vientos-deploy

Ansible playbook to deploy vientos stack

It assumes Ubuntu 18.04TLS, playbook tested to work in LXD containers

Usage

configure

hosts.yml

Firs of all add entry to inventory/hosts.yml following other existin entries and ansible inventory documentation eg.

mx:
  children:
    mx-staging:
      hosts:
        staging.vientos.coop:
          ansible_host: 136.243.86.184
          ansible_port: 2222
          ansible_python_interpreter: /usr/bin/python3

group_vars

Add configuration specific to the group of hosts you maintain to inventory/group_vars/ eg.

inventory.group_vars/mx.yml

---
ssh_key_urls:
  - https://github.com/elf-pavlik.keys
language: es
country: mx
map:
  latitude: 19.43
  longitude: -99.13
  zoom: 9
  tilelayer: "https://api.mapbox.com/styles/v1/vientos/cixqjuql4002y2rrsrjy004fg/tiles/256/{z}/{x}/{y}@2x?access_token=

host_vars

Configuration specific to each host goes to inventory/host_vars/, you need to create a directory for each host with two files in it config.yml and secrets.yml (this one stays git ignored!) eg.

inventory/host_vars/staging.vientos.coop/config.yml

---
common:
  env: staging
  backups:
    destination: user@domain.tld:backups

website:
  name: website
  domain: staging.vientos.coop
  alternative_domain: www.staging.vientos.coop

app:
  name: app
  domain: app.staging.vientos.coop

service:
  name: service
  domain: data.staging.vientos.coop
  port: 8000

idp:
  name: idp
  domain: idp.staging.vientos.coop
  port: 8001

webhooks:
  name: webhooks
  domain: webhooks.staging.vientos.coop
  port: 8002

To disable any of the services simply leave its domain undefined eg.

common:
  env: staging

website:
  name: website

app:
  name: app

service:
  name: service
  domain: data.staging.vientos.coop
  port: 8000

idp:
  name: idp

webhooks:
  name: webhooks

inventory/host_vars/staging.vientos.coop/secrets.yml

---
secrets:
  common:
    letsencryptEmail: # email used to agree to Let's encrypt Terms of Service
    fromEmail: # email used as *From* in emails sent by service and idp
    mailjet:
      public: # get it from https://app.mailjet.com/account/api_keys
      secret: # get it from https://app.mailjet.com/account/api_keys

  app:
    sentry: # get it from https://sentry.io/settings/
    google:
        apiKey: # get it from https://console.developers.google.com
    cloudinary:
      cloud: # get it from https://cloudinary.com/console
      preset: # get it from https://cloudinary.com/console/settings/upload

  service:
    cookie: # generate eg. openssl rand -base64 32
    sentry: # get it from https://sentry.io/settings/
    google:
      clientId: # get it from https://console.developers.google.com
      clientSecret: # get it from https://console.developers.google.com
      gcmApiKey: # get it from https://console.developers.google.com
    facebook:
      clientId: # get it from https://developers.facebook.com/
      clientSecret: # get it from https://developers.facebook.com/

  idp:
    cookie: # generate eg. openssl rand -base64 32
    sentry: # get it from https://sentry.io/settings/
    clientId: # choose one eg. staging-idp
    clientSecret: # generate eg. openssl rand -base64 32

  webhooks:
    secret: # set in https://github.com/vientos/{repo}/settings/hooks

run

ansible-playbook site.yml

test run

For testing purposes Let's Encrypt provides a staging environemnt

ansible-playbook site.yml --extra-vars "letsencrypt_staging=yes"

Details

3rd party services

Cloudinary - http://cloudinary.com
Google - https://console.developers.google.com
- Firebase - https://console.firebase.google.com
Facebook - https://developers.facebook.com/
Sentry - https://sentry.io
Github - https://github.com

Nginx

Included nginx blocks configuration includes

listens on IPv4 and IPv6 interfaces
uses HTTP/2
enables gzip compression
uses Let's Encrypt certificates
redirects HTTP to HTTPS
servers index.html for app if requested path doesn't exist
disables buffering on data service (needed for Server Sent Events to work)
sets max body size

systemd & journald

Systemd manages deployed serivces as user units, systemctl --user provides interface to them e.g.

systemctl --user status vientos-service

In similar way journalctl --user provides interface to see logs of those services e.g.

journalctl --user -u vientos-service

Commands above should get executed as unpriviledged user, by default vientos.

backups

If you specified destination for backups in the config.yaml of particular host (e.g backups.destination: user@domain.tld:backups) it will install a cron job which daily runs backup script which does following steps:

dumps compressed mongo databases to ~/backups
rsyncs ~/backups to specified destination

It will use ssh key generated for unpriviledged user (vientos by default). To to bootstrap authentication manually do following steps:

append content of /home/vientos/.ssh/id_rsa.pub to ~/.ssh/authorized_keys on the destination server
as vientos user on deployed host, try ssh to specified destination server and accept adding its key fingreprint to the list of known hosts

LXD host

Setup follows: https://www.digitalocean.com/community/tutorials/how-to-host-multiple-web-sites-with-nginx-and-haproxy-using-lxd-on-ubuntu-16-04

ZFS configuration

Required for journalctl --user to work, if you have ZFS filesystem for staging container in default pool

sudo zfs set acltype=posixacl default/containers/staging
sudo zfs set xattr=sa default/containers/staging

Otherwise journalctl --user results in error Failed to search journal ACL: Operation not supported

iptables

We need to forward ports 80 and 443 to haproxy container

sudo iptables -A PREROUTING -t nat -i your_network_dev -p tcp --dport 80 -j DNAT --to-destination your_haproxy_ip:80
sudo iptables -A PREROUTING -t nat -i your_network_dev -p tcp --dport 443 -j DNAT --to-destination your_haproxy_ip:443

As well as map custom SSH ports to coresponding containers

sudo iptables -A PREROUTING -t nat -i your_network_dev -p tcp --dport your_custom_ssh_port -j DNAT --to your_container_ip:22
sudo iptables -A FORWARD -p tcp -d your_container_ip --dport 22 -j ACCEPT

To remove those mappings simply replace iptables -A with iptables -D

Make sure you make those rules persistent

sudo apt-get install iptables-persistent

every time you change them

sudo netfilter-persistent save

ssh

You can import SSH keys from github using ssh-import-id

ogvilla / vientos-deploy