rainbowsheep-cloud/README.md

Rainbowsheep Cloud Server 🐑 🌈

Ansible recipes to install and maintain an instance of the Rainbowsheep cloud.

The Rainbowsheep cloud is a very lightweight and secured data cloud based on standard or widely available tools such as NFS, Kerberos and gocryptfs.

It is an alternative to heavy cloud infrastructure such as NextCloud that requires databases, web clients and so on.

The Rainbowsheep cloud is accessible as a regular Linux file system. This allows to easily connect to the cloud with standard Linux tools, and to easily and efficiently perfom complex operations on files if required.

Server structure

Data for all users are stored in the following directories:

/srv
├── protected
│   ├── user1
│   ├── user2
│   └── ...
└── vault
    ├── user1
    ├── user2
    └── ...

Data in /srv/protected is stored as plain files on the server, so this endpoint must be served using krb5p, i.e. Kerberos authentication and encryption. This means your data is securely transmitted and other users cannot have access to your data, but a root user on the server can read it.

Data in /srv/vault is encrypted at the filesystem level using gocryptfs. This means you need your own private password to access your data locally. Only uncrypted data is visible from the server, even for root user. In consequence, the /srv/vault endpoint can be securely served using krb5, i.e. Kerberos authentication only, as transmitted data is the gocryptfs encrypted data.

Configure

Initialize the Kerberos master password:

ansible-vault encrypt_string --ask-vault-pass --stdin-name "krb5_master_password" --output krb5_master_password.yaml

Install

Install cloud using Ansible:

ansible-playbook -i inventory -e "@krb5_master_password.yml" --ask-vault-pass rainbowsheep-cloud.yml

Create user

export RAINBOW_NEW_USER=...

Initialize user password:

ansible-vault encrypt_string --ask-vault-pass --stdin-name "password" --output $RAINBOW_NEW_USER.yml 
echo "username=$RAINBOW_NEW_USER" >> $RAINBOW_NEW_USER.yml

Deploy the new user:

ansible-playbook -i inventory -e "@$RAINBOW_NEW_USER.yml" create-user.yml

Once created, the specified password can be used on client side for Kerberos authentication (kinit) and to mount the gocryptfs vault.