Compare commits
18 Commits
v0.0.3l-em
...
v0.0.4a-aa
Author | SHA1 | Date | |
---|---|---|---|
0dbbaf0751 | |||
64f1b74ba7 | |||
5ddbedac97 | |||
05ddace1af | |||
9019c0dbe7 | |||
9fd18796a6 | |||
6e33ccce33 | |||
f38fca4561 | |||
01c2b76936 | |||
a6a35324ba | |||
70950f9e4e | |||
a7f366a124 | |||
143c3878a3 | |||
76b4ceabe3 | |||
0988c9729e | |||
9bcfcc6305 | |||
4cb8aa49b9 | |||
340333d5d1 |
12
goss/list-goss
Normal file
12
goss/list-goss
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
cd goss/
|
||||||
|
goss -g r-vp1.yaml v
|
||||||
|
goss -g r-vp1.yaml aa wireguard
|
||||||
|
goss add interface enp0s3
|
||||||
|
goss add interface enp0s8
|
||||||
|
goss add interface enp0s9
|
||||||
|
goss add interface wg0
|
||||||
|
goss aa wireguard
|
||||||
|
goss add package wireguard-tools
|
||||||
|
goss add service wg-quick@wg0
|
||||||
|
goss add command "ping -c4 10.0.0.2"
|
||||||
|
goss add file "/etc/wireguard/wg0.conf"
|
@ -15,6 +15,7 @@
|
|||||||
# - firewall-vpn-r
|
# - firewall-vpn-r
|
||||||
- wireguard-r
|
- wireguard-r
|
||||||
# - x509-r
|
# - x509-r
|
||||||
|
- fw-ferm
|
||||||
- ssh-cli
|
- ssh-cli
|
||||||
- syslog-cli
|
- syslog-cli
|
||||||
- post
|
- post
|
||||||
|
@ -18,6 +18,7 @@
|
|||||||
# - firewall-vpn-l
|
# - firewall-vpn-l
|
||||||
- wireguard-l
|
- wireguard-l
|
||||||
# - x509-l
|
# - x509-l
|
||||||
|
- fw-ferm
|
||||||
- ssh-cli
|
- ssh-cli
|
||||||
- syslog-cli
|
- syslog-cli
|
||||||
- post
|
- post
|
||||||
|
23
roles/fw-ferm/README.md
Normal file
23
roles/fw-ferm/README.md
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
[Ferm]:http://ferm.foo-projects.org/
|
||||||
|
|
||||||
|
Modifier l'execution d'iptables [plus d'info ici]:https://wiki.debian.org/iptables
|
||||||
|
```shell
|
||||||
|
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
||||||
|
```
|
||||||
|
|
||||||
|
Pour tester utiliser [Nmap]:https://nmap.org/man/fr/man-briefoptions.html
|
||||||
|
### r-vp1
|
||||||
|
```shell
|
||||||
|
sudo nmap -p51820 192.168.0.51
|
||||||
|
```
|
||||||
|
### r-vp2
|
||||||
|
```shell
|
||||||
|
sudo nmap -p51820 192.168.0.52
|
||||||
|
```
|
||||||
|
### Sortie :
|
||||||
|
```
|
||||||
|
`PORT STATE SERVICE
|
||||||
|
51820/tcp filtered unknown`
|
||||||
|
```
|
||||||
|
|
||||||
|
Faire des ping!
|
63
roles/fw-ferm/files/ferm.conf.r-vp1
Normal file
63
roles/fw-ferm/files/ferm.conf.r-vp1
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
# -*- shell-script -*-
|
||||||
|
#
|
||||||
|
# Ferm script r-vp1
|
||||||
|
|
||||||
|
@def $DEV_PRIVATE = enp0s8;
|
||||||
|
@def $DEV_WORLD = enp0s9;
|
||||||
|
|
||||||
|
@def $NET_PRIVATE = 172.16.0.0/24;
|
||||||
|
|
||||||
|
table filter {
|
||||||
|
chain (INPUT OUTPUT){
|
||||||
|
# allow VPN
|
||||||
|
proto udp dport 51820 ACCEPT;
|
||||||
|
}
|
||||||
|
chain INPUT {
|
||||||
|
policy DROP;
|
||||||
|
|
||||||
|
# connection tracking
|
||||||
|
mod state state INVALID DROP;
|
||||||
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||||
|
|
||||||
|
# allow local connections
|
||||||
|
interface lo ACCEPT;
|
||||||
|
|
||||||
|
# respond to ping
|
||||||
|
proto icmp icmp-type echo-request ACCEPT;
|
||||||
|
|
||||||
|
|
||||||
|
# allow SSH connections from the private network and from some
|
||||||
|
# well-known internet hosts
|
||||||
|
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
|
||||||
|
|
||||||
|
# we provide DNS and SMTP services for the internal net
|
||||||
|
interface $DEV_PRIVATE saddr $NET_PRIVATE {
|
||||||
|
proto (udp tcp) dport domain ACCEPT;
|
||||||
|
proto udp dport bootps ACCEPT;
|
||||||
|
}
|
||||||
|
|
||||||
|
# interface réseau
|
||||||
|
interface $DEV_WORLD {
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# the rest is dropped by the above policy
|
||||||
|
}#FIN INPUT
|
||||||
|
|
||||||
|
# outgoing connections are not limited
|
||||||
|
chain OUTPUT policy ACCEPT;
|
||||||
|
|
||||||
|
chain FORWARD {
|
||||||
|
policy ACCEPT;
|
||||||
|
|
||||||
|
# connection tracking
|
||||||
|
mod state state INVALID DROP;
|
||||||
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||||
|
|
||||||
|
# connections from the internal net to the internet or to other
|
||||||
|
# internal nets are allowed
|
||||||
|
interface $DEV_PRIVATE ACCEPT;
|
||||||
|
|
||||||
|
# the rest is dropped by the above policy
|
||||||
|
}
|
||||||
|
}
|
62
roles/fw-ferm/files/ferm.conf.r-vp2
Normal file
62
roles/fw-ferm/files/ferm.conf.r-vp2
Normal file
@ -0,0 +1,62 @@
|
|||||||
|
# -*- shell-script -*-
|
||||||
|
#
|
||||||
|
# Ferm script r-vp2
|
||||||
|
|
||||||
|
@def $DEV_PRIVATE = enp0s9;
|
||||||
|
@def $DEV_WORLD = enp0s8;
|
||||||
|
|
||||||
|
@def $NET_PRIVATE = 172.16.0.0/24;
|
||||||
|
|
||||||
|
table filter {
|
||||||
|
chain (INPUT OUTPUT){
|
||||||
|
# allow VPN
|
||||||
|
proto udp dport 51820 ACCEPT;
|
||||||
|
}
|
||||||
|
chain INPUT {
|
||||||
|
policy DROP;
|
||||||
|
|
||||||
|
# connection tracking
|
||||||
|
mod state state INVALID DROP;
|
||||||
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||||
|
|
||||||
|
# allow local connections
|
||||||
|
interface lo ACCEPT;
|
||||||
|
|
||||||
|
# respond to ping
|
||||||
|
proto icmp icmp-type echo-request ACCEPT;
|
||||||
|
|
||||||
|
# allow SSH connections from the private network and from some
|
||||||
|
# well-known internet hosts
|
||||||
|
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
|
||||||
|
|
||||||
|
# we provide DNS and SMTP services for the internal net
|
||||||
|
interface $DEV_PRIVATE saddr $NET_PRIVATE {
|
||||||
|
proto (udp tcp) dport domain ACCEPT;
|
||||||
|
proto udp dport bootps ACCEPT;
|
||||||
|
}
|
||||||
|
|
||||||
|
# interface réseau
|
||||||
|
interface $DEV_WORLD {
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
# the rest is dropped by the above policy
|
||||||
|
}#FIN INPUT
|
||||||
|
|
||||||
|
# outgoing connections are not limited
|
||||||
|
chain OUTPUT policy ACCEPT;
|
||||||
|
|
||||||
|
chain FORWARD {
|
||||||
|
policy ACCEPT;
|
||||||
|
|
||||||
|
# connection tracking
|
||||||
|
mod state state INVALID DROP;
|
||||||
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||||
|
|
||||||
|
# connections from the internal net to the internet or to other
|
||||||
|
# internal nets are allowed
|
||||||
|
interface $DEV_PRIVATE ACCEPT;
|
||||||
|
|
||||||
|
# the rest is dropped by the above policy
|
||||||
|
}
|
||||||
|
}
|
15
roles/fw-ferm/tasks/main.yml
Normal file
15
roles/fw-ferm/tasks/main.yml
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
- name: installation de ferm
|
||||||
|
apt:
|
||||||
|
name: ferm
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: copie du ferm.conf
|
||||||
|
copy:
|
||||||
|
src: ferm.conf.{{ ansible_hostname }}
|
||||||
|
dest: /etc/ferm/ferm.conf
|
||||||
|
|
||||||
|
- name: redemarage service ferm
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: ferm.service
|
||||||
|
state: restarted
|
@ -1,77 +1,70 @@
|
|||||||
- name: 00 - cree repertoire wordpress pour export nfs
|
- name: 00 - cree repertoire wordpress pour export nfs
|
||||||
file:
|
file:
|
||||||
path: /exports/wordpress
|
path: /home/wordpress
|
||||||
state: directory
|
state: directory
|
||||||
|
|
||||||
- name: 05 - Install nfs-server
|
- name: 05 - Install nfs-server
|
||||||
apt:
|
apt:
|
||||||
name: nfs-server
|
name: nfs-server
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
- name: 10 - creation fichier exports nfs
|
- name: 10 - creation fichier exports nfs
|
||||||
ansible.builtin.blockinfile:
|
ansible.builtin.blockinfile:
|
||||||
path: /etc/exports
|
path: /etc/exports
|
||||||
block: |
|
block: |
|
||||||
/exports/wordpress 192.168.56.0/255.255.255.0 (rw,no_root_squash,subtree_check)
|
/home/wordpress 192.168.102.0/255.255.255.0(rw,no_root_squash,subtree_check)
|
||||||
|
|
||||||
|
- name: 20 - decompresse wordpress
|
||||||
|
unarchive:
|
||||||
|
src: https://fr.wordpress.org/latest-fr_FR.tar.gz
|
||||||
|
dest: /home/
|
||||||
|
remote_src: yes
|
||||||
|
|
||||||
|
- name: 22 - change owner et group pour repertoire wordpress
|
||||||
|
file:
|
||||||
|
path: /home/wordpress
|
||||||
|
state: directory
|
||||||
|
recurse: yes
|
||||||
|
owner: www-data
|
||||||
|
group: www-data
|
||||||
|
|
||||||
|
- name: 30 - genere fichier de config wordpress
|
||||||
|
copy:
|
||||||
|
src: /home/wordpress/wp-config-sample.php
|
||||||
|
dest: /home/wordpress/wp-config.php
|
||||||
|
remote_src: yes
|
||||||
|
|
||||||
|
- name: 35 - ajuste variable dbname dans fichier de config wp-config.php
|
||||||
|
replace:
|
||||||
|
path: /home/wordpress/wp-config.php
|
||||||
|
regexp: "votre_nom_de_bdd"
|
||||||
|
replace: "wordpressdb"
|
||||||
|
backup: yes
|
||||||
|
|
||||||
|
|
||||||
- name: 15 - Recupere wordpress.tar.gz
|
- name: 40 ajuste variable dbusername dans fichier de config wp-config.php
|
||||||
get_url:
|
replace:
|
||||||
url: "https://fr.wordpress.org/latest-fr_FR.tar.gz"
|
path: /home/wordpress/wp-config.php
|
||||||
dest: /tmp/wordpress-6.1.1-fr_FR.tar.gz
|
regexp: "votre_utilisateur_de_bdd"
|
||||||
|
replace: "wordpressuser"
|
||||||
|
backup: yes
|
||||||
|
|
||||||
- name: 20 - decompresse wordpress
|
- name: 45 - ajuste variable mdp dans fichier de config wp-config.php
|
||||||
unarchive:
|
replace:
|
||||||
src: /tmp/wordpress-6.1.1-fr_FR.tar.gz
|
path: /home/wordpress/wp-config.php
|
||||||
dest: /exports/
|
regexp: "votre_mdp_de_bdd"
|
||||||
remote_src: yes
|
replace: "wordpresspasswd"
|
||||||
|
backup: yes
|
||||||
|
|
||||||
- name: 22 - change owner et group pour repertoire wordpress
|
- name: 50 - ajuste hostname fichier wp-config.php
|
||||||
file:
|
replace:
|
||||||
path: /exports/wordpress
|
path: /home/wordpress/wp-config.php
|
||||||
state: directory
|
regexp: "localhost"
|
||||||
recurse: yes
|
replace: "192.168.102.253"
|
||||||
owner: www-data
|
backup: yes
|
||||||
group: www-data
|
|
||||||
|
|
||||||
- name: 30 - genere fichier de config wordpress
|
|
||||||
copy:
|
|
||||||
src: /exports/wordpress/wp-config-sample.php
|
|
||||||
dest: /exports/wordpress/wp-config.php
|
|
||||||
remote_src: yes
|
|
||||||
|
|
||||||
- name: 35 - ajuste variable dbname dans fichier de config wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /exports/wordpress/wp-config.php
|
|
||||||
regexp: "votre_nom_de_bdd"
|
|
||||||
replace: "wordpressdb"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
|
|
||||||
- name: 40 ajuste variable dbusername dans fichier de config wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /exports/wordpress/wp-config.php
|
|
||||||
regexp: "votre_utilisateur_de_bdd"
|
|
||||||
replace: "wordpressuser"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: 45 - ajuste variable mdp dans fichier de config wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /exports/wordpress/wp-config.php
|
|
||||||
regexp: "votre_mdp_de_bdd"
|
|
||||||
replace: "wordpresspasswd"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: 50 - ajuste hostname fichier wp-config.php
|
|
||||||
replace:
|
|
||||||
path: /exports/wordpress/wp-config.php
|
|
||||||
regexp: "localhost"
|
|
||||||
replace: "192.168.102.253"
|
|
||||||
backup: yes
|
|
||||||
|
|
||||||
- name: 55 - relance nfs
|
|
||||||
service:
|
|
||||||
name: nfs-server
|
|
||||||
state: restarted
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
|
- name: 55 - relance nfs
|
||||||
|
service:
|
||||||
|
name: nfs-server
|
||||||
|
state: restarted
|
||||||
|
enabled: yes
|
||||||
|
@ -6,6 +6,13 @@ s-backup permet de récupérer les dossiers et fichiers présent dans le répert
|
|||||||
# Lancement du script backup.sh
|
# Lancement du script backup.sh
|
||||||
|
|
||||||
Après la fin de l'installation de s-backup et la fin de la configuration de s-win vous pouvez
|
Après la fin de l'installation de s-backup et la fin de la configuration de s-win vous pouvez
|
||||||
lancer le fichier backup.sh pour récuperer l'intégraliter du fichier partagé gsb.lan de s-win
|
lancer le fichier backupsmb.sh pour récuperer l'intégraliter du fichier partagé gsb.lan de s-win
|
||||||
sur la machine s-backup.
|
sur la machine s-backup.
|
||||||
|
|
||||||
|
# Crontab
|
||||||
|
|
||||||
|
Une crontab a été ajoutée mais désactivée par défaut ( backupsmb.sh executée tout les jours à 5h00)
|
||||||
|
|
||||||
|
# Pistes
|
||||||
|
|
||||||
|
- Traps à consolider
|
||||||
|
@ -4,16 +4,16 @@
|
|||||||
name: wireguard
|
name: wireguard
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
|
- name: installation de ferm
|
||||||
|
apt:
|
||||||
|
name: ferm
|
||||||
|
state: present
|
||||||
|
|
||||||
- name: installation de wireguard-tools
|
- name: installation de wireguard-tools
|
||||||
apt:
|
apt:
|
||||||
name: wireguard-tools
|
name: wireguard-tools
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
#- name: installation de sshpass
|
|
||||||
# apt:
|
|
||||||
# name: sshpass
|
|
||||||
# state: present
|
|
||||||
|
|
||||||
#- name: copie du fichier de configuration depuis r-vp1
|
#- name: copie du fichier de configuration depuis r-vp1
|
||||||
# command: "sshpass -p 'root' scp -r root@192.168.99.112:/root/confwg/wg0-b.conf /etc/wireguard/"
|
# command: "sshpass -p 'root' scp -r root@192.168.99.112:/root/confwg/wg0-b.conf /etc/wireguard/"
|
||||||
|
|
||||||
|
@ -4,6 +4,11 @@
|
|||||||
name: wireguard
|
name: wireguard
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
|
- name: installation de ferm
|
||||||
|
apt:
|
||||||
|
name: ferm
|
||||||
|
state: present
|
||||||
|
|
||||||
- name: installation de wireguard-tools
|
- name: installation de wireguard-tools
|
||||||
apt:
|
apt:
|
||||||
name: wireguard-tools
|
name: wireguard-tools
|
||||||
@ -27,12 +32,10 @@
|
|||||||
- name: copie du fichier de configuration
|
- name: copie du fichier de configuration
|
||||||
copy:
|
copy:
|
||||||
src: /root/confwg/wg0-a.conf
|
src: /root/confwg/wg0-a.conf
|
||||||
dest: /etc/wireguard
|
dest: /etc/wireguard/wg0.conf
|
||||||
|
|
||||||
- name: renommage fichier de configuration
|
- name: Restart service httpd, in all cases
|
||||||
command: "mv /etc/wireguard/wg0-a.conf /etc/wireguard/wg0.conf"
|
ansible.builtin.service:
|
||||||
|
name: wg-quick@wg0
|
||||||
- name: demarrage du service wireguard
|
enabled: yes
|
||||||
tags: aaaa
|
state: restarted
|
||||||
command: "systemctl enable wg-quick@wg0"
|
|
||||||
command: "systemctl restart wg-quick@wg0"
|
|
||||||
|
67
s-lb-bd.yml
67
s-lb-bd.yml
@ -1,24 +1,49 @@
|
|||||||
---
|
---
|
||||||
- hosts: localhost
|
- hosts: all
|
||||||
connection: local
|
become: true
|
||||||
vars:
|
tasks:
|
||||||
maria_dbhost: "192.168.102.254"
|
|
||||||
maria_dbname: "wordpress"
|
|
||||||
maria_dbuser: "wp"
|
|
||||||
maria_dbpasswd: "wp"
|
|
||||||
|
|
||||||
|
- name: modules python pour
|
||||||
|
apt:
|
||||||
|
name: python3-pymysql
|
||||||
|
state: present
|
||||||
|
|
||||||
roles:
|
- name: install mariadb-server
|
||||||
- base
|
apt:
|
||||||
- goss
|
name: mariadb-server
|
||||||
- post
|
state: present
|
||||||
#- s-lb-bd-ab
|
|
||||||
- mariadb-ab
|
- name: Cree Bd wordpress
|
||||||
# - role: db-user
|
mysql_db:
|
||||||
# cli_ip: "192.168.102.1"
|
db: wordpressdb
|
||||||
# - role: db-user
|
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||||
# cli_ip: "192.168.102.2"
|
state: present
|
||||||
# - role: db-user
|
|
||||||
# cli_ip: "192.168.102.3"
|
- name: Ouvre port 3306 mariadb-server
|
||||||
- snmp-agent
|
replace:
|
||||||
# - post
|
path: /etc/mysql/mariadb.conf.d/50-server.cnf
|
||||||
|
regexp: '^bind-address.*'
|
||||||
|
replace: '#bind-adress = 127.0.0.1'
|
||||||
|
backup: yes
|
||||||
|
notify: restart mariadb
|
||||||
|
|
||||||
|
- name: Create MySQL user for wordpress
|
||||||
|
mysql_user:
|
||||||
|
name: wordpressuser
|
||||||
|
password: wordpresspasswd
|
||||||
|
priv: "wordpressdb.*:ALL"
|
||||||
|
host: '%'
|
||||||
|
state: present
|
||||||
|
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: restart mariadb
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: mariadb
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- base
|
||||||
|
- goss
|
||||||
|
- post
|
||||||
|
- snmp-agent
|
||||||
|
Reference in New Issue
Block a user