Compare commits
No commits in common. "main" and "v0.0.4c-jp" have entirely different histories.
main
...
v0.0.4c-jp
5
Ansible/README.md
Normal file
5
Ansible/README.md
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
## **Mode d'emplois** : Le playbook ci-dessous peut être déploiyer de la façon suivante :
|
||||||
|
|
||||||
|
````
|
||||||
|
ansible-playbook -i hosts apbase.yml
|
||||||
|
````
|
||||||
@ -6,7 +6,6 @@
|
|||||||
timezone:
|
timezone:
|
||||||
name: Europe/Paris
|
name: Europe/Paris
|
||||||
|
|
||||||
|
|
||||||
- name: configure le fichier apt.conf pour le proxy
|
- name: configure le fichier apt.conf pour le proxy
|
||||||
copy:
|
copy:
|
||||||
content: |
|
content: |
|
||||||
2
Ansible/hosts
Normal file
2
Ansible/hosts
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
[pt]
|
||||||
|
ap33-pt
|
||||||
12
README.md
12
README.md
@ -1,9 +1,6 @@
|
|||||||
# Projet SDIS29 - 2025 - Groupe 3
|
# Projet SDIS29 - 2025 - Groupe 3
|
||||||
**Lastest Update** Version v0.0.5c-rr : le 14/11/24 à 10h40 par Rotsy Rahaingo
|
|
||||||
|
|
||||||
**Oldest Update** Version v0.0.5b-rr : le 14/11/24 à 09h35 par Rotsy Rahaingo
|
**Lastest Update** Version v0.0.4c-jp : le 08/11/2024 à 11h10 par Jarod PAUCHET
|
||||||
|
|
||||||
**Oldest Update** Version v0.0.4c-jp : le 08/11/2024 à 11h10 par Jarod PAUCHET
|
|
||||||
|
|
||||||
**Oldest Update** Version v0.0.4a-rr : le 08/11/2024 à 10h30 par Rotsy Rahaingo
|
**Oldest Update** Version v0.0.4a-rr : le 08/11/2024 à 10h30 par Rotsy Rahaingo
|
||||||
|
|
||||||
@ -195,10 +192,3 @@ sudo sed -i "$rpl" /etc/systemd/journal-upload.conf
|
|||||||
sudo systemctl enable --now systemd-journal-upload.service
|
sudo systemctl enable --now systemd-journal-upload.service
|
||||||
sudo systemctl restart systemd-journal-upload.service
|
sudo systemctl restart systemd-journal-upload.service
|
||||||
````
|
````
|
||||||
|
|
||||||
## **Etape 6: Automatisation avec ansible**
|
|
||||||
Il est également possible d'installer les serveurs ap33-prod et ap33-test automatiquement grâce à ansible. Comme ces machines sont en production, il sera plus judicieux de le faire sur une machine test. Il faudra donc créer deux autres machines :
|
|
||||||
* **ap33-ans** qui contiendra les différents playbooks
|
|
||||||
* **ap33-pt** sera la machine cible et également la machine test
|
|
||||||
|
|
||||||
Pour avoir plus de détails sur chaque playbook, on peut voir dans le répertoire [ansible](https://gitea.lyc-lecastel.fr/uap33-2025-r/sdis29-3/src/branch/main/ansible).
|
|
||||||
|
|||||||
@ -1,28 +0,0 @@
|
|||||||
## **Mode d'emplois** : Les playbooks ci-dessous peuvent être déployer de la façon suivante :
|
|
||||||
|
|
||||||
### Playbook : apbase.yml
|
|
||||||
Ce playbook permet de faire la configuration de base :
|
|
||||||
* changement de la timezone
|
|
||||||
* recuperation du fichier apt.conf pour pouvoir acceder a internet
|
|
||||||
* installation des paquets nécessaires pour la réalisation du projet (tomcat, ant, mariadb-server)
|
|
||||||
* installation du paquet qemu-guest-agent
|
|
||||||
|
|
||||||
Pour l'exécuter : ````ansible-playbook -i hosts apbase.yml````
|
|
||||||
|
|
||||||
### Playbook : apdb.yml
|
|
||||||
Ce playbook permet de :
|
|
||||||
* installer python3 indispensable pour mysql
|
|
||||||
* créer la base de données sdis29
|
|
||||||
* créer un nouvel utilisateur qui aura tous les privilèges
|
|
||||||
* copier le dump mysql sur la machine pt
|
|
||||||
* importer le fichier sdis29.sql sur la base de données
|
|
||||||
**NB**: Le module **login_unix_socket: /run/mysqld/mysqld.sock** est nécessaire à chaque fois qu'on fait appel à la base de données
|
|
||||||
|
|
||||||
Pour l'exécuter :````ansible-playbook - i hosts apdb.yml````
|
|
||||||
|
|
||||||
### Playbook : apdbdump.yml
|
|
||||||
Ce playbook permet de faire une sauvegarde de la base de données :
|
|
||||||
* export de la base de données
|
|
||||||
* recupération du fichier dump
|
|
||||||
|
|
||||||
Pour l'exécuter : ````ansible-playbook -i hosts apdbdump.yml````
|
|
||||||
@ -1,34 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: all
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: installation de python3
|
|
||||||
apt:
|
|
||||||
name: python3-pymysql
|
|
||||||
|
|
||||||
- name: creation de la base de donnees "sdis29"
|
|
||||||
community.mysql.mysql_db:
|
|
||||||
name: sdis29
|
|
||||||
state: present
|
|
||||||
login_unix_socket: /run/mysqld/mysqld.sock
|
|
||||||
|
|
||||||
- name: Creation d'un utilisateur avec tous les privileges
|
|
||||||
community.mysql.mysql_user:
|
|
||||||
name: admin
|
|
||||||
password: password123*
|
|
||||||
priv: '*.*:ALL'
|
|
||||||
state: present
|
|
||||||
login_unix_socket: /run/mysqld/mysqld.sock
|
|
||||||
|
|
||||||
- name: copie du dump mysql sur la machine pt
|
|
||||||
copy:
|
|
||||||
src: sdis29.sql
|
|
||||||
dest: /tmp
|
|
||||||
|
|
||||||
- name: Import du fichier sdis29.sql sur la base de données sdis29
|
|
||||||
community.mysql.mysql_db:
|
|
||||||
name: sdis29
|
|
||||||
state: import
|
|
||||||
target: /tmp/sdis29.sql
|
|
||||||
force: true
|
|
||||||
login_unix_socket: /run/mysqld/mysqld.sock
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: all
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: export de la database sdis29
|
|
||||||
community.mysql.mysql_db:
|
|
||||||
state: dump
|
|
||||||
name: sdis29
|
|
||||||
target: /tmp/sdis29-dump.sql
|
|
||||||
login_unix_socket: /run/mysqld/mysqld.sock
|
|
||||||
|
|
||||||
- name: recuperation du fichier de dump sur la machine locale
|
|
||||||
fetch:
|
|
||||||
src: /tmp/sdis29-dump.sql
|
|
||||||
dest: sdis29-dump.sql
|
|
||||||
flat: yes
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,65 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: wg
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: arrete unattended-upgrades
|
|
||||||
service:
|
|
||||||
name: unattended-upgrades
|
|
||||||
state: stopped
|
|
||||||
|
|
||||||
- name: installe Wireguard
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- wireguard
|
|
||||||
- wireguard-tools
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- hosts: wg_master
|
|
||||||
tasks:
|
|
||||||
- name: copie le fichier wg0-1.conf et wg0-2.conf vers les machines master et cli
|
|
||||||
copy:
|
|
||||||
src: mkwgconf.sh
|
|
||||||
dest: mkwgconf.sh
|
|
||||||
|
|
||||||
- name: generations fichier configuration wireguard wg0-1.conf etc
|
|
||||||
shell: bash mkwgconf.sh
|
|
||||||
|
|
||||||
- name: récupération du fichier wg0-1.conf vers ap33-ans
|
|
||||||
fetch:
|
|
||||||
src: wg0-1.conf
|
|
||||||
dest: wg0-1.conf
|
|
||||||
flat: yes
|
|
||||||
|
|
||||||
- name: récupération du fichier wg0-2.conf vers ap33-ans
|
|
||||||
fetch:
|
|
||||||
src: wg0-2.conf
|
|
||||||
dest: wg0-2.conf
|
|
||||||
flat: yes
|
|
||||||
|
|
||||||
- hosts: wg
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: copie fichier wg0-1 vers les clients
|
|
||||||
copy:
|
|
||||||
src: wg0-1.conf
|
|
||||||
dest: /etc/wireguard/wg0.conf
|
|
||||||
when: ansible_hostname == "ap33-mon"
|
|
||||||
|
|
||||||
- name: copie fichier wg0-2 vers les clients
|
|
||||||
copy:
|
|
||||||
src: wg0-2.conf
|
|
||||||
dest: /etc/wireguard/wg0.conf
|
|
||||||
when: ansible_hostname == "ap33-prod"
|
|
||||||
|
|
||||||
- hosts: wg
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: Activation de wireguard
|
|
||||||
service:
|
|
||||||
name: wg-quick@wg0.service
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
- name: Redémarre le wireguard
|
|
||||||
service:
|
|
||||||
name: wg-quick@wg0.service
|
|
||||||
state: restarted
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
[wg]
|
|
||||||
ap33-prod
|
|
||||||
ap33-test
|
|
||||||
ap33-mon
|
|
||||||
|
|
||||||
[wg_master]
|
|
||||||
ap33-mon
|
|
||||||
|
|
||||||
[wg_cli]
|
|
||||||
ap33-test
|
|
||||||
ap33-prod
|
|
||||||
@ -1,82 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
set -u
|
|
||||||
set -e
|
|
||||||
|
|
||||||
AddressAwg=10.0.0.1/24 # Adresse VPN Wireguard extremite A
|
|
||||||
EndpointA=172.16.0.122 # Adresse extremite A
|
|
||||||
PortA=51820 # Port ecoute extremite A
|
|
||||||
AddressBwg=10.0.0.2/24 # Adresse VPN Wireguard extremite B
|
|
||||||
<<<<<<< HEAD:ansible/wireguard/mkwgconf.sh
|
|
||||||
EndpointB=172.16.0.120 # Adresse extremite B
|
|
||||||
=======
|
|
||||||
EndpointB=172.16.0.121 # Adresse extremite B
|
|
||||||
>>>>>>> d29ce732af0fce68c555df54563113473c3a0c5b:ansible/mkwgconf.sh
|
|
||||||
PortB=51820 # Port ecoute extremite B
|
|
||||||
AddressCwg=10.0.0.3/24 # Adresse VPN Wireguard extremite C
|
|
||||||
EndpointC=172.16.0.121 # Adresse extremite C
|
|
||||||
PortC=51820 # Port ecoute extremite C
|
|
||||||
|
|
||||||
umask 077 ;
|
|
||||||
wg genkey > endpoint-a.key
|
|
||||||
wg pubkey < endpoint-a.key > endpoint-a.pub
|
|
||||||
|
|
||||||
wg genkey > endpoint-b.key
|
|
||||||
wg pubkey < endpoint-b.key > endpoint-b.pub
|
|
||||||
|
|
||||||
wg genkey > endpoint-c.key
|
|
||||||
wg pubkey < endpoint-c.key > endpoint-c.pub
|
|
||||||
|
|
||||||
PKA=$(cat endpoint-a.key)
|
|
||||||
pKA=$(cat endpoint-a.pub)
|
|
||||||
PKB=$(cat endpoint-b.key)
|
|
||||||
pKB=$(cat endpoint-b.pub)
|
|
||||||
PKC=$(cat endpoint-c.key)
|
|
||||||
pKC=$(cat endpoint-c.pub)
|
|
||||||
|
|
||||||
cat <<FINI > wg0-1.conf
|
|
||||||
# local settings for Endpoint A
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = $PKA
|
|
||||||
Address = $AddressAwg
|
|
||||||
ListenPort = $PortA
|
|
||||||
|
|
||||||
# remote settings for Endpoint B
|
|
||||||
[Peer]
|
|
||||||
PublicKey = $pKB
|
|
||||||
Endpoint = ${EndpointB}:$PortB
|
|
||||||
AllowedIPs = $AddressBwg
|
|
||||||
|
|
||||||
# remote settings for Endpoint C
|
|
||||||
[Peer]
|
|
||||||
PublicKey = $pKC
|
|
||||||
Endpoint = ${EndpointC}:$PortC
|
|
||||||
AllowedIPs = $AddressCwg
|
|
||||||
FINI
|
|
||||||
|
|
||||||
cat <<FINI > wg0-2.conf
|
|
||||||
# local settings for Endpoint B
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = $PKB
|
|
||||||
Address = $AddressBwg
|
|
||||||
ListenPort = $PortB
|
|
||||||
|
|
||||||
# remote settings for Endpoint A
|
|
||||||
[Peer]
|
|
||||||
PublicKey = $pKA
|
|
||||||
Endpoint = ${EndpointA}:$PortA
|
|
||||||
AllowedIPs = $AddressAwg
|
|
||||||
FINI
|
|
||||||
|
|
||||||
cat <<FINI > wg0-3.conf
|
|
||||||
#local settings for Endpoint C
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = $PKC
|
|
||||||
Address = $AddressCwg
|
|
||||||
ListenPort = $PortC
|
|
||||||
|
|
||||||
# remote settings for Endpoint A
|
|
||||||
[Peer]
|
|
||||||
PublicKey = $pKA
|
|
||||||
Endpoint = ${EndpointA}:$PortA
|
|
||||||
AllowedIPs = $AddressAwg
|
|
||||||
FINI
|
|
||||||
@ -1,77 +0,0 @@
|
|||||||
---
|
|
||||||
- hosts: wg
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: arrete unattended-upgrades
|
|
||||||
service:
|
|
||||||
name: unattended-upgrades
|
|
||||||
state: stopped
|
|
||||||
|
|
||||||
- name: installe Wireguard
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- wireguard
|
|
||||||
- wireguard-tools
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- hosts: wg_master
|
|
||||||
tasks:
|
|
||||||
- name: copie le fichier wg0-1.conf, wg0-2.conf et wg0-3.conf vers les machines master et cli
|
|
||||||
copy:
|
|
||||||
src: mkwgconf.sh
|
|
||||||
dest: mkwgconf.sh
|
|
||||||
|
|
||||||
- name: generations fichier configuration wireguard wg0-1.conf etc
|
|
||||||
shell: bash mkwgconf.sh
|
|
||||||
|
|
||||||
- name: récupération du fichier wg0-1.conf vers ap33-ans
|
|
||||||
fetch:
|
|
||||||
src: wg0-1.conf
|
|
||||||
dest: wg0-1.conf
|
|
||||||
flat: yes
|
|
||||||
|
|
||||||
- name: récupération du fichier wg0-2.conf vers ap33-ans
|
|
||||||
fetch:
|
|
||||||
src: wg0-2.conf
|
|
||||||
dest: wg0-2.conf
|
|
||||||
flat: yes
|
|
||||||
|
|
||||||
- name: récupération du fichier wg0-3.conf vers ap33-ans
|
|
||||||
fetch:
|
|
||||||
src: wg0-3.conf
|
|
||||||
dest: wg0-3.conf
|
|
||||||
flat: yes
|
|
||||||
|
|
||||||
- hosts: wg
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: copie fichier wg0-1 vers les clients
|
|
||||||
copy:
|
|
||||||
src: wg0-1.conf
|
|
||||||
dest: /etc/wireguard/wg0.conf
|
|
||||||
when: ansible_hostname == "ap33-mon"
|
|
||||||
|
|
||||||
- name: copie fichier wg0-2 vers les clients
|
|
||||||
copy:
|
|
||||||
src: wg0-2.conf
|
|
||||||
dest: /etc/wireguard/wg0.conf
|
|
||||||
when: ansible_hostname == "ap33-prod"
|
|
||||||
|
|
||||||
- name: copie fichier wg0-3.conf vers les clients
|
|
||||||
copy:
|
|
||||||
src: wg0-3.conf
|
|
||||||
dest: /etc/wireguard/wg0.conf
|
|
||||||
when: ansible_hostname == "ap33-test"
|
|
||||||
|
|
||||||
- hosts: wg
|
|
||||||
become: yes
|
|
||||||
tasks:
|
|
||||||
- name: Activation de wireguard
|
|
||||||
service:
|
|
||||||
name: wg-quick@wg0.service
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
- name: Redémarre le wireguard
|
|
||||||
service:
|
|
||||||
name: wg-quick@wg0.service
|
|
||||||
state: restarted
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
# local settings for Endpoint A
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = CNafmAzvjGGAFA5RsDCHtypTh9RGnAxpkxZCt9cBkXo=
|
|
||||||
Address = 10.0.0.1/24
|
|
||||||
ListenPort = 51820
|
|
||||||
|
|
||||||
# remote settings for Endpoint B
|
|
||||||
[Peer]
|
|
||||||
PublicKey = UMlB4+d/SYufqAGbuHDvGvkOhGKEihIgR+rhFzk3Aj0=
|
|
||||||
Endpoint = 172.16.0.120:51820
|
|
||||||
AllowedIPs = 10.0.0.2/24
|
|
||||||
|
|
||||||
# remote settings for Endpoint C
|
|
||||||
[Peer]
|
|
||||||
PublicKey = EWOjtZLwhNLDokDWJCONaBtqpGbr+x5tzNFeUI0hHEE=
|
|
||||||
Endpoint = 172.16.0.121:51820
|
|
||||||
AllowedIPs = 10.0.0.3/24
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
# local settings for Endpoint B
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = SLBteS7RJPIZ0TlZ5b9D6xtHF/5VzuQGmqnzW0Kkb0g=
|
|
||||||
Address = 10.0.0.2/24
|
|
||||||
ListenPort = 51820
|
|
||||||
|
|
||||||
# remote settings for Endpoint A
|
|
||||||
[Peer]
|
|
||||||
PublicKey = Fqd4WMaBpI7DAK6p2BaNhaE9VYzMRmfLxaO9uOmWTys=
|
|
||||||
Endpoint = 172.16.0.122:51820
|
|
||||||
AllowedIPs = 10.0.0.1/24
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
#local settings for Endpoint C
|
|
||||||
[Interface]
|
|
||||||
PrivateKey = wBu8AaHa061bI+6Eb+FmghV3iGKdp0a2Kq6At8UNzHo=
|
|
||||||
Address = 10.0.0.3/24
|
|
||||||
ListenPort = 51820
|
|
||||||
|
|
||||||
# remote settings for Endpoint A
|
|
||||||
[Peer]
|
|
||||||
PublicKey = Fqd4WMaBpI7DAK6p2BaNhaE9VYzMRmfLxaO9uOmWTys=
|
|
||||||
Endpoint = 172.16.0.122:51820
|
|
||||||
AllowedIPs = 10.0.0.1/24
|
|
||||||
Loading…
x
Reference in New Issue
Block a user