Merge branch 'master' of https://gitea.lyc-lecastel.fr/gadmin/gsb2021

README.md

@@ -12,4 +12,31 @@ prérequis : une machine Debian buster
   * r-int
   * r-ext
   * s-proxy
+
+
 ## Les playbooks
+
+
+## Installation
+
+On utilisera l'image de machine virtuelle suivante : 
+  * **debian-buster-gsb-2021b.ova** (2021-03-31)
+    * Bebian Buster 10.9 - 2 cartes - 1 Go - stockage 20 Go
+
+
+### Machine s-adm
+  - créer la machine virtuelle **s-adm** en important l'image ova décrite plus haut 
+  - 
+
+
+### Pour chaque machine
+
+  - importer la machine à partir du fichier **.ova**
+  - définir les cartes réseau en accord avec le plan d'adressage et le schéma
+  - donner le nom adapté (avec sed -i …)
+  - redémarrer
+  - mettre à jour les paquets : apt update && apt upgrade
+  - cloner le dépot : https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
+  
+
+   curl depl/gsbboot|bash

proxy

@@ -0,0 +1 @@
+/etc/nginx/sites-availables/proxy

r-vp1.yml

@@ -12,9 +12,9 @@
    - base
    - goss
    - snmp-agent
-   - vpn-stg-r
-#   - x509-r
-#   - firewall-vpn-r
+   - firewall-vpn-r
+#  - vpn-stg-r
+   - x509-r
    - ssh-cli
    - syslog-cli
    - post

r-vp2.yml

@@ -13,10 +13,11 @@
    - goss
    - dhcp-ag
    - dns-agence
+   - ssh-root-access
    - snmp-agent
-   - vpn-stg-l
-#   - x509-l
-#   - firewall-vpn-l
+   - firewall-vpn-l
+#  - vpn-stg-l
+   - x509-l
    - ssh-cli
    - syslog-cli
    - post

roles/dns-master/files/db.gsb.lan

@@ -21,6 +21,8 @@ s-proxy         IN      A       172.16.0.2
 s-appli    	IN      A       172.16.0.3
 s-win    	IN      A       172.16.0.6
 s-mess   	IN      A       172.16.0.7
+s-nxec		IN	A	172.16.0.7
+s-docker	IN	A	172.16.0.7
 s-mon    	IN      A       172.16.0.8
 s-itil		IN	A	172.16.0.9
 r-int    	IN      A       172.16.0.254

roles/docker-nextcloud/files/config.php

@@ -0,0 +1,48 @@
+<?php
+$CONFIG = array (
+  'htaccess.RewriteBase' => '/',
+  'memcache.local' => '\\OC\\Memcache\\APCu',
+  'apps_paths' => 
+  array (
+    0 => 
+    array (
+      'path' => '/var/www/html/apps',
+      'url' => '/apps',
+      'writable' => false,
+    ),
+    1 => 
+    array (
+      'path' => '/var/www/html/custom_apps',
+      'url' => '/custom_apps',
+      'writable' => true,
+    ),
+  ),
+  'instanceid' => 'ocvc4q2htemf',
+  'passwordsalt' => 'stdJZMx4C5hz85Kqt8XdZIzx8kVOHI',
+  'secret' => 'II1BBgzlx70WUYCapAt/m/Bt1ZEk/n11n0DVq3zynyU8F/bU',
+  'trusted_domains' => 
+  array (
+    0 => '172.16.0.7:5678',
+    1 => '172.16.0.7:8080',
+    2 => 's-mess',
+    3 => 's-mess.gsb.lan',
+    4 => 'localhost:8080',
+    5 => 's-nxec.gsb.lan',
+  ),
+  'trusted_proxies' => ['172.16.0.7'],
+  'overwriteprotocol' => 'http',
+  'overwritehost' => '172.16.0.7:8080',
+  'proxy' => '172.16.0.7:8080',
+  'datadirectory' => '/var/www/html/data',
+  'dbtype' => 'mysql',
+  'version' => '20.0.6.1',
+  'overwrite.cli.url' => 'http://172.16.0.7:5678',
+  'dbname' => 'nextcloud',
+  'dbhost' => 'db',
+  'dbport' => '',
+  'dbtableprefix' => 'oc_',
+  'mysql.utf8mb4' => true,
+  'dbuser' => 'nextcloud',
+  'dbpassword' => 'root',
+  'installed' => true,
+);

roles/docker-nextcloud/files/dhparam.pem

@@ -0,0 +1,13 @@
+-----BEGIN DH PARAMETERS-----
+MIICCAKCAgEA9YcWlg90PgLB2PS31Tv8mxn6cyRZd4GvX6tkqwOfXhdBZYzgoEnJ
+17U+hDqpT5utQpUbfR0//uXr53mpu3ufxCNJ9gSsCIAbmhTIT3qwLwUis3Etb8PA
+4LCTbVHvua5W7/pdM0s8PIOAWK7ah09p+mzwZqx5tKZWtbdERQKIAGE6Xmd4845/
+9oBWTj2g5t83Gt/fZDy+NVRy5ePb/KGix4bEmfnZ5htC/16VFPVrSZUALoxn8HtC
+3nn4eqBrZeAxY6UHuW0ZPkRmpLs3GCILa+gze+wDlKlhC+RQU/f8Fijo6SsQPzNf
+6BzJdoyeeE9OyyhhWu4Mihr39RnShk1ABO2eZrA1TE7L5X3YuCeIO09j99hkEsPr
+mX1zh+v4sx2FFMZLebu+5KYf+ROOOYtMy6AJQq55avccTPrs0S+pxswypbzMD4ym
+BYtPO46XYkRhrX47TfVHLW9oonDmMxPKNidNMrFtKW0b6f09iOcN9iEA/EM0s+3n
+uQ2h+bQrwGqo5aMSUuJ3w8EjFySIqKgU5ZxJzPGSndsqS7zd2hUxNx7EZueHXX5N
+CJ7kWRhIFv8YHHx0J/VFJieyr7DAUATu7chu4aGhwf2AoGYzmI0tjSh+3rQiDh7O
+h+JtKr+wifr9P2vBqIWFQltOC2srRs+EB+5/qN1iIjYmq52MkUbFLfMCAQI=
+-----END DH PARAMETERS-----

roles/docker-nextcloud/files/docker-compose.yml

@@ -16,6 +16,7 @@ services:
       - MYSQL_PASSWORD=root
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
+      - TZ=Europe/Paris
 
   app:
     image: nextcloud
@@ -31,3 +32,4 @@ services:
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
       - MYSQL_HOST=db
+      - TZ=Europe/Paris

roles/docker-nextcloud/files/nginx-selfsigned.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEAzCCAuugAwIBAgIUAr99SgfwQjW0wJSay5rL7I8V6G4wDQYJKoZIhvcNAQEL
+BQAwgZAxCzAJBgNVBAYTAkZSMRIwEAYDVQQIDAlCb3VyZ29nbmUxDjAMBgNVBAcM
+BURpam9uMQwwCgYDVQQKDANHU0IxDjAMBgNVBAsMBWluZnJhMRcwFQYDVQQDDA5z
+LW54ZWMuZ3NiLmxhbjEmMCQGCSqGSIb3DQEJARYXYXhlbC5tcmwuc2NvbEBnbWFp
+bC5jb20wHhcNMjEwMzI5MDkzMTIxWhcNMjIwMzI5MDkzMTIxWjCBkDELMAkGA1UE
+BhMCRlIxEjAQBgNVBAgMCUJvdXJnb2duZTEOMAwGA1UEBwwFRGlqb24xDDAKBgNV
+BAoMA0dTQjEOMAwGA1UECwwFaW5mcmExFzAVBgNVBAMMDnMtbnhlYy5nc2IubGFu
+MSYwJAYJKoZIhvcNAQkBFhdheGVsLm1ybC5zY29sQGdtYWlsLmNvbTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+iB7H1clY8gwX6CQfBqU+V4gF4ZMmg
+HMbnoPvWV0WOJlgyODh5xdE11iJBBby8VNdiruGNJCeLeI4WWUUkJJXMyeWNTM6/
+JIZhVZI0UF042S/s8WdP+jls4aASkp0QH+XDs+758y5D9lRoX+At+bRZSC/Fz/tL
+Y16e15F1+BxZeSWUEajHZIJZ79gm0UQxA9HdHAHpoWR05P74Fy6rnOsQNtBW4Jkt
+xDb9CHRWNVjvbBuPsDwPTEOvMq94r5yWspHDhA3edvtAAJke5N9od4mN8KTJQouJ
+O0ZzvOYIofr8iQM3981p9MuBUwtDNT7+ns22lDXeORoliOCG1gE25DsCAwEAAaNT
+MFEwHQYDVR0OBBYEFJgtmIFxdyFe3vZ/a3UwxORCZiLiMB8GA1UdIwQYMBaAFJgt
+mIFxdyFe3vZ/a3UwxORCZiLiMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAJm7oJOJev7hh/G1xCPPyASWn9s9C9sb5zbxyq1gF5P6Br8Xof9OJ1ZE
+XJaH1MwxxR+2Qhok6gERBSqpwe6jnreImOpqhHEQGdMWJvIRlvTPQmEj/mCoLGKf
+DsIvl3ug4OfNqMojwYlGhsfQH92Qz2pnE88pLIT13y85c8TJHti2+GOxOTSxYLrs
+lt3fYYjnSZ2mm9fLBcP/XgdCSTeN6XwpJr2b56sVh0uehFXnkgzjDd+PTGkIgnfT
+/eXtX8+VbQIOSEOrIt0GneBZ3n37FSgz/y9TR5HgNKyt74oxbLsYR0qWpbCcEjw+
+ex/v7vE3bXgPGE56NzhlM1Pjh90R9hI=
+-----END CERTIFICATE-----

roles/docker-nextcloud/files/nginx-selfsigned.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCvogex9XJWPIMF
++gkHwalPleIBeGTJoBzG56D71ldFjiZYMjg4ecXRNdYiQQW8vFTXYq7hjSQni3iO
+FllFJCSVzMnljUzOvySGYVWSNFBdONkv7PFnT/o5bOGgEpKdEB/lw7Pu+fMuQ/ZU
+aF/gLfm0WUgvxc/7S2NenteRdfgcWXkllBGox2SCWe/YJtFEMQPR3RwB6aFkdOT+
++Bcuq5zrEDbQVuCZLcQ2/Qh0VjVY72wbj7A8D0xDrzKveK+clrKRw4QN3nb7QACZ
+HuTfaHeJjfCkyUKLiTtGc7zmCKH6/IkDN/fNafTLgVMLQzU+/p7NtpQ13jkaJYjg
+htYBNuQ7AgMBAAECggEAfyHLbi7cL74nnZjrFnlBpIE7EpNiaWyDyBr8ta7mh0up
+R+g6N+81mQXeVfc5PvAYfbxKGKyBAjr77eYRgnHyJZkSgB5y/ajwuHEWbvl9Pq2a
+0Q0zhPQojY7aF3O6OwTkAf5Sbebx94hsc5cF55GAEeMa1LHcpethJ6nVIs8A5QtP
+ZgGlfFkgGXp1GQPmeX1jQePSp8nqCftIwFPOuLcuQnisc282NCRHl3M+VlnUIZNL
+fgRxalurrnaKf5P9DRvxiGlUJzoH1h0tgYbfUMpoRXdYYK3wjVbWWPROrS1c1yrl
+17W004k8Fb++rUmQucQEtsiID/ymAMZPtiCG2IqvwQKBgQDjQGf8GFt04ypvoux/
+acOMtHXaA1k1Fa6Gtvr3dCfhlm4dCxvHfAqWawW2GXrSajhVRe+vcqBMyKAY5G3a
+O3nZNpFliMqbftzKkF6AThIgaDaGAzfr+I88urvX0od1+wzjzievOHOlbil3OriD
+HrGmfO/xnnXkgHCQK2YjmhFeoQKBgQDF2fEp5HZAZFWy55LVlS6DIDFfK2DShCNf
+ENcDp1YWz/PCbHTY0xXZ6T4TOX14YYmeZVZFCUcpWGQrfL+ogJhoM9iQFuzYrzMz
+iYjgICeTJPLGQawC6CKVFcE7i6kjNie66IjEIZj1rS2zG/+WVTl95M8JxJO2U7a/
+7JiYJiehWwKBgQCqxb6euisYJpHAPL3ebbtO5Fnf0D5cXwO9JopoJHjH1ITA/JUO
+jo9iQ+CR3Inoz3uv0RNyVABUUzvEGPzYT3OcoJ4Yn/gpa+c9rcnmP0Tt54J5qLeA
+c1QofeclI4c6SMOB+WznBtQZEDTG7XC0z/8OLrsdZkgPw9lS7doejOvaoQKBgGbV
+azp561h2jfBp2nC2lDFFN0Qe2LkyQuwzZX4ZqG488ZZZJrZXqGDVkRUO6X77Ozsf
+sqI5O0prDc1ojnk3NX/birEBqWLKVRNxZboQHGGnb6PKGGx+WRMh9ohLg8KwcB/+
+oq9GQylWNI2GfOaXL0WW+mE6UggPJMpGX92c3zZHAoGAMOFoxUjjzsB0oJLTuYax
+VKE7Jno24o5JeDRm69WS3E6boSZsIY/9r4jWtYiTbhwlTZpZMqad3h/zM/swHvVq
+hh1BaHXBik/9rpnyTMZ9vo6UNyYo/TJPH3yrKwZbF4Cn2uWQoJCfDeo9VXdIEbEn
+SwyeWd4Zkt/wvqmocF5KVqI=
+-----END PRIVATE KEY-----

roles/docker-nextcloud/files/proxy

@@ -22,15 +22,36 @@ server {
 	listen 8080 default_server;
 	listen [::]:8080 default_server;
 	
+	server_name s-nxec.gsb.lan;
+
+	return 302 https://$server_name$request_uri;
+}
+#	location / {
+#		proxy_set_header Host $host;
+#		proxy_set_header X-Real-IP $remote_addr;
+#		proxy_pass http://localhost:5678;
+#		proxy_connect_timeout 900;
+#		proxy_send_timeout 900;
+#		proxy_read_timeout 900;
+
+server {
+	listen 443 ssl default_server;
+	listen [::]:443 ssl default_server;
+	server_name s-nxec.gsb.lan;
+
+	include snippets/self-signed.conf;
+	include snippets/ssl-params.conf;
+
 	location / {
-		proxy_set_header Host $host;
+                proxy_set_header Host $host;
                 proxy_set_header X-Real-IP $remote_addr;
-		proxy_pass http://localhost:5678;
-		proxy_connect_timeout 900;
-		proxy_send_timeout 900;
-		proxy_read_timeout 900;
+                proxy_pass http://localhost:5678;
+                proxy_connect_timeout 900;
+                proxy_send_timeout 900;
+                proxy_read_timeout 900;
 	}
 
+}
 	# SSL configuration
 	#
 	# listen 443 ssl default_server;
@@ -77,7 +98,7 @@ server {
 	#location ~ /\.ht {
 	#	deny all;
 	#}
-}
+
 
 
 # Virtual Host configuration for example.com

roles/docker-nextcloud/files/proxy.bak

@@ -0,0 +1,100 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 8080 default_server;
+	listen [::]:8080 default_server;
+
+	location / {
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_pass http://localhost:5678;
+		proxy_connect_timeout 900;
+		proxy_send_timeout 900;
+		proxy_read_timeout 900;
+	}
+
+	# SSL configuration
+	#
+	# listen 443 ssl default_server;
+	# listen [::]:443 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+#	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+#	index index.html index.htm index.nginx-debian.html;
+
+#	server_name _;
+
+#	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+#		try_files $uri $uri/ =404;
+#	}
+
+	# pass PHP scripts to FastCGI server
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php-fpm (or other unix sockets):
+	#	fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+	#	# With php-cgi (or other tcp sockets):
+	#	fastcgi_pass 127.0.0.1:9000;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

roles/docker-nextcloud/files/self-signed.conf

@@ -0,0 +1,2 @@
+ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
+ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

roles/docker-nextcloud/files/ssl-params.conf

@@ -0,0 +1,18 @@
+ssl_protocols TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_dhparam /etc/nginx/dhparam.pem;
+ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
+ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
+ssl_session_timeout  10m;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off; # Requires nginx >= 1.5.9
+ssl_stapling on; # Requires nginx >= 1.3.7
+ssl_stapling_verify on; # Requires nginx => 1.3.7
+resolver 172.16.0.1 valid=300s;
+resolver_timeout 5s;
+# Disable strict transport security for now. You can uncomment the following
+# line if you understand the implications.
+# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";

roles/docker-nextcloud/tasks/main.yml

@@ -29,3 +29,61 @@
   shell: docker-compose up -d
   args:
     chdir: /root/nextcloud
+
+- name: Installation de Nginx
+  package:
+    name: nginx
+    state: present
+
+- name: Copie de config.php dans /root/nextcloud/nextcloud/config
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php
+    dest: /root/nextcloud/nextcloud/config 
+
+- name: Copie de nginx-selfsigned.key
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/nginx-selfsigned.key
+    dest: /etc/ssl/private
+
+- name: Copie nginx-selfsigned.crt
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/nginx-selfsigned.crt
+    dest: /etc/ssl/certs
+
+- name: Copie de dhparam.pem
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/dhparam.pem
+    dest: /etc/nginx
+
+- name: Copie de self-signed.conf
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/self-signed.conf
+    dest: /etc/nginx/snippets
+
+- name: Copie de ssl-params.conf
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/ssl-params.conf
+    dest: /etc/nginx/snippets
+
+- name: Copie de /etc/nginx/site-availables/proxy
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
+    dest: /etc/nginx/sites-available
+
+- name: Suppression de /etc/nginx/sites-enabled/default
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/n$
+  file:
+    src: /etc/nginx/sites-available/proxy
+    dest: /etc/nginx/sites-enabled/proxy
+    owner: root
+    group: root
+    state: link
+
+- name: Redemarage de Nginx
+  service:
+    name: nginx
+    state: restarted

roles/firewall-vpn-l/files/ferm.conf

@@ -4,12 +4,12 @@
 #
 
 @def $DEV_ADM	= enp0s3;
-@def $DEV_VPN	= enp0s8;
-@def $DEV_EXT	= enp0s9;
+@def $DEV_AG	= enp0s8;
+@def $DEV_VPN	= enp0s9;
 
-@def $NET_ADM=192.168.99.0/24;
-@def $NET_VPN=192.168.0.0/24;
-@def $NET_EXT=192.168.1.0/30;
+@def $NET_ADM=192.168.99.102/24;
+@def $NET_AG=172.16.128.254/24;
+@def $NET_VPN=192.168.0.52/24;
 
 table filter {
     chain INPUT {
@@ -23,28 +23,21 @@ table filter {
         interface lo ACCEPT;
 
         # allow SSH connections
-        #interface ($DEV_ADM) {
 	proto tcp dport ssh ACCEPT;
-	#}
 
         # allow DNS connections
-        #interface ($DEV_INT) {
 	proto udp sport domain ACCEPT;
 	proto udp dport domain ACCEPT;	
-	#}	
-
-        # DHCP
-        proto udp dport (67 68) ACCEPT;
 
         # allow IPsec
-        interface ($DEV_VPN $DEV_EXT) {
+        interface ($DEV_AG $DEV_VPN) {
         proto udp sport 500 ACCEPT;
         proto udp dport 500 ACCEPT;
         proto esp ACCEPT;
 	}
 
         # Autoriser nat-t-ike
- #       interface ($DEV_VPN) {
+ #       interface ($DEV_AG) {
         proto udp sport 4500 ACCEPT;
         proto udp dport 5500 ACCEPT;
 #	}
@@ -54,52 +47,16 @@ table filter {
 	proto (udp tcp) dport domain ACCEPT;
 	#}
 
-	# autoriser supervision
-	proto udp sport 161 ACCEPT;
-
 	# autoriser NTP
 	proto udp sport 123 ACCEPT;
 
-        # respond to ping
-        proto icmp mod limit limit 30/minut ACCEPT; 
-
     }
     chain OUTPUT {
-        policy DROP;
-#        interface ($DEV_PUB) {
-        
-	# Autoriser SSH
-        proto tcp sport ssh ACCEPT;
-
-	# Autoriser DNS
-        proto udp dport domain ACCEPT;
-        proto udp sport domain ACCEPT;
-
-        # DHCP
-        proto udp sport (67 68) ACCEPT;
-	
-	# Autoriser ipsec
-        proto udp dport 500 ACCEPT;
-        proto udp sport 500 ACCEPT;
-	
-	# Autoriser nat-t-ike
-        proto udp dport 4500 ACCEPT;
-        proto udp sport 4500 ACCEPT;
-        
-	# Autoriser supervision
-        proto udp dport 161 ACCEPT;
-	
-	# Autoriser NTP
-        proto udp dport 123 ACCEPT;
-
-        # respond to ping
-        proto icmp ACCEPT; 
-
-#	}
+        policy ACCEPT;
 
         # connection tracking
-        #mod state state INVALID DROP;
-        mod state state (ESTABLISHED RELATED) ACCEPT;
+        # mod state state INVALID DROP;
+        # mod state state (ESTABLISHED RELATED) ACCEPT;
     }
     chain FORWARD {
         policy ACCEPT;
@@ -109,14 +66,3 @@ table filter {
         mod state state (ESTABLISHED RELATED) ACCEPT;
     }
 }
-
-# IPv6:
-#domain ip6 {
-#    table filter {
-#        chain INPUT {
-#            policy ACCEPT;
-#            # ...
-#        }
-#        # ...
-#    }
-#}

roles/firewall-vpn-l/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
-  - name : installer ferm
-    apt: name=ferm state=present
-  - name: fichier parefeu pour VPN
-    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-    notify:
-      - Restart ferm
+- name : installer ferm
+  apt: name=ferm state=present
   
+- name: fichier parefeu pour VPN
+  copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+  notify:
+    - Restart ferm

roles/firewall-vpn-r/files/ferm.conf

@@ -7,9 +7,9 @@
 @def $DEV_VPN	= enp0s8;
 @def $DEV_EXT	= enp0s9;
 
-@def $NET_ADM=192.168.99.0/24;
-@def $NET_VPN=192.168.0.0/24;
-@def $NET_EXT=192.168.1.0/30;
+@def $NET_ADM=192.168.99.112/24;
+@def $NET_VPN=192.168.0.51/24;
+@def $NET_EXT=192.168.1.2/24;
 
 table filter {
     chain INPUT {
@@ -23,15 +23,13 @@ table filter {
         interface lo ACCEPT;
 
         # allow SSH connections
-        #interface ($DEV_ADM) {
 	proto tcp dport ssh ACCEPT;
-	#}
+	
 
         # allow DNS connections
-        #interface ($DEV_INT) {
 	proto udp sport domain ACCEPT;
 	proto udp dport domain ACCEPT;
-	#}	
+		
 
         # allow IPsec
         interface ($DEV_VPN) {
@@ -51,49 +49,13 @@ table filter {
 #	proto (udp tcp) dport domain ACCEPT;
 	#}
 
-	# autoriser supervision
-	proto udp sport 161 ACCEPT;
 
 	# autoriser NTP
 	proto udp sport 123 ACCEPT;
 
-        # respond to ping
-        proto icmp mod limit limit 30/minut ACCEPT; 
-
     }
     chain OUTPUT {
-        policy DROP;
-#        interface ($DEV_PUB) {
-        
-	# Autoriser SSH
-        proto tcp sport ssh ACCEPT;
-
-	# Autoriser DNS
-        proto udp dport domain ACCEPT;
-        proto udp sport domain ACCEPT;
-	
-	# Autoriser ipsec
-        proto udp dport 500 ACCEPT;
-        proto udp sport 500 ACCEPT;
-	
-	# Autoriser nat-t-ike
-        proto udp dport 4500 ACCEPT;
-        proto udp sport 4500 ACCEPT;
-        
-	# Autoriser supervision
-        proto udp dport 161 ACCEPT;
-	
-	# Autoriser NTP
-        proto udp dport 123 ACCEPT;
-
-        # respond to ping
-        proto icmp ACCEPT; 
-
-#	}
-
-        # connection tracking
-        #mod state state INVALID DROP;
-        mod state state (ESTABLISHED RELATED) ACCEPT;
+        policy ACCEPT;
     }
     chain FORWARD {
         policy ACCEPT;
@@ -103,14 +65,3 @@ table filter {
         mod state state (ESTABLISHED RELATED) ACCEPT;
     }
 }
-
-# IPv6:
-#domain ip6 {
-#    table filter {
-#        chain INPUT {
-#            policy ACCEPT;
-#            # ...
-#        }
-#        # ...
-#    }
-#}

roles/firewall-vpn-r/tasks/main.yml

@@ -1,15 +1,8 @@
 ---
-  - name: redemarrer interfaces
-    command: ifdown enp0s8
-  - name: redemarrer interfaces
-    command: ifup enp0s8
-  - name: redemarrer interfaces
-    command: ifdown enp0s9
-  - name: redemarrer interfaces
-    command: ifup enp0s9
-  - name: redemarrer interfaces
-    apt: name=ferm state=present
-  - name: fichier parefeu pour VPN
-    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-    notify:
-      - Restart ferm
+- name : installer ferm
+  apt: name=ferm state=present
+
+- name: fichier parefeu pour VPN
+  copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+  notify:
+    - Restart ferm

roles/ssh-root-access/tasks/main.yml

@@ -0,0 +1,7 @@
+- name: Activation acces ssh root pour vp-1 (certificat)
+  lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: "^PermitRootLogin"
+    line: "PermitRootLogin yes"
+    state: present
+

s-lb-bd.yml

@@ -11,13 +11,14 @@
    roles:
      - base
      - goss
+     - post
      #- s-lb-bd-ab
      - mariadb-ab
-     - role: db-user
-       cli_ip: "192.168.102.1"
-     - role: db-user
-       cli_ip: "192.168.102.2"
-     - role: db-user
-       cli_ip: "192.168.102.3"     
+#     - role: db-user
+#       cli_ip: "192.168.102.1"
+#     - role: db-user
+#       cli_ip: "192.168.102.2"
+#     - role: db-user
+#       cli_ip: "192.168.102.3"     
      - snmp-agent
-     - post
+#     - post