ltrace Infrastructure

Private infrastructure managed with Ansible.

Prerequisites

Control machine

• Ansible installed
• SSH key loaded in ssh-agent:

  ssh-add ~/.ssh/ansible_key
  

Managed machines

Each host must be prepared manually before Ansible can manage it:

1. Create the ansible user with passwordless sudo:

   useradd -m -s /bin/bash ansible
   echo "ansible ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/ansible
   

2. Copy the ansible public key to the user's authorized_keys:

   mkdir -p /home/ansible/.ssh
   echo "<contents of files/ansible_key.pub>" >> /home/ansible/.ssh/authorized_keys
   chmod 700 /home/ansible/.ssh
   chmod 600 /home/ansible/.ssh/authorized_keys
   chown -R ansible:ansible /home/ansible/.ssh
   

3. Install required packages:

   apt-get install -y sudo python3 python3-apt
   

Services

VPN

Adding a host to VPN

On client machine, install wireguard:

apt-get install -y wireguard

Generate a key pair:

wg genkey | tee /etc/wireguard/private.key | wg pubkey > public.key

On the client machine, create /etc/wireguard/wg0.conf:

[Interface]
Address = 10.0.0.2/32
PrivateKey = <your private key>

[Peer]
PublicKey = <server public key>
EndPoint = vpn.ltrace.de:51820
AllowedIPs = 10.0.0.0/24

Then, add a wireguard peer to inventory/host_vars/b/wireguard.yml

wireguard_peers:
    - name: laptop
      public_key: "<public.key>"
      allowed_ips: 10.0.0.2/32

Run scripts/wireguard.sh to update the VPN config.

Mail

Managing mail users

Mail accounts are stored in an Ansible Vault file at inventory/host_vars/<host>/vault.yml. Each account requires a pre-hashed password in SHA512-CRYPT format.

Adding a user

1. Generate a password hash:

   doveadm pw -s SHA512-CRYPT -u user@example.com
   

2. Edit the vault file for the target host:

   ansible-vault edit inventory/host_vars/b/vault.yml
   

   Add the account under vault_mail_accounts:

   vault_mail_accounts:
     - address: user@ltrace.de
       password_hash: "{SHA512-CRYPT}$6$..."
   

3. Apply the playbook to deploy the updated accounts file:

   ansible-playbook playbooks/site.yml -l b
   

If vault.yml does not exist yet, create it with:

ansible-vault create inventory/host_vars/b/vault.yml

The vault password is read from .vault_pass (gitignored). See ansible.cfg for the configured vault password file path.

Managing mail aliases

Mail aliases are configured in inventory/host_vars/<host>/mail.yml under mail_aliases. Each entry maps a source address to one or more destination addresses.

mail_aliases:
  - from: alias@example.com
    to: [ user@example.com ]
  - from: team@example.com
    to: [ alice@example.com, bob@example.com ]

After editing, apply the playbook:

ansible-playbook playbooks/site.yml -l b

Usage

# Dry run
ansible-playbook playbooks/site.yml --check

# Apply to all hosts
ansible-playbook playbooks/site.yml

# Apply to a single host
ansible-playbook playbooks/site.yml -l b