Compare commits
9 Commits
v0.0.6z-ml
...
v0.0.7e-aa
| Author | SHA1 | Date | |
|---|---|---|---|
| b7d8e6e9d4 | |||
| 5526eab214 | |||
| ea4ecb2fae | |||
| 58f4556a53 | |||
| 86e7124f24 | |||
| c99642eae3 | |||
| 5b759a24c9 | |||
| a64004d713 | |||
| dd6d34986b |
@ -28,7 +28,7 @@
|
||||
192.168.99.103 s-lb-web3.gsb.adm
|
||||
192.168.99.112 r-vp1.gsb.adm
|
||||
192.168.99.102 r-vp2.gsb.adm
|
||||
|
||||
192.168.99.120 s-peertube.gsb.adm
|
||||
|
||||
192.168.99.8 syslog.gsb.adm
|
||||
|
||||
|
||||
@ -27,6 +27,6 @@
|
||||
192.168.99.103 s-lb-web3.gsb.adm
|
||||
192.168.99.112 r-vp1.gsb.adm
|
||||
192.168.99.102 r-vp2.gsb.adm
|
||||
|
||||
192.168.99.120 s-peertube.gsb.adm
|
||||
192.168.99.8 syslog.gsb.adm
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
;
|
||||
$TTL 604800
|
||||
@ IN SOA s-infra.gsb.lan. root.s-infra.gsb.lan. (
|
||||
2023012500 ; Serial
|
||||
2023040501 ; Serial
|
||||
7200 ; Refresh
|
||||
86400 ; Retry
|
||||
8419200 ; Expire
|
||||
@ -35,4 +35,5 @@ s-web1 IN A 192.168.101.1
|
||||
s-web2 IN A 192.168.101.2
|
||||
s-lb.gsb.lan IN A 192.168.100.10
|
||||
ns IN CNAME s-infra.gsb.lan.
|
||||
wpad IN CNAME s-infra.gsb.lan.
|
||||
wpad IN CNAME s-infra.gsb.lan.
|
||||
peertube IN A 192.168.100.20
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
;
|
||||
$TTL 604800
|
||||
@ IN SOA s-infra.gsb.lan. root.s-infra.gsb.lan. (
|
||||
2023012500 ; Serial
|
||||
2023040501 ; Serial
|
||||
7200 ; Refresh
|
||||
86400 ; Retry
|
||||
8419200 ; Expire
|
||||
@ -28,4 +28,4 @@ $TTL 604800
|
||||
11.0 IN PTR s-elk.gsb.lan.
|
||||
17.0 IN PTR s-gestsup.lan
|
||||
254.0 IN PTR r-int.gsb.lan.
|
||||
|
||||
100.20 IN PTR s-peertube
|
||||
|
||||
@ -4,10 +4,12 @@
|
||||
|
||||
@def $DEV_PRIVATE = enp0s8;
|
||||
@def $DEV_WORLD = enp0s9;
|
||||
@def $DEV_WORLD = enp0s9;
|
||||
@def $DEV_VPN= wg0;
|
||||
@def $NET_PRIVATE = 172.16.0.0/24;
|
||||
|
||||
table filter {
|
||||
|
||||
chain (INPUT OUTPUT){
|
||||
# allow VPN
|
||||
proto udp dport 51820 ACCEPT;
|
||||
@ -28,22 +30,22 @@ table filter {
|
||||
|
||||
# allow SSH connections from the private network and from some
|
||||
# well-known internet hosts
|
||||
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
|
||||
saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
|
||||
|
||||
# we provide DNS and SMTP services for the internal net
|
||||
interface $DEV_PRIVATE saddr $NET_PRIVATE {
|
||||
proto (udp tcp) dport domain ACCEPT;
|
||||
proto udp dport bootps ACCEPT;
|
||||
}
|
||||
# interface réseau
|
||||
|
||||
# the rest is dropped by the above policy
|
||||
|
||||
}#FIN INPUT
|
||||
|
||||
# outgoing connections are not limited
|
||||
|
||||
chain OUTPUT {
|
||||
policy ACCEPT;
|
||||
# interface $DEV_VPN proto ssh dport 22 ACCEPT;
|
||||
|
||||
}#FIN OUTPUT
|
||||
|
||||
@ -59,6 +61,9 @@ table filter {
|
||||
# internal nets are allowed
|
||||
interface $DEV_PRIVATE ACCEPT;
|
||||
|
||||
interface $DEV_VPN daddr $NET_PRIVATE {
|
||||
proto tcp dport ssh DROP;
|
||||
}
|
||||
# the rest is dropped by the above policy
|
||||
}
|
||||
}
|
||||
|
||||
@ -35,3 +35,24 @@ Nextcloud est alors fonctionnel avec le proxy inverse **traefik** assurant la re
|
||||
ATTENTION : Après avoir relancé la VM, executez le script "nxc-start.sh" afin d'installer les piles applicatives.
|
||||
|
||||
Une fois le script terminé, le site est disponible ici : https://s-nxc.gsb.lan
|
||||
|
||||
|
||||
## 5. Ajout authentification LDAP
|
||||
|
||||
Pour ajouter l'authentification LDAP au Nextcloud, il faut :
|
||||
* Une fois l'installation de Nextcloud terminé, cliquez sur le profil et Application
|
||||
* Dans vos applications, descendre et activer "LDAP user and group backend"
|
||||
* Puis cliquer sur le profil, puis Paramètres d'administration et dans Administration cliquer sur Intégration LDAP/AD
|
||||
* Une fois sur la page d'intégration LDAP/AD :
|
||||
* Dans Hôte mettre :
|
||||
> ldap://s-win.gsb.lan
|
||||
* Cliquer sur Détecter le port (normalement le port 389 apparait)
|
||||
* Dans DN Utilisateur mettre :
|
||||
> CN=nextcloud,CN=Users,DC=GSB,DC=LAN
|
||||
* Mot de passe :
|
||||
> Azerty1+
|
||||
* Et dans Un DN de base par ligne :
|
||||
> DC=GSB,DC=LAN
|
||||
* Après la configuration passe OK
|
||||
* Une fois la configuration finie, cliquer 3 fois sur continuer
|
||||
* Une fois arrivé sur Groupes, vous pouvez vous déconnecter du compte Admin et vous connecter avec un compte qui est dans l'AD.
|
||||
@ -8,7 +8,7 @@
|
||||
- name: installation de docker...
|
||||
shell: curl https://releases.rancher.com/install-docker/20.10.sh | sh
|
||||
|
||||
- name: attente de l'installation...
|
||||
- name: attente de l'installation de docker...
|
||||
wait_for:
|
||||
timeout: 30
|
||||
host: localhost
|
||||
@ -16,8 +16,7 @@
|
||||
- name: installation de k3s...
|
||||
shell: curl -sfL https://get.k3s.io | sh -s - --docker
|
||||
|
||||
- name: mise a jour de resolv.conf...
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2023/roles/peertube/files/resolv.conf
|
||||
dest: /etc/
|
||||
mode: '0644'
|
||||
- name: attente de l'installation de k3s...
|
||||
wait_for:
|
||||
timeout: 25
|
||||
host: localhost
|
||||
|
||||
6
roles/peertube/files/finish
Normal file
6
roles/peertube/files/finish
Normal file
@ -0,0 +1,6 @@
|
||||
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml;
|
||||
helm repo add postgresql https://charts.bitnami.com/bitnami;
|
||||
helm repo add redis https://charts.bitnami.com/bitnami;
|
||||
helm repo add mail https://bokysan.github.io/docker-postfix;
|
||||
helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm/ ;
|
||||
kubectl config view --raw > ~/.kube/config
|
||||
@ -45,9 +45,9 @@ peertube:
|
||||
dbPasswd: user # must be consistent with postgresql configuration
|
||||
dbSsl: false # disabled by default WARNING: ssl connection feature not tested, use at your own risk
|
||||
dbHostname: peertube-gsb-postgresql # must be consistent with postgresql configuration
|
||||
webHostname: peertube # must be changed to your local setup
|
||||
webHostname: s-peertube.gsb.lan # must be changed to your local setup
|
||||
secret: b2753b0f37444974de0e81f04815e6a889fcf8960bd203a01b624d8fa8a37683
|
||||
smtpHostname: peertube-mail # must be consistent with mail configuration
|
||||
smtpHostname: peertube-gsb-mail # must be consistent with mail configuration
|
||||
smtpPort: 587 # must be consistent with mail configuration
|
||||
smtpFrom: noreply@lan.lan # not configured by default, add something meaningfull if you want
|
||||
smtpTls: false # disabled by default WARNING: tls connection feature not tested, use at your own risk
|
||||
|
||||
@ -18,14 +18,11 @@
|
||||
dest: /root/tools/peertube/helm/
|
||||
mode: '0644'
|
||||
|
||||
- name: copie du script finish...
|
||||
copy:
|
||||
src: /root/tools/ansible/gsb2023/roles/peertube/files/finish
|
||||
dest: /root
|
||||
mode: '0644'
|
||||
|
||||
- name: installation de helm...
|
||||
shell: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
|
||||
- name: exposition du cluster...
|
||||
shell: export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
|
||||
|
||||
- name: installation de peertube...
|
||||
shell: helm repo add postgresql https://charts.bitnami.com/bitnami && helm repo add redis https://charts.bitnami.com/bitnami && helm repo add mail https://bokysan.github.io/docker-postfix
|
||||
|
||||
- name: lancement du helm chart peertube...
|
||||
shell: helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm
|
||||
|
||||
@ -14,4 +14,4 @@ iface enp0s3 inet static
|
||||
allow-hotplug enp0s8
|
||||
iface enp0s8 inet static
|
||||
address 192.168.100.20/24
|
||||
post-up systemctl start k3s && sleep 20 && export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
|
||||
post-up systemctl start k3s
|
||||
|
||||
Reference in New Issue
Block a user