ajout ferm.conf

goss/list-goss

@@ -0,0 +1,12 @@
+cd goss/
+goss -g r-vp1.yaml v
+goss  -g r-vp1.yaml aa wireguard
+goss add interface enp0s3
+goss add interface enp0s8
+goss add interface enp0s9
+goss add interface wg0
+goss aa wireguard
+goss add package wireguard-tools
+goss add service wg-quick@wg0
+goss add command "ping -c4  10.0.0.2"
+goss add file "/etc/wireguard/wg0.conf"

goss/r-vp1.yaml

@@ -1,76 +1,56 @@
+file:
+  /etc/wireguard/wg0.conf:
+    exists: true
+    mode: "0644"
+    owner: root
+    group: root
+    filetype: file
+    contains:
+    - AllowedIPs = 10.0.0.2/32, 172.16.128.0/24
 package:
-#  ferm:
-#    installed: true
-   wireguard:
+  wireguard:
     installed: true
-   wireguard-tools:
+    versions:
+    - 1.0.20210223-1
+  wireguard-tools:
     installed: true
-port:
-  udp:68:
-    listening: true
+    versions:
+    - 1.0.20210223-1
 service:
-#  dnsmasq:
-#    enabled: true
-#    running: true
-   wireguard:
-    enabled: true
-    running: true
-  ssh:
+  wg-quick@wg0:
     enabled: true
     running: true
 command:
-  sysctl net.ipv4.ip_forward:
+  host 192.168.99.99:
     exit-status: 0
     stdout:
-    - net.ipv4.ip_forward = 1
+    - 99.99.168.192.in-addr.arpa domain name pointer s-adm.gsb.adm.
     stderr: []
     timeout: 10000
-command:  
-  ping -c 4 192.168.0.52:
+  ping -c4  10.0.0.2:
     exit-status: 0
     stdout:
-    - 4 received = 1
+    - 0% packet loss
     stderr: []
     timeout: 10000
-command:
-  ping -c 4 192.168.1.1:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-command:
-  ping -c 4 192.168.200.254:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-command:
-  ping -c 4 172.16.0.1:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-command:
-  ping -c 4 10.0.0.2:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-#process:
-#  dnsmasq:
-#    running: true
-#  squid:
-#    running: true
 interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.112/24
+    mtu: 1500
   enp0s8:
     exists: true
     addrs:
-    - 192.168.0.51/24
+    - 192.168.1.2/24
+    mtu: 1500
   enp0s9:
     exists: true
     addrs:
-    - 192.168.1.2/24
+    - 192.168.0.51/24
+    mtu: 1500
+  wg0:
+    exists: true
+    addrs:
+    - 10.0.0.1/32
+    mtu: 1420

goss/r-vp2.yaml

@@ -0,0 +1,52 @@
+file:
+  /etc/wireguard/wg0.conf:
+    exists: true
+    mode: "0644"
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  wireguard:
+    installed: true
+    versions:
+    - 1.0.20210223-1
+  wireguard-tools:
+    installed: true
+    versions:
+    - 1.0.20210223-1
+service:
+  isc-dhcp-server:
+    enabled: true
+    running: true
+  wg-quick@wg0:
+    enabled: true
+    running: true
+command:
+  ping -c4 10.0.0.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.102/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.128.254/24
+    mtu: 1500
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.0.52/24
+    mtu: 1500
+  wg0:
+    exists: true
+    addrs:
+    - 10.0.0.2/32
+    mtu: 1420

goss/r-vp2goss.yaml

@@ -1,67 +0,0 @@
-package:
-  ferm:
-    installed: true
-  ipsec:
-    installed: true
-port:
-  tcp:53: 
-    listening: true
-  udp:67:
-    listening: true
-  udp:68:
-    listening: true
-service:
-  dnsmasq:
-    enabled: true
-    running: true
-  ferm:
-    enabled: true
-    running: true
-  ssh:
-    enabled: true
-    running: true
-command:
-  sysctl net.ipv4.ip_forward:
-    exit-status: 0
-    stdout:
-    - net.ipv4.ip_forward = 1
-    stderr: []
-    timeout: 10000
-  sysctl ping -c 4 192.168.0.51:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-  sysctl ping -c 4 192.168.1.1:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-  sysctl ping -c 4 192.168.200.254:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-  sysctl ping -c 4 172.16.0.1:
-    exit-status: 0
-    stdout:
-    - 4 received = 1
-    stderr: []
-    timeout: 10000
-process:
-  dnsmasq:
-    running: true
-  squid3:
-    running: true
-interface:
-  enp0s8:
-    exists: true
-    addrs:
-    - 172.16.128.254/24
-  enp0s9:
-    exists: true
-    addrs:
-    - 192.168.0.52/24

goss/s-agence.yaml

@@ -1,39 +1,19 @@
 command:
-  ip r:
+  ip route |grep default:
     exit-status: 0
     stdout:
     - default via 172.16.128.254 dev enp0s8
-    - 172.16.128.0/24
-    - 192.168.99.0/24
     stderr: []
     timeout: 10000
-  ping -c 2 172.16.128.254:
+  ping -c4 172.16.0.1:
     exit-status: 0
     stdout:
     - 0% packet loss
     stderr: []
     timeout: 10000
-  ping -c 2 192.168.1.2:
+  ping -c4 172.16.128.254:
     exit-status: 0
     stdout:
-    - 0% packet loss
-    stderr: []
-    timeout: 10000
-  ping -c 2 192.168.1.1:
-    exit-status: 0
-    stdout:
-    - 0% packet loss
-    stderr: []
-    timeout: 10000
-  ping -c 2 192.168.200.254:
-    exit-status: 0
-    stdout:
-    - 0% packet loss
-    stderr: []
-    timeout: 10000
-  ping -c 2 172.16.0.1:
-    exit-status: 0
-    stdout:
-    - 0% packet loss
+    -  0% packet loss
     stderr: []
     timeout: 10000

goss/s-backup.yaml

@@ -0,0 +1,41 @@
+package:
+  bind9:
+    installed: true
+  cifs-utils:
+    installed: true
+  rsync:
+    installed: true
+  smbclient:
+    installed: true
+service:
+  bind9:
+    enabled: true
+    running: true
+  rsync:
+    enabled: true
+    running: false
+command:
+  ping -c4 ns.gsb.lan:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+#check si partage windows accesible
+  smbclient -L //s-win --user=uBackup%Azerty1+ | grep 'public':
+    exit-status: 0
+    stdout:
+    - public
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.4/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.4/24
+    mtu: 1500

goss/s-mon.yaml

@@ -49,7 +49,7 @@ interface:
   enp0s3:
     exists: true
     addrs:
-    - 192.168.99.104/24
+    - 192.168.99.8/24
   enp0s8:
     exists: true
     addrs:

pre/inst-depl

@@ -9,16 +9,23 @@ apt update && apt upgrade
 apt install -y apache2 git 
 STOREREP="/var/www/html/gsbstore" 
 
-GLPIREL=10.0.5
+GLPIREL=10.0.6
 str="wget -nc https://github.com/glpi-project/glpi/releases/download/${GLPIREL}/glpi-${GLPIREL}.tgz"
 
-FIREL=10.0.3+1.0
-str2="https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi${FIREL}/fusioninventory-${FIREL}.tar.bz2"
 
-FIAGREL=2.6
-str31="wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x64_${FIAGREL}.exe"
+#Fusion Inventory
+
+#FIREL=10.0.3+1.0
+#str2="https://github.com/fusioninventory/fusioninventory-for-glpi/releases/download/glpi${FIREL}/fusioninventory-${FIREL}.tar.bz2"
+
+
+#GLPI Agent
+
+GLPIAGVER=1.4
+str31="wget -nc https://github.com/glpi-project/glpi-agent/releases/download/${GLPIAGVER}/GLPI-Agent-${GLPIAGVER}-x64.msi"
+
+str32="wget -nc https://github.com/glpi-project/glpi-agent/releases/download/${GLPIAGVER}/GLPI-Agent-${GLPIAGVER}-x86.msi"
 
-str32="wget -nc https://github.com/fusioninventory/fusioninventory-agent/releases/download/${FIAGREL}/fusioninventory-agent_windows-x86_${FIAGREL}.exe"
 
 FOGREL=1.5.9
 str4="wget -nc https://github.com/FOGProject/fogproject/archive/${FOGREL}.tar.gz -O fogproject-${FOGREL}.tar.gz"

roles/base/templates/hosts.j2

@@ -10,18 +10,23 @@
 192.168.99.3	s-appli.gsb.adm
 192.168.99.4	s-backup.gsb.adm
 192.168.99.5	s-puppet.gsb.adm
-192.168.99.6 	s-win.gsb.adm 
+192.168.99.6	s-win.gsb.adm 
 192.168.99.7	s-nxc.gsb.adm
 192.168.99.8	s-mon.gsb.adm
 192.168.99.9	s-itil.gsb.adm
-192.168.99.10	s-sspec.gsb.adm
-192.168.99.11	s-web-ext.gsb.adm
+192.168.99.10	s-lb.gsb.adm
+192.168.99.11	s-elk.gsb.adm
 192.168.99.10	s-dns.gsb.adm
 192.168.99.12	r-int.gsb.adm
 192.168.99.13	r-ext.gsb.adm
 192.168.99.14	s-nas.gsb.adm
 192.168.99.15	s-san.gsb.adm
 192.168.99.16	s-fog.gsb.adm
+192.168.99.50	s-lb-bd.gsb.adm
+192.168.99.101	s-lb-web1.gsb.adm
+192.168.99.102	s-lb-web2.gsb.adm
+192.168.99.103	s-lb-web3.gsb.adm
+
 
 192.168.99.8	syslog.gsb.adm
 

roles/base/templates/hosts.s-proxy.j2

@@ -11,16 +11,20 @@
 192.168.99.3	s-appli.gsb.adm
 192.168.99.4	s-backup.gsb.adm
 192.168.99.5	s-puppet.gsb.adm
-192.168.99.6 	s-win.gsb.adm 
+192.168.99.6	s-win.gsb.adm 
 192.168.99.7	s-nxc.gsb.adm
 192.168.99.8	s-mon.gsb.adm
 192.168.99.9	s-itil.gsb.adm
-192.168.99.10	s-sspec.gsb.adm
-192.168.99.11	s-web-ext.gsb.adm
+192.168.99.10	s-lb.gsb.adm
+192.168.99.11	s-elk.gsb.adm
 192.168.99.10	s-dns.gsb.adm
 192.168.99.12	r-int.gsb.adm
 192.168.99.13	r-ext.gsb.adm
 192.168.99.14	s-nas.gsb.adm
+192.168.99.50	s-lb-bd.gsb.adm
+192.168.99.101	s-lb-web1.gsb.adm
+192.168.99.102	s-lb-web2.gsb.adm
+192.168.99.103	s-lb-web3.gsb.adm
 
 192.168.99.8	syslog.gsb.adm
 

roles/dns-master/files/db.gsb.lan

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2022041200      ; Serial
+                        2023012500      ; Serial
                         7200	        ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -25,7 +25,7 @@ s-nxc		IN	A	172.16.0.7
 s-docker	IN	A	172.16.0.7
 s-mon    	IN      A       172.16.0.8
 s-itil		IN	A	172.16.0.9
-s-elk		IN	A	172.16.0.10
+s-elk		IN	A	172.16.0.11
 s-gestsup	IN	A	172.16.0.17
 r-int    	IN      A       172.16.0.254
 r-int-lnk    	IN      A       192.168.200.254

roles/dns-master/files/db.gsb.lan.rev

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2022041200      ; Serial
+                        2023012500      ; Serial
                         7200            ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -20,12 +20,12 @@ $TTL    604800
 6.0       IN      PTR     s-win.gsb.lan.
 7.0       IN      PTR     s-nxc.gsb.lan.
 8.0       IN      PTR     s-mon.gsb.lan.
-9.0	  IN	  PTR 	  s-itil.gsb.lan.
+9.0	  IN	  PTR	  s-itil.gsb.lan.
 101.1     IN      PTR     s-web1
 101.2     IN      PTR     s-web2
 100.10   IN      PTR      s-lb
 100.10   IN      PTR      s-lb.gsb.lan
-10.0	  IN	  PTR	  s-elk.gsb.lan.
+11.0	  IN	  PTR	  s-elk.gsb.lan.
 17.0	  IN	  PTR	  s-gestsup.lan
 254.0     IN      PTR     r-int.gsb.lan.
 

roles/fw-ferm-1/ferm.conf

@@ -0,0 +1,63 @@
+# -*- shell-script -*-
+#
+# Ferm script r-vp1
+
+@def $DEV_PRIVATE = enp0s8;
+@def $DEV_WORLD = enp0s9;
+
+@def $NET_PRIVATE = 172.16.0.0/24;
+
+table filter {
+    chain (INPUT OUTPUT){
+        # allow VPN
+	proto udp dport 51820 ACCEPT;
+}
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;  
+       
+
+        # allow SSH connections from the private network and from some
+        # well-known internet hosts
+        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+
+        # we provide DNS and SMTP services for the internal net
+        interface $DEV_PRIVATE saddr $NET_PRIVATE {
+            proto (udp tcp) dport domain ACCEPT;
+            proto udp dport bootps ACCEPT;            
+        }
+
+        # interface réseau 
+        interface $DEV_WORLD {
+            
+        }
+
+        # the rest is dropped by the above policy
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_PRIVATE ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+}

roles/fw-ferm-1/nmap-rvp1.txt

@@ -0,0 +1,12 @@
+# CMD
+sudo nmap -pU:51820  192.168.0.51
+#Resultat
+Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-27 09:02 CET
+Nmap scan report for 192.168.0.51
+Host is up (0.00030s latency).
+
+PORT      STATE    SERVICE
+51820/tcp filtered unknown
+MAC Address: 08:00:27:F0:E2:46 (Oracle VirtualBox virtual NIC)
+
+Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

roles/fw-ferm-2/ferm.conf

@@ -0,0 +1,62 @@
+# -*- shell-script -*-
+#
+# Ferm script r-vp2
+
+@def $DEV_PRIVATE = enp0s9;
+@def $DEV_WORLD = enp0s8;
+
+@def $NET_PRIVATE = 172.16.0.0/24;
+
+table filter {
+    chain (INPUT OUTPUT){
+        # allow VPN
+	proto udp dport 51820 ACCEPT;
+}
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+
+        # allow SSH connections from the private network and from some
+        # well-known internet hosts
+        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+
+        # we provide DNS and SMTP services for the internal net
+        interface $DEV_PRIVATE saddr $NET_PRIVATE {
+            proto (udp tcp) dport domain ACCEPT;
+            proto udp dport bootps ACCEPT;
+        }
+
+        # interface réseau
+        interface $DEV_WORLD {
+
+        }
+
+        # the rest is dropped by the above policy
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_PRIVATE ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+}

roles/fw-ferm-2/nmap-rvp2.txt

@@ -0,0 +1,9 @@
+Starting Nmap 7.80 ( https://nmap.org ) at 2023-01-27 09:33 CET
+Nmap scan report for 192.168.0.52
+Host is up (0.00021s latency).
+
+PORT      STATE    SERVICE
+51820/tcp filtered unknown
+MAC Address: 08:00:27:31:FA:71 (Oracle VirtualBox virtual NIC)
+
+Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

roles/glpi/defaults/main.yml

@@ -0,0 +1,6 @@
+depl_url: "http://s-adm.gsb.adm/gsbstore"
+#depl_glpi: "glpi-9.5.6.tgz"
+depl_glpi: "glpi-10.0.6.tgz"
+#depl_fusioninventory: "fusioninventory-9.5+3.0.tar.bz2"
+depl_glpi_agentx64: "GLPI-Agent-1.4-x64.msi"
+depl_glpi_agentx86: "GLPI-Agent-1.4-x86.msi"

roles/glpi/tasks/main.yml

@@ -105,12 +105,12 @@
 #  - name: copy .my.cnf file with root password credentials
 #    copy: src=.my.cnf dest=/root/tools/ansible/.my.cnf owner=root mode=0600
 
-  - name: Installation de Fusioninventory pour Linux
-    unarchive:
-      src: "{{ depl_url }}/{{ depl_fusioninventory }}"
-      #src: http://depl/gsbstore/fusioninventory-{{ fd_version }}.tar.bz2
-      dest: /var/www/html/glpi/plugins
-      remote_src: yes
+#  - name: Installation de Fusioninventory pour Linux
+#    unarchive:
+#      src: "{{ depl_url }}/{{ depl_fusioninventory }}"
+#src: http://depl/gsbstore/fusioninventory-{{ fd_version }}.tar.bz2
+#      dest: /var/www/html/glpi/plugins
+#      remote_src: yes
 
   - name: Creation de ficlient
     file:
@@ -127,23 +127,15 @@
       group: www-data
       mode: 0775
 
-  - name: Installation de FusionInventory windows x64
+  - name: Installation de GLPI Agent windows x64
     get_url:
-      url: "{{ depl_url }}/{{ depl_fusioninventory_agentx64 }}"
+      url: "{{ depl_url }}/{{ depl_glpi_agentx64 }}"
       dest: "/var/www/html/ficlients"
 
-  - name: Installation de FusionInventory windows x86
-    get_url:
-      url: "{{ depl_url }}/{{ depl_fusioninventory_agentx86 }}"
-      dest: "/var/www/html/ficlients"
-
-  - name: Attribution des permissions sur repertoire /plugins/fusioninventory
-    file:
-      path: /var/www/html/glpi/plugins/fusioninventory
-      owner: www-data
-      group: www-data
-      recurse: yes
-      state: directory
+#  - name: Installation de GLPI Agent windows x86
+#    get_url:
+#      url: "{{ depl_url }}/{{ depl_glpi_agentx86 }}"
+#      dest: "/var/www/html/ficlients"
 
   - name: Copie du script dbdump
     copy: 

roles/itil/defaults/main.yml

@@ -1,6 +0,0 @@
-depl_url: "http://s-adm.gsb.adm/gsbstore"
-#depl_glpi: "glpi-9.5.6.tgz"
-depl_glpi: "glpi-10.0.5.tgz"
-depl_fusioninventory: "fusioninventory-9.5+3.0.tar.bz2"
-depl_fusioninventory_agentx64: "fusioninventory-agent_windows-x64_2.6.exe"
-depl_fusioninventory_agentx86: "fusioninventory-agent_windows-x86_2.6.exe"

roles/lb-front/files/haproxy.cfg

@@ -44,7 +44,6 @@ backend fermeweb
 	#option httpchk HEAD / HTTP/1.0
 	server s-lb-web1 192.168.101.1:80 check
 	server s-lb-web2 192.168.101.2:80 check
-	#server s-lb-web3 192.168.101.3:80 check
 
 
 listen stats

roles/lb-front/tasks/main.yml

@@ -8,18 +8,18 @@
     path: /etc/haproxy/haproxy.cfg
     block: |
       frontend proxypublic
-        bind 192.168.56.2:80
+        bind 192.168.100.10:80
         default_backend fermeweb
       
       backend fermeweb
         balance roundrobin
         option httpclose
         #option httpchk HEAD / HTTP/1.0
-        server web1.test 192.168.56.3:80 check
-        #server web2.test 192.168.56.4:80 check
+        server s-lb-web1 192.168.101.1:80 check
+        server s-lb-web2 192.168.101.2:80 check
 
 - name: redemarre haproxy
   service:
     name: haproxy
-    state: restarted
+#    state: restarted
     enabled: yes

roles/lb-nfs-server/README.md

@@ -5,6 +5,6 @@ Ce rôle :
   * installe **nfs-server**
   * copie le fichier de configuration **exports**  pour exporter le répertoire **/home/wordpress** 
   * relance le service **nfs-server**
-
+  * décompresse wordpress
 ### Objectif
 Le répertoire **/home/wordpress** est exporté par **nfs** sur le réseau **n-dmz-db**

roles/lb-nfs-server/files/exports

@@ -7,4 +7,4 @@
 # Example for NFSv4:
 # /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
 # /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
-/home/wordpress 192.168.102.0/255.255.255.0 (rw,no_root_squash,subtree_check)
+/home/wordpress 192.168.102.0/255.255.255.0(rw,no_root_squash,subtree_check)

roles/lb-nfs-server/tasks/main.yml

@@ -1,18 +1,70 @@
----
- - name: installation des paquets 
-   apt:
-     name: 
-     - nfs-kernel-server
-     state: latest
+- name: 00 - cree repertoire wordpress pour export nfs
+  file:
+    path: /home/wordpress
+    state: directory
 
- - name: copie exports pour partage nfs wordpress
-   copy:
-    src: exports
-    dest: /etc
+- name: 05 - Install nfs-server
+  apt:
+    name: nfs-server
+    state: present
 
- - name: redemarrage du service rpcbind requis pour le service nfs
-   shell: service rpcbind restart
+- name: 10 - creation fichier exports nfs
+  ansible.builtin.blockinfile:
+    path: /etc/exports
+    block: |
+      /home/wordpress 192.168.102.0/255.255.255.0(rw,no_root_squash,subtree_check)
 
- - name: redemarrage du service nfs-kernel-server
-   shell: service nfs-kernel-server restart
+- name: 20 - decompresse wordpress
+  unarchive:
+    src: https://fr.wordpress.org/latest-fr_FR.tar.gz
+    dest: /home/
+    remote_src: yes
 
+- name: 22 - change owner et group pour repertoire wordpress
+  file:
+    path: /home/wordpress
+    state: directory
+    recurse: yes
+    owner: www-data
+    group: www-data
+
+- name: 30 - genere fichier de config wordpress
+  copy:
+    src: /home/wordpress/wp-config-sample.php
+    dest: /home/wordpress/wp-config.php
+    remote_src: yes
+
+- name: 35 - ajuste variable dbname dans fichier de config wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "votre_nom_de_bdd"
+    replace: "wordpressdb"
+    backup: yes
+
+
+- name: 40 ajuste variable dbusername dans fichier de config wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "votre_utilisateur_de_bdd"
+    replace: "wordpressuser"
+    backup: yes
+
+- name: 45 - ajuste variable mdp dans fichier de config wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "votre_mdp_de_bdd"
+    replace: "wordpresspasswd"
+    backup: yes
+
+- name: 50 - ajuste hostname fichier wp-config.php
+  replace:
+    path: /home/wordpress/wp-config.php
+    regexp: "localhost"
+    replace: "192.168.102.253"
+    backup: yes
+
+- name: 55 - relance nfs
+  service:
+    name: nfs-server
+    state: restarted
+    enabled: yes

roles/lb-web/tasks/main.yml

@@ -1,38 +1,10 @@
---- 
- - name: creation repertoir
-   file:
-    path: /home/
-    state: directory
- - name: download and extract wordpress
-   unarchive: 
-    src: "{{ depl_url }}/{{ depl_wordpress }}"
-    dest: /home/
-    remote_src: yes
-    owner: www-data
-    group: www-data
-
- - name: Copy sample config file
-   command: mv /home/wordpress/wp-config-sample.php /home/wordpress/wp-config.php creates=/home/wordpress/wp-config.php
-
- - name: Changement du fichier de conf
-   copy:
-     src: wp-config.php
-     dest: /home/wordpress/wp-config.php
-
- - name: Attributions des permissions
-   file:
-     path: /home/wordpress
-     recurse: yes
-     owner: 33
-     group: 33
-
-# - name: Fix permissions
-#   shell: chown -R www-data /var/www/wordpress/*
-#
-# - name: Update default Apache site
-#   lineinfile:
-#     dest=/etc/apache2/sites-enabled/000-default.conf
-#     regexp="(.)+DocumentRoot /var/www/html"
-#     line="DocumentRoot /var/www/wordpress"
-#   notify:
-#     - restart apache2
+---
+- name: installation php et apache ...
+  apt:
+    name:
+      - apache2
+      - php
+      - php-mbstring
+      - php-mysql
+      - mariadb-client
+    state: present

roles/post/files/interfaces.s-elk

@@ -8,13 +8,13 @@ iface lo inet loopback
 # cote N-adm
 allow-hotplug enp0s3
 iface enp0s3 inet static
-	address 192.168.99.10
+	address 192.168.99.11
 	netmask 255.255.255.0
 	gateway 192.168.99.99
 
 # cote N-infra
 allow-hotplug enp0s8
 iface enp0s8 inet static
-	address 172.16.0.10
+	address 172.16.0.11
 	netmask 255.255.255.0
 	post-up route add -net 172.16.64.0/24 gw 172.16.0.254

roles/smb-backup/README.md

@@ -6,6 +6,13 @@ s-backup permet de récupérer les dossiers et fichiers présent dans le répert
 # Lancement du script backup.sh
 
 Après la fin de l'installation de s-backup et la fin de la configuration de s-win vous pouvez
-lancer le fichier backup.sh pour récuperer l'intégraliter du fichier partagé gsb.lan de s-win
+lancer le fichier backupsmb.sh pour récuperer l'intégraliter du fichier partagé gsb.lan de s-win
 sur la machine s-backup.
 
+# Crontab
+
+Une crontab a été ajoutée mais désactivée par défaut ( backupsmb.sh executée tout les jours à 5h00)
+
+# Pistes
+
+- Traps à consolider 

roles/smb-backup/tasks/main.yml

@@ -2,7 +2,22 @@
   apt:
     name:
       - rsync
-      - smbclient 
+      - smbclient
       - cifs-utils
     state: present
 
+- name: copie script backupsmb dans /usr/local/bin
+  copy:
+    src: backupsmb.sh
+    dest: /usr/local/bin
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: crontab backupsmb ( commentee par defaut )
+  cron:
+    name: backupsmb
+    disabled: true
+    minute: "0"
+    hour: "5"
+    job: "/usr/local/bin/backupsmb.sh"

roles/wireguard-r/README.md

@@ -1,14 +1,13 @@
-#Installation de r-vp1 (Wireguard)
+Procédure d'installation de r-vp1 et de copie du fichier wg0-b.conf.
+***
 
-***
-Ce fichier à pour but de présenter l'installation de r-vp1
-***
+Depuis r-vp1 se deplacer dans le repertoire **/tools/ansible/gsb2023** pour executer le playbook:
+**"ansible-playbook -i localhost, -c local r-vp1.yml"** puis reboot r-vp1.
+
+Attendre la fin de l'installation. Ensuite faire une copie distante du fichier
+wg0-b.conf sur r-vp2 **"scp /confwg/wg0-b.conf root@'ip r-vp2':/etc/wireguard/"**.
  
-Se rendre dans le dossier gsb2022 et éxécuter la commande suivante : 
-_"ansible-playbook -i localhost, -c local r-vp1.yml"_
-Attendre la fin de l'installation, puis se rendre dans le dossier confwg
-Faites une copie à distance du fichier wg0-b.conf sur r-vp2 et déplacer le fichier wg0-a.conf localement dans /etc/wireguard
-Renommer les deux fichiers en wg0.conf
-Executer _"systemctl enable wg-quick@wg0"_ puis _"systemctl start wg-quick@wg0"_ sur r-vp1 et r-vp2
-Entrer la commande _"wg"_ si des paquets sont envoyés et reçus votre VPN fonctionne. 
-Lorsque votre infrastructure est prête rendez vous dans gsb2022 et éxécuter le **fichier ping-sagence** afin vérifier le bon fonctionnement. 
+Renommer les fichiers en **wg0.conf**
+
+Executer **"systemctl enable wg-quick@wg0"** puis **"systemctl start wg-quick@wg0"** sur r-vp1 et r-vp2.
+Entrer la commande **"wg"** pour voir si l'interface wg0 est correctement montée. 

s-backup.yml

@@ -4,6 +4,7 @@
 
   roles:
     - base
+    - goss
 #   - proxy3
     - snmp-agent
 #   - ssh-cli

s-itil.yml

@@ -3,11 +3,7 @@
   connection: local
 
   vars:
-
-    glpi_version: "9.4.5"
-    fd_version: "9.4+1.1"
-    fd_version64: "x64_2.5.2"
-    fd_version86: "x86_2.5.2"
+    glpi_version: "10.0.6"
     glpi_dir: "/var/www/html/glpi"
     glpi_dbhost: "127.0.0.1"
     glpi_dbname: "glpi"
@@ -18,7 +14,7 @@
     - base
     - goss
     - snmp-agent
-    - itil
+    - glpi
     - ssh-cli
     - syslog-cli
     - post

s-lb-web1.yml

@@ -8,4 +8,3 @@
     - snmp-agent
     - lb-nfs-client
     - post
-

s-lb-web2.yml

@@ -4,8 +4,7 @@
 
   roles:
     - base
-    - s-lb-web-ab
+    - lb-web
     - snmp-agent
-    - s-nas-client
+    - lb-nfs-client
     - post
-

s-lb.yml

@@ -5,7 +5,7 @@
    roles:
      - base
      - goss
-     - s-lb-ab
+     - lb-front
      - snmp-agent
      - post
 

s-nas.yml

@@ -10,7 +10,6 @@
   roles:
     - base
     - snmp-agent
-    - lb-web
     - lb-nfs-server
     - ssh-cli
     - syslog-cli