⚙️ Baseline Configuration — Attestant

This document explains the standard, repeatable steps to bring a newly provisioned server to the Attestant baseline using Ansible. Follow the checklist and playbooks below — do not make OS or application changes outside of Ansible.

✳️ Before you start

  • Do not install software or change OS settings manually. Use Ansible.
  • Make sure you have SSH access and the required local keys.
  • Ensure you have appropriate access to the ops repo.

🔑 Hardware keys

Summary:

  • Validating/operational servers (chainDB, execDB, etc.) typically share the same hardware key per staff member (e.g. id_xy_dev_1). Verify the keys listed in inventories/<pod>/group_vars/all/main.yml.
  • Signing servers use unique hardware keys stored in the host_vars for that signing host. Ensure those keys are present in roles/ssh/files/.

🧾 Adding a server to Ansible (existing pod)

  1. Open inventories/<pod>/hosts and add the new host in the appropriate groups (e.g., validators, signers).
  2. Update inventories/<pod>/group_vars/all/main.yml (for example dirk_permissions or other pod-wide vars).
  3. Copy a similar host's host_vars/<host>/ as a starting point:
cp -a inventories/<pod>/host_vars/<example-host> inventories/<pod>/host_vars/<new-host>
# then edit host-specific vars (IP, serial, vault.yml, etc.)

🆕 Adding a new pod (summary)

Create a new inventory directory and copy structures from an existing pod as a base. Example:

cd ~/ops/ansible/inventories
mkdir pod6
cp ../pod5/hosts pod6/hosts
mkdir -p pod6/group_vars/all
cp -a ../pod5/group_vars/all/* pod6/group_vars/all/
mkdir -p pod6/host_vars

Important: remove any hostnames from the copied files that belong to the old pod. Edit vault.yml using ansible-vault edit vault.yml.

Add the new pod to the operations inventory so automation daemons are aware of it (edit inventories/<development->operations>/group_vars/all/main.yml as required).

🔐 Create and place server certificates

Requirements:

  • OpenSSL >= 3.0.2 locally (for certificate work).
  • Ansible-vault passphrase available for encrypting files.

Generate certificates via Ansible (example):

dev/prd-ansible-playbook -i inventories/<pod>/hosts create_client_certificate.yml --connection=local --limit <host>

The playbook will create encrypted certificate files in inventories/<pod>/host_files/<host>/.

🧰 Bring the system to baseline

Run the full baseline playbook to install OS-level configuration, harden network ports and apply the standard Attestant baseline:

dev/prd-ansible-playbook -i inventories/<pod>/hosts system.yml --limit <host>

After successful completion:

  1. Reboot the machine

  2. Update the Server Info spreadsheet: mark server as Baseline.

✅ Git workflow — commit inventory changes

Create a local branch, commit inventory/host_var changes, and open a PR for review.

Create a pull request in GitHub and add reviewers.

Utilities & tips

  • Generate strong passwords if needed: pwgen -B 24 (install pwgen if needed).
  • Keep vault.yml edits via ansible-vault edit to avoid accidental plaintext secrets in the repo.

 


 

↩️ Back to the Server Commissioning main page