handle vault password

1 files changed, 40 insertions, 5 deletions

diff --git a/README.org b/README.org
index aabeedb..a5f8764 100644
--- a/README.org
+++ b/README.org
@@ -15,6 +15,32 @@ Docker: needs docker-vars.yml, see docker-vars.yml.sample
 
 Debugging: add -v or -vv to the =ansible-playbook= command.
 
+* Setting up a vault
+:PROPERTIES:
+:CUSTOM_ID: vault
+:END:
+
+You can store passwords in vault files if you like. [[https://stackoverflow.com/questions/37297249/how-to-store-ansible-become-pass-in-a-vault-and-how-to-use-it][More info]]
+
+Put this text into =host_vars/media/plain= and =host_vars/upload/plain=:
+
+#+begin_example
+ansible_become_pass: "{{ vaulted_become_pass }}"
+#+end_example
+
+Use =ansible-vault create host_vars/media/crypted= and =ansible-vault create host_vars/upload/crypted= to create files with the contents:
+
+#+begin_example
+vaulted_become_pass: "yourpasswordhere"
+#+end_example
+
+To set the password for this console session:
+
+#+begin_src sh :eval no
+  export ANSIBLE_PASSWORD=...
+#+end_src
+
+
 * Processes
 
 At the start of the conference preparation period, change
@@ -92,11 +118,23 @@ Then call =process-prerec.sh $file=. It will launch some screen sessions for ree
 * Setting up the backstage area
 
 1. Doublecheck the host in [[file:inventory.yml]] and the variables in [[file:roles/media/defaults/main.yml]].
-2. ansible-playbook -i inventory.yml prod-playbook.yml --tags media
+2. ansible-playbook -i inventory.yml prod-playbook.yml --tags media --ask-become-pass
+   (or =ansible-playbook -i inventory.yml prod-playbook.yml --tags media --ask-vault-pass= if you've [[#vault][stored it in a vault]])
 3. Update the following variables in your Emacs configuration:
    - emacsconf-backstage-dir
    - emacsconf-backstage-phase
- 
+* Upload service
+
+=ansible-playbook -i inventory.yml prod-playbook.yml --tags upload --ask-become-pass=
+(or =ansible-playbook -i inventory.yml prod-playbook.yml --tags upload --ask-vault-pass= if you've [[#vault][stored it in a vault]])
+
+/ssh:media|sudo:upload@media:~upload
+/ssh:media|sudo::/etc/nginx/sites-available
+
+sudo service upload start
+
+Next step, check firewall
+
 * Publishing
 
 Goals:
@@ -202,10 +240,7 @@ https://gist.github.com/aaronpk/7307172
 ansible-playbook -i inventory.yml prod-playbook.yml --tags proxy --extra-vars='{"use_wikimedia": false}'
 
 ansible-playbook -i inventory.yml prod-playbook.yml --tags proxy --extra-vars='{"use_wikimedia": true}'
-* Upload
 
-/ssh:media|sudo:upload@media:~upload
-/ssh:media|sudo::/etc/nginx/sites-available
 * Stream
 ** Prod
 Setting up icecast: