Initial release: ghost_protocol privacy toolkit

.gitignore

@@ -0,0 +1,22 @@
+logs/
+__pycache__/
+*.pyc
+.env
+vars.yaml
+*.log
+*.pem
+*.key
+id_rsa*
+venv/
+.venv/
+.DS_Store
+*.swp
+*.swo
+*~
+*.tar.gz
+.claude/
+private/
+*.retry
+inventory*
+.vault_pass*
+hosts

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ghost_protocol contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,90 @@
+# ghost_protocol
+
+A privacy toolkit for individuals who take digital autonomy seriously. Three tools, one goal: control your own infrastructure.
+
+## Components
+
+### opsec/
+OPSEC hardening suite for Linux systems. MAC randomization, DNS leak prevention, kill switches, Tor integration, hostname randomization, and a desktop status widget. Configurable deployment levels from standard privacy to full paranoid mode.
+
+```bash
+cd opsec && sudo ./install.sh
+```
+
+### covert_sd/
+Covert SD card tool for secure storage operations. Encryption, hidden volumes, and plausible deniability for portable media.
+
+```bash
+cd covert_sd && python3 covert_sd_card_tool.py
+```
+
+### phantom/
+Privacy server deployer. Stand up Matrix, WireGuard, Pi-hole, and more on cloud providers or your own hardware — hardened out of the box.
+
+```bash
+cd phantom && python3 phantom.py
+```
+
+## Who This Is For
+
+- Journalists protecting sources
+- Researchers handling sensitive data
+- Privacy advocates practicing what they preach
+- Anyone who believes infrastructure shouldn't require trust in third parties
+
+## Quick Start
+
+```bash
+git clone <this-repo> ghost_protocol
+cd ghost_protocol
+
+# OPSEC hardening
+cd opsec && sudo ./install.sh
+
+# Deploy a privacy server
+cd ../phantom && python3 phantom.py
+
+# Covert SD operations
+cd ../covert_sd && python3 covert_sd_card_tool.py
+```
+
+## Requirements
+
+- **opsec**: Linux (Debian/Ubuntu), root access
+- **covert_sd**: Python 3.8+, cryptsetup
+- **phantom**: Python 3.8+, Ansible 2.12+, SSH, pyyaml
+  - For AWS deployments: `ansible-galaxy collection install amazon.aws` and `pip install boto3`
+
+## Important: Configure Before Use
+
+**This toolkit ships with intentionally blank or generic defaults.** You must configure it for your environment before relying on it.
+
+### opsec/
+After installing, run `sudo opsec-config.sh` to set:
+- **Tor exit node exclusions** (`TOR_BLACKLIST`) — empty by default. Set country codes based on your threat model (e.g., `us,gb,ca,au,nz` for Five Eyes exclusion). See `configs/opsec-country-codes.conf` for presets.
+- **DNS mode** (`DNS_MODE`) — defaults to `tor`. Choose based on your needs: `tor`, `quad9`, `cloudflare`, `doh`, `dot`, or `custom`.
+- **Deployment level** — run `sudo opsec-config.sh --level apply <level>` to select a preset. Review `configs/levels/` to understand what each level enables.
+- **Widget theme** (`WIDGET_THEME`) — defaults to `default`. Run `sudo opsec-config.sh --theme list` for options.
+- **Hostname pattern** (`HOSTNAME_PATTERN`) — defaults to `desktop`. Set to `random` if you want randomization on boot.
+- **MAC randomization**, **kill switch behavior**, and **traffic blending** all need to be reviewed and enabled per your use case.
+
+The generic defaults are safe but minimal. They will **not** protect you against a sophisticated adversary without customization. Review `/etc/opsec/opsec.conf` after install and adjust every section for your threat model.
+
+### phantom/
+Each deployment prompts for service-specific configuration (domains, credentials, DNS providers). There are no hardcoded server addresses or API keys. You supply everything at deploy time.
+
+### covert_sd/
+The tool prompts for all encryption parameters interactively. No defaults to change, but read the README for security model details.
+
+## Responsible Use
+
+This toolkit is intended for **legitimate privacy protection**: journalists safeguarding sources, researchers handling sensitive data, organizations protecting communications, and individuals exercising their right to privacy.
+
+- Secure deletion features are irreversible. Understand what you are deleting.
+- Network anonymization is not foolproof. No tool provides absolute anonymity.
+- Comply with applicable laws in your jurisdiction.
+- This software is provided as-is with no warranty. You are responsible for how you use it.
+
+## License
+
+MIT — see [LICENSE](LICENSE)

covert_sd/README.md

@@ -0,0 +1,334 @@
+# Covert SD Card Tool
+
+## Introduction
+
+The **Covert SD Card Tool** is a Python script designed to automate the process of setting up a bootable USB/SD card with either Kali Linux or Tails OS. It includes options to create encrypted persistence partitions, secure document storage, and user-friendly access scripts. This tool simplifies the complex steps involved in preparing a secure, portable operating system on a USB drive or SD card.
+
+## Features
+
+- **Install Kali Linux or Tails OS** on a USB/SD card
+- **Create an encrypted persistence partition** for Kali Linux (LUKS encryption)
+- **Create a maximum-security encrypted documents partition** with triple-cascade encryption
+- **Secure drive wiping** using multi-pass shred for data sanitization
+- **User-friendly access scripts** for mounting and locking secure storage
+- **OPSEC-focused design** - generated scripts use generic terminology
+- **Automated dependency checking and installation**
+
+## Prerequisites
+
+- **Operating System:** Linux (Debian-based distributions recommended)
+- **Python Version:** Python 3.x
+- **Root Access:** Required for disk operations
+- **Dependencies:**
+  - `parted` - Partition management
+  - `cryptsetup` - LUKS encryption
+  - `lsblk` - Block device listing
+  - `dd` - Disk writing
+  - `sgdisk` - GPT partition manipulation
+  - `wipefs` - Filesystem signature removal
+  - `shred` - Secure data wiping
+  - `bc` - Calculator for partition math
+  - `fdisk` - Partition table manipulation
+  - `veracrypt` - Document partition encryption
+  - `lsof`, `fuser` - Process detection
+  - `udevadm` - Device management
+
+**Note:** The script will automatically detect missing dependencies and offer to install them.
+
+## Installation
+
+1. **Clone the Repository or Download the Script:**
+
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/ghost_protocol.git
+   cd ghost_protocol/covert_sd
+   ```
+
+2. **Make the Script Executable:**
+
+   ```bash
+   chmod +x covert_sd_card_tool.py
+   ```
+
+## Usage
+
+Run the script with appropriate options:
+
+```bash
+sudo ./covert_sd_card_tool.py [options]
+```
+
+### Command-Line Options
+
+- `-a`, `--all` : Set up both the OS bootable USB and the documents partition (defaults to Kali)
+- `-k`, `--kali` : Create a Kali bootable USB and persistence partition
+- `-t`, `--tails` : Create a Tails bootable USB (no persistence, mutually exclusive with `-a`)
+- `-c`, `--custom` : Create a custom ISO bootable USB (uses Kali-style partitioning with persistence)
+- `-d`, `--docs` : Create an encrypted documents partition
+- `-i`, `--iso` : Path to the ISO file (Kali, Tails, or custom)
+- `--fast` : Enable fast setup mode (weaker encryption, faster setup - not recommended)
+- `--paranoid` : Enable paranoid mode (maximum security: 3-pass wipe, Argon2id, PIM 5000)
+- `--debug` : Enable debug mode with verbose logging
+
+**Note:** `--fast` and `--paranoid` are mutually exclusive. Documents partition always uses strong encryption even in fast mode.
+
+### Examples
+
+- **Install Kali with Encrypted Persistence and Encrypted Documents Partition:**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -a -i /path/to/kali.iso
+  ```
+
+- **Install Tails with Encrypted Documents Partition:**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -t -d -i /path/to/tails.iso
+  ```
+
+- **Install Tails Only (No Documents Partition):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -t -i /path/to/tails.iso
+  ```
+
+- **Create Encrypted Documents Partition Only (No OS):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -d
+  ```
+
+- **Install Custom ISO (e.g., Parrot OS, BlackArch) with Persistence and Documents:**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -c -d -i /path/to/custom.iso
+  ```
+
+- **Install Custom ISO with Persistence Only (No Documents):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -c -i /path/to/custom.iso
+  ```
+
+- **Paranoid Mode - Maximum Security (Tails + Docs):**
+
+  ```bash
+  sudo ./covert_sd_card_tool.py -t -d -i /path/to/tails.iso --paranoid
+  ```
+
+## Security Features
+
+### Documents Partition Encryption
+
+The documents partition uses **strong security** in all modes:
+
+**Standard Mode (default):**
+- **Triple Cascade Encryption:** AES-Twofish-Serpent (3 layers)
+- **Hash Algorithm:** SHA-512
+- **Key Derivation:** PIM 2000 (strong key stretching)
+- **Unlock Time:** ~2-3 seconds
+- **Filesystem:** ext4
+- **Full Format:** Always overwrites old data
+
+**Paranoid Mode (`--paranoid`):**
+- **Triple Cascade Encryption:** AES-Twofish-Serpent (3 layers)
+- **Hash Algorithm:** SHA-512
+- **Key Derivation:** PIM 5000 (maximum key stretching)
+- **Unlock Time:** ~5-7 seconds
+- **Security:** Designed to resist brute-force attacks when used with a strong passphrase
+
+**Fast Mode (`--fast`):**
+- Documents still use standard mode (PIM 2000) - no compromise on docs security
+
+### Persistence Partition Encryption (Kali/Custom)
+
+**Standard Mode (default):**
+- **Algorithm:** AES-XTS-PLAIN64
+- **Key Size:** 512-bit
+- **Hash:** SHA-512
+- **KDF:** LUKS2 PBKDF2
+- **Iteration Time:** 5 seconds
+
+**Paranoid Mode (`--paranoid`):**
+- **Algorithm:** AES-XTS-PLAIN64
+- **Key Size:** 512-bit
+- **Hash:** SHA-512
+- **KDF:** LUKS2 Argon2id (memory-hard, GPU-resistant)
+- **Memory:** 1GB
+- **Parallel Threads:** 4
+- **Iteration Time:** 10 seconds
+
+**Fast Mode (`--fast`):**
+- **Algorithm:** AES-CBC-ESSIV:SHA256
+- **Key Size:** 256-bit
+- **Hash:** SHA-256
+- **KDF:** LUKS1 PBKDF2
+- **Iteration Time:** 1 second
+
+### Secure Drive Wiping
+
+**Standard Mode (default):**
+- **1 pass** with zeros (`dd if=/dev/zero`)
+- Fast and sufficient for most use cases
+- Prevents casual data recovery
+- Confirmation required (must type 'WIPE')
+
+**Paranoid Mode (`--paranoid`):**
+- **3 passes** with random data (`shred`)
+- **Final pass** with zeros
+- Makes data recovery virtually impossible
+- Defense against forensic recovery techniques
+- **Much slower** (can take hours on large drives)
+- Confirmation required (must type 'WIPE')
+
+### OPSEC (Operational Security)
+
+The generated helper scripts use **generic terminology** to avoid disclosing encryption methods:
+
+- Scripts renamed to `mount_storage.sh` and `lock_storage.sh` (instead of mentioning encryption types)
+- README uses terms like "secure storage" instead of specific encryption names
+- No algorithm disclosure in user-facing documentation on the device
+- Suitable for travel scenarios where device inspection may occur
+
+## Generated Helper Scripts
+
+The tool creates a small unencrypted partition (TOOLS) containing:
+
+### `mount_storage.sh`
+- Interactive script to mount the encrypted documents partition
+- Shows available devices and validates input
+- Mounts to `/mnt/secure_storage`
+- Clear error messages and success confirmations
+
+### `lock_storage.sh`
+- Safely dismounts and locks the encrypted storage
+- Checks for open files before locking
+- Shows warnings if applications are still using the storage
+- Syncs pending writes before dismount
+- Prevents data loss from improper ejection
+
+### `README.txt`
+- Simple instructions for non-technical users
+- Generic terminology (no encryption disclosure)
+- Step-by-step mount/lock procedures
+
+## Security Mode Comparison
+
+| Feature | Fast Mode | Standard Mode (Default) | Paranoid Mode |
+|---------|-----------|------------------------|---------------|
+| **Drive Wipe** | Partition table clear only | 1-pass zeros | 3-pass shred + zeros |
+| **Wipe Time (64GB)** | Instant | ~5-10 min | ~2-3 hours |
+| **Persistence KDF** | LUKS1 PBKDF2 | LUKS2 PBKDF2 | LUKS2 Argon2id |
+| **Persistence Unlock** | ~1 sec | ~5 sec | ~10 sec |
+| **Docs Encryption** | AES-Twofish-Serpent | AES-Twofish-Serpent | AES-Twofish-Serpent |
+| **Docs PIM** | 2000 | 2000 | 5000 |
+| **Docs Unlock** | ~2-3 sec | ~2-3 sec | ~5-7 sec |
+| **Best For** | Testing/dev | Travel, daily use | Maximum security, high-risk scenarios |
+
+**Recommendation:** Use **standard mode** for most cases. Use **paranoid mode** if:
+- You're protecting extremely sensitive data
+- You face nation-state level threats
+- You have time for longer setup and unlock times
+- You want defense against forensic analysis
+
+## Important Security Notes
+
+⚠️ **Password Strength:** Use strong passphrases (20+ characters, mixed case, numbers, symbols)
+
+⚠️ **No Password Recovery:** If you forget your password, your data is **permanently inaccessible**
+
+⚠️ **PIM Value:** The tool enforces PIM 2000 for documents partition - this adds 2-3 seconds to unlock time but massively increases security
+
+⚠️ **Always Lock Before Removal:** Use `lock_storage.sh` before removing the device to prevent data corruption
+
+⚠️ **Fast Mode:** While available for persistence partition, documents partition **always uses maximum security**
+
+## Partition Layout Examples
+
+### Kali + Documents (`-a`)
+1. **Partition 1:** Kali Live OS (bootable)
+2. **Partition 2:** LUKS encrypted persistence (configurable size, e.g., 4GB)
+3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
+4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+### Tails Only (`-t`)
+- **Entire Drive:** Tails Live OS (bootable, no additional partitions)
+
+### Tails + Documents (`-t -d`)
+1. **Partition 1:** Tails Live OS (bootable, 12MB EFI System)
+2. **Partition 2:** Tails system partition (~2-3GB depending on Tails version)
+3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
+4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+### Documents Only (`-d`)
+1. **Partition 1:** VeraCrypt encrypted documents (remaining space minus 1GB)
+2. **Partition 2:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+### Custom ISO + Documents (`-c -d`)
+1. **Partition 1:** Custom Live OS (bootable)
+2. **Partition 2:** LUKS encrypted persistence (configurable size, e.g., 4GB)
+3. **Partition 3:** VeraCrypt encrypted documents (remaining space minus 1GB)
+4. **Partition 4:** Unencrypted tools partition (1GB, FAT32, contains scripts)
+
+**Note:** Custom ISO mode uses Kali-style partitioning. Works well with Debian-based live ISOs like Parrot OS, BlackArch, BackBox, etc.
+
+## Using Custom ISOs
+
+The `-c` (custom) flag allows you to use **any bootable ISO** and set it up with encrypted persistence and documents partitions. This is useful for:
+
+### Compatible ISOs
+- **Parrot Security OS** - Privacy-focused security distro
+- **BlackArch Linux** - Penetration testing distro
+- **BackBox** - Ubuntu-based penetration testing
+- **Pentoo** - Gentoo-based security distro
+- **Any Debian/Ubuntu-based live ISO**
+
+### How It Works
+Custom ISOs are treated like Kali Linux:
+1. ISO is flashed to the drive
+2. LUKS encrypted persistence partition is created (if you want settings to persist)
+3. VeraCrypt encrypted documents partition is added (if `-d` flag is used)
+4. Tools partition with mount/lock scripts
+
+### Example: Parrot OS with Docs
+```bash
+sudo ./covert_sd_card_tool.py -c -d -i ~/Downloads/parrot-security.iso
+```
+
+### Compatibility Notes
+- **Best for:** Debian/Ubuntu-based live ISOs
+- **May not work with:** Arch-based ISOs (different partition structure), Windows ISOs
+- **Persistence:** Depends on the ISO supporting LUKS persistence (Debian-based usually do)
+- If persistence doesn't work with your ISO, you can still use the documents partition
+
+## Troubleshooting
+
+### Device Busy Errors
+- The tool automatically unmounts partitions and kills processes using the drive
+- If problems persist, manually unmount: `sudo umount /dev/sdX*`
+- Check for processes: `sudo lsof /dev/sdX`
+
+### VeraCrypt Not Found
+- On Debian/Ubuntu: `sudo apt install veracrypt`
+- Or the script will offer to install it automatically
+
+### Permission Denied
+- Always run with `sudo`
+- Ensure your user has sudo privileges
+
+### Drive Not Detected
+- Check if drive is connected: `lsblk`
+- Verify drive path (e.g., `/dev/sdb` not `/dev/sdb1`)
+- Try unplugging and reconnecting the device
+
+## License
+
+This tool is provided as-is for educational and legitimate security purposes only. Use responsibly and in compliance with applicable laws.
+
+## Contributing
+
+Contributions, bug reports, and feature requests are welcome! Please open an issue or submit a pull request.
+
+## Disclaimer
+
+This tool performs destructive operations on storage devices. **Always verify you've selected the correct drive** before proceeding. The authors are not responsible for data loss.

covert_sd/tools/MOBILE_INSTRUCTIONS.txt

@@ -0,0 +1,239 @@
+======================================================================
+          SECURE STORAGE - MOBILE DEVICE INSTRUCTIONS
+======================================================================
+
+IMPORTANT: Mobile access has limitations compared to desktop.
+Read carefully to understand what's possible on your device.
+
+======================================================================
+ANDROID DEVICES
+======================================================================
+
+REQUIREMENTS:
+  • Android 5.0 or newer
+  • EDS (Encrypted Data Store) app - REQUIRED
+  • USB OTG adapter (to connect USB device to phone)
+  • File manager app (most phones have one built-in)
+
+REQUIRED APP:
+  • EDS Lite (Free & Open Source)
+  • Google Play: https://play.google.com/store/apps/details?id=com.sovworks.eds.android
+  • Direct link if Google Play doesn't work:
+    https://play.google.com/store/apps/details?id=com.sovworks.projecteds
+
+----------------------------------------------------------------------
+SETUP: Using EDS Lite (RECOMMENDED)
+----------------------------------------------------------------------
+
+Step 1: Install EDS Lite
+        • Open Google Play Store
+        • Search for "EDS Lite" or "EDS (Encrypted Data Store)"
+        • Install the app (it's FREE)
+        • Or use the direct link above
+
+Step 2: Connect your USB device
+        • Connect USB device using OTG adapter
+        • Android should show "USB device connected" notification
+
+Step 3: Open EDS Lite app
+        • Tap "Open container"
+        • Navigate to your USB device
+        • Look for the partition WITHOUT a filesystem/label
+        • Select the encrypted partition
+
+Step 4: Enter password
+        • Select encryption: VeraCrypt
+        • Enter your password
+        • For PIM: enter 2000 or 5000 (whatever you set)
+        • Tap "OK"
+
+Step 5: Access your files
+        • Files will appear in EDS Lite
+        • You can view, copy, or share files
+        • Some apps can open files directly from EDS
+
+IMPORTANT - Safely Close:
+        • Tap "Close container" when done
+        • Wait for confirmation before unplugging
+        • Only then remove USB device
+
+----------------------------------------------------------------------
+ALTERNATIVE: VeraCrypt for Android (Advanced Users)
+----------------------------------------------------------------------
+
+ℹ️ NOTE: EDS Lite (above) is easier to use and recommended.
+   Only use VeraCrypt if you're familiar with it.
+
+Step 1: Install VeraCrypt for Android
+        • Download from: https://github.com/veracrypt/veracrypt
+        • Or install from F-Droid store
+        • Enable "Unknown sources" if needed
+
+Step 2-5: Follow similar steps as EDS Lite above
+        • The interface is similar to desktop VeraCrypt
+        • Process is the same: select partition, enter password, mount
+
+======================================================================
+iOS DEVICES (iPhone/iPad)
+======================================================================
+
+✅ SOLUTION: Crypto Disks App (Paid)
+
+RECOMMENDED APP:
+  • Crypto Disks - Store Private Files Securely
+  • App Store: https://apps.apple.com/us/app/crypto-disks-store-private/id889549308
+  • Price: ~$4.99 (one-time purchase)
+  • Supports VeraCrypt containers!
+
+----------------------------------------------------------------------
+SETUP: Using Crypto Disks on iOS
+----------------------------------------------------------------------
+
+Step 1: Purchase and Install Crypto Disks
+        • Open App Store on your iPhone/iPad
+        • Search for "Crypto Disks"
+        • Or use the direct link above
+        • Purchase and install (~$4.99)
+
+Step 2: Transfer Encrypted Container
+        ⚠️ LIMITATION: iOS doesn't support direct USB access like Android
+
+        You have two options:
+
+        OPTION A: Copy via Computer (Easier)
+        1. Connect USB device to your Mac/PC
+        2. Mount the encrypted partition with VeraCrypt
+        3. Create a smaller VeraCrypt container file inside
+        4. Transfer that container to your iPhone via:
+           - AirDrop (Mac to iPhone)
+           - iCloud Drive
+           - iTunes File Sharing
+        5. Open in Crypto Disks app
+
+        OPTION B: Use Wi-Fi File Transfer
+        1. Use Crypto Disks' built-in file transfer
+        2. Transfer container file from computer
+        3. Open in app
+
+Step 3: Mount in Crypto Disks App
+        • Open Crypto Disks app
+        • Select "Add Disk Image"
+        • Choose your transferred container
+        • Enter password and PIM
+        • Access your files
+
+⚠️ IMPORTANT iOS LIMITATIONS:
+   • Cannot directly mount USB partition (Apple restriction)
+   • Must use container FILES, not raw partitions
+   • Requires copying/transferring container to iPhone
+   • Best for occasional access, not primary use
+
+----------------------------------------------------------------------
+iOS WORKAROUND: Emergency Access Only
+----------------------------------------------------------------------
+
+If you don't want to pay for Crypto Disks, here are free alternatives:
+
+Option A: Use a Computer as Bridge
+        1. Mount the encrypted storage on your Mac/PC
+        2. Copy files you need to iCloud or Files app
+        3. Access those files from your iPhone
+        4. Delete copies when done (IMPORTANT for security!)
+
+Option B: Use Remote Access
+        1. Mount encrypted storage on your home computer
+        2. Set up secure remote access (VPN + file sharing)
+        3. Access files remotely from iPhone
+        4. More complex but maintains security
+
+Option C: Take Photos of Documents
+        1. If you just need to VIEW travel docs in emergency
+        2. Take photos/screenshots on computer
+        3. Store in encrypted note app (Apple Notes with lock)
+        4. Delete after trip
+
+NOTE: These workarounds compromise security slightly.
+      Crypto Disks app is the most secure iOS solution.
+
+======================================================================
+IMPORTANT SECURITY NOTES FOR MOBILE
+======================================================================
+
+⚠ Screen Lock
+   • Always have a PIN/password on your phone
+   • If someone steals your phone while storage is mounted,
+     they can access your files
+
+⚠ App Permissions
+   • Only grant necessary permissions to encryption apps
+   • Be cautious with "file access" permissions
+
+⚠ Public WiFi
+   • Don't use public WiFi when accessing sensitive files
+   • Or use a VPN if you must
+
+⚠ Battery Concerns
+   • Don't let your phone die while storage is mounted
+   • Always properly close/dismount before battery runs out
+
+⚠ Background Apps
+   • Close the encryption app properly when done
+   • Don't just switch to another app
+   • Storage might stay mounted in background
+
+⚠ Phone Updates
+   • Close encrypted storage before major OS updates
+   • Updates might interrupt and cause corruption
+
+======================================================================
+TROUBLESHOOTING - ANDROID
+======================================================================
+
+"Cannot find USB device"
+  • Try a different OTG adapter
+  • Check if your phone supports USB OTG
+  • Some phones need USB settings changed (File Transfer mode)
+
+"Wrong password" (but password is correct)
+  • Make sure you selected "VeraCrypt" as encryption type
+  • Verify PIM value (2000 or 5000)
+  • Some apps don't support all VeraCrypt settings
+
+"App crashes when mounting"
+  • Try a different encryption app (EDS vs VeraCrypt)
+  • Check if partition is already mounted
+  • Restart phone and try again
+
+"Can't edit files, only view"
+  • This is normal for some apps
+  • Copy file to phone storage
+  • Edit it there
+  • Copy back when done
+
+"Storage disconnected unexpectedly"
+  • Check USB connection
+  • Some phones cut power to USB to save battery
+  • Disable battery optimization for the encryption app
+
+======================================================================
+LIMITATIONS OF MOBILE ACCESS
+======================================================================
+
+Things that DON'T work well on mobile:
+  ✗ Editing large files directly on encrypted storage
+  ✗ Running programs/apps from encrypted storage
+  ✗ Fast file operations (mobile is slower than desktop)
+  ✗ iOS access (not supported at all)
+
+Things that WORK WELL on mobile:
+  ✓ Viewing documents (PDFs, photos, etc.)
+  ✓ Copying individual files to phone
+  ✓ Sharing files to other apps
+  ✓ Emergency access when no computer available
+  ✓ Quick lookup of information
+
+RECOMMENDATION:
+  Use mobile access for emergencies and viewing only.
+  Use desktop (Linux/Windows) for actual file management.
+
+======================================================================

covert_sd/tools/README.txt

@@ -0,0 +1,194 @@
+======================================================================
+              SECURE STORAGE - QUICK START GUIDE
+======================================================================
+
+WHAT'S ON THIS DEVICE:
+  • Encrypted storage partition for sensitive documents
+  • Portable VeraCrypt (works on ANY computer - no installation!)
+  • Helper scripts (Linux/Mac)
+  • Instructions for Windows and mobile devices
+
+======================================================================
+ACCESSING YOUR FILES - QUICK GUIDE
+======================================================================
+
+LINUX / MAC:
+  1. Open terminal in this folder
+  2. Run: sudo ./mount_storage.sh
+  3. Enter your password
+  4. Files appear in: ~/SecureStorage
+
+WINDOWS:
+  1. Open "WINDOWS_INSTRUCTIONS.txt" on this device
+  2. Follow the step-by-step guide
+  3. Use portable VeraCrypt from "VeraCrypt" folder (no install needed!)
+
+ANDROID:
+  1. Install "EDS Lite" from Google Play Store (FREE)
+     https://play.google.com/store/apps/details?id=com.sovworks.projecteds
+  2. Connect USB with OTG adapter
+  3. Open "MOBILE_INSTRUCTIONS.txt" for step-by-step guide
+
+iOS (iPhone/iPad):
+  1. Install "Crypto Disks" from App Store (~$4.99)
+     https://apps.apple.com/us/app/crypto-disks-store-private/id889549308
+  2. See "MOBILE_INSTRUCTIONS.txt" for setup
+  ⚠ iOS has limitations - requires copying files, can't mount USB directly
+
+======================================================================
+IMPORTANT: HOW TO SAFELY LOCK YOUR STORAGE
+======================================================================
+
+LINUX / MAC:
+  1. Close ALL programs using the secure storage
+  2. Run: sudo ./lock_storage.sh
+  3. Wait for "SUCCESS" message
+  4. Safe to remove device
+
+WINDOWS:
+  1. Close all files
+  2. In VeraCrypt, select the drive
+  3. Click "Dismount"
+  4. Use "Safely Remove Hardware"
+
+⚠ CRITICAL: ALWAYS lock/dismount before removing!
+   Otherwise you risk losing your data.
+
+======================================================================
+PORTABLE VERACRYPT - NO INSTALLATION REQUIRED!
+======================================================================
+
+Inside the "VeraCrypt" folder on this device:
+
+• VeraCrypt-Portable-Windows.exe
+    → Double-click to run on ANY Windows PC
+    → Works without admin rights on most systems
+
+• VeraCrypt-Portable-Linux.AppImage
+    → Run on ANY Linux system (no install!)
+    → Command: ./VeraCrypt-Portable-Linux.AppImage
+    → AppImage = portable, works on all Linux distributions
+
+• veracrypt-Ubuntu-22.04-amd64.deb
+    → System-wide installer for Ubuntu/Debian
+    → Install with: sudo dpkg -i veracrypt-Ubuntu-22.04-amd64.deb
+    → Use this if you prefer installed version over AppImage
+
+• VeraCrypt-MacOS.dmg
+    → Install on Mac (one-time)
+    → Works on any Mac after that
+
+This means you can access your encrypted files on ANY computer
+even if VeraCrypt is not installed!
+
+======================================================================
+YOUR PASSWORD
+======================================================================
+
+⚠ There is NO password recovery! If you forget it, data is GONE.
+
+Password details:
+  • Case-sensitive (Abc123 ≠ abc123)
+  • Minimum 20 characters recommended
+  • Mix of letters, numbers, symbols
+  • Write it down and keep it SAFE (not on this device!)
+
+If you set a PIM value:
+  • Standard setup: PIM = 2000
+  • Paranoid setup: PIM = 5000
+  • VeraCrypt will ask for this when mounting
+
+======================================================================
+TROUBLESHOOTING
+======================================================================
+
+PROBLEM: "Cannot find TOOLS partition"
+FIX: Ensure device is fully connected; try different USB port
+
+PROBLEM: "Wrong password" (but you know it's correct)
+FIX: Check if CAPS LOCK is on; verify PIM value
+
+PROBLEM: "Volume already mounted"
+FIX: Close any VeraCrypt windows and run:
+     • Linux/Mac: sudo veracrypt -d
+     • Windows: Dismount all in VeraCrypt
+
+PROBLEM: "Permission denied" when accessing files
+FIX:
+     • Linux/Mac: Re-run mount script (it sets permissions)
+     • Windows: Check if you ran VeraCrypt as administrator
+
+PROBLEM: "Files appear but I can't edit them"
+FIX:
+     • Linux/Mac: Run: sudo chown -R $USER ~/SecureStorage
+     • Windows: Right-click → Properties → Security → Edit
+
+PROBLEM: Device not detected on Android
+FIX:
+     • Check USB OTG adapter is working
+     • Enable "File Transfer" mode in USB settings
+     • Try different OTG adapter
+
+======================================================================
+FILE LOCATIONS AFTER MOUNTING
+======================================================================
+
+Linux/Mac:     ~/SecureStorage
+               (In your home folder)
+
+Windows:       Z:\ (or whatever drive letter you selected)
+               Shows in "This PC"
+
+Android:       Accessible within EDS Lite or VeraCrypt app
+
+======================================================================
+SECURITY NOTES
+======================================================================
+
+✓ Your files use strong multi-layer encryption
+✓ AES-Twofish-Serpent triple cascade (strongest available)
+✓ Designed to resist brute-force attacks with a strong passphrase
+
+⚠ The password is the ONLY key
+⚠ No backdoors, no recovery, no "forgot password" option
+⚠ Keep password safe but separate from this device
+
+Best practices:
+  • Always dismount before removing device
+  • Don't leave mounted when unattended
+  • Use strong unique password
+  • Don't store password on this device
+  • Lock your computer when storage is mounted
+
+======================================================================
+ADVANCED: MANUAL MOUNTING (if scripts fail)
+======================================================================
+
+LINUX/MAC:
+  1. Find encrypted partition:
+       lsblk -o NAME,SIZE,LABEL,FSTYPE
+       (Look for partition WITHOUT filesystem label)
+
+  2. Mount with VeraCrypt:
+       sudo veracrypt /dev/sdX2 ~/SecureStorage
+       (Replace sdX2 with your partition)
+
+  3. Enter password and PIM when prompted
+
+WINDOWS:
+  1. Open portable VeraCrypt
+  2. Select any drive letter
+  3. Click "Select Device"
+  4. Choose partition WITHOUT label (not the TOOLS one)
+  5. Click "Mount"
+  6. Enter password
+
+======================================================================
+NEED MORE HELP?
+======================================================================
+
+• Windows users: See WINDOWS_INSTRUCTIONS.txt
+• Mobile users: See MOBILE_INSTRUCTIONS.txt
+• VeraCrypt documentation: https://www.veracrypt.fr/en/Documentation.html
+
+======================================================================

covert_sd/tools/WINDOWS_INSTRUCTIONS.txt

@@ -0,0 +1,93 @@
+======================================================================
+           SECURE STORAGE - WINDOWS INSTRUCTIONS
+======================================================================
+
+REQUIREMENTS:
+  • This secure storage device connected
+  • NO SOFTWARE INSTALLATION NEEDED!
+
+======================================================================
+HOW TO ACCESS YOUR SECURE FILES (WINDOWS)
+======================================================================
+
+OPTION 1: USE PORTABLE VERACRYPT (RECOMMENDED - NO INSTALL!)
+
+Step 1: Open the VeraCrypt folder on this USB drive
+
+Step 2: Double-click "VeraCrypt-Portable-Windows.exe"
+        • It runs directly - no installation!
+        • Works on most Windows PCs without admin rights
+        • If blocked, right-click → "Run anyway"
+
+Step 3: The VeraCrypt window opens
+
+----------------------------------------------------------------------
+
+OPTION 2: USE INSTALLED VERACRYPT (if you prefer)
+
+Step 1: Install VeraCrypt (if not already installed)
+        • Go to https://www.veracrypt.fr/en/Downloads.html
+        • Download VeraCrypt for Windows
+        • Run the installer
+
+Step 2: Open VeraCrypt from Start Menu
+        • Search for "VeraCrypt" in Start Menu
+        • Click "VeraCrypt" to launch
+
+----------------------------------------------------------------------
+
+CONTINUING (after opening VeraCrypt either way):
+
+Step 3: Select a drive letter
+        • In VeraCrypt window, click any drive letter (e.g., Z:)
+
+Step 4: Select Volume
+        • Click "Select Device..." button
+        • Find your USB device (look for the partition WITHOUT a filesystem)
+        • Usually it's the second-to-last partition
+        • Click OK
+
+Step 5: Click "Mount" button
+        • Enter your password when prompted
+        • For PIM: leave blank or enter the PIM you set (2000 or 5000)
+        • Click OK
+
+Step 6: Access your files
+        • Open File Explorer
+        • Look for new drive (e.g., Z:)
+        • Your files are there!
+
+======================================================================
+HOW TO SAFELY LOCK YOUR STORAGE (WINDOWS)
+======================================================================
+
+Step 1: Close ALL programs using the secure storage
+        • Save documents
+        • Close File Explorer windows
+        • Close any apps with open files
+
+Step 2: In VeraCrypt window
+        • Select the mounted drive (e.g., Z:)
+        • Click "Dismount" button
+
+Step 3: Safe to remove
+        • Click "Safely Remove Hardware" in system tray
+        • Select your USB device
+        • Remove when Windows says it's safe
+
+======================================================================
+IMPORTANT NOTES
+======================================================================
+
+⚠ ALWAYS dismount before removing the device!
+   Otherwise you risk data corruption.
+
+⚠ If you forget your password, your data is GONE.
+   There is NO password recovery.
+
+⚠ Partition to select:
+   • Look in VeraCrypt's "Select Device" window
+   • Choose the partition WITHOUT a label/filesystem
+   • It's usually NOT the one labeled "TOOLS"
+
+======================================================================

covert_sd/tools/lock_storage.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# Script to safely lock secure storage
+
+echo "======================================================================"
+echo "                    SECURE STORAGE LOCK TOOL"
+echo "======================================================================"
+echo ""
+
+# Mount point location
+MOUNT_POINT="$HOME/SecureStorage"
+
+# Check if storage is mounted
+if mountpoint -q "$MOUNT_POINT" 2>/dev/null || [ -d "$MOUNT_POINT" ] && sudo veracrypt --text --list | grep -q "$MOUNT_POINT"; then
+    echo "Step 1: Checking for open files..."
+
+    # Check if any processes are using the mount
+    OPEN_FILES=$(sudo lsof "$MOUNT_POINT" 2>/dev/null | tail -n +2)
+    if [ -n "$OPEN_FILES" ]; then
+        echo ""
+        echo "⚠ WARNING: Files or programs are still using the secure storage!"
+        echo ""
+        echo "Open files/processes:"
+        echo "$OPEN_FILES"
+        echo ""
+        echo "You should close these programs first to avoid data loss."
+        echo ""
+        read -p "Force close and lock anyway? (y/N): " FORCE
+        if [ "$FORCE" != "y" ] && [ "$FORCE" != "Y" ]; then
+            echo ""
+            echo "Lock cancelled. Please:"
+            echo "  1. Close all programs using the secure storage"
+            echo "  2. Save any open documents"
+            echo "  3. Run this script again"
+            exit 1
+        fi
+        echo ""
+        echo "Forcing lock (files will be closed)..."
+    else
+        echo "✓ No open files detected"
+    fi
+
+    echo ""
+    echo "Step 2: Syncing pending writes to disk..."
+    sync
+    echo "✓ All data written to disk"
+
+    echo ""
+    echo "Step 3: Dismounting encrypted volume..."
+
+    # Dismount the encrypted volume
+    if sudo veracrypt --text --dismount "$MOUNT_POINT" 2>/dev/null; then
+        rmdir "$MOUNT_POINT" 2>/dev/null
+        echo "✓ Volume dismounted"
+        echo ""
+        echo "======================================================================"
+        echo "                           SUCCESS!"
+        echo "======================================================================"
+        echo ""
+        echo "Secure storage is now locked and encrypted."
+        echo "Your data is safe to remove the device."
+        echo ""
+        echo "======================================================================"
+    else
+        echo ""
+        echo "======================================================================"
+        echo "                       DISMOUNT FAILED"
+        echo "======================================================================"
+        echo ""
+        echo "Possible reasons:"
+        echo "  • Files still in use (close all programs)"
+        echo "  • Permission denied"
+        echo "  • Volume not mounted with this script"
+        echo ""
+        echo "Troubleshooting:"
+        echo "  1. Check what's using it: sudo lsof $MOUNT_POINT"
+        echo "  2. Force dismount all: sudo veracrypt -d"
+        echo "  3. Kill processes: sudo fuser -km $MOUNT_POINT"
+        echo ""
+        exit 1
+    fi
+else
+    echo "ℹ Secure storage is not currently mounted."
+    echo ""
+    echo "Nothing to lock - your data is already secured."
+    echo ""
+    echo "If you want to access it, run:"
+    echo "    sudo ./mount_storage.sh"
+fi

covert_sd/tools/mount_storage.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+# Script to mount secure storage partition
+
+echo "======================================================================"
+echo "                    SECURE STORAGE MOUNT TOOL"
+echo "======================================================================"
+echo ""
+
+# Function to find the documents partition (second-to-last partition on drive)
+find_docs_partition() {
+    # Look for drives with TOOLS partition (our indicator)
+    local tools_drive=$(lsblk -ln -o NAME,LABEL | grep "TOOLS" | awk '{print $1}' | head -1)
+
+    if [ -z "$tools_drive" ]; then
+        echo "ERROR: Could not find TOOLS partition."
+        echo "Please ensure the secure storage device is connected."
+        return 1
+    fi
+
+    # Get the base drive name (remove partition number)
+    local base_drive=$(echo "$tools_drive" | sed 's/[0-9]*$//' | sed 's/p$//')
+
+    # Get all partitions on this drive
+    local partitions=$(lsblk -ln -o NAME "/dev/$base_drive" | grep "^$base_drive" | tail -n +2)
+    local part_count=$(echo "$partitions" | wc -l)
+
+    if [ "$part_count" -lt 2 ]; then
+        echo "ERROR: Not enough partitions found."
+        return 1
+    fi
+
+    # Get second-to-last partition (documents partition)
+    local docs_part=$(echo "$partitions" | tail -n 2 | head -n 1)
+    echo "/dev/$docs_part"
+    return 0
+}
+
+echo "Step 1: Detecting secure storage device..."
+DOCS_PARTITION=$(find_docs_partition)
+
+if [ $? -ne 0 ]; then
+    echo ""
+    echo "======================================================================"
+    echo "AUTO-DETECTION FAILED - MANUAL MODE"
+    echo "======================================================================"
+    echo ""
+    echo "Available partitions:"
+    lsblk -o NAME,SIZE,TYPE,LABEL,FSTYPE | grep -v "loop"
+    echo ""
+    echo "TIP: Look for a partition WITHOUT a filesystem (blank FSTYPE)"
+    echo "      This is usually your encrypted documents partition."
+    echo ""
+    read -p "Enter the partition path (e.g., /dev/sdb1): " DOCS_PARTITION
+
+    if [ -z "$DOCS_PARTITION" ]; then
+        echo "ERROR: No partition specified."
+        exit 1
+    fi
+
+    if [ ! -b "$DOCS_PARTITION" ]; then
+        echo "ERROR: $DOCS_PARTITION is not a valid block device."
+        exit 1
+    fi
+fi
+
+echo "✓ Found encrypted partition: $DOCS_PARTITION"
+echo ""
+
+echo "Step 2: Creating mount point..."
+# Mount in user's home directory for easy access
+MOUNT_POINT="$HOME/SecureStorage"
+mkdir -p "$MOUNT_POINT"
+echo "✓ Mount point ready at: $MOUNT_POINT"
+echo ""
+
+echo "Step 3: Mounting encrypted volume..."
+echo "You will now be prompted for your encryption password."
+echo ""
+
+# Mount the encrypted volume
+if sudo veracrypt --text --mount "$DOCS_PARTITION" "$MOUNT_POINT"; then
+    echo ""
+    echo "Setting correct permissions..."
+
+    # Change ownership of the mount point to current user
+    # This allows the user to read/write files
+    sudo chown $USER:$USER "$MOUNT_POINT"
+
+    # If there are already files, change their ownership too
+    if [ "$(ls -A $MOUNT_POINT 2>/dev/null)" ]; then
+        sudo chown -R $USER:$USER "$MOUNT_POINT"/*
+    fi
+
+    echo "✓ Permissions set for user access"
+
+    echo ""
+    echo "======================================================================"
+    echo "                           SUCCESS!"
+    echo "======================================================================"
+    echo ""
+    echo "Your secure storage is now accessible at:"
+    echo "    $MOUNT_POINT"
+    echo ""
+    echo "Easy access:"
+    echo "  • Open file manager and go to Home folder"
+    echo "  • Look for 'SecureStorage' folder"
+    echo "  • Or in terminal: cd ~/SecureStorage"
+    echo ""
+    echo "You can now:"
+    echo "  • Drag and drop files"
+    echo "  • Edit documents"
+    echo "  • Create new folders"
+    echo ""
+    echo "IMPORTANT: When finished, run:"
+    echo "    sudo ./lock_storage.sh"
+    echo ""
+    echo "======================================================================"
+else
+    echo ""
+    echo "======================================================================"
+    echo "                       MOUNT FAILED"
+    echo "======================================================================"
+    echo ""
+    echo "Possible reasons:"
+    echo "  • Wrong password"
+    echo "  • Wrong partition selected"
+    echo "  • Volume already mounted"
+    echo "  • veracrypt not installed"
+    echo ""
+    echo "Troubleshooting:"
+    echo "  1. Check if already mounted: mount | grep secure_storage"
+    echo "  2. Try unmounting first: sudo veracrypt -d"
+    echo "  3. Verify veracrypt: which veracrypt"
+    echo ""
+    rmdir "$MOUNT_POINT" 2>/dev/null
+    exit 1
+fi

covert_sd/tools/veracrypt/DOWNLOAD_INSTRUCTIONS.md

@@ -0,0 +1,93 @@
+# Portable VeraCrypt Setup Instructions
+
+Before running the main tool, you need to download portable VeraCrypt binaries.
+These will be copied to the TOOLS partition so the device works on any computer.
+
+## Required Downloads
+
+Download the following files and place them in this directory (`tools/veracrypt/`):
+
+### 1. Windows Portable (REQUIRED)
+- **File**: `VeraCrypt Portable.exe`
+- **URL**: https://www.veracrypt.fr/en/Downloads.html
+- **Section**: "Portable" under Windows
+- **Size**: ~30 MB
+- **Rename to**: `VeraCrypt-Portable-Windows.exe`
+
+### 2. Linux Portable (REQUIRED)
+- **Option A - GUI version**:
+  - Download from: https://www.veracrypt.fr/en/Downloads.html
+  - Generic Installer: `veracrypt-*-setup.tar.bz2`
+  - Extract and place: `veracrypt-*-setup-gui-x64`
+  - **Rename to**: `VeraCrypt-Portable-Linux`
+
+- **Option B - Console only**:
+  - Download: `veracrypt-*-setup-console-x64`
+  - **Rename to**: `VeraCrypt-Portable-Linux-Console`
+
+### 3. macOS Portable (OPTIONAL)
+- **File**: `VeraCrypt_*.dmg`
+- **URL**: https://www.veracrypt.fr/en/Downloads.html
+- **Note**: Not truly "portable" but can be included for reference
+- **Rename to**: `VeraCrypt-MacOS.dmg`
+
+### 4. Android APK (OPTIONAL but recommended)
+- **Source**: https://github.com/veracrypt/VeraCrypt/releases
+- **Alternative**: EDS Lite from Play Store (can't include, user must download)
+- **Note**: Android apps can't be "portable" but having APK helps
+
+## Quick Download Script
+
+Run this to download automatically (Linux):
+
+```bash
+cd tools/veracrypt/
+
+# Windows Portable
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_Portable_1.26.7.exe \
+  -O VeraCrypt-Portable-Windows.exe
+
+# Linux Console
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/veracrypt-console-1.26.7-Ubuntu-22.04-amd64.deb \
+  -O veracrypt-linux.deb
+ar x veracrypt-linux.deb
+tar xf data.tar.xz
+cp usr/bin/veracrypt VeraCrypt-Portable-Linux
+chmod +x VeraCrypt-Portable-Linux
+rm -rf usr/ *.tar.* *.deb
+
+# macOS
+wget https://launchpad.net/veracrypt/trunk/1.26.7/+download/VeraCrypt_1.26.7.dmg \
+  -O VeraCrypt-MacOS.dmg
+
+echo "✓ Downloads complete!"
+```
+
+## Verification
+
+After downloading, your `tools/veracrypt/` directory should contain:
+
+```
+tools/veracrypt/
+├── DOWNLOAD_INSTRUCTIONS.md (this file)
+├── VeraCrypt-Portable-Windows.exe  (~30 MB)
+├── VeraCrypt-Portable-Linux        (~3-5 MB)
+└── VeraCrypt-MacOS.dmg             (~40 MB) [optional]
+```
+
+## Notes
+
+- **Total size**: ~70-80 MB for all platforms
+- **License**: VeraCrypt is open source (Apache 2.0 / TrueCrypt License 3.0)
+- **Updates**: Check veracrypt.fr periodically for newer versions
+- These portable versions allow accessing your encrypted partition on ANY computer without installing software
+
+## After Downloading
+
+Once you have the files in place, run the main setup script:
+
+```bash
+sudo python3 covert_sd_card_tool.py -d /dev/sdX -a -t /path/to/tails.iso
+```
+
+The script will automatically copy these portable versions to the TOOLS partition.

opsec/README.md

@@ -0,0 +1,97 @@
+# opsec — Privacy Hardening Toolkit
+
+A comprehensive OPSEC hardening suite for Linux systems. Designed for anyone who needs strong privacy defaults without constant manual configuration.
+
+## Features
+
+- **Kill Switch**: iptables rules that block all non-Tor/VPN traffic when enabled
+- **MAC Randomization**: Automatic MAC address spoofing on boot
+- **Hostname Randomization**: Random hostname generation to prevent tracking
+- **DNS Leak Prevention**: Locks DNS to privacy resolvers with immutable resolv.conf
+- **Tor Integration**: Configurable Tor routing with circuit management, exit node filtering, and bridge support
+- **Traffic Blending**: Decoy browsing traffic to mask real activity patterns
+- **Desktop Widget**: Conky-based status HUD with theme support (7 themes included)
+- **Deployment Levels**: Preset configurations from standard privacy to full paranoid mode
+- **Profile System**: Save, load, and switch between configuration profiles
+- **SSH Honeypot Detection**: Check SSH servers against known honeypot signatures
+- **WiFi Security Auditing**: Check wireless configuration for common leaks
+
+## Installation
+
+```bash
+sudo ./install.sh
+```
+
+This copies scripts to `/usr/local/bin/`, configs to `/etc/opsec/`, and sets up systemd services.
+
+## Usage
+
+```bash
+# Interactive configuration
+sudo opsec-config.sh
+
+# Toggle ghost mode (advanced privacy)
+sudo opsec-mode.sh on
+sudo opsec-mode.sh off
+
+# Check OPSEC status
+opsec-check.sh
+
+# Pre-flight readiness check
+opsec-preflight.sh
+
+# Kill switch control
+sudo opsec-killswitch.sh on|off|status
+
+# Apply a deployment level
+sudo opsec-config.sh --level apply bare-metal-standard
+```
+
+## Deployment Levels
+
+| Level | Description |
+|---|---|
+| `bare-metal-standard` | Physical machine, ghost mode toggle available |
+| `bare-metal-paranoid` | Physical machine, ghost mode always on |
+| `cloud-normal` | Cloud VPS, standard privacy (no MAC/hostname) |
+| `cloud-paranoid` | Cloud VPS, maximum security always on |
+
+## Configuration
+
+All settings live in `/etc/opsec/opsec.conf`. Edit via `opsec-config.sh` (interactive TUI) or manually.
+
+Key settings:
+- `TOR_BLACKLIST` — Comma-separated country codes to exclude from Tor exit nodes
+- `DNS_MODE` — DNS resolution mode: `tor`, `quad9`, `cloudflare`, `doh`, `dot`, `custom`
+- `HOSTNAME_PATTERN` — Hostname strategy: `desktop`, `random`, `custom`
+- `LEVEL_TYPE` — `standard` (toggle) or `paranoid` (always on)
+
+## Widget Themes
+
+Seven color themes for the desktop status widget:
+
+`default` `aurora` `ember` `slate` `cyberpunk` `frost` `terminal`
+
+```bash
+sudo opsec-config.sh --theme apply cyberpunk
+```
+
+## Important: Review Your Configuration
+
+**This toolkit ships with intentionally generic defaults.** After installing, you **must** run `sudo opsec-config.sh` and review every setting.
+
+Key items that require your input:
+- **`TOR_BLACKLIST`** is empty by default. You need to set exit node exclusions based on your threat model.
+- **`HOSTNAME_PATTERN`** defaults to `desktop` with no prefix. Set to `random` if you want randomization.
+- **Kill switch and traffic blending** are off by default. Enable them if your threat model requires it.
+- **Deployment level** should be selected to match your environment (bare metal vs cloud, standard vs paranoid).
+
+The generic defaults are **safe but minimal**. They prevent accidental misconfiguration but do not represent a hardened posture. Customize for your needs.
+
+## Responsible Use
+
+This toolkit is designed for legitimate privacy protection. Secure deletion features are irreversible. Network anonymization tools have limitations and are not a guarantee of anonymity. Comply with applicable laws in your jurisdiction. This software is provided as-is.
+
+## License
+
+MIT

opsec/configs/cron/opsec-banner-cache

@@ -0,0 +1,3 @@
+# /etc/cron.d/opsec-banner-cache — Update WAN IP cache for terminal banner
+# Runs every 5 minutes to keep the cached external IP current
+*/5 * * * * root /usr/local/bin/opsec-banner-cache.sh >/dev/null 2>&1

opsec/configs/cron/opsec-log-rotate

@@ -0,0 +1,6 @@
+# /etc/cron.d/opsec-log-rotate — Secure log rotation
+# Interval synced from LOG_ROTATION_HOURS in /etc/opsec/opsec.conf (default: 4h)
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+0 */4 * * * root /usr/local/bin/opsec-log-rotate.sh >/dev/null 2>&1

opsec/configs/desktop/opsec-toggle.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=OPSEC Mode Toggle
+Comment=Toggle between OPSEC Advanced and Standard modes
+Exec=/usr/local/bin/opsec-toggle.sh
+Icon=security-high
+Terminal=false
+Categories=System;Security;
+Keywords=opsec;security;toggle;mode;

opsec/configs/levels/bare-metal-paranoid.conf

@@ -0,0 +1,85 @@
+# /etc/opsec/levels/bare-metal-paranoid.conf — Physical Machine (Paranoid)
+# Maximum security always on. Ghost mode is the default — cannot be disabled.
+# Apply via: sudo opsec-config.sh --level apply bare-metal-paranoid
+
+# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
+# paranoid = ghost mode always on, cannot disable
+LEVEL_TYPE="paranoid"
+
+# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
+PROFILE_NAME="default"
+
+# ─── BASE STATE ───────────────────────────────────────────────────────────────
+BASE_DNS="quad9"
+BASE_MAC_RANDOMIZE="1"
+BASE_IPV6_DISABLE="1"
+
+# ─── TOR SETTINGS ─────────────────────────────────────────────────────────────
+TOR_CIRCUIT_ROTATION="15"
+TOR_BLACKLIST=""
+TOR_STRICT_NODES="1"
+TOR_ISOLATION="1"
+TOR_PADDING="1"
+TOR_SOCKS_PORT="9050"
+TOR_DNS_PORT="5353"
+TOR_NUM_GUARDS="3"
+TOR_SAFE_LOGGING="1"
+
+# ─── DNS SETTINGS ─────────────────────────────────────────────────────────────
+DNS_MODE="tor"
+DNS_CUSTOM_SERVERS=""
+
+# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
+KILLSWITCH_ALLOW_DHCP="1"
+KILLSWITCH_ALLOW_OPENVPN="1"
+KILLSWITCH_ALLOW_WIREGUARD="1"
+KILLSWITCH_EXTRA_PORTS=""
+
+# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
+MAC_INTERFACES="auto"
+MAC_VENDOR_SPOOF=""
+
+# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
+HOSTNAME_PATTERN="random"
+HOSTNAME_CUSTOM_PREFIX=""
+
+# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
+HARDEN_IPV6="1"
+HARDEN_SWAP="1"
+HARDEN_CORE_DUMPS="1"
+HARDEN_CLIPBOARD_CLEAR="1"
+HARDEN_SCREEN_LOCK="1"
+HARDEN_SCREEN_LOCK_TIMEOUT="300"
+HARDEN_TIMEZONE_SPOOF="1"
+HARDEN_TIMEZONE_VALUE="UTC"
+HARDEN_LOCALE_SPOOF="1"
+HARDEN_LOCALE_VALUE="en_US.UTF-8"
+
+# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
+LEAK_WEBRTC_BLOCK="1"
+LEAK_USB_BLOCK="1"
+
+# ─── MONITORING ────────────────────────────────────────────────────────────────
+MONITOR_PROCESSES="1"
+MONITOR_LOG_ROTATION="1"
+LOG_ROTATION_HOURS="1"
+
+# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
+TRAFFIC_JITTER_ENABLED="1"
+TRAFFIC_JITTER_MS="50"
+
+# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
+TOR_BRIDGE_MODE="obfs4"
+TOR_BRIDGE_RELAY=""
+
+# ─── SECURE DELETION ──────────────────────────────────────────────────────────
+WIPE_METHOD="auto"
+
+# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
+DEPLOYMENT_LEVEL="bare-metal-paranoid"
+
+# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
+OPSEC_BANNER="compact"
+
+# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
+WIDGET_THEME="default"

opsec/configs/levels/bare-metal-standard.conf

@@ -0,0 +1,86 @@
+# /etc/opsec/levels/bare-metal-standard.conf — Physical Machine (Standard)
+# Privacy-focused daily driver. Ghost mode available via: opsec-mode on
+# Apply via: sudo opsec-config.sh --level apply bare-metal-standard
+
+# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
+# standard = privacy base, ghost mode toggle available
+# paranoid = ghost mode always on, cannot disable
+LEVEL_TYPE="standard"
+
+# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
+PROFILE_NAME="default"
+
+# ─── BASE STATE (always active in standard mode) ─────────────────────────────
+BASE_DNS="quad9"
+BASE_MAC_RANDOMIZE="1"
+BASE_IPV6_DISABLE="1"
+
+# ─── TOR SETTINGS (used when ghost mode is toggled ON) ───────────────────────
+TOR_CIRCUIT_ROTATION="30"
+TOR_BLACKLIST=""
+TOR_STRICT_NODES="1"
+TOR_ISOLATION="1"
+TOR_PADDING="1"
+TOR_SOCKS_PORT="9050"
+TOR_DNS_PORT="5353"
+TOR_NUM_GUARDS="3"
+TOR_SAFE_LOGGING="1"
+
+# ─── DNS SETTINGS (ghost mode DNS — base uses BASE_DNS above) ────────────────
+DNS_MODE="tor"
+DNS_CUSTOM_SERVERS=""
+
+# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
+KILLSWITCH_ALLOW_DHCP="1"
+KILLSWITCH_ALLOW_OPENVPN="1"
+KILLSWITCH_ALLOW_WIREGUARD="1"
+KILLSWITCH_EXTRA_PORTS=""
+
+# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
+MAC_INTERFACES="auto"
+MAC_VENDOR_SPOOF=""
+
+# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
+HOSTNAME_PATTERN="random"
+HOSTNAME_CUSTOM_PREFIX=""
+
+# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
+HARDEN_IPV6="1"
+HARDEN_SWAP="1"
+HARDEN_CORE_DUMPS="1"
+HARDEN_CLIPBOARD_CLEAR="1"
+HARDEN_SCREEN_LOCK="1"
+HARDEN_SCREEN_LOCK_TIMEOUT="300"
+HARDEN_TIMEZONE_SPOOF="0"
+HARDEN_TIMEZONE_VALUE="UTC"
+HARDEN_LOCALE_SPOOF="0"
+HARDEN_LOCALE_VALUE="en_US.UTF-8"
+
+# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
+LEAK_WEBRTC_BLOCK="1"
+LEAK_USB_BLOCK="1"
+
+# ─── MONITORING ────────────────────────────────────────────────────────────────
+MONITOR_PROCESSES="1"
+MONITOR_LOG_ROTATION="1"
+LOG_ROTATION_HOURS="4"
+
+# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
+TRAFFIC_JITTER_ENABLED="0"
+TRAFFIC_JITTER_MS="50"
+
+# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
+TOR_BRIDGE_MODE="off"
+TOR_BRIDGE_RELAY=""
+
+# ─── SECURE DELETION ──────────────────────────────────────────────────────────
+WIPE_METHOD="auto"
+
+# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
+DEPLOYMENT_LEVEL="bare-metal-standard"
+
+# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
+OPSEC_BANNER="compact"
+
+# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
+WIDGET_THEME="default"

opsec/configs/levels/cloud-normal.conf

@@ -0,0 +1,85 @@
+# /etc/opsec/levels/cloud-normal.conf — Cloud VPS (Standard)
+# Privacy-focused cloud deployment. Ghost mode available via: opsec-mode on
+# No MAC/hostname/screen/USB (hardware-irrelevant on cloud).
+# Apply via: sudo opsec-config.sh --level apply cloud-normal
+
+# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
+LEVEL_TYPE="standard"
+
+# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
+PROFILE_NAME="default"
+
+# ─── BASE STATE (always active in standard mode) ─────────────────────────────
+BASE_DNS="quad9"
+BASE_MAC_RANDOMIZE="0"
+BASE_IPV6_DISABLE="1"
+
+# ─── TOR SETTINGS (used when ghost mode is toggled ON) ───────────────────────
+TOR_CIRCUIT_ROTATION="30"
+TOR_BLACKLIST=""
+TOR_STRICT_NODES="1"
+TOR_ISOLATION="1"
+TOR_PADDING="0"
+TOR_SOCKS_PORT="9050"
+TOR_DNS_PORT="5353"
+TOR_NUM_GUARDS="3"
+TOR_SAFE_LOGGING="1"
+
+# ─── DNS SETTINGS ─────────────────────────────────────────────────────────────
+DNS_MODE="tor"
+DNS_CUSTOM_SERVERS=""
+
+# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
+KILLSWITCH_ALLOW_DHCP="1"
+KILLSWITCH_ALLOW_OPENVPN="1"
+KILLSWITCH_ALLOW_WIREGUARD="1"
+KILLSWITCH_EXTRA_PORTS=""
+
+# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
+MAC_INTERFACES="auto"
+MAC_VENDOR_SPOOF=""
+
+# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
+HOSTNAME_PATTERN="desktop"
+HOSTNAME_CUSTOM_PREFIX=""
+
+# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
+HARDEN_IPV6="1"
+HARDEN_SWAP="1"
+HARDEN_CORE_DUMPS="1"
+HARDEN_CLIPBOARD_CLEAR="0"
+HARDEN_SCREEN_LOCK="0"
+HARDEN_SCREEN_LOCK_TIMEOUT="300"
+HARDEN_TIMEZONE_SPOOF="0"
+HARDEN_TIMEZONE_VALUE="UTC"
+HARDEN_LOCALE_SPOOF="0"
+HARDEN_LOCALE_VALUE="en_US.UTF-8"
+
+# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
+LEAK_WEBRTC_BLOCK="1"
+LEAK_USB_BLOCK="0"
+
+# ─── MONITORING ────────────────────────────────────────────────────────────────
+MONITOR_PROCESSES="1"
+MONITOR_LOG_ROTATION="1"
+LOG_ROTATION_HOURS="1"
+
+# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
+TRAFFIC_JITTER_ENABLED="0"
+TRAFFIC_JITTER_MS="50"
+
+# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
+TOR_BRIDGE_MODE="off"
+TOR_BRIDGE_RELAY=""
+
+# ─── SECURE DELETION ──────────────────────────────────────────────────────────
+WIPE_METHOD="auto"
+
+# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
+DEPLOYMENT_LEVEL="cloud-normal"
+
+# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
+OPSEC_BANNER="compact"
+
+# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
+WIDGET_THEME="default"

opsec/configs/levels/cloud-paranoid.conf

@@ -0,0 +1,84 @@
+# /etc/opsec/levels/cloud-paranoid.conf — Cloud VPS (Paranoid)
+# Maximum security always on. Ghost mode is the default — cannot be disabled.
+# Apply via: sudo opsec-config.sh --level apply cloud-paranoid
+
+# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
+LEVEL_TYPE="paranoid"
+
+# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
+PROFILE_NAME="default"
+
+# ─── BASE STATE ───────────────────────────────────────────────────────────────
+BASE_DNS="quad9"
+BASE_MAC_RANDOMIZE="0"
+BASE_IPV6_DISABLE="1"
+
+# ─── TOR SETTINGS ─────────────────────────────────────────────────────────────
+TOR_CIRCUIT_ROTATION="15"
+TOR_BLACKLIST=""
+TOR_STRICT_NODES="1"
+TOR_ISOLATION="1"
+TOR_PADDING="1"
+TOR_SOCKS_PORT="9050"
+TOR_DNS_PORT="5353"
+TOR_NUM_GUARDS="3"
+TOR_SAFE_LOGGING="1"
+
+# ─── DNS SETTINGS ─────────────────────────────────────────────────────────────
+DNS_MODE="tor"
+DNS_CUSTOM_SERVERS=""
+
+# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
+KILLSWITCH_ALLOW_DHCP="1"
+KILLSWITCH_ALLOW_OPENVPN="1"
+KILLSWITCH_ALLOW_WIREGUARD="1"
+KILLSWITCH_EXTRA_PORTS=""
+
+# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
+MAC_INTERFACES="auto"
+MAC_VENDOR_SPOOF=""
+
+# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
+HOSTNAME_PATTERN="desktop"
+HOSTNAME_CUSTOM_PREFIX=""
+
+# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
+HARDEN_IPV6="1"
+HARDEN_SWAP="1"
+HARDEN_CORE_DUMPS="1"
+HARDEN_CLIPBOARD_CLEAR="1"
+HARDEN_SCREEN_LOCK="0"
+HARDEN_SCREEN_LOCK_TIMEOUT="300"
+HARDEN_TIMEZONE_SPOOF="1"
+HARDEN_TIMEZONE_VALUE="UTC"
+HARDEN_LOCALE_SPOOF="1"
+HARDEN_LOCALE_VALUE="en_US.UTF-8"
+
+# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
+LEAK_WEBRTC_BLOCK="1"
+LEAK_USB_BLOCK="0"
+
+# ─── MONITORING ────────────────────────────────────────────────────────────────
+MONITOR_PROCESSES="1"
+MONITOR_LOG_ROTATION="1"
+LOG_ROTATION_HOURS="1"
+
+# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
+TRAFFIC_JITTER_ENABLED="1"
+TRAFFIC_JITTER_MS="50"
+
+# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
+TOR_BRIDGE_MODE="obfs4"
+TOR_BRIDGE_RELAY=""
+
+# ─── SECURE DELETION ──────────────────────────────────────────────────────────
+WIPE_METHOD="auto"
+
+# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
+DEPLOYMENT_LEVEL="cloud-paranoid"
+
+# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
+OPSEC_BANNER="compact"
+
+# ─── WIDGET THEME ─────────────────────────────────────────────────────────────
+WIDGET_THEME="default"

opsec/configs/opsec-aliases

@@ -0,0 +1,100 @@
+# ─── OPSEC ALIASES ───────────────────────────────────────────────────────────
+
+# Network checks
+alias myip='curl -s ifconfig.me'
+alias checkip='curl -s https://ipinfo.io/ip'
+alias checkdns='cat /etc/resolv.conf'
+alias ports='netstat -tulanp'
+alias listen='lsof -i -P | grep LISTEN'
+alias estab='lsof -i -P | grep ESTABLISHED'
+
+# Process and connection monitoring
+alias checkcon='ss -tupan | grep ESTABLISHED'
+alias checklis='ss -tupan | grep LISTEN'
+alias checkproc='ps auxf | grep -v grep | grep'
+alias psg='ps aux | grep -v grep | grep -i'
+
+# Emergency and cleanup
+alias killcon='killall -9 openvpn ssh 2>/dev/null'
+alias randmac='randomize-mac.sh'
+alias opsec='opsec-check.sh'
+
+# Cleanup operations
+alias clear-logs='sudo find /var/log -name '\''opsec*'\'' -type f -exec truncate -s 0 {} \; && sudo truncate -s 0 /var/log/syslog /var/log/auth.log 2>/dev/null'
+alias clear-history='history -c && > ~/.bash_history && > ~/.zsh_history'
+alias shred-file='shred -vfz -n 3'
+
+# Anonymity
+alias anon-on='sudo systemctl start tor && . torsocks on'
+alias anon-off='. torsocks off && sudo systemctl stop tor'
+alias check-tor='curl -s https://check.torproject.org/api/ip'
+
+# Safe OPSEC status check
+alias opsec-status='echo "OPSEC Status:"; echo "VPN: $(pgrep openvpn > /dev/null && echo "Connected" || echo "Disconnected")"; echo "Tor: $(systemctl is-active tor 2>/dev/null | grep -q active && echo "Active" || echo "Inactive")"; echo "IP: $(curl -s --max-time 2 ifconfig.me || echo "Check failed")"'
+
+# Quick OPSEC check
+alias quick-opsec='opsec-status && echo "" && echo "=== Connections ===" && ss -tupln | grep -E ":443|:9050|:1080" | head -5'
+
+# ─── ADVANCED OPSEC MODE ──────────────────────────────────────────────────────
+
+# Master toggle
+alias opsec-on='sudo /usr/local/bin/opsec-mode.sh on'
+alias opsec-off='sudo /usr/local/bin/opsec-mode.sh off'
+alias opsec-advanced='sudo /usr/local/bin/opsec-mode.sh status'
+
+# Kill switch controls
+alias killswitch-on='sudo /usr/local/bin/opsec-killswitch.sh on'
+alias killswitch-off='sudo /usr/local/bin/opsec-killswitch.sh off'
+alias killswitch-status='sudo /usr/local/bin/opsec-killswitch.sh status'
+
+# Hostname randomization
+alias randhostname='sudo /usr/local/bin/opsec-hostname-randomize.sh'
+
+# Tor circuit management
+alias check-circuit='curl -s --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip'
+alias new-circuit='sudo killall -HUP tor && echo "New Tor circuit requested"'
+
+# DNS leak check
+alias check-dns-leak='echo "=== DNS Leak Check ===" && echo "resolv.conf:" && grep nameserver /etc/resolv.conf && echo "" && echo "Tor DNS test:" && dig +short @127.0.0.1 -p 5353 check.torproject.org 2>/dev/null || echo "Tor DNS not available"'
+
+# OPSEC Config Manager
+alias opsec-config='sudo /usr/local/bin/opsec-config.sh'
+alias opsec-show='sudo /usr/local/bin/opsec-mode.sh status'
+
+# Profile management
+alias opsec-profile='sudo /usr/local/bin/opsec-config.sh --profile'
+
+# Boot mode
+alias opsec-boot-on='sudo /usr/local/bin/opsec-config.sh --boot on'
+alias opsec-boot-off='sudo /usr/local/bin/opsec-config.sh --boot off'
+
+# SSH honeypot check
+alias ssh-safe='/usr/local/bin/opsec-ssh-check.sh'
+
+# Connection monitor
+alias opsec-monitor-start='sudo /usr/local/bin/opsec-monitor.sh start'
+alias opsec-monitor-stop='sudo /usr/local/bin/opsec-monitor.sh stop'
+alias opsec-monitor-status='sudo /usr/local/bin/opsec-monitor.sh status'
+
+# WiFi security
+alias opsec-wifi='sudo /usr/local/bin/opsec-wifi-check.sh'
+
+# Conky widget controls — position: tl tc tr bl bc br (default: bl)
+alias opsec-widget-kill='killall conky 2>/dev/null && echo "Widget stopped" || echo "Widget not running"'
+opsec-widget() { ~/.config/conky/opsec-widget-launch.sh "${1:-bl}"; }
+opsec-widget-restart() { ~/.config/conky/opsec-widget-launch.sh "${1:-bl}"; }
+
+# Deployment level and banner control
+alias opsec-level='sudo /usr/local/bin/opsec-config.sh --level apply'
+alias opsec-level-list='sudo /usr/local/bin/opsec-config.sh --level list'
+alias opsec-banner-set='sudo /usr/local/bin/opsec-config.sh --banner'
+alias opsec-toggle='/usr/local/bin/opsec-toggle.sh'
+
+# Preflight and break-glass
+alias opsec-preflight='/usr/local/bin/opsec-preflight.sh'
+alias opsec-score='/usr/local/bin/opsec-preflight.sh --score'
+alias opsec-breakglass='sudo /usr/local/bin/opsec-mode.sh breakglass'
+alias opsec-breakglass-off='sudo /usr/local/bin/opsec-mode.sh breakglass-off'
+
+# ─── OPSEC TERMINAL BANNER ──────────────────────────────────────────────────
+[ -x /usr/local/bin/opsec-banner.sh ] && /usr/local/bin/opsec-banner.sh

opsec/configs/opsec-country-codes.conf

@@ -0,0 +1,28 @@
+# /etc/opsec/country-codes.conf — Country Code Presets for Tor Blacklisting
+# Used by opsec-config.sh and opsec-lib.sh for quick preset loading
+# Format: PRESET_NAME="cc1,cc2,cc3,..."
+
+# ─── INTELLIGENCE ALLIANCES ────────────────────────────────────────────────────
+
+# Five Eyes — core anglosphere intelligence sharing
+FIVE_EYES="us,gb,ca,au,nz"
+
+# Nine Eyes — Five Eyes + Denmark, France, Netherlands, Norway
+NINE_EYES="us,gb,ca,au,nz,dk,fr,nl,no"
+
+# Fourteen Eyes — Nine Eyes + Germany, Belgium, Italy, Sweden, Spain
+FOURTEEN_EYES="us,gb,ca,au,nz,dk,fr,nl,no,de,be,it,se,es"
+
+# ─── HIGH-SURVEILLANCE STATES ─────────────────────────────────────────────────
+
+# Countries with known mass surveillance / hostile SIGINT
+SURVEILLANCE_STATES="cn,ru,ir,kp,il,sg,ae,sa,eg,tr,pk,th,vn,by,kz"
+
+# ─── COMBINED PRESETS ──────────────────────────────────────────────────────────
+
+# Maximum exclusion: Fourteen Eyes + surveillance states
+MAX_EXCLUSION="us,gb,ca,au,nz,dk,fr,nl,no,de,be,it,se,es,cn,ru,ir,kp,il,sg,ae,sa,eg,tr,pk,th,vn,by,kz"
+
+# ─── VALID COUNTRY CODES (for input validation) ───────────────────────────────
+# ISO 3166-1 alpha-2 codes commonly used as Tor country codes
+VALID_CODES="ad,ae,af,ag,ai,al,am,ao,ar,as,at,au,az,ba,bb,bd,be,bf,bg,bh,bi,bj,bm,bn,bo,br,bs,bt,bw,by,bz,ca,cd,cf,cg,ch,ci,cl,cm,cn,co,cr,cu,cv,cy,cz,de,dj,dk,dm,do,dz,ec,ee,eg,er,es,et,fi,fj,fm,fr,ga,gb,gd,ge,gh,gm,gn,gp,gq,gr,gt,gw,gy,hk,hn,hr,ht,hu,id,ie,il,in,iq,ir,is,it,jm,jo,jp,ke,kg,kh,ki,km,kn,kp,kr,kw,kz,la,lb,lc,li,lk,lr,ls,lt,lu,lv,ly,ma,mc,md,me,mg,mh,mk,ml,mm,mn,mo,mr,mt,mu,mv,mw,mx,my,mz,na,ne,ng,ni,nl,no,np,nr,nz,om,pa,pe,pg,ph,pk,pl,pt,pw,py,qa,ro,rs,ru,rw,sa,sb,sc,sd,se,sg,si,sk,sl,sm,sn,so,sr,ss,st,sv,sy,sz,td,tg,th,tj,tl,tm,tn,to,tr,tt,tv,tw,tz,ua,ug,us,uy,uz,va,vc,ve,vn,vu,ws,ye,za,zm,zw"

opsec/configs/opsec.conf

@@ -0,0 +1,96 @@
+# /etc/opsec/opsec.conf — Central OPSEC Configuration
+# Shell-sourceable KEY="value" format. All scripts source this file.
+# Edit via: sudo opsec-config.sh (interactive TUI)
+# Manual edits: source /usr/local/lib/opsec/opsec-lib.sh && opsec_set_value KEY "value"
+
+# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
+PROFILE_NAME="default"
+
+# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
+TOR_CIRCUIT_ROTATION="30"
+TOR_BLACKLIST=""
+TOR_STRICT_NODES="1"
+TOR_ISOLATION="1"
+TOR_PADDING="1"
+TOR_SOCKS_PORT="9050"
+TOR_DNS_PORT="5353"
+TOR_NUM_GUARDS="3"
+TOR_SAFE_LOGGING="1"
+
+# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
+# Mode: tor | quad9 | cloudflare | doh | dot | custom
+DNS_MODE="tor"
+DNS_CUSTOM_SERVERS=""
+
+# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
+KILLSWITCH_ALLOW_DHCP="1"
+KILLSWITCH_ALLOW_OPENVPN="1"
+KILLSWITCH_ALLOW_WIREGUARD="1"
+KILLSWITCH_EXTRA_PORTS=""
+
+# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
+# Interfaces: auto (all non-lo) or comma-separated list (e.g. "eth0,wlan0")
+MAC_INTERFACES="auto"
+# Vendor spoof: empty for random, or OUI prefix (e.g. "00:1A:2B" for specific vendor)
+MAC_VENDOR_SPOOF=""
+
+# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
+# Pattern: desktop | random | custom
+HOSTNAME_PATTERN="desktop"
+HOSTNAME_CUSTOM_PREFIX=""
+
+# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
+HARDEN_IPV6="1"
+HARDEN_SWAP="1"
+HARDEN_CORE_DUMPS="1"
+HARDEN_CLIPBOARD_CLEAR="0"
+HARDEN_SCREEN_LOCK="1"
+HARDEN_SCREEN_LOCK_TIMEOUT="300"
+HARDEN_TIMEZONE_SPOOF="0"
+HARDEN_TIMEZONE_VALUE="UTC"
+HARDEN_LOCALE_SPOOF="0"
+HARDEN_LOCALE_VALUE="en_US.UTF-8"
+
+# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
+LEAK_WEBRTC_BLOCK="1"
+LEAK_USB_BLOCK="0"
+
+# ─── MONITORING ────────────────────────────────────────────────────────────────
+MONITOR_PROCESSES="0"
+MONITOR_LOG_ROTATION="1"
+LOG_ROTATION_HOURS="4"
+
+# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
+TRAFFIC_JITTER_ENABLED="0"
+TRAFFIC_JITTER_MS="50"
+
+# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
+# standard = privacy base, ghost mode toggle available
+# paranoid = ghost mode always on, cannot disable
+LEVEL_TYPE="standard"
+
+# ─── BASE STATE (always active in standard mode) ─────────────────────────────
+BASE_DNS="quad9"
+BASE_MAC_RANDOMIZE="1"
+BASE_IPV6_DISABLE="1"
+
+# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
+# Mode: off | obfs4 | meek-azure | snowflake
+TOR_BRIDGE_MODE="off"
+TOR_BRIDGE_RELAY=""
+
+# ─── SECURE DELETION ──────────────────────────────────────────────────────────
+# Method: auto | shred | fstrim | luks
+WIPE_METHOD="auto"
+
+# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
+# Level: bare-metal-standard | bare-metal-paranoid | cloud-normal | cloud-paranoid
+DEPLOYMENT_LEVEL="bare-metal-standard"
+
+# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
+# Mode: compact | full | auto | off
+OPSEC_BANNER="compact"
+
+# ─── WIDGET THEME ────────────────────────────────────────────────────────────
+# Theme: default | aurora | ember | slate | cyberpunk | frost | terminal
+WIDGET_THEME="default"

opsec/configs/polkit/com.opsec.mode.policy

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <action id="com.opsec.mode.toggle">
+    <description>Toggle OPSEC Advanced Mode</description>
+    <message>Authentication is required to toggle OPSEC mode</message>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/opsec-mode.sh</annotate>
+    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
+  </action>
+</policyconfig>

opsec/configs/resolv.conf.head

@@ -0,0 +1,14 @@
+# OPSEC DNS Servers
+# Quad9 (Security focused)
+nameserver 9.9.9.9
+nameserver 149.112.112.112
+
+# Cloudflare (Privacy focused)
+nameserver 1.1.1.1
+nameserver 1.0.0.1
+
+# DNS Options
+options edns0 trust-ad
+options timeout:1
+options attempts:1
+options rotate

opsec/configs/resolv.conf.opsec

@@ -0,0 +1,3 @@
+# OPSEC Mode DNS — all resolution through Tor DNSPort
+# Deployed by opsec-mode on, locked with chattr +i
+nameserver 127.0.0.1

opsec/configs/systemd/opsec-boot-advanced.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=OPSEC Boot-into-Advanced Mode Initializer
+Documentation=man:opsec-mode(8)
+DefaultDependencies=no
+Before=network-pre.target NetworkManager.service networking.service
+Before=opsec-mac-randomize.service opsec-hostname-randomize.service opsec-killswitch.service
+After=local-fs.target sysinit.target
+ConditionPathExists=/etc/opsec/boot-advanced.enabled
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/opsec-boot-init.sh
+RemainAfterExit=yes
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

opsec/configs/systemd/opsec-hostname-randomize.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=OPSEC Hostname Randomization
+Before=NetworkManager.service
+Before=networking.service
+After=local-fs.target
+ConditionPathExists=/var/run/opsec-advanced.enabled
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/opsec-hostname-randomize.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

opsec/configs/systemd/opsec-killswitch.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=OPSEC Kill Switch (block non-Tor/VPN traffic)
+Before=NetworkManager.service
+Before=networking.service
+After=local-fs.target
+ConditionPathExists=/var/run/opsec-advanced.enabled
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/opsec-killswitch.sh on
+ExecStop=/usr/local/bin/opsec-killswitch.sh off
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

opsec/configs/systemd/opsec-mac-randomize.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=OPSEC MAC Address Randomization
+Before=NetworkManager.service
+Before=networking.service
+After=local-fs.target
+ConditionPathExists=/var/run/opsec-advanced.enabled
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/randomize-mac.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

opsec/configs/themes/aurora.theme

@@ -0,0 +1,14 @@
+# Aurora theme — purple and cyan tones
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="Aurora"
+CONKY_BG="000000"
+CONKY_COLOR0="B55AFC"
+CONKY_COLOR1="FF63BE"
+CONKY_COLOR2="85E7FF"
+CONKY_COLOR3="000000"
+CONKY_COLOR4="268BD2"
+CONKY_COLOR5="07CAF9"
+CONKY_COLOR6="85E7FF"
+CONKY_COLOR7="ECDEF7"
+CONKY_COLOR8="B55AFC"
+CONKY_COLOR9="4A6A7A"

opsec/configs/themes/cyberpunk.theme

@@ -0,0 +1,14 @@
+# CyberPunk theme — neon cyan/pink/green on black
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="CyberPunk"
+CONKY_BG="000000"
+CONKY_COLOR0="FF3B3B"
+CONKY_COLOR1="00F5A0"
+CONKY_COLOR2="08F7FE"
+CONKY_COLOR3="000000"
+CONKY_COLOR4="08F7FE"
+CONKY_COLOR5="FF2E88"
+CONKY_COLOR6="00D1FF"
+CONKY_COLOR7="EAEAFF"
+CONKY_COLOR8="08F7FE"
+CONKY_COLOR9="2A2A2A"

opsec/configs/themes/default.theme

@@ -0,0 +1,14 @@
+# Default theme — balanced green-on-black aesthetic
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="Default"
+CONKY_BG="000000"
+CONKY_COLOR0="FF4C4C"
+CONKY_COLOR1="00FF9C"
+CONKY_COLOR2="49D6B6"
+CONKY_COLOR3="000000"
+CONKY_COLOR4="49D6B6"
+CONKY_COLOR5="2AFFC6"
+CONKY_COLOR6="2AFFC6"
+CONKY_COLOR7="CFFFE6"
+CONKY_COLOR8="49D6B6"
+CONKY_COLOR9="1A1A1A"

opsec/configs/themes/ember.theme

@@ -0,0 +1,14 @@
+# Ember theme — warm red and white tones
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="Ember"
+CONKY_BG="000000"
+CONKY_COLOR0="FF2B2B"
+CONKY_COLOR1="A0A0A0"
+CONKY_COLOR2="B0B0B0"
+CONKY_COLOR3="000000"
+CONKY_COLOR4="FF2B2B"
+CONKY_COLOR5="FF7A7A"
+CONKY_COLOR6="CFCFCF"
+CONKY_COLOR7="EDEDED"
+CONKY_COLOR8="FF2B2B"
+CONKY_COLOR9="A0A0A0"

opsec/configs/themes/frost.theme

@@ -0,0 +1,14 @@
+# Frost theme — cool blues and teals
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="Frost"
+CONKY_BG="000000"
+CONKY_COLOR0="DC2626"
+CONKY_COLOR1="5EEAD4"
+CONKY_COLOR2="00E5FF"
+CONKY_COLOR3="000000"
+CONKY_COLOR4="22D3EE"
+CONKY_COLOR5="00E5FF"
+CONKY_COLOR6="22D3EE"
+CONKY_COLOR7="DDE6F3"
+CONKY_COLOR8="00E5FF"
+CONKY_COLOR9="1A1A1A"

opsec/configs/themes/slate.theme

@@ -0,0 +1,14 @@
+# Slate theme — muted neutral tones with gold accent
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="Slate"
+CONKY_BG="000000"
+CONKY_COLOR0="C63636"
+CONKY_COLOR1="9A9A9A"
+CONKY_COLOR2="B0B0B0"
+CONKY_COLOR3="000000"
+CONKY_COLOR4="7A7A7A"
+CONKY_COLOR5="D1A954"
+CONKY_COLOR6="AFAFAF"
+CONKY_COLOR7="E6E6E6"
+CONKY_COLOR8="B0B0B0"
+CONKY_COLOR9="7A7A7A"

opsec/configs/themes/terminal.theme

@@ -0,0 +1,14 @@
+# Terminal theme — classic monochrome green CRT aesthetic
+# Deployed to /etc/opsec/themes/ — sourced by opsec_generate_conky()
+THEME_LABEL="Terminal"
+CONKY_BG="0A0A0A"
+CONKY_COLOR0="FF3333"
+CONKY_COLOR1="33FF33"
+CONKY_COLOR2="22BB22"
+CONKY_COLOR3="0A0A0A"
+CONKY_COLOR4="118811"
+CONKY_COLOR5="44FF44"
+CONKY_COLOR6="33DD33"
+CONKY_COLOR7="AAFFAA"
+CONKY_COLOR8="22CC22"
+CONKY_COLOR9="1A3A1A"

opsec/configs/torrc/torrc-default

@@ -0,0 +1,5 @@
+# Minimal stock Tor configuration
+# Restored by opsec-mode off
+
+SocksPort 9050
+Log notice file /var/log/tor/notices.log

opsec/configs/torrc/torrc-opsec

@@ -0,0 +1,32 @@
+# Hardened Tor Configuration for OPSEC Mode
+# Deployed by opsec-mode on — restored to torrc-default on off
+
+# ─── SOCKS & DNS ────────────────────────────────────────────────────────────
+SocksPort 9050 IsolateDestAddr IsolateDestPort
+DNSPort 5353
+
+# ─── FIVE EYES EXCLUSION ────────────────────────────────────────────────────
+# Never use exit nodes in Five Eyes countries
+ExcludeExitNodes {us},{gb},{ca},{au},{nz}
+StrictNodes 1
+
+# ─── CIRCUIT ROTATION ───────────────────────────────────────────────────────
+# Rotate circuits every 30 seconds for maximum anonymity
+MaxCircuitDirtiness 30
+
+# ─── STREAM ISOLATION ───────────────────────────────────────────────────────
+# Each destination gets its own circuit
+IsolateSOCKSAuth 1
+
+# ─── TRAFFIC PADDING ────────────────────────────────────────────────────────
+# Pad cells to resist traffic analysis
+ConnectionPadding 1
+
+# ─── SAFE LOGGING ────────────────────────────────────────────────────────────
+# Scrub sensitive info from logs
+SafeLogging 1
+Log notice file /var/log/tor/notices.log
+
+# ─── PERFORMANCE ─────────────────────────────────────────────────────────────
+NumEntryGuards 3
+UseEntryGuards 1

opsec/configs/udev/99-opsec-usb.rules

@@ -0,0 +1,15 @@
+# /etc/udev/rules.d/99-opsec-usb.rules — OPSEC USB Device Monitoring
+# Logs all USB insertions and sends desktop notification
+# Optionally blocks new devices when LEAK_USB_BLOCK=1 in /etc/opsec/opsec.conf
+
+# Log all USB device insertions
+ACTION=="add", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", \
+    RUN+="/bin/bash -c 'echo \"[$(date +%%Y-%%m-%%d\\ %%H:%%M:%%S)] USB INSERT: vendor=$attr{idVendor} product=$attr{idProduct} serial=$attr{serial}\" >> /var/log/opsec-usb.log'"
+
+# Desktop notification on USB insertion
+ACTION=="add", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", \
+    RUN+="/bin/bash -c 'REAL_USER=$(who | head -1 | awk \"{print \\$1}\"); [ -n \"$REAL_USER\" ] && su - $REAL_USER -c \"DISPLAY=:0 notify-send -u critical OPSEC\\ USB \\\"USB device inserted: $attr{idVendor}:$attr{idProduct}\\\"\" 2>/dev/null || true'"
+
+# Log USB mass storage specifically (higher risk)
+ACTION=="add", SUBSYSTEM=="block", ENV{ID_USB_DRIVER}=="usb-storage", \
+    RUN+="/bin/bash -c 'echo \"[$(date +%%Y-%%m-%%d\\ %%H:%%M:%%S)] USB STORAGE: $env{ID_VENDOR} $env{ID_MODEL} $env{ID_SERIAL}\" >> /var/log/opsec-usb.log'"

opsec/configs/vpn-templates/double-hop-ovpn.conf.template

@@ -0,0 +1,69 @@
+# Double-Hop OpenVPN Configuration Template
+# Chain two VPN servers for additional anonymity layer
+# Replace %%VARIABLES%% with actual values before use
+#
+# Usage: Copy and fill in variables, then:
+#   sudo openvpn --config double-hop.ovpn
+
+# ─── First Hop (Entry Server) ─────────────────────────────────────────────────
+# This is the server your ISP sees you connecting to
+
+client
+dev tun
+proto %%PROTO_1%%
+remote %%SERVER_1%% %%PORT_1%%
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+
+# Authentication
+auth-user-pass %%AUTH_FILE_1%%
+ca %%CA_FILE_1%%
+
+# Security
+cipher AES-256-GCM
+auth SHA512
+tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
+tls-version-min 1.2
+remote-cert-tls server
+
+# Routing — send all traffic through VPN
+redirect-gateway def1
+dhcp-option DNS 10.8.0.1
+
+# Keepalive
+keepalive 10 60
+ping-timer-rem
+
+# Logging
+verb 3
+mute 10
+
+# ─── Second Hop Configuration ─────────────────────────────────────────────────
+# After first VPN is established, launch second hop:
+#
+#   sudo openvpn --config hop2.ovpn --route-nopull \
+#       --route %%SERVER_2%% 255.255.255.255 net_gateway
+#
+# Where hop2.ovpn contains:
+#   client
+#   dev tun1
+#   proto %%PROTO_2%%
+#   remote %%SERVER_2%% %%PORT_2%%
+#   auth-user-pass %%AUTH_FILE_2%%
+#   ca %%CA_FILE_2%%
+#   cipher AES-256-GCM
+#   redirect-gateway def1
+
+# ─── Variables Reference ───────────────────────────────────────────────────────
+# %%SERVER_1%%    — First hop IP/hostname
+# %%PORT_1%%      — First hop port (e.g. 1194, 443)
+# %%PROTO_1%%     — First hop protocol (udp/tcp)
+# %%AUTH_FILE_1%% — First hop credentials file
+# %%CA_FILE_1%%   — First hop CA certificate
+# %%SERVER_2%%    — Second hop IP/hostname
+# %%PORT_2%%      — Second hop port
+# %%PROTO_2%%     — Second hop protocol
+# %%AUTH_FILE_2%% — Second hop credentials file
+# %%CA_FILE_2%%   — Second hop CA certificate

opsec/configs/vpn-templates/wireguard-multihop.conf.template

@@ -0,0 +1,72 @@
+# WireGuard Multi-Hop Configuration Template
+# Chain WireGuard tunnels for additional anonymity
+# Replace %%VARIABLES%% with actual values
+#
+# Architecture:
+#   You → wg0 (Hop 1) → wg1 (Hop 2) → Internet
+#
+# Usage:
+#   sudo cp this-file /etc/wireguard/wg0.conf  (fill in variables)
+#   sudo wg-quick up wg0
+#   sudo wg-quick up wg1
+
+# ═══════════════════════════════════════════════════════════════════════════════
+# HOP 1: /etc/wireguard/wg0.conf — Entry tunnel (your ISP sees this)
+# ═══════════════════════════════════════════════════════════════════════════════
+
+[Interface]
+PrivateKey = %%PRIVATE_KEY_1%%
+Address = %%TUNNEL_IP_1%%/32
+DNS = %%DNS_1%%
+# MTU adjustment for encapsulation overhead
+MTU = 1380
+
+# Post-routing to allow hop 2 through hop 1
+PostUp = ip rule add from %%TUNNEL_IP_2%% table 200; ip route add default via %%GATEWAY_1%% table 200
+PostDown = ip rule del from %%TUNNEL_IP_2%% table 200; ip route del default via %%GATEWAY_1%% table 200
+
+[Peer]
+PublicKey = %%PUBLIC_KEY_1%%
+PresharedKey = %%PSK_1%%
+Endpoint = %%ENDPOINT_1%%:%%PORT_1%%
+AllowedIPs = 0.0.0.0/0, ::/0
+PersistentKeepalive = 25
+
+# ═══════════════════════════════════════════════════════════════════════════════
+# HOP 2: /etc/wireguard/wg1.conf — Exit tunnel (internet sees this)
+# ═══════════════════════════════════════════════════════════════════════════════
+#
+# [Interface]
+# PrivateKey = %%PRIVATE_KEY_2%%
+# Address = %%TUNNEL_IP_2%%/32
+# DNS = %%DNS_2%%
+# MTU = 1340
+# # Route this tunnel's traffic through wg0
+# Table = off
+# PostUp = ip rule add from %%TUNNEL_IP_2%% table 200
+# PostDown = ip rule del from %%TUNNEL_IP_2%% table 200
+#
+# [Peer]
+# PublicKey = %%PUBLIC_KEY_2%%
+# PresharedKey = %%PSK_2%%
+# Endpoint = %%ENDPOINT_2%%:%%PORT_2%%
+# AllowedIPs = 0.0.0.0/0, ::/0
+# PersistentKeepalive = 25
+
+# ─── Variables Reference ───────────────────────────────────────────────────────
+# %%PRIVATE_KEY_1%%  — Your private key for hop 1 (wg genkey)
+# %%PUBLIC_KEY_1%%   — Hop 1 server's public key
+# %%PSK_1%%          — Preshared key for hop 1 (wg genpsk)
+# %%ENDPOINT_1%%     — Hop 1 server IP/hostname
+# %%PORT_1%%         — Hop 1 server port (default: 51820)
+# %%TUNNEL_IP_1%%    — Your assigned tunnel IP on hop 1
+# %%GATEWAY_1%%      — Hop 1 internal gateway IP
+# %%DNS_1%%          — DNS server for hop 1
+#
+# %%PRIVATE_KEY_2%%  — Your private key for hop 2
+# %%PUBLIC_KEY_2%%   — Hop 2 server's public key
+# %%PSK_2%%          — Preshared key for hop 2
+# %%ENDPOINT_2%%     — Hop 2 server IP/hostname (reachable via hop 1)
+# %%PORT_2%%         — Hop 2 server port
+# %%TUNNEL_IP_2%%    — Your assigned tunnel IP on hop 2
+# %%DNS_2%%          — DNS server for hop 2

opsec/conky/conky-opsec-cache.sh

@@ -0,0 +1,146 @@
+#!/bin/bash
+# conky-opsec-cache — Background IP/geo cache updater
+# Runs in a loop, writes results to cache file that the status script reads.
+# This keeps all slow network calls OUT of the conky render path.
+
+CACHE_DIR="/tmp/.opsec-cache"
+CACHE_FILE="${CACHE_DIR}/netinfo"
+LOCK_FILE="${CACHE_DIR}/.updating"
+INTERVAL=30  # seconds between updates
+
+mkdir -p "$CACHE_DIR"
+chmod 700 "$CACHE_DIR"
+
+update_cache() {
+    # Prevent concurrent updates
+    [ -f "$LOCK_FILE" ] && return
+    touch "$LOCK_FILE"
+
+    local advanced=false
+    [ -f /var/run/opsec-advanced.enabled ] && advanced=true
+
+    local pub_ip="" pub_geo="" routed_tor=false exit_country=""
+
+    # In Advanced mode with SOCKS available: verify Tor via HTTPS, then get geo
+    if $advanced && ss -tln 2>/dev/null | grep -q ':9050 '; then
+        # Step 1: Verify Tor routing via HTTPS (encrypted, trusted endpoint)
+        local tor_json
+        tor_json=$(curl -4 -s --max-time 10 --socks5-hostname 127.0.0.1:9050 "https://check.torproject.org/api/ip" 2>/dev/null)
+        if echo "$tor_json" | grep -q '"IsTor":true'; then
+            pub_ip=$(echo "$tor_json" | grep -o '"IP":"[^"]*"' | cut -d'"' -f4)
+            if [ -n "$pub_ip" ] && echo "$pub_ip" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+                routed_tor=true
+            else
+                pub_ip=""
+            fi
+        fi
+        # Step 2: Get geo data via ip-api.com (HTTP only — but over Tor SOCKS so exit encrypts)
+        # ip-api.com pro HTTPS requires a paid key; free tier is HTTP-only
+        # This is acceptable: traffic goes through Tor SOCKS tunnel, so local network can't see it
+        if [ -n "$pub_ip" ]; then
+            local geo_json
+            geo_json=$(curl -4 -s --max-time 10 --socks5-hostname 127.0.0.1:9050 "http://ip-api.com/json/${pub_ip}?fields=countryCode,city" 2>/dev/null)
+            local geo_country geo_city
+            geo_country=$(echo "$geo_json" | grep -o '"countryCode":"[^"]*"' | cut -d'"' -f4)
+            geo_city=$(echo "$geo_json" | grep -o '"city":"[^"]*"' | cut -d'"' -f4)
+            exit_country="$geo_country"
+            [ -n "$geo_country" ] && pub_geo="${geo_city:+${geo_city}, }${geo_country}"
+        fi
+    fi
+
+    # Fallback to direct — only if NOT in advanced mode (kill switch would DROP it)
+    if [ -z "$pub_ip" ] && ! $advanced; then
+        local api_json
+        api_json=$(curl -4 -s --max-time 4 "https://check.torproject.org/api/ip" 2>/dev/null)
+        if [ -n "$api_json" ]; then
+            pub_ip=$(echo "$api_json" | grep -o '"IP":"[^"]*"' | cut -d'"' -f4)
+        fi
+        # Validate IP format
+        if [ -n "$pub_ip" ] && ! echo "$pub_ip" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+            pub_ip=""
+        fi
+        # Get geo via HTTPS (direct mode — no Tor)
+        if [ -n "$pub_ip" ]; then
+            local geo_json
+            geo_json=$(curl -4 -s --max-time 4 "http://ip-api.com/json/${pub_ip}?fields=countryCode,city" 2>/dev/null)
+            local geo_country geo_city
+            geo_country=$(echo "$geo_json" | grep -o '"countryCode":"[^"]*"' | cut -d'"' -f4)
+            geo_city=$(echo "$geo_json" | grep -o '"city":"[^"]*"' | cut -d'"' -f4)
+            [ -n "$geo_country" ] && pub_geo="${geo_city:+${geo_city}, }${geo_country}"
+        fi
+    fi
+
+    # Sanitize exit country — should be 2-3 letter country code
+    [ -n "$exit_country" ] && [ ${#exit_country} -gt 3 ] && exit_country=""
+
+    # Track when exit IP last changed (for circuit age display)
+    local exit_change_time=""
+    local prev_ip="" prev_change_time=""
+    if [ -f "$CACHE_FILE" ]; then
+        prev_ip=$(grep '^PUB_IP=' "$CACHE_FILE" 2>/dev/null | cut -d'"' -f2)
+        prev_change_time=$(grep '^EXIT_CHANGE_TIME=' "$CACHE_FILE" 2>/dev/null | cut -d'"' -f2)
+    fi
+    if [ -n "$pub_ip" ] && [ "$pub_ip" != "$prev_ip" ]; then
+        exit_change_time="$(date +%s)"
+    elif [ -n "$prev_change_time" ]; then
+        exit_change_time="$prev_change_time"
+    else
+        exit_change_time="$(date +%s)"
+    fi
+
+    # Tor bootstrap progress — only from current Tor session
+    local tor_bootstrap="" tor_phase=""
+    if $advanced && systemctl is-active tor >/dev/null 2>&1; then
+        # Get Tor start time, only read log lines after it
+        local tor_start
+        tor_start=$(systemctl show tor@default --property=ActiveEnterTimestamp 2>/dev/null | cut -d= -f2)
+        if [ -n "$tor_start" ]; then
+            local start_ts
+            start_ts=$(date -d "$tor_start" +%s 2>/dev/null || echo 0)
+            local boot_line=""
+            # Read bootstrap lines — -h suppresses filename prefix when checking both paths
+            while IFS= read -r line; do
+                local log_date
+                log_date=$(echo "$line" | grep -oP '^\w+ \d+ [\d:.]+')
+                if [ -n "$log_date" ]; then
+                    local log_ts
+                    log_ts=$(date -d "$log_date" +%s 2>/dev/null || echo 0)
+                    [ "$log_ts" -ge "$start_ts" ] && boot_line="$line"
+                fi
+            done < <(grep -h "Bootstrapped" /run/tor/notices.log /var/log/tor/notices.log 2>/dev/null)
+            if [ -n "$boot_line" ]; then
+                tor_bootstrap=$(echo "$boot_line" | grep -oP '\d+(?=%)')
+                tor_phase=$(echo "$boot_line" | grep -oP '\(\K[^)]+' | head -1)
+            fi
+        fi
+    fi
+
+    # Write atomically (write to tmp then move) — quote values for safe sourcing
+    local tmp="${CACHE_FILE}.tmp"
+    cat > "$tmp" <<EOF
+PUB_IP="${pub_ip}"
+PUB_GEO="${pub_geo}"
+ROUTED_TOR="${routed_tor}"
+EXIT_COUNTRY="${exit_country}"
+EXIT_CHANGE_TIME="${exit_change_time}"
+TOR_BOOTSTRAP="${tor_bootstrap}"
+TOR_PHASE="${tor_phase}"
+CACHE_TIME="$(date +%s)"
+EOF
+    chmod 600 "$tmp"
+    mv -f "$tmp" "$CACHE_FILE"
+    rm -f "$LOCK_FILE"
+}
+
+# Initial update immediately
+update_cache
+
+# Loop forever — poll faster when Tor is bootstrapping
+while true; do
+    if [ -f /var/run/opsec-advanced.enabled ] && systemctl is-active tor >/dev/null 2>&1 && ! ss -tln 2>/dev/null | grep -q ':9050 '; then
+        sleep 5  # Tor bootstrapping — fast poll
+    else
+        sleep "$INTERVAL"
+    fi
+    update_cache
+done

opsec/conky/conky-opsec-status.sh

@@ -0,0 +1,225 @@
+#!/bin/bash
+# Conky OPSEC Status — OPSEC Status Widget
+# Called by conky via execpi — outputs Conky color markup
+# Network data is read from cache (updated by conky-opsec-cache.sh in background)
+#
+# Color map (managed by theme system):
+#   0 = ALERT/BAD    1 = SECURE/GOOD   2 = INFO/NEUTRAL
+#   3 = VOID/BG      4 = STRUCTURAL    5 = TITLE/ACCENT
+#   6 = LABELS       7 = VALUES        8 = SECTION HDR
+#   9 = METADATA
+
+ADVANCED=false
+[ -f /var/run/opsec-advanced.enabled ] && ADVANCED=true
+
+# ─── READ CACHE (instant — no network calls) ──────────────────────────────
+# Safe parsing: extract values via grep/cut instead of sourcing as shell code
+CACHE_FILE="/tmp/.opsec-cache/netinfo"
+PUB_IP="" PUB_GEO="" ROUTED_TOR=false EXIT_COUNTRY="" EXIT_CHANGE_TIME="" TOR_BOOTSTRAP="" TOR_PHASE="" CACHE_TIME=0
+if [ -f "$CACHE_FILE" ]; then
+    _safe_read() { grep "^${1}=" "$CACHE_FILE" 2>/dev/null | head -1 | cut -d'"' -f2; }
+    PUB_IP=$(_safe_read PUB_IP)
+    PUB_GEO=$(_safe_read PUB_GEO)
+    ROUTED_TOR=$(_safe_read ROUTED_TOR)
+    EXIT_COUNTRY=$(_safe_read EXIT_COUNTRY)
+    EXIT_CHANGE_TIME=$(_safe_read EXIT_CHANGE_TIME)
+    TOR_BOOTSTRAP=$(_safe_read TOR_BOOTSTRAP)
+    TOR_PHASE=$(_safe_read TOR_PHASE)
+    CACHE_TIME=$(_safe_read CACHE_TIME)
+    # Sanitize: strip anything that isn't alphanumeric, dots, commas, spaces, or dashes
+    PUB_IP=$(echo "$PUB_IP" | tr -cd '0-9.')
+    EXIT_COUNTRY=$(echo "$EXIT_COUNTRY" | tr -cd 'A-Za-z')
+    EXIT_CHANGE_TIME=$(echo "$EXIT_CHANGE_TIME" | tr -cd '0-9')
+    TOR_BOOTSTRAP=$(echo "$TOR_BOOTSTRAP" | tr -cd '0-9')
+fi
+
+# Kick off cache daemon if not running
+if ! pgrep -f 'conky-opsec-cache\.sh' >/dev/null 2>&1; then
+    nohup ~/.config/conky/conky-opsec-cache.sh >/dev/null 2>&1 &
+fi
+
+# ─── HEADER ──────────────────────────────────────────────────────────────────
+echo "\${color4}\${hr 1}"
+if $ADVANCED; then
+    echo "\${color5}\${font JetBrains Mono:bold:size=11}\${alignc}OPSEC STATUS\${font}"
+    echo "\${color1}\${font JetBrains Mono:bold:size=8}\${alignc}▲ ADVANCED ▲\${font}"
+else
+    echo "\${color5}\${font JetBrains Mono:bold:size=11}\${alignc}OPSEC STATUS\${font}"
+    echo "\${color2}\${font JetBrains Mono:size=8}\${alignc}── STANDARD ──\${font}"
+fi
+echo "\${color4}\${hr 1}"
+
+# ─── SYSTEM ──────────────────────────────────────────────────────────────────
+echo "\${color8}\${font JetBrains Mono:bold:size=9} ▌SYSTEM\${font}"
+echo "\${color6} HOST      \${color7}\${nodename}\${alignr}\${color6}UP \${color7}\${uptime_short}"
+echo "\${color6} CPU       \${color7}\${cpu}%\${alignr}\${color6}RAM \${color7}\${memperc}% \${color9}(\${mem}/\${memmax})"
+
+# ─── NETWORK ─────────────────────────────────────────────────────────────────
+echo "\${color4}\${hr 1}"
+echo "\${color8}\${font JetBrains Mono:bold:size=9} ▌NETWORK\${font}"
+
+LOCAL_IP=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1)}' | head -1)
+[ -z "$LOCAL_IP" ] && LOCAL_IP="No route"
+echo "\${color6} LOCAL IP  \${color7}${LOCAL_IP}"
+
+# External IP from cache
+_display_ip="${PUB_IP}"
+[ -z "$_display_ip" ] && _display_ip="\${color0}UNAVAILABLE"
+if [ -n "$PUB_GEO" ]; then
+    echo "\${color6} EXT IP    \${color7}${_display_ip} \${color9}(${PUB_GEO})"
+else
+    echo "\${color6} EXT IP    \${color7}${_display_ip}"
+fi
+
+VPN_IF=$(ip -o link show 2>/dev/null | awk -F': ' '{print $2}' | grep -E '^(tun|wg)' | head -1)
+if [ -n "$VPN_IF" ]; then
+    VPN_IP=$(ip -4 addr show "$VPN_IF" 2>/dev/null | awk '/inet / {print $2}' | cut -d/ -f1)
+    echo "\${color6} VPN       \${color1}ACTIVE  \${color7}${VPN_IP} \${color9}(${VPN_IF})"
+fi
+
+# TOR/DNS/KSWCH status moved to TOR STATUS section below
+
+PRIMARY_IF=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}' | head -1)
+if [ -n "$PRIMARY_IF" ]; then
+    CUR_MAC=$(ip link show "$PRIMARY_IF" 2>/dev/null | awk '/ether/ {print $2}')
+    FIRST_OCTET=$(echo "$CUR_MAC" | cut -d: -f1)
+    FIRST_DEC=$((16#${FIRST_OCTET}))
+    if (( FIRST_DEC & 2 )); then
+        echo "\${color6} MAC       \${color1}RANDOM  \${color9}(${CUR_MAC})"
+    else
+        echo "\${color6} MAC       \${color0}HWADDR  \${color9}(${CUR_MAC})"
+    fi
+else
+    echo "\${color6} MAC       \${color9}NO IFACE"
+fi
+
+# ─── ADVANCED MODE EXTRAS ────────────────────────────────────────────────────
+if $ADVANCED; then
+    echo "\${color4}\${hr 1}"
+    echo "\${color8}\${font JetBrains Mono:bold:size=9} ▌HARDENING\${font}"
+
+    IPV6_ALL=$(sysctl -n net.ipv6.conf.all.disable_ipv6 2>/dev/null || echo "0")
+    [ "$IPV6_ALL" = "1" ] && echo "\${color6} IPv6      \${color1}BLOCKED" || echo "\${color6} IPv6      \${color0}LEAKING"
+
+    if lsattr /etc/resolv.conf 2>/dev/null | grep -q 'i'; then
+        echo "\${color6} DNSLK     \${color1}LOCKED  \${color9}(immutable)"
+    else
+        echo "\${color6} DNSLK     \${color0}UNLOCKED"
+    fi
+
+    ISO=$(grep "IsolateDestAddr" /etc/tor/torrc 2>/dev/null | head -1)
+    [ -n "$ISO" ] && echo "\${color6} ISOL      \${color1}ACTIVE  \${color9}(stream isolation)"
+
+    PAD=$(grep "ConnectionPadding" /etc/tor/torrc 2>/dev/null | awk '{print $2}')
+    [ "$PAD" = "1" ] && echo "\${color6} TPAD      \${color1}ACTIVE  \${color9}(traffic padding)"
+
+    BLACKLIST=$(grep "ExcludeExitNodes" /etc/tor/torrc 2>/dev/null | sed 's/ExcludeExitNodes //' | tr -d '{}' | tr ',' ' ')
+    [ -n "$BLACKLIST" ] && echo "\${color6} BLOCK     \${color0}$(echo "$BLACKLIST" | tr ' ' ',' | sed 's/,$//')"
+
+    CORE_PAT=$(sysctl -n kernel.core_pattern 2>/dev/null)
+    [[ "$CORE_PAT" == *"/bin/false"* ]] && echo "\${color6} CORE      \${color1}BLOCKED" || echo "\${color6} CORE      \${color0}ENABLED"
+
+    SWAP_ACTIVE=$(swapon --show=SIZE --noheadings 2>/dev/null | head -1)
+    [ -z "$SWAP_ACTIVE" ] && echo "\${color6} SWAP      \${color1}OFF" || echo "\${color6} SWAP      \${color0}ACTIVE \${color9}(${SWAP_ACTIVE})"
+
+    BOOT_COUNT=0
+    for svc in opsec-boot-advanced opsec-mac-randomize opsec-hostname-randomize opsec-killswitch; do
+        systemctl is-enabled "$svc" 2>/dev/null | grep -q enabled && BOOT_COUNT=$((BOOT_COUNT + 1))
+    done
+    if [ "$BOOT_COUNT" -eq 4 ]; then
+        echo "\${color6} BOOT      \${color1}PERSIST \${color9}(${BOOT_COUNT}/4)"
+    elif [ "$BOOT_COUNT" -gt 0 ]; then
+        echo "\${color6} BOOT      \${color2}PARTIAL \${color9}(${BOOT_COUNT}/4)"
+    else
+        echo "\${color6} BOOT      \${color0}NONE    \${color9}(${BOOT_COUNT}/4)"
+    fi
+
+    [ -f /etc/opsec/opsec.conf ] && {
+        PROFILE=$(grep "^PROFILE_NAME=" /etc/opsec/opsec.conf 2>/dev/null | cut -d'"' -f2)
+        [ -n "$PROFILE" ] && echo "\${color6} PROF      \${color2}${PROFILE}"
+    }
+fi
+
+# ─── TOR STATUS (replaces Route Chain) ──────────────────────────────────────
+if $ADVANCED; then
+    echo "\${color4}\${hr 1}"
+    echo "\${color8}\${font JetBrains Mono:bold:size=9} ▌TOR STATUS\${font}"
+
+    # Determine protection state
+    _tor_svc=false; _tor_socks=false; _ks_armed=false; _tor_routed=false
+    systemctl is-active tor >/dev/null 2>&1 && _tor_svc=true
+    ss -tln 2>/dev/null | grep -q ':9050 ' && _tor_socks=true
+    # iptables -L requires root; use state file instead (kill switch is always armed when advanced is on)
+    $ADVANCED && _ks_armed=true
+    [ "$ROUTED_TOR" = "true" ] && _tor_routed=true
+
+    if $_tor_svc && $_tor_socks && $_ks_armed && $_tor_routed; then
+        echo "\${color6} STATE     \${color1}PROTECTED"
+    elif $_tor_svc && ! $_tor_socks; then
+        # Bootstrapping
+        echo "\${color6} STATE     \${color2}BOOTSTRAP \${color9}(${TOR_BOOTSTRAP:-0}% ${TOR_PHASE:-connecting})"
+    elif ! $_tor_svc; then
+        echo "\${color6} STATE     \${color0}EXPOSED   \${color9}(tor down)"
+    elif ! $_ks_armed; then
+        echo "\${color6} STATE     \${color0}EXPOSED   \${color9}(kill switch off)"
+    else
+        echo "\${color6} STATE     \${color0}EXPOSED   \${color9}(not routed)"
+    fi
+
+    # Exit country code only — no IP
+    if [ -n "$EXIT_COUNTRY" ] && [ ${#EXIT_COUNTRY} -le 3 ]; then
+        echo "\${color6} EXIT      \${color2}${EXIT_COUNTRY}"
+    elif $_tor_socks; then
+        echo "\${color6} EXIT      \${color9}resolving..."
+    else
+        echo "\${color6} EXIT      \${color9}—"
+    fi
+
+    # Circuit age — time since exit IP last changed
+    if [ -n "$EXIT_CHANGE_TIME" ] && [ "$EXIT_CHANGE_TIME" -gt 0 ] 2>/dev/null; then
+        _now=$(date +%s)
+        _age=$(( _now - EXIT_CHANGE_TIME ))
+        if [ "$_age" -lt 60 ]; then
+            echo "\${color6} CIRCUIT   \${color2}${_age}s ago"
+        elif [ "$_age" -lt 3600 ]; then
+            echo "\${color6} CIRCUIT   \${color2}$(( _age / 60 ))m ago"
+        else
+            echo "\${color6} CIRCUIT   \${color2}$(( _age / 3600 ))h $(( (_age % 3600) / 60 ))m ago"
+        fi
+    else
+        echo "\${color6} CIRCUIT   \${color9}—"
+    fi
+
+    # DNS leak check — local checks only
+    _dns_server=$(awk '/^nameserver/ {print $2; exit}' /etc/resolv.conf 2>/dev/null)
+    _dns_immutable=false
+    lsattr /etc/resolv.conf 2>/dev/null | grep -q 'i' && _dns_immutable=true
+    _nm_locked=false
+    [ -f /etc/NetworkManager/conf.d/opsec-dns-lock.conf ] && _nm_locked=true
+
+    if [ "$_dns_server" = "127.0.0.1" ] && $_dns_immutable && $_nm_locked; then
+        echo "\${color6} DNS       \${color1}SECURE  \${color9}(tor + locked)"
+    elif [ "$_dns_server" = "127.0.0.1" ] && $_dns_immutable; then
+        echo "\${color6} DNS       \${color2}SECURE  \${color9}(tor, NM unlocked)"
+    elif [ "$_dns_server" = "127.0.0.1" ]; then
+        echo "\${color6} DNS       \${color2}PARTIAL \${color9}(tor, not locked)"
+    elif echo "$_dns_server" | grep -qE '^(9\.9\.9\.9|149\.112\.112\.112|1\.1\.1\.1|1\.0\.0\.1)$'; then
+        echo "\${color6} DNS       \${color2}PRIVACY \${color9}(${_dns_server})"
+    else
+        echo "\${color6} DNS       \${color0}LEAKED  \${color9}(${_dns_server})"
+    fi
+fi
+
+# ─── MODE / LEVEL ───────────────────────────────────────────────────────────
+echo "\${color4}\${hr 1}"
+LEVEL=""
+[ -f /etc/opsec/opsec.conf ] && LEVEL=$(grep "^DEPLOYMENT_LEVEL=" /etc/opsec/opsec.conf 2>/dev/null | cut -d'"' -f2)
+if $ADVANCED; then
+    echo "\${color6} MODE      \${color1}ADVANCED"
+else
+    echo "\${color6} MODE      \${color0}STANDARD"
+fi
+[ -n "$LEVEL" ] && echo "\${color6} LEVEL     \${color7}${LEVEL}"
+
+echo "\${color4}\${hr 1}"
+echo "\${color9}\${font JetBrains Mono:size=7}\${alignc}// updated \${time %H:%M:%S} //\${font}"

opsec/conky/conky-opsec-widget.conf

@@ -0,0 +1,71 @@
+-- OPSEC Status Widget
+-- Colors managed by theme system via opsec-config.sh (--theme apply NAME)
+-- Uses execpi to parse Conky color markup from helper script
+
+conky.config = {
+    -- Window settings
+    -- Default: upper-right on primary display
+    alignment = 'top_right',
+    gap_x = 15,
+    gap_y = 60,
+    minimum_width = 400,
+    minimum_height = 200,
+    maximum_width = 420,
+
+    -- Multi-monitor: pin to primary display (head 0)
+    -- Set xinerama_head to a different number to move to another monitor
+    xinerama_head = 0,
+
+    -- Window type
+    own_window = true,
+    own_window_type = 'desktop',
+    own_window_transparent = false,
+    own_window_argb_visual = true,
+    own_window_argb_value = 210,
+    own_window_colour = '0d1117',
+    own_window_hints = 'undecorated,below,sticky,skip_taskbar,skip_pager',
+
+    -- Drawing
+    double_buffer = true,
+    draw_shades = true,
+    default_shade_color = '000000',
+    draw_outline = false,
+    draw_borders = true,
+    border_inner_margin = 12,
+    border_outer_margin = 4,
+    border_width = 1,
+    border_colour = '1b3a5c',
+    stippled_borders = 0,
+
+    -- Font
+    use_xft = true,
+    font = 'JetBrains Mono:size=10',
+    override_utf8_locale = true,
+
+    -- Colors — OPSEC Status Widget
+    default_color = 'b0b0b0',
+    color0 = 'df2020',  -- ares red (NOT SECURE)
+    color1 = '33ff33',  -- terminal green (SECURE)
+    color2 = '3a8fd6',  -- steel blue (info/neutral)
+    color3 = '0d1117',  -- void (dividers)
+    color4 = '1f6feb',  -- blue (structural lines)
+    color5 = '58a6ff',  -- bright blue (title/accent)
+    color6 = '79c0ff',  -- light blue (labels)
+    color7 = 'c9d1d9',  -- silver (values)
+    color8 = '1f6feb',  -- blue (section headers)
+    color9 = '484f58',  -- dark grey (metadata)
+
+    -- Update interval
+    update_interval = 3,
+    total_run_times = 0,
+
+    -- Misc
+    cpu_avg_samples = 2,
+    no_buffers = true,
+    text_buffer_size = 8192,
+    short_units = true,
+};
+
+conky.text = [[
+${execpi 5 ~/.config/conky/conky-opsec-status.sh}
+]];

opsec/conky/opsec-widget-launch.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+# OPSEC Widget Launcher — positions and launches the Conky widget
+# Usage: opsec-widget-launch.sh [position]
+#
+# Positions:
+#   tl = top-left       tc = top-center       tr = top-right
+#   bl = bottom-left    bc = bottom-center     br = bottom-right
+#
+# Default: tr (top-right)
+# Uses the theme system — regenerates config from /etc/opsec/themes/
+
+CONKY_DIR="$HOME/.config/conky"
+CONF="$CONKY_DIR/conky-opsec-widget.conf"
+POS="${1:-tr}"
+
+# Map shorthand to conky alignment + gaps
+case "$POS" in
+    tl) ALIGN="top_left";     GAP_X=15;  GAP_Y=15 ;;
+    tc) ALIGN="top_middle";   GAP_X=0;   GAP_Y=15 ;;
+    tr) ALIGN="top_right";    GAP_X=15;  GAP_Y=60 ;;
+    bl) ALIGN="bottom_left";  GAP_X=15;  GAP_Y=60 ;;
+    bc) ALIGN="bottom_middle"; GAP_X=0;  GAP_Y=60 ;;
+    br) ALIGN="bottom_right"; GAP_X=15;  GAP_Y=60 ;;
+    *)
+        echo "Usage: $(basename "$0") [tl|tc|tr|bl|bc|br]"
+        echo ""
+        echo "  tl = top-left       tc = top-center       tr = top-right"
+        echo "  bl = bottom-left    bc = bottom-center     br = bottom-right"
+        exit 1
+        ;;
+esac
+
+# Kill existing widget and stale cache daemon
+killall conky 2>/dev/null
+pkill -f 'conky-opsec-cache\.sh' 2>/dev/null
+rm -f /tmp/.opsec-cache/netinfo 2>/dev/null
+sleep 0.3
+
+# Load theme from opsec config
+OPSEC_CONF="/etc/opsec/opsec.conf"
+THEME="default"
+[ -f "$OPSEC_CONF" ] && THEME=$(grep "^WIDGET_THEME=" "$OPSEC_CONF" 2>/dev/null | cut -d'"' -f2)
+[ -z "$THEME" ] && THEME="default"
+
+THEME_FILE="/etc/opsec/themes/${THEME}.theme"
+if [ -f "$THEME_FILE" ]; then
+    . "$THEME_FILE"
+else
+    echo "Theme '${THEME}' not found, using defaults"
+    THEME_LABEL="Default"
+    CONKY_BG="0d1117"
+    CONKY_COLOR0="df2020"; CONKY_COLOR1="33ff33"; CONKY_COLOR2="3a8fd6"
+    CONKY_COLOR3="0d1117"; CONKY_COLOR4="1f6feb"; CONKY_COLOR5="58a6ff"
+    CONKY_COLOR6="79c0ff"; CONKY_COLOR7="c9d1d9"; CONKY_COLOR8="1f6feb"
+    CONKY_COLOR9="484f58"
+fi
+
+# Generate config with theme colors and chosen position
+mkdir -p "$CONKY_DIR"
+cat > "$CONF" << EOF
+-- OPSEC Status Widget — OPSEC Status Widget
+-- Theme: ${THEME} (${THEME_LABEL:-Custom})
+-- Position: ${ALIGN}
+
+conky.config = {
+    alignment = '${ALIGN}',
+    gap_x = ${GAP_X},
+    gap_y = ${GAP_Y},
+    minimum_width = 400,
+    minimum_height = 200,
+    maximum_width = 420,
+
+    own_window = true,
+    own_window_type = 'normal',
+    own_window_transparent = false,
+    own_window_argb_visual = true,
+    own_window_argb_value = 210,
+    own_window_colour = '${CONKY_BG:-0d1117}',
+    own_window_hints = 'undecorated,below,sticky,skip_taskbar,skip_pager',
+
+    xinerama_head = 0,
+
+    double_buffer = true,
+    draw_shades = true,
+    default_shade_color = '000000',
+    draw_outline = false,
+    draw_borders = true,
+    border_inner_margin = 12,
+    border_outer_margin = 4,
+    border_width = 1,
+    border_colour = '${CONKY_COLOR4:-1f6feb}',
+    stippled_borders = 0,
+
+    use_xft = true,
+    font = 'JetBrains Mono:size=10',
+    override_utf8_locale = true,
+
+    default_color = 'b0b0b0',
+    color0 = '${CONKY_COLOR0:-df2020}',
+    color1 = '${CONKY_COLOR1:-33ff33}',
+    color2 = '${CONKY_COLOR2:-3a8fd6}',
+    color3 = '${CONKY_COLOR3:-0d1117}',
+    color4 = '${CONKY_COLOR4:-1f6feb}',
+    color5 = '${CONKY_COLOR5:-58a6ff}',
+    color6 = '${CONKY_COLOR6:-79c0ff}',
+    color7 = '${CONKY_COLOR7:-c9d1d9}',
+    color8 = '${CONKY_COLOR8:-1f6feb}',
+    color9 = '${CONKY_COLOR9:-484f58}',
+
+    update_interval = 3,
+    total_run_times = 0,
+
+    cpu_avg_samples = 2,
+    no_buffers = true,
+    text_buffer_size = 8192,
+    short_units = true,
+};
+
+conky.text = [[
+\${execpi 5 ~/.config/conky/conky-opsec-status.sh}
+]];
+EOF
+
+# Launch
+conky -c "$CONF" &
+disown
+echo "OPSEC widget launched: $ALIGN (theme: $THEME)"

opsec/docs/OPSEC-CHECKLIST.md

@@ -0,0 +1,39 @@
+# OPSEC Checklist
+
+## Pre-Session Setup
+- [ ] Fresh VM snapshot taken
+- [ ] MAC address randomized: `randomize-mac`
+- [ ] System timezone set appropriately
+- [ ] DNS configured for privacy
+- [ ] Verify no personal accounts logged in
+- [ ] Disable WiFi/Bluetooth if not needed
+- [ ] Configure VPN/proxy settings
+- [ ] Test kill switches
+
+## During Session
+- [ ] Use workspace isolation (separate VM/container)
+- [ ] All traffic through VPN/Tor
+- [ ] Monitor connections: `opsec-monitor`
+- [ ] Use encrypted communications
+- [ ] No personal browsing/email
+- [ ] Regular history clearing
+- [ ] Avoid saving sensitive data locally
+- [ ] Use in-memory tools when possible
+
+## Post-Session
+- [ ] Export necessary data
+- [ ] Clear all logs: `clear-logs`
+- [ ] Clear shell history: `clear-history`
+- [ ] Wipe free space
+- [ ] Secure delete files: `shred-file <files>`
+- [ ] Revert to clean VM snapshot
+
+## Emergency Procedures
+- [ ] Kill network connections
+- [ ] Emergency wipe if necessary
+
+## Communication OPSEC
+- [ ] Use encrypted channels
+- [ ] Avoid real names/identifiers
+- [ ] Use dedicated accounts
+- [ ] Regular key rotation

opsec/install.sh

@@ -0,0 +1,289 @@
+#!/bin/bash
+# opsec-toolkit installer — standalone, no Ansible required
+# Usage: sudo ./install.sh [--uninstall]
+#
+# Installs the OPSEC privacy/security toolkit on Debian/Kali/Ubuntu systems.
+# Requires: tor, macchanger, iptables, curl, jq (auto-installed if missing)
+
+set -euo pipefail
+
+# ─── COLORS ──────────────────────────────────────────────────────────────────
+RED=$'\e[38;5;196m'
+GRN=$'\e[38;5;49m'
+YEL=$'\e[38;5;214m'
+CYN=$'\e[38;5;45m'
+RST=$'\e[0m'
+
+ok()   { echo "${GRN}[+]${RST} $*"; }
+warn() { echo "${YEL}[*]${RST} $*"; }
+err()  { echo "${RED}[-]${RST} $*"; }
+info() { echo "${CYN}[~]${RST} $*"; }
+
+# ─── PREFLIGHT ───────────────────────────────────────────────────────────────
+if [ "$EUID" -ne 0 ]; then
+    err "Please run as root: sudo ./install.sh"
+    exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REAL_USER="${SUDO_USER:-$USER}"
+REAL_HOME=$(eval echo "~${REAL_USER}")
+
+# ─── UNINSTALL ───────────────────────────────────────────────────────────────
+if [ "${1:-}" = "--uninstall" ]; then
+    echo ""
+    warn "Uninstalling OPSEC toolkit..."
+    echo ""
+
+    # Stop services
+    for svc in opsec-boot-advanced opsec-killswitch opsec-hostname-randomize opsec-mac-randomize; do
+        systemctl stop "$svc" 2>/dev/null || true
+        systemctl disable "$svc" 2>/dev/null || true
+    done
+
+    # Remove scripts
+    rm -f /usr/local/bin/opsec-*.sh
+
+    # Remove library
+    rm -rf /usr/local/lib/opsec
+
+    # Remove configs (preserve opsec.conf as backup)
+    if [ -d /etc/opsec ]; then
+        cp /etc/opsec/opsec.conf "/tmp/opsec.conf.backup.$(date +%s)" 2>/dev/null || true
+        rm -rf /etc/opsec
+    fi
+
+    # Remove systemd services
+    rm -f /etc/systemd/system/opsec-*.service
+    systemctl daemon-reload
+
+    # Remove cron jobs
+    rm -f /etc/cron.d/opsec-*
+
+    # Remove polkit, desktop, udev
+    rm -f /usr/share/polkit-1/actions/com.opsec.mode.policy
+    rm -f /usr/share/applications/opsec-toggle.desktop
+    rm -f /etc/udev/rules.d/99-opsec-usb.rules
+
+    ok "OPSEC toolkit uninstalled"
+    info "Config backup saved to /tmp/opsec.conf.backup.*"
+    exit 0
+fi
+
+# ─── BANNER ──────────────────────────────────────────────────────────────────
+echo ""
+echo "${CYN}╔══════════════════════════════════════════╗${RST}"
+echo "${CYN}║${RST}     ${RED}OPSEC TOOLKIT${RST} — Installer v1.0      ${CYN}║${RST}"
+echo "${CYN}║${RST}     Privacy & Security Hardening        ${CYN}║${RST}"
+echo "${CYN}╚══════════════════════════════════════════╝${RST}"
+echo ""
+
+# ─── DEPENDENCY CHECK ────────────────────────────────────────────────────────
+info "Checking dependencies..."
+
+DEPS=(tor macchanger iptables ip6tables curl jq iproute2 net-tools procps)
+MISSING=()
+
+for dep in "${DEPS[@]}"; do
+    case "$dep" in
+        tor)        command -v tor >/dev/null 2>&1 || MISSING+=("tor") ;;
+        macchanger) command -v macchanger >/dev/null 2>&1 || MISSING+=("macchanger") ;;
+        iptables)   command -v iptables >/dev/null 2>&1 || MISSING+=("iptables") ;;
+        ip6tables)  command -v ip6tables >/dev/null 2>&1 || MISSING+=("iptables") ;;
+        curl)       command -v curl >/dev/null 2>&1 || MISSING+=("curl") ;;
+        jq)         command -v jq >/dev/null 2>&1 || MISSING+=("jq") ;;
+        iproute2)   command -v ip >/dev/null 2>&1 || MISSING+=("iproute2") ;;
+        net-tools)  command -v netstat >/dev/null 2>&1 || MISSING+=("net-tools") ;;
+        procps)     command -v ps >/dev/null 2>&1 || MISSING+=("procps") ;;
+    esac
+done
+
+# Deduplicate
+MISSING=($(printf '%s\n' "${MISSING[@]}" | sort -u))
+
+if [ ${#MISSING[@]} -gt 0 ]; then
+    warn "Installing missing packages: ${MISSING[*]}"
+    apt-get update -qq
+    apt-get install -y -qq "${MISSING[@]}"
+    ok "Dependencies installed"
+else
+    ok "All dependencies present"
+fi
+
+# Optional: conky for desktop widget
+if ! command -v conky >/dev/null 2>&1; then
+    warn "Conky not installed — desktop widget will not be available"
+    warn "Install later with: apt install conky-all"
+fi
+
+# ─── INSTALL LIBRARY ─────────────────────────────────────────────────────────
+info "Installing OPSEC library..."
+mkdir -p /usr/local/lib/opsec
+cp "$SCRIPT_DIR/lib/opsec-lib.sh" /usr/local/lib/opsec/
+chmod 644 /usr/local/lib/opsec/opsec-lib.sh
+ok "Library installed → /usr/local/lib/opsec/"
+
+# ─── INSTALL SCRIPTS ─────────────────────────────────────────────────────────
+info "Installing OPSEC scripts..."
+for script in "$SCRIPT_DIR"/scripts/opsec-*.sh; do
+    [ -f "$script" ] || continue
+    cp "$script" /usr/local/bin/
+    chmod 755 "/usr/local/bin/$(basename "$script")"
+done
+ok "Scripts installed → /usr/local/bin/"
+
+# ─── INSTALL CONFIGS ─────────────────────────────────────────────────────────
+info "Installing configuration..."
+
+# Main config directory
+mkdir -p /etc/opsec/{themes,levels,vpn-templates,.harden-backup}
+
+# Main config (don't overwrite existing)
+if [ -f /etc/opsec/opsec.conf ]; then
+    warn "Existing opsec.conf found — preserving (new config saved as opsec.conf.new)"
+    cp "$SCRIPT_DIR/configs/opsec.conf" /etc/opsec/opsec.conf.new
+else
+    cp "$SCRIPT_DIR/configs/opsec.conf" /etc/opsec/opsec.conf
+fi
+
+# Country codes
+cp "$SCRIPT_DIR/configs/opsec-country-codes.conf" /etc/opsec/country-codes.conf
+
+# Themes
+cp "$SCRIPT_DIR/configs/themes/"*.theme /etc/opsec/themes/
+
+# Levels
+for f in "$SCRIPT_DIR/configs/levels/"*.conf; do
+    [ -f "$f" ] || continue
+    # Map filenames: bare-metal-standard.conf → bare-metal.conf etc.
+    cp "$f" /etc/opsec/levels/
+done
+
+# VPN templates
+cp "$SCRIPT_DIR/configs/vpn-templates/"*.template /etc/opsec/vpn-templates/
+
+# Torrc templates
+mkdir -p /etc/opsec/torrc
+cp "$SCRIPT_DIR/configs/torrc/torrc-default" /etc/opsec/torrc/
+cp "$SCRIPT_DIR/configs/torrc/torrc-opsec" /etc/opsec/torrc/
+
+# DNS configs
+[ -f "$SCRIPT_DIR/configs/resolv.conf.opsec" ] && cp "$SCRIPT_DIR/configs/resolv.conf.opsec" /etc/opsec/
+[ -f "$SCRIPT_DIR/configs/resolv.conf.head" ] && cp "$SCRIPT_DIR/configs/resolv.conf.head" /etc/opsec/
+
+ok "Configuration installed → /etc/opsec/"
+
+# ─── INSTALL SYSTEMD SERVICES ────────────────────────────────────────────────
+info "Installing systemd services..."
+for svc in "$SCRIPT_DIR/configs/systemd/"*.service; do
+    [ -f "$svc" ] || continue
+    cp "$svc" /etc/systemd/system/
+done
+systemctl daemon-reload
+
+# Enable MAC randomize and hostname randomize at boot
+systemctl enable opsec-mac-randomize.service 2>/dev/null || true
+systemctl enable opsec-hostname-randomize.service 2>/dev/null || true
+ok "Systemd services installed and enabled"
+
+# ─── INSTALL CRON JOBS ──────────────────────────────────────────────────────
+info "Installing cron jobs..."
+cp "$SCRIPT_DIR/configs/cron/opsec-banner-cache" /etc/cron.d/
+cp "$SCRIPT_DIR/configs/cron/opsec-log-rotate" /etc/cron.d/
+chmod 644 /etc/cron.d/opsec-*
+ok "Cron jobs installed → /etc/cron.d/"
+
+# ─── INSTALL POLKIT POLICY ──────────────────────────────────────────────────
+info "Installing polkit policy..."
+mkdir -p /usr/share/polkit-1/actions
+cp "$SCRIPT_DIR/configs/polkit/com.opsec.mode.policy" /usr/share/polkit-1/actions/
+ok "Polkit policy installed"
+
+# ─── INSTALL DESKTOP ENTRY ──────────────────────────────────────────────────
+info "Installing desktop entry..."
+cp "$SCRIPT_DIR/configs/desktop/opsec-toggle.desktop" /usr/share/applications/
+ok "Desktop entry installed"
+
+# ─── INSTALL UDEV RULES ─────────────────────────────────────────────────────
+info "Installing udev rules..."
+cp "$SCRIPT_DIR/configs/udev/99-opsec-usb.rules" /etc/udev/rules.d/
+udevadm control --reload-rules 2>/dev/null || true
+ok "Udev rules installed"
+
+# ─── INSTALL CONKY WIDGET (user-space) ──────────────────────────────────────
+info "Installing Conky widget files..."
+CONKY_DIR="${REAL_HOME}/.config/conky"
+mkdir -p "$CONKY_DIR"
+for f in "$SCRIPT_DIR"/conky/*; do
+    [ -f "$f" ] || continue
+    cp "$f" "$CONKY_DIR/"
+    chown "${REAL_USER}:${REAL_USER}" "$CONKY_DIR/$(basename "$f")"
+done
+chmod +x "$CONKY_DIR"/*.sh 2>/dev/null || true
+ok "Conky widget installed → ${CONKY_DIR}/"
+
+# ─── INSTALL SHELL ALIASES ──────────────────────────────────────────────────
+info "Installing shell aliases..."
+ALIAS_FILE="${REAL_HOME}/.opsec-aliases"
+cp "$SCRIPT_DIR/configs/opsec-aliases" "$ALIAS_FILE"
+chown "${REAL_USER}:${REAL_USER}" "$ALIAS_FILE"
+
+# Add source line to .bashrc and .zshrc if not already present
+for rc in "${REAL_HOME}/.bashrc" "${REAL_HOME}/.zshrc"; do
+    if [ -f "$rc" ]; then
+        if ! grep -q '.opsec-aliases' "$rc" 2>/dev/null; then
+            echo "" >> "$rc"
+            echo "# OPSEC toolkit aliases" >> "$rc"
+            echo "[ -f ~/.opsec-aliases ] && . ~/.opsec-aliases" >> "$rc"
+            chown "${REAL_USER}:${REAL_USER}" "$rc"
+        fi
+    fi
+done
+ok "Aliases installed → ${ALIAS_FILE}"
+
+# ─── TOR CONFIGURATION ──────────────────────────────────────────────────────
+info "Configuring Tor..."
+
+# Ensure tor log directory exists
+mkdir -p /var/log/tor /run/tor
+chown debian-tor:debian-tor /var/log/tor /run/tor 2>/dev/null || true
+
+# Stop tor if running (we'll configure, user starts via opsec-on)
+systemctl stop tor 2>/dev/null || true
+
+ok "Tor configured (start with: opsec-on)"
+
+# ─── TMPFS FOR LOGS ─────────────────────────────────────────────────────────
+info "Setting up tmpfs for OPSEC logs..."
+if ! grep -q 'opsec-logs' /etc/fstab 2>/dev/null; then
+    echo "" >> /etc/fstab
+    echo "# OPSEC: volatile log storage (RAM-only, cleared on reboot)" >> /etc/fstab
+    echo "tmpfs /var/log/opsec tmpfs nosuid,nodev,noexec,mode=0700,size=50M 0 0  # opsec-logs" >> /etc/fstab
+fi
+mkdir -p /var/log/opsec
+mount /var/log/opsec 2>/dev/null || mount -t tmpfs -o nosuid,nodev,noexec,mode=0700,size=50M tmpfs /var/log/opsec 2>/dev/null || true
+ok "OPSEC logs on tmpfs (RAM-only)"
+
+# ─── CACHE DIRECTORY ─────────────────────────────────────────────────────────
+mkdir -p /tmp/.opsec-cache
+chown "${REAL_USER}:${REAL_USER}" /tmp/.opsec-cache 2>/dev/null || true
+
+# ─── POST-INSTALL ────────────────────────────────────────────────────────────
+echo ""
+echo "${CYN}══════════════════════════════════════════${RST}"
+ok "OPSEC toolkit installed successfully!"
+echo "${CYN}══════════════════════════════════════════${RST}"
+echo ""
+info "Quick start:"
+echo "  ${GRN}opsec-on${RST}            — Activate ghost mode (Tor + kill switch + hardening)"
+echo "  ${GRN}opsec-off${RST}           — Deactivate ghost mode"
+echo "  ${GRN}opsec-config${RST}        — Interactive configuration TUI"
+echo "  ${GRN}opsec-show${RST}          — Show current status"
+echo "  ${GRN}killswitch-on${RST}       — Activate kill switch only"
+echo "  ${GRN}opsec-preflight${RST}     — Pre-session readiness check"
+echo ""
+info "Reload your shell to activate aliases:"
+echo "  ${GRN}source ~/.bashrc${RST}  or  ${GRN}source ~/.zshrc${RST}"
+echo ""
+info "Uninstall with: ${YEL}sudo ./install.sh --uninstall${RST}"
+echo ""

opsec/lib/opsec-lib.sh

@@ -0,0 +1,717 @@
+#!/bin/bash
+# /usr/local/lib/opsec/opsec-lib.sh — Shared OPSEC function library
+# Sourced by all OPSEC scripts for config management and common operations
+
+OPSEC_CONF="/etc/opsec/opsec.conf"
+OPSEC_COUNTRY_CODES="/etc/opsec/country-codes.conf"
+OPSEC_PROFILES_DIR="/etc/opsec/profiles"
+OPSEC_STATE_FILE="/var/run/opsec-advanced.enabled"
+OPSEC_BOOT_MARKER="/etc/opsec/boot-advanced.enabled"
+
+# ─── COLOR OUTPUT ──────────────────────────────────────────────────────────────
+opsec_green()  { echo -e "\033[38;5;49m[+]\033[0m \033[38;5;49m$*\033[0m"; }
+opsec_red()    { echo -e "\033[38;5;196m[-]\033[0m \033[38;5;196m$*\033[0m"; }
+opsec_yellow() { echo -e "\033[38;5;214m[*]\033[0m \033[38;5;214m$*\033[0m"; }
+opsec_info()   { echo -e "\033[38;5;39m[~]\033[0m \033[38;5;75m$*\033[0m"; }
+opsec_cyan()   { echo -e "\033[38;5;51m[>]\033[0m \033[38;5;51m$*\033[0m"; }
+opsec_mag()    { echo -e "\033[38;5;201m[*]\033[0m \033[38;5;201m$*\033[0m"; }
+opsec_dim()    { echo -e "\033[38;5;244m    $*\033[0m"; }
+opsec_hdr()    { echo -e "\033[38;5;51m━━━ \033[38;5;201m$*\033[38;5;51m ━━━\033[0m"; }
+
+# ─── CONFIG MANAGEMENT ─────────────────────────────────────────────────────────
+
+opsec_load_config() {
+    if [ -f "$OPSEC_CONF" ]; then
+        # shellcheck disable=SC1090
+        . "$OPSEC_CONF"
+        return 0
+    fi
+    return 1
+}
+
+opsec_save_config() {
+    # Re-serialize all known keys back to config file
+    # Preserves comments and structure
+    local tmp
+    tmp=$(mktemp)
+    cat > "$tmp" << 'HEADER'
+# /etc/opsec/opsec.conf — Central OPSEC Configuration
+# Shell-sourceable KEY="value" format. All scripts source this file.
+# Edit via: sudo opsec-config.sh (interactive TUI)
+
+HEADER
+
+    cat >> "$tmp" << EOF
+# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
+PROFILE_NAME="${PROFILE_NAME:-default}"
+
+# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
+TOR_CIRCUIT_ROTATION="${TOR_CIRCUIT_ROTATION:-30}"
+TOR_BLACKLIST="${TOR_BLACKLIST:-}"
+TOR_STRICT_NODES="${TOR_STRICT_NODES:-1}"
+TOR_ISOLATION="${TOR_ISOLATION:-1}"
+TOR_PADDING="${TOR_PADDING:-1}"
+TOR_SOCKS_PORT="${TOR_SOCKS_PORT:-9050}"
+TOR_DNS_PORT="${TOR_DNS_PORT:-5353}"
+TOR_TRANS_PORT="${TOR_TRANS_PORT:-9040}"
+TOR_NUM_GUARDS="${TOR_NUM_GUARDS:-3}"
+TOR_SAFE_LOGGING="${TOR_SAFE_LOGGING:-1}"
+
+# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
+DNS_MODE="${DNS_MODE:-tor}"
+DNS_CUSTOM_SERVERS="${DNS_CUSTOM_SERVERS:-}"
+
+# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
+KILLSWITCH_ALLOW_DHCP="${KILLSWITCH_ALLOW_DHCP:-1}"
+KILLSWITCH_ALLOW_OPENVPN="${KILLSWITCH_ALLOW_OPENVPN:-1}"
+KILLSWITCH_ALLOW_WIREGUARD="${KILLSWITCH_ALLOW_WIREGUARD:-1}"
+KILLSWITCH_EXTRA_PORTS="${KILLSWITCH_EXTRA_PORTS:-}"
+
+# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
+MAC_INTERFACES="${MAC_INTERFACES:-auto}"
+MAC_VENDOR_SPOOF="${MAC_VENDOR_SPOOF:-}"
+
+# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
+HOSTNAME_PATTERN="${HOSTNAME_PATTERN:-desktop}"
+HOSTNAME_CUSTOM_PREFIX="${HOSTNAME_CUSTOM_PREFIX:-}"
+
+# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
+HARDEN_IPV6="${HARDEN_IPV6:-1}"
+HARDEN_SWAP="${HARDEN_SWAP:-1}"
+HARDEN_CORE_DUMPS="${HARDEN_CORE_DUMPS:-1}"
+HARDEN_CLIPBOARD_CLEAR="${HARDEN_CLIPBOARD_CLEAR:-0}"
+HARDEN_SCREEN_LOCK="${HARDEN_SCREEN_LOCK:-1}"
+HARDEN_SCREEN_LOCK_TIMEOUT="${HARDEN_SCREEN_LOCK_TIMEOUT:-300}"
+HARDEN_TIMEZONE_SPOOF="${HARDEN_TIMEZONE_SPOOF:-0}"
+HARDEN_TIMEZONE_VALUE="${HARDEN_TIMEZONE_VALUE:-UTC}"
+HARDEN_LOCALE_SPOOF="${HARDEN_LOCALE_SPOOF:-0}"
+HARDEN_LOCALE_VALUE="${HARDEN_LOCALE_VALUE:-en_US.UTF-8}"
+
+# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
+LEAK_WEBRTC_BLOCK="${LEAK_WEBRTC_BLOCK:-1}"
+LEAK_USB_BLOCK="${LEAK_USB_BLOCK:-0}"
+
+# ─── MONITORING ────────────────────────────────────────────────────────────────
+MONITOR_PROCESSES="${MONITOR_PROCESSES:-0}"
+MONITOR_LOG_ROTATION="${MONITOR_LOG_ROTATION:-1}"
+LOG_ROTATION_HOURS="${LOG_ROTATION_HOURS:-4}"
+
+# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
+TRAFFIC_JITTER_ENABLED="${TRAFFIC_JITTER_ENABLED:-0}"
+TRAFFIC_JITTER_MS="${TRAFFIC_JITTER_MS:-50}"
+
+# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
+LEVEL_TYPE="${LEVEL_TYPE:-standard}"
+
+# ─── BASE STATE ───────────────────────────────────────────────────────────────
+BASE_DNS="${BASE_DNS:-quad9}"
+BASE_MAC_RANDOMIZE="${BASE_MAC_RANDOMIZE:-1}"
+BASE_IPV6_DISABLE="${BASE_IPV6_DISABLE:-1}"
+
+# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
+TOR_BRIDGE_MODE="${TOR_BRIDGE_MODE:-off}"
+TOR_BRIDGE_RELAY="${TOR_BRIDGE_RELAY:-}"
+
+# ─── SECURE DELETION ──────────────────────────────────────────────────────────
+WIPE_METHOD="${WIPE_METHOD:-auto}"
+
+# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
+DEPLOYMENT_LEVEL="${DEPLOYMENT_LEVEL:-bare-metal-standard}"
+
+# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
+OPSEC_BANNER="${OPSEC_BANNER:-compact}"
+
+# ─── WIDGET THEME ────────────────────────────────────────────────────────────
+WIDGET_THEME="${WIDGET_THEME:-default}"
+EOF
+    mv "$tmp" "$OPSEC_CONF"
+    chmod 600 "$OPSEC_CONF"
+}
+
+opsec_set_value() {
+    local key="$1" val="$2"
+    if [ -z "$key" ]; then return 1; fi
+    # Validate key: must be a valid shell variable name (letters, digits, underscore, starts with letter/underscore)
+    if ! echo "$key" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
+        echo "[!] opsec_set_value: invalid key name '${key}'" >&2
+        return 1
+    fi
+    # Sanitize value: strip characters that could break shell quoting
+    val=$(printf '%s' "$val" | tr -d '`$\\\"'"'" | tr -cd '[:print:]')
+    opsec_load_config
+    eval "${key}=\"${val}\""
+    opsec_save_config
+}
+
+opsec_get_value() {
+    local key="$1"
+    # Validate key: must be a valid shell variable name
+    if ! echo "$key" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
+        echo "[!] opsec_get_value: invalid key name '${key}'" >&2
+        return 1
+    fi
+    opsec_load_config
+    eval "echo \"\${${key}:-}\""
+}
+
+# ─── TORRC GENERATION ──────────────────────────────────────────────────────────
+
+opsec_generate_torrc() {
+    local _dbg="/run/opsec/debug.log"
+    echo "[$(date -Is)] [lib] opsec_generate_torrc called" >> "$_dbg" 2>/dev/null || true
+
+    opsec_load_config || return 1
+
+    local torrc="/etc/tor/torrc"
+    local socks_port="${TOR_SOCKS_PORT:-9050}"
+    local trans_port="${TOR_TRANS_PORT:-9040}"
+    local dns_port="${TOR_DNS_PORT:-5353}"
+    local rotation="${TOR_CIRCUIT_ROTATION:-30}"
+    local blacklist="${TOR_BLACKLIST:-}"
+    local strict="${TOR_STRICT_NODES:-1}"
+    local isolation="${TOR_ISOLATION:-1}"
+    local padding="${TOR_PADDING:-1}"
+    local guards="${TOR_NUM_GUARDS:-3}"
+    local safe_log="${TOR_SAFE_LOGGING:-1}"
+    echo "[$(date -Is)] [lib]   socks=${socks_port} trans=${trans_port} dns=${dns_port} blacklist=${blacklist}" >> "$_dbg" 2>/dev/null || true
+
+    # Build SocksPort line with isolation flags
+    local socks_line="SocksPort ${socks_port}"
+    if [ "$isolation" = "1" ]; then
+        socks_line="${socks_line} IsolateDestAddr IsolateDestPort"
+    fi
+
+    # Build ExcludeExitNodes from blacklist
+    local exclude_line=""
+    if [ -n "$blacklist" ]; then
+        local formatted
+        formatted=$(echo "$blacklist" | sed 's/\([a-z][a-z]\)/{\1}/g; s/,/,/g')
+        exclude_line="ExcludeExitNodes ${formatted}"
+    fi
+
+    local bridge_mode="${TOR_BRIDGE_MODE:-off}"
+    local bridge_relay="${TOR_BRIDGE_RELAY:-}"
+
+    cat > "$torrc" << EOF
+# Autogenerated — do not edit manually
+# Regenerate via: opsec-config.sh --apply
+
+# ─── SOCKS, TRANSPARENT PROXY & DNS ─────────────────────────────────────────
+${socks_line}
+TransPort ${trans_port}
+DNSPort ${dns_port}
+
+# ─── EXIT NODE EXCLUSION ────────────────────────────────────────────────────
+${exclude_line}
+StrictNodes ${strict}
+
+# ─── CIRCUIT ROTATION ───────────────────────────────────────────────────────
+MaxCircuitDirtiness ${rotation}
+
+# ─── TRAFFIC PADDING ────────────────────────────────────────────────────────
+ConnectionPadding ${padding}
+
+# ─── SAFE LOGGING ────────────────────────────────────────────────────────────
+SafeLogging ${safe_log}
+Log notice file /run/tor/notices.log
+
+# ─── ENTRY GUARDS ───────────────────────────────────────────────────────────
+NumEntryGuards ${guards}
+UseEntryGuards 1
+
+EOF
+
+    # ─── PLUGGABLE TRANSPORTS (bridges) ──────────────────────────────────────
+    if [ "$bridge_mode" != "off" ] && [ "$bridge_mode" != "" ]; then
+        cat >> "$torrc" << 'BRIDGE_HEADER'
+
+# ─── BRIDGE CONFIGURATION ────────────────────────────────────────────────────
+UseBridges 1
+BRIDGE_HEADER
+
+        case "$bridge_mode" in
+            obfs4)
+                echo "ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy" >> "$torrc"
+                ;;
+            meek-azure)
+                echo "ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy" >> "$torrc"
+                ;;
+            snowflake)
+                # snowflake-client location varies by distro
+                local sf_bin
+                sf_bin=$(command -v snowflake-client 2>/dev/null || echo "/usr/bin/snowflake-client")
+                echo "ClientTransportPlugin snowflake exec ${sf_bin}" >> "$torrc"
+                ;;
+        esac
+
+        # Add user-specified bridge relay if provided
+        if [ -n "$bridge_relay" ]; then
+            echo "Bridge ${bridge_relay}" >> "$torrc"
+        else
+            # Default bridges for each transport type
+            case "$bridge_mode" in
+                meek-azure)
+                    echo "Bridge meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com" >> "$torrc"
+                    ;;
+                snowflake)
+                    echo "Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ front=foursquare.com ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn" >> "$torrc"
+                    ;;
+            esac
+        fi
+    fi
+
+    chmod 644 "$torrc"
+    echo "[$(date -Is)] [lib]   torrc written ($(wc -l < "$torrc") lines)" >> "$_dbg" 2>/dev/null || true
+    echo "[$(date -Is)] [lib]   torrc contents:" >> "$_dbg" 2>/dev/null || true
+    cat "$torrc" >> "$_dbg" 2>/dev/null || true
+    echo "[$(date -Is)] [lib]   --- end torrc ---" >> "$_dbg" 2>/dev/null || true
+}
+
+# ─── RESOLV.CONF GENERATION ───────────────────────────────────────────────────
+
+opsec_generate_resolv() {
+    local _dbg="/run/opsec/debug.log"
+    echo "[$(date -Is)] [lib] opsec_generate_resolv called" >> "$_dbg" 2>/dev/null || true
+
+    opsec_load_config || return 1
+
+    local mode="${DNS_MODE:-tor}"
+    local resolv="/etc/resolv.conf"
+    echo "[$(date -Is)] [lib]   DNS_MODE=${mode}" >> "$_dbg" 2>/dev/null || true
+
+    # Unlock if immutable
+    chattr -i "$resolv" 2>/dev/null || true
+
+    case "$mode" in
+        tor)
+            echo "nameserver 127.0.0.1" > "$resolv"
+            ;;
+        quad9)
+            cat > "$resolv" << 'EOF'
+nameserver 9.9.9.9
+nameserver 149.112.112.112
+EOF
+            ;;
+        cloudflare)
+            cat > "$resolv" << 'EOF'
+nameserver 1.1.1.1
+nameserver 1.0.0.1
+EOF
+            ;;
+        doh)
+            # DNS-over-HTTPS via dnscrypt-proxy
+            # Ensure dnscrypt-proxy is running
+            if command -v dnscrypt-proxy >/dev/null 2>&1; then
+                # Deploy config if not present
+                if [ ! -f /etc/dnscrypt-proxy/dnscrypt-proxy.toml ] && [ -f /etc/opsec/dnscrypt-proxy.toml ]; then
+                    mkdir -p /etc/dnscrypt-proxy
+                    cp /etc/opsec/dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml
+                fi
+                mkdir -p /var/log/dnscrypt-proxy /var/cache/dnscrypt-proxy
+                # Stop systemd-resolved if it conflicts on :53
+                systemctl stop systemd-resolved 2>/dev/null || true
+                systemctl start dnscrypt-proxy 2>/dev/null || dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml &
+            fi
+            cat > "$resolv" << 'EOF'
+nameserver 127.0.0.53
+EOF
+            ;;
+        dot)
+            # DNS-over-TLS via systemd-resolved
+            cat > "$resolv" << 'EOF'
+nameserver 127.0.0.53
+options edns0 trust-ad
+EOF
+            ;;
+        custom)
+            if [ -n "$DNS_CUSTOM_SERVERS" ]; then
+                : > "$resolv"
+                local IFS=','
+                for server in $DNS_CUSTOM_SERVERS; do
+                    echo "nameserver ${server}" >> "$resolv"
+                done
+            else
+                echo "nameserver 9.9.9.9" > "$resolv"
+            fi
+            ;;
+        *)
+            echo "nameserver 9.9.9.9" > "$resolv"
+            ;;
+    esac
+
+    # Lock if in advanced mode
+    if opsec_is_advanced; then
+        chattr +i "$resolv"
+        echo "[$(date -Is)] [lib]   resolv.conf locked (chattr +i)" >> "$_dbg" 2>/dev/null || true
+    fi
+    echo "[$(date -Is)] [lib]   resolv.conf contents: $(cat "$resolv" 2>/dev/null | tr '\n' ' ')" >> "$_dbg" 2>/dev/null || true
+}
+
+# ─── STATE CHECKS ─────────────────────────────────────────────────────────────
+
+opsec_is_advanced() {
+    [ -f "$OPSEC_STATE_FILE" ]
+}
+
+opsec_is_boot_enabled() {
+    [ -f "$OPSEC_BOOT_MARKER" ]
+}
+
+# ─── PROFILE MANAGEMENT ───────────────────────────────────────────────────────
+
+opsec_profile_save() {
+    local name="$1"
+    if [ -z "$name" ]; then return 1; fi
+    mkdir -p "$OPSEC_PROFILES_DIR"
+    cp "$OPSEC_CONF" "${OPSEC_PROFILES_DIR}/${name}.conf"
+    # Tag profile name inside the saved copy
+    sed -i "s/^PROFILE_NAME=.*/PROFILE_NAME=\"${name}\"/" "${OPSEC_PROFILES_DIR}/${name}.conf"
+}
+
+opsec_profile_load() {
+    local name="$1"
+    local profile="${OPSEC_PROFILES_DIR}/${name}.conf"
+    if [ ! -f "$profile" ]; then return 1; fi
+    cp "$profile" "$OPSEC_CONF"
+    # Update active profile name
+    sed -i "s/^PROFILE_NAME=.*/PROFILE_NAME=\"${name}\"/" "$OPSEC_CONF"
+}
+
+opsec_profile_list() {
+    if [ -d "$OPSEC_PROFILES_DIR" ]; then
+        find "$OPSEC_PROFILES_DIR" -name '*.conf' -printf '%f\n' | sed 's/\.conf$//'
+    fi
+}
+
+opsec_profile_delete() {
+    local name="$1"
+    rm -f "${OPSEC_PROFILES_DIR}/${name}.conf"
+}
+
+opsec_profile_export() {
+    local name="$1" dest="$2"
+    local profile="${OPSEC_PROFILES_DIR}/${name}.conf"
+    if [ ! -f "$profile" ]; then return 1; fi
+    cp "$profile" "$dest"
+}
+
+opsec_profile_import() {
+    local src="$1" name="$2"
+    if [ ! -f "$src" ]; then return 1; fi
+    mkdir -p "$OPSEC_PROFILES_DIR"
+    cp "$src" "${OPSEC_PROFILES_DIR}/${name}.conf"
+}
+
+# ─── COUNTRY CODE HELPERS ─────────────────────────────────────────────────────
+
+opsec_load_country_presets() {
+    if [ -f "$OPSEC_COUNTRY_CODES" ]; then
+        # shellcheck disable=SC1090
+        . "$OPSEC_COUNTRY_CODES"
+    fi
+}
+
+opsec_get_preset() {
+    local preset="$1"
+    opsec_load_country_presets
+    case "$preset" in
+        5eyes|fiveeyes)   echo "$FIVE_EYES" ;;
+        9eyes|nineeyes)   echo "$NINE_EYES" ;;
+        14eyes|fourteeneyes) echo "$FOURTEEN_EYES" ;;
+        surveillance)     echo "$SURVEILLANCE_STATES" ;;
+        max)              echo "$MAX_EXCLUSION" ;;
+        *)                echo "" ;;
+    esac
+}
+
+# ─── DEPLOYMENT LEVEL MANAGEMENT ─────────────────────────────────────────────
+
+OPSEC_LEVELS_DIR="/etc/opsec/levels"
+
+opsec_level_list() {
+    if [ -d "$OPSEC_LEVELS_DIR" ]; then
+        find "$OPSEC_LEVELS_DIR" -name '*.conf' -printf '%f\n' | sed 's/\.conf$//' | sort
+    fi
+}
+
+opsec_level_apply() {
+    local level="$1"
+    local level_file="${OPSEC_LEVELS_DIR}/${level}.conf"
+    if [ ! -f "$level_file" ]; then
+        opsec_red "Level '${level}' not found in ${OPSEC_LEVELS_DIR}"
+        return 1
+    fi
+
+    # Preserve current PROFILE_NAME before overwriting
+    opsec_load_config 2>/dev/null || true
+    local saved_profile="${PROFILE_NAME:-default}"
+
+    # Copy level preset over active config
+    cp "$level_file" "$OPSEC_CONF"
+    chmod 600 "$OPSEC_CONF"
+
+    # Restore profile name and ensure deployment level is tagged
+    opsec_load_config
+    PROFILE_NAME="$saved_profile"
+    DEPLOYMENT_LEVEL="$level"
+    opsec_save_config
+}
+
+# ─── SECURE DELETION ─────────────────────────────────────────────────────────
+
+opsec_detect_storage_type() {
+    # Detect storage type for a given path
+    # Returns: hdd | ssd | luks | unknown
+    local target_path="${1:-/}"
+    local device
+
+    # Find the block device for the path
+    device=$(df -P "$target_path" 2>/dev/null | tail -1 | awk '{print $1}')
+    [ -z "$device" ] && echo "unknown" && return
+
+    # Check for LUKS
+    if command -v cryptsetup >/dev/null 2>&1; then
+        # Check if device is on a dm-crypt layer
+        local dm_name
+        dm_name=$(basename "$device" 2>/dev/null)
+        if [ -e "/sys/block/${dm_name}/dm/uuid" ] 2>/dev/null; then
+            local dm_uuid
+            dm_uuid=$(cat "/sys/block/${dm_name}/dm/uuid" 2>/dev/null)
+            if echo "$dm_uuid" | grep -qi "CRYPT-LUKS"; then
+                echo "luks"
+                return
+            fi
+        fi
+        # Also check via dmsetup
+        if dmsetup info "$device" 2>/dev/null | grep -qi "CRYPT-LUKS"; then
+            echo "luks"
+            return
+        fi
+    fi
+
+    # Resolve to physical disk (strip partition number, handle /dev/mapper)
+    local phys_disk
+    phys_disk=$(lsblk -ndo PKNAME "$device" 2>/dev/null | head -1)
+    [ -z "$phys_disk" ] && phys_disk=$(echo "$device" | sed 's/[0-9]*$//' | sed 's|^/dev/||')
+
+    # Check rotational flag (0 = SSD, 1 = HDD)
+    local rotational_file="/sys/block/${phys_disk}/queue/rotational"
+    if [ -f "$rotational_file" ]; then
+        local rotational
+        rotational=$(cat "$rotational_file" 2>/dev/null)
+        if [ "$rotational" = "0" ]; then
+            echo "ssd"
+        else
+            echo "hdd"
+        fi
+        return
+    fi
+
+    echo "unknown"
+}
+
+opsec_secure_delete() {
+    # SSD-aware secure file deletion
+    # Usage: opsec_secure_delete <file_or_dir> [method]
+    # method: auto (default) | shred | fstrim | luks
+    local target="$1"
+    local method="${2:-${WIPE_METHOD:-auto}}"
+
+    [ -z "$target" ] && return 1
+
+    if [ "$method" = "auto" ]; then
+        method=$(opsec_detect_storage_type "$target")
+    fi
+
+    case "$method" in
+        hdd|shred)
+            # Traditional shred for spinning disks
+            if [ -d "$target" ]; then
+                find "$target" -type f -exec shred -fuz -n 1 {} \; 2>/dev/null
+                rm -rf "$target" 2>/dev/null
+            elif [ -f "$target" ]; then
+                shred -fuz -n 1 "$target" 2>/dev/null
+            fi
+            ;;
+        ssd|fstrim)
+            # For SSDs: overwrite with zeros, delete, then fstrim
+            # shred is ineffective on SSDs due to wear leveling
+            if [ -d "$target" ]; then
+                find "$target" -type f -exec dd if=/dev/zero of={} bs=4k count=1 conv=notrunc 2>/dev/null \;
+                find "$target" -type f -delete 2>/dev/null
+                rm -rf "$target" 2>/dev/null
+            elif [ -f "$target" ]; then
+                dd if=/dev/zero of="$target" bs=4k count=1 conv=notrunc 2>/dev/null
+                rm -f "$target" 2>/dev/null
+            fi
+            # Request TRIM/discard on the filesystem
+            local mount_point
+            mount_point=$(df -P "${target%/*}" 2>/dev/null | tail -1 | awk '{print $6}')
+            if [ -n "$mount_point" ]; then
+                fstrim "$mount_point" 2>/dev/null || true
+            fi
+            ;;
+        luks)
+            # For LUKS: zero file + rely on LUKS key destroy for full wipe
+            if [ -d "$target" ]; then
+                find "$target" -type f -exec dd if=/dev/zero of={} bs=4k count=1 conv=notrunc 2>/dev/null \;
+                find "$target" -type f -delete 2>/dev/null
+                rm -rf "$target" 2>/dev/null
+            elif [ -f "$target" ]; then
+                dd if=/dev/zero of="$target" bs=4k count=1 conv=notrunc 2>/dev/null
+                rm -f "$target" 2>/dev/null
+            fi
+            # Note: full LUKS key destroy handled by emergency-wipe
+            ;;
+        *)
+            # Fallback: basic shred
+            if [ -d "$target" ]; then
+                find "$target" -type f -exec shred -fuz -n 1 {} \; 2>/dev/null
+                rm -rf "$target" 2>/dev/null
+            elif [ -f "$target" ]; then
+                shred -fuz -n 1 "$target" 2>/dev/null
+            fi
+            ;;
+    esac
+}
+
+# ─── WIDGET THEME MANAGEMENT ─────────────────────────────────────────────────
+
+OPSEC_THEMES_DIR="/etc/opsec/themes"
+
+opsec_theme_list() {
+    if [ -d "$OPSEC_THEMES_DIR" ]; then
+        find "$OPSEC_THEMES_DIR" -name '*.theme' -printf '%f\n' | sed 's/\.theme$//' | sort
+    fi
+}
+
+opsec_generate_conky() {
+    opsec_load_config || return 1
+
+    local theme="${WIDGET_THEME:-default}"
+    local theme_file="${OPSEC_THEMES_DIR}/${theme}.theme"
+
+    if [ ! -f "$theme_file" ]; then
+        opsec_red "Theme '${theme}' not found at ${theme_file}"
+        return 1
+    fi
+
+    # Source theme to get CONKY_COLOR* and CONKY_BG values
+    # shellcheck disable=SC1090
+    . "$theme_file"
+
+    local conky_conf_name="conky-opsec-widget.conf"
+
+    # Find and regenerate conky config for each user with the widget installed
+    for home_dir in /home/*; do
+        local conky_conf="${home_dir}/.config/conky/${conky_conf_name}"
+        [ -f "$conky_conf" ] || continue
+
+        local owner
+        owner=$(stat -c '%U' "$conky_conf" 2>/dev/null) || continue
+
+        cat > "$conky_conf" << CONKYEOF
+-- OPSEC Status Widget
+-- Colors managed by theme system via opsec-config.sh
+-- Theme: ${theme} (${THEME_LABEL:-Custom})
+
+conky.config = {
+    -- Window settings
+    alignment = 'top_right',
+    gap_x = 15,
+    gap_y = 60,
+    minimum_width = 400,
+    minimum_height = 200,
+    maximum_width = 420,
+
+    -- Multi-monitor: run xrandr --listmonitors to find head number
+    xinerama_head = 0,
+
+    -- Window type
+    own_window = true,
+    own_window_type = 'desktop',
+    own_window_transparent = false,
+    own_window_argb_visual = true,
+    own_window_argb_value = 210,
+    own_window_colour = '${CONKY_BG:-0d1117}',
+    own_window_hints = 'undecorated,below,sticky,skip_taskbar,skip_pager',
+
+    -- Drawing
+    double_buffer = true,
+    draw_shades = true,
+    default_shade_color = '000000',
+    draw_outline = false,
+    draw_borders = true,
+    border_inner_margin = 12,
+    border_outer_margin = 4,
+    border_width = 1,
+    border_colour = '1b3a5c',
+    stippled_borders = 0,
+
+    -- Font
+    use_xft = true,
+    font = 'JetBrains Mono:size=10',
+    override_utf8_locale = true,
+
+    -- Colors — Theme: ${theme}
+    default_color = 'b0b0b0',
+    color0 = '${CONKY_COLOR0:-df2020}',
+    color1 = '${CONKY_COLOR1:-33ff33}',
+    color2 = '${CONKY_COLOR2:-3a8fd6}',
+    color3 = '${CONKY_COLOR3:-0d1117}',
+    color4 = '${CONKY_COLOR4:-1f6feb}',
+    color5 = '${CONKY_COLOR5:-58a6ff}',
+    color6 = '${CONKY_COLOR6:-79c0ff}',
+    color7 = '${CONKY_COLOR7:-c9d1d9}',
+    color8 = '${CONKY_COLOR8:-1f6feb}',
+    color9 = '${CONKY_COLOR9:-484f58}',
+
+    -- Update interval
+    update_interval = 3,
+    total_run_times = 0,
+
+    -- Misc
+    cpu_avg_samples = 2,
+    no_buffers = true,
+    text_buffer_size = 8192,
+    short_units = true,
+};
+
+conky.text = [[
+\${execpi 5 ~/.config/conky/conky-opsec-status.sh}
+]];
+CONKYEOF
+
+        chown "$owner":"$owner" "$conky_conf"
+        chmod 644 "$conky_conf"
+    done
+
+    # Restart conky for all users running the opsec widget
+    pkill -f 'conky.*opsec' 2>/dev/null || true
+    sleep 1
+
+    for home_dir in /home/*; do
+        local conky_conf="${home_dir}/.config/conky/${conky_conf_name}"
+        [ -f "$conky_conf" ] || continue
+
+        local owner
+        owner=$(stat -c '%U' "$conky_conf" 2>/dev/null) || continue
+        local uid
+        uid=$(id -u "$owner" 2>/dev/null) || continue
+
+        # Relaunch conky as the file owner
+        su - "$owner" -c "DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus nohup conky -c '${conky_conf}' >/dev/null 2>&1 &" 2>/dev/null || true
+    done
+}
+
+# ─── INIT CHECK ────────────────────────────────────────────────────────────────
+# Ensure /etc/opsec exists
+_opsec_init_dirs() {
+    [ -d /etc/opsec ] || mkdir -p /etc/opsec
+    [ -d "$OPSEC_PROFILES_DIR" ] || mkdir -p "$OPSEC_PROFILES_DIR"
+}
+
+# Auto-init on source if running as root
+if [ "$EUID" = "0" ] 2>/dev/null || [ "$(id -u)" = "0" ] 2>/dev/null; then
+    _opsec_init_dirs
+fi

opsec/scripts/opsec-banner-cache.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# /usr/local/bin/opsec-banner-cache.sh — Background WAN IP Cache Updater
+# Updates /var/cache/opsec/wan_ip every 5 minutes (via cron)
+# Never blocks shell startup — the banner reads from cache only
+
+CACHE_DIR="/var/cache/opsec"
+CACHE_FILE="${CACHE_DIR}/wan_ip"
+ENDPOINTS="https://icanhazip.com https://ifconfig.me https://api.ipify.org"
+
+mkdir -p "$CACHE_DIR"
+chmod 755 "$CACHE_DIR"
+
+PUB_IP=""
+
+# Try via Tor first if running
+if pgrep -x tor >/dev/null 2>&1 && ss -tln 2>/dev/null | grep -q ':9050 '; then
+    for ep in $ENDPOINTS; do
+        PUB_IP=$(curl -s --max-time 10 --socks5-hostname 127.0.0.1:9050 "$ep" 2>/dev/null | tr -d '[:space:]')
+        [ -n "$PUB_IP" ] && break
+    done
+fi
+
+# Fallback to direct if Tor failed or not running
+if [ -z "$PUB_IP" ]; then
+    for ep in $ENDPOINTS; do
+        PUB_IP=$(curl -s --max-time 5 "$ep" 2>/dev/null | tr -d '[:space:]')
+        [ -n "$PUB_IP" ] && break
+    done
+fi
+
+# Only write if we got a valid-looking IP
+if echo "$PUB_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+    echo "$PUB_IP" > "$CACHE_FILE"
+    chmod 644 "$CACHE_FILE"
+fi

opsec/scripts/opsec-banner.sh

@@ -0,0 +1,320 @@
+#!/bin/bash
+# /usr/local/bin/opsec-banner.sh — Terminal OPSEC Status Banner
+# Mirrors the Conky desktop widget layout and Widget theme colors
+# Modes: compact | full | off (configured via OPSEC_BANNER in opsec.conf)
+
+OPSEC_CONF="/etc/opsec/opsec.conf"
+[ -f "$OPSEC_CONF" ] && . "$OPSEC_CONF"
+
+BANNER_MODE="${OPSEC_BANNER:-compact}"
+[ -n "$1" ] && BANNER_MODE="$1"
+[ "$BANNER_MODE" = "off" ] && exit 0
+
+# ─── Widget theme colors (matching Conky widget) ────────────────────────────
+R=$'\e[0m'
+BLD=$'\e[1m'
+C0=$'\e[38;5;135m'     # ALERT/BAD    — #B55AFC purple
+C1=$'\e[38;5;204m'     # SECURE/GOOD  — #FF63BE hot pink
+C2=$'\e[38;5;117m'     # INFO/NEUTRAL — #85E7FF cyan
+C4=$'\e[38;5;32m'      # STRUCTURAL   — #268BD2 blue
+C5=$'\e[38;5;45m'      # TITLE/ACCENT — #07CAF9 bright cyan
+C6=$'\e[38;5;117m'     # LABELS       — #85E7FF cyan
+C7=$'\e[38;5;189m'     # VALUES       — #ECDEF7 lavender
+C8=$'\e[38;5;135m'     # SECTION HDR  — #B55AFC purple
+C9=$'\e[38;5;66m'      # METADATA     — #4A6A7A dark grey
+
+# ─── DETECT STATE ────────────────────────────────────────────────────────────
+ADVANCED=false
+[ -f /var/run/opsec-advanced.enabled ] && ADVANCED=true
+
+BREAKGLASS=false
+if [ -f /var/run/opsec-breakglass.active ]; then
+    BREAKGLASS=true
+    _bge=$(cat /var/run/opsec-breakglass.active 2>/dev/null)
+    _bgn=$(date +%s)
+    BG_REM=""
+    [ -n "$_bge" ] && [ "$_bge" -gt "$_bgn" ] 2>/dev/null && BG_REM="$(( (_bge - _bgn) / 60 ))m"
+fi
+
+# ─── HELPERS ─────────────────────────────────────────────────────────────────
+HR="  ${C4}$(printf '─%.0s' {1..48})${R}"
+
+# ─── READ CACHE ──────────────────────────────────────────────────────────────
+CACHE_FILE="/tmp/.opsec-cache/netinfo"
+PUB_IP="" PUB_GEO="" ROUTED_TOR=false EXIT_COUNTRY="" EXIT_CHANGE_TIME="" TOR_BOOTSTRAP="" TOR_PHASE=""
+if [ -f "$CACHE_FILE" ]; then
+    _cr() { grep "^${1}=" "$CACHE_FILE" 2>/dev/null | head -1 | cut -d'"' -f2; }
+    PUB_IP=$(_cr PUB_IP)
+    PUB_GEO=$(_cr PUB_GEO)
+    ROUTED_TOR=$(_cr ROUTED_TOR)
+    EXIT_COUNTRY=$(_cr EXIT_COUNTRY)
+    EXIT_CHANGE_TIME=$(_cr EXIT_CHANGE_TIME)
+    TOR_BOOTSTRAP=$(_cr TOR_BOOTSTRAP)
+    TOR_PHASE=$(_cr TOR_PHASE)
+    PUB_IP=$(echo "$PUB_IP" | tr -cd '0-9.')
+    EXIT_COUNTRY=$(echo "$EXIT_COUNTRY" | tr -cd 'A-Za-z')
+    EXIT_CHANGE_TIME=$(echo "$EXIT_CHANGE_TIME" | tr -cd '0-9')
+    TOR_BOOTSTRAP=$(echo "$TOR_BOOTSTRAP" | tr -cd '0-9')
+fi
+
+# ─── GATHER LIVE STATUS ─────────────────────────────────────────────────────
+
+LOCAL_IP=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="src") print $(i+1)}' | head -1)
+[ -z "$LOCAL_IP" ] && LOCAL_IP="No route"
+
+VPN_IF=$(ip -o link show 2>/dev/null | awk -F': ' '{print $2}' | grep -E '^(tun|wg)' | head -1)
+VPN_OK=false; VPN_IP=""
+if [ -n "$VPN_IF" ]; then
+    VPN_OK=true
+    VPN_IP=$(ip -4 addr show "$VPN_IF" 2>/dev/null | awk '/inet /{print $2}' | cut -d/ -f1)
+fi
+
+PRIMARY_IF=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}' | head -1)
+MAC_OK=false; CUR_MAC=""
+if [ -n "$PRIMARY_IF" ]; then
+    CUR_MAC=$(ip link show "$PRIMARY_IF" 2>/dev/null | awk '/ether/{print $2}')
+    _oct=$((16#$(echo "$CUR_MAC" | cut -d: -f1))) 2>/dev/null
+    (( _oct & 2 )) 2>/dev/null && MAC_OK=true
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# COMPACT BANNER
+# ═════════════════════════════════════════════════════════════════════════════
+
+render_compact() {
+    _si() {
+        local ok=$1 lbl="$2"
+        if $ok; then
+            echo -n "${C6}${lbl}${C1}${BLD}+${R}"
+        else
+            echo -n "${C6}${lbl}${C0}${BLD}x${R}"
+        fi
+    }
+
+    local _tor_ok=false; ss -tln 2>/dev/null | grep -q ':9050 ' && _tor_ok=true
+    local _ks_ok=false
+    [ -f /var/run/opsec-killswitch.enabled ] && _ks_ok=true
+    iptables -L GP_FW >/dev/null 2>&1 && _ks_ok=true
+    local _dns_ok=false
+    local _ds=$(awk '/^nameserver/{print $2;exit}' /etc/resolv.conf 2>/dev/null)
+    case "$_ds" in 127.0.0.1|9.9.9.9|149.112.*|1.1.1.1|1.0.0.1) _dns_ok=true ;; esac
+    local _v6_ok=false
+    [ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null)" = "1" ] && _v6_ok=true
+
+    echo ""
+    if $BREAKGLASS; then
+        echo "  ${C0}${BLD}⚠ BREAKGLASS${R}  ${C0}KS bypassed${BG_REM:+ (${BG_REM})}${R}"
+    fi
+
+    if $ADVANCED; then
+        local sigil="${C1}${BLD}▲ ADVANCED${R}"
+        local ind="$(_si $_tor_ok TOR) $(_si $_ks_ok KS) $(_si $_dns_ok DNS) $(_si $MAC_OK MAC) $(_si $_v6_ok v6)"
+        $VPN_OK && ind="$ind $(_si $VPN_OK VPN)"
+        echo "  ${sigil}  ${ind}  ${C9}${LOCAL_IP}${R}"
+    else
+        local sigil="${C2}── STANDARD${R}"
+        local ind="$(_si $_dns_ok DNS) $(_si $MAC_OK MAC)"
+        $VPN_OK && ind="$ind $(_si $VPN_OK VPN)"
+        echo "  ${sigil}  ${ind}  ${C9}${LOCAL_IP}${R}"
+    fi
+    echo ""
+}
+
+# ═════════════════════════════════════════════════════════════════════════════
+# FULL BANNER — mirrors Conky widget
+# ═════════════════════════════════════════════════════════════════════════════
+
+render_full() {
+    echo ""
+
+    # ── HEADER ──
+    echo "$HR"
+    if $ADVANCED; then
+        echo "  ${C5}${BLD}        OPSEC STATUS${R}"
+        echo "  ${C1}${BLD}        ▲ ADVANCED ▲${R}"
+    else
+        echo "  ${C5}${BLD}        OPSEC STATUS${R}"
+        echo "  ${C2}        ── STANDARD ──${R}"
+    fi
+    echo "$HR"
+
+    # Breakglass warning
+    if $BREAKGLASS; then
+        echo "  ${C0}${BLD} ⚠ BREAKGLASS — Kill switch bypassed ${BG_REM:+(${BG_REM})}${R}"
+        echo "$HR"
+    fi
+
+    # ── SYSTEM ──
+    echo "  ${C8}${BLD} ▌SYSTEM${R}"
+    echo "  ${C6} HOST      ${C7}$(hostname)${R}$(printf '%*s' 1 '')${C6}UP ${C7}$(uptime -p 2>/dev/null | sed 's/^up //' | sed 's/ hours\?/h/;s/ minutes\?/m/;s/ days\?/d/;s/, */ /g' || uptime | awk -F'up ' '{print $2}' | awk -F, '{print $1}')${R}"
+    local _cpu _mem _memtot _memp
+    _cpu=$(awk '/^cpu /{u=$2+$4; t=$2+$4+$5; if(t>0) printf "%.0f", u*100/t}' /proc/stat 2>/dev/null)
+    _mem=$(free -h 2>/dev/null | awk '/^Mem:/{print $3}')
+    _memtot=$(free -h 2>/dev/null | awk '/^Mem:/{print $2}')
+    _memp=$(free 2>/dev/null | awk '/^Mem:/{if($2>0) printf "%.0f", $3*100/$2}')
+    echo "  ${C6} CPU       ${C7}${_cpu:-0}%${R}$(printf '%*s' 1 '')${C6}RAM ${C7}${_memp:-0}% ${C9}(${_mem:-?}/${_memtot:-?})${R}"
+
+    # ── NETWORK ──
+    echo "$HR"
+    echo "  ${C8}${BLD} ▌NETWORK${R}"
+    echo "  ${C6} LOCAL IP  ${C7}${LOCAL_IP}${R}"
+
+    # External IP
+    if [ -n "$PUB_IP" ]; then
+        if [ -n "$PUB_GEO" ]; then
+            echo "  ${C6} EXT IP    ${C7}${PUB_IP} ${C9}(${PUB_GEO})${R}"
+        else
+            echo "  ${C6} EXT IP    ${C7}${PUB_IP}${R}"
+        fi
+    else
+        echo "  ${C6} EXT IP    ${C0}UNAVAILABLE${R}"
+    fi
+
+    # VPN
+    if $VPN_OK; then
+        echo "  ${C6} VPN       ${C1}ACTIVE  ${C7}${VPN_IP} ${C9}(${VPN_IF})${R}"
+    fi
+
+    # MAC
+    if [ -n "$CUR_MAC" ]; then
+        if $MAC_OK; then
+            echo "  ${C6} MAC       ${C1}RANDOM  ${C9}(${CUR_MAC})${R}"
+        else
+            echo "  ${C6} MAC       ${C0}HWADDR  ${C9}(${CUR_MAC})${R}"
+        fi
+    else
+        echo "  ${C6} MAC       ${C9}NO IFACE${R}"
+    fi
+
+    # ── HARDENING (advanced only) ──
+    if $ADVANCED; then
+        echo "$HR"
+        echo "  ${C8}${BLD} ▌HARDENING${R}"
+
+        local _v6=$(sysctl -n net.ipv6.conf.all.disable_ipv6 2>/dev/null || echo "0")
+        [ "$_v6" = "1" ] && echo "  ${C6} IPv6      ${C1}BLOCKED${R}" || echo "  ${C6} IPv6      ${C0}LEAKING${R}"
+
+        if lsattr /etc/resolv.conf 2>/dev/null | grep -q 'i'; then
+            echo "  ${C6} DNSLK     ${C1}LOCKED  ${C9}(immutable)${R}"
+        else
+            echo "  ${C6} DNSLK     ${C0}UNLOCKED${R}"
+        fi
+
+        local _iso=$(grep "IsolateDestAddr" /etc/tor/torrc 2>/dev/null | head -1)
+        [ -n "$_iso" ] && echo "  ${C6} ISOL      ${C1}ACTIVE  ${C9}(stream isolation)${R}"
+
+        local _pad=$(grep "ConnectionPadding" /etc/tor/torrc 2>/dev/null | awk '{print $2}')
+        [ "$_pad" = "1" ] && echo "  ${C6} TPAD      ${C1}ACTIVE  ${C9}(traffic padding)${R}"
+
+        local _bl=$(grep "ExcludeExitNodes" /etc/tor/torrc 2>/dev/null | sed 's/ExcludeExitNodes //' | tr -d '{}' | tr ',' ' ')
+        [ -n "$_bl" ] && echo "  ${C6} BLOCK     ${C0}$(echo "$_bl" | tr ' ' ',' | sed 's/,$//')${R}"
+
+        local _core=$(sysctl -n kernel.core_pattern 2>/dev/null)
+        [[ "$_core" == *"/bin/false"* ]] && echo "  ${C6} CORE      ${C1}BLOCKED${R}" || echo "  ${C6} CORE      ${C0}ENABLED${R}"
+
+        local _swap=$(swapon --show=SIZE --noheadings 2>/dev/null | head -1)
+        [ -z "$_swap" ] && echo "  ${C6} SWAP      ${C1}OFF${R}" || echo "  ${C6} SWAP      ${C0}ACTIVE ${C9}(${_swap})${R}"
+
+        local _bootc=0
+        for _svc in opsec-boot-advanced opsec-mac-randomize opsec-hostname-randomize opsec-killswitch; do
+            systemctl is-enabled "$_svc" 2>/dev/null | grep -q enabled && _bootc=$((_bootc + 1))
+        done
+        if [ "$_bootc" -eq 4 ]; then
+            echo "  ${C6} BOOT      ${C1}PERSIST ${C9}(${_bootc}/4)${R}"
+        elif [ "$_bootc" -gt 0 ]; then
+            echo "  ${C6} BOOT      ${C2}PARTIAL ${C9}(${_bootc}/4)${R}"
+        else
+            echo "  ${C6} BOOT      ${C0}NONE    ${C9}(${_bootc}/4)${R}"
+        fi
+
+        local _prof="${PROFILE_NAME:-}"
+        [ -n "$_prof" ] && echo "  ${C6} PROF      ${C2}${_prof}${R}"
+    fi
+
+    # ── TOR STATUS (advanced only) ──
+    if $ADVANCED; then
+        echo "$HR"
+        echo "  ${C8}${BLD} ▌TOR STATUS${R}"
+
+        local _tor_svc=false _tor_socks=false _ks_armed=false _tor_routed=false
+        systemctl is-active tor >/dev/null 2>&1 && _tor_svc=true
+        ss -tln 2>/dev/null | grep -q ':9050 ' && _tor_socks=true
+        $ADVANCED && _ks_armed=true
+        [ "$ROUTED_TOR" = "true" ] && _tor_routed=true
+
+        if $_tor_svc && $_tor_socks && $_ks_armed && $_tor_routed; then
+            echo "  ${C6} STATE     ${C1}PROTECTED${R}"
+        elif $_tor_svc && ! $_tor_socks; then
+            echo "  ${C6} STATE     ${C2}BOOTSTRAP ${C9}(${TOR_BOOTSTRAP:-0}% ${TOR_PHASE:-connecting})${R}"
+        elif ! $_tor_svc; then
+            echo "  ${C6} STATE     ${C0}EXPOSED   ${C9}(tor down)${R}"
+        elif ! $_ks_armed; then
+            echo "  ${C6} STATE     ${C0}EXPOSED   ${C9}(kill switch off)${R}"
+        else
+            echo "  ${C6} STATE     ${C0}EXPOSED   ${C9}(not routed)${R}"
+        fi
+
+        if [ -n "$EXIT_COUNTRY" ] && [ ${#EXIT_COUNTRY} -le 3 ]; then
+            echo "  ${C6} EXIT      ${C2}${EXIT_COUNTRY}${R}"
+        elif $_tor_socks; then
+            echo "  ${C6} EXIT      ${C9}resolving...${R}"
+        else
+            echo "  ${C6} EXIT      ${C9}—${R}"
+        fi
+
+        if [ -n "$EXIT_CHANGE_TIME" ] && [ "$EXIT_CHANGE_TIME" -gt 0 ] 2>/dev/null; then
+            local _now=$(date +%s)
+            local _age=$(( _now - EXIT_CHANGE_TIME ))
+            if [ "$_age" -lt 60 ]; then
+                echo "  ${C6} CIRCUIT   ${C2}${_age}s ago${R}"
+            elif [ "$_age" -lt 3600 ]; then
+                echo "  ${C6} CIRCUIT   ${C2}$(( _age / 60 ))m ago${R}"
+            else
+                echo "  ${C6} CIRCUIT   ${C2}$(( _age / 3600 ))h $(( (_age % 3600) / 60 ))m ago${R}"
+            fi
+        else
+            echo "  ${C6} CIRCUIT   ${C9}—${R}"
+        fi
+
+        local _dns_server=$(awk '/^nameserver/{print $2;exit}' /etc/resolv.conf 2>/dev/null)
+        local _dns_immutable=false
+        lsattr /etc/resolv.conf 2>/dev/null | grep -q 'i' && _dns_immutable=true
+        local _nm_locked=false
+        [ -f /etc/NetworkManager/conf.d/opsec-dns-lock.conf ] && _nm_locked=true
+
+        if [ "$_dns_server" = "127.0.0.1" ] && $_dns_immutable && $_nm_locked; then
+            echo "  ${C6} DNS       ${C1}SECURE  ${C9}(tor + locked)${R}"
+        elif [ "$_dns_server" = "127.0.0.1" ] && $_dns_immutable; then
+            echo "  ${C6} DNS       ${C2}SECURE  ${C9}(tor, NM unlocked)${R}"
+        elif [ "$_dns_server" = "127.0.0.1" ]; then
+            echo "  ${C6} DNS       ${C2}PARTIAL ${C9}(tor, not locked)${R}"
+        elif echo "$_dns_server" | grep -qE '^(9\.9\.9\.9|149\.112|1\.1\.1\.1|1\.0\.0\.1)'; then
+            echo "  ${C6} DNS       ${C2}PRIVACY ${C9}(${_dns_server})${R}"
+        else
+            echo "  ${C6} DNS       ${C0}LEAKED  ${C9}(${_dns_server})${R}"
+        fi
+    fi
+
+    # ── MODE / LEVEL ──
+    echo "$HR"
+    if $ADVANCED; then
+        echo "  ${C6} MODE      ${C1}ADVANCED${R}"
+    else
+        echo "  ${C6} MODE      ${C0}STANDARD${R}"
+    fi
+    local _lvl="${DEPLOYMENT_LEVEL:-}"
+    [ -n "$_lvl" ] && echo "  ${C6} LEVEL     ${C7}${_lvl}${R}"
+
+    echo "$HR"
+    echo "  ${C9}        // $(date +%H:%M:%S) //${R}"
+    echo ""
+}
+
+# ═════════════════════════════════════════════════════════════════════════════
+# DISPATCH
+# ═════════════════════════════════════════════════════════════════════════════
+
+case "$BANNER_MODE" in
+    compact) render_compact ;;
+    full)    render_full ;;
+esac

opsec/scripts/opsec-boot-init.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# /usr/local/bin/opsec-boot-init.sh — Level-aware boot initializer
+# Called by opsec-boot-advanced.service at boot
+# Standard levels: apply base privacy hardening only
+# Paranoid levels: activate full ghost mode
+
+set -euo pipefail
+
+BOOT_MARKER="/etc/opsec/boot-advanced.enabled"
+STATE_FILE="/var/run/opsec-advanced.enabled"
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+OPSEC_CONF="/etc/opsec/opsec.conf"
+
+# Source shared library if available
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+    opsec_load_config 2>/dev/null || true
+fi
+
+# Load config directly if lib not available
+if [ -f "$OPSEC_CONF" ]; then
+    . "$OPSEC_CONF"
+fi
+
+LEVEL_TYPE="${LEVEL_TYPE:-standard}"
+DEPLOYMENT_LEVEL="${DEPLOYMENT_LEVEL:-bare-metal-standard}"
+
+echo "[opsec-boot] Level: ${DEPLOYMENT_LEVEL} (type: ${LEVEL_TYPE})"
+
+# Paranoid levels: always activate full ghost mode
+if [ "$LEVEL_TYPE" = "paranoid" ]; then
+    echo "[opsec-boot] Paranoid level detected — activating full ghost mode"
+    touch "$STATE_FILE"
+
+    if [ -x /usr/local/bin/opsec-mode.sh ]; then
+        /usr/local/bin/opsec-mode.sh on
+    else
+        echo "[opsec-boot] ERROR: opsec-mode.sh not found"
+        exit 1
+    fi
+
+    echo "[opsec-boot] Ghost mode activated at boot (paranoid level)"
+    exit 0
+fi
+
+# Standard levels: check boot marker, apply base or full accordingly
+if [ -f "$BOOT_MARKER" ]; then
+    echo "[opsec-boot] Boot marker detected — activating ghost mode"
+    touch "$STATE_FILE"
+
+    if [ -x /usr/local/bin/opsec-mode.sh ]; then
+        /usr/local/bin/opsec-mode.sh on
+    else
+        echo "[opsec-boot] ERROR: opsec-mode.sh not found"
+        exit 1
+    fi
+
+    echo "[opsec-boot] Ghost mode activated at boot (boot marker)"
+else
+    echo "[opsec-boot] Standard level, no boot marker — applying base privacy hardening"
+
+    # Apply base hardening inline (cannot source opsec-mode.sh — its exit kills the caller)
+    echo "[opsec-boot] Applying inline base hardening..."
+    sysctl -w net.ipv6.conf.all.disable_ipv6=1 >/dev/null 2>&1 || true
+    sysctl -w net.ipv6.conf.default.disable_ipv6=1 >/dev/null 2>&1 || true
+    swapoff -a 2>/dev/null || true
+    sysctl -w kernel.core_pattern='|/bin/false' >/dev/null 2>&1 || true
+
+    # Set privacy DNS
+    base_dns="${BASE_DNS:-quad9}"
+    chattr -i /etc/resolv.conf 2>/dev/null || true
+    case "$base_dns" in
+        quad9)
+            printf "nameserver 9.9.9.9\nnameserver 149.112.112.112\n" > /etc/resolv.conf
+            ;;
+        cloudflare)
+            printf "nameserver 1.1.1.1\nnameserver 1.0.0.1\n" > /etc/resolv.conf
+            ;;
+    esac
+
+    echo "[opsec-boot] Base privacy hardening applied"
+fi

opsec/scripts/opsec-check.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+# OPSEC Status Check
+
+echo "===== OPSEC Status Check ====="
+echo ""
+
+# Check for running VPN
+echo "[*] VPN Status:"
+if pgrep -x openvpn > /dev/null; then
+    echo "    [+] OpenVPN is running"
+else
+    echo "    [-] OpenVPN is NOT running"
+fi
+
+# Check for Tor
+echo ""
+echo "[*] Tor Status:"
+if systemctl is-active tor >/dev/null 2>&1; then
+    echo "    [+] Tor is running"
+else
+    echo "    [-] Tor is NOT running"
+fi
+
+# Check current connections
+echo ""
+echo "[*] Active Connections:"
+CONNECTIONS=$(ss -tupn | grep ESTAB | wc -l)
+echo "    [*] $CONNECTIONS established connections"
+
+# Check listening services
+echo ""
+echo "[*] Listening Services:"
+LISTENERS=$(ss -tupln | grep LISTEN | wc -l)
+echo "    [*] $LISTENERS listening services"
+
+# Check DNS
+echo ""
+echo "[*] DNS Configuration:"
+grep "nameserver" /etc/resolv.conf | head -3
+
+# Check for history files
+echo ""
+echo "[*] History Files:"
+for hist in ~/.bash_history ~/.zsh_history ~/.python_history ~/.mysql_history; do
+    if [ -f "$hist" ]; then
+        SIZE=$(stat -c%s "$hist" 2>/dev/null)
+        echo "    [!] $hist exists (size: $SIZE bytes)"
+    fi
+done
+
+# Check MAC address
+echo ""
+echo "[*] Network Interfaces:"
+for iface in $(ip -o link show | awk -F': ' '{print $2}' | grep -v lo); do
+    MAC=$(ip link show $iface | awk '/ether/ {print $2}')
+    echo "    [*] $iface: $MAC"
+done
+
+# Check timezone
+echo ""
+echo "[*] System Timezone:"
+echo "    [*] $(timedatectl | grep "Time zone" | awk '{print $3}')"
+
+# Check for running security tools
+echo ""
+echo "[*] Running Security Tools:"
+# Tool inventory is configurable via OPSEC_TOOL_CHECK in opsec.conf
+OPSEC_TOOL_CHECK="${OPSEC_TOOL_CHECK:-curl wget openssl gpg tor}"
+for tool in $OPSEC_TOOL_CHECK; do
+    if pgrep -f $tool > /dev/null; then
+        echo "    [!] $tool is running"
+    fi
+done
+
+echo ""
+echo "===== Check Complete ====="

opsec/scripts/opsec-harden.sh

@@ -0,0 +1,377 @@
+#!/bin/bash
+# /usr/local/bin/opsec-harden.sh — System hardening apply/revert
+# Usage: sudo opsec-harden.sh apply|revert
+#
+# Reads settings from /etc/opsec/opsec.conf
+# Handles: core dumps, swap, timezone, locale, screen lock, WebRTC,
+#          USB blocking, clipboard auto-clear, traffic jitter
+
+## NOTE: Do NOT use "set -euo pipefail" — it causes silent crashes
+## when commands like sysctl, dconf, tc, etc. return non-zero.
+## Use explicit error handling instead (|| true).
+
+if [ "$EUID" -ne 0 ]; then
+    echo "[-] Please run as root"
+    exit 1
+fi
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+BACKUP_DIR="/etc/opsec/.harden-backup"
+
+# Source shared library
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+else
+    # Minimal fallback
+    opsec_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+    opsec_red()    { echo -e "\033[38;5;196m[-] $*\033[0m"; }
+    opsec_yellow() { echo -e "\033[38;5;214m[*] $*\033[0m"; }
+    opsec_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+    opsec_load_config() {
+        [ -f /etc/opsec/opsec.conf ] && . /etc/opsec/opsec.conf
+    }
+fi
+
+mkdir -p "$BACKUP_DIR"
+opsec_load_config 2>/dev/null || true
+
+# ─── CORE DUMPS ────────────────────────────────────────────────────────────────
+
+apply_core_dumps() {
+    if [ "${HARDEN_CORE_DUMPS:-1}" = "1" ]; then
+        opsec_info "Disabling core dumps..."
+
+        # sysctl
+        sysctl -w kernel.core_pattern='|/bin/false' >/dev/null 2>&1
+        sysctl -w fs.suid_dumpable=0 >/dev/null 2>&1
+
+        # limits.d
+        cat > /etc/security/limits.d/opsec-coredump.conf << 'EOF'
+# OPSEC: Disable core dumps
+* hard core 0
+* soft core 0
+EOF
+        # systemd coredump
+        mkdir -p /etc/systemd/coredump.conf.d
+        cat > /etc/systemd/coredump.conf.d/opsec.conf << 'EOF'
+[Coredump]
+Storage=none
+ProcessSizeMax=0
+EOF
+        opsec_green "Core dumps disabled"
+    fi
+}
+
+revert_core_dumps() {
+    sysctl -w kernel.core_pattern='core' >/dev/null 2>&1
+    sysctl -w fs.suid_dumpable=1 >/dev/null 2>&1
+    rm -f /etc/security/limits.d/opsec-coredump.conf
+    rm -f /etc/systemd/coredump.conf.d/opsec.conf
+    opsec_green "Core dumps restored"
+}
+
+# ─── SWAP ──────────────────────────────────────────────────────────────────────
+
+apply_swap() {
+    if [ "${HARDEN_SWAP:-1}" = "1" ]; then
+        opsec_info "Disabling swap..."
+        swapoff -a 2>/dev/null || true
+
+        # Comment out swap entries in fstab (backup first)
+        if [ ! -f "$BACKUP_DIR/fstab.swap" ]; then
+            grep -E '^\s*[^#].*\sswap\s' /etc/fstab > "$BACKUP_DIR/fstab.swap" 2>/dev/null || true
+        fi
+        sed -i '/\sswap\s/s/^/#OPSEC# /' /etc/fstab 2>/dev/null || true
+        opsec_green "Swap disabled"
+    fi
+}
+
+revert_swap() {
+    sed -i 's/^#OPSEC# //' /etc/fstab 2>/dev/null || true
+    swapon -a 2>/dev/null || true
+    opsec_green "Swap restored"
+}
+
+# ─── IPv6 ──────────────────────────────────────────────────────────────────────
+
+apply_ipv6() {
+    if [ "${HARDEN_IPV6:-1}" = "1" ]; then
+        opsec_info "Disabling IPv6..."
+        sysctl -w net.ipv6.conf.all.disable_ipv6=1 >/dev/null
+        sysctl -w net.ipv6.conf.default.disable_ipv6=1 >/dev/null
+        opsec_green "IPv6 disabled"
+    fi
+}
+
+revert_ipv6() {
+    sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null
+    sysctl -w net.ipv6.conf.default.disable_ipv6=0 >/dev/null
+    opsec_green "IPv6 restored"
+}
+
+# ─── TIMEZONE SPOOF ────────────────────────────────────────────────────────────
+
+apply_timezone() {
+    if [ "${HARDEN_TIMEZONE_SPOOF:-0}" = "1" ]; then
+        local tz="${HARDEN_TIMEZONE_VALUE:-UTC}"
+        opsec_info "Spoofing timezone to ${tz}..."
+
+        # Backup current timezone
+        timedatectl show -p Timezone --value > "$BACKUP_DIR/timezone.orig" 2>/dev/null || true
+        timedatectl set-timezone "$tz" 2>/dev/null || {
+            ln -sf "/usr/share/zoneinfo/${tz}" /etc/localtime
+        }
+        opsec_green "Timezone set to ${tz}"
+    fi
+}
+
+revert_timezone() {
+    if [ -f "$BACKUP_DIR/timezone.orig" ]; then
+        local orig_tz
+        orig_tz=$(cat "$BACKUP_DIR/timezone.orig")
+        timedatectl set-timezone "$orig_tz" 2>/dev/null || true
+        rm -f "$BACKUP_DIR/timezone.orig"
+        opsec_green "Timezone restored to ${orig_tz}"
+    fi
+}
+
+# ─── LOCALE SPOOF ─────────────────────────────────────────────────────────────
+
+apply_locale() {
+    if [ "${HARDEN_LOCALE_SPOOF:-0}" = "1" ]; then
+        local loc="${HARDEN_LOCALE_VALUE:-en_US.UTF-8}"
+        opsec_info "Spoofing locale to ${loc}..."
+
+        # Backup
+        locale > "$BACKUP_DIR/locale.orig" 2>/dev/null || true
+        export LANG="$loc"
+        export LC_ALL="$loc"
+        echo "LANG=${loc}" > /etc/default/locale.opsec
+        opsec_green "Locale set to ${loc}"
+    fi
+}
+
+revert_locale() {
+    rm -f /etc/default/locale.opsec
+    if [ -f "$BACKUP_DIR/locale.orig" ]; then
+        rm -f "$BACKUP_DIR/locale.orig"
+    fi
+    opsec_green "Locale restored"
+}
+
+# ─── SCREEN LOCK ───────────────────────────────────────────────────────────────
+
+apply_screen_lock() {
+    if [ "${HARDEN_SCREEN_LOCK:-1}" = "1" ]; then
+        local timeout="${HARDEN_SCREEN_LOCK_TIMEOUT:-300}"
+        opsec_info "Setting screen lock timeout to ${timeout}s..."
+
+        # Try GNOME dconf (runs as user via sudo)
+        local real_user="${SUDO_USER:-$USER}"
+        if command -v dconf >/dev/null 2>&1; then
+            su - "$real_user" -c "
+                dconf write /org/gnome/desktop/session/idle-delay 'uint32 ${timeout}' 2>/dev/null
+                dconf write /org/gnome/desktop/screensaver/lock-enabled 'true' 2>/dev/null
+                dconf write /org/gnome/desktop/screensaver/lock-delay 'uint32 0' 2>/dev/null
+            " 2>/dev/null || true
+        fi
+        opsec_green "Screen lock set to ${timeout}s"
+    fi
+}
+
+revert_screen_lock() {
+    local real_user="${SUDO_USER:-$USER}"
+    if command -v dconf >/dev/null 2>&1; then
+        su - "$real_user" -c "
+            dconf write /org/gnome/desktop/session/idle-delay 'uint32 900' 2>/dev/null
+        " 2>/dev/null || true
+    fi
+    opsec_green "Screen lock restored to default"
+}
+
+# ─── WEBRTC BLOCKING ──────────────────────────────────────────────────────────
+
+apply_webrtc() {
+    if [ "${LEAK_WEBRTC_BLOCK:-1}" = "1" ]; then
+        opsec_info "Blocking WebRTC..."
+        local real_user="${SUDO_USER:-$USER}"
+        local user_home
+        user_home=$(eval echo "~${real_user}")
+
+        # Firefox profiles
+        for profile_dir in "${user_home}"/.mozilla/firefox/*.default* "${user_home}"/.mozilla/firefox/*.opsec*; do
+            [ -d "$profile_dir" ] || continue
+            cat >> "${profile_dir}/user.js" << 'EOF'
+// OPSEC: Disable WebRTC IP leak
+user_pref("media.peerconnection.enabled", false);
+user_pref("media.peerconnection.turn.disable", true);
+user_pref("media.peerconnection.use_document_iceservers", false);
+user_pref("media.peerconnection.video.enabled", false);
+user_pref("media.peerconnection.identity.timeout", 1);
+EOF
+        done
+
+        # Brave/Chromium policies
+        mkdir -p /etc/brave/policies/managed /etc/chromium/policies/managed
+        cat > /etc/brave/policies/managed/opsec-webrtc.json << 'EOF'
+{ "WebRtcIPHandling": "disable_non_proxied_udp" }
+EOF
+        cp /etc/brave/policies/managed/opsec-webrtc.json /etc/chromium/policies/managed/ 2>/dev/null || true
+        opsec_green "WebRTC blocked (Firefox + Brave/Chromium)"
+    fi
+}
+
+revert_webrtc() {
+    local real_user="${SUDO_USER:-$USER}"
+    local user_home
+    user_home=$(eval echo "~${real_user}")
+
+    for profile_dir in "${user_home}"/.mozilla/firefox/*.default* "${user_home}"/.mozilla/firefox/*.opsec*; do
+        [ -d "$profile_dir" ] || continue
+        sed -i '/OPSEC: Disable WebRTC/,/peerconnection\.identity/d' "${profile_dir}/user.js" 2>/dev/null || true
+    done
+    rm -f /etc/brave/policies/managed/opsec-webrtc.json
+    rm -f /etc/chromium/policies/managed/opsec-webrtc.json
+    opsec_green "WebRTC restrictions removed"
+}
+
+# ─── USB BLOCKING ─────────────────────────────────────────────────────────────
+
+apply_usb_block() {
+    if [ "${LEAK_USB_BLOCK:-0}" = "1" ]; then
+        opsec_info "Blocking new USB devices..."
+        echo 0 > /sys/bus/usb/drivers_autoprobe 2>/dev/null || true
+        opsec_green "USB auto-probe disabled (new devices blocked)"
+    fi
+}
+
+revert_usb_block() {
+    echo 1 > /sys/bus/usb/drivers_autoprobe 2>/dev/null || true
+    opsec_green "USB auto-probe restored"
+}
+
+# ─── CLIPBOARD AUTO-CLEAR ─────────────────────────────────────────────────────
+
+apply_clipboard_clear() {
+    if [ "${HARDEN_CLIPBOARD_CLEAR:-0}" = "1" ]; then
+        opsec_info "Starting clipboard auto-clear..."
+        # Launch background clearer (clears clipboard every 30 seconds)
+        local pidfile="/var/run/opsec-clipboard.pid"
+        if [ -f "$pidfile" ] && kill -0 "$(cat "$pidfile")" 2>/dev/null; then
+            opsec_yellow "Clipboard cleaner already running"
+            return
+        fi
+
+        (
+            while true; do
+                sleep 30
+                # Clear X clipboard
+                if command -v xclip >/dev/null 2>&1; then
+                    echo -n "" | xclip -selection clipboard 2>/dev/null || true
+                    echo -n "" | xclip -selection primary 2>/dev/null || true
+                elif command -v xsel >/dev/null 2>&1; then
+                    xsel --clipboard --clear 2>/dev/null || true
+                    xsel --primary --clear 2>/dev/null || true
+                fi
+            done
+        ) &
+        echo $! > "$pidfile"
+        opsec_green "Clipboard auto-clear active (every 30s)"
+    fi
+}
+
+revert_clipboard_clear() {
+    local pidfile="/var/run/opsec-clipboard.pid"
+    if [ -f "$pidfile" ]; then
+        kill "$(cat "$pidfile")" 2>/dev/null || true
+        rm -f "$pidfile"
+    fi
+    opsec_green "Clipboard auto-clear stopped"
+}
+
+# ─── TRAFFIC JITTER ───────────────────────────────────────────────────────────
+
+apply_traffic_jitter() {
+    if [ "${TRAFFIC_JITTER_ENABLED:-0}" = "1" ]; then
+        local ms="${TRAFFIC_JITTER_MS:-50}"
+        opsec_info "Adding ${ms}ms traffic jitter..."
+
+        # Find primary outbound interface
+        local iface
+        iface=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}' | head -1)
+        if [ -n "$iface" ]; then
+            # Remove existing qdisc first
+            tc qdisc del dev "$iface" root 2>/dev/null || true
+            tc qdisc add dev "$iface" root netem delay "${ms}ms" "${ms}ms" distribution normal 2>/dev/null || {
+                opsec_yellow "tc not available — jitter skipped"
+                return
+            }
+            echo "$iface" > "$BACKUP_DIR/jitter-iface"
+            opsec_green "Traffic jitter active on ${iface} (${ms}ms)"
+        else
+            opsec_yellow "No outbound interface found for jitter"
+        fi
+    fi
+}
+
+revert_traffic_jitter() {
+    if [ -f "$BACKUP_DIR/jitter-iface" ]; then
+        local iface
+        iface=$(cat "$BACKUP_DIR/jitter-iface")
+        tc qdisc del dev "$iface" root 2>/dev/null || true
+        rm -f "$BACKUP_DIR/jitter-iface"
+        opsec_green "Traffic jitter removed from ${iface}"
+    fi
+}
+
+# ─── MAIN ──────────────────────────────────────────────────────────────────────
+
+do_apply() {
+    echo ""
+    opsec_hdr "APPLYING SYSTEM HARDENING"
+    echo ""
+    apply_core_dumps
+    apply_swap
+    apply_ipv6
+    apply_timezone
+    apply_locale
+    apply_screen_lock
+    apply_webrtc
+    # Ghost-mode-only features — skip when called from mode_base (OPSEC_BASE_ONLY=1)
+    if [ "${OPSEC_BASE_ONLY:-0}" != "1" ]; then
+        apply_usb_block
+        apply_clipboard_clear
+        apply_traffic_jitter
+    else
+        opsec_info "Base-only mode — skipping USB block, clipboard clear, traffic jitter"
+    fi
+    echo ""
+    opsec_green "All hardening measures applied"
+}
+
+do_revert() {
+    echo ""
+    opsec_hdr "REVERTING SYSTEM HARDENING"
+    echo ""
+    revert_core_dumps
+    revert_swap
+    revert_ipv6
+    revert_timezone
+    revert_locale
+    revert_screen_lock
+    revert_webrtc
+    revert_usb_block
+    revert_clipboard_clear
+    revert_traffic_jitter
+    echo ""
+    opsec_green "All hardening measures reverted"
+}
+
+case "${1:-}" in
+    apply)  do_apply ;;
+    revert) do_revert ;;
+    *)
+        echo "Usage: $(basename "$0") apply|revert"
+        exit 1
+        ;;
+esac

opsec/scripts/opsec-hostname-randomize.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# OPSEC Hostname Randomization
+# Config-aware: reads HOSTNAME_PATTERN and HOSTNAME_CUSTOM_PREFIX from /etc/opsec/opsec.conf
+# Patterns: desktop (desktop-XXXX), random (8 random chars), custom (PREFIX-XXXX)
+
+if [ "$EUID" -ne 0 ]; then
+    echo "Please run as root"
+    exit 1
+fi
+
+# Source config if available
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+    opsec_load_config 2>/dev/null || true
+else
+    opsec_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+    opsec_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+    opsec_dim()    { echo -e "\033[38;5;244m    $*\033[0m"; }
+fi
+
+# Config values with defaults
+PATTERN="${HOSTNAME_PATTERN:-desktop}"
+PREFIX="${HOSTNAME_CUSTOM_PREFIX:-}"
+
+RAND_HEX=$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ')
+OLD_HOSTNAME=$(hostname)
+
+case "$PATTERN" in
+    desktop)
+        NEW_HOSTNAME="desktop-${RAND_HEX}"
+        ;;
+    random)
+        NEW_HOSTNAME=$(head -c 4 /dev/urandom | od -An -tx1 | tr -d ' ')
+        ;;
+    custom)
+        NEW_HOSTNAME="${PREFIX}-${RAND_HEX}"
+        ;;
+    *)
+        NEW_HOSTNAME="desktop-${RAND_HEX}"
+        ;;
+esac
+
+opsec_info "Randomizing hostname..."
+opsec_dim "Old: ${OLD_HOSTNAME}"
+opsec_dim "New: ${NEW_HOSTNAME} (pattern: ${PATTERN})"
+
+# Set hostname via hostnamectl (persistent)
+hostnamectl set-hostname "$NEW_HOSTNAME" 2>/dev/null || {
+    echo "$NEW_HOSTNAME" > /etc/hostname
+    hostname "$NEW_HOSTNAME"
+}
+
+# Update /etc/hosts to match
+if grep -q "$OLD_HOSTNAME" /etc/hosts 2>/dev/null; then
+    sed -i "s/$OLD_HOSTNAME/$NEW_HOSTNAME/g" /etc/hosts
+fi
+
+# Ensure localhost entries exist
+if ! grep -q "127.0.0.1.*$NEW_HOSTNAME" /etc/hosts; then
+    sed -i "/127\.0\.0\.1/s/$/ $NEW_HOSTNAME/" /etc/hosts
+fi
+
+opsec_green "Hostname randomized to: ${NEW_HOSTNAME}"

opsec/scripts/opsec-killswitch.sh

@@ -0,0 +1,261 @@
+#!/bin/bash
+# OPSEC Kill Switch — iptables rules to block non-Tor/VPN traffic
+# Config-aware: reads KILLSWITCH_* settings from /etc/opsec/opsec.conf
+# Usage: opsec-killswitch.sh on|off|status
+
+if [ "$EUID" -ne 0 ]; then
+    echo "Please run as root"
+    exit 1
+fi
+
+# Source config if available
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+    opsec_load_config 2>/dev/null || true
+else
+    opsec_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+    opsec_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+fi
+
+# Config values with defaults
+ALLOW_DHCP="${KILLSWITCH_ALLOW_DHCP:-1}"
+ALLOW_OPENVPN="${KILLSWITCH_ALLOW_OPENVPN:-1}"
+ALLOW_WIREGUARD="${KILLSWITCH_ALLOW_WIREGUARD:-1}"
+EXTRA_PORTS="${KILLSWITCH_EXTRA_PORTS:-}"
+TRANS_PORT="${TOR_TRANS_PORT:-9040}"
+DNS_PORT="${TOR_DNS_PORT:-5353}"
+
+CHAIN="GP_FW"
+TOR_UID=$(id -u debian-tor 2>/dev/null || id -u tor 2>/dev/null || echo "")
+KS_LOG="/run/opsec/debug.log"
+mkdir -p /run/opsec 2>/dev/null || true
+KS_ERR=$(mktemp /run/opsec/.ks-err.XXXXXX 2>/dev/null || mktemp /tmp/.ks-err.XXXXXX)
+KS_FAIL=0
+trap 'rm -f "$KS_ERR"' EXIT
+
+ks_log() { echo "[$(date -Is)] [killswitch] $*" >> "$KS_LOG"; }
+
+# Wrapper that logs failures and tracks failure count
+ipt() {
+    if ! iptables "$@" 2>>"$KS_ERR"; then
+        ks_log "FAILED: iptables $*  — $(cat "$KS_ERR" 2>/dev/null)"
+        cat "$KS_ERR" >&2 2>/dev/null
+        KS_FAIL=$((KS_FAIL + 1))
+        : > "$KS_ERR" 2>/dev/null
+        return 1
+    fi
+    : > "$KS_ERR" 2>/dev/null
+    return 0
+}
+
+ipt6() {
+    if ! ip6tables "$@" 2>>"$KS_ERR"; then
+        ks_log "FAILED: ip6tables $*  — $(cat "$KS_ERR" 2>/dev/null)"
+        KS_FAIL=$((KS_FAIL + 1))
+        : > "$KS_ERR" 2>/dev/null
+        return 1
+    fi
+    : > "$KS_ERR" 2>/dev/null
+    return 0
+}
+
+ks_filter_on() {
+    opsec_info "Arming OPSEC kill switch (filter-only)..."
+    ks_log "=== KILL SWITCH FILTER-ONLY ==="
+    ks_log "TOR_UID=${TOR_UID:-NONE}"
+    ks_log "ALLOW_DHCP=${ALLOW_DHCP} ALLOW_OPENVPN=${ALLOW_OPENVPN} ALLOW_WIREGUARD=${ALLOW_WIREGUARD}"
+    ks_log "EXTRA_PORTS=${EXTRA_PORTS:-none}"
+
+    iptables -N "$CHAIN" 2>/dev/null || iptables -F "$CHAIN"
+
+    ipt -A "$CHAIN" -o lo -j ACCEPT
+    ipt -A "$CHAIN" -i lo -j ACCEPT
+    ipt -A "$CHAIN" -d 127.0.0.0/8 -j ACCEPT
+    ipt -A "$CHAIN" -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+    if [ -n "$TOR_UID" ]; then
+        ipt -A "$CHAIN" -m owner --uid-owner "$TOR_UID" -j ACCEPT
+    else
+        ks_log "WARNING: No TOR_UID — Tor will be blocked by filter!"
+    fi
+
+    ipt -A "$CHAIN" -o tun+ -j ACCEPT
+    ipt -A "$CHAIN" -i tun+ -j ACCEPT
+    ipt -A "$CHAIN" -o wg+ -j ACCEPT
+    ipt -A "$CHAIN" -i wg+ -j ACCEPT
+
+    [ "$ALLOW_DHCP" = "1" ] && ipt -A "$CHAIN" -p udp --dport 67:68 --sport 67:68 -j ACCEPT
+    [ "$ALLOW_OPENVPN" = "1" ] && { ipt -A "$CHAIN" -p udp --dport 1194 -j ACCEPT; ipt -A "$CHAIN" -p tcp --dport 1194 -j ACCEPT; }
+    [ "$ALLOW_WIREGUARD" = "1" ] && ipt -A "$CHAIN" -p udp --dport 51820 -j ACCEPT
+
+    if [ -n "$EXTRA_PORTS" ]; then
+        local IFS=','
+        for rule in $EXTRA_PORTS; do
+            local proto=$(echo "$rule" | cut -d: -f1)
+            local port=$(echo "$rule" | cut -d: -f2)
+            [ -n "$proto" ] && [ -n "$port" ] && ipt -A "$CHAIN" -p "$proto" --dport "$port" -j ACCEPT
+        done
+    fi
+
+    ipt -A "$CHAIN" -j DROP
+    iptables -D OUTPUT -j "$CHAIN" 2>/dev/null
+    ipt -I OUTPUT 1 -j "$CHAIN"
+
+    # IPv6
+    ip6tables -N "$CHAIN" 2>/dev/null || ip6tables -F "$CHAIN"
+    ipt6 -A "$CHAIN" -o lo -j ACCEPT
+    ipt6 -A "$CHAIN" -j DROP
+    ip6tables -D OUTPUT -j "$CHAIN" 2>/dev/null
+    ipt6 -I OUTPUT 1 -j "$CHAIN"
+
+    ks_log "Filter-only lockdown active (no NAT)"
+    opsec_green "Kill switch filter ARMED (pre-bootstrap)"
+}
+
+ks_nat_on() {
+    opsec_info "Arming NAT transparent proxy..."
+    ks_log "=== NAT PROXY ON ==="
+
+    local NAT_CHAIN="GP_NAT"
+
+    # Remove jump before flush to prevent brief bypass window
+    iptables -t nat -D OUTPUT -j "$NAT_CHAIN" 2>/dev/null
+    iptables -t nat -N "$NAT_CHAIN" 2>/dev/null || iptables -t nat -F "$NAT_CHAIN"
+
+    # Tor UID RETURN
+    [ -n "$TOR_UID" ] && ipt -t nat -A "$NAT_CHAIN" -p tcp -m owner --uid-owner "$TOR_UID" -j RETURN
+
+    # VPN RETURN — BEFORE DNS redirect
+    ipt -t nat -A "$NAT_CHAIN" -o tun+ -j RETURN
+    ipt -t nat -A "$NAT_CHAIN" -o wg+ -j RETURN
+
+    # DNS redirect
+    ipt -t nat -A "$NAT_CHAIN" -p udp --dport 53 -j REDIRECT --to-ports "$DNS_PORT"
+    ipt -t nat -A "$NAT_CHAIN" -p tcp --dport 53 -j REDIRECT --to-ports "$DNS_PORT"
+
+    # Loopback RETURN
+    ipt -t nat -A "$NAT_CHAIN" -d 127.0.0.0/8 -j RETURN
+
+    # TCP catch-all TransPort
+    ipt -t nat -A "$NAT_CHAIN" -p tcp -j REDIRECT --to-ports "$TRANS_PORT"
+
+    # Install jump
+    ipt -t nat -I OUTPUT 1 -j "$NAT_CHAIN"
+
+    # Verify chain was populated (at least 3 rules: DNS redirect + TCP catch-all + others)
+    local nat_count
+    nat_count=$(iptables -t nat -L "$NAT_CHAIN" --line-numbers 2>/dev/null | tail -n +3 | wc -l)
+    ks_log "NAT chain rule count: ${nat_count}"
+
+    if [ "$nat_count" -lt 3 ]; then
+        ks_log "WARNING: NAT chain has only ${nat_count} rules — falling back to direct OUTPUT rules"
+        opsec_info "NAT chain underpopulated (${nat_count} rules) — using direct OUTPUT fallback"
+
+        # Remove the jump to the empty/broken chain
+        iptables -t nat -D OUTPUT -j "$NAT_CHAIN" 2>/dev/null
+        iptables -t nat -F "$NAT_CHAIN" 2>/dev/null
+        iptables -t nat -X "$NAT_CHAIN" 2>/dev/null
+
+        # Direct OUTPUT rules as fallback
+        [ -n "$TOR_UID" ] && iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner "$TOR_UID" -j RETURN 2>/dev/null
+        iptables -t nat -A OUTPUT -o tun+ -j RETURN 2>/dev/null
+        iptables -t nat -A OUTPUT -o wg+ -j RETURN 2>/dev/null
+        iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports "$DNS_PORT" 2>/dev/null
+        iptables -t nat -A OUTPUT -p tcp --dport 53 -j REDIRECT --to-ports "$DNS_PORT" 2>/dev/null
+        iptables -t nat -A OUTPUT -d 127.0.0.0/8 -j RETURN 2>/dev/null
+        iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports "$TRANS_PORT" 2>/dev/null
+
+        local fb_count
+        fb_count=$(iptables -t nat -L OUTPUT --line-numbers 2>/dev/null | tail -n +3 | wc -l)
+        ks_log "Fallback OUTPUT NAT rule count: ${fb_count}"
+    fi
+
+    if [ "$KS_FAIL" -gt 0 ]; then
+        ks_log "WARNING: ${KS_FAIL} iptables commands failed during NAT setup"
+        opsec_info "WARNING: ${KS_FAIL} iptables rule(s) failed — check /run/opsec/debug.log"
+        return 1
+    fi
+
+    ks_log "NAT transparent proxy armed"
+    opsec_green "Kill switch fully ARMED — Tor + NAT active"
+}
+
+ks_on() {
+    ks_filter_on
+    ks_nat_on
+}
+
+ks_off() {
+    opsec_info "Disarming OPSEC kill switch..."
+    ks_log "=== KILL SWITCH OFF ==="
+
+    # Filter chain
+    iptables -D OUTPUT -j "$CHAIN" 2>/dev/null
+    iptables -F "$CHAIN" 2>/dev/null
+    iptables -X "$CHAIN" 2>/dev/null
+
+    # NAT chain (config-independent teardown)
+    local NAT_CHAIN="GP_NAT"
+    iptables -t nat -D OUTPUT -j "$NAT_CHAIN" 2>/dev/null
+    iptables -t nat -F "$NAT_CHAIN" 2>/dev/null
+    iptables -t nat -X "$NAT_CHAIN" 2>/dev/null
+
+    # Clean up fallback direct OUTPUT NAT rules (if chain approach failed during arm)
+    # Loop-delete to catch duplicates — keeps removing until no match left
+    local _fb_cleaned=0
+    while iptables -t nat -D OUTPUT -p tcp -j REDIRECT --to-ports "$TRANS_PORT" 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    while iptables -t nat -D OUTPUT -p udp --dport 53 -j REDIRECT --to-ports "$DNS_PORT" 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    while iptables -t nat -D OUTPUT -p tcp --dport 53 -j REDIRECT --to-ports "$DNS_PORT" 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    while iptables -t nat -D OUTPUT -d 127.0.0.0/8 -j RETURN 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    while iptables -t nat -D OUTPUT -o tun+ -j RETURN 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    while iptables -t nat -D OUTPUT -o wg+ -j RETURN 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    if [ -n "$TOR_UID" ]; then
+        while iptables -t nat -D OUTPUT -p tcp -m owner --uid-owner "$TOR_UID" -j RETURN 2>/dev/null; do _fb_cleaned=$((_fb_cleaned+1)); done
+    fi
+    [ "$_fb_cleaned" -gt 0 ] && ks_log "Cleaned ${_fb_cleaned} fallback NAT OUTPUT rules"
+
+    # IPv6
+    ip6tables -D OUTPUT -j "$CHAIN" 2>/dev/null
+    ip6tables -F "$CHAIN" 2>/dev/null
+    ip6tables -X "$CHAIN" 2>/dev/null
+
+    # Flush conntrack to clear stale NAT entries
+    conntrack -F 2>/dev/null && ks_log "conntrack flushed" || true
+
+    ks_log "Kill switch disarmed"
+    opsec_green "Kill switch DISARMED — normal traffic allowed"
+}
+
+ks_status() {
+    if iptables -L "$CHAIN" >/dev/null 2>&1; then
+        opsec_green "Kill switch is ARMED"
+        echo ""
+        echo "IPv4 rules:"
+        iptables -L "$CHAIN" -v -n --line-numbers
+        echo ""
+        echo "NAT chain:"
+        if iptables -t nat -L GP_NAT >/dev/null 2>&1; then
+            iptables -t nat -L GP_NAT -v -n --line-numbers
+        else
+            echo "  (not armed)"
+        fi
+        echo ""
+        echo "IPv6 rules:"
+        ip6tables -L "$CHAIN" -v -n --line-numbers 2>/dev/null
+    else
+        opsec_info "Kill switch is OFF"
+    fi
+}
+
+case "${1}" in
+    on)         ks_on ;;
+    filter-on)  ks_filter_on ;;
+    nat-on)     ks_nat_on ;;
+    off)        ks_off ;;
+    status)     ks_status ;;
+    *)
+        echo "Usage: $(basename "$0") on|off|filter-on|nat-on|status"
+        exit 1
+        ;;
+esac

opsec/scripts/opsec-log-rotate.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# /usr/local/bin/opsec-log-rotate.sh — Secure log rotation and cleanup
+# Truncates sensitive logs, shreds rotated files, clears journald + shell histories
+# Runs via cron (configurable LOG_ROTATION_HOURS in /etc/opsec/opsec.conf)
+
+set -euo pipefail
+
+if [ "$EUID" -ne 0 ]; then
+    echo "[-] Please run as root"
+    exit 1
+fi
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+_HAS_LIB=false
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+    opsec_load_config 2>/dev/null || true
+    _HAS_LIB=true
+else
+    opsec_green()  { echo "[+] $*"; }
+    opsec_info()   { echo "[~] $*"; }
+fi
+
+LOG_FILE="/var/log/opsec-log-rotate.log"
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+
+log() { echo "[$TIMESTAMP] $*" >> "$LOG_FILE"; }
+
+log "Starting secure log rotation"
+
+# ─── TRUNCATE SENSITIVE SYSTEM LOGS ────────────────────────────────────────────
+SENSITIVE_LOGS=(
+    /var/log/auth.log
+    /var/log/syslog
+    /var/log/kern.log
+    /var/log/daemon.log
+    /var/log/messages
+    /var/log/user.log
+    /var/log/mail.log
+    /var/log/debug
+    /var/log/wtmp
+    /var/log/btmp
+    /var/log/lastlog
+    /var/log/faillog
+)
+
+for logfile in "${SENSITIVE_LOGS[@]}"; do
+    if [ -f "$logfile" ]; then
+        truncate -s 0 "$logfile" 2>/dev/null || true
+        log "Truncated: $logfile"
+    fi
+done
+
+# ─── SHRED ROTATED LOG FILES (SSD-aware) ─────────────────────────────────────
+for rotated in /var/log/*.gz /var/log/*.1 /var/log/*.old; do
+    if [ -f "$rotated" ]; then
+        if [ "$_HAS_LIB" = "true" ]; then
+            opsec_secure_delete "$rotated"
+        else
+            shred -fuz "$rotated" 2>/dev/null || rm -f "$rotated"
+        fi
+        log "Wiped: $rotated"
+    fi
+done
+
+# ─── CLEAR JOURNALD ───────────────────────────────────────────────────────────
+if command -v journalctl >/dev/null 2>&1; then
+    journalctl --vacuum-time=1h 2>/dev/null || true
+    log "Journald vacuumed (1h retention)"
+fi
+
+# ─── CLEAR SHELL HISTORIES ────────────────────────────────────────────────────
+for user_home in /home/* /root; do
+    [ -d "$user_home" ] || continue
+    for hist_file in .bash_history .zsh_history .python_history .psql_history .mysql_history .lesshst .viminfo; do
+        if [ -f "${user_home}/${hist_file}" ]; then
+            if [ "$_HAS_LIB" = "true" ]; then
+                opsec_secure_delete "${user_home}/${hist_file}"
+            else
+                shred -fuz "${user_home}/${hist_file}" 2>/dev/null || truncate -s 0 "${user_home}/${hist_file}" 2>/dev/null || true
+            fi
+            log "Cleared: ${user_home}/${hist_file}"
+        fi
+    done
+done
+
+# ─── CLEAR RECENTLY USED ──────────────────────────────────────────────────────
+for user_home in /home/* /root; do
+    [ -d "$user_home" ] || continue
+    rm -f "${user_home}/.local/share/recently-used.xbel" 2>/dev/null || true
+done
+
+# ─── CLEAR TEMP FILES ─────────────────────────────────────────────────────────
+find /tmp -type f -mmin +60 -delete 2>/dev/null || true
+find /var/tmp -type f -mmin +60 -delete 2>/dev/null || true
+
+log "Secure log rotation complete"

opsec/scripts/opsec-mode-toggle.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# opsec-mode-toggle — Keyboard shortcut wrapper for opsec-mode on/off
+# Toggles between standard and advanced OPSEC mode
+# Bind to: Ctrl+Alt+\
+
+STATE_FILE="/var/run/opsec-advanced.enabled"
+BOOTSTRAP_STOP="/var/run/opsec-bootstrap-stop"
+DEBUG_LOG="/var/log/opsec-debug.log"
+
+toggle_log() {
+    echo "[$(date -Is)] [toggle] $*" >> "$DEBUG_LOG" 2>/dev/null || true
+}
+
+if [ -f "$STATE_FILE" ]; then
+    # Turning OFF — signal bootstrap loop to stop, then run mode_off
+    toggle_log "Toggling OFF (state file exists)"
+    # Create stop signal so mode_on's bootstrap loop exits immediately
+    # (needs root — use pkexec for a one-liner)
+    pkexec bash -c "touch ${BOOTSTRAP_STOP} && /usr/local/bin/opsec-mode.sh off"
+    toggle_log "Toggle OFF complete (exit: $?)"
+else
+    toggle_log "Toggling ON (no state file)"
+    pkexec /usr/local/bin/opsec-mode.sh on
+    toggle_log "Toggle ON complete (exit: $?)"
+fi

opsec/scripts/opsec-monitor.sh

@@ -0,0 +1,119 @@
+#!/bin/bash
+# /usr/local/bin/opsec-monitor.sh — Background connection monitor
+# Watches for non-Tor/non-VPN outbound connections, new listening ports,
+# unexpected DNS queries. Sends desktop notifications + logs.
+# Usage: sudo opsec-monitor.sh start|stop|status
+
+set -euo pipefail
+
+PIDFILE="/var/run/opsec-monitor.pid"
+LOGFILE="/var/log/opsec-monitor.log"
+INTERVAL=10
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+else
+    opsec_green()  { echo "[+] $*"; }
+    opsec_red()    { echo "[-] $*"; }
+    opsec_info()   { echo "[~] $*"; }
+fi
+
+notify() {
+    local msg="$1" urgency="${2:-normal}"
+    local real_user="${SUDO_USER:-$USER}"
+    # Desktop notification
+    su - "$real_user" -c "DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u "$real_user")/bus notify-send -u '$urgency' 'OPSEC Monitor' '$msg'" 2>/dev/null || true
+    # Log
+    echo "[$(date '+%H:%M:%S')] $msg" >> "$LOGFILE"
+}
+
+monitor_loop() {
+    local known_listeners=""
+    local tor_uid
+    tor_uid=$(id -u debian-tor 2>/dev/null || id -u tor 2>/dev/null || echo "")
+
+    while true; do
+        # ─── Check for non-Tor/VPN outbound connections ────────────────────
+        local suspicious
+        suspicious=$(ss -tunp 2>/dev/null | grep ESTAB | grep -v '127.0.0.1' | grep -v '::1' | \
+            grep -v "tun\|wg\|tor\|${tor_uid:-NOOP}" | \
+            grep -v ':9050\|:5353\|:1194\|:51820' || true)
+
+        if [ -n "$suspicious" ]; then
+            local count
+            count=$(echo "$suspicious" | wc -l)
+            notify "ALERT: ${count} non-Tor/VPN outbound connection(s) detected" "critical"
+        fi
+
+        # ─── Check for new listening ports ─────────────────────────────────
+        local current_listeners
+        current_listeners=$(ss -tlnp 2>/dev/null | tail -n +2 | awk '{print $4}' | sort)
+
+        if [ -n "$known_listeners" ] && [ "$current_listeners" != "$known_listeners" ]; then
+            local new_ports
+            new_ports=$(comm -13 <(echo "$known_listeners") <(echo "$current_listeners") 2>/dev/null || true)
+            if [ -n "$new_ports" ]; then
+                notify "New listening port(s): ${new_ports}" "critical"
+            fi
+        fi
+        known_listeners="$current_listeners"
+
+        # ─── Check for unexpected DNS queries ──────────────────────────────
+        local dns_leaks
+        dns_leaks=$(ss -tunp 2>/dev/null | grep ':53 ' | grep -v '127.0.0.1' | grep -v '::1' || true)
+        if [ -n "$dns_leaks" ]; then
+            notify "DNS LEAK: Non-local DNS query detected" "critical"
+        fi
+
+        sleep "$INTERVAL"
+    done
+}
+
+do_start() {
+    if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
+        opsec_info "Monitor already running (PID: $(cat "$PIDFILE"))"
+        return
+    fi
+
+    monitor_loop &
+    echo $! > "$PIDFILE"
+    opsec_green "Monitor started (PID: $!, logging to ${LOGFILE})"
+}
+
+do_stop() {
+    if [ -f "$PIDFILE" ]; then
+        local pid
+        pid=$(cat "$PIDFILE")
+        kill "$pid" 2>/dev/null || true
+        # Kill child processes
+        pkill -P "$pid" 2>/dev/null || true
+        rm -f "$PIDFILE"
+        opsec_green "Monitor stopped"
+    else
+        opsec_info "Monitor not running"
+    fi
+}
+
+do_status() {
+    if [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; then
+        opsec_green "Monitor running (PID: $(cat "$PIDFILE"))"
+        if [ -f "$LOGFILE" ]; then
+            echo ""
+            echo "Last 10 log entries:"
+            tail -10 "$LOGFILE" 2>/dev/null || true
+        fi
+    else
+        opsec_info "Monitor not running"
+    fi
+}
+
+case "${1:-}" in
+    start)  do_start ;;
+    stop)   do_stop ;;
+    status) do_status ;;
+    *)
+        echo "Usage: $(basename "$0") start|stop|status"
+        exit 1
+        ;;
+esac

opsec/scripts/opsec-preflight.sh

@@ -0,0 +1,291 @@
+#!/bin/bash
+# /usr/local/bin/opsec-preflight.sh — OPSEC Preflight Verification Gate
+# Verifies all required security controls are active for the current mode.
+#
+# Usage:
+#   opsec-preflight.sh              Human-readable HUD
+#   opsec-preflight.sh --score      Pass/fail count
+#   opsec-preflight.sh --enforce    Exit 1 if any applicable check fails
+#   opsec-preflight.sh --base       Only run base checks (standard mode)
+#   opsec-preflight.sh --full       Run base + ghost checks
+#   opsec-preflight.sh --base --enforce   Base checks, exit 1 on fail
+#   opsec-preflight.sh --full --enforce   Full checks, exit 1 on fail
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+OPSEC_CONF="/etc/opsec/opsec.conf"
+PREFLIGHT_LOG="/var/log/opsec-preflight.log"
+
+# Source library
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+    opsec_load_config 2>/dev/null || true
+elif [ -f "$OPSEC_CONF" ]; then
+    . "$OPSEC_CONF"
+fi
+
+# Fallback colors if lib not loaded
+type opsec_green >/dev/null 2>&1 || {
+    opsec_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+    opsec_red()    { echo -e "\033[38;5;196m[-] $*\033[0m"; }
+    opsec_yellow() { echo -e "\033[38;5;214m[*] $*\033[0m"; }
+    opsec_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+    opsec_cyan()   { echo -e "\033[38;5;51m[>] $*\033[0m"; }
+    opsec_dim()    { echo -e "\033[38;5;244m    $*\033[0m"; }
+    opsec_hdr()    { echo -e "\033[38;5;51m━━━ \033[38;5;201m$*\033[38;5;51m ━━━\033[0m"; }
+}
+
+# ─── PARSE ARGS ───────────────────────────────────────────────────────────────
+MODE_SCORE=false
+MODE_ENFORCE=false
+CHECK_LEVEL=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --score)   MODE_SCORE=true ;;
+        --enforce) MODE_ENFORCE=true ;;
+        --base)    CHECK_LEVEL="base" ;;
+        --full)    CHECK_LEVEL="full" ;;
+        *)         echo "Usage: opsec-preflight.sh [--score|--enforce] [--base|--full]"; exit 1 ;;
+    esac
+    shift
+done
+
+# Auto-detect check level if not specified
+if [ -z "$CHECK_LEVEL" ]; then
+    if [ -f /var/run/opsec-advanced.enabled ]; then
+        CHECK_LEVEL="full"
+    else
+        CHECK_LEVEL="base"
+    fi
+fi
+
+# ─── ENVIRONMENT ──────────────────────────────────────────────────────────────
+LEVEL="${DEPLOYMENT_LEVEL:-bare-metal-standard}"
+LTYPE="${LEVEL_TYPE:-standard}"
+
+is_cloud() {
+    case "$LEVEL" in
+        cloud-*) return 0 ;;
+        *)       return 1 ;;
+    esac
+}
+
+is_bare_metal() {
+    case "$LEVEL" in
+        bare-metal-*) return 0 ;;
+        *)            return 1 ;;
+    esac
+}
+
+# ─── CHECK ENGINE ─────────────────────────────────────────────────────────────
+PASS=0
+FAIL=0
+SKIP=0
+FAILURES=""
+
+check() {
+    local name="$1" result="$2" detail="${3:-}"
+    if [ "$result" = "pass" ]; then
+        PASS=$((PASS + 1))
+        $MODE_SCORE || opsec_green "PASS  ${name}${detail:+  ${detail}}"
+    elif [ "$result" = "fail" ]; then
+        FAIL=$((FAIL + 1))
+        FAILURES="${FAILURES}\n  - ${name}${detail:+: ${detail}}"
+        $MODE_SCORE || opsec_red "FAIL  ${name}${detail:+  ${detail}}"
+    elif [ "$result" = "skip" ]; then
+        SKIP=$((SKIP + 1))
+        $MODE_SCORE || opsec_dim "SKIP  ${name}${detail:+  (${detail})}"
+    fi
+}
+
+# ─── BASE CHECKS (always run) ────────────────────────────────────────────────
+run_base_checks() {
+    $MODE_SCORE || opsec_cyan "Base Privacy Checks"
+
+    # 1. MAC randomized (bare-metal only)
+    if is_bare_metal; then
+        local pif cur_mac first_octet first_dec
+        pif=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}' | head -1)
+        if [ -n "$pif" ]; then
+            cur_mac=$(ip link show "$pif" 2>/dev/null | awk '/ether/ {print $2}')
+            first_octet=$(echo "$cur_mac" | cut -d: -f1)
+            first_dec=$((16#${first_octet})) 2>/dev/null || first_dec=0
+            if (( first_dec & 2 )); then
+                check "MAC randomized" "pass" "${pif}: ${cur_mac}"
+            else
+                check "MAC randomized" "fail" "${pif}: ${cur_mac} (hardware address)"
+            fi
+        else
+            check "MAC randomized" "skip" "no primary interface"
+        fi
+    else
+        check "MAC randomized" "skip" "cloud deployment"
+    fi
+
+    # 2. IPv6 disabled
+    local ipv6_all
+    ipv6_all=$(sysctl -n net.ipv6.conf.all.disable_ipv6 2>/dev/null || echo "0")
+    if [ "$ipv6_all" = "1" ]; then
+        check "IPv6 disabled" "pass"
+    else
+        check "IPv6 disabled" "fail" "net.ipv6.conf.all.disable_ipv6=${ipv6_all}"
+    fi
+
+    # 3. Core dumps disabled
+    local core_pat
+    core_pat=$(sysctl -n kernel.core_pattern 2>/dev/null)
+    if [[ "$core_pat" == *"/bin/false"* ]] || [[ "$core_pat" == *"devnull"* ]]; then
+        check "Core dumps disabled" "pass"
+    else
+        check "Core dumps disabled" "fail" "core_pattern=${core_pat}"
+    fi
+
+    # 4. Swap disabled
+    local swap_count
+    swap_count=$(swapon --show --noheadings 2>/dev/null | wc -l)
+    if [ "$swap_count" -eq 0 ]; then
+        check "Swap disabled" "pass"
+    else
+        check "Swap disabled" "fail" "${swap_count} swap device(s) active"
+    fi
+
+    # 5. DNS is privacy resolver (not ISP)
+    local dns_server
+    dns_server=$(awk '/^nameserver/ {print $2; exit}' /etc/resolv.conf 2>/dev/null)
+    case "$dns_server" in
+        127.0.0.1|127.0.0.53|9.9.9.9|149.112.112.112|1.1.1.1|1.0.0.1)
+            check "DNS privacy resolver" "pass" "${dns_server}"
+            ;;
+        *)
+            check "DNS privacy resolver" "fail" "${dns_server} (possibly ISP)"
+            ;;
+    esac
+
+    # 6. WebRTC blocked (if Firefox present)
+    if [ -d "$HOME/.mozilla/firefox" ] || [ -d "/root/.mozilla/firefox" ]; then
+        local userjs_found=false
+        local profile_dirs
+        profile_dirs=$(find /home/*/.mozilla/firefox /root/.mozilla/firefox -maxdepth 1 -name '*.default*' 2>/dev/null | head -3)
+        for pd in $profile_dirs; do
+            if [ -f "$pd/user.js" ] && grep -q "media.peerconnection.enabled.*false" "$pd/user.js" 2>/dev/null; then
+                userjs_found=true
+                break
+            fi
+        done
+        if $userjs_found; then
+            check "WebRTC blocked" "pass" "user.js configured"
+        else
+            check "WebRTC blocked" "fail" "no user.js with WebRTC disable found"
+        fi
+    else
+        check "WebRTC blocked" "skip" "Firefox not detected"
+    fi
+}
+
+# ─── GHOST CHECKS (only when ghost mode active) ──────────────────────────────
+run_ghost_checks() {
+    $MODE_SCORE || opsec_cyan "Ghost Mode Checks"
+
+    # 1. VPN or Tor active
+    local vpn_if tor_ok=false
+    vpn_if=$(ip -o link show 2>/dev/null | awk -F': ' '{print $2}' | grep -E '^(tun|wg)' | head -1)
+    ss -tln 2>/dev/null | grep -q ':9050 ' && tor_ok=true
+
+    if [ -n "$vpn_if" ] || $tor_ok; then
+        local detail=""
+        [ -n "$vpn_if" ] && detail="VPN:${vpn_if}"
+        $tor_ok && detail="${detail:+${detail} + }Tor:9050"
+        check "VPN/Tor active" "pass" "$detail"
+    else
+        check "VPN/Tor active" "fail" "no tun/wg interface, no Tor on :9050"
+    fi
+
+    # 2. Kill switch armed
+    if [ -f /var/run/opsec-breakglass.active ]; then
+        check "Kill switch armed" "fail" "BREAK-GLASS active — kill switch intentionally dropped"
+    elif iptables -L GP_FW >/dev/null 2>&1; then
+        check "Kill switch armed" "pass"
+    else
+        check "Kill switch armed" "fail" "GP_FW chain not found"
+    fi
+
+    # 3. DNS locked to Tor
+    local dns_server
+    dns_server=$(awk '/^nameserver/ {print $2; exit}' /etc/resolv.conf 2>/dev/null)
+    if [ "$dns_server" = "127.0.0.1" ]; then
+        check "DNS locked to Tor" "pass"
+    else
+        check "DNS locked to Tor" "fail" "DNS=${dns_server} (expected 127.0.0.1)"
+    fi
+
+    # 4. Hostname randomized (bare-metal only)
+    if is_bare_metal; then
+        local cur_hostname
+        cur_hostname=$(hostname)
+        # Check if hostname looks randomized (not default patterns like kali, debian, localhost)
+        case "$cur_hostname" in
+            kali|debian|localhost|ubuntu|parrot)
+                check "Hostname randomized" "fail" "hostname=${cur_hostname} (appears default)"
+                ;;
+            *)
+                check "Hostname randomized" "pass" "${cur_hostname}"
+                ;;
+        esac
+    else
+        check "Hostname randomized" "skip" "cloud deployment"
+    fi
+
+    # 5. resolv.conf immutable
+    if lsattr /etc/resolv.conf 2>/dev/null | grep -q 'i'; then
+        check "resolv.conf immutable" "pass"
+    else
+        check "resolv.conf immutable" "fail" "chattr +i not set"
+    fi
+}
+
+# ─── EXECUTE CHECKS ──────────────────────────────────────────────────────────
+
+if ! $MODE_SCORE; then
+    echo ""
+    opsec_hdr "OPSEC PREFLIGHT — ${CHECK_LEVEL^^}"
+    opsec_dim "Level: ${LEVEL} (${LTYPE})"
+    echo ""
+fi
+
+run_base_checks
+
+if [ "$CHECK_LEVEL" = "full" ]; then
+    $MODE_SCORE || echo ""
+    run_ghost_checks
+fi
+
+# ─── RESULTS ──────────────────────────────────────────────────────────────────
+
+TOTAL=$((PASS + FAIL))
+
+if $MODE_SCORE; then
+    echo "${PASS}/${TOTAL} passed"
+    [ "$FAIL" -gt 0 ] && exit 1
+    exit 0
+fi
+
+echo ""
+opsec_hdr "PREFLIGHT RESULT"
+
+if [ "$FAIL" -eq 0 ]; then
+    opsec_green "ALL CHECKS PASSED (${PASS}/${TOTAL})"
+    [ "$SKIP" -gt 0 ] && opsec_dim "${SKIP} checks skipped (not applicable)"
+else
+    opsec_red "FAILED: ${FAIL}/${TOTAL} checks"
+    opsec_dim "Passed: ${PASS} | Failed: ${FAIL} | Skipped: ${SKIP}"
+    echo -e "\033[38;5;196mFailures:${FAILURES}\033[0m"
+    # Log failures
+    echo "[$(date -Is)] PREFLIGHT ${CHECK_LEVEL^^}: ${PASS}/${TOTAL} passed, ${FAIL} failed${FAILURES}" >> "$PREFLIGHT_LOG" 2>/dev/null || true
+fi
+echo ""
+
+if $MODE_ENFORCE && [ "$FAIL" -gt 0 ]; then
+    exit 1
+fi
+
+exit 0

opsec/scripts/opsec-sentry.sh

@@ -0,0 +1,115 @@
+#!/bin/bash
+# /usr/local/bin/opsec-sentry.sh — Continuous Threat Sentry Manager
+# Manages the sentry daemon for background threat detection
+# Usage: opsec-sentry.sh start|stop|status|restart
+
+set -euo pipefail
+
+SENTRY_BIN="${SENTRY_BIN:-/usr/local/bin/sentry-daemon}"
+PID_FILE="/var/run/opsec-sentry.pid"
+LOG_FILE="/var/log/opsec-sentry.log"
+ALERT_HOOK=""
+
+# Source config for alert hook if available
+OPSEC_CONF="/etc/opsec/opsec.conf"
+[ -f "$OPSEC_CONF" ] && . "$OPSEC_CONF"
+
+# Color output helpers
+_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+_red()    { echo -e "\033[38;5;196m[-] $*\033[0m"; }
+_yellow() { echo -e "\033[38;5;214m[*] $*\033[0m"; }
+_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+
+is_running() {
+    [ -f "$PID_FILE" ] && kill -0 "$(cat "$PID_FILE" 2>/dev/null)" 2>/dev/null
+}
+
+sentry_start() {
+    if is_running; then
+        _yellow "Sentry already running (PID $(cat "$PID_FILE"))"
+        return 0
+    fi
+
+    if [ ! -x "$SENTRY_BIN" ]; then
+        _red "Sentry binary not found at ${SENTRY_BIN}"
+        return 1
+    fi
+
+    local cmd="$SENTRY_BIN --daemon --sentry-pid $PID_FILE --sentry-log $LOG_FILE"
+    [ -n "$ALERT_HOOK" ] && cmd="$cmd --alert-hook $ALERT_HOOK"
+
+    # Run sentry in daemon mode
+    $cmd &
+    local pid=$!
+    echo "$pid" > "$PID_FILE"
+
+    # Verify it started
+    sleep 1
+    if kill -0 "$pid" 2>/dev/null; then
+        _green "Sentry daemon started (PID ${pid})"
+        _info "Log: ${LOG_FILE}"
+    else
+        rm -f "$PID_FILE"
+        _red "Sentry failed to start — check ${LOG_FILE}"
+        return 1
+    fi
+}
+
+sentry_stop() {
+    if ! is_running; then
+        _yellow "Sentry not running"
+        rm -f "$PID_FILE"
+        return 0
+    fi
+
+    local pid
+    pid=$(cat "$PID_FILE" 2>/dev/null)
+    kill "$pid" 2>/dev/null
+    # Wait for graceful shutdown
+    local i=0
+    while kill -0 "$pid" 2>/dev/null && [ $i -lt 10 ]; do
+        sleep 1
+        i=$((i + 1))
+    done
+
+    if kill -0 "$pid" 2>/dev/null; then
+        kill -9 "$pid" 2>/dev/null
+    fi
+
+    rm -f "$PID_FILE"
+    _green "Sentry daemon stopped"
+}
+
+sentry_status() {
+    if is_running; then
+        local pid
+        pid=$(cat "$PID_FILE" 2>/dev/null)
+        _green "Sentry ACTIVE (PID ${pid})"
+        if [ -f "$LOG_FILE" ]; then
+            local lines
+            lines=$(wc -l < "$LOG_FILE" 2>/dev/null || echo "0")
+            _info "Log entries: ${lines}"
+            local last
+            last=$(tail -1 "$LOG_FILE" 2>/dev/null)
+            [ -n "$last" ] && _info "Last: ${last}"
+        fi
+    else
+        _yellow "Sentry NOT running"
+        rm -f "$PID_FILE"
+    fi
+}
+
+case "${1:-}" in
+    start)   sentry_start ;;
+    stop)    sentry_stop ;;
+    restart)
+        sentry_stop
+        sleep 1
+        sentry_start
+        ;;
+    status)  sentry_status ;;
+    *)
+        echo "Usage: opsec-sentry.sh start|stop|status|restart"
+        exit 1
+        ;;
+esac

opsec/scripts/opsec-ssh-check.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+# /usr/local/bin/opsec-ssh-check.sh — SSH Honeypot Detection
+# Checks target SSH banners for known honeypot signatures
+# Alias: ssh-safe
+#
+# Usage: opsec-ssh-check.sh <host> [port]
+
+set -euo pipefail
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+else
+    opsec_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+    opsec_red()    { echo -e "\033[38;5;196m[-] $*\033[0m"; }
+    opsec_yellow() { echo -e "\033[38;5;214m[*] $*\033[0m"; }
+    opsec_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+    opsec_cyan()   { echo -e "\033[38;5;51m[>] $*\033[0m"; }
+    opsec_hdr()    { echo -e "\033[38;5;51m━━━ \033[38;5;201m$*\033[38;5;51m ━━━\033[0m"; }
+fi
+
+HOST="${1:-}"
+PORT="${2:-22}"
+
+if [ -z "$HOST" ]; then
+    echo "Usage: $(basename "$0") <host> [port]"
+    echo "       ssh-safe <host> [port]"
+    exit 1
+fi
+
+opsec_hdr "SSH HONEYPOT CHECK: ${HOST}:${PORT}"
+echo ""
+
+SUSPICIOUS=0
+
+# ─── GRAB BANNER ───────────────────────────────────────────────────────────────
+opsec_info "Grabbing SSH banner..."
+BANNER=$(timeout 5 bash -c "echo '' | nc -w 3 $HOST $PORT 2>/dev/null" || true)
+
+if [ -z "$BANNER" ]; then
+    opsec_yellow "No banner received — port may be filtered or service is not SSH"
+    exit 1
+fi
+
+opsec_cyan "Banner: ${BANNER}"
+echo ""
+
+# ─── KNOWN HONEYPOT SIGNATURES ─────────────────────────────────────────────────
+
+# Cowrie
+if echo "$BANNER" | grep -qiE 'SSH-2\.0-OpenSSH_6\.(0|1|2|6)p1.*Debian'; then
+    opsec_red "COWRIE SIGNATURE: Old OpenSSH version commonly used by Cowrie honeypot"
+    SUSPICIOUS=$((SUSPICIOUS + 3))
+fi
+
+# Kippo
+if echo "$BANNER" | grep -qi 'SSH-1\.99-OpenSSH_5\.1p1'; then
+    opsec_red "KIPPO SIGNATURE: SSH-1.99 with OpenSSH_5.1p1 is a known Kippo default"
+    SUSPICIOUS=$((SUSPICIOUS + 3))
+fi
+
+# HonSSH
+if echo "$BANNER" | grep -qi 'HonSSH'; then
+    opsec_red "HONSH SIGNATURE: Banner explicitly mentions HonSSH"
+    SUSPICIOUS=$((SUSPICIOUS + 5))
+fi
+
+# Generic old version check
+if echo "$BANNER" | grep -qE 'OpenSSH_[345]\.' ; then
+    opsec_yellow "SUSPICIOUS: Very old OpenSSH version (common in honeypots)"
+    SUSPICIOUS=$((SUSPICIOUS + 2))
+fi
+
+# Unusual SSH protocol version
+if echo "$BANNER" | grep -q 'SSH-1\.'; then
+    opsec_yellow "SUSPICIOUS: SSHv1 protocol (deprecated, often honeypot)"
+    SUSPICIOUS=$((SUSPICIOUS + 2))
+fi
+
+# ─── KEY EXCHANGE CHECK ────────────────────────────────────────────────────────
+opsec_info "Checking key exchange algorithms..."
+
+KEX_OUTPUT=$(timeout 5 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+    -o BatchMode=yes -o ConnectTimeout=3 -v -p "$PORT" "check@${HOST}" 2>&1 || true)
+
+# Check for weak/unusual key types
+if echo "$KEX_OUTPUT" | grep -qi 'ssh-dss'; then
+    opsec_yellow "SUSPICIOUS: DSA host key (often seen in honeypots)"
+    SUSPICIOUS=$((SUSPICIOUS + 1))
+fi
+
+# Check for unusually fast key exchange (honeypots often respond instantly)
+if echo "$KEX_OUTPUT" | grep -qi 'Connection reset\|Connection refused'; then
+    opsec_info "Connection dropped (may be rate-limited or filtered)"
+fi
+
+# ─── TIMING CHECK ─────────────────────────────────────────────────────────────
+opsec_info "Checking authentication timing..."
+AUTH_START=$(date +%s%N)
+timeout 3 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+    -o BatchMode=yes -o ConnectTimeout=3 -p "$PORT" "probe@${HOST}" 2>/dev/null || true
+AUTH_END=$(date +%s%N)
+AUTH_MS=$(( (AUTH_END - AUTH_START) / 1000000 ))
+
+if [ "$AUTH_MS" -lt 50 ] && [ "$AUTH_MS" -gt 0 ]; then
+    opsec_yellow "SUSPICIOUS: Unusually fast auth response (${AUTH_MS}ms) — possible honeypot"
+    SUSPICIOUS=$((SUSPICIOUS + 1))
+else
+    opsec_info "Auth response time: ${AUTH_MS}ms"
+fi
+
+# ─── VERDICT ───────────────────────────────────────────────────────────────────
+echo ""
+if [ "$SUSPICIOUS" -ge 3 ]; then
+    opsec_red "VERDICT: HIGH RISK — Likely honeypot (score: ${SUSPICIOUS})"
+    opsec_red "DO NOT connect to this host for operations"
+elif [ "$SUSPICIOUS" -ge 1 ]; then
+    opsec_yellow "VERDICT: MODERATE RISK — Some anomalies detected (score: ${SUSPICIOUS})"
+    opsec_yellow "Proceed with caution"
+else
+    opsec_green "VERDICT: LOW RISK — No honeypot signatures detected (score: ${SUSPICIOUS})"
+fi
+echo ""

opsec/scripts/opsec-toggle.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# OPSEC Toggle — single entry point for keyboard shortcut + desktop file
+# Uses pkexec directly on opsec-mode.sh for proper polkit policy matching
+OPSEC_MODE="/usr/local/bin/opsec-mode.sh"
+STATE_FILE="/var/run/opsec-advanced.enabled"
+
+[ ! -x "$OPSEC_MODE" ] && exit 1
+
+if [ -f "$STATE_FILE" ]; then
+    # Turning OFF — opsec-mode.sh off handles bootstrap stop signal internally
+    if [ "$EUID" -eq 0 ] 2>/dev/null; then
+        "$OPSEC_MODE" off
+    else
+        pkexec "$OPSEC_MODE" off
+    fi
+else
+    # Turning ON — pkexec prompts for auth via polkit policy
+    if [ "$EUID" -eq 0 ] 2>/dev/null; then
+        "$OPSEC_MODE" on
+    else
+        pkexec "$OPSEC_MODE" on
+    fi
+fi

opsec/scripts/opsec-traffic-blend.sh

@@ -0,0 +1,180 @@
+#!/bin/bash
+# /usr/local/bin/opsec-traffic-blend.sh — Decoy Traffic Blending Daemon
+# Generates background browsing noise through Tor/VPN to blend tool traffic
+# with normal-looking web activity. Ghost mode only.
+# Usage: opsec-traffic-blend.sh start|stop|status
+
+set -euo pipefail
+
+PID_FILE="/var/run/opsec-traffic-blend.pid"
+LOG_FILE="/var/log/opsec-traffic-blend.log"
+
+# Source config
+OPSEC_CONF="/etc/opsec/opsec.conf"
+[ -f "$OPSEC_CONF" ] && . "$OPSEC_CONF"
+
+SOCKS_PORT="${TOR_SOCKS_PORT:-9050}"
+# Mean interval in seconds (Poisson distribution approximation)
+BLEND_INTERVAL="${TRAFFIC_BLEND_INTERVAL:-30}"
+
+# Color helpers
+_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+_red()    { echo -e "\033[38;5;196m[-] $*\033[0m"; }
+_yellow() { echo -e "\033[38;5;214m[*] $*\033[0m"; }
+
+# Benign URLs to simulate normal browsing (mix of news, tech, social)
+DECOY_URLS=(
+    "https://en.wikipedia.org/wiki/Special:Random"
+    "https://www.bbc.com/news"
+    "https://news.ycombinator.com"
+    "https://www.reuters.com"
+    "https://stackoverflow.com/questions"
+    "https://github.com/trending"
+    "https://www.reddit.com/r/technology/.json"
+    "https://www.weather.gov"
+    "https://httpbin.org/get"
+    "https://www.kernel.org"
+    "https://www.python.org"
+    "https://www.debian.org"
+    "https://archive.org"
+    "https://www.mozilla.org"
+    "https://duckduckgo.com/?q=weather"
+    "https://lite.cnn.com"
+    "https://text.npr.org"
+)
+
+# Random delay using Poisson-like distribution (exponential inter-arrival)
+poisson_delay() {
+    # Approximate exponential distribution using bash
+    # -ln(U) * mean where U is uniform(0,1)
+    local mean="$1"
+    local rand
+    rand=$((RANDOM % 1000 + 1))
+    # Approximate: -ln(rand/1000) * mean
+    # Using awk for floating point
+    awk -v r="$rand" -v m="$mean" 'BEGIN {
+        u = r / 1000.0;
+        if (u < 0.001) u = 0.001;
+        delay = -log(u) * m;
+        if (delay < 5) delay = 5;
+        if (delay > 120) delay = 120;
+        printf "%d\n", delay;
+    }'
+}
+
+is_running() {
+    [ -f "$PID_FILE" ] && kill -0 "$(cat "$PID_FILE" 2>/dev/null)" 2>/dev/null
+}
+
+blend_loop() {
+    local url_count=${#DECOY_URLS[@]}
+
+    echo "[$(date -Is)] Traffic blend daemon started (mean interval: ${BLEND_INTERVAL}s)" >> "$LOG_FILE"
+
+    while true; do
+        # Pick a random URL
+        local idx=$((RANDOM % url_count))
+        local url="${DECOY_URLS[$idx]}"
+
+        # Determine proxy method
+        local curl_opts=("--silent" "--output" "/dev/null" "--max-time" "15")
+
+        # Use Tor SOCKS if available
+        if ss -tln 2>/dev/null | grep -q ":${SOCKS_PORT} "; then
+            curl_opts+=("--socks5-hostname" "127.0.0.1:${SOCKS_PORT}")
+        fi
+
+        # Add realistic headers
+        curl_opts+=("-H" "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0")
+        curl_opts+=("-H" "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
+        curl_opts+=("-H" "Accept-Language: en-US,en;q=0.5")
+
+        # Make the request
+        curl "${curl_opts[@]}" "$url" 2>/dev/null || true
+
+        # Calculate next delay (Poisson-distributed)
+        local delay
+        delay=$(poisson_delay "$BLEND_INTERVAL")
+
+        sleep "$delay"
+    done
+}
+
+blend_start() {
+    if ! [ -f /var/run/opsec-advanced.enabled ]; then
+        _yellow "Traffic blending requires ghost mode to be active"
+        return 1
+    fi
+
+    if is_running; then
+        _yellow "Traffic blend already running (PID $(cat "$PID_FILE"))"
+        return 0
+    fi
+
+    # Start the blend loop as a background process
+    blend_loop &
+    local pid=$!
+    echo "$pid" > "$PID_FILE"
+    disown "$pid"
+
+    sleep 1
+    if kill -0 "$pid" 2>/dev/null; then
+        _green "Traffic blend started (PID ${pid}, mean interval ${BLEND_INTERVAL}s)"
+    else
+        rm -f "$PID_FILE"
+        _red "Traffic blend failed to start"
+        return 1
+    fi
+}
+
+blend_stop() {
+    if ! is_running; then
+        _yellow "Traffic blend not running"
+        rm -f "$PID_FILE"
+        return 0
+    fi
+
+    local pid
+    pid=$(cat "$PID_FILE" 2>/dev/null)
+    kill "$pid" 2>/dev/null || true
+
+    # Wait for process to stop
+    local i=0
+    while kill -0 "$pid" 2>/dev/null && [ $i -lt 5 ]; do
+        sleep 1
+        i=$((i + 1))
+    done
+
+    kill -9 "$pid" 2>/dev/null || true
+    rm -f "$PID_FILE"
+
+    echo "[$(date -Is)] Traffic blend daemon stopped" >> "$LOG_FILE"
+    _green "Traffic blend stopped"
+}
+
+blend_status() {
+    if is_running; then
+        local pid
+        pid=$(cat "$PID_FILE" 2>/dev/null)
+        _green "Traffic blend ACTIVE (PID ${pid})"
+        _yellow "Mean interval: ${BLEND_INTERVAL}s"
+    else
+        _yellow "Traffic blend NOT running"
+        rm -f "$PID_FILE"
+    fi
+}
+
+case "${1:-}" in
+    start)   blend_start ;;
+    stop)    blend_stop ;;
+    restart)
+        blend_stop
+        sleep 1
+        blend_start
+        ;;
+    status)  blend_status ;;
+    *)
+        echo "Usage: opsec-traffic-blend.sh start|stop|status|restart"
+        exit 1
+        ;;
+esac

opsec/scripts/opsec-widget-launch.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+# OPSEC Widget Launcher — positions and launches the Conky widget
+# Usage: opsec-widget-launch.sh [position]
+#
+# Positions:
+#   tl = top-left       tc = top-center       tr = top-right
+#   bl = bottom-left    bc = bottom-center     br = bottom-right
+#
+# Default: tr (top-right)
+# Uses the theme system — regenerates config from /etc/opsec/themes/
+
+CONKY_DIR="$HOME/.config/conky"
+CONF="$CONKY_DIR/conky-opsec-widget.conf"
+POS="${1:-tr}"
+
+# Map shorthand to conky alignment + gaps
+case "$POS" in
+    tl) ALIGN="top_left";     GAP_X=15;  GAP_Y=15 ;;
+    tc) ALIGN="top_middle";   GAP_X=0;   GAP_Y=15 ;;
+    tr) ALIGN="top_right";    GAP_X=15;  GAP_Y=60 ;;
+    bl) ALIGN="bottom_left";  GAP_X=15;  GAP_Y=60 ;;
+    bc) ALIGN="bottom_middle"; GAP_X=0;  GAP_Y=60 ;;
+    br) ALIGN="bottom_right"; GAP_X=15;  GAP_Y=60 ;;
+    *)
+        echo "Usage: $(basename "$0") [tl|tc|tr|bl|bc|br]"
+        echo ""
+        echo "  tl = top-left       tc = top-center       tr = top-right"
+        echo "  bl = bottom-left    bc = bottom-center     br = bottom-right"
+        exit 1
+        ;;
+esac
+
+# Kill existing widget and stale cache daemon
+killall conky 2>/dev/null
+pkill -f 'conky-opsec-cache\.sh' 2>/dev/null
+rm -f /tmp/.opsec-cache/netinfo 2>/dev/null
+sleep 0.3
+
+# Load theme from opsec config
+OPSEC_CONF="/etc/opsec/opsec.conf"
+THEME="default"
+[ -f "$OPSEC_CONF" ] && THEME=$(grep "^WIDGET_THEME=" "$OPSEC_CONF" 2>/dev/null | cut -d'"' -f2)
+[ -z "$THEME" ] && THEME="default"
+
+THEME_FILE="/etc/opsec/themes/${THEME}.theme"
+if [ -f "$THEME_FILE" ]; then
+    . "$THEME_FILE"
+else
+    echo "Theme '${THEME}' not found, using defaults"
+    THEME_LABEL="Default"
+    CONKY_BG="0d1117"
+    CONKY_COLOR0="df2020"; CONKY_COLOR1="33ff33"; CONKY_COLOR2="3a8fd6"
+    CONKY_COLOR3="0d1117"; CONKY_COLOR4="1f6feb"; CONKY_COLOR5="58a6ff"
+    CONKY_COLOR6="79c0ff"; CONKY_COLOR7="c9d1d9"; CONKY_COLOR8="1f6feb"
+    CONKY_COLOR9="484f58"
+fi
+
+# Generate config with theme colors and chosen position
+mkdir -p "$CONKY_DIR"
+cat > "$CONF" << EOF
+-- OPSEC Status Widget — OPSEC Status Widget
+-- Theme: ${THEME} (${THEME_LABEL:-Custom})
+-- Position: ${ALIGN}
+
+conky.config = {
+    alignment = '${ALIGN}',
+    gap_x = ${GAP_X},
+    gap_y = ${GAP_Y},
+    minimum_width = 400,
+    minimum_height = 200,
+    maximum_width = 420,
+
+    own_window = true,
+    own_window_type = 'normal',
+    own_window_transparent = false,
+    own_window_argb_visual = true,
+    own_window_argb_value = 210,
+    own_window_colour = '${CONKY_BG:-0d1117}',
+    own_window_hints = 'undecorated,below,sticky,skip_taskbar,skip_pager',
+
+    xinerama_head = 0,
+
+    double_buffer = true,
+    draw_shades = true,
+    default_shade_color = '000000',
+    draw_outline = false,
+    draw_borders = true,
+    border_inner_margin = 12,
+    border_outer_margin = 4,
+    border_width = 1,
+    border_colour = '${CONKY_COLOR4:-1f6feb}',
+    stippled_borders = 0,
+
+    use_xft = true,
+    font = 'JetBrains Mono:size=10',
+    override_utf8_locale = true,
+
+    default_color = 'b0b0b0',
+    color0 = '${CONKY_COLOR0:-df2020}',
+    color1 = '${CONKY_COLOR1:-33ff33}',
+    color2 = '${CONKY_COLOR2:-3a8fd6}',
+    color3 = '${CONKY_COLOR3:-0d1117}',
+    color4 = '${CONKY_COLOR4:-1f6feb}',
+    color5 = '${CONKY_COLOR5:-58a6ff}',
+    color6 = '${CONKY_COLOR6:-79c0ff}',
+    color7 = '${CONKY_COLOR7:-c9d1d9}',
+    color8 = '${CONKY_COLOR8:-1f6feb}',
+    color9 = '${CONKY_COLOR9:-484f58}',
+
+    update_interval = 3,
+    total_run_times = 0,
+
+    cpu_avg_samples = 2,
+    no_buffers = true,
+    text_buffer_size = 8192,
+    short_units = true,
+};
+
+conky.text = [[
+\${execpi 5 ~/.config/conky/conky-opsec-status.sh}
+]];
+EOF
+
+# Launch
+conky -c "$CONF" &
+disown
+echo "OPSEC widget launched: $ALIGN (theme: $THEME)"

opsec/scripts/opsec-wifi-check.sh

@@ -0,0 +1,120 @@
+#!/bin/bash
+# /usr/local/bin/opsec-wifi-check.sh — Wireless Evil Twin Detection
+# Periodic scan for AP changes, open networks, BSSID anomalies
+# Usage: opsec-wifi-check.sh [scan|watch]
+
+set -euo pipefail
+
+OPSEC_LIB="/usr/local/lib/opsec/opsec-lib.sh"
+if [ -f "$OPSEC_LIB" ]; then
+    . "$OPSEC_LIB"
+else
+    opsec_green()  { echo -e "\033[38;5;49m[+] $*\033[0m"; }
+    opsec_red()    { echo -e "\033[38;5;196m[-] $*\033[0m"; }
+    opsec_yellow() { echo -e "\033[38;5;214m[*] $*\033[0m"; }
+    opsec_info()   { echo -e "\033[38;5;39m[~] $*\033[0m"; }
+    opsec_cyan()   { echo -e "\033[38;5;51m[>] $*\033[0m"; }
+    opsec_hdr()    { echo -e "\033[38;5;51m━━━ \033[38;5;201m$*\033[38;5;51m ━━━\033[0m"; }
+fi
+
+STATE_DIR="/var/run/opsec-wifi"
+mkdir -p "$STATE_DIR"
+
+notify() {
+    local msg="$1" urgency="${2:-normal}"
+    local real_user="${SUDO_USER:-$USER}"
+    su - "$real_user" -c "DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u "$real_user")/bus notify-send -u '$urgency' 'OPSEC WiFi' '$msg'" 2>/dev/null || true
+}
+
+do_scan() {
+    opsec_hdr "WIRELESS SECURITY SCAN"
+    echo ""
+
+    # Check if connected to WiFi
+    local connected_ssid connected_bssid connected_security
+    connected_ssid=$(nmcli -t -f active,ssid dev wifi 2>/dev/null | grep '^yes:' | cut -d: -f2)
+    connected_bssid=$(nmcli -t -f active,bssid dev wifi 2>/dev/null | grep '^yes:' | cut -d: -f2-)
+    connected_security=$(nmcli -t -f active,security dev wifi 2>/dev/null | grep '^yes:' | cut -d: -f2)
+
+    if [ -z "$connected_ssid" ]; then
+        opsec_info "Not connected to any WiFi network"
+        return
+    fi
+
+    opsec_cyan "Connected: ${connected_ssid} (${connected_bssid})"
+    echo ""
+
+    # ─── Check for open/unencrypted network ────────────────────────────────
+    if [ -z "$connected_security" ] || [ "$connected_security" = "--" ]; then
+        opsec_red "WARNING: Connected to OPEN (unencrypted) network!"
+        notify "Connected to OPEN WiFi: ${connected_ssid}" "critical"
+    elif echo "$connected_security" | grep -qi 'WEP'; then
+        opsec_red "WARNING: WEP encryption (trivially crackable)"
+        notify "WiFi using WEP: ${connected_ssid}" "critical"
+    else
+        opsec_green "Encryption: ${connected_security}"
+    fi
+
+    # ─── Scan for duplicate SSIDs (evil twin indicators) ───────────────────
+    opsec_info "Scanning for duplicate SSIDs..."
+    local scan_results
+    scan_results=$(nmcli -t -f ssid,bssid,signal,security dev wifi list --rescan yes 2>/dev/null || true)
+
+    if [ -n "$scan_results" ]; then
+        # Find APs with same SSID as connected but different BSSID
+        local duplicates
+        duplicates=$(echo "$scan_results" | grep "^${connected_ssid}:" | grep -v "${connected_bssid}" || true)
+
+        if [ -n "$duplicates" ]; then
+            local dup_count
+            dup_count=$(echo "$duplicates" | wc -l)
+            opsec_yellow "ALERT: ${dup_count} other AP(s) broadcasting '${connected_ssid}':"
+            echo "$duplicates" | while IFS=: read -r ssid bssid signal security; do
+                echo -e "  \033[38;5;214m  BSSID: ${bssid}  Signal: ${signal}  Security: ${security}\033[0m"
+            done
+            notify "Evil twin risk: ${dup_count} duplicate AP(s) for ${connected_ssid}" "critical"
+        else
+            opsec_green "No duplicate SSIDs detected"
+        fi
+    fi
+
+    # ─── BSSID change detection ────────────────────────────────────────────
+    local state_file="${STATE_DIR}/${connected_ssid}.bssid"
+    if [ -f "$state_file" ]; then
+        local prev_bssid
+        prev_bssid=$(cat "$state_file")
+        if [ "$prev_bssid" != "$connected_bssid" ]; then
+            opsec_red "BSSID CHANGED for '${connected_ssid}'!"
+            opsec_red "  Previous: ${prev_bssid}"
+            opsec_red "  Current:  ${connected_bssid}"
+            notify "BSSID changed for ${connected_ssid}: ${prev_bssid} → ${connected_bssid}" "critical"
+        else
+            opsec_green "BSSID consistent with last scan"
+        fi
+    fi
+    echo "$connected_bssid" > "$state_file"
+
+    echo ""
+}
+
+do_watch() {
+    opsec_info "Starting continuous WiFi monitoring (Ctrl+C to stop)..."
+    while true; do
+        do_scan
+        echo ""
+        opsec_info "Next scan in 60 seconds..."
+        sleep 60
+    done
+}
+
+case "${1:-scan}" in
+    scan)  do_scan ;;
+    watch) do_watch ;;
+    *)
+        echo "Usage: $(basename "$0") [scan|watch]"
+        echo ""
+        echo "  scan  — One-time wireless security scan (default)"
+        echo "  watch — Continuous monitoring (60s interval)"
+        exit 1
+        ;;
+esac

phantom/README.md

@@ -0,0 +1,97 @@
+# phantom — Privacy Server Deployer
+
+Deploy self-hosted privacy infrastructure with a single command. Supports cloud providers, existing servers, and local deployment.
+
+## Server Types
+
+| Service | Status | Description |
+|---|---|---|
+| Matrix + Element | Ready | Encrypted messaging homeserver with web client |
+| WireGuard VPN | Ready | Private VPN server with client config generation |
+| Pi-hole DNS | Ready | Ad-blocking DNS server (Docker-based) |
+| All-in-One | Ready | Multiple services on one server with nginx reverse proxy |
+| Nextcloud | Stub | Self-hosted file sync and collaboration |
+| Vaultwarden | Stub | Self-hosted Bitwarden password manager |
+| Jellyfin | Stub | Self-hosted media server |
+| Mail-in-a-Box | Stub | Self-hosted email |
+
+## Deployment Targets
+
+- **Linode** — Automated provisioning via API
+- **AWS EC2** — Automated provisioning via API
+- **FlokiNET** — Register pre-provisioned server
+- **Existing server** — Any server with SSH access
+- **Local** — Deploy directly on the current machine
+
+## Quick Start
+
+```bash
+# Requirements
+pip install ansible pyyaml   # or: apt install ansible python3-yaml
+# For AWS deployments:
+pip install boto3
+ansible-galaxy collection install amazon.aws
+
+# Launch
+python3 phantom.py
+```
+
+Select a service, choose a deployment target, provide configuration, and phantom handles the rest:
+1. Provisions infrastructure (if cloud)
+2. Applies base hardening (UFW, fail2ban, SSH lockdown, kernel hardening)
+3. Deploys the selected service
+4. Saves deployment info to `logs/`
+
+## All-in-One Deployment
+
+The all-in-one option deploys multiple services on a single server with:
+- Nginx reverse proxy with TLS termination
+- Let's Encrypt certificates via Certbot
+- Per-service vhost routing
+
+**Warning**: Running multiple services on one server means a compromise of one service risks all services. Use for lab/testing or personal use where convenience outweighs isolation. For production, deploy one service per server.
+
+## Local Deployment
+
+Select "Local (this machine)" as the deployment target to install services directly on your current system. This is useful for:
+- Home lab servers
+- Raspberry Pi deployments
+- LAN-only services
+- Testing before cloud deployment
+
+No SSH key generation or remote provisioning is needed for local deployments.
+
+## Provider Setup
+
+### Linode
+1. Create an API token at https://cloud.linode.com/profile/tokens
+2. Select "Linode" when prompted and paste your token
+
+### AWS
+1. Create an IAM user with EC2 permissions
+2. Generate access keys
+3. Select "AWS" when prompted and provide credentials
+
+### FlokiNET
+1. Provision a server through FlokiNET's control panel
+2. Select "FlokiNET" and provide the server IP
+
+## Project Structure
+
+```
+phantom/
+├── phantom.py          # Main CLI
+├── modules/            # Per-service configuration
+├── playbooks/          # Ansible playbooks
+│   ├── common/         # Shared hardening
+│   ├── matrix/         # Synapse + Element
+│   ├── vpn/            # WireGuard
+│   ├── dns/            # Pi-hole
+│   └── all_in_one/     # Multi-service composer
+├── providers/          # Cloud provisioning
+└── logs/               # Deployment artifacts
+```
+
+## License
+
+MIT

phantom/ansible.cfg

@@ -0,0 +1,8 @@
+[defaults]
+host_key_checking = False
+retry_files_enabled = False
+stdout_callback = yaml
+timeout = 30
+
+[ssh_connection]
+pipelining = True

phantom/modules/__init__.py

@@ -0,0 +1 @@
+# phantom modules

phantom/modules/all_in_one.py

@@ -0,0 +1,126 @@
+"""All-in-one single-server deployment module.
+
+Composes multiple services onto a single server with nginx reverse proxy
+and TLS via Certbot. Includes clear warnings about single-server risks.
+"""
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+YELLOW = "\033[38;5;214m"
+RED = "\033[38;5;196m"
+RESET = "\033[0m"
+
+SERVICES = [
+    ("matrix", "Matrix + Element", "Encrypted messaging"),
+    ("vpn", "WireGuard VPN", "Private VPN server"),
+    ("dns", "Pi-hole DNS", "Ad-blocking DNS"),
+    ("cloud", "Nextcloud", "File sync (stub)"),
+    ("vault", "Vaultwarden", "Password manager (stub)"),
+    ("media", "Jellyfin", "Media server (stub)"),
+]
+
+
+def gather_config(config):
+    """Gather all-in-one deployment configuration."""
+    # Risk warning
+    print(f"\n{RED}  ╔═══════════════════════════════════════════════════════╗{RESET}")
+    print(f"  {RED}║{RESET}  {YELLOW}WARNING: Single-Server Deployment{RESET}                     {RED}║{RESET}")
+    print(f"  {RED}║{RESET}                                                       {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  Running multiple services on one server means:       {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  - A compromise of one service risks ALL services     {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  - Resource contention between services               {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  - Single point of failure for all infrastructure     {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  - More complex backup and recovery                   {RED}║{RESET}")
+    print(f"  {RED}║{RESET}                                                       {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  For production use, prefer one service per server.   {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  This mode is intended for lab/testing or personal    {RED}║{RESET}")
+    print(f"  {RED}║{RESET}  use where convenience outweighs isolation.           {RED}║{RESET}")
+    print(f"  {RED}╚═══════════════════════════════════════════════════════╝{RESET}")
+
+    confirm = input(f"\n  {YELLOW}Acknowledge risks and continue? [y/N]:{RESET} ").strip().lower()
+    if confirm != "y":
+        return None
+
+    # Service selection
+    print(f"\n{CYAN}  ┌─ Select Services ────────────────────────────────────┐{RESET}")
+    for i, (svc_id, label, desc) in enumerate(SERVICES, 1):
+        print(f"  {CYAN}│{RESET}  {WHITE}{i}{RESET}) {label:<20} {GREY}{desc}{RESET}")
+    print(f"  {CYAN}└────────────────────────────────────────────────────────┘{RESET}")
+
+    selections = input(
+        f"\n  {CYAN}Services to deploy (comma-separated, e.g. 1,2,3):{RESET} "
+    ).strip()
+
+    selected_services = []
+    for s in selections.split(","):
+        s = s.strip()
+        try:
+            idx = int(s) - 1
+            if 0 <= idx < len(SERVICES):
+                selected_services.append(SERVICES[idx][0])
+        except ValueError:
+            pass
+
+    if not selected_services:
+        print(f"  {RED}No services selected.{RESET}")
+        return None
+
+    # Warn about stub services
+    STUB_SERVICES = {"cloud", "vault", "media", "email"}
+    stubs_selected = [s for s in selected_services if s in STUB_SERVICES]
+    if stubs_selected:
+        stub_labels = {s[0]: s[1] for s in SERVICES}
+        print(f"\n  {YELLOW}Warning: The following services are stubs (playbook not yet implemented):{RESET}")
+        for s in stubs_selected:
+            print(f"    {YELLOW}- {stub_labels.get(s, s)}{RESET}")
+        proceed = input(f"  {YELLOW}Continue anyway? [y/N]:{RESET} ").strip().lower()
+        if proceed != "y":
+            return None
+
+    config["services"] = selected_services
+    config["all_in_one"] = True
+
+    # Base domain for nginx vhosts
+    config["domain"] = input(
+        f"\n  {CYAN}Base domain (e.g. example.com):{RESET} "
+    ).strip()
+    if not config["domain"]:
+        print(f"  {RED}Domain is required for reverse proxy.{RESET}")
+        return None
+
+    config["certbot_email"] = input(
+        f"  {CYAN}Email for Let's Encrypt [{GREY}optional{RESET}]: "
+    ).strip()
+
+    # Gather per-service configs
+    # Save base domain — each service stores config under its own prefixed keys
+    base_domain = config["domain"]
+    for svc in selected_services:
+        try:
+            mod = __import__(f"modules.{svc}", fromlist=[svc])
+            if hasattr(mod, "gather_config"):
+                # Set per-service subdomain default
+                svc_subdomains = {
+                    "matrix": f"matrix.{base_domain}",
+                    "cloud": f"cloud.{base_domain}",
+                    "vault": f"vault.{base_domain}",
+                    "media": f"media.{base_domain}",
+                    "email": f"mail.{base_domain}",
+                    "dns": f"dns.{base_domain}",
+                    "vpn": base_domain,
+                }
+                if svc in svc_subdomains:
+                    config["domain"] = svc_subdomains[svc]
+                config = mod.gather_config(config)
+                if config is None:
+                    return None
+        except ImportError:
+            pass  # Stub module, skip
+    # Restore base domain
+    config["domain"] = base_domain
+
+    config["nginx_reverse_proxy"] = True
+    config["certbot_enabled"] = bool(config.get("certbot_email"))
+
+    return config

phantom/modules/cloud.py

@@ -0,0 +1,27 @@
+"""Nextcloud deployment module (stub — playbook TODO)."""
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather Nextcloud configuration."""
+    print(f"\n{CYAN}  ┌─ Nextcloud Configuration ─────────────────────────┐{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+
+    config["domain"] = config.get("domain") or input(
+        f"  {CYAN}│{RESET}  Domain (e.g. cloud.example.com): "
+    ).strip()
+
+    config["cloud_admin_user"] = input(
+        f"  {CYAN}│{RESET}  Admin username [{WHITE}admin{RESET}]: "
+    ).strip() or "admin"
+
+    config["cloud_storage_gb"] = input(
+        f"  {CYAN}│{RESET}  Storage quota per user (GB) [{WHITE}10{RESET}]: "
+    ).strip() or "10"
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/modules/dns.py

@@ -0,0 +1,49 @@
+"""Pi-hole / AdGuard DNS server deployment module."""
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+YELLOW = "\033[38;5;214m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather DNS server configuration."""
+    print(f"\n{CYAN}  ┌─ DNS Server Configuration ────────────────────────┐{RESET}")
+
+    print(f"  {CYAN}│{RESET}  Upstream DNS provider:")
+    print(f"  {CYAN}│{RESET}    {WHITE}1{RESET}) Quad9 (9.9.9.9) — security-focused")
+    print(f"  {CYAN}│{RESET}    {WHITE}2{RESET}) Cloudflare (1.1.1.1) — privacy-focused")
+    print(f"  {CYAN}│{RESET}    {WHITE}3{RESET}) Custom")
+
+    dns_choice = input(f"  {CYAN}│{RESET}  Choice [{WHITE}1{RESET}]: ").strip() or "1"
+
+    if dns_choice == "1":
+        config["dns_upstream"] = "9.9.9.9;149.112.112.112"
+        config["dns_upstream_name"] = "Quad9"
+    elif dns_choice == "2":
+        config["dns_upstream"] = "1.1.1.1;1.0.0.1"
+        config["dns_upstream_name"] = "Cloudflare"
+    else:
+        config["dns_upstream"] = input(
+            f"  {CYAN}│{RESET}  Custom DNS (semicolon-separated): "
+        ).strip()
+        config["dns_upstream_name"] = "Custom"
+
+    config["dns_domain"] = input(
+        f"  {CYAN}│{RESET}  Admin interface domain (optional): "
+    ).strip()
+
+    print(f"  {CYAN}│{RESET}")
+    print(f"  {CYAN}│{RESET}  Blocklist presets:")
+    print(f"  {CYAN}│{RESET}    {WHITE}1{RESET}) Standard (ads + trackers)")
+    print(f"  {CYAN}│{RESET}    {WHITE}2{RESET}) Aggressive (+ social media trackers)")
+    print(f"  {CYAN}│{RESET}    {WHITE}3{RESET}) Minimal (ads only)")
+
+    bl_choice = input(f"  {CYAN}│{RESET}  Choice [{WHITE}1{RESET}]: ").strip() or "1"
+    config["dns_blocklist"] = {"1": "standard", "2": "aggressive", "3": "minimal"}.get(
+        bl_choice, "standard"
+    )
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/modules/email.py

@@ -0,0 +1,23 @@
+"""Mail-in-a-Box deployment module (stub — playbook TODO)."""
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather Mail-in-a-Box configuration."""
+    print(f"\n{CYAN}  ┌─ Mail-in-a-Box Configuration ─────────────────────┐{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+
+    config["domain"] = config.get("domain") or input(
+        f"  {CYAN}│{RESET}  Mail domain (e.g. mail.example.com): "
+    ).strip()
+
+    config["email_first_user"] = input(
+        f"  {CYAN}│{RESET}  First email user (e.g. admin@example.com): "
+    ).strip()
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/modules/matrix.py

@@ -0,0 +1,47 @@
+"""Matrix + Element homeserver deployment module."""
+
+import getpass
+import secrets
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather Matrix/Synapse + Element configuration."""
+    print(f"\n{CYAN}  ┌─ Matrix Homeserver Configuration ─────────────────┐{RESET}")
+
+    config["domain"] = config.get("domain") or input(
+        f"  {CYAN}│{RESET}  Domain (e.g. matrix.example.com): "
+    ).strip()
+    if not config["domain"]:
+        print(f"  {CYAN}│{RESET}  Domain is required.")
+        return None
+
+    config["matrix_admin_user"] = input(
+        f"  {CYAN}│{RESET}  Admin username [{WHITE}admin{RESET}]: "
+    ).strip() or "admin"
+
+    config["matrix_admin_password"] = getpass.getpass(
+        f"  {CYAN}│{RESET}  Admin password (blank=generate): "
+    ) or secrets.token_urlsafe(20)
+
+    config["matrix_registration"] = input(
+        f"  {CYAN}│{RESET}  Open registration? [{WHITE}no{RESET}]: "
+    ).strip().lower()
+    config["matrix_registration"] = config["matrix_registration"] in ("yes", "y", "true")
+
+    config["matrix_element_web"] = input(
+        f"  {CYAN}│{RESET}  Deploy Element Web? [{WHITE}yes{RESET}]: "
+    ).strip().lower()
+    config["matrix_element_web"] = config["matrix_element_web"] not in ("no", "n", "false")
+
+    config["matrix_server_name"] = config["domain"].replace("matrix.", "", 1) \
+        if config["domain"].startswith("matrix.") else config["domain"]
+
+    config["matrix_signing_key"] = secrets.token_hex(32)
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/modules/media.py

@@ -0,0 +1,23 @@
+"""Jellyfin media server deployment module (stub — playbook TODO)."""
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather Jellyfin configuration."""
+    print(f"\n{CYAN}  ┌─ Jellyfin Configuration ──────────────────────────┐{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+
+    config["domain"] = config.get("domain") or input(
+        f"  {CYAN}│{RESET}  Domain (e.g. media.example.com): "
+    ).strip()
+
+    config["media_library_path"] = input(
+        f"  {CYAN}│{RESET}  Media library path [{WHITE}/srv/media{RESET}]: "
+    ).strip() or "/srv/media"
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/modules/vault.py

@@ -0,0 +1,29 @@
+"""Vaultwarden (Bitwarden) deployment module (stub — playbook TODO)."""
+
+import secrets
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather Vaultwarden configuration."""
+    print(f"\n{CYAN}  ┌─ Vaultwarden Configuration ───────────────────────┐{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+
+    config["domain"] = config.get("domain") or input(
+        f"  {CYAN}│{RESET}  Domain (e.g. vault.example.com): "
+    ).strip()
+
+    config["vault_admin_token"] = input(
+        f"  {CYAN}│{RESET}  Admin token (blank=generate): "
+    ).strip() or secrets.token_urlsafe(32)
+
+    config["vault_signups_allowed"] = input(
+        f"  {CYAN}│{RESET}  Allow signups? [{WHITE}no{RESET}]: "
+    ).strip().lower() in ("yes", "y", "true")
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/modules/vpn.py

@@ -0,0 +1,39 @@
+"""WireGuard VPN server deployment module."""
+
+CYAN = "\033[38;5;51m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+RESET = "\033[0m"
+
+
+def gather_config(config):
+    """Gather WireGuard VPN configuration."""
+    print(f"\n{CYAN}  ┌─ WireGuard VPN Configuration ──────────────────────┐{RESET}")
+
+    config["vpn_port"] = input(
+        f"  {CYAN}│{RESET}  Listen port [{WHITE}51820{RESET}]: "
+    ).strip() or "51820"
+
+    config["vpn_client_count"] = input(
+        f"  {CYAN}│{RESET}  Number of client configs [{WHITE}3{RESET}]: "
+    ).strip() or "3"
+
+    try:
+        config["vpn_client_count"] = int(config["vpn_client_count"])
+    except ValueError:
+        config["vpn_client_count"] = 3
+
+    config["vpn_dns"] = input(
+        f"  {CYAN}│{RESET}  Client DNS server [{WHITE}1.1.1.1{RESET}]: "
+    ).strip() or "1.1.1.1"
+
+    config["vpn_allowed_ips"] = input(
+        f"  {CYAN}│{RESET}  Allowed IPs [{WHITE}0.0.0.0/0, ::/0{RESET}]: "
+    ).strip() or "0.0.0.0/0, ::/0"
+
+    config["vpn_subnet"] = input(
+        f"  {CYAN}│{RESET}  VPN subnet [{WHITE}10.66.66.0/24{RESET}]: "
+    ).strip() or "10.66.66.0/24"
+
+    print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+    return config

phantom/phantom.py

@@ -0,0 +1,463 @@
+#!/usr/bin/env python3
+"""phantom — Privacy Server Deployer
+
+Deploy self-hosted privacy infrastructure with a single command.
+Supports Matrix, WireGuard VPN, Pi-hole DNS, Nextcloud, and more.
+
+Providers: Linode, AWS, FlokiNET, or local/existing server.
+"""
+
+import json
+import os
+import random
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+# Allow modules to import from phantom
+sys.path.insert(0, os.path.dirname(__file__))
+
+BASE_DIR = Path(__file__).resolve().parent
+PLAYBOOKS_DIR = BASE_DIR / "playbooks"
+PROVIDERS_DIR = BASE_DIR / "providers"
+LOGS_DIR = BASE_DIR / "logs"
+LOGS_DIR.mkdir(exist_ok=True)
+
+# ─── Color Helpers ──────────────────────────────────────────────────────────
+
+RESET = "\033[0m"
+BOLD = "\033[1m"
+DIM = "\033[2m"
+CYAN = "\033[38;5;51m"
+GREEN = "\033[38;5;49m"
+RED = "\033[38;5;196m"
+YELLOW = "\033[38;5;214m"
+MAGENTA = "\033[38;5;201m"
+WHITE = "\033[38;5;255m"
+GREY = "\033[38;5;244m"
+
+
+def ok(msg):
+    print(f"{GREEN}[+]{RESET} {msg}")
+
+def err(msg):
+    print(f"{RED}[-]{RESET} {msg}")
+
+def warn(msg):
+    print(f"{YELLOW}[*]{RESET} {msg}")
+
+def info(msg):
+    print(f"{CYAN}[~]{RESET} {msg}")
+
+def dim(msg):
+    print(f"{GREY}    {msg}{RESET}")
+
+
+# ─── Banner ─────────────────────────────────────────────────────────────────
+
+BANNER = f"""
+{MAGENTA}    ██████╗ ██╗  ██╗ █████╗ ███╗   ██╗████████╗ ██████╗ ███╗   ███╗
+    ██╔══██╗██║  ██║██╔══██╗████╗  ██║╚══██╔══╝██╔═══██╗████╗ ████║
+    ██████╔╝███████║███████║██╔██╗ ██║   ██║   ██║   ██║██╔████╔██║
+    ██╔═══╝ ██╔══██║██╔══██║██║╚██╗██║   ██║   ██║   ██║██║╚██╔╝██║
+    ██║     ██║  ██║██║  ██║██║ ╚████║   ██║   ╚██████╔╝██║ ╚═╝ ██║
+    ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝    ╚═════╝ ╚═╝     ╚═╝{RESET}
+{GREY}         Privacy Server Deployer — Your infrastructure, your rules{RESET}
+"""
+
+
+def banner():
+    print(BANNER)
+
+
+# ─── Deployment ID Generation ───────────────────────────────────────────────
+
+ADJECTIVES = [
+    "silent", "hidden", "shadow", "quiet", "swift", "dark", "fading", "lost",
+    "frozen", "drifting", "hollow", "veiled", "pale", "deep", "still", "wild",
+    "broken", "burning", "crimson", "golden", "silver", "iron", "copper",
+    "cobalt", "jade", "amber", "arctic", "lunar", "solar", "astral", "coral",
+    "misty", "foggy", "dusty", "rusty", "mossy", "stormy", "cloudy", "windy",
+    "gentle", "fierce", "steady", "rapid", "lazy", "bold", "brave", "calm",
+    "clever", "cryptic", "cunning", "eager", "faint", "grave", "keen", "noble",
+    "prime", "rare", "stark", "terse", "vivid", "wary", "zealous", "agile",
+    "blunt", "coarse", "dense", "eerie", "fleet", "gaunt", "harsh", "lucid",
+    "muted", "numb", "opaque", "plain", "rigid", "sleek", "taut", "urban",
+    "vacant", "woven", "binary", "cipher", "delta", "echo", "foxtrot", "gamma",
+    "hex", "index", "kilo", "lambda", "micro", "nano", "omega", "proxy",
+    "quantum", "rogue", "sigma", "theta", "ultra", "vector", "xray", "zero",
+]
+
+NOUNS = [
+    "phantom", "spectre", "wraith", "shade", "ghost", "echo", "void", "rift",
+    "nexus", "pulse", "signal", "cipher", "prism", "beacon", "aegis", "bastion",
+    "citadel", "forge", "haven", "vault", "harbor", "summit", "ridge", "canyon",
+    "glacier", "tundra", "steppe", "mesa", "delta", "fjord", "grove", "marsh",
+    "oasis", "reef", "shoal", "brook", "creek", "falls", "rapids", "spring",
+    "falcon", "raven", "hawk", "condor", "osprey", "heron", "crane", "wren",
+    "finch", "swift", "sparrow", "robin", "wolf", "fox", "lynx", "panther",
+    "tiger", "cobra", "viper", "mantis", "hornet", "spider", "scorpion",
+    "anchor", "arrow", "blade", "bolt", "chain", "crown", "flint", "glyph",
+    "helm", "ingot", "jewel", "knot", "lance", "mast", "oar", "pike",
+    "quill", "rune", "shard", "thorn", "urn", "wand", "atlas", "core",
+    "dusk", "ember", "frost", "gale", "haze", "iris", "jade", "karma",
+    "lumen", "myth", "nova", "orbit", "pixel", "quest", "relay", "sage",
+    "trace", "unity", "vertex", "zenith",
+]
+
+
+def generate_id():
+    """Generate a deployment ID with 10k+ unique combinations."""
+    adj = random.choice(ADJECTIVES)
+    noun = random.choice(NOUNS)
+    num = random.randint(10, 99)
+    return f"{adj}-{noun}-{num}"
+
+
+# ─── SSH Key Generation ─────────────────────────────────────────────────────
+
+def generate_ssh_key(deploy_id):
+    """Generate an RSA 4096 SSH keypair for deployment."""
+    key_dir = LOGS_DIR / deploy_id
+    key_dir.mkdir(parents=True, exist_ok=True)
+    key_path = key_dir / f"deploy_{deploy_id}"
+
+    if key_path.exists():
+        info(f"SSH key already exists: {key_path}")
+        return str(key_path)
+
+    info(f"Generating SSH key: {key_path}")
+    subprocess.run(
+        ["ssh-keygen", "-t", "rsa", "-b", "4096", "-f", str(key_path),
+         "-N", "", "-C", f"deploy-{deploy_id}"],
+        check=True, capture_output=True,
+    )
+    os.chmod(key_path, 0o600)
+    ok(f"SSH key generated: {key_path}")
+    return str(key_path)
+
+
+# ─── Ansible Playbook Execution ─────────────────────────────────────────────
+
+def run_playbook(playbook_path, config, extra_vars=None):
+    """Execute an Ansible playbook with the given config.
+
+    Args:
+        playbook_path: Path object or string to the playbook file.
+        config: Deployment config dict.
+        extra_vars: Optional dict of extra Ansible variables.
+
+    Returns:
+        True if playbook succeeded, False otherwise.
+    """
+    playbook_path = Path(playbook_path)
+    if not playbook_path.exists():
+        err(f"Playbook not found: {playbook_path}")
+        return False
+
+    cmd = ["ansible-playbook", str(playbook_path)]
+
+    # Build vars file
+    vars_file = LOGS_DIR / config["deploy_id"] / "vars.yaml"
+    vars_file.parent.mkdir(parents=True, exist_ok=True)
+
+    try:
+        import yaml  # noqa: optional dependency
+        with open(vars_file, "w") as f:
+            yaml.dump(config, f, default_flow_style=False)
+    except ImportError:
+        with open(vars_file, "w") as f:
+            for k, v in config.items():
+                f.write(f"{k}: {json.dumps(v)}\n")
+
+    cmd.extend(["-e", f"@{vars_file}"])
+
+    if extra_vars:
+        for k, v in extra_vars.items():
+            cmd.extend(["-e", f"{k}={v}"])
+
+    # Set inventory
+    target = config.get("target_host", "localhost")
+    if target == "localhost":
+        cmd.extend(["-i", "localhost,", "--connection", "local"])
+    else:
+        inv_file = LOGS_DIR / config["deploy_id"] / "inventory"
+        with open(inv_file, "w") as f:
+            ssh_key = config.get("ssh_key", "")
+            ssh_user = config.get("ssh_user", "root")
+            line = f"{target} ansible_user={ssh_user}"
+            if ssh_key:
+                line += f" ansible_ssh_private_key_file={ssh_key}"
+            f.write(f"[servers]\n{line}\n")
+        cmd.extend(["-i", str(inv_file)])
+
+        # Elevate privileges for non-root users
+        if ssh_user != "root":
+            cmd.append("--become")
+
+    info(f"Running: {' '.join(cmd)}")
+    result = subprocess.run(cmd)
+    return result.returncode == 0
+
+
+# ─── Deployment Info Logging ────────────────────────────────────────────────
+
+def save_deploy_info(config):
+    """Save deployment metadata to logs."""
+    deploy_dir = LOGS_DIR / config["deploy_id"]
+    deploy_dir.mkdir(parents=True, exist_ok=True)
+    info_file = deploy_dir / "deploy_info.json"
+
+    config["timestamp"] = time.strftime("%Y-%m-%dT%H:%M:%S%z")
+    with open(info_file, "w") as f:
+        json.dump(config, f, indent=2, default=str)
+    ok(f"Deployment info saved: {info_file}")
+
+
+# ─── SSH Connect ────────────────────────────────────────────────────────────
+
+def ssh_connect(config):
+    """Offer to SSH into the deployed server."""
+    target = config.get("target_host", "")
+    if not target or target == "localhost":
+        return
+
+    ssh_key = config.get("ssh_key", "")
+    ssh_user = config.get("ssh_user", "root")
+
+    cmd = ["ssh"]
+    if ssh_key:
+        cmd.extend(["-i", ssh_key])
+    cmd.append(f"{ssh_user}@{target}")
+
+    print()
+    resp = input(f"{CYAN}[?]{RESET} SSH into {target}? [y/N] ").strip().lower()
+    if resp == "y":
+        os.execvp("ssh", cmd)
+
+
+# ─── Provider Selection ─────────────────────────────────────────────────────
+
+def select_provider():
+    """Select deployment target: cloud provider or local/existing server."""
+    print(f"\n{CYAN}  Select deployment target:{RESET}")
+    print(f"  {WHITE}1{RESET}) Linode")
+    print(f"  {WHITE}2{RESET}) AWS (EC2)")
+    print(f"  {WHITE}3{RESET}) FlokiNET (pre-provisioned)")
+    print(f"  {WHITE}4{RESET}) Existing server (SSH)")
+    print(f"  {WHITE}5{RESET}) Local (this machine)")
+    print()
+
+    choice = input(f"  {MAGENTA}>{RESET} ").strip()
+    providers = {"1": "linode", "2": "aws", "3": "flokinet", "4": "existing", "5": "local"}
+    return providers.get(choice)
+
+
+def gather_credentials(provider, config):
+    """Gather provider-specific credentials."""
+    if provider == "linode":
+        config["provider"] = "linode"
+        config["api_token"] = input(f"  {CYAN}Linode API token:{RESET} ").strip()
+        config["region"] = input(f"  {CYAN}Region (e.g. us-east):{RESET} ").strip() or "us-east"
+        config["plan"] = input(f"  {CYAN}Plan (e.g. g6-nanode-1):{RESET} ").strip() or "g6-nanode-1"
+
+    elif provider == "aws":
+        config["provider"] = "aws"
+        config["aws_access_key"] = input(f"  {CYAN}AWS Access Key ID:{RESET} ").strip()
+        config["aws_secret_key"] = input(f"  {CYAN}AWS Secret Access Key:{RESET} ").strip()
+        config["region"] = input(f"  {CYAN}Region (e.g. us-east-1):{RESET} ").strip() or "us-east-1"
+        config["instance_type"] = input(f"  {CYAN}Instance type (e.g. t3.micro):{RESET} ").strip() or "t3.micro"
+
+    elif provider == "flokinet":
+        config["provider"] = "flokinet"
+        config["target_host"] = input(f"  {CYAN}Server IP:{RESET} ").strip()
+        config["ssh_user"] = input(f"  {CYAN}SSH user [root]:{RESET} ").strip() or "root"
+
+    elif provider == "existing":
+        config["provider"] = "existing"
+        config["target_host"] = input(f"  {CYAN}Server IP/hostname:{RESET} ").strip()
+        config["ssh_user"] = input(f"  {CYAN}SSH user [root]:{RESET} ").strip() or "root"
+        existing_key = input(f"  {CYAN}SSH key path (blank to generate):{RESET} ").strip()
+        if existing_key:
+            config["ssh_key"] = existing_key
+
+    elif provider == "local":
+        config["provider"] = "local"
+        config["target_host"] = "localhost"
+        config["ssh_user"] = os.getenv("USER", "root")
+        warn("Local deployment will install services directly on this machine.")
+        confirm = input(f"  {YELLOW}Continue? [y/N]:{RESET} ").strip().lower()
+        if confirm != "y":
+            return False
+
+    return True
+
+
+# ─── Deployment Orchestration ───────────────────────────────────────────────
+
+def deploy(server_type, config):
+    """Full deployment pipeline: summarize -> confirm -> provision -> configure."""
+    config["server_type"] = server_type
+    config.setdefault("deploy_id", generate_id())
+    deploy_id = config["deploy_id"]
+
+    # Summary
+    print(f"\n{CYAN}{'─' * 60}{RESET}")
+    print(f"{MAGENTA}  Deployment Summary{RESET}")
+    print(f"{CYAN}{'─' * 60}{RESET}")
+    print(f"  {WHITE}ID:{RESET}       {deploy_id}")
+    print(f"  {WHITE}Type:{RESET}     {server_type}")
+    print(f"  {WHITE}Provider:{RESET} {config.get('provider', 'unknown')}")
+    print(f"  {WHITE}Target:{RESET}   {config.get('target_host', 'TBD (will provision)')}")
+    if config.get("domain"):
+        print(f"  {WHITE}Domain:{RESET}   {config['domain']}")
+    for k, v in config.items():
+        if k not in ("deploy_id", "server_type", "provider", "target_host",
+                      "domain", "api_token", "aws_access_key", "aws_secret_key",
+                      "ssh_key", "ssh_user", "timestamp"):
+            print(f"  {WHITE}{k}:{RESET} {v}")
+    print(f"{CYAN}{'─' * 60}{RESET}")
+
+    confirm = input(f"\n  {MAGENTA}Deploy? [y/N]:{RESET} ").strip().lower()
+    if confirm != "y":
+        warn("Deployment cancelled.")
+        return
+
+    # Generate SSH key if needed
+    if config.get("provider") not in ("local",) and not config.get("ssh_key"):
+        config["ssh_key"] = generate_ssh_key(deploy_id)
+
+    # Provision if cloud provider
+    if config.get("provider") in ("linode", "aws"):
+        provider_playbook = PROVIDERS_DIR / f"{config['provider']}.yml"
+        # Tell the provider playbook where to write the provisioned IP
+        host_file = LOGS_DIR / deploy_id / "provisioned_host"
+        config["_host_output_file"] = str(host_file)
+        info(f"Provisioning {config['provider']} instance...")
+        if not run_playbook(provider_playbook, config):
+            err("Provisioning failed.")
+            return
+        # Read back the provisioned host IP
+        if host_file.exists():
+            config["target_host"] = host_file.read_text().strip()
+            ok(f"Provisioned server: {config['target_host']}")
+        else:
+            err("Provisioning completed but no host IP was returned.")
+            return
+
+    # Base hardening
+    info("Applying base hardening...")
+    if not run_playbook(PLAYBOOKS_DIR / "common/base_hardening.yml", config):
+        err("Base hardening failed — aborting deployment.")
+        return
+
+    # Service-specific playbook
+    playbook_map = {
+        "matrix": PLAYBOOKS_DIR / "matrix/main.yml",
+        "vpn": PLAYBOOKS_DIR / "vpn/main.yml",
+        "dns": PLAYBOOKS_DIR / "dns/main.yml",
+        "cloud": PLAYBOOKS_DIR / "cloud/main.yml",
+        "vault": PLAYBOOKS_DIR / "vault/main.yml",
+        "media": PLAYBOOKS_DIR / "media/main.yml",
+        "email": PLAYBOOKS_DIR / "email/main.yml",
+        "all_in_one": PLAYBOOKS_DIR / "all_in_one/main.yml",
+    }
+
+    playbook = playbook_map.get(server_type)
+    if playbook:
+        info(f"Configuring {server_type}...")
+        if run_playbook(playbook, config):
+            ok(f"Deployment complete: {deploy_id}")
+        else:
+            err(f"Service configuration failed for {server_type}")
+            return
+
+    # Save info and offer SSH
+    save_deploy_info(config)
+    ssh_connect(config)
+
+
+# ─── Main Menu ──────────────────────────────────────────────────────────────
+
+MENU_ITEMS = [
+    ("1", "Matrix + Element", "matrix", "Encrypted messaging homeserver"),
+    ("2", "WireGuard VPN", "vpn", "Private VPN server"),
+    ("3", "Pi-hole DNS", "dns", "Ad-blocking DNS server"),
+    ("4", "Nextcloud", "cloud", "Self-hosted file sync (coming soon)"),
+    ("5", "Vaultwarden", "vault", "Password manager (coming soon)"),
+    ("6", "Jellyfin", "media", "Media server (coming soon)"),
+    ("7", "Mail-in-a-Box", "email", "Email server (coming soon)"),
+    ("8", "All-in-One", "all_in_one", "Multiple services on one server"),
+    ("0", "Exit", None, None),
+]
+
+
+def main_menu():
+    banner()
+
+    while True:
+        print(f"\n{CYAN}  ┌─ Deploy a Privacy Server ──────────────────────────┐{RESET}")
+        for num, label, _, desc in MENU_ITEMS:
+            if desc:
+                print(f"  {CYAN}│{RESET}  {WHITE}{num}{RESET}) {label:<20} {GREY}{desc}{RESET}")
+            else:
+                print(f"  {CYAN}│{RESET}  {WHITE}{num}{RESET}) {label}")
+        print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
+
+        choice = input(f"\n  {MAGENTA}>{RESET} ").strip()
+
+        if choice == "0":
+            print(f"\n{GREY}  Goodbye.{RESET}\n")
+            break
+
+        # Find matching menu item
+        selected = None
+        for num, label, stype, _ in MENU_ITEMS:
+            if choice == num and stype:
+                selected = stype
+                break
+
+        if not selected:
+            warn("Invalid selection.")
+            continue
+
+        # Import the module
+        try:
+            mod = __import__(f"modules.{selected}", fromlist=[selected])
+        except ImportError as e:
+            err(f"Module not found: {selected} ({e})")
+            continue
+
+        # Select provider
+        provider = select_provider()
+        if not provider:
+            warn("Invalid provider selection.")
+            continue
+
+        config = {"deploy_id": generate_id()}
+
+        if not gather_credentials(provider, config):
+            continue
+
+        # Gather service-specific config
+        if hasattr(mod, "gather_config"):
+            config = mod.gather_config(config)
+            if config is None:
+                continue
+
+        # Deploy
+        deploy(selected, config)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1 and sys.argv[1] in ("--help", "-h"):
+        print("Usage: python3 phantom.py")
+        print("  Interactive privacy server deployer.")
+        print("  Supports Matrix, WireGuard, Pi-hole, and more.")
+        print("  Run without arguments to launch the interactive menu.")
+        sys.exit(0)
+    try:
+        main_menu()
+    except KeyboardInterrupt:
+        print(f"\n{GREY}  Interrupted.{RESET}\n")

phantom/playbooks/all_in_one/main.yml

@@ -0,0 +1,92 @@
+---
+# All-in-One deployment — multiple services on a single server
+# Installs nginx as reverse proxy with TLS termination via Certbot,
+# then deploys selected services behind vhost routing.
+#
+# NOTE: This playbook includes task files directly rather than
+# importing full playbooks, to allow conditional composition.
+
+- name: All-in-One Privacy Server
+  hosts: all
+  become: true
+  vars:
+    base_domain: "{{ domain }}"
+    selected_services: "{{ services | default([]) }}"
+    certbot_email: "{{ certbot_email | default('') }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
+  tasks:
+    # ─── Base: Nginx + Certbot ────────────────────────────────────────
+    - name: Install nginx and certbot
+      apt:
+        name:
+          - nginx
+          - certbot
+          - python3-certbot-nginx
+        state: present
+
+    - name: Remove default nginx site
+      file:
+        path: /etc/nginx/sites-enabled/default
+        state: absent
+      notify: reload nginx
+
+    - name: Allow HTTP/HTTPS through UFW
+      ufw:
+        rule: allow
+        port: "{{ item }}"
+        proto: tcp
+      loop:
+        - "80"
+        - "443"
+
+    # ─── Deploy Individual Services (task files, not full playbooks) ──
+    - name: Deploy Matrix — Synapse
+      include_tasks: "{{ playbook_dir }}/../matrix/tasks/synapse.yml"
+      when: "'matrix' in selected_services"
+
+    - name: Deploy Matrix — Element Web
+      include_tasks: "{{ playbook_dir }}/../matrix/tasks/element.yml"
+      when: "'matrix' in selected_services and (matrix_element_web | default(true) | bool)"
+
+    - name: Deploy Matrix — Nginx vhost
+      include_tasks: "{{ playbook_dir }}/../matrix/tasks/nginx.yml"
+      when: "'matrix' in selected_services"
+
+    - name: Deploy WireGuard — Install
+      include_tasks: "{{ playbook_dir }}/../vpn/tasks/install.yml"
+      when: "'vpn' in selected_services"
+
+    - name: Deploy WireGuard — Configure
+      include_tasks: "{{ playbook_dir }}/../vpn/tasks/configure.yml"
+      when: "'vpn' in selected_services"
+
+    - name: Deploy Pi-hole — Install
+      include_tasks: "{{ playbook_dir }}/../dns/tasks/install.yml"
+      when: "'dns' in selected_services"
+
+    - name: Deploy Pi-hole — Configure
+      include_tasks: "{{ playbook_dir }}/../dns/tasks/configure.yml"
+      when: "'dns' in selected_services"
+
+    # Stub services — print notice
+    - name: Notice for stub services
+      debug:
+        msg: "Service '{{ item }}' playbook not yet implemented — skipping"
+      loop: "{{ selected_services | select('in', ['cloud', 'vault', 'media', 'email']) | list }}"
+
+  handlers:
+    - name: reload nginx
+      service:
+        name: nginx
+        state: reloaded
+
+    - name: restart synapse
+      service:
+        name: matrix-synapse
+        state: restarted
+
+    - name: restart sshd
+      service:
+        name: sshd
+        state: restarted

phantom/playbooks/cloud/main.yml

@@ -0,0 +1,11 @@
+---
+# Cloud deployment — Coming soon
+# This is a stub playbook. Full implementation planned.
+
+- name: Deploy Cloud Server
+  hosts: all
+  become: true
+  tasks:
+    - name: Placeholder
+      debug:
+        msg: "Cloud playbook not yet implemented. Check phantom/README.md for status."

phantom/playbooks/common/base_hardening.yml

@@ -0,0 +1,144 @@
+---
+# Base server hardening — applied to all deployments
+# Covers: updates, firewall, fail2ban, SSH hardening
+
+- name: Base Server Hardening
+  hosts: all
+  become: true
+  vars:
+    ssh_port: "{{ ssh_port | default(22) }}"
+    ssh_allow_password: false
+
+  tasks:
+    # ─── System Updates ─────────────────────────────────────────────────
+    - name: Update apt cache
+      apt:
+        update_cache: true
+        cache_valid_time: 3600
+      when: ansible_os_family == "Debian"
+
+    - name: Upgrade all packages
+      apt:
+        upgrade: safe
+      when: ansible_os_family == "Debian"
+
+    - name: Install essential packages
+      apt:
+        name:
+          - ufw
+          - fail2ban
+          - unattended-upgrades
+          - apt-listchanges
+          - curl
+          - wget
+          - gnupg
+          - ca-certificates
+          - software-properties-common
+        state: present
+      when: ansible_os_family == "Debian"
+
+    # ─── UFW Firewall ───────────────────────────────────────────────────
+    - name: Set UFW default deny incoming
+      ufw:
+        direction: incoming
+        policy: deny
+
+    - name: Set UFW default allow outgoing
+      ufw:
+        direction: outgoing
+        policy: allow
+
+    - name: Allow SSH through UFW
+      ufw:
+        rule: allow
+        port: "{{ ssh_port }}"
+        proto: tcp
+
+    - name: Enable UFW
+      ufw:
+        state: enabled
+
+    # ─── Fail2ban ───────────────────────────────────────────────────────
+    - name: Configure fail2ban SSH jail
+      copy:
+        dest: /etc/fail2ban/jail.local
+        content: |
+          [sshd]
+          enabled = true
+          port = {{ ssh_port }}
+          filter = sshd
+          logpath = /var/log/auth.log
+          maxretry = 5
+          bantime = 3600
+          findtime = 600
+        mode: "0644"
+      notify: restart fail2ban
+
+    - name: Enable fail2ban
+      service:
+        name: fail2ban
+        state: started
+        enabled: true
+
+    # ─── SSH Hardening ──────────────────────────────────────────────────
+    - name: Disable SSH password authentication
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PasswordAuthentication"
+        line: "PasswordAuthentication no"
+      when: not ssh_allow_password
+      notify: restart sshd
+
+    - name: Disable SSH root login with password
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?PermitRootLogin"
+        line: "PermitRootLogin prohibit-password"
+      notify: restart sshd
+
+    - name: Disable SSH X11 forwarding
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?X11Forwarding"
+        line: "X11Forwarding no"
+      notify: restart sshd
+
+    # ─── Automatic Security Updates ─────────────────────────────────────
+    - name: Enable unattended upgrades for security
+      copy:
+        dest: /etc/apt/apt.conf.d/20auto-upgrades
+        content: |
+          APT::Periodic::Update-Package-Lists "1";
+          APT::Periodic::Unattended-Upgrade "1";
+          APT::Periodic::AutocleanInterval "7";
+        mode: "0644"
+      when: ansible_os_family == "Debian"
+
+    # ─── Kernel Hardening ───────────────────────────────────────────────
+    - name: Apply sysctl hardening
+      sysctl:
+        name: "{{ item.key }}"
+        value: "{{ item.value }}"
+        sysctl_set: true
+        reload: true
+      loop:
+        - { key: "net.ipv4.conf.all.rp_filter", value: "1" }
+        - { key: "net.ipv4.conf.default.rp_filter", value: "1" }
+        - { key: "net.ipv4.icmp_echo_ignore_broadcasts", value: "1" }
+        - { key: "net.ipv4.conf.all.accept_redirects", value: "0" }
+        - { key: "net.ipv4.conf.default.accept_redirects", value: "0" }
+        - { key: "net.ipv6.conf.all.accept_redirects", value: "0" }
+        - { key: "net.ipv6.conf.default.accept_redirects", value: "0" }
+        - { key: "net.ipv4.conf.all.send_redirects", value: "0" }
+        - { key: "net.ipv4.conf.default.send_redirects", value: "0" }
+
+  handlers:
+    - name: restart fail2ban
+      service:
+        name: fail2ban
+        state: restarted
+
+    - name: restart sshd
+      service:
+        name: sshd
+        state: restarted

phantom/playbooks/dns/main.yml

@@ -0,0 +1,18 @@
+---
+# Pi-hole DNS server deployment (Docker-based)
+
+- name: Deploy Pi-hole DNS Server
+  hosts: all
+  become: true
+  vars:
+    pihole_upstream: "{{ dns_upstream | default('9.9.9.9;149.112.112.112') }}"
+    pihole_domain: "{{ dns_domain | default('') }}"
+    pihole_blocklist: "{{ dns_blocklist | default('standard') }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
+  tasks:
+    - name: Include Pi-hole installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Pi-hole configuration
+      include_tasks: tasks/configure.yml

phantom/playbooks/dns/tasks/configure.yml

@@ -0,0 +1,66 @@
+---
+# Pi-hole Docker configuration and launch
+
+- name: Create Pi-hole directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - /opt/pihole
+    - /opt/pihole/etc-pihole
+    - /opt/pihole/etc-dnsmasq.d
+
+- name: Generate Pi-hole admin password
+  shell: "openssl rand -base64 16"
+  register: pihole_password
+  args:
+    creates: /opt/pihole/.password
+
+- name: Save admin password
+  copy:
+    content: "{{ pihole_password.stdout }}"
+    dest: /opt/pihole/.password
+    mode: "0600"
+  when: pihole_password.changed
+
+- name: Deploy Pi-hole Docker Compose
+  copy:
+    dest: /opt/pihole/docker-compose.yml
+    content: |
+      services:
+        pihole:
+          container_name: pihole
+          image: pihole/pihole:latest
+          ports:
+            - "53:53/tcp"
+            - "53:53/udp"
+            - "80:80/tcp"
+          environment:
+            TZ: UTC
+            WEBPASSWORD_FILE: /run/secrets/webpassword
+            PIHOLE_DNS_: "{{ pihole_upstream }}"
+            DNSSEC: "true"
+            QUERY_LOGGING: "false"
+          volumes:
+            - /opt/pihole/etc-pihole:/etc/pihole
+            - /opt/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
+          secrets:
+            - webpassword
+          restart: unless-stopped
+          dns:
+            - 127.0.0.1
+            - 9.9.9.9
+      secrets:
+        webpassword:
+          file: /opt/pihole/.password
+    mode: "0644"
+
+- name: Start Pi-hole
+  shell: cd /opt/pihole && docker compose up -d
+  args:
+    creates: /opt/pihole/etc-pihole/pihole-FTL.db
+
+- name: Display admin password
+  debug:
+    msg: "Pi-hole admin password: {{ pihole_password.stdout | default('(see /opt/pihole/.password)') }}"

phantom/playbooks/dns/tasks/install.yml

@@ -0,0 +1,62 @@
+---
+# Pi-hole installation via Docker
+
+- name: Install Docker prerequisites
+  apt:
+    name:
+      - apt-transport-https
+      - ca-certificates
+      - curl
+      - gnupg
+      - lsb-release
+    state: present
+
+- name: Add Docker GPG key
+  apt_key:
+    url: https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg
+    state: present
+
+- name: Add Docker repository
+  apt_repository:
+    repo: "deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
+    state: present
+
+- name: Install Docker
+  apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-compose-plugin
+    state: present
+
+- name: Enable Docker service
+  service:
+    name: docker
+    state: started
+    enabled: true
+
+- name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
+  service:
+    name: systemd-resolved
+    state: stopped
+    enabled: false
+  failed_when: false
+
+- name: Set DNS fallback
+  copy:
+    dest: /etc/resolv.conf
+    content: |
+      nameserver 9.9.9.9
+      nameserver 1.1.1.1
+    mode: "0644"
+
+- name: Allow DNS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item.port }}"
+    proto: "{{ item.proto }}"
+  loop:
+    - { port: "53", proto: "tcp" }
+    - { port: "53", proto: "udp" }
+    - { port: "80", proto: "tcp" }

phantom/playbooks/email/main.yml

@@ -0,0 +1,11 @@
+---
+# Email deployment — Coming soon
+# This is a stub playbook. Full implementation planned.
+
+- name: Deploy Email Server
+  hosts: all
+  become: true
+  tasks:
+    - name: Placeholder
+      debug:
+        msg: "Email playbook not yet implemented. Check phantom/README.md for status."

phantom/playbooks/matrix/main.yml

@@ -0,0 +1,38 @@
+---
+# Matrix (Synapse) + Element Web deployment
+# Installs Synapse homeserver with optional Element Web frontend
+
+- name: Deploy Matrix Homeserver
+  hosts: all
+  become: true
+  vars:
+    matrix_domain: "{{ domain }}"
+    matrix_server_name: "{{ matrix_server_name | default(domain) }}"
+    matrix_admin: "{{ matrix_admin_user | default('admin') }}"
+    matrix_admin_pass: "{{ matrix_admin_password }}"
+    matrix_registration_enabled: "{{ matrix_registration | default(false) }}"
+    element_enabled: "{{ matrix_element_web | default(true) }}"
+    matrix_signing_key: "{{ matrix_signing_key }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
+  tasks:
+    - name: Include Synapse installation tasks
+      include_tasks: tasks/synapse.yml
+
+    - name: Include Element Web tasks
+      include_tasks: tasks/element.yml
+      when: element_enabled | bool
+
+    - name: Include nginx reverse proxy tasks
+      include_tasks: tasks/nginx.yml
+
+  handlers:
+    - name: restart synapse
+      service:
+        name: matrix-synapse
+        state: restarted
+
+    - name: reload nginx
+      service:
+        name: nginx
+        state: reloaded

phantom/playbooks/matrix/tasks/element.yml

@@ -0,0 +1,44 @@
+---
+# Element Web frontend installation
+
+- name: Install nginx (if not already)
+  apt:
+    name: nginx
+    state: present
+
+- name: Create Element Web directory
+  file:
+    path: /var/www/element
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0755"
+
+- name: Download latest Element Web release
+  shell: |
+    LATEST=$(curl -s https://api.github.com/repos/element-hq/element-web/releases/latest | grep -oP '"tag_name": "\K[^"]+')
+    curl -sL "https://github.com/element-hq/element-web/releases/download/${LATEST}/element-${LATEST}.tar.gz" | tar xz -C /var/www/element --strip-components=1
+  args:
+    creates: /var/www/element/index.html
+
+- name: Deploy Element Web config
+  copy:
+    dest: /var/www/element/config.json
+    content: |
+      {
+        "default_server_config": {
+          "m.homeserver": {
+            "base_url": "https://{{ matrix_domain }}",
+            "server_name": "{{ matrix_server_name }}"
+          }
+        },
+        "brand": "Element",
+        "integrations_ui_url": "",
+        "integrations_rest_url": "",
+        "disable_guests": true,
+        "disable_3pid_login": false,
+        "default_theme": "dark"
+      }
+    owner: www-data
+    group: www-data
+    mode: "0644"

phantom/playbooks/matrix/tasks/nginx.yml

@@ -0,0 +1,115 @@
+---
+# Nginx reverse proxy for Matrix + Element
+# Two-phase: HTTP-only first for certbot, then full SSL config
+
+- name: Create certbot webroot
+  file:
+    path: /var/www/certbot
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0755"
+
+- name: Deploy HTTP-only nginx config (for certbot)
+  copy:
+    dest: /etc/nginx/sites-available/matrix
+    content: |
+      server {
+          listen 80;
+          server_name {{ matrix_domain }};
+
+          location /.well-known/acme-challenge/ {
+              root /var/www/certbot;
+          }
+
+          location / {
+              return 200 'phantom setup in progress';
+              add_header Content-Type text/plain;
+          }
+      }
+    mode: "0644"
+  notify: reload nginx
+
+- name: Enable Matrix nginx site
+  file:
+    src: /etc/nginx/sites-available/matrix
+    dest: /etc/nginx/sites-enabled/matrix
+    state: link
+  notify: reload nginx
+
+- name: Flush handlers to apply HTTP config
+  meta: flush_handlers
+
+- name: Obtain TLS certificate
+  command: >
+    certbot certonly --webroot -w /var/www/certbot
+    -d {{ matrix_domain }}
+    --non-interactive
+    --agree-tos
+    {% if certbot_email is defined and certbot_email %}
+    --email {{ certbot_email }}
+    {% else %}
+    --register-unsafely-without-email
+    {% endif %}
+  args:
+    creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
+
+- name: Deploy full SSL nginx config
+  copy:
+    dest: /etc/nginx/sites-available/matrix
+    content: |
+      server {
+          listen 80;
+          server_name {{ matrix_domain }};
+
+          location /.well-known/acme-challenge/ {
+              root /var/www/certbot;
+          }
+
+          location / {
+              return 301 https://$host$request_uri;
+          }
+      }
+
+      server {
+          listen 443 ssl http2;
+          listen 8448 ssl http2;
+          server_name {{ matrix_domain }};
+
+          ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
+          ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
+
+          ssl_protocols TLSv1.2 TLSv1.3;
+          ssl_ciphers HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+
+          client_max_body_size 50m;
+
+          # Synapse
+          location ~* ^(\/_matrix|\/_synapse\/client) {
+              proxy_pass http://127.0.0.1:8008;
+              proxy_set_header X-Forwarded-For $remote_addr;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header Host $host;
+          }
+
+          # .well-known delegation
+          location /.well-known/matrix/server {
+              return 200 '{"m.server": "{{ matrix_domain }}:443"}';
+              add_header Content-Type application/json;
+          }
+
+          location /.well-known/matrix/client {
+              return 200 '{"m.homeserver": {"base_url": "https://{{ matrix_domain }}"}}';
+              add_header Content-Type application/json;
+              add_header Access-Control-Allow-Origin *;
+          }
+
+          # Element Web (if enabled)
+          location / {
+              root /var/www/element;
+              try_files $uri $uri/ /index.html;
+          }
+      }
+    mode: "0644"
+  notify: reload nginx

phantom/playbooks/matrix/tasks/synapse.yml

@@ -0,0 +1,99 @@
+---
+# Synapse homeserver installation and configuration
+
+- name: Install dependencies
+  apt:
+    name:
+      - python3
+      - python3-pip
+      - python3-venv
+      - libpq-dev
+      - postgresql
+      - postgresql-contrib
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+    state: present
+
+- name: Add Matrix Synapse apt repository key
+  apt_key:
+    url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+    state: present
+
+- name: Add Matrix Synapse apt repository
+  apt_repository:
+    repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
+    state: present
+    filename: matrix-org
+
+- name: Install Synapse
+  apt:
+    name: matrix-synapse-py3
+    state: present
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+
+- name: Create PostgreSQL database
+  become_user: postgres
+  postgresql_db:
+    name: synapse
+    encoding: UTF-8
+    lc_collate: C
+    lc_ctype: C
+    template: template0
+
+- name: Create PostgreSQL user
+  become_user: postgres
+  postgresql_user:
+    name: synapse
+    password: "{{ matrix_signing_key[:32] }}"
+    db: synapse
+    priv: ALL
+
+- name: Deploy Synapse homeserver config
+  template:
+    src: ../templates/homeserver.yaml.j2
+    dest: /etc/matrix-synapse/homeserver.yaml
+    owner: matrix-synapse
+    group: matrix-synapse
+    mode: "0640"
+  notify: restart synapse
+
+- name: Allow Matrix federation port through UFW
+  ufw:
+    rule: allow
+    port: "8448"
+    proto: tcp
+
+- name: Allow HTTP/HTTPS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"
+
+- name: Enable and start Synapse
+  service:
+    name: matrix-synapse
+    state: started
+    enabled: true
+
+- name: Wait for Synapse to be ready
+  wait_for:
+    port: 8008
+    host: 127.0.0.1
+    timeout: 30
+
+- name: Create admin user
+  command: >
+    register_new_matrix_user
+    -u {{ matrix_admin }}
+    -p {{ matrix_admin_pass }}
+    -a
+    -c /etc/matrix-synapse/homeserver.yaml
+    http://localhost:8008
+  register: admin_create
+  failed_when: false
+  changed_when: admin_create.rc == 0

phantom/playbooks/matrix/templates/homeserver.yaml.j2

@@ -0,0 +1,53 @@
+## Synapse Homeserver Configuration
+## Generated by phantom
+
+server_name: "{{ matrix_server_name }}"
+pid_file: /run/matrix-synapse.pid
+
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+
+database:
+  name: psycopg2
+  args:
+    user: synapse
+    password: "{{ matrix_signing_key[:32] }}"
+    database: synapse
+    host: localhost
+    cp_min: 5
+    cp_max: 10
+
+log_config: "/etc/matrix-synapse/log.yaml"
+media_store_path: /var/lib/matrix-synapse/media
+signing_key_path: "/etc/matrix-synapse/{{ matrix_server_name }}.signing.key"
+
+enable_registration: {{ matrix_registration_enabled | lower }}
+{% if not matrix_registration_enabled %}
+enable_registration_without_verification: false
+{% endif %}
+
+suppress_key_server_warning: true
+
+trusted_key_servers:
+  - server_name: "matrix.org"
+
+max_upload_size: 50M
+
+url_preview_enabled: true
+url_preview_ip_range_blacklist:
+  - '127.0.0.0/8'
+  - '10.0.0.0/8'
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '192.0.0.0/24'
+  - '169.254.0.0/16'
+  - '::1/128'
+  - 'fe80::/10'
+  - 'fc00::/7'

phantom/playbooks/media/main.yml

@@ -0,0 +1,11 @@
+---
+# Media deployment — Coming soon
+# This is a stub playbook. Full implementation planned.
+
+- name: Deploy Media Server
+  hosts: all
+  become: true
+  tasks:
+    - name: Placeholder
+      debug:
+        msg: "Media playbook not yet implemented. Check phantom/README.md for status."

phantom/playbooks/vault/main.yml

@@ -0,0 +1,11 @@
+---
+# Vault deployment — Coming soon
+# This is a stub playbook. Full implementation planned.
+
+- name: Deploy Vault Server
+  hosts: all
+  become: true
+  tasks:
+    - name: Placeholder
+      debug:
+        msg: "Vault playbook not yet implemented. Check phantom/README.md for status."

phantom/playbooks/vpn/main.yml

@@ -0,0 +1,20 @@
+---
+# WireGuard VPN server deployment
+
+- name: Deploy WireGuard VPN Server
+  hosts: all
+  become: true
+  vars:
+    wg_port: "{{ vpn_port | default(51820) }}"
+    wg_clients: "{{ vpn_client_count | default(3) }}"
+    wg_dns: "{{ vpn_dns | default('1.1.1.1') }}"
+    wg_subnet: "{{ vpn_subnet | default('10.66.66.0/24') }}"
+    wg_allowed_ips: "{{ vpn_allowed_ips | default('0.0.0.0/0, ::/0') }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
+  tasks:
+    - name: Include WireGuard installation tasks
+      include_tasks: tasks/install.yml
+
+    - name: Include WireGuard configuration tasks
+      include_tasks: tasks/configure.yml

phantom/playbooks/vpn/tasks/configure.yml

@@ -0,0 +1,88 @@
+---
+# WireGuard server and client configuration
+
+- name: Detect primary network interface
+  shell: ip route get 1.1.1.1 | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}'
+  register: primary_interface
+  changed_when: false
+
+- name: Generate client keys
+  shell: |
+    mkdir -p /etc/wireguard/clients
+    for i in $(seq 1 {{ wg_clients }}); do
+      if [ ! -f /etc/wireguard/clients/client${i}_private.key ]; then
+        wg genkey | tee /etc/wireguard/clients/client${i}_private.key | wg pubkey > /etc/wireguard/clients/client${i}_public.key
+        wg genpsk > /etc/wireguard/clients/client${i}_psk.key
+        chmod 600 /etc/wireguard/clients/client${i}_*.key
+      fi
+    done
+  args:
+    creates: /etc/wireguard/clients/client1_private.key
+
+- name: Build WireGuard server config
+  shell: |
+    SERVER_PRIVKEY=$(cat /etc/wireguard/server_private.key)
+    IFACE={{ primary_interface.stdout | trim }}
+
+    cat > /etc/wireguard/wg0.conf << EOF
+    [Interface]
+    Address = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '.1/24') }}
+    ListenPort = {{ wg_port }}
+    PrivateKey = ${SERVER_PRIVKEY}
+    PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ${IFACE} -j MASQUERADE
+    PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ${IFACE} -j MASQUERADE
+
+    EOF
+
+    for i in $(seq 1 {{ wg_clients }}); do
+      CLIENT_PUBKEY=$(cat /etc/wireguard/clients/client${i}_public.key)
+      CLIENT_PSK=$(cat /etc/wireguard/clients/client${i}_psk.key)
+      cat >> /etc/wireguard/wg0.conf << EOF
+    [Peer]
+    # Client ${i}
+    PublicKey = ${CLIENT_PUBKEY}
+    PresharedKey = ${CLIENT_PSK}
+    AllowedIPs = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '') }}.$(( i + 1 ))/32
+
+    EOF
+    done
+
+    chmod 600 /etc/wireguard/wg0.conf
+  args:
+    creates: /etc/wireguard/wg0.conf
+
+- name: Generate client config files
+  shell: |
+    SERVER_PUBKEY=$(echo '{{ server_privkey_content.content | b64decode | trim }}' | wg pubkey)
+    SERVER_ENDPOINT="{{ target_host }}:{{ wg_port }}"
+
+    for i in $(seq 1 {{ wg_clients }}); do
+      CLIENT_PRIVKEY=$(cat /etc/wireguard/clients/client${i}_private.key)
+      CLIENT_PSK=$(cat /etc/wireguard/clients/client${i}_psk.key)
+      CLIENT_IP="{{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '') }}.$(( i + 1 ))"
+
+      cat > /etc/wireguard/clients/client${i}.conf << EOF
+    [Interface]
+    PrivateKey = ${CLIENT_PRIVKEY}
+    Address = ${CLIENT_IP}/32
+    DNS = {{ wg_dns }}
+
+    [Peer]
+    PublicKey = ${SERVER_PUBKEY}
+    PresharedKey = ${CLIENT_PSK}
+    Endpoint = ${SERVER_ENDPOINT}
+    AllowedIPs = {{ wg_allowed_ips }}
+    PersistentKeepalive = 25
+    EOF
+
+      # Generate QR code
+      qrencode -t ansiutf8 < /etc/wireguard/clients/client${i}.conf > /etc/wireguard/clients/client${i}_qr.txt 2>/dev/null || true
+    done
+  args:
+    creates: /etc/wireguard/clients/client1.conf
+
+- name: Enable and start WireGuard
+  systemd:
+    name: wg-quick@wg0
+    state: started
+    enabled: true

phantom/playbooks/vpn/tasks/install.yml

@@ -0,0 +1,54 @@
+---
+# WireGuard installation and server key generation
+
+- name: Install WireGuard
+  apt:
+    name:
+      - wireguard
+      - wireguard-tools
+      - qrencode
+    state: present
+  when: ansible_os_family == "Debian"
+
+- name: Enable IP forwarding (IPv4)
+  sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    sysctl_set: true
+    reload: true
+
+- name: Enable IP forwarding (IPv6)
+  sysctl:
+    name: net.ipv6.conf.all.forwarding
+    value: "1"
+    sysctl_set: true
+    reload: true
+
+- name: Generate server private key
+  shell: wg genkey
+  register: wg_server_privkey
+  args:
+    creates: /etc/wireguard/server_private.key
+
+- name: Save server private key
+  copy:
+    content: "{{ wg_server_privkey.stdout }}"
+    dest: /etc/wireguard/server_private.key
+    mode: "0600"
+  when: wg_server_privkey.changed
+
+- name: Read server private key
+  slurp:
+    src: /etc/wireguard/server_private.key
+  register: server_privkey_content
+
+- name: Generate server public key
+  shell: "echo '{{ server_privkey_content.content | b64decode | trim }}' | wg pubkey"
+  register: wg_server_pubkey
+  changed_when: false
+
+- name: Allow WireGuard port through UFW
+  ufw:
+    rule: allow
+    port: "{{ wg_port }}"
+    proto: udp

phantom/providers/aws.yml

@@ -0,0 +1,105 @@
+---
+# Provision an AWS EC2 instance for phantom deployment
+# Requires: aws_access_key, aws_secret_key variables
+
+- name: Provision AWS EC2 Instance
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  vars:
+    aws_region: "{{ region | default('us-east-1') }}"
+    ec2_instance_type: "{{ instance_type | default('t3.micro') }}"
+    ec2_ami: "{{ ami | default('') }}"
+    ec2_key_name: "phantom-{{ deploy_id }}"
+    ssh_key_path: "{{ ssh_key }}.pub"
+
+  environment:
+    AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
+    AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
+    AWS_DEFAULT_REGION: "{{ aws_region }}"
+
+  tasks:
+    - name: Read SSH public key
+      slurp:
+        src: "{{ ssh_key_path }}"
+      register: ssh_pubkey
+
+    - name: Import SSH key to AWS
+      amazon.aws.ec2_key:
+        name: "{{ ec2_key_name }}"
+        key_material: "{{ ssh_pubkey.content | b64decode | trim }}"
+        region: "{{ aws_region }}"
+
+    - name: Find latest Debian AMI (if not specified)
+      amazon.aws.ec2_ami_info:
+        region: "{{ aws_region }}"
+        owners: ["136693071363"]
+        filters:
+          name: "debian-12-amd64-*"
+          architecture: x86_64
+          virtualization-type: hvm
+      register: ami_results
+      when: ec2_ami == ""
+
+    - name: Set AMI fact
+      set_fact:
+        ec2_ami: "{{ (ami_results.images | sort(attribute='creation_date') | last).image_id }}"
+      when: ec2_ami == ""
+
+    - name: Create security group
+      amazon.aws.ec2_security_group:
+        name: "phantom-{{ deploy_id }}"
+        description: "phantom deployment {{ deploy_id }}"
+        region: "{{ aws_region }}"
+        rules:
+          - proto: tcp
+            from_port: 22
+            to_port: 22
+            cidr_ip: 0.0.0.0/0
+          - proto: tcp
+            from_port: 80
+            to_port: 80
+            cidr_ip: 0.0.0.0/0
+          - proto: tcp
+            from_port: 443
+            to_port: 443
+            cidr_ip: 0.0.0.0/0
+      register: sg_result
+
+    - name: Launch EC2 instance
+      amazon.aws.ec2_instance:
+        name: "phantom-{{ deploy_id }}"
+        key_name: "{{ ec2_key_name }}"
+        instance_type: "{{ ec2_instance_type }}"
+        image_id: "{{ ec2_ami }}"
+        region: "{{ aws_region }}"
+        security_group: "{{ sg_result.group_id }}"
+        wait: true
+        state: running
+      register: ec2_result
+
+    - name: Set target host fact
+      set_fact:
+        target_host: "{{ ec2_result.instances[0].public_ip_address }}"
+
+    - name: Display instance info
+      debug:
+        msg: |
+          EC2 instance provisioned:
+            ID: {{ ec2_result.instances[0].instance_id }}
+            IP: {{ target_host }}
+            Region: {{ aws_region }}
+            Type: {{ ec2_instance_type }}
+
+    - name: Write provisioned host IP for phantom
+      copy:
+        content: "{{ target_host }}"
+        dest: "{{ _host_output_file }}"
+      when: _host_output_file is defined
+
+    - name: Wait for SSH
+      wait_for:
+        host: "{{ target_host }}"
+        port: 22
+        delay: 15
+        timeout: 300

phantom/providers/flokinet.yml

@@ -0,0 +1,30 @@
+---
+# Register a pre-provisioned FlokiNET server for phantom deployment
+# FlokiNET servers are provisioned manually via their control panel.
+# This playbook only validates SSH connectivity and prepares the server.
+
+- name: Register FlokiNET Server
+  hosts: all
+  become: true
+  gather_facts: false
+
+  tasks:
+    - name: Ensure Python is available for Ansible
+      raw: test -e /usr/bin/python3 || (apt-get update && apt-get install -y python3)
+      changed_when: false
+
+    - name: Gather facts now that Python is available
+      setup:
+
+    - name: Verify SSH connectivity
+      ping:
+
+    - name: Display server info
+      debug:
+        msg: |
+          FlokiNET server registered:
+            Hostname: {{ ansible_hostname }}
+            OS: {{ ansible_distribution }} {{ ansible_distribution_version }}
+            IP: {{ ansible_default_ipv4.address | default(target_host) }}
+            RAM: {{ ansible_memtotal_mb }}MB
+            Cores: {{ ansible_processor_vcpus }}

phantom/providers/linode.yml

@@ -0,0 +1,66 @@
+---
+# Provision a Linode instance for phantom deployment
+# Requires: LINODE_API_TOKEN or api_token variable
+
+- name: Provision Linode Instance
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  vars:
+    linode_token: "{{ api_token }}"
+    linode_region: "{{ region | default('us-east') }}"
+    linode_plan: "{{ plan | default('g6-nanode-1') }}"
+    linode_image: "{{ image | default('linode/debian12') }}"
+    linode_label: "phantom-{{ deploy_id }}"
+    ssh_key_path: "{{ ssh_key }}.pub"
+
+  tasks:
+    - name: Read SSH public key
+      slurp:
+        src: "{{ ssh_key_path }}"
+      register: ssh_pubkey
+
+    - name: Create Linode instance
+      uri:
+        url: https://api.linode.com/v4/linode/instances
+        method: POST
+        headers:
+          Authorization: "Bearer {{ linode_token }}"
+          Content-Type: application/json
+        body_format: json
+        body:
+          type: "{{ linode_plan }}"
+          region: "{{ linode_region }}"
+          image: "{{ linode_image }}"
+          label: "{{ linode_label }}"
+          authorized_keys:
+            - "{{ ssh_pubkey.content | b64decode | trim }}"
+          booted: true
+        status_code: 200
+      register: linode_result
+
+    - name: Set target host fact
+      set_fact:
+        target_host: "{{ linode_result.json.ipv4[0] }}"
+
+    - name: Display instance info
+      debug:
+        msg: |
+          Linode provisioned:
+            ID: {{ linode_result.json.id }}
+            IP: {{ linode_result.json.ipv4[0] }}
+            Region: {{ linode_region }}
+            Plan: {{ linode_plan }}
+
+    - name: Write provisioned host IP for phantom
+      copy:
+        content: "{{ target_host }}"
+        dest: "{{ _host_output_file }}"
+      when: _host_output_file is defined
+
+    - name: Wait for SSH
+      wait_for:
+        host: "{{ target_host }}"
+        port: 22
+        delay: 10
+        timeout: 300