├── .gitignore ├── LICENSE ├── README.md ├── debops-bootstrap ├── README.rst ├── Vagrantfile └── bootstrap-debops.yml ├── devlab ├── .debops.cfg ├── README.rst └── ansible │ └── inventory │ ├── group_vars │ ├── all │ │ ├── ansible.yml │ │ ├── inventory.yml │ │ ├── sshd.yml │ │ └── users.yml │ └── devlab │ │ └── apt.yml │ ├── host_vars │ ├── helios │ │ ├── apt.yml │ │ ├── dnsmasq.yml │ │ ├── kvm.yml │ │ ├── postfix.yml │ │ └── subnetwork.yml │ ├── jupiter │ │ └── lxc.yml │ └── saturn │ │ └── lxc.yml │ └── hosts ├── lib └── vagrant │ └── src │ ├── .gitignore │ └── public │ └── .gitignore ├── scripts ├── gpg_add_key_to_keyring.sh ├── gpg_generate_key.sh ├── install_ansible_debops_controller.sh ├── provisioning.sh └── provisioning_ldap.sh ├── testing-roles-rolespec-vagrant ├── .rolespec.cfg ├── README.rst ├── Vagrantfile ├── debops-support.sh └── vagrant-support.sh ├── vagrant-ansible-single-machine ├── .debops.cfg ├── .gitignore ├── README.rst ├── Vagrantfile ├── ansible │ └── inventory │ │ ├── group_vars │ │ ├── all.yml │ │ ├── firstGroup.yml │ │ └── secondGroup.yml │ │ └── host_vars │ │ └── web.yml └── site.yml ├── vagrant-docker ├── .debops.cfg ├── .gitignore ├── Dockerfile ├── README.rst ├── Vagrantfile ├── ansible │ └── inventory │ │ ├── group_vars │ │ ├── all.yml │ │ ├── firstGroup.yml │ │ └── secondGroup.yml │ │ ├── groups │ │ └── host_vars │ │ └── web.yml └── simpletest.yml ├── vagrant-multi-machine ├── .debops.cfg ├── .gitignore ├── README.rst ├── Vagrantfile ├── ansible │ └── inventory │ │ ├── group_vars │ │ ├── all.yml │ │ ├── firstGroup.yml │ │ └── secondGroup.yml │ │ ├── groups │ │ └── host_vars │ │ └── web.yml └── simpletest.yml └── webhost-gitusers-dokuwiki ├── .debops.cfg ├── .gitignore ├── README.rst ├── Vagrantfile ├── ansible └── inventory │ ├── groups │ └── host_vars │ └── web.yml ├── setup-dokuwiki-on-gituser └── test.yml /.gitignore: -------------------------------------------------------------------------------- 1 | ansible/secret 2 | secret 3 | ansible.cfg 4 | .vagrant 5 | roles 6 | 7 | *.py[co] 8 | 9 | ### vim ### 10 | [._]*.s[a-w][a-z] 11 | [._]s[a-w][a-z] 12 | *.un~ 13 | Session.vim 14 | .netrwhist 15 | *~ 16 | 17 | 18 | ### Emacs ### 19 | # -*- mode: gitignore; -*- 20 | \#*\# 21 | /.emacs.desktop 22 | /.emacs.desktop.lock 23 | *.elc 24 | auto-save-list 25 | tramp 26 | .\#* 27 | 28 | 29 | ### SublimeText ### 30 | # workspace files are user-specific 31 | *.sublime-workspace 32 | 33 | # project files should be checked into the repository, unless a significant 34 | # proportion of contributors will probably not be using SublimeText 35 | # *.sublime-project 36 | 37 | #sftp configuration file 38 | sftp-config.json 39 | 40 | ### JetBrains IDE ### 41 | .idea 42 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2014 DebOps 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## DebOps Examples 2 | 3 | This is a repository of example [DebOps](http://debops.org/) projects - mostly 4 | Ansible inventories and some additional Bash scripts, when user needs to 5 | perform actions outside Ansible. 6 | 7 | Further documentation will be added at a later time. 8 | 9 | ### Basic examples 10 | 11 | * `vagrant-multi-machine`: Using Debops with a multi-machine 12 | Vagrantfile 13 | * `webhost-gitusers-dokuwiki`: Setting up a Webserver with nginx, 14 | docuwiki and gituser. 15 | * `testing-roles-rolespec-vagrant`: Setting up a virtual machine 16 | (using Vagrant) for testing roles using 17 | [rolespec](https://github.com/nickjj/rolespec) 18 | 19 | 20 | ### Advanced examples 21 | 22 | * `debops-bootstrap`: Bootstrap a DebOps virtual machine with Vagrant 23 | and run `debops` against it. 24 | * `devlab`: manage a "development lab" on an Ubuntu/Xubuntu host with 25 | KVM virtual machines guests, which also are LXC hosts for 26 | containers. 27 | 28 | ### Other examples 29 | 30 | * `vagrant-ansible-single-machine`: Using Ansible (but not debops) 31 | with a single Vagrant box. 32 | 33 | -------------------------------------------------------------------------------- /debops-bootstrap/README.rst: -------------------------------------------------------------------------------- 1 | 2 | ================================================ 3 | Bootstrap and run DebOps on a single Vagrant box 4 | ================================================ 5 | 6 | This project is an example for using the Vagrant Ansible provisioner 7 | bootstraping a DebOps master server and then running ``debops`` on 8 | itself. 9 | 10 | 11 | Requirements 12 | ============ 13 | 14 | * Ansible 15 | * Vagrant 1.8 or newer 16 | 17 | 18 | Quick Start 19 | =========== 20 | 21 | * Fire up Vagrant: ``vagrant up`` 22 | 23 | This will create a virtual machine ``master`` and run a playbook 24 | which will build and install Ansible, install DebOps, upload 25 | the inventory generated from the ``Vagrantfile`` and eventually 26 | run ``debops``. 27 | 28 | 29 | How it works 30 | ============ 31 | 32 | Vagrant will first download the ansible-debops_ role which is later 33 | used to install DebOps in the virtual machine. Then it will spin up 34 | a Debian box and runs the Ansible provisioner with the provided 35 | bootstrap-debops.yml_ playbook. The Ansible inventory and variable 36 | definitions are set in the ``Vagrantfile`` and forwarded to the 37 | provisioner. After DebOps is installed the generated inventory file 38 | is uploaded to the virtual machine and used as input to ``debops`` itself. 39 | 40 | .. _ansible-debops: https://github.com/debops/ansible-debops 41 | .. _bootstrap-debops.yml: https://github.com/debops/examples/blob/master/bootstrap-debops/bootstrap-debops.yml 42 | 43 | 44 | Adopting to your needs 45 | ====================== 46 | 47 | In short: 48 | 49 | - Add the host to any DebOps hostgroup you like to run additional 50 | roles 51 | - Set any role variable in the ``Vagrantfile`` to adjust the DebOps 52 | configuration (follow the ``dhparam_bits`` example) 53 | - If you want to configure and run ``debops`` interactively set 54 | ``vagrant_upload_inventory`` and ``vagrant_run_debops`` in the 55 | ``Vagrantfile`` to ``False``. 56 | 57 | 58 | .. 59 | Local Variables: 60 | mode: rst 61 | ispell-local-dictionary: "american" 62 | End: 63 | -------------------------------------------------------------------------------- /debops-bootstrap/Vagrantfile: -------------------------------------------------------------------------------- 1 | # -*- mode: ruby -*- 2 | # vim: ft=ruby 3 | 4 | 5 | # ---- Configuration variables ---- 6 | 7 | GUI = false # Enable/Disable GUI 8 | RAM = 128 # Default memory size in MB 9 | 10 | # Network configuration 11 | DOMAIN = ".nat.example.com" 12 | NETWORK = "192.168.50." 13 | NETMASK = "255.255.255.0" 14 | 15 | # Default Virtualbox .box 16 | # See: https://wiki.debian.org/Teams/Cloud/VagrantBaseBoxes 17 | BOX = 'debian/jessie64' 18 | 19 | # Ansible configuration 20 | ANSIBLE_PLAYBOOK = "bootstrap-debops.yml" 21 | 22 | 23 | # ---- Custom commands run on the main host ---- 24 | 25 | # Clone ansible-bootstrap repository 26 | system(" 27 | if [ #{ARGV[0]} = 'up' ]; then 28 | test -d roles || mkdir -p roles 29 | if [ ! -d roles/ansible-debops ]; then 30 | echo 'Cloning ansible-debops role' 31 | git clone https://github.com/debops/ansible-debops roles/ansible-debops 32 | else 33 | echo 'Updating ansible-debops role' 34 | cd roles/ansible-debops && git pull ; cd - >/dev/null 35 | fi 36 | fi 37 | ") 38 | 39 | 40 | # ---- Vagrant configuration ---- 41 | 42 | Vagrant.configure(2) do |config| 43 | 44 | config.vm.box = BOX 45 | config.vm.guest = :debian 46 | 47 | config.vm.provider "virtualbox" do |vbox| 48 | vbox.gui = GUI 49 | vbox.memory = RAM 50 | end 51 | 52 | config.vm.define :master do |master| 53 | master.vm.hostname = 'master' + DOMAIN 54 | master.vm.network :private_network, ip: NETWORK + "10", netmask: NETMASK 55 | 56 | config.vm.provision "ansible" do |ansible| 57 | ansible.host_key_checking = "false" 58 | ansible.playbook = ANSIBLE_PLAYBOOK 59 | ansible.groups = { 60 | "debops_master" => ["master"], 61 | "debops_master:vars" => { 62 | "vagrant_upload_inventory" => "True", 63 | "vagrant_run_debops" => "True", 64 | "debops_ansible_packages" => "[]", 65 | "debops_install_systemwide" => "False", 66 | "debops_update_method" => "sync", 67 | "debops_project_name" => "debops-project" 68 | }, 69 | "debops_all_hosts" => ["master"], 70 | "debops_all_hosts:vars" => { 71 | "dhparam_bits" => "[ '1024' ]", 72 | }, 73 | } 74 | end 75 | end 76 | end 77 | -------------------------------------------------------------------------------- /debops-bootstrap/bootstrap-debops.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | - hosts: debops_master 4 | become: True 5 | become_user: root 6 | 7 | pre_tasks: 8 | 9 | - name: Download bootstrap-ansible.sh script 10 | get_url: 11 | url: 'https://raw.githubusercontent.com/debops/debops/master/misc/scripts/bootstrap-ansible.sh' 12 | dest: '/usr/local/sbin' 13 | mode: '0755' 14 | 15 | - name: Build Ansible Debian package 16 | command: '/usr/local/sbin/bootstrap-ansible.sh' 17 | args: 18 | creates: /usr/bin/ansible 19 | 20 | roles: 21 | 22 | - role: ansible-debops 23 | 24 | tasks: 25 | 26 | - name: Upload SSH private key 27 | copy: 28 | src: '{{ ansible_ssh_private_key_file }}' 29 | dest: '/home/vagrant/.ssh/id_rsa' 30 | owner: 'vagrant' 31 | group: 'vagrant' 32 | mode: '0600' 33 | 34 | - name: Disable strict SSH host key check 35 | ini_file: 36 | dest: '{{ debops_project_name }}/.debops.cfg' 37 | section: 'ansible defaults' 38 | option: 'host_key_checking' 39 | value: 'False' 40 | 41 | - name: Upload Ansible inventory 42 | copy: 43 | src: '.vagrant/provisioners/ansible/inventory/vagrant_ansible_inventory' 44 | dest: '{{ debops_project_name }}/ansible/inventory/hosts' 45 | owner: 'vagrant' 46 | group: 'vagrant' 47 | when: vagrant_upload_inventory|d() 48 | 49 | - name: Cleanup inventory definitions 50 | lineinfile: 51 | dest: '{{ debops_project_name }}/ansible/inventory/hosts' 52 | regexp: '.*ansible_ssh_private_key_file.*' 53 | state: absent 54 | when: vagrant_upload_inventory|d() 55 | 56 | - name: Run DebOps 57 | become: False 58 | command: debops 59 | args: 60 | chdir: '{{ debops_project_name }}' 61 | when: vagrant_run_debops|d() 62 | -------------------------------------------------------------------------------- /devlab/.debops.cfg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/debops/examples/132fcd70aa03c2638f96c0c16e3dc8beed79f00d/devlab/.debops.cfg -------------------------------------------------------------------------------- /devlab/README.rst: -------------------------------------------------------------------------------- 1 | DebOps Devlab 2 | ============= 3 | 4 | This is an example inventory to manage a "development lab" on an Ubuntu/Xubuntu 5 | host with KVM virtual machines as guests, which also are LXC hosts for 6 | containers. This setup is used by `drybjed`_ for development and work. 7 | 8 | .. _drybjed: https://github.com/drybjed/ 9 | 10 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/group_vars/all/ansible.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Use stable Ansible version everywhere 4 | role_ansible_version: 'v1.7.2' 5 | 6 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/group_vars/all/inventory.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Internal networks, IP addresses point to router on helios 4 | inventory_net: 5 | 6 | # IPv4 network behind NAT 7 | ipv4: '192.168.144.1/24' 8 | 9 | # IPv6 network 10 | ipv6: 11 | 12 | # Your own prefix 13 | - '2001:db8:1234:5678::1/64' 14 | 15 | # ULA prefix (get one on http://unique-local-ipv6.com/) 16 | #- '{{ "2001:db8:12:34::/48" | ipsubnet(64, 57008) | ipaddr("1") }}' 17 | 18 | # Automatically created 6to4 prefix on host with public IPv4 address 19 | #- '{{ ansible_default_ipv4.address | ipaddr("6to4") | ipsubnet(64, 57008) | ipaddr("1") }}' 20 | 21 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/group_vars/all/sshd.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Allow access from internal networks on all hosts, this is needed if you use 4 | # dual-stack IPv4/IPv6 network in which case ssh connections might jump from 5 | # one IP address space to another 6 | sshd_allow: '{{ ([ inventory_net.ipv4 ] | ipaddr("subnet")) + (inventory_net.ipv6 | ipaddr("subnet")) }}' 7 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/group_vars/all/users.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Set default shell to /bin/zsh 4 | users_default_shell: '/bin/zsh' 5 | 6 | # Install dotfiles everywhere 7 | users_default_dotfiles: True 8 | 9 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/group_vars/devlab/apt.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Specify host with APT local repository and APT cache 4 | apt: 'selena.{{ ansible_domain }}' 5 | 6 | # Add custom APT mirrors to have more reliable APT sources 7 | apt_mirrors: [ 'http://ftp.us.debian.org/debian' ] 8 | 9 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/helios/apt.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Install additional packages on workstation 4 | apt_host_packages: 5 | 6 | - isync 7 | - mutt 8 | - mutt-patched 9 | - msmtp 10 | - urlscan 11 | - feh 12 | - pass 13 | 14 | - uptimed 15 | - gnome-terminal 16 | - newsbeuter 17 | - fonts-inconsolata 18 | 19 | - smtube 20 | - vlc 21 | 22 | - weechat-curses 23 | - elinks 24 | - virt-manager 25 | 26 | - nmap 27 | - bind9-host 28 | - mtr-tiny 29 | - whois 30 | - telnet 31 | 32 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/helios/dnsmasq.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Enable public DNS to have internal domain resolvable from outside 4 | dnsmasq_public_dns: True 5 | 6 | # Create some CNAMEs in DNS 7 | dnsmasq_cname: 8 | 9 | 'selena': [ 'destroy.selena', 'apt' ] 10 | 11 | 'cassini': [ 'code', 'mysql', 'ipam', 'owncloud' ] 12 | 13 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/helios/kvm.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # On Ubuntu/Xubuntu, KVM group is named differently 4 | kvm_group: 'libvirtd' 5 | 6 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/helios/postfix.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Enable local mail on workstation and accept incoming mail from internal network 4 | 5 | postfix: [ 'local', 'network', 'mx' ] 6 | 7 | postfix_mynetworks: '{{ ([ inventory_net.ipv4 ] | ipaddr("subnet")) + (inventory_net.ipv6 | ipaddr("subnet")) }}' 8 | 9 | postfix_allow_smtp: '{{ ([ inventory_net.ipv4 ] | ipaddr("subnet")) + (inventory_net.ipv6 | ipaddr("subnet")) }}' 10 | 11 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/helios/subnetwork.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Configure internal network for KVM guests and LXC containers 4 | subnetwork_ipv4: '{{ inventory_net.ipv4 }}' 5 | 6 | subnetwork_ipv6: '{{ inventory_net.ipv6 }}' 7 | 8 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/jupiter/lxc.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Create LXC containers 4 | lxc_containers: 5 | 6 | - name: 'galileo' 7 | state: 'started' 8 | 9 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/host_vars/saturn/lxc.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # Create LXC containers 4 | lxc_containers: 5 | 6 | - name: 'cassini' 7 | state: 'started' 8 | 9 | -------------------------------------------------------------------------------- /devlab/ansible/inventory/hosts: -------------------------------------------------------------------------------- 1 | # Example inventory for DebOps development lab 2 | 3 | # ---- Ansible Controllers ---- 4 | [workstation] 5 | 6 | # Primary KVM host 7 | helios ansible_connection=local 8 | 9 | 10 | # ---- DebOps Development Lab ---- 11 | [devlab] 12 | 13 | # Local APT repository, APT cache and preseeding server 14 | selena 15 | 16 | # LXC hosts 17 | jupiter 18 | saturn 19 | 20 | # LXC containers 21 | galileo 22 | cassini 23 | 24 | 25 | # ---- IPv6 networking ---- 26 | 27 | # Enable access to IPv6 network using 6to4 tunnel 28 | [debops_6to4] 29 | helios 30 | 31 | 32 | # ---- Development Lab infrastructure ---- 33 | 34 | # Configure internal network for KVM guests and LXC containers 35 | [debops_subnetwork] 36 | helios 37 | 38 | # Configure DNS. DHCP, TFTP for internal network 39 | [debops_dnsmasq] 40 | helios 41 | 42 | # Configure KVM on main host 43 | [debops_kvm] 44 | helios 45 | 46 | # Configure LXC containers on KVM guests 47 | [debops_lxc] 48 | jupiter 49 | saturn 50 | 51 | -------------------------------------------------------------------------------- /lib/vagrant/src/.gitignore: -------------------------------------------------------------------------------- 1 | # Ignore everything in this directory 2 | * 3 | # Except this file 4 | !.gitignore 5 | -------------------------------------------------------------------------------- /lib/vagrant/src/public/.gitignore: -------------------------------------------------------------------------------- 1 | # Ignore everything in this directory 2 | * 3 | # Except this file 4 | !.gitignore 5 | -------------------------------------------------------------------------------- /scripts/gpg_add_key_to_keyring.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ################################################################################ 4 | ################################################################################ 5 | # 6 | # Given keyID (e.g 42ABCED23 or alice@example.com) fetch the pubKey, 7 | # store it in the keyring and mark it as ultimate trust. 8 | # 9 | # Use case: add gpg keys from people/systems you trust to encrypt passwords with 10 | # theese keys. So if you have 3 collegues the password store or encfs container 11 | # will be encrypted, however it can be opened by the owners of the given keyIDs. 12 | # 13 | # Usage: 14 | # ./gpg_add_key_to_keyring.sh 42ABCED23 15 | # ./gpg_add_key_to_keyring.sh alice@example.com 16 | # ./gpg_add_key_to_keyring.sh alice@example.com 17 | # 18 | ################################################################################ 19 | 20 | echo "#### Add additional keys to debops-padlock ####" 21 | 22 | # Add given gpg key to keyring in order to encrypt the password for the encfs container with additional gpg keys. 23 | gpg --keyserver pool.sks-keyservers.net --recv-keys "$1" 24 | 25 | #Trust the keys noninteractive in batch 26 | echo -e "5\ny\n" | gpg --command-fd 0 --expert --edit-key "$1" trust 27 | -------------------------------------------------------------------------------- /scripts/gpg_generate_key.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ################################################################################ 4 | ################################################################################ 5 | # 6 | # If there is no gpg key for the user, create one non-interactively. 7 | # 8 | ################################################################################ 9 | 10 | set -o nounset -o pipefail -o errexit 11 | 12 | 13 | GPG_KEY_TYPE="${GPG_KEY_TYPE:-RSA}" 14 | GPG_KEY_LENGTH="${GPG_KEY_LENGTH:-4096}" 15 | GPG_USER_REALNAME="${GPG_USER_REALNAME:-${USER}}" 16 | GPG_USER_EMAIL="${GPG_USER_EMAIL:-${USER}@$(hostname -f)}" 17 | GPG_KEY_EXPIRE_DATE="${GPG_KEY_EXPIRE_DATE:-0}" 18 | 19 | echo "#### Install encfs and gpgv2 ####" 20 | echo "Install dependencies" 21 | sudo apt-get -q update 22 | DEBIAN_FRONTEND=noninteractive sudo apt-get \ 23 | --no-install-recommends -yq install \ 24 | encfs \ 25 | gpgv2 \ 26 | dirmngr 27 | 28 | echo "#### Creating ${GPG_KEY_TYPE} GPG Keypair for '${GPG_USER_REALNAME} <${GPG_USER_EMAIL}>'####" 29 | # https://alexcabal.com/creating-the-perfect-gpg-keypair 30 | # https://www.gnupg.org/documentation/manuals/gnupg-devel/Unattended-GPG-key-generation.html 31 | cat >/tmp/.gpg.data < /etc/sudoers.d/admins 60 | chmod 0440 /etc/sudoers.d/admins 61 | useradd --user-group --create-home --shell /bin/bash \ 62 | --home-dir /home/${DEBOPS_ADMIN_USER} --groups admins \ 63 | --comment '${DEBOPS_ADMIN_USER} Admin User' ${DEBOPS_ADMIN_USER} 64 | -------------------------------------------------------------------------------- /scripts/provisioning.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ################################################################################ 4 | ################################################################################ 5 | # 6 | # This script calls the needed DebOps plays/roles in order to provision a new cloud VM, 7 | # then prepares the VM to be ansible managed and runs additional Ansible Playbooks in the correct order. 8 | # 9 | # Usage: 10 | # ./provisioning.sh -l 11 | # 12 | # You can also pass ansible parameter to DebOps 13 | # ./provisioning.sh -l -t role::pki --skip-tags role::owncloud --user root -vvv 14 | # 15 | ################################################################################ 16 | 17 | set -o nounset -o pipefail -o errexit 18 | 19 | # Check if we are in the correct root folder of the repo, and change upwards if needed 20 | # otherwise debops won't work 21 | if [[ ! -f .debops.cfg && -f ../.debops.cfg ]]; then 22 | echo "Running $0 from root of repo." 23 | pushd .. > /dev/null 24 | fi 25 | 26 | # Run the bootstrap DebOps playbook to make the VM a DebOps/Ansible managed host. 27 | debops $@ bootstrap || debops --user root $@ bootstrap 28 | 29 | # Execute all DebOps plays (site.yml) to install everything. 30 | debops $@ 31 | 32 | # Run the debops.pki role a second time to really get the Let's Encrypt TLS certificates. 33 | # The second run is necessary for DebOps to request the Let's Encrypt certificates 34 | # sucessfully,due to a "chicken-egg problem": 35 | # - the debops.pki role needs the nginx server configured with debops.nginx role 36 | # to handle the ACME http-01 authentication request 37 | # - So, on the first run, Let's Encrypt certificates cannot be acquired because 38 | # nginx server isn't ready to help authenticate the request. 39 | # 40 | # In order to get Let's Encrypt/ACME TLS certificates you need to meet this requirements: 41 | # - nginx server is configured: add your server to the [debops_service_nginx] group 42 | # - the host has at least 1 public IP address 43 | # - add DNS records pointing to the public IP address of the server for ALL domains, 44 | # for which an LE certificate is being requested, e.g 'cloud.example.net' 45 | # - a separate PKI realm is configured: 46 | # pki_host_realms: 47 | # # Nextcloud 48 | # - name: 'cloud.example.net' 49 | # acme: true 50 | # acme_domains: 51 | # - 'cloud.example.net' 52 | # 53 | debops service/pki $@ 54 | -------------------------------------------------------------------------------- /scripts/provisioning_ldap.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ################################################################################ 4 | ################################################################################ 5 | # 6 | # This script calls the needed DebOps plays/roles in order to provision a new cloud VM, 7 | # then prepares the VM to be ansible managed and runs additional Ansible Playbooks in the correct order. 8 | # 9 | # Usage: 10 | # ./provisioning_ldap.sh -l 11 | # 12 | # You can also pass ansible parameter to DebOps 13 | # ./provisioning_ldap.sh -l -t role::pki --skip-tags role::owncloud --user root -vvv 14 | # 15 | ################################################################################ 16 | 17 | set -o nounset -o pipefail -o errexit 18 | 19 | # Check if we are in the correct root folder of the repo, and change upwards if needed 20 | # otherwise debops won't work 21 | if [[ ! -f .debops.cfg && -f ../.debops.cfg ]]; then 22 | echo "Running $0 from root of repo." 23 | pushd .. > /dev/null 24 | fi 25 | 26 | # Run the bootstrap DebOps playbook to make the VM a DebOps/Ansible managed host. 27 | debops $@ bootstrap-ldap || debops --user root $@ bootstrap-ldap 28 | 29 | # Execute all DebOps plays (site.yml) to install everything. 30 | debops $@ 31 | 32 | # Run the PKI role a second time (the first is executed from the site.yml DebOps playbook) 33 | # The second run is necessary for DebOps to download/request the Let's Encrypt ACME TLS certificates 34 | # Somehow during the first run, only the internal CA TLS Certificates are installed, but not the ACME certificates. 35 | # Running debops.pki helps to get the ACME certs. 36 | debops service/pki $@ 37 | -------------------------------------------------------------------------------- /testing-roles-rolespec-vagrant/.rolespec.cfg: -------------------------------------------------------------------------------- 1 | # -*- mode: sh -* 2 | 3 | wd=$(dirname "${BASH_SOURCE[0]}") 4 | 5 | # Custom configuration that should only apply when *not* running in travis 6 | if [ -z "${ROLESPEC_TRAVIS}" ] ; then 7 | ROLESPEC_ROLES=. 8 | ROLESPEC_TESTS=. 9 | source "$wd"/vagrant-support.sh 10 | fi 11 | 12 | # add support for debops 13 | source "$wd"/debops-support.sh 14 | -------------------------------------------------------------------------------- /testing-roles-rolespec-vagrant/README.rst: -------------------------------------------------------------------------------- 1 | 2 | ===================================================== 3 | Testing roles using rolespec in a virtual machine 4 | ===================================================== 5 | 6 | This project is an example for how to test roles while developing 7 | them. 8 | 9 | `rolespec`_ is a great tool for developing and testing roles. Please 10 | read the `rolespec` documentation for more insight. One thing the 11 | documentation does not cover is how to set up a development 12 | environment for it. This is where this example comes in. 13 | 14 | .. Note:: 15 | 16 | As of 2015-01-07 nickjj's rolespec does not include the required 17 | support for `.rolespec.cfg`. Meanwhile please use this fork: 18 | https://github.com/htgoebel/rolespec 19 | 20 | 21 | 22 | Requirements 23 | ============== 24 | 25 | * Ansible 26 | * `rolespec`_ 27 | * Vagrant 28 | 29 | 30 | Quick Start 31 | =========== 32 | 33 | * Adopt the enclosed ``Vagrantfile`` to your needs. Esp. you need to 34 | adopt the path mapping near the end of the file to match your 35 | directory layout (see below) 36 | 37 | * Fire up Vagrant ``vagrant up`` and log into the Vagrant host: 38 | ``vagrant ssh``. 39 | 40 | * On the Vagrant host, run your tests, e.g:: 41 | 42 | cd /vargrant 43 | rolespec -l openvpn # lint the openvpn-role 44 | rolespec -r openvpn # run the tests for the openvpn-role 45 | rolespec -r openvpn -p # run the tests in "playbook mode" 46 | 47 | 48 | Directory Layout 49 | =================== 50 | 51 | `rolespec` normally assumes this directory layout:: 52 | 53 | /path/to/where/your/projects/are # <--- working dir 54 | ├── roles 55 | │ ├── ansible-role1 56 | │ └── debops.role42 57 | └── tests 58 | ├── ansible-role1 59 | └── debops.role42 60 | 61 | 62 | The files as contained in this directory assumes this directory 63 | layout:: 64 | 65 | /path/to/where/your/projects/are 66 | └── roles 67 | ├── ansible-role1 68 | ├── debops.role42 69 | └── test-suite # <--- working dir 70 | ├── ansible-role1 71 | └── debops.role42 72 | 73 | This is a layout I personally prefer. Your preferences may vary and 74 | adopting the configuration-files to your needs should be easy. 75 | 76 | 77 | Using your test-suite with travis 78 | =================================== 79 | 80 | Using this test-suite with travis should be easy: The 81 | configuration-files test if running under travis and adopt 82 | settings. So you should be able to push your test-suite to github and 83 | have travis running it without changes. 84 | 85 | 86 | .. _rolespec: https://github.com/nickjj/rolespec 87 | 88 | .. 89 | Local Variables: 90 | mode: rst 91 | ispell-local-dictionary: "american" 92 | End: 93 | -------------------------------------------------------------------------------- /testing-roles-rolespec-vagrant/Vagrantfile: -------------------------------------------------------------------------------- 1 | # -*- mode: ruby -*- 2 | # vim: ft=ruby 3 | 4 | # ---- Configuration variables ---- 5 | 6 | GUI = false # Enable/Disable GUI 7 | RAM = 128 # Default memory size in MB 8 | 9 | # Network configuration 10 | DOMAIN = ".nat.example.com" 11 | NETWORK = "192.168.50." 12 | NETMASK = "255.255.255.0" 13 | 14 | # Default Virtualbox .box 15 | # See: https://wiki.debian.org/Teams/Cloud/VagrantBaseBoxes 16 | BOX = 'debian/jessie64' 17 | 18 | HOSTS = { 19 | "test1" => [NETWORK+"10", RAM, GUI, BOX], 20 | } 21 | 22 | DEBOPS = "~/.local/share/debops/debops-playbooks" 23 | 24 | #=== end of configuration part === 25 | 26 | $script = <