Doku aktualisiert (#27)
Bessere erklärung passwörter doku Doku zusammengefasst Housekeeping Co-authored-by: Michael Grote <38253905+quotengrote@users.noreply.github.com> Reviewed-on: mg/ansible#27 Co-Authored-By: mg <michael.grote@posteo.de> Co-Committed-By: mg <michael.grote@posteo.de>
This commit is contained in:
parent
640bc6d71c
commit
06a76ef006
6 changed files with 49 additions and 237 deletions
49
README.md
49
README.md
|
|
@ -1 +1,50 @@
|
|||
# ansible_heimserver
|
||||
|
||||
## example-cli
|
||||
ansible-playbook playbooks/base/0_master.yml -i inventory --limit jenkins-test.grote.lan --key-file id_rsa_ansible_user --vault-pass-file vault-pass.yml
|
||||
|
||||
|
||||
## install necessary collections
|
||||
`ansible-galaxy collection install -r requirements.yml`
|
||||
|
||||
## list installed collections
|
||||
`ansible-galaxy collection list -vvv`
|
||||
|
||||
## fix ansible vault-permissions
|
||||
```
|
||||
sudo chmod 400 id_rsa_ansible_user
|
||||
sudo chmod 400 vault-pass.yml
|
||||
```
|
||||
|
||||
## vault + KeePass LookUp-Plugin
|
||||
|
||||
### Einrichtung
|
||||
Das Plugin wird bei einer Installation mit dem Playbook "ansible" mit eingerichtet.
|
||||
|
||||
Die "Secrets" liegen in der KeepassDB die mit dem Kennwort aus "vault-pass.yml" verschlüsselt ist.
|
||||
"vault-pass.yml" steht mit in der .gitignore
|
||||
Die Variable "vault_password_file" ist mit " ~/ansible/vault-pass.yml" in der ansible.cfg gesetzt.
|
||||
Diese Datei enthält das Passwort mit dem die KeePassDb verschlüsselt ist.
|
||||
Das vault-secret für die GroupVars wird mit `ansible-vault encrypt_string <password>` erstellt.
|
||||
|
||||
### Erklärung
|
||||
keepass_dbx: "./keepass_db.kdbx"
|
||||
keepass_psw: !vault |
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
62383737XXXXXX531
|
||||
1. mit vault-pass.yml wird das Kennwort an ansible-vault übergeben
|
||||
2. ansible-vault entschlüsselt hiermit die variable "keepass_psw"
|
||||
3. der Inhalt der Variable wird dann an das KeePass-Lookup-Plugin übergeben was damit die KeePass-Datei öffnet
|
||||
|
||||
|
||||
|
||||
### Abfrage der Secrets in tasks/playbooks
|
||||
`restic_repository_password: "{{ lookup('keepass', 'restic_repository_password', 'password') }}"`
|
||||
|
||||
#### Erklärung
|
||||
```
|
||||
restic_repository_password: <-- Ansible Variablen Name
|
||||
lookup('keepass' <-- Aufruf Keepass-Lookup-Plugin
|
||||
restic_repository_password <-- Titel Eintrag mit Secret
|
||||
password <-- Feldbzeichner in KeepassDB
|
||||
```
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
ansible-playbook playbooks/base/0_master.yml -i inventory --limit jenkins-test.grote.lan --key-file id_rsa_ansible_user --vault-pass-file vault-pass.yml
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#!/bin/bash
|
||||
sudo chmod 400 /home/mg/ansible/id_rsa_ansible_user
|
||||
sudo chmod 400 /home/mg/ansible/vault-pass.yml
|
||||
# Datei muss Zeilenende LF haben
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
#!/bin/bash
|
||||
ansible-galaxy collection list -vvv
|
||||
# Datei muss Zeilenende LF haben
|
||||
|
|
@ -1,207 +0,0 @@
|
|||
path = /media/share
|
||||
writeable = yes
|
||||
browseable = yes
|
||||
public = yes
|
||||
create mask = 0644
|
||||
directory mask = 0755
|
||||
force user = shareuser
|
||||
fuer alle
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- name: Erstelle SAMBA-Shares
|
||||
template:
|
||||
src: smb.conf
|
||||
dest: /etc/samba/smb.conf
|
||||
validate: 'testparm -s %s'
|
||||
notify: smbd neustarten
|
||||
|
||||
|
||||
|
||||
- name: Testing Iteration
|
||||
copy:
|
||||
dest: /etc/samba/smb.conf
|
||||
content: |
|
||||
{% for freigaben in [freigaben] %}
|
||||
[{{ item.freigabename }}]
|
||||
read only = no
|
||||
browseable = yes
|
||||
public = yes
|
||||
writable = yes
|
||||
available = yes
|
||||
valid users {{ item.erlaubte_user }}
|
||||
path = /shares/{{ item.ordnername }}
|
||||
|
||||
{% endfor %}
|
||||
|
||||
|
||||
|
||||
(% for freigaben in {{ freigaben }} %)
|
||||
|
||||
{{ item.freigabename }}
|
||||
read only = no
|
||||
|
||||
(% endfor %)
|
||||
|
||||
|
||||
valid users {{ item.erlaubte_user }}
|
||||
|
||||
|
||||
[mg]
|
||||
path = /srv/7050c4a3-98ad-41bd-804d-a85c94b16468/mg
|
||||
hide special files = Yes
|
||||
create mask = 0664
|
||||
directory mask = 0775
|
||||
force create mode = 0664
|
||||
force directory mode = 0775
|
||||
inherit acls = Yes
|
||||
read only = No
|
||||
valid users = michaelgrote win10
|
||||
write list = michaelgrote win10
|
||||
vfs objects = recycle
|
||||
recycle:maxsize = 0
|
||||
recycle:exclude_dir =
|
||||
recycle:exclude =
|
||||
recycle:subdir_mode = 0700
|
||||
recycle:directory_mode = 0777
|
||||
recycle:touch = yes
|
||||
recycle:versions = yes
|
||||
recycle:keeptree = yes
|
||||
recycle:repository = .recycle/%U
|
||||
|
||||
|
||||
|
||||
[aptcacherng]
|
||||
path = /srv/7050c4a3-98ad-41bd-804d-a85c94b16468/aptcacherng
|
||||
hide special files = Yes
|
||||
create mask = 0664
|
||||
directory mask = 0775
|
||||
force create mode = 0664
|
||||
force directory mode = 0775
|
||||
inherit permissions = Yes
|
||||
read only = No
|
||||
|
||||
|
||||
|
||||
|
||||
[Backup]
|
||||
path = /srv/7050c4a3-98ad-41bd-804d-a85c94b16468/Backup
|
||||
hide special files = Yes
|
||||
create mask = 0664
|
||||
directory mask = 0775
|
||||
force create mode = 0664
|
||||
force directory mode = 0775
|
||||
inherit acls = Yes
|
||||
read only = No
|
||||
valid users = annemariedroessler michaelgrote restic toolserver win10
|
||||
write list = annemariedroessler michaelgrote restic toolserver win10
|
||||
vfs objects = recycle
|
||||
recycle:maxsize = 0
|
||||
recycle:exclude_dir =
|
||||
recycle:exclude =
|
||||
recycle:subdir_mode = 0700
|
||||
recycle:directory_mode = 0777
|
||||
recycle:touch = yes
|
||||
recycle:versions = yes
|
||||
recycle:keeptree = yes
|
||||
recycle:repository = .recycle/%U
|
||||
|
||||
|
||||
[amd]
|
||||
path = /srv/7050c4a3-98ad-41bd-804d-a85c94b16468/amd
|
||||
hide special files = Yes
|
||||
create mask = 0664
|
||||
directory mask = 0775
|
||||
force create mode = 0664
|
||||
force directory mode = 0775
|
||||
inherit acls = Yes
|
||||
read list = michaelgrote win10
|
||||
read only = No
|
||||
valid users = michaelgrote annemariedroessler win10
|
||||
write list = annemariedroessler
|
||||
vfs objects = recycle
|
||||
recycle:maxsize = 0
|
||||
recycle:exclude_dir =
|
||||
recycle:exclude =
|
||||
recycle:subdir_mode = 0700
|
||||
recycle:directory_mode = 0777
|
||||
recycle:touch = yes
|
||||
recycle:versions = yes
|
||||
recycle:keeptree = yes
|
||||
recycle:repository = .recycle/%U
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
server string = %h server
|
||||
log file = /var/log/samba/log.%m
|
||||
logging = syslog
|
||||
max log size = 1000
|
||||
panic action = /usr/share/samba/panic-action %d
|
||||
disable spoolss = Yes
|
||||
load printers = No
|
||||
printcap name = /dev/null
|
||||
map to guest = Bad User
|
||||
pam password change = Yes
|
||||
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
|
||||
passwd program = /usr/bin/passwd %u
|
||||
socket options = TCP_NODELAY IPTOS_LOWDELAY
|
||||
dns proxy = No
|
||||
idmap config * : backend = tdb
|
||||
printing = bsd
|
||||
acl allow execute always = Yes
|
||||
create mask = 0777
|
||||
directory mask = 0777
|
||||
aio read size = 16384
|
||||
aio write size = 16384
|
||||
allocation roundup size = 4096
|
||||
use sendfile = Yes
|
||||
|
||||
|
||||
|
||||
|
||||
Variable precedence
|
||||
docs
|
||||
|
||||
From 2.0 on, from lowest priority to highest - in other words, if a variable is defined in two places, the place that’s farther down in this list takes precedence.
|
||||
|
||||
role defaults [1]
|
||||
inventory file or script group vars [2]
|
||||
inventory group_vars/all [3]
|
||||
playbook group_vars/all [3]
|
||||
inventory group_vars/* [3]
|
||||
playbook group_vars/* [3]
|
||||
inventory file or script host vars [2]
|
||||
inventory host_vars/*
|
||||
playbook host_vars/*
|
||||
host facts / cached set_facts [4]
|
||||
inventory host_vars/* [3]
|
||||
playbook host_vars/* [3]
|
||||
host facts
|
||||
play vars
|
||||
play vars_prompt
|
||||
play vars_files
|
||||
role vars (defined in role/vars/main.yml)
|
||||
block vars (only for tasks in block)
|
||||
task vars (only for the task)
|
||||
include_vars
|
||||
set_facts / registered vars
|
||||
role (and include_role) params
|
||||
include params
|
||||
extra vars (defined on command line with -e, always win precedence)
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# Ansible Vault + KeePass LookUp-Plugin
|
||||
|
||||
# Einrichtung
|
||||
Das Plugin wird bei einer Installation mit dem Playbook "ansible" mit eingerichtet.
|
||||
|
||||
Die "Secrets" liegen in der KeepassDB die mit dem Kennwort aus "vault-pass.yml" verschlüsselt ist.
|
||||
"vault-pass.yml" steht mit in der .gitignore
|
||||
Die Variable "vault_password_file" ist mit " ~/ansible/vault-pass.yml" in der ansible.cfg gesetzt.
|
||||
Diese Datei enthält das Passwort mit dem die KeePassDb verschlüsselt ist.
|
||||
Das vault-secret für die GroupVars wird mit `ansible-vault encrypt_string <password>` erstellt.
|
||||
|
||||
|
||||
# Abfrage der Secrets in tasks/playbooks
|
||||
`restic_repository_password: "{{ lookup('keepass', 'restic_repository_password', 'password') }}"`
|
||||
|
||||
## Erklärung
|
||||
```
|
||||
restic_repository_password: <-- Ansible Variablen Name
|
||||
lookup('keepass' <-- Aufruf Keepass-Lookup-Plugin
|
||||
restic_repository_password <-- Titel Eintrag mit Secret
|
||||
password <-- Feldbzeichner in KeepassDB
|
||||
```
|
||||
Loading…
Reference in a new issue