setup_zwiebelkuchen.yml

# This ansible playbook performs setup of a
# RaspberryPi providing a tor-proxied wifi accesspoint.
#
# Call from remote:
#
#   $ ansible-playbook -i 192.168.178.13, -u pi -k setup_zwiebelkuchen.yml
#
# with the real IP used instead.
#
# You may want to fiddle with the settings in `vars`. The DNS servers used are
# from CCC Berlin and from Digitalcourage/FoebuD
#
- hosts: all
  become: false
  become_user: root
  vars:
      - hostname: "zwiebelkuchen"
      - dns_servers: "213.73.91.35, 85.214.20.141"

  handlers:
  - name: restart dhcpd
    become: true
    service:
        name: "isc-dhcp-server"
        state: restarted
  - name: restart hostapd
    become: true
    service:
        name: "hostapd"
        state: restarted
  - name: disable ipv4 forwarding immediately
    become: true
    shell: echo 0 > /proc/sys/net/ipv4/ip_forward
  - name: restart tor
    become: true
    service:
        name: "tor"
        state: restarted

  tasks:
  - name: Update system
    become: true
    apt: upgrade=safe update_cache=yes

  - name: Install additionally needed packages
    become: true
    package:
        name: "{{ item }}"
        state: present
    with_items:
        - "unattended-upgrades"
        - "rng-tools"
        - "hostapd"
        - "isc-dhcp-server"
        - "iptables-persistent"
        - "tor"

  #
  # Enable unattended upgrades
  #
  - name: enable unattended upgrades setting an origin-pattern
    become: true
    replace:
        dest: "/etc/apt/apt.conf.d/50unattended-upgrades"
        regexp: '^//      "o=Raspbian,n=jessie";'
        replace: '        "o=Raspbian,n=jessie";'

  - name: start unattended-upgrades every other hour
    become: true
    cron:
        name: "system-update"
        minute: '39'
        hour: '*/2'
        job: '/usr/bin/unattended-upgrade'

  #
  # Pin wlan device names
  #
  - name: pin wlan1 to builtin wifi device
    become: true
    copy:
        src: "70-persistent-net.rules"
        dest: "/etc/udev/rules.d/70-persistent-net.rules"
        owner: root
        group: root
        mode: 0644
        backup: yes

  #
  # configure dhcpd
  #
  - name: tweak dhcpd.conf - unset preset domain-name
    become: true
    replace:
        dest: "/etc/dhcp/dhcpd.conf"
        regexp: '^option domain-name "example\.org";'
        replace: '#option domain-name "example.org";'
    notify: restart dhcpd

  - name: tweak dhcpd.conf - unset preset domain-name-servers
    become: true
    replace:
        dest: "/etc/dhcp/dhcpd.conf"
        regexp: '^option domain-name-servers (.*);$'
        replace: '#option domain-name-servers \1'
    notify: restart dhcpd

  - name: tweak dhcpd.conf - set authoritative flag
    become: true
    replace:
        dest: "/etc/dhcp/dhcpd.conf"
        regexp: '^#authoritative;$'
        replace: 'authoritative;'
    notify: restart dhcpd

  - name: tweak dhcpd.conf - add new subnet
    become: true
    blockinfile:
        dest: "/etc/dhcp/dhcpd.conf"
        block: |
            subnet 192.168.42.0 netmask 255.255.255.0 {
                   range 192.168.42.10 192.168.42.50;
                   option broadcast-address 192.168.42.255;
                   option routers 192.168.42.1;
                   default-lease-time 600;
                   max-lease-time 7200;
                   option domain-name "local";
                   option domain-name-servers {{ dns_servers }};
            }
    notify: restart dhcpd

  - name: set wlan1 as dhcp-serviced device
    become: true
    replace:
        dest: "/etc/default/isc-dhcp-server"
        regexp: '^INTERFACES=""'
        replace: 'INTERFACES="wlan1"'
    notify: restart dhcpd

  - name: setup static ip config for wlan1
    become: true
    copy:
        src: "interfaces.tmpl"
        dest: "/etc/network/interfaces"
        owner: root
        group: root
        mode: 0644
        backup: yes

  #
  # configure hostapd
  #
  - name: install hostapd.conf
    become: true
    copy:
        src: "hostapd.conf.tmpl"
        dest: "/etc/hostapd/hostapd.conf"
        owner: root
        group: root
        mode: 0600
        backup: yes
    notify: restart hostapd

  - name: tell hostapd.conf location
    become: true
    replace:
        dest: "/etc/default/hostapd"
        regexp: '^#DAEMON_CONF=""'
        replace: 'DAEMON_CONF="/etc/hostapd/hostapd.conf"'
    notify: restart hostapd

  - name: deactivate ipv4 forwarding at boot time
    become: true
    replace:
        dest: "/etc/sysctl.conf"
        regexp: "^net.ipv4.ip_forward=1"
        replace: "#net.ipv4.ip_forward=1"
    notify: disable ipv4 forwarding immediately

  #
  # install tor and related fw rules
  #
  - name: tweak torrc
    become: true
    blockinfile:
        dest: "/etc/tor/torrc"
        insertafter: "^## https://www.torproject.org/docs/faq#torrc"
        block: |
            Log notice file /var/log/tor/notices.log
            VirtualAddrNetwork 10.192.0.0/10
            AutomapHostsSuffixes .onion,.exit
            AutomapHostsOnResolve 1
            TransPort 9040
            TransListenAddress 192.168.42.1
            DNSPort 53
            DNSListenAddress 192.168.42.1
    notify: restart tor

  - name: install ipv4 firewall rules
    become: true
    copy:
        src: "rules.v4"
        dest: "/etc/iptables/rules.v4"
        owner: root
        group: root
        mode: 0644
        backup: yes

  #
  # activate new services
  #
  - name: activate service hostapd
    become: true
    systemd:
        name: hostapd
        state: started
        enabled: true

  - name: activate service isc-dhcpd-server
    become: true
    systemd:
        name: isc-dhcp-server
        state: started
        enabled: true

  - name: enable service tor
    become: true
    systemd:
        name: tor
        state: started
        enabled: true