cloud-config.server.j2

#cloud-config

{%- set cloud_config = 'https://github.com/davedittrich/goSecure/blob/master/cloud-config.server.j2' %}

# See: https://cloudinit.readthedocs.io/en/latest/topics/examples.html

hostname: gosecure-server
manage_etc_hosts: false

groups:
  - gosecure: [pi,pirate]
  - nginx: [pi,pirate]
users:
  - name: pi
    gecos: "goSecure pi"
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    groups: users,docker,video,netdev,gosecure
    plain_text_passwd: "{{ gosecure_pi_password }}"
    lock_passwd: false
    ssh-import-id: None
    ssh-authorized-keys:
      - {{ gosecure_pi_pubkey }}
    ssh_pwauth: true
    chpasswd: { expire: false }
  - name: pirate
    gecos: "pirate"
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    groups: users,docker,video,netdev,gosecure
    plain_text_passwd: "{{ gosecure_pi_password }}"
    lock_passwd: false
    ssh-import-id: None
    ssh_pwauth: true
    ssh-authorized-keys:
      - {{ gosecure_pi_pubkey }}
    chpasswd: { expire: false }

package_upgrade: false

# Set the locale of the system
locale: "{{ gosecure_pi_locale }}"

# Set the timezone
# Value of 'timezone' must exist in /usr/share/zoneinfo
timezone: "{{ gosecure_pi_timezone }}"

write_files:
  - content: |
      # File created by {{ cloud_config }}

      127.0.1.1 gosecure-server.localdomain gosecure-server
      127.0.0.1 localhost
      # For development and network reconfiguration via Ansible
      192.168.50.1 setup client
      192.168.50.2 server

      ::1 ipv6-localhost ipv6-loopback
      fe00::0 ipv6-localnet
      ff00::0 ipv6-mcastprefix
      ff02::1 ipv6-allnodes
      ff02::2 ipv6-allrouters
      ff02::3 ipv6-allhosts
    path: /etc/hosts
  - content: |
      {{ gosecure_vpn_client_id }} : PSK {{ gosecure_vpn_client_psk }}
    path: /etc/ipsec.secrets
    owner: root:root
    permissions: '0600'
  - content: |
      net.ipv6.conf.all.disable_ipv6=1
    path: /etc/sysctl.d/local.conf
  - content: |
      auto wlan0
      allow-hotplug wlan0
      iface wlan0 inet manual
          wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
    path: /etc/network/interfaces.d/wlan0
  - content: |
      country={{ gosecure_pi_wifi_country }}
      ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
      update_config=1
      network={
         ssid="{{ gosecure_client_ssid }}"
         psk="{{ gosecure_client_psk }}"
      }
    path: /etc/wpa_supplicant/wpa_supplicant.conf
    owner: root:root
    permissions: '0600'
  - content: |
      # KEYBOARD CONFIGURATION FILE

      # Consult the keyboard(5) manual page.

      XKBMODEL="{{ gosecure_pi_keyboard_model }}"
      XKBLAYOUT="{{ gosecure_pi_keyboard_layout }}"
      XKBVARIANT=""
      XKBOPTIONS=""

      BACKSPACE="guess"
    path: /etc/default/keyboard
  - content: |
      # File created by {{ cloud_config }}
      config setup

      conn %default
              ikelifetime=60m
              keylife=20m
              rekeymargin=3m
              keyingtries=1
              keyexchange=ikev1
              left=%defaultroute
              leftsubnet=0.0.0.0/0
              leftid=@gosecure
              leftfirewall=yes
              right=%any
              rightsourceip=172.16.176.100/27
              auto=add
              authby=secret
              ike=aes256-sha384-ecp384!
              esp=aes256gcm128!
              aggressive=yes

      conn rw-client1
              rightid={{ gosecure_vpn_client_id }}

      # To add additional clients:
      # conn rw-client2 # increment the last number by 1 for each additional client
      #        rightid=<unique_id_of_client> # set a unique id for each client
    path: /etc/ipsec.conf
    owner: root:root
    permissions: '0600'
# - content: |
#     hostname
#     clientid
#     persistent
#     slaac private
#     option rapid_commit
#     option domain_name_servers,domain_name,domain_search,host_name
#     option classless_static_routes
#     option ntpservers
#     option interface_mtu
#     require dhcp_server_identifier
#   path: /etc/dhcpcd.conf
# - content: |
#     domain-needed
#     bogus-priv
#     server=8.8.8.8
#     server=8.8.4.4
#     cache-size=4096
#     local=/home/
#     expand-hosts
#     domain=gosecure
#     dhcp-range=192.168.50.101,192.168.50.200,255.255.255.0,14d
#     dhcp-option=option:router,192.168.50.1
#     dhcp-option=252,"\n"
#     log-facility=/var/log/dnsmasq.log
#     log-async
#     log-dhcp
#   path: /etc/dnsmasq.conf
  - content: |
      auto eth0:1
      allow-hotplug eth0:1
      iface eth0 inet static
      address 192.168.50.2
      netmask 255.255.255.0

    path: /etc/network/interfaces.d/eth0:1

# Install any additional apt packages you need here
packages:
 - ntp
 - curl
 - unzip
 - rsync
 - nginx
 - dnsmasq
 - rng-tools
 - rpi-update

# These commands will be only be run once on first boot
runcmd:
  - 'systemctl enable rng-tools'
  - 'service networking restart'
  - 'systemctl restart avahi-daemon'
  - 'ifdown eth0:1'
  - 'ifup eth0:1'
  - 'sleep 20'
  - 'rpi-update'
  - 'sudo -u pi wget -P /home/pi https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_server_install_pi.py'
  - 'ifconfig -a'
  - 'echo "[+] Setup completed: log in and reboot after recording SSH key fingerprint information"'
  - 'sleep 5'

# vim: syntax=yaml