ajout activation wg0

pre/inst-depl

@@ -1,12 +1,13 @@
 #!/bin/bash
-## aa : 2023-04-18 15:25
+## aa : 2023-01-18 15:25
+## ps : 2023-02-01 15:25
 
 set -o errexit
 set -o pipefail
 GITUSR=gitgsb
 GITPRJ=gsb2023
-apt update && apt upgrade
-apt install -y apache2 git 
+apt-get update 
+apt-get install -y apache2 git 
 STOREREP="/var/www/html/gsbstore" 
 
 GLPIREL=10.0.6

roles/base/templates/hosts.j2

@@ -27,6 +27,8 @@
 192.168.99.102	s-lb-web2.gsb.adm
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
+192.168.99.102  r-vp2.gsb.adm
+
 
 192.168.99.8	syslog.gsb.adm
 

roles/base/templates/hosts.s-proxy.j2

@@ -26,6 +26,7 @@
 192.168.99.102	s-lb-web2.gsb.adm
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
+192.168.99.102  r-vp2.gsb.adm
 
 192.168.99.8	syslog.gsb.adm
 

roles/nxc-traefik/files/docker-compose.yml

@@ -0,0 +1,80 @@
+version: '3'
+volumes:
+  nextcloud:
+  db:
+
+networks:
+  proxy:
+    external: true
+  nxc:
+    external: false
+
+services:
+  reverse-proxy:
+    # The official v2 Traefik docker image
+    image: traefik:latest
+    container_name: traefik
+    # Enables the web UI and tells Traefik to listen to docker
+    command: --api.insecure=true --providers.docker
+    ports:
+      # The HTTP port
+      - "80:80"
+      - "443:443"
+      # The Web UI (enabled by --api.insecure=true)
+      - "8080:8080"
+    volumes:
+      # So that Traefik can listen to the Docker events
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      # Map the static configuration into the container
+      - ./config/static.yml:/etc/traefik/traefik.yml:ro
+      # Map the dynamic configuration into the container
+      - ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
+      # Map the certificats into the container
+      - ./certs:/etc/certs:ro
+    networks:
+      - proxy
+  
+  db:
+    image: mariadb:10.5
+    container_name: db
+    restart: always
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
+    volumes:
+      - db:/var/lib/mysql
+    networks:
+      - nxc
+    environment:
+      - MYSQL_ROOT_PASSWORD=Azerty1+
+      - MYSQL_PASSWORD=Azerty1+
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+
+  app:
+    image: nextcloud
+    container_name: app
+    restart: always
+    ports:
+      - 8081:80
+    #links:
+    depends_on:
+      - db
+    volumes:
+      - ./nextcloud:/var/www/html
+    networks:
+      - proxy
+      - nxc
+    labels:
+#      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`s-nxc.gsb.lan`)"
+      - "traefik.http.routers.app.tls=true"
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+        #      - "traefik.http.routers.app.entrypoints=websecure"
+        #      - "traefik.http.routers.app.rule=Host(`mon.nxc`)"
+      - "traefik.http.routers.app.service=app-service"
+      - "traefik.http.services.app-service.loadbalancer.server.port=80"
+    environment:
+      - MYSQL_PASSWORD=Azerty1+
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_HOST=db

roles/nxc-traefik/files/nextcloud.yml

@@ -1,58 +0,0 @@
-version: '2'
-
-volumes:
-  #  nextcloud:
-  db:
-
-services:
-  db:
-    image: mariadb
-    container_name: db
-    restart: always
-    #command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
-    command: --innodb-read-only-compressed=OFF
-    volumes:
-      - db:/var/lib/mysql
-    networks:
-      - nxc-db
-    environment:
-      - MYSQL_ROOT_PASSWORD=blabla
-      - MYSQL_PASSWORD=blabla
-      - MYSQL_DATABASE=nextcloud
-      - MYSQL_USER=nextcloud
-
-  nxc:
-    image: nextcloud
-    restart: always
-    container_name: nxc
-#    ports:
-#      - 8080:80
-#    links:
-    depends_on:
-      - db
-    volumes:
-      - ./nextcloud:/var/www/html
-    environment:
-      - MYSQL_PASSWORD=blabla
-      - MYSQL_DATABASE=nextcloud
-      - MYSQL_USER=nextcloud
-      - MYSQL_HOST=db
-    labels:
-      # Enable this container to be mapped by traefik
-      # For more information, see: https://docs.traefik.io/providers/docker/#exposedbydefault
-      - "traefik.enable=true"
-      # URL to reach this container
-      - "traefik.http.routers.nxc.rule=Host(`s-nxc.gsb.lan`)"
-      # Activation of TLS
-      - "traefik.http.routers.nxc.tls=true"
-      # If port is different than 80, use the following service:
-      #-  "traefik.http.services.<service_name>.loadbalancer.server.port=<port>"
-      #      -  "traefik.http.services.app.loadbalancer.server.port=8080"
-    networks:
-      - proxy
-      - nxc-db
-networks:
-  proxy:
-    external: true
-  nxc-db:
-    external: false

roles/nxc-traefik/files/nxc-debug.sh

@@ -1,6 +1,4 @@
 #!/bin/bash
-docker-compose -f nextcloud.yml down
-docker-compose -f traefik.yml down
+docker compose down -v
 sleep 1
-docker-compose -f traefik.yml up -d --remove-orphans
-docker-compose -f nextcloud.yml up -d
+docker compose up -d

roles/nxc-traefik/files/nxc-prune.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
-docker volume prune -f
-docker container prune -f
-docker image prune -f
+
+docker compose down -v
+#docker volume prune -f
+#docker container prune -f
+#docker image prune -f

roles/nxc-traefik/files/nxc-start.sh

@@ -1,3 +1,2 @@
 #!/bin/bash
-docker-compose -f traefik.yml up -d  
-docker-compose -f nextcloud.yml up -d 
+docker compose up -d 

roles/nxc-traefik/files/nxc-stop.sh

@@ -1,3 +1,2 @@
 #!/bin/bash
-docker-compose -f nextcloud.yml down
-docker-compose -f traefik.yml down
+docker compose down

roles/nxc-traefik/files/traefik.yml

@@ -1,28 +0,0 @@
-version: '3'
-
-services:
-  reverse-proxy:
-    #image: traefik:v2.5
-    image: traefik
-    container_name: traefik
-    restart: always
-    security_opt:
-      - no-new-privileges:true
-    ports:
-      # Web
-      - 80:80
-      - 443:443
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      # Map the static configuration into the container
-      - ./config/static.yml:/etc/traefik/traefik.yml:ro
-      # Map the dynamic configuration into the container
-      - ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
-      # Map the certificats into the container
-      - ./certs:/etc/certs:ro
-    networks:
-      - proxy
-
-networks:
-  proxy:
-    external: true

roles/nxc-traefik/tasks/main.yml

@@ -24,14 +24,9 @@
     src: dynamic.yml   
     dest: /root/nxc/config
 
-- name: Copie de nextcloud.yml
+- name: Copie de docker-compose.yml
   copy: 
-    src: nextcloud.yml
-    dest: /root/nxc
-
-- name: Copie de traefik.yml
-  copy:
-    src: traefik.yml
+    src: docker-compose.yml
     dest: /root/nxc
 
 - name: Copie de nxc-stop.sh
@@ -76,3 +71,8 @@
 
 - name: Creation reseau docker proxy
   command: docker network create proxy
+
+- name: Démarrage du docker-compose...
+  command: /bin/bash docker-compose up -d
+  args:
+    chdir: /root/nxc

scripts/mkvm

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-mkvmrelease="v1.2"
+mkvmrelease="v1.2.1"
 
 ovarelease="2023a"
 ovafogrelease="2023a"
@@ -66,8 +66,8 @@ vm="$1"
 
 create_vm "${vm}"
 if [[ "${vm}" == "s-adm" ]] ; then
-	bash addint-s.adm
-if [[ "${vm}" == "s-infra" ]] ; then
+	bash addint.s-adm
+elif [[ "${vm}" == "s-infra" ]] ; then
 	create_if "${vm}" "n-adm" "n-infra"
 elif [[ "${vm}" == "s-proxy" ]] ; then
 	create_if "${vm}" "n-adm" "n-infra"

scripts/mkvm.ps1

@@ -22,11 +22,10 @@ function create_vm{ param([string]$nomvm)
 function create_if{ param([string]$nomvm, [string]$nic, [int]$rang, [string]$reseau)
 	#Création d'une interface
 	if ($nomvm -and $nic -and $rang -and $reseau) {
-	#if ("1" -eq "1") {
 		if ($nic -eq "bridge") {
 			#Création d'une interface en pont
 			& "$vboxmanage" modifyvm  "$nomvm" --nic"$rang" bridged
-			& "$vboxmanage" modifyvm  "$nomvm" --nictype"$rang" 82540EM
+			& "$vboxmanage" modifyvm  "$nomvm" --nictype"$rang" virtio
 			& "$vboxmanage" modifyvm  "$nomvm" --cableconnected"$rang" on
 			& "$vboxmanage" modifyvm  "$nomvm" --nicpromisc"$rang" allow-all
 			Write-Host "$nomvm : IF$rang $nic"
@@ -35,7 +34,7 @@ function create_if{ param([string]$nomvm, [string]$nic, [int]$rang, [string]$res
 			#Création d'une interface en reseau interne
 			& "$vboxmanage" modifyvm  "$nomvm" --nic"$rang" intnet
 			& "$vboxmanage" modifyvm  "$nomvm" --intnet"$rang" "$reseau"
-			& "$vboxmanage" modifyvm  "$nomvm" --nictype"$rang" 82540EM
+			& "$vboxmanage" modifyvm  "$nomvm" --nictype"$rang" virtio
 			& "$vboxmanage" modifyvm  "$nomvm" --cableconnected"$rang" on
 			& "$vboxmanage" modifyvm  "$nomvm" --nicpromisc"$rang" allow-all
 			Write-Host "$nomvm : IF$rang $nic $reseau"
@@ -43,6 +42,9 @@ function create_if{ param([string]$nomvm, [string]$nic, [int]$rang, [string]$res
 	}
 }
 
+function usage{
+	Write-Host "usage : mkvm ${myInvocation.ScriptName} <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-agence|s-appli|s-backup|s-itil|s-ncx|s-fog|s-dns-ext|s-web-ext|s-lb|s-lb-bd|s-lb-web1|s-lb-web2|s-lb-web3>"
+}
 
 if ($args[0] -eq "s-adm") {
 
@@ -52,107 +54,103 @@ if ($args[0] -eq "s-adm") {
 	
 }
 
-elseif ($args[0] -eq "s-infra") {
+elseif ($args[0] -eq "r-int") {
 
 	create_vm $args[0]
 	create_if $args[0] "int" 1 "n-adm"
-	create_if $args[0] "int" 2 "n-infra"
-
-#création de la première interface
-& "$vboxmanage" modifyvm  "s-infra" --nic1 intnet
-& "$vboxmanage" modifyvm  "s-infra" --intnet1 "n-adm"
-& "$vboxmanage" modifyvm  "s-infra" --nictype1 82540EM
-& "$vboxmanage" modifyvm  "s-infra" --cableconnected1 on
-& "$vboxmanage" modifyvm  "s-infra" --nicpromisc1 allow-all
-
-#création de la deuxième interface
-& "$vboxmanage" modifyvm  "s-infra" --nic2 intnet
-& "$vboxmanage" modifyvm  "s-infra" --intnet2 "n-infra"
-& "$vboxmanage" modifyvm  "s-infra" --nictype2 82540EM
-& "$vboxmanage" modifyvm  "s-infra" --cableconnected2 on
-& "$vboxmanage" modifyvm  "s-infra" --nicpromisc2 allow-all
-}
-
-elseif ($args[0] -eq "r-int") {
-
-	create_vm($args[0])
-
-#interface 1
-& "$vboxmanage" modifyvm  "r-int" --nic1 intnet
-& "$vboxmanage" modifyvm  "r-int" --intnet1 "n-adm"
-& "$vboxmanage" modifyvm  "r-int" --nictype1 82540EM
-& "$vboxmanage" modifyvm  "r-int" --cableconnected1 on
-& "$vboxmanage" modifyvm  "r-int" --nicpromisc1 allow-all
-
-#interface 2
-& "$vboxmanage" modifyvm  "r-int" --nic2 intnet
-& "$vboxmanage" modifyvm  "r-int" --intnet2 "n-link"
-& "$vboxmanage" modifyvm  "r-int" --nictype2 82540EM
-& "$vboxmanage" modifyvm  "r-int" --cableconnected2 on
-& "$vboxmanage" modifyvm  "r-int" --nicpromisc2 allow-all
-
-#interface 3
-& "$vboxmanage" modifyvm  "r-int" --nic3 intnet
-& "$vboxmanage" modifyvm  "r-int" --intnet3 "n-wifi"
-& "$vboxmanage" modifyvm  "r-int" --nictype3 82540EM
-& "$vboxmanage" modifyvm  "r-int" --cableconnected3 on
-& "$vboxmanage" modifyvm  "r-int" --nicpromisc3 allow-all
-
-#interface 4
-& "$vboxmanage" modifyvm  "r-int" --nic4 intnet
-& "$vboxmanage" modifyvm  "r-int" --intnet4 "n-user"
-& "$vboxmanage" modifyvm  "r-int" --nictype4 82540EM
-& "$vboxmanage" modifyvm  "r-int" --cableconnected4 on
-& "$vboxmanage" modifyvm  "r-int" --nicpromisc4 allow-all
-
-#interface 5
-& "$vboxmanage" modifyvm  "r-int" --nic5 intnet
-& "$vboxmanage" modifyvm  "r-int" --intnet5 "n-infra"
-& "$vboxmanage" modifyvm  "r-int" --nictype5 82540EM
-& "$vboxmanage" modifyvm  "r-int" --cableconnected5 on
-& "$vboxmanage" modifyvm  "r-int" --nicpromisc5 allow-all
+	create_if $args[0] "int" 2 "n-link"
+	create_if $args[0] "int" 3 "n-wifi"
+	create_if $args[0] "int" 4 "n-user"
+	create_if $args[0] "int" 5 "n-infra"
 }
 
 elseif ($args[0] -eq "r-ext") {
 
-	create_vm($args[0])
-
-#interface 1
-& "$vboxmanage" modifyvm  "r-ext" --nic1 intnet
-& "$vboxmanage" modifyvm  "r-ext" --intnet1 "n-adm"
-& "$vboxmanage" modifyvm  "r-ext" --nictype1 82540EM
-& "$vboxmanage" modifyvm  "r-ext" --cableconnected1 on
-& "$vboxmanage" modifyvm  "r-ext" --nicpromisc1 allow-all
-
-#interface 2
-& "$vboxmanage" modifyvm  "r-ext" --nic2 intnet
-& "$vboxmanage" modifyvm  "r-ext" --intnet2 "n-dmz"
-& "$vboxmanage" modifyvm  "r-ext" --nictype2 82540EM
-& "$vboxmanage" modifyvm  "r-ext" --cableconnected2 on
-& "$vboxmanage" modifyvm  "r-ext" --nicpromisc2 allow-all
-
-#interface 3
-& "$vboxmanage" modifyvm  "r-ext" --nic3 bridged
-& "$vboxmanage" modifyvm  "r-ext" --nictype3 82540EM
-& "$vboxmanage" modifyvm  "r-ext" --cableconnected3 on
-& "$vboxmanage" modifyvm  "r-ext" --nicpromisc3 allow-all
-
-#interface 4
-& "$vboxmanage" modifyvm  "r-ext" --nic4 intnet
-& "$vboxmanage" modifyvm  "r-ext" --intnet4 "n-linkv"
-& "$vboxmanage" modifyvm  "r-ext" --nictype4 82540EM
-& "$vboxmanage" modifyvm  "r-ext" --cableconnected4 on
-& "$vboxmanage" modifyvm  "r-ext" --nicpromisc4 allow-all
-
-#interface 5
-& "$vboxmanage" modifyvm  "r-ext" --nic5 intnet
-& "$vboxmanage" modifyvm  "r-ext" --intnet5 "n-link"
-& "$vboxmanage" modifyvm  "r-ext" --nictype5 82540EM
-& "$vboxmanage" modifyvm  "r-ext" --cableconnected5 on
-& "$vboxmanage" modifyvm  "r-ext" --nicpromisc5 allow-all
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz"
+	create_if $args[0] "bridge" 3 "null"
+	create_if $args[0] "int" 4 "n-linkv"
+	create_if $args[0] "int" 5 "n-link"
 }
 
-elseif ($args[0] -eq "test") {
+elseif (((((((($args[0] -eq "s-elk") `
+-or ($args[0] -eq "s-mon") `
+-or ($args[0] -eq "s-backup") `
+-or ($args[0] -eq "s-appli") `
+-or ($args[0] -eq "s-infra") `
+-or ($args[0] -eq "s-proxy") `
+-or ($args[0] -eq "s-itil") `
+-or ($args[0] -eq "s-nxc") `
+))))))) {
 
-fonction1 $args[0] $args[1]
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-infra"
+}
+
+elseif ($args[0] -eq "s-fog") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-infra"
+	create_if $args[0] "int" 3 "n-user"
+}
+
+elseif ($args[0] -eq "s-agence") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-agence"
+}
+
+elseif ($args[0] -eq "s-lb") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz"
+	create_if $args[0] "int" 3 "n-dmz-lb"
+}
+
+elseif (($args[0] -eq "s-lb-db") -or ($args[0] -eq "s-nas")) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz-db"
+}
+
+elseif ((($args[0] -eq "s-lb-web1") -or ($args[0] -eq "s-lb-web2") -or ($args[0] -eq "s-lb-web3"))) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz-lb"
+	create_if $args[0] "int" 3 "n-dmz-db"
+}
+
+elseif (($args[0] -eq "s-dns-ext") -or ($args[0] -eq "s-web-ext")) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-infra"
+	create_if $args[0] "int" 3 "n-user"
+}
+
+elseif ($args[0] -eq "r-vp1") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-linkv"
+	create_if $args[0] "bridge" 3 "null"
+}
+
+elseif ($args[0] -eq "r-vp2") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-agence"
+	create_if $args[0] "bridge" 3 "null"
+}
+
+else {
+	usage
 }

scripts/r-vp1-post.sh

@@ -1,2 +1,5 @@
 #!/bin/bash
+#stoper le fw
+systemctl stop ferm
+#ouverture du service web pour copie distante
 cd /root/confwg/ && python3 -m http.server 8000 &

scripts/r-vp2-post.sh

@@ -1,3 +1,7 @@
 #!/bin/bash
-
+#recuperation du fichier de config
 wget http://r-vp1.gsb.adm:8000/wg0-b.qconf
+#renomage fichier et mv
+mv ./wg0-b.conf /etc/wireguard/wg0.conf
+#activation interface wg0
+systemctl enable wg-quick@wg0 && systemctl start wg-quick@wg0