From bb382639cbd2c4a02958d34611e2bda7906dc221 Mon Sep 17 00:00:00 2001 From: Matt Birkholz Date: Mon, 15 Jun 2026 11:37:18 -0600 Subject: [PATCH] Update README.html. --- README.html | 1419 ++++++++++++++++++++++++--------------------------- 1 file changed, 660 insertions(+), 759 deletions(-) diff --git a/README.html b/README.html index b89a2cc..5946799 100644 --- a/README.html +++ b/README.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + A Small Institute @@ -24,8 +24,8 @@ an expendable public face (easily wiped clean) while maintaining a secure and private campus that can function with or without the Internet.

-
-

1. Overview

+
+

1. Overview

This small institute has a public server on the Internet, Front, that @@ -48,7 +48,7 @@ connects to Front making the institute email, cloud, etc. available to members off campus.

-
+
                 =                                                   
               _|||_                                                 
         =-The-Institute-=                                           
@@ -95,8 +95,8 @@ uses OpenPGP encryption to secure message content.
-
-

2. Caveats

+
+

2. Caveats

This small institute prizes its privacy, so there is little or no @@ -144,8 +144,8 @@ month) because of this assumption.

-
-

3. The Services

+
+

3. The Services

The small institute's network is designed to provide a number of @@ -157,8 +157,8 @@ policies. On first reading, those subsections should be skipped; they reference particulars first introduced in the following chapter.

-
-

3.1. The Name Service

+
+

3.1. The Name Service

The institute has a public domain, e.g. small.example.org, and a @@ -172,8 +172,8 @@ names like core.

-
-

3.2. The Email Service

+
+

3.2. The Email Service

Front provides the public SMTP (Simple Mail Transfer Protocol) service @@ -269,8 +269,8 @@ setting for the maximum message size is given in a code block labeled configurations wherever <<postfix-message-size>> appears.

-
-

3.2.1. The Postfix Configurations

+
+

3.2.1. The Postfix Configurations

The institute aims to accommodate encrypted email containing short @@ -285,7 +285,7 @@ handle maxi-messages.

-postfix-message-size
- { p: message_size_limit, v: 104857600 }
+postfix-message-size
- { p: message_size_limit, v: 104857600 }
@@ -300,7 +300,7 @@ re-sending the bounce (or just grabbing the go-bag!).

-postfix-queue-times
- { p: delay_warning_time, v: 1h }
+postfix-queue-times
- { p: delay_warning_time, v: 1h }
 - { p: maximal_queue_lifetime, v: 4h }
 - { p: bounce_queue_lifetime, v: 4h }
 

@@ -314,7 +314,7 @@ disables relaying (other than for the local networks).
 

 
 

-postfix-relaying
- p: smtpd_relay_restrictions
+postfix-relaying
- p: smtpd_relay_restrictions
   v: permit_mynetworks reject_unauth_destination
 

 

@@ -326,7 +326,7 @@ effect.
 

 
 

-postfix-maildir
- { p: home_mailbox, v: Maildir/ }
+postfix-maildir
- { p: home_mailbox, v: Maildir/ }
 

 

 
@@ -337,8 +337,8 @@ in the respective roles below.
-
-

3.2.2. The Dovecot Configurations

+
+

3.2.2. The Dovecot Configurations

The Dovecot settings on both Front and Core disable POP and require @@ -352,7 +352,7 @@ The official documentation for Dovecot once was a Wiki but now is

-dovecot-tls
protocols = imap
+dovecot-tls
protocols = imap
 ssl = required
@@ -364,7 +364,7 @@ configuration keeps them from even listening at the IMAP port

-dovecot-ports
service imap-login {
+dovecot-ports
service imap-login {
   inet_listener imap {
     port = 0
   }
@@ -378,7 +378,7 @@ directories.
 

 
 

-dovecot-maildir
mail_location = maildir:~/Maildir
+dovecot-maildir
mail_location = maildir:~/Maildir
 

 

 
@@ -387,7 +387,7 @@ In version 2.4 (Debian 13), this variable was split in two.
 

 
 

-dovecot-maildir
mail_driver = maildir
+dovecot-maildir
mail_driver = maildir
 mail_path = ~/Maildir
 mail_inbox_path = ~/Maildir
 

@@ -402,15 +402,15 @@ Dovecot before 2.4 (Debian 13).
-
-

3.3. The Web Services

+
+

3.3. The Web Services

Front provides the public HTTP service that serves institute web pages at e.g. https://small.example.org/. The small institute initially runs with a self-signed, "snake oil" server certificate, causing browsers to warn of possible fraud, but this certificate is easily -replaced by one signed by a recognized authority, as discussed in The +replaced by one signed by a recognized authority, as discussed in The Front Role.

@@ -465,15 +465,15 @@ will automatically wipe it within 15 minutes.

-
-

3.4. The Cloud Service

+
+

3.4. The Cloud Service

Core runs Nextcloud to provide a private institute cloud at https://core.small.private/nextcloud/. It is managed manually per The Nextcloud Server Administration Guide. The code and data, including especially database dumps, are stored in /Nextcloud/ which -is included in Core's backup procedure as described in Backups. The +is included in Core's backup procedure as described in Backups. The default Apache2 configuration expects to find the web scripts in /var/www/nextcloud/, so the institute symbolically links this to /Nextcloud/nextcloud/. @@ -487,15 +487,15 @@ private network.

-
-

3.5. Accounts

+
+

3.5. Accounts

A small institute has just a handful of members. For simplicity (and thus security) static configuration files are preferred over complex account management systems, LDAP, Active Directory, and the like. The Ansible scripts configure the same set of user accounts on Core and -Front. The Institute Commands (e.g. ./inst new dick) capture the +Front. The Institute Commands (e.g. ./inst new dick) capture the processes of enrolling, modifying and retiring members of the institute. They update the administrator's membership roll, and run Ansible to create (and disable) accounts on Core, Front, Nextcloud, @@ -510,8 +510,8 @@ accomplished via the campus cloud and the resulting desktop files can all be private (readable and writable only by the owner) by default.

-
-

3.5.1. The Administration Accounts

+
+

3.5.1. The Administration Accounts

The institute avoids the use of the root account (uid 0) because @@ -520,21 +520,21 @@ command is used to consciously (conscientiously!) run specific scripts and programs as root. When installation of a Debian OS leaves the host with no user accounts, just the root account, the next step is to create a system administrator's account named sysadm and to give -it permission to use the sudo command (e.g. as described in The +it permission to use the sudo command (e.g. as described in The Front Machine). When installation prompts for the name of an initial, privileged user account the same name is given (e.g. as -described in The Core Machine). Installation may not prompt and +described in The Core Machine). Installation may not prompt and still create an initial user account with a distribution specific name (e.g. pi). Any name can be used as long as it is provided as the value of ansible_user in hosts. Its password is specified by a vault-encrypted variable in the Secret/become.yml file. (The -hosts and Secret/become.yml files are described in The Ansible +hosts and Secret/become.yml files are described in The Ansible Configuration.)

-
-

3.5.2. The Monkey Accounts

+
+

3.5.2. The Monkey Accounts

The institute's Core uses a special account named monkey to run @@ -545,8 +545,8 @@ account is created on Front as well.

-
-

3.6. Keys

+
+

3.6. Keys

The institute keeps its "master secrets" in an encrypted @@ -627,8 +627,8 @@ the administrator's password keep, to install a new SSH key.

-
-

3.7. Backups

+
+

3.7. Backups

The small institute backs up its data, but not so much so that nothing @@ -664,7 +664,7 @@ files mentioned in the Nextcloud database dump).

-private/backup
#!/bin/bash -e
+private/backup
#!/bin/bash -e
 #
 # DO NOT EDIT.
 #
@@ -768,8 +768,8 @@ finish
-
-

4. The Particulars

+
+

4. The Particulars

This chapter introduces Ansible variables intended to simplify @@ -781,13 +781,13 @@ stored in separate files: public/vars.yml a

The example settings in this document configure VirtualBox VMs as -described in the Testing chapter. For more information about how a +described in the Testing chapter. For more information about how a small institute turns the example Ansible code into a working Ansible -configuration, see chapter The Ansible Configuration. +configuration, see chapter The Ansible Configuration.

-
-

4.1. Generic Particulars

+
+

4.1. Generic Particulars

The small institute's domain name is used quite frequently in the @@ -826,8 +826,8 @@ domain_priv: small.private

-
-

4.2. Subnets

+
+

4.2. Subnets

The small institute uses a private Ethernet, two VPNs, and a "wild", @@ -927,7 +927,7 @@ example result follows the code.

-
+

=> 10.62.17.0/24

@@ -940,12 +940,11 @@ code block below. The small institute treats these addresses as sensitive information so again the code block below "tangles" into private/vars.yml rather than public/vars.yml. Two of the addresses are in 192.168 subnets because they are part of a test -configuration using mostly-default VirtualBoxes (described here). +configuration using mostly-default VirtualBoxes (described here).

-private/vars.yml

-private_net_cidr:           192.168.56.0/24
+private/vars.yml
private_net_cidr:           192.168.56.0/24
 wild_net_cidr:              192.168.57.0/24
 public_wg_net_cidr:         10.177.87.0/24
 campus_wg_net_cidr:         10.84.139.0/24
@@ -961,7 +960,7 @@ e.g. _net_and_mask rather than _net_cidr.
 

 
 

-network-vars
private_net:
+network-vars
private_net:
            "{{ private_net_cidr | ansible.utils.ipaddr('network') }}"
 private_net_mask:
            "{{ private_net_cidr | ansible.utils.ipaddr('netmask') }}"
@@ -1003,7 +1002,7 @@ the institute's Internet domain name.
 

 
 

-public/vars.yml
front_addr: 192.168.15.4
+public/vars.yml
front_addr: 192.168.15.4
 

 

 
@@ -1021,8 +1020,7 @@ with address-vars in the default/main.yml files.
 

 
 

-address-vars

-core_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('1') }}"
+address-vars
core_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('1') }}"
 gate_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('2') }}"
 gate_wild_addr_cidr:
                     "{{ wild_net_cidr | ansible.utils.ipaddr('1') }}"
@@ -1044,19 +1042,19 @@ core_wg_addr:
-
-

5. The Hardware

+
+

5. The Hardware

The small institute's network was built by its system administrator using Ansible on a trusted notebook. The Ansible configuration and scripts were generated by "tangling" the Ansible code included here. -(The Ansible Configuration describes how to do this.) The following +(The Ansible Configuration describes how to do this.) The following sections describe how Front, Gate and Core were prepared for Ansible.

-
-

5.1. The Front Machine

+
+

5.1. The Front Machine

Front is the small institute's public facing server, a virtual machine @@ -1069,13 +1067,13 @@ possible to quickly re-provision a new Front machine from a frontier Internet café using just the administrator's notebook.

-
-

5.1.1. A Digital Ocean Droplet

+
+

5.1.1. A Digital Ocean Droplet

The following example prepared a Digital Ocean droplet to be Front. The institute administrator opened an account at Digital Ocean, -registered an ssh key, and used a Digital Ocean control panel to +registered an SSH key, and used a Digital Ocean control panel to create a new machine (again, one of the cheapest, smallest available) with Debian 13 installed, named small.example.org. Once created, the machine and its IP address (159.65.75.60) appeared on the panel. @@ -1093,7 +1091,7 @@ during the hand-off.

The freshly created Digital Ocean droplet came with just one account, root, but the small institute avoids remote access to the "super -user" account (per the policy in The Administration Accounts), so the +user" account (per the policy in The Administration Accounts), so the first thing the administrator did was to create a sysadm account.

@@ -1101,7 +1099,7 @@ first thing the administrator did was to create a sysadm account. The password for the sysadm account was generated by gpw, saved in the administrator's password keep, and added to Secret/become.yml as shown below. (Producing a working Ansible configuration with -Secret/become.yml file is described in The Ansible Configuration.) +Secret/become.yml file is described in The Ansible Configuration.) 

@@ -1143,8 +1141,8 @@ notebook$
 
 

 After creating the sysadm account on the droplet, the administrator
-concatenated a personal public ssh key and the key found in
-Secret/ssh_admin/ (created by The CA Command) into an admin_keys
+concatenated a personal public SSH key and the key found in
+Secret/ssh_admin/ (created by The CA Command) into an admin_keys
 file, copied it to the droplet, and installed it as the
 authorized_keys for sysadm.
 

@@ -1166,7 +1164,7 @@ notebook$
 
 

 After installing authorized keys, the administrator verified that
-password-less ssh logins work, then disabled root logins and tested
+password-less SSH logins work, then disabled root logins and tested
 that they were indeed denied.
 

 
@@ -1186,7 +1184,7 @@ key.  The systemd-resolved package was installed so that the
 subsequent reboot gets ResolveD configured properly (else resolvectl
 hangs, causing wg-quick@wg0 to hang…).  The rest are included just
 to speed up (re)testing of "prepared" test machines, e.g. prepared as
-described in The Test Front Machine.
+described in The Test Front Machine.
 

 
 
@@ -1225,17 +1223,17 @@ notebook$
 
 

 The public key is copied and pasted into private/vars.yml as the
-value of front_wg_pubkey (as in the example here).
+value of front_wg_pubkey (as in the example here).
 

 
 

 The prospective IP address (159.65.75.60) is also pasted into
 public/vars.yml as the value of front_addr (as in the example
-here).
+here).
 

 
 

-Finally, the new machine's ssh public host is copied to
+Finally, the new machine's SSH public host is copied to
 private/front_ed25519_key.pub.
 

 
@@ -1252,8 +1250,8 @@ Ansible prepared for the droplet!).
-
-

5.2. The Core Machine

+
+

5.2. The Core Machine

Core is the small institute's private file, email, cloud and whatnot @@ -1277,7 +1275,7 @@ The following example prepared a new core on a PC with Debian 11 freshly installed. During installation, the machine was named core, no desktop or server software was installed, no root password was set, and a privileged account named sysadm was created (per the policy in -The Administration Accounts). +The Administration Accounts). 

@@ -1293,7 +1291,7 @@ Is the information correct? [Y/n]
 The password was generated by gpw, saved in the administrator's
 password keep, and later added to Secret/become.yml as shown below.
 (Producing a working Ansible configuration with Secret/become.yml
-file is described in The Ansible Configuration.)
+file is described in The Ansible Configuration.)
 

 
 
@@ -1356,24 +1354,48 @@ _                  nagios-nrpe-plugin
 

 
 

-Next, the administrator concatenated a personal public ssh key and the
-key found in Secret/ssh_admin/ (created by The CA Command) into an
-admin_keys file, copied it to Core, and installed it as the
-authorized_keys for sysadm.
+Now Core no longer needed the Internets so it was disconnected from
+the cable modem and connected to the campus Ethernet switch.  Its
+primary Ethernet interface was manually configured with its private IP
+address and a default route, using commands similar to the examples
+below.  In the example commands, the address 192.168.56.1 is the
+example value of core_addr set in Subnets.  The second address,
+192.168.56.2, is likewise the example value of gate_addr.
+

+
+
+sysadm@core$ sudo ip address add 192.168.56.1 dev enp82s0
+sysadm@core$ sudo ip route add default via 192.168.56.2 dev enp82s0
+

+
+

+Next, the administrator connected their notebook to the campus
+Ethernet and adopted an unused IP address, e.g. 192.168.56.100.
+

+
+
+notebook$ sudo ip address add 192.168.56.100 dev eth0
+

+
+

+On their notebook, the administrator concatenated their personal
+public SSH key with Ansible's (found in Secret/ssh_admin/, created
+by The CA Command) into an admin_keys file, copied the file to Core,
+and installed it as the authorized_keys for sysadm.
 

 
 
 notebook$ cat ~/.ssh/id_ed25519.pub \
 notebook_     Secret/ssh_admin/id_ed25519.pub \
 notebook_     > admin_keys
-notebook$ scp admin_keys sysadm@core.lan:
-The authenticity of host 'core.lan' can't be established.
+notebook$ scp admin_keys sysadm@192.168.56.1:
+The authenticity of host '192.168.56.1' can't be established.
 ....
 Are you sure you want to continue connecting (...)? yes
 ...
-sysadm@core.lan's password: oingstramextedil
-notebook$ ssh sysadm@core.lan
-sysadm@core.lan's password: oingstramextedil
+sysadm@192.168.56.1's password: oingstramextedil
+notebook$ ssh sysadm@192.168.56.1
+sysadm@192.168.56.1's password: oingstramextedil
 sysadm@core$ ( umask 077; mkdir .ssh; \
 sysadm@core_   cp admin_keys .ssh/authorized_keys )
 sysadm@core$ rm admin_keys
@@ -1382,40 +1404,13 @@ notebook$ rm admin_keys
 notebook$
 

 
-

-Note that the name core.lan should be known to the cable modem's DNS
-service.  An IP address might be used instead, discovered with an ip
--4 a command on Core.
-

-
-

-Now Core no longer needed the Internets so it was disconnected from
-the cable modem and connected to the campus Ethernet switch.  Its
-primary Ethernet interface was temporarily (manually) configured with
-a new, private IP address and a default route.
-

-
-

-In the example command lines below, the address 10.227.248.1 was
-generated by the random subnet address picking procedure described in
-Subnets, and is named core_addr in the Ansible code.  The second
-address, 10.227.248.2, is the corresponding address for Gate's
-Ethernet interface, and is named gate_addr in the Ansible
-code.
-

-
-
-sysadm@core$ sudo ip address add 10.227.248.1 dev enp82s0
-sysadm@core$ sudo ip route add default via 10.227.248.2 dev enp82s0
-

-
 

 At this point Core was prepared for provisioning with Ansible.
-
-

5.3. The Gate Machine

+
+

5.3. The Gate Machine

Gate is the small institute's route to the Internet, and the campus @@ -1435,7 +1430,7 @@ modem, a USB port tethered to a phone, a wireless adapter connected to a campground Wi-Fi access point, etc. -

+
 =============== | ==================================================
                 |                                           Premises
           (Campus ISP)                                              
@@ -1448,8 +1443,8 @@ connected to a campground Wi-Fi access point, etc.
                 +----Ethernet switch
-
-

5.3.1. Alternate Gate Topology

+
+

5.3.1. Alternate Gate Topology

While Gate and Core really need to be separate machines for security @@ -1458,7 +1453,7 @@ This avoids the need for a second Wi-Fi access point and leads to the following topology.

-
+
 =============== | ==================================================
                 |                                           Premises
            (House ISP)                                              
@@ -1482,37 +1477,28 @@ its Ethernet and Wi-Fi clients are allowed to communicate).
-
-

5.3.2. Original Gate Topology

+
+

5.3.2. Original Gate Topology

The Ansible code in this document is somewhat dependent on the -physical network shown in the Overview wherein Gate has three network +physical network shown in the Overview wherein Gate has three network interfaces.

-The following example prepared a new gate on a PC with Debian 11 +The following example prepared a new gate on a PC with Debian 13 freshly installed. During installation, the machine was named gate, -no desktop or server software was installed, no root password was set, -and a privileged account named sysadm was created (per the policy in -The Administration Accounts). +no desktop nor server software was installed, no root password was +set, and a privileged account named sysadm was created (per the +policy in The Administration Accounts).

-
-New password: icismassssadestm
-Retype new password: icismassssadestm
-...
-        Full Name []: System Administrator
-...
-Is the information correct? [Y/n] 
-
-

-The password was generated by gpw, saved in the administrator's -password keep, and later added to Secret/become.yml as shown below. -(Producing a working Ansible configuration with Secret/become.yml -file is described in The Ansible Configuration.) +The password for sysadm was generated by gpw, saved in the +administrator's password keep, and later added to Secret/become.yml +as shown below. (Producing a working Ansible configuration with +Secret/become.yml file is described in The Ansible Configuration.) 

@@ -1524,7 +1510,7 @@ notebook_     >>Secret/become.yml

-With Debian freshly installed, Gate needed a couple additional +With Debian freshly installed, Gate just needed a few additional software packages. The administrator temporarily plugged Gate into a cable modem and installed them as shown below.

@@ -1532,72 +1518,98 @@ cable modem and installed them as shown below. 
 $ sudo apt install systemd-resolved unattended-upgrades \
 _                  ufw postfix wireguard lm-sensors \
-_                  nagios-nrpe-server
+_                  nagios-nrpe-server munin-node emacs

-The host then needed to be rebooted to get its name service working -again after systemd-resolved was installed. (Any help with this will -be welcome!) After rebooting and re-logging in, the administrator was -ready to proceed. +Manual installation of Postfix prompted for configuration type and +mail name. The answers given are listed here.

+
    +
  • General type of mail configuration: Internet Site
    • +
  • System mail name: gate.small.private
    • +
+

-Next, the administrator concatenated a personal public ssh key and the -key found in Secret/ssh_admin/ (created by The CA Command) into an -admin_keys file, copied it to Gate, and installed it as the -authorized_keys for sysadm. +Now Gate no longer needed the Internets, and needed to be rebooted to +get its name service working again after installing +systemd-resolved. (Any help with this will be welcome!) It was +shutdown and disconnected from the cable modem, then connected to the +campus Ethernet switch and restarted. Logged in on the console, the +administrator configured the primary Ethernet interface with Gate's +private IP address using a command similar to the example below. In +the example command, the address 192.168.56.2 is the example value +of gate_addr, set in Subnets. +

+ +
+sysadm@gate$ sudo ip address add 192.168.56.2 dev eth0
+
+ +

+Next, the administrator connected their notebook to the campus +Ethernet and adopted an unused IP address, e.g. 192.168.56.100. +

+ +
+notebook$ sudo ip address add 192.168.56.100 dev eth0
+
+ +

+On their notebook, the administrator concatenated their personal +public SSH key with Ansible's (found in Secret/ssh_admin/, created +by The CA Command) into an admin_keys file, copied the file to Gate, +and installed it as the authorized_keys for sysadm. 

 notebook$ cat ~/.ssh/id_ed25519.pub \
 notebook_     Secret/ssh_admin/id_ed25519.pub \
 notebook_     > admin_keys
-notebook$ scp admin_keys sysadm@gate.lan:
-The authenticity of host 'gate.lan' can't be established.
+notebook$ scp admin_keys sysadm@192.168.56.2:
+The authenticity of host '192.168.56.2' can't be established.
 ....
 Are you sure you want to continue connecting (...)? yes
 ...
-sysadm@gate.lan's password: icismassssadestm
-notebook$ ssh sysadm@gate.lan
-sysadm@gate.lan's password: icismassssadestm
+sysadm@192.168.56.2's password: icismassssadestm
+notebook$ ssh sysadm@192.168.56.2
+sysadm@192.168.56.2's password: icismassssadestm
 sysadm@gate$ ( umask 077; mkdir .ssh; \
 sysadm@gate_   cp admin_keys .ssh/authorized_keys )
-sysadm@core$ rm admin_keys
-sysadm@core$ logout
+sysadm@gate$ rm admin_keys
+sysadm@gate$ logout
 notebook$ rm admin_keys
 notebook$

-Note that the name gate.lan should be known to the cable modem's DNS -service. An IP address might be used instead, discovered with an ip -a command on Gate. -

- -

-Now Gate no longer needed the Internets so it was disconnected from -the cable modem and connected to the campus Ethernet switch. Its -primary Ethernet interface was temporarily (manually) configured with -a new, private IP address. +Gate was also connected to the USB Ethernet dongles cabled to the +campus Wi-Fi access point and the campus ISP, and the values of three +variables (gate_lan_mac, gate_wild_mac, and gate_isp_mac in +private/vars.yml) were set to the hardware MAC addresses of the +dongles. (For more information, see the tasks in the 9.3 section.)

-In the example command lines below, the address 10.227.248.2 was -generated by the random subnet address picking procedure described in -Subnets, and is named gate_addr in the Ansible code. +Finally, a new WireGuard™ private key was generated. The following +commands generated the key without revealing it, and displayed the +corresponding public key. 

-$ sudo ip address add 10.227.248.2 dev eth0
+sysadm@small$ umask 077
+susadm@small$ wg genkey \
+sysadm@small_ | sudo tee /etc/wireguard/private-key \
+sysadm@small_ | wg pubkey
+S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4=
+sysadm@small$ logout
+notebook$

-Gate was also connected to the USB Ethernet dongles cabled to the -campus Wi-Fi access point and the campus ISP and the values of three -variables (gate_lan_mac, gate_wild_mac, and gate_isp_mac in -private/vars.yml) match the actual hardware MAC addresses of the -dongles. (For more information, see the tasks in the 9.3 section.) +The public key is copied and pasted into private/vars.yml as the +value of front_wg_pubkey (as in the example here).

@@ -1607,22 +1619,22 @@ At this point Gate was prepared for provisioning with Ansible.

-
-

6. The All Role

+
+

6. The All Role

The all role contains tasks that are executed on all of the institute's servers. At the moment there is just the one.

-
-

6.1. Include Particulars

+
+

6.1. Include Particulars

The all role's task contains a reference to a common institute particular, the institute's domain_name, a variable found in the public/vars.yml file. Thus the first task of the all role is to -include the variables defined in this file (described in The +include the variables defined in this file (described in The Particulars). The code block below is the first to tangle into roles/all/tasks/main.yml.

@@ -1635,8 +1647,8 @@ Particulars). The code block below is the first to tangle into
-
-

6.2. Enable Systemd Resolved

+
+

6.2. Enable Systemd Resolved

The systemd-networkd and systemd-resolved service units are not @@ -1657,8 +1669,7 @@ follows these recommendations (and not the suggestion to enable

-roles_t/all/tasks/main.yml

-- name: Install systemd-resolved.
+roles_t/all/tasks/main.yml
- name: Install systemd-resolved.
   become: yes
   apt: pkg=systemd-resolved
   when:
@@ -1705,19 +1716,18 @@ follows these recommendations (and not the suggestion to enable
-
-

6.3. Trust Institute Certificate Authority

+
+

6.3. Trust Institute Certificate Authority

All servers should recognize the institute's Certificate Authority as trustworthy, so its certificate is added to the set of trusted CAs on each host. More information about how the small institute manages its -X.509 certificates is available in Keys. +X.509 certificates is available in Keys.

-roles_t/all/tasks/main.yml

-- name: Trust the institute CA.
+roles_t/all/tasks/main.yml
- name: Trust the institute CA.
   become: yes
   copy:
     src: ../Secret/CA/pki/ca.crt
@@ -1739,15 +1749,15 @@ X.509 certificates is available in Keys.
-
-

7. The Front Role

+
+

7. The Front Role

The front role installs and configures the services expected on the institute's publicly accessible "front door": email, web, VPN. The virtual machine is prepared with an Ubuntu Server install and remote access to a privileged, administrator's account. (For details, see -The Front Machine.) +The Front Machine.)

@@ -1762,8 +1772,8 @@ perhaps with symbolic links to, for example, /etc/letsencrypt/live/small.example.org/fullchain.pem.

-
-

7.1. Role Defaults

+
+

7.1. Role Defaults

The front role sets a number of variables to default values in its @@ -1773,7 +1783,9 @@ The front role sets a number of variables to default values in its

roles_t/front/defaults/main.yml
---
 <<network-vars>>
+
 <<address-vars>>
+
 <<membership-rolls>>
@@ -1781,15 +1793,15 @@ The front role sets a number of variables to default values in its

The membership-rolls reference defines membership_rolls which is used to select an empty membership roll if one has not been written -yet. (See section 12.7.) +yet. (See section 12.7.)

-
-

7.2. Include Particulars

+
+

7.2. Include Particulars

-The first task, as in The All Role, is to include the institute +The first task, as in The All Role, is to include the institute particulars. The front role refers to private variables and the membership roll, so these are included was well.

@@ -1809,8 +1821,8 @@ membership roll, so these are included was well.
-
-

7.3. Configure Hostname

+
+

7.3. Configure Hostname

This task ensures that Front's /etc/hostname and /etc/mailname are @@ -1819,8 +1831,7 @@ delivery.

-roles_t/front/tasks/main.yml

-- name: Configure hostname.
+roles_t/front/tasks/main.yml
- name: Configure hostname.
   become: yes
   copy:
     content: "{{ domain_name }}\n"
@@ -1838,8 +1849,8 @@ delivery.
-
-

7.4. Add Administrator to System Groups

+
+

7.4. Add Administrator to System Groups

The administrator often needs to read (directories of) log files owned @@ -1848,8 +1859,7 @@ these groups speeds up debugging.

-roles_t/front/tasks/main.yml

-- name: Add {{ ansible_user }} to system groups.
+roles_t/front/tasks/main.yml
- name: Add {{ ansible_user }} to system groups.
   become: yes
   user:
     name: "{{ ansible_user }}"
@@ -1859,8 +1869,8 @@ these groups speeds up debugging.
-
-

7.5. Configure Monkey

+
+

7.5. Configure Monkey

The small institute runs cron jobs and web scripts that generate @@ -1868,14 +1878,13 @@ reports and perform checks. The un-privileged jobs are run by a system account named monkey. One of Monkey's more important jobs on Core is to run rsync to update the public web site on Front. Monkey on Core will login as monkey on Front to synchronize the files (as -described in *Configure Apache2). To do that without needing a +described in *Configure Apache2). To do that without needing a password, the monkey account on Front should authorize Monkey's SSH key on Core.

-roles_t/front/tasks/main.yml

-- name: Create monkey.
+roles_t/front/tasks/main.yml
- name: Create monkey.
   become: yes
   user:
     name: monkey
@@ -1898,51 +1907,48 @@ key on Core.
-
-

7.6. Install Rsync

+
+

7.6. Install Rsync

Monkey uses Rsync to keep the institute's public web site up-to-date.

-roles_t/front/tasks/main.yml

-- name: Install rsync.
+roles_t/front/tasks/main.yml
- name: Install rsync.
   become: yes
   apt: pkg=rsync
-
-

7.7. Install Unattended Upgrades

+
+

7.7. Install Unattended Upgrades

The institute prefers to install security updates as soon as possible.

-roles_t/front/tasks/main.yml

-- name: Install basic software.
+roles_t/front/tasks/main.yml
- name: Install basic software.
   become: yes
   apt: pkg=unattended-upgrades
-
-

7.8. Configure User Accounts

+
+

7.8. Configure User Accounts

User accounts are created immediately so that Postfix and Dovecot can start delivering email immediately, without returning "no such -recipient" replies. The Account Management chapter describes the +recipient" replies. The Account Management chapter describes the members and usernames variables used below.

-roles_t/front/tasks/main.yml

-- name: Create user accounts.
+roles_t/front/tasks/main.yml
- name: Create user accounts.
   become: yes
   user:
     name: "{{ item }}"
@@ -1974,8 +1980,8 @@ recipient" replies.  The Account Management chapter de
-
-

7.9. Install Server Certificate

+
+

7.9. Install Server Certificate

The servers on Front use the same certificate (and key) to @@ -1984,8 +1990,7 @@ and /etc/server.key files, the latter only readable by root.

-roles_t/front/tasks/main.yml

-- name: Install server certificate/key.
+roles_t/front/tasks/main.yml
- name: Install server certificate/key.
   become: yes
   copy:
     src: "{{ item.src }}"
@@ -2005,8 +2010,8 @@ and /etc/server.key files, the latter only readable by root.
-
-

7.10. Configure Postfix on Front

+
+

7.10. Configure Postfix on Front

Front uses Postfix to provide the institute's public SMTP service, and @@ -2023,7 +2028,7 @@ The appropriate answers are listed here but will be checked

-As discussed in The Email Service above, Front's Postfix configuration +As discussed in The Email Service above, Front's Postfix configuration includes site-wide support for larger message sizes, shorter queue times, the relaying configuration, and the common path to incoming emails. These and a few Front-specific Postfix configurations @@ -2036,7 +2041,7 @@ via which Core relays messages from the campus.

-postfix-front-networks
- p: mynetworks
+postfix-front-networks
- p: mynetworks
   v: >-
      {{ public_wg_net_cidr }}
      127.0.0.0/8
@@ -2052,7 +2057,7 @@ difficult for internal hosts, who do not have (public) domain names.
 

 
 

-postfix-front-restrictions
- p: smtpd_recipient_restrictions
+postfix-front-restrictions
- p: smtpd_recipient_restrictions
   v: >-
      permit_mynetworks
      reject_unauth_pipelining
@@ -2073,13 +2078,13 @@ messages; incoming messages are delivered locally, without
 

 
 

-postfix-header-checks
- p: smtp_header_checks
+postfix-header-checks
- p: smtp_header_checks
   v: regexp:/etc/postfix/header_checks.cf
 

 

 
 

-postfix-header-checks-content
/^Received:/    IGNORE
+postfix-header-checks-content
/^Received:/    IGNORE
 /^User-Agent:/  IGNORE
 

 

@@ -2091,7 +2096,7 @@ Debian default for inet_interfaces.
 

 
 

-postfix-front
- { p: smtpd_tls_cert_file, v: /etc/server.crt }
+postfix-front
- { p: smtpd_tls_cert_file, v: /etc/server.crt }
 - { p: smtpd_tls_key_file, v: /etc/server.key }
 <<postfix-front-networks>>
 <<postfix-front-restrictions>>
@@ -2110,8 +2115,7 @@ start and enable the service.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Install Postfix.
+roles_t/front/tasks/main.yml
- name: Install Postfix.
   become: yes
   apt: pkg=postfix
 
@@ -2167,8 +2171,8 @@ start and enable the service.
 

 

 

-

-
7.11. Configure Public Email Aliases

+

+
7.11. Configure Public Email Aliases

 

 

 The institute's Front needs to deliver email addressed to a number of
@@ -2201,8 +2205,7 @@ created by a more specialized role.
 

 
 

-roles_t/front/handlers/main.yml

-- name: New aliases.
+roles_t/front/handlers/main.yml
- name: New aliases.
   become: yes
   command: newaliases
   tags: actualizer
@@ -2210,8 +2213,8 @@ created by a more specialized role.
 

 

 

-

-
7.12. Configure OpenDKIM

+

+
7.12. Configure OpenDKIM

 

 

 Front uses OpenDKIM to sign outgoing emails.  It does not verify
@@ -2220,8 +2223,7 @@ OpenDKIM, and Postfix.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Install OpenDKIM.
+roles_t/front/tasks/main.yml
- name: Install OpenDKIM.
   become: yes
   apt: pkg=opendkim
 
@@ -2299,8 +2301,7 @@ OpenDKIM, and Postfix.
 

 
 

-roles_t/front/handlers/main.yml

-- name: Restart OpenDKIM.
+roles_t/front/handlers/main.yml
- name: Restart OpenDKIM.
   become: yes
   systemd:
     service: opendkim
@@ -2310,8 +2311,8 @@ OpenDKIM, and Postfix.
 

 

 

-

-
7.13. Configure Dovecot IMAPd

+

+
7.13. Configure Dovecot IMAPd

 

 

 Front uses Dovecot's IMAPd to allow user Fetchmail jobs on Core to
@@ -2320,7 +2321,7 @@ default with POP and IMAP (without TLS) support disabled.  This is a
 bit "over the top" given that Core accesses Front via VPN, but helps
 to ensure privacy even when members must, in extremis, access recent
 email directly from their accounts on Front.  For more information
-about Front's role in the institute's email services, see The Email
+about Front's role in the institute's email services, see The Email
 Service.
 

 
@@ -2339,8 +2340,7 @@ and enables it to start at every reboot.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Install Dovecot IMAPd.
+roles_t/front/tasks/main.yml
- name: Install Dovecot IMAPd.
   become: yes
   apt: pkg=dovecot-imapd
 
@@ -2390,8 +2390,7 @@ and enables it to start at every reboot.
 

 
 

-roles_t/front/handlers/main.yml

-- name: Restart Dovecot.
+roles_t/front/handlers/main.yml
- name: Restart Dovecot.
   become: yes
   systemd:
     service: dovecot
@@ -2401,8 +2400,8 @@ and enables it to start at every reboot.
 

 

 

-

-
7.14. Configure Apache2 

+

+
7.14. Configure Apache2 

 

 

 This is the small institute's public web site.  It is simple, static,
@@ -2438,7 +2437,7 @@ taken from https://www
 

 
 

-apache-ciphers
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+apache-ciphers
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
 SSLHonorCipherOrder on
 SSLCipherSuite {{ [ 'ECDHE-ECDSA-AES128-GCM-SHA256',
                     'ECDHE-ECDSA-AES256-GCM-SHA384',
@@ -2493,7 +2492,7 @@ used on all of the institute's web sites.
 

 
 

-apache-userdir-front
UserDir /home/www-users
+apache-userdir-front
UserDir /home/www-users
 <Directory /home/www-users/>
         Require all granted
         AllowOverride None
@@ -2508,7 +2507,7 @@ HTTPS URLs.
 

 
 

-apache-redirect-front
<VirtualHost *:80>
+apache-redirect-front
<VirtualHost *:80>
         Redirect permanent / https://{{ domain_name }}/
 </VirtualHost>
 

@@ -2533,7 +2532,7 @@ the inside of a VirtualHost block.  They should apply globally.
 

 
 

-apache-front
ServerName {{ domain_name }}
+apache-front
ServerName {{ domain_name }}
 ServerAdmin webmaster@{{ domain_name }}
 
 DocumentRoot /home/www
@@ -2568,8 +2567,7 @@ e.g. /etc/apache2/sites-available/small.example.org.conf and runs
 

 
 

-roles_t/front/tasks/main.yml

-- name: Install Apache2.
+roles_t/front/tasks/main.yml
- name: Install Apache2.
   become: yes
   apt: pkg=apache2
 
@@ -2619,8 +2617,7 @@ e.g. /etc/apache2/sites-available/small.example.org.conf and runs
 

 
 

-roles_t/front/handlers/main.yml

-- name: Restart Apache2.
+roles_t/front/handlers/main.yml
- name: Restart Apache2.
   become: yes
   systemd:
     service: apache2
@@ -2635,8 +2632,7 @@ that it does not interfere with its replacement.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Disable default vhosts.
+roles_t/front/tasks/main.yml
- name: Disable default vhosts.
   become: yes
   file:
     path: /etc/apache2/sites-enabled/{{ item }}
@@ -2653,8 +2649,7 @@ same records as access.log.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Disable other-vhosts-access-log option.
+roles_t/front/tasks/main.yml
- name: Disable other-vhosts-access-log option.
   become: yes
   file:
     path: /etc/apache2/conf-enabled/other-vhosts-access-log.conf
@@ -2669,8 +2664,7 @@ the users' ~/Public/HTML/ directories.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Create UserDir.
+roles_t/front/tasks/main.yml
- name: Create UserDir.
   become: yes
   file:
     path: /home/www-users/
@@ -2700,8 +2694,8 @@ the users' ~/Public/HTML/ directories.
 

 

 

-

-
7.15. Configure Public WireGuard™ Subnet

+

+
7.15. Configure Public WireGuard™ Subnet

 

 

 Front uses WireGuard™ to provide a public (Internet accessible) VPN
@@ -2716,8 +2710,7 @@ not exist), and enable the service.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Enable IP forwarding.
+roles_t/front/tasks/main.yml
- name: Enable IP forwarding.
   become: yes
   copy:
     content: "net.ipv4.ip_forward = 1\n"
@@ -2759,8 +2752,7 @@ not exist), and enable the service.
 

 
 

-roles_t/front/handlers/main.yml

-- name: Reload sysctl.
+roles_t/front/handlers/main.yml
- name: Reload sysctl.
   become: yes
   systemd:
     service: systemd-sysctl
@@ -2791,8 +2783,8 @@ The "empty" WireGuard™ configuration file (below) is used until the
 

 

 

-

-
7.15.1. Example private/front-wg0.conf

+

+
7.15.1. Example private/front-wg0.conf

 

 

 The example private/front-wg0.conf below recognizes Core by its
@@ -2859,8 +2851,8 @@ WireGuard™ tunnel on Dick's notebook, used abroad

 

 

-

-
7.16. Configure Kamailio

+

+
7.16. Configure Kamailio

 

 

 Front uses Kamailio to provide a SIP service on the public VPN so that
@@ -2882,7 +2874,7 @@ specifies the actual IP, known here as front_wg_addr.
 

 
 

-kamailio
listen=udp:{{ front_wg_addr }}:5060
+kamailio
listen=udp:{{ front_wg_addr }}:5060
 

 

 
@@ -2898,8 +2890,7 @@ The first step is to install Kamailio.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Install Kamailio.
+roles_t/front/tasks/main.yml
- name: Install Kamailio.
   become: yes
   apt: pkg=kamailio
 

@@ -2913,8 +2904,7 @@ not be started before the wg0 device has appeared.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Create Kamailio/Systemd configuration drop.
+roles_t/front/tasks/main.yml
- name: Create Kamailio/Systemd configuration drop.
   become: yes
   file:
     path: /etc/systemd/system/kamailio.service.d
@@ -2933,8 +2923,7 @@ not be started before the wg0 device has appeared.
 

 
 

-roles_t/front/handlers/main.yml

-- name: Reload Systemd.
+roles_t/front/handlers/main.yml
- name: Reload Systemd.
   become: yes
   systemd:
     daemon-reload: yes
@@ -2946,8 +2935,7 @@ Finally, Kamailio can be configured and started.
 

 
 

-roles_t/front/tasks/main.yml

-- name: Configure Kamailio.
+roles_t/front/tasks/main.yml
- name: Configure Kamailio.
   become: yes
   copy:
     content: |
@@ -2971,8 +2959,7 @@ Finally, Kamailio can be configured and started.
 

 
 

-roles_t/front/handlers/main.yml

-- name: Restart Kamailio.
+roles_t/front/handlers/main.yml
- name: Restart Kamailio.
   become: yes
   systemd:
     service: kamailio
@@ -2983,39 +2970,41 @@ Finally, Kamailio can be configured and started.
 

 

 

-

-
8. The Core Role

+

+
8. The Core Role

 

 

 The core role configures many essential campus network services as
 well as the institute's private cloud, so the core machine has
 horsepower (CPUs and RAM) and large disks and is prepared with a
 Debian install and remote access to a privileged, administrator's
-account.  (For details, see The Core Machine.)
+account.  (For details, see The Core Machine.)
 

 

-

-
8.1. Role Defaults

+

+
8.1. Role Defaults

 

 

-As in The Front Role, the core role sets a number of variables to
+As in The Front Role, the core role sets a number of variables to
 default values in its defaults/main.yml file.
 

 
 

 roles_t/core/defaults/main.yml
---
 <<network-vars>>
+
 <<address-vars>>
+
 <<membership-rolls>>
 

 

 

 

-

-
8.2. Include Particulars

+

+
8.2. Include Particulars

 

 

-The first task, as in The Front Role, is to include the institute
+The first task, as in The Front Role, is to include the institute
 particulars and membership roll.
 

 
@@ -3036,8 +3025,8 @@ particulars and membership roll.
 

 

 

-

-
8.3. Configure Hostname

+

+
8.3. Configure Hostname

 

 

 This task ensures that Core's /etc/hostname and /etc/mailname are
@@ -3048,8 +3037,7 @@ proper email delivery.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Configure hostname.
+roles_t/core/tasks/main.yml
- name: Configure hostname.
   become: yes
   copy:
     content: "{{ item.name }}\n"
@@ -3067,8 +3055,8 @@ proper email delivery.
 

 

 

-

-
8.4. Configure Systemd Resolved

+

+
8.4. Configure Systemd Resolved

 

 

 Core runs the campus name server, so Resolved is configured to use it
@@ -3077,8 +3065,7 @@ list, and to disable its cache and stub listener.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Configure resolved.
+roles_t/core/tasks/main.yml
- name: Configure resolved.
   become: yes
   lineinfile:
     path: /etc/systemd/resolved.conf
@@ -3112,8 +3099,8 @@ list, and to disable its cache and stub listener.
 

 

 

-

-
8.5. Configure Core NetworkD

+

+
8.5. Configure Core NetworkD

 

 

 Core's network interface is statically configured using the
@@ -3147,8 +3134,7 @@ fact was an empty hash at first boot on a simulated campus Ethernet.)
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install 10-lan.link.
+roles_t/core/tasks/main.yml
- name: Install 10-lan.link.
   become: yes
   copy:
     content: |
@@ -3175,8 +3161,7 @@ fact was an empty hash at first boot on a simulated campus Ethernet.)
 

 
 

-roles_t/core/handlers/main.yml

-- name: Reload networkd.
+roles_t/core/handlers/main.yml
- name: Reload networkd.
   become: yes
   command: networkctl reload
   tags: actualizer
@@ -3184,8 +3169,8 @@ fact was an empty hash at first boot on a simulated campus Ethernet.)
 

 

 

-

-
8.6. Configure DHCP For the Private Ethernet

+

+
8.6. Configure DHCP For the Private Ethernet

 

 

 Core speaks DHCP (Dynamic Host Configuration Protocol) using the
@@ -3240,8 +3225,7 @@ the real private/core-dhcpd.conf (<
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install DHCP server.
+roles_t/core/tasks/main.yml
- name: Install DHCP server.
   become: yes
   apt: pkg=isc-dhcp-server
 
@@ -3276,8 +3260,7 @@ the real private/core-dhcpd.conf (<
 

 
 

-roles_t/core/handlers/main.yml

-- name: Restart DHCP server.
+roles_t/core/handlers/main.yml
- name: Restart DHCP server.
   become: yes
   systemd:
     service: isc-dhcp-server
@@ -3287,12 +3270,12 @@ the real private/core-dhcpd.conf (<
 

 

 

-

-
8.7. Configure BIND9

+

+
8.7. Configure BIND9

 

 

 Core uses BIND9 to provide name service for the institute as described
-in The Name Service.  The configuration supports reverse name lookups,
+in The Name Service.  The configuration supports reverse name lookups,
 resolving many private network addresses to private domain names.
 

 
@@ -3301,8 +3284,7 @@ The following tasks install and configure BIND9 on Core.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install BIND9.
+roles_t/core/tasks/main.yml
- name: Install BIND9.
   become: yes
   apt: pkg=bind9
 
@@ -3346,8 +3328,7 @@ The following tasks install and configure BIND9 on Core.
 

 
 

-roles_t/core/handlers/main.yml

-- name: Reload BIND9.
+roles_t/core/handlers/main.yml
- name: Reload BIND9.
   become: yes
   systemd:
     service: bind9
@@ -3364,7 +3345,7 @@ probably be used as forwarders rather than Google.
 

 
 

-bind-options
acl "trusted" {
+bind-options
acl "trusted" {
         {{ private_net_cidr }};
         {{ public_wg_net_cidr }};
         {{ campus_wg_net_cidr }};
@@ -3394,7 +3375,7 @@ probably be used as forwarders rather than Google.
 

 
 

-bind-local
include "/etc/bind/zones.rfc1918";
+bind-local
include "/etc/bind/zones.rfc1918";
 
 zone "{{ domain_priv }}." {
         type master;
@@ -3506,8 +3487,8 @@ probably be used as forwarders rather than Google.
 

 

 

-

-
8.8. Add Administrator to System Groups

+

+
8.8. Add Administrator to System Groups

 

 

 The administrator often needs to read (directories of) log files owned
@@ -3516,8 +3497,7 @@ these groups speeds up debugging.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Add {{ ansible_user }} to system groups.
+roles_t/core/tasks/main.yml
- name: Add {{ ansible_user }} to system groups.
   become: yes
   user:
     name: "{{ ansible_user }}"
@@ -3527,20 +3507,19 @@ these groups speeds up debugging.
 

 

 

-

-
8.9. Configure Monkey

+

+
8.9. Configure Monkey

 

 

 The small institute runs cron jobs and web scripts that generate
 reports and perform checks.  The un-privileged jobs are run by a
 system account named monkey.  One of Monkey's more important jobs on
 Core is to run rsync to update the public web site on Front (as
-described in *Configure Apache2).
+described in *Configure Apache2).
 

 
 

-roles_t/core/tasks/main.yml

-- name: Create monkey.
+roles_t/core/tasks/main.yml
- name: Create monkey.
   become: yes
   user:
     name: monkey
@@ -3593,34 +3572,32 @@ described in *Configure Apache2).
 

 

 

-

-
8.10. Install Unattended Upgrades

+

+
8.10. Install Unattended Upgrades

 

 

 The institute prefers to install security updates as soon as possible.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install basic software.
+roles_t/core/tasks/main.yml
- name: Install basic software.
   become: yes
   apt: pkg=unattended-upgrades
 

 

 

 

-

-
8.11. Configure User Accounts

+

+
8.11. Configure User Accounts

 

 

 User accounts are created immediately so that backups can begin
-restoring as soon as possible.  The Account Management chapter
+restoring as soon as possible.  The Account Management chapter
 describes the members and usernames variables.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Create user accounts.
+roles_t/core/tasks/main.yml
- name: Create user accounts.
   become: yes
   user:
     name: "{{ item }}"
@@ -3652,8 +3629,8 @@ describes the members and usernames variables.
 

 

 

-

-
8.12. Install Server Certificate

+

+
8.12. Install Server Certificate

 

 

 The servers on Core use the same certificate (and key) to authenticate
@@ -3662,8 +3639,7 @@ to institute clients.  They share the /etc/server.crt and
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install server certificate/key.
+roles_t/core/tasks/main.yml
- name: Install server certificate/key.
   become: yes
   copy:
     src: "{{ item.src }}"
@@ -3683,8 +3659,8 @@ to institute clients.  They share the /etc/server.crt and
 

 

 

-

-
8.13. Install Chrony

+

+
8.13. Install Chrony

 

 

 Core uses Chrony to provide a time synchronization service to the campus.
@@ -3692,8 +3668,7 @@ The default daemon's default configuration is fine.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install Chrony.
+roles_t/core/tasks/main.yml
- name: Install Chrony.
   become: yes
   apt: pkg=chrony
 
@@ -3710,8 +3685,7 @@ The default daemon's default configuration is fine.
 

 
 

-roles_t/core/handlers/main.yml

-- name: Restart Chrony.
+roles_t/core/handlers/main.yml
- name: Restart Chrony.
   become: yes
   systemd:
     service: chrony
@@ -3720,8 +3694,8 @@ The default daemon's default configuration is fine.
 

 

 

-

-
8.14. Configure Postfix on Core

+

+
8.14. Configure Postfix on Core

 

 

 Core uses Postfix to provide SMTP service to the campus.  The default
@@ -3737,7 +3711,7 @@ The appropriate answers are listed here but will be checked
 
 
 

-As discussed in The Email Service above, Core delivers email addressed
+As discussed in The Email Service above, Core delivers email addressed
 to any internal domain name locally, and uses its smarthost Front to
 relay the rest.  Core is reachable only on institute networks, so
 there is little benefit in enabling TLS, but it does need to handle
@@ -3750,7 +3724,7 @@ Core relays messages from any institute network.
 

 
 

-postfix-core-networks
- p: mynetworks
+postfix-core-networks
- p: mynetworks
   v: >-
      {{ private_net_cidr }}
      {{ public_wg_net_cidr }}
@@ -3766,7 +3740,7 @@ Core uses Front to relay messages to the Internet.
 

 
 

-postfix-core-relayhost
- { p: relayhost, v: "[{{ front_wg_addr }}]" }
+postfix-core-relayhost
- { p: relayhost, v: "[{{ front_wg_addr }}]" }
 

 

 
@@ -3778,7 +3752,7 @@ file.
 

 
 

-postfix-transport
.{{ domain_name }}      local:$myhostname
+postfix-transport
.{{ domain_name }}      local:$myhostname
 .{{ domain_priv }}      local:$myhostname
 

 

@@ -3789,7 +3763,7 @@ The complete list of Core's Postfix settings for
 

 
 

-postfix-core
<<postfix-relaying>>
+postfix-core
<<postfix-relaying>>
 - { p: smtpd_tls_security_level, v: none }
 - { p: smtp_tls_security_level, v: none }
 <<postfix-message-size>>
@@ -3809,8 +3783,7 @@ enable the service.  Whenever /etc/postfix/transport is changed, the
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install Postfix.
+roles_t/core/tasks/main.yml
- name: Install Postfix.
   become: yes
   apt: pkg=postfix
 
@@ -3849,8 +3822,7 @@ enable the service.  Whenever /etc/postfix/transport is changed, the
 

 
 

-roles_t/core/handlers/main.yml

-- name: Restart Postfix.
+roles_t/core/handlers/main.yml
- name: Restart Postfix.
   become: yes
   systemd:
     service: postfix
@@ -3867,8 +3839,8 @@ enable the service.  Whenever /etc/postfix/transport is changed, the
 

 

 

-

-
8.15. Configure Private Email Aliases

+

+
8.15. Configure Private Email Aliases

 

 

 The institute's Core needs to deliver email addressed to institute
@@ -3880,8 +3852,7 @@ installed by more specialized roles.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install institute email aliases.
+roles_t/core/tasks/main.yml
- name: Install institute email aliases.
   become: yes
   blockinfile:
     block: |
@@ -3896,8 +3867,7 @@ installed by more specialized roles.
 

 
 

-roles_t/core/handlers/main.yml

-- name: New aliases.
+roles_t/core/handlers/main.yml
- name: New aliases.
   become: yes
   command: newaliases
   tags: actualizer
@@ -3905,8 +3875,8 @@ installed by more specialized roles.
 

 

 

-

-
8.16. Configure Dovecot IMAPd

+

+
8.16. Configure Dovecot IMAPd

 

 

 Core uses Dovecot's IMAPd to store and serve member emails.  As on
@@ -3916,7 +3886,7 @@ top" given that Core is only accessed from private (encrypted)
 networks, but helps to ensure privacy even when members accidentally
 attempt connections from outside the private networks.  For more
 information about Core's role in the institute's email services, see
-The Email Service.
+The Email Service.
 

 
 

@@ -3924,7 +3894,7 @@ The institute follows the recommendation in the package
 README.Debian (in /usr/share/dovecot-core/) but replaces the
 default "snake oil" certificate with another, signed by the institute.
 (For more information about the institute's X.509 certificates, see
-Keys.)
+Keys.)
 

 
 

@@ -3934,8 +3904,7 @@ and enables it to start at every reboot.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install Dovecot IMAPd.
+roles_t/core/tasks/main.yml
- name: Install Dovecot IMAPd.
   become: yes
   apt: pkg=dovecot-imapd
 
@@ -3983,8 +3952,7 @@ and enables it to start at every reboot.
 

 
 

-roles_t/core/handlers/main.yml

-- name: Restart Dovecot.
+roles_t/core/handlers/main.yml
- name: Restart Dovecot.
   become: yes
   systemd:
     service: dovecot
@@ -3994,8 +3962,8 @@ and enables it to start at every reboot.
 

 

 

-

-
8.17. Configure Fetchmail

+

+
8.17. Configure Fetchmail

 

 

 Core runs a fetchmail for each member of the institute.  Individual
@@ -4012,7 +3980,7 @@ the username.  The template is only used when the record has a
 

 
 

-fetchmail-config
# Permissions on this file may be no greater than 0600.
+fetchmail-config
# Permissions on this file may be no greater than 0600.
 
 set no bouncemail
 set no spambounce
@@ -4031,7 +3999,7 @@ The Systemd service description.
 

 
 

-fetchmail-service
[Unit]
+fetchmail-service
[Unit]
 Description=Fetchmail --idle task for {{ item }}.
 AssertPathExists=/home/{{ item }}/.fetchmailrc
 After=wg-quick@wg0.service
@@ -4059,8 +4027,7 @@ provided the Core service.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install fetchmail.
+roles_t/core/tasks/main.yml
- name: Install fetchmail.
   become: yes
   apt: pkg=fetchmail
 
@@ -4113,8 +4080,7 @@ stopped and disabled from restarting at boot, deleted even.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Stop former user fetchmail services.
+roles_t/core/tasks/main.yml
- name: Stop former user fetchmail services.
   become: yes
   systemd:
     service: fetchmail-{{ item }}
@@ -4135,8 +4101,7 @@ Otherwise the following task might be appropriate.
 

 
 

-

-- name: Delete former user fetchmail services.
+
- name: Delete former user fetchmail services.
   become: yes
   file:
     path: /etc/systemd/system/fetchmail-{{ item }}.service
@@ -4151,12 +4116,12 @@ Otherwise the following task might be appropriate.
 

 

 

-

-
8.18. Configure Apache2 

+

+
8.18. Configure Apache2 

 

 

 This is the small institute's campus web server.  It hosts several web
-sites as described in The Web Services.
+sites as described in The Web Services.
 

 
 
@@ -4227,7 +4192,7 @@ naming a sub-directory in the member's home directory on Core.  The
 

-apache-userdir-core
UserDir Public/HTML
+apache-userdir-core
UserDir Public/HTML
 <Directory /home/*/Public/HTML/>
         Require all granted
         AllowOverride None
@@ -4242,7 +4207,7 @@ redirect, the encryption ciphers and certificates.
 

 
 

-apache-live
<VirtualHost *:80>
+apache-live
<VirtualHost *:80>
         ServerName live
         ServerAlias live.{{ domain_priv }}
         ServerAdmin webmaster@core.{{ domain_priv }}
@@ -4269,7 +4234,7 @@ familiar.
 

 
 

-apache-test
<VirtualHost *:80>
+apache-test
<VirtualHost *:80>
         ServerName test
         ServerAlias test.{{ domain_priv }}
         ServerAdmin webmaster@core.{{ domain_priv }}
@@ -4298,7 +4263,7 @@ trained staffers, monitored by a revision control system, etc.
 

 
 

-apache-campus
<VirtualHost *:80>
+apache-campus
<VirtualHost *:80>
         ServerName www
         ServerAlias www.{{ domain_priv }}
         ServerAdmin webmaster@core.{{ domain_priv }}
@@ -4326,8 +4291,7 @@ The tasks below install Apache2 and edit its default configuration.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install Apache2.
+roles_t/core/tasks/main.yml
- name: Install Apache2.
   become: yes
   apt: pkg=apache2
 
@@ -4359,8 +4323,7 @@ The a2ensite command enables them.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install live web site.
+roles_t/core/tasks/main.yml
- name: Install live web site.
   become: yes
   copy:
     content: |
@@ -4411,8 +4374,7 @@ The a2ensite command enables them.
 

 
 

-roles_t/core/handlers/main.yml

-- name: Restart Apache2.
+roles_t/core/handlers/main.yml
- name: Restart Apache2.
   become: yes
   systemd:
     service: apache2
@@ -4422,8 +4384,8 @@ The a2ensite command enables them.
 

 

 

-

-
8.19. Configure Website Updates

+

+
8.19. Configure Website Updates

 

 

 Monkey on Core runs /usr/local/sbin/webupdate every 15 minutes via a
@@ -4432,7 +4394,7 @@ Monkey on Core runs /usr/local/sbin/webupdate every 15 minutes via a
 

 
 

-private/webupdate
#!/bin/bash -e
+private/webupdate
#!/bin/bash -e
 #
 # DO NOT EDIT.
 #
@@ -4450,12 +4412,11 @@ rsync -avz --delete --chmod=g-w         \
 The following tasks install the webupdate script from private/,
 and create Monkey's cron job.  An example webupdate script is
-provided here.
+provided here.
 

 
 

-roles_t/core/tasks/main.yml

-- name: "Install Monkey's webupdate script."
+roles_t/core/tasks/main.yml
- name: "Install Monkey's webupdate script."
   become: yes
   copy:
     src: ../private/webupdate
@@ -4475,12 +4436,12 @@ provided here.
 

 

 

-

-
8.20. Configure Core WireGuard™ Interface

+

+
8.20. Configure Core WireGuard™ Interface

 

 

 Core connects to Front's WireGuard™ service to provide members abroad
-with a route to the campus networks.  As described in Configure Public
+with a route to the campus networks.  As described in Configure Public
 WireGuard™ Subnet for Front, Core is expected to forward packets from/to the
 private networks.
 

@@ -4491,8 +4452,7 @@ service.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Enable IP forwarding.
+roles_t/core/tasks/main.yml
- name: Enable IP forwarding.
   become: yes
   copy:
     content: "net.ipv4.ip_forward = 1\n"
@@ -4539,8 +4499,7 @@ service.
 

 
 

-roles_t/core/handlers/main.yml

-- name: Reload sysctl.
+roles_t/core/handlers/main.yml
- name: Reload sysctl.
   become: yes
   systemd:
     service: systemd-sysctl
@@ -4556,8 +4515,8 @@ service.
 

 

 

-

-
8.21. Configure NAGIOS

+

+
8.21. Configure NAGIOS

 

 

 Core runs a nagios4 server to monitor "services" on institute hosts.
@@ -4576,8 +4535,7 @@ Core and Campus (and thus Gate) machines.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install NAGIOS4.
+roles_t/core/tasks/main.yml
- name: Install NAGIOS4.
   become: yes
   apt:
     pkg: [ nagios4, monitoring-plugins-basic, nagios-nrpe-plugin,
@@ -4636,8 +4594,7 @@ Core and Campus (and thus Gate) machines.
 

 
 

-roles_t/core/handlers/main.yml

-- name: Reload NAGIOS4.
+roles_t/core/handlers/main.yml
- name: Reload NAGIOS4.
   become: yes
   systemd:
     service: nagios4
@@ -4646,8 +4603,8 @@ Core and Campus (and thus Gate) machines.
 

 

 

-

-
8.21.1. Configure NAGIOS Monitors for Core

+

+
8.21.1. Configure NAGIOS Monitors for Core

 

 

 The first block in nagios.cfg specifies monitors for services on
@@ -4722,8 +4679,8 @@ used here may specify plugin arguments.
 

 

 

-

-
8.21.2. Custom NAGIOS Monitor inst_sensors

+

+
8.21.2. Custom NAGIOS Monitor inst_sensors

 

 

 The check_sensors plugin is included in the package
@@ -4819,8 +4776,7 @@ Core.
 

 
 

-roles_t/core/templates/nagios.cfg

-define command {
+roles_t/core/templates/nagios.cfg
define command {
     command_name            inst_sensors
     command_line            /usr/local/sbin/inst_sensors
 }
@@ -4835,8 +4791,8 @@ Core.
 

 

 

-

-
8.21.3. Configure NAGIOS Monitors for Remote Hosts

+

+
8.21.3. Configure NAGIOS Monitors for Remote Hosts

 

 

 The following sections contain code blocks specifying monitors for
@@ -4853,12 +4809,12 @@ plugin with pre-defined arguments appropriate for the institute.  The
 commands are defined in code blocks interleaved with the blocks that
 monitor them.  The command blocks are appended to nrpe.cfg and the
 monitoring blocks to nagios.cfg.  The nrpe.cfg file is installed
-on each campus host by the campus role's Configure NRPE tasks.
+on each campus host by the campus role's Configure NRPE tasks.
 

 

 

-

-
8.21.4. Configure NAGIOS Monitors for Gate

+

+
8.21.4. Configure NAGIOS Monitors for Gate

 

 

 Define the monitored host, gate.  Monitor its response to network
@@ -4866,8 +4822,7 @@ pings.
 

 
 

-roles_t/core/templates/nagios.cfg

-define host {
+roles_t/core/templates/nagios.cfg
define host {
     use                     linux-server
     host_name               gate
     address                 {{ gate_addr }}
@@ -4890,8 +4845,7 @@ Monitor inst_root on Gate.
 

 
 

-roles_t/core/templates/nagios.cfg

-define service {
+roles_t/core/templates/nagios.cfg
define service {
     use                     generic-service
     host_name               gate
     service_description     Root Partition
@@ -4905,8 +4859,7 @@ Monitor check_load on Gate.
 

 
 

-roles_t/core/templates/nagios.cfg

-define service {
+roles_t/core/templates/nagios.cfg
define service {
     use                     generic-service
     host_name               gate
     service_description     Current Load
@@ -4920,8 +4873,7 @@ Monitor check_zombie_procs and check_total_procs on Ga
 

 
 

-roles_t/core/templates/nagios.cfg

-define service {
+roles_t/core/templates/nagios.cfg
define service {
     use                     generic-service
     host_name               gate
     service_description     Zombie Processes
@@ -4952,8 +4904,7 @@ Monitor inst_swap on Gate.
 

 
 

-roles_t/core/templates/nagios.cfg

-define service {
+roles_t/core/templates/nagios.cfg
define service {
     use                     generic-service
     host_name               gate
     service_description     Swap Usage
@@ -4977,8 +4928,7 @@ Monitor inst_sensors on Gate.
 

 
 

-roles_t/core/templates/nagios.cfg

-define service {
+roles_t/core/templates/nagios.cfg
define service {
     use                     generic-service
     host_name               gate
     service_description     Temperature Sensors
@@ -4989,17 +4939,16 @@ Monitor inst_sensors on Gate.
 

 

 

-

-
8.22. Configure Backups

+

+
8.22. Configure Backups

 

 

 The following task installs the backup script from private/.  An
-example script is provided in here.
+example script is provided in here.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install backup script.
+roles_t/core/tasks/main.yml
- name: Install backup script.
   become: yes
   copy:
     src: ../private/backup
@@ -5009,20 +4958,20 @@ example script is provided in here.
 

 

 

-

-
8.23. Configure Nextcloud

+

+
8.23. Configure Nextcloud

 

 

 Core runs Nextcloud to provide a private institute cloud, as described
-in The Cloud Service.  Installing, restoring (from backup), and
+in The Cloud Service.  Installing, restoring (from backup), and
 upgrading Nextcloud are manual processes documented in The Nextcloud
 Admin Manual, Maintenance.  However Ansible can help prepare Core
 before an install or restore, and perform basic security checks
 afterwards.
 

 

-

-
8.23.1. Prepare Core For Nextcloud

+

+
8.23.1. Prepare Core For Nextcloud

 

 

 The Ansible code contained herein prepares Core to run Nextcloud by
@@ -5031,8 +4980,7 @@ installing a cron job.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Install packages required by Nextcloud.
+roles_t/core/tasks/main.yml
- name: Install packages required by Nextcloud.
   become: yes
   apt:
     pkg: [ apache2, mariadb-server, php, php-apcu, php-bcmath,
@@ -5047,8 +4995,7 @@ Next, a number of Apache2 modules are enabled.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Enable Apache2 modules for Nextcloud.
+roles_t/core/tasks/main.yml
- name: Enable Apache2 modules for Nextcloud.
   become: yes
   apache2_module:
     name: "{{ item }}"
@@ -5080,8 +5027,7 @@ Administration Guide (sub-section 
-roles_t/core/tasks/main.yml

-- name: Install Nextcloud web configuration.
+roles_t/core/tasks/main.yml
- name: Install Nextcloud web configuration.
   become: yes
   copy:
     src: nextcloud.conf
@@ -5105,8 +5051,7 @@ virtual host's document root.
 

 
 

-roles_t/core/files/nextcloud.conf

-<Directory /var/www/html/>
+roles_t/core/files/nextcloud.conf
<Directory /var/www/html/>
     <IfModule mod_rewrite.c>
         RewriteEngine on
         # LogLevel alert rewrite:trace3
@@ -5131,8 +5076,7 @@ page.  The following portion of nextcloud.conf sets a
 

 
 

-roles_t/core/files/nextcloud.conf

-<IfModule mod_headers.c>
+roles_t/core/files/nextcloud.conf
<IfModule mod_headers.c>
     Header always set \
         Strict-Transport-Security "max-age=15552000; includeSubDomains"
 </IfModule>
@@ -5147,8 +5091,7 @@ cloud FUBARs.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Add {{ ansible_user }} to web server group.
+roles_t/core/tasks/main.yml
- name: Add {{ ansible_user }} to web server group.
   become: yes
   user:
     name: "{{ ansible_user }}"
@@ -5163,8 +5106,7 @@ jobs.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Create Nextcloud cron job.
+roles_t/core/tasks/main.yml
- name: Create Nextcloud cron job.
   become: yes
   cron:
     minute: 11,26,41,56
@@ -5194,8 +5136,7 @@ the following task can create Nextcloud's DB.
 

 
 

-

-- name: Create Nextcloud DB.
+
- name: Create Nextcloud DB.
   become: yes
   mysql_db:
     check_implicit_admin: yes
@@ -5213,8 +5154,7 @@ created manually.
 

 
 

-

-- name: Create Nextcloud DB user.
+
- name: Create Nextcloud DB user.
   become: yes
   mysql_user:
     check_implicit_admin: yes
@@ -5251,8 +5191,7 @@ its document root.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Link /var/www/nextcloud.
+roles_t/core/tasks/main.yml
- name: Link /var/www/nextcloud.
   become: yes
   file:
     path: /var/www/nextcloud
@@ -5264,8 +5203,8 @@ its document root.
 

 

 

-

-
8.23.2. Configure PHP

+

+
8.23.2. Configure PHP

 

 

 The following tasks set a number of PHP parameters for better
@@ -5273,8 +5212,7 @@ performance, as recommended by Nextcloud.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Set PHP memory_limit for Nextcloud.
+roles_t/core/tasks/main.yml
- name: Set PHP memory_limit for Nextcloud.
   become: yes
   lineinfile:
     path: /etc/php/8.2/apache2/php.ini
@@ -5308,8 +5246,8 @@ performance, as recommended by Nextcloud.
 

 

 

-

-
8.23.3. Create /Nextcloud/

+

+
8.23.3. Create /Nextcloud/

 

 

 The Ansible tasks up to this point have completed Core's LAMP stack
@@ -5367,8 +5305,8 @@ sudo mount /Nextcloud
 

 

 

-

-
8.23.4. Restore Nextcloud

+

+
8.23.4. Restore Nextcloud

 

 

 Restoring Nextcloud in the newly created /Nextcloud/ presumably
@@ -5427,8 +5365,8 @@ Overview web page.
 

 

 

-

-
8.23.5. Install Nextcloud

+

+
8.23.5. Install Nextcloud

 

 

 Installing Nextcloud in the newly created /Nextcloud/ starts with
@@ -5497,8 +5435,8 @@ Administration > Overview page.
 

 

 

-

-
8.23.6. Afterwards

+

+
8.23.6. Afterwards

 

 

 Whether Nextcloud was restored or installed, there are a few things
@@ -5511,8 +5449,7 @@ afterwards tasks causes them to skip rather than fail.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Test for /Nextcloud/nextcloud/.
+roles_t/core/tasks/main.yml
- name: Test for /Nextcloud/nextcloud/.
   stat:
     path: /Nextcloud/nextcloud
   register: nextcloud
@@ -5542,8 +5479,7 @@ Pretty URLs (below).
 

 
 

-roles_t/core/tasks/main.yml

-- name: Configure Nextcloud trusted domains.
+roles_t/core/tasks/main.yml
- name: Configure Nextcloud trusted domains.
   become: yes
   replace:
     path: /var/www/nextcloud/config/config.php
@@ -5574,8 +5510,7 @@ enables it.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Configure Nextcloud memcache.
+roles_t/core/tasks/main.yml
- name: Configure Nextcloud memcache.
   become: yes
   lineinfile:
     path: /var/www/nextcloud/config/config.php
@@ -5596,8 +5531,7 @@ and htaccess.RewriteBase.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Configure Nextcloud for Pretty URLs.
+roles_t/core/tasks/main.yml
- name: Configure Nextcloud for Pretty URLs.
   become: yes
   lineinfile:
     path: /var/www/nextcloud/config/config.php
@@ -5642,8 +5576,7 @@ unedited copy of the parameters SMTP and not by Sendmail nor Qmail.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Configure Nextcloud settings.
+roles_t/core/tasks/main.yml
- name: Configure Nextcloud settings.
   become: yes
   lineinfile:
     path: /var/www/nextcloud/config/config.php
@@ -5678,8 +5611,7 @@ run before the next backup.
 

 
 

-roles_t/core/tasks/main.yml

-- name: Create /Nextcloud/dbbackup.cnf.
+roles_t/core/tasks/main.yml
- name: Create /Nextcloud/dbbackup.cnf.
   no_log: yes
   become: yes
   copy:
@@ -5708,14 +5640,14 @@ run before the next backup.
 

 

 

-

-
9. The Gate Role

+

+
9. The Gate Role

 

 

 The gate role configures the services expected at the campus gate:
 access to the private Ethernet from the untrusted Ethernet (e.g. a
 campus Wi-Fi AP) via VPN, and access to the Internet via NAT.  The
-gate machine uses three network interfaces (see The Gate Machine)
+gate machine uses three network interfaces (see The Gate Machine)
 configured with persistent names used in its firewall rules.
 

 
@@ -5737,24 +5669,25 @@ applied first, by which Gate gets a campus machine's DNS and Postfix
 configurations, etc.
 

 

-

-
9.1. Role Defaults

+

+
9.1. Role Defaults

 

 

-As in The Core Role, the gate role sets a number of variables to
+As in The Core Role, the gate role sets a number of variables to
 default values in its defaults/main.yml file.
 

 
 

 roles_t/gate/defaults/main.yml
---
 <<network-vars>>
+
 <<address-vars>>
 

 

 

 

-

-
9.2. Include Particulars

+

+
9.2. Include Particulars

 

 

 The following should be familiar boilerplate by now.
@@ -5771,8 +5704,8 @@ The following should be familiar boilerplate by now.
 

 

 

-

-
9.3. Configure Gate NetworkD

+

+
9.3. Configure Gate NetworkD

 

 

 Gate's network interfaces are configured by .link and .network
@@ -5791,7 +5724,7 @@ gate_isp_mac:               08:00:27:3d:42:e5
 
 

 Note that the .network files do not use the interface names for
-reasons discussed in the 8.5 section.
+reasons discussed in the 8.5 section.
 

 
 

@@ -5799,8 +5732,8 @@ The tasks in the following sections install the necessary
 configuration files.
 

 

-

-
9.3.1. Gate's lan Interface

+

+
9.3.1. Gate's lan Interface

 

 

 The campus Ethernet interface is named lan and configured by
@@ -5808,8 +5741,7 @@ The campus Ethernet interface is named lan and configured by
 

 
 

-roles_t/gate/tasks/main.yml

-- name: Install 10-lan.link.
+roles_t/gate/tasks/main.yml
- name: Install 10-lan.link.
   become: yes
   copy:
     content: |
@@ -5848,8 +5780,8 @@ The campus Ethernet interface is named lan and configured by
 

 

 

-

-
9.3.2. Gate's wild Interface

+

+
9.3.2. Gate's wild Interface

 

 

 The institute keeps the wild ones off the campus Ethernet.  Its wild
@@ -5883,8 +5815,7 @@ configured by 10-wild.link and 10-wild.network files in
 

 
 

-roles_t/gate/tasks/main.yml

-- name: Install 10-wild.link.
+roles_t/gate/tasks/main.yml
- name: Install 10-wild.link.
   become: yes
   copy:
     content: |
@@ -5926,8 +5857,8 @@ configured by 10-wild.link and 10-wild.network files in
 

 

 

-

-
9.3.3. Gate's isp Interface

+

+
9.3.3. Gate's isp Interface

 

 

 The interface to the campus ISP is named isp and configured by
@@ -5938,8 +5869,7 @@ tether, Wi-Fi connection, etc.
 

 
 

-roles_t/gate/tasks/main.yml

-- name: Install 10-isp.link.
+roles_t/gate/tasks/main.yml
- name: Install 10-isp.link.
   become: yes
   copy:
     content: |
@@ -6027,8 +5957,8 @@ and re-load the firewall rules with that new naming.
 

 

 

-

-
9.4. Configure Gate ResolveD

+

+
9.4. Configure Gate ResolveD

 

 

 Gate provides name service on the wild Ethernet by having its "stub
@@ -6037,8 +5967,7 @@ listener" listen there.  That stub should not read /etc/hosts lest
 

 
 

-roles_t/gate/tasks/main.yml

-- name: Configure resolved.
+roles_t/gate/tasks/main.yml
- name: Configure resolved.
   become: yes
   lineinfile:
     path: /etc/systemd/resolved.conf
@@ -6056,8 +5985,7 @@ listener" listen there.  That stub should not read /etc/hosts lest
 

 
 

-roles_t/gate/handlers/main.yml

-- name: Reload Systemd.
+roles_t/gate/handlers/main.yml
- name: Reload Systemd.
   become: yes
   systemd:
     daemon-reload: yes
@@ -6072,8 +6000,8 @@ listener" listen there.  That stub should not read /etc/hosts lest
 

 

 

-

-
9.5. UFW Rules

+

+
9.5. UFW Rules

 

 

 Gate uses the Uncomplicated FireWall (UFW) to install its packet
@@ -6097,7 +6025,7 @@ traffic through their WireGuard™ interface.
 

 
 

-ufw-nat
-A POSTROUTING -s {{ private_net_cidr }} -o isp -j MASQUERADE
+ufw-nat
-A POSTROUTING -s {{ private_net_cidr }} -o isp -j MASQUERADE
 -A POSTROUTING -s {{    wild_net_cidr }} -o isp -j MASQUERADE
 

 

@@ -6113,7 +6041,7 @@ tracking).
 

 
 

-ufw-forward-nat
-A ufw-before-forward -i lan  -o isp -j ACCEPT
+ufw-forward-nat
-A ufw-before-forward -i lan  -o isp -j ACCEPT
 -A ufw-before-forward -i wild -o isp -j ACCEPT
 

 

@@ -6127,7 +6055,7 @@ public and campus VPNs is also allowed.
 

 
 

-ufw-forward-private
-A ufw-before-forward -i lan  -o wg0 -j ACCEPT
+ufw-forward-private
-A ufw-before-forward -i lan  -o wg0 -j ACCEPT
 -A ufw-before-forward -i wg0  -o lan -j ACCEPT
 -A ufw-before-forward -i wg0  -o wg0 -j ACCEPT
 

@@ -6147,8 +6075,8 @@ forwarded to lan.
 

 

 

-

-
9.6. Configure UFW

+

+
9.6. Configure UFW

 

 

 The following tasks install the Uncomplicated Firewall (UFW), set its
@@ -6157,8 +6085,7 @@ policy in /etc/default/ufw, and install the institute's rules in
 

 
 

-roles_t/gate/tasks/main.yml

-- name: Install UFW.
+roles_t/gate/tasks/main.yml
- name: Install UFW.
   become: yes
   apt: pkg=ufw
 
@@ -6200,8 +6127,8 @@ policy in /etc/default/ufw, and install the institute's rules in
 

 

 

-

-
9.7. Configure Campus WireGuard™ Subnet

+

+
9.7. Configure Campus WireGuard™ Subnet

 

 

 Gate uses WireGuard™ to provide a campus VPN service.  Gate's routes
@@ -6219,8 +6146,7 @@ not exist), and enable the service.
 

 
 

-roles_t/gate/tasks/main.yml

-- name: Enable IP forwarding.
+roles_t/gate/tasks/main.yml
- name: Enable IP forwarding.
   become: yes
   copy:
     content: "net.ipv4.ip_forward = 1\n"
@@ -6262,8 +6188,7 @@ not exist), and enable the service.
 

 
 

-roles_t/gate/handlers/main.yml

-- name: Reload sysctl.
+roles_t/gate/handlers/main.yml
- name: Reload sysctl.
   become: yes
   systemd:
     service: systemd-sysctl
@@ -6292,8 +6217,8 @@ The "empty" WireGuard™ configuration file (below) is used until the
 

 

 

-

-
9.7.1. Example private/gate-wg0.conf

+

+
9.7.1. Example private/gate-wg0.conf

 

 

 The example private/gate-wg0.conf below recognizes a wired IoT
@@ -6378,8 +6303,8 @@ WireGuard™ tunnel on Dick's notebook, used on campus
 

 

 

-

-
10. The Campus Role

+

+
10. The Campus Role

 

 

 The campus role configures generic campus server machines: network
@@ -6395,24 +6320,25 @@ Wireless campus devices register their public keys using the ./inst
 client command which updates the WireGuard™ configuration on Gate.
 

 

-

-
10.1. Role Defaults

+

+
10.1. Role Defaults

 

 

-As in The Gate Role, the campus role sets a number of variables to
+As in The Gate Role, the campus role sets a number of variables to
 default values in its defaults/main.yml file.
 

 
 

 roles_t/campus/defaults/main.yml
---
 <<network-vars>>
+
 <<address-vars>>
 

 

 

 

-

-
10.2. Include Particulars

+

+
10.2. Include Particulars

 

 

 The following should be familiar boilerplate by now.
@@ -6429,16 +6355,15 @@ The following should be familiar boilerplate by now.
 

 

 

-

-
10.3. Configure Hostname

+

+
10.3. Configure Hostname

 

 

 Clients should be using the expected host name.
 

 
 

-roles_t/campus/tasks/main.yml

-- name: Configure hostname.
+roles_t/campus/tasks/main.yml
- name: Configure hostname.
   become: yes
   copy:
     content: "{{ item.content }}"
@@ -6458,8 +6383,8 @@ Clients should be using the expected host name.
 

 

 

-

-
10.4. Configure Systemd Timesyncd

+

+
10.4. Configure Systemd Timesyncd

 

 

 The institute uses a common time reference throughout the campus.
@@ -6468,8 +6393,7 @@ and file timestamps.
 

 
 

-roles_t/campus/tasks/main.yml

-- name: Install timesyncd.
+roles_t/campus/tasks/main.yml
- name: Install timesyncd.
   become: yes
   apt: pkg=systemd-timesyncd
 
@@ -6508,8 +6432,8 @@ and file timestamps.
 

 

 

-

-
10.5. Add Administrator to System Groups

+

+
10.5. Add Administrator to System Groups

 

 

 The administrator often needs to read (directories of) log files owned
@@ -6518,8 +6442,7 @@ these groups speeds up debugging.
 

 
 

-roles_t/campus/tasks/main.yml

-- name: Add {{ ansible_user }} to system groups.
+roles_t/campus/tasks/main.yml
- name: Add {{ ansible_user }} to system groups.
   become: yes
   user:
     name: "{{ ansible_user }}"
@@ -6529,24 +6452,23 @@ these groups speeds up debugging.
 

 

 

-

-
10.6. Install Unattended Upgrades

+

+
10.6. Install Unattended Upgrades

 

 

 The institute prefers to install security updates as soon as possible.
 

 
 

-roles_t/campus/tasks/main.yml

-- name: Install basic software.
+roles_t/campus/tasks/main.yml
- name: Install basic software.
   become: yes
   apt: pkg=unattended-upgrades
 

 

 

 

-

-
10.7. Configure Postfix on Campus

+

+
10.7. Configure Postfix on Campus

 

 

 The Postfix settings used by the campus include message size, queue
@@ -6563,8 +6485,7 @@ tasks below.
 
 
 

-roles_t/campus/tasks/main.yml

-- name: Install Postfix.
+roles_t/campus/tasks/main.yml
- name: Install Postfix.
   become: yes
   apt: pkg=postfix
 
@@ -6603,8 +6524,7 @@ tasks below.
 

 
 

-roles_t/campus/handlers/main.yml

-- name: Restart Postfix.
+roles_t/campus/handlers/main.yml
- name: Restart Postfix.
   become: yes
   systemd:
     service: postfix
@@ -6614,8 +6534,8 @@ tasks below.
 

 

 

-

-
10.8. Set Domain Name

+

+
10.8. Set Domain Name

 

 

 The host's fully qualified (private) domain name (FQDN) is set by an
@@ -6625,8 +6545,7 @@ manpage.)
 

 
 

-roles_t/campus/tasks/main.yml

-- name: Set domain name.
+roles_t/campus/tasks/main.yml
- name: Set domain name.
   become: yes
   vars:
     host: "{{ inventory_hostname }}"
@@ -6638,19 +6557,18 @@ manpage.)
 

 

 

-

-
10.9. Configure NRPE

+

+
10.9. Configure NRPE

 

 

 Each campus host runs an NRPE (a NAGIOS Remote Plugin Executor)
 server so that the NAGIOS4 server on Core can collect statistics.  The
-NAGIOS service is discussed in the Configure NRPE section of The Core
+NAGIOS service is discussed in the Configure NRPE section of The Core
 Role.
 

 
 

-roles_t/campus/tasks/main.yml

-- name: Install NRPE.
+roles_t/campus/tasks/main.yml
- name: Install NRPE.
   become: yes
   apt:
     pkg: [ nagios-nrpe-server, lm-sensors ]
@@ -6693,8 +6611,7 @@ Role.
 

 
 

-roles_t/campus/handlers/main.yml

-- name: Reload NRPE server.
+roles_t/campus/handlers/main.yml
- name: Reload NRPE server.
   become: yes
   systemd:
     service: nagios-nrpe-server
@@ -6705,8 +6622,8 @@ Role.
 

 

 

-

-
11. The Ansible Configuration

+

+
11. The Ansible Configuration

 

 

 The small institute uses Ansible to maintain the configuration of its
@@ -6715,7 +6632,7 @@ runs playbook site.yml to apply the appro
 role(s) to each host.  Examples of these files are included here, and
 are used to test the roles.  The example configuration applies the
 institutional roles to VirtualBox machines prepared according to
-chapter Testing.
+chapter Testing.
 

 
 

@@ -6728,13 +6645,13 @@ while changes to the institute's particulars are committed to a
 separate revision history.
 

 

-

-
11.1. ansible.cfg

+

+
11.1. ansible.cfg

 

 

 The Ansible configuration file ansible.cfg contains just a handful
 of settings, some included just to create a test jig as described in
-Testing.
+Testing.
 

 
 
    
@@ -6743,7 +6660,7 @@ of settings, some included just to create a test jig as described in
 that Python 3 can be expected on all institute hosts.
 
  • vault_password_file is set to suppress prompts for the vault
 password.  The institute keeps its vault password in Secret/ (as
-described in Keys) and thus sets this parameter to
+described in Keys) and thus sets this parameter to
 Secret/vault-password.
    • 
 
  • inventory is set to avoid specifying it on the command line.
    • 
 
  • roles_path is set to the recently tangled roles files in
@@ -6760,8 +6677,8 @@ described in Keys) and thus sets this parameter to
 

 

 

-

-
11.2. hosts

+

+
11.2. hosts

 

 

 The Ansible inventory file hosts describes all of the institute's
@@ -6773,7 +6690,7 @@ describes three test servers named front, core and 
 
 

-hosts
all:
+hosts
all:
   vars:
     ansible_user: sysadm
     ansible_ssh_extra_args: -i Secret/ssh_admin/id_ed25519
@@ -6838,8 +6755,8 @@ the Secret/vault-password file.
 

 

 

-

-
11.3. playbooks/site.yml

+

+
11.3. playbooks/site.yml

 

 

 The example playbooks/site.yml playbook (below) applies the
@@ -6872,8 +6789,8 @@ the example inventory: hosts.
 

 

 

-

-
11.4. Secret/vault-password

+

+
11.4. Secret/vault-password

 

 

 As already mentioned, the small institute keeps its Ansible vault
@@ -6885,17 +6802,17 @@ example password matches the example encryptions above.
 

 
 

-Secret/vault-password
alitysortstagess
+Secret/vault-password
alitysortstagess
 

 

 

 

-

-
11.5. Creating A Working Ansible Configuration

+

+
11.5. Creating A Working Ansible Configuration

 

 

 A working Ansible configuration can be "tangled" from this document to
-produce the test configuration described in the Testing chapter.  The
+produce the test configuration described in the Testing chapter.  The
 tangling is done by Emacs's org-babel-tangle function and has
 already been performed with the resulting tangle included in the
 distribution with this document.
@@ -6938,7 +6855,7 @@ would be copied, with appropriate changes, into new subdirectories
 public/ and private/.
 
  • ~/network/Secret would be a symbolic link to the (auto-mounted?)
 location of the administrator's encrypted USB drive, as described in
-section Keys.
    • 
+section Keys.
 
 
 
    
@@ -6974,8 +6891,8 @@ super-project's directory.
 
    
 
    
 
    
-
    
-
    11.6. Maintaining A Working Ansible Configuration
    
+
    
+
    11.6. Maintaining A Working Ansible Configuration
    
 
    
 
    
 The Ansible roles currently tangle into the roles_t/ directory to
@@ -6994,8 +6911,8 @@ their way back to the code block in this document.
 
    
 
    
 
    
-
    
-
    12. The Institute Commands
    
+
    
+
    12. The Institute Commands
    
 
    
 
    
 The institute's administrator uses a convenience script to reliably
@@ -7005,8 +6922,8 @@ Ansible configuration.  The Ansible commands it executes are expected
 to get their defaults from ./ansible.cfg.
 
    
 
    
-
    
-
    12.1. Sub-command Blocks
    
+
    
+
    12.1. Sub-command Blocks
    
 
    
 
    
 The code blocks in this chapter tangle into the inst script.  Each
@@ -7032,8 +6949,8 @@ The first code block is the header of the ./inst script.
 
    
 
    
 
    
-
    
-
    12.2. Sanity Check
    
+
    
+
    12.2. Sanity Check
    
 
    
 
    
 The next code block does not implement a sub-command; it implements
@@ -7045,8 +6962,7 @@ permissions.  It probes past the Secret/ mount poin
 
    
 
 
    
-inst
    
-sub note_missing_file_p ($);
+inst
    sub note_missing_file_p ($);
 sub note_missing_directory_p ($);
 
 {
@@ -7093,8 +7009,8 @@ permissions.  It probes past the Secret/ mount poin
 
    
 
    
 
    
-
    
-
    12.3. Importing Ansible Variables
    
+
    
+
    12.3. Importing Ansible Variables
    
 
    
 
    
 To ensure that Ansible and ./inst are sympatico vis-a-vi certain
@@ -7106,8 +7022,7 @@ them.
 
    
 
 
    
-inst
    
-sub mysystem (@) {
+inst
    sub mysystem (@) {
   my $line = join (" ", @_);
   print "$line\n";
   my $status = system $line;
@@ -7139,8 +7054,8 @@ The playbook that updates private/vars.pl:
 
    
 
    
 
    
-
    
-
    12.4. The check-inst-vars Role
    
+
    
+
    12.4. The check-inst-vars Role
    
 
    
 
    
 This role is executed by playbooks/check-inst-vars.yml and is not
@@ -7150,6 +7065,7 @@ just a playbook because it needs a copy of the role defaults.
 
    
 roles_t/check-inst-vars/defaults/main.yml
    ---
 <<network-vars>>
+
 <<address-vars>>
 
    
 
    
@@ -7191,7 +7107,7 @@ following few provide the servers' public keys and ports.
 
    
 
 
    
-private/vars.yml
    front_wg_pubkey: S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4=
+private/vars.yml
    front_wg_pubkey: S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4=
 public_wg_port:  39608
 
 gate_wg_pubkey:  y3cjFnvQbylmH4lGTujpqc8rusIElmJ4Gu9hh6iR7QI=
@@ -7202,8 +7118,8 @@ campus_wg_port:  51820
 
    
 
    
 
    
-
    
-
    12.5. The CA Command
    
+
    
+
    12.5. The CA Command
    
 
    
 
    
 The next code block implements the CA sub-command, which creates a
@@ -7250,8 +7166,7 @@ that will be installed on their servers by the next ./inst config.
 
    
 
 
    
-inst
    
-if (defined $ARGV[0] && $ARGV[0] eq "CA") {
+inst
    if (defined $ARGV[0] && $ARGV[0] eq "CA") {
   die "usage: $0 CA" if @ARGV != 1;
   die "Secret/CA/easyrsa: not an executable\n"
     if ! -x "Secret/CA/easyrsa";
@@ -7311,8 +7226,8 @@ that will be installed on their servers by the next ./inst config.
 
    
 
    
 
    
-
    
-
    12.6. The Config Command
    
+
    
+
    12.6. The Config Command
    
 
    
 
    
 The next code block implements the config sub-command, which
@@ -7334,8 +7249,7 @@ Example command lines:
 
    
 
 
    
-inst
    
-if (defined $ARGV[0] && $ARGV[0] eq "config") {
+inst
    if (defined $ARGV[0] && $ARGV[0] eq "config") {
   die "Secret/CA/easyrsa: not executable\n"
     if ! -x "Secret/CA/easyrsa";
   shift;
@@ -7362,12 +7276,12 @@ Example command lines:
 
    
 
    
 
    
-
    
-
    12.7. Account Management
    
+
    
+
    12.7. Account Management
    
 
    
 
    
 For general information about members and their Unix accounts, see
-Accounts.  The account management sub-commands maintain a mapping
+Accounts.  The account management sub-commands maintain a mapping
 associating member "usernames" (Unix account names) with their
 records.  The mapping is stored among other things in
 private/members.yml as the value associated with the key members.
@@ -7433,8 +7347,7 @@ value of membership_rolls.
 
    
 
 
    
-membership-rolls
    
-membership_rolls:
+membership-rolls
    membership_rolls:
 - "../private/members.yml"
 - "../private/members-empty.yml"
 
    
@@ -7455,8 +7368,7 @@ read from the file.  The dump subroutine is another story (below).
 
    
 
 
    
-inst
    
-use YAML::XS qw(LoadFile DumpFile);
+inst
    use YAML::XS qw(LoadFile DumpFile);
 
 sub read_members_yaml () {
   my $path;
@@ -7531,8 +7443,7 @@ each record.
 
    
 
 
    
-inst
    
-sub print_member ($$$) {
+inst
    sub print_member ($$$) {
   my ($out, $username, $member) = @_;
   print $out "  ", $username, ":\n";
   print $out "    status: ", $member->{"status"}, "\n";
@@ -7567,8 +7478,8 @@ each record.
 
    
 
    
 
    
-
    
-
    12.8. The New Command
    
+
    
+
    12.8. The New Command
    
 
    
 
    
 The next code block implements the new sub-command.  It adds a new
@@ -7582,8 +7493,7 @@ initial, generated password.
 
    
 
 
    
-inst
    
-sub valid_username (@);
+inst
    sub valid_username (@);
 sub shell_escape ($);
 sub strip_vault ($);
 
@@ -7658,8 +7568,8 @@ initial, generated password.
 
    
 
    
 
    
-
    
-
    12.9. The Pass Command
    
+
    
+
    12.9. The Pass Command
    
 
    
 
    
 The institute's passwd command on Core securely emails root with a
@@ -7673,8 +7583,8 @@ Ansible site.yml playbook to update the
 message is sent to member@core.
 
    
 
    
-
    
-
    12.9.1. Less Aggressive passwd.
    
+
    
+
    12.9.1. Less Aggressive passwd.
    
 
    
 
    
 The next code block implements the less aggressive passwd command.
@@ -7770,8 +7680,8 @@ print "
 
    
 
    
 
    
-
    
-
    12.9.2. Less Aggressive Pass Command
    
+
    
+
    12.9.2. Less Aggressive Pass Command
    
 
    
 
    
 The following code block implements the ./inst pass command, used by
@@ -7780,8 +7690,7 @@ the administrator to update private/members.yml before running
 
    
 
 
    
-inst
    
-use MIME::Base64;
+inst
    use MIME::Base64;
 sub write_wireguard ($);
 
 if (defined $ARGV[0] && $ARGV[0] eq "pass") {
@@ -7858,8 +7767,8 @@ users:resetpassword command.
 
    
 
    
 
    
-
    
-
    12.9.3. Installing the Less Aggressive passwd
    
+
    
+
    12.9.3. Installing the Less Aggressive passwd
    
 
    
 
    
 The following Ansible tasks install the less aggressive passwd
@@ -7872,8 +7781,7 @@ configuration so that the email to root can be encrypted.
 
    
 
 
    
-roles_t/core/tasks/main.yml
    
-- name: Install institute passwd command.
+roles_t/core/tasks/main.yml
    - name: Install institute passwd command.
   become: yes
   template:
    src: passwd
@@ -7918,8 +7826,7 @@ configuration so that the email to root can be encrypted.
 
    
 
 
    
-roles_t/core/handlers/main.yml
    
-- name: Import root PGP key.
+roles_t/core/handlers/main.yml
    - name: Import root PGP key.
   become: no
   command: gpg --import /etc/root-pub.pem
 
    
@@ -7927,16 +7834,15 @@ configuration so that the email to root can be encrypted.
 
    
 
    
 
    
-
    
-
    12.10. The Old Command
    
+
    
+
    12.10. The Old Command
    
 
    
 
    
 The old command disables a member's account (and thus their clients).
 
    
 
 
    
-inst
    
-if (defined $ARGV[0] && $ARGV[0] eq "old") {
+inst
    if (defined $ARGV[0] && $ARGV[0] eq "old") {
   my $user = valid_username (@ARGV);
   my $yaml = read_members_yaml ();
   my $members = $yaml->{"members"};
@@ -7972,8 +7878,8 @@ The old command disables a member's account (and thus their clients
 
    
 
    
 
    
-
    
-
    12.11. The Client Command
    
+
    
+
    12.11. The Client Command
    
 
    
 
    
 The client command registers the public key of a client wishing to
@@ -8237,8 +8143,8 @@ better support in NetworkManager soon.)
 
    
 
    
 
    
-
    
-
    12.12. Institute Command Help
    
+
    
+
    12.12. Institute Command Help
    
 
    
 
    
 This should be the last block tangled into the inst script.  It
@@ -8247,15 +8153,14 @@ above.
 
    
 
 
    
-inst
    
-die "usage: $0 [CA|config|new|pass|old|client] ...\n";
+inst
    die "usage: $0 [CA|config|new|pass|old|client] ...\n";
 
    
 
    
 
    
 
    
 
    
-
    
-
    13. Testing
    
+
    
+
    13. Testing
    
 
    
 
    
 The example files in this document, ansible.cfg and hosts as well
@@ -8274,7 +8179,7 @@ simulation is the VirtualBox host.
 
    
 The next two sections list the steps taken to create the simulated
 Core, Gate and Front machines, and connect them to their networks.
-The process is similar to that described in The (Actual) Hardware, but
+The process is similar to that described in The (Actual) Hardware, but
 is covered in detail here where the VirtualBox hypervisor can be
 assumed and exact command lines can be given (and copied during
 re-testing).  The remaining sections describe the manual testing
@@ -8290,8 +8195,8 @@ HTML version of the latest revision can be found on the official web
 site at https://www.virtualbox.org/manual/UserManual.html.
 
    
 
    
-
    
-
    13.1. The Test Networks
    
+
    
+
    13.1. The Test Networks
    
 
    
 
    
 The networks used in the test:
@@ -8360,14 +8265,14 @@ in 192.168.15.0/24, on the NAT network public.
 
    
 
    
 
    
-
    
-
    13.2. The Test Machines
    
+
    
+
    13.2. The Test Machines
    
 
    
 
    
 The virtual machines are created by VBoxManage command lines in the
 following sub-sections.  They each start with a recent Debian release
 (e.g. debian-12.5.0-amd64-netinst.iso) in their simulated DVD
-drives.  Preparation of The Hardware installed additional software
+drives.  Preparation of The Hardware installed additional software
 packages and keys while the machines had Internet access.  They were
 then moved to the new campus network where Ansible completed the
 configuration without Internet access.
@@ -8385,8 +8290,8 @@ shutting each VM down, executing a VBoxManage command line or two,
 and restarting.
 
    
 
    
-
    
-
    13.2.1. The Test Wireguard™ Keys 
    
+
    
+
    13.2.1. The Test Wireguard™ Keys 
    
 
    
 
    
 All of the private keys used in the example/test configuration are
@@ -8451,8 +8356,8 @@ collected (and registered with the ./inst client command).
 
    
 
 
    
 
    
 
    
-
    
-
    13.2.2. Ansible Test Authorization
    
+
    
+
    13.2.2. Ansible Test Authorization
    
 
    
 
    
 Part of each machine's preparation is to authorize password-less SSH
@@ -8463,7 +8368,7 @@ provided here tagged with test-auth and used via noweb reference
 
    
 
 
    
-test-auth
    ( cd
+test-auth
    ( cd
   umask 077
   if [ ! -d .ssh ]; then mkdir .ssh; fi
   ( echo -n "ssh-rsa"
@@ -8483,8 +8388,8 @@ provided here tagged with test-auth and used via noweb reference
 
    
 
    
 
    
-
    
-
    13.2.3. A Test Machine
    
+
    
+
    13.2.3. A Test Machine
    
 
    
 
    
 The following shell function contains most of the VBoxManage
@@ -8616,8 +8521,8 @@ The administrator logs in here, with username sysadm and password
 
    
 
    
 
    
-
    
-
    13.2.4. The Test Front Machine
    
+
    
+
    13.2.4. The Test Front Machine
    
 
    
 
    
 The front machine is created with 512MiB of RAM, 4GiB of disk, and
@@ -8681,8 +8586,7 @@ Ansible's public SSH key.
 
    
 
 
    
-private/test-front-prep
    
-( umask 377
+private/test-front-prep
    ( umask 377
   echo "AJkzVxfTm/KvRjzTN/9X2jYy+CAugiwZfN5F3JTegms=" \
   | sudo tee /etc/wireguard/private-key >/dev/null )
 
@@ -8706,8 +8610,7 @@ to the second NIC.
 
    
 
 
    
-private/test-front-prep
    
-( cd /etc/network/; \
+private/test-front-prep
    ( cd /etc/network/; \
   [ -f interfaces~ ] || sudo mv interfaces interfaces~ )
 cat <<EOF | sudo tee /etc/network/interfaces >/dev/null
 # This file describes the network interfaces available on your system
@@ -8742,8 +8645,7 @@ identities).
 
    
 
 
    
-private/test-front-prep
    
-( cd front_ssh/; sudo cp -b ssh_host_* /etc/ssh/ )
+private/test-front-prep
    ( cd front_ssh/; sudo cp -b ssh_host_* /etc/ssh/ )
 
    
 
    
 
@@ -8756,7 +8658,7 @@ down and moved to the simulated cloud (from the default NAT network).
 The following VBoxManage commands effect the move, connecting the
 primary NIC to public and a second NIC to the host-only network
 vboxnet2 (making it directly accessible to the administrator's
-notebook as described in The Test Networks).
+notebook as described in The Test Networks).
 
    
 
 
    
@@ -8770,8 +8672,8 @@ VBoxManage modifyvm front --nic2 hostonly --hostonlyadapter2 vboxnet2
 
    
 
    
 
    
-
    
-
    13.2.5. The Test Gate Machine
    
+
    
+
    13.2.5. The Test Gate Machine
    
 
    
 
    
 The gate machine is created with the same amount of RAM and disk as
@@ -8785,7 +8687,7 @@ not changed, gate can be created with one command.
 
    
 
 
    
-After Debian is installed (as detailed in A Test Machine) and the
+After Debian is installed (as detailed in A Test Machine) and the
 machine rebooted, the administrator copies the following script to the
 machine and executes it.
 
    
@@ -8807,7 +8709,8 @@ The script starts by installing additional software packages.
 private/test-gate-prep
    #!/bin/bash -e
 
 sudo apt install wireguard systemd-resolved unattended-upgrades \
-                 postfix ufw lm-sensors nagios-nrpe-server
+                 postfix ufw lm-sensors nagios-nrpe-server \
+                 munin-node emacs
 
    
 
    
 
@@ -8842,8 +8745,7 @@ sufficient to allow remote access by Ansible.)
 
    
 
 
    
-private/test-gate-prep
    
-cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
+private/test-gate-prep
    cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
 [Match]
 MACAddress=08:00:27:f3:16:79
 
@@ -8939,8 +8841,8 @@ values of the MAC address variables in this table.
 
    
 
    
 
    
-
    
-
    13.2.6. The Test Core Machine
    
+
    
+
    13.2.6. The Test Core Machine
    
 
    
 
    
 The core machine is created with 1GiB of RAM and 6GiB of disk.
@@ -8954,7 +8856,7 @@ created with following command.
 
    
 
 
    
-After Debian is installed (as detailed in A Test Machine) and the
+After Debian is installed (as detailed in A Test Machine) and the
 machine rebooted, the administrator copies the following script to the
 machine and executes it.
 
    
@@ -9016,8 +8918,7 @@ Next, the script configures the primary NIC with 10-lan.link and
 
    
 
 
    
-private/test-core-prep
    
-cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
+private/test-core-prep
    cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
 [Match]
 MACAddress=08:00:27:b3:e5:5f
 
@@ -9062,8 +8963,8 @@ VBoxManage modifyvm core --nic1 hostonly --hostonlyadapter1 vboxnet0
 
    
 
    
 
    
-
    
-
    13.3. Configure Test Machines
    
+
    
+
    13.3. Configure Test Machines
    
 
    
 
    
 At this point the three test machines core, gate, and front are
@@ -9098,8 +8999,8 @@ less than a restart will get systemd-udevd to rename the isp<
 
    
 
    
 
    
-
    
-
    13.4. Test Basics
    
+
    
+
    13.4. Test Basics
    
 
    
 
    
 At this point the test institute is just core, gate and front,
@@ -9161,12 +9062,12 @@ instant attention).
 
    
 
    
 
    
-
    
-
    13.5. The Test Nextcloud
    
+
    
+
    13.5. The Test Nextcloud
    
 
    
 
    
 Further tests involve Nextcloud account management.  Nextcloud is
-installed on core as described in Install Nextcloud.  Once
+installed on core as described in Install Nextcloud.  Once
 /Nextcloud/ is created, ./inst config core will validate
 or update its configuration files.
 
    
@@ -9188,8 +9089,8 @@ with the ./inst client command.
 
    
 
    
 
    
-
    
-
    13.6. Test New Command
    
+
    
+
    13.6. Test New Command
    
 
    
 
    
 A member must be enrolled so that a member's client machine can be
@@ -9209,8 +9110,8 @@ Take note of Dick's initial password.
 
    
 
    
 
    
-
    
-
    13.7. The Test Member Notebook
    
+
    
+
    13.7. The Test Member Notebook
    
 
    
 
    
 A test member's notebook is created next, much like the servers,
@@ -9238,7 +9139,7 @@ behind) the access point.
 
    
 
 
    
-Debian is installed much as detailed in A Test Machine except that
+Debian is installed much as detailed in A Test Machine except that
 the SSH server option is not needed and the GNOME desktop option
 is.  When the machine reboots, the administrator logs into the
 desktop and installs a couple additional software packages (which
@@ -9252,8 +9153,8 @@ require several more).
 
    
 
    
 
    
-
    
-
    13.8. Test Client Command
    
+
    
+
    13.8. Test Client Command
    
 
    
 
    
 The ./inst client command is used to register the public key of a
@@ -9295,8 +9196,8 @@ sudo systemctl enable wg-quick@campus
 
    
 
    
 
    
-
    
-
    13.9. Test Campus WireGuard™ Subnet
    
+
    
+
    13.9. Test Campus WireGuard™ Subnet
    
 
    
 
    
 A few basic tests are then performed in a terminal.
@@ -9313,8 +9214,8 @@ host www
 
    
 
    
 
    
-
    
-
    13.10. Test Web Pages
    
+
    
+
    13.10. Test Web Pages
    
 
    
 
    
 Next, the administrator copies Backup/WWW/ (included in the
@@ -9368,8 +9269,8 @@ the edit observed immediately, and its correction within 15 minutes.
 
    
 
    
 
    
-
    
-
    13.11. Test Nextcloud
    
+
    
+
    13.11. Test Nextcloud
    
 
    
 
    
 Using the browser on the simulated member notebook, the Nextcloud
@@ -9446,8 +9347,8 @@ the calendar.
 
 
    
 
    
-
    
-
    13.12. Test Email
    
+
    
+
    13.12. Test Email
    
 
    
 
    
 With Evolution running on the member notebook dick, one second email
@@ -9475,8 +9376,8 @@ Outgoing email is also tested.  A message to
 
    
 
    
 
    
-
    
-
    13.13. Test Public VPN
    
+
    
+
    13.13. Test Public VPN
    
 
    
 
    
 At this point, dick can move abroad, from the campus Wi-Fi
@@ -9537,8 +9438,8 @@ calendar events.
 
    
 
    
 
    
-
    
-
    13.14. Test Pass Command
    
+
    
+
    13.14. Test Pass Command
    
 
    
 
    
 To test the ./inst pass command, the administrator logs in to core
@@ -9590,8 +9491,8 @@ Finally, the administrator verifies that dick can login on co
 
    
 
    
 
    
-
    
-
    13.15. Test Old Command
    
+
    
+
    13.15. Test Old Command
    
 
    
 
    
 One more institute command is left to exercise.  The administrator
@@ -9611,16 +9512,16 @@ fail.
 
    
 
    
 
    
-
    
-
    14. Future Work
    
+
    
+
    14. Future Work
    
 
    
 
    
 The small institute's network, as currently defined in this doocument,
 is lacking in a number of respects.
 
    
 
    
-
    
-
    14.1. Deficiencies
    
+
    
+
    14.1. Deficiencies
    
 
    
 
    
 The current network monitoring is rudimentary.  It could use some
@@ -9641,16 +9542,16 @@ not available on Front, yet.
 
    
 
    
 
    
-
    
-
    14.2. More Tests
    
+
    
+
    14.2. More Tests
    
 
    
 
    
 The testing process described in the previous chapter is far from
 complete.  Additional tests are needed.
 
    
 
    
-
    
-
    14.2.1. Backup
    
+
    
+
    14.2.1. Backup
    
 
    
 
    
 The backup command has not been tested.  It needs an encrypted
@@ -9659,8 +9560,8 @@ partition with which to sync?  And then some way to compare that to
 
    
 
    
 
    
-
    
-
    14.2.2. Restore
    
+
    
+
    14.2.2. Restore
    
 
    
 
    
 The restore process has not been tested.  It might just copy Backup/
@@ -9670,8 +9571,8 @@ perhaps permissions too.  It could also use an example
 
    
 
    
 
    
-
    
-
    14.2.3. Campus Disconnect
    
+
    
+
    14.2.3. Campus Disconnect
    
 
    
 
    
 Email access (IMAPS) on front is… difficult to test unless
@@ -9695,8 +9596,8 @@ could be used.
 
    
 
    
 
    
-
    
-
    15. Appendix: The Bootstrap
    
+
    
+
    15. Appendix: The Bootstrap
    
 
    
 
    
 Creating the private network from whole cloth (machines with recent
@@ -9716,11 +9617,11 @@ etc.: quite a bit of temporary, manual localnet configuration just to
 get to the additional packages.
 
    
 
    
-
    
-
    15.1. The Current Strategy
    
+
    
+
    15.1. The Current Strategy
    
 
    
 
    
-The strategy pursued in The Hardware is two phase: prepare the servers
+The strategy pursued in The Hardware is two phase: prepare the servers
 on the Internet where additional packages are accessible, then connect
 them to the campus facilities (the private Ethernet switch, Wi-Fi AP,
 ISP), manually configure IP addresses (while the DHCP client silently
@@ -9728,8 +9629,8 @@ fails), and avoid names until BIND9 is configured.
 
    
 
    
 
    
-
    
-
    15.2. Starting With Gate
    
+
    
+
    15.2. Starting With Gate
    
 
    
 
    
 The strategy of Starting With Gate concentrates on configuring Gate's
@@ -9773,8 +9674,8 @@ ansible-playbook -l core site.yml
 
 
    
 
    
-
    
-
    15.3. Pre-provision With Ansible
    
+
    
+
    15.3. Pre-provision With Ansible
    
 
    
 
    
 A refinement of the current strategy might avoid the need to maintain
@@ -9827,7 +9728,7 @@ routes on Front and Gate, making the simulation less… similar.
 
    
 
    
 
    Author: Matt Birkholz
    
-
    Created: 2026-05-09 Sat 15:42
    
+
    Created: 2026-06-15 Mon 11:36
    
 
    Validate
    
 
    
 
-- 
2.47.3