*.pyc

*~

tmp/

docs/_build/

testsite/preseed_files/

# Ignore "temporary" files created with the playbook tls.yml (certs, keys, and

# host config files for GnuTLS - ca.cfg is versioned, though).

testsite/tls/*.pem

testsite/tls/*.key

   - ``testsite/tls/mail.example.com_smtp.key``

   - ``testsite/tls/xmpp.example.com_xmpp.key``

   - ``testsite/tls/ldap.example.com_ldap.key``

   - ``testsite/tls/web.example.com_https.key``

   - ``testsite/tls/phpfino.example.com_https.key``

   - ``testsite/tls/wsgi.example.com_https.key``

4. Issue TLS certificates corresponding to the generated TLS private keys

   (correct FQDN for DNS subject alternative name **must** be used), making sure

   to change domain in filenames if necessary:

   - ``testsite/tls/mail.example.com_imap.pem`` (subject alternative name should

     be ``mail.example.com``)

   - ``testsite/tls/mail.example.com_smtp.pem`` (subject alternative name should

     be ``mail.example.com``)

   - ``testsite/tls/xmpp.example.com_xmpp.pem`` (subject alternative name should

     be ``xmpp.example.com``)

   - ``testsite/tls/ldap.example.com_ldap.pem`` (subject alternative name should

     be ``ldap.example.com``)

   - ``testsite/tls/web.example.com_https.pem`` (subject alternative name should

     be ``web.example.com``)

   - ``testsite/tls/web.example.com_https.pem`` (subject alternative name should

     be ``web.example.com``)

   - ``testsite/tls/phpinfo.example.com_https.pem`` (subject alternative name

     should be ``phpinfo.example.com``)

   - ``testsite/tls/wsgi.example.com_https.pem`` (subject alternative name

     should be ``wsgi.example.com``)

5. Create ``PEM`` truststore file which contains all CA certificates that form

   CA chain for the issued end entity certificates from previous step at

   location ``testsite/tls/ca.pem``. It is very important to

   include the full CA chain used for LDAP server.

6. Generate the preseed files:

  .. code-block:: shell

    ansible-playbook playbooks/preseed.yml

7. Install all servers using the generated preseed files.

8. Add the SSH host fingerprints to your ``known_hosts`` file (don't forget to

   remove old entries if you are redoing the process). You can easily obtain all

   the necessary fingerprints with command (don't forget to modify domain if you

   need to):

   .. code-block:: shell

9. Invoke the ``bootstrap.yml`` playbook in order to set-up some basic

   environment for Ansible runs on all servers:

  .. code-block:: shell

    ansible-playbook playbooks/bootstrap.yml

10. Finally, apply configuration on all servers:

  .. code-block:: shell

    ansible-playbook playbooks/site.yml

The playbooks and configurations for test site make a couple of assumptions:

* Each server will be set-up with an operating system user ``admin``, capable of

  running the sudo commands.

* The password for operating system user ``admin`` is hard-coded to ``admin``.

* An SSH ``authorized_keys`` file is set-up for the operating system user

  ``admin``. The SSH key stored in it will be read from location

  ``~/.ssh/id_rsa.pub`` (i.e. from home directory of user running the Ansible

  commands).

For more details on how the playbooks and configuration have been implemented,

feel free to browse the test site files (in directory ``testsite``).

[defaults]

roles_path=../roles