Review Security Landscape

[rgbkrk]

I'm playing a bit fast and loose IMO to get this up and running. From what I can tell, I'm doing pretty well. However, it would be great to do a good review of the following:

Public Key Infrastructure

• Should the CA for the auth store be independent of the CA for communicating amongst Docker nodes?
• Should each deployment be a wholly separate entity with a new CA?

ObjectRocket (or other programmatic Database access)

• In the same spirit of total annihilation, we could be creating access to the main mongo database programmatically with a new user for every deployment.

Side Ansible question - are the values of variables rendered locally or on the host being deployed to?

Clearly flying has made me crazy.