first commit
This commit is contained in:
Nuxgrid
@@ -0,0 +1,127 @@
|
||||
---
|
||||
- name: Génération du certificat SSL Let's Encrypt
|
||||
hosts: infra
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Installer certbot et le plugin nginx
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- nginx
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Déployer la config Nginx HTTP simple (ACME challenge)
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/nginx/sites-available/certbot
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ domain_name }} {{ subdomains | join(' ') }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/html;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 200 'ok';
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
|
||||
- name: Activer le site certbot
|
||||
ansible.builtin.file:
|
||||
src: /etc/nginx/sites-available/certbot
|
||||
dest: /etc/nginx/sites-enabled/certbot
|
||||
state: link
|
||||
force: yes
|
||||
|
||||
- name: Désactiver le site par défaut
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
|
||||
- name: Tester la configuration Nginx
|
||||
ansible.builtin.command: nginx -t
|
||||
changed_when: false
|
||||
|
||||
- name: Redémarrer Nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Ouvrir les ports dans UFW
|
||||
ansible.builtin.ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "22"
|
||||
- "80"
|
||||
- "443"
|
||||
|
||||
- name: Vérifier si le certificat existe déjà
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
register: cert_file
|
||||
tags: [gen]
|
||||
|
||||
- name: Générer le certificat avec Certbot (domaine + sous-domaines)
|
||||
ansible.builtin.command: >
|
||||
certbot certonly --nginx
|
||||
-d {{ domain_name }}
|
||||
{{ subdomains | map('regex_replace', '^(.*)$', '-d \1') | join(' ') }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
--email admin@{{ domain_name }}
|
||||
when: not cert_file.stat.exists
|
||||
tags: [gen]
|
||||
|
||||
- name: Vérifier que le certificat a bien été généré
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
register: cert_check
|
||||
|
||||
- name: Afficher le résultat
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ 'Certificat généré : /etc/letsencrypt/live/' + domain_name + '/fullchain.pem' if cert_check.stat.exists else 'ERREUR : certificat non trouvé' }}"
|
||||
|
||||
- name: Vérifier le renouvellement automatique
|
||||
ansible.builtin.command: certbot renew --dry-run
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: cert_check.stat.exists
|
||||
|
||||
- name: Créer le dossier docker/certs
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/nginx/certs"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0750"
|
||||
tags: [create]
|
||||
|
||||
- name: Copier fullchain.pem dans docker/certs
|
||||
ansible.builtin.copy:
|
||||
src: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
dest: "{{ docker_dir }}/nginx/certs/fullchain.pem"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0644"
|
||||
remote_src: yes
|
||||
tags: [create]
|
||||
|
||||
- name: Copier privkey.pem dans docker/certs
|
||||
ansible.builtin.copy:
|
||||
src: "/etc/letsencrypt/live/{{ domain_name }}/privkey.pem"
|
||||
dest: "{{ docker_dir }}/nginx/certs/privkey.pem"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
remote_src: yes
|
||||
tags: [create]
|
||||
@@ -0,0 +1,106 @@
|
||||
---
|
||||
- name: Installation et configuration du clamAV
|
||||
hosts: infra
|
||||
become: true
|
||||
gather_facts: true
|
||||
tasks:
|
||||
- name: Vérifier si ClamAV existe dans les dépôts
|
||||
ansible.builtin.command: apt-cache search ^clamav$
|
||||
register: clamav_search
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher résultat
|
||||
ansible.builtin.debug:
|
||||
var: clamav_search.stdout
|
||||
|
||||
- name: Installer ClamAV si disponible
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- clamav
|
||||
- clamav-daemon
|
||||
state: present
|
||||
update_cache: true
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Démarrer ClamAV
|
||||
ansible.builtin.service:
|
||||
name: clamav-daemon
|
||||
state: started
|
||||
enabled: true
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Arrêter clamav-freshclam avant la mise à jour
|
||||
ansible.builtin.service:
|
||||
name: clamav-freshclam
|
||||
state: stopped
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Mettre à jour la base de données virale (freshclam)
|
||||
ansible.builtin.command: freshclam
|
||||
register: freshclam_result
|
||||
changed_when: "'Database updated' in freshclam_result.stdout"
|
||||
failed_when: freshclam_result.rc != 0
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Redémarrer clamav-freshclam après la mise à jour
|
||||
ansible.builtin.service:
|
||||
name: clamav-freshclam
|
||||
state: started
|
||||
enabled: true
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Configurer ClamAV - activer la détection PUA
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/clamav/clamd.conf
|
||||
regexp: "^#?DetectPUA"
|
||||
line: "DetectPUA yes"
|
||||
backup: true
|
||||
when: clamav_search.stdout != ""
|
||||
notify: Redémarrer clamav-daemon
|
||||
|
||||
- name: Configurer ClamAV - activer les logs
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/clamav/clamd.conf
|
||||
regexp: "^#?LogFile "
|
||||
line: "LogFile /var/log/clamav/clamav.log"
|
||||
backup: true
|
||||
when: clamav_search.stdout != ""
|
||||
notify: Redémarrer clamav-daemon
|
||||
|
||||
- name: Configurer ClamAV - taille max des fichiers scannés
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/clamav/clamd.conf
|
||||
regexp: "^#?MaxFileSize"
|
||||
line: "MaxFileSize 100M"
|
||||
backup: true
|
||||
when: clamav_search.stdout != ""
|
||||
notify: Redémarrer clamav-daemon
|
||||
|
||||
- name: Planifier un scan quotidien via cron
|
||||
ansible.builtin.cron:
|
||||
name: "ClamAV daily scan"
|
||||
minute: "30"
|
||||
hour: "2"
|
||||
job: >
|
||||
ionice -c 3 nice -n 19
|
||||
docker exec gestion-clamav
|
||||
clamscan -r /home /tmp /app/uploads
|
||||
--log=/var/log/clamav/daily_scan.log --quiet
|
||||
user: root
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Afficher résultat final
|
||||
ansible.builtin.debug:
|
||||
msg: "ClamAV installé et configuré avec succès"
|
||||
when: clamav_search.stdout != ""
|
||||
|
||||
- name: Afficher message si ClamAV non disponible
|
||||
ansible.builtin.debug:
|
||||
msg: "ClamAV n'est pas disponible dans les dépôts"
|
||||
when: clamav_search.stdout == ""
|
||||
|
||||
handlers:
|
||||
- name: Redémarrer clamav-daemon
|
||||
ansible.builtin.service:
|
||||
name: clamav-daemon
|
||||
state: restarted
|
||||
@@ -0,0 +1,332 @@
|
||||
---
|
||||
- name: Installation et configuration du Gitea Act Runner
|
||||
hosts: infra
|
||||
become: false
|
||||
gather_facts: true
|
||||
|
||||
vars:
|
||||
act_runner_version: "0.2.11"
|
||||
act_runner_binary: /usr/local/bin/act_runner
|
||||
act_runner_workdir: /opt/gitea-runner
|
||||
act_runner_config: /opt/gitea-runner/.runner
|
||||
gitea_instance_url: "https://gitea.uber-stup.club"
|
||||
runner_name: "{{ inventory_hostname }}-runner"
|
||||
runner_labels: "ubuntu-latest:docker://catthehacker/ubuntu:act-22.04,ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04"
|
||||
|
||||
# ── Utilisateur CI/CD ────────────────────────────────
|
||||
ci_cd_user: "ci-cd"
|
||||
ci_cd_user_shell: "/bin/bash"
|
||||
ci_cd_user_groups:
|
||||
- docker
|
||||
ci_cd_ssh_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICJ4COozE+71IvOhzK7ijeQY5lmoDxYTA0+B0lEAO0tG xor_fakers@AsusXor" # ex: "ssh-ed25519 AAAAC3Nza... ci-cd@gitea"
|
||||
|
||||
tasks:
|
||||
# ── Verrou dpkg (unattended-upgrades / cloud-init au boot) ──
|
||||
- name: Attendre la libération du verrou dpkg/apt
|
||||
become: true
|
||||
shell: |
|
||||
while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
|
||||
|| fuser /var/lib/dpkg/lock >/dev/null 2>&1 \
|
||||
|| fuser /var/lib/apt/lists/lock >/dev/null 2>&1 \
|
||||
|| fuser /var/cache/apt/archives/lock >/dev/null 2>&1; do
|
||||
sleep 5
|
||||
done
|
||||
changed_when: false
|
||||
args:
|
||||
executable: /bin/bash
|
||||
tags: always
|
||||
|
||||
# ── Prérequis ──────────────────────────────────────────
|
||||
- name: Installer les paquets requis
|
||||
become: true
|
||||
apt:
|
||||
name:
|
||||
- curl
|
||||
- ca-certificates
|
||||
state: present
|
||||
update_cache: yes
|
||||
register: apt_prereqs_result
|
||||
until: apt_prereqs_result is succeeded
|
||||
retries: 10
|
||||
delay: 15
|
||||
|
||||
# ── Docker (requis pour exécuter les jobs) ─────────────
|
||||
- name: Vérifier si Docker est installé
|
||||
become: true
|
||||
command: docker --version
|
||||
register: docker_check
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Installer Docker si absent
|
||||
become: true
|
||||
block:
|
||||
- name: Ajouter la clé GPG Docker
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
|
||||
- name: Ajouter le dépôt Docker
|
||||
apt_repository:
|
||||
repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
|
||||
- name: Installer Docker
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
state: present
|
||||
update_cache: yes
|
||||
register: apt_docker_result
|
||||
until: apt_docker_result is succeeded
|
||||
retries: 10
|
||||
delay: 15
|
||||
|
||||
- name: Démarrer et activer Docker
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
when: docker_check.rc != 0
|
||||
|
||||
# ── Utilisateur dédié CI/CD ─────────────────────────────
|
||||
- name: Vérifier que ci_cd_ssh_pubkey est fourni
|
||||
fail:
|
||||
msg: "La variable 'ci_cd_ssh_pubkey' est requise. Relancez avec : -e ci_cd_ssh_pubkey='ssh-ed25519 AAAA...'"
|
||||
when: ci_cd_ssh_pubkey is not defined or ci_cd_ssh_pubkey == ""
|
||||
tags: ["ci-cd-user"]
|
||||
|
||||
- name: Créer l'utilisateur CI/CD
|
||||
become: true
|
||||
user:
|
||||
name: "{{ ci_cd_user }}"
|
||||
shell: "{{ ci_cd_user_shell }}"
|
||||
groups: "{{ ci_cd_user_groups }}"
|
||||
append: true
|
||||
create_home: true
|
||||
state: present
|
||||
tags: ["ci-cd-user"]
|
||||
|
||||
- name: Créer le répertoire .ssh de l'utilisateur CI/CD
|
||||
become: true
|
||||
file:
|
||||
path: "/home/{{ ci_cd_user }}/.ssh"
|
||||
state: directory
|
||||
owner: "{{ ci_cd_user }}"
|
||||
group: "{{ ci_cd_user }}"
|
||||
mode: "0700"
|
||||
tags: ["ci-cd-user"]
|
||||
|
||||
- name: Déployer la clé publique SSH de l'utilisateur CI/CD
|
||||
become: true
|
||||
authorized_key:
|
||||
user: "{{ ci_cd_user }}"
|
||||
key: "{{ ci_cd_ssh_pubkey }}"
|
||||
state: present
|
||||
exclusive: false
|
||||
tags: ["ci-cd-user"]
|
||||
|
||||
- name: Autoriser l'utilisateur CI/CD à utiliser Docker sans mot de passe (sudo ciblé, optionnel)
|
||||
become: true
|
||||
copy:
|
||||
dest: "/etc/sudoers.d/{{ ci_cd_user }}-docker"
|
||||
content: "{{ ci_cd_user }} ALL=(ALL) NOPASSWD: /usr/bin/docker\n"
|
||||
mode: "0440"
|
||||
validate: "visudo -cf %s"
|
||||
tags: ["ci-cd-user"]
|
||||
|
||||
# ── Téléchargement act_runner ──────────────────────────
|
||||
- name: Vérifier si act_runner est déjà installé
|
||||
become: true
|
||||
stat:
|
||||
path: "{{ act_runner_binary }}"
|
||||
register: runner_bin
|
||||
tags: ["runner", "register-runner"]
|
||||
|
||||
- name: Récupérer la version installée
|
||||
become: true
|
||||
command: "{{ act_runner_binary }} --version"
|
||||
register: installed_version
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: runner_bin.stat.exists
|
||||
tags: ["runner", "register-runner"]
|
||||
|
||||
- name: Télécharger act_runner v{{ act_runner_version }}
|
||||
become: true
|
||||
get_url:
|
||||
url: "https://dl.gitea.com/act_runner/{{ act_runner_version }}/act_runner-{{ act_runner_version }}-linux-amd64"
|
||||
dest: "{{ act_runner_binary }}"
|
||||
mode: "0755"
|
||||
force: yes
|
||||
tags: ["runner", "register-runner"]
|
||||
when: >
|
||||
not (runner_bin.stat.exists | default(false)) or
|
||||
(installed_version.stdout is defined and act_runner_version not in installed_version.stdout)
|
||||
# ── Répertoire de travail ──────────────────────────────
|
||||
- name: Créer le répertoire de travail
|
||||
become: true
|
||||
file:
|
||||
path: "{{ act_runner_workdir }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
tags: ["register-runner"]
|
||||
|
||||
# ── Enregistrement du runner ───────────────────────────
|
||||
- name: Vérifier que gitea_runner_token est fourni
|
||||
become: true
|
||||
fail:
|
||||
msg: "La variable 'gitea_runner_token' est requise. Relancez avec : -e gitea_runner_token=<token>"
|
||||
when: gitea_runner_token is not defined or gitea_runner_token == ""
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Vérifier si le runner est déjà enregistré
|
||||
become: true
|
||||
stat:
|
||||
path: "{{ act_runner_config }}"
|
||||
register: runner_config
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Arrêter le service avant re-enregistrement
|
||||
become: true
|
||||
systemd:
|
||||
name: gitea-runner
|
||||
state: stopped
|
||||
failed_when: false
|
||||
when: gitea_runner_token is defined and runner_config.stat.exists
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Supprimer l'ancienne configuration du runner
|
||||
become: true
|
||||
file:
|
||||
path: "{{ act_runner_config }}"
|
||||
state: absent
|
||||
when: gitea_runner_token is defined and runner_config.stat.exists
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Enregistrer le runner auprès de Gitea
|
||||
become: true
|
||||
command: >
|
||||
{{ act_runner_binary }} register
|
||||
--instance {{ gitea_instance_url }}
|
||||
--token {{ gitea_runner_token }}
|
||||
--name {{ runner_name }}
|
||||
--labels {{ runner_labels }}
|
||||
--no-interactive
|
||||
args:
|
||||
chdir: "{{ act_runner_workdir }}"
|
||||
no_log: true
|
||||
tags: ["register-runner"]
|
||||
|
||||
# ── Service systemd ────────────────────────────────────
|
||||
- name: Créer le service systemd gitea-runner
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/systemd/system/gitea-runner.service
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Gitea Act Runner
|
||||
After=network.target docker.service
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
ExecStart={{ act_runner_binary }} daemon
|
||||
WorkingDirectory={{ act_runner_workdir }}
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
User=root
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
notify: Recharger systemd
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Activer et démarrer le service gitea-runner
|
||||
become: true
|
||||
systemd:
|
||||
name: gitea-runner
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
tags: ["register-runner"]
|
||||
|
||||
# ── Vérification ───────────────────────────────────────
|
||||
- name: Vérifier le statut du runner
|
||||
become: true
|
||||
command: systemctl status gitea-runner
|
||||
register: runner_status
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Afficher le statut
|
||||
become: true
|
||||
debug:
|
||||
msg: "{{ runner_status.stdout_lines }}"
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Check if swap is already active
|
||||
become: true
|
||||
ansible.builtin.command: swapon --show
|
||||
register: swap_status
|
||||
changed_when: false
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Create swapfile
|
||||
become: true
|
||||
ansible.builtin.command: "fallocate -l {{ swap_size }} {{ swap_file }}"
|
||||
args:
|
||||
creates: "{{ swap_file }}"
|
||||
tags: ["register-runner"]
|
||||
when: swap_status.stdout == ""
|
||||
|
||||
- name: Set swapfile permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ swap_file }}"
|
||||
mode: "0600"
|
||||
owner: root
|
||||
group: root
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Format swap
|
||||
become: true
|
||||
ansible.builtin.command: mkswap {{ swap_file }}
|
||||
tags: ["register-runner"]
|
||||
when: swap_status.stdout == ""
|
||||
|
||||
- name: Enable swap
|
||||
become: true
|
||||
ansible.builtin.command: swapon {{ swap_file }}
|
||||
tags: ["register-runner"]
|
||||
when: swap_status.stdout == ""
|
||||
|
||||
- name: Ensure swap in fstab
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/fstab
|
||||
line: "{{ swap_file }} none swap sw 0 0"
|
||||
state: present
|
||||
tags: ["register-runner"]
|
||||
|
||||
- name: Set swappiness
|
||||
become: true
|
||||
ansible.builtin.sysctl:
|
||||
name: vm.swappiness
|
||||
value: "{{ swap_swappiness }}"
|
||||
state: present
|
||||
reload: yes
|
||||
tags: ["register-runner"]
|
||||
|
||||
handlers:
|
||||
- name: Recharger systemd
|
||||
become: true
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
@@ -0,0 +1,146 @@
|
||||
---
|
||||
- name: S3 backup pour la db de prod
|
||||
hosts: infra
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- acl
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: docker
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
tags: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
tags: docker
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: docker
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: ansible_user is defined
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
tags: docker
|
||||
|
||||
- name: Copy S3 project
|
||||
ansible.builtin.copy:
|
||||
src: ../monitoring/s3-backup/
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: project
|
||||
@@ -0,0 +1,146 @@
|
||||
---
|
||||
- name: Déploiement OTA & S3 pour les build
|
||||
hosts: infra
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- acl
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: docker
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
tags: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
tags: docker
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: docker
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: ansible_user is defined
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
tags: docker
|
||||
|
||||
- name: Copy S3 project
|
||||
ansible.builtin.copy:
|
||||
src: ../monitoring/s3/
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: project
|
||||
@@ -0,0 +1,155 @@
|
||||
---
|
||||
- name: Déploiement des solution de monitoring et de sécurité
|
||||
hosts: infra
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- acl
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: docker
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
tags: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
tags: docker
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: docker
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: ansible_user is defined
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
tags: docker
|
||||
|
||||
- name: Copy Docker project
|
||||
ansible.builtin.copy:
|
||||
src: ../monitoring/security/
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: project
|
||||
|
||||
- name: Set permissions for .env file
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/.env"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
tags: project
|
||||
ignore_errors: yes
|
||||
@@ -0,0 +1,77 @@
|
||||
---
|
||||
- name: Mises à jour de sécurité automatiques (unattended-upgrades)
|
||||
hosts: load-balancer
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Installer unattended-upgrades et jq (notification Discord)
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- unattended-upgrades
|
||||
- jq
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Déployer la config des origines/exclusions (50unattended-upgrades)
|
||||
ansible.builtin.template:
|
||||
src: ../templates/unattended-upgrades-50.j2
|
||||
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Déployer la config d'activation périodique (20auto-upgrades)
|
||||
ansible.builtin.template:
|
||||
src: ../templates/unattended-upgrades-20.j2
|
||||
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Déployer le script de notification Discord
|
||||
ansible.builtin.template:
|
||||
src: ../templates/unattended-upgrades-notify.sh.j2
|
||||
dest: /usr/local/bin/unattended-upgrades-notify.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0750"
|
||||
|
||||
- name: Déployer le service systemd de notification
|
||||
ansible.builtin.template:
|
||||
src: ../templates/unattended-upgrades-notify.service.j2
|
||||
dest: /etc/systemd/system/unattended-upgrades-notify.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Recharger systemd
|
||||
|
||||
- name: Déployer le timer systemd de notification
|
||||
ansible.builtin.template:
|
||||
src: ../templates/unattended-upgrades-notify.timer.j2
|
||||
dest: /etc/systemd/system/unattended-upgrades-notify.timer
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
notify: Recharger systemd
|
||||
|
||||
- name: Activer et démarrer le timer de notification
|
||||
ansible.builtin.systemd:
|
||||
name: unattended-upgrades-notify.timer
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
- name: Vérifier la config avec un dry-run
|
||||
ansible.builtin.command: unattended-upgrade --dry-run --debug
|
||||
register: dry_run_result
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Afficher le résultat du dry-run
|
||||
ansible.builtin.debug:
|
||||
var: dry_run_result.stdout_lines
|
||||
|
||||
handlers:
|
||||
- name: Recharger systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
@@ -0,0 +1,132 @@
|
||||
---
|
||||
- name: Configure WireGuard VPN Client
|
||||
hosts: load-balancer
|
||||
become: true
|
||||
vars:
|
||||
vpn_ip: "10.0.0.12"
|
||||
vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
|
||||
vpn_server_pubkey: "VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg="
|
||||
vpn_server_ip: "131.123.42.158"
|
||||
vpn_server_port: "51820"
|
||||
vpn_network: "10.0.0.0/24"
|
||||
vpn_private_ip: "10.0.0.1"
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install WireGuard and tools
|
||||
apt:
|
||||
name:
|
||||
- wireguard
|
||||
- wireguard-tools
|
||||
state: present
|
||||
|
||||
- name: Create WireGuard config directory
|
||||
file:
|
||||
path: /etc/wireguard
|
||||
state: directory
|
||||
mode: '0700'
|
||||
|
||||
- name: Create WireGuard config
|
||||
copy:
|
||||
content: |
|
||||
[Interface]
|
||||
Address = {{ vpn_ip }}/32
|
||||
ListenPort = 51821
|
||||
PrivateKey = {{ vpn_private_key }}
|
||||
|
||||
[Peer]
|
||||
PublicKey = {{ vpn_server_pubkey }}
|
||||
Endpoint = {{ vpn_server_ip }}:{{ vpn_server_port }}
|
||||
AllowedIPs = {{ vpn_network }}
|
||||
PersistentKeepalive = 25
|
||||
dest: /etc/wireguard/wg0.conf
|
||||
mode: '0600'
|
||||
register: wg_config
|
||||
|
||||
- name: Enable WireGuard service
|
||||
systemd:
|
||||
name: wg-quick@wg0
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Redémarrer WireGuard si la config a changé (state:started ne recharge pas seul)
|
||||
systemd:
|
||||
name: wg-quick@wg0
|
||||
state: restarted
|
||||
when: wg_config.changed
|
||||
|
||||
- name: Enregistrer le pair load-balancer sur le serveur VPN
|
||||
hosts: vpn-uber
|
||||
become: true
|
||||
vars:
|
||||
vpn_ip: "10.0.0.12"
|
||||
vpn_private_key: "+E1pcelkLIr0x6FcOofnAWAFr6g5qHu8QHpG1sY6mG4="
|
||||
|
||||
tasks:
|
||||
- name: Calculer la clé publique du client à partir de sa clé privée
|
||||
command: wg pubkey
|
||||
args:
|
||||
stdin: "{{ vpn_private_key }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: client_pubkey
|
||||
changed_when: false
|
||||
no_log: true
|
||||
tags: [vpn]
|
||||
|
||||
- name: Ajouter le pair dans wg0.conf
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/wireguard/wg0.conf
|
||||
marker: "# {mark} PEER load-balancer"
|
||||
insertafter: EOF
|
||||
block: |
|
||||
[Peer]
|
||||
PublicKey = {{ client_pubkey.stdout }}
|
||||
AllowedIPs = {{ vpn_ip }}/32
|
||||
register: peer_added
|
||||
tags: [vpn]
|
||||
|
||||
|
||||
- name: Appliquer la config sans couper les autres pairs
|
||||
ansible.builtin.shell: wg syncconf wg0 <(wg-quick strip wg0)
|
||||
args:
|
||||
executable: /bin/bash
|
||||
when: peer_added.changed
|
||||
tags: [vpn]
|
||||
|
||||
- name: Vérifier la connectivité VPN du load-balancer
|
||||
hosts: load-balancer
|
||||
become: true
|
||||
vars:
|
||||
vpn_ip: "10.0.0.12"
|
||||
vpn_private_ip: "10.0.0.1"
|
||||
|
||||
tasks:
|
||||
- name: Wait for VPN connection to establish
|
||||
pause:
|
||||
seconds: 3
|
||||
|
||||
- name: Check VPN connection
|
||||
command: ip addr show wg0
|
||||
register: wg_status
|
||||
changed_when: false
|
||||
|
||||
- name: Test VPN connectivity
|
||||
command: ping -c 1 "{{ vpn_private_ip }}"
|
||||
register: ping_result
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Display VPN status
|
||||
debug:
|
||||
msg: |
|
||||
VPN Configuration Complete!
|
||||
IP Address: {{ vpn_ip }}
|
||||
WireGuard Status:
|
||||
{{ wg_status.stdout }}
|
||||
|
||||
Ping result ({{ 'SUCCESS' if ping_result.rc == 0 else 'FAILED' }}):
|
||||
{{ ping_result.stdout | default('Connection test deferred') }}
|
||||
Reference in New Issue
Block a user