Compare commits
No commits in common. "master" and "v0.7.b-tl" have entirely different histories.
44
README.md
44
README.md
@ -12,48 +12,4 @@ prérequis : une machine Debian buster
|
||||
* r-int
|
||||
* r-ext
|
||||
* s-proxy
|
||||
|
||||
|
||||
## Les playbooks
|
||||
|
||||
|
||||
## Installation
|
||||
|
||||
On utilisera l'image de machine virtuelle suivante :
|
||||
* **debian-buster-gsb-2021b.ova** (2021-03-31)
|
||||
* Bebian Buster 10.9 - 2 cartes - 1 Go - stockage 20 Go
|
||||
|
||||
|
||||
### Machine s-adm
|
||||
* créer la machine virtuelle **s-adm** en important l'image ova décrite plus haut
|
||||
* renommer la machine puis redémarrer
|
||||
* taper :
|
||||
```shell
|
||||
mkdir -p tools/ansible ; cd tools/ansible
|
||||
git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
|
||||
cd gsb2021/pre
|
||||
bash inst-depl
|
||||
cd /var/www/html/gsbstore
|
||||
bash getall
|
||||
cd /root/tools/ansible/gsb021/pre
|
||||
bash gsbboot
|
||||
cd .. ; bash pull-config/pre
|
||||
```
|
||||
- redémarrer
|
||||
|
||||
### Pour chaque machine
|
||||
|
||||
- importer la machine à partir du fichier **.ova**
|
||||
- définir les cartes réseau en accord avec le plan d'adressage et le schéma
|
||||
- donner le nom adapté (avec sed -i …)
|
||||
- redémarrer
|
||||
- mettre à jour les paquets : apt update && apt upgrade
|
||||
- cloner le dépot :
|
||||
```shell
|
||||
mkdir -p tools/ansible ; cd tools/ansible
|
||||
git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
|
||||
cd gsb2021/pre
|
||||
export DEPL=192.168.99.99
|
||||
bash gsbboot
|
||||
bash pull-config
|
||||
```
|
||||
|
||||
@ -7,13 +7,13 @@ command:
|
||||
- 192.168.99.0/24
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
ping -c 2 172.16.128.254:
|
||||
ping -c 2 172.16.0.1:
|
||||
exit-status: 0
|
||||
stdout:
|
||||
- 0% packet loss
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
ping -c 2 192.168.1.2:
|
||||
ping -c 2 172.16.128.254:
|
||||
exit-status: 0
|
||||
stdout:
|
||||
- 0% packet loss
|
||||
@ -25,15 +25,15 @@ command:
|
||||
- 0% packet loss
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
ping -c 2 192.168.1.2:
|
||||
exit-status: 0
|
||||
stdout:
|
||||
- 0% packet loss
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
ping -c 2 192.168.200.254:
|
||||
exit-status: 0
|
||||
stdout:
|
||||
- 0% packet loss
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
ping -c 2 172.16.0.1:
|
||||
exit-status: 0
|
||||
stdout:
|
||||
- 0% packet loss
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
|
||||
54
pre/gsbboot
54
pre/gsbboot
@ -1,54 +0,0 @@
|
||||
#!/bin/bash
|
||||
version="1.8"
|
||||
__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
__file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
|
||||
__base="$(basename ${__file})"
|
||||
__root="$(cd "$(dirname "${__dir}")" && pwd)"
|
||||
echo "dir : ${__dir}"
|
||||
echo "file : ${__file}"
|
||||
echo "base : ${__base}"
|
||||
echo "root : ${__root}"
|
||||
|
||||
# version 1.8
|
||||
# install git si besoin
|
||||
# install ansible si besoin + backports si wheezy
|
||||
|
||||
readonly base=/root/tools/ansible
|
||||
readonly slist=/etc/apt/sources.list
|
||||
readonly host=depl
|
||||
if [[ -z ${DEPL+x} ]]; then
|
||||
echo "erreur : DEPL indefini"
|
||||
echo " DEPL : adresse serveur deploiement"
|
||||
echo "export DEPL=xyzt ; ./$0"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
hostf="${host}.local"
|
||||
prj=gsb
|
||||
APT=apt
|
||||
|
||||
which git >> /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
${APT} update
|
||||
echo "installation de git ..."
|
||||
${APT} install -y git-core
|
||||
fi
|
||||
${APT} update
|
||||
${APT} upgrade -y
|
||||
|
||||
which ansible >> /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
echo "installation de ansible ..."
|
||||
${APT} install -y ansible
|
||||
fi
|
||||
|
||||
[ -e "${base}" ] || mkdir -p "${base}"
|
||||
|
||||
grep "${hostf}" /etc/hosts > /dev/null || echo "${DEPL} ${hostf} ${host}" >> /etc/hosts
|
||||
cd "${base}"
|
||||
|
||||
cp ${prj}/pull-config ${base}
|
||||
|
||||
#echo "N'oubliez pasz d'indiquer l'adresse DEPL dans '/root/tools/ansible/pull-config'"
|
||||
echo "Vous pouvez lancer 'bash pull-config' depuis ${base} ..."
|
||||
|
||||
@ -1,39 +1,46 @@
|
||||
#!/bin/bash
|
||||
## ps : 2021-04-01 15:25
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
GITUSR=gitgsb
|
||||
GITPRJ=gsb2021
|
||||
GITPRJ=gsb
|
||||
apt update && apt upgrade
|
||||
apt install -y apache2 git
|
||||
STOREREP="/var/www/html/gsbstore"
|
||||
[[ -d "${STOREREP}" ]]|| mkdir "${STOREREP}"
|
||||
getent passwd "${GITUSR}" >> /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
echo "creation utilisateur "${GITUSR}" ..."
|
||||
/sbin/useradd -m -d /home/"${GITUSR}" -s /bin/bash "${GITUSR}"
|
||||
echo "${GITUSR}:${GITUSR}" | /sbin/chpasswd
|
||||
else
|
||||
echo "utilisateur "${GITUSR}" existant..."
|
||||
fi
|
||||
su -c "git init --share --bare /home/${GITUSR}/${GITPRJ}.git" "${GITUSR}"
|
||||
su -c "cd ${GITPRJ}.git/.git/hooks && mv post-update.sample post-update" "${GITUSR}"
|
||||
[[ -h /var/www/html/"${GITPRJ}".git ]]|| ln -s /home/"${GITUSR}"/"${GITPRJ}".git /var/www/html/"${GITPRJ}".git
|
||||
[[ -d /var/www/html/gsbstore ]]|| mkdir /var/www/html/gsbstore
|
||||
|
||||
(cat <<EOT > /var/www/html/gsbstore/getall
|
||||
|
||||
(cat <<EOT > "${STOREREP}/getall"
|
||||
#!/bin/bash
|
||||
|
||||
LPIREL=9.5.3
|
||||
wget -nc https://github.com/glpi-project/glpi/releases/download/${GLPIREL}/glpi-${GLPIREL}.tgz
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
FIREL=9.5+1.0
|
||||
#wget -nc https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi${FIREL}/fusioninventory-${FIREL}.tar.gz
|
||||
#https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi9.5.0%2B1.0/fusioninventory-9.5.0+1.0.tar.bz2
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi9.5.0%2B1.0/fusioninventory-9.5.0+1.0.tar.bz2
|
||||
GLPIREL=9.4.5
|
||||
wget -nc https://github.com/glpi-project/glpi/releases/download/\${GLPIREL}/glpi-\${GLPIREL}.tgz
|
||||
|
||||
FIAGREL=2.6
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x64_${FIAGREL}.exe
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x86_${FIAGREL}.exe
|
||||
FIREL=9.4+2.4
|
||||
wget -nc -O fusioninventory-glpi\${FIREL}.tag.gz https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi\${FIREL}.tar.gz
|
||||
#https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi9.4+2.4.tar.g
|
||||
|
||||
FOGREL=1.5.9
|
||||
wget -nc https://github.com/FOGProject/fogproject/archive/${FOGREL}.tar.gz -O fogproject-${FOGREL}.tar.gz
|
||||
FIAGREL=2.5.2
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\${FIAGREL}/fusioninventory-agent_windows-x64_\${FIAGREL}.exe
|
||||
|
||||
WPREL=5.6
|
||||
wget -nc https://fr.wordpress.org/wordpress-5.6-fr_FR.tar.gz
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\$FIAGREL/fusioninventory-agent_windows-x86_\${FIAGREL}.exe
|
||||
|
||||
GOSSVER=v0.3.16
|
||||
curl -L https://github.com/aelsabbahy/goss/releases/download/${GOSSVER}/goss-linux-amd64 -o goss
|
||||
chmod +x goss
|
||||
FOGREL=1.5.7
|
||||
wget -nc https://github.com/FOGProject/fogproject/archive/\${FOGREL}.tar.gz -O fogproject-\${FOGREL}.tar.gz
|
||||
|
||||
wget -nc https://fr.wordpress.org/wordpress-5.3.2-fr_FR.tar.gz
|
||||
|
||||
EOT
|
||||
)
|
||||
|
||||
@ -1,48 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
GITUSR=gitgsb
|
||||
GITPRJ=gsb
|
||||
apt update && apt upgrade
|
||||
apt install -y apache2 git
|
||||
getent passwd "${GITUSR}" >> /dev/null
|
||||
if [[ $? != 0 ]]; then
|
||||
echo "creation utilisateur "${GITUSR}" ..."
|
||||
/sbin/useradd -m -d /home/"${GITUSR}" -s /bin/bash "${GITUSR}"
|
||||
echo "${GITUSR}:${GITUSR}" | /sbin/chpasswd
|
||||
else
|
||||
echo "utilisateur "${GITUSR}" existant..."
|
||||
fi
|
||||
su -c "git init --share --bare /home/${GITUSR}/${GITPRJ}.git" "${GITUSR}"
|
||||
su -c "cd ${GITPRJ}.git/.git/hooks && mv post-update.sample post-update" "${GITUSR}"
|
||||
[[ -h /var/www/html/"${GITPRJ}".git ]]|| ln -s /home/"${GITUSR}"/"${GITPRJ}".git /var/www/html/"${GITPRJ}".git
|
||||
[[ -d /var/www/html/gsbstore ]]|| mkdir /var/www/html/gsbstore
|
||||
|
||||
(cat <<EOT > /var/www/html/gsbstore/getall
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
GLPIREL=9.4.5
|
||||
wget -nc https://github.com/glpi-project/glpi/releases/download/\${GLPIREL}/glpi-\${GLPIREL}.tgz
|
||||
|
||||
FIREL=9.4+2.4
|
||||
wget -nc -O fusioninventory-glpi\${FIREL}.tag.gz https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi\${FIREL}.tar.gz
|
||||
#https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi9.4+2.4.tar.g
|
||||
|
||||
FIAGREL=2.5.2
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\${FIAGREL}/fusioninventory-agent_windows-x64_\${FIAGREL}.exe
|
||||
|
||||
wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\$FIAGREL/fusioninventory-agent_windows-x86_\${FIAGREL}.exe
|
||||
|
||||
FOGREL=1.5.7
|
||||
wget -nc https://github.com/FOGProject/fogproject/archive/\${FOGREL}.tar.gz -O fogproject-\${FOGREL}.tar.gz
|
||||
|
||||
wget -nc https://fr.wordpress.org/wordpress-5.3.2-fr_FR.tar.gz
|
||||
|
||||
EOT
|
||||
)
|
||||
cat /var/www/html/gsbstore/getall
|
||||
|
||||
@ -2,15 +2,31 @@
|
||||
|
||||
if [ -z ${UREP+x} ]; then
|
||||
UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
|
||||
else
|
||||
echo "var is set to '$var'"
|
||||
fi
|
||||
REPO=$(basename ${UREP})
|
||||
|
||||
dir=/root/tools/ansible
|
||||
host=depl
|
||||
hostf=$host.sio.lan
|
||||
repo=gsb
|
||||
|
||||
[ -e "${dir}" ] || mkdir -p "${dir}"
|
||||
[ -e $dir ] || mkdir -p $dir
|
||||
|
||||
cd "${dir}" || exit 1
|
||||
#grep $hostf /etc/hosts > /dev/null || echo "10.121.38.10 $hostf $host" >> /etc/hosts
|
||||
|
||||
cd $dir
|
||||
|
||||
hostname > hosts
|
||||
ansible-pull -i "${dir}/hosts" -U "${UREP}"
|
||||
|
||||
#git clone http://$host/$repo.git
|
||||
|
||||
#cd $repo
|
||||
#git pull
|
||||
|
||||
#ansible-playbook -c local -i 'localhost,' $(hostname).yml
|
||||
#ansible-pull -i $dir/hosts -d $repo -U "${UREP}"
|
||||
ansible-pull -i $dir/hosts -U "${UREP}"
|
||||
|
||||
exit 0
|
||||
|
||||
11
pull-config
11
pull-config
@ -3,14 +3,19 @@
|
||||
if [ -z ${UREP+x} ]; then
|
||||
UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
|
||||
fi
|
||||
REPO=$(basename ${UREP})
|
||||
|
||||
dir=/root/tools/ansible
|
||||
host=depl
|
||||
hostf=$host.sio.lan
|
||||
|
||||
[ -e "${dir}" ] || mkdir -p "${dir}"
|
||||
[ -e ${dir} ] || mkdir -p ${dir}
|
||||
|
||||
cd "${dir}" || exit 1
|
||||
#grep $hostf /etc/hosts > /dev/null || echo "10.121.38.10 $hostf $host" >> /etc/hosts
|
||||
|
||||
cd ${dir}
|
||||
|
||||
hostname > hosts
|
||||
ansible-pull -i "${dir}/hosts" -U "${UREP}"
|
||||
ansible-pull -i ${dir}/hosts -U "${UREP}"
|
||||
|
||||
exit 0
|
||||
|
||||
@ -12,9 +12,9 @@
|
||||
- base
|
||||
- goss
|
||||
- snmp-agent
|
||||
- firewall-vpn-r
|
||||
# - vpn-stg-r
|
||||
- x509-r
|
||||
- vpn-stg-r
|
||||
# - x509-r
|
||||
# - firewall-vpn-r
|
||||
- ssh-cli
|
||||
- syslog-cli
|
||||
- post
|
||||
|
||||
@ -13,11 +13,10 @@
|
||||
- goss
|
||||
- dhcp-ag
|
||||
- dns-agence
|
||||
- ssh-root-access
|
||||
- snmp-agent
|
||||
- firewall-vpn-l
|
||||
# - vpn-stg-l
|
||||
- x509-l
|
||||
- vpn-stg-l
|
||||
# - x509-l
|
||||
# - firewall-vpn-l
|
||||
- ssh-cli
|
||||
- syslog-cli
|
||||
- post
|
||||
|
||||
@ -7,14 +7,6 @@
|
||||
copy: src=apt.conf dest=/etc/apt/apt.conf
|
||||
when: ansible_hostname != "s-adm"
|
||||
|
||||
#- name: Sysctl desactive ipv6
|
||||
# sysctl:
|
||||
# name: net.ipv6.conf.all.disable_ipv6
|
||||
# value: 1
|
||||
# sysctl_set: yes
|
||||
# state: present
|
||||
# reload: yes
|
||||
|
||||
- name: Update + Upgrade
|
||||
apt:
|
||||
upgrade: yes
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
127.0.1.1 {{ ansible_nodename }} {{ ansible_hostname }}
|
||||
127.0.0.1 localhost ip6-localhost ip6-loopback
|
||||
|
||||
#10.121.38.10 depl.sio.lan depl
|
||||
10.121.38.10 depl.sio.lan depl
|
||||
|
||||
192.168.99.99 s-adm.gsb.adm depl.sio.lan depl
|
||||
192.168.99.99 s-adm.gsb.adm
|
||||
192.168.99.1 s-infra.gsb.adm
|
||||
192.168.99.2 s-proxy.gsb.adm
|
||||
192.168.99.3 s-appli.gsb.adm
|
||||
|
||||
@ -3,9 +3,9 @@
|
||||
127.0.0.1 localhost ip6-localhost ip6-loopback
|
||||
172.16.0.2 s-proxy.gsb.lan s-proxy
|
||||
|
||||
#10.121.38.10 depl
|
||||
10.121.38.10 depl
|
||||
|
||||
192.168.99.99 s-adm.gsb.adm depl
|
||||
192.168.99.99 s-adm.gsb.adm
|
||||
192.168.99.1 s-infra.gsb.adm
|
||||
192.168.99.2 s-proxy.gsb.adm
|
||||
192.168.99.3 s-appli.gsb.adm
|
||||
|
||||
@ -21,8 +21,6 @@ s-proxy IN A 172.16.0.2
|
||||
s-appli IN A 172.16.0.3
|
||||
s-win IN A 172.16.0.6
|
||||
s-mess IN A 172.16.0.7
|
||||
s-nxc IN A 172.16.0.7
|
||||
s-docker IN A 172.16.0.7
|
||||
s-mon IN A 172.16.0.8
|
||||
s-itil IN A 172.16.0.9
|
||||
r-int IN A 172.16.0.254
|
||||
|
||||
@ -1,48 +0,0 @@
|
||||
<?php
|
||||
$CONFIG = array (
|
||||
'htaccess.RewriteBase' => '/',
|
||||
'memcache.local' => '\\OC\\Memcache\\APCu',
|
||||
'apps_paths' =>
|
||||
array (
|
||||
0 =>
|
||||
array (
|
||||
'path' => '/var/www/html/apps',
|
||||
'url' => '/apps',
|
||||
'writable' => false,
|
||||
),
|
||||
1 =>
|
||||
array (
|
||||
'path' => '/var/www/html/custom_apps',
|
||||
'url' => '/custom_apps',
|
||||
'writable' => true,
|
||||
),
|
||||
),
|
||||
'instanceid' => 'ocvc4q2htemf',
|
||||
'passwordsalt' => 'stdJZMx4C5hz85Kqt8XdZIzx8kVOHI',
|
||||
'secret' => 'II1BBgzlx70WUYCapAt/m/Bt1ZEk/n11n0DVq3zynyU8F/bU',
|
||||
'trusted_domains' =>
|
||||
array (
|
||||
0 => '172.16.0.7:5678',
|
||||
1 => '172.16.0.7:8080',
|
||||
2 => 's-mess',
|
||||
3 => 's-mess.gsb.lan',
|
||||
4 => 'localhost:8080',
|
||||
5 => 's-nxec.gsb.lan',
|
||||
),
|
||||
'trusted_proxies' => ['172.16.0.7'],
|
||||
'overwriteprotocol' => 'http',
|
||||
'overwritehost' => '172.16.0.7:8080',
|
||||
'proxy' => '172.16.0.7:8080',
|
||||
'datadirectory' => '/var/www/html/data',
|
||||
'dbtype' => 'mysql',
|
||||
'version' => '20.0.6.1',
|
||||
'overwrite.cli.url' => 'http://172.16.0.7:5678',
|
||||
'dbname' => 'nextcloud',
|
||||
'dbhost' => 'db',
|
||||
'dbport' => '',
|
||||
'dbtableprefix' => 'oc_',
|
||||
'mysql.utf8mb4' => true,
|
||||
'dbuser' => 'nextcloud',
|
||||
'dbpassword' => 'root',
|
||||
'installed' => true,
|
||||
);
|
||||
@ -1,13 +0,0 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA9YcWlg90PgLB2PS31Tv8mxn6cyRZd4GvX6tkqwOfXhdBZYzgoEnJ
|
||||
17U+hDqpT5utQpUbfR0//uXr53mpu3ufxCNJ9gSsCIAbmhTIT3qwLwUis3Etb8PA
|
||||
4LCTbVHvua5W7/pdM0s8PIOAWK7ah09p+mzwZqx5tKZWtbdERQKIAGE6Xmd4845/
|
||||
9oBWTj2g5t83Gt/fZDy+NVRy5ePb/KGix4bEmfnZ5htC/16VFPVrSZUALoxn8HtC
|
||||
3nn4eqBrZeAxY6UHuW0ZPkRmpLs3GCILa+gze+wDlKlhC+RQU/f8Fijo6SsQPzNf
|
||||
6BzJdoyeeE9OyyhhWu4Mihr39RnShk1ABO2eZrA1TE7L5X3YuCeIO09j99hkEsPr
|
||||
mX1zh+v4sx2FFMZLebu+5KYf+ROOOYtMy6AJQq55avccTPrs0S+pxswypbzMD4ym
|
||||
BYtPO46XYkRhrX47TfVHLW9oonDmMxPKNidNMrFtKW0b6f09iOcN9iEA/EM0s+3n
|
||||
uQ2h+bQrwGqo5aMSUuJ3w8EjFySIqKgU5ZxJzPGSndsqS7zd2hUxNx7EZueHXX5N
|
||||
CJ7kWRhIFv8YHHx0J/VFJieyr7DAUATu7chu4aGhwf2AoGYzmI0tjSh+3rQiDh7O
|
||||
h+JtKr+wifr9P2vBqIWFQltOC2srRs+EB+5/qN1iIjYmq52MkUbFLfMCAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
@ -16,7 +16,6 @@ services:
|
||||
- MYSQL_PASSWORD=root
|
||||
- MYSQL_DATABASE=nextcloud
|
||||
- MYSQL_USER=nextcloud
|
||||
- TZ=Europe/Paris
|
||||
|
||||
app:
|
||||
image: nextcloud
|
||||
@ -32,4 +31,3 @@ services:
|
||||
- MYSQL_DATABASE=nextcloud
|
||||
- MYSQL_USER=nextcloud
|
||||
- MYSQL_HOST=db
|
||||
- TZ=Europe/Paris
|
||||
|
||||
@ -1,24 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEAzCCAuugAwIBAgIUAr99SgfwQjW0wJSay5rL7I8V6G4wDQYJKoZIhvcNAQEL
|
||||
BQAwgZAxCzAJBgNVBAYTAkZSMRIwEAYDVQQIDAlCb3VyZ29nbmUxDjAMBgNVBAcM
|
||||
BURpam9uMQwwCgYDVQQKDANHU0IxDjAMBgNVBAsMBWluZnJhMRcwFQYDVQQDDA5z
|
||||
LW54ZWMuZ3NiLmxhbjEmMCQGCSqGSIb3DQEJARYXYXhlbC5tcmwuc2NvbEBnbWFp
|
||||
bC5jb20wHhcNMjEwMzI5MDkzMTIxWhcNMjIwMzI5MDkzMTIxWjCBkDELMAkGA1UE
|
||||
BhMCRlIxEjAQBgNVBAgMCUJvdXJnb2duZTEOMAwGA1UEBwwFRGlqb24xDDAKBgNV
|
||||
BAoMA0dTQjEOMAwGA1UECwwFaW5mcmExFzAVBgNVBAMMDnMtbnhlYy5nc2IubGFu
|
||||
MSYwJAYJKoZIhvcNAQkBFhdheGVsLm1ybC5zY29sQGdtYWlsLmNvbTCCASIwDQYJ
|
||||
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+iB7H1clY8gwX6CQfBqU+V4gF4ZMmg
|
||||
HMbnoPvWV0WOJlgyODh5xdE11iJBBby8VNdiruGNJCeLeI4WWUUkJJXMyeWNTM6/
|
||||
JIZhVZI0UF042S/s8WdP+jls4aASkp0QH+XDs+758y5D9lRoX+At+bRZSC/Fz/tL
|
||||
Y16e15F1+BxZeSWUEajHZIJZ79gm0UQxA9HdHAHpoWR05P74Fy6rnOsQNtBW4Jkt
|
||||
xDb9CHRWNVjvbBuPsDwPTEOvMq94r5yWspHDhA3edvtAAJke5N9od4mN8KTJQouJ
|
||||
O0ZzvOYIofr8iQM3981p9MuBUwtDNT7+ns22lDXeORoliOCG1gE25DsCAwEAAaNT
|
||||
MFEwHQYDVR0OBBYEFJgtmIFxdyFe3vZ/a3UwxORCZiLiMB8GA1UdIwQYMBaAFJgt
|
||||
mIFxdyFe3vZ/a3UwxORCZiLiMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
|
||||
BQADggEBAJm7oJOJev7hh/G1xCPPyASWn9s9C9sb5zbxyq1gF5P6Br8Xof9OJ1ZE
|
||||
XJaH1MwxxR+2Qhok6gERBSqpwe6jnreImOpqhHEQGdMWJvIRlvTPQmEj/mCoLGKf
|
||||
DsIvl3ug4OfNqMojwYlGhsfQH92Qz2pnE88pLIT13y85c8TJHti2+GOxOTSxYLrs
|
||||
lt3fYYjnSZ2mm9fLBcP/XgdCSTeN6XwpJr2b56sVh0uehFXnkgzjDd+PTGkIgnfT
|
||||
/eXtX8+VbQIOSEOrIt0GneBZ3n37FSgz/y9TR5HgNKyt74oxbLsYR0qWpbCcEjw+
|
||||
ex/v7vE3bXgPGE56NzhlM1Pjh90R9hI=
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,28 +0,0 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCvogex9XJWPIMF
|
||||
+gkHwalPleIBeGTJoBzG56D71ldFjiZYMjg4ecXRNdYiQQW8vFTXYq7hjSQni3iO
|
||||
FllFJCSVzMnljUzOvySGYVWSNFBdONkv7PFnT/o5bOGgEpKdEB/lw7Pu+fMuQ/ZU
|
||||
aF/gLfm0WUgvxc/7S2NenteRdfgcWXkllBGox2SCWe/YJtFEMQPR3RwB6aFkdOT+
|
||||
+Bcuq5zrEDbQVuCZLcQ2/Qh0VjVY72wbj7A8D0xDrzKveK+clrKRw4QN3nb7QACZ
|
||||
HuTfaHeJjfCkyUKLiTtGc7zmCKH6/IkDN/fNafTLgVMLQzU+/p7NtpQ13jkaJYjg
|
||||
htYBNuQ7AgMBAAECggEAfyHLbi7cL74nnZjrFnlBpIE7EpNiaWyDyBr8ta7mh0up
|
||||
R+g6N+81mQXeVfc5PvAYfbxKGKyBAjr77eYRgnHyJZkSgB5y/ajwuHEWbvl9Pq2a
|
||||
0Q0zhPQojY7aF3O6OwTkAf5Sbebx94hsc5cF55GAEeMa1LHcpethJ6nVIs8A5QtP
|
||||
ZgGlfFkgGXp1GQPmeX1jQePSp8nqCftIwFPOuLcuQnisc282NCRHl3M+VlnUIZNL
|
||||
fgRxalurrnaKf5P9DRvxiGlUJzoH1h0tgYbfUMpoRXdYYK3wjVbWWPROrS1c1yrl
|
||||
17W004k8Fb++rUmQucQEtsiID/ymAMZPtiCG2IqvwQKBgQDjQGf8GFt04ypvoux/
|
||||
acOMtHXaA1k1Fa6Gtvr3dCfhlm4dCxvHfAqWawW2GXrSajhVRe+vcqBMyKAY5G3a
|
||||
O3nZNpFliMqbftzKkF6AThIgaDaGAzfr+I88urvX0od1+wzjzievOHOlbil3OriD
|
||||
HrGmfO/xnnXkgHCQK2YjmhFeoQKBgQDF2fEp5HZAZFWy55LVlS6DIDFfK2DShCNf
|
||||
ENcDp1YWz/PCbHTY0xXZ6T4TOX14YYmeZVZFCUcpWGQrfL+ogJhoM9iQFuzYrzMz
|
||||
iYjgICeTJPLGQawC6CKVFcE7i6kjNie66IjEIZj1rS2zG/+WVTl95M8JxJO2U7a/
|
||||
7JiYJiehWwKBgQCqxb6euisYJpHAPL3ebbtO5Fnf0D5cXwO9JopoJHjH1ITA/JUO
|
||||
jo9iQ+CR3Inoz3uv0RNyVABUUzvEGPzYT3OcoJ4Yn/gpa+c9rcnmP0Tt54J5qLeA
|
||||
c1QofeclI4c6SMOB+WznBtQZEDTG7XC0z/8OLrsdZkgPw9lS7doejOvaoQKBgGbV
|
||||
azp561h2jfBp2nC2lDFFN0Qe2LkyQuwzZX4ZqG488ZZZJrZXqGDVkRUO6X77Ozsf
|
||||
sqI5O0prDc1ojnk3NX/birEBqWLKVRNxZboQHGGnb6PKGGx+WRMh9ohLg8KwcB/+
|
||||
oq9GQylWNI2GfOaXL0WW+mE6UggPJMpGX92c3zZHAoGAMOFoxUjjzsB0oJLTuYax
|
||||
VKE7Jno24o5JeDRm69WS3E6boSZsIY/9r4jWtYiTbhwlTZpZMqad3h/zM/swHvVq
|
||||
hh1BaHXBik/9rpnyTMZ9vo6UNyYo/TJPH3yrKwZbF4Cn2uWQoJCfDeo9VXdIEbEn
|
||||
SwyeWd4Zkt/wvqmocF5KVqI=
|
||||
-----END PRIVATE KEY-----
|
||||
@ -22,36 +22,15 @@ server {
|
||||
listen 8080 default_server;
|
||||
listen [::]:8080 default_server;
|
||||
|
||||
server_name s-nxec.gsb.lan;
|
||||
|
||||
return 302 https://$server_name$request_uri;
|
||||
}
|
||||
# location / {
|
||||
# proxy_set_header Host $host;
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
# proxy_pass http://localhost:5678;
|
||||
# proxy_connect_timeout 900;
|
||||
# proxy_send_timeout 900;
|
||||
# proxy_read_timeout 900;
|
||||
|
||||
server {
|
||||
listen 443 ssl default_server;
|
||||
listen [::]:443 ssl default_server;
|
||||
server_name s-nxec.gsb.lan;
|
||||
|
||||
include snippets/self-signed.conf;
|
||||
include snippets/ssl-params.conf;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_pass http://localhost:5678;
|
||||
proxy_connect_timeout 900;
|
||||
proxy_send_timeout 900;
|
||||
proxy_read_timeout 900;
|
||||
proxy_pass http://localhost:5678;
|
||||
proxy_connect_timeout 900;
|
||||
proxy_send_timeout 900;
|
||||
proxy_read_timeout 900;
|
||||
}
|
||||
|
||||
}
|
||||
# SSL configuration
|
||||
#
|
||||
# listen 443 ssl default_server;
|
||||
@ -98,7 +77,7 @@ server {
|
||||
#location ~ /\.ht {
|
||||
# deny all;
|
||||
#}
|
||||
|
||||
}
|
||||
|
||||
|
||||
# Virtual Host configuration for example.com
|
||||
|
||||
@ -1,100 +0,0 @@
|
||||
##
|
||||
# You should look at the following URL's in order to grasp a solid understanding
|
||||
# of Nginx configuration files in order to fully unleash the power of Nginx.
|
||||
# https://www.nginx.com/resources/wiki/start/
|
||||
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
||||
# https://wiki.debian.org/Nginx/DirectoryStructure
|
||||
#
|
||||
# In most cases, administrators will remove this file from sites-enabled/ and
|
||||
# leave it as reference inside of sites-available where it will continue to be
|
||||
# updated by the nginx packaging team.
|
||||
#
|
||||
# This file will automatically load configuration files provided by other
|
||||
# applications, such as Drupal or Wordpress. These applications will be made
|
||||
# available underneath a path with that package name, such as /drupal8.
|
||||
#
|
||||
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
||||
##
|
||||
|
||||
# Default server configuration
|
||||
#
|
||||
server {
|
||||
listen 8080 default_server;
|
||||
listen [::]:8080 default_server;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_pass http://localhost:5678;
|
||||
proxy_connect_timeout 900;
|
||||
proxy_send_timeout 900;
|
||||
proxy_read_timeout 900;
|
||||
}
|
||||
|
||||
# SSL configuration
|
||||
#
|
||||
# listen 443 ssl default_server;
|
||||
# listen [::]:443 ssl default_server;
|
||||
#
|
||||
# Note: You should disable gzip for SSL traffic.
|
||||
# See: https://bugs.debian.org/773332
|
||||
#
|
||||
# Read up on ssl_ciphers to ensure a secure configuration.
|
||||
# See: https://bugs.debian.org/765782
|
||||
#
|
||||
# Self signed certs generated by the ssl-cert package
|
||||
# Don't use them in a production server!
|
||||
#
|
||||
# include snippets/snakeoil.conf;
|
||||
|
||||
# root /var/www/html;
|
||||
|
||||
# Add index.php to the list if you are using PHP
|
||||
# index index.html index.htm index.nginx-debian.html;
|
||||
|
||||
# server_name _;
|
||||
|
||||
# location / {
|
||||
# First attempt to serve request as file, then
|
||||
# as directory, then fall back to displaying a 404.
|
||||
# try_files $uri $uri/ =404;
|
||||
# }
|
||||
|
||||
# pass PHP scripts to FastCGI server
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# include snippets/fastcgi-php.conf;
|
||||
#
|
||||
# # With php-fpm (or other unix sockets):
|
||||
# fastcgi_pass unix:/run/php/php7.3-fpm.sock;
|
||||
# # With php-cgi (or other tcp sockets):
|
||||
# fastcgi_pass 127.0.0.1:9000;
|
||||
#}
|
||||
|
||||
# deny access to .htaccess files, if Apache's document root
|
||||
# concurs with nginx's one
|
||||
#
|
||||
#location ~ /\.ht {
|
||||
# deny all;
|
||||
#}
|
||||
}
|
||||
|
||||
|
||||
# Virtual Host configuration for example.com
|
||||
#
|
||||
# You can move that to a different file under sites-available/ and symlink that
|
||||
# to sites-enabled/ to enable it.
|
||||
#
|
||||
#server {
|
||||
# listen 80;
|
||||
# listen [::]:80;
|
||||
#
|
||||
# server_name example.com;
|
||||
#
|
||||
# root /var/www/example.com;
|
||||
# index index.html;
|
||||
#
|
||||
# location / {
|
||||
# try_files $uri $uri/ =404;
|
||||
# }
|
||||
#}
|
||||
@ -1,2 +0,0 @@
|
||||
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
|
||||
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
|
||||
@ -1,18 +0,0 @@
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
||||
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
|
||||
ssl_session_timeout 10m;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_tickets off; # Requires nginx >= 1.5.9
|
||||
ssl_stapling on; # Requires nginx >= 1.3.7
|
||||
ssl_stapling_verify on; # Requires nginx => 1.3.7
|
||||
resolver 172.16.0.1 valid=300s;
|
||||
resolver_timeout 5s;
|
||||
# Disable strict transport security for now. You can uncomment the following
|
||||
# line if you understand the implications.
|
||||
# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options DENY;
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
@ -29,61 +29,3 @@
|
||||
shell: docker-compose up -d
|
||||
args:
|
||||
chdir: /root/nextcloud
|
||||
|
||||
- name: Installation de Nginx
|
||||
package:
|
||||
name: nginx
|
||||
state: present
|
||||
|
||||
- name: Copie de config.php dans /root/nextcloud/nextcloud/config
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php
|
||||
dest: /root/nextcloud/nextcloud/config
|
||||
|
||||
- name: Copie de nginx-selfsigned.key
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/nginx-selfsigned.key
|
||||
dest: /etc/ssl/private
|
||||
|
||||
- name: Copie nginx-selfsigned.crt
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/nginx-selfsigned.crt
|
||||
dest: /etc/ssl/certs
|
||||
|
||||
- name: Copie de dhparam.pem
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/dhparam.pem
|
||||
dest: /etc/nginx
|
||||
|
||||
- name: Copie de self-signed.conf
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/self-signed.conf
|
||||
dest: /etc/nginx/snippets
|
||||
|
||||
- name: Copie de ssl-params.conf
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/ssl-params.conf
|
||||
dest: /etc/nginx/snippets
|
||||
|
||||
- name: Copie de /etc/nginx/site-availables/proxy
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
|
||||
dest: /etc/nginx/sites-available
|
||||
|
||||
- name: Suppression de /etc/nginx/sites-enabled/default
|
||||
file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
|
||||
- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/n$
|
||||
file:
|
||||
src: /etc/nginx/sites-available/proxy
|
||||
dest: /etc/nginx/sites-enabled/proxy
|
||||
owner: root
|
||||
group: root
|
||||
state: link
|
||||
|
||||
- name: Redemarage de Nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: restarted
|
||||
|
||||
@ -4,12 +4,12 @@
|
||||
#
|
||||
|
||||
@def $DEV_ADM = enp0s3;
|
||||
@def $DEV_AG = enp0s8;
|
||||
@def $DEV_VPN = enp0s9;
|
||||
@def $DEV_VPN = enp0s8;
|
||||
@def $DEV_EXT = enp0s9;
|
||||
|
||||
@def $NET_ADM=192.168.99.102/24;
|
||||
@def $NET_AG=172.16.128.254/24;
|
||||
@def $NET_VPN=192.168.0.52/24;
|
||||
@def $NET_ADM=192.168.99.0/24;
|
||||
@def $NET_VPN=192.168.0.0/24;
|
||||
@def $NET_EXT=192.168.1.0/30;
|
||||
|
||||
table filter {
|
||||
chain INPUT {
|
||||
@ -23,21 +23,28 @@ table filter {
|
||||
interface lo ACCEPT;
|
||||
|
||||
# allow SSH connections
|
||||
#interface ($DEV_ADM) {
|
||||
proto tcp dport ssh ACCEPT;
|
||||
#}
|
||||
|
||||
# allow DNS connections
|
||||
#interface ($DEV_INT) {
|
||||
proto udp sport domain ACCEPT;
|
||||
proto udp dport domain ACCEPT;
|
||||
#}
|
||||
|
||||
# DHCP
|
||||
proto udp dport (67 68) ACCEPT;
|
||||
|
||||
# allow IPsec
|
||||
interface ($DEV_AG $DEV_VPN) {
|
||||
interface ($DEV_VPN $DEV_EXT) {
|
||||
proto udp sport 500 ACCEPT;
|
||||
proto udp dport 500 ACCEPT;
|
||||
proto esp ACCEPT;
|
||||
}
|
||||
|
||||
# Autoriser nat-t-ike
|
||||
# interface ($DEV_AG) {
|
||||
# interface ($DEV_VPN) {
|
||||
proto udp sport 4500 ACCEPT;
|
||||
proto udp dport 5500 ACCEPT;
|
||||
# }
|
||||
@ -47,16 +54,52 @@ table filter {
|
||||
proto (udp tcp) dport domain ACCEPT;
|
||||
#}
|
||||
|
||||
# autoriser supervision
|
||||
proto udp sport 161 ACCEPT;
|
||||
|
||||
# autoriser NTP
|
||||
proto udp sport 123 ACCEPT;
|
||||
|
||||
# respond to ping
|
||||
proto icmp mod limit limit 30/minut ACCEPT;
|
||||
|
||||
}
|
||||
chain OUTPUT {
|
||||
policy ACCEPT;
|
||||
policy DROP;
|
||||
# interface ($DEV_PUB) {
|
||||
|
||||
# Autoriser SSH
|
||||
proto tcp sport ssh ACCEPT;
|
||||
|
||||
# Autoriser DNS
|
||||
proto udp dport domain ACCEPT;
|
||||
proto udp sport domain ACCEPT;
|
||||
|
||||
# DHCP
|
||||
proto udp sport (67 68) ACCEPT;
|
||||
|
||||
# Autoriser ipsec
|
||||
proto udp dport 500 ACCEPT;
|
||||
proto udp sport 500 ACCEPT;
|
||||
|
||||
# Autoriser nat-t-ike
|
||||
proto udp dport 4500 ACCEPT;
|
||||
proto udp sport 4500 ACCEPT;
|
||||
|
||||
# Autoriser supervision
|
||||
proto udp dport 161 ACCEPT;
|
||||
|
||||
# Autoriser NTP
|
||||
proto udp dport 123 ACCEPT;
|
||||
|
||||
# respond to ping
|
||||
proto icmp ACCEPT;
|
||||
|
||||
# }
|
||||
|
||||
# connection tracking
|
||||
# mod state state INVALID DROP;
|
||||
# mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
#mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
}
|
||||
chain FORWARD {
|
||||
policy ACCEPT;
|
||||
@ -66,3 +109,14 @@ table filter {
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
}
|
||||
}
|
||||
|
||||
# IPv6:
|
||||
#domain ip6 {
|
||||
# table filter {
|
||||
# chain INPUT {
|
||||
# policy ACCEPT;
|
||||
# # ...
|
||||
# }
|
||||
# # ...
|
||||
# }
|
||||
#}
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
- name : installer ferm
|
||||
apt: name=ferm state=present
|
||||
- name : installer ferm
|
||||
apt: name=ferm state=present
|
||||
- name: fichier parefeu pour VPN
|
||||
copy: src=ferm.conf dest=/etc/ferm/ferm.conf
|
||||
notify:
|
||||
- Restart ferm
|
||||
|
||||
- name: fichier parefeu pour VPN
|
||||
copy: src=ferm.conf dest=/etc/ferm/ferm.conf
|
||||
notify:
|
||||
- Restart ferm
|
||||
@ -7,9 +7,9 @@
|
||||
@def $DEV_VPN = enp0s8;
|
||||
@def $DEV_EXT = enp0s9;
|
||||
|
||||
@def $NET_ADM=192.168.99.112/24;
|
||||
@def $NET_VPN=192.168.0.51/24;
|
||||
@def $NET_EXT=192.168.1.2/24;
|
||||
@def $NET_ADM=192.168.99.0/24;
|
||||
@def $NET_VPN=192.168.0.0/24;
|
||||
@def $NET_EXT=192.168.1.0/30;
|
||||
|
||||
table filter {
|
||||
chain INPUT {
|
||||
@ -23,13 +23,15 @@ table filter {
|
||||
interface lo ACCEPT;
|
||||
|
||||
# allow SSH connections
|
||||
#interface ($DEV_ADM) {
|
||||
proto tcp dport ssh ACCEPT;
|
||||
|
||||
#}
|
||||
|
||||
# allow DNS connections
|
||||
#interface ($DEV_INT) {
|
||||
proto udp sport domain ACCEPT;
|
||||
proto udp dport domain ACCEPT;
|
||||
|
||||
#}
|
||||
|
||||
# allow IPsec
|
||||
interface ($DEV_VPN) {
|
||||
@ -49,13 +51,49 @@ table filter {
|
||||
# proto (udp tcp) dport domain ACCEPT;
|
||||
#}
|
||||
|
||||
# autoriser supervision
|
||||
proto udp sport 161 ACCEPT;
|
||||
|
||||
# autoriser NTP
|
||||
proto udp sport 123 ACCEPT;
|
||||
|
||||
# respond to ping
|
||||
proto icmp mod limit limit 30/minut ACCEPT;
|
||||
|
||||
}
|
||||
chain OUTPUT {
|
||||
policy ACCEPT;
|
||||
policy DROP;
|
||||
# interface ($DEV_PUB) {
|
||||
|
||||
# Autoriser SSH
|
||||
proto tcp sport ssh ACCEPT;
|
||||
|
||||
# Autoriser DNS
|
||||
proto udp dport domain ACCEPT;
|
||||
proto udp sport domain ACCEPT;
|
||||
|
||||
# Autoriser ipsec
|
||||
proto udp dport 500 ACCEPT;
|
||||
proto udp sport 500 ACCEPT;
|
||||
|
||||
# Autoriser nat-t-ike
|
||||
proto udp dport 4500 ACCEPT;
|
||||
proto udp sport 4500 ACCEPT;
|
||||
|
||||
# Autoriser supervision
|
||||
proto udp dport 161 ACCEPT;
|
||||
|
||||
# Autoriser NTP
|
||||
proto udp dport 123 ACCEPT;
|
||||
|
||||
# respond to ping
|
||||
proto icmp ACCEPT;
|
||||
|
||||
# }
|
||||
|
||||
# connection tracking
|
||||
#mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
}
|
||||
chain FORWARD {
|
||||
policy ACCEPT;
|
||||
@ -65,3 +103,14 @@ table filter {
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
}
|
||||
}
|
||||
|
||||
# IPv6:
|
||||
#domain ip6 {
|
||||
# table filter {
|
||||
# chain INPUT {
|
||||
# policy ACCEPT;
|
||||
# # ...
|
||||
# }
|
||||
# # ...
|
||||
# }
|
||||
#}
|
||||
|
||||
@ -1,8 +1,15 @@
|
||||
---
|
||||
- name : installer ferm
|
||||
apt: name=ferm state=present
|
||||
|
||||
- name: fichier parefeu pour VPN
|
||||
copy: src=ferm.conf dest=/etc/ferm/ferm.conf
|
||||
notify:
|
||||
- Restart ferm
|
||||
- name: redemarrer interfaces
|
||||
command: ifdown enp0s8
|
||||
- name: redemarrer interfaces
|
||||
command: ifup enp0s8
|
||||
- name: redemarrer interfaces
|
||||
command: ifdown enp0s9
|
||||
- name: redemarrer interfaces
|
||||
command: ifup enp0s9
|
||||
- name: redemarrer interfaces
|
||||
apt: name=ferm state=present
|
||||
- name: fichier parefeu pour VPN
|
||||
copy: src=ferm.conf dest=/etc/ferm/ferm.conf
|
||||
notify:
|
||||
- Restart ferm
|
||||
|
||||
@ -8,7 +8,6 @@
|
||||
get_url:
|
||||
url: "{{ depl_url }}/{{ depl_fog }}"
|
||||
dest: /root/fog
|
||||
remote_src: yes
|
||||
|
||||
- name: decompression du fichier d'installation de fog
|
||||
unarchive:
|
||||
|
||||
@ -60,11 +60,11 @@ define hostgroup{
|
||||
members srv-2012
|
||||
}
|
||||
|
||||
define hostgroup{
|
||||
hostgroup_name dns-win
|
||||
alias dns-win
|
||||
members srv-2012
|
||||
}
|
||||
#define hostgroup{
|
||||
# hostgroup_name switch
|
||||
# alias switch
|
||||
# members netgear
|
||||
#}
|
||||
|
||||
define hostgroup{
|
||||
hostgroup_name uptimegrp
|
||||
|
||||
@ -79,7 +79,7 @@ define service{
|
||||
|
||||
define service{
|
||||
use generic-service
|
||||
hostgroup_name dns-win
|
||||
hostgroup_name windows-servers
|
||||
service_description Service DNS
|
||||
check_command check_nt!SERVICESTATE!-l W32Time,"Client DNS"
|
||||
}
|
||||
|
||||
@ -44,7 +44,7 @@ backend fermeweb
|
||||
#option httpchk HEAD / HTTP/1.0
|
||||
server s-lb-web1 192.168.101.1:80 check
|
||||
server s-lb-web2 192.168.101.2:80 check
|
||||
server s-lb-web3 192.168.101.3:80 check
|
||||
# server s-lb-web3 192.168.101.3:80 check
|
||||
|
||||
listen stats
|
||||
bind *:8080
|
||||
|
||||
@ -1,16 +1,10 @@
|
||||
---
|
||||
- name: Install apache2 php php5-mysql et autres modules php
|
||||
- name: Install apache2 php php5-mysql
|
||||
apt:
|
||||
name:
|
||||
- apache2
|
||||
- php
|
||||
- php-mysql
|
||||
- php-gd
|
||||
- php-zip
|
||||
- php-mbstring
|
||||
- php-curl
|
||||
- php-imagick
|
||||
- php-xml
|
||||
state: present
|
||||
|
||||
- name: copie exports pour partage nfs wordpress
|
||||
|
||||
@ -1,7 +0,0 @@
|
||||
- name: Activation acces ssh root pour r-vp1 (certificat)
|
||||
lineinfile:
|
||||
dest: /etc/ssh/sshd_config
|
||||
regexp: "^PermitRootLogin"
|
||||
line: "PermitRootLogin yes"
|
||||
state: present
|
||||
|
||||
15
s-lb-bd.yml
15
s-lb-bd.yml
@ -11,14 +11,13 @@
|
||||
roles:
|
||||
- base
|
||||
- goss
|
||||
- post
|
||||
#- s-lb-bd-ab
|
||||
- mariadb-ab
|
||||
# - role: db-user
|
||||
# cli_ip: "192.168.102.1"
|
||||
# - role: db-user
|
||||
# cli_ip: "192.168.102.2"
|
||||
# - role: db-user
|
||||
# cli_ip: "192.168.102.3"
|
||||
- role: db-user
|
||||
cli_ip: "192.168.102.1"
|
||||
- role: db-user
|
||||
cli_ip: "192.168.102.2"
|
||||
- role: db-user
|
||||
cli_ip: "192.168.102.3"
|
||||
- snmp-agent
|
||||
# - post
|
||||
- post
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user