n0mad1k
128 lines
4.4 KiB
YAML
128 lines
4.4 KiB
YAML
---
|
|
# Linode Redirector-only Deployment Playbook
|
|
|
|
- name: Deploy Linode redirector
|
|
hosts: localhost
|
|
gather_facts: false
|
|
connection: local
|
|
vars_files:
|
|
- vars.yaml
|
|
vars:
|
|
# Default values for required variables
|
|
linode_region: "{{ linode_region | default(region_choices | random) }}"
|
|
plan: "{{ plan | default('g6-nanode-1') }}"
|
|
image: "{{ image | default('linode/kali') }}"
|
|
|
|
# Generate random instance name if not provided
|
|
redirector_name: "{{ redirector_name | default('srv-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
|
|
|
|
# Generate random shell handler port if not provided
|
|
shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"
|
|
|
|
tasks:
|
|
- name: Validate required Linode token
|
|
assert:
|
|
that:
|
|
- linode_token is defined and linode_token != ""
|
|
fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."
|
|
|
|
- name: Create redirector Linode instance
|
|
community.general.linode_v4:
|
|
access_token: "{{ linode_token }}"
|
|
label: "{{ redirector_name }}"
|
|
type: "{{ plan }}"
|
|
region: "{{ linode_region }}"
|
|
image: "{{ image }}"
|
|
root_pass: "{{ lookup('password', '/dev/null length=16') }}"
|
|
authorized_keys:
|
|
- "{{ lookup('file', ssh_key_path) }}"
|
|
state: present
|
|
register: redirector_instance
|
|
|
|
- name: Set redirector_ip for later use
|
|
set_fact:
|
|
redirector_ip: "{{ redirector_instance.instance.ipv4[0] }}"
|
|
redirector_instance_id: "{{ redirector_instance.instance.id }}"
|
|
|
|
# Enhanced SSH wait task with better retry mechanism
|
|
- name: Wait for redirector SSH to be available
|
|
block:
|
|
- name: Initial wait for port to be open
|
|
wait_for:
|
|
host: "{{ redirector_instance.instance.ipv4[0] }}"
|
|
port: 22
|
|
delay: 60
|
|
timeout: 180
|
|
state: started
|
|
|
|
- name: Additional pause for SSH initialization
|
|
pause:
|
|
seconds: 60
|
|
|
|
- name: Test SSH connection
|
|
command: >
|
|
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10
|
|
-i {{ ssh_key_path | replace('.pub', '') }} root@{{ redirector_instance.instance.ipv4[0] }} echo "SSH Ready"
|
|
register: ssh_test
|
|
retries: 5
|
|
delay: 20
|
|
until: ssh_test.rc == 0
|
|
ignore_errors: yes
|
|
|
|
- name: Fail if SSH test unsuccessful
|
|
fail:
|
|
msg: "Could not connect to redirector via SSH after multiple attempts"
|
|
when: ssh_test.rc != 0
|
|
|
|
# Fix: Use hardcoded "redirector" for the name and "root" for the user
|
|
- name: Add redirector to inventory
|
|
add_host:
|
|
name: "redirector"
|
|
groups: "redirectors"
|
|
ansible_host: "{{ redirector_ip }}"
|
|
ansible_user: "root"
|
|
ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
|
|
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
|
|
|
|
- name: Configure redirector server
|
|
hosts: redirectors
|
|
become: true
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars.yaml
|
|
vars:
|
|
c2_ip: "{{ hostvars['localhost']['c2_ip'] | default('127.0.0.1') }}"
|
|
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
|
tasks:
|
|
- name: Wait for apt to be available
|
|
apt:
|
|
update_cache: yes
|
|
register: apt_result
|
|
until: apt_result is success
|
|
retries: 5
|
|
delay: 10
|
|
|
|
- name: Disable root password authentication for SSH immediately
|
|
lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
state: present
|
|
|
|
- name: Restart SSH service to apply changes
|
|
service:
|
|
name: ssh
|
|
state: restarted
|
|
|
|
- name: Include common redirector configuration tasks
|
|
include_tasks: "../tasks/configure_redirector.yml"
|
|
|
|
- name: Print deployment summary
|
|
debug:
|
|
msg:
|
|
- "Redirector Deployment Complete!"
|
|
- "-------------------------------"
|
|
- "Redirector IP: {{ ansible_host }}"
|
|
- "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
|
|
- "Shell Handler Port: {{ shell_handler_port }}"
|
|
when: not disable_summary | default(false) |