modification

README.md

@@ -1,6 +1,6 @@
 # gsb2023
 
-2023-01-25 ps 
+2023-02-01 ps 
 
 Environnement et playbooks ansible pour le projet GSB 2023
 
@@ -13,7 +13,6 @@ Prérequis :
     * **debian-buster-gsb-2023a.ova**
 
 
-
   * **s-adm** : routeur adm, DHCP + NAT, deploiement, proxy squid 
   * **s-infra** : DNS maitre, autoconfiguration navigateurs avec **wpad**
   * **r-int** : routage, DHCP 
@@ -34,7 +33,7 @@ Prérequis :
   * **s-lb-web1** : Serveur Wordpress 1 Load Balancer
   * **s-lb-web2** : Serveur Wordpress 2 Load Balancer
   * **s-lb-db** : Serveur Mariadb pour Wordpress
-  * **s-lb-nfs** : Serveur NFS pour application Wordpress
+  * **s-nas** : Serveur NFS pour application Wordpress avec LB
 
 
 ## Les playbooks
@@ -42,13 +41,25 @@ Prérequis :
 
 ## Installation
 
-On utilisera l'image de machine virtuelle suivante : 
+On utilisera les images de machines virtuelle suivantes : 
   * **debian-bullseye-2023a.ova** (2023-01-06)
     * Debian Bullseye 11.6 - 2 cartes - 1 Go - stockage 20 Go
 
+et pour **s-fog** : 
+  * **debian-buster-2023a.ova** (2023-01-06)
+    * Debian Buster 10 - 2 cartes - 1 Go - stockage 20 Go
+
+On utilsera le script (bash) **mkvm** ou (PowerShell) **mkvm.ps1** pour créeer une VM
+
+```shell
+gsb2023>
+cd pre
+$ mkvm s-adm
+
+```
 
 ### Machine s-adm
-  * créer la machine virtuelle **s-adm** en important l'image ova décrite plus haut
+  * créer la machine virtuelle **s-adm** avec **mkvm * comme décrit plus haut.
   * renommer la machine puis redémarrer
   * taper :
 ```shell
@@ -66,11 +77,10 @@ On utilisera l'image de machine virtuelle suivante :
   
 ### Pour chaque machine
 
-  - importer la machine à partir du fichier **.ova**
-  - définir les cartes réseau en accord avec le plan d'adressage et le schéma
+  - créer la machine avec **mkvm**, les cartes réseau sont paramétrées par **mkvm** selon les spécifications 
   - donner le nom adapté (avec sed -i …)
   - redémarrer
-  - mettre à jour les paquets : apt update && apt upgrade
+  - mettre à jour les paquets : apt update 
   - cloner le dépot : 
 ```shell
 mkdir -p tools/ansible ; cd tools/ansible

pre/inst-depl

@@ -1,12 +1,13 @@
 #!/bin/bash
-## aa : 2023-04-18 15:25
+## aa : 2023-01-18 15:25
+## ps : 2023-02-01 15:25
 
 set -o errexit
 set -o pipefail
 GITUSR=gitgsb
 GITPRJ=gsb2023
-apt update && apt upgrade
-apt install -y apache2 git 
+apt-get update 
+apt-get install -y apache2 git 
 STOREREP="/var/www/html/gsbstore" 
 
 GLPIREL=10.0.6

r-vp1.yml

@@ -13,9 +13,9 @@
    - goss
 #   - snmp-agent
 #   - firewall-vpn-r
+   - post
    - wireguard-r
-#   - x509-r
    - fw-ferm
    - ssh-cli
    - syslog-cli
-   - post
+   

roles/base/templates/hosts.j2

@@ -27,6 +27,8 @@
 192.168.99.102	s-lb-web2.gsb.adm
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
+192.168.99.102  r-vp2.gsb.adm
+
 
 192.168.99.8	syslog.gsb.adm
 

roles/base/templates/hosts.s-proxy.j2

@@ -26,6 +26,7 @@
 192.168.99.102	s-lb-web2.gsb.adm
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
+192.168.99.102  r-vp2.gsb.adm
 
 192.168.99.8	syslog.gsb.adm
 

roles/dhcp-fog/tasks/main.yml

@@ -10,5 +10,3 @@
   copy: src=dhcpd.conf dest=/etc/dhcp/
   notify:
     - restart isc-dhcp-server
-  
- 

roles/fog/tasks/main.yml

@@ -1,17 +1,15 @@
 ---
-- name: creation d'un repertoire fog
-  file:
-    path: /root/tools/fog
-    state: directory
-
 - name: recuperation de l'archive d'installation fog sur git
   git:
     repo: https://gitea.lyc-lecastel.fr/gadmin/fog.git
     dest: /root/tools/fog/
     clone: yes
     update: yes
+    force: yes
 
-#- name: Instructions
-#  tags: msg
-#    debug: msg='{{instructions}}'
-
+- name: Modification fichier bash (desac UDPCast)
+  ansible.builtin.lineinfile:
+    path: /root/tools/fog/lib/common/functions.sh
+    regexp: '^configureUDPCast\(\).*'
+    line: "configureUDPCast() {\nreturn"
+    backup: yes

roles/lb-bd/files/.my.cnf

@@ -1,3 +0,0 @@
-[client]
-user=root
-password=root

roles/lb-bd/files/installmysql.sh

@@ -1,16 +0,0 @@
-# Download and Install the Latest Updates for the OS
-apt-get update && apt-get upgrade -y
-
-# Install MySQL Server in a Non-Interactive mode. Default root password will be "root"
-echo "mysql-server mysql-server/root_password password root" | debconf-set-selections
-echo "mysql-server mysql-server/root_password_again password root" | debconf-set-selections
-apt-get -y install mysql-server
-
-
-# Run the MySQL Secure Installation wizard
-mysql_secure_installation
-
-sed -i 's/127\.0\.0\.1/0\.0\.0\.0/g' /etc/mysql/my.cnf
-mysql -uroot -p -e 'USE mysql; UPDATE `user` SET `Host`="%" WHERE `User`="root" AND `Host`="localhost"; DELETE FROM `user` WHERE `Host` != "%" AND `User`="root"; FLUSH PRIVILEGES;'
-
-service mysql restart

roles/lb-bd/files/my.cnf

@@ -1,128 +0,0 @@
-#
-# The MySQL database server configuration file.
-#
-# You can copy this to one of:
-# - "/etc/mysql/my.cnf" to set global options,
-# - "~/.my.cnf" to set user-specific options.
-# 
-# One can use all long options that the program supports.
-# Run program with --help to get a list of available options and with
-# --print-defaults to see which it would actually understand and use.
-#
-# For explanations see
-# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
-
-# This will be passed to all mysql clients
-# It has been reported that passwords should be enclosed with ticks/quotes
-# escpecially if they contain "#" chars...
-# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
-[client]
-port		= 3306
-socket		= /var/run/mysqld/mysqld.sock
-
-# Here is entries for some specific programs
-# The following values assume you have at least 32M ram
-
-# This was formally known as [safe_mysqld]. Both versions are currently parsed.
-[mysqld_safe]
-socket		= /var/run/mysqld/mysqld.sock
-nice		= 0
-
-[mysqld]
-#
-# * Basic Settings
-#
-user		= mysql
-pid-file	= /var/run/mysqld/mysqld.pid
-socket		= /var/run/mysqld/mysqld.sock
-port		= 3306
-basedir		= /usr
-datadir		= /var/lib/mysql
-tmpdir		= /tmp
-lc-messages-dir	= /usr/share/mysql
-skip-external-locking
-#
-# Instead of skip-networking the default is now to listen only on
-# localhost which is more compatible and is not less secure.
-#bind-address		= 127.0.0.1
-#
-# * Fine Tuning
-#
-key_buffer		= 16M
-max_allowed_packet	= 16M
-thread_stack		= 192K
-thread_cache_size       = 8
-# This replaces the startup script and checks MyISAM tables if needed
-# the first time they are touched
-myisam-recover         = BACKUP
-#max_connections        = 100
-#table_cache            = 64
-#thread_concurrency     = 10
-#
-# * Query Cache Configuration
-#
-query_cache_limit	= 1M
-query_cache_size        = 16M
-#
-# * Logging and Replication
-#
-# Both location gets rotated by the cronjob.
-# Be aware that this log type is a performance killer.
-# As of 5.1 you can enable the log at runtime!
-#general_log_file        = /var/log/mysql/mysql.log
-#general_log             = 1
-#
-# Error log - should be very few entries.
-#
-log_error = /var/log/mysql/error.log
-#
-# Here you can see queries with especially long duration
-#slow_query_log_file = /var/log/mysql/mysql-slow.log
-#slow_query_log      = 1
-#long_query_time = 2
-#log_queries_not_using_indexes
-#
-# The following can be used as easy to replay backup logs or for replication.
-# note: if you are setting up a replication slave, see README.Debian about
-#       other settings you may need to change.
-#server-id		= 1
-#log_bin			= /var/log/mysql/mysql-bin.log
-expire_logs_days	= 10
-max_binlog_size         = 100M
-#binlog_do_db		= include_database_name
-#binlog_ignore_db	= include_database_name
-#
-# * InnoDB
-#
-# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
-# Read the manual for more InnoDB related options. There are many!
-#
-# * Security Features
-#
-# Read the manual, too, if you want chroot!
-# chroot = /var/lib/mysql/
-#
-# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
-#
-# ssl-ca=/etc/mysql/cacert.pem
-# ssl-cert=/etc/mysql/server-cert.pem
-# ssl-key=/etc/mysql/server-key.pem
-
-
-
-[mysqldump]
-quick
-quote-names
-max_allowed_packet	= 16M
-
-[mysql]
-#no-auto-rehash	# faster start of mysql but no tab completition
-
-[isamchk]
-key_buffer		= 16M
-
-#
-# * IMPORTANT: Additional settings that can override those from this file!
-#   The files must end with '.cnf', otherwise they'll be ignored.
-#
-!includedir /etc/mysql/conf.d/

roles/lb-bd/handlers/main.yml

@@ -1,3 +1,4 @@
 ---
- - name: restart mysql-server
-   service: name=mysql-server state=restarted
+- name: restart mariadb
+  ansible.builtin.service:
+    name: mariadb

roles/lb-bd/tasks/main.yml

@@ -1,4 +1,35 @@
 ---
-- name: Install paquets
-  apt: name=mysql-server state=present force=yes
+
+- name: modules python pour
+  apt:
+    name: python3-pymysql
+    state: present
+
+- name: install mariadb-server
+  apt:
+    name: mariadb-server
+    state: present
+
+- name: Cree Bd wordpress
+  mysql_db:
+    db: wordpressdb
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+    state: present
+
+- name: Ouvre port 3306 mariadb-server
+  replace:
+    path: /etc/mysql/mariadb.conf.d/50-server.cnf
+    regexp: '^bind-address.*'
+    replace: '#bind-adress = 127.0.0.1'
+    backup: yes
+  notify: restart mariadb
+
+- name: Create MySQL user for wordpress
+  mysql_user:
+    name: wordpressuser
+    password: wordpresspasswd
+    priv: "wordpressdb.*:ALL"
+    host: '%'
+    state: present
+    login_unix_socket: /var/run/mysqld/mysqld.sock
 

roles/lb-nfs-client/tasks/main.yml

@@ -10,4 +10,4 @@
     dest: /etc/fstab
     regexp: ''
     insertafter: EOF
-    line: '192.168.102.253:/home/wordpress /var/www/html/wordpress nfs soft,timeo=5,intr,rsize=8192,wsize=8192,wsize=8192 0 0'
+    line: '192.168.102.253:/home/ /var/www/html/wordpress nfs soft,timeo=5,intr,rsize=8192,wsize=8192,wsize=8192 0 0'

roles/lb-nfs-server/tasks/main.yml

@@ -60,7 +60,7 @@
   replace:
     path: /home/wordpress/wp-config.php
     regexp: "localhost"
-    replace: "192.168.102.253"
+    replace: "192.168.102.254"
     backup: yes
 
 - name: 55 - relance nfs

roles/lb-web/tasks/main.yml

@@ -1,5 +1,7 @@
 ---
-- name:
+- name: installation des paquets web
+  apt:
+    name:
       - apache2
       - php
       - php-mbstring
@@ -16,11 +18,11 @@
   blockinfile:
     path: /etc/fstab
     block: |
-      192.168.56.6:/exports/wordpress /var/www/html nfs soft,timeo=5,intr,rsize=8192,wsize=8192,wsize=8192 0 0
+      192.168.102.253:/home/wordpress /var/www/html nfs soft,timeo=5,intr,rsize=8192,wsize=8192,wsize=8192 0 0
 
-- name: monte export wordpress
-  ansible.posix.mount:
-    path: /var/www/html
-    state: mounted
-    fstype: nfs
-    src: 192.168.56.6:/exports/wordpress
+      #- name: monte export wordpress
+      #  ansible.posix.mount:
+      #    path: /var/www/html
+      #    state: mounted
+      #    fstype: nfs
+      #    src: 192.168.102.253:/exports/wordpress

roles/nxc-traefik/files/docker-compose.yml

@@ -0,0 +1,80 @@
+version: '3'
+volumes:
+  nextcloud:
+  db:
+
+networks:
+  proxy:
+    external: true
+  nxc:
+    external: false
+
+services:
+  reverse-proxy:
+    # The official v2 Traefik docker image
+    image: traefik:latest
+    container_name: traefik
+    # Enables the web UI and tells Traefik to listen to docker
+    command: --api.insecure=true --providers.docker
+    ports:
+      # The HTTP port
+      - "80:80"
+      - "443:443"
+      # The Web UI (enabled by --api.insecure=true)
+      - "8080:8080"
+    volumes:
+      # So that Traefik can listen to the Docker events
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      # Map the static configuration into the container
+      - ./config/static.yml:/etc/traefik/traefik.yml:ro
+      # Map the dynamic configuration into the container
+      - ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
+      # Map the certificats into the container
+      - ./certs:/etc/certs:ro
+    networks:
+      - proxy
+  
+  db:
+    image: mariadb:10.5
+    container_name: db
+    restart: always
+    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
+    volumes:
+      - db:/var/lib/mysql
+    networks:
+      - nxc
+    environment:
+      - MYSQL_ROOT_PASSWORD=Azerty1+
+      - MYSQL_PASSWORD=Azerty1+
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+
+  app:
+    image: nextcloud
+    container_name: app
+    restart: always
+    ports:
+      - 8081:80
+    #links:
+    depends_on:
+      - db
+    volumes:
+      - ./nextcloud:/var/www/html
+    networks:
+      - proxy
+      - nxc
+    labels:
+#      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`s-nxc.gsb.lan`)"
+      - "traefik.http.routers.app.tls=true"
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+        #      - "traefik.http.routers.app.entrypoints=websecure"
+        #      - "traefik.http.routers.app.rule=Host(`mon.nxc`)"
+      - "traefik.http.routers.app.service=app-service"
+      - "traefik.http.services.app-service.loadbalancer.server.port=80"
+    environment:
+      - MYSQL_PASSWORD=Azerty1+
+      - MYSQL_DATABASE=nextcloud
+      - MYSQL_USER=nextcloud
+      - MYSQL_HOST=db

roles/nxc-traefik/files/nextcloud.yml

@@ -1,58 +0,0 @@
-version: '2'
-
-volumes:
-  #  nextcloud:
-  db:
-
-services:
-  db:
-    image: mariadb
-    container_name: db
-    restart: always
-    #command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
-    command: --innodb-read-only-compressed=OFF
-    volumes:
-      - db:/var/lib/mysql
-    networks:
-      - nxc-db
-    environment:
-      - MYSQL_ROOT_PASSWORD=blabla
-      - MYSQL_PASSWORD=blabla
-      - MYSQL_DATABASE=nextcloud
-      - MYSQL_USER=nextcloud
-
-  nxc:
-    image: nextcloud
-    restart: always
-    container_name: nxc
-#    ports:
-#      - 8080:80
-#    links:
-    depends_on:
-      - db
-    volumes:
-      - ./nextcloud:/var/www/html
-    environment:
-      - MYSQL_PASSWORD=blabla
-      - MYSQL_DATABASE=nextcloud
-      - MYSQL_USER=nextcloud
-      - MYSQL_HOST=db
-    labels:
-      # Enable this container to be mapped by traefik
-      # For more information, see: https://docs.traefik.io/providers/docker/#exposedbydefault
-      - "traefik.enable=true"
-      # URL to reach this container
-      - "traefik.http.routers.nxc.rule=Host(`s-nxc.gsb.lan`)"
-      # Activation of TLS
-      - "traefik.http.routers.nxc.tls=true"
-      # If port is different than 80, use the following service:
-      #-  "traefik.http.services.<service_name>.loadbalancer.server.port=<port>"
-      #      -  "traefik.http.services.app.loadbalancer.server.port=8080"
-    networks:
-      - proxy
-      - nxc-db
-networks:
-  proxy:
-    external: true
-  nxc-db:
-    external: false

roles/nxc-traefik/files/nxc-debug.sh

@@ -1,6 +1,4 @@
 #!/bin/bash
-docker-compose -f nextcloud.yml down
-docker-compose -f traefik.yml down
+docker compose down -v
 sleep 1
-docker-compose -f traefik.yml up -d --remove-orphans
-docker-compose -f nextcloud.yml up -d
+docker compose up -d

roles/nxc-traefik/files/nxc-prune.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
-docker volume prune -f
-docker container prune -f
-docker image prune -f
+
+docker compose down -v
+#docker volume prune -f
+#docker container prune -f
+#docker image prune -f

roles/nxc-traefik/files/nxc-start.sh

@@ -1,3 +1,2 @@
 #!/bin/bash
-docker-compose -f traefik.yml up -d  
-docker-compose -f nextcloud.yml up -d 
+docker compose up -d 

roles/nxc-traefik/files/nxc-stop.sh

@@ -1,3 +1,2 @@
 #!/bin/bash
-docker-compose -f nextcloud.yml down
-docker-compose -f traefik.yml down
+docker compose down

roles/nxc-traefik/files/traefik.yml

@@ -1,28 +0,0 @@
-version: '3'
-
-services:
-  reverse-proxy:
-    #image: traefik:v2.5
-    image: traefik
-    container_name: traefik
-    restart: always
-    security_opt:
-      - no-new-privileges:true
-    ports:
-      # Web
-      - 80:80
-      - 443:443
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      # Map the static configuration into the container
-      - ./config/static.yml:/etc/traefik/traefik.yml:ro
-      # Map the dynamic configuration into the container
-      - ./config/dynamic.yml:/etc/traefik/dynamic.yml:ro
-      # Map the certificats into the container
-      - ./certs:/etc/certs:ro
-    networks:
-      - proxy
-
-networks:
-  proxy:
-    external: true

roles/nxc-traefik/tasks/main.yml

@@ -24,14 +24,9 @@
     src: dynamic.yml   
     dest: /root/nxc/config
 
-- name: Copie de nextcloud.yml
+- name: Copie de docker-compose.yml
   copy: 
-    src: nextcloud.yml
-    dest: /root/nxc
-
-- name: Copie de traefik.yml
-  copy:
-    src: traefik.yml
+    src: docker-compose.yml
     dest: /root/nxc
 
 - name: Copie de nxc-stop.sh
@@ -76,3 +71,8 @@
 
 - name: Creation reseau docker proxy
   command: docker network create proxy
+
+    #- name: Démarrage du docker-compose...
+    #command: /bin/bash docker-compose up -d
+    #args:
+    #chdir: /root/nxc

roles/ssh-cli/tasks/main.yml

@@ -1,10 +1,14 @@
 ---
 
 - name: Creation de .ssh 
-  file: path=/root/.ssh mode=0700 state=directory
+  file: 
+    path: /root/.ssh
+    mode: 0700
+    state: directory
 
-- name: Copie cle public s-adm 
-  shell: curl 192.168.99.99/id_rsa.pub > ~/.ssh/authorized_keys 
+- name: Copie cle publiique depuis s-adm 
+  ansible.posix.authorized_key:
+    user: root
+    state: present
+    key: http://s-adm.gsb.adm/id_rsa.pub
 
-#- name: Copie cle public s-spec
-#  shell: curl 192.168.99.10/id_rsa.pub >> ~/.ssh/authorized_keys 

roles/wireguard-l/tasks/main.yml

@@ -14,8 +14,7 @@
     name: wireguard-tools
     state: present
 
-#- name: copie du fichier de configuration depuis r-vp1
-#  command: "sshpass -p 'root' scp -r root@192.168.99.112:/root/confwg/wg0-b.conf /etc/wireguard/"
+
 
 #- name: renommage du fichier de configuration
 #  command: "mv /etc/wireguard/wg0-b.conf /etc/wireguard/wg0.conf"

roles/wireguard-r/README.md

@@ -1,13 +1,19 @@
-Procédure d'installation de r-vp1 et de copie du fichier wg0-b.conf.
+Procédure d'installation de **r-vp1** et de copie du fichier wg0-b.conf.
 ***
 
-Depuis r-vp1 se deplacer dans le repertoire **/tools/ansible/gsb2023** pour executer le playbook:
-**"ansible-playbook -i localhost, -c local r-vp1.yml"** puis reboot r-vp1.
 
-Attendre la fin de l'installation. Ensuite faire une copie distante du fichier
-wg0-b.conf sur r-vp2 **"scp /confwg/wg0-b.conf root@'ip r-vp2':/etc/wireguard/"**.
+Depuis **r-vp1** se deplacer dans le repertoire **/tools/ansible/gsb2023** pour executer le playbook:
+**"ansible-playbook -i localhost, -c local r-vp1.yml"** puis reboot **r-vp1**.
 
-Renommer les fichiers en **wg0.conf**
 
-Executer **"systemctl enable wg-quick@wg0"** puis **"systemctl start wg-quick@wg0"** sur r-vp1 et r-vp2.
-Entrer la commande **"wg"** pour voir si l'interface wg0 est correctement montée. 
+Sur **r-vp1**:
+
+Attendre la fin de l'installation. Ensuite lancer un serveur http avec python3 pour récuperer le fichier
+wg0-b.conf sur **r-vp2** . Lancer le script **r-vp1-post.sh** dans **/tools/ansible/gsb2023/Scripts**.
+
+
+Sur **r-vp2**:
+
+Lancer le script r-vp2-post.sh dans **/tools/ansible/gsb2023/Scripts** pour recuperer wg0-b.conf
+et qui renomme le fichier en **wg0.conf** . Il redémarre et active le service **wg-quick@wg0**.
+

roles/wireguard-r/tasks/main.yml

@@ -39,3 +39,4 @@
     name: wg-quick@wg0
     enabled: yes
     state: restarted
+

s-lb-bd.yml

@@ -3,47 +3,11 @@
   become: true
   tasks:
 
-  - name: modules python pour
-    apt:
-      name: python3-pymysql
-      state: present
-
-  - name: install mariadb-server
-    apt:
-      name: mariadb-server
-      state: present
-
-  - name: Cree Bd wordpress
-    mysql_db:
-      db: wordpressdb
-      login_unix_socket: /var/run/mysqld/mysqld.sock
-      state: present
-
-  - name: Ouvre port 3306 mariadb-server
-    replace:
-      path: /etc/mysql/mariadb.conf.d/50-server.cnf
-      regexp: '^bind-address.*'
-      replace: '#bind-adress = 127.0.0.1'
-      backup: yes
-    notify: restart mariadb
-
-  - name: Create MySQL user for wordpress
-    mysql_user:
-      name: wordpressuser
-      password: wordpresspasswd
-      priv: "wordpressdb.*:ALL"
-      host: '%'
-      state: present
-      login_unix_socket: /var/run/mysqld/mysqld.sock
-
-  handlers:
-    - name: restart mariadb
-      ansible.builtin.service:
-        name: mariadb
-        state: restarted
 
   roles:
     - base
     - goss
+    - lb-bd
     - post
     - snmp-agent
+    - ssh-cli

s-lb-web1.yml

@@ -4,6 +4,8 @@
 
   roles:
     - base
+    - post
     - lb-web
     - snmp-agent
-    - post
+    - ssh-cli
+

s-lb-web2.yml

@@ -4,6 +4,7 @@
 
   roles:
     - base
+    - post
     - lb-web
     - snmp-agent
-    - post
+    - ssh-cli

s-lb.yml

@@ -7,5 +7,6 @@
      - goss
      - lb-front
      - snmp-agent
+     - ssh-cli
      - post
 

scripts/mkvm

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-mkvmrelease="v1.2"
+mkvmrelease="v1.2.1"
 
 ovarelease="2023a"
 ovafogrelease="2023a"
@@ -11,7 +11,7 @@ deletemode=0
 usage () {
 	echo "$0 - version ${mkvmrelease} - Ova version ${ovarelease}"
 	echo "$0 : creation VM et parametrage interfaces"
-	echo "usage : $0 [-r] <s-infra|r-int|r-ext|s-proxy|s-mon|s-appli|s-backup|s-itil|s-ncx|s-fog>"
+	echo "usage : $0 [-r] <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-appli|s-backup|s-itil|s-ncx|s-fog>"
 	echo "       option -r : efface vm existante avant creation nouvelle"
 	exit 1
 }
@@ -33,7 +33,6 @@ create_vm () {
 }
 
 setif () {
-
 	VBoxManage modifyvm  "$1" --nic"${2}" intnet
 	VBoxManage modifyvm  "$1" --intnet"${2}" "$3"
 	VBoxManage modifyvm  "$1" --nictype"${2}" 82540EM
@@ -66,7 +65,9 @@ fi
 vm="$1"
 
 create_vm "${vm}"
-if [[ "${vm}" == "s-infra" ]] ; then
+if [[ "${vm}" == "s-adm" ]] ; then
+	bash addint.s-adm
+elif [[ "${vm}" == "s-infra" ]] ; then
 	create_if "${vm}" "n-adm" "n-infra"
 elif [[ "${vm}" == "s-proxy" ]] ; then
 	create_if "${vm}" "n-adm" "n-infra"

scripts/mkvm.ps1

@@ -0,0 +1,156 @@
+# POUR POUVOIR EXECUTER DES SCRIPTS POWERSHELL SOUS WINDOWS LANCER COMMANDE SUIVANTE EN ADMIN SOUS POWERSHELL
+# set-executionpolicy unrestricted
+
+#mkvm pour toutes les vms
+
+$mkvmrelease="v1.2"
+$ovarelease="2023a"
+$ovafogrelease="2023a"
+$ovafile="$HOME\Downloads\debian-bullseye-gsb-${ovarelease}.ova"
+$ovafilefog="$HOME\Downloads\debian-buster-gsb-${ovafogrelease}.ova"
+$vboxmanage="C:\Program Files\Oracle\VirtualBox\VBoxManage.exe"
+$deletemode=0
+
+#FONCTIONS
+
+function create_vm{ param([string]$nomvm)
+	#Importation depuis l'ova
+	& "$vboxmanage" import "$ovafile"  --vsys 0 --vmname "$nomvm"
+	Write-Host "Machine $nomvm importée"
+}
+
+function create_if{ param([string]$nomvm, [string]$nic, [int]$rang, [string]$reseau)
+	#Création d'une interface
+	if ($nomvm -and $nic -and $rang -and $reseau) {
+		if ($nic -eq "bridge") {
+			#Création d'une interface en pont
+			& "$vboxmanage" modifyvm  "$nomvm" --nic"$rang" bridged
+			& "$vboxmanage" modifyvm  "$nomvm" --nictype"$rang" virtio
+			& "$vboxmanage" modifyvm  "$nomvm" --cableconnected"$rang" on
+			& "$vboxmanage" modifyvm  "$nomvm" --nicpromisc"$rang" allow-all
+			Write-Host "$nomvm : IF$rang $nic"
+		}
+		elseif ($nic -eq "int") {
+			#Création d'une interface en reseau interne
+			& "$vboxmanage" modifyvm  "$nomvm" --nic"$rang" intnet
+			& "$vboxmanage" modifyvm  "$nomvm" --intnet"$rang" "$reseau"
+			& "$vboxmanage" modifyvm  "$nomvm" --nictype"$rang" virtio
+			& "$vboxmanage" modifyvm  "$nomvm" --cableconnected"$rang" on
+			& "$vboxmanage" modifyvm  "$nomvm" --nicpromisc"$rang" allow-all
+			Write-Host "$nomvm : IF$rang $nic $reseau"
+		}
+	}
+}
+
+function usage{
+	Write-Host "usage : mkvm ${myInvocation.ScriptName} <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-agence|s-appli|s-backup|s-itil|s-ncx|s-fog|s-dns-ext|s-web-ext|s-lb|s-lb-bd|s-lb-web1|s-lb-web2|s-lb-web3>"
+}
+
+if ($args[0] -eq "s-adm") {
+
+	create_vm $args[0]
+	create_if $args[0] "bridge" 1 "null"
+	create_if $args[0] "int" 2 "n-adm"
+	
+}
+
+elseif ($args[0] -eq "r-int") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-link"
+	create_if $args[0] "int" 3 "n-wifi"
+	create_if $args[0] "int" 4 "n-user"
+	create_if $args[0] "int" 5 "n-infra"
+}
+
+elseif ($args[0] -eq "r-ext") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz"
+	create_if $args[0] "bridge" 3 "null"
+	create_if $args[0] "int" 4 "n-linkv"
+	create_if $args[0] "int" 5 "n-link"
+}
+
+elseif (((((((($args[0] -eq "s-elk") `
+-or ($args[0] -eq "s-mon") `
+-or ($args[0] -eq "s-backup") `
+-or ($args[0] -eq "s-appli") `
+-or ($args[0] -eq "s-infra") `
+-or ($args[0] -eq "s-proxy") `
+-or ($args[0] -eq "s-itil") `
+-or ($args[0] -eq "s-nxc") `
+))))))) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-infra"
+}
+
+elseif ($args[0] -eq "s-fog") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-infra"
+	create_if $args[0] "int" 3 "n-user"
+}
+
+elseif ($args[0] -eq "s-agence") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-agence"
+}
+
+elseif ($args[0] -eq "s-lb") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz"
+	create_if $args[0] "int" 3 "n-dmz-lb"
+}
+
+elseif (($args[0] -eq "s-lb-db") -or ($args[0] -eq "s-nas")) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz-db"
+}
+
+elseif ((($args[0] -eq "s-lb-web1") -or ($args[0] -eq "s-lb-web2") -or ($args[0] -eq "s-lb-web3"))) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-dmz-lb"
+	create_if $args[0] "int" 3 "n-dmz-db"
+}
+
+elseif (($args[0] -eq "s-dns-ext") -or ($args[0] -eq "s-web-ext")) {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-infra"
+	create_if $args[0] "int" 3 "n-user"
+}
+
+elseif ($args[0] -eq "r-vp1") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-linkv"
+	create_if $args[0] "bridge" 3 "null"
+}
+
+elseif ($args[0] -eq "r-vp2") {
+
+	create_vm $args[0]
+	create_if $args[0] "int" 1 "n-adm"
+	create_if $args[0] "int" 2 "n-agence"
+	create_if $args[0] "bridge" 3 "null"
+}
+
+else {
+	usage
+}

scripts/r-vp1-post.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+#stoper le fw
+systemctl stop ferm
+#ouverture du service web pour copie distante
+cd /root/confwg/ && python3 -m http.server 8000 &

scripts/r-vp2-post.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+#recuperation du fichier de config
+wget http://r-vp1.gsb.adm:8000/wg0-b.qconf
+#renomage fichier et mv
+mv ./wg0-b.conf /etc/wireguard/wg0.conf
+#activation interface wg0
+systemctl enable wg-quick@wg0 && systemctl start wg-quick@wg0