Ansible configuration for the Netz39 infrastructure
Alexander Dahl
e9ca246090
The container can serve HTTP for yet unknown reasons, but that port is not yet exposed. Do NOT confuse this with the old static website jabber.n39.eu which was decoupled from prosody and plain HTML only. The reverse proxy is used to make the static website available, and to let dehydrated renew the certs. The certs are used for https to the static website _and_ for the XMPP server itself! |
||
|---|---|---|
| files | ||
| roles | ||
| templates | ||
| .editorconfig | ||
| .yamllint | ||
| all.yml | ||
| ansible.cfg | ||
| holmium.yml | ||
| inventory.yml | ||
| krypton.yml | ||
| main.yml | ||
| oganesson.yml | ||
| platon.yml | ||
| pottwal.yml | ||
| proxmox.yml | ||
| radon.yml | ||
| README.md | ||
| requirements.yml | ||
| tau.yml | ||
| unicorn.yml | ||
Ansible configuration for the Netz39 infrastructure
This call lists all hosts defined in the inventory:
ansible -i inventory.yml all --list-hosts
Setup
ansible-galaxy install -r requirements.yml
Call with
ansible-playbook -i inventory.yml --ask-vault-pass main.yml
You need to provide a user with sudo rights and the vault password.
HTTPS ingress configuration
HTTPS ingress is controlled by the server holmium and forwarded to the configured servers.
To set up a new HTTPS vhost, the following steps need to be taken:
- Select a domain (for internal services we use sub-domains of
.n39.eu). - Create an external CNAME from this domain to
dyndns.n39.eu. - Create an internal DNS entry in the Descartes DNS config. This is usually an alias on an existing server.
- Add the entry to the holmium playbook.
- Set up Dehydrated and vhost on the target host, e.g. using
setup-http-site-proxy.
Do not forget to execute all playbooks with relevant changes.