aurore
/
ansible
15
2
Fork 0
Code Issues 1 Pull Requests 13 Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
15 Commits
31 Branches
0 Tags
3.8 MiB
Jinja 92.6%
Python 5.7%
Shell 1.7%
 
 
 
new-infra
bird
dns
aruba
radius
on-en-a-litteralement-rien-a-foutre
radvd
keepalived
ifupdown2
master
dhcp
cleanup_no_ldap_for_servers
infra_router
ask_vault_pass
borgfix
auditd
prometheus_apt_pending_and_reboot
move_host_vars
prometheus-ipmi-exporter
fix-portail
crans
apt
remove_old_db_servers
rspamd
wireguard-ovh
pass
nullmailer
logs
mailserver
re2o-master
mail_server
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'b78b8fe6c5'
${ noResults }
Go to file
Alexandre Iooss b78b8fe6c5 SSHJump also on 10.128.1.* 5 years ago
group_vars/all Don't use SSH agent 6 years ago
roles Fix perm on user dir 6 years ago
.gitignore Initial commit 6 years ago
.gitmodules Add roles as submodules 6 years ago
README.md SSHJump also on 10.128.1.* 5 years ago
base.yml Initial commit 6 years ago
hosts Add VPN OVH 5 years ago
ldap.yml Inventory clean up 6 years ago

README.md

Playbook et rôles Ansible d'Aurore

Pour cloner ce projet :

git clone --recursive git@gitlab.federez.net:erdnaxe/ansible-role-ldap-client.git

Exécution d'un playbook

Pour tester :

ansible-playbook --ask-vault-pass -bK -i hosts base.yml --check --diff

Pour appliquer :

ansible-playbook --ask-vault-pass -bK -i hosts base.yml

FAQ

Mettre sa clé SSH sur une machine

ssh-copy-id -i ~/.ssh/id_rsa_aurore.pub virtu.fede-aurore.net

Automatiquement ajouter fingerprint ECDSA (dangereux !)

Il faut changer la variable d'environnement suivante : ANSIBLE_HOST_KEY_CHECKING=0.

Configurer la connexion au bastion

Envoyer son agent SSH peut être dangereux (source).

On va utiliser plutôt ProxyCommand. Dans la configuration SSH :

# Keep session alive only for bastion
Host proxy.auro.re
    ControlMaster auto
    ControlPath ~/.ssh/%r@%h:%p

# Use a bastion and a key to log on all Aurore servers
Host 10.128.*
    ProxyJump proxy.auro.re
    IdentityFile ~/.ssh/id_rsa_aurore