bsdnix/README.md

Ansible roles and playbook to maintain bsdnix.de

Basics

In order to be able to deploy freebsd vps' on Hetzner cloud you need to do:

• first create a vps with debian
• from there install freebsd using mfs method (uncle google will tell you)
• update the freebsd system
• install python and https://github.com/paulc/hcloud-freebsd
• enable hcloud-freebsd
• /etc/rc.conf shall not contain a hostname or ip config, hcloud-freebsd will add it. Even ipv6 only works, since the script grabs the server vars from 169.254.169.254, which will be reachable even if the server has no public ipv4 ip
• cleanup history, logs, etc
• shutdown the vps
• create a snapshot, name it visely, I name mine like: FreeBSD-14.1-RELEASE-hcloud-init
• delete the builder vps

Then you can deploy new freebsd vps' using this snapshot. They'll come up, configure themselves to be reachable.

The deploy.yaml playbook will then use the hetzner cloud dynamic inventory to discover your vps. So, you have to call make deploy twice: once to deploy a new vps and second time to configure it. Subsequent calls only configure of course.

Setup ansible

• Create group_vars/all/vars.yaml with this content:

  hetzner_cloud_token: <YOUR-HETZNER-HCLOUD-TOKEN>
  

• Create a file containing some generated password: pwgen -ys 32 1 > ~/.config/ansible/hcloud.secret

• Encrypt the vars file: ansible-vault encrypt --vault-password-file ~/.config/ansible/hcloud.secret group_vars/all/vars.yaml

Now the hetzner ansible plugin is able to call hcloud with the appropriate token, no need to enter it manually anymore. Also, while the yaml file containing the token might be part of your public repo, it is a ansible vauld, properly encrypted and the key stays local on your work machine.

To use

• make deploy: deploy a new shell VPS and configure it if it already exists, only configure

• make clean: remove the shell VPC. Do not do this with the production instance!

To make the output more verbose, add -v[vvv] to the target, e.g.: make depoy-vvvv