Compare commits
2 Commits
v0.0.5o-jc
...
v0.0.5d-lg
| Author | SHA1 | Date | |
|---|---|---|---|
| 4144927187 | |||
| b5bf346eb4 |
@ -1,90 +0,0 @@
|
||||
file:
|
||||
/etc/kea/kea-ctrl-agent.conf:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
size: 2470
|
||||
owner: _kea
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/etc/kea/kea-dhcp4.conf:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
size: 11346
|
||||
owner: _kea
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/tmp/kea4-ctrl-socket:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
size: 0
|
||||
owner: _kea
|
||||
group: _kea
|
||||
filetype: socket
|
||||
contains: []
|
||||
/usr/local/lib/kea:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
size: 4096
|
||||
owner: root
|
||||
group: root
|
||||
filetype: directory
|
||||
contains: []
|
||||
package:
|
||||
isc-kea-common:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
isc-kea-ctrl-agent:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
isc-kea-dhcp4:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
isc-kea-hooks:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
libmariadb3:
|
||||
installed: true
|
||||
versions:
|
||||
- 1:10.11.4-1~deb12u1
|
||||
mariadb-common:
|
||||
installed: true
|
||||
versions:
|
||||
- 1:10.11.4-1~deb12u1
|
||||
mysql-common:
|
||||
installed: true
|
||||
versions:
|
||||
- 5.8+1.1.0
|
||||
port:
|
||||
tcp:8000:
|
||||
listening: true
|
||||
ip:
|
||||
- 172.16.64.20
|
||||
service:
|
||||
isc-kea-ctrl-agent.service:
|
||||
enabled: true
|
||||
running: true
|
||||
isc-kea-dhcp4-server.service:
|
||||
enabled: true
|
||||
running: true
|
||||
interface:
|
||||
enp0s3:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.99.20/24
|
||||
mtu: 1500
|
||||
enp0s8:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.0.20/24
|
||||
mtu: 1500
|
||||
enp0s9:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.64.20/24
|
||||
mtu: 1500
|
||||
@ -1,90 +0,0 @@
|
||||
file:
|
||||
/etc/kea/kea-ctrl-agent.conf:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
size: 2470
|
||||
owner: _kea
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/etc/kea/kea-dhcp4.conf:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
size: 11346
|
||||
owner: _kea
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/tmp/kea4-ctrl-socket:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
size: 0
|
||||
owner: _kea
|
||||
group: _kea
|
||||
filetype: socket
|
||||
contains: []
|
||||
/usr/local/lib/kea:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
size: 4096
|
||||
owner: root
|
||||
group: root
|
||||
filetype: directory
|
||||
contains: []
|
||||
package:
|
||||
isc-kea-common:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
isc-kea-ctrl-agent:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
isc-kea-dhcp4:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
isc-kea-hooks:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.1-isc20231123184533
|
||||
libmariadb3:
|
||||
installed: true
|
||||
versions:
|
||||
- 1:10.11.4-1~deb12u1
|
||||
mariadb-common:
|
||||
installed: true
|
||||
versions:
|
||||
- 1:10.11.4-1~deb12u1
|
||||
mysql-common:
|
||||
installed: true
|
||||
versions:
|
||||
- 5.8+1.1.0
|
||||
port:
|
||||
tcp:8000:
|
||||
listening: true
|
||||
ip:
|
||||
- 172.16.64.21
|
||||
service:
|
||||
isc-kea-ctrl-agent.service:
|
||||
enabled: true
|
||||
running: true
|
||||
isc-kea-dhcp4-server.service:
|
||||
enabled: true
|
||||
running: true
|
||||
interface:
|
||||
enp0s3:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.99.21/24
|
||||
mtu: 1500
|
||||
enp0s8:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.0.21/24
|
||||
mtu: 1500
|
||||
enp0s9:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.64.21/24
|
||||
mtu: 1500
|
||||
146
goss/s-mon.yaml
146
goss/s-mon.yaml
@ -1,62 +1,92 @@
|
||||
file:
|
||||
/etc/systemd/system/systemd-journal-remote.service:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contents: []
|
||||
/var/log/journal/remote:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
owner: systemd-journal-remote
|
||||
group: systemd-journal-remote
|
||||
filetype: directory
|
||||
contents: []
|
||||
package:
|
||||
apache2:
|
||||
installed: true
|
||||
versions:
|
||||
- 2.4.57-2
|
||||
mariadb-server:
|
||||
installed: true
|
||||
versions:
|
||||
- 1:10.11.4-1~deb12u1
|
||||
systemd-journal-remote:
|
||||
installed: true
|
||||
versions:
|
||||
- 252.19-1~deb12u1
|
||||
apache2:
|
||||
installed: true
|
||||
zabbix-server-mysql:
|
||||
installed: true
|
||||
zabbix-frontend-php:
|
||||
installed: true
|
||||
zabbix-apache-conf:
|
||||
installed: true
|
||||
zabbix-sql-scripts:
|
||||
installed: true
|
||||
zabbix-agent:
|
||||
installed: true
|
||||
mariadb-server:
|
||||
installed: true
|
||||
python3-pymysql:
|
||||
installed: true
|
||||
systemd-journal-remote:
|
||||
installed: true
|
||||
file:
|
||||
/etc/systemd/system/systemd-journal-remote.service:
|
||||
exist: true
|
||||
mode: "0777"
|
||||
filetype: directory
|
||||
/var/log/journal/remote:
|
||||
exist: true
|
||||
mode: "0777"
|
||||
filetype: directory
|
||||
port:
|
||||
tcp:80:
|
||||
listening: true
|
||||
ip:
|
||||
- 0.0.0.0
|
||||
tcp:3306:
|
||||
listening: true
|
||||
ip:
|
||||
- 127.0.0.1
|
||||
tcp:10050:
|
||||
listening: true
|
||||
ip:
|
||||
- 0.0.0.0
|
||||
tcp:10051:
|
||||
listening: true
|
||||
ip:
|
||||
- 0.0.0.0
|
||||
tcp:19532:
|
||||
listening: true
|
||||
ip:
|
||||
- '*'
|
||||
service:
|
||||
apache2:
|
||||
enabled: true
|
||||
running: true
|
||||
mariadb.service:
|
||||
enabled: true
|
||||
running: true
|
||||
systemd-journal-remote.socket:
|
||||
enabled: true
|
||||
running: true
|
||||
zabbix-agent:
|
||||
enabled: true
|
||||
running: true
|
||||
zabbix-server:
|
||||
enabled: true
|
||||
running: true
|
||||
apache2:
|
||||
enabled: true
|
||||
running: true
|
||||
zabbix-server:
|
||||
enabled: true
|
||||
running: true
|
||||
zabbix-agent:
|
||||
enabled: true
|
||||
running: true
|
||||
systemd-journal-remote.socket:
|
||||
enabled: true
|
||||
running: true
|
||||
command:
|
||||
sysctl net.ipv4.ip_forward:
|
||||
exit-status: 0
|
||||
stdout:
|
||||
- net.ipv4.ip_forward = 0
|
||||
stderr: []
|
||||
timeout: 10000
|
||||
process:
|
||||
apache2:
|
||||
running: true
|
||||
zabbix_server:
|
||||
running: true
|
||||
mariadb:
|
||||
running: true
|
||||
interface:
|
||||
enp0s3:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.99.8/24
|
||||
mtu: 1500
|
||||
enp0s8:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.0.8/24
|
||||
mtu: 1500
|
||||
enp0s3:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.99.8/24
|
||||
enp0s8:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.0.8/24
|
||||
http:
|
||||
http://s-mon.gsb.lan/zabbix:
|
||||
status: 200
|
||||
allow-insecure: false
|
||||
no-follow-redirects: false
|
||||
timeout: 5000
|
||||
body: []
|
||||
http://localhost/zabbix:
|
||||
status: 401
|
||||
allow-insecure: false
|
||||
no-follow-redirects: false
|
||||
timeout: 5000
|
||||
body: []
|
||||
|
||||
102
goss/s-nxc.yaml
102
goss/s-nxc.yaml
@ -2,144 +2,118 @@ file:
|
||||
/root/nxc:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 4096
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 4096
|
||||
owner: root
|
||||
group: root
|
||||
filetype: directory
|
||||
contains: []
|
||||
|
||||
/root/nxc/certs:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 4096
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 4096
|
||||
owner: root
|
||||
group: root
|
||||
filetype: directory
|
||||
contains: []
|
||||
|
||||
/root/nxc/config:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 4096
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 4096
|
||||
owner: root
|
||||
group: root
|
||||
filetype: directory
|
||||
contains: []
|
||||
|
||||
/root/nxc/config/dynamic.yml:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
#size: 415
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 415
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/root/nxc/config/static.yml:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
#size: 452
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 452
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/root/nxc/docker-compose.yml:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
#size: 2135
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 2135
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/root/nxc/nxc-debug.sh:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 64
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 64
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/root/nxc/nxc-prune.sh:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 110
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 110
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/root/nxc/nxc-start.sh:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 34
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 34
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/root/nxc/nxc-stop.sh:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 32
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 32
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
/usr/local/bin/mkcert:
|
||||
exists: true
|
||||
mode: "0755"
|
||||
#size: 4788866
|
||||
#owner: root
|
||||
#group: root
|
||||
size: 4788866
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
|
||||
addr:
|
||||
tcp://s-nxc.gsb.lan:443:
|
||||
tcp://s-nxc.gsb.lan:8081:
|
||||
reachable: true
|
||||
timeout: 500
|
||||
|
||||
port:
|
||||
tcp:22:
|
||||
listening: true
|
||||
ip:
|
||||
- 0.0.0.0
|
||||
|
||||
tcp:80:
|
||||
listening: true
|
||||
ip: []
|
||||
|
||||
tcp:443:
|
||||
listening: true
|
||||
ip: []
|
||||
|
||||
#tcp:8081:
|
||||
#listening: true
|
||||
#ip:
|
||||
#- 0.0.0.0
|
||||
|
||||
tcp:8081:
|
||||
listening: true
|
||||
ip:
|
||||
- 0.0.0.0
|
||||
interface:
|
||||
enp0s3:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.99.7/24
|
||||
mtu: 1500
|
||||
|
||||
enp0s8:
|
||||
exists: true
|
||||
addrs:
|
||||
- 172.16.0.7/24
|
||||
mtu: 1500
|
||||
|
||||
http:
|
||||
https://s-nxc.gsb.lan:
|
||||
status: 200
|
||||
allow-insecure: true
|
||||
no-follow-redirects: false
|
||||
timeout: 5000
|
||||
body:
|
||||
- Nextcloud
|
||||
|
||||
Binary file not shown.
@ -7,7 +7,7 @@
|
||||
- name: on verifie si docker est installe
|
||||
stat:
|
||||
path: /usr/bin/docker
|
||||
#command: which docker
|
||||
# command: which docker
|
||||
register: docker_present
|
||||
|
||||
- name: Execution du script getdocker si docker n'est pas deja installe
|
||||
|
||||
@ -1,76 +1,6 @@
|
||||
Configuration de ferm
|
||||
|
||||
# [Ferm](http://ferm.foo-projects.org/)
|
||||
|
||||
Modifier l'execution d'iptables [plus d'info ici#!/bin/bash
|
||||
set -u
|
||||
set -e
|
||||
# Version Site to Site
|
||||
|
||||
AddressAwg=10.0.0.1/32 # Adresse VPN Wireguard cote A
|
||||
EndpointA=192.168.0.51 # Adresse extremite A
|
||||
PortA=51820 # Port ecoute extremite A
|
||||
NetworkA=192.168.1.0/24 # reseau cote A
|
||||
NetworkC=192.168.200.0/24 #reseau cote A
|
||||
NetworkD=172.16.0.0/24 #reseau cote A
|
||||
|
||||
AddressBwg=10.0.0.2/32 # Adresse VPN Wireguard cote B
|
||||
EndpointB=192.168.0.52 # Adresse extremite B
|
||||
PortB=51820 # Port ecoute extremite B
|
||||
NetworkB=172.16.128.0/24 # reseau cote B
|
||||
|
||||
umask 077
|
||||
wg genkey > endpoint-a.key
|
||||
wg pubkey < endpoint-a.key > endpoint-a.pub
|
||||
|
||||
wg genkey > endpoint-b.key
|
||||
wg pubkey < endpoint-b.key > endpoint-b.pub
|
||||
|
||||
|
||||
PKA=$(cat endpoint-a.key)
|
||||
pKA=$(cat endpoint-a.pub)
|
||||
PKB=$(cat endpoint-b.key)
|
||||
pKB=$(cat endpoint-b.pub)
|
||||
|
||||
cat <<FINI > wg0-a.conf
|
||||
# local settings for Endpoint A
|
||||
[Interface]
|
||||
PrivateKey = $PKA
|
||||
Address = $AddressAwg
|
||||
ListenPort = $PortA
|
||||
|
||||
# IP forwarding
|
||||
PreUp = sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
# remote settings for Endpoint B
|
||||
[Peer]
|
||||
PublicKey = $pKB
|
||||
Endpoint = ${EndpointB}:$PortB
|
||||
AllowedIPs = $AddressBwg, $NetworkB
|
||||
|
||||
FINI
|
||||
|
||||
|
||||
cat <<FINI > wg0-b.conf
|
||||
# local settings for Endpoint B
|
||||
[Interface]
|
||||
PrivateKey = $PKB
|
||||
Address = $AddressBwg
|
||||
ListenPort = $PortB
|
||||
|
||||
# IP forwarding
|
||||
PreUp = sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
# remote settings for Endpoint A
|
||||
[Peer]
|
||||
PublicKey = $pKA
|
||||
Endpoint = ${EndpointA}:$PortA
|
||||
AllowedIPs = $AddressAwg, $NetworkA, $NetworkC, $NetworkD
|
||||
|
||||
FINI
|
||||
|
||||
echo "wg0-a.conf et wg0-b.conf sont generes ..."
|
||||
echo "copier wg0-b.conf sur la machine b et renommer les fichiers de configuration ..."](https://wiki.debian.org/iptables)
|
||||
Modifier l'execution d'iptables [plus d'info ici](https://wiki.debian.org/iptables)
|
||||
```shell
|
||||
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
||||
```
|
||||
|
||||
@ -1,50 +0,0 @@
|
||||
---
|
||||
- name: Mise a jour apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Creation /etc/gotify
|
||||
ansible.builtin.file:
|
||||
path: /etc/gotify
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Creation /opt/gotify
|
||||
ansible.builtin.file:
|
||||
path: /opt/gotify
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: installation de gotify
|
||||
get_url:
|
||||
url: "https://github.com/gotify/server/releases/latest/download/gotify-linux-amd64.zip"
|
||||
dest: "/tmp/gotify.zip"
|
||||
|
||||
- name: Extraction de Gotify
|
||||
ansible.builtin.unarchive:
|
||||
src: "/tmp/gotify.zip"
|
||||
dest: "/opt/gotify"
|
||||
become: yes
|
||||
|
||||
- name: Creation du fichier systemd
|
||||
template:
|
||||
src: "gotify.service.j2"
|
||||
dest: "/etc/systemd/system/gotify.service"
|
||||
become: yes
|
||||
|
||||
- name: Reload systemd
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Creation du fichier conf gotify
|
||||
template:
|
||||
src: "config.yml.j2"
|
||||
dest: "/etc/gotify/config.yml"
|
||||
become: yes
|
||||
|
||||
- name: Demarage du gotify
|
||||
systemd:
|
||||
name: gotify
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
@ -1,4 +0,0 @@
|
||||
server:
|
||||
keepaliveperiodseconds: 0
|
||||
listenaddr: "" # the address to bind on, leave empty to bind on all addresses
|
||||
port: 8008
|
||||
@ -1,13 +0,0 @@
|
||||
[Unit]
|
||||
Description=Gotify Server
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
ExecStart=/opt/gotify/gotify-linux-amd64
|
||||
Restart=on-failure
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
BIN
roles/kea-master/templates/.kea-dhcp4-j1.conf.swp
Normal file
BIN
roles/kea-master/templates/.kea-dhcp4-j1.conf.swp
Normal file
Binary file not shown.
@ -6,7 +6,7 @@
|
||||
{
|
||||
// We need to specify where the agent should listen to incoming HTTP
|
||||
// queries.
|
||||
"http-host": "172.16.0.20",
|
||||
"http-host": "172.16.64.1",
|
||||
|
||||
// This specifies the port CA will listen on.
|
||||
"http-port": 8000,
|
||||
@ -18,7 +18,7 @@
|
||||
{
|
||||
"comment": "socket to DHCPv4 server",
|
||||
"socket-type": "unix",
|
||||
"socket-name": "/tmp/kea4-ctrl-socket"
|
||||
"socket-name": "/tm/kea4-ctrl-socket"
|
||||
},
|
||||
|
||||
// Location of the DHCPv6 command channel socket.
|
||||
@ -22,7 +22,7 @@
|
||||
// The DHCPv4 server listens on this interface. When changing this to
|
||||
// the actual name of your interface, make sure to also update the
|
||||
// interface parameter in the subnet definition below.
|
||||
"interfaces": [ "enp0s9" ]
|
||||
"interfaces": [ "enp0s8" ]
|
||||
},
|
||||
|
||||
// Control socket is required for communication between the Control
|
||||
@ -88,7 +88,7 @@
|
||||
"high-availability": [ {
|
||||
// This parameter points to this server instance. The respective
|
||||
// HA peers must have this parameter set to their own names.
|
||||
"this-server-name": "s-kea1.gsb.lan",
|
||||
"this-server-name": "kea1",
|
||||
// The HA mode is set to hot-standby. In this mode, the active server handles
|
||||
// all the traffic. The standby takes over if the primary becomes unavailable.
|
||||
"mode": "hot-standby",
|
||||
@ -116,24 +116,24 @@
|
||||
"peers": [
|
||||
// This is the configuration of this server instance.
|
||||
{
|
||||
"name": "s-kea1.gsb.lan",
|
||||
"name": "kea1",
|
||||
// This specifies the URL of this server instance. The
|
||||
// Control Agent must run along with this DHCPv4 server
|
||||
// instance and the "http-host" and "http-port" must be
|
||||
// set to the corresponding values.
|
||||
"url": "http://172.16.64.20:8000/",
|
||||
"url": "http://172.16.64.1:8000/",
|
||||
// This server is primary. The other one must be
|
||||
// secondary.
|
||||
"role": "primary"
|
||||
},
|
||||
// This is the configuration of the secondary server.
|
||||
{
|
||||
"name": "s-kea2.gsb.lan",
|
||||
"name": "kea2",
|
||||
// Specifies the URL on which the partner's control
|
||||
// channel can be reached. The Control Agent is required
|
||||
// to run on the partner's machine with "http-host" and
|
||||
// "http-port" values set to the corresponding values.
|
||||
"url": "http://172.16.64.21:8000/",
|
||||
"url": "http://172.16.64.2:8000/",
|
||||
// The other server is secondary. This one must be
|
||||
// primary.
|
||||
"role": "standby"
|
||||
@ -152,7 +152,7 @@
|
||||
|
||||
// There are no relays in this network, so we need to tell Kea that this subnet
|
||||
// is reachable directly via the specified interface.
|
||||
"interface": "enp0s9",
|
||||
"interface": "enp0s8",
|
||||
|
||||
// Specify a dynamic address pool.
|
||||
"pools": [
|
||||
@ -171,7 +171,7 @@
|
||||
{
|
||||
// For each IPv4 subnet you typically need to specify at least one router.
|
||||
"name": "routers",
|
||||
"data": "172.16.64.254"
|
||||
"data": "172.16.64.1"
|
||||
},
|
||||
{
|
||||
// Using cloudflare or Quad9 is a reasonable option. Change this
|
||||
@ -179,7 +179,7 @@
|
||||
// choice is 8.8.8.8, owned by Google. Using third party DNS
|
||||
// service raises some privacy concerns.
|
||||
"name": "domain-name-servers",
|
||||
"data": "172.16.0.1"
|
||||
"data": "172.16.64.1"
|
||||
}
|
||||
],
|
||||
|
||||
BIN
roles/kea-slave/templates/.kea-dhcp4-j1.conf.swp
Normal file
BIN
roles/kea-slave/templates/.kea-dhcp4-j1.conf.swp
Normal file
Binary file not shown.
66
roles/kea-slave/templates/kea-ctrl-agent-j1.conf
Normal file
66
roles/kea-slave/templates/kea-ctrl-agent-j1.conf
Normal file
@ -0,0 +1,66 @@
|
||||
// This is an example of a configuration for Control-Agent (CA) listening
|
||||
// for incoming HTTP traffic. This is necessary for handling API commands,
|
||||
// in particular lease update commands needed for HA setup.
|
||||
{
|
||||
"Control-agent":
|
||||
{
|
||||
// We need to specify where the agent should listen to incoming HTTP
|
||||
// queries.
|
||||
"http-host": "172.16.64.1",
|
||||
|
||||
// This specifies the port CA will listen on.
|
||||
"http-port": 8000,
|
||||
|
||||
"control-sockets":
|
||||
{
|
||||
// This is how the Agent can communicate with the DHCPv4 server.
|
||||
"dhcp4":
|
||||
{
|
||||
"comment": "socket to DHCPv4 server",
|
||||
"socket-type": "unix",
|
||||
"socket-name": "/tm/kea4-ctrl-socket"
|
||||
},
|
||||
|
||||
// Location of the DHCPv6 command channel socket.
|
||||
# "dhcp6":
|
||||
# {
|
||||
# "socket-type": "unix",
|
||||
# "socket-name": "/tmp/kea6-ctrl-socket"
|
||||
# },
|
||||
|
||||
// Location of the D2 command channel socket.
|
||||
# "d2":
|
||||
# {
|
||||
# "socket-type": "unix",
|
||||
# "socket-name": "/tmp/kea-ddns-ctrl-socket",
|
||||
# "user-context": { "in-use": false }
|
||||
# }
|
||||
},
|
||||
|
||||
// Similar to other Kea components, CA also uses logging.
|
||||
"loggers": [
|
||||
{
|
||||
"name": "kea-ctrl-agent",
|
||||
"output_options": [
|
||||
{
|
||||
"output": "stdout",
|
||||
|
||||
// Several additional parameters are possible in addition
|
||||
// to the typical output. Flush determines whether logger
|
||||
// flushes output to a file. Maxsize determines maximum
|
||||
// filesize before the file is rotated. maxver
|
||||
// specifies the maximum number of rotated files being
|
||||
// kept.
|
||||
"flush": true,
|
||||
"maxsize": 204800,
|
||||
"maxver": 4,
|
||||
// We use pattern to specify custom log message layout
|
||||
"pattern": "%d{%y.%m.%d %H:%M:%S.%q} %-5p [%c/%i] %m\n"
|
||||
}
|
||||
],
|
||||
"severity": "INFO",
|
||||
"debuglevel": 0 // debug level only applies when severity is set to DEBUG.
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -22,7 +22,7 @@
|
||||
// The DHCPv4 server listens on this interface. When changing this to
|
||||
// the actual name of your interface, make sure to also update the
|
||||
// interface parameter in the subnet definition below.
|
||||
"interfaces": "{{ kea_dhcp_int }}"
|
||||
"interfaces": [ "enp0s8" ]
|
||||
},
|
||||
|
||||
// Control socket is required for communication between the Control
|
||||
@ -76,19 +76,19 @@
|
||||
// deliver lease updates to the server as well as synchronize the
|
||||
// lease database after failure.
|
||||
{
|
||||
"library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_lease_cmds.so"
|
||||
"library": "/usr/local/lib/kea/hooks/libdhcp_lease_cmds.so"
|
||||
},
|
||||
|
||||
{
|
||||
// The HA hook library should be loaded.
|
||||
"library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_ha.so",
|
||||
"library": "/usr/local/lib/kea/hooks/libdhcp_ha.so",
|
||||
"parameters": {
|
||||
// Each server should have the same HA configuration, except for the
|
||||
// "this-server-name" parameter.
|
||||
"high-availability": [ {
|
||||
// This parameter points to this server instance. The respective
|
||||
// HA peers must have this parameter set to their own names.
|
||||
"this-server-name": "{{ kea_this_server }}",
|
||||
"this-server-name": "kea1",
|
||||
// The HA mode is set to hot-standby. In this mode, the active server handles
|
||||
// all the traffic. The standby takes over if the primary becomes unavailable.
|
||||
"mode": "hot-standby",
|
||||
@ -116,24 +116,24 @@
|
||||
"peers": [
|
||||
// This is the configuration of this server instance.
|
||||
{
|
||||
"name": "{{ kea_srv1 }}",
|
||||
"name": "kea1",
|
||||
// This specifies the URL of this server instance. The
|
||||
// Control Agent must run along with this DHCPv4 server
|
||||
// instance and the "http-host" and "http-port" must be
|
||||
// set to the corresponding values.
|
||||
"url": "http://{{ kea_ctrl_address1 }}:8000/",
|
||||
"url": "http://172.16.64.1:8000/",
|
||||
// This server is primary. The other one must be
|
||||
// secondary.
|
||||
"role": "primary"
|
||||
},
|
||||
// This is the configuration of the secondary server.
|
||||
{
|
||||
"name": "{{ kea_srv2 }}",
|
||||
"name": "kea2",
|
||||
// Specifies the URL on which the partner's control
|
||||
// channel can be reached. The Control Agent is required
|
||||
// to run on the partner's machine with "http-host" and
|
||||
// "http-port" values set to the corresponding values.
|
||||
"url": "http://{{ kea_ctrl_address2 }}:8000/",
|
||||
"url": "http://172.16.64.2:8000/",
|
||||
// The other server is secondary. This one must be
|
||||
// primary.
|
||||
"role": "standby"
|
||||
@ -152,7 +152,7 @@
|
||||
|
||||
// There are no relays in this network, so we need to tell Kea that this subnet
|
||||
// is reachable directly via the specified interface.
|
||||
"interface": "enp0s9",
|
||||
"interface": "enp0s8",
|
||||
|
||||
// Specify a dynamic address pool.
|
||||
"pools": [
|
||||
@ -171,7 +171,7 @@
|
||||
{
|
||||
// For each IPv4 subnet you typically need to specify at least one router.
|
||||
"name": "routers",
|
||||
"data": "172.16.64.254"
|
||||
"data": "172.16.64.1"
|
||||
},
|
||||
{
|
||||
// Using cloudflare or Quad9 is a reasonable option. Change this
|
||||
@ -179,7 +179,7 @@
|
||||
// choice is 8.8.8.8, owned by Google. Using third party DNS
|
||||
// service raises some privacy concerns.
|
||||
"name": "domain-name-servers",
|
||||
"data": "172.16.0.1"
|
||||
"data": "172.16.64.1"
|
||||
}
|
||||
],
|
||||
|
||||
@ -1,14 +0,0 @@
|
||||
# Rôle Kea
|
||||
***
|
||||
Rôle du Kea pour la haute disponibilité dhcp
|
||||
|
||||
## Tables des matières
|
||||
1. [Que fait le rôle Kea ?]
|
||||
|
||||
|
||||
## Que fait le rôle Kea ?
|
||||
Il permet de configurer les serveur kea en mode haute disponibilité.
|
||||
|
||||
### Installation et configuration de kea
|
||||
|
||||
Le rôle kea va installer les packets kea dhcp4, hook, admin une fois les packets installer. Nous allons configurer les 2 serveurs kea pour qu'il distribut les ip de n-user et soit en haute disponibilité.
|
||||
@ -1,8 +0,0 @@
|
||||
#variable kea
|
||||
kea_ver: "2.4.1"
|
||||
kea_dbname: ""
|
||||
kaa_dbuser: ""
|
||||
kea_dbpasswd: ""
|
||||
kea_dhcp4_dir: "/etc/kea/kea-dhcp4.conf"
|
||||
kea_ctrl_dir: "/etc/kea/kea-ctrl-agent.conf"
|
||||
|
||||
@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Restart isc-kea-dhcp4-server
|
||||
ansible.builtin.service:
|
||||
name: isc-kea-dhcp4-server.service
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Restart isc-kea-ctrl-agent
|
||||
ansible.builtin.service:
|
||||
name: isc-kea-ctrl-agent.service
|
||||
state: restarted
|
||||
enabled: yes
|
||||
@ -1,43 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Preparation
|
||||
ansible.builtin.shell: curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-2-4/setup.deb.sh' | sudo -E bash
|
||||
|
||||
- name: Update apt
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
|
||||
#- name: Installation paquet isc-kea-common
|
||||
# ansible.builtin.apt:
|
||||
# deb: isc-kea-common
|
||||
# state: present
|
||||
|
||||
- name: Installation isc-kea-dhcp4
|
||||
ansible.builtin.apt:
|
||||
name: isc-kea-dhcp4-server
|
||||
state: present
|
||||
|
||||
- name: Installation isc-kea-ctrl-agent
|
||||
ansible.builtin.apt:
|
||||
name: isc-kea-ctrl-agent
|
||||
state: present
|
||||
|
||||
- name: Installation isc-kea-hooks
|
||||
ansible.builtin.apt:
|
||||
name: isc-kea-hooks
|
||||
state: present
|
||||
|
||||
- name: Generation ---- du fichier de configuration kea-ctrl-agent
|
||||
ansible.builtin.template:
|
||||
src: kea-ctrl-agent.conf.j2
|
||||
dest: /etc/kea/kea-ctrl-agent.conf
|
||||
notify:
|
||||
- Restart isc-kea-ctrl-agent
|
||||
|
||||
- name: Generation du fichier de configuration kea-dhcp4.conf
|
||||
ansible.builtin.template:
|
||||
src: kea-dhcp4.conf.j2
|
||||
dest: /etc/kea/kea-dhcp4.conf
|
||||
notify:
|
||||
- Restart isc-kea-dhcp4-server
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
{
|
||||
"Control-agent":
|
||||
{
|
||||
"http-host": "{{ kea_ctrl_address_this }}",
|
||||
"http-port": 8000,
|
||||
"control-sockets":
|
||||
{
|
||||
"dhcp4":
|
||||
{
|
||||
"socket-type": "unix",
|
||||
"socket-name": "/tmp/kea4-ctrl-socket"
|
||||
},
|
||||
},
|
||||
|
||||
"loggers": [
|
||||
{
|
||||
"name": "kea-ctrl-agent",
|
||||
"output_options": [
|
||||
{
|
||||
"output": "stdout",
|
||||
"flush": true,
|
||||
"maxsize": 204800,
|
||||
"maxver": 4,
|
||||
{% raw %} "pattern": "%d{%y.%m.%d %H:%M:%S.%q} %-5p [%c/%i] %m\n", {% endraw %}
|
||||
}
|
||||
],
|
||||
"severity": "INFO",
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
23
roles/lb-front/files/goss.yaml
Normal file
23
roles/lb-front/files/goss.yaml
Normal file
@ -0,0 +1,23 @@
|
||||
port:
|
||||
tcp:80:
|
||||
listening: true
|
||||
ip:
|
||||
- 192.168.100.11
|
||||
service:
|
||||
haproxy:
|
||||
enabled: true
|
||||
running: true
|
||||
sshd:
|
||||
enabled: true
|
||||
running: true
|
||||
interface:
|
||||
enp0s8:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.100.11/24
|
||||
mtu: 1500
|
||||
enp0s9:
|
||||
exists: true
|
||||
addrs:
|
||||
- 192.168.101.254/24
|
||||
mtu: 1500
|
||||
@ -41,7 +41,7 @@ frontend proxypublic
|
||||
backend fermeweb
|
||||
balance roundrobin
|
||||
option httpclose
|
||||
option httpchk HEAD / HTTP/1.0
|
||||
#option httpchk HEAD / HTTP/1.0
|
||||
server s-lb-web1 192.168.101.1:80 check
|
||||
server s-lb-web2 192.168.101.2:80 check
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@
|
||||
backend fermeweb
|
||||
balance roundrobin
|
||||
option httpclose
|
||||
option httpchk HEAD / HTTP/1.0
|
||||
#option httpchk HEAD / HTTP/1.0
|
||||
server s-lb-web1 192.168.101.1:80 check
|
||||
server s-lb-web2 192.168.101.2:80 check
|
||||
|
||||
|
||||
@ -53,8 +53,8 @@ services:
|
||||
image: nextcloud
|
||||
container_name: app
|
||||
restart: always
|
||||
#ports:
|
||||
#- 8081:80
|
||||
ports:
|
||||
- 8081:80
|
||||
#links:
|
||||
depends_on:
|
||||
- db
|
||||
|
||||
@ -24,10 +24,7 @@ bash r-vp1-post.sh
|
||||
```
|
||||
## Sur **r-vp2**:
|
||||
|
||||
Lancer le playbook : *ansible-playbook -i localhost, -c local* r-vp2.yml sur **r-vp2**
|
||||
|
||||
Puis lancer le script r-vp2-post.sh pour récuperer le fichier de configuration et activer l'interface wg0.
|
||||
|
||||
Lancer le script r-vp2-post.sh pour récuperer le fichier de configuration et activer l'interface wg0.
|
||||
### 🛠️ Lancer le script
|
||||
```bash
|
||||
cd /tools/ansible/gsb2023/Scripts
|
||||
@ -37,11 +34,7 @@ bash r-vp2-post.sh
|
||||
```
|
||||
## Fin
|
||||
|
||||
Pour finir redemarer les machines.
|
||||
redemarer les machines
|
||||
```bash
|
||||
reboot
|
||||
```
|
||||
Veuillez maintenant vous rendre dans le dossier du role ferm :
|
||||
*gsb2024/roles/fw-ferm*
|
||||
|
||||
*Modification : jm*
|
||||
@ -1,3 +1,2 @@
|
||||
SERVER: "127.0.0.1"
|
||||
SERVERACTIVE: "192.168.99.8"
|
||||
TOKENAPI: "f72473b7e5402a5247773e456f3709dcdd5e41792360108fc3451bbfeed8eafe"
|
||||
SERVERACTIVE: "172.16.0.8"
|
||||
|
||||
@ -28,11 +28,3 @@
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: mise ne place script hostcreate
|
||||
template:
|
||||
src: hostcreate.sh.j2
|
||||
dest: /tmp/hostcreate.sh
|
||||
|
||||
- name: lancement script hostcreate
|
||||
command: bash /tmp/hostcreate.sh
|
||||
|
||||
|
||||
@ -1 +0,0 @@
|
||||
curl -X POST -H "Content-Type: application/json" -d '{ "jsonrpc":"2.0","method":"host.create","params": {"host": "{{ ansible_hostname }}","groups": [{"groupid": "6"}],"templates": [{"templateid": "10343"}],"inventory_mode": 0,"inventory": {"type": 0}},"auth": "{{ TOKENAPI }}","id": 1}' http://{{ SERVERACTIVE }}/zabbix/api_jsonrpc.php
|
||||
@ -7,7 +7,6 @@
|
||||
- goss
|
||||
# - proxy3
|
||||
- zabbix-cli
|
||||
- gotify
|
||||
# - ssh-cli
|
||||
# - syslog-cli
|
||||
- smb-backup
|
||||
|
||||
@ -1,21 +0,0 @@
|
||||
---
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
vars:
|
||||
kea_this_server: "s-kea1"
|
||||
kea_srv1: "s-kea1"
|
||||
kea_srv2: "s-kea2"
|
||||
kea_ctrl_address_this: "172.16.0.20"
|
||||
kea_ctrl_address1: "172.16.0.20"
|
||||
kea_ctrl_address2: "172.16.0.21"
|
||||
kea_dhcp_int: ["enp0s9"]
|
||||
|
||||
roles:
|
||||
- base
|
||||
- goss
|
||||
# - ssh-cli
|
||||
- kea
|
||||
# - zabbix-cli
|
||||
# - journald-snd
|
||||
# - snmp-agent
|
||||
- post
|
||||
@ -1,18 +0,0 @@
|
||||
# **Explication :**
|
||||
|
||||
Le dossier Wireguard comprend tous les tests de ping à effectuer une fois l'installation complète complète de wireguard.
|
||||
|
||||
Les dossiers présent dans ce dossier contiennent les routes qui doivent être présent sur nos différentes machines. Vous pouvez comparer les interface avec un "ip a" en cas de disfonctionnement.
|
||||
|
||||
# **Etapes pour lancer les tests:**
|
||||
|
||||
Pour tester le bon fonctionnement du VPN et faire la phase de test, rendez vous sur la machine ou vous voulez faire les tests de ping (nous allons prendre ping-sinfra.sh comme exemple)
|
||||
|
||||
* Mettez vous dans le dossier tools/ansible/gsb2024/wireguard
|
||||
|
||||
* Lancer le script de s-infra : bash ping-sinfra.sh
|
||||
|
||||
Une fois lancer une série de ping vont se lancer automatiquement, si tout est bon le scipt devrait arrivé à sa fin.
|
||||
Si toutefois un ping ne passe pas, le scipt vaa bloquer sur le ping qui est en cours d'éxécution !
|
||||
|
||||
*Modification : jm*
|
||||
Reference in New Issue
Block a user