|
|
|
|
59
|
|
59
|
|
60
|
# Set up EncFS as per "these instructions":http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/.
|
60
|
# Set up EncFS as per "these instructions":http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/.
|
61
|
# Create a user account for Ansible to do its thing through. This account should be set up for passwordless sudo.
|
61
|
# Create a user account for Ansible to do its thing through. This account should be set up for passwordless sudo.
|
62
|
-# Put your Tarsnap key in `roles/common/files/root_tarsnap.key`.
|
|
|
63
|
-# Put your SSL certificate's components in the respective files that start with `wildcard_ca` in `roles/common/files`, and a combined version in `roles/ircbouncer/files/etc_ssl_znc-combined.pem`.
|
|
|
64
|
-# You should probably disable remote root login and password-based logins in `/etc/ssh/sshd_config` but that's up to you.
|
|
|
|
|
62
|
+# Put your Tarsnap key in @roles/common/files/root_tarsnap.key@.
|
|
|
63
|
+# Put your SSL certificate's components in the respective files that start with @wildcard_ca@ in @roles/common/files@, and a combined version in @roles/ircbouncer/files/etc_ssl_znc-combined.pem@.
|
|
|
64
|
+# You should probably disable remote root login and password-based logins in @/etc/ssh/sshd_config@ but that's up to you.
|
65
|
|
65
|
|
66
|
Now, the time-consuming part: grep through the files for the string `TODO` and replace as necessary. You'll probably want to check out all the files in the respective `vars/` sub-directories in each playbook directory.
|
66
|
Now, the time-consuming part: grep through the files for the string `TODO` and replace as necessary. You'll probably want to check out all the files in the respective `vars/` sub-directories in each playbook directory.
|
67
|
|
67
|
|
|
|
|
|
71
|
|
71
|
|
72
|
To run the whole dang thing:
|
72
|
To run the whole dang thing:
|
73
|
|
73
|
|
74
|
- ansible-playbook -i ./hosts site.yml
|
|
|
|
|
74
|
+bc. ansible-playbook -i ./hosts site.yml
|
75
|
|
75
|
|
76
|
To run just one or more piece, use tags. I try to tag all my includes for easy isolated development. For example, to focus in on your firewall setup:
|
76
|
To run just one or more piece, use tags. I try to tag all my includes for easy isolated development. For example, to focus in on your firewall setup:
|
77
|
|
77
|
|
78
|
- ansible-playbook -i ./hosts --tags=ferm site.yml
|
|
|
|
|
78
|
+bc. ansible-playbook -i ./hosts --tags=ferm site.yml
|
79
|
|
79
|
|
80
|
You might find that it fails at one point or another. This is probably because something needs to be done manually, usually because there's no good way of automating it. Fortunately, all the tasks are clearly named so you should be able to find out where it stopped. I've tried to add comments where manual intervention is necessary. OpenVPN in particular requires a bunch of manual command line stuff to get running.
|
80
|
You might find that it fails at one point or another. This is probably because something needs to be done manually, usually because there's no good way of automating it. Fortunately, all the tasks are clearly named so you should be able to find out where it stopped. I've tried to add comments where manual intervention is necessary. OpenVPN in particular requires a bunch of manual command line stuff to get running.
|
81
|
|
81
|
|