 30
        timeout: 300
        state: started

    - name: Set correct permissions on SSH key
      file:
        path: "~/.ssh/{{ c2_name }}.pem"
        mode: "0600"

    - name: Add C2 to inventory
      add_host:
        name: "c2"
        groups: "c2servers"
        ansible_host: "{{ c2_ip }}"
        ansible_user: "{{ ssh_user }}"
        ansible_ssh_private_key_file: "~/.ssh/{{ c2_name }}.pem"
        ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes"

# Rest of the playbook for configuring the C2 server
- name: Configure C2 server
  hosts: c2servers
  become: true
  gather_facts: true
  vars_files:
    - vars.yaml
  vars:
    redirector_ip: "{{ hostvars['localhost']['redirector_ip'] | default('127.0.0.1') }}"
    c2_subdomain: "{{ c2_subdomain | default('mail') }}"
  
  # Include the rest of your C2 configuration tasks here
  tasks:
    - name: Wait for apt to be available
      apt:
        update_cache: yes
      register: apt_result
      until: apt_result is success
      retries: 5
      delay: 10

    - name: Include common tool installation tasks
      include_tasks: "../tasks/install_tools.yml"
      
    - name: Include common C2 configuration tasks
      include_tasks: "../tasks/configure_c2.yml"
      
    - name: Include common security hardening tasks
      include_tasks: "../tasks/security_hardening.yml"
      
    - name: Include common mail server configuration tasks
      include_tasks: "../tasks/configure_mail.yml"
      
    - name: Print deployment summary
      debug:
        msg:
          - "C2 Server Deployment Complete!"
          - "-----------------------------"
          - "C2 Server IP: {{ ansible_host }}"
          - "C2 Server Domain: {{ c2_subdomain }}.{{ domain }} (Update DNS A record)"
          - "GoPhish Admin Port: {{ gophish_admin_port }}"
          - "SSH Key: ~/.ssh/{{ hostvars['localhost']['c2_name'] }}.pem"
      when: not disable_summary | default(false)