$ show trailofbits/algo
Algo VPN is a deployment tool that automates the setup of a personal VPN server on cloud providers or local Ubuntu machines. It uses Ansible to provision a hardened server running strongSwan (IKEv2/IPsec) and WireGuard, with optional DNS encryption via dnscrypt-proxy and privacy enhancements like log rotation and history clearing. The architecture is a set of Ansible playbooks and roles, orchestrated by a shell script entry point (`algo`) that invokes `ansible-playbook`. Cloud provisioning is handled by provider-specific roles (AWS EC2, DigitalOcean, Azure, GCE, etc.), while server configuration roles handle system hardening, PKI certificate generation, VPN service configuration, and client profile generation (mobileconfig, WireGuard .conf, QR codes). The system is designed for security and privacy: it uses strong crypto defaults (ECC secp384r1), minimal logging, and unattended upgrades. External dependencies include Ansible, community.crypto collection, cloud provider SDKs, and the dnscrypt-proxy package. The primary data flow is: user edits `config.cfg` → Ansible playbook runs → cloud VM is created → server is configured with VPN services → client configuration files are generated and stored locally. User management (add/revoke) is handled by a separate playbook. The repository includes extensive unit, integration, and end-to-end tests, with Docker-based integration testing and CI/CD via GitHub Actions.
The LLM identified 4 files worth highlighting for reuse:
A custom Ansible module that derives a WireGuard public key from a private key using the X25519 curve. It is self-contained, has no internal dependencies beyond the `cryptography` library, and can be reused in any Ansible project that needs to compute WireGuard public keys. Demonstrates non-obvious skill in implementing a low-level cryptographic operation as an Ansible module.
A reusable Ansible task file that generates a full PKI hierarchy: ECC private keys, self-signed CA, server and client certificates with strict constraints (name constraints, key usage, extended key usage, pathlen=0), and a certificate revocation list. It uses the `community.crypto` collection and is parameterized for different environments. This pattern can be extracted and applied to any project requiring automated certificate issuance with strong security defaults.
A mock Ansible module for `apt` used in Docker-based integration tests. It simulates package installation without requiring a real package manager, enabling fast and deterministic testing of Ansible roles. The pattern of creating lightweight mock modules for integration tests is reusable across any Ansible project that wants to test role logic without side effects.
A Jinja2 template for iptables rules that implements a secure firewall configuration for a VPN server. It is parameterized with variables for allowed ports, forwarding rules, and anti-spoofing measures. The template is self-contained and can be adapted for any server that needs a minimal, secure iptables ruleset with VPN traffic handling.