Compare commits
No commits in common. "main" and "v0.0.3a-em" have entirely different histories.
main
...
v0.0.3a-em
47
README.md
47
README.md
@ -1,6 +1,6 @@
|
|||||||
# gsb2023
|
# gsb2023
|
||||||
|
|
||||||
2023-02-02 ps
|
2023-01-25 ps
|
||||||
|
|
||||||
Environnement et playbooks ansible pour le projet GSB 2023
|
Environnement et playbooks ansible pour le projet GSB 2023
|
||||||
|
|
||||||
@ -13,6 +13,7 @@ Prérequis :
|
|||||||
* **debian-buster-gsb-2023a.ova**
|
* **debian-buster-gsb-2023a.ova**
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
* **s-adm** : routeur adm, DHCP + NAT, deploiement, proxy squid
|
* **s-adm** : routeur adm, DHCP + NAT, deploiement, proxy squid
|
||||||
* **s-infra** : DNS maitre, autoconfiguration navigateurs avec **wpad**
|
* **s-infra** : DNS maitre, autoconfiguration navigateurs avec **wpad**
|
||||||
* **r-int** : routage, DHCP
|
* **r-int** : routage, DHCP
|
||||||
@ -33,7 +34,7 @@ Prérequis :
|
|||||||
* **s-lb-web1** : Serveur Wordpress 1 Load Balancer
|
* **s-lb-web1** : Serveur Wordpress 1 Load Balancer
|
||||||
* **s-lb-web2** : Serveur Wordpress 2 Load Balancer
|
* **s-lb-web2** : Serveur Wordpress 2 Load Balancer
|
||||||
* **s-lb-db** : Serveur Mariadb pour Wordpress
|
* **s-lb-db** : Serveur Mariadb pour Wordpress
|
||||||
* **s-nas** : Serveur NFS pour application Wordpress avec LB
|
* **s-lb-nfs** : Serveur NFS pour application Wordpress
|
||||||
|
|
||||||
|
|
||||||
## Les playbooks
|
## Les playbooks
|
||||||
@ -41,28 +42,15 @@ Prérequis :
|
|||||||
|
|
||||||
## Installation
|
## Installation
|
||||||
|
|
||||||
On utilisera les images de machines virtuelle suivantes :
|
On utilisera l'image de machine virtuelle suivante :
|
||||||
* **debian-bullseye-2023a.ova** (2023-01-06)
|
* **debian-bullseye-2023a.ova** (2023-01-06)
|
||||||
* Debian Bullseye 11.6 - 2 cartes - 1 Go - stockage 20 Go
|
* Debian Bullseye 11.6 - 2 cartes - 1 Go - stockage 20 Go
|
||||||
|
|
||||||
et pour **s-fog** :
|
|
||||||
* **debian-buster-2023a.ova** (2023-01-06)
|
|
||||||
* Debian Buster 10 - 2 cartes - 1 Go - stockage 20 Go
|
|
||||||
|
|
||||||
On utilsera le script (bash) **mkvm** ou (PowerShell) **mkvm.ps1** pour créeer une VM
|
|
||||||
|
|
||||||
```shell
|
|
||||||
gsb2023>
|
|
||||||
cd scripts
|
|
||||||
$ mkvm -r s-adm
|
|
||||||
|
|
||||||
```
|
|
||||||
|
|
||||||
### Machine s-adm
|
### Machine s-adm
|
||||||
* créer la machine virtuelle **s-adm** avec **mkvm** comme décrit plus haut.
|
* créer la machine virtuelle **s-adm** en important l'image ova décrite plus haut
|
||||||
* utiliser le script de renommage comme suit --> `bash chname <nouveau_nom_de_machine>` , puis redémarrer
|
* renommer la machine puis redémarrer
|
||||||
* utiliser le script **s-adm-start** : `bash s-adm-start` , puis redémarrer
|
* taper :
|
||||||
* ou sinon :
|
|
||||||
```shell
|
```shell
|
||||||
mkdir -p tools/ansible ; cd tools/ansible
|
mkdir -p tools/ansible ; cd tools/ansible
|
||||||
git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2023.git
|
git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2023.git
|
||||||
@ -78,11 +66,12 @@ $ mkvm -r s-adm
|
|||||||
|
|
||||||
### Pour chaque machine
|
### Pour chaque machine
|
||||||
|
|
||||||
- créer la machine avec **mkvm -r**, les cartes réseau sont paramétrées par **mkvm** selon les spécifications
|
- importer la machine à partir du fichier **.ova**
|
||||||
- utiliser le script de renommage comme suit : `bash chname <nouveau_nom_de_machine>`
|
- définir les cartes réseau en accord avec le plan d'adressage et le schéma
|
||||||
|
- donner le nom adapté (avec sed -i …)
|
||||||
- redémarrer
|
- redémarrer
|
||||||
- utiliser le script **gsb-start** : `bash gsb-start`
|
- mettre à jour les paquets : apt update && apt upgrade
|
||||||
- ou sinon:
|
- cloner le dépot :
|
||||||
```shell
|
```shell
|
||||||
mkdir -p tools/ansible ; cd tools/ansible
|
mkdir -p tools/ansible ; cd tools/ansible
|
||||||
git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2023.git
|
git clone https://gitea.lyc-lecastel.fr/gadmin/gsb2023.git
|
||||||
@ -92,18 +81,6 @@ bash gsbboot
|
|||||||
cd ../..
|
cd ../..
|
||||||
bash pull-config
|
bash pull-config
|
||||||
```
|
```
|
||||||
- redémarrer
|
|
||||||
- **Remarque** : une machine doit avoir été redémarrée pour prendre en charge la nouvelle configuration
|
- **Remarque** : une machine doit avoir été redémarrée pour prendre en charge la nouvelle configuration
|
||||||
|
|
||||||
|
|
||||||
## Les tests
|
|
||||||
|
|
||||||
Il peuvent êtres mis en oeuvre avec **goss** de la façon suivante : chaque machine installée dispose d'un fichier de test ad-hoc portant le nom de la machine elle-même (machine.yml).
|
|
||||||
|
|
||||||
```
|
|
||||||
cd tools/ansible/gsb2023
|
|
||||||
bash agoss # lance le test portant le nom de la machine
|
|
||||||
```
|
|
||||||
|
|
||||||
`bash agoss -f tap` permet de lancer le test avec le détail d'exécution
|
|
||||||
|
|
||||||
|
|||||||
@ -1,12 +0,0 @@
|
|||||||
cd goss/
|
|
||||||
goss -g r-vp1.yaml v
|
|
||||||
goss -g r-vp1.yaml aa wireguard
|
|
||||||
goss add interface enp0s3
|
|
||||||
goss add interface enp0s8
|
|
||||||
goss add interface enp0s9
|
|
||||||
goss add interface wg0
|
|
||||||
goss aa wireguard
|
|
||||||
goss add package wireguard-tools
|
|
||||||
goss add service wg-quick@wg0
|
|
||||||
goss add command "ping -c4 10.0.0.2"
|
|
||||||
goss add file "/etc/wireguard/wg0.conf"
|
|
||||||
@ -1,19 +1,39 @@
|
|||||||
command:
|
command:
|
||||||
ip route |grep default:
|
ip r:
|
||||||
exit-status: 0
|
exit-status: 0
|
||||||
stdout:
|
stdout:
|
||||||
- default via 172.16.128.254 dev enp0s8
|
- default via 172.16.128.254 dev enp0s8
|
||||||
|
- 172.16.128.0/24
|
||||||
|
- 192.168.99.0/24
|
||||||
stderr: []
|
stderr: []
|
||||||
timeout: 10000
|
timeout: 10000
|
||||||
ping -c4 172.16.0.1:
|
ping -c 2 172.16.128.254:
|
||||||
exit-status: 0
|
exit-status: 0
|
||||||
stdout:
|
stdout:
|
||||||
- 0% packet loss
|
- 0% packet loss
|
||||||
stderr: []
|
stderr: []
|
||||||
timeout: 10000
|
timeout: 10000
|
||||||
ping -c4 172.16.128.254:
|
ping -c 2 192.168.1.2:
|
||||||
exit-status: 0
|
exit-status: 0
|
||||||
stdout:
|
stdout:
|
||||||
- 0% packet loss
|
- 0% packet loss
|
||||||
|
stderr: []
|
||||||
|
timeout: 10000
|
||||||
|
ping -c 2 192.168.1.1:
|
||||||
|
exit-status: 0
|
||||||
|
stdout:
|
||||||
|
- 0% packet loss
|
||||||
|
stderr: []
|
||||||
|
timeout: 10000
|
||||||
|
ping -c 2 192.168.200.254:
|
||||||
|
exit-status: 0
|
||||||
|
stdout:
|
||||||
|
- 0% packet loss
|
||||||
|
stderr: []
|
||||||
|
timeout: 10000
|
||||||
|
ping -c 2 172.16.0.1:
|
||||||
|
exit-status: 0
|
||||||
|
stdout:
|
||||||
|
- 0% packet loss
|
||||||
stderr: []
|
stderr: []
|
||||||
timeout: 10000
|
timeout: 10000
|
||||||
|
|||||||
@ -1,26 +0,0 @@
|
|||||||
port:
|
|
||||||
tcp:5044:
|
|
||||||
listening: true
|
|
||||||
ip:
|
|
||||||
- 0.0.0.0
|
|
||||||
tcp:5601:
|
|
||||||
listening: true
|
|
||||||
ip:
|
|
||||||
- 0.0.0.0
|
|
||||||
tcp:9200:
|
|
||||||
listening: true
|
|
||||||
ip:
|
|
||||||
- 0.0.0.0
|
|
||||||
service:
|
|
||||||
docker:
|
|
||||||
enabled: true
|
|
||||||
running: true
|
|
||||||
interface:
|
|
||||||
enp0s3:
|
|
||||||
exists: true
|
|
||||||
addrs:
|
|
||||||
- 192.168.99.11/24
|
|
||||||
enp0s8:
|
|
||||||
exists: true
|
|
||||||
addrs:
|
|
||||||
- 172.16.0.11/24
|
|
||||||
@ -34,7 +34,7 @@ if [[ $? != 0 ]]; then
|
|||||||
${APT} install -y git-core
|
${APT} install -y git-core
|
||||||
fi
|
fi
|
||||||
${APT} update
|
${APT} update
|
||||||
#${APT} upgrade -y
|
${APT} upgrade -y
|
||||||
|
|
||||||
which ansible >> /dev/null
|
which ansible >> /dev/null
|
||||||
if [[ $? != 0 ]]; then
|
if [[ $? != 0 ]]; then
|
||||||
|
|||||||
@ -1,32 +1,24 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
## aa : 2023-01-18 15:25
|
## aa : 2023-04-18 15:25
|
||||||
## ps : 2023-02-01 15:25
|
|
||||||
|
|
||||||
set -o errexit
|
set -o errexit
|
||||||
set -o pipefail
|
set -o pipefail
|
||||||
GITUSR=gitgsb
|
GITUSR=gitgsb
|
||||||
GITPRJ=gsb2023
|
GITPRJ=gsb2023
|
||||||
apt-get update
|
apt update && apt upgrade
|
||||||
apt-get install -y apache2 git
|
apt install -y apache2 git
|
||||||
STOREREP="/var/www/html/gsbstore"
|
STOREREP="/var/www/html/gsbstore"
|
||||||
|
|
||||||
GLPIREL=10.0.6
|
GLPIREL=10.0.5
|
||||||
str="wget -nc https://github.com/glpi-project/glpi/releases/download/${GLPIREL}/glpi-${GLPIREL}.tgz"
|
str="wget -nc https://github.com/glpi-project/glpi/releases/download/${GLPIREL}/glpi-${GLPIREL}.tgz"
|
||||||
|
|
||||||
|
FIREL=10.0.3+1.0
|
||||||
|
str2="https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi${FIREL}/fusioninventory-${FIREL}.tar.bz2"
|
||||||
|
|
||||||
#Fusion Inventory
|
FIAGREL=2.6
|
||||||
|
str31="wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x64_${FIAGREL}.exe"
|
||||||
#FIREL=10.0.3+1.0
|
|
||||||
#str2="https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi${FIREL}/fusioninventory-${FIREL}.tar.bz2"
|
|
||||||
|
|
||||||
|
|
||||||
#GLPI Agent
|
|
||||||
|
|
||||||
GLPIAGVER=1.4
|
|
||||||
str31="wget -nc https://github.com/glpi-project/glpi-agent/releases/download/${GLPIAGVER}/GLPI-Agent-${GLPIAGVER}-x64.msi"
|
|
||||||
|
|
||||||
str32="wget -nc https://github.com/glpi-project/glpi-agent/releases/download/${GLPIAGVER}/GLPI-Agent-${GLPIAGVER}-x86.msi"
|
|
||||||
|
|
||||||
|
str32="wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x86_${FIAGREL}.exe"
|
||||||
|
|
||||||
FOGREL=1.5.9
|
FOGREL=1.5.9
|
||||||
str4="wget -nc https://github.com/FOGProject/fogproject/archive/${FOGREL}.tar.gz -O fogproject-${FOGREL}.tar.gz"
|
str4="wget -nc https://github.com/FOGProject/fogproject/archive/${FOGREL}.tar.gz -O fogproject-${FOGREL}.tar.gz"
|
||||||
@ -45,9 +37,7 @@ str6="curl -L https://github.com/aelsabbahy/goss/releases/download/${GOSSVER}/go
|
|||||||
#str8="wget -nc 'https://gestsup.fr/index.php?page=download&channel=stable&version=${GESTSUPREL}&type=gestsup' -O gestsup_${GESTSUPREL}.zip"
|
#str8="wget -nc 'https://gestsup.fr/index.php?page=download&channel=stable&version=${GESTSUPREL}&type=gestsup' -O gestsup_${GESTSUPREL}.zip"
|
||||||
str8="wget -nc 'https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.30&type=gestsup' -O gestsup_3.2.30.zip"
|
str8="wget -nc 'https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.30&type=gestsup' -O gestsup_3.2.30.zip"
|
||||||
|
|
||||||
|
ELKREL=8.6.0
|
||||||
#METRICBEAT ET FILEBEAT
|
|
||||||
ELKREL=8.5.3
|
|
||||||
str81="wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${ELKREL}-amd64.deb"
|
str81="wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${ELKREL}-amd64.deb"
|
||||||
|
|
||||||
str82="wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${ELKREL}-windows-x86_64.zip"
|
str82="wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${ELKREL}-windows-x86_64.zip"
|
||||||
|
|||||||
13
r-vp1-fw.yml
13
r-vp1-fw.yml
@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
connection: local
|
|
||||||
|
|
||||||
vars:
|
|
||||||
- ip1: 192.168.0.51
|
|
||||||
- remip: 192.168.0.52
|
|
||||||
- mynet: 192.168.1.0
|
|
||||||
- remnet: 172.16.128.0
|
|
||||||
|
|
||||||
roles:
|
|
||||||
- fw-ferm
|
|
||||||
|
|
||||||
@ -12,8 +12,9 @@
|
|||||||
- base
|
- base
|
||||||
- goss
|
- goss
|
||||||
# - snmp-agent
|
# - snmp-agent
|
||||||
- post
|
# - firewall-vpn-r
|
||||||
- wireguard-r
|
- wireguard-r
|
||||||
|
# - x509-r
|
||||||
- ssh-cli
|
- ssh-cli
|
||||||
- syslog-cli
|
- syslog-cli
|
||||||
|
- post
|
||||||
|
|||||||
12
r-vp2-fw.yml
12
r-vp2-fw.yml
@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: localhost
|
|
||||||
connection: local
|
|
||||||
|
|
||||||
vars:
|
|
||||||
- ip1: 192.168.0.52
|
|
||||||
- remip: 192.168.0.51
|
|
||||||
- mynet: 172.16.128.0
|
|
||||||
- remnet: 192.168.1.0
|
|
||||||
|
|
||||||
roles:
|
|
||||||
- fw-ferm
|
|
||||||
@ -15,7 +15,9 @@
|
|||||||
- dns-agence
|
- dns-agence
|
||||||
- ssh-root-access
|
- ssh-root-access
|
||||||
# - snmp-agent
|
# - snmp-agent
|
||||||
|
# - firewall-vpn-l
|
||||||
- wireguard-l
|
- wireguard-l
|
||||||
- post
|
# - x509-l
|
||||||
- ssh-cli
|
- ssh-cli
|
||||||
- syslog-cli
|
- syslog-cli
|
||||||
|
- post
|
||||||
|
|||||||
@ -26,9 +26,7 @@
|
|||||||
192.168.99.101 s-lb-web1.gsb.adm
|
192.168.99.101 s-lb-web1.gsb.adm
|
||||||
192.168.99.102 s-lb-web2.gsb.adm
|
192.168.99.102 s-lb-web2.gsb.adm
|
||||||
192.168.99.103 s-lb-web3.gsb.adm
|
192.168.99.103 s-lb-web3.gsb.adm
|
||||||
192.168.99.112 r-vp1.gsb.adm
|
|
||||||
192.168.99.102 r-vp2.gsb.adm
|
|
||||||
192.168.99.120 s-peertube.gsb.adm
|
|
||||||
|
|
||||||
192.168.99.8 syslog.gsb.adm
|
192.168.99.8 syslog.gsb.adm
|
||||||
|
|
||||||
|
|||||||
@ -25,8 +25,6 @@
|
|||||||
192.168.99.101 s-lb-web1.gsb.adm
|
192.168.99.101 s-lb-web1.gsb.adm
|
||||||
192.168.99.102 s-lb-web2.gsb.adm
|
192.168.99.102 s-lb-web2.gsb.adm
|
||||||
192.168.99.103 s-lb-web3.gsb.adm
|
192.168.99.103 s-lb-web3.gsb.adm
|
||||||
192.168.99.112 r-vp1.gsb.adm
|
|
||||||
192.168.99.102 r-vp2.gsb.adm
|
|
||||||
192.168.99.120 s-peertube.gsb.adm
|
|
||||||
192.168.99.8 syslog.gsb.adm
|
192.168.99.8 syslog.gsb.adm
|
||||||
|
|
||||||
|
|||||||
@ -109,12 +109,12 @@ log-facility local7;
|
|||||||
#DHCP pour le réseau wifi
|
#DHCP pour le réseau wifi
|
||||||
#subnet 172.16.65.0 netmask 255.255.255.0 {
|
#subnet 172.16.65.0 netmask 255.255.255.0 {
|
||||||
# range 172.16.65.1 172.16.65.100;
|
# range 172.16.65.1 172.16.65.100;
|
||||||
# option domain-name-servers ns1.internal.example.org;
|
# option domain-name-servers ns1.internal.example.org;
|
||||||
# option domain-name "internal.example.org";
|
# option domain-name "internal.example.org";
|
||||||
# option routers 10.5.5.1;
|
# option routers 10.5.5.1;
|
||||||
# option broadcast-address 10.5.5.31;
|
# option broadcast-address 10.5.5.31;
|
||||||
# default-lease-time 600;
|
# default-lease-time 600;
|
||||||
# max-lease-time 7200;
|
# max-lease-time 7200;
|
||||||
#}
|
#}
|
||||||
|
|
||||||
#DHCP pour le réseau USER
|
#DHCP pour le réseau USER
|
||||||
|
|||||||
@ -10,3 +10,5 @@
|
|||||||
copy: src=dhcpd.conf dest=/etc/dhcp/
|
copy: src=dhcpd.conf dest=/etc/dhcp/
|
||||||
notify:
|
notify:
|
||||||
- restart isc-dhcp-server
|
- restart isc-dhcp-server
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
23
roles/dns-ag-cs/files/named.conf.options
Normal file
23
roles/dns-ag-cs/files/named.conf.options
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
// 0.2 - putconf - vendredi 12 avril 2013, 08:54:33 (UTC+0200)
|
||||||
|
|
||||||
|
options {
|
||||||
|
directory "/var/cache/bind";
|
||||||
|
|
||||||
|
// If there is a firewall between you and nameservers you want
|
||||||
|
// to talk to, you may need to fix the firewall to allow multiple
|
||||||
|
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
|
||||||
|
|
||||||
|
// If your ISP provided one or more IP addresses for stable
|
||||||
|
// nameservers, you probably want to use them as forwarders.
|
||||||
|
// Uncomment the following block, and insert the addresses replacing
|
||||||
|
// the all-0's placeholder.
|
||||||
|
|
||||||
|
forwarders {
|
||||||
|
172.16.0.1;
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
auth-nxdomain no; # conform to RFC1035
|
||||||
|
listen-on-v6 { any; };
|
||||||
|
};
|
||||||
|
|
||||||
4
roles/dns-ag-cs/handlers/main.yml
Normal file
4
roles/dns-ag-cs/handlers/main.yml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
---
|
||||||
|
- name: restart bind9
|
||||||
|
service: name=bind9 state=restarted
|
||||||
|
|
||||||
11
roles/dns-ag-cs/tasks/main.yml
Normal file
11
roles/dns-ag-cs/tasks/main.yml
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Installation bind9
|
||||||
|
apt: name=bind9 state=present update_cache=yes
|
||||||
|
|
||||||
|
- name: Copie named.conf.options
|
||||||
|
copy: src=named.conf.options dest=/etc/bind
|
||||||
|
notify:
|
||||||
|
- restart bind9
|
||||||
|
|
||||||
|
|
||||||
@ -5,7 +5,7 @@
|
|||||||
;
|
;
|
||||||
$TTL 604800
|
$TTL 604800
|
||||||
@ IN SOA s-infra.gsb.lan. root.s-infra.gsb.lan. (
|
@ IN SOA s-infra.gsb.lan. root.s-infra.gsb.lan. (
|
||||||
2023051000 ; Serial
|
2023012500 ; Serial
|
||||||
7200 ; Refresh
|
7200 ; Refresh
|
||||||
86400 ; Retry
|
86400 ; Retry
|
||||||
8419200 ; Expire
|
8419200 ; Expire
|
||||||
@ -36,5 +36,3 @@ s-web2 IN A 192.168.101.2
|
|||||||
s-lb.gsb.lan IN A 192.168.100.10
|
s-lb.gsb.lan IN A 192.168.100.10
|
||||||
ns IN CNAME s-infra.gsb.lan.
|
ns IN CNAME s-infra.gsb.lan.
|
||||||
wpad IN CNAME s-infra.gsb.lan.
|
wpad IN CNAME s-infra.gsb.lan.
|
||||||
s-peertube IN A 192.168.100.20
|
|
||||||
peertube IN CNAME s-peertube
|
|
||||||
|
|||||||
@ -5,7 +5,7 @@
|
|||||||
;
|
;
|
||||||
$TTL 604800
|
$TTL 604800
|
||||||
@ IN SOA s-infra.gsb.lan. root.s-infra.gsb.lan. (
|
@ IN SOA s-infra.gsb.lan. root.s-infra.gsb.lan. (
|
||||||
2023040501 ; Serial
|
2023012500 ; Serial
|
||||||
7200 ; Refresh
|
7200 ; Refresh
|
||||||
86400 ; Retry
|
86400 ; Retry
|
||||||
8419200 ; Expire
|
8419200 ; Expire
|
||||||
@ -28,3 +28,4 @@ $TTL 604800
|
|||||||
11.0 IN PTR s-elk.gsb.lan.
|
11.0 IN PTR s-elk.gsb.lan.
|
||||||
17.0 IN PTR s-gestsup.lan
|
17.0 IN PTR s-gestsup.lan
|
||||||
254.0 IN PTR r-int.gsb.lan.
|
254.0 IN PTR r-int.gsb.lan.
|
||||||
|
|
||||||
|
|||||||
@ -1,9 +1,8 @@
|
|||||||
## Principe du rôle elk
|
## Principe du rôle elk
|
||||||
ELK 8.5.3
|
|
||||||
|
|
||||||
Ce rôle permet de créer un serveur ELK pour centraliser les logs et de des métriques pour simplifier la gestion du parc informatique GSB.
|
Ce rôle permet de créer un serveur ELK pour centraliser les logs et d'avoir des métriques pour simplifier la gestion du parc informatique GSB.
|
||||||
Le principe de ce rôle est d'installer docker, les différentes tâches de ce rôle sont de :
|
Le principe de se rôle est d'installer docker, les différentes tâches de se rôle est de :
|
||||||
- Vérifier si ELK est déjà installé,
|
Vérifier si ELK est déjà installé,
|
||||||
- Importation un docker-compose depuis github,
|
Installer ELK sur github,
|
||||||
- Changement la configuration pour passer en version 'basic'
|
Changer la configuration
|
||||||
- Lancement d'ELK avec docker-compose
|
Lancer ELK avec docker-compose
|
||||||
|
|||||||
502
roles/elk/files/get_docker.sh
Executable file
502
roles/elk/files/get_docker.sh
Executable file
@ -0,0 +1,502 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
set -e
|
||||||
|
# Docker CE for Linux installation script
|
||||||
|
#
|
||||||
|
# See https://docs.docker.com/install/ for the installation steps.
|
||||||
|
#
|
||||||
|
# This script is meant for quick & easy install via:
|
||||||
|
# $ curl -fsSL https://get.docker.com -o get-docker.sh
|
||||||
|
# $ sh get-docker.sh
|
||||||
|
#
|
||||||
|
# For test builds (ie. release candidates):
|
||||||
|
# $ curl -fsSL https://test.docker.com -o test-docker.sh
|
||||||
|
# $ sh test-docker.sh
|
||||||
|
#
|
||||||
|
# NOTE: Make sure to verify the contents of the script
|
||||||
|
# you downloaded matches the contents of install.sh
|
||||||
|
# located at https://github.com/docker/docker-install
|
||||||
|
# before executing.
|
||||||
|
#
|
||||||
|
# Git commit from https://github.com/docker/docker-install when
|
||||||
|
# the script was uploaded (Should only be modified by upload job):
|
||||||
|
SCRIPT_COMMIT_SHA="3d8fe77c2c46c5b7571f94b42793905e5b3e42e4"
|
||||||
|
|
||||||
|
|
||||||
|
# The channel to install from:
|
||||||
|
# * nightly
|
||||||
|
# * test
|
||||||
|
# * stable
|
||||||
|
# * edge (deprecated)
|
||||||
|
DEFAULT_CHANNEL_VALUE="stable"
|
||||||
|
if [ -z "$CHANNEL" ]; then
|
||||||
|
CHANNEL=$DEFAULT_CHANNEL_VALUE
|
||||||
|
fi
|
||||||
|
|
||||||
|
DEFAULT_DOWNLOAD_URL="https://download.docker.com"
|
||||||
|
if [ -z "$DOWNLOAD_URL" ]; then
|
||||||
|
DOWNLOAD_URL=$DEFAULT_DOWNLOAD_URL
|
||||||
|
fi
|
||||||
|
|
||||||
|
DEFAULT_REPO_FILE="docker-ce.repo"
|
||||||
|
if [ -z "$REPO_FILE" ]; then
|
||||||
|
REPO_FILE="$DEFAULT_REPO_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
mirror=''
|
||||||
|
DRY_RUN=${DRY_RUN:-}
|
||||||
|
while [ $# -gt 0 ]; do
|
||||||
|
case "$1" in
|
||||||
|
--mirror)
|
||||||
|
mirror="$2"
|
||||||
|
shift
|
||||||
|
;;
|
||||||
|
--dry-run)
|
||||||
|
DRY_RUN=1
|
||||||
|
;;
|
||||||
|
--*)
|
||||||
|
echo "Illegal option $1"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift $(( $# > 0 ? 1 : 0 ))
|
||||||
|
done
|
||||||
|
|
||||||
|
case "$mirror" in
|
||||||
|
Aliyun)
|
||||||
|
DOWNLOAD_URL="https://mirrors.aliyun.com/docker-ce"
|
||||||
|
;;
|
||||||
|
AzureChinaCloud)
|
||||||
|
DOWNLOAD_URL="https://mirror.azure.cn/docker-ce"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
command_exists() {
|
||||||
|
command -v "$@" > /dev/null 2>&1
|
||||||
|
}
|
||||||
|
|
||||||
|
is_dry_run() {
|
||||||
|
if [ -z "$DRY_RUN" ]; then
|
||||||
|
return 1
|
||||||
|
else
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
is_wsl() {
|
||||||
|
case "$(uname -r)" in
|
||||||
|
*microsoft* ) true ;; # WSL 2
|
||||||
|
*Microsoft* ) true ;; # WSL 1
|
||||||
|
* ) false;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
is_darwin() {
|
||||||
|
case "$(uname -s)" in
|
||||||
|
*darwin* ) true ;;
|
||||||
|
*Darwin* ) true ;;
|
||||||
|
* ) false;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
deprecation_notice() {
|
||||||
|
distro=$1
|
||||||
|
date=$2
|
||||||
|
echo
|
||||||
|
echo "DEPRECATION WARNING:"
|
||||||
|
echo " The distribution, $distro, will no longer be supported in this script as of $date."
|
||||||
|
echo " If you feel this is a mistake please submit an issue at https://github.com/docker/docker-install/issues/new"
|
||||||
|
echo
|
||||||
|
sleep 10
|
||||||
|
}
|
||||||
|
|
||||||
|
get_distribution() {
|
||||||
|
lsb_dist=""
|
||||||
|
# Every system that we officially support has /etc/os-release
|
||||||
|
if [ -r /etc/os-release ]; then
|
||||||
|
lsb_dist="$(. /etc/os-release && echo "$ID")"
|
||||||
|
fi
|
||||||
|
# Returning an empty string here should be alright since the
|
||||||
|
# case statements don't act unless you provide an actual value
|
||||||
|
echo "$lsb_dist"
|
||||||
|
}
|
||||||
|
|
||||||
|
add_debian_backport_repo() {
|
||||||
|
debian_version="$1"
|
||||||
|
backports="deb http://ftp.debian.org/debian $debian_version-backports main"
|
||||||
|
if ! grep -Fxq "$backports" /etc/apt/sources.list; then
|
||||||
|
(set -x; $sh_c "echo \"$backports\" >> /etc/apt/sources.list")
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo_docker_as_nonroot() {
|
||||||
|
if is_dry_run; then
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
if command_exists docker && [ -e /var/run/docker.sock ]; then
|
||||||
|
(
|
||||||
|
set -x
|
||||||
|
$sh_c 'docker version'
|
||||||
|
) || true
|
||||||
|
fi
|
||||||
|
your_user=your-user
|
||||||
|
[ "$user" != 'root' ] && your_user="$user"
|
||||||
|
# intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output
|
||||||
|
echo "If you would like to use Docker as a non-root user, you should now consider"
|
||||||
|
echo "adding your user to the \"docker\" group with something like:"
|
||||||
|
echo
|
||||||
|
echo " sudo usermod -aG docker $your_user"
|
||||||
|
echo
|
||||||
|
echo "Remember that you will have to log out and back in for this to take effect!"
|
||||||
|
echo
|
||||||
|
echo "WARNING: Adding a user to the \"docker\" group will grant the ability to run"
|
||||||
|
echo " containers which can be used to obtain root privileges on the"
|
||||||
|
echo " docker host."
|
||||||
|
echo " Refer to https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface"
|
||||||
|
echo " for more information."
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check if this is a forked Linux distro
|
||||||
|
check_forked() {
|
||||||
|
|
||||||
|
# Check for lsb_release command existence, it usually exists in forked distros
|
||||||
|
if command_exists lsb_release; then
|
||||||
|
# Check if the `-u` option is supported
|
||||||
|
set +e
|
||||||
|
lsb_release -a -u > /dev/null 2>&1
|
||||||
|
lsb_release_exit_code=$?
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Check if the command has exited successfully, it means we're in a forked distro
|
||||||
|
if [ "$lsb_release_exit_code" = "0" ]; then
|
||||||
|
# Print info about current distro
|
||||||
|
cat <<-EOF
|
||||||
|
You're using '$lsb_dist' version '$dist_version'.
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Get the upstream release info
|
||||||
|
lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[:space:]')
|
||||||
|
dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[:space:]')
|
||||||
|
|
||||||
|
# Print info about upstream distro
|
||||||
|
cat <<-EOF
|
||||||
|
Upstream release is '$lsb_dist' version '$dist_version'.
|
||||||
|
EOF
|
||||||
|
else
|
||||||
|
if [ -r /etc/debian_version ] && [ "$lsb_dist" != "ubuntu" ] && [ "$lsb_dist" != "raspbian" ]; then
|
||||||
|
if [ "$lsb_dist" = "osmc" ]; then
|
||||||
|
# OSMC runs Raspbian
|
||||||
|
lsb_dist=raspbian
|
||||||
|
else
|
||||||
|
# We're Debian and don't even know it!
|
||||||
|
lsb_dist=debian
|
||||||
|
fi
|
||||||
|
dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
|
||||||
|
case "$dist_version" in
|
||||||
|
10)
|
||||||
|
dist_version="buster"
|
||||||
|
;;
|
||||||
|
9)
|
||||||
|
dist_version="stretch"
|
||||||
|
;;
|
||||||
|
8|'Kali Linux 2')
|
||||||
|
dist_version="jessie"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
semverParse() {
|
||||||
|
major="${1%%.*}"
|
||||||
|
minor="${1#$major.}"
|
||||||
|
minor="${minor%%.*}"
|
||||||
|
patch="${1#$major.$minor.}"
|
||||||
|
patch="${patch%%[-.]*}"
|
||||||
|
}
|
||||||
|
|
||||||
|
do_install() {
|
||||||
|
echo "# Executing docker install script, commit: $SCRIPT_COMMIT_SHA"
|
||||||
|
|
||||||
|
if command_exists docker; then
|
||||||
|
docker_version="$(docker -v | cut -d ' ' -f3 | cut -d ',' -f1)"
|
||||||
|
MAJOR_W=1
|
||||||
|
MINOR_W=10
|
||||||
|
|
||||||
|
semverParse "$docker_version"
|
||||||
|
|
||||||
|
shouldWarn=0
|
||||||
|
if [ "$major" -lt "$MAJOR_W" ]; then
|
||||||
|
shouldWarn=1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$major" -le "$MAJOR_W" ] && [ "$minor" -lt "$MINOR_W" ]; then
|
||||||
|
shouldWarn=1
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat >&2 <<-'EOF'
|
||||||
|
Warning: the "docker" command appears to already exist on this system.
|
||||||
|
|
||||||
|
If you already have Docker installed, this script can cause trouble, which is
|
||||||
|
why we're displaying this warning and provide the opportunity to cancel the
|
||||||
|
installation.
|
||||||
|
|
||||||
|
If you installed the current Docker package using this script and are using it
|
||||||
|
EOF
|
||||||
|
|
||||||
|
if [ $shouldWarn -eq 1 ]; then
|
||||||
|
cat >&2 <<-'EOF'
|
||||||
|
again to update Docker, we urge you to migrate your image store before upgrading
|
||||||
|
to v1.10+.
|
||||||
|
|
||||||
|
You can find instructions for this here:
|
||||||
|
https://github.com/docker/docker/wiki/Engine-v1.10.0-content-addressability-migration
|
||||||
|
EOF
|
||||||
|
else
|
||||||
|
cat >&2 <<-'EOF'
|
||||||
|
again to update Docker, you can safely ignore this message.
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat >&2 <<-'EOF'
|
||||||
|
|
||||||
|
You may press Ctrl+C now to abort this script.
|
||||||
|
EOF
|
||||||
|
( set -x; sleep 20 )
|
||||||
|
fi
|
||||||
|
|
||||||
|
user="$(id -un 2>/dev/null || true)"
|
||||||
|
|
||||||
|
sh_c='sh -c'
|
||||||
|
if [ "$user" != 'root' ]; then
|
||||||
|
if command_exists sudo; then
|
||||||
|
sh_c='sudo -E sh -c'
|
||||||
|
elif command_exists su; then
|
||||||
|
sh_c='su -c'
|
||||||
|
else
|
||||||
|
cat >&2 <<-'EOF'
|
||||||
|
Error: this installer needs the ability to run commands as root.
|
||||||
|
We are unable to find either "sudo" or "su" available to make this happen.
|
||||||
|
EOF
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if is_dry_run; then
|
||||||
|
sh_c="echo"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# perform some very rudimentary platform detection
|
||||||
|
lsb_dist=$( get_distribution )
|
||||||
|
lsb_dist="$(echo "$lsb_dist" | tr '[:upper:]' '[:lower:]')"
|
||||||
|
|
||||||
|
if is_wsl; then
|
||||||
|
echo
|
||||||
|
echo "WSL DETECTED: We recommend using Docker Desktop for Windows."
|
||||||
|
echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop"
|
||||||
|
echo
|
||||||
|
cat >&2 <<-'EOF'
|
||||||
|
|
||||||
|
You may press Ctrl+C now to abort this script.
|
||||||
|
EOF
|
||||||
|
( set -x; sleep 20 )
|
||||||
|
fi
|
||||||
|
|
||||||
|
case "$lsb_dist" in
|
||||||
|
|
||||||
|
ubuntu)
|
||||||
|
if command_exists lsb_release; then
|
||||||
|
dist_version="$(lsb_release --codename | cut -f2)"
|
||||||
|
fi
|
||||||
|
if [ -z "$dist_version" ] && [ -r /etc/lsb-release ]; then
|
||||||
|
dist_version="$(. /etc/lsb-release && echo "$DISTRIB_CODENAME")"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
debian|raspbian)
|
||||||
|
dist_version="$(sed 's/\/.*//' /etc/debian_version | sed 's/\..*//')"
|
||||||
|
case "$dist_version" in
|
||||||
|
10)
|
||||||
|
dist_version="buster"
|
||||||
|
;;
|
||||||
|
9)
|
||||||
|
dist_version="stretch"
|
||||||
|
;;
|
||||||
|
8)
|
||||||
|
dist_version="jessie"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
;;
|
||||||
|
|
||||||
|
centos|rhel)
|
||||||
|
if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
|
||||||
|
dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
if command_exists lsb_release; then
|
||||||
|
dist_version="$(lsb_release --release | cut -f2)"
|
||||||
|
fi
|
||||||
|
if [ -z "$dist_version" ] && [ -r /etc/os-release ]; then
|
||||||
|
dist_version="$(. /etc/os-release && echo "$VERSION_ID")"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Check if this is a forked Linux distro
|
||||||
|
check_forked
|
||||||
|
|
||||||
|
# Run setup for each distro accordingly
|
||||||
|
case "$lsb_dist" in
|
||||||
|
ubuntu|debian|raspbian)
|
||||||
|
pre_reqs="apt-transport-https ca-certificates curl"
|
||||||
|
if [ "$lsb_dist" = "debian" ]; then
|
||||||
|
# libseccomp2 does not exist for debian jessie main repos for aarch64
|
||||||
|
if [ "$(uname -m)" = "aarch64" ] && [ "$dist_version" = "jessie" ]; then
|
||||||
|
add_debian_backport_repo "$dist_version"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! command -v gpg > /dev/null; then
|
||||||
|
pre_reqs="$pre_reqs gnupg"
|
||||||
|
fi
|
||||||
|
apt_repo="deb [arch=$(dpkg --print-architecture)] $DOWNLOAD_URL/linux/$lsb_dist $dist_version $CHANNEL"
|
||||||
|
(
|
||||||
|
if ! is_dry_run; then
|
||||||
|
set -x
|
||||||
|
fi
|
||||||
|
$sh_c 'apt-get update -qq >/dev/null'
|
||||||
|
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq $pre_reqs >/dev/null"
|
||||||
|
$sh_c "curl -fsSL \"$DOWNLOAD_URL/linux/$lsb_dist/gpg\" | apt-key add -qq - >/dev/null"
|
||||||
|
$sh_c "echo \"$apt_repo\" > /etc/apt/sources.list.d/docker.list"
|
||||||
|
$sh_c 'apt-get update -qq >/dev/null'
|
||||||
|
)
|
||||||
|
pkg_version=""
|
||||||
|
if [ -n "$VERSION" ]; then
|
||||||
|
if is_dry_run; then
|
||||||
|
echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
|
||||||
|
else
|
||||||
|
# Will work for incomplete versions IE (17.12), but may not actually grab the "latest" if in the test channel
|
||||||
|
pkg_pattern="$(echo "$VERSION" | sed "s/-ce-/~ce~.*/g" | sed "s/-/.*/g").*-0~$lsb_dist"
|
||||||
|
search_command="apt-cache madison 'docker-ce' | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3"
|
||||||
|
pkg_version="$($sh_c "$search_command")"
|
||||||
|
echo "INFO: Searching repository for VERSION '$VERSION'"
|
||||||
|
echo "INFO: $search_command"
|
||||||
|
if [ -z "$pkg_version" ]; then
|
||||||
|
echo
|
||||||
|
echo "ERROR: '$VERSION' not found amongst apt-cache madison results"
|
||||||
|
echo
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
search_command="apt-cache madison 'docker-ce-cli' | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3"
|
||||||
|
# Don't insert an = for cli_pkg_version, we'll just include it later
|
||||||
|
cli_pkg_version="$($sh_c "$search_command")"
|
||||||
|
pkg_version="=$pkg_version"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
(
|
||||||
|
if ! is_dry_run; then
|
||||||
|
set -x
|
||||||
|
fi
|
||||||
|
if [ -n "$cli_pkg_version" ]; then
|
||||||
|
$sh_c "apt-get install -y -qq --no-install-recommends docker-ce-cli=$cli_pkg_version >/dev/null"
|
||||||
|
fi
|
||||||
|
$sh_c "apt-get install -y -qq --no-install-recommends docker-ce$pkg_version >/dev/null"
|
||||||
|
)
|
||||||
|
echo_docker_as_nonroot
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
centos|fedora|rhel)
|
||||||
|
yum_repo="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
|
||||||
|
if ! curl -Ifs "$yum_repo" > /dev/null; then
|
||||||
|
echo "Error: Unable to curl repository file $yum_repo, is it valid?"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [ "$lsb_dist" = "fedora" ]; then
|
||||||
|
pkg_manager="dnf"
|
||||||
|
config_manager="dnf config-manager"
|
||||||
|
enable_channel_flag="--set-enabled"
|
||||||
|
disable_channel_flag="--set-disabled"
|
||||||
|
pre_reqs="dnf-plugins-core"
|
||||||
|
pkg_suffix="fc$dist_version"
|
||||||
|
else
|
||||||
|
pkg_manager="yum"
|
||||||
|
config_manager="yum-config-manager"
|
||||||
|
enable_channel_flag="--enable"
|
||||||
|
disable_channel_flag="--disable"
|
||||||
|
pre_reqs="yum-utils"
|
||||||
|
pkg_suffix="el"
|
||||||
|
fi
|
||||||
|
(
|
||||||
|
if ! is_dry_run; then
|
||||||
|
set -x
|
||||||
|
fi
|
||||||
|
$sh_c "$pkg_manager install -y -q $pre_reqs"
|
||||||
|
$sh_c "$config_manager --add-repo $yum_repo"
|
||||||
|
|
||||||
|
if [ "$CHANNEL" != "stable" ]; then
|
||||||
|
$sh_c "$config_manager $disable_channel_flag docker-ce-*"
|
||||||
|
$sh_c "$config_manager $enable_channel_flag docker-ce-$CHANNEL"
|
||||||
|
fi
|
||||||
|
$sh_c "$pkg_manager makecache"
|
||||||
|
)
|
||||||
|
pkg_version=""
|
||||||
|
if [ -n "$VERSION" ]; then
|
||||||
|
if is_dry_run; then
|
||||||
|
echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
|
||||||
|
else
|
||||||
|
pkg_pattern="$(echo "$VERSION" | sed "s/-ce-/\\\\.ce.*/g" | sed "s/-/.*/g").*$pkg_suffix"
|
||||||
|
search_command="$pkg_manager list --showduplicates 'docker-ce' | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
|
||||||
|
pkg_version="$($sh_c "$search_command")"
|
||||||
|
echo "INFO: Searching repository for VERSION '$VERSION'"
|
||||||
|
echo "INFO: $search_command"
|
||||||
|
if [ -z "$pkg_version" ]; then
|
||||||
|
echo
|
||||||
|
echo "ERROR: '$VERSION' not found amongst $pkg_manager list results"
|
||||||
|
echo
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
search_command="$pkg_manager list --showduplicates 'docker-ce-cli' | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
|
||||||
|
# It's okay for cli_pkg_version to be blank, since older versions don't support a cli package
|
||||||
|
cli_pkg_version="$($sh_c "$search_command" | cut -d':' -f 2)"
|
||||||
|
# Cut out the epoch and prefix with a '-'
|
||||||
|
pkg_version="-$(echo "$pkg_version" | cut -d':' -f 2)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
(
|
||||||
|
if ! is_dry_run; then
|
||||||
|
set -x
|
||||||
|
fi
|
||||||
|
# install the correct cli version first
|
||||||
|
if [ -n "$cli_pkg_version" ]; then
|
||||||
|
$sh_c "$pkg_manager install -y -q docker-ce-cli-$cli_pkg_version"
|
||||||
|
fi
|
||||||
|
$sh_c "$pkg_manager install -y -q docker-ce$pkg_version"
|
||||||
|
)
|
||||||
|
echo_docker_as_nonroot
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
if [ -z "$lsb_dist" ]; then
|
||||||
|
if is_darwin; then
|
||||||
|
echo
|
||||||
|
echo "ERROR: Unsupported operating system 'macOS'"
|
||||||
|
echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop"
|
||||||
|
echo
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
echo
|
||||||
|
echo "ERROR: Unsupported distribution '$lsb_dist'"
|
||||||
|
echo
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# wrapped up in a function so that we have some protection against only getting
|
||||||
|
# half the file during "curl | sh"
|
||||||
|
do_install
|
||||||
@ -22,6 +22,6 @@
|
|||||||
replace: 'xpack.license.self_generated.type: basic'
|
replace: 'xpack.license.self_generated.type: basic'
|
||||||
|
|
||||||
- name: Execution du fichier docker-compose.yml
|
- name: Execution du fichier docker-compose.yml
|
||||||
shell: docker compose up -d
|
shell: docker-compose up -d
|
||||||
args:
|
args:
|
||||||
chdir: /root/elk
|
chdir: /root/elk
|
||||||
|
|||||||
@ -1 +0,0 @@
|
|||||||
BEATVER: "8.5.3"
|
|
||||||
@ -1,4 +1,4 @@
|
|||||||
- name: restart filebeat
|
- name: start filebeat
|
||||||
service:
|
service:
|
||||||
name: filebeat
|
name: filebeat
|
||||||
state: started
|
state: started
|
||||||
|
|||||||
@ -1,12 +1,12 @@
|
|||||||
---
|
---
|
||||||
- name: Récupération de filebeat
|
- name: Récupération de filebeat
|
||||||
get_url:
|
get_url:
|
||||||
url: http://s-adm.gsb.adm/gsbstore/filebeat-${BEATVAR}-amd64.deb
|
url: http://s-adm.gsb.adm/gsbstore/filebeat-7.16.3-amd64.deb
|
||||||
dest: /tmp/
|
dest: /tmp/
|
||||||
|
|
||||||
- name: Installation de filebeat
|
- name: Installation de filebeat
|
||||||
apt:
|
apt:
|
||||||
deb: /tmp/filebeat-${BEATVEAR}-amd64.deb
|
deb: /tmp/filebeat-7.16.3-amd64.deb
|
||||||
|
|
||||||
- name: Changement du fichier de conf
|
- name: Changement du fichier de conf
|
||||||
copy:
|
copy:
|
||||||
@ -15,9 +15,9 @@
|
|||||||
|
|
||||||
- name: Configuration de filebeat
|
- name: Configuration de filebeat
|
||||||
shell: filebeat modules enable system
|
shell: filebeat modules enable system
|
||||||
notify: restart filebeat
|
notify: start filebeat
|
||||||
|
|
||||||
- name: Lancement de la configuration de filebeat
|
- name: Lancement de la configuration de filebeat
|
||||||
shell: filebeat setup -e
|
shell: filebeat setup -e
|
||||||
notify: restart filebeat
|
notify: start filebeat
|
||||||
|
|
||||||
|
|||||||
@ -1,16 +0,0 @@
|
|||||||
# Fog
|
|
||||||
|
|
||||||
Ce rôle permet l'installation et la modification de Fog.
|
|
||||||
|
|
||||||
|
|
||||||
## Fog, c'est quoi ?
|
|
||||||
|
|
||||||
|
|
||||||
Fog permet le déploiement d'images disque tel que Windows ou bien Linux en utilisant PXE (Preboot Execution Environment).
|
|
||||||
|
|
||||||
|
|
||||||
## Comment l'installer ?
|
|
||||||
|
|
||||||
|
|
||||||
Avant toute chose, lancer le fichier goss de s-fog ( présent dans gsb2023/goss/s-fog.yaml ) pour vérifier que la configuration réseau est correct et opérationnel. Une fois l'installation principale effectuée, il faut lancer le playbook ansible s-fog.yaml.
|
|
||||||
Il faudra se rendre dans le dossier **fog** pour lancer le script **installfog.sh** ( fog/bin/ ). La configuration sera déjà établie via le fichier **.fogsettings**
|
|
||||||
@ -1,46 +0,0 @@
|
|||||||
## Start of FOG Settings
|
|
||||||
## Created by the FOG Installer
|
|
||||||
## Find more information about this file in the FOG Project wiki:
|
|
||||||
## https://wiki.fogproject.org/wiki/index.php?title=.fogsettings
|
|
||||||
## Version: 1.5.9
|
|
||||||
## Install time: jeu. 26 janv. 2023 11:41:05
|
|
||||||
ipaddress='172.16.64.16'
|
|
||||||
copybackold='0'
|
|
||||||
interface='enp0s9'
|
|
||||||
submask='255.255.255.0'
|
|
||||||
hostname='s-fog.gsb.lan'
|
|
||||||
routeraddress='192.168.99.99'
|
|
||||||
plainrouter='192.168.99.99'
|
|
||||||
dnsaddress='172.16.0.1'
|
|
||||||
username='fogproject'
|
|
||||||
password='/7ElC1OHrP47EN2w59xl'
|
|
||||||
osid='2'
|
|
||||||
osname='Debian'
|
|
||||||
dodhcp='y'
|
|
||||||
bldhcp='1'
|
|
||||||
dhcpd='isc-dhcp-server'
|
|
||||||
blexports='1'
|
|
||||||
installtype='N'
|
|
||||||
snmysqluser='fogmaster'
|
|
||||||
snmysqlpass='HHO5vSGqFiHE_9d2lja3'
|
|
||||||
snmysqlhost='localhost'
|
|
||||||
mysqldbname='fog'
|
|
||||||
installlang='0'
|
|
||||||
storageLocation='/images'
|
|
||||||
fogupdateloaded=1
|
|
||||||
docroot='/var/www/html/'
|
|
||||||
webroot='/fog/'
|
|
||||||
caCreated='yes'
|
|
||||||
httpproto='http'
|
|
||||||
startrange='172.16.64.10'
|
|
||||||
endrange='172.16.64.254'
|
|
||||||
bootfilename='undionly.kpxe'
|
|
||||||
packages='apache2 bc build-essential cpp curl g++ gawk gcc genisoimage git gzip htmldoc isc-dhcp-server isolinux lftp libapache2-mod-php7.4 libc6 libcurl4 li>
|
|
||||||
noTftpBuild=''
|
|
||||||
sslpath='/opt/fog/snapins/ssl/'
|
|
||||||
backupPath='/home/'
|
|
||||||
armsupport='0'
|
|
||||||
php_ver='7.4'
|
|
||||||
php_verAdds='-7.4'
|
|
||||||
sslprivkey='/opt/fog/snapins/ssl//.srvprivate.key'
|
|
||||||
## End of FOG Settings
|
|
||||||
@ -11,16 +11,7 @@
|
|||||||
clone: yes
|
clone: yes
|
||||||
update: yes
|
update: yes
|
||||||
|
|
||||||
- name: Modification fichier bash (desac UDPCast)
|
#- name: Instructions
|
||||||
ansible.builtin.lineinfile:
|
# tags: msg
|
||||||
path: /root/tools/fog/lib/common/functions.sh
|
# debug: msg='{{instructions}}'
|
||||||
regexp: '^configureUDPCast\(\).*'
|
|
||||||
line: "configureUDPCast() {\nreturn"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: fichier config fogsettings
|
|
||||||
command: "cp /root/tools/ansible/roles/fog/files/fogsettings /opt/fog/"
|
|
||||||
|
|
||||||
- name: fichier fogsettings en .fogsettings
|
|
||||||
command: "mv /opt/fog/fogsettings /opt/fog/.fogsettings"
|
|
||||||
|
|
||||||
|
|||||||
@ -1,23 +0,0 @@
|
|||||||
# [Ferm](http://ferm.foo-projects.org/)
|
|
||||||
|
|
||||||
Modifier l'execution d'iptables [plus d'info ici](https://wiki.debian.org/iptables)
|
|
||||||
```shell
|
|
||||||
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
|
||||||
```
|
|
||||||
|
|
||||||
Pour tester utiliser [Nmap](https://nmap.org/man/fr/man-briefoptions.html)
|
|
||||||
### r-vp1
|
|
||||||
```shell
|
|
||||||
sudo nmap -p51820 192.168.0.51
|
|
||||||
```
|
|
||||||
### r-vp2
|
|
||||||
```shell
|
|
||||||
sudo nmap -p51820 192.168.0.52
|
|
||||||
```
|
|
||||||
### Sortie :
|
|
||||||
```
|
|
||||||
`PORT STATE SERVICE
|
|
||||||
51820/tcp filtered unknown`
|
|
||||||
```
|
|
||||||
|
|
||||||
Faire des ping!
|
|
||||||
@ -1,69 +0,0 @@
|
|||||||
# -*- shell-script -*-
|
|
||||||
#
|
|
||||||
# Ferm script r-vp1
|
|
||||||
|
|
||||||
@def $DEV_PRIVATE = enp0s8;
|
|
||||||
@def $DEV_WORLD = enp0s9;
|
|
||||||
@def $DEV_WORLD = enp0s9;
|
|
||||||
@def $DEV_VPN= wg0;
|
|
||||||
@def $NET_PRIVATE = 172.16.0.0/24;
|
|
||||||
|
|
||||||
table filter {
|
|
||||||
|
|
||||||
chain (INPUT OUTPUT){
|
|
||||||
# allow VPN
|
|
||||||
proto udp dport 51820 ACCEPT;
|
|
||||||
}
|
|
||||||
chain INPUT {
|
|
||||||
policy DROP;
|
|
||||||
|
|
||||||
# connection tracking
|
|
||||||
mod state state INVALID DROP;
|
|
||||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
||||||
|
|
||||||
# allow local connections
|
|
||||||
interface lo ACCEPT;
|
|
||||||
|
|
||||||
# respond to ping
|
|
||||||
proto icmp icmp-type echo-request ACCEPT;
|
|
||||||
|
|
||||||
|
|
||||||
# allow SSH connections from the private network and from some
|
|
||||||
# well-known internet hosts
|
|
||||||
saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
|
|
||||||
|
|
||||||
# we provide DNS and SMTP services for the internal net
|
|
||||||
interface $DEV_PRIVATE saddr $NET_PRIVATE {
|
|
||||||
proto (udp tcp) dport domain ACCEPT;
|
|
||||||
proto udp dport bootps ACCEPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
# the rest is dropped by the above policy
|
|
||||||
|
|
||||||
}#FIN INPUT
|
|
||||||
|
|
||||||
# outgoing connections are not limited
|
|
||||||
|
|
||||||
chain OUTPUT {
|
|
||||||
policy ACCEPT;
|
|
||||||
|
|
||||||
}#FIN OUTPUT
|
|
||||||
|
|
||||||
chain FORWARD {
|
|
||||||
policy ACCEPT;
|
|
||||||
|
|
||||||
proto icmp icmp-type echo-request ACCEPT;
|
|
||||||
# connection tracking
|
|
||||||
mod state state INVALID DROP;
|
|
||||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
||||||
|
|
||||||
# connections from the internal net to the internet or to other
|
|
||||||
# internal nets are allowed
|
|
||||||
interface $DEV_PRIVATE ACCEPT;
|
|
||||||
|
|
||||||
interface $DEV_VPN daddr $NET_PRIVATE {
|
|
||||||
proto tcp dport ssh DROP;
|
|
||||||
}
|
|
||||||
# the rest is dropped by the above policy
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,68 +0,0 @@
|
|||||||
# -*- shell-script -*-
|
|
||||||
#
|
|
||||||
# Ferm script r-vp2
|
|
||||||
|
|
||||||
@def $DEV_PRIVATE = enp0s9;
|
|
||||||
@def $DEV_WORLD = enp0s8;
|
|
||||||
@def $DEV_VPN= wg0;
|
|
||||||
@def $NET_PRIVATE = 172.16.0.0/24;
|
|
||||||
|
|
||||||
table filter {
|
|
||||||
chain (INPUT OUTPUT){
|
|
||||||
# allow VPN
|
|
||||||
proto udp dport 51820 ACCEPT;
|
|
||||||
}
|
|
||||||
chain INPUT {
|
|
||||||
policy DROP;
|
|
||||||
|
|
||||||
# connection tracking
|
|
||||||
mod state state INVALID DROP;
|
|
||||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
||||||
|
|
||||||
# allow local connections
|
|
||||||
interface lo ACCEPT;
|
|
||||||
|
|
||||||
# respond to ping
|
|
||||||
proto icmp icmp-type echo-request ACCEPT;
|
|
||||||
|
|
||||||
# allow SSH connections from the private network and from some
|
|
||||||
# well-known internet hosts
|
|
||||||
saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
|
|
||||||
|
|
||||||
# we provide DNS and SMTP services for the internal net
|
|
||||||
interface $DEV_PRIVATE saddr $NET_PRIVATE {
|
|
||||||
proto (udp tcp) dport domain ACCEPT;
|
|
||||||
proto udp dport bootps ACCEPT;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
# interface réseau
|
|
||||||
interface $DEV_WORLD {
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
# the rest is dropped by the above policy
|
|
||||||
}#FIN INPUT
|
|
||||||
|
|
||||||
# outgoing connections are not limited
|
|
||||||
chain OUTPUT {
|
|
||||||
policy ACCEPT;
|
|
||||||
}
|
|
||||||
chain FORWARD {
|
|
||||||
policy ACCEPT;
|
|
||||||
|
|
||||||
proto icmp icmp-type echo-request ACCEPT;
|
|
||||||
# connection tracking
|
|
||||||
mod state state INVALID DROP;
|
|
||||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
||||||
|
|
||||||
# connections from the internal net to the internet or to other
|
|
||||||
# internal nets are allowed
|
|
||||||
interface $DEV_PRIVATE ACCEPT;
|
|
||||||
|
|
||||||
interface $DEV_VPN daddr $NET_PRIVATE {
|
|
||||||
proto tcp dport ssh DROP;
|
|
||||||
}
|
|
||||||
# the rest is dropped by the above policy
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
- name: installation de ferm
|
|
||||||
apt:
|
|
||||||
name: ferm
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: copie du ferm.conf
|
|
||||||
copy:
|
|
||||||
src: ferm.conf.{{ ansible_hostname }}
|
|
||||||
dest: /etc/ferm/ferm.conf
|
|
||||||
|
|
||||||
- name: redemarage service ferm
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: ferm.service
|
|
||||||
state: restarted
|
|
||||||
@ -1,6 +0,0 @@
|
|||||||
depl_url: "http://s-adm.gsb.adm/gsbstore"
|
|
||||||
#depl_glpi: "glpi-9.5.6.tgz"
|
|
||||||
depl_glpi: "glpi-10.0.6.tgz"
|
|
||||||
#depl_fusioninventory: "fusioninventory-9.5+3.0.tar.bz2"
|
|
||||||
depl_glpi_agentx64: "GLPI-Agent-1.4-x64.msi"
|
|
||||||
depl_glpi_agentx86: "GLPI-Agent-1.4-x86.msi"
|
|
||||||
@ -1,2 +1,3 @@
|
|||||||
depl_url: "http://s-adm.gsb.adm/gsbstore"
|
depl_url: "http://s-adm.gsb.adm/gsbstore"
|
||||||
depl_goss: "goss"
|
depl_goss: "goss"
|
||||||
|
|
||||||
|
|||||||
@ -1,4 +1,5 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- name: goss binary exists
|
- name: goss binary exists
|
||||||
stat: path=/usr/local/bin/goss
|
stat: path=/usr/local/bin/goss
|
||||||
register: gossbin
|
register: gossbin
|
||||||
@ -17,3 +18,4 @@
|
|||||||
mode: 0755
|
mode: 0755
|
||||||
remote_src: yes
|
remote_src: yes
|
||||||
when: gossbin.stat.exists == false and ansible_hostname == "s-adm"
|
when: gossbin.stat.exists == false and ansible_hostname == "s-adm"
|
||||||
|
|
||||||
|
|||||||
@ -14,6 +14,22 @@ mot de passe : glpi
|
|||||||
Selectionner la base glpi
|
Selectionner la base glpi
|
||||||
Ne pas envoyer de statistique d'usage
|
Ne pas envoyer de statistique d'usage
|
||||||
|
|
||||||
|
## Fusion Inventory :
|
||||||
|
|
||||||
|
Installer le plugin dans Configuration > Plugins
|
||||||
|
Activer le plugin
|
||||||
|
Pour que la remonter de l'agent se fasse, il faut ajouter une crontab (crontab -e) sur s-itil : * * * * * /usr/bin/php7.4 /var/www/glpi/front/cron.php &>/dev/null
|
||||||
|
Puis éxécuter le tasksheduler dans Configuration > Actions automatiques > taskscheduler
|
||||||
|
|
||||||
|
Pour l'agent Windows, récuperer l'agent sur http://s-itil/ficlients
|
||||||
|
Il faut faire une installation à parti de 0
|
||||||
|
Selectionner comme type d'installation complète
|
||||||
|
Dans le mode serveur mettre l'url : http://s-itil/plugins/fusioninventory et cocher la case installation rapide
|
||||||
|
|
||||||
|
Pour l'agent Debian il faut installer le paquet fusioninventory-agent
|
||||||
|
Ajouter la ligne server = http://s-itil/plugins/fusioninventory dans le fichier /etc/fusioninventory/agent.cfg
|
||||||
|
Redemarrer le service fusioninventory-agent puis faite un reload
|
||||||
|
Exécuter la commande pkill -USR1 -f -P 1 fusioninventory-agent
|
||||||
|
|
||||||
## Postfix :
|
## Postfix :
|
||||||
|
|
||||||
6
roles/itil/defaults/main.yml
Normal file
6
roles/itil/defaults/main.yml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
depl_url: "http://s-adm.gsb.adm/gsbstore"
|
||||||
|
#depl_glpi: "glpi-9.5.6.tgz"
|
||||||
|
depl_glpi: "glpi-10.0.5.tgz"
|
||||||
|
depl_fusioninventory: "fusioninventory-9.5+3.0.tar.bz2"
|
||||||
|
depl_fusioninventory_agentx64: "fusioninventory-agent_windows-x64_2.6.exe"
|
||||||
|
depl_fusioninventory_agentx86: "fusioninventory-agent_windows-x86_2.6.exe"
|
||||||
@ -105,12 +105,12 @@
|
|||||||
# - name: copy .my.cnf file with root password credentials
|
# - name: copy .my.cnf file with root password credentials
|
||||||
# copy: src=.my.cnf dest=/root/tools/ansible/.my.cnf owner=root mode=0600
|
# copy: src=.my.cnf dest=/root/tools/ansible/.my.cnf owner=root mode=0600
|
||||||
|
|
||||||
# - name: Installation de Fusioninventory pour Linux
|
- name: Installation de Fusioninventory pour Linux
|
||||||
# unarchive:
|
unarchive:
|
||||||
# src: "{{ depl_url }}/{{ depl_fusioninventory }}"
|
src: "{{ depl_url }}/{{ depl_fusioninventory }}"
|
||||||
#src: http://depl/gsbstore/fusioninventory-{{ fd_version }}.tar.bz2
|
#src: http://depl/gsbstore/fusioninventory-{{ fd_version }}.tar.bz2
|
||||||
# dest: /var/www/html/glpi/plugins
|
dest: /var/www/html/glpi/plugins
|
||||||
# remote_src: yes
|
remote_src: yes
|
||||||
|
|
||||||
- name: Creation de ficlient
|
- name: Creation de ficlient
|
||||||
file:
|
file:
|
||||||
@ -127,15 +127,23 @@
|
|||||||
group: www-data
|
group: www-data
|
||||||
mode: 0775
|
mode: 0775
|
||||||
|
|
||||||
- name: Installation de GLPI Agent windows x64
|
- name: Installation de FusionInventory windows x64
|
||||||
get_url:
|
get_url:
|
||||||
url: "{{ depl_url }}/{{ depl_glpi_agentx64 }}"
|
url: "{{ depl_url }}/{{ depl_fusioninventory_agentx64 }}"
|
||||||
dest: "/var/www/html/ficlients"
|
dest: "/var/www/html/ficlients"
|
||||||
|
|
||||||
# - name: Installation de GLPI Agent windows x86
|
- name: Installation de FusionInventory windows x86
|
||||||
# get_url:
|
get_url:
|
||||||
# url: "{{ depl_url }}/{{ depl_glpi_agentx86 }}"
|
url: "{{ depl_url }}/{{ depl_fusioninventory_agentx86 }}"
|
||||||
# dest: "/var/www/html/ficlients"
|
dest: "/var/www/html/ficlients"
|
||||||
|
|
||||||
|
- name: Attribution des permissions sur repertoire /plugins/fusioninventory
|
||||||
|
file:
|
||||||
|
path: /var/www/html/glpi/plugins/fusioninventory
|
||||||
|
owner: www-data
|
||||||
|
group: www-data
|
||||||
|
recurse: yes
|
||||||
|
state: directory
|
||||||
|
|
||||||
- name: Copie du script dbdump
|
- name: Copie du script dbdump
|
||||||
copy:
|
copy:
|
||||||
3
roles/lb-bd/files/.my.cnf
Normal file
3
roles/lb-bd/files/.my.cnf
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
[client]
|
||||||
|
user=root
|
||||||
|
password=root
|
||||||
16
roles/lb-bd/files/installmysql.sh
Executable file
16
roles/lb-bd/files/installmysql.sh
Executable file
@ -0,0 +1,16 @@
|
|||||||
|
# Download and Install the Latest Updates for the OS
|
||||||
|
apt-get update && apt-get upgrade -y
|
||||||
|
|
||||||
|
# Install MySQL Server in a Non-Interactive mode. Default root password will be "root"
|
||||||
|
echo "mysql-server mysql-server/root_password password root" | debconf-set-selections
|
||||||
|
echo "mysql-server mysql-server/root_password_again password root" | debconf-set-selections
|
||||||
|
apt-get -y install mysql-server
|
||||||
|
|
||||||
|
|
||||||
|
# Run the MySQL Secure Installation wizard
|
||||||
|
mysql_secure_installation
|
||||||
|
|
||||||
|
sed -i 's/127\.0\.0\.1/0\.0\.0\.0/g' /etc/mysql/my.cnf
|
||||||
|
mysql -uroot -p -e 'USE mysql; UPDATE `user` SET `Host`="%" WHERE `User`="root" AND `Host`="localhost"; DELETE FROM `user` WHERE `Host` != "%" AND `User`="root"; FLUSH PRIVILEGES;'
|
||||||
|
|
||||||
|
service mysql restart
|
||||||
128
roles/lb-bd/files/my.cnf
Normal file
128
roles/lb-bd/files/my.cnf
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
#
|
||||||
|
# The MySQL database server configuration file.
|
||||||
|
#
|
||||||
|
# You can copy this to one of:
|
||||||
|
# - "/etc/mysql/my.cnf" to set global options,
|
||||||
|
# - "~/.my.cnf" to set user-specific options.
|
||||||
|
#
|
||||||
|
# One can use all long options that the program supports.
|
||||||
|
# Run program with --help to get a list of available options and with
|
||||||
|
# --print-defaults to see which it would actually understand and use.
|
||||||
|
#
|
||||||
|
# For explanations see
|
||||||
|
# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
|
||||||
|
|
||||||
|
# This will be passed to all mysql clients
|
||||||
|
# It has been reported that passwords should be enclosed with ticks/quotes
|
||||||
|
# escpecially if they contain "#" chars...
|
||||||
|
# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
|
||||||
|
[client]
|
||||||
|
port = 3306
|
||||||
|
socket = /var/run/mysqld/mysqld.sock
|
||||||
|
|
||||||
|
# Here is entries for some specific programs
|
||||||
|
# The following values assume you have at least 32M ram
|
||||||
|
|
||||||
|
# This was formally known as [safe_mysqld]. Both versions are currently parsed.
|
||||||
|
[mysqld_safe]
|
||||||
|
socket = /var/run/mysqld/mysqld.sock
|
||||||
|
nice = 0
|
||||||
|
|
||||||
|
[mysqld]
|
||||||
|
#
|
||||||
|
# * Basic Settings
|
||||||
|
#
|
||||||
|
user = mysql
|
||||||
|
pid-file = /var/run/mysqld/mysqld.pid
|
||||||
|
socket = /var/run/mysqld/mysqld.sock
|
||||||
|
port = 3306
|
||||||
|
basedir = /usr
|
||||||
|
datadir = /var/lib/mysql
|
||||||
|
tmpdir = /tmp
|
||||||
|
lc-messages-dir = /usr/share/mysql
|
||||||
|
skip-external-locking
|
||||||
|
#
|
||||||
|
# Instead of skip-networking the default is now to listen only on
|
||||||
|
# localhost which is more compatible and is not less secure.
|
||||||
|
#bind-address = 127.0.0.1
|
||||||
|
#
|
||||||
|
# * Fine Tuning
|
||||||
|
#
|
||||||
|
key_buffer = 16M
|
||||||
|
max_allowed_packet = 16M
|
||||||
|
thread_stack = 192K
|
||||||
|
thread_cache_size = 8
|
||||||
|
# This replaces the startup script and checks MyISAM tables if needed
|
||||||
|
# the first time they are touched
|
||||||
|
myisam-recover = BACKUP
|
||||||
|
#max_connections = 100
|
||||||
|
#table_cache = 64
|
||||||
|
#thread_concurrency = 10
|
||||||
|
#
|
||||||
|
# * Query Cache Configuration
|
||||||
|
#
|
||||||
|
query_cache_limit = 1M
|
||||||
|
query_cache_size = 16M
|
||||||
|
#
|
||||||
|
# * Logging and Replication
|
||||||
|
#
|
||||||
|
# Both location gets rotated by the cronjob.
|
||||||
|
# Be aware that this log type is a performance killer.
|
||||||
|
# As of 5.1 you can enable the log at runtime!
|
||||||
|
#general_log_file = /var/log/mysql/mysql.log
|
||||||
|
#general_log = 1
|
||||||
|
#
|
||||||
|
# Error log - should be very few entries.
|
||||||
|
#
|
||||||
|
log_error = /var/log/mysql/error.log
|
||||||
|
#
|
||||||
|
# Here you can see queries with especially long duration
|
||||||
|
#slow_query_log_file = /var/log/mysql/mysql-slow.log
|
||||||
|
#slow_query_log = 1
|
||||||
|
#long_query_time = 2
|
||||||
|
#log_queries_not_using_indexes
|
||||||
|
#
|
||||||
|
# The following can be used as easy to replay backup logs or for replication.
|
||||||
|
# note: if you are setting up a replication slave, see README.Debian about
|
||||||
|
# other settings you may need to change.
|
||||||
|
#server-id = 1
|
||||||
|
#log_bin = /var/log/mysql/mysql-bin.log
|
||||||
|
expire_logs_days = 10
|
||||||
|
max_binlog_size = 100M
|
||||||
|
#binlog_do_db = include_database_name
|
||||||
|
#binlog_ignore_db = include_database_name
|
||||||
|
#
|
||||||
|
# * InnoDB
|
||||||
|
#
|
||||||
|
# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
|
||||||
|
# Read the manual for more InnoDB related options. There are many!
|
||||||
|
#
|
||||||
|
# * Security Features
|
||||||
|
#
|
||||||
|
# Read the manual, too, if you want chroot!
|
||||||
|
# chroot = /var/lib/mysql/
|
||||||
|
#
|
||||||
|
# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
|
||||||
|
#
|
||||||
|
# ssl-ca=/etc/mysql/cacert.pem
|
||||||
|
# ssl-cert=/etc/mysql/server-cert.pem
|
||||||
|
# ssl-key=/etc/mysql/server-key.pem
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[mysqldump]
|
||||||
|
quick
|
||||||
|
quote-names
|
||||||
|
max_allowed_packet = 16M
|
||||||
|
|
||||||
|
[mysql]
|
||||||
|
#no-auto-rehash # faster start of mysql but no tab completition
|
||||||
|
|
||||||
|
[isamchk]
|
||||||
|
key_buffer = 16M
|
||||||
|
|
||||||
|
#
|
||||||
|
# * IMPORTANT: Additional settings that can override those from this file!
|
||||||
|
# The files must end with '.cnf', otherwise they'll be ignored.
|
||||||
|
#
|
||||||
|
!includedir /etc/mysql/conf.d/
|
||||||
@ -1,4 +1,3 @@
|
|||||||
---
|
---
|
||||||
- name: restart mariadb
|
- name: restart mysql-server
|
||||||
ansible.builtin.service:
|
service: name=mysql-server state=restarted
|
||||||
name: mariadb
|
|
||||||
|
|||||||
@ -1,35 +1,4 @@
|
|||||||
---
|
---
|
||||||
|
- name: Install paquets
|
||||||
- name: modules python pour
|
apt: name=mysql-server state=present force=yes
|
||||||
apt:
|
|
||||||
name: python3-pymysql
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: install mariadb-server
|
|
||||||
apt:
|
|
||||||
name: mariadb-server
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Cree Bd wordpress
|
|
||||||
mysql_db:
|
|
||||||
db: wordpressdb
|
|
||||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Ouvre port 3306 mariadb-server
|
|
||||||
replace:
|
|
||||||
path: /etc/mysql/mariadb.conf.d/50-server.cnf
|
|
||||||
regexp: '^bind-address.*'
|
|
||||||
replace: '#bind-adress = 127.0.0.1'
|
|
||||||
backup: yes
|
|
||||||
notify: restart mariadb
|
|
||||||
|
|
||||||
- name: Create MySQL user for wordpress
|
|
||||||
mysql_user:
|
|
||||||
name: wordpressuser
|
|
||||||
password: wordpresspasswd
|
|
||||||
priv: "wordpressdb.*:ALL"
|
|
||||||
host: '%'
|
|
||||||
state: present
|
|
||||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
|
||||||
|
|
||||||
|
|||||||
@ -10,4 +10,4 @@
|
|||||||
dest: /etc/fstab
|
dest: /etc/fstab
|
||||||
regexp: ''
|
regexp: ''
|
||||||
insertafter: EOF
|
insertafter: EOF
|
||||||
line: '192.168.102.253:/home/ /var/www/html/wordpress nfs soft,timeo=5,intr,rsize=8192,wsize=8192,wsize=8192 0 0'
|
line: '192.168.102.253:/home/wordpress /var/www/html/wordpress nfs soft,timeo=5,intr,rsize=8192,wsize=8192,wsize=8192 0 0'
|
||||||
|
|||||||
@ -5,6 +5,6 @@ Ce rôle :
|
|||||||
* installe **nfs-server**
|
* installe **nfs-server**
|
||||||
* copie le fichier de configuration **exports** pour exporter le répertoire **/home/wordpress**
|
* copie le fichier de configuration **exports** pour exporter le répertoire **/home/wordpress**
|
||||||
* relance le service **nfs-server**
|
* relance le service **nfs-server**
|
||||||
* décompresse wordpress
|
|
||||||
### Objectif
|
### Objectif
|
||||||
Le répertoire **/home/wordpress** est exporté par **nfs** sur le réseau **n-dmz-db**
|
Le répertoire **/home/wordpress** est exporté par **nfs** sur le réseau **n-dmz-db**
|
||||||
|
|||||||
@ -7,4 +7,4 @@
|
|||||||
# Example for NFSv4:
|
# Example for NFSv4:
|
||||||
# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
|
# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
|
||||||
# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
|
# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
|
||||||
/home/wordpress 192.168.102.0/255.255.255.0(rw,no_root_squash,subtree_check)
|
/home/wordpress 192.168.102.0/255.255.255.0 (rw,no_root_squash,subtree_check)
|
||||||
|
|||||||
@ -1,70 +1,18 @@
|
|||||||
- name: 00 - cree repertoire wordpress pour export nfs
|
---
|
||||||
file:
|
- name: installation des paquets
|
||||||
path: /home/wordpress
|
apt:
|
||||||
state: directory
|
name:
|
||||||
|
- nfs-kernel-server
|
||||||
|
state: latest
|
||||||
|
|
||||||
- name: 05 - Install nfs-server
|
- name: copie exports pour partage nfs wordpress
|
||||||
apt:
|
copy:
|
||||||
name: nfs-server
|
src: exports
|
||||||
state: present
|
dest: /etc
|
||||||
|
|
||||||
- name: 10 - creation fichier exports nfs
|
- name: redemarrage du service rpcbind requis pour le service nfs
|
||||||
ansible.builtin.blockinfile:
|
shell: service rpcbind restart
|
||||||
path: /etc/exports
|
|
||||||
block: |
|
|
||||||
/home/wordpress 192.168.102.0/255.255.255.0(rw,no_root_squash,subtree_check)
|
|
||||||
|
|
||||||
- name: 20 - decompresse wordpress
|
- name: redemarrage du service nfs-kernel-server
|
||||||
unarchive:
|
shell: service nfs-kernel-server restart
|
||||||
src: https://fr.wordpress.org/latest-fr_FR.tar.gz
|
|
||||||
dest: /home/
|
|
||||||
remote_src: yes
|
|
||||||
|
|
||||||
- name: 22 - change owner et group pour repertoire wordpress
|
|
||||||
file:
|
|
||||||
path: /home/wordpress
|
|
||||||
state: directory
|
|
||||||
recurse: yes
|
|
||||||
owner: www-data
|
|
||||||
group: www-data
|
|
||||||
|
|
||||||
- name: 30 - genere fichier de config wordpress
|
|
||||||
copy:
|
|
||||||
src: /home/wordpress/wp-config-sample.php
|
|
||||||
dest: /home/wordpress/wp-config.php
|
|
||||||
remote_src: yes
|
|
||||||
|
|
||||||
- name: 35 - ajuste variable dbname dans fichier de config wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /home/wordpress/wp-config.php
|
|
||||||
regexp: "votre_nom_de_bdd"
|
|
||||||
replace: "wordpressdb"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
|
|
||||||
- name: 40 ajuste variable dbusername dans fichier de config wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /home/wordpress/wp-config.php
|
|
||||||
regexp: "votre_utilisateur_de_bdd"
|
|
||||||
replace: "wordpressuser"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: 45 - ajuste variable mdp dans fichier de config wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /home/wordpress/wp-config.php
|
|
||||||
regexp: "votre_mdp_de_bdd"
|
|
||||||
replace: "wordpresspasswd"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: 50 - ajuste hostname fichier wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /home/wordpress/wp-config.php
|
|
||||||
regexp: "localhost"
|
|
||||||
replace: "192.168.102.254"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: 55 - relance nfs
|
|
||||||
service:
|
|
||||||
name: nfs-server
|
|
||||||
state: restarted
|
|
||||||
enabled: yes
|
|
||||||
|
|||||||
102
roles/lb-web/files/wp-config.php
Normal file
102
roles/lb-web/files/wp-config.php
Normal file
@ -0,0 +1,102 @@
|
|||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* La configuration de base de votre installation WordPress.
|
||||||
|
*
|
||||||
|
* Ce fichier est utilisé par le script de création de wp-config.php pendant
|
||||||
|
* le processus d’installation. Vous n’avez pas à utiliser le site web, vous
|
||||||
|
* pouvez simplement renommer ce fichier en « wp-config.php » et remplir les
|
||||||
|
* valeurs.
|
||||||
|
*
|
||||||
|
* Ce fichier contient les réglages de configuration suivants :
|
||||||
|
*
|
||||||
|
* Réglages MySQL
|
||||||
|
* Préfixe de table
|
||||||
|
* Clés secrètes
|
||||||
|
* Langue utilisée
|
||||||
|
* ABSPATH
|
||||||
|
*
|
||||||
|
* @link https://fr.wordpress.org/support/article/editing-wp-config-php/.
|
||||||
|
*
|
||||||
|
* @package WordPress
|
||||||
|
*/
|
||||||
|
|
||||||
|
// ** Réglages MySQL - Votre hébergeur doit vous fournir ces informations. ** //
|
||||||
|
/** Nom de la base de données de WordPress. */
|
||||||
|
define( 'DB_NAME', 'wordpress' );
|
||||||
|
|
||||||
|
/** Utilisateur de la base de données MySQL. */
|
||||||
|
define( 'DB_USER', 'wp' );
|
||||||
|
|
||||||
|
/** Mot de passe de la base de données MySQL. */
|
||||||
|
define( 'DB_PASSWORD', 'wp' );
|
||||||
|
|
||||||
|
/** Adresse de l’hébergement MySQL. */
|
||||||
|
define( 'DB_HOST', '192.168.102.254' );
|
||||||
|
|
||||||
|
/** Jeu de caractères à utiliser par la base de données lors de la création des tables. */
|
||||||
|
define( 'DB_CHARSET', 'utf8' );
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Type de collation de la base de données.
|
||||||
|
* N’y touchez que si vous savez ce que vous faites.
|
||||||
|
*/
|
||||||
|
define( 'DB_COLLATE', '' );
|
||||||
|
|
||||||
|
/**#@+
|
||||||
|
* Clés uniques d’authentification et salage.
|
||||||
|
*
|
||||||
|
* Remplacez les valeurs par défaut par des phrases uniques !
|
||||||
|
* Vous pouvez générer des phrases aléatoires en utilisant
|
||||||
|
* {@link https://api.wordpress.org/secret-key/1.1/salt/ le service de clés secrètes de WordPress.org}.
|
||||||
|
* Vous pouvez modifier ces phrases à n’importe quel moment, afin d’invalider tous les cookies existants.
|
||||||
|
* Cela forcera également tous les utilisateurs à se reconnecter.
|
||||||
|
*
|
||||||
|
* @since 2.6.0
|
||||||
|
*/
|
||||||
|
define( 'AUTH_KEY', 'mettez une phrase unique ici' );
|
||||||
|
define( 'SECURE_AUTH_KEY', 'mettez une phrase unique ici' );
|
||||||
|
define( 'LOGGED_IN_KEY', 'mettez une phrase unique ici' );
|
||||||
|
define( 'NONCE_KEY', 'mettez une phrase unique ici' );
|
||||||
|
define( 'AUTH_SALT', 'mettez une phrase unique ici' );
|
||||||
|
define( 'SECURE_AUTH_SALT', 'mettez une phrase unique ici' );
|
||||||
|
define( 'LOGGED_IN_SALT', 'mettez une phrase unique ici' );
|
||||||
|
define( 'NONCE_SALT', 'mettez une phrase unique ici' );
|
||||||
|
/**#@-*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Préfixe de base de données pour les tables de WordPress.
|
||||||
|
*
|
||||||
|
* Vous pouvez installer plusieurs WordPress sur une seule base de données
|
||||||
|
* si vous leur donnez chacune un préfixe unique.
|
||||||
|
* N’utilisez que des chiffres, des lettres non-accentuées, et des caractères soulignés !
|
||||||
|
*/
|
||||||
|
$table_prefix = 'wp_';
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Pour les développeurs : le mode déboguage de WordPress.
|
||||||
|
*
|
||||||
|
* En passant la valeur suivante à "true", vous activez l’affichage des
|
||||||
|
* notifications d’erreurs pendant vos essais.
|
||||||
|
* Il est fortement recommandé que les développeurs d’extensions et
|
||||||
|
* de thèmes se servent de WP_DEBUG dans leur environnement de
|
||||||
|
* développement.
|
||||||
|
*
|
||||||
|
* Pour plus d’information sur les autres constantes qui peuvent être utilisées
|
||||||
|
* pour le déboguage, rendez-vous sur le Codex.
|
||||||
|
*
|
||||||
|
* @link https://fr.wordpress.org/support/article/debugging-in-wordpress/
|
||||||
|
*/
|
||||||
|
define( 'WP_DEBUG', false );
|
||||||
|
|
||||||
|
/* C’est tout, ne touchez pas à ce qui suit ! Bonne publication. */
|
||||||
|
|
||||||
|
/** Chemin absolu vers le dossier de WordPress. */
|
||||||
|
if ( ! defined( 'ABSPATH' ) )
|
||||||
|
define( 'ABSPATH', dirname( __FILE__ ) . '/' );
|
||||||
|
|
||||||
|
/** Réglage des variables de WordPress et de ses fichiers inclus. */
|
||||||
|
require_once( ABSPATH . 'wp-settings.php' );
|
||||||
|
define('DB_NAME', 'wordpress');
|
||||||
|
define('DB_HOST', '192.168.102.254');
|
||||||
|
define('DB_USER', 'wp');
|
||||||
|
define('DB_PASSWORD', 'wp');
|
||||||
@ -1,15 +1,33 @@
|
|||||||
---
|
---
|
||||||
- name: installation des paquets web
|
- name: installation php et apache ...
|
||||||
apt:
|
apt:
|
||||||
name:
|
name:
|
||||||
- apache2
|
- apache2
|
||||||
- php
|
- php
|
||||||
- php-mbstring
|
- php-mbstring
|
||||||
- php-mysql
|
- php-mysql
|
||||||
- mariadb-client
|
- mariadb-client
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
- name: install nfs-common
|
- name: download and extract wordpress
|
||||||
apt:
|
unarchive:
|
||||||
name: nfs-common
|
src: https://fr.wordpress.org/latest-fr_FR.tar.gz
|
||||||
state: present
|
dest: /home/
|
||||||
|
remote_src: yes
|
||||||
|
owner: www-data
|
||||||
|
group: www-data
|
||||||
|
|
||||||
|
- name: Copy sample config file
|
||||||
|
command: mv /home/wordpress/wp-config-sample.php /home/wordpress/wp-config.php creates=/home/wordpress/wp-config.php
|
||||||
|
|
||||||
|
- name: Changement du fichier de conf
|
||||||
|
copy:
|
||||||
|
src: wp-config.php
|
||||||
|
dest: /home/wordpress/wp-config.php
|
||||||
|
|
||||||
|
- name: Attributions des permissions
|
||||||
|
file:
|
||||||
|
path: /home/wordpress
|
||||||
|
recurse: yes
|
||||||
|
owner: 33
|
||||||
|
group: 33
|
||||||
|
|||||||
@ -1 +0,0 @@
|
|||||||
BEATVER: "8.5.3"
|
|
||||||
@ -1,5 +1,5 @@
|
|||||||
- name: restart metricbeat
|
- name: start metricbeat
|
||||||
service:
|
service:
|
||||||
name: metricbeat
|
name: metricbeat
|
||||||
state: restarted
|
state: started
|
||||||
enabled: yes
|
enabled: yes
|
||||||
|
|||||||
@ -1,12 +1,12 @@
|
|||||||
---
|
---
|
||||||
- name: Récupération de metricbeat
|
- name: Récupération de metricbeat
|
||||||
get_url:
|
get_url:
|
||||||
url: http://s-adm.gsb.adm/gsbstore/metricbeat-${BEATVER}-amd64.deb
|
url: http://s-adm.gsb.adm/gsbstore/metricbeat-7.16.3-amd64.deb
|
||||||
dest: /tmp/
|
dest: /tmp/
|
||||||
|
|
||||||
- name: Installation de metricbeat
|
- name: Installation de metricbeat
|
||||||
apt:
|
apt:
|
||||||
deb: /tmp/metricbeat-${BEATVER}-amd64.deb
|
deb: /tmp/metricbeat-7.16.3-amd64.deb
|
||||||
|
|
||||||
- name: Changement du fichier de conf
|
- name: Changement du fichier de conf
|
||||||
copy:
|
copy:
|
||||||
@ -15,9 +15,9 @@
|
|||||||
|
|
||||||
- name: Configuration de metricbeat
|
- name: Configuration de metricbeat
|
||||||
shell: metricbeat modules enable system
|
shell: metricbeat modules enable system
|
||||||
notify: restart metricbeat
|
notify: start metricbeat
|
||||||
|
|
||||||
- name: Lancement de la configuration de metricbeat
|
- name: Lancement de la configuration de metricbeat
|
||||||
shell: metricbeat setup -e
|
shell: metricbeat setup -e
|
||||||
notify: restart metricbeat
|
notify: start metricbeat
|
||||||
|
|
||||||
|
|||||||
@ -26,7 +26,6 @@ define host {
|
|||||||
host_name localhost
|
host_name localhost
|
||||||
alias localhost
|
alias localhost
|
||||||
address 127.0.0.1
|
address 127.0.0.1
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -9,6 +9,5 @@ define host{
|
|||||||
host_name s-adm
|
host_name s-adm
|
||||||
alias debian-servers
|
alias debian-servers
|
||||||
address 192.168.99.99
|
address 192.168.99.99
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -9,6 +9,5 @@ define host{
|
|||||||
host_name s-appli
|
host_name s-appli
|
||||||
alias debian-servers
|
alias debian-servers
|
||||||
address 172.16.0.3
|
address 172.16.0.3
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -9,6 +9,5 @@ define host{
|
|||||||
host_name s-backup
|
host_name s-backup
|
||||||
alias serveur proxy
|
alias serveur proxy
|
||||||
address 172.16.0.4
|
address 172.16.0.4
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -9,7 +9,6 @@ define host{
|
|||||||
host_name s-fog
|
host_name s-fog
|
||||||
alias serveur proxy
|
alias serveur proxy
|
||||||
address 172.16.0.16
|
address 172.16.0.16
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -9,6 +9,5 @@ define host{
|
|||||||
host_name s-infra
|
host_name s-infra
|
||||||
alias debian-servers
|
alias debian-servers
|
||||||
address 172.16.0.1
|
address 172.16.0.1
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -9,7 +9,6 @@ define host{
|
|||||||
host_name s-itil
|
host_name s-itil
|
||||||
alias serveur proxy
|
alias serveur proxy
|
||||||
address 172.16.0.9
|
address 172.16.0.9
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -9,6 +9,5 @@ define host{
|
|||||||
host_name s-nxc
|
host_name s-nxc
|
||||||
alias debian-servers
|
alias debian-servers
|
||||||
address 172.16.0.7
|
address 172.16.0.7
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -9,7 +9,6 @@ define host{
|
|||||||
host_name s-proxy
|
host_name s-proxy
|
||||||
alias serveur proxy
|
alias serveur proxy
|
||||||
address 172.16.0.2
|
address 172.16.0.2
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -9,7 +9,6 @@ define host{
|
|||||||
host_name s-win
|
host_name s-win
|
||||||
alias serveur proxy
|
alias serveur proxy
|
||||||
address 172.16.0.6
|
address 172.16.0.6
|
||||||
parents r-int
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -35,24 +35,3 @@ Nextcloud est alors fonctionnel avec le proxy inverse **traefik** assurant la re
|
|||||||
ATTENTION : Après avoir relancé la VM, executez le script "nxc-start.sh" afin d'installer les piles applicatives.
|
ATTENTION : Après avoir relancé la VM, executez le script "nxc-start.sh" afin d'installer les piles applicatives.
|
||||||
|
|
||||||
Une fois le script terminé, le site est disponible ici : https://s-nxc.gsb.lan
|
Une fois le script terminé, le site est disponible ici : https://s-nxc.gsb.lan
|
||||||
|
|
||||||
|
|
||||||
## 5. Ajout authentification LDAP
|
|
||||||
|
|
||||||
Pour ajouter l'authentification LDAP au Nextcloud, il faut :
|
|
||||||
* Une fois l'installation de Nextcloud terminé, cliquez sur le profil et Application
|
|
||||||
* Dans vos applications, descendre et activer "LDAP user and group backend"
|
|
||||||
* Puis cliquer sur le profil, puis Paramètres d'administration et dans Administration cliquer sur Intégration LDAP/AD
|
|
||||||
* Une fois sur la page d'intégration LDAP/AD :
|
|
||||||
* Dans Hôte mettre :
|
|
||||||
> ldap://s-win.gsb.lan
|
|
||||||
* Cliquer sur Détecter le port (normalement le port 389 apparait)
|
|
||||||
* Dans DN Utilisateur mettre :
|
|
||||||
> CN=nextcloud,CN=Users,DC=GSB,DC=LAN
|
|
||||||
* Mot de passe :
|
|
||||||
> Azerty1+
|
|
||||||
* Et dans Un DN de base par ligne :
|
|
||||||
> DC=GSB,DC=LAN
|
|
||||||
* Après la configuration passe OK
|
|
||||||
* Une fois la configuration finie, cliquer 3 fois sur continuer
|
|
||||||
* Une fois arrivé sur Groupes, vous pouvez vous déconnecter du compte Admin et vous connecter avec un compte qui est dans l'AD.
|
|
||||||
@ -1,80 +0,0 @@
|
|||||||
version: '3'
|
|
||||||
volumes:
|
|
||||||
nextcloud:
|
|
||||||
db:
|
|
||||||
|
|
||||||
networks:
|
|
||||||
proxy:
|
|
||||||
external: true
|
|
||||||
nxc:
|
|
||||||
external: false
|
|
||||||
|
|
||||||
services:
|
|
||||||
reverse-proxy:
|
|
||||||
# The official v2 Traefik docker image
|
|
||||||
image: traefik:latest
|
|
||||||
container_name: traefik
|
|
||||||
# Enables the web UI and tells Traefik to listen to docker
|
|
||||||
command: --api.insecure=true --providers.docker
|
|
||||||
ports:
|
|
||||||
# The HTTP port
|
|
||||||
- "80:80"
|
|
||||||
- "443:443"
|
|
||||||
# The Web UI (enabled by --api.insecure=true)
|
|
||||||
- "8080:8080"
|
|
||||||
volumes:
|
|
||||||
# So that Traefik can listen to the Docker events
|
|
||||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
||||||
# Map the static configuration into the container
|
|
||||||
- ./config/static.yml:/etc/traefik/traefik.yml:ro
|
|
||||||
# Map the dynamic configuration into the container
|
|
||||||
- ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
|
|
||||||
# Map the certificats into the container
|
|
||||||
- ./certs:/etc/certs:ro
|
|
||||||
networks:
|
|
||||||
- proxy
|
|
||||||
|
|
||||||
db:
|
|
||||||
image: mariadb:10.5
|
|
||||||
container_name: db
|
|
||||||
restart: always
|
|
||||||
command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
|
|
||||||
volumes:
|
|
||||||
- db:/var/lib/mysql
|
|
||||||
networks:
|
|
||||||
- nxc
|
|
||||||
environment:
|
|
||||||
- MYSQL_ROOT_PASSWORD=Azerty1+
|
|
||||||
- MYSQL_PASSWORD=Azerty1+
|
|
||||||
- MYSQL_DATABASE=nextcloud
|
|
||||||
- MYSQL_USER=nextcloud
|
|
||||||
|
|
||||||
app:
|
|
||||||
image: nextcloud
|
|
||||||
container_name: app
|
|
||||||
restart: always
|
|
||||||
ports:
|
|
||||||
- 8081:80
|
|
||||||
#links:
|
|
||||||
depends_on:
|
|
||||||
- db
|
|
||||||
volumes:
|
|
||||||
- ./nextcloud:/var/www/html
|
|
||||||
networks:
|
|
||||||
- proxy
|
|
||||||
- nxc
|
|
||||||
labels:
|
|
||||||
# - "traefik.enable=true"
|
|
||||||
- "traefik.http.routers.app.rule=Host(`s-nxc.gsb.lan`)"
|
|
||||||
- "traefik.http.routers.app.tls=true"
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.docker.network=proxy"
|
|
||||||
# - "traefik.http.routers.app.entrypoints=websecure"
|
|
||||||
# - "traefik.http.routers.app.rule=Host(`mon.nxc`)"
|
|
||||||
- "traefik.http.routers.app.service=app-service"
|
|
||||||
- "traefik.http.services.app-service.loadbalancer.server.port=80"
|
|
||||||
environment:
|
|
||||||
- MYSQL_PASSWORD=Azerty1+
|
|
||||||
- MYSQL_DATABASE=nextcloud
|
|
||||||
- MYSQL_USER=nextcloud
|
|
||||||
- MYSQL_HOST=db
|
|
||||||
58
roles/nxc-traefik/files/nextcloud.yml
Normal file
58
roles/nxc-traefik/files/nextcloud.yml
Normal file
@ -0,0 +1,58 @@
|
|||||||
|
version: '2'
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
# nextcloud:
|
||||||
|
db:
|
||||||
|
|
||||||
|
services:
|
||||||
|
db:
|
||||||
|
image: mariadb
|
||||||
|
container_name: db
|
||||||
|
restart: always
|
||||||
|
#command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
|
||||||
|
command: --innodb-read-only-compressed=OFF
|
||||||
|
volumes:
|
||||||
|
- db:/var/lib/mysql
|
||||||
|
networks:
|
||||||
|
- nxc-db
|
||||||
|
environment:
|
||||||
|
- MYSQL_ROOT_PASSWORD=blabla
|
||||||
|
- MYSQL_PASSWORD=blabla
|
||||||
|
- MYSQL_DATABASE=nextcloud
|
||||||
|
- MYSQL_USER=nextcloud
|
||||||
|
|
||||||
|
nxc:
|
||||||
|
image: nextcloud
|
||||||
|
restart: always
|
||||||
|
container_name: nxc
|
||||||
|
# ports:
|
||||||
|
# - 8080:80
|
||||||
|
# links:
|
||||||
|
depends_on:
|
||||||
|
- db
|
||||||
|
volumes:
|
||||||
|
- ./nextcloud:/var/www/html
|
||||||
|
environment:
|
||||||
|
- MYSQL_PASSWORD=blabla
|
||||||
|
- MYSQL_DATABASE=nextcloud
|
||||||
|
- MYSQL_USER=nextcloud
|
||||||
|
- MYSQL_HOST=db
|
||||||
|
labels:
|
||||||
|
# Enable this container to be mapped by traefik
|
||||||
|
# For more information, see: https://docs.traefik.io/providers/docker/#exposedbydefault
|
||||||
|
- "traefik.enable=true"
|
||||||
|
# URL to reach this container
|
||||||
|
- "traefik.http.routers.nxc.rule=Host(`s-nxc.gsb.lan`)"
|
||||||
|
# Activation of TLS
|
||||||
|
- "traefik.http.routers.nxc.tls=true"
|
||||||
|
# If port is different than 80, use the following service:
|
||||||
|
#- "traefik.http.services.<service_name>.loadbalancer.server.port=<port>"
|
||||||
|
# - "traefik.http.services.app.loadbalancer.server.port=8080"
|
||||||
|
networks:
|
||||||
|
- proxy
|
||||||
|
- nxc-db
|
||||||
|
networks:
|
||||||
|
proxy:
|
||||||
|
external: true
|
||||||
|
nxc-db:
|
||||||
|
external: false
|
||||||
@ -1,4 +1,6 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
docker compose down -v
|
docker-compose -f nextcloud.yml down
|
||||||
|
docker-compose -f traefik.yml down
|
||||||
sleep 1
|
sleep 1
|
||||||
docker compose up -d
|
docker-compose -f traefik.yml up -d --remove-orphans
|
||||||
|
docker-compose -f nextcloud.yml up -d
|
||||||
|
|||||||
@ -1,6 +1,4 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
docker volume prune -f
|
||||||
docker compose down -v
|
docker container prune -f
|
||||||
#docker volume prune -f
|
docker image prune -f
|
||||||
#docker container prune -f
|
|
||||||
#docker image prune -f
|
|
||||||
|
|||||||
@ -1,2 +1,3 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
docker compose up -d
|
docker-compose -f traefik.yml up -d
|
||||||
|
docker-compose -f nextcloud.yml up -d
|
||||||
|
|||||||
@ -1,2 +1,3 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
docker compose down
|
docker-compose -f nextcloud.yml down
|
||||||
|
docker-compose -f traefik.yml down
|
||||||
|
|||||||
28
roles/nxc-traefik/files/traefik.yml
Normal file
28
roles/nxc-traefik/files/traefik.yml
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
version: '3'
|
||||||
|
|
||||||
|
services:
|
||||||
|
reverse-proxy:
|
||||||
|
#image: traefik:v2.5
|
||||||
|
image: traefik
|
||||||
|
container_name: traefik
|
||||||
|
restart: always
|
||||||
|
security_opt:
|
||||||
|
- no-new-privileges:true
|
||||||
|
ports:
|
||||||
|
# Web
|
||||||
|
- 80:80
|
||||||
|
- 443:443
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||||
|
# Map the static configuration into the container
|
||||||
|
- ./config/static.yml:/etc/traefik/traefik.yml:ro
|
||||||
|
# Map the dynamic configuration into the container
|
||||||
|
- ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
|
||||||
|
# Map the certificats into the container
|
||||||
|
- ./certs:/etc/certs:ro
|
||||||
|
networks:
|
||||||
|
- proxy
|
||||||
|
|
||||||
|
networks:
|
||||||
|
proxy:
|
||||||
|
external: true
|
||||||
@ -24,9 +24,14 @@
|
|||||||
src: dynamic.yml
|
src: dynamic.yml
|
||||||
dest: /root/nxc/config
|
dest: /root/nxc/config
|
||||||
|
|
||||||
- name: Copie de docker-compose.yml
|
- name: Copie de nextcloud.yml
|
||||||
copy:
|
copy:
|
||||||
src: docker-compose.yml
|
src: nextcloud.yml
|
||||||
|
dest: /root/nxc
|
||||||
|
|
||||||
|
- name: Copie de traefik.yml
|
||||||
|
copy:
|
||||||
|
src: traefik.yml
|
||||||
dest: /root/nxc
|
dest: /root/nxc
|
||||||
|
|
||||||
- name: Copie de nxc-stop.sh
|
- name: Copie de nxc-stop.sh
|
||||||
@ -71,8 +76,3 @@
|
|||||||
|
|
||||||
- name: Creation reseau docker proxy
|
- name: Creation reseau docker proxy
|
||||||
command: docker network create proxy
|
command: docker network create proxy
|
||||||
|
|
||||||
#- name: Démarrage du docker-compose...
|
|
||||||
#command: /bin/bash docker-compose up -d
|
|
||||||
#args:
|
|
||||||
#chdir: /root/nxc
|
|
||||||
|
|||||||
@ -1,22 +0,0 @@
|
|||||||
---
|
|
||||||
- name: mise a jour de resolv.conf...
|
|
||||||
copy:
|
|
||||||
src: /root/tools/ansible/gsb2023/roles/peertube/files/resolv.conf
|
|
||||||
dest: /etc/
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: installation de docker...
|
|
||||||
shell: curl https://releases.rancher.com/install-docker/20.10.sh | sh
|
|
||||||
|
|
||||||
- name: attente de l'installation de docker...
|
|
||||||
wait_for:
|
|
||||||
timeout: 30
|
|
||||||
host: localhost
|
|
||||||
|
|
||||||
- name: installation de k3s...
|
|
||||||
shell: curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=192.168.100.20 --flannel-iface=enp0s8" sh -s - --docker
|
|
||||||
|
|
||||||
- name: attente de l'installation de k3s...
|
|
||||||
wait_for:
|
|
||||||
timeout: 25
|
|
||||||
host: localhost
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
MYHOST=peertube.gsb.lan;
|
|
||||||
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml;
|
|
||||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.cert -subj /CN="${MYHOST}"/O="${MYHOST}" -addext "subjectAltName = DNS:${MYHOST}";
|
|
||||||
kubectl create secret tls tls-peertube --key tls.key --cert tls.cert;
|
|
||||||
helm repo add postgresql https://charts.bitnami.com/bitnami;
|
|
||||||
helm repo add redis https://charts.bitnami.com/bitnami;
|
|
||||||
helm repo add mail https://bokysan.github.io/docker-postfix;
|
|
||||||
helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm/ ;
|
|
||||||
kubectl config view --raw > ~/.kube/config
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
domain gsb.lan
|
|
||||||
search gsb.lan
|
|
||||||
nameserver 172.16.0.1
|
|
||||||
nameserver 192.168.99.99
|
|
||||||
@ -1,139 +0,0 @@
|
|||||||
replicaCount: 1
|
|
||||||
image:
|
|
||||||
repository: chocobozzz/peertube
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "v5.0.1-bullseye"
|
|
||||||
|
|
||||||
imagePullSecrets: []
|
|
||||||
nameOverride: ""
|
|
||||||
fullnameOverride: ""
|
|
||||||
|
|
||||||
serviceAccount:
|
|
||||||
create: false
|
|
||||||
annotations: {}
|
|
||||||
name: ""
|
|
||||||
podAnnotations: {}
|
|
||||||
podSecurityContext: {}
|
|
||||||
securityContext: {}
|
|
||||||
|
|
||||||
service:
|
|
||||||
type: ClusterIP
|
|
||||||
port: 9000
|
|
||||||
nginxPort: 9001
|
|
||||||
|
|
||||||
## default config for postgresql should work, but feel free to modify it if required.
|
|
||||||
# must stay consistent with peertube configuration, otherwise peertube will crash
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
primary:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: "pvc-postgres"
|
|
||||||
global:
|
|
||||||
postgresql:
|
|
||||||
auth:
|
|
||||||
postgrePassword: "admin"
|
|
||||||
username: "user"
|
|
||||||
password: "user"
|
|
||||||
database: "peertube"
|
|
||||||
|
|
||||||
## the main list of variables tha will be applied in the peertube container
|
|
||||||
# any error or misconfiguration will make peertube crash.
|
|
||||||
peertube:
|
|
||||||
env:
|
|
||||||
dbUser: user # must be consistent with postgresql configuration
|
|
||||||
dbPasswd: user # must be consistent with postgresql configuration
|
|
||||||
dbSsl: false # disabled by default WARNING: ssl connection feature not tested, use at your own risk
|
|
||||||
dbHostname: peertube-gsb-postgresql # must be consistent with postgresql configuration
|
|
||||||
webHostname: peertube.gsb.lan # must be changed to your local setup
|
|
||||||
secret: b2753b0f37444974de0e81f04815e6a889fcf8960bd203a01b624d8fa8a37683
|
|
||||||
smtpHostname: peertube-gsb-mail # must be consistent with mail configuration
|
|
||||||
smtpPort: 587 # must be consistent with mail configuration
|
|
||||||
smtpFrom: noreply@lan.lan # not configured by default, add something meaningfull if you want
|
|
||||||
smtpTls: false # disabled by default WARNING: tls connection feature not tested, use at your own risk
|
|
||||||
smtpDisableStartTls: false # unless crashes related to tls/ssl, this should be unchanged
|
|
||||||
adminEmail: root@localhost.lan # use this if you want peopleto be able to reach you
|
|
||||||
redisHostname: peertube-gsb-redis-master # must be consistent with redis configuration
|
|
||||||
redisAuth: peertube # must be consistent with redis configuration
|
|
||||||
app:
|
|
||||||
userCanRegister: true # control if people can register by themselves
|
|
||||||
rootPasswd: rootroot # CHANGE THIS! the default admin username is 'root' this variable define the password
|
|
||||||
## the next section configure at wich quality videos will be transcoded
|
|
||||||
transcoding360: true
|
|
||||||
transcoding480: true
|
|
||||||
transcoding720: true
|
|
||||||
transcoding1080: false
|
|
||||||
transcoding2160: false
|
|
||||||
|
|
||||||
## the configuration of the postfix server called 'mail' here
|
|
||||||
# change these settings if you know what you are doing
|
|
||||||
mail:
|
|
||||||
enbled: true
|
|
||||||
config:
|
|
||||||
general:
|
|
||||||
ALLOWED_SENDER_DOMAINS: "yes"
|
|
||||||
DKIM_AUTOGENERATE: "yes"
|
|
||||||
opendkim:
|
|
||||||
RequireSafeKeys: "no"
|
|
||||||
postfix:
|
|
||||||
smtp_tls_security_level: "secure" # works by default, any other tls level is untested
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
service:
|
|
||||||
port: 587
|
|
||||||
|
|
||||||
## the configuration of the redis server
|
|
||||||
redis:
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: "pvc-redis"
|
|
||||||
replica:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: "pvc-redis"
|
|
||||||
auth:
|
|
||||||
enbled: true
|
|
||||||
password: "peertube"
|
|
||||||
|
|
||||||
## ingress configuration is very specific this part must be configured or else you'll get 503 or 404 errors
|
|
||||||
ingress:
|
|
||||||
enabled: true
|
|
||||||
className: ""
|
|
||||||
annotations:
|
|
||||||
kubernetes.io/ingress.class: traefik
|
|
||||||
traefik.ingress.kubernetes.io/proxy-body-size: 6G # this caps the size of imported videos, if set low this might prevent you from uploading videos
|
|
||||||
# kubernetes.io/tls-acme: "true"
|
|
||||||
hosts:
|
|
||||||
- host: peertube.gsb.lan
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: ImplementationSpecific
|
|
||||||
tls:
|
|
||||||
- secretName: tls-peertube
|
|
||||||
- hosts:
|
|
||||||
- peertube.gsb.lan
|
|
||||||
|
|
||||||
resources: {}
|
|
||||||
autoscaling:
|
|
||||||
enabled: false
|
|
||||||
minimumReplicas: 3
|
|
||||||
maximumReplicas: 20
|
|
||||||
targetCPUUtilizationPercentage: 90
|
|
||||||
targetMemoryUtilizationPercentage: 75
|
|
||||||
windowSeconds: 120
|
|
||||||
minCPUPercentage: 20
|
|
||||||
minMemoryPercentage: 30
|
|
||||||
|
|
||||||
## this section should be configured to match your needs and available ressources
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
reclaimPolicy: Retain
|
|
||||||
redisVolumeStorage: 1Gi
|
|
||||||
peertubeVolumeStorage: 5Gi
|
|
||||||
postgresqlVolumeStorage: 1Gi
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
|
|
||||||
nodeSelector: {}
|
|
||||||
tolerations: []
|
|
||||||
affinity: {}
|
|
||||||
@ -1,28 +0,0 @@
|
|||||||
---
|
|
||||||
- name: création du répertoire du dépot peertube...
|
|
||||||
file:
|
|
||||||
path: /root/tools/peertube
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: clonage du dépot peertube...
|
|
||||||
git:
|
|
||||||
repo: https://github.com/Elam-Monnot/Peertube-helm.git
|
|
||||||
dest: /root/tools/peertube
|
|
||||||
clone: yes
|
|
||||||
force: yes
|
|
||||||
|
|
||||||
- name: copie de values.yaml...
|
|
||||||
copy:
|
|
||||||
src: /root/tools/ansible/gsb2023/roles/peertube/files/values.yaml
|
|
||||||
dest: /root/tools/peertube/helm/
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: copie du script finish...
|
|
||||||
copy:
|
|
||||||
src: /root/tools/ansible/gsb2023/roles/peertube/files/finish
|
|
||||||
dest: /root
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: installation de helm...
|
|
||||||
shell: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
|
||||||
@ -1,7 +0,0 @@
|
|||||||
# Rôle Post
|
|
||||||
|
|
||||||
Le rôle "post" copie la configuration des interfaces des cartes réseaux nécessaires selon la machine sur laquelle on exécute le rôle. Il place cette configuration dans /etc/network/interfaces.
|
|
||||||
|
|
||||||
Ensuite, on copie le fichier "resolv.conf" dans /etc/ lorsque que la machine qui exécute le rôle n'est pas "s-adm", "s-proxy" ou "r-vp2".
|
|
||||||
|
|
||||||
Cependant, si la machine qui exécute le rôle est "s-proxy", on copie le fichier "resolv.conf.s-proxy" dans /etc/resolv.conf
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
### 0.2 - putconf - jeudi 7 janvier 2016, 16:18:49 (UTC+0100)
|
|
||||||
|
|
||||||
# The loopback network interface
|
|
||||||
auto lo
|
|
||||||
iface lo inet loopback
|
|
||||||
|
|
||||||
# carte n-adm
|
|
||||||
allow-hotplug enp0s3
|
|
||||||
iface enp0s3 inet static
|
|
||||||
address 192.168.99.101/24
|
|
||||||
|
|
||||||
# Réseau n-dmz-lb
|
|
||||||
allow-hotplug enp0s8
|
|
||||||
iface enp0s8 inet static
|
|
||||||
address 192.168.101.1/24
|
|
||||||
|
|
||||||
# réseau n-dmz-db
|
|
||||||
allow-hotplug enp0s9
|
|
||||||
iface enp0s9 inet static
|
|
||||||
address 192.168.102.1/24
|
|
||||||
post-up mount -o rw 192.168.102.253:/home/wordpress /var/www/html
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
### 0.2 - putconf - jeudi 7 janvier 2016, 16:18:49 (UTC+0100)
|
|
||||||
|
|
||||||
# The loopback network interface
|
|
||||||
auto lo
|
|
||||||
iface lo inet loopback
|
|
||||||
|
|
||||||
# carte n-adm
|
|
||||||
allow-hotplug enp0s3
|
|
||||||
iface enp0s3 inet static
|
|
||||||
address 192.168.99.101/24
|
|
||||||
|
|
||||||
# Réseau n-dmz-lb
|
|
||||||
allow-hotplug enp0s8
|
|
||||||
iface enp0s8 inet static
|
|
||||||
address 192.168.101.1/24
|
|
||||||
|
|
||||||
# réseau n-dmz-db
|
|
||||||
allow-hotplug enp0s9
|
|
||||||
iface enp0s9 inet static
|
|
||||||
address 192.168.102.1/24
|
|
||||||
post-up mount -o rw 192.168.102.253:/home/wordpress /var/www/html
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
search gsb.lan
|
|
||||||
domain gsb.lan
|
|
||||||
nameserver 172.16.0.1
|
|
||||||
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
|
|
||||||
- name: Copie interfaces
|
|
||||||
copy: src=interfaces.{{ ansible_hostname }} dest=/etc/network/interfaces
|
|
||||||
|
|
||||||
- name: Copie resolv.conf
|
|
||||||
copy: src=resolv.conf dest=/etc/
|
|
||||||
when: ansible_hostname != "s-adm" and ansible_hostname != "s-proxy"
|
|
||||||
|
|
||||||
- name: pas de chgt resolv.conf pour r-vp2
|
|
||||||
meta: end_play
|
|
||||||
when: ansible_hostname == "r-vp2"
|
|
||||||
|
|
||||||
- name: Copie resolv.conf pour s-proxy
|
|
||||||
copy: src=resolv.conf.s-proxy dest=/etc/resolv.conf
|
|
||||||
when: ansible_hostname == "s-proxy"
|
|
||||||
|
|
||||||
#- name: Confirm
|
|
||||||
# prompt: "<Entree> pour redemarrer ..."
|
|
||||||
|
|
||||||
#- name: Reboot
|
|
||||||
# shell: reboot
|
|
||||||
|
|
||||||
@ -34,4 +34,4 @@ iface enp0s10 inet static
|
|||||||
allow-hotplug enp0s16
|
allow-hotplug enp0s16
|
||||||
iface enp0s16 inet static
|
iface enp0s16 inet static
|
||||||
address 172.16.0.254/24
|
address 172.16.0.254/24
|
||||||
post-up sleep 10 && systemctl restart isc-dhcp-server
|
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user