syntaxe

README.md

@@ -12,4 +12,47 @@ prérequis : une machine Debian buster
   * r-int
   * r-ext
   * s-proxy
+
+
 ## Les playbooks
+
+
+## Installation
+
+On utilisera l'image de machine virtuelle suivante : 
+  * **debian-buster-gsb-2021b.ova** (2021-03-31)
+    * Bebian Buster 10.9 - 2 cartes - 1 Go - stockage 20 Go
+
+
+### Machine s-adm
+  * créer la machine virtuelle **s-adm** en important l'image ova décrite plus haut
+  * renommer la machine puis redémarrer
+  * taper :
+```shell
+    mkdir -p tools/ansible ; cd tools/ansible
+    git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
+    cd gsb2021/pre
+    bash inst-depl
+    cd /var/www/html/gsbstore
+    bash getall-latest
+    cd /root/tools/ansible/gsb021
+    bash gsbboot
+    bash pull-config
+```
+  - redémarrer
+  
+### Pour chaque machine
+
+  - importer la machine à partir du fichier **.ova**
+  - définir les cartes réseau en accord avec le plan d'adressage et le schéma
+  - donner le nom adapté (avec sed -i …)
+  - redémarrer
+  - mettre à jour les paquets : apt update && apt upgrade
+  - cloner le dépot : 
+```shell
+mkdir -p tools/ansible ; cd tools/ansible
+git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git
+cd gsb2021/pre
+bash gsbboot
+bash pull-config
+```

goss/s-agence.yaml

@@ -7,31 +7,31 @@ command:
     - 192.168.99.0/24
     stderr: []
     timeout: 10000
-  ping -c 2 172.16.0.1:
-    exit-status: 0
-    stdout:
-    - 0% packet loss
-    stderr: []
-    timeout: 10000
   ping -c 2 172.16.128.254:
     exit-status: 0
     stdout:
     - 0% packet loss
     stderr: []
     timeout: 10000
-  ping -c 2 192.168.1.1:
-    exit-status: 0
-    stdout:
-    - 0% packet loss
-    stderr: []
-    timeout: 10000
   ping -c 2 192.168.1.2:
     exit-status: 0
     stdout:
     - 0% packet loss
     stderr: []
     timeout: 10000
-  ping -c 2 192.168.200.254:
+  ping -c 2 192.168.1.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 192.168.200.254
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 2 172.16.0.1:
     exit-status: 0
     stdout:
     - 0% packet loss

pre/gsbboot

@@ -0,0 +1,54 @@
+#!/bin/bash
+version="1.8"
+__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+__file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
+__base="$(basename ${__file})"
+__root="$(cd "$(dirname "${__dir}")" && pwd)" 
+echo "dir : ${__dir}"
+echo "file : ${__file}"
+echo "base : ${__base}"
+echo "root : ${__root}"
+
+# version 1.8
+# install git si besoin
+# install ansible si besoin + backports si wheezy
+
+readonly base=/root/tools/ansible
+readonly slist=/etc/apt/sources.list
+readonly host=depl
+if [[ -z ${DEPL+x} ]]; then
+  echo "erreur : DEPL indefini"
+  echo " DEPL : adresse serveur deploiement"
+  echo "export DEPL=xyzt ; ./$0"
+  exit 1
+fi
+
+hostf="${host}.local" 
+prj=gsb
+APT=apt
+
+which git >> /dev/null
+if [[ $? != 0 ]]; then
+	${APT} update
+	echo "installation de git ..."
+	${APT} install -y git-core
+fi
+${APT} update
+${APT} upgrade -y
+
+which ansible >> /dev/null
+if [[ $? != 0 ]]; then
+	echo "installation de ansible ..."
+	${APT} install -y ansible 
+fi
+
+[ -e "${base}" ] || mkdir -p "${base}"
+
+grep "${hostf}" /etc/hosts > /dev/null || echo "${DEPL} ${hostf} ${host}" >> /etc/hosts
+cd "${base}"
+
+cp ${prj}/pull-config ${base}
+
+#echo "N'oubliez pasz d'indiquer l'adresse DEPL dans '/root/tools/ansible/pull-config'"
+echo "Vous pouvez lancer 'bash pull-config' depuis ${base} ..."
+

pre/inst-depl

@@ -1,24 +1,16 @@
 #!/bin/bash
+## ps : 2021-04-01 15:25
+
 set -o errexit
 set -o pipefail
 GITUSR=gitgsb
-GITPRJ=gsb
+GITPRJ=gsb2021
 apt update && apt upgrade
 apt install -y apache2 git 
-getent passwd "${GITUSR}" >> /dev/null
-if [[ $? != 0 ]]; then
-  echo "creation utilisateur "${GITUSR}" ..."
-  /sbin/useradd -m -d /home/"${GITUSR}" -s /bin/bash "${GITUSR}" 
-  echo "${GITUSR}:${GITUSR}" | /sbin/chpasswd 
-else
-  echo "utilisateur "${GITUSR}" existant..."
-fi
-su -c "git init --share --bare /home/${GITUSR}/${GITPRJ}.git" "${GITUSR}"
-su -c "cd ${GITPRJ}.git/.git/hooks && mv post-update.sample post-update" "${GITUSR}"
-[[ -h /var/www/html/"${GITPRJ}".git ]]|| ln -s /home/"${GITUSR}"/"${GITPRJ}".git /var/www/html/"${GITPRJ}".git
-[[ -d /var/www/html/gsbstore ]]|| mkdir /var/www/html/gsbstore
+STOREREP="/var/www/html/gsbstore" 
+[[ -d "${STOREREP}" ]]|| mkdir "${STOREREP}"
  
-(cat <<EOT > /var/www/html/gsbstore/getall
+(cat <<EOT > "${STOREREP}/getall"
 
 #!/bin/bash
 

pre/inst-depl.old

@@ -0,0 +1,48 @@
+#!/bin/bash
+set -o errexit
+set -o pipefail
+GITUSR=gitgsb
+GITPRJ=gsb
+apt update && apt upgrade
+apt install -y apache2 git 
+getent passwd "${GITUSR}" >> /dev/null
+if [[ $? != 0 ]]; then
+  echo "creation utilisateur "${GITUSR}" ..."
+  /sbin/useradd -m -d /home/"${GITUSR}" -s /bin/bash "${GITUSR}" 
+  echo "${GITUSR}:${GITUSR}" | /sbin/chpasswd 
+else
+  echo "utilisateur "${GITUSR}" existant..."
+fi
+su -c "git init --share --bare /home/${GITUSR}/${GITPRJ}.git" "${GITUSR}"
+su -c "cd ${GITPRJ}.git/.git/hooks && mv post-update.sample post-update" "${GITUSR}"
+[[ -h /var/www/html/"${GITPRJ}".git ]]|| ln -s /home/"${GITUSR}"/"${GITPRJ}".git /var/www/html/"${GITPRJ}".git
+[[ -d /var/www/html/gsbstore ]]|| mkdir /var/www/html/gsbstore
+ 
+(cat <<EOT > /var/www/html/gsbstore/getall
+
+#!/bin/bash
+
+set -o errexit
+set -o pipefail
+
+GLPIREL=9.4.5
+wget -nc https://github.com/glpi-project/glpi/releases/download/\${GLPIREL}/glpi-\${GLPIREL}.tgz
+ 
+FIREL=9.4+2.4
+wget -nc -O fusioninventory-glpi\${FIREL}.tag.gz https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi\${FIREL}.tar.gz 
+#https://github.com/fusioninventory/fusioninventory-for-glpi/archive/glpi9.4+2.4.tar.g 
+ 
+FIAGREL=2.5.2 
+wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\${FIAGREL}/fusioninventory-agent_windows-x64_\${FIAGREL}.exe
+ 
+wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/\$FIAGREL/fusioninventory-agent_windows-x86_\${FIAGREL}.exe
+ 
+FOGREL=1.5.7
+wget -nc https://github.com/FOGProject/fogproject/archive/\${FOGREL}.tar.gz -O fogproject-\${FOGREL}.tar.gz
+ 
+wget -nc https://fr.wordpress.org/wordpress-5.3.2-fr_FR.tar.gz
+
+EOT
+)
+cat /var/www/html/gsbstore/getall
+

pre/pull-config

@@ -2,31 +2,15 @@
 
 if [ -z ${UREP+x} ]; then 
 	UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git 
-else 
-	echo "var is set to '$var'" 
 fi
-REPO=$(basename ${UREP})
 
 dir=/root/tools/ansible
-host=depl
-hostf=$host.sio.lan
-repo=gsb
 
-[ -e $dir ] || mkdir -p $dir
+[ -e "${dir}" ] || mkdir -p "${dir}"
 
-#grep $hostf /etc/hosts > /dev/null || echo "10.121.38.10 $hostf $host" >> /etc/hosts
-
-cd  $dir
+cd  "${dir}" || exit 1
 
 hostname  > hosts
-
-#git clone http://$host/$repo.git
-
-#cd $repo
-#git pull
-
-#ansible-playbook -c local -i 'localhost,' $(hostname).yml
-#ansible-pull -i $dir/hosts -d $repo -U "${UREP}"
-ansible-pull -i $dir/hosts  -U "${UREP}"
+ansible-pull -i "${dir}/hosts"  -U "${UREP}"
 
 exit 0

pull-config

@@ -3,19 +3,14 @@
 if [ -z ${UREP+x} ]; then 
 	UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2021.git 
 fi
-REPO=$(basename ${UREP})
 
 dir=/root/tools/ansible
-host=depl
-hostf=$host.sio.lan
 
-[ -e ${dir} ] || mkdir -p ${dir}
+[ -e "${dir}" ] || mkdir -p "${dir}"
 
-#grep $hostf /etc/hosts > /dev/null || echo "10.121.38.10 $hostf $host" >> /etc/hosts
-
-cd  ${dir}
+cd  "${dir}" || exit 1
 
 hostname  > hosts
-ansible-pull -i ${dir}/hosts  -U "${UREP}"
+ansible-pull -i "${dir}/hosts"  -U "${UREP}"
 
 exit 0

roles/firewall-vpn-l/files/ferm.conf

@@ -23,18 +23,11 @@ table filter {
         interface lo ACCEPT;
 
         # allow SSH connections
-        #interface ($DEV_VPN) {
 	proto tcp dport ssh ACCEPT;
-	#}
 
         # allow DNS connections
-        #interface ($DEV_INT) {
 	proto udp sport domain ACCEPT;
-	proto udp dport domain ACCEPT;
-	#}	
-
-        # DHCP
-        proto udp dport (67 68) ACCEPT;
+	proto udp dport domain ACCEPT;	
 
         # allow IPsec
         interface ($DEV_AG $DEV_VPN) {

roles/firewall-vpn-l/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
-  - name : installer ferm
-    apt: name=ferm state=present
-  - name: fichier parefeu pour VPN
-    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-    notify:
-      - Restart ferm
-    
+- name : installer ferm
+  apt: name=ferm state=present
+  
+- name: fichier parefeu pour VPN
+  copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+  notify:
+    - Restart ferm

roles/firewall-vpn-r/files/ferm.conf

@@ -9,7 +9,7 @@
 
 @def $NET_ADM=192.168.99.112/24;
 @def $NET_VPN=192.168.0.51/24;
-@def $NET_EXT=192.168.1.2/30;
+@def $NET_EXT=192.168.1.2/24;
 
 table filter {
     chain INPUT {
@@ -23,15 +23,13 @@ table filter {
         interface lo ACCEPT;
 
         # allow SSH connections
-        #interface ($DEV_ADM) {
 	proto tcp dport ssh ACCEPT;
-	#}
+	
 
         # allow DNS connections
-        #interface ($DEV_INT) {
 	proto udp sport domain ACCEPT;
 	proto udp dport domain ACCEPT;
-	#}	
+		
 
         # allow IPsec
         interface ($DEV_VPN) {
@@ -51,49 +49,13 @@ table filter {
 #	proto (udp tcp) dport domain ACCEPT;
 	#}
 
-	# autoriser supervision
-	proto udp sport 161 ACCEPT;
 
 	# autoriser NTP
 	proto udp sport 123 ACCEPT;
 
-        # respond to ping
-        proto icmp mod limit limit 30/minut ACCEPT; 
-
     }
     chain OUTPUT {
-        policy DROP;
-#        interface ($DEV_PUB) {
-        
-	# Autoriser SSH
-        proto tcp sport ssh ACCEPT;
-
-	# Autoriser DNS
-        proto udp dport domain ACCEPT;
-        proto udp sport domain ACCEPT;
-	
-	# Autoriser ipsec
-        proto udp dport 500 ACCEPT;
-        proto udp sport 500 ACCEPT;
-	
-	# Autoriser nat-t-ike
-        proto udp dport 4500 ACCEPT;
-        proto udp sport 4500 ACCEPT;
-        
-	# Autoriser supervision
-        proto udp dport 161 ACCEPT;
-	
-	# Autoriser NTP
-        proto udp dport 123 ACCEPT;
-
-        # respond to ping
-        proto icmp ACCEPT; 
-
-#	}
-
-        # connection tracking
-        #mod state state INVALID DROP;
-        mod state state (ESTABLISHED RELATED) ACCEPT;
+        policy ACCEPT;
     }
     chain FORWARD {
         policy ACCEPT;
@@ -102,15 +64,4 @@ table filter {
         mod state state INVALID DROP;
         mod state state (ESTABLISHED RELATED) ACCEPT;
     }
-}
-
-# IPv6:
-#domain ip6 {
-#    table filter {
-#        chain INPUT {
-#            policy ACCEPT;
-#            # ...
-#        }
-#        # ...
-#    }
-#}
+}

roles/firewall-vpn-r/tasks/main.yml

@@ -1,10 +1,8 @@
 ---
 - name : installer ferm
-    apt: name=ferm state=present
+  apt: name=ferm state=present
 
-  - name: fichier parefeu pour VPN
-    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
-  
-  - name: Restart ferm
-      name: ferm
-      state: restarted
+- name: fichier parefeu pour VPN
+  copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+  notify:
+    - Restart ferm

roles/fog/tasks/main.yml

@@ -8,6 +8,7 @@
     get_url:
       url: "{{ depl_url }}/{{ depl_fog }}"
       dest: /root/fog
+      remote_src: yes
 
   - name: decompression du fichier d'installation de fog
     unarchive:

roles/s-lb-ab/files/haproxy.cfg

@@ -44,7 +44,7 @@ backend fermeweb
 	#option httpchk HEAD / HTTP/1.0
 	server s-lb-web1 192.168.101.1:80 check
 	server s-lb-web2 192.168.101.2:80 check
-#	server s-lb-web3 192.168.101.3:80 check
+	server s-lb-web3 192.168.101.3:80 check
 
 listen stats
 	bind	*:8080