#! Admin Tools
Ansible playbooks and other admin tools/docs for maintaining the #! network.
- Recent version of Ansible
- Local #! pass database
- User with sudo access on all servers
You might also want to use the following snippet in
[diff "gpg"] textconv = gpg --no-tty --decrypt cachetextconv = false [diff "ansible-vault"] textconv = ansible-vault view cachetextconv = false
All the “service servers” (as opposed to shell servers) listen for SSH
on port 8993 (ASCII-encoding of
#!), and the user is
the following exceptions:
sfo1.irc.hashbang.shdo not yet follow that convention;
git-infra.hashbang.shis a service hosted on
nyc3.apps.hashbang.shwhich uses port 22.
This is expressed in the following
Host da1.hashbang.sh ny1.hashbang.sh sf1.hashbang.sh to1.hashbang.sh User your_nick Host git-infra.hashbang.sh User git Host sfo1.irc.hashbang.sh ldap.hashbang.sh User core Host *.hashbang.sh hashbang.sh User core Port 8993
There are several playbooks present here:
shell.ymlis used to synchronise the configuration (incl. installed packages) across the shell servers.
credentials.ymlis used to deploy the admin's SSH keys across all servers:
- admins can login as
rooton the shell servers;
- they can login as
coreon the CoreOS servers.
- admins can login as
coreos.ymlperforms CoreOS-specific tasks. Currently, it only bootstraps the Ansible agent's dependencies.
mail.ymldeploy the mail aliases and Postfix configuration.
irc.ymldeploys static and templated configuration to the IRC servers, including oper blocks for users defined in
ldap_ban.ymldisables user accounts in LDAP and terminates their sessions on the shell servers; it requires python-ldap installed. Invoke as follows:
For scripting purposes, the script accepts a comma-separated list of users, (
users), and a Boolean determining if the homedirs should be deleted (
Install a package
Making a configuration change
- Prepare your change for
shell-etc, test it locally.
- Create a pull-request for it on Github, wait for a review.
- Perform a signed merge into
git merge -S --no-ff branch
Only merge into
masterthings that you will deploy immediately. Do not merge if you aren't in a position to follow-up with a deploy.
- Run the
shell.ymlplaybook, see below.
Sync packages & configuration across all shell servers
Simply run the appropriate Ansible playbook: