diff options
| author | Jan Tuomi <jan@jantuomi.fi> | 2025-06-23 15:36:54 +0300 |
|---|---|---|
| committer | Jan Tuomi <jan@jantuomi.fi> | 2025-06-23 15:36:54 +0300 |
| commit | 9093e8d91b0000442dd538a2991fd2645cbeb154 (patch) | |
| tree | deeb7a7fbece36a48303a56ee5f3726bea466caf | |
| parent | 9dcb3d37f98efad7657d06cb080a5112b9d50b63 (diff) | |
Add README
| -rw-r--r-- | README.md | 40 | ||||
| -rw-r--r-- | templates/etc_ssh_sshd_config.j2 | 2 |
2 files changed, 41 insertions, 1 deletions
diff --git a/README.md b/README.md new file mode 100644 index 0000000..98f2d48 --- /dev/null +++ b/README.md @@ -0,0 +1,40 @@ +# My FreeBSD home server Ansible playbooks + +This repository describes my home server setup with Ansible. The server machine is an Intel N150 based mini-PC with two wired network interfaces and four M.2 NVMe slots. The NVMe slots are fitted with 1TB drives. + +## Manual installer setup + +1. Download a recent FreeBSD release. Tested with https://download.freebsd.org/releases/amd64/amd64/ISO-IMAGES/14.3/FreeBSD-14.3-RELEASE-amd64-memstick.img. +2. Run the installer off a USB drive. During installation, configure: + + - a Finnish keymap + - hostname "pursotin" + - an Auto-ZFS setup with Root-on-ZFS, pool name "zroot" + - RAID10: a stripe of two mirrors + - 4K sectors + - root encrypted (GELI), GPT (BIOS+UEFI) + - 8GB of non-mirrored, encrypted swap (times four for a total of 32GB) + - install base, kernel, src, ports, handbook + - set up IPv4 (DHCP) and v6 (SLAAC) with DNS 192.168.0.1 and 8.8.8.8 + - services: sshd, ntpd, ntpd sync on start, powerd + +3. After install, open a shell in the chroot env and temporarily allow in `/etc/ssh/sshd_config`: + +``` +PasswordAuthentication yes +PermitRootLogin yes +``` + +4. Reboot. +5. Install SSH keys with `ssh-copy-id`. +6. You can now run the playbook. + +## Running the playbook + +```shell +ansible-playbook -i inventory playbook.yml +``` + +## Author + +Jan Tuomi, \<jan at jantuomi.fi\>. diff --git a/templates/etc_ssh_sshd_config.j2 b/templates/etc_ssh_sshd_config.j2 index b7ad162..06179ce 100644 --- a/templates/etc_ssh_sshd_config.j2 +++ b/templates/etc_ssh_sshd_config.j2 @@ -58,7 +58,7 @@ AuthorizedKeysFile .ssh/authorized_keys # Change to yes to enable built-in password authentication. # Note that passwords may also be accepted via KbdInteractiveAuthentication. -PasswordAuthentication yes +PasswordAuthentication no #PermitEmptyPasswords no # Change to no to disable PAM authentication |