feat: add peertube repo part2

roles/fw-ferm/files/iptables.test.r-vp1

@@ -0,0 +1,43 @@
+# Définir la politique par défaut
+iptables -P INPUT DROP
+iptables -P OUTPUT ACCEPT
+iptables -P FORWARD ACCEPT
+
+# Autoriser le trafic pour le VPN
+iptables -A INPUT -p udp --dport 51820 -j ACCEPT
+
+# Autoriser les connexions établies et connexes
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Autoriser les connexions sur l'interface loopback
+iptables -A INPUT -i lo -j ACCEPT
+
+# Autoriser les requêtes ping
+iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+
+# Autoriser les connexions SSH depuis le réseau privé et depuis certains hôtes internet
+iptables -A INPUT -p tcp -s 172.16.0.0/24,81.209.165.42 --dport ssh -j ACCEPT
+
+# Autoriser les connexions DNS et SMTP sur l'interface privée
+iptables -A INPUT -i enp0s9 -s 172.16.0.0/24 -p udp --dport domain -j ACCEPT
+iptables -A INPUT -i enp0s9 -s 172.16.0.0/24 -p tcp --dport domain -j ACCEPT
+iptables -A INPUT -i enp0s9 -s 172.16.0.0/24 -p udp --dport bootps -j ACCEPT
+
+# Autoriser les requêtes ping sur l'interface VPN
+iptables -A INPUT -i wg0 -p icmp --icmp-type echo-request -j ACCEPT
+
+# Interdire les connexions SSH sur l'interface VPN
+iptables -A INPUT -i wg0 -s 0.0.0.0/0 -p tcp --dport ssh -j DROP
+
+# Interdire les connexions SSH sortantes sur l'interface VPN
+iptables -A OUTPUT -o wg0 -d 0.0.0.0/0 -p tcp --dport ssh -j DROP
+
+# Autoriser le trafic sur l'interface publique
+iptables -A INPUT -i enp0s8 -j ACCEPT
+
+# Autoriser les connexions depuis l'interface privée vers l'interface publique ou une autre interface privée
+iptables -A FORWARD -i enp0s9 -o enp0s8 -j ACCEPT
+iptables -A FORWARD -i enp0s9 -o enp0s9 -j ACCEPT
+
+# Interdire toutes les autres connexions de forwarding
+iptables -A FORWARD -j DROP

roles/fw-ferm/files/iptables.test.r-vp2

@@ -0,0 +1,50 @@
+# Politique par défaut : DROP
+iptables -P INPUT DROP
+iptables -P FORWARD ACCEPT
+iptables -P OUTPUT ACCEPT
+
+# Autoriser les connexions VPN entrantes
+iptables -A INPUT -p udp --dport 51820 -j ACCEPT
+
+# Autoriser les connexions établies et apparentées
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Autoriser les connexions depuis l'interface locale
+iptables -A INPUT -i lo -j ACCEPT
+
+# Autoriser les requêtes ping
+iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+
+# Autoriser les connexions SSH depuis le réseau privé et depuis certains hôtes Internet
+iptables -A INPUT -s 172.16.0.0/24 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+iptables -A INPUT -s 81.209.165.42 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+
+# Autoriser les connexions DNS et SMTP depuis le réseau privé
+iptables -A INPUT -i enp0s8 -s 172.16.0.0/24 -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -i enp0s8 -s 172.16.0.0/24 -p tcp --dport 53 -j ACCEPT
+iptables -A INPUT -i enp0s8 -s 172.16.0.0/24 -p udp --dport 67 -j ACCEPT
+
+# Autoriser le trafic sortant
+iptables -A OUTPUT -j ACCEPT
+
+# Autoriser les requêtes ping sortantes
+iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
+
+# Autoriser les connexions SSH sortantes
+iptables -A OUTPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+
+# Autoriser les connexions VPN sortantes
+iptables -A FORWARD -i wg0 -o enp0s9 -j ACCEPT
+iptables -A FORWARD -i enp0s9 -o wg0 -j ACCEPT
+
+# Interdire les connexions SSH entrantes depuis l'interface VPN
+iptables -A FORWARD -i wg0 -p tcp --dport 22 -j DROP
+
+# Autoriser les connexions SSH sortantes vers l'interface VPN
+iptables -A FORWARD -o wg0 -p tcp --dport 22 -j ACCEPT
+
+# Autoriser les connexions établies et apparentées
+iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Autoriser le trafic depuis le réseau privé
+iptables -A FORWARD -i enp0s8 -o enp0s9 -j ACCEPT

roles/peertube/files/values.yaml

@@ -0,0 +1,139 @@
+replicaCount: 1
+image:
+  repository: chocobozzz/peertube
+  pullPolicy: IfNotPresent
+  tag: "v5.0.1-bullseye"
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  create: false
+  annotations: {}
+  name: ""
+podAnnotations: {}
+podSecurityContext: {}
+securityContext: {}
+
+service:
+  type: ClusterIP
+  port: 9000
+  nginxPort: 9001
+
+## default config for postgresql should work, but feel free to modify it if required.
+# must stay consistent with peertube configuration, otherwise peertube will crash
+postgresql:
+  enabled: true
+  primary:
+    persistence:
+      enabled: true
+      existingClaim: "pvc-postgres"
+  global:
+    postgresql:
+      auth:
+        postgrePassword: "admin"
+        username: "user"
+        password: "user"
+        database: "peertube"
+
+## the main list of variables tha will be applied in the peertube container
+# any error or misconfiguration will make peertube crash.
+peertube:
+  env:
+    dbUser: user # must be consistent with postgresql configuration
+    dbPasswd: user # must be consistent with postgresql configuration
+    dbSsl: false # disabled by default WARNING: ssl connection feature not tested, use at your own risk
+    dbHostname: peertube-postgresql # must be consistent with postgresql configuration
+    webHostname: peertube # must be changed to your local setup
+    secret: b2753b0f37444974de0e81f04815e6a889fcf8960bd203a01b624d8fa8a37683
+    smtpHostname: peertube-mail # must be consistent with mail configuration
+    smtpPort: 587 # must be consistent with mail configuration
+    smtpFrom: noreply@lan.lan # not configured by default, add something meaningfull if you want
+    smtpTls: false # disabled by default WARNING: tls connection feature not tested, use at your own risk
+    smtpDisableStartTls: false # unless crashes related to tls/ssl, this should be unchanged
+    adminEmail: root@localhost.lan # use this if you want peopleto be able to reach you 
+    redisHostname: peertube-redis-master # must be consistent with redis configuration
+    redisAuth: peertube # must be consistent with redis configuration
+  app:
+    userCanRegister: true # control if people can register by themselves
+    rootPasswd: rootroot # CHANGE THIS! the default admin username is 'root' this variable define the password
+## the next section configure at wich quality videos will be transcoded 
+    transcoding360: true
+    transcoding480: true
+    transcoding720: true
+    transcoding1080: false
+    transcoding2160: false
+
+## the configuration of the postfix server called 'mail' here 
+# change these settings if you know what you are doing
+mail:
+  enbled: true
+  config:
+    general:
+      ALLOWED_SENDER_DOMAINS: # should be the same as your web domain
+      DKIM_AUTOGENERATE: "yes"
+    opendkim:
+      RequireSafeKeys: "no"
+    postfix:
+       smtp_tls_security_level: "secure" # works by default, any other tls level is untested
+  persistence:
+    enabled: false
+  service:
+    port: 587
+
+## the configuration of the redis server
+redis:
+  master:
+    persistence:
+      enabled: true
+      existingClaim: "pvc-redis"
+  replica:
+    persistence:
+      enabled: true
+      existingClaim: "pvc-redis"
+  auth:
+    enbled: true
+    password: "peertube"
+
+## ingress configuration is very specific this part must be configured or else you'll get 503 or 404 errors
+ingress:
+  enabled: false
+  className: ""
+  annotations: 
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/proxy-body-size: 4G # this caps the size of imported videos, if set low this might prevent you from uploading videos
+    # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: # your domain here
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: 
+  #  - secretName: chart-example-tls
+    - hosts:
+      -  # your domain here
+
+resources: {}
+autoscaling:
+  enabled: true
+  minimumReplicas: 3
+  maximumReplicas: 20
+  targetCPUUtilizationPercentage: 90
+  targetMemoryUtilizationPercentage: 75
+  windowSeconds: 120
+  minCPUPercentage: 20
+  minMemoryPercentage: 30
+
+## this section should be configured to match your needs and available ressources
+persistence:
+  enabled: true
+  reclaimPolicy: Retain
+  redisVolumeStorage: 1Gi
+  peertubeVolumeStorage: 5Gi
+  postgresqlVolumeStorage: 1Gi
+  accessMode: ReadWriteOnce 
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

roles/peertube/tasks/main.yml

@@ -1,11 +1,30 @@
 ---
   - name: installation de docker...
-    command: curl https://releases.rancher.com/install-docker/20.10.sh | sh
+    shell: curl https://releases.rancher.com/install-docker/20.10.sh | sh
 
   - name: installation de k3s...
-    command: curl -sfL https://get.k3s.io | sh -s - --docker
+    shell: curl -sfL https://get.k3s.io | sh -s - --docker
 
-  - name: activationde k3s au démarrage...
-    systemd:
-      name: k3s
-      enabled: true
+  - name: création du répertoire du dépot peertube...
+    file:
+      path: /root/tools/peertube
+      state: directory
+      mode: '0755'
+
+  - name: clonage du dépot peertube...
+    git:
+      repo: https://github.com/Elam-Monnot/Peertube-helm.git
+      dest: /root/tools/peertube
+      clone: yes
+
+  - name: copie de values.yaml...
+    copy:
+      src: /root/tools/ansible/gsb2023/roles/peertube/files/values.yaml
+      dest: /root/tools/peertube/Peertube-helm/helm/
+      mode: '0644'
+
+  - name: installation de helm...
+    shell: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+  - name: installation de peertube...
+    shell: helm build /root/tools/peertube/Peertube-helm/helm && helm install --create-namesapce -n peertube peertube-gsb

roles/post/files/interfaces.s-peertube

@@ -8,9 +8,10 @@ iface lo inet loopback
 allow-hotplug enp0s3
 iface enp0s3 inet static
 	address 192.168.99.120/24
+	gateway 192.168.99.99
 
 # Réseau n-dmz
 allow-hotplug enp0s8
 iface enp0s8 inet static
         address 192.168.100.20/24
-
+	post-up systemctl start k3s

scripts/addint.s-peertube

@@ -1,5 +1,5 @@
 #!/bin/bash
-nom=s-lb-web1
+nom=s-peertube
 
 # N-adm (enp0s3)
 

scripts/mkvm

@@ -110,6 +110,8 @@ elif [[ "${vm}" == "s-lb-bd" ]] ; then
         create_if "${vm}" "n-adm" "n-dmz-db"
 elif [[ "${vm}" == "s-nas" ]] ; then
         create_if "${vm}" "n-adm" "n-dmz-db"
+elif [[ "${vm}" == "s-peertube" ]] ; then
+	./addint.s-peertube
 elif [[ "${vm}" == "r-vp1" ]] ; then
 	./addint.r-vp1
 elif [[ "${vm}" == "r-vp2" ]] ; then