openafs-appliance.yml

#
# Ansible playbook to configure an OpenAFS appliance.
#
# SPDX-FileCopyrightText: 2023 Carnegie Mellon University
# SPDX-License-Identifier: GPL-2.0-only
#
- hosts: image
  vars:
    debug_image: false  # set this to true to allow passwordless root login
    hostname: openafs
    kerberos:
      realm: ANDREW.CMU.EDU
    openafs:
      cell: andrew.cmu.edu
    samba:
      workgroup: "OPENAFS"
    samba_rebuild:
      root: "http://coda.cs.cmu.edu/~jaharkes/samba-rebuild"
    coda:
      enabled: false
      realm: testserver.coda.cs.cmu.edu
    iface:
      name: eth0

  tasks:
  #####################################
  - name: ensure required software packages are installed
    ansible.builtin.apt:
      pkg:
      - avahi-utils
      - chrony
      - krb5-user
      # openafs
      - openafs-client
      - openafs-krb5
      # samba
      - samba
      # webauth
      - caddy
      - gunicorn
      - python3-flask

  #####################################
  - name: configure system hostname/networking
    tags: config
    block:
    - name: set hostname
      ansible.builtin.copy:
        content: "{{ hostname }}"
        dest: /etc/hostname

    - name: unset root password
      ansible.builtin.replace:
        path: /etc/shadow
        regexp: '^root:[^:]*:(.*)$'
        replace: 'root::\1'
      when: debug_image | bool

    - name: configure networking
      ansible.builtin.copy:
        content: |
          auto {{ iface.name }}
          allow-hotplug {{ iface.name }}
          iface {{ iface.name }} inet dhcp
        dest: /etc/network/interfaces.d/wired

  #####################################
  - name: configure Kerberos
    tags: config
    block:
    - name: add CS.CMU.EDU realm mapping to krb5.config
      ansible.builtin.lineinfile:
        path: /etc/krb5.conf
        regexp: '^\s*\.cs\.cmu\.edu = CS\.CMU\.EDU$'
        line: "        .cs.cmu.edu = CS.CMU.EDU"

    - name: set default kerberos realm
      ansible.builtin.replace:
        path: /etc/krb5.conf
        regexp: '^(.*default_realm[^=]*=).*$'
        replace: '\1 {{ kerberos.realm }}'

  #####################################
  - name: configure OpenAFS
    tags: config
    block:
    - name: configure OpenAFS | client
      ansible.builtin.copy:
        content: |
          AFS_CLIENT=true
          AFS_AFSDB=true
          AFS_CRYPT=true
          AFS_DYNROOT=Yes
          AFS_FAKESTAT=true
        dest: /etc/openafs/afs.conf.client

    - name: configure OpenAFS | increase cache size
      ansible.builtin.copy:
        content: "/afs:/var/cache/openafs:1000000"
        dest: /etc/openafs/cacheinfo

    - name: set local AFS cell
      ansible.builtin.copy:
        content: "{{ openafs.cell }}"
        dest: /etc/openafs/ThisCell

    - name: update CellServDB to a more recent version
      ansible.builtin.copy:
        src: CellServDB
        dest: /etc/openafs/CellServDB

    - name: add {andrew,cs,ece} cell shortcuts
      ansible.builtin.copy:
        content: |
          andrew.cmu.edu  andrew
          cs.cmu.edu      cs
          ece.cmu.edu     ece
        dest: /etc/openafs/CellAlias
      when: openafs.cell == "andrew.cmu.edu"

  #####################################
  - name: add/configure Coda client
    when: coda.enabled | bool
    tags: config
    block:
    - name: fetch Coda repository signing key
      ansible.builtin.get_url:
        url: http://coda.cs.cmu.edu/coda/jaharkes.key
        dest: /etc/apt/keyrings/coda.asc
        checksum: "sha256:045cba6000a9c9e86a52e68e6717c9a6d2ca03bd20d240b6b4393c37d03b55c8"

    - name: add repo for Coda packages
      ansible.builtin.apt_repository:
        repo: "deb [signed-by=/etc/apt/keyrings/coda.asc] http://coda.cs.cmu.edu/coda bookworm main"

    - name: install Coda
      ansible.builtin.apt:
        pkg: coda-client

    - name: configure Coda
      ansible.builtin.lineinfile:
        path: /etc/coda/venus.conf
        regexp: '^#?{{ item.key }}=.*$'
        line: '{{ item.key }}={{ item.val }}'
      loop:
      - { key: "realm", val: '"{{ coda.realm }}"' }
      - { key: "cachesize", val: '500M' }
      - { key: "wholefilemaxsize", val: '200M' }
      - { key: "wholefileminsize", val: '200M' }

  #####################################
  - name: configure Samba
    tags: config
    block:
    - name: add repo for custom-built Samba packages
      ansible.builtin.apt_repository:
        repo: "deb [allow-insecure=yes trusted=yes] {{ samba_rebuild.root }} ./"

    - name: install custom-built Samba packages
      ansible.builtin.apt:
        pkg: samba
        state: latest

    - name: configure Samba | set workgroup name
      ansible.builtin.lineinfile:
        path: /etc/samba/smb.conf
        regexp: '^.*workgroup = .*$'
        line: "   workgroup = {{ samba.workgroup }}"
        insertafter: '^\[global\]$'

    - name: configure Samba | add user and preexec scripts
      ansible.builtin.blockinfile:
        path: /etc/samba/smb.conf
        block: |
          client use kerberos = off
          add user script = /usr/sbin/useradd -s /usr/sbin/nologin -m '%u'
          preexec = /usr/bin/aklog -c {{ openafs.cell }}
          preexec close = no
        insertbefore: '^#=+ Share Definitions =+$'

    - name: configure Samba | Don't expose home directories
      ansible.builtin.lineinfile:
        path: /etc/samba/smb.conf
        insertafter: '^\[homes\]$'
        line: '   available = no'

    - name: configure Samba | Make default shares not browseable
      ansible.builtin.replace:
        path: /etc/samba/smb.conf
        regexp: '^([ \t]*)browseable = yes$'
        replace: '\1browseable = no'

    - name: configure Samba | add AFS share
      ansible.builtin.blockinfile:
        marker: "# {mark} OPENAFS SHARE"
        block: |
          [afs]
             comment = AFS Root Directory Share
             path = /afs
             afs share = yes
             vfs objects = fake_perms offline
             store dos attributes = no
             map archive = no
             map hidden = no
             map readonly = permissions
             map system = no
             browseable = yes
             read only = no
             guest ok = yes
        path: /etc/samba/smb.conf

    - name: configure Samba | add Coda share
      when: coda.enabled | bool
      ansible.builtin.blockinfile:
        marker: "# {mark} CODA SHARE"
        block: |
          [coda]
             comment = Coda Root Directory Share
             path = /coda
             vfs objects = fake_perms offline
             store dos attributes = no
             map archive = no
             map hidden = no
             map readonly = permissions
             map system = no
             browseable = yes
             read only = no
             guest ok = yes
        path: /etc/samba/smb.conf

  #####################################
  - name: configure WebAuth application
    tags: config
    block:
    - name: copy webauth source to /app
      ansible.builtin.copy:
        src: webauth/
        dest: /app/

    - name: create systemd file for webauth
      ansible.builtin.copy:
        content: |
          [Unit]
          Description=Web-based authentication application
          After=network.target
          [Service]
          User=root
          WorkingDirectory=/app
          ExecStart=/usr/bin/gunicorn -w 4 webauth:app
          Restart=always
          [Install]
          WantedBy=multi-user.target
        dest: /etc/systemd/system/webauth.service

    - name: enable webauth service
      command:
        cmd: /bin/systemctl enable webauth.service
        creates: /etc/systemd/system/multi-user.target.wants/webauth.service

    - name: configure Caddy frontend for https offload
      ansible.builtin.copy:
        content: |
          {{ hostname }}.local {
                  encode gzip
                  handle /static/* {
                          root * /app
                          file_server
                  }
                  handle {
                          reverse_proxy localhost:8000
                  }
          }
        dest: /etc/caddy/Caddyfile

  #####################################
  - name: cleanup
    tags: config
    block:
    - name: clean apt package cache
      command:
        cmd: /usr/bin/apt-get clean