pbreugno/rainbowsheep-cloud
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: Base rainbowsheep-cloud ansible playbooks and roles

Browse source
This commit is contained in:
Paul Breugnot 2026-10-19 14:24:03 +02:00
commit 494e748beb
12 changed files with 345 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

73
README.md Normal file
View file

@ -0,0 +1,73 @@
# Rainbowsheep Cloud Server :sheep: :rainbow:
Ansible recipes to install and maintain an instance of the Rainbowsheep cloud.
The Rainbowsheep cloud is a very lightweight and secured data cloud based on
standard or widely available tools such as NFS, Kerberos and gocryptfs.
It is an alternative to heavy cloud infrastructure such as NextCloud that
requires databases, web clients and so on.
The Rainbowsheep cloud is accessible as a regular Linux file system. This allows
to easily connect to the cloud with standard Linux tools, and to easily and
efficiently perfom complex operations on files if required.
## Server structure
Data for all users are stored in the following directories:
```
/srv
├── protected
│ ├── user1
│ ├── user2
│ └── ...
└── vault
├── user1
├── user2
└── ...
```
Data in `/srv/protected` is stored as plain files on the server, so this
endpoint must be served using `krb5p`, i.e. Kerberos authentication and
encryption. This means your data is securely transmitted and other users cannot
have access to your data, but a `root` user on the server can read it.
Data in `/srv/vault` is encrypted at the filesystem level using `gocryptfs`.
This means you need your own private password to access your data locally. Only
uncrypted data is visible from the server, even for `root` user. In consequence,
the `/srv/vault` endpoint can be securely served using `krb5`, i.e. Kerberos
authentication only, as transmitted data is the `gocryptfs` encrypted data.
# Configure
Initialize the Kerberos master password:
```bash
ansible-vault encrypt_string --ask-vault-pass --stdin-name "krb5_master_password" --output krb5_master_password.yaml
```
# Install
Install cloud using Ansible:
```bash
ansible-playbook -i inventory -e "@krb5_master_password.yml" --ask-vault-pass rainbowsheep-cloud.yml
```
# Create user
```bash
export RAINBOW_NEW_USER=...
```
Initialize user password:
```bash
ansible-vault encrypt_string --ask-vault-pass --stdin-name "password" --output $RAINBOW_NEW_USER.yml
echo "username=$RAINBOW_NEW_USER" >> $RAINBOW_NEW_USER.yml
```
Deploy the new user:
```bash
ansible-playbook -i inventory -e "@$RAINBOW_NEW_USER.yml" create-user.yml
```
Once created, the specified password can be used on client side for Kerberos
authentication (`kinit`) and to mount the `gocryptfs` vault.