From 56aef1fa9bb3a41c88718350a19e9bbdc9d4bdc6 Mon Sep 17 00:00:00 2001 From: Xor290 Date: Fri, 7 Aug 2026 18:58:50 +0200 Subject: [PATCH] chore:: update --- .gitignore | 2 + certs/fullchain.pem | 80 ++++++++++++++++ certs/privkey.pem | 5 + .../playbook-journald-rsyslog-chrony.yml | 17 ++++ infra/playbook-app-firewall-lockdown.yml | 96 +++++++++++++++++-- infra/playbook-haproxy.yml | 73 ++++---------- infra/playbook-wireguard-vpn.yml | 38 ++++++++ inventory/group_vars/all/vars.yml | 1 + inventory/group_vars/ota-uber/vars.yml | 4 + inventory/group_vars/prod/vars.yml | 3 +- inventory/group_vars/replica-prod/vars.yml | 1 + inventory/host.ini | 19 ++-- prod/playbook-prod.yml | 33 ++++++- 13 files changed, 301 insertions(+), 71 deletions(-) create mode 100644 certs/fullchain.pem create mode 100644 certs/privkey.pem create mode 100644 inventory/group_vars/ota-uber/vars.yml diff --git a/.gitignore b/.gitignore index d6b130c..175e2fc 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ .claude/settings.local.json +ota/.env +ota/certs/ diff --git a/certs/fullchain.pem b/certs/fullchain.pem new file mode 100644 index 0000000..952ec47 --- /dev/null +++ b/certs/fullchain.pem @@ -0,0 +1,80 @@ +-----BEGIN CERTIFICATE----- +MIIDiDCCAw6gAwIBAgISBbDpQ8oHY7guAk3faJrZKlPmMAoGCCqGSM49BAMDMDMx +CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ +RTEwHhcNMjYwNjA4MTg0MzQ5WhcNMjYwOTA2MTg0MzQ4WjAYMRYwFAYDVQQDEw1t +bG4tdWJlci5jbHViMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpOe5wxYPT8ZX +OQNIT0nheWK4M+hdmj9pgsi6GEQjOJxqqlkqA6/V8M6ETWea6cjksn0B6MiQydNE +PmAaQJgpE6OCAhswggIXMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEF +BQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSJlN02wPPN4VXT+t6Ns84LHz2D +DzAfBgNVHSMEGDAWgBS7IMpHC/7X5Zz5jwkqo4w3RbG82DAzBggrBgEFBQcBAQQn +MCUwIwYIKwYBBQUHMAKGF2h0dHA6Ly95ZTEuaS5sZW5jci5vcmcvMBgGA1UdEQQR +MA+CDW1sbi11YmVyLmNsdWIwEwYDVR0gBAwwCjAIBgZngQwBAgEwLwYDVR0fBCgw +JjAkoCKgIIYeaHR0cDovL3llMS5jLmxlbmNyLm9yZy8xMDMuY3JsMIIBCwYKKwYB +BAHWeQIEAgSB/ASB+QD3AHUAyKPEf8ezrbk1awE/anoSbeM6TkOlxkb5l605dZkd +z5oAAAGeqMHjqAAABAMARjBEAiB8S2oE3E/xGA3RdVQehtCjoEXOASBbDbe+Vw0I +nHrCqgIgFy24r57bl0bEt/4idmm/MtzbKX1AJZxYv6JqSRoOrfoAfgAai51rD/6/ +gbR5OcbSMQqG1tEC1PBG4hgsneNfXiYl7wAAAZ6oweQ5AAgAAAUAHD6tDQQDAEcw +RQIhAOICIAOd8ccaikz7PAzREsczeq14zSfevdatdzM1TRS3AiAxviAJx4WZtz3O +xbhbzWXdVa9Ru/F5lF3groeN9vUUzDAKBggqhkjOPQQDAwNoADBlAjEAiwI/D0h7 +nlA3o2Ni1Zp2KdTGYrSURx6aUrQHiNga+l8czXlkVqF5RiQLz0mGjA82AjBqn2Hs +gRsc/T8Lx32HhtLFca1GPLSs5utEQfP92d+bLhOrZm/iOYurhNp7Z/dN3wE= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQsw +CQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0y +NTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYD +VQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUr +gQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+z +ASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9x +teIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF +BwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqj +jDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUF +BwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNV +HSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5s +ZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgf +Zwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/L +VKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzEL +MAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo +IEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcN +MzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4G +A1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo ++wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2 +b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNV +HQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB +/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKW +rt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZo +dHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1Ud +HwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMD +aQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYK +Ax54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC2 +6hSW1/IWaas6dg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP +MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy +Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa +Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l +dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H +ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7 +AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd +BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2 +5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw +Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg +MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD +ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e +/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo +shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS +2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95 +IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN +/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0 +upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc +MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV +pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ +cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p +TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R +-----END CERTIFICATE----- diff --git a/certs/privkey.pem b/certs/privkey.pem new file mode 100644 index 0000000..951b488 --- /dev/null +++ b/certs/privkey.pem @@ -0,0 +1,5 @@ +-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg674do8xZennE30s5 +41lM0sOSCCF4vszIl+1vnis/jqqhRANCAASk57nDFg9Pxlc5A0hPSeF5Yrgz6F2a +P2mCyLoYRCM4nGqqWSoDr9XwzoRNZ5rpyOSyfQHoyJDJ00Q+YBpAmCkT +-----END PRIVATE KEY----- diff --git a/hardening/playbook-journald-rsyslog-chrony.yml b/hardening/playbook-journald-rsyslog-chrony.yml index e833659..1201ae1 100644 --- a/hardening/playbook-journald-rsyslog-chrony.yml +++ b/hardening/playbook-journald-rsyslog-chrony.yml @@ -61,6 +61,14 @@ - { regexp: '^#?MaxFileSec=', line: 'MaxFileSec=1month' } register: journald_base + - name: journald - creer le dossier conf.d si absent + ansible.builtin.file: + path: /etc/systemd/journald.conf.d + state: directory + owner: root + group: root + mode: "0755" + - name: journald - deployer aussi en conf.d ansible.builtin.template: src: ../templates/60-journald.conf.j2 @@ -96,6 +104,15 @@ when: chrony_active.stdout != "active" register: timesyncd_base + - name: timesyncd - creer le dossier conf.d si absent + ansible.builtin.file: + path: /etc/systemd/timesyncd.conf.d + state: directory + owner: root + group: root + mode: "0755" + when: chrony_active.stdout != "active" + - name: timesyncd - deployer aussi en conf.d ansible.builtin.template: src: ../templates/60-timesyncd.conf.j2 diff --git a/infra/playbook-app-firewall-lockdown.yml b/infra/playbook-app-firewall-lockdown.yml index 086e8cc..c278011 100644 --- a/infra/playbook-app-firewall-lockdown.yml +++ b/infra/playbook-app-firewall-lockdown.yml @@ -26,22 +26,106 @@ ansible.builtin.iptables: chain: DOCKER-USER protocol: tcp - match: multiport - destination_ports: "80,443" + destination_port: "{{ item }}" jump: DROP action: insert - comment: "app-firewall: bloque 80/443 hors load-balancer" + comment: "app-firewall: bloque {{ item }} hors load-balancer" + loop: + - "80" + - "443" - name: Autoriser les connexions 80/443 depuis le load-balancer (VPN) ansible.builtin.iptables: chain: DOCKER-USER protocol: tcp source: "{{ lb_vpn_ip }}/32" - match: multiport - destination_ports: "80,443" + destination_port: "{{ item }}" jump: RETURN action: insert - comment: "app-firewall: autorise 80/443 depuis le load-balancer" + comment: "app-firewall: autorise {{ item }} depuis le load-balancer" + loop: + - "80" + - "443" + + - name: Sauvegarder les règles iptables (persistance au reboot) + ansible.builtin.command: netfilter-persistent save + changed_when: false + +# Le load-balancer n'a besoin que de faire du reverse-proxy HTTP/HTTPS vers +# prod/replica-prod : il n'a aucune raison de se connecter en SSH à quoi que +# ce soit. On bloque donc son SSH sortant vers toutes les autres machines du +# réseau (chaîne INPUT, en tête de chaîne pour passer avant les ACCEPT VPN +# existants), afin de limiter le rayon d'action en cas de compromission du +# load-balancer (seul hôte exposé publiquement sur 80/443). + +- name: Empêcher le load-balancer de se connecter en SSH aux autres machines + hosts: all:!load-balancer + become: true + gather_facts: false + + vars: + lb_vpn_ip: "{{ hostvars['load-balancer']['vpn_ip'] }}" + lb_public_ip: "{{ hostvars['load-balancer']['ansible_host'] }}" + + tasks: + - name: Installer iptables-persistent + ansible.builtin.apt: + name: iptables-persistent + state: present + update_cache: yes + + - name: Bloquer le SSH entrant depuis le load-balancer + ansible.builtin.iptables: + chain: INPUT + protocol: tcp + source: "{{ item }}/32" + destination_port: "22" + jump: DROP + action: insert + rule_num: 1 + comment: "app-firewall: bloque SSH depuis le load-balancer" + loop: + - "{{ lb_vpn_ip }}" + - "{{ lb_public_ip }}" + + - name: Sauvegarder les règles iptables (persistance au reboot) + ansible.builtin.command: netfilter-persistent save + changed_when: false + +# Le replica n'a besoin de parler à bdd-redis-prod que sur le port Postgres +# (5432, réplication). On bloque son SSH vers bdd-redis-prod (chaîne INPUT, +# en tête de chaîne pour passer avant l'ACCEPT VPN existant sur dpt:22) sans +# toucher au port 5432, déjà autorisé pour toute la plage VPN 10.0.0.0/24. + +- name: Empêcher le replica de se connecter en SSH à bdd-redis-prod + hosts: bdd-redis-prod + become: true + gather_facts: false + + vars: + replica_vpn_ip: "{{ hostvars['replica-prod-uber']['vpn_ip'] }}" + replica_public_ip: "{{ hostvars['replica-prod-uber']['ansible_host'] }}" + + tasks: + - name: Installer iptables-persistent + ansible.builtin.apt: + name: iptables-persistent + state: present + update_cache: yes + + - name: Bloquer le SSH entrant depuis le replica + ansible.builtin.iptables: + chain: INPUT + protocol: tcp + source: "{{ item }}/32" + destination_port: "22" + jump: DROP + action: insert + rule_num: 1 + comment: "app-firewall: bloque SSH depuis le replica" + loop: + - "{{ replica_vpn_ip }}" + - "{{ replica_public_ip }}" - name: Sauvegarder les règles iptables (persistance au reboot) ansible.builtin.command: netfilter-persistent save diff --git a/infra/playbook-haproxy.yml b/infra/playbook-haproxy.yml index 59bcc96..ad8d7f1 100644 --- a/infra/playbook-haproxy.yml +++ b/infra/playbook-haproxy.yml @@ -1,45 +1,4 @@ --- -# Le certificat mln-uber.club n'est pas généré ici : il existe déjà sur prod-uber -# (utilisé par le conteneur waf du docker-compose). On le récupère et on le copie -# vers le load-balancer. Relancer ce playbook après chaque renouvellement du cert -# sur prod-uber pour resynchroniser HAProxy. - -- name: Récupérer le certificat mln-uber.club depuis prod-uber - hosts: prod-uber - become: true - gather_facts: false - - vars: - # À CONFIRMER : chemin réel du cert sur prod-uber (aucun playbook ne le dépose - # actuellement à cet endroit — à ajuster si différent). - app_cert_dir: "{{ docker_dir }}/certs" - local_cert_sync_dir: /tmp/mln-uber-cert-sync - - tasks: - - name: Créer le dossier temporaire local de synchronisation - ansible.builtin.file: - path: "{{ local_cert_sync_dir }}" - state: directory - mode: "0700" - delegate_to: localhost - become: false - - - name: Rapatrier fullchain.pem et privkey.pem - ansible.builtin.fetch: - src: "{{ app_cert_dir }}/{{ item }}" - dest: "{{ local_cert_sync_dir }}/{{ item }}" - flat: true - loop: - - fullchain.pem - - privkey.pem - - - name: Restreindre les permissions locales de la clé privée - ansible.builtin.file: - path: "{{ local_cert_sync_dir }}/privkey.pem" - mode: "0600" - delegate_to: localhost - become: false - - name: Déploiement HAProxy (load-balancer) hosts: load-balancer become: true @@ -48,7 +7,7 @@ vars: haproxy_cert_dir: /etc/haproxy/certs haproxy_cert_path: "{{ haproxy_cert_dir }}/{{ domain_name }}.pem" - local_cert_sync_dir: /tmp/mln-uber-cert-sync + local_cert_sync_dir: ../certs tasks: - name: Installer HAProxy @@ -91,11 +50,24 @@ group: root mode: "0640" - - name: Ouvrir le port HTTPS dans UFW - ansible.builtin.ufw: - rule: allow - port: "443" - proto: tcp + - name: Installer iptables-persistent + ansible.builtin.apt: + name: iptables-persistent + state: present + update_cache: yes + + - name: Autoriser le port HTTPS (443) entrant + ansible.builtin.iptables: + chain: INPUT + protocol: tcp + destination_port: "443" + jump: ACCEPT + action: insert + comment: "haproxy: autorise HTTPS entrant" + + - name: Sauvegarder les règles iptables (persistance au reboot) + ansible.builtin.command: netfilter-persistent save + changed_when: false - name: Déployer la configuration HAProxy ansible.builtin.template: @@ -113,13 +85,6 @@ state: started enabled: yes - - name: Nettoyer les fichiers temporaires locaux - ansible.builtin.file: - path: "{{ local_cert_sync_dir }}" - state: absent - delegate_to: localhost - become: false - handlers: - name: reload haproxy ansible.builtin.systemd: diff --git a/infra/playbook-wireguard-vpn.yml b/infra/playbook-wireguard-vpn.yml index 410f970..a56d699 100644 --- a/infra/playbook-wireguard-vpn.yml +++ b/infra/playbook-wireguard-vpn.yml @@ -67,6 +67,44 @@ vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4=" tasks: + # ─── Dynamic debug WireGuard ──────────────────────────────────────────── + # Le module kernel wireguard ne logge les handshakes/keepalives (utilisés + # par les decoders/rules Wazuh) que si son dynamic debug est activé. Ce + # flag n'est PAS persistant : il retombe à "désactivé" à chaque reboot ou + # rechargement du module, ce qui coupe silencieusement la remontée des + # handshakes vers Wazuh sans toucher au fonctionnement du VPN lui-même + # (constaté : coupure du 18 au 30/07/2026 après un reboot du serveur). + - name: Déployer le service systemd qui réactive le dynamic debug wireguard au boot + ansible.builtin.copy: + dest: /etc/systemd/system/wireguard-dyndbg.service + mode: "0644" + owner: root + group: root + content: | + [Unit] + Description=Active le dynamic debug du module kernel WireGuard (logs handshakes pour Wazuh) + After=wg-quick@wg0.service sys-kernel-debug.mount + Requires=wg-quick@wg0.service + PartOf=wg-quick@wg0.service + + [Service] + Type=oneshot + RemainAfterExit=yes + ExecStart=/bin/sh -c 'echo "module wireguard +p" > /sys/kernel/debug/dynamic_debug/control' + + [Install] + WantedBy=multi-user.target + register: dyndbg_unit + tags: [vpn, logging] + + - name: Activer et démarrer le service wireguard-dyndbg + ansible.builtin.systemd: + name: wireguard-dyndbg.service + daemon_reload: "{{ dyndbg_unit.changed }}" + enabled: yes + state: started + tags: [vpn, logging] + - name: Calculer la clé publique du client à partir de sa clé privée command: wg pubkey args: diff --git a/inventory/group_vars/all/vars.yml b/inventory/group_vars/all/vars.yml index 8938313..898f433 100644 --- a/inventory/group_vars/all/vars.yml +++ b/inventory/group_vars/all/vars.yml @@ -12,3 +12,4 @@ discord_infra_webhook_url: "https://discord.com/api/webhooks/1526937190410621032 # (NAT des ports publiés) ou servent de relais VPN. Surchargé à true uniquement pour les hosts # sans aucun rôle de forwarding (voir group_vars/load-balancer). ip_forwarding_disabled: false +ssl_domain: "mln-uber.club" diff --git a/inventory/group_vars/ota-uber/vars.yml b/inventory/group_vars/ota-uber/vars.yml new file mode 100644 index 0000000..9a3af33 --- /dev/null +++ b/inventory/group_vars/ota-uber/vars.yml @@ -0,0 +1,4 @@ +ip_forwarding_disabled: true +user_ssh: "omnex" +group_ssh: "ssh" +password_user_ssh: "$6$w6GBkTHgj8K84P7o$pToS4pRMGLKwfpRfnz6i.WpO72Lt5DLtFQWZJsKL2dKvQrdKdi2q8xRuWqq/W3ybFNLQapvAqN33HexVjajGw0" #aiQgIAcCVIy1E33ReRssfm414dm diff --git a/inventory/group_vars/prod/vars.yml b/inventory/group_vars/prod/vars.yml index 0f3c48a..1990475 100644 --- a/inventory/group_vars/prod/vars.yml +++ b/inventory/group_vars/prod/vars.yml @@ -4,4 +4,5 @@ compose_project_dir: "../docker-prod/" # Utilisé uniquement par prod/playbook-s3-img.yml (les autres playbooks du groupe utilisent ansible_user) user_deploy: "ubuntu" docker_group: "docker" -docker_dir: "/home/ubuntu/docker/s3-img" +docker_dir: "/home/ubuntu/docker" +ssl_dir: "/home/ubuntu/docker/certs" diff --git a/inventory/group_vars/replica-prod/vars.yml b/inventory/group_vars/replica-prod/vars.yml index dd6ec73..852be41 100644 --- a/inventory/group_vars/replica-prod/vars.yml +++ b/inventory/group_vars/replica-prod/vars.yml @@ -2,3 +2,4 @@ compose_project_dir: "../../docker-prod/" docker_group: "docker" user_deploy: "ubuntu" +ssl_dir: "/home/ubuntu/docker/certs" diff --git a/inventory/host.ini b/inventory/host.ini index 146d65d..800b81d 100644 --- a/inventory/host.ini +++ b/inventory/host.ini @@ -8,26 +8,29 @@ pre-prod-uber ansible_host=131.123.39.112 ansible_user=omnex ansible_ssh_private bdd-redis-prod ansible_host=132.243.162.62 ansible_user=root ansible_ssh_private_key_file=../.ssh/key_bdd_redis vpn_ip=10.0.0.5 [replica-prod] -replica-prod-uber ansible_host=132.243.162.161 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.9 +replica-prod-uber ansible_host=132.243.162.161 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.9 ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm [infra-monitoring-security] -monitoring-uber ansible_host=185.103.167.138 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.2 +monitoring-uber ansible_host=185.103.167.138 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.2 ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm [infra-runner] -runner-uber ansible_host=185.103.164.200 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex +runner-uber ansible_host=185.103.164.200 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm [infra-utils] -s3-uber ansible_host=80.96.58.164 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm +s3-uber ansible_host=80.96.58.164 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm vpn_ip=10.0.0.14 [vpn-uber] -vpn-uber ansible_host=131.123.42.158 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.1 +vpn-uber ansible_host=131.123.42.158 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.1 ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm [load-balancer] -load-balancer ansible_host=93.185.166.221 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.12 +load-balancer ansible_host=143.246.199.221 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.12 + +[ota-uber] +ota-uber ansible_host=193.27.90.157 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.10 ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm [infra] -monitoring-uber ansible_host=185.103.167.138 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.2 -vpn-uber ansible_host=131.123.42.158 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.1 +monitoring-uber ansible_host=185.103.167.138 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.2 ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm +vpn-uber ansible_host=131.123.42.158 ansible_user=omnex ansible_ssh_private_key_file=../.ssh/omnex vpn_ip=10.0.0.1 ansible_become_pass=aiQgIAcCVIy1E33ReRssfm414dm backup-mln ansible_host=85.121.176.241 ansible_user=root ansible_ssh_private_key_file=../.ssh/key_backup vpn_ip=10.0.0.4 [infra:children] diff --git a/prod/playbook-prod.yml b/prod/playbook-prod.yml index 7fc9bb0..652fc7f 100644 --- a/prod/playbook-prod.yml +++ b/prod/playbook-prod.yml @@ -1,9 +1,13 @@ --- - name: Installation et configuration du frontend et backend - hosts: replica-prod + hosts: prod-uber become: true gather_facts: true + vars: + ssl_dir: "{{ docker_dir }}/certs" + ssl_domain: mln-uber.club + tasks: - name: Update apt cache apt: @@ -169,4 +173,29 @@ owner: "{{ docker_user }}" group: "{{ docker_group }}" mode: "0750" - tags: project + tags: [certs] + + - name: Générer la clé privée RSA 2048 + community.crypto.openssl_privatekey: + path: "{{ ssl_dir }}/privkey.pem" + type: RSA + size: 2048 + mode: "0600" + tags: [certs] + + - name: Générer la CSR pour le certificat auto-signé + community.crypto.openssl_csr: + path: "{{ ssl_dir }}/selfsigned.csr" + privatekey_path: "{{ ssl_dir }}/privkey.pem" + common_name: "{{ ssl_domain }}" + tags: [certs] + + - name: Générer le certificat auto-signé + community.crypto.x509_certificate: + path: "{{ ssl_dir }}/fullchain.pem" + privatekey_path: "{{ ssl_dir }}/privkey.pem" + csr_path: "{{ ssl_dir }}/selfsigned.csr" + provider: selfsigned + selfsigned_not_after: "+3650d" + mode: "0644" + tags: [certs]