Phantom v2: dual-mode architecture, security hardening, deployment management
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
n0mad1k
@@ -1,66 +1,66 @@
|
||||
---
|
||||
# Pi-hole Docker configuration and launch
|
||||
|
||||
- name: Create Pi-hole directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
loop:
|
||||
- /opt/pihole
|
||||
- /opt/pihole/etc-pihole
|
||||
- /opt/pihole/etc-dnsmasq.d
|
||||
# Pi-hole native configuration
|
||||
|
||||
- name: Generate Pi-hole admin password
|
||||
shell: "openssl rand -base64 16"
|
||||
register: pihole_password
|
||||
command: openssl rand -base64 16
|
||||
register: pihole_password_gen
|
||||
args:
|
||||
creates: /opt/pihole/.password
|
||||
creates: /etc/pihole/.phantom_password
|
||||
|
||||
- name: Save admin password
|
||||
copy:
|
||||
content: "{{ pihole_password.stdout }}"
|
||||
dest: /opt/pihole/.password
|
||||
content: "{{ pihole_password_gen.stdout }}"
|
||||
dest: /etc/pihole/.phantom_password
|
||||
mode: "0600"
|
||||
when: pihole_password.changed
|
||||
when: pihole_password_gen.changed
|
||||
|
||||
- name: Deploy Pi-hole Docker Compose
|
||||
copy:
|
||||
dest: /opt/pihole/docker-compose.yml
|
||||
content: |
|
||||
services:
|
||||
pihole:
|
||||
container_name: pihole
|
||||
image: pihole/pihole:latest
|
||||
ports:
|
||||
- "53:53/tcp"
|
||||
- "53:53/udp"
|
||||
- "80:80/tcp"
|
||||
environment:
|
||||
TZ: UTC
|
||||
WEBPASSWORD_FILE: /run/secrets/webpassword
|
||||
PIHOLE_DNS_: "{{ pihole_upstream }}"
|
||||
DNSSEC: "true"
|
||||
QUERY_LOGGING: "false"
|
||||
volumes:
|
||||
- /opt/pihole/etc-pihole:/etc/pihole
|
||||
- /opt/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
|
||||
secrets:
|
||||
- webpassword
|
||||
restart: unless-stopped
|
||||
dns:
|
||||
- 127.0.0.1
|
||||
- 9.9.9.9
|
||||
secrets:
|
||||
webpassword:
|
||||
file: /opt/pihole/.password
|
||||
mode: "0644"
|
||||
- name: Read saved password
|
||||
slurp:
|
||||
src: /etc/pihole/.phantom_password
|
||||
register: pihole_password_file
|
||||
|
||||
- name: Start Pi-hole
|
||||
shell: cd /opt/pihole && docker compose up -d
|
||||
args:
|
||||
creates: /opt/pihole/etc-pihole/pihole-FTL.db
|
||||
- name: Set Pi-hole admin password
|
||||
command: "pihole -a -p {{ (pihole_password_file.content | b64decode).strip() }}"
|
||||
changed_when: true
|
||||
|
||||
- name: Display admin password
|
||||
- name: Set upstream DNS servers
|
||||
command: "pihole -a setdns {{ pihole_upstream | replace(';', ' ') }}"
|
||||
changed_when: true
|
||||
|
||||
- name: Configure blocklist level
|
||||
block:
|
||||
- name: Update gravity (standard blocklist)
|
||||
command: pihole -g
|
||||
changed_when: true
|
||||
when: pihole_blocklist == "standard"
|
||||
|
||||
- name: Add aggressive blocklists
|
||||
lineinfile:
|
||||
path: /etc/pihole/adlists.list
|
||||
line: "{{ item }}"
|
||||
create: true
|
||||
mode: "0644"
|
||||
loop:
|
||||
- "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
|
||||
- "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt"
|
||||
when: pihole_blocklist == "aggressive"
|
||||
notify: update gravity
|
||||
|
||||
- name: Update gravity after blocklist changes
|
||||
command: pihole -g
|
||||
changed_when: true
|
||||
when: pihole_blocklist == "aggressive"
|
||||
|
||||
- name: Enable DNSSEC
|
||||
command: pihole -a dnssec on
|
||||
changed_when: true
|
||||
|
||||
- name: Ensure pihole-FTL is running
|
||||
service:
|
||||
name: pihole-FTL
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Display admin credentials
|
||||
debug:
|
||||
msg: "Pi-hole admin password: {{ pihole_password.stdout | default('(see /opt/pihole/.password)') }}"
|
||||
msg: "Pi-hole admin password saved to /etc/pihole/.phantom_password — access admin at http://{{ ansible_default_ipv4.address | default('server_ip') }}/admin"
|
||||
|
||||
@@ -1,40 +1,17 @@
|
||||
---
|
||||
# Pi-hole installation via Docker
|
||||
# Pi-hole native installation (no Docker)
|
||||
|
||||
- name: Install Docker prerequisites
|
||||
- name: Install Pi-hole prerequisites
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- git
|
||||
- iproute2
|
||||
- whiptail
|
||||
- ca-certificates
|
||||
- cron
|
||||
state: present
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg
|
||||
state: present
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
|
||||
- name: Install Docker
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
|
||||
- name: Enable Docker service
|
||||
service:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: true
|
||||
update_cache: true
|
||||
|
||||
- name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
|
||||
service:
|
||||
@@ -43,7 +20,7 @@
|
||||
enabled: false
|
||||
failed_when: false
|
||||
|
||||
- name: Set DNS fallback
|
||||
- name: Set DNS fallback for installation
|
||||
copy:
|
||||
dest: /etc/resolv.conf
|
||||
content: |
|
||||
@@ -51,6 +28,45 @@
|
||||
nameserver 1.1.1.1
|
||||
mode: "0644"
|
||||
|
||||
- name: Create Pi-hole config directory
|
||||
file:
|
||||
path: /etc/pihole
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy setupVars.conf for unattended install
|
||||
copy:
|
||||
dest: /etc/pihole/setupVars.conf
|
||||
content: |
|
||||
PIHOLE_INTERFACE={{ ansible_default_ipv4.interface | default('eth0') }}
|
||||
PIHOLE_DNS_1={{ pihole_upstream.split(';')[0] | default('9.9.9.9') }}
|
||||
PIHOLE_DNS_2={{ pihole_upstream.split(';')[1] | default('149.112.112.112') }}
|
||||
QUERY_LOGGING=false
|
||||
INSTALL_WEB_SERVER=true
|
||||
INSTALL_WEB_INTERFACE=true
|
||||
LIGHTTPD_ENABLED=false
|
||||
CACHE_SIZE=10000
|
||||
DNS_FQDN_REQUIRED=true
|
||||
DNS_BOGUS_PRIV=true
|
||||
DNSSEC=true
|
||||
BLOCKING_ENABLED=true
|
||||
WEBPASSWORD=
|
||||
mode: "0644"
|
||||
|
||||
- name: Clone Pi-hole repository
|
||||
git:
|
||||
repo: https://github.com/pi-hole/pi-hole.git
|
||||
dest: /opt/pihole-install
|
||||
version: master
|
||||
depth: 1
|
||||
|
||||
- name: Run Pi-hole installer (unattended)
|
||||
command: bash /opt/pihole-install/automated\ install/basic-install.sh --unattended
|
||||
args:
|
||||
creates: /usr/local/bin/pihole
|
||||
environment:
|
||||
PIHOLE_SKIP_OS_CHECK: "true"
|
||||
|
||||
- name: Allow DNS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
@@ -59,4 +75,14 @@
|
||||
loop:
|
||||
- { port: "53", proto: "tcp" }
|
||||
- { port: "53", proto: "udp" }
|
||||
- { port: "80", proto: "tcp" }
|
||||
|
||||
- name: Allow Pi-hole admin from private networks only
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "80"
|
||||
proto: tcp
|
||||
from_ip: "{{ item }}"
|
||||
loop:
|
||||
- "10.0.0.0/8"
|
||||
- "172.16.0.0/12"
|
||||
- "192.168.0.0/16"
|
||||
|
||||
Reference in New Issue
Block a user