# RT and RTIR deployment project #
## Content
1. [Prerequisites](#prerequisites)
    1. [Ansible](#ansible)
    2. [SSH connection to target machine and sudo](#ssh-connection-to-target-machine-and-sudo)
2. [Installation steps](#installation-steps)
    1. [Certificate](#certificate)
    2. [Configuration files](#configuration-files)
        1. [ansible/hosts](#ansiblehosts)
        2. [ansible-deploy-conf.yml](#ansibleansible-deploy-confyml)
    3. [Installation](#installation)
3. [Post installation](#post-installation)
4. [Updating RT](#updating-rt)
5. [Ansible playbook tags summary](#ansible-playbook-tags-summary)

## Prerequisites ##
### Ansible ###
Install ansible:
``` 
$ sudo apt install pipx
$ pipx install --include-deps ansible
```

### SSH connection to target machine and sudo ###
The default way would be to generate a key-pair with `ssh-keygen` and copy the public half into `/home/<user>/.ssh/authorized_keys` either manually or with `ssh-copy-id`
You also have to have sudo configured for your user.

## Installation steps ##
There are several differences between production and development mode, some steps are only necessary in production mode, they will be tagged.

### Ansible-Galaxy Requirements ###
Other playbooks and roles needed for running this playbook, described in ansible/requirements.yml
Install with:

```
$ cd rtir-deploy/ansible
$ ansible-galaxy install requirements.yml 
```

### Certificate ###
__ONLY NECESSARY IN PRODUCTION MODE__
You need to download rt.csirt.muni.cz certificate and key from passbolt
 * [rt.csirt.muni.cz.pem - certificate](https://janus.csirt.muni.cz/app/passwords/view/06ee6f5b-e475-4501-ab48-35a3247f055a)
 * [rt.csirt.muni.cz.key - key](https://janus.csirt.muni.cz/app/passwords/view/5464aa5a-d4c7-4380-9bc5-418616c3fe71)

### Configuration files ###
#### ansible/hosts ####
  
Fill out sudo password in ansible/hosts:
```
[clients]
rt_server ansible_host=<TARGET MACHINE> ansible_ssh_user=csirt ansible_become_pass=<LINK IN FILE>
```
* __REQUIRED__
  * address of target server (`ansible_host`)
  * user for Ansible to use for connecting (`ansible_ssh_user`)
  * password for Ansible to use with sudo (`ansible_become_pass`)

#### ansible/ansible-deploy-conf.yml ####
Basically all you need/want to configure in this file is:
* __REQUIRED__
  * app-user name (`user` in `server` section)
  * your server ipv4 address (`ipv4` in `server` section)
  * your server hostname (`hostname` in `server` section)
  * nats credentials (`username` and `password` in `nats` under section `rt`)
* __OPTIONAL__
  * `owner` in `server` section
  * `password` and `postgres_password` in `postgres` section
  * `rt`, `rtir` and `visibility` `version`s in their respective sections

Changing other things is NOT recommended, it could and probably would break the installation process.

### Installation ###
```
$ cd rtir-deploy/ansible
$ ansible-playbook -i hosts playbook.yml
```

## Post-installation ##
You can visit https://<server.hostname> to check if everything is working as intended. For login use following:
```
login: root
password: password
```

## Updating RT ## 
You can update rt by running the ansible `playbook.yml` with `--tags update`. The playbook will prompt for old and to-be-installed versions of `rt`. 

```
$ cd ansible
$ ansible-playbook -i hosts playbook.yml --tags update
```

Or if you find prompts annoying, you can provide the versions with extra_vars like this:
```
$ ansible-playbook -i hosts playbook.yml --tags update --extra-vars="{\
'rt_old_version_number':'5.0.6', \
'rt_new_version_number':'5.0.7', \
'rtir_old_version_number':'5.0.5', \
'rtir_new_version_number':'5.0.6'}"
```

## Ansible playbook tags summary ##
* `update` - Updates RT, RT-IR, upgrades all packages and runs a dist-upgrade (TODO split update tags so you can update only packages or only rt) (Untested if tag is exclusive, but shouldn't break too much)
* `configs` - Changes configuration files, generates jinja configs, crontab
* `common` - Installs esssential required packages (like `curl`, `git`...)
* `firewall`, `iptables` - Manages firewall
* `rt` - Manages rt (install, configuration)
* `rtir` - Manages rtir (install, configuration)
* `vector` - Vector configuration
* `visibility` - runs Visibility role
* `postgres` - Manages postgres database (install, configuration)
* `sendmail`, `mail` - Manages sendmail (configuration, copies certs)
* `perl` - Manages perl (install, configuration)
* `certs` - Copies certificates
* `apache2` - Manages webserver, copies certs)
* `cron` - Updates crontab
