chore: delete ansible
This commit is contained in:
+1
-1
@@ -2,4 +2,4 @@
|
||||
**/.expo/
|
||||
test_address.sh
|
||||
easpip
|
||||
ansible
|
||||
ansible/
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
[defaults]
|
||||
inventory = inventory/host.ini
|
||||
host_key_checking = False
|
||||
interpreter_python = auto_silent
|
||||
|
||||
[privilege_escalation]
|
||||
become = True
|
||||
become_method = sudo
|
||||
become_user = root
|
||||
@@ -1,39 +0,0 @@
|
||||
pg_version: "16"
|
||||
db_user: admin_gestion_commande_db
|
||||
db_name: gestion_commande_db
|
||||
db_password: "hb-FS462(#I~6(4',Nt=3Rd4567890jsezZ"
|
||||
db_host: "localhost"
|
||||
db_port: 5432
|
||||
# Redis Configuration
|
||||
redis_bind: "127.0.0.1"
|
||||
redis_port: 6379
|
||||
redis_maxmemory: "1024mb"
|
||||
redis_maxmemory_policy: "allkeys-lru"
|
||||
redis_password: "uQ64h5UhFdrm!H|_cCQer"
|
||||
|
||||
# ============================================
|
||||
# Configuration Nginx et Applications
|
||||
# ============================================
|
||||
|
||||
directory: "/home/ubuntu"
|
||||
backend_dir: "/home/ubuntu/backend"
|
||||
backend_binary: "/home/ubuntu/backend/main"
|
||||
uploads_dir: "/home/ubuntu/backend/uploads"
|
||||
frontend_port: 5173
|
||||
domain_name: "uber-demo.club"
|
||||
# Utilisateurs et permissions
|
||||
user_web: "www-data" # Utilisateur pour les applications web
|
||||
user_deploy: "ubuntu" # Utilisateur pour le déploiement
|
||||
user_owner: "root" # Propriétaire des fichiers systemd
|
||||
ip: "5.181.0.112"
|
||||
# Backend
|
||||
backend_local_port: 8080
|
||||
backend_port: 80
|
||||
# Timeouts
|
||||
nginx_proxy_timeout: 60
|
||||
|
||||
# Upload Size
|
||||
nginx_max_body_size: "10M"
|
||||
|
||||
# Security
|
||||
nginx_enable_firewall: true
|
||||
@@ -1,13 +0,0 @@
|
||||
[all]
|
||||
uber-stup ansible_host=5.252.20.129 ansible_user=root ansible_ssh_pass=rL9lY6YkcDQmfRuZ3Z
|
||||
uber-stup-web ansible_host=185.234.9.102 ansible_user=root ansible_ssh_pass=hTASFYOydY46haeO3J
|
||||
demo-uber ansible_host=5.181.0.112 ansible_user=root ansible_ssh_pass=jQCpl49FcISQfHaF8j
|
||||
|
||||
[uber-stup]
|
||||
uber-stup ansible_host=5.252.20.129 ansible_user=root ansible_ssh_pass=rL9lY6YkcDQmfRuZ3Z
|
||||
|
||||
[uber-stup-web]
|
||||
uber-stup-web ansible_host=185.234.9.102 ansible_user=root ansible_ssh_pass=hTASFYOydY46haeO3J
|
||||
|
||||
[demo-uber]
|
||||
demo-uber ansible_host=5.181.0.112 ansible_user=root ansible_ssh_pass=jQCpl49FcISQfHaF8j
|
||||
@@ -1,316 +0,0 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: demo-uber
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update and upgrade
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
upgrade: "dist"
|
||||
|
||||
- name: install basic dependencies
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- curl
|
||||
- wget
|
||||
- tar
|
||||
- rsync
|
||||
- acl
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Download Go 1.23.0 tarball
|
||||
ansible.builtin.get_url:
|
||||
url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz
|
||||
dest: /tmp/go1.23.0.linux-amd64.tar.gz
|
||||
mode: "0644"
|
||||
|
||||
- name: Extract Go 1.23.0
|
||||
ansible.builtin.unarchive:
|
||||
src: /tmp/go1.23.0.linux-amd64.tar.gz
|
||||
dest: /usr/local
|
||||
remote_src: yes
|
||||
|
||||
- name: Ensure Go 1.23 is in PATH for all users
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/profile.d/go.sh
|
||||
line: "export PATH=/usr/local/go/bin:$PATH"
|
||||
create: yes
|
||||
state: present
|
||||
mode: "0644"
|
||||
|
||||
- name: Check Go versions
|
||||
ansible.builtin.shell: |
|
||||
echo "Go: $(go version)"
|
||||
register: versions_check
|
||||
changed_when: false
|
||||
failed_when: versions_check.rc != 0
|
||||
|
||||
- name: Display all versions
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ versions_check.stdout_lines }}"
|
||||
|
||||
# ============================================
|
||||
# FRONTEND
|
||||
# ============================================
|
||||
|
||||
- name: Create /var/www if not exists
|
||||
ansible.builtin.file:
|
||||
path: /var/www
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Créer l'utilisateur de déploiement s'il n'existe pas
|
||||
ansible.builtin.user:
|
||||
name: "{{ user_deploy }}"
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
|
||||
- name: Ensure /home/{{ user_deploy }} exists with correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "/home/{{ user_deploy }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
# ============================================
|
||||
# BACKEND
|
||||
# ============================================
|
||||
|
||||
- name: Create backend directory with deploy user ownership
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Synchroniser le backend Go
|
||||
ansible.builtin.synchronize:
|
||||
src: ../backend/gestion/
|
||||
dest: "{{ backend_dir }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=.git"
|
||||
- "--exclude=.gitignore"
|
||||
- "--exclude=docker-compose.yml"
|
||||
- "--exclude=.env"
|
||||
- "--no-owner"
|
||||
- "--no-group"
|
||||
delete: yes
|
||||
recursive: yes
|
||||
tags: backend
|
||||
|
||||
- name: Fix backend ownership after rsync (rsync tourne en root)
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
recurse: yes
|
||||
tags: backend
|
||||
|
||||
- name: Remove old binary if owned by another user
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}/main"
|
||||
state: absent
|
||||
tags: backend
|
||||
|
||||
- name: Compile backend as deploy user
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.shell: |
|
||||
export PATH=/usr/local/go/bin:$PATH
|
||||
go mod tidy
|
||||
go build -o main .
|
||||
args:
|
||||
chdir: "{{ backend_dir }}"
|
||||
executable: /bin/bash
|
||||
tags: backend
|
||||
|
||||
- name: Set ownership to www-data for runtime
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
recurse: yes
|
||||
tags: backend
|
||||
|
||||
- name: Set executable permission on backend binary
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_binary }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
tags: backend
|
||||
|
||||
# ============================================
|
||||
# SYSTEMD SERVICES
|
||||
# ============================================
|
||||
|
||||
- name: Create systemd service for backend
|
||||
ansible.builtin.template:
|
||||
src: ./templates/backend.service.j2
|
||||
dest: /etc/systemd/system/backend.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
tags: backend
|
||||
|
||||
- name: Reload systemd daemon
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: yes
|
||||
tags: backend
|
||||
|
||||
- name: Enable and restart backend service
|
||||
ansible.builtin.systemd:
|
||||
name: backend
|
||||
enabled: yes
|
||||
state: restarted
|
||||
tags: backend
|
||||
|
||||
- name: Wait for backend to be ready
|
||||
ansible.builtin.wait_for:
|
||||
port: "{{ backend_local_port }}"
|
||||
delay: 2
|
||||
timeout: 30
|
||||
tags: backend
|
||||
|
||||
- name: Display service status
|
||||
ansible.builtin.shell: |
|
||||
echo "=== Backend Service ==="
|
||||
systemctl status backend --no-pager || true
|
||||
register: service_status
|
||||
changed_when: false
|
||||
tags: backend
|
||||
|
||||
- name: Show service status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ service_status.stdout_lines }}"
|
||||
tags: backend
|
||||
|
||||
- name: Configuration UFW
|
||||
ansible.builtin.ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- 80
|
||||
- 22
|
||||
|
||||
- name: Activation du firewall
|
||||
ansible.builtin.ufw:
|
||||
state: enabled
|
||||
|
||||
# - name: Vérifier si un certificat existe déjà
|
||||
# ansible.builtin.stat:
|
||||
# path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
# register: cert_file
|
||||
# tags: [certbot]
|
||||
#
|
||||
- name: Déployer la configuration Nginx HTTP
|
||||
ansible.builtin.template:
|
||||
src: templates/nginx2.conf.j2
|
||||
dest: /etc/nginx/sites-available/api
|
||||
vars:
|
||||
ssl_enabled: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Activation du site Nginx
|
||||
ansible.builtin.file:
|
||||
src: /etc/nginx/sites-available/api
|
||||
dest: /etc/nginx/sites-enabled/api
|
||||
state: link
|
||||
force: yes
|
||||
tags: [certbot]
|
||||
|
||||
- name: Suppression du site par défaut
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
tags: [certbot]
|
||||
|
||||
- name: Test de la configuration Nginx
|
||||
ansible.builtin.command: nginx -t
|
||||
changed_when: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Redémarrage de Nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
enabled: yes
|
||||
tags: [certbot]
|
||||
|
||||
# ============================================================
|
||||
# Certificat SSL Let's Encrypt
|
||||
# ============================================================
|
||||
# - name: Générer le certificat SSL avec Certbot
|
||||
# ansible.builtin.command: >
|
||||
# certbot certonly --nginx
|
||||
# -d {{ domain_name }}
|
||||
# --non-interactive
|
||||
# --agree-tos
|
||||
# --email admin@{{ domain_name }}
|
||||
# tags: [certbot]
|
||||
|
||||
# ============================================================
|
||||
# Nginx - reconfiguration HTTPS après certificat
|
||||
# ============================================================
|
||||
# - name: Vérifier la présence du certificat
|
||||
# ansible.builtin.stat:
|
||||
# path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
# register: cert_file_after
|
||||
# tags: [nginx]
|
||||
|
||||
#- name: Déployer la configuration Nginx HTTPS
|
||||
# ansible.builtin.template:
|
||||
# src: templates/nginx.conf.j2
|
||||
# dest: /etc/nginx/sites-available/api
|
||||
# vars:
|
||||
# ssl_enabled: true
|
||||
# when: cert_file_after.stat.exists
|
||||
# notify: Restart nginx
|
||||
# tags: [nginx]
|
||||
|
||||
#- name: Test de la configuration Nginx finale
|
||||
# ansible.builtin.command: nginx -t
|
||||
# changed_when: false
|
||||
# tags: [nginx]
|
||||
|
||||
# - name: Redémarrage de Nginx avec SSL
|
||||
# ansible.builtin.systemd:
|
||||
# name: nginx
|
||||
# state: restarted
|
||||
# when: cert_file_after.stat.exists
|
||||
# tags: [nginx]
|
||||
|
||||
# - name: Vérifier le renouvellement automatique
|
||||
# ansible.builtin.command: certbot renew --dry-run
|
||||
# register: certbot_renew
|
||||
# changed_when: false
|
||||
# failed_when: false
|
||||
# tags: [certbot]
|
||||
|
||||
# - name: Afficher le statut du renouvellement
|
||||
# ansible.builtin.debug:
|
||||
# msg: "{{ certbot_renew.stdout_lines }}"
|
||||
# tags: [certbot]
|
||||
|
||||
handlers:
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Restart nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
@@ -1,198 +0,0 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: backend
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- software-properties-common
|
||||
- acl
|
||||
state: present
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: ansible_user is defined
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
|
||||
- name: Create frontend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Create backend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Synchronize frontend content (excluding node_modules and .git)
|
||||
ansible.builtin.synchronize:
|
||||
src: ../frontend-prep
|
||||
dest: "{{ nginx_frontend_path }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=node_modules"
|
||||
- "--exclude=.git"
|
||||
- "--exclude=dist"
|
||||
- "--exclude=build"
|
||||
delete: no
|
||||
recursive: yes
|
||||
tags: sync_frontend
|
||||
|
||||
- name: Set ownership for frontend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: sync_frontend
|
||||
|
||||
- name: Synchronize backend content (excluding node_modules and .git)
|
||||
ansible.builtin.synchronize:
|
||||
src: ../backend
|
||||
dest: "{{ backend_dir }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=node_modules"
|
||||
- "--exclude=.git"
|
||||
- "--exclude=dist"
|
||||
- "--exclude=build"
|
||||
delete: no
|
||||
recursive: yes
|
||||
tags: sync_backend
|
||||
|
||||
- name: Set ownership for backend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: sync_backend
|
||||
|
||||
- name: Copy Docker project
|
||||
ansible.builtin.copy:
|
||||
src: ../docker/
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
|
||||
- name: Set permissions for .env file
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/.env"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
ignore_errors: yes
|
||||
@@ -1,142 +0,0 @@
|
||||
---
|
||||
# ============================================
|
||||
# Fail2Ban Installation et configuration
|
||||
# ============================================
|
||||
- name: Installation et configuration de Fail2Ban
|
||||
hosts: uber-stup-web
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
vars:
|
||||
fail2ban_bantime: "1h"
|
||||
fail2ban_findtime: "10m"
|
||||
fail2ban_maxretry: 5
|
||||
fail2ban_ignoreip: "127.0.0.1/8 ::1"
|
||||
|
||||
tasks:
|
||||
# ============================================================
|
||||
# Installation
|
||||
# ============================================================
|
||||
- name: Installer Fail2Ban
|
||||
ansible.builtin.apt:
|
||||
name: fail2ban
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
# ============================================================
|
||||
# Configuration globale (jail.local)
|
||||
# ============================================================
|
||||
- name: Créer jail.local avec la configuration globale
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/fail2ban/jail.local
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[DEFAULT]
|
||||
ignoreip = {{ fail2ban_ignoreip }}
|
||||
bantime = {{ fail2ban_bantime }}
|
||||
findtime = {{ fail2ban_findtime }}
|
||||
maxretry = {{ fail2ban_maxretry }}
|
||||
banaction = iptables-multiport
|
||||
backend = systemd
|
||||
loglevel = INFO
|
||||
|
||||
# ============================================================
|
||||
# SSH
|
||||
# ============================================================
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = ssh
|
||||
filter = sshd
|
||||
logpath = %(sshd_log)s
|
||||
maxretry = 3
|
||||
bantime = 24h
|
||||
|
||||
# ============================================================
|
||||
# Nginx - requêtes trop fréquentes (rate limit)
|
||||
# ============================================================
|
||||
[nginx-limit-req]
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = nginx-limit-req
|
||||
logpath = /var/log/nginx/error.log
|
||||
maxretry = 10
|
||||
bantime = 1h
|
||||
|
||||
# ============================================================
|
||||
# Nginx - 4xx répétés (scan, bot)
|
||||
# ============================================================
|
||||
[nginx-http-auth]
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = nginx-http-auth
|
||||
logpath = /var/log/nginx/error.log
|
||||
maxretry = 5
|
||||
bantime = 1h
|
||||
|
||||
# ============================================================
|
||||
# Nginx - bad bots / scans (404 répétés)
|
||||
# ============================================================
|
||||
[nginx-botsearch]
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = nginx-botsearch
|
||||
logpath = /var/log/nginx/access.log
|
||||
maxretry = 10
|
||||
bantime = 2h
|
||||
|
||||
# ============================================================
|
||||
# API Backend - brute force login (POST /api/v2/login)
|
||||
# ============================================================
|
||||
[backend-login]
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = backend-login
|
||||
logpath = /var/log/nginx/access.log
|
||||
maxretry = 10
|
||||
findtime = 5m
|
||||
bantime = 2h
|
||||
notify: Restart fail2ban
|
||||
|
||||
# ============================================================
|
||||
# Filtre personnalisé - brute force login API
|
||||
# ============================================================
|
||||
- name: Créer le filtre fail2ban pour le login API
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/fail2ban/filter.d/backend-login.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Definition]
|
||||
failregex = ^<HOST> .* "POST /api/v2/login HTTP/.*" (401|403) .*$
|
||||
ignoreregex =
|
||||
notify: Restart fail2ban
|
||||
|
||||
# ============================================================
|
||||
# Démarrage et activation
|
||||
# ============================================================
|
||||
- name: Démarrer et activer Fail2Ban
|
||||
ansible.builtin.systemd:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
# ============================================================
|
||||
# Vérification
|
||||
# ============================================================
|
||||
- name: Vérifier le statut de Fail2Ban
|
||||
ansible.builtin.command: fail2ban-client status
|
||||
register: fail2ban_status
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher le statut des jails
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ fail2ban_status.stdout_lines }}"
|
||||
|
||||
handlers:
|
||||
- name: Restart fail2ban
|
||||
ansible.builtin.systemd:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
@@ -1,260 +0,0 @@
|
||||
- name: Déploiement complet Frontend
|
||||
hosts: uber-stup-web
|
||||
gather_facts: true
|
||||
become: true
|
||||
vars:
|
||||
domain_name: mln-uber.club
|
||||
frontend_dir: /home/ubuntu/frontend
|
||||
frontend_port: 5173
|
||||
tasks:
|
||||
- name: Update and upgrade
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
upgrade: dist
|
||||
|
||||
- name: Install basic dependencies
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- curl
|
||||
- nginx
|
||||
- tar
|
||||
- build-essential
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
- name: Créer l'utilisateur de déploiement s'il n'existe pas
|
||||
ansible.builtin.user:
|
||||
name: "{{ user_deploy }}"
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
|
||||
- name: Ensure /home/{{ user_deploy }} exists with correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "/home/{{ user_deploy }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Setup Node.js 20 repository
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
||||
args:
|
||||
executable: /bin/bash
|
||||
creates: /etc/apt/sources.list.d/nodesource.list
|
||||
|
||||
- name: Install Node.js 20
|
||||
ansible.builtin.apt:
|
||||
name: nodejs
|
||||
state: present
|
||||
update_cache: yes
|
||||
dpkg_options: "force-overwrite"
|
||||
|
||||
- name: Verify Node.js and npm versions
|
||||
ansible.builtin.shell: |
|
||||
node -v
|
||||
npm -v
|
||||
register: versions_check
|
||||
changed_when: false
|
||||
|
||||
- name: Show versions
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ versions_check.stdout_lines }}"
|
||||
|
||||
- name: Create folder for frontend
|
||||
ansible.builtin.file:
|
||||
path: "{{ frontend_dir }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
tags: frontend
|
||||
|
||||
- name: Synchroniser le frontend (excluant node_modules et .git)
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.synchronize:
|
||||
src: ../frontend-prep/
|
||||
dest: "{{ frontend_dir }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=node_modules"
|
||||
- "--exclude=.git"
|
||||
- "--exclude=.gitignore"
|
||||
- "--exclude=build"
|
||||
delete: no
|
||||
recursive: yes
|
||||
perms: yes
|
||||
owner: yes
|
||||
rsync_path: rsync
|
||||
tags: frontend
|
||||
|
||||
- name: Install npm dependencies
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.command: npm install
|
||||
args:
|
||||
chdir: "{{ frontend_dir }}"
|
||||
tags: frontend
|
||||
|
||||
- name: Build frontend
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.command: npm run build
|
||||
args:
|
||||
chdir: "{{ frontend_dir }}"
|
||||
tags: frontend
|
||||
|
||||
- name: Install serve globally
|
||||
ansible.builtin.command: npm install -g serve
|
||||
tags: frontend
|
||||
|
||||
- name: Création du fichier systemd pour le frontend
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/frontend.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Frontend React (serve)
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User={{ user_deploy }}
|
||||
WorkingDirectory={{ frontend_dir }}
|
||||
ExecStart=/usr/bin/npx serve -s build -l {{ frontend_port }}
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
Environment="NODE_ENV=production"
|
||||
Environment="VITE_TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB"
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
notify: Reload systemd
|
||||
tags: frontend
|
||||
|
||||
- name: Enable and start frontend service
|
||||
ansible.builtin.systemd:
|
||||
name: frontend
|
||||
state: started
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
tags: frontend
|
||||
|
||||
- name: Configuration UFW
|
||||
ansible.builtin.ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "22"
|
||||
- "80"
|
||||
- "443"
|
||||
|
||||
- name: Activation du firewall
|
||||
ansible.builtin.ufw:
|
||||
state: enabled
|
||||
|
||||
- name: Vérifier si un certificat existe déjà
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
register: cert_file
|
||||
tags: [certbot]
|
||||
|
||||
- name: Déployer la configuration Nginx HTTP
|
||||
ansible.builtin.template:
|
||||
src: templates/nginx-frontend.conf.j2
|
||||
dest: /etc/nginx/sites-available/frontend
|
||||
vars:
|
||||
ssl_enabled: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Activation du site Nginx
|
||||
ansible.builtin.file:
|
||||
src: /etc/nginx/sites-available/frontend
|
||||
dest: /etc/nginx/sites-enabled/frontend
|
||||
state: link
|
||||
force: yes
|
||||
tags: [certbot]
|
||||
|
||||
- name: Suppression du site par défaut
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
tags: [certbot]
|
||||
|
||||
- name: Test de la configuration Nginx
|
||||
ansible.builtin.command: nginx -t
|
||||
changed_when: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Redémarrage de Nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
enabled: yes
|
||||
tags: [certbot]
|
||||
|
||||
# ============================================================
|
||||
# Certificat SSL Let's Encrypt
|
||||
# ============================================================
|
||||
|
||||
- name: Générer le certificat SSL avec Certbot
|
||||
ansible.builtin.command: >
|
||||
certbot certonly --nginx
|
||||
-d {{ domain_name }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
--email admin@{{ domain_name }}
|
||||
when: not cert_file.stat.exists
|
||||
tags: [certbot]
|
||||
|
||||
# ============================================================
|
||||
# Nginx - reconfiguration HTTPS après certificat
|
||||
# ============================================================
|
||||
- name: Vérifier la présence du certificat
|
||||
ansible.builtin.stat:
|
||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
||||
register: cert_file_after
|
||||
|
||||
- name: Déployer la configuration Nginx HTTPS
|
||||
ansible.builtin.template:
|
||||
src: templates/nginx-frontend.conf.j2
|
||||
dest: /etc/nginx/sites-available/frontend
|
||||
vars:
|
||||
ssl_enabled: true
|
||||
when: cert_file_after.stat.exists
|
||||
notify: Restart nginx
|
||||
tags: [nginx]
|
||||
|
||||
- name: Test de la configuration Nginx finale
|
||||
ansible.builtin.command: nginx -t
|
||||
changed_when: false
|
||||
tags: [nginx]
|
||||
|
||||
- name: Redémarrage de Nginx avec SSL
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
when: cert_file_after.stat.exists
|
||||
tags: [nginx]
|
||||
|
||||
- name: Vérifier le renouvellement automatique
|
||||
ansible.builtin.command: certbot renew --dry-run
|
||||
register: certbot_renew
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags: [certbot]
|
||||
|
||||
- name: Afficher le statut du renouvellement
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ certbot_renew.stdout_lines }}"
|
||||
tags: [certbot]
|
||||
|
||||
handlers:
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Restart nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: restarted
|
||||
@@ -1,308 +0,0 @@
|
||||
---
|
||||
# ============================================
|
||||
# PostgreSQL Installation (vm-postgres uniquement)
|
||||
# ============================================
|
||||
- name: Installation et configuration de PostgreSQL
|
||||
hosts: demo-uber
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
# ============================================================
|
||||
# Dépendances requises
|
||||
# ============================================================
|
||||
- name: Installer les dépendances pour le dépôt APT
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- gnupg2
|
||||
- curl
|
||||
- ca-certificates
|
||||
- lsb-release
|
||||
- python3-psycopg2
|
||||
- acl
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
# ============================================================
|
||||
# Ajout du dépôt officiel PostgreSQL
|
||||
# ============================================================
|
||||
- name: Ajouter la clé GPG du dépôt PostgreSQL
|
||||
ansible.builtin.apt_key:
|
||||
url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
|
||||
state: present
|
||||
|
||||
- name: Ajouter le dépôt PostgreSQL 16
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main"
|
||||
state: present
|
||||
filename: pgdg
|
||||
|
||||
# ============================================================
|
||||
# Installation PostgreSQL 16
|
||||
# ============================================================
|
||||
- name: Installer PostgreSQL 16
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "postgresql-{{ pg_version }}"
|
||||
- "postgresql-client-{{ pg_version }}"
|
||||
- "postgresql-contrib-{{ pg_version }}"
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Démarrer et activer PostgreSQL
|
||||
ansible.builtin.systemd:
|
||||
name: postgresql
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
# ============================================================
|
||||
# Configuration PostgreSQL
|
||||
# ============================================================
|
||||
- name: Configurer l'écoute sur localhost
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
||||
regexp: "^#?listen_addresses"
|
||||
line: "listen_addresses = 'localhost'"
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configurer le port
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
||||
regexp: "^#?port"
|
||||
line: "port = {{ db_port }}"
|
||||
notify: Restart postgresql
|
||||
|
||||
# ============================================================
|
||||
# Locale requise
|
||||
# ============================================================
|
||||
- name: Générer la locale fr_FR.UTF-8
|
||||
ansible.builtin.command: locale-gen fr_FR.UTF-8
|
||||
register: locale_gen
|
||||
changed_when: "'Generation complete' in locale_gen.stdout"
|
||||
|
||||
- name: Mettre à jour les locales
|
||||
ansible.builtin.command: update-locale
|
||||
when: locale_gen.changed
|
||||
|
||||
# ============================================================
|
||||
# Création de la base de données et configuration utilisateur
|
||||
# ============================================================
|
||||
- name: Définir le mot de passe de l'utilisateur postgres
|
||||
become_user: postgres
|
||||
ansible.builtin.postgresql_user:
|
||||
name: "{{ db_user }}"
|
||||
password: "{{ db_password }}"
|
||||
state: present
|
||||
|
||||
- name: Vérifier si la base de données existe
|
||||
become_user: postgres
|
||||
ansible.builtin.command: psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{ db_name }}'"
|
||||
register: db_exists
|
||||
changed_when: false
|
||||
|
||||
- name: Créer la base de données avec ICU
|
||||
become_user: postgres
|
||||
ansible.builtin.command: >
|
||||
psql -c "CREATE DATABASE {{ db_name }}
|
||||
OWNER {{ db_user }}
|
||||
ENCODING 'UTF8'
|
||||
LOCALE_PROVIDER icu
|
||||
ICU_LOCALE 'fr-FR'
|
||||
TEMPLATE template0"
|
||||
when: db_exists.stdout != "1"
|
||||
|
||||
- name: Accorder tous les privilèges sur la base
|
||||
become_user: postgres
|
||||
ansible.builtin.postgresql_privs:
|
||||
db: "{{ db_name }}"
|
||||
role: "{{ db_user }}"
|
||||
type: database
|
||||
privs: ALL
|
||||
state: present
|
||||
|
||||
# ============================================================
|
||||
# Authentification pg_hba.conf
|
||||
# ============================================================
|
||||
- name: Configurer l'authentification md5 pour les connexions locales
|
||||
ansible.builtin.postgresql_pg_hba:
|
||||
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
||||
contype: host
|
||||
databases: "{{ db_name }}"
|
||||
users: "{{ db_user }}"
|
||||
source: "127.0.0.1/32"
|
||||
method: md5
|
||||
notify: Restart postgresql
|
||||
|
||||
- name: Configurer l'authentification md5 pour IPv6 local
|
||||
ansible.builtin.postgresql_pg_hba:
|
||||
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
||||
contype: host
|
||||
databases: "{{ db_name }}"
|
||||
users: "{{ db_user }}"
|
||||
source: "::1/128"
|
||||
method: md5
|
||||
notify: Restart postgresql
|
||||
|
||||
# ============================================================
|
||||
# Vérification
|
||||
# ============================================================
|
||||
- name: Vérifier la version de PostgreSQL
|
||||
become_user: postgres
|
||||
ansible.builtin.command: psql --version
|
||||
register: pg_version_check
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher la version
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ pg_version_check.stdout }}"
|
||||
|
||||
- name: Vérifier que la base existe
|
||||
become_user: postgres
|
||||
ansible.builtin.command: psql -lqt
|
||||
register: pg_databases
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher les bases de données
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ pg_databases.stdout_lines }}"
|
||||
|
||||
handlers:
|
||||
- name: Restart postgresql
|
||||
ansible.builtin.systemd:
|
||||
name: postgresql
|
||||
state: restarted
|
||||
|
||||
# ============================================
|
||||
# Redis Installation (vm-redis uniquement)
|
||||
# ============================================
|
||||
- name: Installation et configuration de Redis
|
||||
hosts: demo-uber
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Installer Redis
|
||||
apt:
|
||||
name:
|
||||
- redis-server
|
||||
- python3-redis
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Créer le répertoire de backup Redis
|
||||
file:
|
||||
path: /var/lib/redis/backup
|
||||
state: directory
|
||||
owner: redis
|
||||
group: redis
|
||||
mode: "0755"
|
||||
|
||||
- name: Configurer Redis - bind address (accepter connexions réseau)
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^bind"
|
||||
line: "bind 127.0.0.1 192.168.1.62"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - port
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^port"
|
||||
line: "port {{ redis_port }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - maxmemory
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?maxmemory"
|
||||
line: "maxmemory {{ redis_maxmemory }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - maxmemory-policy
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?maxmemory-policy"
|
||||
line: "maxmemory-policy {{ redis_maxmemory_policy }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - requirepass
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?requirepass"
|
||||
line: "requirepass {{ redis_password }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Activer AOF (Append Only File) pour Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^appendonly"
|
||||
line: "appendonly yes"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer la fréquence de sync AOF
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?appendfsync"
|
||||
line: "appendfsync everysec"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Activer la persistance RDB (snapshots)
|
||||
blockinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
block: |
|
||||
save 900 1
|
||||
save 300 10
|
||||
save 60 10000
|
||||
marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE"
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer le nom du fichier AOF
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^appendfilename"
|
||||
line: 'appendfilename "appendonly.aof"'
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Désactiver le mode protégé Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^protected-mode"
|
||||
line: "protected-mode no"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer le répertoire de travail Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^dir"
|
||||
line: "dir /var/lib/redis"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Définir le niveau de log
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^loglevel"
|
||||
line: "loglevel notice"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: S'assurer que Redis est démarré
|
||||
systemd:
|
||||
name: redis-server
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
handlers:
|
||||
- name: Redémarrer Redis
|
||||
systemd:
|
||||
name: redis-server
|
||||
state: restarted
|
||||
@@ -1,28 +0,0 @@
|
||||
[Unit]
|
||||
Description=Backend Golang API
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User={{ user_owner }}
|
||||
WorkingDirectory={{ backend_dir }}
|
||||
Environment="PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
Environment="USER_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlds"
|
||||
Environment="DB_HOST=localhost"
|
||||
Environment="DB_PORT=5432"
|
||||
Environment="DB_USER=admin_gestion_commande_db"
|
||||
Environment="DB_PASSWORD=hb-FS462(#I~6(4',Nt=3Rd4567890jsezZ"
|
||||
Environment="DB_NAME=gestion_commande_db"
|
||||
Environment="DB_SSLMODE=disable"
|
||||
Environment="REDIS_HOST=127.0.0.1"
|
||||
Environment="REDIS_PORT=6379"
|
||||
Environment="REDIS_PASSWORD=uQ64h5UhFdrm!H|_cCQer"
|
||||
Environment="SESSION_SECRET=jfWR21Ywbuy{Yq<1A26TV)jCe"
|
||||
Environment="GIN_MODE=release"
|
||||
Environment="TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB"
|
||||
Environment="API_PORT={{ backend_local_port }}"
|
||||
Environment="ADMIN_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlzZ"
|
||||
ExecStart={{ backend_binary }}
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,14 +0,0 @@
|
||||
[Unit]
|
||||
Description=Frontend React Production (Vite)
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User={{ user_owner }}
|
||||
Group={{ user_owner }}
|
||||
WorkingDirectory={{ nginx_frontend_path }}
|
||||
ExecStart=/usr/bin/npm run preview -- --port {{ frontend_port }}
|
||||
Restart=always
|
||||
Environment=NODE_ENV=production
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,191 +0,0 @@
|
||||
# =========================================================
|
||||
# Request ID for correlation
|
||||
# =========================================================
|
||||
map $http_x_request_id $req_id {
|
||||
default $http_x_request_id;
|
||||
"" $request_id;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Backend distant
|
||||
# =========================================================
|
||||
upstream backend {
|
||||
server uber-stup.club:443;
|
||||
keepalive 32;
|
||||
}
|
||||
|
||||
{% if ssl_enabled %}
|
||||
# =========================================================
|
||||
# HTTP → HTTPS redirect + ACME challenge
|
||||
# =========================================================
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ domain_name }};
|
||||
|
||||
# Certbot renouvellement automatique
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# HTTPS Server
|
||||
# =========================================================
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name {{ domain_name }};
|
||||
|
||||
# =========================================================
|
||||
# SSL/TLS - Let's Encrypt
|
||||
# =========================================================
|
||||
ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/{{ domain_name }}/chain.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets off;
|
||||
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
resolver 1.1.1.1 8.8.8.8 valid=300s;
|
||||
resolver_timeout 5s;
|
||||
|
||||
{% else %}
|
||||
# =========================================================
|
||||
# HTTP Server (phase pré-certificat)
|
||||
# =========================================================
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ domain_name }};
|
||||
|
||||
# ACME challenge accessible avant l'émission du certificat
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
root {{ frontend_dir }}/dist;
|
||||
index index.html;
|
||||
client_max_body_size {{ nginx_max_body_size }};
|
||||
|
||||
location /api/ {
|
||||
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
|
||||
|
||||
if ($request_method = 'OPTIONS') {
|
||||
add_header 'Access-Control-Allow-Origin' "$http_origin" always;
|
||||
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
|
||||
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always;
|
||||
add_header 'Access-Control-Allow-Credentials' 'true' always;
|
||||
add_header 'Access-Control-Max-Age' 86400 always;
|
||||
add_header 'Content-Length' 0;
|
||||
add_header 'Content-Type' 'text/plain charset=UTF-8';
|
||||
return 204;
|
||||
}
|
||||
|
||||
proxy_pass https://backend;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_name uber-stup.club;
|
||||
|
||||
proxy_set_header Host uber-stup.club;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Request-ID $req_id;
|
||||
proxy_set_header Connection "";
|
||||
|
||||
proxy_connect_timeout {{ nginx_proxy_timeout }}s;
|
||||
proxy_send_timeout {{ nginx_proxy_timeout }}s;
|
||||
proxy_read_timeout {{ nginx_proxy_timeout }}s;
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
||||
add_header Pragma "no-cache" always;
|
||||
add_header Expires "0" always;
|
||||
}
|
||||
|
||||
location /uploads/ {
|
||||
alias {{ uploads_dir }}/;
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
|
||||
location ^~ /uploads/images/ {
|
||||
alias {{ uploads_dir }}/images/;
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
|
||||
types {
|
||||
image/jpeg jpg jpeg;
|
||||
image/png png;
|
||||
image/gif gif;
|
||||
image/webp webp;
|
||||
image/svg+xml svg;
|
||||
}
|
||||
default_type image/jpeg;
|
||||
}
|
||||
|
||||
location ^~ /uploads/videos/ {
|
||||
alias {{ uploads_dir }}/videos/;
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
|
||||
types {
|
||||
video/mp4 mp4;
|
||||
video/webm webm;
|
||||
video/ogg ogv;
|
||||
}
|
||||
default_type video/mp4;
|
||||
}
|
||||
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
{% if ssl_enabled %}
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
{% endif %}
|
||||
add_header Content-Security-Policy "
|
||||
default-src 'self';
|
||||
script-src 'self' 'unsafe-inline' 'unsafe-eval';
|
||||
style-src 'self' 'unsafe-inline';
|
||||
img-src 'self' data: https:;
|
||||
font-src 'self' data:;
|
||||
connect-src 'self' https://api.tomtom.com https://uber-stup.club;
|
||||
" always;
|
||||
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
}
|
||||
@@ -1,170 +0,0 @@
|
||||
# =========================================================
|
||||
# Request ID for correlation
|
||||
# =========================================================
|
||||
map $http_x_request_id $req_id {
|
||||
default $http_x_request_id;
|
||||
"" $request_id;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Rate limiting
|
||||
# =========================================================
|
||||
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
|
||||
limit_req_zone $binary_remote_addr zone=uploads:10m rate=10r/m;
|
||||
|
||||
# =========================================================
|
||||
# Upstream backend
|
||||
# =========================================================
|
||||
upstream backend {
|
||||
server 127.0.0.1:{{ backend_local_port }} max_fails=3 fail_timeout=30s;
|
||||
keepalive 32;
|
||||
keepalive_requests 100;
|
||||
keepalive_timeout 60s;
|
||||
}
|
||||
|
||||
{% if ssl_enabled %}
|
||||
# =========================================================
|
||||
# HTTP → HTTPS redirect
|
||||
# =========================================================
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ domain_name }};
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
{% endif %}
|
||||
|
||||
# =========================================================
|
||||
# API Server
|
||||
# =========================================================
|
||||
server {
|
||||
{% if ssl_enabled %}
|
||||
listen {{ backend_port }} ssl;
|
||||
listen [::]:{{ backend_port }} ssl;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_prefer_server_ciphers off;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets off;
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
{% else %}
|
||||
listen {{ backend_port }};
|
||||
listen [::]:{{ backend_port }};
|
||||
{% endif %}
|
||||
|
||||
server_name {{ domain_name }};
|
||||
client_max_body_size {{ nginx_max_body_size }};
|
||||
|
||||
server_tokens off;
|
||||
|
||||
# =========================================================
|
||||
# Security headers
|
||||
# =========================================================
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
proxy_hide_header X-Powered-By;
|
||||
proxy_hide_header Server;
|
||||
|
||||
# =========================================================
|
||||
# API proxy
|
||||
# =========================================================
|
||||
location / {
|
||||
limit_req zone=api burst=20 nodelay;
|
||||
|
||||
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
|
||||
|
||||
proxy_pass http://backend;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Request-ID $req_id;
|
||||
proxy_set_header Connection "";
|
||||
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Uploads
|
||||
# =========================================================
|
||||
location /uploads/ {
|
||||
alias {{ uploads_dir }}/;
|
||||
limit_req zone=uploads burst=20 nodelay;
|
||||
limit_except GET HEAD { deny all; }
|
||||
|
||||
# Bloquer les fichiers exécutables
|
||||
location ~* \.(php|php5|phtml|sh|py|pl|cgi|exe|asp|aspx|jsp)$ {
|
||||
deny all;
|
||||
}
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
}
|
||||
|
||||
location ^~ /uploads/images/ {
|
||||
alias {{ uploads_dir }}/images/;
|
||||
limit_req zone=uploads burst=20 nodelay;
|
||||
limit_except GET HEAD OPTIONS { deny all; }
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
|
||||
types {
|
||||
image/jpeg jpg jpeg;
|
||||
image/png png;
|
||||
image/gif gif;
|
||||
image/webp webp;
|
||||
image/svg+xml svg;
|
||||
}
|
||||
default_type image/jpeg;
|
||||
}
|
||||
|
||||
location ^~ /uploads/videos/ {
|
||||
alias {{ uploads_dir }}/videos/;
|
||||
limit_req zone=uploads burst=20 nodelay;
|
||||
limit_except GET HEAD OPTIONS { deny all; }
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
|
||||
types {
|
||||
video/mp4 mp4;
|
||||
video/webm webm;
|
||||
video/ogg ogv;
|
||||
}
|
||||
default_type video/mp4;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Deny hidden files and sensitive files
|
||||
# =========================================================
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
}
|
||||
@@ -1,142 +0,0 @@
|
||||
# =========================================================
|
||||
# Request ID for correlation
|
||||
# =========================================================
|
||||
map $http_x_request_id $req_id {
|
||||
default $http_x_request_id;
|
||||
"" $request_id;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Rate limiting
|
||||
# =========================================================
|
||||
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
|
||||
limit_req_zone $binary_remote_addr zone=uploads:10m rate=10r/m;
|
||||
|
||||
# =========================================================
|
||||
# Upstream backend
|
||||
# =========================================================
|
||||
upstream backend {
|
||||
server 127.0.0.1:{{ backend_local_port }} max_fails=3 fail_timeout=30s;
|
||||
keepalive 32;
|
||||
keepalive_requests 100;
|
||||
keepalive_timeout 60s;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# API Server
|
||||
# =========================================================
|
||||
server {
|
||||
listen {{ backend_port }};
|
||||
listen [::]:{{ backend_port }};
|
||||
server_name {{ ip }};
|
||||
client_max_body_size {{ nginx_max_body_size }};
|
||||
|
||||
server_tokens off;
|
||||
|
||||
# =========================================================
|
||||
# Security headers
|
||||
# =========================================================
|
||||
add_header X-Frame-Options "DENY" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
proxy_hide_header X-Powered-By;
|
||||
proxy_hide_header Server;
|
||||
|
||||
# =========================================================
|
||||
# API proxy
|
||||
# =========================================================
|
||||
location / {
|
||||
limit_req zone=api burst=20 nodelay;
|
||||
|
||||
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
|
||||
|
||||
proxy_pass http://backend;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Request-ID $req_id;
|
||||
proxy_set_header Connection "";
|
||||
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Uploads
|
||||
# =========================================================
|
||||
location /uploads/ {
|
||||
alias {{ uploads_dir }}/;
|
||||
limit_req zone=uploads burst=20 nodelay;
|
||||
limit_except GET HEAD { deny all; }
|
||||
|
||||
# Bloquer les fichiers exécutables
|
||||
location ~* \.(php|php5|phtml|sh|py|pl|cgi|exe|asp|aspx|jsp)$ {
|
||||
deny all;
|
||||
}
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
}
|
||||
|
||||
location ^~ /uploads/images/ {
|
||||
alias {{ uploads_dir }}/images/;
|
||||
limit_req zone=uploads burst=20 nodelay;
|
||||
limit_except GET HEAD OPTIONS { deny all; }
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
|
||||
types {
|
||||
image/jpeg jpg jpeg;
|
||||
image/png png;
|
||||
image/gif gif;
|
||||
image/webp webp;
|
||||
image/svg+xml svg;
|
||||
}
|
||||
default_type image/jpeg;
|
||||
}
|
||||
|
||||
location ^~ /uploads/videos/ {
|
||||
alias {{ uploads_dir }}/videos/;
|
||||
limit_req zone=uploads burst=20 nodelay;
|
||||
limit_except GET HEAD OPTIONS { deny all; }
|
||||
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable" always;
|
||||
|
||||
types {
|
||||
video/mp4 mp4;
|
||||
video/webm webm;
|
||||
video/ogg ogv;
|
||||
}
|
||||
default_type video/mp4;
|
||||
}
|
||||
|
||||
# =========================================================
|
||||
# Deny hidden files and sensitive files
|
||||
# =========================================================
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
}
|
||||
@@ -1,25 +0,0 @@
|
||||
[Unit]
|
||||
Description=Serveo Tunnel Service
|
||||
After=network-online.target nginx.service
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=ubuntu
|
||||
WorkingDirectory={{directory}}
|
||||
ExecStart=/usr/bin/ssh \
|
||||
-o ServerAliveInterval=60 \
|
||||
-o ServerAliveCountMax=3 \
|
||||
-o ExitOnForwardFailure=yes \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-R {{nginx_app_name}}:80:{{nginx_domain}}:80 \
|
||||
serveo.net
|
||||
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
StandardOutput=append:{{tunnel_log}}
|
||||
StandardError=append:{{tunnel_log_error}}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Reference in New Issue
Block a user