  - curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list
  - apt-get update
  - apt dist-upgrade -y
  - apt-get install tailscale -y
  - echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.d/99-tailscale.conf
  - echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.d/99-tailscale.conf
  - sysctl -p /etc/sysctl.d/99-tailscale.conf
  - tailscale up --authkey=${tailscale_auth_key} --advertise-routes=${cidr}

# main.tf
  resource "hcloud_server" "jumphost" {
    name = "jumphost-${var.client_name}"
    image = var.ostype
    server_type = "cx22"
    location = var.location
    ssh_keys = [ data.hcloud_ssh_key.ssh_sleutel_thomas.id, data.hcloud_ssh_key.ssh_sleutel_bryan.id ]
    public_net {
        ipv4_enabled = true
        ipv6_enabled = true
    }
    user_data = templatefile("./Cloud-init-jumphost.yaml",{
        ip_proxy = var.ip_proxy
        ip_attack = var.ip_attack
        ip_command = var.ip_command
        ip_phishy = var.ip_phishy
        tailscale_auth_key = var.tailscale_auth_key
        cidr = var.client_cidr
        gateway = var.gateway
        playbook_attack = (indent(36, file("./ansible/playbook_attack.yml"))) 
        playbook_mythic = (indent(41, file("./ansible/playbook_mythic.yml")))
        playbook_gophish = (indent(46, templatefile("./ansible/playbook_gophish.yml", {
            gophishpass = var.gophishpass
        })))
        playbook_openvpn = (indent(51, file("./ansible/openvpn-playbook.yml")))
    })
    network {
        network_id = hcloud_network.network.id
        ip = var.ip_jumphost
    }
    depends_on = [ hcloud_network_subnet.subnet , hcloud_server.proxy ]
}


# Cloud-init-jumphost.yaml
#cloud-config
write_files:
  - path: /inventory.yml
    content: |
      all:
        children:
          proxy:
            hosts:
              proxyserver:
                ansible_host: ${ip_proxy}
          mythic:
            hosts:
              mythicserver:
                ansible_host: ${ip_command}
                ansible_ssh_pass: password
                ansible_user: ansible
          phishy:
            hosts:
              phishyserver:
                ansible_host: ${ip_phishy}
                ansible_ssh_pass: password
                ansible_user: ansible
          attack:
            hosts:
              attackserver:
                ansible_host: ${ip_attack}
                ansible_ssh_pass: password
                ansible_user: ansible
          jumphost:
            hosts:
              jumphostserver:
                ansible_host: 10.69.0.6

  - path: /playbook_attack.yml
    content: |
      ${playbook_attack}
    permissions: "0755"

  - path: /playbook_mythic.yml
    content: |
      ${playbook_mythic}
    permissions: "0755"

  - path: /playbook_gophish.yml
    content: |
      ${playbook_gophish}
    permissions: "0755"
  
  - path: /openvpn-playbook.yml
    content: |
      ${playbook_openvpn}
    permissions: "0755"

  - path: /run_ansible.sh
    content: |
      #!/bin/bash
      ansible-playbook -i /inventory.yml /playbook_gophish.yml -f 20 &
      ansible-playbook -i /inventory.yml /playbook_attack.yml -f 20 &
      ansible-playbook -i /inventory.yml /playbook_mythic.yml -f 20 &
      ansible-playbook -i /inventory.yml /openvpn-playbook.yml -f 20 &
      wait
      echo "Playbooks have been completed"

    permissions: "0755"




ansible-playbook /playbook.yml



sudo systemctl daemon-reexec
sudo systemctl restart systemd-networkd
sudo systemctl restart systemd-resolved
sudo apt update



---
- name: Setup OpenVPN Server and Send Config to Discord
  hosts: localhost
  become: yes
  vars:
    clients:
      - ${client_name}_1
      - ${client_name}_2
    discord_webhook_url: ${discord_webhook_url}
    cipher: "AES-256-GCM" # Set your preferred cipher here
  handlers:
    - name: Save iptables rules
      command: iptables-save > /etc/iptables/rules.v4
  tasks:
    - name: Install required packages
      apt:
        name:
          - openvpn
          - easy-rsa
          - jq
          - curl
        state: present
        update_cache: yes

    - name: upgrade dist
      apt:
        state: present
        update_cache: yes
        upgrade: dist

    - name: Create Easy-RSA directory
      file:
        path: /etc/openvpn/easy-rsa
        state: directory

    - name: Setup Easy-RSA files
      shell: cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa
      args:
        creates: /etc/openvpn/easy-rsa/vars

    - name: Configure Easy-RSA vars
      copy:
        dest: /etc/openvpn/easy-rsa/vars
        content: |
          set_var EASYRSA_BATCH "yes"
          set_var EASYRSA_REQ_COUNTRY "BE"
          set_var EASYRSA_REQ_PROVINCE "Antwerp"
          set_var EASYRSA_REQ_CITY "Mechelen"
          set_var EASYRSA_REQ_ORG "MyVPN"
          set_var EASYRSA_REQ_EMAIL "admin@example.com"
          set_var EASYRSA_REQ_OU "IT"
          set_var EASYRSA_ALGO "ec"
          set_var EASYRSA_DIGEST "sha512"  # Use SHA-512 for signing

    - name: Remove existing PKI
      file:
        path: /etc/openvpn/easy-rsa/pki
        state: absent

    - name: Reinitialize PKI
      shell: echo yes | /etc/openvpn/easy-rsa/easyrsa init-pki
      args:
        chdir: /etc/openvpn/easy-rsa

    - name: Generate CA and server certificate
      shell: |
        echo yes | /etc/openvpn/easy-rsa/easyrsa build-ca nopass
        echo yes | /etc/openvpn/easy-rsa/easyrsa gen-req server nopass
        echo yes | /etc/openvpn/easy-rsa/easyrsa sign-req server server
      args:
        chdir: /etc/openvpn/easy-rsa

    - name: Generate client certificates
      shell: |
        for client in {{ clients | join(' ') }}; do
          echo yes | /etc/openvpn/easy-rsa/easyrsa gen-req $client nopass
          echo yes | /etc/openvpn/easy-rsa/easyrsa sign-req client $client
        done
      args:
        chdir: /etc/openvpn/easy-rsa

    - name: Generate DH parameters
      command: /etc/openvpn/easy-rsa/easyrsa gen-dh
      args:
        chdir: /etc/openvpn/easy-rsa

    - name: Generate HMAC key
      command: openvpn --genkey --secret /etc/openvpn/ta.key

    - name: Create client directories
      file:
        path: "/etc/openvpn/{{ item }}"
        state: directory
      loop: "{{ clients }}"

    - name: Get public IP address
      command: curl -s http://ipinfo.io/ip
      register: public_ip

    - name: Create client configurations
      copy:
        dest: "/etc/openvpn/{{ item }}/{{ item }}.ovpn"
        content: |
          client
          dev tun
          proto udp
          remote {{ public_ip.stdout }} 1194
          resolv-retry infinite
          nobind
          persist-key
          persist-tun
          <ca>
          {{ lookup('file', '/etc/openvpn/easy-rsa/pki/ca.crt') }}
          </ca>
          <cert>
          {{ lookup('file', '/etc/openvpn/easy-rsa/pki/issued/{{ item }}.crt') }}
          </cert>
          <key>
          {{ lookup('file', '/etc/openvpn/easy-rsa/pki/private/{{ item }}.key') }}
          </key>
          verb 3
          cipher {{ cipher }}
          data-ciphers {{ cipher }}
          data-ciphers-fallback BF-CBC
          remote-cert-tls server  # Enforce server certificate verification
      loop: "{{ clients }}"

    - name: Create OpenVPN server configuration
      copy:
        dest: /etc/openvpn/server.conf
        content: |
          port 1194
          proto udp
          dev tun
          ca /etc/openvpn/easy-rsa/pki/ca.crt
          cert /etc/openvpn/easy-rsa/pki/issued/server.crt
          key /etc/openvpn/easy-rsa/pki/private/server.key
          dh /etc/openvpn/easy-rsa/pki/dh.pem
          server 10.99.99.0 255.255.255.0
          push "route ${ip_range} 255.255.255.0"    
          push "dhcp-option DNS 8.8.8.8"
          push "dhcp-option DNS 8.8.4.4"
          keepalive 10 120
          cipher {{ cipher }}
          data-ciphers {{ cipher }}
          verify-client-cert require  # Enable server certificate verification
          user nobody
          group nogroup
          persist-key
          persist-tun
          status openvpn-status.log
          verb 3

    - name: Install iptables-persistent to persist rules
      apt:
        name: iptables-persistent
        state: present
        update_cache: yes

    - name: Allow NAT for VPN traffic (10.99.99.0/24) going out enp7s0
      iptables:
        table: nat
        chain: POSTROUTING
        out_interface: enp7s0 # <-- change this to your actual interface if different
        source: "10.99.99.0/24"
        jump: MASQUERADE

    - name: Allow forwarding from VPN to LAN
      iptables:
        table: filter
        chain: FORWARD
        source: "10.99.99.0/24"
        destination: "${cidr}"
        jump: ACCEPT

    - name: Allow forwarding from LAN to VPN
      iptables:
        table: filter
        chain: FORWARD
        source: "${cidr}"
        destination: "10.99.99.0/24"
        jump: ACCEPT

    - name: Start and enable OpenVPN service
      systemd:
        name: openvpn@server
        enabled: yes
        state: started

    - name: Restart OpenVPN service
      systemd:
        name: openvpn@server
        state: restarted

    - name: Send client configurations to Discord
      uri:
        url: "{{ discord_webhook_url }}"
        method: POST
        headers:
          Content-Type: multipart/form-data
        body:
          content: "Here is your OpenVPN configuration for {{ item }}:"
          file:
            filename: "{{ item }}.ovpn"
            content: "{{ lookup('file', '/etc/openvpn/' + item + '/' + item + '.ovpn') }}"
        body_format: form-multipart
        status_code:
          - 204
          - 200 # Accept 200 as a valid response
      loop: "{{ clients }}"
