suppresion utilisation role db-user

proxy

@@ -0,0 +1 @@
+/etc/nginx/sites-availables/proxy

r-vp1.yml

@@ -12,9 +12,9 @@
    - base
    - goss
    - snmp-agent
-   - vpn-stg-r
-#   - x509-r
-#   - firewall-vpn-r
+   - firewall-vpn-r
+#  - vpn-stg-r
+   - x509-r
    - ssh-cli
    - syslog-cli
    - post

r-vp2.yml

@@ -13,10 +13,11 @@
    - goss
    - dhcp-ag
    - dns-agence
+   - ssh-root-access
    - snmp-agent
-   - vpn-stg-l
-#   - x509-l
-#   - firewall-vpn-l
+   - firewall-vpn-l
+#  - vpn-stg-l
+   - x509-l
    - ssh-cli
    - syslog-cli
    - post

roles/dns-master/files/db.gsb.lan

@@ -21,6 +21,8 @@ s-proxy         IN      A       172.16.0.2
 s-appli    	IN      A       172.16.0.3
 s-win    	IN      A       172.16.0.6
 s-mess   	IN      A       172.16.0.7
+s-nxec		IN	A	172.16.0.7
+s-docker	IN	A	172.16.0.7
 s-mon    	IN      A       172.16.0.8
 s-itil		IN	A	172.16.0.9
 r-int    	IN      A       172.16.0.254

roles/docker-nextcloud/files/docker-compose.yml

@@ -16,6 +16,7 @@ services:
       - MYSQL_PASSWORD=root
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
+      - TZ=Europe/Paris
 
   app:
     image: nextcloud
@@ -31,3 +32,4 @@ services:
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud
       - MYSQL_HOST=db
+      - TZ=Europe/Paris

roles/docker-nextcloud/files/proxy

@@ -24,7 +24,7 @@ server {
 
 	location / {
 		proxy_set_header Host $host;
-                proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Real-IP $remote_addr;
 		proxy_pass http://localhost:5678;
 		proxy_connect_timeout 900;
 		proxy_send_timeout 900;

roles/docker-nextcloud/tasks/main.yml

@@ -29,3 +29,36 @@
   shell: docker-compose up -d
   args:
     chdir: /root/nextcloud
+
+- name: Installation de Nginx
+  package:
+    name: nginx
+    state: present
+
+- name: Copie de /etc/nginx/site-availables/proxy
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
+    dest: /etc/nginx/sites-available
+
+- name: Supression de /etc/nginx/sites-enabled/default
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+
+- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/nginx/sites-enabled/proxy
+  file:
+    src: /etc/nginx/sites-available/proxy
+    dest: /etc/nginx/sites-enabled/proxy
+    owner: root
+    group: root
+    state: link
+
+- name: Redemmarage de Nginx
+  service:
+    name: nginx
+    state: restarted
+
+- name: Copie de config.php dans /root/nextcloud/nextcloud/config
+  copy:
+    src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php
+    dest: /root/nextcloud/nextcloud/config 

roles/firewall-vpn-l/files/ferm.conf

@@ -7,9 +7,9 @@
 @def $DEV_VPN	= enp0s8;
 @def $DEV_EXT	= enp0s9;
 
-@def $NET_ADM=192.168.99.0/24;
-@def $NET_VPN=192.168.0.0/24;
-@def $NET_EXT=192.168.1.0/30;
+@def $NET_ADM=192.168.99.102/24;
+@def $NET_VPN=172.16.128.254/24;
+@def $NET_EXT=192.168.0.52/30;
 
 table filter {
     chain INPUT {

roles/firewall-vpn-r/files/ferm.conf

@@ -7,9 +7,9 @@
 @def $DEV_VPN	= enp0s8;
 @def $DEV_EXT	= enp0s9;
 
-@def $NET_ADM=192.168.99.0/24;
-@def $NET_VPN=192.168.0.0/24;
-@def $NET_EXT=192.168.1.0/30;
+@def $NET_ADM=192.168.99.112/24;
+@def $NET_VPN=192.168.0.51/24;
+@def $NET_EXT=192.168.1.2/30;
 
 table filter {
     chain INPUT {

roles/firewall-vpn-r/tasks/main.yml

@@ -1,15 +1,10 @@
 ---
-  - name: redemarrer interfaces
-    command: ifdown enp0s8
-  - name: redemarrer interfaces
-    command: ifup enp0s8
-  - name: redemarrer interfaces
-    command: ifdown enp0s9
-  - name: redemarrer interfaces
-    command: ifup enp0s9
-  - name: redemarrer interfaces
+- name : installer ferm
     apt: name=ferm state=present
+
   - name: fichier parefeu pour VPN
     copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-    notify:
-      - Restart ferm
+  
+  - name: Restart ferm
+      name: ferm
+      state: restarted

roles/ssh-root-access/tasks/main.yml

@@ -0,0 +1,7 @@
+- name: Activation acces ssh root pour vp-1 (certificat)
+  lineinfile:
+    dest: /etc/ssh/sshd_config
+    regexp: "^PermitRootLogin"
+    line: "PermitRootLogin yes"
+    state: present
+

s-lb-bd.yml

@@ -11,13 +11,14 @@
    roles:
      - base
      - goss
+     - post
      #- s-lb-bd-ab
      - mariadb-ab
-     - role: db-user
-       cli_ip: "192.168.102.1"
-     - role: db-user
-       cli_ip: "192.168.102.2"
-     - role: db-user
-       cli_ip: "192.168.102.3"     
+#     - role: db-user
+#       cli_ip: "192.168.102.1"
+#     - role: db-user
+#       cli_ip: "192.168.102.2"
+#     - role: db-user
+#       cli_ip: "192.168.102.3"     
      - snmp-agent
-     - post
+#     - post