Xor290/ansible-mln
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update

Browse Source
This commit is contained in:
Xor290
2026-08-08 12:04:57 +02:00
parent 56aef1fa9b
commit 8e36acd812
76 changed files with 12710 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/s3-backup/.env
+2
View File
@@ -0,0 +1,2 @@
RUSTFS_ACCESS_KEY=iBacJPHUHSf6SMTnxrr
RUSTFS_SECRET_KEY=4jNzZhstv1WkwTwtvR4gHSbrx01m4sJl4LBBleeJ
monitoring/s3-backup/backup.py
+141
View File
@@ -0,0 +1,141 @@
#!/usr/bin/env python3
"""
Script de dump PostgreSQL + upload vers MinIO
SDK officiel MinIO + contournement certificat auto-signe
"""
import os
import ssl
import subprocess
import sys
from pathlib import Path
import urllib3
# Configuration PostgreSQL
PG_VERSION = "16"
DB_HOST = "localhost"
DB_PORT = 5432
DB_NAME = "gestion_commande_db"
DB_USER = "admin_gestion_commande_db"
DB_PASSWORD = "1SWDxH20rV7K2Uc2PNlwCaCxfVZEtKomF0CK9OMh"
# Configuration MinIO
MINIO_ENDPOINT = "10.0.0.4:9000"
MINIO_ACCESS_KEY = "admin"
MINIO_SECRET_KEY = "admin@12345"
MINIO_BUCKET = "backup-db-prod-mln"
MINIO_OBJECT = f"postgresql/{DB_NAME}.dump"
MINIO_SECURE = False # HTTPS
# Fichier local temporaire
OUTPUT_DIR = Path("./dumps")
OUTPUT_DIR.mkdir(parents=True, exist_ok=True)
DUMP_FILE = OUTPUT_DIR / f"{DB_NAME}.dump"
def find_pg_dump() -> str:
candidates = [
f"/usr/lib/postgresql/{PG_VERSION}/bin/pg_dump",
f"/usr/pgsql-{PG_VERSION}/bin/pg_dump",
"/usr/bin/pg_dump",
"/usr/local/bin/pg_dump",
]
for path in candidates:
if Path(path).exists():
return path
result = subprocess.run(["which", "pg_dump"], capture_output=True, text=True)
if result.returncode == 0:
return result.stdout.strip()
sys.exit("pg_dump introuvable.")
def run_dump(pg_dump: str) -> None:
env = os.environ.copy()
env["PGPASSWORD"] = DB_PASSWORD
cmd = [
pg_dump,
"--host",
DB_HOST,
"--port",
str(DB_PORT),
"--username",
DB_USER,
"--dbname",
DB_NAME,
"--format",
"custom",
"--compress",
"9",
"--verbose",
"--file",
str(DUMP_FILE),
]
print(f"[1/2] Dump -> {DUMP_FILE}")
result = subprocess.run(cmd, env=env, capture_output=True, text=True)
if result.stderr:
print(result.stderr)
if result.returncode != 0:
sys.exit(f"Echec du dump (code {result.returncode})")
size_mb = DUMP_FILE.stat().st_size / 1024 / 1024
print(f" OK ({size_mb:.2f} Mo)")
def upload_to_minio() -> None:
from minio import Minio
print(f"[2/2] Upload -> {MINIO_ENDPOINT}/{MINIO_BUCKET}/{MINIO_OBJECT}")
# Contexte SSL qui accepte les certificats auto-signes
ssl_ctx = ssl.create_default_context()
ssl_ctx.check_hostname = False
ssl_ctx.verify_mode = ssl.CERT_NONE
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
http_client = urllib3.PoolManager(
ssl_context=ssl_ctx,
cert_reqs="CERT_NONE",
)
client = Minio(
MINIO_ENDPOINT,
access_key=MINIO_ACCESS_KEY,
secret_key=MINIO_SECRET_KEY,
secure=MINIO_SECURE,
http_client=http_client,
)
if not client.bucket_exists(MINIO_BUCKET):
client.make_bucket(MINIO_BUCKET)
print(f" Bucket '{MINIO_BUCKET}' cree.")
client.fput_object(
bucket_name=MINIO_BUCKET,
object_name=MINIO_OBJECT,
file_path=str(DUMP_FILE),
content_type="application/octet-stream",
)
print(f" OK : s3://{MINIO_BUCKET}/{MINIO_OBJECT}")
DUMP_FILE.unlink()
print(f" Fichier local supprime.")
if __name__ == "__main__":
try:
from minio import Minio # noqa
except ImportError:
sys.exit("SDK MinIO manquant : pip install minio")
pg_dump_bin = find_pg_dump()
print(f"pg_dump : {pg_dump_bin}\n")
run_dump(pg_dump_bin)
upload_to_minio()
print("\nBackup termine avec succes !")
print(f" s3://{MINIO_BUCKET}/{MINIO_OBJECT}")
monitoring/s3-backup/docker-compose.yml
+104
View File
@@ -0,0 +1,104 @@
services:
nginx:
image: nginx:alpine
container_name: s3_nginx
restart: unless-stopped
ports:
- "10.0.0.4:80:80"
- "10.0.0.4:8080:8080"
- "10.0.0.4:9000:9000"
- "10.0.0.4:9001:9001"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
- ./certs:/etc/nginx/certs:ro
- nginx_logs:/var/log/nginx
depends_on:
- minio
networks:
- s3_net
minio:
image: minio/minio:latest
container_name: s3_minio
restart: unless-stopped
hostname: minio
volumes:
- /mnt/data:/data
environment:
- MINIO_ROOT_USER=admin
- MINIO_ROOT_PASSWORD=admin@12345
- MINIO_ADDRESS=:9000
- MINIO_CONSOLE_ADDRESS=:9001
command: minio server /data --console-address :9001
networks:
- s3_net
dozzle-agent:
image: amir20/dozzle:latest
command: agent
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
ports:
- "10.0.0.4:7007:7007"
restart: unless-stopped
beszel-agent:
image: henrygd/beszel-agent:latest
container_name: beszel_agent
restart: unless-stopped
network_mode: host
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
PORT: "10001"
KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwRVn66crRDX5iL0bxNOnrp3OhTiXHKs+COx/bo5vmQ beszel-agent"
# ─── ClamAV Antivirus ─────────────────────────────────────────
clamav:
image: clamav/clamav:stable
container_name: s3_clamav
restart: unless-stopped
environment:
- FRESHCLAM_CHECKS=24
- CLAMD_SCAN_MAX_FILESIZE=200M
- CLAMD_SCAN_MAX_SCANSIZE=200M
volumes:
- clamav_db:/var/lib/clamav
- clamav_logs:/var/log/clamav
networks:
- s3_net
clamav-scanner:
image: clamav/clamav:stable
container_name: s3_clamav_scanner
restart: unless-stopped
depends_on:
- clamav
volumes:
- clamav_db:/var/lib/clamav:ro
- clamav_scan_logs:/var/log/clamav
- /mnt/data:/scan:ro
entrypoint: >
/bin/sh -c "
echo 'Waiting for virus definitions...' &&
until [ -f /var/lib/clamav/daily.cvd ] || [ -f /var/lib/clamav/daily.cld ]; do sleep 10; done &&
while true; do
DATE=$$(date +%Y%m%d_%H%M%S) &&
LOG=/var/log/clamav/scan-$$DATE.log &&
echo \"[$$DATE] Scan started\" | tee -a $$LOG &&
clamscan --recursive --infected --log=$$LOG /scan &&
echo \"[$$DATE] Scan complete\" | tee -a $$LOG &&
sleep 86400;
done"
networks:
- s3_net
networks:
s3_net:
driver: bridge
volumes:
nginx_logs:
clamav_db:
clamav_logs:
clamav_scan_logs:
monitoring/s3-backup/nginx/nginx.conf
+96
View File
@@ -0,0 +1,96 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
resolver 127.0.0.11 valid=10s ipv6=off;
# ── MinIO Console GUI HTTPS (VPN: 10.0.0.4:8080) ────────
server {
listen 8080 ssl;
server_name 10.0.0.4 _;
ssl_certificate /etc/nginx/certs/cert.pem;
ssl_certificate_key /etc/nginx/certs/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/minio_console_access.log;
error_log /var/log/nginx/minio_console_error.log;
location / {
proxy_pass http://minio:9001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── HTTP Redirect to HTTPS (VPN: 10.0.0.4:80) ────────────
server {
listen 80;
server_name _;
location / {
return 301 https://$host:8080$request_uri;
}
}
# ── MinIO Console Direct HTTPS (VPN: 10.0.0.4:9001) ──────
server {
listen 9001 ssl;
server_name 10.0.0.4 _;
ssl_certificate /etc/nginx/certs/cert.pem;
ssl_certificate_key /etc/nginx/certs/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/minio_console_direct_access.log;
error_log /var/log/nginx/minio_console_direct_error.log;
location / {
proxy_pass http://minio:9001;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
proxy_read_timeout 300s;
client_max_body_size 500m;
}
}
# ── MinIO S3 API HTTP (VPN: 10.0.0.4:9000) ────────────────
server {
listen 9000;
server_name 10.0.0.4 _;
access_log /var/log/nginx/minio_s3_api_access.log;
error_log /var/log/nginx/minio_s3_api_error.log;
location / {
proxy_pass http://minio:9000;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto http;
proxy_buffering off;
proxy_read_timeout 300s;
client_max_body_size 2g;
}
}
}