56 lines
2.0 KiB
Markdown
56 lines
2.0 KiB
Markdown
|
## Ansible roles and playbook to maintain bsdnix.de
|
||
|
|
|
||
|
|
### Basics
|
||
|
|
|
||
|
|
In order to be able to deploy freebsd vps' on Hetzner cloud you need to do:
|
||
|
|
|
||
|
|
- first create a vps with debian
|
||
|
|
- from there install freebsd using mfs method (uncle google will tell you)
|
||
|
|
- update the freebsd system
|
||
|
|
- install python and https://github.com/paulc/hcloud-freebsd
|
||
|
|
- enable hcloud-freebsd
|
||
|
|
- `/etc/rc.conf` shall not contain a hostname or ip config, hcloud-freebsd will
|
||
|
|
add it. Even ipv6 only works, since the script grabs the server vars from
|
||
|
|
169.254.169.254, which will be reachable even if the server has no public ipv4 ip
|
||
|
|
- cleanup history, logs, etc
|
||
|
|
- shutdown the vps
|
||
|
|
- create a snapshot, name it visely, I name mine like: `FreeBSD-14.1-RELEASE-hcloud-init`
|
||
|
|
- delete the builder vps
|
||
|
|
|
||
|
|
Then you can deploy new freebsd vps' using this snapshot. They'll come
|
||
|
|
up, configure themselves to be reachable.
|
||
|
|
|
||
|
|
The `deploy.yaml` playbook will then use the hetzner cloud dynamic
|
||
|
|
inventory to discover your vps. So, you have to call `make deploy`
|
||
|
|
twice: once to deploy a new vps and second time to configure
|
||
|
|
it. Subsequent calls only configure of course.
|
||
|
|
|
||
|
|
### Setup ansible
|
||
|
|
|
||
|
|
- Create `group_vars/all/vars.yaml` with this content:
|
||
|
|
```yaml
|
||
|
|
hetzner_cloud_token: <YOUR-HETZNER-HCLOUD-TOKEN>
|
||
|
|
```
|
||
|
|
- Create a file containing some generated password:
|
||
|
|
`pwgen -ys 32 1 > ~/.config/ansible/hcloud.secret`
|
||
|
|
|
||
|
|
- Encrypt the vars file:
|
||
|
|
`ansible-vault encrypt --vault-password-file
|
||
|
|
~/.config/ansible/hcloud.secret group_vars/all/vars.yaml`
|
||
|
|
|
||
|
|
Now the hetzner ansible plugin is able to call hcloud with the
|
||
|
|
appropriate token, no need to enter it manually anymore. Also, while
|
||
|
|
the yaml file containing the token might be part of your public repo,
|
||
|
|
it is a ansible vauld, properly encrypted and the key stays local on
|
||
|
|
your work machine.
|
||
|
|
|
||
|
|
### To use
|
||
|
|
|
||
|
|
- `make deploy`: deploy a new shell VPS and configure it
|
||
|
|
if it already exists, only configure
|
||
|
|
|
||
|
|
- `make clean`: remove the shell VPC. Do not do this with the production instance!
|
||
|
|
|
||
|
|
|
||
|
|
To make the output more verbose, add `-v[vvv]` to the target, e.g.: `make depoy-vvvv`
|