main.yml

---

- name: Install essential tools
  hosts: localhost

  tasks:
    - name: Tune system swappiness
      ansible.posix.sysctl:
        name: vm.swappiness
        value: '1'
        state: present
        sysctl_file: /etc/sysctl.d/99-swappiness.conf
        sysctl_set: true
        reload: true

    - name: Perform a dist upgrade
      ansible.builtin.apt:
        update_cache: true
        upgrade: full

    - name: Install some recommended additional packages
      ansible.builtin.apt:
        pkg: "{{ system_packages }}"
        state: present

    - name: Install some pipx packages
      community.general.pipx:
        name: "{{ item }}"
      with_items: "{{ pipx_packages }}"
      become: true
      become_user: "{{ local_username }}"

    - name: Create seclists symlink
      block:
        - name: Gather the package facts
          ansible.builtin.package_facts:
            manager: auto
          no_log: true

        - name: Print the package facts
          ansible.builtin.debug:
            var: ansible_facts.packages
          no_log: true

        - name: Create symlink to seclists from wordlists dir
          ansible.builtin.file:
            src: /usr/share/seclists
            dest: /usr/share/wordlists/seclists
            state: link
          when: "'seclists' in ansible_facts.packages"

    - name: Setup anonymous browsing capability
      block:
        - name: Install tor and proxychains
          ansible.builtin.apt:
            pkg:
              - tor
              - proxychains4

        - name: Copy torrc file
          ansible.builtin.copy:
            src: etc/tor/torrc
            dest: /etc/tor/torrc
            owner: root
            group: root
            mode: '0644'
            backup: true

        - name: Ensure tor service runs on system startup
          ansible.builtin.systemd:
            name: tor
            state: started
            enabled: true

        - name: Copy proxychains4 config file
          ansible.builtin.copy:
            src: etc/proxychains4.conf
            dest: /etc/proxychains4.conf
            owner: root
            group: root
            mode: '0644'
            backup: true

    - name: Setup tmux
      block:
        - name: Install packages needed for tmux
          ansible.builtin.apt:
            pkg:
              - tmux
              - xsel

        - name: Git clone tmux plugin repo
          ansible.builtin.git:
            repo: "{{ tmux_plugin_repo }}"
            dest: "~{{ local_username }}/.tmux/plugins/tpm"
            clone: true
            version: master
          become: true
          become_user: "{{ local_username }}"

        - name: Copy sample .tmux.conf file to the user's homedir
          ansible.builtin.copy:
            src: home/user/.tmux.conf
            dest: "~{{ local_username }}/.tmux.conf"
            mode: '0644'
          become: true
          become_user: "{{ local_username }}"

        - name: Install all required tmux plugins
          ansible.builtin.shell: "~{{local_username}}/.tmux/plugins/tpm/scripts/install_plugins.sh"
          become: true
          become_user: "{{ local_username }}"

    - name: Setup custom fonts
      become: true
      become_user: "{{ local_username }}"
      block:
        - name: Create local fonts directory
          ansible.builtin.file:
            path: "~{{ local_username }}/.local/share/fonts"
            mode: '0755'
            state: directory

        - name: Download nerd fonts to local fonts folder
          ansible.builtin.get_url:
            url: "{{ item }}"
            dest: "~{{ local_username }}/.local/share/fonts/"
            mode: '0644'
          with_items: "{{ nerd_fonts }}"

        - name: Refresh fonts cache
          ansible.builtin.shell: "fc-cache -fv"

    - name: "Enable passwordless sudo for user {{ local_username }}"
      ansible.builtin.user:
        name: "{{ local_username }}"
        groups: kali-trusted
        append: true

    - name: Clone some git repositories
      block:
        - name: Create base dir for privesc scripts
          ansible.builtin.file:
            path: /opt/privesc-scripts
            state: directory
            mode: '0775'

        - name: Create symlink from /usr/share
          ansible.builtin.file:
            src: /opt/privesc-scripts
            dest: /usr/share/privesc-scripts
            state: link

        - name: Git clone PEASS-ng
          ansible.builtin.git:
            repo: 'https://github.com/carlospolop/PEASS-ng.git'
            dest: /opt/privesc-scripts/PEASS-ng
            clone: true
            version: master

        - name: Git clone LinEnum
          ansible.builtin.git:
            repo: 'https://github.com/rebootuser/LinEnum.git'
            dest: /opt/privesc-scripts/LinEnum
            clone: true
            version: master

        - name: Git clone linux-smart-enumeration
          ansible.builtin.git:
            repo: 'https://github.com/diego-treitos/linux-smart-enumeration'
            dest: /opt/privesc-scripts/linux-smart-enumeration
            clone: true
            version: master

        - name: Git clone linux-exploit-suggester
          ansible.builtin.git:
            repo: 'https://github.com/The-Z-Labs/linux-exploit-suggester.git'
            dest: /opt/privesc-scripts/linux-exploit-suggester
            clone: true
            version: master

        - name: Git clone GitTools
          ansible.builtin.git:
            repo: 'https://github.com/internetwache/GitTools.git'
            dest: /opt/GitTools
            clone: true
            version: master

        - name: Git clone zphisher  # An automated phishing tool with 30+ templates
          ansible.builtin.git:
            repo: 'https://github.com/htr-tech/zphisher.git'
            dest: /opt/zphisher
            clone: true
            version: master
            depth: 1

        - name: Git clone vulhub  # Pre-Built Vulnerable Environments Based on Docker-Compose
          ansible.builtin.git:
            repo: 'https://github.com/vulhub/vulhub.git'
            dest: /opt/vulhub
            clone: true
            version: master

        - name: Git clone WEF (Wi-Fi Exploitation Framework)
          ansible.builtin.git:
            repo: 'https://github.com/D3Ext/WEF.git'
            dest: /opt/WEF
            clone: true
            version: main

    - name: Setup some CTF style vulnerable docker images and packages
      when: setup_vuln_docker_images
      block:
        - name: Install docker packages
          ansible.builtin.apt:
            pkg:
              - docker.io
              - python3-docker

        - name: Make local user able to run docker commands
          ansible.builtin.user:
            name: "{{ local_username }}"
            append: true
            groups:
              - docker

        - name: Pull some vulnerable docker images
          community.docker.docker_image:
            name: "{{ item }}"
            source: pull
          loop:
            - webgoat/webgoat          # docker run --rm -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=UTC --name webgoat webgoat/webgoat
            - bkimminich/juice-shop    # docker run --rm -d -p 3000:3000 --name juice-shop bkimminich/juice-shop

        - name: Install DVWA package
          ansible.builtin.apt:
            pkg:
              - dvwa
        # start the service using `sudo systemctl start dvwa`
        # navigate to http://localhost:42001
        # default creds are admin/password
        # Security Level can be changed in /etc/dvwa/config/config.inc.php


    - name: Install projectdiscovery.io OSS tools
      become: true
      become_user: "{{ local_username }}"
      block:
        - name: Create projectdiscovery temporary directory for extraction
          ansible.builtin.file:
            path: /tmp/projectdiscovery
            state: directory

        - name: Get latest release information for pdtm
          ansible.builtin.uri:
            url: "{{ projectdiscovery_tool_manager_url }}"
            return_content: true
          register: pdtm_latest_release

        - name: Extract pdtm version from the latest release URL
          ansible.builtin.set_fact:
            pdtm_version: "{{ pdtm_latest_release.json.tag_name | regex_replace('^v', '') }}"

        - name: Extract download URL for pdtm
          ansible.builtin.set_fact:
            pdtm_download_url: "{{ pdtm_latest_release.json.assets | selectattr('name', 'match', '^pdtm_' ~ pdtm_version ~ '_linux_amd64.zip$') | map(attribute='browser_download_url') | first }}"

        - name: Download pdtm file
          ansible.builtin.get_url:
            url: "{{ pdtm_download_url }}"
            mode: '0644'
            dest: "/tmp/projectdiscovery/pdtm_{{ pdtm_version }}_linux_amd64.zip"

        - name: Unzip pdtm file
          ansible.builtin.unarchive:
            src: "/tmp/projectdiscovery/pdtm_{{ pdtm_version }}_linux_amd64.zip"
            dest: /tmp/projectdiscovery
            remote_src: true

        - name: Execute pdtm file
          ansible.builtin.shell:
            cmd: "/tmp/projectdiscovery/pdtm -i pdtm"  # this will set PATH to ~/.pdtm/go/bin in ~/.zshrc and also install pdtm in ~/.pdtm/go/bin
            creates: "~{{ local_username }}/.pdtm/go/bin/pdtm"

        - name: Remove projectdiscovery.io temporary download directory
          ansible.builtin.file:
            path: /tmp/projectdiscovery
            state: absent

        - name: Install all other projectdiscovery.io tools
          ansible.builtin.shell:
            cmd: "~{{ local_username }}/.pdtm/go/bin/pdtm -i {{ item }}"
            creates: "~{{ local_username }}/.pdtm/go/bin/{{item}}"
          with_items: "{{ projectdiscovery_tools }}"

        - name: Update all projectdiscovery.io tools
          ansible.builtin.shell:
            cmd: "~{{ local_username }}/.pdtm/go/bin/pdtm -update-all"

    - name: Setup some essential paths
      become: true
      become_user: "{{ local_username }}"
      block:
        - name: Set bin path for rust/cargo, pipx, and golang
          ansible.builtin.blockinfile:
            path: "~{{ local_username }}/.zshrc"
            marker: "# {mark} ANSIBLE MANAGED BLOCK - bin paths"
            block: |
              # rust binaries installed using cargo
              export PATH="$PATH:/home/{{ local_username }}/.cargo/bin"

              # golang binaries
              export PATH="$PATH:/home/{{ local_username }}/go/bin"

              # pipx binaries
              export PATH="$PATH:/home/{{ local_username }}/.local/bin"
            create: false

    - name: Generate ssh keys
      become: true
      become_user: "{{ local_username }}"
      block:
        - name: Ensure .ssh directory exists
          ansible.builtin.file:
            path: "~{{ local_username }}/.ssh"
            state: directory
            mode: '0700'

        - name: Generate SSH key pair
          community.crypto.openssh_keypair:
            state: present
            type: rsa
            size: 4096
            path: "~{{ local_username }}/.ssh/id_rsa"

    - name: Setup custom shell aliases and functions
      become: true
      become_user: "{{ local_username }}"
      block:
        - name: Copy sample .shell_aliases and .shell_functions files
          ansible.builtin.copy:
            src: "{{ item }}"
            dest: "~{{ local_username }}/{{ item | basename }}"
            mode: '0644'
          with_items:
            - home/user/.shell_aliases
            - home/user/.shell_functions
            - home/user/.shell_variables

        - name: Include .shell_aliases, .shell_functions and .shell_variables files in .zshrc
          ansible.builtin.blockinfile:
            path: "~{{ local_username }}/.zshrc"
            marker: "# {mark} ANSIBLE MANAGED BLOCK - extra shell functions and aliases"
            block: |
              [[ -f ~/.shell_aliases ]] && source ~/.shell_aliases
              [[ -f ~/.shell_functions ]] && source ~/.shell_functions
              [[ -f ~/.shell_variables ]] && source ~/.shell_variables
            create: false

    - name: Install VSCodium and some plugins
      block:
        - name: Add VSCodium apt key
          ansible.builtin.apt_key:
            url: "{{ vscodium.apt_key_url }}"
            keyring: "{{ vscodium.apt_key_keyring }}"

        - name: Add VSCodium repo
          ansible.builtin.apt_repository:
            repo: "{{ vscodium.repo }}"
            state: present
            filename: "{{ vscodium.repo_filename }}"

        - name: Install the lastest version of VSCodium
          ansible.builtin.apt:
            name: "{{ vscodium.package }}"

        - name: Install some VSCodium extensions
          ansible.builtin.command: "codium --install-extension {{ item }}"
          with_items: "{{ vscodium.extensions }}"
          become: true
          become_user: "{{ local_username }}"

    - name: build and install rust binaries using cargo
      community.general.cargo:
        name: "{{ item }}"
        locked: true
        state: latest
      with_items: "{{ cargo_packages }}"
      become: true
      become_user: "{{ local_username }}"

    - name: build and install golang binaries
      ansible.builtin.command: "go install {{ item }}"
      with_items: "{{ golang_tools }}"
      become: true
      become_user: "{{ local_username }}"

    - name: Set system time to UTC
      community.general.timezone:
        name: Etc/UTC

    - name: Get an offline copy of all tldr pages
      ansible.builtin.shell: |
        /bin/zsh -i -c 'tldr --update'
      become: true
      become_user: "{{ local_username }}"

    - name: Setup alacritty
      block:
        - name: Create alacritty config directory
          ansible.builtin.file:
            path: "~{{ local_username }}/.config/alacritty"
            state: directory
            mode: '0755'
            owner: "{{ local_username }}"
            group: "{{ local_username }}"

        - name: Clone alacritty themes git repo
          ansible.builtin.git:
            repo: "{{ alacritty_themes_repo }}"
            dest: "~{{ local_username }}/.config/alacritty/themes"
            clone: true

        - name: Copy sample alacritty config file
          ansible.builtin.copy:
            src: home/user/.config/alacritty/alacritty.toml
            dest: "~{{ local_username }}/.config/alacritty/alacritty.toml"
            mode: '0644'
      become: true
      become_user: "{{ local_username }}"

    - block:
        - name: Clone lazyvim starter git repo
          ansible.builtin.git:
            repo: "{{ lazyvim_starter_url }}"
            dest: "~{{ local_username }}/.config/nvim"
      become: true
      become_user: "{{ local_username }}"

    - name: Initialize zoxide in zsh shell
      ansible.builtin.lineinfile:
        path: "~{{ local_username }}/.zshrc"
        line: "{{ item }}"
      with_items:
        - ""
        - "# initialize zoxide"
        - eval "$(zoxide init zsh)"

    - name: Initialize fzf in zsh shell
      ansible.builtin.lineinfile:
        path: "~{{ local_username }}/.zshrc"
        line: "{{ item }}"
      with_items:
        - ""
        - "# Set up fzf key bindings and fuzzy completion"
        - source <(fzf --zsh)

    - name: Final cleanup
      block:
        - name: Remove problematic packages
          ansible.builtin.apt:
            pkg: "{{ problematic_packages }}"
            state: absent
            purge: true

        - name: Cleanup apt packages and repodata
          ansible.builtin.apt:
            autoremove: true
            autoclean: true