From e1557aede769cb1dbce67ecdf85511ff12f76112 Mon Sep 17 00:00:00 2001
From: abrown38 <a.brown@epcc.ed.ac.uk>
Date: Fri, 23 Aug 2024 22:43:38 +0100
Subject: [PATCH] Create GPO to configure proxy for clients

---
 .../win_domain_controller/tasks/setup.yml     | 20 +++++++++++++++++++
 .../templates/proxy_gpo.ps1.j2                | 13 ++++++++++++
 .../roles/win_domain_controller/vars/main.yml |  3 +++
 3 files changed, 36 insertions(+)
 create mode 100644 ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2

diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml
index 24663e0..b53b7a4 100644
--- a/ansible/roles/win_domain_controller/tasks/setup.yml
+++ b/ansible/roles/win_domain_controller/tasks/setup.yml
@@ -120,3 +120,23 @@
       win_shell: powershell C:\eidf\{{ server_hardening_script }}
       tags: apply_hardening_scripts
   when: inventory_hostname in groups['meta-name_dc01']
+
+- name: Squid Proxy GPO Script
+  tags: proxy_script
+  block:
+    - name: Copy Squid GPO Script
+      vars:
+        proxy_vm: "{{ os_project }}-{{ win_project }}-proxy"
+        proxy_address: "{{ hostvars[proxy_vm].ansible_host }}:3128"
+      ansible.builtin.template:
+        src: "{{ squid_proxy_script_tmpl }}"
+        dest: "{{ script_dir }}\\{{ squid_proxy_script }}"
+        force: true
+      tags: copy_proxy_script
+
+    - name: Apply Squid GPO Script
+      win_shell: "powershell {{ script_dir }}\\{{ squid_proxy_script }}"
+      tags: create_proxy_gpo
+  when: |
+    inventory_hostname in groups['meta-name_dc01'] and
+    project_zone == 'protected'
diff --git a/ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2 b/ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2
new file mode 100644
index 0000000..ceaf70e
--- /dev/null
+++ b/ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2
@@ -0,0 +1,13 @@
+New-GPO -Name "Squid Proxy" -comment "Configure Client VMs to use Squid HTTP proxy"
+Set-GPRegistryValue -Name "Squid Proxy" -ValueName "ProxyEnable" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Value 1 -Type DWord
+Set-GPRegistryValue -Name "Squid Proxy" -ValueName "ProxyServer" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Value "{{ proxy_address }}" -Type String
+Set-GPRegistryValue -Name "Squid Proxy" -ValueName "ProxyOverride" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Value "<local>" -Type String
+Set-GPRegistryValue -Name "Squid Proxy" -ValueName "Proxy" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" -Value 1 -Type DWord
+
+$DomainInfo = Get-ADDomain
+$DomainOU = $DomainInfo.DistinguishedName
+$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName
+
+New-GPLink -Name "Squid Proxy" -Target $workbenchOU
+
+Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\ProxyScript.txt'
\ No newline at end of file
diff --git a/ansible/roles/win_domain_controller/vars/main.yml b/ansible/roles/win_domain_controller/vars/main.yml
index 5a09703..30ad142 100644
--- a/ansible/roles/win_domain_controller/vars/main.yml
+++ b/ansible/roles/win_domain_controller/vars/main.yml
@@ -1,5 +1,8 @@
 group_policy_script: OpenStackADBuild.ps1
 server_hardening_script: serverhardening.ps1
+squid_proxy_script: proxy_gpo.ps1
+squid_proxy_script_tmpl: proxy_gpo.ps1.j2
+script_dir: C:\eidf
 
 OUs:
   - Project Users