Compare commits
No commits in common. "main" and "v0.0.4b-jp" have entirely different histories.
main
...
v0.0.4b-jp
5
Ansible/README.md
Normal file
5
Ansible/README.md
Normal file
@ -0,0 +1,5 @@
|
||||
## **Mode d'emplois** : Le playbook ci-dessous peut être déploiyer de la façon suivante :
|
||||
|
||||
````
|
||||
ansible-playbook -i hosts apbase.yml
|
||||
````
|
||||
@ -6,7 +6,6 @@
|
||||
timezone:
|
||||
name: Europe/Paris
|
||||
|
||||
|
||||
- name: configure le fichier apt.conf pour le proxy
|
||||
copy:
|
||||
content: |
|
||||
@ -25,4 +24,4 @@
|
||||
- name: installation de qemu-guest-agent
|
||||
apt:
|
||||
name: qemu-guest-agent
|
||||
state: present
|
||||
state: present
|
||||
2
Ansible/hosts
Normal file
2
Ansible/hosts
Normal file
@ -0,0 +1,2 @@
|
||||
[pt]
|
||||
ap33-pt
|
||||
26
README.md
26
README.md
@ -1,13 +1,6 @@
|
||||
# Projet SDIS29 - 2025 - Groupe 3
|
||||
**Lastest Update** Version v0.0.5c-rr : le 14/11/24 à 10h40 par Rotsy Rahaingo
|
||||
|
||||
**Oldest Update** Version v0.0.5b-rr : le 14/11/24 à 09h35 par Rotsy Rahaingo
|
||||
|
||||
**Oldest Update** Version v0.0.4c-jp : le 08/11/2024 à 11h10 par Jarod PAUCHET
|
||||
|
||||
**Oldest Update** Version v0.0.4a-rr : le 08/11/2024 à 10h30 par Rotsy Rahaingo
|
||||
|
||||
**Oldest Update** Version v0.0.3d-jp : le 08/11/2024 à 09h00 par Jarod PAUCHET
|
||||
**Lastest Update** Version v0.0.3d-jp : le 08/11/2024 à 09h00 par Jarod PAUCHET
|
||||
|
||||
**Oldest Update** Version v0.0.3c-jp : le 07/11/2024 à 18h00 par Rotsy Rahaingo
|
||||
|
||||
@ -21,6 +14,8 @@
|
||||
|
||||
**Oldest Update** Version v0.0.1a-jp : le 07/11/2024 à 10h45 par Jarod PAUCHET
|
||||
|
||||
Voici un plan d'installation du projet ap3 de 2025 :
|
||||
|
||||
## Etape 1 - Installation des machines virtuelles KVM :
|
||||
|
||||
### Paramètres communs
|
||||
@ -29,13 +24,13 @@
|
||||
|
||||
Clonage intégral de la machine **Debian-12.7-template**
|
||||
--> Nommage de trois machine,
|
||||
* **ap33-prod** (id = 2620), IP : 172.16.0.120/24 ; gateway : 172.16.0.254
|
||||
* **ap33-test** (id = 2621), IP : 172.16.0.121/24 ; gateway : 172.16.0.254
|
||||
* **ap33-mon** (id = 2622), IP : 172.16.0.122/24 ; gateway : 172.16.0.254
|
||||
* **ap33-prod** (id = 6120), IP : 172.16.0.120/24 ; gateway : 172.16.0.254
|
||||
* **ap33-test** (id = 6121), IP : 172.16.0.121/24 ; gateway : 172.16.0.254
|
||||
* **ap33-mon** (id = 6122), IP : 172.16.0.122/24 ; gateway : 172.16.0.254
|
||||
|
||||
Implémentation des clés SSH publique avec **cloud-int** :
|
||||
|
||||
Effectuer les commandes suivantes afin de copier votre clé :
|
||||
Effectuer les commandes suivantes afin de copier votre clé:
|
||||
* ssh-keygen
|
||||
* cat .ssh/id_rsa.pub
|
||||
|
||||
@ -195,10 +190,3 @@ sudo sed -i "$rpl" /etc/systemd/journal-upload.conf
|
||||
sudo systemctl enable --now systemd-journal-upload.service
|
||||
sudo systemctl restart systemd-journal-upload.service
|
||||
````
|
||||
|
||||
## **Etape 6: Automatisation avec ansible**
|
||||
Il est également possible d'installer les serveurs ap33-prod et ap33-test automatiquement grâce à ansible. Comme ces machines sont en production, il sera plus judicieux de le faire sur une machine test. Il faudra donc créer deux autres machines :
|
||||
* **ap33-ans** qui contiendra les différents playbooks
|
||||
* **ap33-pt** sera la machine cible et également la machine test
|
||||
|
||||
Pour avoir plus de détails sur chaque playbook, on peut voir dans le répertoire [ansible](https://gitea.lyc-lecastel.fr/uap33-2025-r/sdis29-3/src/branch/main/ansible).
|
||||
|
||||
@ -1,28 +0,0 @@
|
||||
## **Mode d'emplois** : Les playbooks ci-dessous peuvent être déployer de la façon suivante :
|
||||
|
||||
### Playbook : apbase.yml
|
||||
Ce playbook permet de faire la configuration de base :
|
||||
* changement de la timezone
|
||||
* recuperation du fichier apt.conf pour pouvoir acceder a internet
|
||||
* installation des paquets nécessaires pour la réalisation du projet (tomcat, ant, mariadb-server)
|
||||
* installation du paquet qemu-guest-agent
|
||||
|
||||
Pour l'exécuter : ````ansible-playbook -i hosts apbase.yml````
|
||||
|
||||
### Playbook : apdb.yml
|
||||
Ce playbook permet de :
|
||||
* installer python3 indispensable pour mysql
|
||||
* créer la base de données sdis29
|
||||
* créer un nouvel utilisateur qui aura tous les privilèges
|
||||
* copier le dump mysql sur la machine pt
|
||||
* importer le fichier sdis29.sql sur la base de données
|
||||
**NB**: Le module **login_unix_socket: /run/mysqld/mysqld.sock** est nécessaire à chaque fois qu'on fait appel à la base de données
|
||||
|
||||
Pour l'exécuter :````ansible-playbook - i hosts apdb.yml````
|
||||
|
||||
### Playbook : apdbdump.yml
|
||||
Ce playbook permet de faire une sauvegarde de la base de données :
|
||||
* export de la base de données
|
||||
* recupération du fichier dump
|
||||
|
||||
Pour l'exécuter : ````ansible-playbook -i hosts apdbdump.yml````
|
||||
@ -1,34 +0,0 @@
|
||||
---
|
||||
- hosts: all
|
||||
become: yes
|
||||
tasks:
|
||||
- name: installation de python3
|
||||
apt:
|
||||
name: python3-pymysql
|
||||
|
||||
- name: creation de la base de donnees "sdis29"
|
||||
community.mysql.mysql_db:
|
||||
name: sdis29
|
||||
state: present
|
||||
login_unix_socket: /run/mysqld/mysqld.sock
|
||||
|
||||
- name: Creation d'un utilisateur avec tous les privileges
|
||||
community.mysql.mysql_user:
|
||||
name: admin
|
||||
password: password123*
|
||||
priv: '*.*:ALL'
|
||||
state: present
|
||||
login_unix_socket: /run/mysqld/mysqld.sock
|
||||
|
||||
- name: copie du dump mysql sur la machine pt
|
||||
copy:
|
||||
src: sdis29.sql
|
||||
dest: /tmp
|
||||
|
||||
- name: Import du fichier sdis29.sql sur la base de données sdis29
|
||||
community.mysql.mysql_db:
|
||||
name: sdis29
|
||||
state: import
|
||||
target: /tmp/sdis29.sql
|
||||
force: true
|
||||
login_unix_socket: /run/mysqld/mysqld.sock
|
||||
@ -1,18 +0,0 @@
|
||||
---
|
||||
- hosts: all
|
||||
become: yes
|
||||
tasks:
|
||||
- name: export de la database sdis29
|
||||
community.mysql.mysql_db:
|
||||
state: dump
|
||||
name: sdis29
|
||||
target: /tmp/sdis29-dump.sql
|
||||
login_unix_socket: /run/mysqld/mysqld.sock
|
||||
|
||||
- name: recuperation du fichier de dump sur la machine locale
|
||||
fetch:
|
||||
src: /tmp/sdis29-dump.sql
|
||||
dest: sdis29-dump.sql
|
||||
flat: yes
|
||||
|
||||
|
||||
@ -1,65 +0,0 @@
|
||||
---
|
||||
- hosts: wg
|
||||
become: yes
|
||||
tasks:
|
||||
- name: arrete unattended-upgrades
|
||||
service:
|
||||
name: unattended-upgrades
|
||||
state: stopped
|
||||
|
||||
- name: installe Wireguard
|
||||
apt:
|
||||
name:
|
||||
- wireguard
|
||||
- wireguard-tools
|
||||
state: present
|
||||
|
||||
- hosts: wg_master
|
||||
tasks:
|
||||
- name: copie le fichier wg0-1.conf et wg0-2.conf vers les machines master et cli
|
||||
copy:
|
||||
src: mkwgconf.sh
|
||||
dest: mkwgconf.sh
|
||||
|
||||
- name: generations fichier configuration wireguard wg0-1.conf etc
|
||||
shell: bash mkwgconf.sh
|
||||
|
||||
- name: récupération du fichier wg0-1.conf vers ap33-ans
|
||||
fetch:
|
||||
src: wg0-1.conf
|
||||
dest: wg0-1.conf
|
||||
flat: yes
|
||||
|
||||
- name: récupération du fichier wg0-2.conf vers ap33-ans
|
||||
fetch:
|
||||
src: wg0-2.conf
|
||||
dest: wg0-2.conf
|
||||
flat: yes
|
||||
|
||||
- hosts: wg
|
||||
become: yes
|
||||
tasks:
|
||||
- name: copie fichier wg0-1 vers les clients
|
||||
copy:
|
||||
src: wg0-1.conf
|
||||
dest: /etc/wireguard/wg0.conf
|
||||
when: ansible_hostname == "ap33-mon"
|
||||
|
||||
- name: copie fichier wg0-2 vers les clients
|
||||
copy:
|
||||
src: wg0-2.conf
|
||||
dest: /etc/wireguard/wg0.conf
|
||||
when: ansible_hostname == "ap33-prod"
|
||||
|
||||
- hosts: wg
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Activation de wireguard
|
||||
service:
|
||||
name: wg-quick@wg0.service
|
||||
enabled: yes
|
||||
|
||||
- name: Redémarre le wireguard
|
||||
service:
|
||||
name: wg-quick@wg0.service
|
||||
state: restarted
|
||||
@ -1,11 +0,0 @@
|
||||
[wg]
|
||||
ap33-prod
|
||||
ap33-test
|
||||
ap33-mon
|
||||
|
||||
[wg_master]
|
||||
ap33-mon
|
||||
|
||||
[wg_cli]
|
||||
ap33-test
|
||||
ap33-prod
|
||||
@ -1,82 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -u
|
||||
set -e
|
||||
|
||||
AddressAwg=10.0.0.1/24 # Adresse VPN Wireguard extremite A
|
||||
EndpointA=172.16.0.122 # Adresse extremite A
|
||||
PortA=51820 # Port ecoute extremite A
|
||||
AddressBwg=10.0.0.2/24 # Adresse VPN Wireguard extremite B
|
||||
<<<<<<< HEAD:ansible/wireguard/mkwgconf.sh
|
||||
EndpointB=172.16.0.120 # Adresse extremite B
|
||||
=======
|
||||
EndpointB=172.16.0.121 # Adresse extremite B
|
||||
>>>>>>> d29ce732af0fce68c555df54563113473c3a0c5b:ansible/mkwgconf.sh
|
||||
PortB=51820 # Port ecoute extremite B
|
||||
AddressCwg=10.0.0.3/24 # Adresse VPN Wireguard extremite C
|
||||
EndpointC=172.16.0.121 # Adresse extremite C
|
||||
PortC=51820 # Port ecoute extremite C
|
||||
|
||||
umask 077 ;
|
||||
wg genkey > endpoint-a.key
|
||||
wg pubkey < endpoint-a.key > endpoint-a.pub
|
||||
|
||||
wg genkey > endpoint-b.key
|
||||
wg pubkey < endpoint-b.key > endpoint-b.pub
|
||||
|
||||
wg genkey > endpoint-c.key
|
||||
wg pubkey < endpoint-c.key > endpoint-c.pub
|
||||
|
||||
PKA=$(cat endpoint-a.key)
|
||||
pKA=$(cat endpoint-a.pub)
|
||||
PKB=$(cat endpoint-b.key)
|
||||
pKB=$(cat endpoint-b.pub)
|
||||
PKC=$(cat endpoint-c.key)
|
||||
pKC=$(cat endpoint-c.pub)
|
||||
|
||||
cat <<FINI > wg0-1.conf
|
||||
# local settings for Endpoint A
|
||||
[Interface]
|
||||
PrivateKey = $PKA
|
||||
Address = $AddressAwg
|
||||
ListenPort = $PortA
|
||||
|
||||
# remote settings for Endpoint B
|
||||
[Peer]
|
||||
PublicKey = $pKB
|
||||
Endpoint = ${EndpointB}:$PortB
|
||||
AllowedIPs = $AddressBwg
|
||||
|
||||
# remote settings for Endpoint C
|
||||
[Peer]
|
||||
PublicKey = $pKC
|
||||
Endpoint = ${EndpointC}:$PortC
|
||||
AllowedIPs = $AddressCwg
|
||||
FINI
|
||||
|
||||
cat <<FINI > wg0-2.conf
|
||||
# local settings for Endpoint B
|
||||
[Interface]
|
||||
PrivateKey = $PKB
|
||||
Address = $AddressBwg
|
||||
ListenPort = $PortB
|
||||
|
||||
# remote settings for Endpoint A
|
||||
[Peer]
|
||||
PublicKey = $pKA
|
||||
Endpoint = ${EndpointA}:$PortA
|
||||
AllowedIPs = $AddressAwg
|
||||
FINI
|
||||
|
||||
cat <<FINI > wg0-3.conf
|
||||
#local settings for Endpoint C
|
||||
[Interface]
|
||||
PrivateKey = $PKC
|
||||
Address = $AddressCwg
|
||||
ListenPort = $PortC
|
||||
|
||||
# remote settings for Endpoint A
|
||||
[Peer]
|
||||
PublicKey = $pKA
|
||||
Endpoint = ${EndpointA}:$PortA
|
||||
AllowedIPs = $AddressAwg
|
||||
FINI
|
||||
@ -1,77 +0,0 @@
|
||||
---
|
||||
- hosts: wg
|
||||
become: yes
|
||||
tasks:
|
||||
- name: arrete unattended-upgrades
|
||||
service:
|
||||
name: unattended-upgrades
|
||||
state: stopped
|
||||
|
||||
- name: installe Wireguard
|
||||
apt:
|
||||
name:
|
||||
- wireguard
|
||||
- wireguard-tools
|
||||
state: present
|
||||
|
||||
- hosts: wg_master
|
||||
tasks:
|
||||
- name: copie le fichier wg0-1.conf, wg0-2.conf et wg0-3.conf vers les machines master et cli
|
||||
copy:
|
||||
src: mkwgconf.sh
|
||||
dest: mkwgconf.sh
|
||||
|
||||
- name: generations fichier configuration wireguard wg0-1.conf etc
|
||||
shell: bash mkwgconf.sh
|
||||
|
||||
- name: récupération du fichier wg0-1.conf vers ap33-ans
|
||||
fetch:
|
||||
src: wg0-1.conf
|
||||
dest: wg0-1.conf
|
||||
flat: yes
|
||||
|
||||
- name: récupération du fichier wg0-2.conf vers ap33-ans
|
||||
fetch:
|
||||
src: wg0-2.conf
|
||||
dest: wg0-2.conf
|
||||
flat: yes
|
||||
|
||||
- name: récupération du fichier wg0-3.conf vers ap33-ans
|
||||
fetch:
|
||||
src: wg0-3.conf
|
||||
dest: wg0-3.conf
|
||||
flat: yes
|
||||
|
||||
- hosts: wg
|
||||
become: yes
|
||||
tasks:
|
||||
- name: copie fichier wg0-1 vers les clients
|
||||
copy:
|
||||
src: wg0-1.conf
|
||||
dest: /etc/wireguard/wg0.conf
|
||||
when: ansible_hostname == "ap33-mon"
|
||||
|
||||
- name: copie fichier wg0-2 vers les clients
|
||||
copy:
|
||||
src: wg0-2.conf
|
||||
dest: /etc/wireguard/wg0.conf
|
||||
when: ansible_hostname == "ap33-prod"
|
||||
|
||||
- name: copie fichier wg0-3.conf vers les clients
|
||||
copy:
|
||||
src: wg0-3.conf
|
||||
dest: /etc/wireguard/wg0.conf
|
||||
when: ansible_hostname == "ap33-test"
|
||||
|
||||
- hosts: wg
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Activation de wireguard
|
||||
service:
|
||||
name: wg-quick@wg0.service
|
||||
enabled: yes
|
||||
|
||||
- name: Redémarre le wireguard
|
||||
service:
|
||||
name: wg-quick@wg0.service
|
||||
state: restarted
|
||||
@ -1,17 +0,0 @@
|
||||
# local settings for Endpoint A
|
||||
[Interface]
|
||||
PrivateKey = CNafmAzvjGGAFA5RsDCHtypTh9RGnAxpkxZCt9cBkXo=
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
|
||||
# remote settings for Endpoint B
|
||||
[Peer]
|
||||
PublicKey = UMlB4+d/SYufqAGbuHDvGvkOhGKEihIgR+rhFzk3Aj0=
|
||||
Endpoint = 172.16.0.120:51820
|
||||
AllowedIPs = 10.0.0.2/24
|
||||
|
||||
# remote settings for Endpoint C
|
||||
[Peer]
|
||||
PublicKey = EWOjtZLwhNLDokDWJCONaBtqpGbr+x5tzNFeUI0hHEE=
|
||||
Endpoint = 172.16.0.121:51820
|
||||
AllowedIPs = 10.0.0.3/24
|
||||
@ -1,11 +0,0 @@
|
||||
# local settings for Endpoint B
|
||||
[Interface]
|
||||
PrivateKey = SLBteS7RJPIZ0TlZ5b9D6xtHF/5VzuQGmqnzW0Kkb0g=
|
||||
Address = 10.0.0.2/24
|
||||
ListenPort = 51820
|
||||
|
||||
# remote settings for Endpoint A
|
||||
[Peer]
|
||||
PublicKey = Fqd4WMaBpI7DAK6p2BaNhaE9VYzMRmfLxaO9uOmWTys=
|
||||
Endpoint = 172.16.0.122:51820
|
||||
AllowedIPs = 10.0.0.1/24
|
||||
@ -1,11 +0,0 @@
|
||||
#local settings for Endpoint C
|
||||
[Interface]
|
||||
PrivateKey = wBu8AaHa061bI+6Eb+FmghV3iGKdp0a2Kq6At8UNzHo=
|
||||
Address = 10.0.0.3/24
|
||||
ListenPort = 51820
|
||||
|
||||
# remote settings for Endpoint A
|
||||
[Peer]
|
||||
PublicKey = Fqd4WMaBpI7DAK6p2BaNhaE9VYzMRmfLxaO9uOmWTys=
|
||||
Endpoint = 172.16.0.122:51820
|
||||
AllowedIPs = 10.0.0.1/24
|
||||
Loading…
x
Reference in New Issue
Block a user