n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
113 lines
3.2 KiB
YAML
113 lines
3.2 KiB
YAML
---
|
|
# Provision an AWS EC2 instance for phantom deployment
|
|
# Requires: aws_access_key, aws_secret_key variables
|
|
|
|
- name: Provision AWS EC2 Instance
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
vars:
|
|
deploy_id: "{{ deployment_id }}"
|
|
aws_region: "{{ region | default('us-east-1') }}"
|
|
ec2_instance_type: "{{ instance_type | default('t3.micro') }}"
|
|
ec2_ami: "{{ ami | default('') }}"
|
|
ec2_key_name: "ph-{{ deployment_id }}"
|
|
ssh_key_path: "{{ ssh_key }}.pub"
|
|
|
|
environment:
|
|
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
|
AWS_DEFAULT_REGION: "{{ aws_region }}"
|
|
|
|
tasks:
|
|
- name: Read SSH public key
|
|
slurp:
|
|
src: "{{ ssh_key_path }}"
|
|
register: ssh_pubkey
|
|
|
|
- name: Import SSH key to AWS
|
|
amazon.aws.ec2_key:
|
|
name: "{{ ec2_key_name }}"
|
|
key_material: "{{ ssh_pubkey.content | b64decode | trim }}"
|
|
region: "{{ aws_region }}"
|
|
|
|
- name: Find latest Debian AMI (if not specified)
|
|
amazon.aws.ec2_ami_info:
|
|
region: "{{ aws_region }}"
|
|
owners: ["136693071363"]
|
|
filters:
|
|
name: "debian-12-amd64-*"
|
|
architecture: x86_64
|
|
virtualization-type: hvm
|
|
register: ami_results
|
|
when: ec2_ami == ""
|
|
|
|
- name: Set AMI fact
|
|
set_fact:
|
|
ec2_ami: "{{ (ami_results.images | sort(attribute='creation_date') | last).image_id }}"
|
|
when: ec2_ami == ""
|
|
|
|
- name: Create security group
|
|
amazon.aws.ec2_security_group:
|
|
name: "ph-{{ deploy_id }}"
|
|
description: "phantom deployment {{ deploy_id }}"
|
|
region: "{{ aws_region }}"
|
|
rules:
|
|
- proto: tcp
|
|
from_port: 22
|
|
to_port: 22
|
|
cidr_ip: 0.0.0.0/0
|
|
- proto: tcp
|
|
from_port: 80
|
|
to_port: 80
|
|
cidr_ip: 0.0.0.0/0
|
|
- proto: tcp
|
|
from_port: 443
|
|
to_port: 443
|
|
cidr_ip: 0.0.0.0/0
|
|
register: sg_result
|
|
|
|
- name: Launch EC2 instance
|
|
amazon.aws.ec2_instance:
|
|
name: "ph-{{ deploy_id }}"
|
|
key_name: "{{ ec2_key_name }}"
|
|
instance_type: "{{ ec2_instance_type }}"
|
|
image_id: "{{ ec2_ami }}"
|
|
region: "{{ aws_region }}"
|
|
security_group: "{{ sg_result.group_id }}"
|
|
wait: true
|
|
state: running
|
|
register: ec2_result
|
|
|
|
- name: Set target host fact
|
|
set_fact:
|
|
target_host: "{{ ec2_result.instances[0].public_ip_address }}"
|
|
|
|
- name: Display instance info
|
|
debug:
|
|
msg: |
|
|
EC2 instance provisioned:
|
|
ID: {{ ec2_result.instances[0].instance_id }}
|
|
IP: {{ target_host }}
|
|
Region: {{ aws_region }}
|
|
Type: {{ ec2_instance_type }}
|
|
|
|
- name: Write provisioned host IP for phantom
|
|
copy:
|
|
content: "{{ target_host }}"
|
|
dest: "{{ _host_output_file }}"
|
|
when: _host_output_file is defined
|
|
|
|
- name: Write instance ID for teardown
|
|
copy:
|
|
content: "{{ ec2_result.instances[0].instance_id }}"
|
|
dest: "{{ _host_output_file | dirname }}/instance_id"
|
|
when: _host_output_file is defined
|
|
|
|
- name: Wait for SSH
|
|
wait_for:
|
|
host: "{{ target_host }}"
|
|
port: 22
|
|
delay: 15
|
|
timeout: 300
|