This repository is used to automate the building, testing, deployment, and maintenance of servers and endpoints that are managed by MTecknology (Mike L.).
Primary Goals:
- Provide a :ref:`bootstrap script <bootstrap>` to get a system "enrolled" into teckhost management
- Provide a bare metal installer, similar to debian-installer
- Automatically run a full CI/CD (build+install+validate) pipeline on any change
Secondary Goals:
- Provide the ability to test with local file system changes
- Limit user interaction to env (wifi, hostname) and encryption questions
- Implement CI/CD release process to automatically promote after tests pass
- Provide automated "release" of all "static assets" (teckhost.iso, bootstrap)
VPS:
- Implement Salt-Cloud (or manually create)
- Log in and run :ref:`Salt Bootstrap <bootstrap>`
- Provide keys
Bare Metal:
- Download or :ref:`Build <build-iso>` ISO
- Copy ISO to flash drive (with
mbufferordd) - Boot to installer and choose either LVM or Encrypted
- Provide network/hostname/keys
Salt is at the core of deployment and maintenance. Package selection, user
creation, security policies, etc. is all done by salt during a
state.highstate. The ultimate goal of this ./bootstrap script is to run
the highstate as quickly and safely as possible.
In order for this ./bootstrap script to complete, it will need to prompt for
a passphrase to decrypt salt's :ref:`Pillar Data <pillar>` keys.
To run the bootstrap:
wget https://raw.githubusercontent.com/mtecknology/teckhost/master/bootstrap bash bootstrap
In order to read encrypted "pillar" data, salt needs access to a gpg key; this is stored in this repository in an encrypted blob. The :ref:`Salt Bootstrap <bootstrap>` script will expect the user to have access to this private key in order to decrypt the blob.
Ideally, only pre-hashed values will be stored in pillar. For example, a
password hash generated with crypt is encrypted for salt, rather than the
password itself. This repository is highly exposed and nothing within, even
encrypted, should be considered more secure than the test data.
To encrypt data for pillar:
# Import the public key curl -s https://raw.githubusercontent.com/MTecknology/teckhost/master/pillar/teckhost.pub | gpg --import # Pipe the secret data through gpg echo -n 'S3cr!t' | gpg --trust-model always -ear [email protected]