Skip to content

Commit f06b047

Browse files
slothkongslothkong
authored
docs: General user-facing guidelines improvement (#42)
1 parent 6f974f3 commit f06b047

21 files changed

Lines changed: 1125 additions & 734 deletions

File tree

‎README.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,29 +5,29 @@ A collection of configuration templates
55
to customize your
66
[European Weather Cloud (EWC)](https://europeanweather.cloud/) tenancy. See full list of Items in the [index](#index) below.
77

8-
Want to learn how other users make the best out of these templates, or have ideas of your own? Head over to [the official discussion platform](https://chat.europeanweather.cloud/) and engage with the EWC community. Feedback is always welcomed! ♥️
8+
Want to learn how other users make the best out of these templates, or have ideas of your own? Head over to [the EWC discussion platform](https://chat.europeanweather.cloud/) and engage with the community. Feedback is always welcomed! ♥️
99

1010
## Index
1111

12-
>💡 Two levels of functionality available in this collection: 1) one to configure previously provisioned instances, 2) another to self-provisioning or manage provisioned instances (i.e. "one-line" deployment and full state management).
12+
>💡 Two levels of functionality available in this bundle: 1) one to install items onto existing instances, 2) another to provision or manage the state of instances whilst installing items on top ( full deployment and state management).
1313
1414
### Level 1: Configuration (existing VMs)
1515

1616
| Name | Summary |
1717
|------|-----|
18-
| [eumetcast-terrestrial-amt-flavour](./playbooks/eumetcast-terrestrial-amt-flavour/) | Configures an existing VM to realiably capture and store data streamed by the EUMETCast Terrestrial service over a high-bandwith network |
19-
| [eumetsat-data-tailor-flavour](./playbooks/eumetsat-data-tailor-flavour/) |Transforms an existing VM into a powerful satellite data customization hub, enabling users to efficiently subset, aggregate, reproject, and reformat data from METOP, MFG, MSG, MTG, and Sentinel-3 into GIS and image formats, offering faster processing and greater flexibility than web-based alternatives. |
18+
| [eumetcast-terrestrial-amt-flavour](./playbooks/eumetcast-terrestrial-amt-flavour/) | Configures an existing VM to capture and store data streamed by the EUMETCast Terrestrial service over a high-bandwidth network |
19+
| [eumetsat-data-tailor-flavour](./playbooks/eumetsat-data-tailor-flavour/) |Transforms an existing VM into a satellite data customization hub, enabling users to efficiently subset, aggregate, reproject, and reformat data from METOP, MFG, MSG, MTG, and Sentinel-3 into GIS and image formats, offering faster processing and greater flexibility than web-based alternatives. |
2020
| [eumetsat-s3-mount-flavour](./playbooks/eumetsat-s3-mount-flavour/) | Enables a VM to access public EUMETSAT data, stored in S3 buckets, just as if it was kept on the local filesystem |
21-
| [haproxy-flavour](./playbooks/haproxy-flavour/) | Configures an existing VM as a high-performance load balancer, enhancing application speed, security, and scalability with easy management for TCP and HTTP workloads. |
22-
| [ipa-client-disenroll-flavour](./playbooks/ipa-client-disenroll-flavour/) | Simplifies the secure removal of a running VM from a FreeIPA-managed fleet of instances, reducing administrative overhead and enhancing security by eliminating stale credentials and DNS records. |
23-
| [ipa-client-enroll-flavour](./playbooks/ipa-client-enroll-flavour) | Seamlessly integrates a running VM into a FreeIPA-managed fleet of instances, enabling centralized user authentication, DNS resolution, and secure remote access for simplified and scalable identity management. |
21+
| [haproxy-flavour](./playbooks/haproxy-flavour/) | Configures an existing VM as a load balancer, enhancing application speed, security, and scalability with easy management for TCP and HTTP workloads. |
22+
| [ipa-client-disenroll-flavour](./playbooks/ipa-client-disenroll-flavour/) | Simplifies the removal of a running VM from a FreeIPA-managed fleet of instances, reducing administrative overhead and enhancing security by eliminating stale credentials and DNS records. |
23+
| [ipa-client-enroll-flavour](./playbooks/ipa-client-enroll-flavour) | Integrates a running VM into a FreeIPA-managed fleet of instances, enabling centralized user authentication, DNS resolution, and secure remote access for simplified and scalable identity management. |
2424
| [ipa-server-flavour](./playbooks/ipa-server-flavour/) | Turns an existing VM into a FreeIPA server, a central place for user authentication, authorization, and DNS-based resource discovery for secure and efficient identity management. |
2525
| [nginx-proxy-manager-flavour](./playbooks/nginx-proxy-manager-flavour/) | Configures an existing VM as a user-friendly Nginx Proxy Manager server, simplifying virtual host management, SSL/HTTP/2 support, and security features like exploit blocking for efficient and secure proxy operations. |
2626
| [remote-desktop-flavour](./playbooks/remote-desktop-flavour/) | Transforms an existing VM into a secure, graphical desktop environment using X2Go and MATE, enabling simple remote access and intuitive cloud-based development for tenant users. |
27-
| [ssh-bastion-flavour](./playbooks/ssh-bastion-flavour/) | Tightens the configuration of a running VM, to operate as a secure SSH proxy with Fail2ban, providing tenant admins and users a fortified entry point to safely access private EWC networks from the public internet. |
27+
| [ssh-bastion-flavour](./playbooks/ssh-bastion-flavour/) | Reduces the attack surface of a running VM and turns it into a SSH proxy with Fail2ban, providing tenant admins and users a secure entry point to access private EWC networks from the public internet. |
2828
| [xcube-viewer-flavour](./playbooks/xcube-viewer-flavour/) | Configures an existing VM with the xcube Viewer, to visualize Earth Observation data within a user-friendly graphical user interface |
2929

30-
### Level 2: Self-provisioning + Configuration
30+
### Level 2: Provisioning/Management + Configuration
3131

3232
| Name | Summary |
3333
|------|-----|

‎playbooks/default-stack-provisioning/README.md‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,9 @@ to their DNS configuration.
3535
* Install [python](https://www.python.org/downloads) (version 3.9 or higher)
3636
* Install [python-openstackclient](https://pypi.org/project/python-openstackclient) (version 8.0 or higher)
3737
* Install [ansible](https://pypi.org/project/ansible) (version 2.15 or higher)
38-
* Install [terraform](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+-+IaC+via+Terraform+and+OpenTofu#EWCIaCviaTerraformandOpenTofu-InstallationoftheCLI) (version 1.0 or higher)
39-
* Get OpenStack API credentials (see [How to request OpenStack Application Credentials](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+-+How+to+request+Openstack+Application+Credentials) section of the EWC documentation)
40-
* Create an SSH keypair (see [Creating Keys](https://confluence.ecmwf.int/display/EWCLOUDKB/Add+your+SSH+key+pair+to+Morpheus#AddyourSSHkeypairtoMorpheus-Creatingthekeys) section of the EWC documentation)
41-
* Import your public SSH key to OpenStack (see [Import SSH Key](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+-+OpenStack+Command-Line+client#EWCOpenStackCommandLineclient-ImportSSHkey) section of the EWC documentation).
38+
* Install [terraform](https://confluence.ecmwf.int/x/UyRNH) (version 1.0 or higher)
39+
* Get OpenStack application credentials and add them to your shell's environment variables (see the [How to request OpenStack Application Credentials](https://confluence.ecmwf.int/x/TiRNH) and [Using OpenStack RC files](https://confluence.ecmwf.int/x/TyRNH#EWCOpenStackAPIaccessInstallanduseCommandLineclient-usingOpenStackRCfile) sections of the EWC documentation for details)
40+
* Create an SSH keypair and import the public SSH key to OpenStack (see [EWC OpenStack API access - Setup a KeyPair](https://confluence.ecmwf.int/x/0ZglK) section of the EWC documentation).
4241

4342
## Usage
4443
> ⚠️ Only RockyLinux versions 9 or 8 are supported due
@@ -64,14 +63,14 @@ git clone https://github.com/ewcloud/ewc-ansible-playbook-flavours-and-provision
6463
cd ewc-ansible-playbook-flavours-and-provisioning/playbooks/default-stack-provisioning
6564
```
6665

67-
#### 1.2. (Optional) Checkout an specific Item's version
66+
#### 1.2. Checkout an specific Item's version
6867
>⚠️ Make sure to replace `x.y.z` in the command below, with your version of preference.
6968
7069
```bash
7170
git checkout x.y.z
7271
```
7372

74-
### 2. Download Ansible dependencies
73+
### 2. Download Ansible dependencies
7574
>💡 By default, Ansible Roles are installed under the `~/.ansible/roles` directory within your working environment.
7675
7776
Download the correct version of the Ansible dependencies, if you haven't done so already:
@@ -118,7 +117,7 @@ ansible-playbook \
118117
"ipa_server_hostname":"ipa-server-1",
119118
"ipa_server_flavor_name":"4cpu-8gbmem",
120119
"ipa_server_image_name":"Rocky-9.7-20260519081947",
121-
"ipa_domain":"eumetsat.sandbox.ewc",
120+
"ipa_domain":"internal-eumetsat-sandbox.ewc",
122121
"ipa_admin_username":"ipaadmin",
123122
"ipa_admin_password":"my-secret-password",
124123
"ipa_admin_givenname":"IPAADMIN",
@@ -154,9 +153,9 @@ ansible-playbook \
154153
| ipa_server_instance_name| name of the instance, used in the full instance name | `string` | `server` | yes |
155154
| ipa_server_instance_index | index or identifier for the instance, used as suffix in the full instance name | `number` | `1` | yes |
156155
| ipa_server_hostname | hostname of the IPA server. Should match the pattern "<ipa_server_app_name>-<ipa_server_instance_name>-<ipa_server_instance_index>". Required for input validation purpose | `string` | `ipa-server-1` | yes |
157-
| ipa_server_flavor_name | name the flavor to use for the instance. To learn about available options, checkout the [official EWC VM plans documentation](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+VM+plans) | `string` | `4cpu-8gbmem` | yes |
158-
| ipa_server_image_name | name of the image to use for the instance. For complete information on available options, see the [official EWC Images documentation](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+Virtual+Images+Available) | `string` | `Rocky-8.10-20260519112324` | yes |
159-
| ipa_domain | domain name to be managed by the IPA server. Example: `eumetsat.sandbox.ewc` | `string` | n/a | yes |
156+
| ipa_server_flavor_name | name the flavor to use for the instance. To learn about available options, checkout the [official EWC VM plans documentation](https://confluence.ecmwf.int/x/evWHEw) | `string` | `4cpu-8gbmem` | yes |
157+
| ipa_server_image_name | name of the image to use for the instance. For complete information on available options, see the [official EWC Images documentation](https://confluence.ecmwf.int/x/pU2xG) | `string` | `Rocky-8.10-20260519112324` | yes |
158+
| ipa_domain | domain name to be managed by the IPA server. Example: `internal-eumetsat-sandbox.ewc` | `string` | n/a | yes |
160159
| ipa_admin_username | username of administrator account to replace the default IPA admin | `string` | `ipaadmin` | yes |
161160
| ipa_admin_password | password of administrator account to replace the default IPA admin | `string` | n/a | yes |
162161
| ipa_admin_givenname | given name of the administrator to replace the default IPA admin (needs not be a physical person) | `string` | `EWC` | yes |
@@ -165,19 +164,20 @@ ansible-playbook \
165164
| ssh_bastion_app_name | application name, used as prefix in the full instance name | `string` | `ssh` | yes |
166165
| ssh_bastion_instance_name| name of the instance, used in the full instance name | `string` | `bastion` | yes |
167166
| ssh_bastion_instance_index | index or identifier for the instance, used as suffix in the full instance name | `number` | `1` | yes |
168-
| ssh_bastion_flavor_name | name the flavor to use for the instance. To learn about available options, checkout the [official EWC VM plans documentation](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+VM+plans) | `string` | `4cpu-8gbmem` | yes |
169-
| ssh_bastion_image_name | name of the image to use for the instance. For complete information on available options, see the [official EWC Images documentation](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+Virtual+Images+Available) | `string` | `Rocky-9.7-20260519081947` | yes |
167+
| ssh_bastion_flavor_name | name the flavor to use for the instance. To learn about available options, checkout the [official EWC VM plans documentation](https://confluence.ecmwf.int/x/evWHEw) | `string` | `4cpu-8gbmem` | yes |
168+
| ssh_bastion_image_name | name of the image to use for the instance. For complete information on available options, see the [official EWC Images documentation](https://confluence.ecmwf.int/x/pU2xG) | `string` | `Rocky-9.7-20260519081947` | yes |
170169
| remote_desktop_tf_project_path | path to terraform working directory | `string` | `~/ewc/remote-desktop-1` | yes |
171170
| remote_desktop_app_name | application name, used as prefix in the full instance name | `string` | `remote` | yes |
172171
| remote_desktop_instance_name| name of the instance, used in the full instance name | `string` | `desktop` | yes |
173172
| remote_desktop_instance_index | index or identifier for the instance, used as suffix in the full instance name | `number` | `1` | yes |
174-
| remote_desktop_flavor_name | name the flavor to use for the instance. To learn about available options, checkout the [official EWC VM plans documentation](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+VM+plans) | `string` | `4cpu-8gbmem` | yes |
175-
| remote_desktop_image_name | name of the image to use for the instance. For complete information on available options, see the [official EWC Images documentation](https://confluence.ecmwf.int/display/EWCLOUDKB/EWC+Virtual+Images+Available) | `string` | `Rocky-9.7-20260519081947` | yes |
173+
| remote_desktop_flavor_name | name the flavor to use for the instance. To learn about available options, checkout the [official EWC VM plans documentation](https://confluence.ecmwf.int/x/evWHEw) | `string` | `4cpu-8gbmem` | yes |
174+
| remote_desktop_image_name | name of the image to use for the instance. For complete information on available options, see the [official EWC Images documentation](https://confluence.ecmwf.int/x/pU2xG) | `string` | `Rocky-9.7-20260519081947` | yes |
176175
| remote_desktop_instance_has_fip | technically required to temporarily assign a floating IP to the instance to securely connect from localhost during initial configuration. 💡 The template ensures to remove the floating IP during post-provisioning | `string` | `yes` | yes |
177176
| fail2ban_whitelisted_ip_ranges | IPv4 ranges (in CIDR format) to be whitelisted in Fail2ban configuration. When in doubt, do not set. Example: `['10.0.0.0/24','192.168.1.0/24']` | `list(string)` | `null` | no |
178177

179178

180179
## Dependencies
180+
181181
> 💡 Upon execution, a SBOM (SPDX format) is auto-generated and stored in the VM's file system root directory (see `/sbom.json`).
182182
183183
| Name | Home URL |

0 commit comments

Comments
 (0)