route ok r-vp1

goss/s-webcom.yaml

@@ -0,0 +1,24 @@
+package:
+  apache2:
+    installed: true
+addr:
+  tcp://depl.sio.lan:80:
+    reachable: true
+    timeout: 500
+port:
+  tcp:80:
+    listening: true
+service:
+  apache2:
+dns:
+  depl.sio.lan:
+    resolveable: true
+    timeout: 500
+process:
+  apache2:
+    running: true
+interface:
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.12/24

pre/pull-config

@@ -5,7 +5,7 @@ prj=gsb2023
 opt=""
 
 if [ -z ${UREP+x} ]; then 
-	UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2023.git 
+	UREP=https://gitea.lyc-lecastel.fr/anthony.arnoux/gsb2023.git 
 fi
 
 dir=/root/tools/ansible

pull-config

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 if [ -z ${UREP+x} ]; then 
-	UREP=https://gitea.lyc-lecastel.fr/gadmin/gsb2023.git 
+	UREP=https://gitea.lyc-lecastel.fr/anthony.arnoux/gsb2023.git 
 fi
 
 dir=/root/tools/ansible

r-vp1.yml

@@ -16,4 +16,5 @@
    - wireguard-r
    - ssh-cli
    - syslog-cli
+   - fw-ferm
    

r-vp2.yml

@@ -19,3 +19,4 @@
    - post
    - ssh-cli
    - syslog-cli
+   - fw-ferm

roles/apache2only/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart apache2
+  service:
+    name: apache2
+    state: restarted

roles/apache2only/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: apt update
+  apt:
+    update_cache: yes
+    cache_valid_time: 3600
+
+- name: Install apache2
+  apt:
+    pkg:
+    - apache2

roles/base/templates/hosts.j2

@@ -28,7 +28,7 @@
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
 192.168.99.102  r-vp2.gsb.adm
-
+192.168.99.120  s-peertube.gsb.adm
 
 192.168.99.8	syslog.gsb.adm
 

roles/base/templates/hosts.s-proxy.j2

@@ -27,6 +27,6 @@
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
 192.168.99.102  r-vp2.gsb.adm
-
+192.168.99.120  s-peertube.gsb.adm
 192.168.99.8	syslog.gsb.adm
 

roles/dns-master/files/db.gsb.lan

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2023012500      ; Serial
+                        2023060100      ; Serial
                         7200	        ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -26,6 +26,7 @@ s-docker	IN	A	172.16.0.7
 s-mon    	IN      A       172.16.0.8
 s-itil		IN	A	172.16.0.9
 s-elk		IN	A	172.16.0.11
+s-webcom	IN	A	172.16.0.12
 s-gestsup	IN	A	172.16.0.17
 r-int    	IN      A       172.16.0.254
 r-int-lnk    	IN      A       192.168.200.254
@@ -36,3 +37,5 @@ s-web2          IN      A       192.168.101.2
 s-lb.gsb.lan    IN      A       192.168.100.10
 ns   	        IN      CNAME   s-infra.gsb.lan.
 wpad		IN	CNAME	s-infra.gsb.lan.
+s-peertube	IN	A	192.168.100.20
+peertube 	IN 	CNAME 	s-peertube

roles/dns-master/files/db.gsb.lan.rev

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2023012500      ; Serial
+                        2023060100      ; Serial
                         7200            ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -26,6 +26,6 @@ $TTL    604800
 100.10   IN      PTR      s-lb
 100.10   IN      PTR      s-lb.gsb.lan
 11.0	  IN	  PTR	  s-elk.gsb.lan.
+12.0	  IN	  PTR	  s-webcom.gsb.lan.
 17.0	  IN	  PTR	  s-gestsup.lan
 254.0     IN      PTR     r-int.gsb.lan.
-

roles/fog/tasks/main.yml

@@ -22,5 +22,5 @@
   command: "cp /root/tools/ansible/roles/fog/files/fogsettings /opt/fog/"
 
 - name: fichier fogsettings en .fogsettings
-command: "mv /opt/fog/fogsettings /opt/fog/.fogsettings"
+  command: "mv /opt/fog/fogsettings /opt/fog/.fogsettings"
 

roles/fw-ferm/files/ferm.conf.r-vp1

@@ -4,10 +4,12 @@
 
 @def $DEV_PRIVATE = enp0s8;
 @def $DEV_WORLD = enp0s9;
+@def $DEV_WORLD = enp0s9;
 @def $DEV_VPN= wg0;
 @def $NET_PRIVATE = 172.16.0.0/24;
 
 table filter {
+
     chain (INPUT OUTPUT){
         # allow VPN
 	proto udp dport 51820 ACCEPT;
@@ -28,22 +30,22 @@ table filter {
 
         # allow SSH connections from the private network and from some
         # well-known internet hosts
-        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+        saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
 
         # we provide DNS and SMTP services for the internal net
         interface $DEV_PRIVATE saddr $NET_PRIVATE {
             proto (udp tcp) dport domain ACCEPT;
             proto udp dport bootps ACCEPT;
         }
-        # interface réseau
 
         # the rest is dropped by the above policy
+
     }#FIN INPUT
 
     # outgoing connections are not limited
+
     chain OUTPUT {
         policy ACCEPT;
-#	interface $DEV_VPN proto ssh dport 22 ACCEPT;
 
     }#FIN OUTPUT
 
@@ -59,6 +61,9 @@ table filter {
         # internal nets are allowed
         interface $DEV_PRIVATE ACCEPT;
 
+	interface $DEV_VPN daddr $NET_PRIVATE {
+ 	proto tcp dport ssh DROP;
+        }
         # the rest is dropped by the above policy
     }
 }

roles/fw-ferm/files/ferm.conf.r-vp2

@@ -51,6 +51,7 @@ table filter {
     chain FORWARD {
         policy ACCEPT;
 
+	proto icmp icmp-type echo-request ACCEPT;
         # connection tracking
         mod state state INVALID DROP;
         mod state state (ESTABLISHED RELATED) ACCEPT;

roles/nagios/files/cfg/s-webcom.cfg

@@ -0,0 +1,14 @@
+# A simple configuration file for monitoring the local host
+# This can serve as an example for configuring other servers;
+# Custom services specific to this host are added here, but services
+# defined in nagios2-common_services.cfg may also apply.
+# 
+
+define host{
+        use                     linux-server            ; Name of host template to use
+        host_name               s-webcom
+        alias                   debian-servers, http-servers
+        address                 172.16.0.12
+		parents			r-int
+        }
+

roles/nagios/files/hostgroups.cfg

@@ -2,7 +2,7 @@ define hostgroup {
 
     hostgroup_name          debian-servers           ; The name of the hostgroup
     alias                   Linux Servers           ; Long name of the group
-    members                 s-infra, s-proxy, s-adm, s-nxc, s-appli, s-backup, s-itil, s-fog, r-int, r-ext               ; Comma separated list of hosts that belong to this group
+    members                 s-infra, s-proxy, s-adm, s-nxc, s-appli, s-backup, s-itil, s-fog, r-int, r-ext, s-webcom               ; Comma separated list of hosts that belong to this group
 }
 
 define hostgroup {
@@ -14,7 +14,7 @@ define hostgroup {
 define hostgroup {
 	hostgroup_name		http-servers
 	alias			Serveurs web
-	members			s-itil
+	members			s-itil, s-webcom
 }
 
 define hostgroup {

roles/nxc-traefik/README.md

@@ -35,3 +35,24 @@ Nextcloud est alors fonctionnel avec le proxy inverse **traefik** assurant la re
 ATTENTION : Après avoir relancé la VM, executez le script "nxc-start.sh" afin d'installer les piles applicatives.
  
 Une fois le script terminé, le site est disponible ici : https://s-nxc.gsb.lan
+
+
+## 5. Ajout authentification LDAP
+
+Pour ajouter l'authentification LDAP au Nextcloud, il faut :
+* Une fois l'installation de Nextcloud terminé, cliquez sur le profil et Application
+* Dans vos applications, descendre et activer "LDAP user and group backend"
+* Puis cliquer sur le profil, puis Paramètres d'administration et dans Administration cliquer sur Intégration LDAP/AD
+* Une fois sur la page d'intégration LDAP/AD :
+    * Dans Hôte mettre : 
+        > ldap://s-win.gsb.lan
+    * Cliquer sur Détecter le port (normalement le port 389 apparait)
+    * Dans DN Utilisateur mettre :
+        > CN=nextcloud,CN=Users,DC=GSB,DC=LAN
+    * Mot de passe : 
+        > Azerty1+
+    * Et dans Un DN de base par ligne : 
+        > DC=GSB,DC=LAN
+* Après la configuration passe OK
+* Une fois la configuration finie, cliquer 3 fois sur continuer
+* Une fois arrivé sur Groupes, vous pouvez vous déconnecter du compte Admin et vous connecter avec un compte qui est dans l'AD.

roles/peertube-k3s/tasks/main.yml

@@ -8,16 +8,15 @@
   - name: installation de docker...
     shell: curl https://releases.rancher.com/install-docker/20.10.sh | sh
 
-  - name: attente de l'installation...
+  - name: attente de l'installation de docker...
     wait_for:
       timeout: 30
       host: localhost
 
   - name: installation de k3s...
-    shell: curl -sfL https://get.k3s.io | sh -s - --docker
+    shell: curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=192.168.100.20 --flannel-iface=enp0s8" sh -s - --docker
 
-  - name: mise a jour de resolv.conf...
-    copy:
-      src: /root/tools/ansible/gsb2023/roles/peertube/files/resolv.conf
-      dest: /etc/
-      mode: '0644'
+  - name: attente de l'installation de k3s...
+    wait_for:
+      timeout: 25
+      host: localhost

roles/peertube/files/finish

@@ -0,0 +1,9 @@
+MYHOST=peertube.gsb.lan;
+export KUBECONFIG=/etc/rancher/k3s/k3s.yaml;
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.cert -subj /CN="${MYHOST}"/O="${MYHOST}" -addext "subjectAltName = DNS:${MYHOST}";
+kubectl create secret tls tls-peertube --key tls.key --cert tls.cert;
+helm repo add postgresql https://charts.bitnami.com/bitnami;
+helm repo add redis https://charts.bitnami.com/bitnami;
+helm repo add mail https://bokysan.github.io/docker-postfix;
+helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm/ ;
+kubectl config view --raw > ~/.kube/config

roles/peertube/files/resolv.conf

@@ -1 +1,4 @@
+domain gsb.lan
+search gsb.lan
+nameserver 172.16.0.1
 nameserver 192.168.99.99

roles/peertube/files/values.yaml

@@ -45,9 +45,9 @@ peertube:
     dbPasswd: user # must be consistent with postgresql configuration
     dbSsl: false # disabled by default WARNING: ssl connection feature not tested, use at your own risk
     dbHostname: peertube-gsb-postgresql # must be consistent with postgresql configuration
-    webHostname: peertube # must be changed to your local setup
+    webHostname: peertube.gsb.lan # must be changed to your local setup
     secret: b2753b0f37444974de0e81f04815e6a889fcf8960bd203a01b624d8fa8a37683
-    smtpHostname: peertube-mail # must be consistent with mail configuration
+    smtpHostname: peertube-gsb-mail # must be consistent with mail configuration
     smtpPort: 587 # must be consistent with mail configuration
     smtpFrom: noreply@lan.lan # not configured by default, add something meaningfull if you want
     smtpTls: false # disabled by default WARNING: tls connection feature not tested, use at your own risk
@@ -98,21 +98,21 @@ redis:
 
 ## ingress configuration is very specific this part must be configured or else you'll get 503 or 404 errors
 ingress:
-  enabled: false
+  enabled: true
   className: ""
   annotations: 
-    kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/proxy-body-size: 4G # this caps the size of imported videos, if set low this might prevent you from uploading videos
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/proxy-body-size: 6G # this caps the size of imported videos, if set low this might prevent you from uploading videos
     # kubernetes.io/tls-acme: "true"
   hosts:
-    - host: # your domain here
+    - host: peertube.gsb.lan
       paths:
         - path: /
           pathType: ImplementationSpecific
   tls:
-  #  - secretName: chart-example-tls
+    - secretName: tls-peertube
     - hosts:
-      -  # your domain here
+      - peertube.gsb.lan
 
 resources: {}
 autoscaling:

roles/peertube/tasks/main.yml

@@ -18,14 +18,11 @@
       dest: /root/tools/peertube/helm/
       mode: '0644'
 
+  - name: copie du script finish...
+    copy:
+      src: /root/tools/ansible/gsb2023/roles/peertube/files/finish
+      dest: /root
+      mode: '0644'
+
   - name: installation de helm...
     shell: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-
-  - name: exposition du cluster...
-    shell: export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
-
-  - name: installation de peertube...
-    shell: helm repo add postgresql https://charts.bitnami.com/bitnami && helm repo add redis https://charts.bitnami.com/bitnami && helm repo add mail https://bokysan.github.io/docker-postfix
-
-  - name: lancement du helm chart peertube...
-    shell: helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm

roles/post/files/interfaces.r-int

@@ -34,4 +34,4 @@ iface enp0s10 inet static
 allow-hotplug enp0s16
 iface enp0s16 inet static
 	address 172.16.0.254/24
-	
+	post-up sleep 10 && systemctl restart isc-dhcp-server	

roles/post/files/interfaces.r-vp1

@@ -15,6 +15,7 @@ allow-hotplug enp0s8
 iface enp0s8 inet static
 	address 192.168.1.2
 	netmask 255.255.255.0
+	post-up route add default gw 192.168.1.1
 
 # accés par pont et entre vpn
 allow-hotplug enp0s9

roles/post/files/interfaces.s-agence

@@ -11,4 +11,4 @@ iface enp0s3 inet dhcp
 
 allow-hotplug enp0s8
 iface enp0s8 inet dhcp
-
+	post-up route add default gw 172.16.128.254

roles/post/files/interfaces.s-peertube

@@ -14,4 +14,4 @@ iface enp0s3 inet static
 allow-hotplug enp0s8
 iface enp0s8 inet static
         address 192.168.100.20/24
-	post-up systemctl start k3s && sleep 20 && export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+	post-up systemctl start k3s 

roles/post/files/interfaces.s-webcom

@@ -0,0 +1,21 @@
+#This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# cote N-adm
+allow-hotplug enp0s3
+iface enp0s3 inet static
+	address 192.168.99.12
+	netmask 255.255.255.0
+    gateway 192.168.99.99
+
+
+# cote N-infra
+allow-hotplug enp0s8
+iface enp0s8 inet static
+	address 172.16.0.12
+	netmask 255.255.255.0
+	post-up route add -net 172.16.64.0/24 gw 172.16.0.254

roles/r-int/tasks/main.yml

@@ -17,3 +17,13 @@
 
   #- name: extraction fog.tar.gz
   #unarchive: src=/tmp/fog.tar.gz  dest=/var/www/ copy=no
+
+#- name: delais 2 secondes isc-dhcp-service
+#  become: yes
+#  lineinfile:
+#    path: /etc/init.d/isc-dhcp-server
+#    insertafter: '^\s+start\)$'
+#    line: "                sleep 2"
+#    firstmatch: yes
+#    state: present
+#    backup: yes

roles/wireguard-l/README.md

@@ -1,5 +1,5 @@
-#ajout du sleep 5
+# ajout du sleep 5
 
-éditer "/etc/init.d/isc-dhcp-server"
-aller au "case \"$1\" in" et rajouter "sleep 5" avant le "if"
+~~éditer "/etc/init.d/isc-dhcp-server"~~
+~~aller au "case \"$1\" in" et rajouter "sleep 5" avant le "if"~~
 

s-webcom.yml

@@ -0,0 +1,11 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - ssh-cli
+    - syslog-cli
+    - snmp-agent
+    - apache2only
+    - post

scripts/mkvm

@@ -11,7 +11,7 @@ deletemode=0
 usage () {
 	echo "$0 - version ${mkvmrelease} - Ova version ${ovarelease}"
 	echo "$0 : creation VM et parametrage interfaces"
-	echo "usage : $0 [-r] <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-appli|s-backup|s-itil|s-ncx|s-fog>"
+	echo "usage : $0 [-r] <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-appli|s-backup|s-itil|s-ncx|s-fog|s-webcom>"
 	echo "       option -r : efface vm existante avant creation nouvelle"
 	exit 1
 }
@@ -80,6 +80,8 @@ elif [[ "${vm}" == "r-ext" ]] ; then
 	./addint.r-ext
 elif [[ "${vm}" == "s-mon" ]] ; then
         create_if "${vm}" "n-adm" "n-infra"
+elif [[ "${vm}" == "s-webcom" ]] ; then
+        create_if "${vm}" "n-adm" "n-infra"
 elif [[ "${vm}" == "s-appli" ]] ; then
         create_if "${vm}" "n-adm" "n-infra"
 elif [[ "${vm}" == "s-backup" ]] ; then

scripts/mkvm.ps1

@@ -43,7 +43,7 @@ function create_if{ param([string]$nomvm, [string]$nic, [int]$rang, [string]$res
 }
 
 function usage{
-	Write-Host "usage : mkvm ${myInvocation.ScriptName} <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-agence|s-appli|s-backup|s-itil|s-ncx|s-fog|s-dns-ext|s-web-ext|s-lb|s-lb-bd|s-lb-web1|s-lb-web2|s-lb-web3>"
+	Write-Host "usage : mkvm ${myInvocation.ScriptName} <s-adm|s-infra|r-int|r-ext|s-proxy|s-mon|s-agence|s-appli|s-backup|s-itil|s-ncx|s-fog|s-dns-ext|s-web-ext|s-lb|s-lb-bd|s-lb-web1|s-lb-web2|s-lb-web3|s-webcom>"
 }
 
 if ($args[0] -eq "s-adm") {
@@ -80,6 +80,7 @@ elseif (((((((($args[0] -eq "s-elk") `
 -or ($args[0] -eq "s-appli") `
 -or ($args[0] -eq "s-infra") `
 -or ($args[0] -eq "s-proxy") `
+-or ($args[0] -eq "s-webcom") `
 -or ($args[0] -eq "s-itil") `
 -or ($args[0] -eq "s-nxc") `
 ))))))) {

windows/mkusr-backup.cmd

@@ -1,3 +1,4 @@
+@echo off
 net group gg-backup /ADD
 call mkusr uBackup "u-backup" gg-backup
 icacls "C:\gsb\partages\public" /Grant:r uBackup:M /T

windows/mkusr-compta.cmd

@@ -1,3 +1,4 @@
+@echo off
 call mkusr aDupont "Albert Dupon" gg-compta
 call mkusr cSeum "Claire Seum" gg-compta
 call mkusr nPaul "Nicolas Paul" gg-compta

windows/mkusr-nextcloud.cmd

@@ -0,0 +1,2 @@
+@echo off
+call mkusr nextcloud "nextcloud" nextcloud