maj scipt python wireguard

goss s-itil pages web
actualisation test goss s-itil
2024-01-19 10:33:38 +01:00 · 2024-01-19 10:01:28 +01:00 · 2024-01-19 09:57:01 +01:00 · 2024-01-19 08:55:25 +01:00 · 2024-01-18 19:52:08 +01:00 · 2024-01-18 19:25:26 +01:00
618 changed files with 49349 additions and 0 deletions
--- a/README.md
+++ b/README.md
@ -1,2 +1,148 @@
 # gsb2024

+2024-01-17 18h04 ps
+
+Environnement et playbooks **ansible** pour le projet **GSB 2024**
+
+## Quickstart
+
+Prérequis : 
+  * une machine **Linux Debian Bookworm** ou **Windows**
+  * VirtualBox
+  * git 
+  * fichier machines virtuelles **ova** :
+    * **debian-bookworm-gsb-2023c.ova**
+    * **debian-bullseye-gsb-2024a.ova**
+
+
+## Les machines 
+
+  * **s-adm** : routeur adm, DHCP + NAT, déploiement, proxy squid 
+  * **s-infra** : DNS maitre, autoconfiguration navigateurs avec **wpad**
+  * **r-int** : routage, DHCP 
+  * **r-ext** : routage, NAT
+  * **s-proxy** : proxy **squid**
+  * **s-itil** : serveur GLPI
+  * **s-backup** : DNS esclave + sauvegarde s-win (SMB)
+  * **s-mon** : supervision avec **Nagios4**, notifications et syslog
+  * **s-fog** : deploiement postes de travail avec **FOG**
+  * **s-win** : Windows Server 2019, AD, DNS, DHCP, partage fichiers
+  * **s-nxc** : NextCloud avec **docker** via proxy inverse **traefik** et certificat auto-signé
+  * **s-elk** : pile **ELK** dockerisée
+  * **s-lb**  : Load Balancer **HaProxy** pour application Wordpress (DMZ)
+  * **r-vp1** : Routeur VPN Wireguard coté siège
+  * **r-vp2** : Routeur VPN Wireguard coté agence, DHCP
+  * **s-agence** : Serveur agence
+  * **s-lb**  : Load Balancer **HaProxy** pour application Wordpress 
+  * **s-lb-web1** : Serveur Wordpress 1 Load Balancer
+  * **s-lb-web2** : Serveur Wordpress 2 Load Balancer
+  * **s-lb-db** : Serveur Mariadb pour Wordpress
+  * **s-nas** : Serveur NFS pour application Wordpress avec LB
+  * **s-kea1** : Serveur DHCP Kea HA 1
+  * **s-kea2** : Serveur DHCP Kea HA 2
+
+
+## Les playbooks
+
+Il existe un playbook ansible pour chaque machine à installer, nommé comme la machine avec l'extension **.yml**
+
+## Installation
+
+On utilisera les images de machines virtuelle suivantes : 
+  * **debian-bookworm-gsb-2023c.ova** (2023-12-18)
+    * Debian Bookworm 12.4 - 2 cartes - 1 Go - Stockage 20 Go
+
+et pour **s-fog** : 
+  * **debian-bullseye-2024a.ova** (2024-01-06)
+    * Debian Bullseye 11.8 - 2 cartes - 1 Go - stockage 20 Go
+
+Les images **.ova** doivent etre stockées dans le répertoire habituel de téléchargement de l'utilisateur courant.
+
+### Création d'une VM
+
+Sur la machine physique, récupérer le dépot **gsb2024.git** avec :
+```shell
+   git clone https://gitea.lyc-lecastel.fr/gsb/gsb2024.git
+```
+
+On utilisera le script (bash) **mkvm** ou (PowerShell) **mkvm.ps1** pour créer une VM Virtualbox.
+
+```shell
+cd gsb2024/scripts
+mkvm -r s-adm
+
+```
+
+### Machine s-adm
+
+La machine **-sadm** est la première machine à installer.
+
+
+  * créer la machine virtuelle **s-adm** avec **mkvm** comme décrit plus haut.
+  * démarrer la VM puis ouvir une session
+  * utiliser le script de renommage comme suit :
+```shell
+bash chname <nouveau_nom_de_machine>` , puis redémarrer
+```
+  * utiliser le script **s-adm-start** : `bash s-adm-start` , puis redémarrer
+  * ou sinon :
+```shell
+    mkdir -p tools/ansible ; cd tools/ansible
+    git clone https://gitea.lyc-lecastel.fr/gsb/gsb2024.git
+    cd gsb2024/pre
+    bash inst-depl
+    cd /root/tools/ansible/gsb2024/pre
+    DEPL=192.168.99.99 bash gsbboot
+    cd ../.. ; bash pull-config
+```
+  - redémarrer
+  - la machine **s-adm** doit etre opérationnelle
+  
+### Pour chaque machine
+
+####  Etape 1 - Nommage machine
+
+  - créer la machine avec **mkvm -r**, les cartes réseau sont paramétrées par **mkvm** selon les spécifications 
+  - ouvrir une session sur la machine considérée
+  - renommer la machine soit
+     * en utilisant le script de renommage comme suit : 
+        ` /root/tools/ansible/gsb2024/scripts/chname <nouveau_nom_de_machine>`
+     * soit (ici on renomme la machine en **s-infra**) avec :  
+```shell
+export HOST=s-infra   
+curl 192.168.99.99/gsbstore/inst1|bash
+reboot # on redemarre
+``` 
+
+#### Etape 2 - installation outils, depot gsb2024 et lancement playbook
+
+  - utiliser le script **gsb-start** : `bash gsb-start`
+  - ou sinon:
+```shell
+curl 192.168.99.99/gsbstore/inst2|bash
+```
+  - le script recupere le dépot **gsb2024.git**
+  - il lance ensuite le script **pull-config** avec le script porant le nom de la machine
+  - on peut alors redémarrer
+
+#### Etape 3 - Redémarrage et tests
+
+  - redémarrer
+  - **Remarque** : une machine doit avoir été redémarrée pour prendre en charge la nouvelle configuration, en particulier la couche réseau et l'adressage.
+  - selon les situations, il est possible qu'un seul playbook ne soit pas suffisant pour installer complètement une machine. Dans ce cas de figure, le second playbook s'appelle **s-machine-post.yml**.
+Il est à lancer depuis ''tools/ansible/gsb2024'' :
+```shell
+ansible-playbook -i localhost, -c local s-machine-post.yml
+```
+
+## Les tests
+
+Il peuvent êtres mis en oeuvre avec **goss** de la façon suivante : chaque machine installée  dispose d'un fichier de test ad-hoc portant le nom de la machine elle-même (machine.yml).
+
+```
+cd tools/ansible/gsb2024
+bash agoss # lance le test portant le nom de la machine 
+```
+
+`bash agoss -f tap` permet de lancer le test avec le détail d'exécution
+
--- a/11
+++ b/11
@ -0,0 +1,11 @@
+#!/bin/bash
+HOST=$(hostname)
+FHOST=$(pwd)/goss/$HOST
+if [ -r "$FHOST".yaml ] ; then
+	#goss -gossfile "$FHOST".yaml v --no-color
+	goss -gossfile "$FHOST".yaml v "$@"
+else
+	echo $0 : erreur lecture fichier "$FHOST".yaml 
+	exit 1 
+fi
+
--- a/7
+++ b/7
@ -0,0 +1,7 @@
+v5.0.2.j : 2019-01-25 -kb
+  ejout role s-nas-cliet et s-nas-server
+v5.0.1 : 2019-01-24 - ps
+  reorganisation : anciens playbooks et roles deplaces dans repertoire old
+v3.2.0 : 2017-11-16 - ps 
+  ajout changelog
+
--- a/doc/Docker-openvas.txt
+++ b/doc/Docker-openvas.txt
@ -0,0 +1,38 @@
+Fichier de documentation fait par Adnan Baljic, le 31/01/2019
+
+Configuration machine:
+Système: Carte Mère: Mémoire Vive: 2048
+Stockage: Contrôleur SATA: Ajouter un disque dur VDI de 8Go
+Réseau 1: n-adm
+Réseau 2: n-infra
+USB: Décocher "Activer le contrôleur USB"
+
+Important: Avant exécution du playbook, veillez à ne pas oublier de créer une partition sur /dev/sdb:
+-fdisk /dev/sdb
+-o
+-n
+-p
+-1
+-w
+
+La configuration de docker se fait automatiquement via le playbook s-docker.yml
+De base, s-docker.yml installera seulement docker-openvas-ab. Cependant, vous pouvez aussi installer docker-iredmail-ab en décommentant sa ligne et en
+commentant la ligne docker-openvas-ab. (Tous les 2 sont accessible depuis le port 443, si les 2 sont installés en même temps, il pourrait y avoir conflit.
+
+Manipulation à faire pour la mise en place d'Openvas via Docker:
+Après exécution de gsbboot et du pull-config, il faudra redémarrer la machine (prise en compte des modifications telles que
+les interfaces...) et exécuter la commande ci-dessous:
+docker run -d -p 443:443 -e PUBLIC_HOSTNAME=172.16.0.19 --name openvas mikesplain/openvas
+
+Manipulation à faire pour la mise en place d'Openvas via Docker:
+Après exécution de gsbboot et du pull-config, il faudra redémarrer la machine (prise en compte des modifications telles que
+les interfaces...) et exécuter la commande ci-dessous:
+docker run -d -p 443:443 -e PUBLIC_HOSTNAME=172.16.0.19 --name openvas lejmr/iredmail
+
+Ensuite, il faudra faire: "docker start nom_du_container" pour le démarrer.
+L'accès au container se fait via une machine virtuelle windows 7 avec Mozilla Firefox à jour, via https://172.16.0.19:443.
+
+Le changement du système de fichier de /dev/sdb1 et le montage sur /var/lib/docker se fera automatiquement via le playbook.
+
+Les tests effectués:
+Jeudi 31 janvier 2019, 15:38 par Adnan Baljic= TEST OpenVAS OK
--- a/doc/icinga.txt
+++ b/doc/icinga.txt
@ -0,0 +1,3 @@
+Roles fait par Adnan Baljic, le 17/01/2019
+Installation de icinga, nagios3-plugins, copie des fichiers de configuration vers /etc/icinga/ (=commands.cfg, hostgroups.cfg) 
+et /etc/icinga/objects/ (=namevm.cfg, services_icinga.cfg, contacts_icinga.cfg)
--- a/doc/pics/e4-SAN-V2.dia
+++ b/doc/pics/e4-SAN-V2.dia
--- a/doc/pics/e4-adm.dia
+++ b/doc/pics/e4-adm.dia
--- a/doc/pics/e4-adm.png
+++ b/doc/pics/e4-adm.png
--- a/doc/pics/e4-agence.dia
+++ b/doc/pics/e4-agence.dia
--- a/doc/pics/e4-agence.png
+++ b/doc/pics/e4-agence.png
--- a/doc/pics/e4-dmz-ab.png
+++ b/doc/pics/e4-dmz-ab.png
--- a/doc/pics/e4-dmz-ha.dia
+++ b/doc/pics/e4-dmz-ha.dia
--- a/doc/pics/e4-dmz-ha.png
+++ b/doc/pics/e4-dmz-ha.png
--- a/doc/pics/e4-dmz-old.png
+++ b/doc/pics/e4-dmz-old.png
--- a/doc/pics/e4-dmz-tl.dia
+++ b/doc/pics/e4-dmz-tl.dia
--- a/doc/pics/e4-dmz-tl.png
+++ b/doc/pics/e4-dmz-tl.png
--- a/doc/pics/e4-dmz.dia
+++ b/doc/pics/e4-dmz.dia
--- a/doc/pics/e4-dmz.png
+++ b/doc/pics/e4-dmz.png
--- a/doc/pics/e4-v2.3.dia
+++ b/doc/pics/e4-v2.3.dia
--- a/doc/pics/e4-v2.3.png
+++ b/doc/pics/e4-v2.3.png
--- a/doc/pics/e4-v2.3x.dia
+++ b/doc/pics/e4-v2.3x.dia
--- a/doc/pics/e4-v2.dia
+++ b/doc/pics/e4-v2.dia
--- a/doc/pics/e4-vpn-infra-v1.2.dia
+++ b/doc/pics/e4-vpn-infra-v1.2.dia
--- a/doc/pics/e4-vpn-infra-v1.2.png
+++ b/doc/pics/e4-vpn-infra-v1.2.png
--- a/doc/pics/e4-vpn-infra.dia
+++ b/doc/pics/e4-vpn-infra.dia
--- a/doc/pics/e4.dia
+++ b/doc/pics/e4.dia
--- a/doc/pics/e4.png
+++ b/doc/pics/e4.png
--- a/doc/r-vp.txt
+++ b/doc/r-vp.txt
@ -0,0 +1,23 @@
+Fichier de documentation fait par Adnan Baljic, le 24/01/2019
+
+Manipulation à faire pour la mise en place de r-vp1 et r-vp2:
+Après exécution de gsbboot et du pull-config, il faudra désactiver l'interface 
+de n-adm pour éviter une boucle. Pour cela, il suffit de faire "ifdown enp0sx"
+
+Pour ce qui est des tests pour vérifier que l'agence passe bien par le tunnel 
+chiffré, vous pouvez stopper le service ipsec ou strongswan ("service 
+strongswan stop" ou "service ipsec stop", cela revient à faire la même chose)
+
+Important: sur r-vp2, si la route par défaut est celui de s-adm, veuillez 
+supprimer cette route en faisant "route del default" sinon l'agence ne passera
+pas par le tunnel chiffré mais vers s-adm 
+cf. Schéma GSB/E4 - VPN/Infra - Version 1.2 - 2019-01-23
+
+La mise en place de strongswan via les certificats se fait via le playbook
+r-vpx-x509.yml. La manipulation ci-dessus n'est pas à faire pour les vpn avec
+certificat si r-vp2-x509 et r-vp1-x509 n'ont pas de route par défaut. Si ils ont
+une route par défaut, veuillez effectuer la même manipulation que pour r-vp2.
+Il faudra tout de même désactiver l'interface de n-adm sur les 2 r-vpx-x509.
+
+Les tests effectués:
+Jeudi 24 janvier 2019, 14:45 par Adnan Baljic= TEST OK
--- a/doc/s-fog.txt
+++ b/doc/s-fog.txt
@ -0,0 +1,11 @@
+fichier de documentation réalier par Olivier Soares et Gaetan Maillard, le 25/01/2019
+
+Pour mettre en oeuvre le serveur fog, il faut déployer une machine virtuel debian (une ova), de la mettre à jour, de la renommer (s-fog), puis de récupérer gsbboot et faire un bash pull-config.
+
+Après avoir avoir fait l'installation de base, il suffit d'éxécuter le playbook "s-fog.yml" avec la commande ansible-playbooks -i hosts s-fog.yml". Ce playbook va récupérer le fichier d'installation de fog, le décompacter et configurer les différentes cartes réseaux de s-fog sachant qu'il y en a trois:
+
+L'interface enp0s3 permet d'avoir accès internet via le réseau "n-adm"
+L'interface enp0s8 permet de communiquer avec le réseau "n-infra"
+L'interface enp0s9 permet d'avoir accès et deployer des postes sur le réseau "n-user"
+
+Maintenant le serveur fog est prêt à être installer, avant de commencer l'installation il faut tout d'abord vérifier que l'accès à tous les réseaux soit correcte. Pour ça il suffit d'éxécuter le fichier de test goss
--- a/goss/list-goss
+++ b/goss/list-goss
@ -0,0 +1,12 @@
+cd goss/
+goss -g r-vp1.yaml v
+goss  -g r-vp1.yaml aa wireguard
+goss add interface enp0s3
+goss add interface enp0s8
+goss add interface enp0s9
+goss add interface wg0
+goss aa wireguard
+goss add package wireguard-tools
+goss add service wg-quick@wg0
+goss add command "ping -c4  10.0.0.2"
+goss add file "/etc/wireguard/wg0.conf"
--- a/goss/r-ext.yaml
+++ b/goss/r-ext.yaml
@ -0,0 +1,40 @@
+command:
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 1
+    stderr: []
+    timeout: 10000
+  ping -c 4 172.16.0.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 4 172.16.0.254:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c 4 192.168.200.254:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.13/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.100.254/24
+  enp0s9:
+    exists: true
+  enp0s16:
+    exists: true
+    addrs:
+    - 192.168.200.253/24
--- a/goss/r-int.yaml
+++ b/goss/r-int.yaml
@ -0,0 +1,35 @@
+package:
+  isc-dhcp-server:
+    installed: true
+service:
+  isc-dhcp-server:
+    enabled: true
+    running: true
+command:
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 1
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.12/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.200.254/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 172.16.65.254/24
+  enp0s10:
+    exists: true
+    addrs:
+    - 172.16.64.254/24
+  enp0s16:
+    exists: true
+    addrs:
+    - 172.16.0.254/24
--- a/goss/r-vp1-cs.yaml
+++ b/goss/r-vp1-cs.yaml
@ -0,0 +1,106 @@
+file:
+  /etc/ipsec.d/cacerts/strongswanCert.pem:
+    exists: true
+    mode: "0644"
+    size: 1834
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp1Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp2Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp1Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1675
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp2Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1679
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  strongswan:
+    installed: true
+    versions:
+    - 5.2.1-6+deb8u2
+service:
+  strongswan:
+    enabled: true
+    running: true
+user:
+  strongswan:
+    exists: true
+    uid: 112
+    gid: 65534
+    groups:
+    - nogroup
+    home: /var/lib/strongswan
+    shell: /usr/sbin/nologin
+command:
+  Associations:
+    exit-status: 127
+    stdout: []
+    stderr:
+    - 'sh: 1: Associations: not found'
+    timeout: 10000
+  ip r|grep default:
+    exit-status: 0
+    stdout:
+    - default via 192.168.1.1 dev enp0s9
+    stderr: []
+    timeout: 10000
+  ipsec  listcacerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=Root CA"'
+    stderr: []
+    timeout: 10000
+  ipsec  listcerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=r-vp1"'
+    - 'subject:  "C=CH, O=GSB, CN=r-vp2"'
+    stderr: []
+    timeout: 10000
+  ipsec statusall|grep Security:
+    exit-status: 0
+    stdout:
+    - 'Security Associations (1 up, 0 connecting):'
+    stderr: []
+    timeout: 10000
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 1
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.0.51/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.1.2/24
--- a/goss/r-vp1-old.yaml
+++ b/goss/r-vp1-old.yaml
@ -0,0 +1,106 @@
+file:
+  /etc/ipsec.d/cacerts/strongswanCert.pem:
+    exists: true
+    mode: "0644"
+    size: 1834
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp1Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp2Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp1Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1675
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp2Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1679
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  strongswan:
+    installed: true
+    versions:
+    - 5.2.1-6+deb8u2
+service:
+  strongswan:
+    enabled: true
+    running: true
+user:
+  strongswan:
+    exists: true
+    uid: 112
+    gid: 65534
+    groups:
+    - nogroup
+    home: /var/lib/strongswan
+    shell: /usr/sbin/nologin
+command:
+  Associations:
+    exit-status: 127
+    stdout: []
+    stderr:
+    - 'sh: 1: Associations: not found'
+    timeout: 10000
+  ip r|grep default:
+    exit-status: 0
+    stdout:
+    - default via 192.168.1.1 dev enp0s9
+    stderr: []
+    timeout: 10000
+  ipsec  listcacerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=Root CA"'
+    stderr: []
+    timeout: 10000
+  ipsec  listcerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=r-vp1"'
+    - 'subject:  "C=CH, O=GSB, CN=r-vp2"'
+    stderr: []
+    timeout: 10000
+  ipsec statusall|grep Security:
+    exit-status: 0
+    stdout:
+    - 'Security Associations (1 up, 0 connecting):'
+    stderr: []
+    timeout: 10000
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 1
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.0.51/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.1.2/24
--- a/goss/r-vp1.yaml
+++ b/goss/r-vp1.yaml
@ -0,0 +1,55 @@
+file:
+  /etc/wireguard/wg0.conf:
+    exists: true
+    mode: "0600"
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  wireguard:
+    installed: true
+    versions:
+    - 1.0.20210914-1
+  wireguard-tools:
+    installed: true
+    versions:
+    - 1.0.20210914-1+b1
+service:
+  wg-quick@wg0:
+    enabled: true
+    running: true
+command:
+  host 192.168.99.99:
+    exit-status: 0
+    stdout:
+    - 99.99.168.192.in-addr.arpa domain name pointer s-adm.gsb.adm.
+    stderr: []
+    timeout: 10000
+  ping -c4  10.0.0.2:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.112/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.1.2/24
+    mtu: 1500
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.0.51/24
+    mtu: 1500
+  wg0:
+    exists: true
+    addrs:
+    - 10.0.0.1/32
+    mtu: 1420
--- a/goss/r-vp2-cs.yaml
+++ b/goss/r-vp2-cs.yaml
@ -0,0 +1,105 @@
+file:
+  /etc/ipsec.d/cacerts/strongswanCert.pem:
+    exists: true
+    mode: "0644"
+    size: 1834
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp1Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp2Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp1Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1675
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp2Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1679
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  strongswan:
+    installed: true
+    versions:
+    - 5.2.1-6+deb8u2
+service:
+  strongswan:
+    enabled: true
+    running: true
+user:
+  strongswan:
+    exists: true
+    gid: 65534
+    groups:
+    - nogroup
+    home: /var/lib/strongswan
+    shell: /usr/sbin/nologin
+command:
+  Associations:
+    exit-status: 127
+    stdout: []
+    stderr:
+    - 'sh: 1: Associations: not found'
+    timeout: 10000
+  ip r|grep default:
+    exit-status: 0
+    stdout:
+    - default via 192.168.99.99 dev enp0s3
+    stderr: []
+    timeout: 10000
+  ipsec  listcacerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=Root CA"'
+    stderr: []
+    timeout: 10000
+  ipsec  listcerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=r-vp2"'
+    - 'subject:  "C=CH, O=GSB, CN=r-vp1"'
+    stderr: []
+    timeout: 10000
+  ipsec statusall|grep Security:
+    exit-status: 0
+    stdout:
+    - 'Security Associations (1 up, 0 connecting):'
+    stderr: []
+    timeout: 10000
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 1
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.128.254/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.0.52/24
--- a/goss/r-vp2-old.yaml
+++ b/goss/r-vp2-old.yaml
@ -0,0 +1,105 @@
+file:
+  /etc/ipsec.d/cacerts/strongswanCert.pem:
+    exists: true
+    mode: "0644"
+    size: 1834
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp1Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/certs/r-vp2Cert.pem:
+    exists: true
+    mode: "0644"
+    size: 1509
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp1Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1675
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+  /etc/ipsec.d/private/r-vp2Key.pem:
+    exists: true
+    mode: "0600"
+    size: 1679
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  strongswan:
+    installed: true
+    versions:
+    - 5.2.1-6+deb8u2
+service:
+  strongswan:
+    enabled: true
+    running: true
+user:
+  strongswan:
+    exists: true
+    gid: 65534
+    groups:
+    - nogroup
+    home: /var/lib/strongswan
+    shell: /usr/sbin/nologin
+command:
+  Associations:
+    exit-status: 127
+    stdout: []
+    stderr:
+    - 'sh: 1: Associations: not found'
+    timeout: 10000
+  ip r|grep default:
+    exit-status: 0
+    stdout:
+    - default via 192.168.99.99 dev enp0s3
+    stderr: []
+    timeout: 10000
+  ipsec  listcacerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=Root CA"'
+    stderr: []
+    timeout: 10000
+  ipsec  listcerts|grep subject:
+    exit-status: 0
+    stdout:
+    - 'subject:  "C=CH, O=GSB, CN=r-vp2"'
+    - 'subject:  "C=CH, O=GSB, CN=r-vp1"'
+    stderr: []
+    timeout: 10000
+  ipsec statusall|grep Security:
+    exit-status: 0
+    stdout:
+    - 'Security Associations (1 up, 0 connecting):'
+    stderr: []
+    timeout: 10000
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 1
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.128.254/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.0.52/24
--- a/goss/r-vp2.yaml
+++ b/goss/r-vp2.yaml
@ -0,0 +1,53 @@
+file:
+  /etc/wireguard/wg0.conf:
+    exists: true
+    mode: "0600"
+    size: 374
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  wireguard:
+    installed: true
+    versions:
+    - 1.0.20210914-1
+  wireguard-tools:
+    installed: true
+    versions:
+    - 1.0.20210914-1+b1
+service:
+  isc-dhcp-server:
+    enabled: true
+    running: true
+  wg-quick@wg0:
+    enabled: true
+    running: true
+command:
+  ping -c4 10.0.0.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.102/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.128.254/24
+    mtu: 1500
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.0.52/24
+    mtu: 1500
+  wg0:
+    exists: true
+    addrs:
+    - 10.0.0.2/32
+    mtu: 1420
--- a/goss/s-adm.yaml
+++ b/goss/s-adm.yaml
@ -0,0 +1,95 @@
+file:
+    /var/www/html/gsbstore/getall:
+        exists: true
+        mode: "0644"
+        owner: root
+        group: root
+        filetype: file
+        contents: []
+package:
+    dnsmasq:
+        installed: true
+    lighttpd:
+        installed: true
+        versions:
+            - 1.4.69-1
+    squid:
+        installed: true
+addr:
+    tcp://depl.sio.lan:80:
+        reachable: true
+        timeout: 500
+port:
+    tcp:53:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp:80:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp6:53:
+        listening: true
+        ip:
+            - '::'
+    tcp6:80:
+        listening: true
+        ip:
+            - '::'
+    udp:53:
+        listening: true
+        ip:
+            - 0.0.0.0
+    udp:67:
+        listening: true
+        ip:
+            - 0.0.0.0
+    udp6:53:
+        listening: true
+        ip:
+            - '::'
+service:
+    dnsmasq:
+        enabled: true
+        running: true
+    lighttpd:
+        enabled: true
+        running: true
+    squid:
+        enabled: true
+        running: true
+    ssh:
+        enabled: true
+        running: true
+user:
+    dnsmasq:
+        exists: true
+        gid: 65534
+        groups:
+            - nogroup
+        home: /var/lib/misc
+        shell: /usr/sbin/nologin
+command:
+    /sbin/sysctl net.ipv4.ip_forward:
+        exit-status: 0
+        stdout:
+            - net.ipv4.ip_forward = 1
+        stderr: []
+        timeout: 10000
+dns:
+    depl.sio.lan:
+        resolveable: true
+        resolvable: null
+        timeout: 500
+process:
+    dnsmasq:
+        running: true
+    lighttpd:
+        running: true
+    squid:
+        running: true
+interface:
+    enp0s8:
+        exists: true
+        addrs:
+            - 192.168.99.99/24
--- a/goss/s-agence.yaml
+++ b/goss/s-agence.yaml
@ -0,0 +1,19 @@
+command:
+  ip route |grep default:
+    exit-status: 0
+    stdout:
+    - default via 172.16.128.254 dev enp0s8
+    stderr: []
+    timeout: 10000
+  ping -c4 172.16.0.1:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+  ping -c4 172.16.128.254:
+    exit-status: 0
+    stdout:
+    -  0% packet loss
+    stderr: []
+    timeout: 10000
--- a/goss/s-appli.yaml
+++ b/goss/s-appli.yaml
@ -0,0 +1,35 @@
+service:
+  mariadb:
+    enabled: true
+    running: true
+
+  apache2:
+    enabled: true
+    running: true
+
+file:
+  /var/www/html/wordpress:
+    exists: true
+    owner: www-data
+    group: www-data
+    filetype: directory
+
+  /var/www/html/wordpress-5.8.2-fr_FR.tar.gz:
+    exists: true
+
+  /var/www/html/wordpress/wp-config-sample.php:
+    exists: true
+
+  /etc/apache2/sites-enabled/000-default.conf:
+    exists: true
+
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.3/24
+
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.3/24
--- a/goss/s-backup.yaml
+++ b/goss/s-backup.yaml
@ -0,0 +1,41 @@
+package:
+  bind9:
+    installed: true
+  cifs-utils:
+    installed: true
+  rsync:
+    installed: true
+  smbclient:
+    installed: true
+service:
+  bind9:
+    enabled: true
+    running: true
+  rsync:
+    enabled: true
+    running: false
+command:
+  ping -c4 ns.gsb.lan:
+    exit-status: 0
+    stdout:
+    - 0% packet loss
+    stderr: []
+    timeout: 10000
+#check si partage windows accesible
+  smbclient -L //s-win --user=uBackup%Azerty1+ | grep 'public':
+    exit-status: 0
+    stdout:
+    - public
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.4/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.4/24
+    mtu: 1500
--- a/goss/s-elk.yaml
+++ b/goss/s-elk.yaml
@ -0,0 +1,26 @@
+port:
+  tcp:5044:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp:5601:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp:9200:
+    listening: true
+    ip:
+    - 0.0.0.0
+service:
+  docker:
+    enabled: true
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.11/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.11/24
--- a/goss/s-fog.yaml
+++ b/goss/s-fog.yaml
@ -0,0 +1,77 @@
+file:
+    /tftpboot/default.ipxe:
+        exists: true
+        mode: "0644"
+        owner: root
+        group: root
+        filetype: file
+        contains: []
+        contents: null
+package:
+    apache2:
+        installed: true
+        versions:
+            - 2.4.56-1~deb11u2
+    isc-dhcp-server:
+        installed: true
+        versions:
+            - 4.4.1-2.3+deb11u2
+    mariadb-server:
+        installed: true
+        versions:
+            - 1:10.5.21-0+deb11u1
+    tftpd-hpa:
+        installed: true
+        versions:
+            - 5.2+20150808-1.2
+port:
+    tcp:80:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp:443:
+        listening: true
+        ip:
+            - 0.0.0.0
+    udp:67:
+        listening: true
+        ip:
+            - 0.0.0.0
+    udp:69:
+        listening: true
+        ip:
+            - 0.0.0.0
+service:
+    apache2:
+        enabled: true
+        running: true
+    isc-dhcp-server:
+        enabled: true
+        running: true
+    nfs-server:
+        enabled: true
+        running: true
+    tftpd-hpa:
+        enabled: true
+        running: true
+command:
+    ping -c 4 192.168.99.99:
+        exit-status: 0
+        stdout:
+            - 0% packet loss
+        stderr: []
+        timeout: 10000
+    ping -c 4 google.fr:
+        exit-status: 0
+        stdout:
+            - 0% packet loss
+        stderr: []
+        timeout: 10000
+process:
+    apache2:
+        running: true
+interface:
+    enp0s9:
+        exists: true
+        addrs:
+            - 172.16.64.16/24
--- a/goss/s-infra.yaml
+++ b/goss/s-infra.yaml
@ -0,0 +1,90 @@
+package:
+  bind9:
+    installed: true
+  lighttpd:
+    installed: true
+addr:
+  tcp://192.168.99.99:8080:
+    reachable: true
+    timeout: 500
+port:
+  tcp:80:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp6:80:
+    listening: true
+    ip:
+    - '::'
+service:
+  bind9:
+    enabled: true
+    running: true
+  lighttpd:
+    enabled: true
+    running: true
+command:
+  host 172.16.0.2:
+    exit-status: 0
+    stdout:
+    - 2.0.16.172.in-addr.arpa domain name pointer s-proxy.gsb.lan.
+    stderr: []
+    timeout: 10000
+  host 172.16.0.9:
+    exit-status: 0
+    stdout:
+    - 9.0.16.172.in-addr.arpa domain name pointer s-itil.gsb.lan.
+    stderr: []
+    timeout: 10000
+  host free.fr:
+    exit-status: 0
+    stdout:
+    - free.fr has address 212.27.48.10
+    - free.fr has IPv6 address 2a01:e0c:1::1
+    - free.fr mail is handled by 10 mx1.free.fr.
+    - free.fr mail is handled by 20 mx2.free.fr.
+    stderr: []
+    timeout: 10000
+  host s-infra:
+    exit-status: 0
+    stdout:
+    - s-infra.gsb.lan has address 172.16.0.1
+    stderr: []
+    timeout: 10000
+  host s-infra.gsb.lan:
+    exit-status: 0
+    stdout:
+    - s-infra.gsb.lan has address 172.16.0.1
+    stderr: []
+    timeout: 10000
+  host s-mon:
+    exit-status: 0
+    stdout:
+    - s-mon.gsb.lan has address 172.16.0.8
+    stderr: []
+    timeout: 10000
+  host s-mon.gsb.lan:
+    exit-status: 0
+    stdout:
+    - s-mon.gsb.lan has address 172.16.0.8
+    stderr: []
+    timeout: 10000
+process:
+  lighttpd:
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.1/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.1/24
+http:
+  http://localhost/wpad.dat:
+    status: 200
+    allow-insecure: false
+    no-follow-redirects: false
+    timeout: 5000
+    body: []
--- a/goss/s-itil.yaml
+++ b/goss/s-itil.yaml
@ -0,0 +1,87 @@
+file:
+    /etc/nginx/sites-enabled/default:
+        exists: false
+        contents: []
+    /etc/nginx/sites-enabled/glpi:
+        exists: true
+        mode: "0644"
+        owner: root
+        group: root
+        filetype: file
+        contents: []
+    /var/www/html/glpi:
+        exists: true
+        mode: "0755"
+        owner: www-data
+        group: www-data
+        filetype: directory
+        contents: []
+    /var/www/html/glpicli:
+        exists: true
+        mode: "0775"
+        owner: www-data
+        group: www-data
+        filetype: directory
+        contents: []
+    /var/www/html/glpicli/GLPI-Agent-1.7-x64.msi:
+        exists: true
+        mode: "0644"
+        owner: root
+        group: root
+        filetype: file
+        contents: []
+port:
+    tcp:22:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp:80:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp:3306:
+        listening: true
+        ip:
+            - 127.0.0.1
+    tcp:9000:
+        listening: true
+        ip:
+            - 127.0.0.1
+    tcp:10050:
+        listening: true
+        ip:
+            - 0.0.0.0
+service:
+    mariadb.service:
+        enabled: true
+        running: true
+    nginx:
+        enabled: true
+        running: true
+    php8.2-fpm.service:
+        enabled: true
+        running: true
+    ssh:
+        enabled: true
+        running: true
+    systemd-journal-upload:
+        enabled: true
+        running: true
+    zabbix-agent:
+        enabled: true
+        running: true
+http:
+    http://s-itil.gsb.lan/:
+        status: 200
+        allow-insecure: false
+        no-follow-redirects: false
+        timeout: 5000
+        body: []
+        username: glpi
+        password: glpi
+    http://s-itil.gsb.lan/glpicli:
+        status: 200
+        allow-insecure: false
+        no-follow-redirects: false
+        timeout: 5000
+        body: []
--- a/goss/s-lb-bd.yaml
+++ b/goss/s-lb-bd.yaml
@ -0,0 +1,21 @@
+package:
+  mysql-server:
+    installed: true
+    versions:
+    - 5.5.54-0+deb8u1
+command:
+  egrep "#bind-address" /etc/mysql/my.cnf:
+    exit-status: 0
+    stdout:
+    - "#bind-address\t\t= 127.0.0.1"
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.13/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.102.50/24
--- a/goss/s-lb-web1.yaml
+++ b/goss/s-lb-web1.yaml
@ -0,0 +1,63 @@
+package:
+  apache2:
+    installed: true
+    versions:
+    - 2.4.10-10+deb8u7
+  php5:
+    installed: true
+    versions:
+    - 5.6.29+dfsg-0+deb8u1
+port:
+  tcp:22:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp6:22:
+    listening: true
+    ip:
+    - '::'
+  tcp6:80:
+    listening: true
+    ip:
+    - '::'
+service:
+  apache2:
+    enabled: true
+    running: true
+  sshd:
+    enabled: true
+    running: true
+user:
+  sshd:
+    exists: true
+    uid: 105
+    gid: 65534
+    groups:
+    - nogroup
+    home: /var/run/sshd
+    shell: /usr/sbin/nologin
+command:
+  egrep 192.168.102.14:/export/www /etc/fstab:
+    exit-status: 0
+    stdout:
+    - 192.168.102.14:/export/www /var/www/html nfs _netdev rw 0 0
+    stderr: []
+    timeout: 10000
+process:
+  apache2:
+    running: true
+  sshd:
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.11/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.101.1/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.102.1/24
--- a/goss/s-lb-web2.yaml
+++ b/goss/s-lb-web2.yaml
@ -0,0 +1,63 @@
+package:
+  apache2:
+    installed: true
+    versions:
+    - 2.4.10-10+deb8u7
+  php5:
+    installed: true
+    versions:
+    - 5.6.29+dfsg-0+deb8u1
+port:
+  tcp:22:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp6:22:
+    listening: true
+    ip:
+    - '::'
+  tcp6:80:
+    listening: true
+    ip:
+    - '::'
+service:
+  apache2:
+    enabled: true
+    running: true
+  sshd:
+    enabled: true
+    running: true
+user:
+  sshd:
+    exists: true
+    uid: 105
+    gid: 65534
+    groups:
+    - nogroup
+    home: /var/run/sshd
+    shell: /usr/sbin/nologin
+command:
+  egrep 192.168.102.14:/export/www /etc/fstab:
+    exit-status: 0
+    stdout:
+    - 192.168.102.14:/export/www /var/www/html nfs _netdev rw 0 0
+    stderr: []
+    timeout: 10000
+process:
+  apache2:
+    running: true
+  sshd:
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.12/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.101.2/24
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.102.2/24
--- a/goss/s-lb.yaml
+++ b/goss/s-lb.yaml
@ -0,0 +1,28 @@
+port:
+  tcp:80:
+    listening: true
+    ip:
+    - 192.168.100.11
+service:
+  haproxy:
+    enabled: true
+    running: true
+  sshd:
+    enabled: true
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.100/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.100.11/24
+    mtu: 1500
+  enp0s9:
+    exists: true
+    addrs:
+    - 192.168.101.254/24
+    mtu: 1500
--- a/goss/s-lb.yaml.old
+++ b/goss/s-lb.yaml.old
@ -0,0 +1,65 @@
+file:
+  /etc/haproxy/haproxy.cfg:
+    exists: true
+    mode: "0644"
+    size: 1518
+    owner: root
+    group: root
+    filetype: file
+    contains: []
+package:
+  haproxy:
+    installed: true
+port:
+  tcp:80:
+    listening: true
+    ip:
+    - 192.168.100.10
+service:
+  haproxy:
+    enabled: true
+    running: true
+user:
+  haproxy:
+    exists: true
+    uid: 111
+    gid: 117
+    groups:
+    - haproxy
+    home: /var/lib/haproxy
+    shell: /bin/false
+group:
+  haproxy:
+    exists: true
+    gid: 117
+command:
+  egrep "balance\s+roundrobin" /etc/haproxy/haproxy.cfg:
+    exit-status: 0
+    stdout:
+    - balance roundrobin
+    stderr: []
+    timeout: 10000
+  egrep "bind\s+192.168.100.10:80" /etc/haproxy/haproxy.cfg:
+    exit-status: 0
+    stdout:
+    - bind 192.168.100.10:80
+    stderr: []
+    timeout: 10000
+  egrep "mode\s+http" /etc/haproxy/haproxy.cfg:
+    exit-status: 0
+    stdout:
+    - "mode\thttp"
+    stderr: []
+    timeout: 10000
+process:
+  haproxy:
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.10/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 192.168.100.10/24
--- a/goss/s-mon.yaml
+++ b/goss/s-mon.yaml
@ -0,0 +1,92 @@
+package:
+  apache2:
+    installed: true
+  zabbix-server-mysql:
+    installed: true
+  zabbix-frontend-php:
+    installed: true
+  zabbix-apache-conf:
+    installed: true
+  zabbix-sql-scripts:
+    installed: true
+  zabbix-agent:
+    installed: true
+  mariadb-server:
+    installed: true
+  python3-pymysql:
+    installed: true
+  systemd-journal-remote:
+    installed: true
+file:
+  /etc/systemd/system/systemd-journal-remote.service:
+    exist: true
+    mode: "0777"
+    filetype: directory
+  /var/log/journal/remote:
+    exist: true
+    mode: "0777"
+    filetype: directory
+port:
+  tcp:80:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp:3306:
+    listening: true
+    ip:
+    - 127.0.0.1
+  tcp:10050:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp:10051:
+    listening: true
+    ip:
+    - 0.0.0.0
+  tcp:19532:
+    listening: true
+    ip:
+      - '*'
+service:
+  apache2:
+    enabled: true
+    running: true
+  zabbix-server:
+    enabled: true
+    running: true
+  zabbix-agent:
+    enabled: true
+    running: true
+  systemd-journal-remote.socket:
+    enabled: true
+    running: true
+command:
+  sysctl net.ipv4.ip_forward:
+    exit-status: 0
+    stdout:
+    - net.ipv4.ip_forward = 0
+    stderr: []
+    timeout: 10000
+process:
+  apache2:
+    running: true
+  zabbix_server:
+    running: true
+  mariadb:
+    running: true
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.8/24
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.8/24
+http:
+  http://localhost/zabbix:
+    status: 401
+    allow-insecure: false
+    no-follow-redirects: false
+    timeout: 5000
+    body: []
--- a/goss/s-proxy.yaml
+++ b/goss/s-proxy.yaml
@ -0,0 +1,30 @@
+package:
+  squid:
+    installed: true
+port:
+  tcp:8080:
+    listening: true
+    ip:
+    - '0.0.0.0'
+service:
+  squid:
+    enabled: true
+    running: true
+command:
+  host 172.16.0.2:
+    exit-status: 0
+    stdout:
+    - 2.0.16.172.in-addr.arpa domain name pointer s-proxy.gsb.lan.
+    stderr: []
+    timeout: 10000
+interface:
+  enp0s3:
+    exists: true
+    addrs:
+    - 192.168.99.2/24
+    mtu: 1500
+  enp0s8:
+    exists: true
+    addrs:
+    - 172.16.0.2/24
+    mtu: 1500
--- a/14
+++ b/14
@ -0,0 +1,14 @@
+#!/bin/bash
+
+filename=/root/tools/ansible/gsb/goss/$HOSTNAME.yaml
+
+if ! [ -e $filename ] ; then
+	echo gsbchk : erreur ouverture $filename
+	exit 1
+
+fi
+if [ $# == 1] ; then
+	goss -g $filename v
+else
+	goss $*
+fi
--- a/179
+++ b/179
@ -0,0 +1,179 @@
+#!/usr/bin/perl
+
+#use strict;
+#use warnings;
+#SCRIPT PERMETTANT DE METTRE LES INTERFACES APPROPRIEES POUR LA MACHINE ENTREE EN PARAMETRE ET DE LA DEMARRER
+my %machines = (
+             's-infra' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-proxy' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-spec' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-mon' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-mess' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-itil' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-proxy' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-backup' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             's-appli' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-infra'
+             },
+             'r-int' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-link',
+		    netif3 => 'n-wifi',
+		    netif4 => 'n-user',
+		    netif5 => 'n-infra'
+             },
+             'r-ext' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-dmz',
+		    netif3 => 'enp0s3',
+                    netif4 => 'n-linkv',
+                    netif5 => 'n-link'
+             },
+             'r-vp2' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-agence',
+                    netif3 => 'enp0s3'
+             },
+             'r-vp1' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'enp0s3',
+                    netif3 => 'n-linkv' 
+             },
+             's-lb' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-dmz',
+                    netif3 => 'n-dmz-lb'
+             },
+             's-lb-bd' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-dmz-db'
+                    
+             },
+             's-lb-web1' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-dmz-lb',
+                    netif3 => 'n-dmz-db'
+             },
+             's-lb-web2' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-dmz-lb',
+                    netif3 => 'n-dmz-db'
+             },
+  	     's-nas' => {
+                    netif1 => 'n-adm',
+                    netif2 => 'n-dmz-db',
+             }
+
+
+
+
+
+
+
+);
+
+
+my ($net1, $net2, $net3, $net4, $net5);
+
+my $machine = shift;
+die "usage : gsbstart <machine>" unless ( $machine);
+
+#print $machines { $machine }  "\n";
+if (%{$machines{$machine}}) { 
+#	print $machines { $machine } {netif1}, "\n";
+        $net1   =  $machines { $machine } {netif1};
+        $net2   =  $machines { $machine } {netif2};
+	$net3   =  $machines { $machine } {netif3};
+        $net4   =  $machines { $machine } {netif4};
+        $net5   =  $machines { $machine } {netif5};
+
+	
+
+} else {
+	print "machine $machine inconnue\n";
+}
+#
+  
+my $ninfra = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\""; 
+
+my $rint = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\nVBoxManage modifyvm ".$machine. " --nic3 intnet\nVBoxManage modifyvm ".$machine. " --intnet3 \"". $net3."\"\nVBoxManage modifyvm ".$machine. " --nic4 intnet\nVBoxManage modifyvm ".$machine. " --intnet4 \"". $net4."\"\nVBoxManage modifyvm ".$machine. " --nic5 intnet\nVBoxManage modifyvm ".$machine. " --intnet5 \"". $net5."\"";
+
+my $rext = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\nVBoxManage modifyvm ".$machine. " --nic3 bridged\nVBoxManage modifyvm ".$machine. " --bridgeadapter1 ". $net3."\nVBoxManage modifyvm ".$machine. " --nic4 intnet\nVBoxManage modifyvm ".$machine. " --intnet4 \"". $net4."\"\nVBoxManage modifyvm ".$machine. " --nic5 intnet\nVBoxManage modifyvm ".$machine. " --intnet5 \"". $net5."\"";
+
+my $rvp2 = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\nVBoxManage modifyvm ".$machine. " --nic3 bridged\nVBoxManage modifyvm ".$machine. " --bridgeadapter1 ". $net3."\n";
+
+my $rvp1 = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 bridged\nVBoxManage modifyvm ".$machine. " --bridgeadapter1 ". $net2 ."\nVBoxManage modifyvm ".$machine. " --nic3 intnet\nVBoxManage modifyvm ".$machine. " --intnet3 \"". $net3."\"\n";
+
+my $lb = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\nVBoxManage modifyvm ".$machine. " --nic3 intnet\nVBoxManage modifyvm ".$machine. " --intnet3 ". $net3."\n";
+
+my $lbbd ="VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\n";
+
+my $lbweb = "VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\nVBoxManage modifyvm ".$machine. " --nic3 intnet\nVBoxManage modifyvm ".$machine. " --intnet3 \"". $net3."\"\n"; 
+
+my $snas ="VBoxManage modifyvm ".$machine. " --nic1 intnet\nVBoxManage modifyvm ".$machine. " --intnet1 \"". $net1."\"\nVBoxManage modifyvm ".$machine. " --nic2 intnet\nVBoxManage modifyvm ".$machine. " --intnet2 \"". $net2."\"\n";
+
+#print $routeur;
+
+
+if ($machine eq "r-int") {
+		qx($rint);
+		print "la création des interfaces du routeur $machine a fonctionné!\n";
+}else{
+	if ($machine eq "r-ext") {
+		qx($rext);
+	}else{
+		qx($ninfra);
+		print "la création des interfaces de $machine a fonctionné!\n";
+	}	
+}
+if ($machine eq "r-vp2") {
+	qx($rvp2);
+}
+if ($machine eq "r-vp1") {
+        qx($rvp1);
+}
+if ($machine eq "s-lb"){
+	qx($lb);
+}
+if ($machine eq "s-lb-web1"){
+	qx($lbweb);
+}
+if ($machine eq "s-lb-web2"){
+        qx($lbweb);
+}
+if ($machine eq "s-lb-bd"){
+        qx($lbbd);
+}
+if ($machine eq "s-nas"){
+        qx($snas);
+}
+
+qx(VBoxManage startvm $machine);	
+	
+
+
--- a/28
+++ b/28
@ -0,0 +1,28 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+
+while ($_ = shift @ARGV) {
+	if ($_ eq "-a"){
+		qx(./gsbstart s-infra);
+		qx(./gsbstart s-spec);
+		qx(./gsbstart s-proxy);
+                qx(./gsbstart s-mon);
+                qx(./gsbstart s-mess);
+                qx(./gsbstart s-itil);
+                qx(./gsbstart s-backup);
+                qx(./gsbstart s-appli);
+                qx(./gsbstart r-vp1);
+                qx(./gsbstart r-vp2);
+                qx(./gsbstart r-int);
+                qx(./gsbstart r-ext);
+                qx(./gsbstart s-lb);
+                qx(./gsbstart s-lb-web-1);
+                qx(./gsbstart s-lb-web-2);
+                qx(./gsbstart s-lb-bd);
+
+	}else{
+                qx(./gsbstart $_);
+	}	
+}
--- a/lisezmoi.txt
+++ b/lisezmoi.txt
@ -0,0 +1,14 @@
+lisezmoi.txt
+------------
+
+Ce document décrit les divers élements du projet GSB du BTS SIO utilisé pour l'Epreuve E4
+
+
+Le projet GSB décrit les diférents playbooks permttant d'installer les
+machines du projet GSB
+
+Les répertoires : 
+
+- roles : les roles
+- goss : les outils de test
+
--- a/old/s-bdd.yml
+++ b/old/s-bdd.yml
@ -0,0 +1,23 @@
+---
+ - hosts: localhost
+   connection: local
+   vars:
+        maria_dbhost: "192.168.102.254"
+        maria_dbname: "wordpress"
+        maria_dbuser: "wp"
+        maria_dbpasswd: "wp"
+
+
+   roles:
+     - base
+     - goss
+#    - s-lb-bd
+     - mariadb
+     - role: db-user
+       cli_ip: "192.168.102.1"
+     - role: db-user
+       cli_ip: "192.168.102.2"
+     - role: db-user
+       cli_ip: "192.168.102.3"     
+     - snmp-agent
+     - post
--- a/old/s-gestsup.yml
+++ b/old/s-gestsup.yml
@ -0,0 +1,12 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - gestsup
+    - postfix-gestsup
+    - ssh-cli
+    # - syslog-cli
+    - snmp-agent
+    - post
--- a/old/s-graylog.yml
+++ b/old/s-graylog.yml
@ -0,0 +1,12 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - goss
+    - docker-graylog
+    - ssh-cli
+    - syslog
+    - post
+
--- a/old/s-lb-wordpress.yml
+++ b/old/s-lb-wordpress.yml
@ -0,0 +1,18 @@
+---
+ - hosts: localhost
+   connection: local
+   vars:
+         wp_mysql_db: "wordpress"
+         wp_mysql_user: "wp"
+         wp_mysql_password: "wp"
+         wp_mysql_host: "192.168.102.50"
+
+   roles:
+     - base
+     - goss
+     - apache2
+     - s-lb-wordpress
+     - snmp-agent
+     - post
+     - mysql
+     - php-fpm
--- a/old/s-lb-wordpress2.yml
+++ b/old/s-lb-wordpress2.yml
@ -0,0 +1,18 @@
+---
+ - hosts: localhost
+   connection: local
+   vars:
+         wp_mysql_db: "wordpress"
+         wp_mysql_user: "wp"
+         wp_mysql_password: "wp"
+         wp_mysql_host: "192.168.102.50"
+
+   roles:
+     - base
+     - goss
+     - apache2
+     - s-lb-wordpress
+     - snmp-agent
+     - post
+     - mysql
+     - php-fpm
--- a/old/s-web.yml
+++ b/old/s-web.yml
@ -0,0 +1,14 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - apache2
+    - snmp-agent
+    - ssh-cli
+    - syslog-cli
+    - post
+    #- mysql
+    - wordpress
+
--- a/old/s-web1.yml
+++ b/old/s-web1.yml
@ -0,0 +1,11 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - s-lb-web
+    - snmp-agent
+    - s-nas-client
+    - post
+
--- a/old/s-web2.yml
+++ b/old/s-web2.yml
@ -0,0 +1,11 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - s-lb-web
+    - snmp-agent
+    - s-nas-client
+    - post
+
--- a/old/s-web3.yml
+++ b/old/s-web3.yml
@ -0,0 +1,11 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - s-lb-web
+    - snmp-agent
+    - s-nas-client
+    - post
+
--- a/old/user-yb.yml
+++ b/old/user-yb.yml
@ -0,0 +1,9 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+    - base
+    - syslog-cli
+    - post
+    - db-user
--- a/pre/gsbboot
+++ b/pre/gsbboot
@ -0,0 +1,54 @@
+#!/bin/bash
+version="1.8"
+__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+__file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
+__base="$(basename ${__file})"
+__root="$(cd "$(dirname "${__dir}")" && pwd)" 
+echo "dir : ${__dir}"
+echo "file : ${__file}"
+echo "base : ${__base}"
+echo "root : ${__root}"
+
+# version 1.8
+# install git si besoin
+# install ansible si besoin + backports si wheezy
+
+readonly base=/root/tools/ansible
+readonly slist=/etc/apt/sources.list
+readonly host=depl
+if [[ -z ${DEPL+x} ]]; then
+  echo "erreur : DEPL indefini"
+  echo " DEPL : adresse serveur deploiement"
+  echo "export DEPL=xyzt ; ./$0"
+  exit 1
+fi
+
+hostf="${host}.local" 
+prj=gsb2024
+APT=apt
+
+which git >> /dev/null
+if [[ $? != 0 ]]; then
+	${APT} update
+	echo "installation de git ..."
+	${APT} install -y git-core
+fi
+${APT} update
+#${APT} upgrade -y
+
+which ansible >> /dev/null
+if [[ $? != 0 ]]; then
+	echo "installation de ansible ..."
+	${APT} install -y ansible 
+fi
+
+[ -e "${base}" ] || mkdir -p "${base}"
+
+grep "${hostf}" /etc/hosts > /dev/null || echo "${DEPL} ${hostf} ${host}" >> /etc/hosts
+cd "${base}"
+
+cp ${prj}/pull-config ${base}
+
+#echo "N'oubliez pasz d'indiquer l'adresse DEPL dans '/root/tools/ansible/pull-config'"
+echo "Vous pouvez lancer 'bash pull-config' depuis ${base} ..."
+
--- a/pre/inst-depl
+++ b/pre/inst-depl
@ -0,0 +1,113 @@
+#!/bin/bash
+## aa : 2023-01-18 15:25
+## ps : 2023-02-01 15:25
+## ps : 2023-12-18 15:25
+## ps : 2024-01-17 15:25
+
+set -o errexit
+set -o pipefail
+GITUSR=gitgsb
+GITPRJ=gsb2024
+apt-get update 
+apt-get install -y lighttpd git 
+STOREREP="/var/www/html/gsbstore" 
+
+
+GLPIREL=10.0.11
+str="wget -nc -4 https://github.com/glpi-project/glpi/releases/download/${GLPIREL}/glpi-${GLPIREL}.tgz"
+
+#GLPI Agent
+
+GLPIAGVER=1.7
+str31="wget -nc -4 https://github.com/glpi-project/glpi-agent/releases/download/${GLPIAGVER}/GLPI-Agent-${GLPIAGVER}-x64.msi"
+
+#str32="wget -nc -4 https://github.com/glpi-project/glpi-agent/releases/download/${GLPIAGVER}/GLPI-Agent-${GLPIAGVER}-x86.msi"
+
+FOGREL=1.5.10
+str4="wget -nc -4 https://github.com/FOGProject/fogproject/archive/${FOGREL}.tar.gz -O fogproject-${FOGREL}.tar.gz"
+
+WPREL=6.4.2
+#v6.1.1 le 17/01/2023
+str5="wget -nc -4 https://fr.wordpress.org/latest-fr_FR.tar.gz -O wordpress-6.4.2-fr_FR.tar.gz"
+
+str6="wget -nc -4 https://github.com/goss-org/goss/releases/latest/download/goss-linux-amd64 -O goss"
+
+str7="wget -nc -4 https://github.com/goss-org/goss/releases/latest/download/dgoss -O dgoss"
+
+#GESTSUPREL=3.2.30
+#str8="wget -nc -4 'https://gestsup.fr/index.php?page=download&channel=stable&version=${GESTSUPREL}&type=gestsup' -O gestsup_${GESTSUPREL}.zip"
+str8="wget -nc -4 'https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.30&type=gestsup' -O gestsup_3.2.30.zip"
+
+#METRICBEAT ET FILEBEAT
+ELKREL=8.11.3
+str81="wget -nc -4 https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${ELKREL}-amd64.deb"
+str82="wget -nc -4 https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${ELKREL}-windows-x86_64.zip"
+str83="wget -nc -4 https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-${ELKREL}-windows-x86_64.zip"
+str84="wget -nc -4 https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-${ELKREL}-amd64.deb"
+
+
+[[ -d "${STOREREP}" ]] || mkdir "${STOREREP}"
+
+(cat <<EOT > "${STOREREP}/getall"
+#!/bin/bash
+
+${str}
+${str31}
+${str4}
+${str5}
+${str6}
+${str7}
+
+chmod +x ./goss ./dgoss
+
+wget -nc -4 https://get.docker.com -O getdocker.sh 
+chmod +x ./getdocker.sh
+
+wget -nc -4 https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64 -O mkcert
+chmod +x ./mkcert
+
+#${str8}
+
+${str81} 
+${str82} 
+${str83} 
+${str84} 
+
+EOT
+)
+
+cat "${STOREREP}/getall"
+
+cd "${STOREREP}" || exit 2
+bash getall
+cp goss /usr/local/bin
+
+(cat <<'EOT' > "${STOREREP}/inst1"
+#!/bin/bash
+if [[ -z "${HOST+x}" ]]; then
+  echo "erreur : variable HOST indefinie"
+  echo " HOST : adresse serveur deploiement"
+  echo "export HOST=s-xyzt ; ./$0"
+  exit 1
+fi
+
+hostname=$(hostname)
+echo "${HOST}" > /etc/hostname
+hostnamectl set-hostname "${HOST}"
+sed -i "s/${hostname}/${HOST}/g" /etc/hosts
+echo "vous pouvez redemarrer ..."
+EOT
+)
+
+(cat <<'EOT' > "${STOREREP}/inst2"
+#!/bin/bash
+
+mkdir -p ~/tools/ansible ; cd ~/tools/ansible
+git clone https://gitea.lyc-lecastel.fr/gsb/gsb2024.git
+cd gsb2024/pre
+DEPL=192.168.99.99 bash gsbboot
+cd ../.. ; bash pull-config
+EOT
+)
+
+
--- a/pre/mkmaster.sh
+++ b/pre/mkmaster.sh
@ -0,0 +1,16 @@
+#!/bin/bash
+
+apt update
+apt install -y curl sudo wget vim git ansible
+timedatectl set-timezone Europe/Paris
+echo bookworm > /etc/hostname
+
+cat > /etc/hosts << EOT
+127.0.0.1       localhost
+127.0.1.1       bookworm 
+127.0.0.1       localhost ip6-localhost ip6-loopback
+EOT
+
+apt autoclean
+apt autoremove
+
--- a/pre/pull-config
+++ b/pre/pull-config
@ -0,0 +1,28 @@
+#!/bin/bash
+
+dir=/root/tools/ansible
+prj=gsb2024
+opt=""
+
+if [ -z ${UREP+x} ]; then 
+	UREP=https://gitea.lyc-lecastel.fr/gsb/gsb2024.git
+fi
+
+dir=/root/tools/ansible
+
+[ -e "${dir}" ] || mkdir -p "${dir}"
+
+cd  "${dir}" || exit 1
+
+if [[ $# == 1 ]] ; then
+	opt=$1
+fi
+if [[ "${opt}" == '-l'  ]] ; then
+	cd "${dir}/${prj}" || exit 2
+	echo "Execution locale ...."
+	ansible-playbook -i localhost, -c local  "$(hostname).yml"
+else
+	ansible-pull -i "$(hostname)," -U "${UREP}"
+fi
+
+exit 0
--- a/28
+++ b/28
@ -0,0 +1,28 @@
+#!/bin/bash
+
+dir=/root/tools/ansible
+prj=gsb2024
+opt=""
+
+if [ -z ${UREP+x} ]; then 
+	UREP=https://gitea.lyc-lecastel.fr/gsb/gsb2024.git
+fi
+
+dir=/root/tools/ansible
+
+[ -e "${dir}" ] || mkdir -p "${dir}"
+
+cd  "${dir}" || exit 1
+
+if [[ $# == 1 ]] ; then
+	opt=$1
+fi
+if [[ "${opt}" == '-l'  ]] ; then
+	cd "${dir}/${prj}" || exit 2
+	echo "Execution locale ...."
+	ansible-playbook -i localhost, -c local  "$(hostname).yml"
+else
+	ansible-pull -i "$(hostname)," -U "${UREP}"
+fi
+
+exit 0
--- a/r-ext.yml
+++ b/r-ext.yml
@ -0,0 +1,12 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+   - base
+   - goss
+   - r-ext
+   - snmp-agent
+   - ssh-cli
+   # - syslog-cli
+   - post
--- a/r-int.yml
+++ b/r-int.yml
@ -0,0 +1,13 @@
+---
+- hosts: localhost
+  connection: local
+
+  roles:
+   - base
+   - goss
+   - r-int
+   - ssh-cli
+   # - syslog-cli
+   - dhcp
+   - snmp-agent
+   - post
--- a/r-vp1-fw.yml
+++ b/r-vp1-fw.yml
@ -0,0 +1,13 @@
+---
+- hosts: localhost
+  connection: local
+
+  vars:
+   - ip1: 192.168.0.51
+   - remip: 192.168.0.52
+   - mynet: 192.168.1.0
+   - remnet: 172.16.128.0
+
+  roles:
+   - fw-ferm
+   
--- a/r-vp1.yml
+++ b/r-vp1.yml
@ -0,0 +1,19 @@
+---
+- hosts: localhost
+  connection: local
+
+  vars:
+   - ip1: 192.168.0.51
+   - remip: 192.168.0.52
+   - mynet: 192.168.1.0
+   - remnet: 172.16.128.0
+
+  roles:
+   - base
+   - goss
+#   - snmp-agent
+   - post
+   - wireguard-r
+   - ssh-cli
+   # - syslog-cli
+   
--- a/r-vp2-fw.yml
+++ b/r-vp2-fw.yml
@ -0,0 +1,12 @@
+---
+- hosts: localhost
+  connection: local
+
+  vars:
+   - ip1: 192.168.0.52
+   - remip: 192.168.0.51
+   - mynet: 172.16.128.0
+   - remnet: 192.168.1.0
+
+  roles:
+   - fw-ferm
--- a/r-vp2.yml
+++ b/r-vp2.yml
@ -0,0 +1,21 @@
+---
+- hosts: localhost
+  connection: local
+
+  vars:
+   - ip1: 192.168.0.52
+   - remip: 192.168.0.51
+   - mynet: 172.16.128.0
+   - remnet: 192.168.1.0
+
+  roles:
+   - base
+   - goss
+   - dhcp-ag
+   - dns-agence
+   - ssh-root-access
+#   - snmp-agent
+   - wireguard-l
+   - post
+   - ssh-cli
+   # - syslog-cli
--- a/roles/appli/README.md
+++ b/roles/appli/README.md
@ -0,0 +1,4 @@
+## Fonctionnement du rôle appli
+  
+Ce rôle permet de créer un serveur wordpress avec MariaDB et apache.  
+Ce rôle permet aussi de créer la base de donnée nécessaire pour wordpress.  
--- a/roles/appli/handlers/main.yml
+++ b/roles/appli/handlers/main.yml
@ -0,0 +1,4 @@
+---
+- name: restart apache
+  service: name=apache2 state=restarted
+  become: yes
--- a/roles/appli/tasks/main.yml
+++ b/roles/appli/tasks/main.yml
@ -0,0 +1,72 @@
+
+---
+- name: Installation des packets
+  apt:
+    state: present
+    name:
+    - php
+    - php-fpm
+    - php-mbstring
+    - php-ssh2
+    - php-gd
+    - php-mysql
+    - python3-mysqldb
+    - libapache2-mod-php
+    - mariadb-server
+    - apache2 
+    - python3
+
+- name: Création du répertoire pour wordpress
+  file:
+    path: /var/www/html/wordpress
+    state: directory
+
+- name: Téléchargement de wordpress
+  get_url:
+    url: http://s-adm.gsb.adm/gsbstore/wordpress-5.8.2-fr_FR.tar.gz
+    dest: /var/www/html
+
+- name: Extraction du fichier wordpress
+  unarchive:
+    src: /var/www/html/wordpress-5.8.2-fr_FR.tar.gz
+    dest: /var/www/html
+
+- name: Fix permissions owner
+  shell: chown -R www-data /var/www/html/wordpress
+
+- name: Fix permissions groups
+  shell: chgrp -R www-data /var/www/html/wordpress
+
+- name: Mettre à jour le site Apache par défaut
+  lineinfile:
+    dest: /etc/apache2/sites-enabled/000-default.conf
+    regexp: "(.)+DocumentRoot /var/www/html"
+    line: "DocumentRoot /var/www/html/wordpress"
+
+- name: restart apache2
+  service:
+    name: apache2
+    state: restarted
+
+- name: Mettre à jour le fichier de configuration WordPress
+  lineinfile:
+    dest: /var/www/html/wordpress/wp-config-sample.php
+    backup: yes
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  with_items:
+    - {'regexp': "define\\('DB_NAME', '(.)+'\\);", 'line': "define('DB_NAME', 'wordpress');"}
+    - {'regexp': "define\\('DB_HOST', '(.)+'\\);", 'line': "define('DB_HOST', 'localhost');"}
+    - {'regexp': "define\\('DB_USER', '(.)+'\\);", 'line': "define('DB_USER', 'wp');"}
+    - {'regexp': "define\\('DB_PASSWORD', '(.)+'\\);", 'line': "define('DB_PASSWORD', 'wp');"}
+
+- name: Création de la base de donnée mysql
+  mysql_db:
+    name: wordpress
+    state: present
+
+- name: Création de l'utilisateur mysql
+  mysql_user:
+    name: wordpress
+    password: wp
+    priv: "*.*:ALL"
--- a/roles/base/files/apt.conf
+++ b/roles/base/files/apt.conf
@ -0,0 +1 @@
+Acquire::http::Proxy "http://192.168.99.99:8080";
--- a/roles/base/files/resolv.conf
+++ b/roles/base/files/resolv.conf
@ -0,0 +1,4 @@
+domain gsb.lan
+search gsb.lan
+nameserver 192.168.99.99
+
--- a/roles/base/files/sources.list
+++ b/roles/base/files/sources.list
@ -0,0 +1,4 @@
+deb https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
+deb https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
+deb https://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
+
--- a/roles/base/files/sources.list.Debian
+++ b/roles/base/files/sources.list.Debian
@ -0,0 +1,4 @@
+deb https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
+deb https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
+deb https://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
+
--- a/roles/base/files/sources.list.Ubuntu
+++ b/roles/base/files/sources.list.Ubuntu
@ -0,0 +1,13 @@
+#------------------------------------------------------------------------------#
+#                            OFFICIAL UBUNTU REPOS                             #
+#------------------------------------------------------------------------------#
+
+
+###### Ubuntu Main Repos
+deb http://fr.archive.ubuntu.com/ubuntu/ wily main restricted universe 
+
+###### Ubuntu Update Repos
+deb http://fr.archive.ubuntu.com/ubuntu/ wily-security main restricted universe 
+deb http://fr.archive.ubuntu.com/ubuntu/ wily-updates main restricted universe 
+
+
--- a/roles/base/files/sources.list.bookworm
+++ b/roles/base/files/sources.list.bookworm
@ -0,0 +1,4 @@
+deb https://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
+deb https://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
+deb https://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
+
--- a/roles/base/files/sources.list.bullseye
+++ b/roles/base/files/sources.list.bullseye
@ -0,0 +1,4 @@
+deb http://deb.debian.org/debian/ bullseye main non-free contrib
+deb http://security.debian.org/debian-security bullseye-security main contrib non-free
+deb http://deb.debian.org/debian/ bullseye-updates main contrib non-free
+
--- a/roles/base/files/sources.list.buster
+++ b/roles/base/files/sources.list.buster
@ -0,0 +1,9 @@
+
+#deb http://ftp.fr.debian.org/debian/ stretch main contrib non-free
+#deb http://security.debian.org/ stretch/updates main
+#deb http://ftp.fr.debian.org/debian/ stretch-updates main
+
+deb http://deb.debian.org/debian/ buster main contrib non-free
+deb http://security.debian.org/debian-security buster/updates main contrib non-free
+deb http://deb.debian.org/debian/ buster-updates main contrib non-free
+
--- a/roles/base/files/sources.list.jessie
+++ b/roles/base/files/sources.list.jessie
@ -0,0 +1,22 @@
+# 
+
+# deb cdrom:[Debian GNU/Linux 6.0.0 _Squeeze_ - Official i386 NETINST Binary-1 20110205-14:34]/ jessie main
+
+#deb cdrom:[Debian GNU/Linux 6.0.0 _Squeeze_ - Official i386 NETINST Binary-1 20110205-14:34]/ jessie main
+
+
+deb http://ftp.fr.debian.org/debian/ jessie main contrib non-free
+#deb-src http://ftp.fr.debian.org/debian/ jessie main
+
+deb http://security.debian.org/ jessie/updates main
+#deb-src http://security.debian.org/ jessie/updates main
+
+deb http://ftp.fr.debian.org/debian/ jessie-updates main
+#deb-src http://ftp.fr.debian.org/debian/ jessie-updates main
+#deb http://backports.debian.org/debian-backports jessie-backports main
+#deb http://packages.steve.org.uk/slaughter/jessie/ ./
+#deb https://rex.linux-files.org/debian/ jessie rex
+
+
+#deb http://http.debian.net/debian jessie-backports main
+
--- a/roles/base/files/sources.list.wheezy
+++ b/roles/base/files/sources.list.wheezy
@ -0,0 +1,22 @@
+# 
+
+# deb cdrom:[Debian GNU/Linux 6.0.0 _Squeeze_ - Official i386 NETINST Binary-1 20110205-14:34]/ wheezy main
+
+#deb cdrom:[Debian GNU/Linux 6.0.0 _Squeeze_ - Official i386 NETINST Binary-1 20110205-14:34]/ wheezy main
+
+
+deb http://ftp.fr.debian.org/debian/ wheezy main contrib non-free
+#deb-src http://ftp.fr.debian.org/debian/ wheezy main
+
+deb http://security.debian.org/ wheezy/updates main
+#deb-src http://security.debian.org/ wheezy/updates main
+
+deb http://ftp.fr.debian.org/debian/ wheezy-updates main
+#deb-src http://ftp.fr.debian.org/debian/ wheezy-updates main
+#deb http://backports.debian.org/debian-backports wheezy-backports main
+#deb http://packages.steve.org.uk/slaughter/wheezy/ ./
+#deb https://rex.linux-files.org/debian/ wheezy rex
+
+
+deb http://http.debian.net/debian wheezy-backports main
+
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@ -0,0 +1,83 @@
+---
+
+- name: desactive unatentted upgrade
+  ansible.builtin.service:
+    name: unattended-upgrades.service
+    state: stopped
+    enabled: false
+
+- name: Copie sources.list
+  copy:
+    src: sources.list.{{ ansible_distribution_release }}
+    dest: /etc/apt/sources.list
+
+- name: Copie apt.conf pour proxy 
+  copy:
+    src: apt.conf
+    dest: /etc/apt/apt.conf
+  when: ansible_hostname != "s-adm"    
+
+#- name: Sysctl desactive ipv6
+#  sysctl:
+#    name: net.ipv6.conf.all.disable_ipv6
+#    value: 1
+#    sysctl_set: yes
+#    state: present
+#    reload: yes
+
+- name: Update + Upgrade
+  apt:
+    upgrade: yes
+    update_cache: yes
+    cache_valid_time: 86400 #One day
+
+- name: Install paquets
+  apt:
+    state: present
+    name: 
+    - vim 
+    - ntp 
+    - mc
+    - tcpdump
+    - curl
+    - net-tools
+    - rsync
+    - sudo
+    - iptables
+
+- name: Desinstall paquets
+  apt:
+    state: absent
+    name: 
+    - nfs-common 
+    - rpcbind 
+    - bluetooth
+
+- name: Configure Vim
+  alternatives:
+    name: editor
+    path: /usr/bin/vim
+
+- name:  Generation /etc/hosts
+  template:
+    src: hosts.j2
+    dest: /etc/hosts
+  when: ansible_hostname != "s-proxy"
+
+- name:  Generation /etc/hosts pour s-proxy
+  template:
+    src: hosts.s-proxy.j2
+    dest: /etc/hosts
+  when: ansible_hostname == "s-proxy"
+
+- name: Desactive IPV6 avec sysctl
+  sysctl:
+    name: "{{ item }}"
+    value: 1
+    state: present
+    reload: yes
+  with_items:
+    - net.ipv6.conf.all.disable_ipv6
+    - net.ipv6.conf.default.disable_ipv6
+    - net.ipv6.conf.lo.disable_ipv6
+
--- a/roles/base/templates/hosts.j2
+++ b/roles/base/templates/hosts.j2
@ -0,0 +1,37 @@
+127.0.0.1       localhost
+127.0.1.1       {{ ansible_nodename }}.gsb.lan {{ ansible_hostname }}
+127.0.0.1       localhost ip6-localhost ip6-loopback
+
+#10.121.38.10	depl.sio.lan depl
+
+192.168.99.99	s-adm.gsb.adm depl.sio.lan depl
+192.168.99.1	s-infra.gsb.adm
+192.168.99.2	s-proxy.gsb.adm
+192.168.99.3	s-appli.gsb.adm
+192.168.99.4	s-backup.gsb.adm
+192.168.99.5	s-puppet.gsb.adm
+192.168.99.6	s-win.gsb.adm 
+192.168.99.7	s-nxc.gsb.adm
+192.168.99.8	s-mon.gsb.adm
+192.168.99.9	s-itil.gsb.adm
+192.168.99.10	s-lb.gsb.adm
+192.168.99.11	s-elk.gsb.adm
+192.168.99.10	s-dns.gsb.adm
+192.168.99.12	r-int.gsb.adm
+192.168.99.13	r-ext.gsb.adm
+192.168.99.14	s-nas.gsb.adm
+192.168.99.15	s-san.gsb.adm
+192.168.99.16	s-fog.gsb.adm
+192.168.99.20	s-kea1.gsb.adm
+192.168.99.21	s-kea2.gsb.adm
+192.168.99.22	s-awx.gsb.adm
+192.168.99.50	s-lb-bd.gsb.adm
+192.168.99.101	s-lb-web1.gsb.adm
+192.168.99.102	s-lb-web2.gsb.adm
+192.168.99.103	s-lb-web3.gsb.adm
+192.168.99.112  r-vp1.gsb.adm
+192.168.99.102  r-vp2.gsb.adm
+192.168.99.120  s-peertube.gsb.adm
+
+192.168.99.8	syslog.gsb.adm
+
--- a/roles/base/templates/hosts.s-proxy.j2
+++ b/roles/base/templates/hosts.s-proxy.j2
@ -0,0 +1,35 @@
+127.0.0.1       localhost
+127.0.1.1       {{ ansible_nodename }} {{ ansible_hostname }}
+127.0.0.1       localhost ip6-localhost ip6-loopback
+172.16.0.2	s-proxy.gsb.lan s-proxy
+
+#10.121.38.10	depl
+
+192.168.99.99	s-adm.gsb.adm depl
+192.168.99.1	s-infra.gsb.adm
+192.168.99.2	s-proxy.gsb.adm
+192.168.99.3	s-appli.gsb.adm
+192.168.99.4	s-backup.gsb.adm
+192.168.99.5	s-puppet.gsb.adm
+192.168.99.6	s-win.gsb.adm 
+192.168.99.7	s-nxc.gsb.adm
+192.168.99.8	s-mon.gsb.adm
+192.168.99.9	s-itil.gsb.adm
+192.168.99.10	s-lb.gsb.adm
+192.168.99.11	s-elk.gsb.adm
+192.168.99.10	s-dns.gsb.adm
+192.168.99.12	r-int.gsb.adm
+192.168.99.13	r-ext.gsb.adm
+192.168.99.14	s-nas.gsb.adm
+192.168.99.20	s-kea1.gsb.adm
+192.168.99.21	s-kea2.gsb.adm
+192.168.99.22	s-awx.gsb.adm
+192.168.99.50	s-lb-bd.gsb.adm
+192.168.99.101	s-lb-web1.gsb.adm
+192.168.99.102	s-lb-web2.gsb.adm
+192.168.99.103	s-lb-web3.gsb.adm
+192.168.99.112  r-vp1.gsb.adm
+192.168.99.102  r-vp2.gsb.adm
+192.168.99.120  s-peertube.gsb.adm
+192.168.99.8	syslog.gsb.adm
+
--- a/roles/dhcp-ag/files/dhcpd.conf
+++ b/roles/dhcp-ag/files/dhcpd.conf
@ -0,0 +1,152 @@
+#
+# Sample configuration file for ISC dhcpd for Debian
+#
+#
+
+# The ddns-updates-style parameter controls whether or not the server will
+# attempt to do a DNS update when a lease is confirmed. We default to the
+# behavior of the version 2 packages ('none', since DHCP v2 didn't
+# have support for DDNS.)
+ddns-update-style none;
+
+# option definitions common to all supported networks...
+option domain-name "gsb.lan";
+option domain-name-servers 172.16.0.1;
+
+default-lease-time 86400;
+max-lease-time 86400;
+
+# If this DHCP server is the official DHCP server for the local
+# network, the authoritative directive should be uncommented.
+#authoritative;
+
+# Use this to send dhcp log messages to a different log file (you also
+# have to hack syslog.conf to complete the redirection).
+log-facility local7;
+
+# No service will be given on this subnet, but declaring it helps the 
+# DHCP server to understand the network topology.
+
+#subnet 10.152.187.0 netmask 255.255.255.0 {
+#}
+
+# This is a very basic subnet declaration.
+
+#subnet 10.254.239.0 netmask 255.255.255.224 {
+#  range 10.254.239.10 10.254.239.20;
+#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
+#}
+
+# This declaration allows BOOTP clients to get dynamic addresses,
+# which we don't really recommend.
+
+#subnet 10.254.239.32 netmask 255.255.255.224 {
+#  range dynamic-bootp 10.254.239.40 10.254.239.60;
+#  option broadcast-address 10.254.239.31;
+#  option routers rtr-239-32-1.example.org;
+#}
+
+# A slightly different configuration for an internal subnet.
+#subnet 10.5.5.0 netmask 255.255.255.224 {
+#  range 10.5.5.26 10.5.5.30;
+#  option domain-name-servers ns1.internal.example.org;
+#  option domain-name "internal.example.org";
+#  option routers 10.5.5.1;
+#  option broadcast-address 10.5.5.31;
+#  default-lease-time 600;
+#  max-lease-time 7200;
+#}
+
+# Hosts which require special configuration options can be listed in
+# host statements.   If no address is specified, the address will be
+# allocated dynamically (if possible), but the host-specific information
+# will still come from the host declaration.
+
+#host passacaglia {
+#  hardware ethernet 0:0:c0:5d:bd:95;
+#  filename "vmunix.passacaglia";
+#  server-name "toccata.fugue.com";
+#}
+
+# Fixed IP addresses can also be specified for hosts.   These addresses
+# should not also be listed as being available for dynamic assignment.
+# Hosts for which fixed IP addresses have been specified can boot using
+# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
+# be booted with DHCP, unless there is an address range on the subnet
+# to which a BOOTP client is connected which has the dynamic-bootp flag
+# set.
+#host fantasia {
+#  hardware ethernet 08:00:07:26:c0:a5;
+#  fixed-address fantasia.fugue.com;
+#}
+
+# You can declare a class of clients and then do address allocation
+# based on that.   The example below shows a case where all clients
+# in a certain class get addresses on the 10.17.224/24 subnet, and all
+# other clients get addresses on the 10.0.29/24 subnet.
+
+#class "foo" {
+#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
+#}
+
+#shared-network 224-29 {
+#  subnet 10.17.224.0 netmask 255.255.255.0 {
+#    option routers rtr-224.example.org;
+#  }
+#  subnet 10.0.29.0 netmask 255.255.255.0 {
+#    option routers rtr-29.example.org;
+#  }
+#  pool {
+#    allow members of "foo";
+#    range 10.17.224.10 10.17.224.250;
+#  }
+#  pool {
+#    deny members of "foo";
+#    range 10.0.29.10 10.0.29.230;
+#  }
+#}
+
+#DHCP pour le réseau wifi
+#subnet 172.16.65.0 netmask 255.255.255.0 {
+#	range 172.16.65.1 172.16.65.100;
+#  	option domain-name-servers ns1.internal.example.org;
+#  	option domain-name "internal.example.org";
+#  	option routers 10.5.5.1;
+#  	option broadcast-address 10.5.5.31;
+#  	default-lease-time 600;
+#  	max-lease-time 7200;
+#}
+
+#DHCP pour le réseau USER
+
+#subnet 172.16.64.0 netmask 255.255.255.0 {
+#        range 172.16.64.20 172.16.64.120;
+#        option domain-name-servers 172.16.0.6, 172.16.0.1 ;
+#        option routers 172.16.64.254;
+#        option broadcast-address 172.16.64.255;
+#       default-lease-time 600;
+#       max-lease-time 7200;
+#}
+
+#DHCP pour le réseau INFRA
+
+#subnet 172.16.0.0 netmask 255.255.255.0 {
+#        range 172.16.0.1 172.16.0.100;
+#       option domain-name-servers ns1.internal.example.org;
+#       option domain-name "internal.example.org";
+#       option routers 10.5.5.1;
+#       option broadcast-address 10.5.5.31;
+#       default-lease-time 600;
+#       max-lease-time 7200;
+#}
+
+#DHCP pour le réseau AGENCE
+
+subnet 172.16.128.0 netmask 255.255.255.0 {
+	range 172.16.128.10 172.16.128.50;
+	option domain-name-servers 172.16.0.1;
+	option routers 172.16.128.254;
+	option broadcast-address 172.16.128.255;
+	default-lease-time 86400;
+	max-lease-time 86400;
+}
--- a/roles/dhcp-ag/files/isc-dhcp-server
+++ b/roles/dhcp-ag/files/isc-dhcp-server
@ -0,0 +1,18 @@
+# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)
+
+# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
+DHCPDv4_CONF=/etc/dhcp/dhcpd.conf
+#DHCPDv6_CONF=/etc/dhcp/dhcpd6.conf
+
+# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
+DHCPDv4_PID=/var/run/dhcpd.pid
+#DHCPDv6_PID=/var/run/dhcpd6.pid
+
+# Additional options to start dhcpd with.
+#	Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
+#OPTIONS=""
+
+# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
+#	Separate multiple interfaces with spaces, e.g. "eth0 eth1".
+INTERFACESv4="enp0s8"
+INTERFACESv6=""
--- a/roles/dhcp-ag/handlers/main.yml
+++ b/roles/dhcp-ag/handlers/main.yml
@ -0,0 +1,3 @@
+---
+  - name: restart dhcp 
+    service: name=isc-dhcp-server state=restarted
--- a/roles/dhcp-ag/tasks/main.yml
+++ b/roles/dhcp-ag/tasks/main.yml
@ -0,0 +1,11 @@
+---
+  - name: Installation serveur dhcp
+    apt: name=isc-dhcp-server state=present update_cache=yes
+
+  - name: copie dhcpd.conf
+    copy: src=dhcpd.conf dest=/etc/dhcp
+   # notify: restart dhcp
+
+  - name: copie conf isc-dhcp-server
+    copy: src=isc-dhcp-server dest=/etc/default/isc-dhcp-server
+   # notify: restart dhcp
--- a/roles/dhcp-fog/files/dhcpd.conf
+++ b/roles/dhcp-fog/files/dhcpd.conf
@ -0,0 +1,142 @@
+#
+# Sample configuration file for ISC dhcpd for Debian
+#
+#
+
+# The ddns-updates-style parameter controls whether or not the server will
+# attempt to do a DNS update when a lease is confirmed. We default to the
+# behavior of the version 2 packages ('none', since DHCP v2 didn't
+# have support for DDNS.)
+ddns-update-style none;
+
+# option definitions common to all supported networks...
+option domain-name "gsb.lan";
+option domain-name-servers 172.16.0.1;
+
+default-lease-time 86400;
+max-lease-time 86400;
+
+# If this DHCP server is the official DHCP server for the local
+# network, the authoritative directive should be uncommented.
+#authoritative;
+
+# Use this to send dhcp log messages to a different log file (you also
+# have to hack syslog.conf to complete the redirection).
+log-facility local7;
+
+# No service will be given on this subnet, but declaring it helps the 
+# DHCP server to understand the network topology.
+
+#subnet 10.152.187.0 netmask 255.255.255.0 {
+#}
+
+# This is a very basic subnet declaration.
+
+#subnet 10.254.239.0 netmask 255.255.255.224 {
+#  range 10.254.239.10 10.254.239.20;
+#  option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
+#}
+
+# This declaration allows BOOTP clients to get dynamic addresses,
+# which we don't really recommend.
+
+#subnet 10.254.239.32 netmask 255.255.255.224 {
+#  range dynamic-bootp 10.254.239.40 10.254.239.60;
+#  option broadcast-address 10.254.239.31;
+#  option routers rtr-239-32-1.example.org;
+#}
+
+# A slightly different configuration for an internal subnet.
+#subnet 10.5.5.0 netmask 255.255.255.224 {
+#  range 10.5.5.26 10.5.5.30;
+#  option domain-name-servers ns1.internal.example.org;
+#  option domain-name "internal.example.org";
+#  option routers 10.5.5.1;
+#  option broadcast-address 10.5.5.31;
+#  default-lease-time 600;
+#  max-lease-time 7200;
+#}
+
+# Hosts which require special configuration options can be listed in
+# host statements.   If no address is specified, the address will be
+# allocated dynamically (if possible), but the host-specific information
+# will still come from the host declaration.
+
+#host passacaglia {
+#  hardware ethernet 0:0:c0:5d:bd:95;
+#  filename "vmunix.passacaglia";
+#  server-name "toccata.fugue.com";
+#}
+
+# Fixed IP addresses can also be specified for hosts.   These addresses
+# should not also be listed as being available for dynamic assignment.
+# Hosts for which fixed IP addresses have been specified can boot using
+# BOOTP or DHCP.   Hosts for which no fixed address is specified can only
+# be booted with DHCP, unless there is an address range on the subnet
+# to which a BOOTP client is connected which has the dynamic-bootp flag
+# set.
+#host fantasia {
+#  hardware ethernet 08:00:07:26:c0:a5;
+#  fixed-address fantasia.fugue.com;
+#}
+
+# You can declare a class of clients and then do address allocation
+# based on that.   The example below shows a case where all clients
+# in a certain class get addresses on the 10.17.224/24 subnet, and all
+# other clients get addresses on the 10.0.29/24 subnet.
+
+#class "foo" {
+#  match if substring (option vendor-class-identifier, 0, 4) = "SUNW";
+#}
+
+#shared-network 224-29 {
+#  subnet 10.17.224.0 netmask 255.255.255.0 {
+#    option routers rtr-224.example.org;
+#  }
+#  subnet 10.0.29.0 netmask 255.255.255.0 {
+#    option routers rtr-29.example.org;
+#  }
+#  pool {
+#    allow members of "foo";
+#    range 10.17.224.10 10.17.224.250;
+#  }
+#  pool {
+#    deny members of "foo";
+#    range 10.0.29.10 10.0.29.230;
+#  }
+#}
+
+#DHCP pour le réseau wifi
+#subnet 172.16.65.0 netmask 255.255.255.0 {
+#	range 172.16.65.1 172.16.65.100;
+#	option domain-name-servers ns1.internal.example.org;
+#	option domain-name "internal.example.org";
+#	option routers 10.5.5.1;
+#	option broadcast-address 10.5.5.31;
+#	default-lease-time 600;
+#	max-lease-time 7200;
+#}
+
+#DHCP pour le réseau USER
+
+subnet 172.16.64.0 netmask 255.255.255.0 {
+        range 172.16.64.20 172.16.64.120;
+        option domain-name-servers 172.16.0.1 ;
+        option routers 172.16.64.254;
+        option broadcast-address 172.16.64.255;
+#       default-lease-time 600;
+#       max-lease-time 7200;
+}
+
+#DHCP pour le réseau INFRA
+
+#subnet 172.16.0.0 netmask 255.255.255.0 {
+#        range 172.16.0.1 172.16.0.100;
+#       option domain-name-servers ns1.internal.example.org;
+#       option domain-name "internal.example.org";
+#       option routers 10.5.5.1;
+#       option broadcast-address 10.5.5.31;
+#       default-lease-time 600;
+#       max-lease-time 7200;
+#}
+
--- a/roles/dhcp-fog/files/isc-dhcp-server
+++ b/roles/dhcp-fog/files/isc-dhcp-server
@ -0,0 +1,18 @@
+# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)
+
+# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
+DHCPDv4_CONF=/etc/dhcp/dhcpd.conf
+#DHCPDv6_CONF=/etc/dhcp/dhcpd6.conf
+
+# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
+DHCPDv4_PID=/var/run/dhcpd.pid
+#DHCPDv6_PID=/var/run/dhcpd6.pid
+
+# Additional options to start dhcpd with.
+#	Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
+#OPTIONS=""
+
+# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
+#	Separate multiple interfaces with spaces, e.g. "eth0 eth1".
+INTERFACESv4="enp0s9"
+INTERFACESv6=""
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
root	050a4fdc7d	maj scipt python wireguard	2024-01-19 10:33:38 +01:00
root	8568463dc7	goss s-itil pages web	2024-01-19 10:01:28 +01:00
root	d58d3ae8d7	actualisation test goss s-itil	2024-01-19 09:57:01 +01:00
root	16af48fbf3	test playbook docker	2024-01-19 08:55:25 +01:00
root	b104d23495	Mise à jour fichier README.md Zabbix-cli	2024-01-18 19:52:08 +01:00
root	77e9367396	fin #- zabbix-cli	2024-01-18 19:25:26 +01:00
root	38582b8f8d	mise à jour role zabbix-cli	2024-01-18 18:59:18 +01:00
gsb	1eae98a064	Actualiser roles/wireguard-r/README.md	2024-01-18 18:44:38 +01:00
sio user	39ee37f3e8	ajout entree pour s-awx	2024-01-18 17:10:33 +01:00
gsb	1f4c957726	Actualiser roles/wireguard-r/README.md	2024-01-18 16:42:19 +01:00
gsb	89515287b0	Actualiser roles/wireguard-r/README.md	2024-01-18 16:17:14 +01:00
gsb	77d1440da7	Actualiser roles/wireguard-r/README.md	2024-01-18 16:13:04 +01:00
gsb	be66b9e2f4	Actualiser roles/wireguard-r/-README.md	2024-01-18 16:10:05 +01:00
gsb	91417b7f8e	Actualiser roles/wireguard-r/-README.md	2024-01-18 16:03:25 +01:00
Jimmy Chevanne	69052938f7	Merge branch 'main' of https://gitea.lyc-lecastel.fr/gsb/gsb2024	2024-01-18 15:46:08 +01:00
gsb	81af190640	Actualiser roles/wireguard-r/README.md	2024-01-18 15:44:10 +01:00
Jimmy Chevanne	8b80414e46	maj lb-nfs-server	2024-01-18 15:44:02 +01:00
gsb	91acd3c18d	Actualiser roles/wireguard-r/README.md	2024-01-18 15:37:07 +01:00
gsb	8498d7be15	Actualiser roles/wireguard-r/README.md	2024-01-18 15:35:08 +01:00
root	15e57a4a40	modif docker install	2024-01-18 11:51:53 +01:00
Jimmy Chevanne	8b59a5553f	maj post-lb web2	2024-01-18 11:45:25 +01:00
Florian Ribeiro	5f1b04fd96	update	2024-01-18 11:34:02 +01:00
root	3b88857c0b	modif reseau proxy	2024-01-18 11:19:52 +01:00
root	72c5498e64	maj role fw	2024-01-18 11:11:34 +01:00
root	e1cc021ee2	mise a jour role kea-master et kea-slave modif des fichiers de config	2024-01-18 10:59:19 +01:00
Jimmy Chevanne	76528fad6f	maj playbooks lb	2024-01-18 10:36:06 +01:00
Jimmy Chevanne	bc7cdc993f	maj playbooks lb	2024-01-18 10:01:18 +01:00
phil	01e06119a5	mkvm : mode normal pour option -s	2024-01-18 00:14:03 +01:00
root	99672bef0d	reorganisation roles kea-master et kea-slave	2024-01-17 22:25:55 +01:00
phil	f9e801c39e	MAJ doc README.md	2024-01-17 18:06:26 +01:00
phil	85374ee503	s-fog.yml et s-fog-post.yml	2024-01-17 17:00:31 +01:00
phil	5232d80321	syntax dans inst-depl	2024-01-17 15:08:29 +01:00
phil	5acca816af	inst-depl	2024-01-17 15:01:52 +01:00
root	394a8d8cd8	'fogsettings : short hostname	2024-01-17 14:53:47 +01:00
root	ff03ee66a5	fog: test goss et fogsettings adresse	2024-01-17 14:45:05 +01:00
root	1e30fd87a9	adapt diverses	2024-01-17 13:39:34 +01:00
root	924a11f843	inst-depl echappement	2024-01-17 13:06:42 +01:00
phil	83a3942900	inst-depl inst1 et inst2	2024-01-17 12:18:45 +01:00
phil	0d2968b2c8	prepa role fog	2024-01-16 23:55:52 +01:00
phil	86afa7c616	nettoyage pull-config	2024-01-16 23:14:22 +01:00
phil	00071b1c67	chgt plage adresse pour n-user : 100-150	2024-01-16 22:05:56 +01:00
root	b5237811e1	s-fog.yaml et fogsettings single interface	2024-01-16 15:34:41 +01:00
Jimmy Chevanne	25bb47afd3	Creation role kea a continuer	2024-01-16 12:41:50 +01:00
root	addabae478	maj s-mon : become	2024-01-16 12:06:22 +01:00
root	a57998f5de	maj goss r-vp2.yaml	2024-01-16 11:39:57 +01:00
root	262b7bdb13	maj goss r-vp2	2024-01-16 11:03:44 +01:00
Alhassane Kone	c45dc50d12	maj mvkm.ps1: ajout kea1 et kea2	2024-01-16 10:38:55 +01:00
Jimmy Chevanne	d1116a91c3	update	2024-01-16 10:32:09 +01:00
Jimmy Chevanne	9c8dca44c9	mise à jour mkvm	2024-01-16 10:24:04 +01:00
root	ce3b6e0a77	nettoyage s-fog	2024-01-15 21:47:44 +01:00
phil	a03298ed54	php version dans fogsettings	2024-01-15 21:34:04 +01:00
sio user	80b54a50df	ajout entrée dnas base, post et dns-master pour s-kea1 et s-kea2	2024-01-15 17:54:31 +01:00
root	045af9bea2	maj zabbix cli	2024-01-15 17:22:15 +01:00
gsb	6b10b981f4	Actualiser roles/journald-rcv/README.md	2024-01-15 13:57:01 +01:00
root	3811e2df5c	README.md	2024-01-15 00:49:40 +01:00
root	27aad0dcb5	commente appel role zabbix-cli non fonctionnel	2024-01-15 00:42:05 +01:00
phil	c03c066d41	mkvm options	2024-01-15 00:02:43 +01:00
phil	beca7dbdcc	ajout option -s pour mkvm	2024-01-14 23:19:06 +01:00
root	5dcaeb0629	s-adm.yaml pour goss	2024-01-14 23:03:57 +01:00
gsb	82bda1c85b	Actualiser roles/journald-rcv/README.md	2024-01-14 22:51:39 +01:00
root	0537e6f942	mise a jour test goss role s-itil s-mon. Actualisation de la documentation role journald-rcv modification des roles s-fog et s-itil	2024-01-14 22:47:02 +01:00
phil	7310641ce0	typo	2024-01-14 22:44:49 +01:00
phil	48b16468b6	typo inst-depl	2024-01-14 22:43:05 +01:00
phil	c7a893651e	inst-depl : inst goss	2024-01-14 22:39:56 +01:00
phil	236e560329	inst-depl ipv4 et gestup	2024-01-14 22:30:01 +01:00
phil	84144c72fb	inst-depl => lighttpd	2024-01-14 22:15:23 +01:00
root	84aa96c106	maj handler role glpi	2024-01-14 14:20:13 +01:00
phil	d6ddbb4dd6	MAJ doc README.md	2024-01-13 16:08:49 +01:00
root	cc36b5dcf7	fogsettings : trash	2024-01-12 22:39:04 +01:00
root	5aa12d8acd	chgt role base	2024-01-12 22:05:05 +01:00
root	35a21bab2f	comment appel zabbix-cli dans s-adm.yml	2024-01-12 21:43:40 +01:00
root	cdd64636ed	maj README windows	2024-01-12 15:48:39 +01:00
root	db966c5e9e	README.md à jour	2024-01-12 15:22:43 +01:00
root	8107158a4f	README.md à jour	2024-01-12 15:20:02 +01:00
Jimmy Chevanne	18cb3a1d99	creation goss s-mon	2024-01-12 15:17:41 +01:00
Jimmy Chevanne	0997c5d44a	creation goss s-mon	2024-01-12 15:14:00 +01:00
gsb	bf877b63a6	Actualiser roles/glpi/handlers/main.yml	2024-01-12 15:07:06 +01:00
root	a4b7b06c3f	modif test agoss	2024-01-12 14:47:21 +01:00
root	8a81aac1e2	modif test agoss	2024-01-12 14:37:22 +01:00
Jimmy Chevanne	8f4b5b6398	maj readme zabbix-srv	2024-01-12 14:33:51 +01:00
Jimmy Chevanne	03b7706c23	maj readme zabbix-srv	2024-01-12 14:26:18 +01:00
root	008731f456	modif role fog & routeur	2024-01-12 14:07:00 +01:00
gsb	cbcefb5fbd	Actualiser roles/glpi/README.md	2024-01-12 10:56:00 +01:00
gsb	2b8745bedf	Actualiser roles/glpi/README.md	2024-01-12 10:54:28 +01:00
gsb	1613c632b4	Actualiser roles/glpi/README.md	2024-01-12 10:52:24 +01:00
Jimmy Chevanne	41aa9c626c	maj role zabbix srv : rendre idempottent le playbook	2024-01-12 10:23:24 +01:00
gsb	6816bca773	Actualiser roles/glpi/README.md	2024-01-12 10:19:19 +01:00
gsb	fe386b4f4c	Actualiser roles/glpi/README.md	2024-01-12 10:01:19 +01:00
gsb	008b6ce0bb	Actualiser roles/glpi/README.md	2024-01-12 09:52:11 +01:00
gsb	9447a6c726	Actualiser roles/glpi/README.md	2024-01-12 09:45:59 +01:00
gsb	c550ea90c2	Actualiser roles/glpi/README.md	2024-01-12 09:39:57 +01:00
gsb	dc010b3562	Actualiser roles/glpi/README.md	2024-01-12 09:28:04 +01:00
gsb	46cd74fed6	Actualiser roles/glpi/README.md	2024-01-12 09:27:42 +01:00
gsb	1f1ade55c7	Actualiser roles/glpi/README.md	2024-01-12 09:22:41 +01:00
gsb	e5ba286b4f	Actualiser roles/glpi/README.md	2024-01-12 09:21:06 +01:00
gsb	9faec4b433	Actualiser roles/glpi/README.md	2024-01-12 09:20:22 +01:00
gsb	29f0b8e269	Actualiser roles/glpi/README.md	2024-01-12 09:17:21 +01:00
gsb	4722affa2e	Actualiser roles/glpi/README.md	2024-01-12 09:16:56 +01:00
gsb	fb290afb6a	Actualiser roles/glpi/README.md	2024-01-12 09:15:33 +01:00
gsb	a0be338fd5	Actualiser roles/glpi/README.md	2024-01-12 09:13:33 +01:00
gsb	1e8e9e1281	Actualiser roles/glpi/README.md	2024-01-12 08:53:31 +01:00
gsb	713a9ecc28	Actualiser roles/glpi/README.md	2024-01-12 08:50:43 +01:00
gsb	6a023456fb	Actualiser roles/glpi/README.md	2024-01-12 08:49:59 +01:00
gsb	932728ae3a	Actualiser roles/glpi/README.md	2024-01-12 08:45:44 +01:00
gsb	b35f036ce2	Actualiser roles/glpi/README.md	2024-01-12 08:44:54 +01:00
gsb	fd25eba978	Actualiser roles/glpi/README.md	2024-01-12 08:20:45 +01:00
root	7b36d98298	mise a jour role glpi	2024-01-11 16:12:00 +01:00
gsb	663b8d349a	Actualiser roles/glpi/README.md	2024-01-11 15:36:13 +01:00
gsb	d5279901dc	Actualiser roles/glpi/README.md	2024-01-11 15:34:15 +01:00
Cerena Hostains	790cf9f0a6	modif fog	2024-01-11 15:26:32 +01:00
Cerena Hostains	b03fedcc45	modif role fog	2024-01-11 15:26:32 +01:00
Cerena Hostains	9deef13f8e	modif fog	2024-01-11 15:18:03 +01:00
root	6ebde054e0	update	2024-01-11 15:07:44 +01:00
root	57738871f0	update	2024-01-11 15:00:04 +01:00
Jimmy Chevanne	4f73bd7520	mise à jour 2eme du nom zabbix cli	2024-01-11 11:51:32 +01:00
root	efcbd3d0cf	modification roles glpi	2024-01-11 11:19:46 +01:00
root	ac1d2756bd	mise a jour role glpi	2024-01-11 11:19:46 +01:00
Jimmy Chevanne	1a9cfeb5d2	mise à jour zabbix-cli	2024-01-11 11:06:35 +01:00
Jimmy Chevanne	dea09f952d	amelioration role zabbix server	2024-01-11 09:49:23 +01:00
root	1a63a0d865	mise à jour roles GLPI 10.0.11 et maj role BASE	2024-01-09 12:37:47 +01:00
sio user	975cb35f00	chgt buster => bullseye, 2023=>2024	2024-01-09 11:42:14 +01:00
phil	ccb083ddcc	doc Windows - suite	2024-01-08 20:48:58 +01:00
phil	882a072fa9	doc Windows	2024-01-08 20:40:31 +01:00
root	01faab4a6e	modifications des playbooks journald snd et rcv	2023-12-25 14:57:04 +01:00
root	d9fb25425d	Ajout de default pour Zabbix-cli	2023-12-22 19:01:25 +01:00
root	fb900be1e4	Ajout role Zabbix-cli + ajout des agents dans les srv	2023-12-22 15:00:33 +01:00
root	92c6b3eb89	ajout du role zabbix-srv	2023-12-22 14:30:25 +01:00
root	bce5723e7b	mise à jour du playbook journald-rcv	2023-12-22 14:20:12 +01:00
root	a7315fa4c8	Ajout role journald-rcv	2023-12-22 11:01:03 +01:00
root	8cfbefc4dc	roles journald-snd	2023-12-22 09:43:24 +01:00
root	0697ad4eec	ajout du service ssh dans Goss	2023-12-22 09:04:11 +01:00
phil	ae54eb5cb8	README	2023-12-22 00:17:25 +01:00
phil	2fe557e70b	README	2023-12-22 00:08:40 +01:00
phil	877f0a054f	README	2023-12-22 00:01:51 +01:00
phil	74433d2655	typo	2023-12-21 23:41:56 +01:00
phil	51ac36f669	MAJ mkvm.ps1 pour 2024 et bookworm	2023-12-21 23:32:49 +01:00
phil	3f565e0dac	Reorganisation et toilettage...	2023-12-21 23:18:43 +01:00
Auguste Bedloe	71d35bb498	Reorg diverses	2023-12-21 22:37:22 +01:00
Auguste Bedloe	78da7eef67	inst-depl	2023-12-21 21:43:43 +01:00
Auguste Bedloe	ed512fc702	inst-depl	2023-12-21 20:49:29 +01:00
Auguste Bedloe	17266a2b57	inst-depl : maj versions ...	2023-12-21 19:26:20 +01:00
Auguste Bedloe	26ebf4899b	Maj doc pour 2024	2023-12-21 19:11:54 +01:00
Alhassane Kone	21d6a77ffa	commente syslog-cli pour r-*	2023-12-21 15:28:53 +01:00
sio user	23b480e9fd	comment syslog-cli	2023-12-21 15:14:59 +01:00
sio user	9f99511968	gsb-start...	2023-12-21 15:06:38 +01:00
sio user	cceccda12b	comment syslog-cli	2023-12-21 14:46:12 +01:00
sio user	36a6850a52	MAJ pour bookworm	2023-12-21 14:37:43 +01:00
sio user	d14bf44b2b	Modif Nom VM dans mkvm	2023-12-21 14:23:29 +01:00
sio user	a4fd46609d	scripts de debian11 vers niv. sup.	2023-12-19 14:01:12 +01:00
sio user	1b2c6a9220	README + mkmaster ...	2023-12-19 13:54:29 +01:00
phil	aca2dfa392	Modifs divers pour 2024 et bookworm	2023-12-18 23:44:35 +01:00
phil	62ef5fa4e9	Premier commit	2023-12-18 23:20:30 +01:00
				`@ -0,0 +1 @@`
				`Acquire::http::Proxy "http://192.168.99.99:8080";`