73 lines
2.3 KiB
Markdown
73 lines
2.3 KiB
Markdown
# Rainbowsheep Cloud Server :sheep: :rainbow:
|
|
|
|
Ansible recipes to install and maintain an instance of the Rainbowsheep cloud.
|
|
|
|
The Rainbowsheep cloud is a very lightweight and secured data cloud based on
|
|
standard or widely available tools such as NFS, Kerberos and gocryptfs.
|
|
|
|
It is an alternative to heavy cloud infrastructure such as NextCloud that
|
|
requires databases, web clients and so on.
|
|
|
|
The Rainbowsheep cloud is accessible as a regular Linux file system. This allows
|
|
to easily connect to the cloud with standard Linux tools, and to easily and
|
|
efficiently perfom complex operations on files if required.
|
|
|
|
## Server structure
|
|
|
|
Data for all users are stored in the following directories:
|
|
```
|
|
/srv
|
|
├── protected
|
|
│ ├── user1
|
|
│ ├── user2
|
|
│ └── ...
|
|
└── vault
|
|
├── user1
|
|
├── user2
|
|
└── ...
|
|
```
|
|
|
|
Data in `/srv/protected` is stored as plain files on the server, so this
|
|
endpoint must be served using `krb5p`, i.e. Kerberos authentication and
|
|
encryption. This means your data is securely transmitted and other users cannot
|
|
have access to your data, but a `root` user on the server can read it.
|
|
|
|
Data in `/srv/vault` is encrypted at the filesystem level using `gocryptfs`.
|
|
This means you need your own private password to access your data locally. Only
|
|
uncrypted data is visible from the server, even for `root` user. In consequence,
|
|
the `/srv/vault` endpoint can be securely served using `krb5`, i.e. Kerberos
|
|
authentication only, as transmitted data is the `gocryptfs` encrypted data.
|
|
|
|
# Configure
|
|
|
|
Initialize the Kerberos master password:
|
|
```bash
|
|
ansible-vault encrypt_string --ask-vault-pass --stdin-name "krb5_master_password" --output krb5_master_password.yaml
|
|
```
|
|
|
|
# Install
|
|
|
|
Install cloud using Ansible:
|
|
```bash
|
|
ansible-playbook -i inventory -e "@krb5_master_password.yml" --ask-vault-pass rainbowsheep-cloud.yml
|
|
```
|
|
|
|
# Create user
|
|
|
|
```bash
|
|
export RAINBOW_NEW_USER=...
|
|
```
|
|
|
|
Initialize user password:
|
|
```bash
|
|
ansible-vault encrypt_string --ask-vault-pass --stdin-name "password" --output $RAINBOW_NEW_USER.yml
|
|
echo "username=$RAINBOW_NEW_USER" >> $RAINBOW_NEW_USER.yml
|
|
```
|
|
|
|
Deploy the new user:
|
|
```bash
|
|
ansible-playbook -i inventory -e "@$RAINBOW_NEW_USER.yml" create-user.yml
|
|
```
|
|
|
|
Once created, the specified password can be used on client side for Kerberos
|
|
authentication (`kinit`) and to mount the `gocryptfs` vault.
|