diff --git a/.gitignore b/.gitignore index 6c33b32..f497be5 100644 --- a/.gitignore +++ b/.gitignore @@ -3,7 +3,9 @@ roles/Nazara/files/dns roles/Nazara/files/dhcp roles/Node/files/vm-definitions/** roles/ShadowArch/files/mirrorlist -venv/ +roles/Foundation/files/custom/public/img/** +venv/** +**/pkg/** **pkg.tar.zst # ---> Python diff --git a/examples/msn0.yml b/examples/msn0.yml index c4273c5..07505b6 100644 --- a/examples/msn0.yml +++ b/examples/msn0.yml @@ -38,8 +38,8 @@ all: static: true sslidentity: aninix.net-0001 secdetection: true - iptv_location: Milwaukee - Node0: + iptv_location: "Milwaukee|Madison" + Node0: ipinterface: enp1s0f0 ip: 10.0.1.4 mac: DE:8B:9E:19:55:1D @@ -67,7 +67,7 @@ all: memory: 2 vnc: 9 bridge: br0 - disks: + disks: - '-drive format=raw,index=0,media=disk,file=/dev/sdd' Maat: ip: 10.0.1.18 @@ -147,7 +147,7 @@ all: cores: 2 memory: 2 bridge: br0 - vnc: 6 + vnc: 10 disks: - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test1.qcow2' test2: @@ -157,7 +157,7 @@ all: cores: 2 memory: 2 bridge: br0 - vnc: 5 + vnc: 11 disks: - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test2.qcow2' test3: @@ -167,7 +167,7 @@ all: cores: 2 memory: 2 bridge: br0 - vnc: 4 + vnc: 12 disks: - '-drive format=qcow2,l2-cache-size=8M,file=/srv/maat/vm/test3.qcow2' appliances: @@ -183,7 +183,7 @@ all: mac: 70:74:14:4F:8E:42 Games: ip: 10.0.1.66 - mac: 00:1F:BC:10:1C:F8 + mac: E0:BE:03:77:0E:88 Print: ip: 10.0.1.67 mac: 00:80:92:77:CE:E4 @@ -201,7 +201,7 @@ all: mac: 80:D2:1D:17:63:10 Tachikoma: ip: 10.0.1.72 - mac: B8:76:3F:70:DB:C1 + mac: 90:0f:0c:1a:d3:23 Dedsec: ip: 10.0.1.73 mac: 34:F6:4B:36:12:8F diff --git a/playbooks/vars-debugging.yml b/playbooks/vars-debugging.yml index 5207c3c..696587b 100644 --- a/playbooks/vars-debugging.yml +++ b/playbooks/vars-debugging.yml @@ -12,7 +12,7 @@ # Expects ANSIBLE_VAULT_FILE to be set in the environment to path the vault # Also set ANSIBLE_VAULT_PASSWORD_FILE to your password file location if you want it. # -- hosts: "{{ targets | default('all') }}" +- hosts: "{{ targets | default('managed') }}" order: sorted serial: "{{ threads | default('8') }}" gather_facts: true diff --git a/precommit-hooks/find-incomplete-roles b/precommit-hooks/find-incomplete-roles index ad84081..e69de29 100644 --- a/precommit-hooks/find-incomplete-roles +++ b/precommit-hooks/find-incomplete-roles @@ -1,19 +0,0 @@ -#!/bin/bash - -cd ~/src/Ubiqtorate/roles - -if [ -n "$(git status | grep roles &>/dev/null)" ]; then - echo There are roles that are not committed yet. - exit 1; -fi - -unset bad -for i in `ls -1`; do - if ! grep "$i" ../playbooks/deploy.yml &>/dev/null; then - echo "$i is not used in playbooks/deploy.yml" - bad="1" - fi -done -if [ -n "$bad" ]; then - exit 1; -fi diff --git a/precommit-hooks/find-large-files b/precommit-hooks/find-large-files new file mode 100644 index 0000000..a37c96b --- /dev/null +++ b/precommit-hooks/find-large-files @@ -0,0 +1,10 @@ +#!/bin/bash + +# Limit files in git to 1M. +find . -type f -exec du -k {} \; | egrep -v '^[[:digit:]]?[[:digit:]]?[[:digit:]][[:space:]]|\s./.git/' + +if [ $? -ne 1 ]; then + echo + echo "These files are probably larger than you want to commit to Git. Please try to find an alternate delivery path, such as a CDN or Git-LFS." + exit 1; +fi diff --git a/precommit-hooks/find-missing-customizations b/precommit-hooks/find-missing-customizations new file mode 100644 index 0000000..2c2921f --- /dev/null +++ b/precommit-hooks/find-missing-customizations @@ -0,0 +1,14 @@ +#!/bin/bash + +retcode=0 +for host in `ansible -i "examples/msn0.yml" --list-hosts managed | grep -v ' hosts '`; do + if [ ! -f roles/ShadowArch/files/motd/"$host" ]; then + echo "Need MOTD for $host" + retcode=1; + fi + if [ ! -f roles/Sharingan/files/monit/hostdefs/"$host" ]; then + echo "Need Sharingan-Data file for $host" + retcode=1; + fi +done +exit $retcode diff --git a/precommit-hooks/find-passwords-in-files b/precommit-hooks/find-passwords-in-files new file mode 100644 index 0000000..c19204f --- /dev/null +++ b/precommit-hooks/find-passwords-in-files @@ -0,0 +1,28 @@ +#!/bin/bash + +# Ignore Ansibilized templates. +saferegex='\s+}}"?\s*$' +# Ignore comments +saferegex="$saferegex"'|^[a-z,A-Z,0-9,_,-,/,.]+:\s*;|^[a-z,A-Z,0-9,_,-,/,.]+:\s*#|^[a-z,A-Z,0-9,_,-,/,.]+:\s*//' +# Ignore binary file matches. +saferegex="$saferegex"'|binary\ file\ matches' +# AniNIX Constructs +saferegex="$saferegex"'|password.aninix.net|aur.list' +# Web constructs +saferegex="$saferegex"'|.css:|.html:|.md:|htdocs|htpasswd' +# Ignore template text to set policy +saferegex="$saferegex"'|_LENGTH|Set new|attempt|pwdchange' +# haveibeenpwned is referenced in comments +saferegex="$saferegex"'|haveibeenpwned' +# Unset variables. +saferegex="$saferegex"'|\s+=\s*$|\s+yes$|\s+no$' +# Ignore LDAP attributes +saferegex="$saferegex"'|pwpolicies|pwdLastSuccess|pwdAttribute|pwdMaxAge|pwdExpireWarning|pwdInHistory|pwdCheckQuality|pwdMaxFailure|pwdLockout|pwdLockoutDuration|pwdGraceAuthNLimit|pwdFailureCountInterval|pwdMustChange|pwdMinLength|pwdAllowUserChange|pwdSafeModify|pwdChangedTime|pwdPolicy|last changed their password on|/root/.ldappass' + +egrep -ir 'secret|password|pw|passphrase' roles/*/{files,templates} 2>&1 | egrep -v "$saferegex" +if [ $? -ne 1 ]; then + echo + echo If these are false positives, you need to add the signature to the whitelist in $0. + echo Otherwise, convert any files above to templates and encode the passphrase into your vault. + exit 1; +fi diff --git a/roles/Cyberbrain/tasks/main.yml b/roles/Cyberbrain/tasks/main.yml index 641e76a..0f09ae3 100644 --- a/roles/Cyberbrain/tasks/main.yml +++ b/roles/Cyberbrain/tasks/main.yml @@ -8,7 +8,7 @@ - name: Standardize the servicefile become: yes register: servicefile - copy: + copy: src: cyberbrain.service dest: /usr/lib/systemd/system/cyberbrain.service owner: root @@ -20,7 +20,7 @@ service: name: webssh state: stopped - enabled: no + enabled: no - systemd: daemon_reload: true diff --git a/roles/DarkNet/README.md b/roles/DarkNet/README.md index d640890..376c285 100644 --- a/roles/DarkNet/README.md +++ b/roles/DarkNet/README.md @@ -11,8 +11,8 @@ A basic VM to provide DarkNet functionality in an AniNIX replica only needs the * Virtualized NIC * 150G of storage for any [AniNIX/WolfPack](/AniNIX/WolfPack) downloads, preferably on a unique physical harddrive that can be pulled and drilled -# Hosted Services -The DarkNet uses a small package list. It uses a couple services to achieve its goals. First, it uses [NordVPN](http://nordvpn.com/) to protect all traffic -- very simply, all one has to do to connect to the VPN is to run `nordvpn connect` and provide your login credentials to the service. We also use TOR for further anonymity -- torsocks and tor-browser-en provide functionality to cover that. +# Hosted Services +The DarkNet uses a small package list. It uses a couple services to achieve its goals. First, it uses [NordVPN](http://nordvpn.com/) to protect all traffic -- very simply, all one has to do to connect to the VPN is to run `nordvpn connect` and provide your login credentials to the service. We also use TOR for further anonymity -- torsocks and tor-browser-en provide functionality to cover that. We recommend whitelisting your replica's subnet so that NordVPN doesn't see local traffic and services like log aggregation and administration can happen without exposing access across the VPN. ``` diff --git a/roles/DarkNet/tasks/main.yml b/roles/DarkNet/tasks/main.yml index 111073c..2470e04 100644 --- a/roles/DarkNet/tasks/main.yml +++ b/roles/DarkNet/tasks/main.yml @@ -18,7 +18,7 @@ name: "{{ item }}" state: started enabled: yes - loop: + loop: - tor - nordvpnd - deluged @@ -26,3 +26,9 @@ - debug: msg: "Remember to use the nordvpn-bin command to set up your account." + + # TODO Add yaml for OVPN file, user, pass to Vault + # TODO Enforce vpn.service on server instead of nordvpnd. + # TODO Add /etc/bashrc.d file for `alias torlynx='torsocks elinks https://check.torproject.org/'` + # TODO Add monit checks for tor and openvpn services + # TODO Shift deluged to WolfPack diff --git a/roles/DedSec/tasks/main.yml b/roles/DedSec/tasks/main.yml new file mode 100644 index 0000000..e4b3fe3 --- /dev/null +++ b/roles/DedSec/tasks/main.yml @@ -0,0 +1,8 @@ +--- + # Consider https://blackarch.org/blackarch-guide-en.pdf + - name: Install DedSec packages + become: yes + package: + name: + - tcpdump + - wireshark diff --git a/roles/Foundation/files/custom/bin/gen-aninix-custom b/roles/Foundation/files/custom/bin/gen-aninix-custom index 5e5c607..300decb 100644 --- a/roles/Foundation/files/custom/bin/gen-aninix-custom +++ b/roles/Foundation/files/custom/bin/gen-aninix-custom @@ -1,7 +1,5 @@ #!/bin/bash -set -x - URI=https://aninix.net/assets/css/theme-arc-green.css # Gitea arc-green palette @@ -59,7 +57,7 @@ a { cd /var/lib/gitea/web-snippets head="$(curl -ks https://aninix.net/ | egrep -B 99999 '^
/var/lib/gitea/custom/public/"$i".html diff --git a/roles/Foundation/files/custom/bin/sitemap.php b/roles/Foundation/files/custom/bin/sitemap.php index 1fed5c8..3b70e8f 100644 --- a/roles/Foundation/files/custom/bin/sitemap.php +++ b/roles/Foundation/files/custom/bin/sitemap.php @@ -1,6 +1,6 @@ - /var/lib/gitea/custom/sitemap.xml` * @@ -15,7 +15,7 @@ echo ' '; exec("(echo /srv/http/aninix.net/index.php; find /srv/http/aninix.net/pages -type f; find /srv/http/aninix.net/martialarts/ -type f) | egrep \.php\$ | egrep -v ^./unlisted\|^./errors/\|head.php\|foot.php\|test\|Template\|darknet", $output); -foreach ($output as &$file) { +foreach ($output as &$file) { echo ' '; echo ' https://aninix.net/'.substr($file,strlen($path)).' @@ -23,10 +23,10 @@ echo ' https://aninix.net/'.substr($file,strlen($path)).' echo ' '.date('Y-m-d',filemtime($file)).' '; echo ' -'; +'; } -/* Print footer */ +/* Print footer */ echo ' '; ?> diff --git a/roles/Foundation/files/custom/options/license/AniNIX-WTFPL b/roles/Foundation/files/custom/options/license/AniNIX-WTFPL index bffb679..e15653d 100644 --- a/roles/Foundation/files/custom/options/license/AniNIX-WTFPL +++ b/roles/Foundation/files/custom/options/license/AniNIX-WTFPL @@ -1,31 +1,31 @@ -# http://www.wtfpl.net/about/ - - DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE - Version 2, December 2004 - - Copyright (C) 2004 Sam Hocevar - - Everyone is permitted to copy and distribute verbatim or modified - copies of this license document, and changing it is allowed as long - as the name is changed. - - DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. You just DO WHAT THE FUCK YOU WANT TO. - - ANINIX ADDENDUM - - Trademark 2017 (https://aninix.net/) - - The "AniNIX" name and |> logo are trademarked as of 2017/11/21. - AniNIX materials may be reproduced and re-used (though you must - contact the admins of the network to get written permission to use - the AniNIX name or logo) so long as such reproduction or re-use - does not inhibit the original AniNIX use of the same. - - Attribution is appreciated for other materials but not legally - required or necessary. - - "AniNIX" trademark serial: 87177883 - |> Logo trademark serial: 87177887 +# http://www.wtfpl.net/about/ + + DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE + Version 2, December 2004 + + Copyright (C) 2004 Sam Hocevar + + Everyone is permitted to copy and distribute verbatim or modified + copies of this license document, and changing it is allowed as long + as the name is changed. + + DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. You just DO WHAT THE FUCK YOU WANT TO. + + ANINIX ADDENDUM + + Trademark 2017 (https://aninix.net/) + + The "AniNIX" name and |> logo are trademarked as of 2017/11/21. + AniNIX materials may be reproduced and re-used (though you must + contact the admins of the network to get written permission to use + the AniNIX name or logo) so long as such reproduction or re-use + does not inhibit the original AniNIX use of the same. + + Attribution is appreciated for other materials but not legally + required or necessary. + + "AniNIX" trademark serial: 87177883 + |> Logo trademark serial: 87177887 diff --git a/roles/Foundation/files/custom/public/img/AniNIX.png b/roles/Foundation/files/custom/public/img/AniNIX.png deleted file mode 100755 index 3b01845..0000000 Binary files a/roles/Foundation/files/custom/public/img/AniNIX.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/avatar_default.png b/roles/Foundation/files/custom/public/img/avatar_default.png deleted file mode 100755 index 3b01845..0000000 Binary files a/roles/Foundation/files/custom/public/img/avatar_default.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/favicon.png b/roles/Foundation/files/custom/public/img/favicon.png deleted file mode 120000 index 8b0f8d2..0000000 --- a/roles/Foundation/files/custom/public/img/favicon.png +++ /dev/null @@ -1 +0,0 @@ -AniNIX.png \ No newline at end of file diff --git a/roles/Foundation/files/custom/public/img/gitea-lg.png b/roles/Foundation/files/custom/public/img/gitea-lg.png deleted file mode 120000 index 8b0f8d2..0000000 --- a/roles/Foundation/files/custom/public/img/gitea-lg.png +++ /dev/null @@ -1 +0,0 @@ -AniNIX.png \ No newline at end of file diff --git a/roles/Foundation/files/custom/public/img/gitea-safari.svg b/roles/Foundation/files/custom/public/img/gitea-safari.svg deleted file mode 120000 index 8b0f8d2..0000000 --- a/roles/Foundation/files/custom/public/img/gitea-safari.svg +++ /dev/null @@ -1 +0,0 @@ -AniNIX.png \ No newline at end of file diff --git a/roles/Foundation/files/custom/public/img/gitea-sm.png b/roles/Foundation/files/custom/public/img/gitea-sm.png deleted file mode 120000 index 8b0f8d2..0000000 --- a/roles/Foundation/files/custom/public/img/gitea-sm.png +++ /dev/null @@ -1 +0,0 @@ -AniNIX.png \ No newline at end of file diff --git a/roles/Foundation/files/custom/public/img/icons b/roles/Foundation/files/custom/public/img/icons deleted file mode 120000 index 5aebaa4..0000000 --- a/roles/Foundation/files/custom/public/img/icons +++ /dev/null @@ -1 +0,0 @@ -/srv/yggdrasil/Pictures/AniNIX/Icons/ \ No newline at end of file diff --git a/roles/Foundation/files/custom/public/img/qr.png b/roles/Foundation/files/custom/public/img/qr.png deleted file mode 100755 index 3dbec4c..0000000 Binary files a/roles/Foundation/files/custom/public/img/qr.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/rss.png b/roles/Foundation/files/custom/public/img/rss.png deleted file mode 100755 index 0925b26..0000000 Binary files a/roles/Foundation/files/custom/public/img/rss.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/discord.ico b/roles/Foundation/files/custom/public/img/social/discord.ico deleted file mode 100755 index ac7417a..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/discord.ico and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/facebook.png b/roles/Foundation/files/custom/public/img/social/facebook.png deleted file mode 100755 index b8770ee..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/facebook.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/github.png b/roles/Foundation/files/custom/public/img/social/github.png deleted file mode 100755 index 17fe0e3..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/github.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/linkedin.png b/roles/Foundation/files/custom/public/img/social/linkedin.png deleted file mode 100755 index 9aa6024..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/linkedin.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/nextdoor.png b/roles/Foundation/files/custom/public/img/social/nextdoor.png deleted file mode 100755 index e94c029..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/nextdoor.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/rss.png b/roles/Foundation/files/custom/public/img/social/rss.png deleted file mode 100755 index 0925b26..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/rss.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/strava.png b/roles/Foundation/files/custom/public/img/social/strava.png deleted file mode 100755 index 5e918f0..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/strava.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/wtfpl.png b/roles/Foundation/files/custom/public/img/social/wtfpl.png deleted file mode 100755 index 035f8ea..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/wtfpl.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/social/youtube.png b/roles/Foundation/files/custom/public/img/social/youtube.png deleted file mode 100755 index 68dda67..0000000 Binary files a/roles/Foundation/files/custom/public/img/social/youtube.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/ushf.jpg b/roles/Foundation/files/custom/public/img/ushf.jpg deleted file mode 100755 index 6520ea8..0000000 Binary files a/roles/Foundation/files/custom/public/img/ushf.jpg and /dev/null differ diff --git a/roles/Foundation/files/custom/public/img/wtfpl.png b/roles/Foundation/files/custom/public/img/wtfpl.png deleted file mode 100755 index 035f8ea..0000000 Binary files a/roles/Foundation/files/custom/public/img/wtfpl.png and /dev/null differ diff --git a/roles/Foundation/files/custom/public/martialarts/mil-gi.jpeg b/roles/Foundation/files/custom/public/martialarts/mil-gi.jpeg deleted file mode 100755 index 40ebba2..0000000 Binary files a/roles/Foundation/files/custom/public/martialarts/mil-gi.jpeg and /dev/null differ diff --git a/roles/Foundation/files/web-snippets/martialarts/index b/roles/Foundation/files/web-snippets/martialarts/index index 4f372f8..ce5320d 100644 --- a/roles/Foundation/files/web-snippets/martialarts/index +++ b/roles/Foundation/files/web-snippets/martialarts/index @@ -17,7 +17,7 @@

- Open-source + Open-source

We want your training with our system to become a part of your life. This means that we provide access to a revision-controlled copy of our notes that all our students can download, keep, and contribute to. We're tired of the old era where how the system works is kept hidden from students and piecemealed out as a marketing ploy -- we want to be as trasparent as possible in how our program and our martial art function. Transparency keeps our instructors honest and our students engaged -- this means a better martial arts experience for everyone. @@ -116,13 +116,13 @@ > Checkout - +

- + +

@@ -170,13 +170,13 @@ > Checkout - +
- + - + +

@@ -225,13 +225,13 @@ > Checkout - +
- + - -

+ +

@@ -296,13 +296,13 @@ > Checkout - +
- +