# streisandeffect/streisand architecture

> Architecture diagram of the GitHub repository streisandeffect/streisand, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/streisandeffect/streisand
- Repository: https://github.com/streisandeffect/streisand

## Overview

Streisand automates provisioning and configuration of a censorship-resistant server, then presents clients with a private website containing service software and setup instructions. The main user workflow is to choose a supported cloud provider or an existing/local server, deploy services, and retrieve their client guidance from the generated site. The README also documents multiple VPN and proxy options and evasion add-ons. Source excerpts cover only a helper module and utilities, so implementation-level links among the Ansible playbooks and roles are not verified here.

Main entry points: [`playbooks/streisand.yml`](https://github.com/streisandeffect/streisand/blob/master/playbooks/streisand.yml) (Main deployment), [`playbooks/roles`](https://github.com/streisandeffect/streisand/tree/master/playbooks/roles) (VPN services), [`playbooks/roles/streisand-gateway/tasks/main.yml`](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/streisand-gateway/tasks/main.yml) (Private gateway), [`playbooks`](https://github.com/streisandeffect/streisand/tree/master/playbooks) (Cloud providers)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_provision["Server provisioning"]
  node_entry["Main deployment<br/>[streisand.yml]"]
  node_cloud["Cloud providers"]
  node_do_module["DigitalOcean module"]
  node_alternate["Local or existing"]
end

subgraph group_services["Connectivity services"]
  node_vpn["VPN services"]
  node_openvpn["OpenVPN<br/>[main.yml]"]
  node_wireguard["WireGuard<br/>[main.yml]"]
  node_openconnect["OpenConnect<br/>[main.yml]"]
  node_shadowsocks["Shadowsocks<br/>[main.yml]"]
  node_tor["Tor bridge<br/>[main.yml]"]
  node_ssh["SSH forwarding<br/>[main.yml]"]
  node_addons["Evasion add-ons"]
end

subgraph group_access["Client access"]
  node_gateway["Private gateway<br/>[main.yml]"]
  node_mirror["Service mirrors<br/>[main.yml]"]
  node_clientdocs["Client instructions"]
end

subgraph group_operations["Server operations"]
  node_security["Firewall and security<br/>[main.yml]"]
  node_certificates["Certificates<br/>[main.yml]"]
  node_adblock["Ad blocking<br/>[main.yml]"]
  node_diagnostics["Diagnostics<br/>[main.yml]"]
end

node_operator(("Unix operator"))
node_user(("Service user"))

node_operator -.->|"starts deployment"| node_entry
node_entry -.->|"provisions server"| node_cloud
node_entry -.->|"supports install"| node_alternate
node_cloud -.->|"creates droplets"| node_do_module
node_entry -.->|"installs services"| node_vpn
node_vpn -.->|"includes"| node_openvpn
node_vpn -.->|"includes"| node_wireguard
node_vpn -.->|"includes"| node_openconnect
node_vpn -.->|"includes"| node_shadowsocks
node_vpn -.->|"includes"| node_tor
node_vpn -.->|"includes"| node_ssh
node_entry -.->|"configures add-ons"| node_addons
node_entry -.->|"publishes private site"| node_gateway
node_gateway -.->|"presents instructions"| node_clientdocs
node_gateway -.->|"offers downloads"| node_mirror
node_entry -.->|"configures security"| node_security
node_entry -.->|"configures certificates"| node_certificates
node_entry -.->|"offers ad blocking"| node_adblock
node_entry -.->|"generates diagnostics"| node_diagnostics
node_user -.->|"retrieves instructions"| node_gateway

click node_entry "https://github.com/streisandeffect/streisand/blob/master/playbooks/streisand.yml"
click node_cloud "https://github.com/streisandeffect/streisand/tree/master/playbooks"
click node_do_module "https://github.com/streisandeffect/streisand/blob/master/library/digital_ocean_droplet.py"
click node_alternate "https://github.com/streisandeffect/streisand/blob/master/playbooks/existing-server.yml"
click node_vpn "https://github.com/streisandeffect/streisand/tree/master/playbooks/roles"
click node_openvpn "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/openvpn/tasks/main.yml"
click node_wireguard "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/wireguard/tasks/main.yml"
click node_openconnect "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/openconnect/tasks/main.yml"
click node_shadowsocks "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/shadowsocks/tasks/main.yml"
click node_tor "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/tor-bridge/tasks/main.yml"
click node_ssh "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/ssh-forward/tasks/main.yml"
click node_addons "https://github.com/streisandeffect/streisand/tree/master/playbooks/roles"
click node_gateway "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/streisand-gateway/tasks/main.yml"
click node_mirror "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/streisand-mirror/tasks/main.yml"
click node_clientdocs "https://github.com/streisandeffect/streisand/tree/master/playbooks/roles"
click node_security "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/ufw/tasks/main.yml"
click node_certificates "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/certificates/tasks/main.yml"
click node_adblock "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/ad-blocking/tasks/main.yml"
click node_diagnostics "https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/diagnostics/tasks/main.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_cloud,node_do_module,node_alternate,node_user toneBlue
class node_vpn,node_openvpn,node_wireguard,node_openconnect,node_shadowsocks,node_tor,node_ssh,node_addons toneAmber
class node_gateway,node_mirror,node_clientdocs toneMint
class node_security,node_certificates,node_adblock,node_diagnostics toneRose
class node_operator toneIndigo
```

## Components

### Server provisioning

- [Main deployment](https://github.com/streisandeffect/streisand/blob/master/playbooks/streisand.yml): `playbooks/streisand.yml`
- [Cloud providers](https://github.com/streisandeffect/streisand/tree/master/playbooks): `playbooks`
- [DigitalOcean module](https://github.com/streisandeffect/streisand/blob/master/library/digital_ocean_droplet.py): `library/digital_ocean_droplet.py`
- [Local or existing](https://github.com/streisandeffect/streisand/blob/master/playbooks/existing-server.yml): `playbooks/existing-server.yml`

### Connectivity services

- [VPN services](https://github.com/streisandeffect/streisand/tree/master/playbooks/roles): `playbooks/roles`
- [OpenVPN](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/openvpn/tasks/main.yml): `playbooks/roles/openvpn/tasks/main.yml`
- [WireGuard](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/wireguard/tasks/main.yml): `playbooks/roles/wireguard/tasks/main.yml`
- [OpenConnect](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/openconnect/tasks/main.yml): `playbooks/roles/openconnect/tasks/main.yml`
- [Shadowsocks](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/shadowsocks/tasks/main.yml): `playbooks/roles/shadowsocks/tasks/main.yml`
- [Tor bridge](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/tor-bridge/tasks/main.yml): `playbooks/roles/tor-bridge/tasks/main.yml`
- [SSH forwarding](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/ssh-forward/tasks/main.yml): `playbooks/roles/ssh-forward/tasks/main.yml`
- [Evasion add-ons](https://github.com/streisandeffect/streisand/tree/master/playbooks/roles): `playbooks/roles`

### Client access

- [Private gateway](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/streisand-gateway/tasks/main.yml): `playbooks/roles/streisand-gateway/tasks/main.yml`
- [Service mirrors](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/streisand-mirror/tasks/main.yml): `playbooks/roles/streisand-mirror/tasks/main.yml`
- [Client instructions](https://github.com/streisandeffect/streisand/tree/master/playbooks/roles): `playbooks/roles`

### Server operations

- [Firewall and security](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/ufw/tasks/main.yml): `playbooks/roles/ufw/tasks/main.yml`
- [Certificates](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/certificates/tasks/main.yml): `playbooks/roles/certificates/tasks/main.yml`
- [Ad blocking](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/ad-blocking/tasks/main.yml): `playbooks/roles/ad-blocking/tasks/main.yml`
- [Diagnostics](https://github.com/streisandeffect/streisand/blob/master/playbooks/roles/diagnostics/tasks/main.yml): `playbooks/roles/diagnostics/tasks/main.yml`

### Other components

- **Unix operator**
- **Service user**

## Connections

- Unix operator → Main deployment: starts deployment (evidence: `README.md`)
- Main deployment → Cloud providers: provisions server (evidence: `README.md`)
- Main deployment → Local or existing: supports install (evidence: `README.md`)
- Cloud providers → DigitalOcean module: creates droplets
- Main deployment → VPN services: installs services (evidence: `README.md`)
- VPN services → OpenVPN: includes (evidence: `README.md`)
- VPN services → WireGuard: includes (evidence: `README.md`)
- VPN services → OpenConnect: includes (evidence: `README.md`)
- VPN services → Shadowsocks: includes (evidence: `README.md`)
- VPN services → Tor bridge: includes (evidence: `README.md`)
- VPN services → SSH forwarding: includes (evidence: `README.md`)
- Main deployment → Evasion add-ons: configures add-ons (evidence: `README.md`)
- Main deployment → Private gateway: publishes private site (evidence: `README.md`)
- Private gateway → Client instructions: presents instructions (evidence: `README.md`)
- Private gateway → Service mirrors: offers downloads
- Main deployment → Firewall and security: configures security
- Main deployment → Certificates: configures certificates
- Main deployment → Ad blocking: offers ad blocking
- Main deployment → Diagnostics: generates diagnostics
- Service user → Private gateway: retrieves instructions (evidence: `README.md`)