forked from trailofbits/algo
-
Notifications
You must be signed in to change notification settings - Fork 0
/
config.cfg
111 lines (93 loc) · 3.33 KB
/
config.cfg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
---
# Add as many users as you want for your VPN server here.
# Credentials will be generated for each one.
users:
- dan
- jack
# NOTE: If your usernames have leading 0's, like "000dan", you have to escape them
### Advanced users only below this line ###
# If True re-init all existing certificates. (True or False)
easyrsa_reinit_existent: False
vpn_network: 10.19.48.0/24
vpn_network_ipv6: 'fd9d:bc11:4020::/48'
server_name: "{{ ansible_ssh_host }}"
IP_subject_alt_name: "{{ ansible_ssh_host }}"
# StrongSwan log level
# https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration
strongswan_log_level: 2
adblock_lists:
- "http://winhelp2002.mvps.org/hosts.txt"
- "https://adaway.org/hosts.txt"
- "https://www.malwaredomainlist.com/hostslist/hosts.txt"
- "https://hosts-file.net/ad_servers.txt"
# Enable DNS encryption. Use dns_encryption_provider to specify the provider. If false dns_servers should be specified
dns_encryption: true
# Possible values: google, cloudflare
dns_encryption_provider: cloudflare
# DNS servers which will be used if dns_encryption disabled
dns_servers:
ipv4:
- 1.1.1.1
- 1.0.0.1
ipv6:
- 2606:4700:4700::1111
- 2606:4700:4700::1001
# IP address for the local dns resolver
local_service_ip: 172.16.0.1
pkcs12_PayloadCertificateUUID: "{{ 900000 | random | to_uuid | upper }}"
VPN_PayloadIdentifier: "{{ 800000 | random | to_uuid | upper }}"
CA_PayloadIdentifier: "{{ 700000 | random | to_uuid | upper }}"
# Block traffic between connected clients
BetweenClients_DROP: Y
congrats:
common: |
"# Congratulations! #"
"# Your Algo server is running. #"
"# Config files and certificates are in the ./configs/ directory. #"
"# Go to https://whoer.net/ after connecting #"
"# and ensure that all your traffic passes through the VPN. #"
"# Local DNS resolver {{ local_service_ip }} #"
p12_pass: |
"# The p12 and SSH keys password for new users is {{ easyrsa_p12_export_password }} #"
ca_key_pass: |
"# The CA key password is {{ easyrsa_CA_password }} #"
ssh_access: |
"# Shell access: ssh -i {{ ansible_ssh_private_key_file|default(omit) }} {{ ansible_ssh_user|default(omit) }}@{{ ansible_ssh_host|default(omit) }} #"
SSH_keys:
comment: algo@ssh
private: configs/algo.pem
public: configs/algo.pem.pub
cloud_providers:
azure:
size: Basic_A0
image:
offer: UbuntuServer
publisher: Canonical
sku: '16.04-LTS' # 16.04-LTS / 17.04
version: latest
digitalocean:
size: s-1vcpu-1gb
image: "ubuntu-16-04-x64" # ubuntu-16-04-x64 / ubuntu-17-10-x64
ec2:
size: t2.micro
image:
name: "ubuntu-xenial-16.04" # ubuntu-xenial-16.04 / ubuntu-zesty-17.04
owner: "099720109477"
gce:
size: f1-micro
image: ubuntu-1604 # ubuntu-1604 / ubuntu-1704
lightsail:
size: nano_1_0
image: ubuntu_16_04
scaleway:
size: VC1S
image: Ubuntu Xenial
arch: x86_64
openstack:
flavor_ram: ">=512"
image: Ubuntu-16.04
local:
fail_hint:
- Sorry, but something went wrong!
- Please check the troubleshooting guide.
- https://trailofbits.github.io/algo/troubleshooting.html