Python 3 is specified explicitly during virtual environment

   creation and in ``ansible.cfg`` configuration file

   (``interpreter_python`` option under ``defaults`` section).

Pre-requisites

--------------

For the set-up outlined in this usage guide you'll need the following:

  be installed on top of this server. The server will be set-up

  manually (this is currently out of scope for the *Majic Ansible

  Roles* automated set-up).

* Three servers where the services will be set-up. All servers must be able to

  communicate over network with each-other, the Ansible servers, and with

  usage instructions.

* All servers should be on the same network.

* IP addresses for all servers should be known.

* Netmask for all servers should be known.

* Gateway for all servers should be known.

In case of the servers listed above, it might be safest to have them as VMs -

this is cheapest thing to do, and simplest (who wants to deal with pesky hardware anyway?).

Usage instructions assume the following:

* Domain used for all servers is ``example.com``. If you wish to use a different

  domain, adjust the instructions accordingly.

Installing required packages

----------------------------

With the operating system installed, it is necessary to install a couple of

packages, and to prepare the environment a bit on the Ansible server:

1. Install the necessary system packages (using the ``root`` account)::

     apt-get install -y virtualenv virtualenvwrapper git python3-pip python3-dev libffi-dev libssl-dev

   .. warning::

      If you are already logged-in as user ``ansible`` in the server, you will

      need to log-out and log-in again in order to be able to use

      ``virtualenvwrapper`` commands!

   ::

     mkdir ~/mysite/

     mkvirtualenv -p /usr/bin/python3 -a ~/mysite/ mysite

     pip install -U pip setuptools

     pip install 'ansible~=2.9.0' dnspython

7. The preseed files should have been updated now, and you should have the new

   customised configuration files in the ``preseed_files`` directory. You can

   now use these to install the servers.

Installing the servers with preseed files

-----------------------------------------

You have your preseed files now, so you can go ahead and install the

servers ``comms.example.com``, ``www.example.com``, and

``bak.example.com`` using them with network install CD. Have a look at

`Debian instructions

more details.

If you need to, you can easily serve the preseed files from the Ansible server

with Python's built-in HTTP server::

  cd ~/mysite/preseed_files/

  python3 -m http.server 8000

Then you can point installer to the preseed file selecting the

``Advanced options -> Automated install`` (don't press ``ENTER`` yet),

then pressing ``TAB``, and appending the following at the end (just

fill-in the correct hostname - ``comms``, ``www``, or ``bak``)::

      ansible_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

      os_users:

        - name: admin

          uid: 1000

          additional_groups:

            - sudo

          authorized_keys:

            - "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

          password: "{{ 'admin' | password_hash('sha512') }}"

      common_packages:

      ca_certificates:

        truststore: "{{ lookup('file', '~/mysite/tls/truststore.pem') }}"

   .. note::

      The ``common`` role comes with ability to set-up time

      synchronisation using NTP. This is not done by default. For

      details see the role parameter ``ntp_servers``.

   .. note::

      The ``ca_certificates`` parameter lets us deploy custom CA

      certificates on servers. The name we pick (in this case