security.yaml

- name: "Setting up a VPN client."
  hosts: localhost
  connection: local
  tasks:
    # install VPN
    - name: mullvad - download deb package
      get_url:
        url: https://mullvad.net/download/app/deb/latest
        dest: /tmp/mullvad-latest.deb
        checksum: sha256:2dfb8b05818795511c5691d275148011ff43ed00a145dfdf871f04a020596d27
    - name: mullvad - install with apt
      apt:
        deb: /tmp/mullvad-latest.deb
      become: yes
    - name: mullvad - configure
      shell: |
        mullvad auto-connect set on
        mullvad lan set allow
        mullvad dns set default --block-ads --block-gambling --block-malware --block-trackers
    - name: mullvad - create autostart directory
      file:
        path: ~/.config/autostart
        state: directory
    - name: mullvad - symlink autostart file
      file:
        src: "{{ playbook_dir }}/config/autostart/mullvad-vpn.desktop"
        dest: ~/.config/autostart/mullvad-vpn.desktop
        state: link
        force: true

    - name: firewall - deny all incoming
      ufw:
        rule: deny
        direction: in
        state: enabled
      become: yes