9 ms·
Sovereign – Ansible playbooks to build and maintain your own personal cloud
- j2d3 13y agoI have been wanting to do this, hadn't gotten around to detailing all the pieces I'd need to put together, and also I've been wanting to check out ansible. Thanks for this writeup!
- NickABusey 13y agoIt would be great if someone could set this up as an AMI for idiot proof setup on AWS.
- vsviridov 13y agoAddition of XMPP messaging via eJabberd would be welcomed. Also, potentially use Baïkal for CalDAV/CardDAV as an option...
- mwcampbell 13y agoFor XMPP I highly recommend Prosody (http://prosody.im/ http://prosody.im/)
- squeed 13y agoSeconded. I've been running prosody for months without any interruptions.
- 286c8cb04bda 13y agoI second this. Every couple of weeks, ejabberd will attempt to eat all of the RAMs. Scheduling restarts was easier than trying to figure out why that was happening. Since switching to prosody, we've seen much better stability.
- grey-area 13y agoI had been a paying Google Apps customer for personal and corporate use since the service was in beta. Until several weeks ago, that is. I was about to set up another Google Apps account for a new project when I stopped to consider what I would be funding with my USD $50 per user per year This is exactly how I feel about Google Apps. I used to recommend it to customers, now I hesitate to recommend it, even though the alternatives aren't as easy or fully-featured without a lot more work. Thanks to the author for setting this lot up, I'll definitely be looking at it, and possibly using a few of the pieces. Ansible is great though; even if you're not setting up your own private cloud it's worth taking a look at for deployment. AnsibleWorks really should set up an extensive library of playbooks like this, each isolated so that they can easily be mixed and matched. Their examples were a bit limited and specific last time I looked. Does anyone have any tales of using Dovecot (good or bad), as I'm considering installing it?
- pdonis 13y agoDoes anyone have any tales of using Dovecot I've been using it on a server at home to basically archive my email (since the account I use to receive new email gets fussy if it gets too full) for a number of years now; it's worked great for me. I particularly like the fact that as of version 2.0, it supports sieve filtering out of the box, including a ManageSieve server, so I can easily set up complex filtering rules.
- grey-area 13y agoThanks. Filters sound interesting too. Probably spam filtering would be my biggest concern moving from google apps, I don't really care about the webmail.
- Nux 13y agoPeople seem to think that if you move your domain off GApps you're suddenly going to receive so much spam that your inbox will blow up. This is not so at all. A decent Postfix configuration + up2date SpamAssassin can do wonders. One of the "secrets" is to train Spamassassin. What I do for example is to move all the spam I receive in my inbox to a special folder that I later run "sa-learn --spam" on from a cronjob. You don't even need a webmail/interface for this.
- Nux 13y agoVery nice!
- mwcampbell 13y agoI was surprised to read that this configuration uses DSPAM rather than SpamAssassin. Can anyone here compare these two, or point to a recent comparison?
- tlrobinson 13y agoDocker seems like it could be a nice alternative to Ansible here. I'd love to see something as easy to use as an "app store" for "personal cloud" servers. One click to install servers for email, contacts, calendar, dropbox, backups, etc.
- gmuslera 13y agoAre complementary, not overlapping. Could be interesting to have some of the services described there in their own containers, but a lot of data must be shared between most of them.
- boothead 13y agoAnyone got any examples of setting up a set of services on a docker host with ansible? It would also seem feasible to use docker files ontop of a minimal image that used ansible with a local connection to do the set up... Anyone doing this?
- lifty 13y agoI am working on something like what you are suggesting. I currently have only the email container done(Postix/Dovecot) and working on a small cmdline tool that will take care of bootstrapping the containers by asking a few simple questions. The point is to make the whole setup as frictionless as possible, by providing a sensible set of standards and only asking for the bare minimum configuration parameters. In the future I plan to expand the tool with a web interface so you can install and uninstall applications from a central repository or a git repository. I will publish what I have soon, just need to build a few more applications containers(think rss reader, owncloud, git repo). It seems like a useful thing to have and I am curious if there is a demand for such a tool.
- nickstinemates 13y agoFor installation, are you planning on using one of the existing project like DockerUI[1] or Shipyard[2]? 1: https://github.com/crosbymichael/dockerui https://github.com/crosbymichael/dockerui 2: https://github.com/ehazlett/shipyard https://github.com/ehazlett/shipyard
- sdfjkl 13y agoIt's not worth bothering with filesystem encryption on a VPS. Keep in mind that the hypervisor has full, unrestricted and essentially undetectable access to the contents of the virtual machine's RAM, so they can read decrypted data, private keys and cleartext passwords. If you want even a hint of privacy, you'll have to rent some rackspace and put a tamper-resistant box of your own in there - and stop trusting it the first time it goes down unexpectedly.
- cube13 13y agoIf you want to have privacy, don't let anything get onto the internet. That's been true from day one. The NSA hasn't changed that.
- droopyEyelids 13y agoIt's important to understand that privacy, like security, isn't an all or nothing proposition. Instead, they're both questions of degrees of inconvenience and degrees of difficulty.
- Karunamon 13y agoSecurity might be about layers, but privacy very much is all or nothing. A given piece of information either is or is not private.
- rst 13y ago... or make sure that your cloud-based resources, whatever they are, only see ciphertext, and access them only through heavily secured machines that you hold locally. Which requires the attacker to compromise your laptop, or phone, or whatever. (Which is almost certainly still possible for an attacker with the resources of a major government that decides you're of sufficient interest, but it raises the bar a bit.)
- Terretta 13y agoHow do you propose bootstrapping the cipher onto a "known compromised" machine in a known compromised environment?
- deleted 13y ago[deleted]
- hyperplane 13y ago> Intrusion prevention via fail2ban and rootkit detection via rkhunter. Semantics, semantics, but rkhunter is intrusion detection, not prevention. I don't know what rkhunter would do to stop an intrusion, and fail2ban stopping a brute-force on your SSH login is hardly the likely intrusion vector for a server running this many services. These tools still require a huge amount of systems administration work before it really counts as a "personal cloud". rkhunter looks for some basic rootkits but will not really protect you from emerging threats, other than to tell you you have a file integrity mismatch on a common file such as /usr/bin/login. Since this is installing everything, it seems wise to add better host-based intrusion detection/file integrity checking across all services and configurations, via AIDE[1] or Samhain[2], which you could do with this type of automated setup. Both can then use the local MTA to alert you directly to your mail client if something is compromised, plus you gain the security of your configuration files for these services not having been tampered with. What about running unattended-upgrades[3] for security patches to things like Apache et al? Given the adversaries expected here, I assume that we aren't worried about false packages, etc. as a risk. [1] http://aide.sourceforge.net/ http://aide.sourceforge.net/ [2] http://la-samhna.de/samhain/ http://la-samhna.de/samhain/ [3] https://launchpad.net/unattended-upgrades https://launchpad.net/unattended-upgrades
- programminggeek 13y agoI refuse to use reaper technology run my cloud.
- mrbill 13y agoI'm a bit confused as to why postgrey is being used (it's circa postfix 2.1.x) when postfix's "postscreen" is now built-in and just as good.
- ciupicri 13y agoAs a side note, the postscreen(8) man page [1] says that "this service was introduced with Postfix version 2.8.". Also RHEL 6 comes with postfix-2.6.6-2.2.el6_1.i686. [1] http://www.postfix.org/postscreen.8.html http://www.postfix.org/postscreen.8.html
- mratzloff 13y agoI've been thinking about setting something like this up in Switzerland or someplace. Any suggestions?
- ef4 13y agoI don't see a reason to buy overseas hosting. So long as your body is still in the US, the NSA could get your data if they really wanted to. But the real goal here is not to stop a targeted government attack. It's to avoid cost-effective, bulk surveillance. For that, a server in your basement is quite good.
- sebilasse 13y agoFor Switzerland hosted V or dedicated server: http://nine.ch/ http://nine.ch/
- dkoch 13y agoAre there any new and modern open source HTML5 webmail clients available? It's been several years since I last set up self-hosted email. At the time Roundcube was the best out there, but it wasn't in the same league as Gmail.
- rufugee 13y agothe problem I seem to run into when into when hosting my own email these days is that my IP (currently with ovh) keeps getting marked by sbls because of some other bad citizen in the same block. I've been looking at sendgrid and authsmtp as potential ways to avoid this, but would love to hear what others are doing... those of you who hosts... how do you prevent from getting black listed?
- rufugee 13y agothe problem I seem to run into when into when hosting my own email these days is that my IP (currently with ovh) keeps getting marked by sbls because of some other bad citizen in the same block. I've been looking at sendgrid and authsmtp as potential ways to avoid this, but would love to hear what others are doing... those of you who hosts... how do you prevent from getting black listed?
- luikore 13y agoI think it could be of more coolness if named "Hegemon", which is more connected to "Ansible"...
- ciupicri 13y agoIs it to me or I need to somehow compute the hash of the password used for email? [1] [1] https://github.com/al3x/sovereign/blob/master/roles/mailserver/vars/main.yml#L15 https://github.com/al3x/sovereign/blob/master/roles/mailserv...
- sherr 13y agoThank you. Not only a good real world example of server provisioning with Ansible, something I've been meaning to try, but a pretty well chosen set of services to install and configure. I'm already using Postfix and Dovecot over SSL but will surely learn from the rest of the setup.
- 616c 13y agoI like the use of Dovecot, but I got tired of resource consumption with OwnCloud, despite it being a very, very cool project (and Android not speaking CardDav or CalDav natively, sigh; the ONE thing that makes me like iOS). In any event, I have been looking into Cyrus IMAP because a) it used by Fastmail, they even host their forked version of the code [0] and b) there is a alpha-beta feature right now for a CardDAV and CalDav server baked in. [1] Maybe I can try and work on my own sovereign-like setup with this. [0] https://github.com/brong/cyrus-imapd/tree/fastmail https://github.com/brong/cyrus-imapd/tree/fastmail [1] http://cyrusimap.web.cmu.edu/mediawiki/index.php/Latest_Updates http://cyrusimap.web.cmu.edu/mediawiki/index.php/Latest_Upda...
- mcovey 13y agoInstead of going through all this hassle with private clouds just to avoid using a service like Dropbox, I have some shell scripts that use rsync and curl to grab almost everything I want to back up from my hard drive and the internet (rss subscriptions, bookmarks), and generate a tar.7z.gpg file. The 7z archive is AES256 encrypted as well. I feel relatively safe that I could drop this file anywhere I want and it would be useless to anybody without access to my brain or keystrokes, so I just put it in unsecure cloud storage. If I'm wrong about that, then I'm screwed, because all of my finances and identity would be full compromised. Each backup is pretty small since it's mostly text files and a few binaries and images. I have a minimal amount of media files so I don't bother to back up larger things that are mostly replaceable.