Maj README.md

README.md

@@ -1,6 +1,6 @@
 # gsb2024
 
-2024-01-17 18h04 ps
+2024-01-19 11h45 ps
 
 Environnement et playbooks **ansible** pour le projet **GSB 2024**
 
@@ -23,8 +23,8 @@ Prérequis :
   * **r-ext** : routage, NAT
   * **s-proxy** : proxy **squid**
   * **s-itil** : serveur GLPI
-  * **s-backup** : DNS esclave + sauvegarde s-win (SMB)
+  * **s-backup** : DNS esclave + sauvegarde s-win (SMB), Stork et Gotify
-  * **s-mon** : supervision avec **Nagios4**, notifications et syslog
+  * **s-mon** : supervision avec **Nagios4/Zabbix**, notifications et journald
   * **s-fog** : deploiement postes de travail avec **FOG**
   * **s-win** : Windows Server 2019, AD, DNS, DHCP, partage fichiers
   * **s-nxc** : NextCloud avec **docker** via proxy inverse **traefik** et certificat auto-signé

goss/s-itil.yaml

@@ -1,59 +1,87 @@
-#package:
-# systemd-journal-remote:
-#   installed: true
 file:
+    /etc/nginx/sites-enabled/default:
+        exists: false
+        contents: []
+    /etc/nginx/sites-enabled/glpi:
+        exists: true
+        mode: "0644"
+        owner: root
+        group: root
+        filetype: file
+        contents: []
     /var/www/html/glpi:
         exists: true
         mode: "0755"
         owner: www-data
         group: www-data
         filetype: directory
-
+        contents: []
     /var/www/html/glpicli:
         exists: true
         mode: "0775"
         owner: www-data
         group: www-data
         filetype: directory
-
+        contents: []
-  /var/www/html/glpi/plugins:
-    exists: true
-    mode: "0777"
-    filetype: directory
-
     /var/www/html/glpicli/GLPI-Agent-1.7-x64.msi:
         exists: true
-    #mode: "0777"
+        mode: "0644"
+        owner: root
+        group: root
         filetype: file
-
+        contents: []
-  /var/www/html/index.nginx-debian.html:
-    exists: true
-    mode: "0775"
-    owner: www-data
-    group: www-data
-    filetype: file
-service:
-  mariadb:
-    enabled: true
-    running: true
-
-  nginx:
-    enabled: true
-    running: true
-
-  zabbix-agent:
-    enable: true
-    running: true
-  
-  systemd-journal-upload.service:
-    enabled: true
-    running: true
 port:
+    tcp:22:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp:80:
+        listening: true
+        ip:
+            - 0.0.0.0
+    tcp:3306:
+        listening: true
+        ip:
+            - 127.0.0.1
+    tcp:9000:
+        listening: true
+        ip:
+            - 127.0.0.1
     tcp:10050:
         listening: true
         ip:
             - 0.0.0.0
-  tcp:10050:
+service:
-    listening: true
+    mariadb.service:
-    ip:
+        enabled: true
-    - '::'
+        running: true
+    nginx:
+        enabled: true
+        running: true
+    php8.2-fpm.service:
+        enabled: true
+        running: true
+    ssh:
+        enabled: true
+        running: true
+    systemd-journal-upload:
+        enabled: true
+        running: true
+    zabbix-agent:
+        enabled: true
+        running: true
+http:
+    http://s-itil.gsb.lan/:
+        status: 200
+        allow-insecure: false
+        no-follow-redirects: false
+        timeout: 5000
+        body: []
+        username: glpi
+        password: glpi
+    http://s-itil.gsb.lan/glpicli:
+        status: 200
+        allow-insecure: false
+        no-follow-redirects: false
+        timeout: 5000
+        body: []

goss/s-lb-bd.yaml

@@ -1,21 +1,38 @@
-package:
+addr:
-  mysql-server:
+    tcp://192.168.102.1:80:
-    installed: true
+        reachable: true
-    versions:
+        timeout: 500
-    - 5.5.54-0+deb8u1
+    tcp://192.168.102.2:80:
-command:
+        reachable: true
-  egrep "#bind-address" /etc/mysql/my.cnf:
+        timeout: 500
-    exit-status: 0
+service:
-    stdout:
+    mariadb:
-    - "#bind-address\t\t= 127.0.0.1"
+        enabled: true
-    stderr: []
+        running: true
-    timeout: 10000
+    mysql:
+        enabled: true
+        running: true
+user:
+    mysql:
+        exists: true
+        uid: 104
+        gid: 111
+        groups:
+            - mysql
+        home: /nonexistent
+        shell: /bin/false
+group:
+    mysql:
+        exists: true
+        gid: 111
 interface:
     enp0s3:
         exists: true
         addrs:
-    - 192.168.99.13/24
+            - 192.168.99.154/24
+        mtu: 1500
     enp0s8:
         exists: true
         addrs:
-    - 192.168.102.50/24
+            - 192.168.102.254/24
+        mtu: 1500

goss/s-lb-web1.yaml

@@ -2,20 +2,12 @@ package:
     apache2:
         installed: true
         versions:
-    - 2.4.10-10+deb8u7
+            - 2.4.57-2
-  php5:
+    nfs-common:
         installed: true
         versions:
-    - 5.6.29+dfsg-0+deb8u1
+            - 1:2.6.2-4
 port:
-  tcp:22:
-    listening: true
-    ip:
-    - 0.0.0.0
-  tcp6:22:
-    listening: true
-    ip:
-    - '::'
     tcp6:80:
         listening: true
         ip:
@@ -24,40 +16,47 @@ service:
     apache2:
         enabled: true
         running: true
-  sshd:
+    nfs-common:
-    enabled: true
+        enabled: false
-    running: true
+        running: false
-user:
-  sshd:
-    exists: true
-    uid: 105
-    gid: 65534
-    groups:
-    - nogroup
-    home: /var/run/sshd
-    shell: /usr/sbin/nologin
-command:
-  egrep 192.168.102.14:/export/www /etc/fstab:
-    exit-status: 0
-    stdout:
-    - 192.168.102.14:/export/www /var/www/html nfs _netdev rw 0 0
-    stderr: []
-    timeout: 10000
 process:
     apache2:
         running: true
-  sshd:
+mount:
-    running: true
+    /var/www/html:
+        exists: true
+        opts:
+            - rw
+            - relatime
+        vfs-opts:
+            - rw
+            - vers=4.2
+            - rsize=131072
+            - wsize=131072
+            - namlen=255
+            - hard
+            - proto=tcp
+            - timeo=600
+            - retrans=2
+            - sec=sys
+            - clientaddr=192.168.102.1
+            - local_lock=none
+            - addr=192.168.102.253
+        source: 192.168.102.253:/home/wordpress
+        filesystem: nfs4
 interface:
     enp0s3:
         exists: true
         addrs:
-    - 192.168.99.11/24
+            - 192.168.99.101/24
+        mtu: 1500
     enp0s8:
         exists: true
         addrs:
             - 192.168.101.1/24
+        mtu: 1500
     enp0s9:
         exists: true
         addrs:
             - 192.168.102.1/24
+        mtu: 1500

goss/s-lb-web2.yaml

@@ -2,20 +2,12 @@ package:
     apache2:
         installed: true
         versions:
-    - 2.4.10-10+deb8u7
+            - 2.4.57-2
-  php5:
+    nfs-common:
         installed: true
         versions:
-    - 5.6.29+dfsg-0+deb8u1
+            - 1:2.6.2-4
 port:
-  tcp:22:
-    listening: true
-    ip:
-    - 0.0.0.0
-  tcp6:22:
-    listening: true
-    ip:
-    - '::'
     tcp6:80:
         listening: true
         ip:
@@ -24,40 +16,47 @@ service:
     apache2:
         enabled: true
         running: true
-  sshd:
+    nfs-common:
-    enabled: true
+        enabled: false
-    running: true
+        running: false
-user:
-  sshd:
-    exists: true
-    uid: 105
-    gid: 65534
-    groups:
-    - nogroup
-    home: /var/run/sshd
-    shell: /usr/sbin/nologin
-command:
-  egrep 192.168.102.14:/export/www /etc/fstab:
-    exit-status: 0
-    stdout:
-    - 192.168.102.14:/export/www /var/www/html nfs _netdev rw 0 0
-    stderr: []
-    timeout: 10000
 process:
     apache2:
         running: true
-  sshd:
+mount:
-    running: true
+    /var/www/html:
+        exists: true
+        opts:
+            - rw
+            - relatime
+        vfs-opts:
+            - rw
+            - vers=4.2
+            - rsize=131072
+            - wsize=131072
+            - namlen=255
+            - hard
+            - proto=tcp
+            - timeo=600
+            - retrans=2
+            - sec=sys
+            - clientaddr=192.168.102.2
+            - local_lock=none
+            - addr=192.168.102.253
+        source: 192.168.102.253:/home/wordpress
+        filesystem: nfs4
 interface:
     enp0s3:
         exists: true
         addrs:
-    - 192.168.99.12/24
+            - 192.168.99.102/24
+        mtu: 1500
     enp0s8:
         exists: true
         addrs:
             - 192.168.101.2/24
+        mtu: 1500
     enp0s9:
         exists: true
         addrs:
             - 192.168.102.2/24
+        mtu: 1500

goss/s-lb.yaml

@@ -1,14 +1,39 @@
+package:
+    haproxy:
+        installed: true
+        versions:
+            - 2.6.12-1+deb12u1
+addr:
+    tcp://192.168.101.1:80:
+        reachable: true
+        timeout: 500
+    tcp://192.168.101.2:80:
+        reachable: true
+        timeout: 500
 port:
     tcp:80:
         listening: true
         ip:
-    - 192.168.100.11
+            - 192.168.100.10
 service:
     haproxy:
         enabled: true
         running: true
-  sshd:
+user:
-    enabled: true
+    haproxy:
+        exists: true
+        uid: 104
+        gid: 111
+        groups:
+            - haproxy
+        home: /var/lib/haproxy
+        shell: /usr/sbin/nologin
+group:
+    haproxy:
+        exists: true
+        gid: 111
+process:
+    haproxy:
         running: true
 interface:
     enp0s3:
@@ -19,10 +44,12 @@ interface:
     enp0s8:
         exists: true
         addrs:
-    - 192.168.100.11/24
+            - 192.168.100.10/24
-    mtu: 1500
-  enp0s9:
-    exists: true
-    addrs:
-    - 192.168.101.254/24
         mtu: 1500
+http:
+    http://192.168.100.10/:
+        status: 200
+        allow-insecure: false
+        no-follow-redirects: false
+        timeout: 5000
+        body: []

goss/s-nas.yaml

@@ -0,0 +1,55 @@
+file:
+    /home/wordpress:
+        exists: true
+        mode: "0755"
+        owner: www-data
+        group: www-data
+        filetype: directory
+        contents: []
+package:
+    file:
+        installed: true
+        versions:
+            - 1:5.44-3
+    nfs-common:
+        installed: true
+        versions:
+            - 1:2.6.2-4
+    nfs-kernel-server:
+        installed: true
+        versions:
+            - 1:2.6.2-4
+addr:
+    tcp://192.168.102.1:80:
+        reachable: true
+        timeout: 500
+    tcp://192.168.102.2:80:
+        reachable: true
+        timeout: 500
+service:
+    nfs-common:
+        enabled: false
+        running: false
+    nfs-kernel-server:
+        enabled: true
+        running: true
+    nfs-mountd:
+        enabled: true
+        running: true
+    nfs-server:
+        enabled: true
+        running: true
+    nfs-utils:
+        enabled: true
+        running: false
+interface:
+    enp0s3:
+        exists: true
+        addrs:
+            - 192.168.99.153/24
+        mtu: 1500
+    enp0s8:
+        exists: true
+        addrs:
+            - 192.168.102.253/24
+        mtu: 1500

roles/dns-master/files/db.gsb.lan

@@ -5,7 +5,7 @@
 ;
 $TTL    604800
 @       IN      SOA     s-infra.gsb.lan. root.s-infra.gsb.lan. (
-                        2024011800      ; Serial
+                        2024011900      ; Serial
                         7200	        ; Refresh
                         86400           ; Retry
                         8419200         ; Expire
@@ -16,9 +16,11 @@ $TTL    604800
 @      	        IN      A       127.0.0.1
 @       	IN      AAAA    ::1
 s-infra  	IN      A       172.16.0.1
-s-backup        IN      A	172.16.0.4
 s-proxy         IN      A       172.16.0.2
 s-appli    	IN      A       172.16.0.3
+s-backup        IN      A	172.16.0.4
+s-stork         IN      A	172.16.0.4
+s-gotify        IN      A	172.16.0.4
 s-win    	IN      A       172.16.0.6
 s-mess   	IN      A       172.16.0.7
 s-nxc		IN	A	172.16.0.7

roles/docker/tasks/main.yml

@@ -5,9 +5,12 @@
     dest: /usr/local/bin
 
 - name: on verifie si docker est installe
-  command: which docker
+  stat:
+    path: /usr/bin/docker
+# command: which docker
   register: docker_present
 
 - name: Execution du script getdocker si docker n'est pas deja installe
   shell: bash /usr/local/bin/getdocker.sh
-  when: docker_present.stdout.find('/usr/bin/docker') == -1
+  #when: docker_present.stdout.find('/usr/bin/docker') == -1
+  when: not docker_present.stat.exists

roles/nxc-traefik/tasks/main.yml

@@ -75,7 +75,8 @@
 
 - name: création du réseau proxy
   command: docker network create proxy
-  when: net_proxy.stdout.find('proxy') == -1
+#  when: net_proxy.stdout.find('proxy') == -1
+  when: "'proxy' not in net_proxy.stdout"
 
     #- name: Démarrage du docker-compose...
     #command: /bin/bash docker-compose up -d

s-lb-web1.yml

@@ -4,6 +4,7 @@
 
   roles:
     - base
+    - goss
     - post-lb
     - lb-web
       # - zabbix-cli

s-lb-web2.yml

@@ -4,6 +4,7 @@
 
   roles:
     - base
+    - goss
     - post-lb
     - lb-web
       # - zabbix-cli

s-nas.yml

@@ -9,6 +9,7 @@
     
   roles:
     - base
+    - goss
       #- zabbix-cli
     - lb-nfs-server
     - ssh-cli

scripts/r-vp1-post.sh

@@ -1,5 +1,32 @@
-#!/bin/bash
+!/bin/bash
+
+#Ancien scipt 2023
 #stoper le fw
-systemctl stop ferm
+#systemctl stop ferm
 #ouverture du service web pour copie distante
+#cd /root/confwg/ && python3 -m http.server 8000 &
+
+
+
+#Script 2024
+
+# Fonction pour arrêter le serveur web
+stop_server() {
+    echo "Arrêt du serveur et démarrage de ferm..."
+    pkill -f "python3 -m http.server"
+}
+
+# Stopper le ferm
+systemctl stop ferm
+
+# Ouverture du service web pour copie distante
 cd /root/confwg/ && python3 -m http.server 8000 &
+
+echo "Ouverture du serveur"
+
+# Timer pour récupéré le fichier avant de fermer le serveur python
+sleep 120
+
+#Appel de la fonction stop-serveur
+stop_server
+