Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 9337ffacdd | |||
| d400423372 | |||
| 897358f759 | |||
| 7578459304 | |||
| 7aa06b59e3 | |||
| 0bd99b90b8 | |||
| 0f04d501a9 | |||
| 9e90b1b26f |
@@ -0,0 +1,191 @@
|
|||||||
|
# 📘 Automatisation & Déploiement — Serveurs ap31 (Prod / Test / Moniteur)
|
||||||
|
|
||||||
|
Ce projet regroupe plusieurs missions réalisées dans le cadre du BTS SIO SISR.
|
||||||
|
L’objectif général est **d’automatiser l’installation, la configuration et la supervision** des serveurs ap31 grâce à *Ansible*, *Docker*, *Payara*, *MariaDB*, *WireGuard*, *GLPI*, et *Caddy*.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# 📑 Sommaire
|
||||||
|
|
||||||
|
1. [Contexte du projet](#-contexte-du-projet)
|
||||||
|
2. [Environnement technique](#-environnement-technique)
|
||||||
|
3. [Mission I6 — Automatisation Ansible (Docker / Payara / MariaDB)](#-mission-i6--automatisation-ansible)
|
||||||
|
4. [Mission I7 — Mise en place d’un VPN WireGuard](#-mission-i7--mise-en-place-dun-vpn-wireguard)
|
||||||
|
5. [Mission I9 — Serveur GLPI + Proxy Inverse Caddy + HTTPS](#-mission-i9--serveur-glpi--proxy-inverse-caddy--https)
|
||||||
|
6. [Ports ouverts & Firewall](#-ports-ouverts--firewall)
|
||||||
|
7. [Définitions & technologies utilisées](#-définitions--technologies-utilisées)
|
||||||
|
8. [Liens vers les playbooks & fichiers](#-liens-vers-les-playbooks--fichiers)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# 📂 Contexte du projet
|
||||||
|
|
||||||
|
Les serveurs concernés :
|
||||||
|
|
||||||
|
| Serveur | Rôle |
|
||||||
|
|----------------|--------------------------------|
|
||||||
|
| **ap31-prod** | Serveur de production |
|
||||||
|
| **ap31-test** | Serveur de test |
|
||||||
|
| **ap31-mon** | Serveur de supervision / logs |
|
||||||
|
| **ap31-pt** | Serveur hébergeant GLPI + Caddy |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# 🛠️ Environnement technique
|
||||||
|
|
||||||
|
| Outil / Technologie | Usage |
|
||||||
|
|---------------------|--------|
|
||||||
|
| **Ansible** | Automatisation de l’installation et configuration |
|
||||||
|
| **Docker / Docker Compose** | Conteneurisation (Payara, GLPI, MariaDB) |
|
||||||
|
| **Payara Server** | Serveur d'applications Java (remplaçant moderne de Tomcat) |
|
||||||
|
| **MariaDB / MySQL** | Base de données pour Payara et GLPI |
|
||||||
|
| **WireGuard** | VPN entre les serveurs prod / test / mon |
|
||||||
|
| **Caddy** | Proxy inverse + HTTPS auto-signé |
|
||||||
|
| **GLPI 11** | Gestion du parc informatique |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# 🧩 Mission I6 — Automatisation Ansible
|
||||||
|
|
||||||
|
## 📌 Structure des playbooks
|
||||||
|
|
||||||
|
### **1. Installation Docker + Payara**
|
||||||
|
Playbook : `payara.yml`
|
||||||
|
➡️ installe Docker via `get-docker.sh`, configure Payara, lance les conteneurs.
|
||||||
|
|
||||||
|
### **2. VPN Wireguard**
|
||||||
|
Playbook : `wg.yml`
|
||||||
|
➡️ installe Wireguard et génère les configs via un script et distribue sur ap31-test et ap31-prod.
|
||||||
|
|
||||||
|
### **3. GLPI**
|
||||||
|
Playbook : `install-glpi.yml`
|
||||||
|
➡️ installe GLPI et la base de données prévue avec.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# 🔐 Mission I7 — Mise en place d’un VPN WireGuard
|
||||||
|
|
||||||
|
## 🎯 Objectifs
|
||||||
|
|
||||||
|
- Relier **ap31-prod**, **ap31-test**, **ap31-mon** via un VPN chiffré
|
||||||
|
|
||||||
|
|
||||||
|
## 📌 Playbook utilisé : `wg.yml`
|
||||||
|
|
||||||
|
Ce playbook :
|
||||||
|
|
||||||
|
- Installe WireGuard sur 2 machines
|
||||||
|
- Génère les fichiers de configuration (`wg0-*.conf`) sur ap31-mon
|
||||||
|
- Déploie la configuration adaptée sur chaque serveur
|
||||||
|
- Active le service WireGuard
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# 🖥️ Mission I9 — Déploiement GLPI + Proxy inverse Caddy
|
||||||
|
|
||||||
|
## 🎯 Objectifs
|
||||||
|
|
||||||
|
- Héberger **GLPI 11** via Docker (GLPI + MariaDB)
|
||||||
|
- Tester la remontée d’inventaire depuis **glpi-agent** sous Linux
|
||||||
|
- Écrire un playbook Ansible d’installation
|
||||||
|
- Mettre en place un **proxy inverse Caddy** avec **HTTPS interne**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📌 Fichiers docker compose
|
||||||
|
|
||||||
|
Disponible ici :
|
||||||
|
|
||||||
|
🔗 **docker-compose.yml (GLPI)**
|
||||||
|
https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/docker-compose.yml
|
||||||
|
|
||||||
|
🔗 **compose.yml (Payara)**
|
||||||
|
https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/compose.yml
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📌 Caddyfile (reverse proxy + HTTPS interne)
|
||||||
|
|
||||||
|
```conf
|
||||||
|
ap31-pt.sio.lan {
|
||||||
|
tls internal # certificat auto-signé par Caddy
|
||||||
|
reverse_proxy localhost:4000 # Proxy vers GLPI
|
||||||
|
}
|
||||||
|
|
||||||
|
ap31-pt {
|
||||||
|
tls internal
|
||||||
|
reverse_proxy localhost:4000
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📌 Test de remontée d’inventaire (glpi-agent)
|
||||||
|
|
||||||
|
```sh
|
||||||
|
vagrant@glpi-agent:~$ sudo glpi-agent --no-ssl-check --server https://ap31-pt.sio.lan
|
||||||
|
[info] target server0: server https://ap31-pt.sio.lan
|
||||||
|
[info] sending contact request to server0
|
||||||
|
[info] [http client] SSL Client info: Cert-Issuer: '/CN=Caddy Local Authority - ECC Intermediate'
|
||||||
|
[info] running task Inventory
|
||||||
|
[info] New inventory from glpi-agent-2025-12-05-09-30-21 for server0
|
||||||
|
[info] [http client] SSL Client warning: Peer certificate not verified
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔥 Ports ouverts & Firewall
|
||||||
|
|
||||||
|
```sh
|
||||||
|
debian@ap31-pt:~$ sudo ufw status verbose
|
||||||
|
Status: active
|
||||||
|
Logging: on (low)
|
||||||
|
Default: deny (incoming), allow (outgoing), deny (routed)
|
||||||
|
New profiles: skip
|
||||||
|
|
||||||
|
To Action From
|
||||||
|
-- ------ ----
|
||||||
|
80/tcp ALLOW IN Anywhere
|
||||||
|
443/tcp ALLOW IN Anywhere
|
||||||
|
8080/tcp ALLOW IN Anywhere
|
||||||
|
22/tcp ALLOW IN Anywhere
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📚 Définitions & technologies utilisées
|
||||||
|
Payara:
|
||||||
|
|
||||||
|
Serveur d’applications Java moderne, dérivé de GlassFish.
|
||||||
|
Permet d’héberger des applications web Java EE / Jakarta EE.
|
||||||
|
|
||||||
|
GLPI:
|
||||||
|
|
||||||
|
Outil de gestion de parc informatique :
|
||||||
|
|
||||||
|
- inventaire des machines
|
||||||
|
|
||||||
|
- gestion des tickets
|
||||||
|
|
||||||
|
- périphériques
|
||||||
|
|
||||||
|
- contrats, licences, garanties
|
||||||
|
|
||||||
|
WireGuard:
|
||||||
|
|
||||||
|
VPN moderne, très rapide, extrêmement simple à configurer.
|
||||||
|
|
||||||
|
Caddy
|
||||||
|
|
||||||
|
Serveur web + reverse proxy capable d’émettre automatiquement des certificats HTTPS.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
| Fichier |Lien |
|
||||||
|
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||||
|
| **payara.yml** | [https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/payara.yml](https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/payara.yml) |
|
||||||
|
| **install-glpi.yml** | [https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/install-glpi.yml](https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/install-glpi.yml) |
|
||||||
|
| **docker-compose.yml** | [https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/docker-compose.yml](https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/docker-compose.yml) |
|
||||||
|
| **compose.yml** | [https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/compose.yml](https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/compose.yml) |
|
||||||
|
| **wg.yml** | [https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/wg.yml](https://gitea.lyc-lecastel.fr/uap31-2026-r/SDIS29/src/branch/main/partie2/ansible/files/wg.yml) |
|
||||||
|
|
||||||
|
|||||||
91
partie2/ansible/mkwgconf-p2p.sh
Normal file
91
partie2/ansible/mkwgconf-p2p.sh
Normal file
@@ -0,0 +1,91 @@
|
|||||||
|
è-#!/bin/bash
|
||||||
|
set -u
|
||||||
|
set -e
|
||||||
|
|
||||||
|
AddressAwg=10.0.0.1/32 # Adresse VPN Wireguard extremite A
|
||||||
|
EndpointA=172.16.0.101 # Adresse extremite A
|
||||||
|
PortA=51820 # Port ecoute extremite A
|
||||||
|
AddressBwg=10.0.0.2/32 # Adresse VPN Wireguard extremite B
|
||||||
|
EndpointB=172.16.0.102 # Adresse extremite B
|
||||||
|
PortB=51820 # Port ecoute extremite B
|
||||||
|
AddressCwg=10.0.0.3/32 # Adresse VPN Wireguard extremite C
|
||||||
|
EndpointC=172.0.0.103 # Adresse extremite C
|
||||||
|
PortC=51820 # Port ecoute extremite C
|
||||||
|
|
||||||
|
umask 077 ;
|
||||||
|
wg genkey > endpoint-a.key
|
||||||
|
wg pubkey < endpoint-a.key > endpoint-a.pub
|
||||||
|
|
||||||
|
wg genkey > endpoint-b.key
|
||||||
|
wg pubkey < endpoint-b.key > endpoint-b.pub
|
||||||
|
|
||||||
|
wg genkey > endpoint-c.key
|
||||||
|
wg pubkey < endpoint-c.key > endpoint-c.pub
|
||||||
|
|
||||||
|
PKA=$(cat endpoint-a.key)
|
||||||
|
pKA=$(cat endpoint-a.pub)
|
||||||
|
PKB=$(cat endpoint-b.key)
|
||||||
|
pKB=$(cat endpoint-b.pub)
|
||||||
|
PKC=$(cat endpoint-c.key)
|
||||||
|
pKC=$(cat endpoint-c.pub)
|
||||||
|
|
||||||
|
cat <<FINI > wg0-a.conf
|
||||||
|
# local settings for Endpoint A
|
||||||
|
[Interface]
|
||||||
|
PrivateKey = $PKA
|
||||||
|
Address = $AddressAwg
|
||||||
|
ListenPort = $PortA
|
||||||
|
|
||||||
|
# remote settings for Endpoint B
|
||||||
|
[Peer]
|
||||||
|
PublicKey = $pKB
|
||||||
|
Endpoint = ${EndpointB}:$PortB
|
||||||
|
AllowedIPs = $AddressBwg
|
||||||
|
|
||||||
|
# remote settings for Endpoint C
|
||||||
|
[Peer]
|
||||||
|
PublicKey = $pKC
|
||||||
|
Endpoint = ${EndpointC}:$PortC
|
||||||
|
AllowedIPs = $AddressCwg
|
||||||
|
FINI
|
||||||
|
|
||||||
|
|
||||||
|
cat <<FINI > wg0-b.conf
|
||||||
|
# local settings for Endpoint B
|
||||||
|
[Interface]
|
||||||
|
PrivateKey = $PKB
|
||||||
|
Address = $AddressBwg
|
||||||
|
ListenPort = $PortB
|
||||||
|
|
||||||
|
# remote settings for Endpoint A
|
||||||
|
[Peer]
|
||||||
|
PublicKey = $pKA
|
||||||
|
Endpoint = ${EndpointA}:$PortA
|
||||||
|
AllowedIPs = $AddressAwg
|
||||||
|
|
||||||
|
# remote settings for Endpoint C
|
||||||
|
[Peer]
|
||||||
|
PublicKey = $pKC
|
||||||
|
Endpoint = ${EndpointC}:$PortC
|
||||||
|
AllowedIPs = $AddressCwg
|
||||||
|
FINI
|
||||||
|
|
||||||
|
cat <<FINI > wg0-c.conf
|
||||||
|
# local settings for Endpoint C
|
||||||
|
[Interface]
|
||||||
|
PrivateKey = $PKC
|
||||||
|
Address = $AddressBwg
|
||||||
|
ListenPort = $PortB
|
||||||
|
|
||||||
|
# remote settings for Endpoint A
|
||||||
|
[Peer]
|
||||||
|
PublicKey = $pKA
|
||||||
|
Endpoint = ${EndpointA}:$PortA
|
||||||
|
AllowedIPs = $AddressAwg
|
||||||
|
|
||||||
|
# remote settings for Endpoint B
|
||||||
|
[Peer]
|
||||||
|
PublicKey = $pKB
|
||||||
|
Endpoint = ${EndpointB}:$PortB
|
||||||
|
AllowedIPs = $AddressBwg
|
||||||
|
FINI
|
||||||
60
partie2/ansible/wg.yml
Normal file
60
partie2/ansible/wg.yml
Normal file
@@ -0,0 +1,60 @@
|
|||||||
|
---
|
||||||
|
- name: WireGuard pour apx31-prod et apx31-test
|
||||||
|
hosts:
|
||||||
|
- ap31-test
|
||||||
|
- ap31-prod
|
||||||
|
become: true
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: Installer WireGuard
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- wireguard
|
||||||
|
- wireguard-tools
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
|
||||||
|
- name: Copier le script mkwgconf-p2p.sh dans /tmp
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: mkwgconf-p2p.sh
|
||||||
|
dest: /tmp/mkwgconf-p2p.sh
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Executer le script mkwgconf
|
||||||
|
ansible.builtin.shell:
|
||||||
|
cmd: cd /tmp && /tmp/mkwgconf-p2p.sh
|
||||||
|
when: inventory_hostname == "ap31-test"
|
||||||
|
|
||||||
|
- name: Recupere wg0-a.conf
|
||||||
|
ansible.builtin.fetch:
|
||||||
|
src: /tmp/wg0-a.conf
|
||||||
|
dest: /tmp/
|
||||||
|
# mode: '0600'
|
||||||
|
flat: yes
|
||||||
|
when: inventory_hostname == "ap31-test"
|
||||||
|
|
||||||
|
- name: Recupere wg0-b.conf
|
||||||
|
ansible.builtin.fetch:
|
||||||
|
src: /tmp/wg0-b.conf
|
||||||
|
dest: /tmp/
|
||||||
|
# mode: '0600'
|
||||||
|
flat: yes
|
||||||
|
when: inventory_hostname == "ap31-test"
|
||||||
|
|
||||||
|
- name: Renvoi wg0-a.conf
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: /tmp/wg0-a.conf
|
||||||
|
dest: /etc/wireguard/wg0.conf
|
||||||
|
# mode: '0600'
|
||||||
|
when: inventory_hostname == "ap31-test"
|
||||||
|
|
||||||
|
- name: Renvoi wg0-b.conf
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: /tmp/wg0-b.conf
|
||||||
|
dest: /etc/wireguard/wg0.conf
|
||||||
|
#mode: '0600'
|
||||||
|
when: inventory_hostname == "ap31-prod"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Reference in New Issue
Block a user