LILiK/lilik_playbook - lilik_playbook - Gitea: Git with a cup of tea

Playbooks to a new Lilik

13 lines

371 B

Raw Normal View History

Various LXC fixes.

9 years ago

add gateway for different vlan to group_vars

7 years ago

roles/ssh_server: multi key and OpenSSH v8 support Add support for OpenSSH v8 (ouput of `ssh-keygen` changed slightly) in module `ssh_cert` and use a better implementation for multiple user CA. Now we are reading user_ca from `group_vars/all.yaml`. `user_ca_keys` should be list of each allowed User CA on one host (in this way is easier to rotate CAs without reissuing keys to each user at the same time). The production CA must be the first one in the list. Host certificate will be checked only against the first CA and updated if their host key was issued from another CA in the list. For this reason now we are using a template to create `/etc/ssh/user_ca.pub` on the target, to preserve the key order. `group_vars/all.yaml.example` has been updated to reflect the new usage.

5 years ago

set ip to bind in reverse proxy http configuration Because we are using openwrt and we would like to mantain LUCI running on it's interface we can't bind on 0.0.0.0. or 127.0.0.1 hence we must listen on a specific ip. This will set the public ip from the group vars to be the one where we listen

8 years ago

add domain to group_vars and use it in reverse proxy templates

8 years ago

---
# ip of the management vlan gateway
management_gateway: 0.0.0.0
# ip of the vm vlan gateway
vm_gateway: 0.0.0.0
# Put here a list of public keys for each allowed users CA.
# The first one should be the current production one.
user_ca_keys:
 - ""
# Put here the public ip for your organisation
public_ip: 0.0.0.0
# Put here the domain for your organisation
domain: ""