Merge branch 'main' of https://gitea.lyc-lecastel.fr/gadmin/gsb2023

roles/base/templates/hosts.j2

@@ -28,7 +28,7 @@
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
 192.168.99.102  r-vp2.gsb.adm
-
+192.168.99.120  s-peertube.gsb.adm
 
 192.168.99.8	syslog.gsb.adm
 

roles/base/templates/hosts.s-proxy.j2

@@ -27,6 +27,6 @@
 192.168.99.103	s-lb-web3.gsb.adm
 192.168.99.112  r-vp1.gsb.adm
 192.168.99.102  r-vp2.gsb.adm
-
+192.168.99.120  s-peertube.gsb.adm
 192.168.99.8	syslog.gsb.adm
 

roles/dns-master/files/db.gsb.lan

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2023012500      ; Serial
+                        2023040501      ; Serial
                         7200	        ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -35,4 +35,5 @@ s-web1          IN      A       192.168.101.1
 s-web2          IN      A       192.168.101.2
 s-lb.gsb.lan    IN      A       192.168.100.10
 ns   	        IN      CNAME   s-infra.gsb.lan.
-wpad		IN	CNAME	s-infra.gsb.lan.	
+wpad		IN	CNAME	s-infra.gsb.lan.
+peertube	IN	A	192.168.100.20

roles/dns-master/files/db.gsb.lan.rev

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2023012500      ; Serial
+                        2023040501      ; Serial
                         7200            ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -28,4 +28,4 @@ $TTL    604800
 11.0	  IN	  PTR	  s-elk.gsb.lan.
 17.0	  IN	  PTR	  s-gestsup.lan
 254.0     IN      PTR     r-int.gsb.lan.
-
+100.20	IN	PTR	  s-peertube

roles/fw-ferm/files/ferm.conf.r-vp1

@@ -4,10 +4,12 @@
 
 @def $DEV_PRIVATE = enp0s8;
 @def $DEV_WORLD = enp0s9;
+@def $DEV_WORLD = enp0s9;
 @def $DEV_VPN= wg0;
 @def $NET_PRIVATE = 172.16.0.0/24;
 
 table filter {
+
     chain (INPUT OUTPUT){
         # allow VPN
 	proto udp dport 51820 ACCEPT;
@@ -28,22 +30,22 @@ table filter {
 
         # allow SSH connections from the private network and from some
         # well-known internet hosts
-        saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
+        saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
 
         # we provide DNS and SMTP services for the internal net
         interface $DEV_PRIVATE saddr $NET_PRIVATE {
             proto (udp tcp) dport domain ACCEPT;
             proto udp dport bootps ACCEPT;
         }
-        # interface réseau
 
         # the rest is dropped by the above policy
+
     }#FIN INPUT
 
     # outgoing connections are not limited
+
     chain OUTPUT {
         policy ACCEPT;
-#	interface $DEV_VPN proto ssh dport 22 ACCEPT;
 
     }#FIN OUTPUT
 
@@ -59,6 +61,9 @@ table filter {
         # internal nets are allowed
         interface $DEV_PRIVATE ACCEPT;
 
+	interface $DEV_VPN daddr $NET_PRIVATE {
+ 	proto tcp dport ssh DROP;
+        }
         # the rest is dropped by the above policy
     }
 }

roles/peertube/tasks/main.yml

@@ -22,10 +22,10 @@
     shell: curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
   - name: exposition du cluster...
-    shell: export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+    command: KUBECONFIG=/etc/rancher/k3s/k3s.yaml
 
   - name: installation de peertube...
     shell: helm repo add postgresql https://charts.bitnami.com/bitnami && helm repo add redis https://charts.bitnami.com/bitnami && helm repo add mail https://bokysan.github.io/docker-postfix
 
   - name: lancement du helm chart peertube...
-    shell: helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm
+    shell: helm install --create-namespace -n peertube peertube-gsb /root/tools/peertube/helm/