My Raspberry Pi Server Setup
Tags: ansible, raspberrypi, auth0, traefik
Published: 2022-01-01 15:05:26

---
title: My Raspberry Pi Server Setup
published: true
description: Raspberry Pi Logo in front of blue circuit board
tags: [ansible, raspberrypi, auth0, traefik]
cover_image: https://www.wallpapertip.com/wmimgs/54-542184_raspberry-pi-4-logo.jpg
---


I've had a raspberry pi mainly sitting in a drawer for a while now. Haphazardly I dust off the SD card to set up the box with dynamic DNS and play with it as a personal server. It always went back to the drawer when I broke the SO with some crazy experiment.

As an SRE, I spend most of my time thinking about what flows are more burdensome to the team and how to automate the process to gain more time to do other important stuff. But with my RBP it was different. I'd never versioned the scripts I executed and never thought about creating proper automation for the box.

To avoid giving up on the Pi again, I started my journey differently this time. Every configuration running on the Pi must be replayable to fix it just by burning a new SO in the SD card and running the automation to set it up. [This](https://github.com/thspinto/raspberry-config) is what I have up to now.

## Provisioning Raspbian

I started with the [Rasbian Buster Lite image](https://www.raspberrypi.org/downloads/raspbian) and burned it on the SD card. Assure you're pointing to the correct disk before running the commands below!

```
unzip -p 2020-02-13-raspbian-buster-lite.zip | sudo dd of=/dev/disk2 bs=4m
touch /Volumes/boot/ssh # to enable ssh
```

## Ansible automation

Ansible [Ansible](https://docs.ansible.com/ansible/latest/index.html) is an excellent tool for automating systems configurations. This setup starts with the default user and password.

### Initialize

The `initialize` playbook adds my user and public keys to the RBP and disables password ssh logins.

```
ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook initialize.yaml -i inventories/thspinto
```

Notice that `inventories/thspinto/all.yaml` is unreadable. That's because its encrypted with [Ansible Vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html#file-level-encryption). I don't recommend versioning secrets in public repositories for most use cases, even if they are encrypted. In my case, I versioned it because I'll certainly lose the file otherwise. Also the only sensitive information I have is a token to alter my DNS registry. Since there is virtually no traffic in my domain, it's no big deal.

### Basic setup

In the second phase, I did a little hardening and added docker. This is done by the setup playbook:

```bash
ansible-galaxy install -r requirements.yml
ansible-playbook --vault-password-file /path/to/my/vault-password-file setup.yaml -i inventories/thspinto
```

### Services

The last playbook spins up the services I want to run using docker-compose. I separated it from the rest because it is frequently changed and deployed.

```bash
ansible-playbook --vault-password-file /path/to/my/vault-password-file services.yaml -i inventories/thspinto
```

Currently I run:

* [Cloudflare DDNS](https://github.com/oznu/docker-cloudflare-ddns) to register the Pi's id the my domain.
* [Traefik 2.1](https://docs.traefik.io) as proxy with docker service discovery
* [ForwardAuth](https://github.com/thomseddon/traefik-forward-auth) to have OpenConnectID login using [Auth0](https://auth0.com/)


## My Pi

Everything runs fine on model B with one 700MHz core and 512MB of ram. Checkout the [raspberry-config repo](https://github.com/thspinto/raspberry-config) for more details and updates. However I can't really do much with this hardware. That's why as next steps I'm considering buying more RBPs and setting up a clustered environment with [k3s](https://k3s.io/).