Project

General

Profile

README

DuckCorp Infrastructure

This is the root of the DuckCorp Admin Team materials used to install, configure and manage services.

DuckCorp is commited to Free Software, thus all materials are published under the GPL v3 License (see details of the license in the COPYING file).

Materials

All sensitive materials are encrypted, read the Dealing with Secrets chapter to know more about this.

Configuration Management & Deployment

We use Ansible to help us automate as much as possible; you'll find more about it in the ansible directory.

Still, many things are handled manually, this is WIP.

PKI

Our TLS certificates are managed using mkcert. The mkcert.conf file holds the DuckCorp-specific configuration, and services contains the specific service names not in /etc/services. The keys configuration and resulting certificates are stored in the pki directory.

With this layout, mkcert can be run in-place (at the top-level of this repository), automagically finding its configuration and work directories.

Scripts

In the scripts directory are the following scripts:

  • adm_check_*: this series of scripts check various resources hosted by DuckCorp against the outside world to see if there is any misconfiguration or if the hosting became obsolete (without the user telling us, which happen very often…)
  • adm_publish_tlsa: compute TLSA DNS RR for DNSSEC-enabled DNS zones based on the available TLS certificates
  • check_certs_expiration: warn when certificates are nearly expired (or already expired)

They are meant to be run in-place from the top of this repository. The lib subdirectory contains code factorized between the scripts.

Documentation

The admin-oriented documentation can be found alongside the other materials, but for some topics we might write a dedicated explanation and store it in the doc directory.

For Admin Team Members

Requirements

First, clone [the repository](ssh://vcs-git.duckcorp.org/srv/vcs/git/duckcorp/duckcorp-infra.git). You should probably have a look at the Requirements in the underlying directories too.

Git configuration

  • Always create a merge commit : $ git config --local merge.ff false
  • Allow fast-forward merges when using pull : $ git config --local pull.ff only
  • All commits must be GPG signed : $ git config --local commit.gpgSign true

Dealing with Secrets

We use Ansible Vault to hide some parameters like service credentials, user personal information or emails to avoid SPAM.

To make it easy git attributes are defined to make diff-ing and merging easy.

Your configuration needs to be enhanced to tel git how to handle these files. This is very easy, look at this URL for more info:

: https://github.com/building5/ansible-vault-tools

Because ansible-vault is called at the top level directory of the repository, this setup requires to define either ANSIBLE_VAULT_PASSWORD_FILE or ANSIBLE_CONFIG environment variable (otherwise ansible-vault would not know the path of the ansible vault password file).

Shell Helper

You might want to use this little bashrc snippet to simplify setting ANSIBLE_CONFIG correctly:

ansprep () {
    local git_topdir
    git_topdir=$(git rev-parse --show-toplevel 2>/dev/null)
    if [ $? -ne 0 ]; then
        echo "Not a git repository" >&2
        return 1
    fi

    local ansible_config
    ansible_config=$(find $git_topdir -name ansible.cfg)
    if [ $? -ne 0  -o -z "$ansible_config" ]; then
        echo "Not an Ansible project" >&2
        return 1
    fi

    export ANSIBLE_CONFIG=$ansible_config
    export ANSIBLE_FORCE_COLOR=true
}

Once in the git repository (anywhere inside) you can just run the ansprep command to setup everything. This way the ansible-vault-tools features will work wherever you are in the repository.

Ansible Vault Password

The Ansible Vault Password is encrypted with GPG in ansible/vault_pass.asc.

It is read by ansible/decrypt-vault-password.sh script which is automatically called by Ansible, being the Ansible Vault Password File.

When the list of admins (in admins_gpg_keys file) change this file needs to be updated (and the secret may also need to be changed):

admins_gpg_keys="$(cat admins_gpg_keys | awk 'match($0, "^(0x)?[0-9A-F]{40}\\>") { printf "%s ",$1 }')" # ignore comments if any
gpg --group duckcorp="${admins_gpg_keys}" --recipient duckcorp \
    --trust-model=always --no-encrypt-to --no-throw-keyids \
    --encrypt --armor ansible/vault_pass

Git usage

When merging a branch, use --verify-signatures switch. If this fails, then DO NOT MERGE!!!

When adding submodule, please use the HTTPs URL to allow contributors to clone. Also use --name to set the submodule name or the path is taken by default. Then, you can ask git to automatically rewrite the URL to the right form with this command:

git config --global url.ssh://vcs-git.duckcorp.org/srv/vcs/git/.insteadOf https://vcs-git.duckcorp.org/

For External Contributor

You're welcome to contribute ideas, report problems, send patches… using our Ticket Tracker (in the Contribution tracker).

You can clone this repository or browse it.

Statistics
| Branch: | Revision:
Name Size Revision Age Author Comment
  ansible 97a08878 7 days Marc Dequènes duckland: add extra VLAN for untrusted devices
  attic fc1357ef almost 4 years Marc Dequènes add attic to keep some old backup scripts as re...
  doc dc328c80 almost 2 years Pierre-Louis Bonicoli List TCP ports forwarded to Orthos
  pki 111a5be2 9 months Marc Dequènes monitoring: probes custom labels and internal_h...
  scripts 4da9d21a over 2 years Marc Dequènes adm_check_web: check CNAMEs until final RR
.gitattributes 49 Bytes 67bdda4a over 3 years Marc Dequènes Include the Ansible Vault Key The key is GPG-e...
.gitignore 265 Bytes 67bdda4a over 3 years Marc Dequènes Include the Ansible Vault Key The key is GPG-e...
.gitmodules 3.4 KB 15888fae about 1 year Marc Dequènes roles/prometheus: re-add as a submodule
COPYING 34.3 KB 5d76f2d8 over 6 years Marc Dequènes First public version
README.md 5.51 KB ae647f1f over 3 years Marc Dequènes doc: add a shell snippet to help with the vault...
admins_gpg_keys 146 Bytes 67bdda4a over 3 years Marc Dequènes Include the Ansible Vault Key The key is GPG-e...
checks_whitelist.yml 822 Bytes 00b10d21 almost 5 years Marc Dequènes adm_check_dns: implement partial whitelisting
mkcert.conf 154 Bytes 5d76f2d8 over 6 years Marc Dequènes First public version
services 347 Bytes e9b7d9a0 almost 6 years Marc Dequènes removed obsolete im_gateway service #2

Latest revisions

# Date Author Comment
97a08878 2024-03-22 05:35 Marc Dequènes

duckland: add extra VLAN for untrusted devices

aea4ebf9 2024-01-24 07:09 Marc Dequènes

duck: add mail alias

ea3ea468 2024-01-12 01:33 Marc Dequènes

Toushirou: fix IPv6 route

In ipv6 rules there is no lookup in the default table like in IPv4 for
some obscure reason. The multihoming script previously did add the
missing rule but now it's not used anymore. Switching back to using the
gateway keyword which is using the main table instead.

587a9159 2024-01-10 13:52 Marc Dequènes

monitoring: extend data retention to 3 years

0faa85aa 2024-01-10 08:49 Marc Dequènes

Toushirou: use IPv6 VRRP IP

40eeefa6 2024-01-10 07:46 Marc Dequènes

Toushirou: moved to Hivane housing

bfb0fca0 2024-01-10 03:41 Marc Dequènes

dns: update Toushirou's IPs

4cbd13f9 2023-12-28 07:31 Marc Dequènes

matrix: disbale bridge deployment

d0ba8e75 2023-12-15 02:41 Marc Dequènes

matrix: remove annoying session limit

48cee172 2023-11-29 04:45 Marc Dequènes

stuff.milkypond.org:: enable apc in the CLI

It is necessary for crontabs and also using the CLI tool.

View all revisions | View revisions

Also available in: Atom