Skip to content
This repository was archived by the owner on Jun 4, 2021. It is now read-only.

Commit 1dd46f6

Browse files
alimakkialimakki
committed
Merge branch 'ocserv_cli_instructions' of github.com:alimakki/streisand into ocserv_cli_instructions
2 parents 700ca9d + e902ba9 commit 1dd46f6

File tree

28 files changed

+282
-82
lines changed

28 files changed

+282
-82
lines changed

‎README-fr.md

+19-47
Original file line numberDiff line numberDiff line change
@@ -109,64 +109,36 @@ Effectuez toutes ces tâches sur votre machine locale.
109109
* Sur Debian et Ubuntu
110110

111111
sudo apt-get install git
112-
* Sur Fedora
112+
* Sur Fedora 27, certains progiciels sont nécessaires plus tard
113113

114-
sudo yum install git
115-
* Sur macOS (via [Homebrew](https://brew.sh/))
114+
sudo yum install git python2-pip gcc python2-devel python2-crypto python2-pycurl libcurl-devel
115+
* Sur CentOS 7, `pip` est disponible dans le dépôt EPEL; certains progiciels supplémentaires sont nécessaires plus tard.
116116

117-
brew install git
118-
* Installez le système de gestion de paquets [pip](https://pip.pypa.io/en/latest/) pour Python.
119-
* Sur Debian et Ubuntu (installe également les dépendances qui sont nécessaires pour construire Ansible et qui sont requises par certains modules)
117+
sudo yum -y update && sudo yum install -y epel-release
118+
sudo yum -y update && sudo yum install -y git gcc python-devel python-crypto python-pycurl python-pip libcurl-devel
119+
* Sur macOS, `git` fait partie des outils de développement et sera installé la première fois que vous l'exécuterez. S'il n'y a pas déjà une commande `pip` installée, installez-la avec:
120120

121-
sudo apt-get install python-paramiko python-pip python-pycurl python-dev build-essential
122-
* Sur Fedora
121+
sudo python2.7 -m ensurepip
123122

124-
sudo yum install python-pip
125-
* Sur macOS
126-
127-
sudo easy_install pip
128-
sudo pip install pycurl
129-
130-
* Installez [Ansible](https://www.ansible.com/).
131-
* Sur macOS (via [Homebrew](https://brew.sh/))
132-
133-
brew install ansible
134-
* Sur BSD ou Linux (via pip)
135-
136-
sudo pip install ansible markupsafe
137-
* Installez les bibliothèques Python nécessaires pour votre fournisseur de cloud.
138-
* Amazon EC2
139-
140-
sudo pip install boto boto3
141-
* Azure
142-
143-
sudo pip install ansible[azure]
144-
* DigitalOcean
145-
146-
sudo pip install dopy==0.3.5
147-
* Google
123+
### Exécution ###
124+
1. Clonez le répertoire Streisand et entrez dans le répertoire.
148125

149-
sudo pip install "apache-libcloud>=0.17.0"
150-
* Linode
126+
git clone https://github.com/StreisandEffect/streisand.git && cd streisand
151127

152-
sudo pip install linode-python
153-
* Rackspace Cloud
128+
2. Exécutez le programme d'installation pour Ansible et ses dépendances.
154129

155-
sudo pip install pyrax
156-
* Si vous utilisez une version de Python installée avec Homebrew, vous devez également exécuter ces commandes pour vous assurer qu'il peut trouver les bibliothèques nécessaires:
130+
./util/venv-dependencies.sh ./venv
131+
* Le programme d'installation détectera les progiciels manquants et imprimera les commandes nécessaires pour les installer.
157132

158-
mkdir -p ~/Library/Python/2.7/lib/python/site-packages
159-
echo '/usr/local/lib/python2.7/site-packages' > ~/Library/Python/2.7/lib/python/site-packages/homebrew.pth
133+
3. Activez les progciels Ansible installés.
160134

161-
### Exécution ###
162-
1. Clonez le répertoire Streisand et entrez dans le répertoire.
163-
164-
git clone https://github.com/StreisandEffect/streisand.git && cd streisand
165-
2. Exécuter le script Streisand.
135+
source ./venv/bin/activate
136+
137+
4. Exécutez le script Streisand.
166138

167139
./streisand
168-
3. Suivez les instructions pour choisir votre fournisseur, la région physique du serveur, et son nom. Vous serez également invité à entrer les informations de l'API.
169-
4. Une fois les informations de connexion et les clés d'API saisies, Streisand commencera à faire tourner un nouveau serveur distant.
140+
5. Suivez les instructions pour choisir votre fournisseur, la région physique du serveur, et son nom. Vous serez également invité à entrer les informations de l'API.
141+
6. Une fois les informations de connexion et les clés d'API saisies, Streisand commencera à faire tourner un nouveau serveur distant.
170142
5. Attendez que l'installation soit terminée (cela prend habituellement environ dix minutes) et recherchez les fichiers correspondants dans le dossier 'generated-docs' dans le répertoire du dépôt Streisand. Le fichier HTML expliquera comment se connecter à la passerelle via SSL ou via le service caché Tor. Toutes les instructions, les fichiers, les clients en miroir et les clés du nouveau serveur se trouvent alors sur la passerelle. Vous avez fini!
171143

172144
### Installation de Streisand sur localhost (Avancé) ###

‎global_vars/default-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,5 @@ streisand_ssh_forward_enabled: yes
2020
streisand_sshuttle_enabled: no
2121
streisand_stunnel_enabled: yes
2222
streisand_tinyproxy_enabled: yes
23-
streisand_tor_enabled: yes
23+
streisand_tor_enabled: no
2424
streisand_wireguard_enabled: yes

‎global_vars/integration/test-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ streisand_ssh_forward_enabled: yes
1616
streisand_openvpn_enabled: yes
1717
streisand_wireguard_enabled: yes
1818
streisand_openconnect_enabled: yes
19-
streisand_tor_enabled: yes
19+
streisand_tor_enabled: no
2020
streisand_stunnel_enabled: yes
2121
streisand_tinyproxy_enabled: yes
2222
# TODO(@cpu): The services below need some manner of integration test written

‎global_vars/noninteractive/amazon-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ streisand_ssh_forward_enabled: yes
2323
streisand_sshuttle_enabled: no
2424
streisand_stunnel_enabled: yes
2525
streisand_tinyproxy_enabled: yes
26-
streisand_tor_enabled: yes
26+
streisand_tor_enabled: no
2727
streisand_wireguard_enabled: yes
2828

2929
# The AWS region number.

‎global_vars/noninteractive/azure-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ streisand_ssh_forward_enabled: yes
2323
streisand_sshuttle_enabled: no
2424
streisand_stunnel_enabled: yes
2525
streisand_tinyproxy_enabled: yes
26-
streisand_tor_enabled: yes
26+
streisand_tor_enabled: no
2727
streisand_wireguard_enabled: yes
2828

2929
# The region to deploy into.

‎global_vars/noninteractive/digitalocean-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ streisand_ssh_forward_enabled: yes
2727
streisand_sshuttle_enabled: no
2828
streisand_stunnel_enabled: yes
2929
streisand_tinyproxy_enabled: yes
30-
streisand_tor_enabled: yes
30+
streisand_tor_enabled: no
3131
streisand_wireguard_enabled: yes
3232

3333
# The Digital Ocean region number.

‎global_vars/noninteractive/google-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ streisand_ssh_forward_enabled: yes
2222
streisand_sshuttle_enabled: no
2323
streisand_stunnel_enabled: yes
2424
streisand_tinyproxy_enabled: yes
25-
streisand_tor_enabled: yes
25+
streisand_tor_enabled: no
2626
streisand_wireguard_enabled: yes
2727

2828
# Server location:

‎global_vars/noninteractive/linode-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ streisand_ssh_forward_enabled: yes
2121
streisand_sshuttle_enabled: no
2222
streisand_stunnel_enabled: yes
2323
streisand_tinyproxy_enabled: yes
24-
streisand_tor_enabled: yes
24+
streisand_tor_enabled: no
2525
streisand_wireguard_enabled: yes
2626

2727
# Choose the server location.

‎global_vars/noninteractive/local-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ streisand_ssh_forward_enabled: yes
2222
streisand_sshuttle_enabled: no
2323
streisand_stunnel_enabled: yes
2424
streisand_tinyproxy_enabled: yes
25-
streisand_tor_enabled: yes
25+
streisand_tor_enabled: no
2626
streisand_wireguard_enabled: yes
2727

2828
# Definitions needed for Let's Encrypt HTTPS (or TLS) certificate setup.

‎global_vars/noninteractive/rackspace-site.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ streisand_ssh_forward_enabled: yes
2121
streisand_sshuttle_enabled: no
2222
streisand_stunnel_enabled: yes
2323
streisand_tinyproxy_enabled: yes
24-
streisand_tor_enabled: yes
24+
streisand_tor_enabled: no
2525
streisand_wireguard_enabled: yes
2626

2727
# Choose the region to deploy into.

‎playbooks/customize.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@
4141
default: "yes"
4242
private: no
4343
- name: streisand_tor_enabled
44-
prompt: "Enable Tor? Press enter for default "
45-
default: "yes"
44+
prompt: "Enable Tor? (UPSTREAM IS BROKEN) Press enter for default "
45+
default: "no"
4646
private: no
4747
- name: streisand_wireguard_enabled
4848
prompt: "Enable WireGuard? Press enter for default "

‎playbooks/roles/common/tasks/detect-public-ip.yml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# detect-public-ip.yml will attempt to identify whether the server's public
3+
# IP address is different from what is visible on the host and, if
4+
# successfully detected, ask to update the address for documentation and
5+
# configuration profiles
6+
- name: "Install dns module"
7+
apt:
8+
name: dnsutils
9+
10+
- name: "Initialize lookup variable"
11+
set_fact:
12+
external_ipv4_address: "presumed_failed"
13+
14+
- name: "Check external IP Address through Google"
15+
command: dig +short myip.opendns.com @resolver1.opendns.com A
16+
register: dig_output
17+
18+
- name: "Set the variable to the value"
19+
set_fact:
20+
external_ipv4_address: "{{ dig_output.stdout | regex_replace('\"', '') }}"
21+
when: (dig_output.rc == 0)
22+
23+
# Enter this block only when when the IPs are different and query user for updating
24+
# to public ip
25+
- block:
26+
- name: "Initialize the prompt"
27+
set_fact:
28+
prompt_external_ip: |
29+
We have found another public IP address of your server
30+
31+
Some cloud providers use load balancers or SDN to make servers externally
32+
reachable. It seems
33+
- {{ external_ipv4_address }} is publicly visible
34+
- {{ streisand_ipv4_address }} is visible on the server
35+
36+
Type 'yes' to use {{ external_ipv4_address }} for the VPN
37+
Hit 'enter' to skip and use {{ streisand_ipv4_address }}.
38+
39+
Skip with 'enter' if you do not know {{ external_ipv4_address }}
40+
41+
- name: "Ask user to update to public IP address"
42+
pause:
43+
prompt: "{{ prompt_external_ip }}"
44+
register: publish_external
45+
46+
- name: "Change streisand_ipv4_address to public if requested"
47+
set_fact:
48+
streisand_ipv4_address: "{{ external_ipv4_address }}"
49+
when: ((publish_external.user_input == "yes") or (publish_external.user_input == "Yes") or (publish_external.user_input == "YES") or (publish_external.user_input == "Y") or (publish_external.user_input == "y"))
50+
when: (external_ipv4_address != "presumed_failed") and (streisand_ipv4_address != external_ipv4_address)
51+
...

‎playbooks/roles/common/tasks/set-default-variables.yml

+3
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,6 @@
3636
set_fact:
3737
streisand_server_name: "{{ ansible_hostname }}"
3838
when: streisand_server_name is not defined
39+
40+
- import_tasks: detect-public-ip.yml
41+
when: (hostvars['127.0.0.1']['streisand_genesis_role'] is defined and ((hostvars['127.0.0.1']['streisand_genesis_role'] == "localhost") or (hostvars['127.0.0.1']['streisand_genesis_role'] == "existing-server")))

‎playbooks/roles/common/vars/main.yml

+3
Original file line numberDiff line numberDiff line change
@@ -126,3 +126,6 @@ streisand_my_ip_url: https://duckduckgo.com/?q=ip+address
126126
# Ciphersuites recommended from Mozilla's Modern compatibility profile
127127
# https://wiki.mozilla.org/Security/Server_Side_TLS
128128
streisand_tls_ciphers: "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
129+
130+
apt_repository_retries: 10
131+
apt_repository_delay: 20

‎playbooks/roles/lets-encrypt/tasks/install.yml

+4
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88
- name: Add the official acmetool repository
99
apt_repository:
1010
repo: "deb http://ppa.launchpad.net/hlandau/rhea/{{ ansible_distribution|lower }} {{ ansible_lsb.codename }} main"
11+
register: le_add_apt_repository
12+
until: not le_add_apt_repository.failed
13+
retries: "{{ apt_repository_retries }}"
14+
delay: "{{ apt_repository_delay }}"
1115

1216
- name: Install acmetool
1317
apt:

‎playbooks/roles/nginx/tasks/main.yml

+5
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@
1515
- name: Add the official Nginx repository
1616
apt_repository:
1717
repo: "deb https://nginx.org/packages/{{ ansible_distribution|lower }}/ {{ ansible_lsb.codename }} nginx"
18+
register: nginx_add_apt_repository
19+
until: not nginx_add_apt_repository.failed
20+
retries: "{{ apt_repository_retries }}"
21+
delay: "{{ apt_repository_delay }}"
22+
1823

1924
- name: Install Nginx
2025
apt:

‎playbooks/roles/openconnect/tasks/install.yml

+10
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,18 @@
11
---
2+
3+
# It *shouldn't* be necessary to run this particular apt_repository
4+
# call in a "retry" loop; enabling Universe doesn't reach out to the
5+
# network, so this shouldn't have transient failures. For the sake of
6+
# consistency with the other apt_repository calls, it does retry.
7+
28
- name: Enable the Universe repository
39
apt_repository:
410
repo: "deb http://archive.ubuntu.com/ubuntu {{ ansible_distribution_release }} universe"
511
state: present
12+
register: openconnect_add_apt_repository
13+
until: not openconnect_add_apt_repository.failed
14+
retries: "{{ apt_repository_retries }}"
15+
delay: "{{ apt_repository_delay }}"
616

717
- name: Install ocserv
818
apt:

‎playbooks/roles/openvpn/tasks/install.yml

+4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@
1010
apt_repository:
1111
repo: 'deb https://build.openvpn.net/debian/openvpn/stable {{ ansible_lsb.codename }} main'
1212
state: present
13+
register: openvpn_add_apt_repository
14+
until: not openvpn_add_apt_repository.failed
15+
retries: "{{ apt_repository_retries }}"
16+
delay: "{{ apt_repository_delay }}"
1317

1418
- name: Install OpenVPN and its dependencies from APT
1519
apt:

‎playbooks/roles/openvpn/templates/client-common.j2

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ persist-tun
88
remote-cert-tls server
99
verify-x509-name {{ openvpn_server_common_name.stdout }} name
1010
tls-version-min 1.2
11-
compress lz4
11+
compress
1212
verb 3
1313
route {{ streisand_ipv4_address }} 255.255.255.255 net_gateway
1414

‎playbooks/roles/openvpn/templates/etc_openvpn_server_common.j2

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
2828

2929
auth {{ openvpn_auth_digest }}
3030
tls-version-min 1.2
31-
compress lz4
31+
compress
3232
user nobody
3333
group nogroup
3434
persist-key

0 commit comments

Comments
 (0)