From: Matt Birkholz Date: Wed, 30 Oct 2024 04:35:45 +0000 (-0700) Subject: Update README.html. X-Git-Url: https://birchwood-abbey.net/git?a=commitdiff_plain;ds=inline;p=Institute Update README.html. --- diff --git a/README.html b/README.html index 720bf1b..b92892e 100644 --- a/README.html +++ b/README.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + A Small Institute @@ -48,7 +48,7 @@ connects to Front making the institute email, cloud, etc. available to members off campus.

-
+
                 =                                                   
               _|||_                                                 
         =-The-Institute-=                                           
@@ -1022,7 +1022,7 @@ example result follows the code.
 

 
 
-

+

 

 => 10.62.17.0/24
 

@@ -1056,22 +1056,32 @@ e.g. _net_and_mask rather than _net_cidr.
 

 
 

-private/vars.yml
private_net:             "{{ private_net_cidr | ipaddr('network') }}"
-private_net_mask:        "{{ private_net_cidr | ipaddr('netmask') }}"
-private_net_and_mask:      "{{ private_net }} {{ private_net_mask }}"
-public_vpn_net:       "{{ public_vpn_net_cidr | ipaddr('network') }}"
-public_vpn_net_mask:  "{{ public_vpn_net_cidr | ipaddr('netmask') }}"
+private/vars.yml
private_net:
+           "{{ private_net_cidr | ansible.utils.ipaddr('network') }}"
+private_net_mask:
+           "{{ private_net_cidr | ansible.utils.ipaddr('netmask') }}"
+private_net_and_mask:
+                           "{{ private_net }} {{ private_net_mask }}"
+public_vpn_net:
+        "{{ public_vpn_net_cidr | ansible.utils.ipaddr('network') }}"
+public_vpn_net_mask:
+        "{{ public_vpn_net_cidr | ansible.utils.ipaddr('netmask') }}"
 public_vpn_net_and_mask:
                      "{{ public_vpn_net }} {{ public_vpn_net_mask }}"
-campus_vpn_net:       "{{ campus_vpn_net_cidr | ipaddr('network') }}"
-campus_vpn_net_mask:  "{{ campus_vpn_net_cidr | ipaddr('netmask') }}"
+campus_vpn_net:
+        "{{ campus_vpn_net_cidr | ansible.utils.ipaddr('network') }}"
+campus_vpn_net_mask:
+        "{{ campus_vpn_net_cidr | ansible.utils.ipaddr('netmask') }}"
 campus_vpn_net_and_mask:
                      "{{ campus_vpn_net }} {{ campus_vpn_net_mask }}"
-gate_wifi_net:         "{{ gate_wifi_net_cidr | ipaddr('network') }}"
-gate_wifi_net_mask:    "{{ gate_wifi_net_cidr | ipaddr('netmask') }}"
+gate_wifi_net:
+         "{{ gate_wifi_net_cidr | ansible.utils.ipaddr('network') }}"
+gate_wifi_net_mask:
+         "{{ gate_wifi_net_cidr | ansible.utils.ipaddr('netmask') }}"
 gate_wifi_net_and_mask:
                        "{{ gate_wifi_net }} {{ gate_wifi_net_mask }}"
-gate_wifi_broadcast: "{{ gate_wifi_net_cidr | ipaddr('broadcast') }}"
+gate_wifi_broadcast:
+       "{{ gate_wifi_net_cidr | ansible.utils.ipaddr('broadcast') }}"
 

 

 
@@ -1107,18 +1117,23 @@ The following code block picks the obvious IP addresses for Core
 

 
 

-private/vars.yml
core_addr_cidr:             "{{ private_net_cidr | ipaddr('1') }}"
-gate_addr_cidr:             "{{ private_net_cidr | ipaddr('2') }}"
-gate_wifi_addr_cidr:        "{{ gate_wifi_net_cidr | ipaddr('1') }}"
-wifi_wan_addr_cidr:         "{{ gate_wifi_net_cidr | ipaddr('2') }}"
-front_private_addr_cidr:    "{{ public_vpn_net_cidr | ipaddr('1') }}"
+private/vars.yml
core_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('1') }}"
+gate_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('2') }}"
+gate_wifi_addr_cidr:
+               "{{ gate_wifi_net_cidr | ansible.utils.ipaddr('1') }}"
+wifi_wan_addr_cidr:
+               "{{ gate_wifi_net_cidr | ansible.utils.ipaddr('2') }}"
+front_private_addr_cidr:
+              "{{ public_vpn_net_cidr | ansible.utils.ipaddr('1') }}"
 
-core_addr:                 "{{ core_addr_cidr | ipaddr('address') }}"
-gate_addr:                 "{{ gate_addr_cidr | ipaddr('address') }}"
-gate_wifi_addr:       "{{ gate_wifi_addr_cidr | ipaddr('address') }}"
-wifi_wan_addr:         "{{ wifi_wan_addr_cidr | ipaddr('address') }}"
+core_addr:   "{{ core_addr_cidr | ansible.utils.ipaddr('address') }}"
+gate_addr:   "{{ gate_addr_cidr | ansible.utils.ipaddr('address') }}"
+gate_wifi_addr:
+        "{{ gate_wifi_addr_cidr | ansible.utils.ipaddr('address') }}"
+wifi_wan_addr:
+         "{{ wifi_wan_addr_cidr | ansible.utils.ipaddr('address') }}"
 front_private_addr:
-                  "{{ front_private_addr_cidr | ipaddr('address') }}"
+    "{{ front_private_addr_cidr | ansible.utils.ipaddr('address') }}"
 

 

 

@@ -1475,7 +1490,7 @@ USB-Ethernet adapter, or a wireless adapter connected to a
 campground Wi-Fi access point, etc.
 
 
-
+
 =============== | ==================================================
                 |                                           Premises
           (Campus ISP)                                              
@@ -1498,7 +1513,7 @@ This avoids the need for a second Wi-Fi access point and leads to the
 following topology.
 

 
-
+
 =============== | ==================================================
                 |                                           Premises
            (House ISP)                                              
@@ -1651,8 +1666,8 @@ The all role contains tasks that are executed on all of the
 institute's servers.  At the moment there is just the one.
 

 

-

-
6.1. Include Particulars

+

+
6.1. Include Particulars

 

 

 The all role's task contains a reference to a common institute
@@ -1793,8 +1808,8 @@ uses the institute's CA and server certificates, and expects client
 certificates signed by the institute CA.
 

 

-

-
7.1. Include Particulars

+

+
7.1. Include Particulars

 

 

 The first task, as in The All Role, is to include the institute
@@ -1819,8 +1834,8 @@ membership roll, so these are included was well.
 

 

 

-

-
7.2. Configure Hostname

+

+
7.2. Configure Hostname

 

 

 This task ensures that Front's /etc/hostname and /etc/mailname are
@@ -1850,8 +1865,8 @@ delivery.
 

 

 

-

-
7.3. Add Administrator to System Groups

+

+
7.3. Add Administrator to System Groups

 

 

 The administrator often needs to read (directories of) log files owned
@@ -1910,8 +1925,8 @@ those stored in Secret/ssh_front/etc/ssh/
 

 

 

-

-
7.5. Configure Monkey

+

+
7.5. Configure Monkey

 

 

 The small institute runs cron jobs and web scripts that generate
@@ -1967,8 +1982,8 @@ Monkey uses Rsync to keep the institute's public web site up-to-date.
 

 

 

-

-
7.7. Install Unattended Upgrades

+

+
7.7. Install Unattended Upgrades

 

 

 The institute prefers to install security updates as soon as possible.
@@ -1983,8 +1998,8 @@ The institute prefers to install security updates as soon as possible.
 

 

 

-
-

-
7.9. Install Server Certificate

+

+
7.9. Install Server Certificate

 

 

 The servers on Front use the same certificate (and key) to
@@ -2255,8 +2270,8 @@ created by a more specialized role.
 

 

 

-

-
7.12. Configure Dovecot IMAPd

+

+
7.12. Configure Dovecot IMAPd

 

 

 Front uses Dovecot's IMAPd to allow user Fetchmail jobs on Core to
@@ -2612,8 +2627,8 @@ the users' ~/Public/HTML/ directories.
 

 

 

-

-
7.14. Configure OpenVPN

+

+
7.14. Configure OpenVPN

 

 

 Front uses OpenVPN to provide the institute's public VPN service.  The
@@ -2897,8 +2912,8 @@ Debian install and remote access to a privileged, administrator's
 account.  (For details, see The Core Machine.)
 

 

-

-
8.1. Include Particulars

+

+
8.1. Include Particulars

 

 

 The first task, as in The Front Role, is to include the institute
@@ -2920,8 +2935,8 @@ particulars and membership roll.
 

 

 

-

-
8.2. Configure Hostname

+

+
8.2. Configure Hostname

 

 

 This task ensures that Core's /etc/hostname and /etc/mailname are
@@ -2954,8 +2969,8 @@ proper email delivery.
 

 

 

-

-
8.3. Configure Systemd Resolved

+

+
8.3. Configure Systemd Resolved

 

 

 Core runs the campus name server, so Resolved is configured to use it
@@ -3263,19 +3278,19 @@ probably be used as forwarders rather than Google.
         file "/etc/bind/db.domain";
 };
 
-zone "{{ private_net_cidr | ipaddr('revdns')
+zone "{{ private_net_cidr | ansible.utils.ipaddr('revdns')
          | regex_replace('^0\.','') }}" {
         type master;
         file "/etc/bind/db.private";
 };
 
-zone "{{ public_vpn_net_cidr | ipaddr('revdns')
+zone "{{ public_vpn_net_cidr | ansible.utils.ipaddr('revdns')
          | regex_replace('^0\.','') }}" {
         type master;
         file "/etc/bind/db.public_vpn";
 };
 
-zone "{{ campus_vpn_net_cidr | ipaddr('revdns')
+zone "{{ campus_vpn_net_cidr | ansible.utils.ipaddr('revdns')
          | regex_replace('^0\.','') }}" {
         type master;
         file "/etc/bind/db.campus_vpn";
@@ -3368,8 +3383,8 @@ probably be used as forwarders rather than Google.
 

 

 

-

-
8.7. Add Administrator to System Groups

+

+
8.7. Add Administrator to System Groups

 

 

 The administrator often needs to read (directories of) log files owned
@@ -3389,8 +3404,8 @@ these groups speeds up debugging.
 

 

 

-

-
8.8. Configure Monkey

+

+
8.8. Configure Monkey

 

 

 The small institute runs cron jobs and web scripts that generate
@@ -3457,8 +3472,8 @@ described in *Configure Apache2).
 

 

 

-

-
8.9. Install Unattended Upgrades

+

+
8.9. Install Unattended Upgrades

 

 

 The institute prefers to install security updates as soon as possible.
@@ -3490,8 +3505,8 @@ with Nextcloud on the command line.
 

 

 

-

-
8.11. Configure User Accounts

+

+
8.11. Configure User Accounts

 

 

 User accounts are created immediately so that backups can begin
@@ -3533,8 +3548,8 @@ describes the members and usernames variables.
 

 

 

-

-
8.12. Install Server Certificate

+

+
8.12. Install Server Certificate

 

 

 The servers on Core use the same certificate (and key) to authenticate
@@ -3758,8 +3773,8 @@ installed by more specialized roles.
 

 

 

-

-
8.16. Configure Dovecot IMAPd

+

+
8.16. Configure Dovecot IMAPd

 

 

 Core uses Dovecot's IMAPd to store and serve member emails.  As on
@@ -5085,7 +5100,7 @@ performance, as recommended by Nextcloud.
   lineinfile:
     path: /etc/php/8.2/apache2/php.ini
     regexp: memory_limit *=
-    line: memory_limit = 512M
+    line: memory_limit = 768M
 
 - name: Include PHP parameters for Nextcloud.
   become: yes
@@ -5509,8 +5524,8 @@ applied first, by which Gate gets a campus machine's DNS and Postfix
 configurations, etc.
 

 

-

-
9.1. Include Particulars

+

+
9.1. Include Particulars

 

 

 The following should be familiar boilerplate by now.
@@ -5896,8 +5911,8 @@ addresses (or perhaps finding no wifi interface at all?).
 

 

 

-

-
9.6. Install Server Certificate

+

+
9.6. Install Server Certificate

 

 

 The (OpenVPN) server on Gate uses an institute certificate (and key)
@@ -5924,8 +5939,8 @@ and Front) do.
 

 

 

-

-
9.7. Configure OpenVPN

+

+
9.7. Configure OpenVPN

 

 

 Gate uses OpenVPN to provide the institute's campus VPN service.  Its
@@ -6052,8 +6067,8 @@ Wireless campus devices can get a key to the campus VPN from the
 configured manually.
 

 

-

-
10.1. Include Particulars

+

+
10.1. Include Particulars

 

 

 The following should be familiar boilerplate by now.
@@ -6069,8 +6084,8 @@ The following should be familiar boilerplate by now.
 

 

 

-

-
10.2. Configure Hostname

+

+
10.2. Configure Hostname

 

 

 Clients should be using the expected host name.
@@ -6097,8 +6112,8 @@ Clients should be using the expected host name.
 

 

 

-

-
10.3. Configure Systemd Resolved

+

+
10.3. Configure Systemd Resolved

 

 

 Campus machines use the campus name server on Core (or dns.google),
@@ -6170,8 +6185,8 @@ and file timestamps.
 

 

 

-

-
10.5. Add Administrator to System Groups

+

+
10.5. Add Administrator to System Groups

 

 

 The administrator often needs to read (directories of) log files owned
@@ -6191,8 +6206,8 @@ these groups speeds up debugging.
 

 

 

-

-
10.6. Install Unattended Upgrades

+

+
10.6. Install Unattended Upgrades

 

 

 The institute prefers to install security updates as soon as possible.
@@ -9127,7 +9142,7 @@ routes on Front and Gate, making the simulation less… similar.
 

 

 
Author: Matt Birkholz

-
Created: 2024-09-03 Tue 08:43

+
Created: 2024-10-29 Tue 21:35

 
Validate