1. Install OS

For Raspberry Pi:

1. Install latest Ubuntu server LTS.
2. Connect with ethernet and SSH to local IP with ssh -o PasswordAuthentication=yes -o PreferredAuthentications=keyboard-interactive,password -o PubkeyAuthentication=no ubuntu@<IP>

For Ubuntu Desktops:

1. Enable full drive encryption during install. This reduces risk from hardware theft.
2. Do not create a user named woolie as part of setup, instead create a temporary user named 'tmpbootstrap'. This will only be used to run puppet initially and should be removed after. Puppet needs to create the woolie user to keep UIDs/GIDs in sync.
3. Set hostname if asked, following scheme of {model}{increment}.

For desktop1 to auto decrypt and mount the internal SATA HDD:

1. Configure auto unlocking of partition:
   1. Retrieve password from password manager for drive starting UUID=cd5e45c0
   2. Open GNOME disks.
   3. Select LUKS partition on drive (not the filesystem).
   4. Additional partition options > Edit Encryption Options.
   5. Uncheck "User Session Defaults".
   6. Check "Unlock at system startup".
   7. Enter passphrase from manager.
2. Configure auto mounting of filesystem:
   1. Select the filesystem (not the partition) in GNOME disks.
   2. Additional partition options -> Edit Mount Options.
   3. Uncheck "User Session Defaults".
   4. Check "Mount at system startup"
   5. Set mount point: /media/woolie/bulkstorage.

2. Run puppet

1. If bootstrapping a host that needs a static IP, ensure the router configuration is set as in this README. If changing a hardware used for the same host, update the MAC address in the README/router.

2. Set hostname with sudo hostnamectl set-hostname "{model}{increment}

3. Run the bootstrap script:

   wget -q -O - https://raw.github.com/AWooldrige/puppet/master/bootstrap.sh | sudo bash

3. Add credentials not managed by Puppet

For workstations:

1. Transfer SSH keys from another machine.

For webpi:

2. Set [ddns] in /home/woolie/.aws/credentials
3. Set /etc/nginx/secrets/photos.htpasswd contents from password store
4. Set /etc/nginx/secrets/cg.htpasswd contents from password store
5. Restore tiddlywiki backup using /var/ww/tw/ww
6. Install pihole using instructions from [https://pi-hole.net/]

All lowercase

Allocated hostnames:

• websh1

Each file should be prepended with the following text.

#########################################################################
##   This file is controlled by Puppet - changes will be overwritten   ##
#########################################################################

All scripts should log to syslog and to stdout/stderr. This should be managed within the scripts themselves.

To see log output for the main crons:

• sudo journalctl -t 'gdpup'
• sudo journalctl -t 'ddns'

Each machine has one main user, woolie. This user is used for SSH remote access and local access. The user should always have a password set and should also require it for sudo (no passwordless sudo, even on remote machines).