feat: Base rainbowsheep-cloud ansible playbooks and roles

roles/chrony/tasks/main.yml

@@ -0,0 +1,22 @@
+---
+# tasks file for chrony_client
+- name: Install chrony
+  ansible.builtin.apt:
+    name: chrony
+    state: present
+    update_cache: yes
+
+# - name: Configure chrony client
+  # ansible.builtin.template:
+    # src: chrony.conf.j2
+    # dest: /etc/chrony/chrony.conf
+    # owner: root
+    # group: root
+    # mode: "0644"
+  # notify: Restart chrony
+
+- name: Enable and start chrony
+  ansible.builtin.service:
+    name: chrony
+    state: started
+    enabled: yes

roles/kerberos/defaults/main.yml

@@ -0,0 +1,2 @@
+
+kerberos_realm: "{{ ansible_facts['hostname'] }}"

roles/kerberos/handlers/main.yml

@@ -0,0 +1,8 @@
+- name: Restart krb5 kdc
+  ansible.builtin.service:
+    name: krb5-kdc
+    state: restarted
+- name: Restart krb5 admin server
+  ansible.builtin.service:
+    name: krb5-admin-server
+    state: restarted

roles/kerberos/tasks/main.yml

@@ -0,0 +1,76 @@
+- name: Install Kerberos server
+  ansible.builtin.apt:
+    pkg:
+      - krb5-user
+      - krb5-kdc
+      - krb5-admin-server
+    state: present
+    update_cache: yes
+
+- name: Enables krb5-kdc
+  ansible.builtin.service:
+    name: krb5-kdc
+    enabled: true
+
+- name: Enables krb5-admin-server
+  ansible.builtin.service:
+    name: krb5-admin-server
+    enabled: true
+
+- name: Configure krb5
+  ansible.builtin.template:
+    src: krb5.conf.j2
+    dest: /etc/krb5.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart krb5 kdc
+    - Restart krb5 admin server
+
+- name: Configure krb5 kdc
+  ansible.builtin.template:
+    src: kdc.conf.j2
+    dest: /etc/krb5kdc/kdc.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart krb5 kdc
+    - Restart krb5 admin server
+
+- name: Configure krb5 ACLs
+  # Allow */admin (notable root/admin) user to manage principals
+  ansible.builtin.template:
+    src: kadm5.acl.j2
+    dest: /etc/krb5kdc/kadm5.acl
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart krb5 kdc
+    - Restart krb5 admin server
+
+
+- name: Create kdc
+  ansible.builtin.command:
+    cmd: "kdb5_util create -P {{ krb5_master_password }}"
+  register: create_kdc
+  failed_when: create_kdc.rc != 0 and create_kdc.rc != 1
+  changed_when: create_kdc.rc == 0
+
+- name: Create kdc stash file
+  # The stash file is specified in kdc.conf as key_stash_file
+  ansible.builtin.command:
+    cmd: "kdb5_util stash -P {{ krb5_master_password }}"
+
+- name: Start krb5-kdc
+  ansible.builtin.service:
+    name: krb5-kdc
+    state: started
+
+- name: Start krb5-admin-server
+  ansible.builtin.service:
+    name: krb5-admin-server
+    state: started
+

roles/kerberos/templates/kadm5.acl.j2

@@ -0,0 +1 @@
+*/admin@{{ kerberos_realm | upper }} *

roles/kerberos/templates/kdc.conf.j2

@@ -0,0 +1,21 @@
+[kdcdefaults]
+    kdc_ports = 750,88
+
+[realms]
+    {{ kerberos_realm | upper }} = {
+        database_name = /var/lib/krb5kdc/principal
+        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
+        acl_file = /etc/krb5kdc/kadm5.acl
+        key_stash_file = /etc/krb5kdc/stash
+        kdc_ports = 750,88
+        max_life = 3d 0h 0m 0s
+        max_renewable_life = 7d 0h 0m 0s
+        #master_key_type = aes256-cts
+        #supported_enctypes = aes256-cts:normal aes128-cts:normal
+        default_principal_flags = +preauth
+    }
+
+[logging]
+	kdc = CONSOLE
+	kdc = FILE:/var/log/kdc.log
+	debug = true

roles/kerberos/templates/krb5.conf.j2

@@ -0,0 +1,28 @@
+[libdefaults]
+	default_realm = {{ kerberos_realm | upper }}
+	dns_lookup_realm = true
+    dns_lookup_kdc = true
+
+# The following krb5.conf variables are only for MIT Kerberos.
+	kdc_timesync = 1
+	ccache_type = 4
+	forwardable = true
+	proxiable = true
+	rdns = false
+
+    ticket_lifetime = 3d
+    renew_lifetime = 7d
+
+# The following libdefaults parameters are only for Heimdal Kerberos.
+	fcc-mit-ticketflags = true
+
+[realms]
+	{{ kerberos_realm | upper }} = {
+		kdc = kerberos.{{ kerberos_realm }}
+		admin_server = kerberos.{{ kerberos_realm }}
+		default_principal_flags = +preauth
+	}
+
+[domain_realm]
+    {{ kerberos_realm }}  = {{ kerberos_realm | upper }}
+    .{{ kerberos_realm }} = {{ kerberos_realm | upper }}

roles/nfs/tasks/main.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Install nfs server
+  ansible.builtin.apt:
+    name: nfs-kernel-server
+    state: present
+    update_cache: yes
+
+- name: Create /srv/protected export
+  ansible.builtin.file:
+    state: directory
+    path: /srv/protected
+
+- name: Export /srv/protected
+  ansible.builtin.lineinfile:
+    path: /etc/exports
+    regexp: '^/srv/protected'
+    line: /srv/protected *(rw,sync,sec=krb5p,no_subtree_check) 
+
+- name: Create /srv/vault export
+  ansible.builtin.file:
+    state: directory
+    path: /srv/vault
+
+- name: Export /srv/vault
+  ansible.builtin.lineinfile:
+    path: /etc/exports
+    regexp: '^/srv/vault'
+    line: /srv/vault *(rw,sync,sec=krb5p:krb5i:krb5,no_subtree_check)
+
+- name: Enable and start NFS server
+  ansible.builtin.service:
+    name: nfs-kernel-server
+    state: started
+    enabled: yes
+

roles/vault/tasks/main.yml

@@ -0,0 +1,5 @@
+
+- name: Install gocryptfs
+  ansible.builtin.apt:
+    name: gocryptfs
+    update_cache: true