ansible-base/README.md

180 lines
5.4 KiB
Markdown
Raw Normal View History

2020-05-15 22:22:26 +02:00
# ansible-base
## Introduction
This document describes how to use ansible-base to deploy basic infrastructures.
2020-07-20 18:00:13 +02:00
The main parts of this document are:
2020-05-15 22:22:26 +02:00
* Ansible "server" (or local machine) preparation
* Nodes preparation
* Deployment
## Ansible "server" (or local machine) preparation
Update and install Ansible and GIT on your system.
2020-07-20 18:00:13 +02:00
Clone this repo (ssh pubkey needs to be authorized for this repo) and go into the cloned directory:
2020-05-15 22:22:26 +02:00
```bash
2020-05-15 22:26:48 +02:00
git clone https://git.grifon.fr/nemo/ansible-base.git
2020-05-15 22:22:26 +02:00
cd ansible-core
```
2020-07-20 18:00:13 +02:00
Download roles dependecies (currenty not used):
2020-05-15 22:22:26 +02:00
```ansible-galaxy install -r requirements.yml -p ./roles/```
2020-07-20 18:00:13 +02:00
Copy the template inventory folder and edit all subfiles to add your node(s) and other informations:
2020-05-15 22:22:26 +02:00
```bash
2020-07-20 18:00:13 +02:00
cp -R inventory_template inventory_yourInventoryName
2020-05-15 22:22:26 +02:00
```
2020-07-20 18:00:13 +02:00
> Note: you can create a dedicated private GIT repository to manage your inventory.
The main inventory file is: `inventory_yourInventoryName/inventory.yml`
Example with template values:
2020-05-15 22:22:26 +02:00
```bash
all:
vars:
ansible_user: ansible
ansible_become: yes
2020-07-11 20:46:38 +02:00
ansible_python_interpreter: auto_silent
2020-05-15 22:22:26 +02:00
children:
function:
children:
2020-07-24 21:03:14 +02:00
backup_server:
hosts:
mySecondGentooHost.example.org:
2020-07-11 20:46:38 +02:00
munin_server:
2020-08-08 16:34:10 +02:00
hosts:
myFirstGentooHost.example.org:
ldap_server:
2020-05-15 22:22:26 +02:00
hosts:
myFirstGentooHost.example.org:
...
...
os:
children:
os_gentoo:
hosts:
myFirstGentooHost.example.org:
mySecondGentooHost.anotherexample.org:
2020-07-11 20:46:38 +02:00
...
2020-05-15 22:22:26 +02:00
os_debian:
hosts:
myFirstDebianHost.example.org:
mySecondDebianHost.anotherexample.org:
...
2020-07-11 20:46:38 +02:00
os_centos:
hosts:
myFirstCentOSHost.example.org:
mySecondCentOSHost.anotherexample.org:
...
2020-05-15 22:22:26 +02:00
...
```
2020-07-20 18:00:13 +02:00
> Note: the node's name needs to be reachable, you can use IP address or FQDN (recommended).
2020-05-15 22:22:26 +02:00
2020-07-20 18:00:13 +02:00
Create a vault file for all nodes using the vault template file and define all values:
2020-05-15 22:22:26 +02:00
```bash
2020-07-21 18:36:43 +02:00
cp inventory_yourInventoryName/group_vars/all/vault.yml.template inventory_yourInventoryName/group_vars/all/vault.yml
vim inventory_yourInventoryName/group_vars/all/vault.yml
2020-05-15 22:22:26 +02:00
```
2020-07-20 18:00:13 +02:00
Encrypt the vault file and check if edit function works. A prompt will ask you a password:
2020-05-15 22:22:26 +02:00
```bash
2020-07-21 18:36:43 +02:00
ansible-vault encrypt inventory_yourInventoryName/group_vars/all/vault.yml
ansible-vault edit inventory_yourInventoryName/group_vars/all/vault.yml
2020-05-15 22:22:26 +02:00
```
2020-07-20 18:00:13 +02:00
> Note: if you version your code, don't forget to exclude this vault file of versionning (with .`gitignore file` if you are using GIT).
2020-05-15 22:22:26 +02:00
2020-07-21 18:36:43 +02:00
According to your needs, you can edit all variables in `inventory_yourInventoryName` directory and subdirectories.
2020-05-15 22:22:26 +02:00
2020-07-20 18:00:13 +02:00
You can also define host-specific variables (reboot/upgrade enable/disabe, cron hours, specific config, ...) in the `inventory_yourInventoryName/host_vars` directory (host.example.org is an example). Don't forget to update .gitignore if you don't want to publish some host vars.
2020-05-15 22:22:26 +02:00
## Nodes preparation
2020-07-20 18:00:13 +02:00
On the node, with the root account (or sudo):
2020-05-15 22:22:26 +02:00
* Install SSH, sudo and gentoolkit (if Gentoo) OR python-apt (if Debian) OR python-yum (if CentOS) ...
2020-07-11 20:46:38 +02:00
* Configure, enable and start SSH service.
2020-05-15 22:22:26 +02:00
* Configure the ansible user :
```bash
# Create an ansible user
useradd -m -s /bin/bash ansible
# Add sudoers rights to ansible user
echo "ansible ALL=(ALL:ALL) NOPASSWD: ALL
" > /etc/sudoers.d/ansible
# Check the sudo configuration
su - ansible
sudo -i # If OK, you're root here
exit
exit
# Add SSH public key of the account used on the Ansible server (or local machine) to the ansible user on the remote node to deploy
su - ansible
mkdir -p .ssh
vi .ssh/authorized_keys # Here add pubkey
```
2020-07-20 18:00:13 +02:00
> Note: this procedure can vary slightly if you're not using a Debian or CentOS node.
2020-05-15 22:22:26 +02:00
2020-07-20 18:00:13 +02:00
On the Ansible server (or local machine), check the SSH connection:
2020-05-15 22:22:26 +02:00
```bash
ssh ansible@<YOUR_MANAGED_NODE>
exit
```
## Deployment
2020-07-20 18:00:13 +02:00
From the Ansible server (or your local machine), you can deploy specific playbooks using the following command:
2020-05-15 22:22:26 +02:00
```bash
2020-07-20 18:00:13 +02:00
ansible-playbook -i inventory_yourInventoryName/inventory.yml <playbook_name> --ask-vault-pass
2020-05-15 22:22:26 +02:00
```
2020-07-20 18:00:13 +02:00
> Notes:
2020-05-15 22:22:26 +02:00
>
2020-07-11 20:46:38 +02:00
> * `--diff` option can be added to see the difference applied.
> * `--check` option can be added to test the deployment without really do any action on the remote node (in some cases it fails even if the deployment will go well).
> * `--limit` option can be added to select host to configure (ex: `--limit os_gentoo`)
2020-05-15 22:22:26 +02:00
2020-07-20 18:00:13 +02:00
Playbook deployment:
2020-05-15 22:22:26 +02:00
2020-07-24 21:03:14 +02:00
* `playbook_general_deploy.yml`
* `playbook_backup_deploy.yml`
* `playbook_munin_deploy.yml`
2020-08-08 16:34:10 +02:00
* `playbook_ldap_deploy.yml`
2020-05-15 22:22:26 +02:00
### playbook_general_deploy.yml
2020-07-20 18:00:13 +02:00
This playbook deploys general configuration: tools (useful packages), auto reboot, auto upgrade, sudo users, NTP client, iptables config and DNS resolvers.
2020-05-15 22:22:26 +02:00
### playbook_backup_deploy.yml
2020-07-24 21:03:14 +02:00
This playbook deploys a backup server with a dedicated user to save GIT repositories to backup (use Ansible vars to list them). Furthermore, it configures users for each server to backup and configure "client" servers to send backups through SSH (pubkey authent).
2020-07-24 21:03:14 +02:00
### playbook_munin_deploy.yml
2020-07-24 21:03:14 +02:00
This playbook deploys a Munin server and Munin "clients" using async to get information from "clients". He integrates HTTPS configuration and configuration generation with Ansible vars.
2020-05-15 22:22:26 +02:00
2020-08-08 16:34:10 +02:00
### playbook_ldap_deploy.yml
This playbook deploys and configures an OpenLDAP server.
2020-10-03 15:55:07 +02:00
### playbook_icinga2_deploy.yml
This playbook deploys and configures an Icinga2/MariaDB/Icingaweb2 server.