first commit
This commit is contained in:
Nuxgrid
@@ -0,0 +1,308 @@
|
||||
---
|
||||
# ============================================
|
||||
# PostgreSQL Installation (vm-postgres uniquement)
|
||||
# ============================================
|
||||
- name: Installation et configuration de PostgreSQL
|
||||
hosts: bdd-redis-prod
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
# ============================================================
|
||||
# Dépendances requises
|
||||
# ============================================================
|
||||
- name: Installer les dépendances pour le dépôt APT
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- gnupg2
|
||||
- curl
|
||||
- ca-certificates
|
||||
- lsb-release
|
||||
- python3-psycopg2
|
||||
- acl
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
# ============================================================
|
||||
# Ajout du dépôt officiel PostgreSQL
|
||||
# ============================================================
|
||||
- name: Ajouter la clé GPG du dépôt PostgreSQL
|
||||
ansible.builtin.apt_key:
|
||||
url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
|
||||
state: present
|
||||
|
||||
- name: Ajouter le dépôt PostgreSQL 16
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main"
|
||||
state: present
|
||||
filename: pgdg
|
||||
|
||||
# ============================================================
|
||||
# Installation PostgreSQL 16
|
||||
# ============================================================
|
||||
- name: Installer PostgreSQL 16
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "postgresql-{{ pg_version }}"
|
||||
- "postgresql-client-{{ pg_version }}"
|
||||
- "postgresql-contrib-{{ pg_version }}"
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Démarrer et activer PostgreSQL
|
||||
ansible.builtin.systemd:
|
||||
name: postgresql
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
# ============================================================
|
||||
# Configuration PostgreSQL
|
||||
# ============================================================
|
||||
- name: Configurer l'écoute sur localhost
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
||||
regexp: "^#?listen_addresses"
|
||||
line: "listen_addresses = 'localhost'"
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configurer le port
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
||||
regexp: "^#?port"
|
||||
line: "port = {{ db_port }}"
|
||||
notify: Restart postgresql
|
||||
|
||||
# ============================================================
|
||||
# Locale requise
|
||||
# ============================================================
|
||||
- name: Générer la locale fr_FR.UTF-8
|
||||
ansible.builtin.command: locale-gen fr_FR.UTF-8
|
||||
register: locale_gen
|
||||
changed_when: "'Generation complete' in locale_gen.stdout"
|
||||
|
||||
- name: Mettre à jour les locales
|
||||
ansible.builtin.command: update-locale
|
||||
when: locale_gen.changed
|
||||
|
||||
# ============================================================
|
||||
# Création de la base de données et configuration utilisateur
|
||||
# ============================================================
|
||||
- name: Définir le mot de passe de l'utilisateur postgres
|
||||
become_user: postgres
|
||||
ansible.builtin.postgresql_user:
|
||||
name: "{{ db_user }}"
|
||||
password: "{{ db_password }}"
|
||||
state: present
|
||||
|
||||
- name: Vérifier si la base de données existe
|
||||
become_user: postgres
|
||||
ansible.builtin.command: psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{ db_name }}'"
|
||||
register: db_exists
|
||||
changed_when: false
|
||||
|
||||
- name: Créer la base de données avec ICU
|
||||
become_user: postgres
|
||||
ansible.builtin.command: >
|
||||
psql -c "CREATE DATABASE {{ db_name }}
|
||||
OWNER {{ db_user }}
|
||||
ENCODING 'UTF8'
|
||||
LOCALE_PROVIDER icu
|
||||
ICU_LOCALE 'fr-FR'
|
||||
TEMPLATE template0"
|
||||
when: db_exists.stdout != "1"
|
||||
|
||||
- name: Accorder tous les privilèges sur la base
|
||||
become_user: postgres
|
||||
ansible.builtin.postgresql_privs:
|
||||
db: "{{ db_name }}"
|
||||
role: "{{ db_user }}"
|
||||
type: database
|
||||
privs: ALL
|
||||
state: present
|
||||
|
||||
# ============================================================
|
||||
# Authentification pg_hba.conf
|
||||
# ============================================================
|
||||
- name: Configurer l'authentification md5 pour les connexions locales
|
||||
ansible.builtin.postgresql_pg_hba:
|
||||
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
||||
contype: host
|
||||
databases: "{{ db_name }}"
|
||||
users: "{{ db_user }}"
|
||||
source: "127.0.0.1/32"
|
||||
method: md5
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configurer l'authentification md5 pour IPv6 local
|
||||
ansible.builtin.postgresql_pg_hba:
|
||||
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
||||
contype: host
|
||||
databases: "{{ db_name }}"
|
||||
users: "{{ db_user }}"
|
||||
source: "::1/128"
|
||||
method: md5
|
||||
notify: Restart postgresql
|
||||
|
||||
# ============================================================
|
||||
# Vérification
|
||||
# ============================================================
|
||||
- name: Vérifier la version de PostgreSQL
|
||||
become_user: postgres
|
||||
ansible.builtin.command: psql --version
|
||||
register: pg_version_check
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher la version
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ pg_version_check.stdout }}"
|
||||
|
||||
- name: Vérifier que la base existe
|
||||
become_user: postgres
|
||||
ansible.builtin.command: psql -lqt
|
||||
register: pg_databases
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher les bases de données
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ pg_databases.stdout_lines }}"
|
||||
|
||||
handlers:
|
||||
- name: Restart postgresql
|
||||
ansible.builtin.systemd:
|
||||
name: postgresql
|
||||
state: restarted
|
||||
|
||||
# ============================================
|
||||
# Redis Installation (vm-redis uniquement)
|
||||
# ============================================
|
||||
- name: Installation et configuration de Redis
|
||||
hosts: bdd-redis-prod
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Installer Redis
|
||||
apt:
|
||||
name:
|
||||
- redis-server
|
||||
- python3-redis
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Créer le répertoire de backup Redis
|
||||
file:
|
||||
path: /var/lib/redis/backup
|
||||
state: directory
|
||||
owner: redis
|
||||
group: redis
|
||||
mode: "0755"
|
||||
|
||||
- name: Configurer Redis - bind address (accepter connexions réseau)
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^bind"
|
||||
line: "bind 127.0.0.1 {{ vpn_ip }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - port
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^port"
|
||||
line: "port {{ redis_port }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - maxmemory
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?maxmemory"
|
||||
line: "maxmemory {{ redis_maxmemory }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - maxmemory-policy
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?maxmemory-policy"
|
||||
line: "maxmemory-policy {{ redis_maxmemory_policy }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - requirepass
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?requirepass"
|
||||
line: "requirepass {{ redis_password }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Activer AOF (Append Only File) pour Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^appendonly"
|
||||
line: "appendonly yes"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer la fréquence de sync AOF
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?appendfsync"
|
||||
line: "appendfsync everysec"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Activer la persistance RDB (snapshots)
|
||||
blockinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
block: |
|
||||
save 900 1
|
||||
save 300 10
|
||||
save 60 10000
|
||||
marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE"
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer le nom du fichier AOF
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^appendfilename"
|
||||
line: 'appendfilename "appendonly.aof"'
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Désactiver le mode protégé Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^protected-mode"
|
||||
line: "protected-mode no"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer le répertoire de travail Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^dir"
|
||||
line: "dir /var/lib/redis"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Définir le niveau de log
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^loglevel"
|
||||
line: "loglevel notice"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: S'assurer que Redis est démarré
|
||||
systemd:
|
||||
name: redis-server
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
handlers:
|
||||
- name: Redémarrer Redis
|
||||
systemd:
|
||||
name: redis-server
|
||||
state: restarted
|
||||
@@ -0,0 +1,172 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: replica-prod
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- acl
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: docker
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
tags: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
tags: docker
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: docker
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: ansible_user is defined
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
tags: docker
|
||||
|
||||
- name: Copy Docker project
|
||||
ansible.builtin.copy:
|
||||
src: "{{ compose_project_dir }}"
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: project
|
||||
|
||||
- name: Set permissions for .env file
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/.env.example"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
tags: project
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Set permissions for lbtelegram.env file
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/.env.lbtelegram"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
tags: project
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Create certs folder
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/certs"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0750"
|
||||
tags: project
|
||||
@@ -0,0 +1,155 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: bdd-redis-prod
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- acl
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
tags: docker
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
tags: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
tags: docker
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: docker
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
tags: docker
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ user_deploy }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: user_deploy is defined
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
tags: docker
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
tags: docker
|
||||
|
||||
- name: Copy Docker project
|
||||
ansible.builtin.copy:
|
||||
src: ../../monitoring/s3-img
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
tags: project
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: project-fin
|
||||
|
||||
- name: Set permissions for .env file
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/.env"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
tags: project
|
||||
ignore_errors: yes
|
||||
Reference in New Issue
Block a user