cloud-config.client.j2

#cloud-config

{%- set cloud_config = 'https://github.com/davedittrich/goSecure/blob/master/cloud-config.client.j2' %}

# See: https://cloudinit.readthedocs.io/en/latest/topics/examples.html

hostname: gosecure-client
manage_etc_hosts: false

groups:
  - gosecure: [pi,pirate]
users:
  - name: pi
    gecos: "goSecure pi"
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    groups: users,docker,video,netdev,gosecure
    plain_text_passwd: "{{ gosecure_pi_password }}"
    lock_passwd: false
    ssh-import-id: None
    ssh-authorized-keys:
      - {{ gosecure_pi_pubkey }}
    ssh_pwauth: true
    chpasswd: { expire: false }
  - name: pirate
    gecos: "pirate"
    sudo: ALL=(ALL) NOPASSWD:ALL
    shell: /bin/bash
    groups: users,docker,video,netdev,gosecure
    plain_text_passwd: "{{ gosecure_pi_password }}"
    lock_passwd: false
    ssh-import-id: None
    ssh_pwauth: true
    ssh-authorized-keys:
      - {{ gosecure_pi_pubkey }}
    chpasswd: { expire: false }

package_upgrade: false

# Set the locale of the system
locale: "{{ gosecure_pi_locale }}"

# Set the timezone
# Value of 'timezone' must exist in /usr/share/zoneinfo
timezone: "{{ gosecure_pi_timezone }}"

write_files:
  - content: |
      # File created by {{ cloud_config }}

      127.0.1.1 gosecure-client.localdomain gosecure-client
      127.0.0.1 localhost
      192.168.50.1 setup client
      # For development and network reconfiguration via Ansible
      192.168.50.2 server

      ::1 ipv6-localhost ipv6-loopback
      fe00::0 ipv6-localnet
      ff00::0 ipv6-mcastprefix
      ff02::1 ipv6-allnodes
      ff02::2 ipv6-allrouters
      ff02::3 ipv6-allhosts
    path: /etc/hosts
  - content: |
      {{ gosecure_vpn_client_id }} : PSK {{ gosecure_vpn_client_psk }}
    path: /etc/ipsec.secrets
    owner: root:root
    permissions: '0600'
  - content: |
      net.ipv6.conf.all.disable_ipv6=1
    path: /etc/sysctl.d/local.conf
  - content: |
      auto wlan0
      allow-hotplug wlan0
      iface wlan0 inet manual
          wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
    path: /etc/network/interfaces.d/wlan0
  - content: |
      country={{ gosecure_pi_wifi_country }}
      ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
      update_config=1
      network={
         ssid="{{ gosecure_client_ssid }}"
         psk="{{ gosecure_client_psk }}"
      }
    path: /etc/wpa_supplicant/wpa_supplicant.conf
    owner: root:root
    permissions: '0600'
  - content: |
      # KEYBOARD CONFIGURATION FILE

      # Consult the keyboard(5) manual page.

      XKBMODEL="{{ gosecure_pi_keyboard_model }}"
      XKBLAYOUT="{{ gosecure_pi_keyboard_layout }}"
      XKBVARIANT=""
      XKBOPTIONS=""

      BACKSPACE="guess"
    path: /etc/default/keyboard
  - content: |
      hostname
      clientid
      persistent
      slaac private
      option rapid_commit
      option domain_name_servers,domain_name,domain_search,host_name
      option classless_static_routes
      option ntpservers
      option interface_mtu
      require dhcp_server_identifier
    path: /etc/dhcpcd.conf
  - content: |
      domain-needed
      bogus-priv
      server=8.8.8.8
      server=8.8.4.4
      cache-size=4096
      local=/home/
      expand-hosts
      domain=gosecure
      dhcp-range=192.168.50.101,192.168.50.200,255.255.255.0,14d
      dhcp-option=option:router,192.168.50.1
      dhcp-option=252,"\n"
      log-facility=/var/log/dnsmasq.log
      log-async
      log-dhcp
    path: /etc/dnsmasq.conf
  - content: |
      auto eth0
      allow-hotplug eth0
      iface eth0 inet static
      address 192.168.50.1
      netmask 255.255.255.0

      auto eth0:1
      allow-hotplug eth0:1
      iface eth0:1 inet dhcp
    path: /etc/network/interfaces.d/eth0

# Install any additional apt packages you need here
packages:
 - ntp
 - curl
 - nginx
 - dnsmasq
 - rng-tools
 - rpi-update

# These commands will be only be run once on first boot
runcmd:
  - 'systemctl enable rng-tools'
  - 'service networking restart'
  - 'systemctl restart avahi-daemon'
  - 'ifdown eth0'
  - 'ifup eth0'
  - 'sleep 20'
  - 'rpi-update'
  - 'sudo -u pi wget -P /home/pi https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_client_install.py'
  - 'systemctl status dnsmasq'
  - 'ifconfig -a'
  - 'echo "[+] Setup completed: log in and reboot after recording SSH key fingerprint information"'
  - 'sleep 5'

# vim: syntax=yaml