From fc757e938e48de0c563667a47c7a509eb31fb3ef Mon Sep 17 00:00:00 2001 From: Matt Birkholz Date: Mon, 1 Jan 2024 10:49:04 -0700 Subject: [PATCH] Update README.html. --- README.html | 161 +++++++++++++++++++++++++--------------------------- 1 file changed, 76 insertions(+), 85 deletions(-) diff --git a/README.html b/README.html index 78a6c4e..ccb6f52 100644 --- a/README.html +++ b/README.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + A Small Institute @@ -48,7 +48,7 @@ connects to Front making the institute email, cloud, etc. available to members off campus.

-
+
                 =                                                   
               _|||_                                                 
         =-The-Institute-=                                           
@@ -1030,7 +1030,7 @@ example result follows the code.
 

 
 
-

+

 

 => 10.62.17.0/24
 

@@ -1238,7 +1238,7 @@ Are you sure you want to continue connecting (...)? yes
 sysadm@159.65.75.60's password: givitysticangout
 notebook$ ssh sysadm@159.65.75.60
 sysadm@159.65.75.60's password: givitysticangout
-sysadm@ubuntu$ ( mask 077; mkdir .ssh; \
+sysadm@ubuntu$ ( umask 077; mkdir .ssh; \
 sysadm@ubuntu_   cp admin_keys .ssh/authorized_keys; \
 sysadm@ubuntu_   rm admin_keys )
 sysadm@ubuntu$ logout
@@ -1381,7 +1381,7 @@ Are you sure you want to continue connecting (...)? yes
 sysadm@core.lan's password: oingstramextedil
 notebook$ ssh sysadm@core.lan
 sysadm@core.lan's password: oingstramextedil
-sysadm@core$ ( mask 077; mkdir .ssh; \
+sysadm@core$ ( umask 077; mkdir .ssh; \
 sysadm@core_   cp admin_keys .ssh/authorized_keys )
 sysadm@core$ rm admin_keys
 sysadm@core$ logout
@@ -1445,7 +1445,7 @@ USB-Ethernet adapter, or a wireless adapter connected to a
 campground Wi-Fi access point, etc.
 
 
-
+
 =============== | ==================================================
                 |                                           Premises
           (Campus ISP)                                              
@@ -1468,7 +1468,7 @@ This avoids the need for a second Wi-Fi access point and leads to the
 following topology.
 

 
-
+
 =============== | ==================================================
                 |                                           Premises
            (House ISP)                                              
@@ -1563,7 +1563,7 @@ Are you sure you want to continue connecting (...)? yes
 sysadm@gate.lan's password: icismassssadestm
 notebook$ ssh sysadm@gate.lan
 sysadm@gate.lan's password: icismassssadestm
-sysadm@gate$ ( mask 077; mkdir .ssh; \
+sysadm@gate$ ( umask 077; mkdir .ssh; \
 sysadm@gate_   cp admin_keys .ssh/authorized_keys )
 sysadm@core$ rm admin_keys
 sysadm@core$ logout
@@ -1640,8 +1640,8 @@ uses the institute's CA and server certificates, and expects client
 certificates signed by the institute CA.
 

 

-

-
6.1. Include Particulars

+

+
6.1. Include Particulars

 

 

 The front role's tasks contain references to several common
@@ -1673,8 +1673,8 @@ The code block below is the first to tangle into
 

 

 

-

-
6.2. Configure Hostname

+

+
6.2. Configure Hostname

 

 

 This task ensures that Front's /etc/hostname and /etc/mailname are
@@ -1798,8 +1798,8 @@ separate code block named enable-resolved.
 

 

-
-

-
6.6. Configure Monkey

+

+
6.6. Configure Monkey

 

 

 The small institute runs cron jobs and web scripts that generate
@@ -1915,8 +1915,8 @@ Monkey uses Rsync to keep the institute's public web site up-to-date.
 

 

 

-

-
6.8. Install Unattended Upgrades

+

+
6.8. Install Unattended Upgrades

 

 

 The institute prefers to install security updates as soon as possible.
@@ -1931,8 +1931,8 @@ The institute prefers to install security updates as soon as possible.
 

 

 

-
-

-
6.10. Trust Institute Certificate Authority

+

+
6.10. Trust Institute Certificate Authority

 

 

 Front should recognize the institute's Certificate Authority as
@@ -2008,8 +2008,8 @@ X.509 certificates is available in Keys.
 

 

 

-

-
6.11. Install Server Certificate

+

+
6.11. Install Server Certificate

 

 

 The servers on Front use the same certificate (and key) to
@@ -2273,8 +2273,8 @@ created by a more specialized role.
 

 

 

-

-
6.14. Configure Dovecot IMAPd

+

+
6.14. Configure Dovecot IMAPd

 

 

 Front uses Dovecot's IMAPd to allow user Fetchmail jobs on Core to
@@ -2738,8 +2738,8 @@ the users' ~/Public/HTML/ directories.
 

 

 

-

-
6.16. Configure OpenVPN

+

+
6.16. Configure OpenVPN

 

 

 Front uses OpenVPN to provide the institute's public VPN service.  The
@@ -3063,8 +3063,8 @@ Debian install and remote access to a privileged, administrator's
 account.  (For details, see The Core Machine.)
 

 

-

-
7.1. Include Particulars

+

+
7.1. Include Particulars

 

 

 The first task, as in The Front Role, is to include the institute
@@ -3086,8 +3086,8 @@ particulars and membership roll.
 

 

 

-

-
7.2. Configure Hostname

+

+
7.2. Configure Hostname

 

 

 This task ensures that Core's /etc/hostname and /etc/mailname are
@@ -3120,8 +3120,8 @@ proper email delivery.
 

 

 

-

-
7.3. Enable Systemd Resolved

+

+
7.3. Enable Systemd Resolved

 

 

 Core starts the systemd-networkd and systemd-resolved service
@@ -3165,8 +3165,8 @@ units on boot.  See Enable Systemd Resolved.
 

 

 

-

-
7.4. Configure Systemd Resolved

+

+
7.4. Configure Systemd Resolved

 

 

 Core runs the campus name server, so Resolved is configured to use it
@@ -3633,8 +3633,8 @@ craps up /var/log/ and the Systemd journal.
 

 

 

-

-
7.8. Add Administrator to System Groups

+

+
7.8. Add Administrator to System Groups

 

 

 The administrator often needs to read (directories of) log files owned
@@ -3654,8 +3654,8 @@ these groups speeds up debugging.
 

 

 

-

-
7.9. Configure Monkey

+

+
7.9. Configure Monkey

 

 

 The small institute runs cron jobs and web scripts that generate
@@ -3755,8 +3755,8 @@ with Nextcloud on the command line.
 

 

 

-

-
7.12. Configure User Accounts

+

+
7.12. Configure User Accounts

 

 

 User accounts are created immediately so that backups can begin
@@ -3798,8 +3798,8 @@ describes the members and usernames variables.
 

 

 

-

-
7.13. Trust Institute Certificate Authority

+

+
7.13. Trust Institute Certificate Authority

 

 

 Core should recognize the institute's Certificate Authority as
@@ -3831,8 +3831,8 @@ X.509 certificates is available in Keys.
 

 

 

-

-
7.14. Install Server Certificate

+

+
7.14. Install Server Certificate

 

 

 The servers on Core use the same certificate (and key) to authenticate
@@ -4085,8 +4085,8 @@ installed by more specialized roles.
 

 

 

-

-
7.18. Configure Dovecot IMAPd

+

+
7.18. Configure Dovecot IMAPd

 

 

 Core uses Dovecot's IMAPd to store and serve member emails.  As on
@@ -5970,8 +5970,8 @@ applied first, by which Gate gets a campus machine's DNS and Postfix
 configurations, etc.
 

 

-

-
8.1. Include Particulars

+

+
8.1. Include Particulars

 

 

 The following should be familiar boilerplate by now.
@@ -6345,8 +6345,8 @@ the daemon listens only on the Gate-WiFi network interface.
 

 

 

-

-
8.6. Install Server Certificate

+

+
8.6. Install Server Certificate

 

 

 The (OpenVPN) server on Gate uses an institute certificate (and key)
@@ -6373,8 +6373,8 @@ and Front) do.
 

 

 

-

-
8.7. Configure OpenVPN

+

+
8.7. Configure OpenVPN

 

 

 Gate uses OpenVPN to provide the institute's campus VPN service.  Its
@@ -6537,8 +6537,8 @@ Wireless campus devices can get a key to the campus VPN from the
 configured manually.
 

 

-

-
9.1. Include Particulars

+

+
9.1. Include Particulars

 

 

 The following should be familiar boilerplate by now.
@@ -6554,8 +6554,8 @@ The following should be familiar boilerplate by now.
 

 

 

-

-
9.2. Configure Hostname

+

+
9.2. Configure Hostname

 

 

 Clients should be using the expected host name.
@@ -6570,26 +6570,20 @@ Clients should be using the expected host name.
     dest: "{{ item.file }}"
   loop:
   - { file: /etc/hostname,
-      content: "{{ inventory_hostname }}" }
+      content: "{{ inventory_hostname }}\n" }
   - { file: /etc/mailname,
-      content: "{{ inventory_hostname }}.{{ domain_priv }}" }
-  when: inventory_hostname != ansible_hostname
-  notify: Update hostname.
+      content: "{{ inventory_hostname }}.{{ domain_priv }}\n" }
 
-
- - -
-roles_t/campus/handlers/main.yml
---
 - name: Update hostname.
   become: yes
   command: hostname -F /etc/hostname
+  when: inventory_hostname != ansible_hostname
-
-

9.3. Enable Systemd Resolved

+
+

9.3. Enable Systemd Resolved

Campus machines start the systemd-networkd and systemd-resolved @@ -6633,8 +6627,8 @@ service units on boot. See Enable Systemd Resolved.

-
-

9.4. Configure Systemd Resolved

+
+

9.4. Configure Systemd Resolved

Campus machines use the campus name server on Core (or dns.google), @@ -6660,7 +6654,7 @@ and include the institute's private domain in their search lists.

-roles_t/campus/handlers/main.yml
+roles_t/campus/handlers/main.yml
---
 - name: Reload Systemd.
   become: yes
   command: systemctl daemon-reload
@@ -6705,8 +6699,8 @@ and file timestamps.
-
-

9.6. Add Administrator to System Groups

+
+

9.6. Add Administrator to System Groups

The administrator often needs to read (directories of) log files owned @@ -6726,8 +6720,8 @@ these groups speeds up debugging.

-
-

9.7. Trust Institute Certificate Authority

+
+

9.7. Trust Institute Certificate Authority

Campus hosts should recognize the institute's Certificate Authority as @@ -6759,8 +6753,8 @@ keys, certificates and passwords, see Keys.)

-
-

9.8. Install Unattended Upgrades

+
+

9.8. Install Unattended Upgrades

The institute prefers to install security updates as soon as possible. @@ -8526,10 +8520,8 @@ VBoxManage startvm $NAME --type headless

The machine's console should soon show the installer's first prompt: -to choose a system language. (The prompts might be answered by -"preseeding" the Debian installer, but that process has yet to be -debugged.) The appropriate responses to the installer's prompts are -given in the list below. +to choose a system language. The appropriate responses to the +installer's prompts are given in the list below.

    @@ -8624,8 +8616,7 @@ additional software packages.

    Note that the Postfix installation may prompt for a couple settings. -The defaults, listed below, are fine, but the system mail name should -be the same as the institute's domain name. +The defaults, listed below, are fine.

      @@ -9702,7 +9693,7 @@ routes on Front and Gate, making the simulation less… similar.

Author: Matt Birkholz

-

Created: 2023-12-30 Sat 14:12

+

Created: 2024-01-01 Mon 10:48

Validate

-- 2.25.1