fw filtrage interne ok

README.md

@@ -53,7 +53,7 @@ On utilsera le script (bash) **mkvm** ou (PowerShell) **mkvm.ps1** pour créeer
 
 ```shell
 gsb2023>
-cd pre
+cd scripts
 $ mkvm -r s-adm
 
 ```

r-vp1-fw.yml

@@ -0,0 +1,13 @@
+---
+- hosts: localhost
+  connection: local
+
+  vars:
+   - ip1: 192.168.0.51
+   - remip: 192.168.0.52
+   - mynet: 192.168.1.0
+   - remnet: 172.16.128.0
+
+  roles:
+   - fw-ferm
+   

r-vp1.yml

@@ -12,10 +12,8 @@
    - base
    - goss
 #   - snmp-agent
-#   - firewall-vpn-r
    - post
    - wireguard-r
-   - fw-ferm
    - ssh-cli
    - syslog-cli
    

r-vp2-fw.yml

@@ -0,0 +1,12 @@
+---
+- hosts: localhost
+  connection: local
+
+  vars:
+   - ip1: 192.168.0.52
+   - remip: 192.168.0.51
+   - mynet: 172.16.128.0
+   - remnet: 192.168.1.0
+
+  roles:
+   - fw-ferm

r-vp2.yml

@@ -15,10 +15,7 @@
    - dns-agence
    - ssh-root-access
 #   - snmp-agent
-#   - firewall-vpn-l
    - wireguard-l
-#   - x509-l
    - post
    - ssh-cli
    - syslog-cli
-   - fw-ferm

roles/dns-ag-cs/files/named.conf.options

@@ -1,23 +0,0 @@
-// 0.2 - putconf - vendredi 12 avril 2013, 08:54:33 (UTC+0200)
-
-options {
-        directory "/var/cache/bind";
-
-        // If there is a firewall between you and nameservers you want
-        // to talk to, you may need to fix the firewall to allow multiple
-        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113
-
-        // If your ISP provided one or more IP addresses for stable
-        // nameservers, you probably want to use them as forwarders.
-        // Uncomment the following block, and insert the addresses replacing
-        // the all-0's placeholder.
-
-        forwarders {
-                172.16.0.1;
-
-         };
-
-        auth-nxdomain no;    # conform to RFC1035
-        listen-on-v6 { any; };
-};
-

roles/dns-ag-cs/handlers/main.yml

@@ -1,4 +0,0 @@
----
-  - name: restart bind9
-    service: name=bind9 state=restarted
-

roles/dns-ag-cs/tasks/main.yml

@@ -1,11 +0,0 @@
----
-
-- name: Installation bind9
-  apt:  name=bind9 state=present update_cache=yes
-
-- name: Copie named.conf.options
-  copy: src=named.conf.options dest=/etc/bind
-  notify:
-    - restart bind9
-
-

roles/fw-ferm/files/ferm.conf.r-vp1

@@ -35,23 +35,22 @@ table filter {
             proto (udp tcp) dport domain ACCEPT;
             proto udp dport bootps ACCEPT;
         }
-
         # interface réseau
-        interface $DEV_WORLD {
-
-        }
 
         # the rest is dropped by the above policy
     }#FIN INPUT
 
     # outgoing connections are not limited
-    chain OUTPUT {policy ACCEPT;
+    chain OUTPUT {
+        policy ACCEPT;
+#	interface $DEV_VPN proto ssh dport 22 ACCEPT;
+
     }#FIN OUTPUT
 
     chain FORWARD {
         policy ACCEPT;
+
         proto icmp icmp-type echo-request ACCEPT;
-        }
         # connection tracking
         mod state state INVALID DROP;
         mod state state (ESTABLISHED RELATED) ACCEPT;

roles/fw-ferm/files/ferm.conf.r-vp2

@@ -27,19 +27,15 @@ table filter {
 
         # allow SSH connections from the private network and from some
         # well-known internet hosts
-        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+        saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
 
         # we provide DNS and SMTP services for the internal net
         interface $DEV_PRIVATE saddr $NET_PRIVATE {
             proto (udp tcp) dport domain ACCEPT;
             proto udp dport bootps ACCEPT;
         }
-        interface $DEV_VPN{
-        # respond to ping
-        proto icmp icmp-type echo-request ACCEPT;
-        # disallow ssh
-        saddr proto tcp dport ssh ACCEPT;
-        }
+
+
         # interface réseau
         interface $DEV_WORLD {
 
@@ -49,13 +45,8 @@ table filter {
     }#FIN INPUT
 
     # outgoing connections are not limited
-    chain OUTPUT {policy ACCEPT;
-        interface $DEV_VPN{
-        # allow ssh
-        daddr proto tcp dport ssh DROP;
-        # respond to ping
-        proto icmp icmp-type echo-request ACCEPT;
-        }
+    chain OUTPUT {
+	policy ACCEPT;
 }
     chain FORWARD {
         policy ACCEPT;
@@ -68,6 +59,9 @@ table filter {
         # internal nets are allowed
         interface $DEV_PRIVATE ACCEPT;
 
+	interface $DEV_VPN daddr $NET_PRIVATE {
+	proto tcp dport ssh DROP;
+	}
         # the rest is dropped by the above policy
     }
 }

roles/fw-ferm/files/iptables.test.r-vp1

@@ -1,43 +0,0 @@
-# Définir la politique par défaut
-iptables -P INPUT DROP
-iptables -P OUTPUT ACCEPT
-iptables -P FORWARD ACCEPT
-
-# Autoriser le trafic pour le VPN
-iptables -A INPUT -p udp --dport 51820 -j ACCEPT
-
-# Autoriser les connexions établies et connexes
-iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-# Autoriser les connexions sur l'interface loopback
-iptables -A INPUT -i lo -j ACCEPT
-
-# Autoriser les requêtes ping
-iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
-
-# Autoriser les connexions SSH depuis le réseau privé et depuis certains hôtes internet
-iptables -A INPUT -p tcp -s 172.16.0.0/24,81.209.165.42 --dport ssh -j ACCEPT
-
-# Autoriser les connexions DNS et SMTP sur l'interface privée
-iptables -A INPUT -i enp0s9 -s 172.16.0.0/24 -p udp --dport domain -j ACCEPT
-iptables -A INPUT -i enp0s9 -s 172.16.0.0/24 -p tcp --dport domain -j ACCEPT
-iptables -A INPUT -i enp0s9 -s 172.16.0.0/24 -p udp --dport bootps -j ACCEPT
-
-# Autoriser les requêtes ping sur l'interface VPN
-iptables -A INPUT -i wg0 -p icmp --icmp-type echo-request -j ACCEPT
-
-# Interdire les connexions SSH sur l'interface VPN
-iptables -A INPUT -i wg0 -s 0.0.0.0/0 -p tcp --dport ssh -j DROP
-
-# Interdire les connexions SSH sortantes sur l'interface VPN
-iptables -A OUTPUT -o wg0 -d 0.0.0.0/0 -p tcp --dport ssh -j DROP
-
-# Autoriser le trafic sur l'interface publique
-iptables -A INPUT -i enp0s8 -j ACCEPT
-
-# Autoriser les connexions depuis l'interface privée vers l'interface publique ou une autre interface privée
-iptables -A FORWARD -i enp0s9 -o enp0s8 -j ACCEPT
-iptables -A FORWARD -i enp0s9 -o enp0s9 -j ACCEPT
-
-# Interdire toutes les autres connexions de forwarding
-iptables -A FORWARD -j DROP

roles/fw-ferm/files/iptables.test.r-vp2

@@ -1,50 +0,0 @@
-# Politique par défaut : DROP
-iptables -P INPUT DROP
-iptables -P FORWARD ACCEPT
-iptables -P OUTPUT ACCEPT
-
-# Autoriser les connexions VPN entrantes
-iptables -A INPUT -p udp --dport 51820 -j ACCEPT
-
-# Autoriser les connexions établies et apparentées
-iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-# Autoriser les connexions depuis l'interface locale
-iptables -A INPUT -i lo -j ACCEPT
-
-# Autoriser les requêtes ping
-iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
-
-# Autoriser les connexions SSH depuis le réseau privé et depuis certains hôtes Internet
-iptables -A INPUT -s 172.16.0.0/24 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-iptables -A INPUT -s 81.209.165.42 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-
-# Autoriser les connexions DNS et SMTP depuis le réseau privé
-iptables -A INPUT -i enp0s8 -s 172.16.0.0/24 -p udp --dport 53 -j ACCEPT
-iptables -A INPUT -i enp0s8 -s 172.16.0.0/24 -p tcp --dport 53 -j ACCEPT
-iptables -A INPUT -i enp0s8 -s 172.16.0.0/24 -p udp --dport 67 -j ACCEPT
-
-# Autoriser le trafic sortant
-iptables -A OUTPUT -j ACCEPT
-
-# Autoriser les requêtes ping sortantes
-iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
-
-# Autoriser les connexions SSH sortantes
-iptables -A OUTPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-
-# Autoriser les connexions VPN sortantes
-iptables -A FORWARD -i wg0 -o enp0s9 -j ACCEPT
-iptables -A FORWARD -i enp0s9 -o wg0 -j ACCEPT
-
-# Interdire les connexions SSH entrantes depuis l'interface VPN
-iptables -A FORWARD -i wg0 -p tcp --dport 22 -j DROP
-
-# Autoriser les connexions SSH sortantes vers l'interface VPN
-iptables -A FORWARD -o wg0 -p tcp --dport 22 -j ACCEPT
-
-# Autoriser les connexions établies et apparentées
-iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-# Autoriser le trafic depuis le réseau privé
-iptables -A FORWARD -i enp0s8 -o enp0s9 -j ACCEPT

roles/peertube-k3s/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+  - name: mise a jour de resolv.conf...
+    copy:
+      src: /root/tools/ansible/gsb2023/roles/peertube/files/resolv.conf
+      dest: /etc/
+      mode: '0644'
+        
+  - name: installation de docker...
+    shell: curl https://releases.rancher.com/install-docker/20.10.sh | sh
+
+  - name: attente de l'installation...
+    wait_for:
+      timeout: 30
+      host: localhost
+
+  - name: installation de k3s...
+    shell: curl -sfL https://get.k3s.io | sh -s - --docker
+
+  - name: mise a jour de resolv.conf...
+    copy:
+      src: /root/tools/ansible/gsb2023/roles/peertube/files/resolv.conf
+      dest: /etc/
+      mode: '0644'

roles/peertube/files/values.yaml

@@ -44,7 +44,7 @@ peertube:
     dbUser: user # must be consistent with postgresql configuration
     dbPasswd: user # must be consistent with postgresql configuration
     dbSsl: false # disabled by default WARNING: ssl connection feature not tested, use at your own risk
-    dbHostname: peertube-postgresql # must be consistent with postgresql configuration
+    dbHostname: peertube-gsb-postgresql # must be consistent with postgresql configuration
     webHostname: peertube # must be changed to your local setup
     secret: b2753b0f37444974de0e81f04815e6a889fcf8960bd203a01b624d8fa8a37683
     smtpHostname: peertube-mail # must be consistent with mail configuration
@@ -53,7 +53,7 @@ peertube:
     smtpTls: false # disabled by default WARNING: tls connection feature not tested, use at your own risk
     smtpDisableStartTls: false # unless crashes related to tls/ssl, this should be unchanged
     adminEmail: root@localhost.lan # use this if you want peopleto be able to reach you 
-    redisHostname: peertube-redis-master # must be consistent with redis configuration
+    redisHostname: peertube-gsb-redis-master # must be consistent with redis configuration
     redisAuth: peertube # must be consistent with redis configuration
   app:
     userCanRegister: true # control if people can register by themselves
@@ -71,7 +71,7 @@ mail:
   enbled: true
   config:
     general:
-      ALLOWED_SENDER_DOMAINS: # should be the same as your web domain
+      ALLOWED_SENDER_DOMAINS: "yes" 
       DKIM_AUTOGENERATE: "yes"
     opendkim:
       RequireSafeKeys: "no"
@@ -116,7 +116,7 @@ ingress:
 
 resources: {}
 autoscaling:
-  enabled: true
+  enabled: false
   minimumReplicas: 3
   maximumReplicas: 20
   targetCPUUtilizationPercentage: 90

roles/peertube/tasks/main.yml

@@ -1,16 +1,4 @@
 ---
-  - name: installation de docker...
-    shell: curl https://releases.rancher.com/install-docker/20.10.sh | sh
-
-  - name: installation de k3s...
-    shell: curl -sfL https://get.k3s.io | sh -s - --docker
-
-  - name: mise a jour de resolv.conf...
-    copy:
-      src: /root/tools/ansible/gsb2023/roles/peertube/files/resolv.conf
-      dest: /etc/
-      mode '0644'
-
   - name: création du répertoire du dépot peertube...
     file:
       path: /root/tools/peertube
@@ -22,6 +10,7 @@
       repo: https://github.com/Elam-Monnot/Peertube-helm.git
       dest: /root/tools/peertube
       clone: yes
+      force: yes
 
   - name: copie de values.yaml...
     copy:
@@ -32,5 +21,11 @@
   - name: installation de helm...
     shell: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
+  - name: exposition du cluster...
+    shell: export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+
   - name: installation de peertube...
-    shell: helm repo add postgresql https://charts.bitnami.com/bitnami && helm repo add redis https://charts.bitnami.com/bitnami && helm repo add mail https://bokysan.github.io/docker-postfix && helm dependency build /root/tools/peertube/helm/ && helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm
+    shell: helm repo add postgresql https://charts.bitnami.com/bitnami && helm repo add redis https://charts.bitnami.com/bitnami && helm repo add mail https://bokysan.github.io/docker-postfix
+
+  - name: lancement du helm chart peertube...
+    shell: helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm

roles/post/files/interfaces.r-vp1-cs

@@ -1,26 +0,0 @@
-# This file describes the network interfaces available on your system
-# and how to activate them. For more information, see interfaces(5).
-
-# The loopback network interface
-#auto lo
-#iface lo inet loopback
-
-#cote N-adm
-allow-hotplug enp0s3
-iface enp0s3 inet dhcp
-	
-# reseau entre vpn
-allow-hotplug enp0s8
-iface enp0s8 inet static
-	address 192.168.0.51
-	netmask 255.255.255.0
-
-# reseau interne n-linkv
-allow-hotplug enp0s9
-iface enp0s9 inet static
-	address 192.168.1.2
-	netmask 255.255.255.0
-	up route add -net 172.16.128.0/24 gw 192.168.1.2
-	up route add default gw 192.168.1.1
-#	post-up /bin/bash /root/iptables-vpn
-	post-up /etc/init.d/ipsec restart

roles/post/files/interfaces.r-vp2-cs

@@ -1,25 +0,0 @@
-# This file describes the network interfaces available on your system
-# and how to activate them. For more information, see interfaces(5).
-
-# The loopback network interface
-#auto lo
-#iface lo inet loopback
-
-# cote N-adm
-allow-hotplug enp0s3
-iface enp0s3 inet dhcp
-
-# cote Agence
-allow-hotplug enp0s8
-iface enp0s8 inet static
-	address 172.16.128.254
-	netmask 255.255.255.0
-
-# cote VPN
-allow-hotplug enp0s9
-iface enp0s9 inet static
-	address 192.168.0.52
-	netmask 255.255.255.0
-	up route add -net 192.168.1.0/24 gw 172.16.128.254
-#	post-up /bin/bash /root/iptables-vpn
-	post-up /etc/init.d/ipsec restart

roles/post/files/interfaces.s-peertube

@@ -14,4 +14,4 @@ iface enp0s3 inet static
 allow-hotplug enp0s8
 iface enp0s8 inet static
         address 192.168.100.20/24
-	post-up systemctl start k3s && export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+	post-up systemctl start k3s && sleep 20 && export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

roles/wireguard-l/tasks/main.yml

@@ -14,7 +14,15 @@
     name: wireguard-tools
     state: present
 
-
+- name: delais 2 secondes isc-dhcp-service
+  become: yes
+  lineinfile:
+    path: /etc/init.d/isc-dhcp-server
+    insertafter: '^\s+start\)$'
+    line: "                sleep 2"
+    firstmatch: yes
+    state: present
+    backup: yes
 
 #- name: renommage du fichier de configuration
 #  command: "mv /etc/wireguard/wg0-b.conf /etc/wireguard/wg0.conf"

s-peertube.yml

@@ -7,4 +7,5 @@
     - post
     - snmp-agent
     - ssh-cli
+    - peertube-k3s
     - peertube