ansible/README.md

# TuDatTr IaC

## User
It is expected that a user with sudo privilages is on the target, for me the users name is "tudattr"
you can add such user with the following command `useradd -m -g sudo -s /bin/bash tudattr`
Don't forget to set a password for the new user with `passwd tudattr`
## sudo
Install sudo on the target machine, with debian its

```sh
su root
apt install sudo
usermod -a -G sudo tudattr
```

## Backups
Backup for aya01 and raspberry are in a backblaze b2, which gets encrypted on the clientside by rclone.
but first of all we need to create the buckets and provide ansible with the needed information.

First we need to create a api key for backblaze, consists of an id and a key.
we use clone to sync to backblaze.
we can encrypt the data with rclone before sending it to backblaze.
to do this we need two buckets:
- b2
- crypt
on each device that should be backupped.

we create these by running `rclone config` and creating one [remote] b2 config and a [secret] crypt config. The crypt config should have two passwords that we store in our secrets file.

`
## Vault
- Create vault with: `ansible-vault create secrets.yml`
- Create entry in vault with: `ansible-vault edit secrets.yml`
- Add following entries: TODO
  
## Docker
To add new docker containers to the docker role you need to add the following and replace `service` with the name of your service:

- Add relevent vars to `group_vars/all/vars.yaml`:
```yaml
service:
  host: "service"
  ports:
    http: "19999"
  volumes:
    config: "{{ docker_dir }}/service/" # config folder or your dir
    data: "{{ docker_data_dir }}/service/" # data folder or your dir (only works on aya01)
```

- Create necessary directories for service in the docker role `roles/docker/tasks/service.yaml`
```yaml
- name: Create service dirs
  file:
    path: "{{ item }}"
    owner: 1000
    group: 1000
    mode: '775'
    state: directory
  loop:
    - "{{ service.volumes.config }}"
    - "{{ service.volumes.data }}"

# optional:
# - name: Place service config
#   template:
#     owner: 1000
#     mode: '660'
#     src: "templates/hostname/service/service.yml"
#     dest: "{{ prm_config }}/service.yml"
```

- Includ new tasks to `roles/docker/tasks/hostname_compose.yaml`:
```yaml
- include_tasks: service.yaml
  tags:
    - service
```

- Add new service to compose `roles/docker/templates/hostname/compose.yaml`
```yaml
  service:
    image: service/service
    container_name: service
    hostname: service
    networks:
      - net
    ports:
      - "{{service_port}}:19999"
    restart: unless-stopped
    volumes:
      - "{{service_config}}:/etc/service"
      - "{{service_lib}}:/var/lib/service"
      - "{{service_cache}}:/var/cache/service"
```

## Server
- Install Debian (debian-11.5.0-amd64-netinst.iso) on remote system
- Create user (tudattr)
- Get IP of remote system (192.168.20.11)
- Create ssh-config entry
  ```config
  Host aya01
    HostName 192.168.20.11
    Port 22
    User tudattr
    IdentityFile /mnt/veracrypt1/genesis
  ```
  - copy public key to remote system
  `ssh-copy-id -i /mnt/veracrypt1/genesis.pub aya01`
- Add this host to ansible inventory
- Install sudo on remote
- add user to sudo group (with `su --login` without login the path will not be loaded correctly see [here](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=918754)) and `usermod -a -G sudo tudattr`
- set time correctly when getting the following error
```sh
Release file for http://security.debian.org/debian-security/dists/bullseye-security/InRelease is not valid yet (invalid for another 12h 46min 9s). Updates for this repository will not be applied.
```
By doing on remote system (example):
```sh
sudo systemctl stop ntp.service
sudo ntpd -gq
sudo systemctl start ntp.service
```
### zoneminder
- Enable authentification in (Option->System)
- Create new Camera:
  - General>Name: BirdCam
  - General>Function: Ffmpeg
  - General>Function: Modect
  - Source>Source Path: `rtsp://user:pw@ip:554/cam/mpeg4`
- Change default admin password
- Create users



## RaspberryPi
- Install raspbian lite (2022-09-22-raspios-bullseye-arm64-lite.img) on pi
- Get IP of remote system (192.168.20.11)
- Create ssh-config entry
```config
Host pi
     HostName 192.168.20.11
     Port 22
     User tudattr
     IdentityFile /mnt/veracrypt1/genesis
```
- enable ssh on pi
- copy public key to pi
- change user password of user on pi
- execute `ansible-playbook -i production --ask-vault-pass --extra-vars '@secrets.yml' pi.yml`

## Mikrotik
- Create rsa-key on your device and name it mikrotik_rsa
- On mikrotik run: `/user/ssh-keys/import public-key-file=mikrotik_rsa.pub user=tudattr`
- Create ssh-config entry:
```config
Host mikrotik
     HostName 192.168.70.1
     Port 2200
     User tudattr
     IdentityFile /mnt/veracrypt1/mikrotik_rsa
```

### wireguard
thanks to [mikrotik](https://www.medo64.com/2022/04/wireguard-on-mikrotik-routeros-7/)0
quick code
```
# add wiregurad interface
interface/wireguard/add listen-port=51820 name=wg1
# get public key
interface/wireguard/print
$ > public-key: <mikrotik_public_key>
# add network/ip for wireguard interface
ip/address/add address=192.168.200.1/24 network=192.168.200.0 interface=wg1
# add firewall rule for wireguard (maybe specify to be from pppoe-wan)
/ip/firewall/filter/add chain=input protocol=udp dst-port=51820 action=accept 
# routing for wg1 clients and rest of the network
> <insert forward for routing between wg1 and other networks>
# enable internet for wg1 clients (may have to add to enable internet list
/ip/firewall/nat/add chain=srcnat src-address=192.168.200.0/24 out-interface=pppoe-wan action=masquerade
```
add peer
```
/interface/wireguard/peers/add interface=wg1 allowed-address=<untaken_ipv4>/24 public-key="<client_public_key"
```

Keygeneragion on archlinux `wg genkey | (umask 0077 && tee wireguard.key) | wg pubkey > peer_A.pub`
Wireguard config on archlinux at `/etc/wireguard/wg0.conf`:
```
[Interface]
PrivateKey = <client_private_key>
Address = 192.168.200.250/24

[Peer]
PublicKey = <mikrotik public key>
Endpoint = tudattr.dev:51820
AllowedIPs = 0.0.0.0/0
```
used ipv4: 
- tudattr: 192.168.200.250
- livei: 192.168.200.240

#### notes
- wireguard->add
  name: wg_tunnel01
  listen port: 51820
  [save]
- wireguard->peers->add
  interface: wg_tunnel01
  endpoint port: 51820
  allowed address: ::/0
  psk: <password>
  persistent keepalive: 25
- ip->address->address list->add
  address:192.168.200.1/24
  network: 192.168.200.0
  interface: wg_tunnel01

## troubleshooting
### Docker networking problem
`docker system prune -a`
### Time problems (NTP service: n/a)
systemctl status systemd-timesyncd.service
when not available
sudo apt install systemd-timesyncd/stable
### Syncthing inotify
echo "fs.inotify.max_user_watches=204800" | sudo tee -a /etc/sysctl.conf
https://forum.cloudron.io/topic/7163/how-to-increase-inotify-limit-for-syncthing/2