n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
98 lines
5.4 KiB
Plaintext
98 lines
5.4 KiB
Plaintext
# /etc/opsec/opsec.conf — Central OPSEC Configuration
|
|
# Shell-sourceable KEY="value" format. All scripts source this file.
|
|
# Edit via: sudo opsec-config.sh (interactive TUI)
|
|
# Manual edits: source /usr/local/lib/opsec/opsec-lib.sh && opsec_set_value KEY "value"
|
|
|
|
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
|
PROFILE_NAME="default"
|
|
|
|
# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
|
|
TOR_CIRCUIT_ROTATION="30"
|
|
TOR_BLACKLIST="us,gb,ca,au,nz"
|
|
TOR_STRICT_NODES="0"
|
|
TOR_ISOLATION="1"
|
|
TOR_PADDING="1"
|
|
TOR_SOCKS_PORT="9050"
|
|
TOR_DNS_PORT="5353"
|
|
TOR_TRANS_PORT="9040"
|
|
TOR_NUM_GUARDS="3"
|
|
TOR_SAFE_LOGGING="1"
|
|
|
|
# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
|
|
# Mode: tor | quad9 | cloudflare | doh | dot | custom
|
|
DNS_MODE="tor"
|
|
DNS_CUSTOM_SERVERS=""
|
|
|
|
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
|
KILLSWITCH_ALLOW_DHCP="1"
|
|
KILLSWITCH_ALLOW_OPENVPN="1"
|
|
KILLSWITCH_ALLOW_WIREGUARD="1"
|
|
KILLSWITCH_EXTRA_PORTS=""
|
|
|
|
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
|
# Interfaces: auto (all non-lo) or comma-separated list (e.g. "eth0,wlan0")
|
|
MAC_INTERFACES="auto"
|
|
# Vendor spoof: empty for random, or OUI prefix (e.g. "00:1A:2B" for specific vendor)
|
|
MAC_VENDOR_SPOOF=""
|
|
|
|
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
|
# Pattern: desktop | random | custom
|
|
HOSTNAME_PATTERN="random"
|
|
HOSTNAME_CUSTOM_PREFIX="workstation"
|
|
|
|
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
|
HARDEN_IPV6="1"
|
|
HARDEN_SWAP="1"
|
|
HARDEN_CORE_DUMPS="1"
|
|
HARDEN_CLIPBOARD_CLEAR="1"
|
|
HARDEN_SCREEN_LOCK="1"
|
|
HARDEN_SCREEN_LOCK_TIMEOUT="300"
|
|
HARDEN_TIMEZONE_SPOOF="0"
|
|
HARDEN_TIMEZONE_VALUE="UTC"
|
|
HARDEN_LOCALE_SPOOF="0"
|
|
HARDEN_LOCALE_VALUE="en_US.UTF-8"
|
|
|
|
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
|
LEAK_WEBRTC_BLOCK="1"
|
|
LEAK_USB_BLOCK="1"
|
|
|
|
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
|
MONITOR_PROCESSES="1"
|
|
MONITOR_LOG_ROTATION="1"
|
|
LOG_ROTATION_HOURS="4"
|
|
|
|
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
|
TRAFFIC_JITTER_ENABLED="0"
|
|
TRAFFIC_JITTER_MS="50"
|
|
|
|
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
|
# standard = privacy base, ghost mode toggle available
|
|
# paranoid = ghost mode always on, cannot disable
|
|
LEVEL_TYPE="standard"
|
|
|
|
# ─── BASE STATE (always active in standard mode) ─────────────────────────────
|
|
BASE_DNS="quad9"
|
|
BASE_MAC_RANDOMIZE="1"
|
|
BASE_IPV6_DISABLE="1"
|
|
|
|
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
|
# Mode: off | obfs4 | meek-azure | snowflake
|
|
TOR_BRIDGE_MODE="off"
|
|
TOR_BRIDGE_RELAY=""
|
|
|
|
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
|
# Method: auto | shred | fstrim | luks
|
|
WIPE_METHOD="auto"
|
|
|
|
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
|
# Level: bare-metal-standard | bare-metal-paranoid | cloud-normal | cloud-paranoid
|
|
DEPLOYMENT_LEVEL="bare-metal"
|
|
|
|
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
|
# Mode: compact | full | auto | off
|
|
OPSEC_BANNER="full"
|
|
|
|
# ─── WIDGET THEME ────────────────────────────────────────────────────────────
|
|
# Theme: default | aurora | ember | slate | cyberpunk | frost | terminal
|
|
WIDGET_THEME="apt"
|