CoM-c2itall/providers/Linode/c2.yml

---
# Linode C2 Deployment Playbook

- name: Deploy Linode C2 server
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    # Default values for required variables
    linode_region: "{{ linode_region | default(region_choices | random) }}"
    plan: "{{ plan | default('g6-standard-2') }}"
    # Use static value to avoid recursive templating
    c2_image_static: "linode/kali"
    
    # Generate random instance name if not provided
    c2_name: "{{ c2_name | default('node-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"

  tasks:
    - name: Validate required Linode token
      assert:
        that:
          - linode_token is defined and linode_token != ""
        fail_msg: "Linode API token is required. Set linode_token in vars.yaml or via --linode-token."

    # Replace these tasks at the beginning of the playbook
    - name: Set region for C2 server
      set_fact:
        c2_region_value: "{{ selected_region | default(linode_region, true) | default('us-east', true) }}"

    - name: Display region selection information for debugging
      debug:
        msg:
          - "Selected Region: {{ selected_region | default('Not set') }}"
          - "Linode Region: {{ linode_region | default('Not set') }}"
          - "Using Region: {{ c2_region_value }}"
      when: debug | default(false) | bool

    - name: Set random region only if absolutely no region specified
      set_fact:
        c2_region_value: "{{ region_choices | random }}"
      when: region_choices is defined and region_choices|length > 0 and not selected_region is defined and not linode_region is defined and not c2_region_value is defined

    - name: Create C2 Linode instance
      block:
        - name: Try creating instance in specified region
          community.general.linode_v4:
            access_token: "{{ linode_token }}"
            label: "{{ c2_name }}"
            type: "{{ plan }}"
            region: "{{ c2_region_value }}"
            image: "linode/kali"
            root_pass: "{{ lookup('password', '/dev/null length=16') }}"
            authorized_keys:
              - "{{ lookup('file', ssh_key_path) }}"
            state: present
          register: c2_instance
      rescue:
        - name: Log region restriction error
          debug:
            msg: "Region {{ c2_region_value }} is restricted. Trying fallback regions..."

        - name: Set fallback regions (most reliable ones first)
          set_fact:
            fallback_regions:
              - "us-east"
              - "us-central" 
              - "eu-west"
              - "us-west"

        - name: Try fallback regions
          community.general.linode_v4:
            access_token: "{{ linode_token }}"
            label: "{{ c2_name }}"
            type: "{{ plan }}"
            region: "{{ item }}"
            image: "linode/kali"
            root_pass: "{{ lookup('password', '/dev/null length=16') }}"
            authorized_keys:
              - "{{ lookup('file', ssh_key_path) }}"
            state: present
          register: c2_instance
          loop: "{{ fallback_regions }}"
          when: c2_instance is not defined or c2_instance.failed
          ignore_errors: yes

        - name: Update deployment region with successful fallback
          set_fact:
            c2_region_value: "{{ item }}"
          loop: "{{ fallback_regions }}"
          when: c2_instance.results is defined and c2_instance.results[ansible_loop.index0] is defined and not c2_instance.results[ansible_loop.index0].failed
          
        - name: Fail if all regions are restricted
          fail:
            msg: "All attempted regions are restricted. Please try again later or contact Linode support."
          when: c2_instance.failed | default(true)

    - name: Set c2_ip for later use
      block:
        - name: Extract instance info from direct creation
          set_fact:
            c2_ip: "{{ c2_instance.instance.ipv4[0] }}"
            c2_instance_id: "{{ c2_instance.instance.id }}"
          when: c2_instance.instance is defined

        - name: Extract instance info from fallback creation
          set_fact:
            c2_ip: "{{ item.instance.ipv4[0] }}"
            c2_instance_id: "{{ item.instance.id }}"
          loop: "{{ c2_instance.results | default([]) }}"
          when: c2_instance.results is defined and item.instance is defined and not item.failed

    - name: Display final C2 deployment region and IP
      debug:
        msg: "C2 server deployed successfully in region {{ c2_region_value }} with IP {{ c2_ip }}"

    # Enhanced SSH wait task for Linode/c2.yml
    - name: Wait for C2 SSH to be available
      block:
        - name: Initial wait for port to be open
          wait_for:
            host: "{{ c2_instance.instance.ipv4[0] }}"
            port: 22
            delay: 60
            timeout: 180
            state: started

        - name: Additional pause for SSH initialization
          pause:
            seconds: 60
          
        - name: Test SSH connection
          command: >
            ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10
            -i {{ ssh_key_path | replace('.pub', '') }} root@{{ c2_instance.instance.ipv4[0] }} echo "SSH Ready"
          register: ssh_test
          retries: 5
          delay: 20
          until: ssh_test.rc == 0
          ignore_errors: yes
          
        - name: Fail if SSH test unsuccessful
          fail:
            msg: "Could not connect to C2 server via SSH after multiple attempts"
          when: ssh_test.rc != 0

    - name: Add C2 to inventory
      add_host:
        name: "c2"
        groups: "c2servers"
        ansible_host: "{{ c2_ip }}"
        ansible_user: "root"
        ansible_ssh_private_key_file: "{{ ssh_key_path | replace('.pub', '') }}"
        ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
        ansible_python_interpreter: "/usr/bin/python3"  # Use remote system's Python

- name: Configure C2 server
  hosts: c2servers
  become: true
  gather_facts: true
  vars_files:
    - vars.yaml
  vars:
    redirector_ip: "{{ hostvars['localhost']['redirector_ip'] | default('127.0.0.1') }}"
    c2_subdomain: "{{ c2_subdomain | default('mail') }}"
  tasks:
    - name: Wait for apt to be available
      apt:
        update_cache: yes
      register: apt_result
      until: apt_result is success
      retries: 5
      delay: 10
    
    - name: Disable root password authentication for SSH immediately
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^#?PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
      
    - name: Restart SSH service to apply changes
      service:
        name: ssh
        state: restarted

    - name: Include common tool installation tasks
      include_tasks: "../../common/tasks/install_tools.yml"
      
    - name: Include common C2 configuration tasks
      include_tasks: "../../modules/c2/tasks/configure_c2.yml"
         
    - name: Include common mail server configuration tasks
      include_tasks: "../../common/tasks/configure_mail.yml"
      
    - name: Print deployment summary
      debug:
        msg:
          - "C2 Server Deployment Complete!"
          - "-----------------------------"
          - "C2 Server IP: {{ ansible_host }}"
          - "C2 Server Domain: {{ domain }}"
          - "GoPhish Admin Port: {{ gophish_admin_port }}"
      when: not disable_summary | default(false)