# Rainbowsheep Cloud Server :sheep: :rainbow:

Ansible recipes to install and maintain an instance of the Rainbowsheep cloud.

The Rainbowsheep cloud is a very lightweight and secured data cloud based on
standard or widely available tools such as NFS, Kerberos and gocryptfs.

It is an alternative to heavy cloud infrastructure such as NextCloud that
requires databases, web clients and so on.

The Rainbowsheep cloud is accessible as a regular Linux file system. This allows
to easily connect to the cloud with standard Linux tools, and to easily and
efficiently perfom complex operations on files if required.

## Server structure

Data for all users are stored in the following directories:
```
/srv
├── protected
│   ├── user1
│   ├── user2
│   └── ...
└── vault
    ├── user1
    ├── user2
    └── ...
```

Data in `/srv/protected` is stored as plain files on the server, so this
endpoint must be served using `krb5p`, i.e. Kerberos authentication and
encryption. This means your data is securely transmitted and other users cannot
have access to your data, but a `root` user on the server can read it.

Data in `/srv/vault` is encrypted at the filesystem level using `gocryptfs`.
This means you need your own private password to access your data locally. Only
uncrypted data is visible from the server, even for `root` user. In consequence,
the `/srv/vault` endpoint can be securely served using `krb5`, i.e. Kerberos
authentication only, as transmitted data is the `gocryptfs` encrypted data.

# Configure

Initialize the Kerberos master password:
```bash
ansible-vault encrypt_string --ask-vault-pass --stdin-name "krb5_master_password" --output krb5_master_password.yaml
```

# Install

Install cloud using Ansible:
```bash
ansible-playbook -i inventory -e "@krb5_master_password.yml" --ask-vault-pass rainbowsheep-cloud.yml
```

# Create user

```bash
export RAINBOW_NEW_USER=...
```

Initialize user password:
```bash
ansible-vault encrypt_string --ask-vault-pass --stdin-name "password" --output $RAINBOW_NEW_USER.yml 
echo "username=$RAINBOW_NEW_USER" >> $RAINBOW_NEW_USER.yml
```

Deploy the new user:
```bash
ansible-playbook -i inventory -e "@$RAINBOW_NEW_USER.yml" create-user.yml
```

Once created, the specified password can be used on client side for Kerberos
authentication (`kinit`) and to mount the `gocryptfs` vault.