Ansible/README.md

65 lines
1.8 KiB
Markdown
Raw Normal View History

2021-10-16 16:26:14 +00:00
# Ansible
2022-05-25 23:24:56 +00:00
Catalogue of Ansible playbooks and helper scripts for server management
atmen: slave, servant
2022-05-25 23:24:56 +00:00
## Configuration options
### SSH Ports
The ssh port can be configured in 2 steps:
1. Change the `ansible_ssh_port` variable in `inventory/group_vars/all.yml`
2. Change the `sshd_port` variable in `inventory/vars/unprovisioned.yaml`
2022-05-25 23:24:56 +00:00
## Node configuration process
### Provisioning
- Add atmen user for provisioning
- Configure SSH key for atmen user
- Add maintainer user
- Configure SSH key for maintainer user
2022-05-25 23:24:56 +00:00
- Disable root login (passwd --lock root)
- Disable SSH login for creator user
- Disable SSH password login
- Change SSH port
2022-05-25 23:24:56 +00:00
### SSH Setup
- Install fail2ban
### Miscellaneous
- Disable unattended-upgrade is installed
2022-05-25 23:24:56 +00:00
- Disable IPv6
- Setup hostname
- Install open-iscsi, nfs-common, nfs-utils
2022-05-25 23:24:56 +00:00
### OMV configuration
- Install OMV through OMV-extras
- (lab) Add Vagrant user to SSH group
- Add atmen user to sudoers
- Install openmediavault-zfs, openmediavault-s3, openmediavault-filebrowser
2022-05-25 23:24:56 +00:00
# OMV manual configuration
2023-11-12 22:04:38 +00:00
## NFS configuration
- Create FS
- Enable NFS
- `subtree_check,insecure,no_root_squash,anonuid=1000,anongid=100` in NFS share extra options
# Vault
Sensitive data is stored under two files in the `vault` directory:
- `user_provisioning.yml` contains the vault password
- `vault.yml` contains the sensitive data
## user_provisioning.yml
Configure users for provisioning and manual maintenance
```yaml
vault_atmen_password: <atmen_password>
vault_maintainer_user: <your_user>
vault_maintainer_password: <maintainer_password>
```
## vault.yml
Configure k3s secrets
```yaml
ansible_become_password: <atmen_password>
token: <k3s_token>
```
To avoid pasting your vault password everytime, you can create a `.vault_pass` file in the root directory with the vault password.