|
|
|
|
# Playbook et rôles Ansible d'Aurore
|
|
|
|
|
|
|
|
|
|
Pour cloner ce projet :
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
git clone --recursive git@gitlab.federez.net:erdnaxe/ansible-role-ldap-client.git
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Exécution d'un playbook
|
|
|
|
|
|
|
|
|
|
Pour tester :
|
|
|
|
|
```bash
|
|
|
|
|
ansible-playbook --ask-vault-pass -bK -i hosts base.yml --check --diff
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Pour appliquer :
|
|
|
|
|
```bash
|
|
|
|
|
ansible-playbook --ask-vault-pass -bK -i hosts base.yml
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## FAQ
|
|
|
|
|
|
|
|
|
|
### Mettre sa clé SSH sur une machine
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
ssh-copy-id -i ~/.ssh/id_rsa_aurore.pub virtu.fede-aurore.net
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Automatiquement ajouter fingerprint ECDSA (dangereux !)
|
|
|
|
|
|
|
|
|
|
Il faut changer la variable d'environnement suivante :
|
|
|
|
|
`ANSIBLE_HOST_KEY_CHECKING=0`.
|
|
|
|
|
|
|
|
|
|
### Configurer la connexion au bastion
|
|
|
|
|
|
|
|
|
|
Envoyer son agent SSH peut être dangereux ([source](https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/)).
|
|
|
|
|
|
|
|
|
|
On va utiliser plutôt ProxyCommand.
|
|
|
|
|
Dans la configuration SSH :
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
# Keep session alive only for bastion
|
|
|
|
|
Host proxy.auro.re
|
|
|
|
|
ControlMaster auto
|
|
|
|
|
ControlPath ~/.ssh/%r@%h:%p
|
|
|
|
|
|
|
|
|
|
# Use a bastion and a key to log on all Aurore servers
|
|
|
|
|
Host 10.128.0.*
|
|
|
|
|
ProxyJump proxy.auro.re
|
|
|
|
|
IdentityFile ~/.ssh/id_rsa_aurore
|
|
|
|
|
```
|
|
|
|
|
|
