Ansible configuration for the Netz39 infrastructure
tux
9a873d934a
Reviewed-on: https://gitea.n39.eu/Netz39_Admin/netz39-infra-ansible/pulls/101 Reviewed-by: Alexander Dahl <alex@netz39.de> Reviewed-by: tux <tux@netz39.de> |
||
|---|---|---|
| files | ||
| group_vars/all | ||
| host_vars | ||
| roles | ||
| templates | ||
| .editorconfig | ||
| .mailmap | ||
| .yamllint | ||
| all.yml | ||
| ansible.cfg | ||
| holmium.yml | ||
| inventory.yml | ||
| krypton.yml | ||
| main.yml | ||
| oganesson.yml | ||
| platon.yml | ||
| pottwal.yml | ||
| proxmox.yml | ||
| radon.yml | ||
| README.md | ||
| requirements.yml | ||
| tau.yml | ||
| unicorn.yml | ||
Ansible configuration for the Netz39 infrastructure
This call lists all hosts defined in the inventory:
ansible -i inventory.yml all --list-hosts
Setup
ansible-galaxy install -r requirements.yml
Edit vault encrypted vars files
ansible-vault edit group_vars/all/vault
Call with
ansible-playbook -i inventory.yml --ask-vault-pass main.yml
You need to provide a user with sudo rights and the vault password.
HTTPS ingress configuration
HTTPS ingress is controlled by the server holmium and forwarded to the configured servers.
To set up a new HTTPS vhost, the following steps need to be taken:
- Select a domain (for internal services we use sub-domains of
.n39.eu). - Create an external CNAME from this domain to
dyndns.n39.eu. - Create an internal DNS entry in the Descartes DNS config. This is usually an alias on an existing server.
- Add the entry to the holmium playbook.
- Set up Dehydrated and vhost on the target host, e.g. using
setup_http_site_proxy.
Do not forget to execute all playbooks with relevant changes.