Mike Ashley 959e893862 Create webmail role that installs Roundcube | 8 jaren geleden | |
---|---|---|
.vagrant/provisioners/ansible/inventory/secret | 8 jaren geleden | |
group_vars | 8 jaren geleden | |
roles | 8 jaren geleden | |
.gitignore | 8 jaren geleden | |
.travis.yml | 8 jaren geleden | |
AUTHORS.md | 9 jaren geleden | |
CONTRIBUTING.md | 8 jaren geleden | |
LICENSE.md | 9 jaren geleden | |
README.md | 8 jaren geleden | |
Vagrantfile | 8 jaren geleden | |
hosts | 8 jaren geleden | |
requirements.txt | 8 jaren geleden | |
site.yml | 8 jaren geleden | |
test-requirements.txt | 8 jaren geleden | |
tests.py | 9 jaren geleden |
Sovereign is a set of Ansible playbooks that you can use to build and maintain your own personal cloud based entirely on open source software, so you’re in control.
If you’ve never used Ansible before, you might find these playbooks useful to learn from, since they show off a fair bit of what the tool can do.
The original author’s background and motivations might be of interest. tl;dr: frustrations with Google Apps and concerns about privacy and long-term support.
Sovereign offers useful cloud services while being reasonably secure and low-maintenance. Use it to set up your server, SSH in every couple weeks, but mostly forget about it.
What do you get if you point Sovereign at a server? All kinds of good stuff!
Don’t want one or more of the above services? Comment out the relevant role in site.yml
. Or get more granular and comment out the associated include:
directive in one of the playbooks.
You do not need to acquire an SSL certificate. The SSL certificates you need will be obtained from Let’s Encrypt automatically when you deploy your server.
apt-get install sudo
If you haven’t already, download and install Tarsnap, or use brew install tarsnap
if you use Homebrew.
Create a new machine key for your server:
tarsnap-keygen --keyfile roles/tarsnap/files/decrypted_tarsnap.key --user me@example.com --machine example.com
For goodness sake, change the root password:
passwd
Create a user account for Ansible to do its thing through:
useradd deploy
passwd deploy
mkdir /home/deploy
Authorize your ssh key if you want passwordless ssh login (optional):
mkdir /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
nano /home/deploy/.ssh/authorized_keys
chmod 400 /home/deploy/.ssh/authorized_keys
chown deploy:deploy /home/deploy -R
echo 'deploy ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/deploy
Your new account will be automatically set up for passwordless sudo
.
Modify the settings in group_vars/sovereign
to your liking. If you want to see how they’re used in context, just search for the corresponding string.
All of the variables in group_vars/sovereign
must be set for sovereign to function.
Setting password_hash
for your mail users is a bit tricky. You can generate one using doveadm-pw.
# doveadm pw -s SHA512-CRYPT
Enter new password: foo
Retype new password: foo
{SHA512-CRYPT}$6$drlIN9fx7Aj7/iLu$XvjeuQh5tlzNpNfs4NwxN7.HGRLglTKism0hxs2C1OvD02d3x8OBN9KQTueTr53nTJwVShtCYiW80SGXAjSyM0
Remove {SHA512-CRYPT}
and insert the rest as the password_hash
value.
Alternatively, if you don’t already have doveadm
installed, Python 3.3 or higher on Linux will generate the appropriate string for you (assuming your password is password
):
python3 -c 'import crypt; print(crypt.crypt("password", salt=crypt.METHOD_SHA512))'
On OS X and other platforms the passlib package may be used to generate the required string:
python -c 'import passlib.hash; print(passlib.hash.sha512_crypt.encrypt("password", rounds=5000))'
Same for the IRC password hash…
# znc --makepass
[ ** ] Type your new password.
[ ?? ] Enter Password: foo
[ ?? ] Confirm Password: foo
[ ** ] Kill ZNC process, if it's running.
[ ** ] Then replace password in the <User> section of your config with this:
<Pass password>
Method = sha256
Hash = 310c5f99825e80d5b1d663a0a993b8701255f16b2f6056f335ba6e3e720e57ed
Salt = YdlPM5yjBmc/;JO6cfL5
</Pass>
[ ** ] After that start ZNC again, and you should be able to login with the new password.
Take the strings after Hash =
and Salt =
and insert them as the value for irc_password_hash
and irc_password_salt
respectively.
Alternatively, if you don’t already have znc
installed, Python 3.3 or higher on Linux will generate the appropriate string for you (assuming your password is password
):
python3 -c 'import crypt; print("irc_password_salt: {}\nirc_password_hash: {}".format(*crypt.crypt("password", salt=crypt.METHOD_SHA256).split("$")[2:]))'
On OS X and other platforms the passlib:https://pythonhosted.org/passlib/ package may be used to generate the required string:
python -c 'import passlib.hash; print("irc_password_salt: {}\nirc_password_hash: {}".format(*passlib.hash.sha256_crypt.encrypt("password", rounds=5000).split("$")[2:]))'
For Git hosting, copy your public key into place:
cp ~/.ssh/id_rsa.pub roles/git/files/gitolite.pub
Finally, replace the host.example.net
in the file hosts
. If your SSH daemon listens on a non-standard port, add a colon and the port number after the IP address. In that case you also need to add your custom port to the task Set firewall rules for web traffic and SSH
in the file roles/common/tasks/ufw.yml
.
If you’ve just bought a new domain name, point it at Linode’s DNS Manager or similar. Most VPS services (and even some domain registrars) offer a managed DNS service that you can use for this at no charge. If you’re using an existing domain that’s already managed elsewhere, you can probably just modify a few records.
Create A
or CNAME
records which point to your server’s IP address:
example.com
mail.example.com
www.example.com
(for Web hosting)autoconfig.example.com
(for email client automatic configuration)read.example.com
(for Wallabag)news.example.com
(for Selfoss)cloud.example.com
(for ownCloud)git.example.com
(for cgit)First, make sure you’ve got Ansible 1.9.3+ installed.
To run the whole dang thing:
ansible-playbook -i ./hosts site.yml
To run just one or more piece, use tags. I try to tag all my includes for easy isolated development. For example, to focus in on your firewall setup:
ansible-playbook -i ./hosts --tags=ufw site.yml
You might find that it fails at one point or another. This is probably because something needs to be done manually, usually because there’s no good way of automating it. Fortunately, all the tasks are clearly named so you should be able to find out where it stopped. I’ve tried to add comments where manual intervention is necessary.
The dependencies
tag just installs dependencies, performing no other operations. The tasks associated with the dependencies
tag do not rely on the user-provided settings that live in group_vars/sovereign
. Running the playbook with the dependencies
tag is particularly convenient for working with Docker images.
Create an MX
record for example.com
which assigns mail.example.com
as the domain’s mail server.
To ensure your emails pass DKIM checks you need to add a txt
record. The name field will be default._domainkey.EXAMPLE.COM.
The value field contains the public key used by OpenDKIM. The exact value needed can be found in the file /etc/opendkim/keys/EXAMPLE.COM/default.txt
it’ll look something like this:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKKAQfMwKVx+oJripQI+Ag4uTwYnsXKjgBGtl7Tk6UMTUwhMqnitqbR/ZQEZjcNolTkNDtyKZY2Z6LqvM4KsrITpiMbkV1eX6GKczT8Lws5KXn+6BHCKULGdireTAUr3Id7mtjLrbi/E3248Pq0Zs39hkDxsDcve12WccjafJVwIDAQAB
For DMARC you’ll also need to add a txt
record. The name field should be _dmarc.EXAMPLE.COM
and the value should be v=DMARC1; p=none
. More info on DMARC can be found here
Set up SPF and reverse DNS as per this post. Make sure to validate that it’s all working, for example by sending an email to check-auth@verifier.port25.com and reviewing the report that will be emailed back to you.
Sign in to the ZNC web interface and set things up to your liking. It isn’t exposed through the firewall, so you must first set up an SSH tunnel:
ssh deploy@example.com -L 6643:localhost:6643
Then proceed to http://localhost:6643 in your web browser.
Similarly, to access the server monitoring page, use another SSH tunnel:
ssh deploy@example.com -L 2812:localhost:2812
Again proceeding to http://localhost:2812 in your web browser.
Finally, sign into ownCloud with a new administrator account to set it up. You should select PostgreSQL as the configuration backend. Use owncloud
as the database user and the database name. For the database password use the password you set for owncloud_db_password
in group_vars/sovereign
.
We’re collecting known-good client setups on our wiki.
If you run into an errors, please check the wiki page. If the problem you encountered, is not listed, please go ahead and create an issue. If you already have a bugfix and/or workaround, just put them in the issue and the wiki page.
You will need to manually enter the password for any encrypted volumes on reboot. This is not Sovereign-specific, but rather a function of how EncFS works. This will necessitate SSHing into your machine after reboot, or accessing it via a console interface if one is available to you. Once you’re in, run this:
encfs /encrypted /decrypted --public
It is possible that some daemons may need to be restarted after you enter your password for the encrypted volume(s). Some services may stall out while looking for resources that will only be available once the /decrypted
volume is available and visible to daemon user accounts.
Ask questions and provide feedback in #sovereign
on Freenode.