* update variable name to store_pki
* Document BetweenClients_DROP
* Update README.md
* Update faq.md
* VPN On Demand is for Apple IPSEC clients only
* How to update users from cloud-init
* How to monitor user activity
* Fix typo
* Update FAQ about WireGuard, fix typos
* Correct locations of install log and user configs
* Update-users from cloud-init
* Update features list
* More "IPsec" and "WireGuard" changes
* fixed broken link/absent link in FAQ
* Python version README fix for #1622
* road warrior instructions
* Update index.md
* Reorganize config.cfg
As per @davidemyers suggestions
* Further config changes
As per feedback, also better explanation of keys_clean_all
* Add road warrior instructions to FAQ
* Remove specific ports from RW instructions
* Keep custom dnscrypt-proxy conffile when upgrading
* Unattended upgrade tuning
- Upgrade the 50unattended-upgrades file with latest options
- Keep the common unattended upgrade options in one file
- Enable removing of unused kernels and dependencies to save some space
* Pick server to update from menu
* Command instead of shell
* Move to find module
Switched to the find module, and made the whole block dependent on server being undefined.
* Change names
* users.yml update
- Add assert to check if any servers found
- Set server_list as a proper list
* Change 'Build string' to 'Build list'
* Point additional docs to index.md
* Update index.md
Moves existing links from readme.md over to update this separate (previously out-of-date, redundant) page.
* Update documented Ansible roles
* Fix broken links in index.md
* Complete index.md
As a general rule all docs should be linked to from the index file. No?
* Update SSH access instructions
* Clarify SSH access instructions
* Delete setup-roles.md
* Update deploy-from-ansible.md
Change header, insert text from setup-roles.md
* Remove link to setup-roles from index.md
* Fix typos
* Update deploy-from-ansible.md
Document other `--skip-tags` options, as well as examples for Vultr and Scaleway variables.
* Update deploy-from-ansible.md
Added region examples for AWS and Lightsail. Happy to add other examples if people have experience with other providers.
I was going to add this onto the existing PR for docs update, but it turned out to be a little more involved and require some testing of actual deployment.
Changes the "region not available" question to reflect Algo behavior since #976. Also addresses #1413.
Adds a couple of quote marks to the Ubuntu error question, which disappeared for some reason.
* Update main.yml
* Change module names and add IPv6 firewall rules
Uses guide at https://www.renemoser.net/blog/2018/03/19/vultr-firewalling-with-ansible/ written by Rene Moser.
* change vultr to vr
* add ip_version to firewall rules
* add SSH access rules
* Use variable for wireguard port
* update module names for ansible 2.7
* Fix trailing whitespaces
* Try to fix trailing whitespaces again
* Update cloud-vultr.md
More fleshed-out instructions for generating an API key and saving the file. Also notes the default ansible behavior of looking for the file in `~/.vultr.ini`.
* Update README.md
Uses the Unified hosts file from @StevenBlack available [here](https://github.com/StevenBlack/hosts). This encompasses the Ad Away, MVPS, and Malware Domain lists, deleting duplicates for us, and also adds a bunch more.
* Update DNS filtering advice in FAQ
Updates how to temporarily disable adblocking on IPsec and Wireguard clients separately, and also updates the IPSsec command to avoid `ipsec restart` which [isn't appreciated by systemd](https://bugs.launchpad.net/ubuntu/+source/strongswan/+bug/1287339).
* Update faq.md
Fix typo
# Algo will use the following lists to block ads. You can add new block lists
# after deployment by modifying the line starting "BLOCKLIST_URLS=" at:
# /usr/local/sbin/adblock.sh
# If you load very large blocklists, you may also have to modify resource limits:
# /etc/systemd/system/dnsmasq.service.d/100-CustomLimitations.conf
* Troubleshooting.md updates
Adds solutions to #1067 to the troubleshooting faq. Also moves a couple of answers to correspond to the headers.
* Change to Algo, strongly rec Ubuntu 18.04
Adds "Algo VPN" to the organization in the "Profiles" menu of "General Settings". (The type still shows up as "Unknown" in the "VPN" menu, because that seems to be governed by the "VPNSubType" string, which must be empty according to the [developer reference](https://developer.apple.com/enterprise/documentation/Configuration-Profile-Reference.pdf) Maybe this can help clear the way for #1101.
This is to better document the "encryption" flag for those who are interested in full disk encryption on AWS. Recently on running the script, I also found the minimum permissions documented at https://github.com/trailofbits/algo/blob/master/docs/deploy-from-ansible.md weren't enough; "ec2:CopyImage" is also required. Not sure if you'd rather have this documented in the AWS docs instead, and not sure if you want "ec2:CopyImage" added to the default minimum required permissions. I can do either if you'd prefer.
The spacing of several lines in the congrats message has been off. Here's the congrats output with this fix:
```
ok: [54.85.244.8] => {
"msg": [
[
"\"# Congratulations! #\"",
"\"# Your Algo server is running. #\"",
"\"# Config files and certificates are in the ./configs/ directory. #\"",
"\"# Go to https://whoer.net/ after connecting #\"",
"\"# and ensure that all your traffic passes through the VPN. #\"",
"\"# Local DNS resolver 172.16.0.1 #\"",
""
],
" \"# The p12 and SSH keys password for new users is CR2qzRcA #\"\n",
" \"# The CA key password is ed0fd57e7d355af08d12ccdbfd3f5931 #\"\n",
" \"# Shell access: ssh -i configs/algo.pem ubuntu@54.85.244.8 #\"\n"
]
}
```
Ansible2.5 allows Algo to directly ask AWS for the region list, rather than have it hardcoded and updated manually. Updated the documented minimum required permissions to include "DescribeRegions".
Many times people are reaching VPC limits not because they're running other VPCs on AWS, but because they've already deployed several times (AWS allows five VPCs per region). This lets people know they can simply delete their old VPCs instead of contacting AWS support.
