first commit

2026-07-22 21:01:19 +02:00
commit 8bb06f3737
57 changed files with 3529 additions and 0 deletions
@@ -0,0 +1,106 @@
+---
+- name: Installation et configuration du clamAV
+  hosts: infra
+  become: true
+  gather_facts: true
+  tasks:
+      - name: Vérifier si ClamAV existe dans les dépôts
+        ansible.builtin.command: apt-cache search ^clamav$
+        register: clamav_search
+        changed_when: false
+
+      - name: Afficher résultat
+        ansible.builtin.debug:
+            var: clamav_search.stdout
+
+      - name: Installer ClamAV si disponible
+        ansible.builtin.apt:
+            name:
+                - clamav
+                - clamav-daemon
+            state: present
+            update_cache: true
+        when: clamav_search.stdout != ""
+
+      - name: Démarrer ClamAV
+        ansible.builtin.service:
+            name: clamav-daemon
+            state: started
+            enabled: true
+        when: clamav_search.stdout != ""
+
+      - name: Arrêter clamav-freshclam avant la mise à jour
+        ansible.builtin.service:
+            name: clamav-freshclam
+            state: stopped
+        when: clamav_search.stdout != ""
+
+      - name: Mettre à jour la base de données virale (freshclam)
+        ansible.builtin.command: freshclam
+        register: freshclam_result
+        changed_when: "'Database updated' in freshclam_result.stdout"
+        failed_when: freshclam_result.rc != 0
+        when: clamav_search.stdout != ""
+
+      - name: Redémarrer clamav-freshclam après la mise à jour
+        ansible.builtin.service:
+            name: clamav-freshclam
+            state: started
+            enabled: true
+        when: clamav_search.stdout != ""
+
+      - name: Configurer ClamAV - activer la détection PUA
+        ansible.builtin.lineinfile:
+            path: /etc/clamav/clamd.conf
+            regexp: "^#?DetectPUA"
+            line: "DetectPUA yes"
+            backup: true
+        when: clamav_search.stdout != ""
+        notify: Redémarrer clamav-daemon
+
+      - name: Configurer ClamAV - activer les logs
+        ansible.builtin.lineinfile:
+            path: /etc/clamav/clamd.conf
+            regexp: "^#?LogFile "
+            line: "LogFile /var/log/clamav/clamav.log"
+            backup: true
+        when: clamav_search.stdout != ""
+        notify: Redémarrer clamav-daemon
+
+      - name: Configurer ClamAV - taille max des fichiers scannés
+        ansible.builtin.lineinfile:
+            path: /etc/clamav/clamd.conf
+            regexp: "^#?MaxFileSize"
+            line: "MaxFileSize 100M"
+            backup: true
+        when: clamav_search.stdout != ""
+        notify: Redémarrer clamav-daemon
+
+      - name: Planifier un scan quotidien via cron
+        ansible.builtin.cron:
+            name: "ClamAV daily scan"
+            minute: "30"
+            hour: "2"
+            job: >
+                ionice -c 3 nice -n 19
+                docker exec gestion-clamav
+                clamscan -r /home /tmp /app/uploads
+                --log=/var/log/clamav/daily_scan.log --quiet
+            user: root
+        when: clamav_search.stdout != ""
+
+      - name: Afficher résultat final
+        ansible.builtin.debug:
+            msg: "ClamAV installé et configuré avec succès"
+        when: clamav_search.stdout != ""
+
+      - name: Afficher message si ClamAV non disponible
+        ansible.builtin.debug:
+            msg: "ClamAV n'est pas disponible dans les dépôts"
+        when: clamav_search.stdout == ""
+
+  handlers:
+      - name: Redémarrer clamav-daemon
+        ansible.builtin.service:
+            name: clamav-daemon
+            state: restarted