ajout de config.php

goss/s-agence.yaml

@@ -0,0 +1,39 @@
+command:
+  ip r:
+    exit-status: 0
+    stdout:
+    - default via 172.16.128.254 dev enp0s8
+    - 172.16.128.0/24
+    - 192.168.99.0/24
+    stderr: []
+    timeout: 10000
+  ping -c 2 172.16.0.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 172.16.128.254:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.1.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.1.2:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.200.254:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000

roles/docker-nextcloud/files/config.php

@@ -0,0 +1,47 @@
+<?php
+$CONFIG = array (
+  'htaccess.RewriteBase' => '/',
+  'memcache.local' => '\\OC\\Memcache\\APCu',
+  'apps_paths' => 
+  array (
+    0 => 
+    array (
+      'path' => '/var/www/html/apps',
+      'url' => '/apps',
+      'writable' => false,
+    ),
+    1 => 
+    array (
+      'path' => '/var/www/html/custom_apps',
+      'url' => '/custom_apps',
+      'writable' => true,
+    ),
+  ),
+  'instanceid' => 'ocvc4q2htemf',
+  'passwordsalt' => 'stdJZMx4C5hz85Kqt8XdZIzx8kVOHI',
+  'secret' => 'II1BBgzlx70WUYCapAt/m/Bt1ZEk/n11n0DVq3zynyU8F/bU',
+  'trusted_domains' => 
+  array (
+    0 => '172.16.0.7:5678',
+    1 => '172.16.0.7:8080',
+    2 => 's-mess',
+    3 => 's-mess.gsb.lan',
+    4 => 'localhost:8080',
+  ),
+  'trusted_proxies' => ['172.16.0.7'],
+  'overwriteprotocol' => 'http',
+  'overwritehost' => '172.16.0.7:8080',
+  'proxy' => '172.16.0.7:8080',
+  'datadirectory' => '/var/www/html/data',
+  'dbtype' => 'mysql',
+  'version' => '20.0.6.1',
+  'overwrite.cli.url' => 'http://172.16.0.7:5678',
+  'dbname' => 'nextcloud',
+  'dbhost' => 'db',
+  'dbport' => '',
+  'dbtableprefix' => 'oc_',
+  'mysql.utf8mb4' => true,
+  'dbuser' => 'nextcloud',
+  'dbpassword' => 'root',
+  'installed' => true,
+);

roles/docker-nextcloud/files/docker-compose.yml

@@ -21,13 +21,13 @@ services:
     image: nextcloud
     restart: always
     ports:
-      - 8080:80
+      - 5678:80
     links:
       - db
     volumes:
-      - nextcloud:/var/www/html
+      - ./nextcloud:/var/www/html
     environment:
-      - MYSQL_PASSWORD=nextcloud
+      - MYSQL_PASSWORD=root
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
       - MYSQL_HOST=db

roles/docker-nextcloud/files/proxy

@@ -0,0 +1,100 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# https://www.nginx.com/resources/wiki/start/
+# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+# https://wiki.debian.org/Nginx/DirectoryStructure
+#
+# In most cases, administrators will remove this file from sites-enabled/ and
+# leave it as reference inside of sites-available where it will continue to be
+# updated by the nginx packaging team.
+#
+# This file will automatically load configuration files provided by other
+# applications, such as Drupal or Wordpress. These applications will be made
+# available underneath a path with that package name, such as /drupal8.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 8080 default_server;
+	listen [::]:8080 default_server;
+
+	location / {
+		proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+		proxy_pass http://localhost:5678;
+		proxy_connect_timeout 900;
+		proxy_send_timeout 900;
+		proxy_read_timeout 900;
+	}
+
+	# SSL configuration
+	#
+	# listen 443 ssl default_server;
+	# listen [::]:443 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+#	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+#	index index.html index.htm index.nginx-debian.html;
+
+#	server_name _;
+
+#	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+#		try_files $uri $uri/ =404;
+#	}
+
+	# pass PHP scripts to FastCGI server
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php-fpm (or other unix sockets):
+	#	fastcgi_pass unix:/run/php/php7.3-fpm.sock;
+	#	# With php-cgi (or other tcp sockets):
+	#	fastcgi_pass 127.0.0.1:9000;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

roles/docker-nextcloud/tasks/main.yml

@@ -22,7 +22,7 @@
 
 - name: Copie de docker-compose.yml
   copy: 
-    src: /root/gsb2021/roles/docker-nextcloud/files/docker-compose.yml
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/docker-compose.yml
     dest: /root/nextcloud
 
 - name: Execution du fichier docker-compose.yml

roles/fog/defaults/main.yml

@@ -0,0 +1,2 @@
+depl_url: "http://s-adm.gsb.adm/gsbstore"
+depl_fog: "fogproject-1.5.9.tar.gz"

roles/fog/tasks/main.yml

@@ -6,10 +6,10 @@
 
   - name: recuperation du fichier d'installation de fog
     get_url:
-      url: http://depl/gsbstore/fogproject-1.5.7.tar.gz
+      url: "{{ depl_url }}/{{ depl_fog }}"
       dest: /root/fog
 
   - name: decompression du fichier d'installation de fog
     unarchive:
-      src: /root/fog/fogproject-1.5.7.tar.gz
+      src: "/root/fog/{{ depl_fog }}"
       dest: /root/fog

roles/icinga/files/cfg/hostgroups_icinga.cfg

@@ -15,13 +15,13 @@ define hostgroup {
 define hostgroup { 
 	hostgroup_name debian-servers 
 	alias		Serveurs distant
-	members        s-infra, s-proxy, r-int, r-ext, s-adm, s-itil
+	members        s-infra, s-proxy, r-int, r-ext, s-adm, s-itil, s-mess
 } 
 
 define hostgroup { 
 	hostgroup_name ssh-servers 
 	alias 		acces SSH 
-	members		s-adm, s-infra, s-proxy, r-int, r-ext, localhost, gwsio2, s-itil	 
+	members		s-adm, s-infra, s-proxy, r-int, r-ext, localhost, gwsio2, s-itil, s-mess, s-lb
 }
 
 define hostgroup { 
@@ -39,7 +39,7 @@ define hostgroup {
 define hostgroup {
         hostgroup_name  http-servers
 		alias           serveurs-web
-		members         localhost, s-itil 
+		members         localhost, s-itil, s-adm
         }
 
 #define hostgroup {
@@ -69,6 +69,7 @@ define hostgroup{
 define hostgroup{
 	hostgroup_name	uptimegrp
 	alias		uptimegrp
-	members		s-infra, s-proxy, r-int, r-ext, s-adm, s-itil
+	members		s-infra, s-proxy, r-int, r-ext, s-adm, s-itil, s-mess, s-lb
 }
 
+

roles/icinga/files/cfg/s-lb.cfg

@@ -0,0 +1,14 @@
+# A simple configuration file for monitoring the local host
+# This can serve as an example for configuring other servers;
+# Custom services specific to this host are added here, but services
+# defined in nagios2-common_services.cfg may also apply.
+# 
+
+define host{
+        use                     generic-host            ; Name of host template$
+        host_name               s-lb
+        alias                   debian-servers
+        address                 192.168.100.10
+        parents                 r-int
+        }
+

roles/icinga/files/cfg/s-mess.cfg

@@ -0,0 +1,14 @@
+# A simple configuration file for monitoring the local host
+# This can serve as an example for configuring other servers;
+# Custom services specific to this host are added here, but services
+# defined in nagios2-common_services.cfg may also apply.
+# 
+
+define host{
+        use                     generic-host            ; Name of host template$
+        host_name               s-mess
+        alias                   nextcloud
+        address                 172.16.0.7
+        parents                 r-int
+        }
+

roles/mariadb-ab/tasks/main.yml

@@ -2,15 +2,42 @@
 - name: Installation des paquets python-mysqldb mariadb-server
   apt: 
     name:
-    - python-mysqldb
+    - python3-mysqldb
-    - mariadb-server 
+    - mariadb-server
+    - python3-passlib
+    - python3-pymysql
     state: present
 
+- name: python3 par defaut
+  alternatives:
+    link: /usr/bin/python
+    name: python
+    path: /usr/bin/python3
+    priority: 10
+
 - name: Create mysql database
-  mysql_db: name={{ maria_dbname }} state=present
+  mysql_db: 
+    name: "{{ maria_dbname }}" 
+    state: present
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+
+- name: Creation de l'utilisateur mysql avec tous les privileges
+  mysql_user:
+    name: "{{ maria_dbuser }}"
+    password: "{{ maria_dbpasswd }}"
+    priv: '*.*:ALL,GRANT'
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+  with_items:
+    - "127.0.0.1"
+#    - ::1
+#    - localhost
 
 - name: Copie du fichier my.cnf pour autorises toutes les adresses sur le port 3306
-  copy : src=my.cnf dest=/etc/mysql/
+  copy:
+    src: my.cnf
+    dest: /etc/mysql/
  
 - name: Redemarrage du service mariadb
-  shell: service mariadb restart
+  service: 
+    name: mariadb
+    state: restarted

roles/post/files/interfaces.r-vp1

@@ -1,6 +1,5 @@
 # This file describes the network interfaces available on your system
 # and how to activate them. For more information, see interfaces(5).
-
 # The loopback network interface
 #auto lo
 #iface lo inet loopback
@@ -22,8 +21,11 @@ allow-hotplug enp0s9
 iface enp0s9 inet static
 	address 192.168.1.2
 	netmask 255.255.255.0
-	up route add -net 172.16.128.0/24 gw 192.168.1.2
+	post-up /usr/sbin/ip route add 172.16.128.0/24 via 192.168.1.2
+	post-up /usr/sbin/ip route add 172.16.0.0/24 via 192.168.1.1
+	post-up /usr/sbin/ip route add 192.168.200.0/24 via 192.168.1.1
+
 #	up route add -net 172.16.128.0/24 gw 192.168.0.52
 #	up route add default gw 192.168.1.1
 #	post-up /bin/bash /root/iptables-vpn
-	post-up /etc/init.d/ipsec restart
+	post-up /etc/init.d/ipsec restart

roles/post/files/interfaces.r-vp2

@@ -1,6 +1,5 @@
 # This file describes the network interfaces available on your system
 # and how to activate them. For more information, see interfaces(5).
-
 # The loopback network interface
 #auto lo
 #iface lo inet loopback
@@ -22,7 +21,9 @@ allow-hotplug enp0s9
 iface enp0s9 inet static
 	address 192.168.0.52
 	netmask 255.255.255.0
-#	up route add -net 192.168.1.0/24 gw 172.16.128.254
+	post-up /usr/sbin/ip route add 192.168.1.0/24 via 172.16.128.254/24
-	up route add -net 192.168.1.0/24 gw 192.168.0.52
+	post-up /usr/sbin/ip route add 172.16.0.0/24 via 172.16.128.254/24
+
+#	up route add -net 192.168.1.0/24 gw 192.168.0.52
 #	post-up /bin/bash /root/iptables-vpn
-	post-up /etc/init.d/ipsec restart
+	post-up /etc/init.d/ipsec restart

roles/post/files/interfaces.s-agence

@@ -9,3 +9,6 @@ iface lo inet loopback
 allow-hotplug enp0s3
 iface enp0s3 inet dhcp
 
+allow-hotplug enp0s8
+iface enp0s8 inet dhcp
+

roles/s-lb-ab/files/haproxy.cfg

@@ -44,7 +44,7 @@ backend fermeweb
 	#option httpchk HEAD / HTTP/1.0
 	server s-lb-web1 192.168.101.1:80 check
 	server s-lb-web2 192.168.101.2:80 check
-
+#	server s-lb-web3 192.168.101.3:80 check
 
 listen stats
 	bind	*:8080

roles/s-lb-bd-ab/files/installmysql.sh

@@ -13,4 +13,4 @@ mysql_secure_installation
 sed -i 's/127\.0\.0\.1/0\.0\.0\.0/g' /etc/mysql/my.cnf
 mysql -uroot -p -e 'USE mysql; UPDATE `user` SET `Host`="%" WHERE `User`="root" AND `Host`="localhost"; DELETE FROM `user` WHERE `Host` != "%" AND `User`="root"; FLUSH PRIVILEGES;'
 
-service mysql restart
+service mysql restart

roles/s-lb-wordpress/defaults/main.yml

@@ -0,0 +1,2 @@
+depl_url: "http://s-adm.gsb.adm/gsbstore/"
+depl_wordpress: "wordpress-5.6-fr_FR.tar.gz"

roles/s-lb-wordpress/tasks/main.yml

@@ -5,9 +5,11 @@
     state: directory
  - name: download and extract wordpress
    unarchive: 
-    src: http://depl/gsbstore/wordpress-5.6-fr_FR.tar.gz
+    src: "{{ depl_url }}/{{ depl_wordpress }}"
     dest: /home/
     remote_src: yes
+    owner: www-data
+    group: www-data
 
  - name: Copy sample config file
    command: mv /home/wordpress/wp-config-sample.php /home/wordpress/wp-config.php creates=/home/wordpress/wp-config.php
@@ -23,6 +25,14 @@
      - {'regexp': "define\\('DB_USER', '(.)+'\\);", 'line': "define('DB_USER', '{{wp_mysql_user}}');"}        
      - {'regexp': "define\\('DB_PASSWORD', '(.)+'\\);", 'line': "define('DB_PASSWORD', '{{wp_mysql_password}}');"}
 
+
+ - name: Attributions des permissions
+   file:
+     path: /home/wordpress
+     recurse: yes
+     owner: 33
+     group: 33
+
 # - name: Fix permissions
 #   shell: chown -R www-data /var/www/wordpress/*
 #

roles/vpn-stg-l/files/ipsec.conf

@@ -7,7 +7,7 @@ conn tunnel #
         left=192.168.0.52
         leftsubnet=172.16.128.0/24
         right=192.168.0.51
-        rightsubnet=192.168.0.0/16, 172.16.0.0/24
+        rightsubnet=192.168.1.0/24, 192.168.200.0/24, 172.16.0.0/24
         ike=aes256-sha2_256-modp1024!
         esp=aes256-sha2_256!
         keyingtries=0
@@ -20,3 +20,4 @@ conn tunnel #
         auto=start
         keyexchange=ikev2
         type=tunnel
+#

roles/vpn-stg-r/files/ipsec.conf

@@ -5,7 +5,7 @@ config setup
 conn %default
 conn tunnel #
         left=192.168.0.51
-        leftsubnet=192.168.0.0/16, 172.16.0.0/24
+        leftsubnet=192.168.1.0/24, 192.168.200.0/24, 172.16.0.0/24
         right=192.168.0.52
         rightsubnet=172.16.128.0/24
         ike=aes256-sha2_256-modp1024!
@@ -20,3 +20,4 @@ conn tunnel #
         auto=start
         keyexchange=ikev2
         type=tunnel
+#

roles/x509-l/files/ipsec.conf

@@ -7,7 +7,7 @@ conn tunnel #
         left=192.168.0.52
         leftsubnet=172.16.128.0/24
         right=192.168.0.51
-        rightsubnet=192.168.0.0/16, 172.16.0.0/24
+        rightsubnet=192.168.1.0/24, 192.168.200.0/24, 172.16.0.0/24
         ike=aes256-sha2_256-modp1024!
         esp=aes256-sha2_256!
         keyingtries=0
@@ -22,4 +22,4 @@ conn tunnel #
         type=tunnel
 	leftcert=r-vp2Cert.pem
         leftid="C=CH, O=GSB, CN=r-vp2"
-        rightid="C=CH, O=GSB, CN=r-vp1"
+        rightid="C=CH, O=GSB, CN=r-vp1"

roles/x509-r/files/ipsec.conf

@@ -5,7 +5,7 @@ config setup
 conn %default
 conn tunnel #
         left=192.168.0.51
-        leftsubnet=192.168.0.0/16, 172.16.0.0/24
+        leftsubnet=192.168.1.0/24, 192.168.200.0/24, 172.16.0.0/24
         right=192.168.0.52
         rightsubnet=172.16.128.0/24
         ike=aes256-sha2_256-modp1024!
@@ -22,4 +22,4 @@ conn tunnel #
         type=tunnel
 	leftcert=r-vp1Cert.pem
         leftid="C=CH, O=GSB, CN=r-vp1"
-        rightid="C=CH, O=GSB, CN=r-vp2"
+        rightid="C=CH, O=GSB, CN=r-vp2"

s-agence.yml

@@ -7,3 +7,4 @@
     - ssh-cli
     - syslog-cli
     - post
+    - goss

s-lb-bd.retry

@@ -0,0 +1 @@
+localhost

s-nas.retry

@@ -0,0 +1 @@
+localhost