blob: e17cf5860fc1395db0f19f068331c306d52b201e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
# Instance backup configuration for the baserock.org frontend system.
#
# We don't need to back anything up from this system, but the backup
# SSH key needs access to it in order to SSH to the other systems on the
# internal network.
---
- hosts: frontend-haproxy
gather_facts: false
sudo: yes
vars:
# The 'backup' key cannot be used to SSH into the 'frontend' machine except
# from these IPs.
#
# 82.70.136.246 is Codethink's Zen Internet line.
# 86.134.108.84 is a BT Internet IP currently in use by Codethink.
#
# The backup SSH private key is the main secret needed to connect as the
# backup user. This IP restriction is just for a bit of extra safety.
PERMITTED_BACKUP_HOSTS: 82.70.136.246/32,86.134.108.84/32
tasks:
- name: backup user
user:
name: backup
- name: authorize backup public key
authorized_key:
user: backup
key: "{{ lookup('file', '../keys/backup.key.pub') }}"
key_options: 'from="{{ PERMITTED_BACKUP_HOSTS }}",no-agent-forwarding,no-X11-forwarding'
|
