summaryrefslogtreecommitdiff
path: root/README.md
diff options
context:
space:
mode:
authorJoey Hess2014-04-03 00:59:26 -0400
committerJoey Hess2014-04-03 01:55:49 -0400
commit42f207232beb57c18f67884e7c28424dba3c84c6 (patch)
treefe389f774e2f0de6cd5562b9b349f727319cc03f /README.md
parent167609746d22951477abd6490b34480205c659af (diff)
debianization and a wrapper program for /usr/bin
Diffstat (limited to 'README.md')
-rw-r--r--README.md76
1 files changed, 41 insertions, 35 deletions
diff --git a/README.md b/README.md
index 68201d85..c918b324 100644
--- a/README.md
+++ b/README.md
@@ -1,18 +1,18 @@
-This is a work in progress configuration management system using Haskell
-and Git.
+This is a configuration management system using Haskell and Git.
-Propellor enures that the system it's run in satisfies a list of
+Propellor enures that the system it's run against satisfies a list of
properties, taking action as necessary when a property is not yet met.
-The design is intentionally very minimal.
+Propellor is configured via a git repository, which typically lives
+in ~/.propellor/. The git repository contains a config.hs file,
+and also the entire source code to propellor.
-Propellor lives in a git repository. You'll typically want to have
-the repository checked out on a laptop, in order to make changes and push
-them out to hosts. Each host will also have a clone of the repository,
-and in that clone "make" can be used to build and run propellor.
-This can be done by a cron job (which propellor can set up),
-or a remote host can be triggered to update by running propellor
-on your laptop: propellor --spin $host
+You typically want to have the repository checked out on a laptop, in order
+to make changes and push them out to hosts. Each host will also have a
+clone of the repository, and in that clone "make" can be used to build and
+run propellor. This can be done by a cron job (which propellor can set up),
+or a remote host can be triggered to update by running propellor on your
+laptop: propellor --spin $host
Properties are defined using Haskell. Edit config.hs to get started.
@@ -28,35 +28,41 @@ and so it's easy to factor out things like classes of hosts as desired.
## quick start
-1. Clone propellor's git repository to your laptop (or whatever).
- git clone git://git.kitenet.net/propellor
- or joeyh/propellor on github
-2. Run: sudo make deps # installs build dependencies
-3. Run: make build
-4. If you don't have a gpg private key, generate one: gpg --gen-key
-5. Run: ./propellor --add-key $KEYID
-7. Pick a host and run: ./propellor --spin $HOST
-8. Now you have a simple propellor deployment, but it doesn't do anything
- to the host yet, besides installing propellor.
-
- So, edit config.hs to configure the host (maybe start with a few simple
- properties), and re-run step 7. Repeat until happy and move on to the
- next host. :)
+1. Get propellor installed
+ `cabal install propellor`
+ or
+ `apt-get install propellor`
+2. Run propellor for the first time. It will set up a `~/.propellor/` git
+ repository for you.
+3. In `~/.propellor/`, use git to push the repository to a central
+ server (github, or your own git server). Configure that central
+ server as the origin remote of the repository.
+4. If you don't have a gpg private key, generate one: `gpg --gen-key`
+5. Run: `propellor --add-key $KEYID`
+6. Edit `~/.propellor/config.hs`, and add a host you want to manage.
+ You can start by not adding any properties, or only a few.
+7. Pick a host and run: `propellor --spin $HOST`
+8. Now you have a simple propellor deployment, but it doesn't do
+ much to the host yet, besides installing propellor.
+
+ So, edit `~/.propellor/config.hs` to configure the host (maybe
+ start with a few simple properties), and re-run step 7.
+ Repeat until happy and move on to the next host. :)
9. To move beyond manually running propellor --spin against hosts
when you change configuration, add a property to your hosts
- like: Cron.runPropellor "30 * * * *"
+ like: `Cron.runPropellor "30 * * * *"`
Now they'll automatically update every 30 minutes, and you can
`git commit -S` and `git push` changes that affect any number of
hosts.
-10. Write some neat new properties and send patches to propellor@joeyh.name!
+8. Write some neat new properties and send patches to <propellor@joeyh.name>!
## security
Propellor's security model is that the hosts it's used to deploy are
untrusted, and that the central git repository server is untrusted.
-The only trusted machine is the laptop where you run propellor --spin
+The only trusted machine is the laptop where you run `propellor --spin`
to connect to a remote host. And that one only because you have a ssh key
or login password to the host.
@@ -70,10 +76,10 @@ otherwise.
That is only done when privdata/keyring.gpg exists. To set it up:
-gpg --gen-key # only if you don't already have a gpg key
-propellor --add-key $MYKEYID
+ gpg --gen-key # only if you don't already have a gpg key
+ propellor --add-key $MYKEYID
-In order to be secure from the beginning, when propellor --spin is used
+In order to be secure from the beginning, when `propellor --spin` is used
to bootstrap propellor on a new host, it transfers the local git repositry
to the remote host over ssh. After that, the remote host knows the
gpg key, and will use it to verify git fetches.
@@ -81,17 +87,17 @@ gpg key, and will use it to verify git fetches.
Since the propoellor git repository is public, you can't store
in cleartext private data such as passwords, ssh private keys, etc.
-Instead, propellor --spin $host looks for a privdata/$host.gpg file and
+Instead, `propellor --spin $host` looks for a `~/.propellor/privdata/$host.gpg` file and
if found decrypts it and sends it to the remote host using ssh. This lets
a remote host know its own private data, without seeing all the rest.
-To securely store private data, use: propellor --set $host $field
+To securely store private data, use: `propellor --set $host $field`
The field name will be something like 'Password "root"'; see PrivData.hs
for available fields.
## debugging
-Set PROPELLOR_DEBUG=1 to make propellor print out all the commands it runs
-and any other debug messages Properties choose to emit.
+Set `PROPELLOR_DEBUG=1` to make propellor print out all the commands it runs
+and any other debug messages that Properties choose to emit.
[1] http://reclass.pantsfullofunix.net/