Initial release: ghost_protocol privacy toolkit
This commit is contained in:
ghost
@@ -0,0 +1,92 @@
|
||||
---
|
||||
# All-in-One deployment — multiple services on a single server
|
||||
# Installs nginx as reverse proxy with TLS termination via Certbot,
|
||||
# then deploys selected services behind vhost routing.
|
||||
#
|
||||
# NOTE: This playbook includes task files directly rather than
|
||||
# importing full playbooks, to allow conditional composition.
|
||||
|
||||
- name: All-in-One Privacy Server
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
base_domain: "{{ domain }}"
|
||||
selected_services: "{{ services | default([]) }}"
|
||||
certbot_email: "{{ certbot_email | default('') }}"
|
||||
target_host: "{{ target_host | default('localhost') }}"
|
||||
|
||||
tasks:
|
||||
# ─── Base: Nginx + Certbot ────────────────────────────────────────
|
||||
- name: Install nginx and certbot
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
|
||||
- name: Remove default nginx site
|
||||
file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
notify: reload nginx
|
||||
|
||||
- name: Allow HTTP/HTTPS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "80"
|
||||
- "443"
|
||||
|
||||
# ─── Deploy Individual Services (task files, not full playbooks) ──
|
||||
- name: Deploy Matrix — Synapse
|
||||
include_tasks: "{{ playbook_dir }}/../matrix/tasks/synapse.yml"
|
||||
when: "'matrix' in selected_services"
|
||||
|
||||
- name: Deploy Matrix — Element Web
|
||||
include_tasks: "{{ playbook_dir }}/../matrix/tasks/element.yml"
|
||||
when: "'matrix' in selected_services and (matrix_element_web | default(true) | bool)"
|
||||
|
||||
- name: Deploy Matrix — Nginx vhost
|
||||
include_tasks: "{{ playbook_dir }}/../matrix/tasks/nginx.yml"
|
||||
when: "'matrix' in selected_services"
|
||||
|
||||
- name: Deploy WireGuard — Install
|
||||
include_tasks: "{{ playbook_dir }}/../vpn/tasks/install.yml"
|
||||
when: "'vpn' in selected_services"
|
||||
|
||||
- name: Deploy WireGuard — Configure
|
||||
include_tasks: "{{ playbook_dir }}/../vpn/tasks/configure.yml"
|
||||
when: "'vpn' in selected_services"
|
||||
|
||||
- name: Deploy Pi-hole — Install
|
||||
include_tasks: "{{ playbook_dir }}/../dns/tasks/install.yml"
|
||||
when: "'dns' in selected_services"
|
||||
|
||||
- name: Deploy Pi-hole — Configure
|
||||
include_tasks: "{{ playbook_dir }}/../dns/tasks/configure.yml"
|
||||
when: "'dns' in selected_services"
|
||||
|
||||
# Stub services — print notice
|
||||
- name: Notice for stub services
|
||||
debug:
|
||||
msg: "Service '{{ item }}' playbook not yet implemented — skipping"
|
||||
loop: "{{ selected_services | select('in', ['cloud', 'vault', 'media', 'email']) | list }}"
|
||||
|
||||
handlers:
|
||||
- name: reload nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
|
||||
- name: restart synapse
|
||||
service:
|
||||
name: matrix-synapse
|
||||
state: restarted
|
||||
|
||||
- name: restart sshd
|
||||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# Cloud deployment — Coming soon
|
||||
# This is a stub playbook. Full implementation planned.
|
||||
|
||||
- name: Deploy Cloud Server
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Placeholder
|
||||
debug:
|
||||
msg: "Cloud playbook not yet implemented. Check phantom/README.md for status."
|
||||
@@ -0,0 +1,144 @@
|
||||
---
|
||||
# Base server hardening — applied to all deployments
|
||||
# Covers: updates, firewall, fail2ban, SSH hardening
|
||||
|
||||
- name: Base Server Hardening
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
ssh_port: "{{ ssh_port | default(22) }}"
|
||||
ssh_allow_password: false
|
||||
|
||||
tasks:
|
||||
# ─── System Updates ─────────────────────────────────────────────────
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: true
|
||||
cache_valid_time: 3600
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Upgrade all packages
|
||||
apt:
|
||||
upgrade: safe
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Install essential packages
|
||||
apt:
|
||||
name:
|
||||
- ufw
|
||||
- fail2ban
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
- curl
|
||||
- wget
|
||||
- gnupg
|
||||
- ca-certificates
|
||||
- software-properties-common
|
||||
state: present
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
# ─── UFW Firewall ───────────────────────────────────────────────────
|
||||
- name: Set UFW default deny incoming
|
||||
ufw:
|
||||
direction: incoming
|
||||
policy: deny
|
||||
|
||||
- name: Set UFW default allow outgoing
|
||||
ufw:
|
||||
direction: outgoing
|
||||
policy: allow
|
||||
|
||||
- name: Allow SSH through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ ssh_port }}"
|
||||
proto: tcp
|
||||
|
||||
- name: Enable UFW
|
||||
ufw:
|
||||
state: enabled
|
||||
|
||||
# ─── Fail2ban ───────────────────────────────────────────────────────
|
||||
- name: Configure fail2ban SSH jail
|
||||
copy:
|
||||
dest: /etc/fail2ban/jail.local
|
||||
content: |
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = {{ ssh_port }}
|
||||
filter = sshd
|
||||
logpath = /var/log/auth.log
|
||||
maxretry = 5
|
||||
bantime = 3600
|
||||
findtime = 600
|
||||
mode: "0644"
|
||||
notify: restart fail2ban
|
||||
|
||||
- name: Enable fail2ban
|
||||
service:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
# ─── SSH Hardening ──────────────────────────────────────────────────
|
||||
- name: Disable SSH password authentication
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#?PasswordAuthentication"
|
||||
line: "PasswordAuthentication no"
|
||||
when: not ssh_allow_password
|
||||
notify: restart sshd
|
||||
|
||||
- name: Disable SSH root login with password
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#?PermitRootLogin"
|
||||
line: "PermitRootLogin prohibit-password"
|
||||
notify: restart sshd
|
||||
|
||||
- name: Disable SSH X11 forwarding
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#?X11Forwarding"
|
||||
line: "X11Forwarding no"
|
||||
notify: restart sshd
|
||||
|
||||
# ─── Automatic Security Updates ─────────────────────────────────────
|
||||
- name: Enable unattended upgrades for security
|
||||
copy:
|
||||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
content: |
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
APT::Periodic::AutocleanInterval "7";
|
||||
mode: "0644"
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
# ─── Kernel Hardening ───────────────────────────────────────────────
|
||||
- name: Apply sysctl hardening
|
||||
sysctl:
|
||||
name: "{{ item.key }}"
|
||||
value: "{{ item.value }}"
|
||||
sysctl_set: true
|
||||
reload: true
|
||||
loop:
|
||||
- { key: "net.ipv4.conf.all.rp_filter", value: "1" }
|
||||
- { key: "net.ipv4.conf.default.rp_filter", value: "1" }
|
||||
- { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
|
||||
- { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
|
||||
- { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
|
||||
- { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
|
||||
- { key: "net.ipv6.conf.default.accept_redirects", value: "0" }
|
||||
- { key: "net.ipv4.conf.all.send_redirects", value: "0" }
|
||||
- { key: "net.ipv4.conf.default.send_redirects", value: "0" }
|
||||
|
||||
handlers:
|
||||
- name: restart fail2ban
|
||||
service:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
||||
- name: restart sshd
|
||||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
# Pi-hole DNS server deployment (Docker-based)
|
||||
|
||||
- name: Deploy Pi-hole DNS Server
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
pihole_upstream: "{{ dns_upstream | default('9.9.9.9;149.112.112.112') }}"
|
||||
pihole_domain: "{{ dns_domain | default('') }}"
|
||||
pihole_blocklist: "{{ dns_blocklist | default('standard') }}"
|
||||
target_host: "{{ target_host | default('localhost') }}"
|
||||
|
||||
tasks:
|
||||
- name: Include Pi-hole installation
|
||||
include_tasks: tasks/install.yml
|
||||
|
||||
- name: Include Pi-hole configuration
|
||||
include_tasks: tasks/configure.yml
|
||||
@@ -0,0 +1,66 @@
|
||||
---
|
||||
# Pi-hole Docker configuration and launch
|
||||
|
||||
- name: Create Pi-hole directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
loop:
|
||||
- /opt/pihole
|
||||
- /opt/pihole/etc-pihole
|
||||
- /opt/pihole/etc-dnsmasq.d
|
||||
|
||||
- name: Generate Pi-hole admin password
|
||||
shell: "openssl rand -base64 16"
|
||||
register: pihole_password
|
||||
args:
|
||||
creates: /opt/pihole/.password
|
||||
|
||||
- name: Save admin password
|
||||
copy:
|
||||
content: "{{ pihole_password.stdout }}"
|
||||
dest: /opt/pihole/.password
|
||||
mode: "0600"
|
||||
when: pihole_password.changed
|
||||
|
||||
- name: Deploy Pi-hole Docker Compose
|
||||
copy:
|
||||
dest: /opt/pihole/docker-compose.yml
|
||||
content: |
|
||||
services:
|
||||
pihole:
|
||||
container_name: pihole
|
||||
image: pihole/pihole:latest
|
||||
ports:
|
||||
- "53:53/tcp"
|
||||
- "53:53/udp"
|
||||
- "80:80/tcp"
|
||||
environment:
|
||||
TZ: UTC
|
||||
WEBPASSWORD_FILE: /run/secrets/webpassword
|
||||
PIHOLE_DNS_: "{{ pihole_upstream }}"
|
||||
DNSSEC: "true"
|
||||
QUERY_LOGGING: "false"
|
||||
volumes:
|
||||
- /opt/pihole/etc-pihole:/etc/pihole
|
||||
- /opt/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
|
||||
secrets:
|
||||
- webpassword
|
||||
restart: unless-stopped
|
||||
dns:
|
||||
- 127.0.0.1
|
||||
- 9.9.9.9
|
||||
secrets:
|
||||
webpassword:
|
||||
file: /opt/pihole/.password
|
||||
mode: "0644"
|
||||
|
||||
- name: Start Pi-hole
|
||||
shell: cd /opt/pihole && docker compose up -d
|
||||
args:
|
||||
creates: /opt/pihole/etc-pihole/pihole-FTL.db
|
||||
|
||||
- name: Display admin password
|
||||
debug:
|
||||
msg: "Pi-hole admin password: {{ pihole_password.stdout | default('(see /opt/pihole/.password)') }}"
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
# Pi-hole installation via Docker
|
||||
|
||||
- name: Install Docker prerequisites
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
state: present
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg
|
||||
state: present
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
|
||||
- name: Install Docker
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
|
||||
- name: Enable Docker service
|
||||
service:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
|
||||
service:
|
||||
name: systemd-resolved
|
||||
state: stopped
|
||||
enabled: false
|
||||
failed_when: false
|
||||
|
||||
- name: Set DNS fallback
|
||||
copy:
|
||||
dest: /etc/resolv.conf
|
||||
content: |
|
||||
nameserver 9.9.9.9
|
||||
nameserver 1.1.1.1
|
||||
mode: "0644"
|
||||
|
||||
- name: Allow DNS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item.port }}"
|
||||
proto: "{{ item.proto }}"
|
||||
loop:
|
||||
- { port: "53", proto: "tcp" }
|
||||
- { port: "53", proto: "udp" }
|
||||
- { port: "80", proto: "tcp" }
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# Email deployment — Coming soon
|
||||
# This is a stub playbook. Full implementation planned.
|
||||
|
||||
- name: Deploy Email Server
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Placeholder
|
||||
debug:
|
||||
msg: "Email playbook not yet implemented. Check phantom/README.md for status."
|
||||
@@ -0,0 +1,38 @@
|
||||
---
|
||||
# Matrix (Synapse) + Element Web deployment
|
||||
# Installs Synapse homeserver with optional Element Web frontend
|
||||
|
||||
- name: Deploy Matrix Homeserver
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
matrix_domain: "{{ domain }}"
|
||||
matrix_server_name: "{{ matrix_server_name | default(domain) }}"
|
||||
matrix_admin: "{{ matrix_admin_user | default('admin') }}"
|
||||
matrix_admin_pass: "{{ matrix_admin_password }}"
|
||||
matrix_registration_enabled: "{{ matrix_registration | default(false) }}"
|
||||
element_enabled: "{{ matrix_element_web | default(true) }}"
|
||||
matrix_signing_key: "{{ matrix_signing_key }}"
|
||||
target_host: "{{ target_host | default('localhost') }}"
|
||||
|
||||
tasks:
|
||||
- name: Include Synapse installation tasks
|
||||
include_tasks: tasks/synapse.yml
|
||||
|
||||
- name: Include Element Web tasks
|
||||
include_tasks: tasks/element.yml
|
||||
when: element_enabled | bool
|
||||
|
||||
- name: Include nginx reverse proxy tasks
|
||||
include_tasks: tasks/nginx.yml
|
||||
|
||||
handlers:
|
||||
- name: restart synapse
|
||||
service:
|
||||
name: matrix-synapse
|
||||
state: restarted
|
||||
|
||||
- name: reload nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
# Element Web frontend installation
|
||||
|
||||
- name: Install nginx (if not already)
|
||||
apt:
|
||||
name: nginx
|
||||
state: present
|
||||
|
||||
- name: Create Element Web directory
|
||||
file:
|
||||
path: /var/www/element
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Download latest Element Web release
|
||||
shell: |
|
||||
LATEST=$(curl -s https://api.github.com/repos/element-hq/element-web/releases/latest | grep -oP '"tag_name": "\K[^"]+')
|
||||
curl -sL "https://github.com/element-hq/element-web/releases/download/${LATEST}/element-${LATEST}.tar.gz" | tar xz -C /var/www/element --strip-components=1
|
||||
args:
|
||||
creates: /var/www/element/index.html
|
||||
|
||||
- name: Deploy Element Web config
|
||||
copy:
|
||||
dest: /var/www/element/config.json
|
||||
content: |
|
||||
{
|
||||
"default_server_config": {
|
||||
"m.homeserver": {
|
||||
"base_url": "https://{{ matrix_domain }}",
|
||||
"server_name": "{{ matrix_server_name }}"
|
||||
}
|
||||
},
|
||||
"brand": "Element",
|
||||
"integrations_ui_url": "",
|
||||
"integrations_rest_url": "",
|
||||
"disable_guests": true,
|
||||
"disable_3pid_login": false,
|
||||
"default_theme": "dark"
|
||||
}
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0644"
|
||||
@@ -0,0 +1,115 @@
|
||||
---
|
||||
# Nginx reverse proxy for Matrix + Element
|
||||
# Two-phase: HTTP-only first for certbot, then full SSL config
|
||||
|
||||
- name: Create certbot webroot
|
||||
file:
|
||||
path: /var/www/certbot
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy HTTP-only nginx config (for certbot)
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/matrix
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 200 'phantom setup in progress';
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
|
||||
- name: Enable Matrix nginx site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/matrix
|
||||
dest: /etc/nginx/sites-enabled/matrix
|
||||
state: link
|
||||
notify: reload nginx
|
||||
|
||||
- name: Flush handlers to apply HTTP config
|
||||
meta: flush_handlers
|
||||
|
||||
- name: Obtain TLS certificate
|
||||
command: >
|
||||
certbot certonly --webroot -w /var/www/certbot
|
||||
-d {{ matrix_domain }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
{% if certbot_email is defined and certbot_email %}
|
||||
--email {{ certbot_email }}
|
||||
{% else %}
|
||||
--register-unsafely-without-email
|
||||
{% endif %}
|
||||
args:
|
||||
creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
|
||||
|
||||
- name: Deploy full SSL nginx config
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/matrix
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen 8448 ssl http2;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
client_max_body_size 50m;
|
||||
|
||||
# Synapse
|
||||
location ~* ^(\/_matrix|\/_synapse\/client) {
|
||||
proxy_pass http://127.0.0.1:8008;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# .well-known delegation
|
||||
location /.well-known/matrix/server {
|
||||
return 200 '{"m.server": "{{ matrix_domain }}:443"}';
|
||||
add_header Content-Type application/json;
|
||||
}
|
||||
|
||||
location /.well-known/matrix/client {
|
||||
return 200 '{"m.homeserver": {"base_url": "https://{{ matrix_domain }}"}}';
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
}
|
||||
|
||||
# Element Web (if enabled)
|
||||
location / {
|
||||
root /var/www/element;
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
@@ -0,0 +1,99 @@
|
||||
---
|
||||
# Synapse homeserver installation and configuration
|
||||
|
||||
- name: Install dependencies
|
||||
apt:
|
||||
name:
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- libpq-dev
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
|
||||
- name: Add Matrix Synapse apt repository key
|
||||
apt_key:
|
||||
url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
|
||||
state: present
|
||||
|
||||
- name: Add Matrix Synapse apt repository
|
||||
apt_repository:
|
||||
repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
|
||||
state: present
|
||||
filename: matrix-org
|
||||
|
||||
- name: Install Synapse
|
||||
apt:
|
||||
name: matrix-synapse-py3
|
||||
state: present
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
|
||||
- name: Create PostgreSQL database
|
||||
become_user: postgres
|
||||
postgresql_db:
|
||||
name: synapse
|
||||
encoding: UTF-8
|
||||
lc_collate: C
|
||||
lc_ctype: C
|
||||
template: template0
|
||||
|
||||
- name: Create PostgreSQL user
|
||||
become_user: postgres
|
||||
postgresql_user:
|
||||
name: synapse
|
||||
password: "{{ matrix_signing_key[:32] }}"
|
||||
db: synapse
|
||||
priv: ALL
|
||||
|
||||
- name: Deploy Synapse homeserver config
|
||||
template:
|
||||
src: ../templates/homeserver.yaml.j2
|
||||
dest: /etc/matrix-synapse/homeserver.yaml
|
||||
owner: matrix-synapse
|
||||
group: matrix-synapse
|
||||
mode: "0640"
|
||||
notify: restart synapse
|
||||
|
||||
- name: Allow Matrix federation port through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "8448"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTP/HTTPS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "80"
|
||||
- "443"
|
||||
|
||||
- name: Enable and start Synapse
|
||||
service:
|
||||
name: matrix-synapse
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Wait for Synapse to be ready
|
||||
wait_for:
|
||||
port: 8008
|
||||
host: 127.0.0.1
|
||||
timeout: 30
|
||||
|
||||
- name: Create admin user
|
||||
command: >
|
||||
register_new_matrix_user
|
||||
-u {{ matrix_admin }}
|
||||
-p {{ matrix_admin_pass }}
|
||||
-a
|
||||
-c /etc/matrix-synapse/homeserver.yaml
|
||||
http://localhost:8008
|
||||
register: admin_create
|
||||
failed_when: false
|
||||
changed_when: admin_create.rc == 0
|
||||
@@ -0,0 +1,53 @@
|
||||
## Synapse Homeserver Configuration
|
||||
## Generated by phantom
|
||||
|
||||
server_name: "{{ matrix_server_name }}"
|
||||
pid_file: /run/matrix-synapse.pid
|
||||
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
user: synapse
|
||||
password: "{{ matrix_signing_key[:32] }}"
|
||||
database: synapse
|
||||
host: localhost
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
|
||||
log_config: "/etc/matrix-synapse/log.yaml"
|
||||
media_store_path: /var/lib/matrix-synapse/media
|
||||
signing_key_path: "/etc/matrix-synapse/{{ matrix_server_name }}.signing.key"
|
||||
|
||||
enable_registration: {{ matrix_registration_enabled | lower }}
|
||||
{% if not matrix_registration_enabled %}
|
||||
enable_registration_without_verification: false
|
||||
{% endif %}
|
||||
|
||||
suppress_key_server_warning: true
|
||||
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
|
||||
max_upload_size: 50M
|
||||
|
||||
url_preview_enabled: true
|
||||
url_preview_ip_range_blacklist:
|
||||
- '127.0.0.0/8'
|
||||
- '10.0.0.0/8'
|
||||
- '172.16.0.0/12'
|
||||
- '192.168.0.0/16'
|
||||
- '100.64.0.0/10'
|
||||
- '192.0.0.0/24'
|
||||
- '169.254.0.0/16'
|
||||
- '::1/128'
|
||||
- 'fe80::/10'
|
||||
- 'fc00::/7'
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# Media deployment — Coming soon
|
||||
# This is a stub playbook. Full implementation planned.
|
||||
|
||||
- name: Deploy Media Server
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Placeholder
|
||||
debug:
|
||||
msg: "Media playbook not yet implemented. Check phantom/README.md for status."
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# Vault deployment — Coming soon
|
||||
# This is a stub playbook. Full implementation planned.
|
||||
|
||||
- name: Deploy Vault Server
|
||||
hosts: all
|
||||
become: true
|
||||
tasks:
|
||||
- name: Placeholder
|
||||
debug:
|
||||
msg: "Vault playbook not yet implemented. Check phantom/README.md for status."
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
# WireGuard VPN server deployment
|
||||
|
||||
- name: Deploy WireGuard VPN Server
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
wg_port: "{{ vpn_port | default(51820) }}"
|
||||
wg_clients: "{{ vpn_client_count | default(3) }}"
|
||||
wg_dns: "{{ vpn_dns | default('1.1.1.1') }}"
|
||||
wg_subnet: "{{ vpn_subnet | default('10.66.66.0/24') }}"
|
||||
wg_allowed_ips: "{{ vpn_allowed_ips | default('0.0.0.0/0, ::/0') }}"
|
||||
target_host: "{{ target_host | default('localhost') }}"
|
||||
|
||||
tasks:
|
||||
- name: Include WireGuard installation tasks
|
||||
include_tasks: tasks/install.yml
|
||||
|
||||
- name: Include WireGuard configuration tasks
|
||||
include_tasks: tasks/configure.yml
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
# WireGuard server and client configuration
|
||||
|
||||
- name: Detect primary network interface
|
||||
shell: ip route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}'
|
||||
register: primary_interface
|
||||
changed_when: false
|
||||
|
||||
- name: Generate client keys
|
||||
shell: |
|
||||
mkdir -p /etc/wireguard/clients
|
||||
for i in $(seq 1 {{ wg_clients }}); do
|
||||
if [ ! -f /etc/wireguard/clients/client${i}_private.key ]; then
|
||||
wg genkey | tee /etc/wireguard/clients/client${i}_private.key | wg pubkey > /etc/wireguard/clients/client${i}_public.key
|
||||
wg genpsk > /etc/wireguard/clients/client${i}_psk.key
|
||||
chmod 600 /etc/wireguard/clients/client${i}_*.key
|
||||
fi
|
||||
done
|
||||
args:
|
||||
creates: /etc/wireguard/clients/client1_private.key
|
||||
|
||||
- name: Build WireGuard server config
|
||||
shell: |
|
||||
SERVER_PRIVKEY=$(cat /etc/wireguard/server_private.key)
|
||||
IFACE={{ primary_interface.stdout | trim }}
|
||||
|
||||
cat > /etc/wireguard/wg0.conf << EOF
|
||||
[Interface]
|
||||
Address = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '.1/24') }}
|
||||
ListenPort = {{ wg_port }}
|
||||
PrivateKey = ${SERVER_PRIVKEY}
|
||||
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ${IFACE} -j MASQUERADE
|
||||
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ${IFACE} -j MASQUERADE
|
||||
|
||||
EOF
|
||||
|
||||
for i in $(seq 1 {{ wg_clients }}); do
|
||||
CLIENT_PUBKEY=$(cat /etc/wireguard/clients/client${i}_public.key)
|
||||
CLIENT_PSK=$(cat /etc/wireguard/clients/client${i}_psk.key)
|
||||
cat >> /etc/wireguard/wg0.conf << EOF
|
||||
[Peer]
|
||||
# Client ${i}
|
||||
PublicKey = ${CLIENT_PUBKEY}
|
||||
PresharedKey = ${CLIENT_PSK}
|
||||
AllowedIPs = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '') }}.$(( i + 1 ))/32
|
||||
|
||||
EOF
|
||||
done
|
||||
|
||||
chmod 600 /etc/wireguard/wg0.conf
|
||||
args:
|
||||
creates: /etc/wireguard/wg0.conf
|
||||
|
||||
- name: Generate client config files
|
||||
shell: |
|
||||
SERVER_PUBKEY=$(echo '{{ server_privkey_content.content | b64decode | trim }}' | wg pubkey)
|
||||
SERVER_ENDPOINT="{{ target_host }}:{{ wg_port }}"
|
||||
|
||||
for i in $(seq 1 {{ wg_clients }}); do
|
||||
CLIENT_PRIVKEY=$(cat /etc/wireguard/clients/client${i}_private.key)
|
||||
CLIENT_PSK=$(cat /etc/wireguard/clients/client${i}_psk.key)
|
||||
CLIENT_IP="{{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '') }}.$(( i + 1 ))"
|
||||
|
||||
cat > /etc/wireguard/clients/client${i}.conf << EOF
|
||||
[Interface]
|
||||
PrivateKey = ${CLIENT_PRIVKEY}
|
||||
Address = ${CLIENT_IP}/32
|
||||
DNS = {{ wg_dns }}
|
||||
|
||||
[Peer]
|
||||
PublicKey = ${SERVER_PUBKEY}
|
||||
PresharedKey = ${CLIENT_PSK}
|
||||
Endpoint = ${SERVER_ENDPOINT}
|
||||
AllowedIPs = {{ wg_allowed_ips }}
|
||||
PersistentKeepalive = 25
|
||||
EOF
|
||||
|
||||
# Generate QR code
|
||||
qrencode -t ansiutf8 < /etc/wireguard/clients/client${i}.conf > /etc/wireguard/clients/client${i}_qr.txt 2>/dev/null || true
|
||||
done
|
||||
args:
|
||||
creates: /etc/wireguard/clients/client1.conf
|
||||
|
||||
- name: Enable and start WireGuard
|
||||
systemd:
|
||||
name: wg-quick@wg0
|
||||
state: started
|
||||
enabled: true
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
# WireGuard installation and server key generation
|
||||
|
||||
- name: Install WireGuard
|
||||
apt:
|
||||
name:
|
||||
- wireguard
|
||||
- wireguard-tools
|
||||
- qrencode
|
||||
state: present
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Enable IP forwarding (IPv4)
|
||||
sysctl:
|
||||
name: net.ipv4.ip_forward
|
||||
value: "1"
|
||||
sysctl_set: true
|
||||
reload: true
|
||||
|
||||
- name: Enable IP forwarding (IPv6)
|
||||
sysctl:
|
||||
name: net.ipv6.conf.all.forwarding
|
||||
value: "1"
|
||||
sysctl_set: true
|
||||
reload: true
|
||||
|
||||
- name: Generate server private key
|
||||
shell: wg genkey
|
||||
register: wg_server_privkey
|
||||
args:
|
||||
creates: /etc/wireguard/server_private.key
|
||||
|
||||
- name: Save server private key
|
||||
copy:
|
||||
content: "{{ wg_server_privkey.stdout }}"
|
||||
dest: /etc/wireguard/server_private.key
|
||||
mode: "0600"
|
||||
when: wg_server_privkey.changed
|
||||
|
||||
- name: Read server private key
|
||||
slurp:
|
||||
src: /etc/wireguard/server_private.key
|
||||
register: server_privkey_content
|
||||
|
||||
- name: Generate server public key
|
||||
shell: "echo '{{ server_privkey_content.content | b64decode | trim }}' | wg pubkey"
|
||||
register: wg_server_pubkey
|
||||
changed_when: false
|
||||
|
||||
- name: Allow WireGuard port through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ wg_port }}"
|
||||
proto: udp
|
||||
Reference in New Issue
Block a user