Ansible configuration for the Netz39 infrastructure

This call lists all hosts defined in the inventory:

ansible all --list-hosts

Setup

ansible-galaxy install -r requirements.yml

Vault Password

Store the vault password in a file named vault-pass in the projects root directory. Make sure that this file is only readable by you:

 echo "<your-vault-password>" > vault-pass
chmod 600 vault-pass

The password will automatically be picked up by Ansible.

If you do not want to store the vault password in a file, you can also provide it interactively by adding the option --ask-vault-pass (or -J) to the ansible-playbook command.

Setup SSH Access to hosts

LOGUSER=<loguser>
SSH_KEY=<absolute/path/to/ssh/private/key>
ansible-playbook setup-ssh.yml -e "setup_ssh_logname=$LOGUSER" -e "setup_ssh_key=$SSH_KEY"

This playbook also adds rhodium.n39.eu (OpenWRT router), but our Ansible cannot set up SSH keys (yet). Please add your key to OpenWRT manually.

Edit vault encrypted vars files

ansible-vault edit group_vars/all/vault

Call with

ansible-galaxy install --force -r requirements.yml
ansible-playbook main.yml

Please make sure that the galaxy roles are in sync with the requirements file!

You need to provide a user with sudo rights and the vault password.

Verify Changes

ansible-lint main.yml
ansible-playbook main.yml --check --diff

HTTPS ingress configuration

HTTPS ingress is controlled by the server holmium and forwarded to the configured servers.

To set up a new HTTPS vhost, the following steps need to be taken:

1. Select a domain (for internal services we use sub-domains of .n39.eu).
2. Create an external CNAME from this domain to dyndns.n39.eu.
3. Create an internal DNS entry in the Descartes DNS config. This is usually an alias on an existing server.
4. Add the entry to the holmium playbook.
5. Set up Dehydrated and vhost on the target host, e.g. using setup_http_site_proxy.

Do not forget to execute all playbooks with relevant changes.