Snowflake proxy deployment

ansible/playbook.yml

@@ -1,12 +1,15 @@
 - name: Deploy common services
   hosts: all
   roles:
+    # Backbone
     - common
     - ufw
     - prometheus-node-exporter
     - wireguard
     - fail2ban
     - podman
+    # Applications
+    - snowflake-proxy
 
 - name: Deploy our monitoring stack
   hosts: lovelace

ansible/roles/snowflake-proxy/README.md

@@ -0,0 +1,13 @@
+# snowflake-proxy
+
+This Ansible role installs and enables a
+[Snowflake](https://snowflake.torproject.org/) proxy.
+
+Snowflake is a system that helps people circumvent censorship by acting as an
+unknown middle layer between the publically known Tor network relay addresses
+and the user behind a censoring firewall. More specifically, we act as a
+forwarding proxy to the Tor network for the user, passing along encrypted
+traffic and allowing users to access an uncensored internet without firewalls
+having our IP on any public list that they can ban us from.
+
+Naturally this system works best from dynamic IP addresses.

ansible/roles/snowflake-proxy/files/snowflake-override.conf

@@ -0,0 +1,33 @@
+# Ansible managed
+
+[Service]
+CapabilityBoundingSet=
+DevicePolicy=closed
+DynamicUser=true
+IPAddressDeny=link-local
+IPAddressDeny=localhost
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+PrivateUsers=true
+ProcSubset=pid
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=yes
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=noaccess
+ProtectSystem=strict
+RemoveIPC=true
+RestrictAddressFamilies=~AF_UNIX
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged
+UMask=0077

ansible/roles/snowflake-proxy/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart snowflake-proxy
+  service:
+    name: snowflake-proxy
+    state: restarted
+  tags:
+    - role::snowflake-proxy

ansible/roles/snowflake-proxy/tasks/main.yml

@@ -0,0 +1,39 @@
+---
+- name: Install snowflake-proxy
+  package:
+    name: snowflake-proxy
+    state: present
+  tags:
+    - role::snowflake-proxy
+
+- name: Create snowflake-proxy override directory
+  file:
+    path: /etc/systemd/system/snowflake-proxy.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  tags:
+    - role::snowflake-proxy
+
+- name: Copy snowflake-proxy override options
+  copy:
+    src: snowflake-override.conf
+    dest: /etc/systemd/system/snowflake-proxy.service.d/override.conf
+    owner: root
+    group: root
+    mode: '0444'
+  register: snowflake_proxy_override_conf
+  notify:
+    - restart snowflake-proxy
+  tags:
+    - role::snowflake-proxy
+
+- name: Start and enable snowflake-proxy
+  service:
+    name: snowflake-proxy
+    enabled: true
+    daemon_reload: "{{ snowflake_proxy_override_conf is changed }}"
+    state: started
+  tags:
+    - role::snowflake-proxy