ephi2006 / eduid_resourceregistry Goto Github PK

After having run the playbook successfully for the first time, it is time to setup and configure the Resource Registry

1. Make sure that the ansible variable "setup_enabled" is set to 'TRUE'. If this has not been the case, you need to enable setup and re-run the playbook.

2. Open https://{fqdn}/setup in your browser and create your admin account

3. Disable setup again:

setup_enabled: FALSE

For any productive webserver, we recommend using a certificate issued by a trusted CA, eg one obtained from Comodo. For testing and development, a self-signed certificate will do the job.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout roles/registry/files/{{ fqdn }}.key -out roles/registry/files/{{ fqdn }}.crt

For signing the metadata you don't need a trusted certificate, so just create one yourself.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout roles/registry/files/metadata-signer.key -out roles/registry/files/metadata-signer.crt

Create a random vault password - If you haven't done so already

openssl rand -base64 32 > ~/.ansible_vault_pass

Copy, populate and encrypt the secrets file

cp group_vars/secrets.example group_vars/secrets
vi group_vars/secrets
ansible-vault encrypt group_vars/secrets --vault-password-file ~/.ansible_vault_pass

Run the Playbook

ansible-playbook -i [development|production] resource_registry.yml --vault-password-file ~/.ansible_vault_pass

Show the secret vars

ansible-vault view group_vars/secrets --vault-password-file ~/.ansible_vault_pass
``