README.md

@@ -12,48 +12,4 @@ prérequis : une machine Debian buster
   * r-int
   * r-ext
   * s-proxy
-
-
 ## Les playbooks
-
-
-## Installation
-
-On utilisera l'image de machine virtuelle suivante : 
-  * **debian-buster-gsb-2021b.ova** (2021-03-31)
-    * Bebian Buster 10.9 - 2 cartes - 1 Go - stockage 20 Go
-
-
-### Machine s-adm
-  * créer la machine virtuelle **s-adm** en important l'image ova décrite plus haut
-  * renommer la machine puis redémarrer
-  * taper :
-```shell
-    mkdir -p tools/ansible ; cd tools/ansible
-    git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
-    cd gsb2021/pre
-    bash inst-depl
-    cd /var/www/html/gsbstore
-    bash getall
-    cd /root/tools/ansible/gsb021/pre
-    bash gsbboot
-    cd .. ; bash pull-config/pre
-```
-  - redémarrer
-  
-### Pour chaque machine
-
-  - importer la machine à partir du fichier **.ova**
-  - définir les cartes réseau en accord avec le plan d'adressage et le schéma
-  - donner le nom adapté (avec sed -i …)
-  - redémarrer
-  - mettre à jour les paquets : apt update && apt upgrade
-  - cloner le dépot : 
-```shell
-mkdir -p tools/ansible ; cd tools/ansible
-git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
-cd gsb2021/pre
-export DEPL=192.168.99.99
-bash gsbboot
-bash pull-config
-```

goss/s-agence.yaml

@@ -7,13 +7,13 @@ command:
     - 192.168.99.0/24
     stderr: []
     timeout: 10000
-  ping -c 2 172.16.128.254:
+  ping -c 2 172.16.0.1:
     exit-status: 0
     stdout:
     - 0% packet loss
     stderr: []
     timeout: 10000
-  ping -c 2 192.168.1.2:
+  ping -c 2 172.16.128.254:
     exit-status: 0
     stdout:
     - 0% packet loss
@@ -25,15 +25,15 @@ command:
     - 0% packet loss
     stderr: []
     timeout: 10000
+  ping -c 2 192.168.1.2:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
   ping -c 2 192.168.200.254:
     exit-status: 0
     stdout:
     - 0% packet loss
     stderr: []
     timeout: 10000
-  ping -c 2 172.16.0.1:
-    exit-status: 0
-    stdout:
-    - 0% packet loss
-    stderr: []
-    timeout: 10000

pre/gsbboot

@@ -1,54 +0,0 @@
-#!/bin/bash
-version="1.8"
-__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-__file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
-__base="$(basename ${__file})"
-__root="$(cd "$(dirname "${__dir}")" && pwd)" 
-echo "dir : ${__dir}"
-echo "file : ${__file}"
-echo "base : ${__base}"
-echo "root : ${__root}"
-
-# version 1.8
-# install git si besoin
-# install ansible si besoin + backports si wheezy
-
-readonly base=/root/tools/ansible
-readonly slist=/etc/apt/sources.list
-readonly host=depl
-if [[ -z ${DEPL+x} ]]; then
-  echo "erreur : DEPL indefini"
-  echo " DEPL : adresse serveur deploiement"
-  echo "export DEPL=xyzt ; ./$0"
-  exit 1
-fi
-
-hostf="${host}.local" 
-prj=gsb
-APT=apt
-
-which git >> /dev/null
-if [[ $? != 0 ]]; then
-	${APT} update
-	echo "installation de git ..."
-	${APT} install -y git-core
-fi
-${APT} update
-${APT} upgrade -y
-
-which ansible >> /dev/null
-if [[ $? != 0 ]]; then
-	echo "installation de ansible ..."
-	${APT} install -y ansible 
-fi
-
-[ -e "${base}" ] || mkdir -p "${base}"
-
-grep "${hostf}" /etc/hosts > /dev/null || echo "${DEPL} ${hostf} ${host}" >> /etc/hosts
-cd "${base}"
-
-cp ${prj}/pull-config ${base}
-
-#echo "N'oubliez pasz d'indiquer l'adresse DEPL dans '/root/tools/ansible/pull-config'"
-echo "Vous pouvez lancer 'bash pull-config' depuis ${base} ..."
-

pre/inst-depl

@@ -1,39 +1,46 @@
 #!/bin/bash
-## ps : 2021-04-01 15:25
-
 set -o errexit
 set -o pipefail
 GITUSR=gitgsb
-GITPRJ=gsb2021
+GITPRJ=gsb
 apt update && apt upgrade
 apt install -y apache2 git 
-STOREREP="/var/www/html/gsbstore" 
+getent passwd "${GITUSR}" >> /dev/null
-[[ -d "${STOREREP}" ]]|| mkdir "${STOREREP}"
+if [[ $? != 0 ]]; then
+  echo "creation utilisateur "${GITUSR}" ..."
+  /sbin/useradd -m -d /home/"${GITUSR}" -s /bin/bash "${GITUSR}" 
+  echo "${GITUSR}:${GITUSR}" | /sbin/chpasswd 
+else
+  echo "utilisateur "${GITUSR}" existant..."
+fi
+su -c "git init --share --bare /home/${GITUSR}/${GITPRJ}.git" "${GITUSR}"
+su -c "cd ${GITPRJ}.git/.git/hooks && mv post-update.sample post-update" "${GITUSR}"
+[[ -h /var/www/html/"${GITPRJ}".git ]]|| ln -s /home/"${GITUSR}"/"${GITPRJ}".git /var/www/html/"${GITPRJ}".git
+[[ -d /var/www/html/gsbstore ]]|| mkdir /var/www/html/gsbstore
+ 
+(cat <<EOT > /var/www/html/gsbstore/getall
 
-(cat <<EOT > "${STOREREP}/getall"
 #!/bin/bash
 
-LPIREL=9.5.3
+set -o errexit
-wget -nc https://github.com/glpi-project/glpi/releases/download/${GLPIREL}/glpi-${GLPIREL}.tgz
+set -o pipefail
 
-FIREL=9.5+1.0
+GLPIREL=9.4.5
-#wget -nc https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi${FIREL}/fusioninventory-${FIREL}.tar.gz
+wget -nc https://github.com/glpi-project/glpi/releases/download/\${GLPIREL}/glpi-\${GLPIREL}.tgz
-#https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi9.5.0%2B1.0/fusioninventory-9.5.0+1.0.tar.bz2
-wget -nc https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi9.5.0%2B1.0/fusioninventory-9.5.0+1.0.tar.bz2
  
-FIAGREL=2.6 
+FIREL=9.4+2.4
-wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x64_${FIAGREL}.exe
+wget -nc -O fusioninventory-glpi\${FIREL}.tag.gz https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi\${FIREL}.tar.gz 
-wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x86_${FIAGREL}.exe
+#https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi9.4+2.4.tar.g 
  
-FOGREL=1.5.9
+FIAGREL=2.5.2 
-wget -nc https://github.com/FOGProject/fogproject/archive/${FOGREL}.tar.gz -O fogproject-${FOGREL}.tar.gz
+wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\${FIAGREL}/fusioninventory-agent_windows-x64_\${FIAGREL}.exe
  
-WPREL=5.6
+wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\$FIAGREL/fusioninventory-agent_windows-x86_\${FIAGREL}.exe
-wget -nc https://fr.wordpress.org/wordpress-5.6-fr_FR.tar.gz
  
-GOSSVER=v0.3.16
+FOGREL=1.5.7
-curl -L https://github.com/aelsabbahy/goss/releases/download/${GOSSVER}/goss-linux-amd64 -o goss
+wget -nc https://github.com/FOGProject/fogproject/archive/\${FOGREL}.tar.gz -O fogproject-\${FOGREL}.tar.gz
-chmod +x goss 
+ 
+wget -nc https://fr.wordpress.org/wordpress-5.3.2-fr_FR.tar.gz
 
 EOT
 )

pre/inst-depl.old

@@ -1,48 +0,0 @@
-#!/bin/bash
-set -o errexit
-set -o pipefail
-GITUSR=gitgsb
-GITPRJ=gsb
-apt update && apt upgrade
-apt install -y apache2 git 
-getent passwd "${GITUSR}" >> /dev/null
-if [[ $? != 0 ]]; then
-  echo "creation utilisateur "${GITUSR}" ..."
-  /sbin/useradd -m -d /home/"${GITUSR}" -s /bin/bash "${GITUSR}" 
-  echo "${GITUSR}:${GITUSR}" | /sbin/chpasswd 
-else
-  echo "utilisateur "${GITUSR}" existant..."
-fi
-su -c "git init --share --bare /home/${GITUSR}/${GITPRJ}.git" "${GITUSR}"
-su -c "cd ${GITPRJ}.git/.git/hooks && mv post-update.sample post-update" "${GITUSR}"
-[[ -h /var/www/html/"${GITPRJ}".git ]]|| ln -s /home/"${GITUSR}"/"${GITPRJ}".git /var/www/html/"${GITPRJ}".git
-[[ -d /var/www/html/gsbstore ]]|| mkdir /var/www/html/gsbstore
- 
-(cat <<EOT > /var/www/html/gsbstore/getall
-
-#!/bin/bash
-
-set -o errexit
-set -o pipefail
-
-GLPIREL=9.4.5
-wget -nc https://github.com/glpi-project/glpi/releases/download/\${GLPIREL}/glpi-\${GLPIREL}.tgz
- 
-FIREL=9.4+2.4
-wget -nc -O fusioninventory-glpi\${FIREL}.tag.gz https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi\${FIREL}.tar.gz 
-#https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi9.4+2.4.tar.g 
- 
-FIAGREL=2.5.2 
-wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\${FIAGREL}/fusioninventory-agent_windows-x64_\${FIAGREL}.exe
- 
-wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\$FIAGREL/fusioninventory-agent_windows-x86_\${FIAGREL}.exe
- 
-FOGREL=1.5.7
-wget -nc https://github.com/FOGProject/fogproject/archive/\${FOGREL}.tar.gz -O fogproject-\${FOGREL}.tar.gz
- 
-wget -nc https://fr.wordpress.org/wordpress-5.3.2-fr_FR.tar.gz
-
-EOT
-)
-cat /var/www/html/gsbstore/getall
-

pre/pull-config

@@ -2,15 +2,31 @@
 
 if [ -z ${UREP+x} ]; then 
 	UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git 
+else 
+	echo "var is set to '$var'" 
 fi
+REPO=$(basename ${UREP})
 
 dir=/root/tools/ansible
+host=depl
+hostf=$host.sio.lan
+repo=gsb
 
-[ -e "${dir}" ] || mkdir -p "${dir}"
+[ -e $dir ] || mkdir -p $dir
 
-cd  "${dir}" || exit 1
+#grep $hostf /etc/hosts > /dev/null || echo "10.121.38.10 $hostf $host" >> /etc/hosts
+
+cd  $dir
 
 hostname  > hosts
-ansible-pull -i "${dir}/hosts"  -U "${UREP}"
+
+#git clone http://$host/$repo.git
+
+#cd $repo
+#git pull
+
+#ansible-playbook -c local -i 'localhost,' $(hostname).yml
+#ansible-pull -i $dir/hosts -d $repo -U "${UREP}"
+ansible-pull -i $dir/hosts  -U "${UREP}"
 
 exit 0

pull-config

@@ -3,14 +3,19 @@
 if [ -z ${UREP+x} ]; then 
 	UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git 
 fi
+REPO=$(basename ${UREP})
 
 dir=/root/tools/ansible
+host=depl
+hostf=$host.sio.lan
 
-[ -e "${dir}" ] || mkdir -p "${dir}"
+[ -e ${dir} ] || mkdir -p ${dir}
 
-cd  "${dir}" || exit 1
+#grep $hostf /etc/hosts > /dev/null || echo "10.121.38.10 $hostf $host" >> /etc/hosts
+
+cd  ${dir}
 
 hostname  > hosts
-ansible-pull -i "${dir}/hosts"  -U "${UREP}"
+ansible-pull -i ${dir}/hosts  -U "${UREP}"
 
 exit 0

roles/base/tasks/main.yml

@@ -7,14 +7,6 @@
   copy: src=apt.conf dest=/etc/apt/apt.conf
   when: ansible_hostname != "s-adm"    
 
-#- name: Sysctl desactive ipv6
-#  sysctl:
-#    name: net.ipv6.conf.all.disable_ipv6
-#    value: 1
-#    sysctl_set: yes
-#    state: present
-#    reload: yes
-
 - name: Update + Upgrade
   apt:
     upgrade: yes

roles/base/templates/hosts.j2

@@ -2,9 +2,9 @@
 127.0.1.1       {{ ansible_nodename }} {{ ansible_hostname }}
 127.0.0.1       localhost ip6-localhost ip6-loopback
 
-#10.121.38.10	depl.sio.lan depl
+10.121.38.10	depl.sio.lan depl
 
-192.168.99.99	s-adm.gsb.adm depl.sio.lan depl
+192.168.99.99	s-adm.gsb.adm
 192.168.99.1	s-infra.gsb.adm
 192.168.99.2	s-proxy.gsb.adm
 192.168.99.3	s-appli.gsb.adm

roles/base/templates/hosts.s-proxy.j2

@@ -3,9 +3,9 @@
 127.0.0.1       localhost ip6-localhost ip6-loopback
 172.16.0.2	s-proxy.gsb.lan s-proxy
 
-#10.121.38.10	depl
+10.121.38.10	depl
 
-192.168.99.99	s-adm.gsb.adm depl
+192.168.99.99	s-adm.gsb.adm
 192.168.99.1	s-infra.gsb.adm
 192.168.99.2	s-proxy.gsb.adm
 192.168.99.3	s-appli.gsb.adm

roles/dns-master/files/db.gsb.lan

@@ -21,7 +21,7 @@ s-proxy         IN      A       172.16.0.2
 s-appli    	IN      A       172.16.0.3
 s-win    	IN      A       172.16.0.6
 s-mess   	IN      A       172.16.0.7
-s-nxc		IN	A	172.16.0.7
+s-nxec		IN	A	172.16.0.7
 s-docker	IN	A	172.16.0.7
 s-mon    	IN      A       172.16.0.8
 s-itil		IN	A	172.16.0.9

roles/docker-nextcloud/tasks/main.yml

@@ -35,6 +35,29 @@
     name: nginx
     state: present
 
+- name: Copie de /etc/nginx/site-availables/proxy
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
+    dest: /etc/nginx/sites-available
+
+- name: Suppression de /etc/nginx/sites-enabled/default
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/nginx/sites-enabled/proxy
+  file:
+    src: /etc/nginx/sites-available/proxy
+    dest: /etc/nginx/sites-enabled/proxy
+    owner: root
+    group: root
+    state: link
+
+- name: Redemarage de Nginx
+  service:
+    name: nginx
+    state: restarted
+
 - name: Copie de config.php dans /root/nextcloud/nextcloud/config
   copy:
     src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php
@@ -64,26 +87,3 @@
   copy:
     src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/ssl-params.conf
     dest: /etc/nginx/snippets
-
-- name: Copie de /etc/nginx/site-availables/proxy
-  copy:
-    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
-    dest: /etc/nginx/sites-available
-
-- name: Suppression de /etc/nginx/sites-enabled/default
-  file:
-    path: /etc/nginx/sites-enabled/default
-    state: absent
-
-- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/n$
-  file:
-    src: /etc/nginx/sites-available/proxy
-    dest: /etc/nginx/sites-enabled/proxy
-    owner: root
-    group: root
-    state: link
-
-- name: Redemarage de Nginx
-  service:
-    name: nginx
-    state: restarted

roles/firewall-vpn-l/files/ferm.conf

@@ -4,12 +4,12 @@
 #
 
 @def $DEV_ADM	= enp0s3;
-@def $DEV_AG	= enp0s8;
+@def $DEV_VPN	= enp0s8;
-@def $DEV_VPN	= enp0s9;
+@def $DEV_EXT	= enp0s9;
 
 @def $NET_ADM=192.168.99.102/24;
-@def $NET_AG=172.16.128.254/24;
+@def $NET_VPN=172.16.128.254/24;
-@def $NET_VPN=192.168.0.52/24;
+@def $NET_EXT=192.168.0.52/30;
 
 table filter {
     chain INPUT {
@@ -23,21 +23,28 @@ table filter {
         interface lo ACCEPT;
 
         # allow SSH connections
+        #interface ($DEV_ADM) {
 	proto tcp dport ssh ACCEPT;
+	#}
 
         # allow DNS connections
+        #interface ($DEV_INT) {
 	proto udp sport domain ACCEPT;
 	proto udp dport domain ACCEPT;
+	#}	
+
+        # DHCP
+        proto udp dport (67 68) ACCEPT;
 
         # allow IPsec
-        interface ($DEV_AG $DEV_VPN) {
+        interface ($DEV_VPN $DEV_EXT) {
         proto udp sport 500 ACCEPT;
         proto udp dport 500 ACCEPT;
         proto esp ACCEPT;
 	}
 
         # Autoriser nat-t-ike
- #       interface ($DEV_AG) {
+ #       interface ($DEV_VPN) {
         proto udp sport 4500 ACCEPT;
         proto udp dport 5500 ACCEPT;
 #	}
@@ -47,16 +54,52 @@ table filter {
 	proto (udp tcp) dport domain ACCEPT;
 	#}
 
+	# autoriser supervision
+	proto udp sport 161 ACCEPT;
+
 	# autoriser NTP
 	proto udp sport 123 ACCEPT;
 
+        # respond to ping
+        proto icmp mod limit limit 30/minut ACCEPT; 
+
     }
     chain OUTPUT {
-        policy ACCEPT;
+        policy DROP;
+#        interface ($DEV_PUB) {
+        
+	# Autoriser SSH
+        proto tcp sport ssh ACCEPT;
+
+	# Autoriser DNS
+        proto udp dport domain ACCEPT;
+        proto udp sport domain ACCEPT;
+
+        # DHCP
+        proto udp sport (67 68) ACCEPT;
+	
+	# Autoriser ipsec
+        proto udp dport 500 ACCEPT;
+        proto udp sport 500 ACCEPT;
+	
+	# Autoriser nat-t-ike
+        proto udp dport 4500 ACCEPT;
+        proto udp sport 4500 ACCEPT;
+        
+	# Autoriser supervision
+        proto udp dport 161 ACCEPT;
+	
+	# Autoriser NTP
+        proto udp dport 123 ACCEPT;
+
+        # respond to ping
+        proto icmp ACCEPT; 
+
+#	}
 
         # connection tracking
-        # mod state state INVALID DROP;
+        #mod state state INVALID DROP;
-        # mod state state (ESTABLISHED RELATED) ACCEPT;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
     }
     chain FORWARD {
         policy ACCEPT;
@@ -66,3 +109,14 @@ table filter {
         mod state state (ESTABLISHED RELATED) ACCEPT;
     }
 }
+
+# IPv6:
+#domain ip6 {
+#    table filter {
+#        chain INPUT {
+#            policy ACCEPT;
+#            # ...
+#        }
+#        # ...
+#    }
+#}

roles/firewall-vpn-l/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
-- name : installer ferm
+  - name : installer ferm
-  apt: name=ferm state=present
+    apt: name=ferm state=present
+  - name: fichier parefeu pour VPN
+    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+    notify:
+      - Restart ferm
     
-- name: fichier parefeu pour VPN
-  copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-  notify:
-    - Restart ferm

roles/firewall-vpn-r/files/ferm.conf

@@ -9,7 +9,7 @@
 
 @def $NET_ADM=192.168.99.112/24;
 @def $NET_VPN=192.168.0.51/24;
-@def $NET_EXT=192.168.1.2/24;
+@def $NET_EXT=192.168.1.2/30;
 
 table filter {
     chain INPUT {
@@ -23,13 +23,15 @@ table filter {
         interface lo ACCEPT;
 
         # allow SSH connections
+        #interface ($DEV_ADM) {
 	proto tcp dport ssh ACCEPT;
-	
+	#}
 
         # allow DNS connections
+        #interface ($DEV_INT) {
 	proto udp sport domain ACCEPT;
 	proto udp dport domain ACCEPT;
-		
+	#}	
 
         # allow IPsec
         interface ($DEV_VPN) {
@@ -49,13 +51,49 @@ table filter {
 #	proto (udp tcp) dport domain ACCEPT;
 	#}
 
+	# autoriser supervision
+	proto udp sport 161 ACCEPT;
 
 	# autoriser NTP
 	proto udp sport 123 ACCEPT;
 
+        # respond to ping
+        proto icmp mod limit limit 30/minut ACCEPT; 
+
     }
     chain OUTPUT {
-        policy ACCEPT;
+        policy DROP;
+#        interface ($DEV_PUB) {
+        
+	# Autoriser SSH
+        proto tcp sport ssh ACCEPT;
+
+	# Autoriser DNS
+        proto udp dport domain ACCEPT;
+        proto udp sport domain ACCEPT;
+	
+	# Autoriser ipsec
+        proto udp dport 500 ACCEPT;
+        proto udp sport 500 ACCEPT;
+	
+	# Autoriser nat-t-ike
+        proto udp dport 4500 ACCEPT;
+        proto udp sport 4500 ACCEPT;
+        
+	# Autoriser supervision
+        proto udp dport 161 ACCEPT;
+	
+	# Autoriser NTP
+        proto udp dport 123 ACCEPT;
+
+        # respond to ping
+        proto icmp ACCEPT; 
+
+#	}
+
+        # connection tracking
+        #mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
     }
     chain FORWARD {
         policy ACCEPT;
@@ -65,3 +103,14 @@ table filter {
         mod state state (ESTABLISHED RELATED) ACCEPT;
     }
 }
+
+# IPv6:
+#domain ip6 {
+#    table filter {
+#        chain INPUT {
+#            policy ACCEPT;
+#            # ...
+#        }
+#        # ...
+#    }
+#}

roles/firewall-vpn-r/tasks/main.yml

@@ -1,8 +1,10 @@
 ---
 - name : installer ferm
-  apt: name=ferm state=present
+    apt: name=ferm state=present
 
-- name: fichier parefeu pour VPN
+  - name: fichier parefeu pour VPN
-  copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-  notify:
+  
-    - Restart ferm
+  - name: Restart ferm
+      name: ferm
+      state: restarted

roles/fog/tasks/main.yml

@@ -8,7 +8,6 @@
     get_url:
       url: "{{ depl_url }}/{{ depl_fog }}"
       dest: /root/fog
-      remote_src: yes
 
   - name: decompression du fichier d'installation de fog
     unarchive:

roles/icinga/files/cfg/hostgroups_icinga.cfg

@@ -60,11 +60,11 @@ define hostgroup{
 	members		srv-2012
 }
 
-define hostgroup{
+#define hostgroup{
-	hostgroup_name	dns-win
+#	hostgroup_name	switch
-	alias		dns-win
+#	alias		switch
-	members		srv-2012
+#	members		netgear
-}
+#}
 
 define hostgroup{
 	hostgroup_name	uptimegrp

roles/icinga/files/cfg/services_icinga.cfg

@@ -79,7 +79,7 @@ define service{
 
 define service{
 	use				generic-service
-	hostgroup_name			dns-win
+	hostgroup_name			windows-servers
 	service_description		Service DNS
 	check_command			check_nt!SERVICESTATE!-l W32Time,"Client DNS"
 }

roles/s-lb-ab/files/haproxy.cfg

@@ -44,7 +44,7 @@ backend fermeweb
 	#option httpchk HEAD / HTTP/1.0
 	server s-lb-web1 192.168.101.1:80 check
 	server s-lb-web2 192.168.101.2:80 check
-	server s-lb-web3 192.168.101.3:80 check
+#	server s-lb-web3 192.168.101.3:80 check
 
 listen stats
 	bind	*:8080

roles/s-lb-web-ab/tasks/main.yml

@@ -1,16 +1,10 @@
 ---
-- name: Install apache2 php php5-mysql et autres modules php
+- name: Install apache2 php php5-mysql
   apt:
     name:
     - apache2
     - php
     - php-mysql
-    - php-gd
-    - php-zip
-    - php-mbstring
-    - php-curl
-    - php-imagick
-    - php-xml
     state: present
 
 - name: copie exports pour partage nfs wordpress

roles/ssh-root-access/tasks/main.yml

@@ -1,4 +1,4 @@
-- name: Activation acces ssh root pour r-vp1 (certificat)
+- name: Activation acces ssh root pour vp-1 (certificat)
   lineinfile:
     dest: /etc/ssh/sshd_config
     regexp: "^PermitRootLogin"