suppresion utilisation role db-user

goss/s-agence.yaml

@@ -0,0 +1,39 @@
+command:
+  ip r:
+    exit-status: 0
+    stdout:
+    - default via 172.16.128.254 dev enp0s8
+    - 172.16.128.0/24
+    - 192.168.99.0/24
+    stderr: []
+    timeout: 10000
+  ping -c 2 172.16.0.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 172.16.128.254:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.1.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.1.2:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.200.254:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000

proxy

@@ -0,0 +1 @@
+/etc/nginx/sites-availables/proxy

r-vp1.yml

@@ -12,9 +12,9 @@
    - base
    - goss
    - snmp-agent
-   - vpn-stg-r
+   - firewall-vpn-r
-#   - x509-r
+#  - vpn-stg-r
-#   - firewall-vpn-r
+   - x509-r
    - ssh-cli
    - syslog-cli
    - post

r-vp2.yml

@@ -13,10 +13,11 @@
    - goss
    - dhcp-ag
    - dns-agence
+   - ssh-root-access
    - snmp-agent
-   - vpn-stg-l
+   - firewall-vpn-l
-#   - x509-l
+#  - vpn-stg-l
-#   - firewall-vpn-l
+   - x509-l
    - ssh-cli
    - syslog-cli
    - post

roles/dns-master/files/db.gsb.lan

@@ -21,6 +21,8 @@ s-proxy         IN      A       172.16.0.2
 s-appli    	IN      A       172.16.0.3
 s-win    	IN      A       172.16.0.6
 s-mess   	IN      A       172.16.0.7
+s-nxec		IN	A	172.16.0.7
+s-docker	IN	A	172.16.0.7
 s-mon    	IN      A       172.16.0.8
 s-itil		IN	A	172.16.0.9
 r-int    	IN      A       172.16.0.254

roles/docker-nextcloud/files/config.php

@@ -0,0 +1,47 @@
+<?php
+$CONFIG = array (
+  'htaccess.RewriteBase' => '/',
+  'memcache.local' => '\\OC\\Memcache\\APCu',
+  'apps_paths' => 
+  array (
+    0 => 
+    array (
+      'path' => '/var/www/html/apps',
+      'url' => '/apps',
+      'writable' => false,
+    ),
+    1 => 
+    array (
+      'path' => '/var/www/html/custom_apps',
+      'url' => '/custom_apps',
+      'writable' => true,
+    ),
+  ),
+  'instanceid' => 'ocvc4q2htemf',
+  'passwordsalt' => 'stdJZMx4C5hz85Kqt8XdZIzx8kVOHI',
+  'secret' => 'II1BBgzlx70WUYCapAt/m/Bt1ZEk/n11n0DVq3zynyU8F/bU',
+  'trusted_domains' => 
+  array (
+    0 => '172.16.0.7:5678',
+    1 => '172.16.0.7:8080',
+    2 => 's-mess',
+    3 => 's-mess.gsb.lan',
+    4 => 'localhost:8080',
+  ),
+  'trusted_proxies' => ['172.16.0.7'],
+  'overwriteprotocol' => 'http',
+  'overwritehost' => '172.16.0.7:8080',
+  'proxy' => '172.16.0.7:8080',
+  'datadirectory' => '/var/www/html/data',
+  'dbtype' => 'mysql',
+  'version' => '20.0.6.1',
+  'overwrite.cli.url' => 'http://172.16.0.7:5678',
+  'dbname' => 'nextcloud',
+  'dbhost' => 'db',
+  'dbport' => '',
+  'dbtableprefix' => 'oc_',
+  'mysql.utf8mb4' => true,
+  'dbuser' => 'nextcloud',
+  'dbpassword' => 'root',
+  'installed' => true,
+);

roles/docker-nextcloud/files/docker-compose.yml

@@ -16,6 +16,7 @@ services:
       - MYSQL_PASSWORD=root
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
+      - TZ=Europe/Paris
 
   app:
     image: nextcloud
@@ -31,3 +32,4 @@ services:
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
       - MYSQL_HOST=db
+      - TZ=Europe/Paris

roles/docker-nextcloud/files/proxy

@@ -24,7 +24,7 @@ server {
 
 	location / {
 		proxy_set_header Host $host;
-                proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Real-IP $remote_addr;
 		proxy_pass http://localhost:5678;
 		proxy_connect_timeout 900;
 		proxy_send_timeout 900;

roles/docker-nextcloud/tasks/main.yml

@@ -29,3 +29,36 @@
   shell: docker-compose up -d
   args:
     chdir: /root/nextcloud
+
+- name: Installation de Nginx
+  package:
+    name: nginx
+    state: present
+
+- name: Copie de /etc/nginx/site-availables/proxy
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
+    dest: /etc/nginx/sites-available
+
+- name: Supression de /etc/nginx/sites-enabled/default
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/nginx/sites-enabled/proxy
+  file:
+    src: /etc/nginx/sites-available/proxy
+    dest: /etc/nginx/sites-enabled/proxy
+    owner: root
+    group: root
+    state: link
+
+- name: Redemmarage de Nginx
+  service:
+    name: nginx
+    state: restarted
+
+- name: Copie de config.php dans /root/nextcloud/nextcloud/config
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php
+    dest: /root/nextcloud/nextcloud/config 

roles/firewall-vpn-l/files/ferm.conf

@@ -7,9 +7,9 @@
 @def $DEV_VPN	= enp0s8;
 @def $DEV_EXT	= enp0s9;
 
-@def $NET_ADM=192.168.99.0/24;
+@def $NET_ADM=192.168.99.102/24;
-@def $NET_VPN=192.168.0.0/24;
+@def $NET_VPN=172.16.128.254/24;
-@def $NET_EXT=192.168.1.0/30;
+@def $NET_EXT=192.168.0.52/30;
 
 table filter {
     chain INPUT {

roles/firewall-vpn-r/files/ferm.conf

@@ -7,9 +7,9 @@
 @def $DEV_VPN	= enp0s8;
 @def $DEV_EXT	= enp0s9;
 
-@def $NET_ADM=192.168.99.0/24;
+@def $NET_ADM=192.168.99.112/24;
-@def $NET_VPN=192.168.0.0/24;
+@def $NET_VPN=192.168.0.51/24;
-@def $NET_EXT=192.168.1.0/30;
+@def $NET_EXT=192.168.1.2/30;
 
 table filter {
     chain INPUT {

roles/firewall-vpn-r/tasks/main.yml

@@ -1,15 +1,10 @@
 ---
-  - name: redemarrer interfaces
+- name : installer ferm
-    command: ifdown enp0s8
-  - name: redemarrer interfaces
-    command: ifup enp0s8
-  - name: redemarrer interfaces
-    command: ifdown enp0s9
-  - name: redemarrer interfaces
-    command: ifup enp0s9
-  - name: redemarrer interfaces
     apt: name=ferm state=present
+
   - name: fichier parefeu pour VPN
     copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-    notify:
+  
-      - Restart ferm
+  - name: Restart ferm
+      name: ferm
+      state: restarted

roles/fog/defaults/main.yml

@@ -0,0 +1,2 @@
+depl_url: "http://s-adm.gsb.adm/gsbstore"
+depl_fog: "fogproject-1.5.9.tar.gz"

roles/fog/tasks/main.yml

@@ -6,10 +6,10 @@
 
   - name: recuperation du fichier d'installation de fog
     get_url:
-      url: http://depl/gsbstore/fogproject-1.5.7.tar.gz
+      url: "{{ depl_url }}/{{ depl_fog }}"
       dest: /root/fog
 
   - name: decompression du fichier d'installation de fog
     unarchive:
-      src: /root/fog/fogproject-1.5.7.tar.gz
+      src: "/root/fog/{{ depl_fog }}"
       dest: /root/fog

roles/icinga/files/cfg/hostgroups_icinga.cfg

@@ -15,13 +15,13 @@ define hostgroup {
 define hostgroup { 
 	hostgroup_name debian-servers 
 	alias		Serveurs distant
-	members        s-infra, s-proxy, r-int, r-ext, s-adm, s-itil
+	members        s-infra, s-proxy, r-int, r-ext, s-adm, s-itil, s-mess
 } 
 
 define hostgroup { 
 	hostgroup_name ssh-servers 
 	alias 		acces SSH 
-	members		s-adm, s-infra, s-proxy, r-int, r-ext, localhost, gwsio2, s-itil	 
+	members		s-adm, s-infra, s-proxy, r-int, r-ext, localhost, gwsio2, s-itil, s-mess, s-lb
 }
 
 define hostgroup { 
@@ -39,7 +39,7 @@ define hostgroup {
 define hostgroup {
         hostgroup_name  http-servers
 		alias           serveurs-web
-		members         localhost, s-itil 
+		members         localhost, s-itil, s-adm
         }
 
 #define hostgroup {
@@ -69,6 +69,7 @@ define hostgroup{
 define hostgroup{
 	hostgroup_name	uptimegrp
 	alias		uptimegrp
-	members		s-infra, s-proxy, r-int, r-ext, s-adm, s-itil
+	members		s-infra, s-proxy, r-int, r-ext, s-adm, s-itil, s-mess, s-lb
 }
 
+

roles/icinga/files/hostgroups_icinga.cfg

@@ -1,75 +0,0 @@
-# Some generic hostgroup definitions
-
-define hostgroup {
-        hostgroup_name  all
-		alias           All Servers
-		members         *
-        }
-
-define hostgroup {
-        hostgroup_name 	       localhost
-		alias          Debian GNU/Linux Servers
-		members        localhost  
-        }
-
-define hostgroup { 
-	hostgroup_name debian-servers 
-	alias		Serveurs distant
-	members        s-infra, s-proxy, r-int, r-ext, s-adm, s-itil, s-mess
-} 
-
-define hostgroup { 
-	hostgroup_name ssh-servers 
-	alias 		acces SSH 
-	members		s-adm, s-infra, s-proxy, r-int, r-ext, localhost, gwsio2, s-itil, s-mess, s-lb
-}
-
-define hostgroup { 
-	hostgroup_name dns-servers
-	alias serveurs-dns 
-	members s-infra, srv-2012 
-} 
-
-define hostgroup { 
-	hostgroup_name dhcp-servers
-	alias serveurs-dhcp 
-	members r-int, srv-2012 
-} 
-
-define hostgroup {
-        hostgroup_name  http-servers
-		alias           serveurs-web
-		members         localhost, s-itil, s-adm
-        }
-
-#define hostgroup {
-#        hostgroup_name  email-servers
-#		alias           serveurs-email
-#		members         s-mess
-#       }
-
-define hostgroup { 
-	hostgroup_name proxy-servers
-	alias 		serveurs-proxy 
-	members 	s-proxy 
-}
-
-define hostgroup{
-	hostgroup_name	windows-servers
-	alias		windows-servers
-	members		srv-2012
-}
-
-#define hostgroup{
-#	hostgroup_name	switch
-#	alias		switch
-#	members		netgear
-#}
-
-define hostgroup{
-	hostgroup_name	uptimegrp
-	alias		uptimegrp
-	members		s-infra, s-proxy, r-int, r-ext, s-adm, s-itil, s-mess, s-lb
-}
-
-

roles/s-lb-ab/files/haproxy.cfg

@@ -44,7 +44,7 @@ backend fermeweb
 	#option httpchk HEAD / HTTP/1.0
 	server s-lb-web1 192.168.101.1:80 check
 	server s-lb-web2 192.168.101.2:80 check
-#	server s-lb-web3 192.168.101.2:80 check
+#	server s-lb-web3 192.168.101.3:80 check
 
 listen stats
 	bind	*:8080

roles/ssh-root-access/tasks/main.yml

@@ -0,0 +1,7 @@
+- name: Activation acces ssh root pour vp-1 (certificat)
+  lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: "^PermitRootLogin"
+    line: "PermitRootLogin yes"
+    state: present
+

roles/x509-l/files/ipsec.conf

@@ -7,7 +7,7 @@ conn tunnel #
         left=192.168.0.52
         leftsubnet=172.16.128.0/24
         right=192.168.0.51
-        rightsubnet=192.168.0.0/16, 172.16.0.0/24
+        rightsubnet=192.168.1.0/24, 192.168.200.0/24, 172.16.0.0/24
         ike=aes256-sha2_256-modp1024!
         esp=aes256-sha2_256!
         keyingtries=0
@@ -22,4 +22,4 @@ conn tunnel #
         type=tunnel
 	leftcert=r-vp2Cert.pem
         leftid="C=CH, O=GSB, CN=r-vp2"
-        rightid="C=CH, O=GSB, CN=r-vp1"
+        rightid="C=CH, O=GSB, CN=r-vp1"

roles/x509-r/files/ipsec.conf

@@ -5,7 +5,7 @@ config setup
 conn %default
 conn tunnel #
         left=192.168.0.51
-        leftsubnet=192.168.0.0/16, 172.16.0.0/24
+        leftsubnet=192.168.1.0/24, 192.168.200.0/24, 172.16.0.0/24
         right=192.168.0.52
         rightsubnet=172.16.128.0/24
         ike=aes256-sha2_256-modp1024!
@@ -22,4 +22,4 @@ conn tunnel #
         type=tunnel
 	leftcert=r-vp1Cert.pem
         leftid="C=CH, O=GSB, CN=r-vp1"
-        rightid="C=CH, O=GSB, CN=r-vp2"
+        rightid="C=CH, O=GSB, CN=r-vp2"

s-agence.yml

@@ -7,3 +7,4 @@
     - ssh-cli
     - syslog-cli
     - post
+    - goss

s-lb-bd.yml

@@ -11,13 +11,14 @@
    roles:
      - base
      - goss
+     - post
      #- s-lb-bd-ab
      - mariadb-ab
-     - role: db-user
+#     - role: db-user
-       cli_ip: "192.168.102.1"
+#       cli_ip: "192.168.102.1"
-     - role: db-user
+#     - role: db-user
-       cli_ip: "192.168.102.2"
+#       cli_ip: "192.168.102.2"
-     - role: db-user
+#     - role: db-user
-       cli_ip: "192.168.102.3"     
+#       cli_ip: "192.168.102.3"     
      - snmp-agent
-     - post
+#     - post