git.squeep.com Git - awsible/blob - BOOTSTRAP.txt

   1 Starting up a new AWSible environment
   2 -------------------------------------
   3
   4 * initialize CA for environment
   5
   6         env="myAwsibleEnvironment"
   7         region="us-east-1"
   8
   9         curl -fOL https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz
  10         mkdir "${env}_ca"
  11         tar -C "${env}_ca" --strip-components 1 -x -f EasyRSA-3.0.1.tgz
  12
  13         pushd "${env}_ca"
  14                 # create CA cert
  15                 ./easyrsa init-pki
  16                 ./easyrsa build-ca
  17                         cn: ${env}
  18
  19                 # create openVPN region server cert
  20                 ./easyrsa build-server-full ${region}.${env} nopass
  21
  22                 # create CRL
  23                 ./easyrsa gen-crl
  24
  25                 pushd "pki"
  26                         openvpn --genkey --secret ta.key
  27                 popd
  28         popd
  29
  30 * generate ansible variables for VPN
  31
  32         ./generate-ansible-vpcaccess-vars.sh ${env} ${region}
  33
  34 * create ssh keypair as keys/management{,.pub}
  35
  36 * configure group_vars/all with:
  37   - ACCT_ID   aws acct id
  38   - DEFAULT_AMI  ami of amazon linux in chosen region
  39   - vpc variables
  40
  41 * install managed policies by hand
  42     for f in roles/aws-infrastructure/files/*-policy.json
  43     do
  44         n=$(basename "$f" .json)
  45         aws --region "{{ vpc_region }}" iam create-policy --policy-name "$n" --description "{{ get this from somewhere }}" --policy-document file://"$f"
  46     done
  47
  48 * ansible-playbook init_vpc.yml
  49
  50 * add IGW to VPC Main route table
  51
  52 * change pub-subnets to auto-assign external IPs
  53
  54 * bootstrap vpcaccess from external system
  55         ansible-playbook init_vpcaccess.yml
  56         aws --region ${region} iam create-policy --policy-name vpcaccess-policy --description vpcaccess --policy-document file://../roles/vpcaccess-infrastructure/files/vpcaccess-policy.json
  57         # attach policy to role
  58         INVENTORY_PUBLIC=1 ansible-playbook vpcaccess-d0stage
  59
  60 * configure group_vars/all with chosen MANAGEMENT_SUBNET
  61
  62 * ansible-playbook init_management.yml
  63
  64 * add base and management policies to management IAM role
  65
  66 * create persistant management data volume
  67     * attach and format
  68       mkfs -t ext4 -j -m 0 -L /media/data /dev/xvdf
  69     * add to /etc/fstab
  70       mkdir /media/data && chown ec2-user:ec2-user /media/data
  71       LABEL=/media/data /media/data    ext4    defaults 0   2
  72       mount -a
  73     * install AWSible repo in /data/management/
  74
  75 * bootstrap management server from external system
  76     ansible-playbook management.yml
  77