|Thomas Buck e6bd74153d creating domain list for letsencrypt dynamically. some other small fixes.||4 days ago|
|filter_plugins||2 years ago|
|group_vars||2 years ago|
|roles||4 days ago|
|.gitignore||5 months ago|
|LICENSE.md||6 years ago|
|README.md||2 months ago|
|hosts||4 months ago|
|requirements.txt||2 years ago|
|site.yml||5 months ago|
Forked from Sovereign on GitHub.
You do not need to acquire an SSL certificate. The SSL certificates you need will be obtained from Let’s Encrypt automatically when you deploy your server.
The following steps are done on the remote server by
sshing into it and running these commands.
apt-get install sudo python
For goodness sake, change the root password:
Create a user account for Ansible to do its thing through:
useradd deploy passwd deploy mkdir /home/deploy
Authorize your ssh key if you want passwordless ssh login (optional):
mkdir /home/deploy/.ssh chmod 700 /home/deploy/.ssh nano /home/deploy/.ssh/authorized_keys chmod 400 /home/deploy/.ssh/authorized_keys chown deploy:deploy /home/deploy -R
Or, in short:
ssh-copy-id -i ~/.ssh/id_ecdsa deploy@hostname
Also, enable passwordless sudo for the deploy user:
echo 'deploy ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/deploy
Your new account will be automatically set up for passwordless
Or you can just add your
deploy user to the sudo group.
adduser deploy sudo
Ansible (the tool setting up your server) runs locally on your computer and sends commands to the remote server.
Download this repository somewhere on your machine, either through
Clone or Download > Download ZIP above,
git as below.
Also install the dependencies for password generation as well as ansible itself.
git clone https://github.com/xythobuz/sovereign.git cd sovereign sudo pip install -r ./requirements.txt
Or, if you’re on Arch, instead of using pip, install the required stuff manually:
sudo pacman -Syu ansible python-jmespath python-passlib
Modify the settings in the
group_vars/sovereign folder to your liking.
If you want to see how they’re used in context, just search for the corresponding string.
All of the variables in
group_vars/sovereign must be set for sovereign to function.
Finally, replace the
host.example.net in the file
If your SSH daemon listens on a non-standard port, add a colon and the port number after the IP address.
In that case you also need to add your custom port to the task
Set firewall rules for web traffic and SSH in the file
If you’ve just bought a new domain name, point it at Linode’s DNS Manager or similar. Most VPS services (and even some domain registrars) offer a managed DNS service that you can use for this at no charge. If you’re using an existing domain that’s already managed elsewhere, you can probably just modify a few records.
CNAME records which point to your server’s IP address:
www.example.com(for Web hosting)
autoconfig.example.com(for email client automatic configuration)
stats.example.com(for web stats)
First, make sure you’ve got Ansible installed. This should already be done by running the pip requirements.txt from above.
To run the whole dang thing:
ansible-playbook -i ./hosts --ask-sudo-pass site.yml
If you chose to make a passwordless sudo deploy user, you can omit the
MX record for
example.com which assigns
mail.example.com as the domain’s mail server.
To ensure your emails pass DKIM checks you need to add a
The name field will be
The value field contains the public key used by DKIM.
The exact value needed can be found in the file
For DMARC you’ll also need to add a
The name field should be
_dmarc.EXAMPLE.COM and the value should be
We will also add a
txt record for SPF. This is now legacy, but some providers need it, so we provide an empty policy.
For my DNS provider, that zonefile looks like this:
@ IN MX 10 mail @ IN TXT "v=spf1 a:mail.example.com ?all" _dmarc IN TXT "v=DMARC1; p=reject;" mail._domainkey IN TXT "v=DKIM1; k=rsa; p=INSERT_PUBLIC_KEY_HERE"
Correctly set up reverse DNS for your server and make sure to validate that it’s all working, for example by sending an email to email@example.com and reviewing the report that will be emailed back to you.
Sign in to the ZNC web interface and set things up to your liking. It isn’t exposed through the firewall, so you must first set up an SSH tunnel:
ssh firstname.lastname@example.org -L 6643:localhost:6643
Then proceed to http://localhost:6643 in your web browser. The same goes for the RSpamD web interface on port 11334.
To access the gitea admin CLI, execute it like this:
sudo -u git /usr/local/bin/gitea admin create-user --admin --config /etc/gitea/app.ini --name USERNAME --password PASSWORD --email MAIL
To re-new the LetsEncrypt certificates, for example after adding a new role that needs another subdomain, call:
sudo certbot delete -c /etc/letsencrypt/cli.conf --cert-name DOMAIN
Then re-run the whole sovereign playbook, or at least the letsencrypt part of it.