{"id":13775677,"url":"https://github.com/david415/ansible-tor","last_synced_at":"2025-08-04T04:38:43.058Z","repository":{"id":15268791,"uuid":"17998030","full_name":"david415/ansible-tor","owner":"david415","description":"An Ansible role for using tor!","archived":false,"fork":false,"pushed_at":"2015-08-23T11:56:34.000Z","size":468,"stargazers_count":73,"open_issues_count":3,"forks_count":23,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-04-03T01:41:34.669Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/david415.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-03-21T23:58:50.000Z","updated_at":"2025-02-03T14:46:53.000Z","dependencies_parsed_at":"2022-09-05T10:10:23.546Z","dependency_job_id":null,"html_url":"https://github.com/david415/ansible-tor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/david415/ansible-tor","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david415%2Fansible-tor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david415%2Fansible-tor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david415%2Fansible-tor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david415%2Fansible-tor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/david415","download_url":"https://codeload.github.com/david415/ansible-tor/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david415%2Fansible-tor/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":268649818,"owners_count":24284195,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-04T02:00:09.867Z","response_time":79,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:45.936Z","updated_at":"2025-08-04T04:38:43.031Z","avatar_url":"https://github.com/david415.png","language":null,"funding_links":[],"categories":["\u003ca id=\"6e80463404d46f0493cf6e84597e4b5c\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"e99ba5f3de02f68412b13ca718a0afb6\"\u003e\u003c/a\u003eTor\u0026\u0026\u0026Onion\u0026\u0026洋葱"],"readme":"Ansible Tor\n===========\n\nI'm not maintaining this project anymore... so you should instead use Nusenu's good work here:\nhttps://github.com/nusenu/ansible-relayor\n\n\nThis is an Ansible role for use with Tor - https://www.torproject.org/\n\nI hope that relay operators will find this useful for deploying\nand maintaining large numbers of Tor relays and bridges with\nfinesse, concurrency and idempotency!\n\nThis ansible role can help you reduce the complexity to a single\ncommand for deploying one or more tor relays or tor bridges with or\nwithout obfsproxy.\n\nHere I assume the user has setup their ansible project directory according to the best practices\ndirectory-layout specified here:\n\nhttp://docs.ansible.com/playbooks_best_practices.html#directory-layout\n\n...and simply run a command like this: ansible-playbook -i production tor-relays.yml\n\nIn this case I'm running the tor-relays.yml playbook against\nthe \"production\" inventory file. This tor-relays playbook might\nspecify a host group called tor-relays... which is defined in the\ninventory file. I could have many other host groups defined in the\ninventory as well such as: tor-exit-relays, tor-bridges,\ntor-bananaphone-bridges, tor-hidden-tahoe-storage-nodes etc.\n\n\n\nRequirements\n------------\n\nWorks on Debian and Ubuntu.\nI've tried it... so I know. =-)\n\n\nRole Variables\n--------------\n\ntor_distribution_release should be set to the desired distribution of\nthe Tor Project's APT repo - http://deb.torproject.org/torproject.org\n\nPerhaps many debian users will want to specify \"wheezy\"... however if\nyou intend to operate a tor bridge then you unless you probably want\n\"tor-experimental-0.2.5.x-wheezy\" so that you can have\nServerTransportOptions in your torrc.\n\ntor_obfsproxy_home variable should set when you want to use obfsproxy\nwith your bridge configuration. Perhaps I should change this to be a\nboolean variable names tor_run_obfsproxy... and then set a reasonable\ndefault for the obfsproxy python virtual env directory?\n\ntor_wait_for_hidden_services can be set to yes if you would like the\nansible-tor role to wait for the newly created tor hidden services to\nstart. It does so by waiting for the tor hidden service hostname file\nto appear.\n\n\nExample Tor obfs4 Bridge Playbook\n---------------------------------\n\n```yml\n---\n- hosts: tor-relays\n  user: human\n  connection: ssh\n  roles:\n# XXX uber-paranoid openssh ansible role?\n#    - { role: ansible-openssh-hardened,\n#        backports_url: \"http://ftp.de.debian.org/debian/\",\n#        backports_distribution_release: \"wheezy-backports\",\n#        ssh_admin_ed25519pubkey_path: \"/home/amnesia/.ssh/id_ed25519.pub\",\n#        sudo: yes\n#      }\n#    - { role: ansible-tlsdate,\n#        remove_ntp: yes,\n#        sudo: yes\n#      }\n    - { role: ansible-tor,\n        tor_distribution_release: \"tor-experimental-0.2.5.x-wheezy\",\n        tor_BridgeRelay: 1,\n        tor_PublishServerDescriptor: \"bridge\",\n        tor_ExtORPort: \"auto\",\n        tor_ORPort: 9001,\n        tor_ServerTransportPlugin: \"obfs4 exec /usr/bin/obfs4proxy\",\n        tor_ExitPolicy: \"reject *:*\",\n        tor_obfs4proxy_enabled: True,\n        sudo: yes\n      }\n```\n\n\nNote that the `ansible-tlsdate` role is also not strictly necessary...\nhowever Tor does need accurate time and I think it is *much* better\nto use tldated instead of ntpd.\nSee here:\nhttps://github.com/david415/ansible-tlsdate\n\nFurthermore it is also a good idea to have a hardened openssh-server\nconfiguration;  that supports the new ed25515 key exchange +\nthe new polychacha1305 DJB-inspired crypto transport.\nSee here:\nhttps://github.com/david415/ansible-openssh-hardened\n\n\nExample Tor Scramblesuit Bridge Playbook\n----------------------------------------\n\nThis playbook installs and fully configures a scramblesuit\n( http://www.cs.kau.se/philwint/scramblesuit/ ) tor bridge using the latest\nobfsproxy available to pip (installs into a python virtualenv).\n\n```yml\n---\n\n- hosts: tor-bridges\n  roles:\n    - { role: ansible-role-firewall,\n        firewall_allowed_tcp_ports: [ 22, 4703 ],\n        sudo: yes\n      }\n    - { role: david415.ansible-tor,\n        tor_distribution_release: \"wheezy\",\n        tor_BridgeRelay: 1,\n        tor_PublishServerDescriptor: \"bridge\",\n        tor_obfsproxy_home: \"/home/ansible\",\n        tor_ORPort: 9001,\n        tor_ServerTransportPlugin: \"scramblesuit exec {{ tor_obfsproxy_home }}/{{ tor_obfsproxy_virtenv }}/bin/obfsproxy --log-min-severity=info --log-file=/var/log/tor/obfsproxy.log managed\",\n        tor_ServerTransportListenAddr: \"scramblesuit 0.0.0.0:4703\",\n        tor_ExitPolicy: \"reject *:*\",\n        sudo: yes\n      }\n```\n\nYou should also feel free to apply iptables rulesets...\nhowever this also is not strictly necessary but at times might be a good idea.\n\n\nExample Tor Bananaphone Bridge Playbook\n---------------------------------------\n\nThis playbook demonstrates configuring a tor bridge\nwith an obfsproxy installed from my git repo so that\nthe bananaphone pluggable transport is available (it has not been\nmerged upstream).\n\nBananaphone provides tor over markov chains!\nIf you have sensitive or interesting documents then please consider\noperating a bananaphone bridge utilizing these text corpuses.\nRead about the bananaphone pluggable transport for tor - http://bananaphone.io/\n\n\n```yml\n---\n\n- hosts: tor-bridges\n  roles:\n    - { role: david415.ansible-tor,\n        tor_distribution_release: \"tor-experimental-0.2.5.x-wheezy\",\n        tor_BridgeRelay: 1,\n        tor_PublishServerDescriptor: \"bridge\",\n        tor_obfsproxy_home: \"/home/ansible\",\n        tor_ORPort: 9001,\n        tor_obfsproxy_git_url: \"git+https://github.com/david415/obfsproxy.git\",\n        tor_ServerTransportPlugin: \"bananaphone exec {{ tor_obfsproxy_home }}/{{ tor_obfsproxy_virtenv }}/bin/obfsproxy --log-min-severity=info --log-file=/var/log/tor/obfsproxy.log managed\",\n        tor_ServerTransportOptions: \"bananaphone corpus=/usr/share/dict/words encodingSpec=words,sha1,4 modelName=markov order=1\",\n        tor_ServerTransportListenAddr: \"bananaphone 0.0.0.0:4703\",\n        tor_ExitPolicy: \"reject *:*\",\n        sudo: yes\n      }\n```\n\n\nExample Tor Relay Playbook\n--------------------------\n\n\nThis example playbook sets up tor relays with hidden service for\nssh...\n\nThis playbook demonstrates waiting for the hidden services\nto be created... by awaiting the existence of the tor hidden service\nhostname files. This happens when the role variable\n\"tor_wait_for_hidden_services\" is set to yes.\n\nThis feature could be useful when configuring other services that\ndepend on knowing the hidden service's onion address... such as\nmy ansible-tahoe-lafs role:\nhttps://github.com/david415/ansible-tahoe-lafs\n\nRead about Tahoe-LAFS here:\nhttps://tahoe-lafs.org/trac/tahoe-lafs\nRead about tor hidden services here:\nhttps://www.torproject.org/docs/tor-hidden-service.html.en\n\n\n```yml\n---\n- hosts: tor-relays\n  user: ansible\n  connection: ssh\n  vars:\n    relay_hidden_services_parent_dir: \"/var/lib/tor/services\"\n    relay_hidden_services: [ { dir: \"hidden_ssh\",\n                               ports: [ { virtport: \"22\",\n                                 target: \"localhost:22\" } ] }\n    ]\n  roles:\n    - { role: ansible-role-firewall,\n        firewall_allowed_tcp_ports: [ 22, 9001 ],\n        sudo: yes\n      }\n    - { role: david415.ansible-tor,\n        tor_distribution_release: \"wheezy\",\n        tor_ExitPolicy: \"reject *:*\",\n        tor_hidden_services: \"{{ relay_hidden_services }}\",\n        tor_hidden_services_parent_dir: \"{{ relay_hidden_services_parent_dir }}\",\n        tor_wait_for_hidden_services: yes,\n        sudo: yes\n      }\n```\n\n\nExample Multi-tor-instance playbook\n-----------------------------------\n\n\npolytorus-ansibilus.yml:\n```yml\n---\n- hosts: tor-relays\n  roles:\n    - { role: david415.ansible-tor,\n        tor_distribution_release: \"wheezy\",\n        tor_ExitPolicy: \"reject *:*\",\n        sudo: yes\n      }\n```\n\nA simple playbook like this can be used to deploy many instances of\ntor on many servers. You can configure multiple tor instances using\nthe host_vars file for each host.\n\nHere's what an example host_vars file looks like (with rfc1918 ip addrs):\n\nhost_vars/192.168.1.1:\n```yml\ntor_Nickname: [ \"ScratchMaster\" ]\nproc_instances: [ {\nname: \"relay1\",\ntor_ORPort: [\"192.168.1.1:9002\"],\ntor_SOCKSPort: [\"8041\"]\n},\n{\nname: \"relay2\",\ntor_ORPort: [\"192.168.1.2:9002\"],\ntor_SOCKSPort: [\"8042\"]\n},\n{\nname: \"relay3\",\ntor_ORPort: [\"192.168.1.3:9002\"],\ntor_SOCKSPort: [\"8043\"]\n}]\n```\n\nIn the above example playbook, all the role variables get applied to\nall tor instances. If you want to control the role variables for a\nspecific host then you must use that host's host_vars file.\n\nNote: when this role is used in \"multi-tor process mode\"... meaning\nthat if the proc_instances variable is defined... then the torrc template will set\nreasonable defaults for these torrc options: User, PidFile, Log and DataDirectory.\n\nThis next example is NOT very practical because it can only be used\nwith a host inventory with one host! If it were to be used with\nmultiple hosts then their torrc files would contain the same IP addresses.\n\n```yml\n---\n- hosts: tor-relays\n  roles:\n    - { role: david415.ansible-tor,\n        tor_distribution_release: \"wheezy\",\n        tor_ExitPolicy: \"reject *:*\",\n        tor_instance_parent_dir: \"/etc/tor/instances\",\n        proc_instances: [ {\n                          name: \"relay1\",\n                          tor_ORPort: [\"192.168.1.1:9002\"],\n                          tor_SocksPort: [\"8041\"]\n                        },\n                        {\n                          name: \"relay2\",\n                          tor_ORPort: [\"192.168.1.2:9002\"],\n                          tor_SocksPort: [\"8042\"]\n                        },\n                        {\n                          name: \"relay3\",\n                          tor_ORPort: [\"192.168.1.3:9002\"],\n                          tor_SocksPort: [\"8043\"]\n                        }],\n        sudo: yes\n      }\n```\n\n\nTor configuration - torrc\n-------------------------\n\ntorrc may have options set from host_vars/group_vars and\nalso set from role variables.\n\nThe host_vars can set arbitrary torrc configuration options however\nthe role variables currently support a small subset of the torrc\noptions at the moment... it's a work in progress; refer to the\ntemplates/torrc for a more detailed overview.\n\nThe host_vars variable names must begin with \"tor_\";\nHere's an example setting \"Nickname\":\n\n```yml\ntor_Nickname: [ \"OnionRobot\" ]\n```\n\nThe dictionary value is a list because in some cases you may want to\nspecify multiple lines in the torrc that begin with the dictionary key.\n\n\nLicense\n-------\n\nMIT\n\n\nFeature requests and bug-reports welcome!\n-----------------------------------------\n\nhttps://github.com/david415/ansible-tor/issues\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavid415%2Fansible-tor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdavid415%2Fansible-tor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavid415%2Fansible-tor/lists"}