From 80e8888b512adf114a30688ec8e2dce9ee3b4d64 Mon Sep 17 00:00:00 2001 From: Xor290 Date: Wed, 11 Mar 2026 20:23:20 +0100 Subject: [PATCH] chore: delete ansible --- .gitignore | 2 +- ansible/ansible.cfg | 9 - ansible/group_vars/all/vars.yml | 39 --- ansible/inventory/host.ini | 13 - ansible/playbook-backend.yml | 316 ----------------------- ansible/playbook-docker.yml | 198 -------------- ansible/playbook-fail2ban.yml | 142 ---------- ansible/playbook-frontend.yml | 260 ------------------- ansible/playbook.yml | 308 ---------------------- ansible/templates/backend.service.j2 | 28 -- ansible/templates/frontend.service.j2 | 14 - ansible/templates/nginx-frontend.conf.j2 | 191 -------------- ansible/templates/nginx.conf.j2 | 170 ------------ ansible/templates/nginx2.conf.j2 | 142 ---------- ansible/templates/tunnel.service.j2 | 25 -- 15 files changed, 1 insertion(+), 1856 deletions(-) delete mode 100644 ansible/ansible.cfg delete mode 100644 ansible/group_vars/all/vars.yml delete mode 100644 ansible/inventory/host.ini delete mode 100644 ansible/playbook-backend.yml delete mode 100644 ansible/playbook-docker.yml delete mode 100644 ansible/playbook-fail2ban.yml delete mode 100644 ansible/playbook-frontend.yml delete mode 100644 ansible/playbook.yml delete mode 100644 ansible/templates/backend.service.j2 delete mode 100644 ansible/templates/frontend.service.j2 delete mode 100644 ansible/templates/nginx-frontend.conf.j2 delete mode 100644 ansible/templates/nginx.conf.j2 delete mode 100644 ansible/templates/nginx2.conf.j2 delete mode 100644 ansible/templates/tunnel.service.j2 diff --git a/.gitignore b/.gitignore index 2702b7cc..9db1edfb 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,4 @@ **/.expo/ test_address.sh easpip -ansible +ansible/ diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg deleted file mode 100644 index b30502de..00000000 --- a/ansible/ansible.cfg +++ /dev/null @@ -1,9 +0,0 @@ -[defaults] -inventory = inventory/host.ini -host_key_checking = False -interpreter_python = auto_silent - -[privilege_escalation] -become = True -become_method = sudo -become_user = root \ No newline at end of file diff --git a/ansible/group_vars/all/vars.yml b/ansible/group_vars/all/vars.yml deleted file mode 100644 index 726a1a23..00000000 --- a/ansible/group_vars/all/vars.yml +++ /dev/null @@ -1,39 +0,0 @@ -pg_version: "16" -db_user: admin_gestion_commande_db -db_name: gestion_commande_db -db_password: "hb-FS462(#I~6(4',Nt=3Rd4567890jsezZ" -db_host: "localhost" -db_port: 5432 -# Redis Configuration -redis_bind: "127.0.0.1" -redis_port: 6379 -redis_maxmemory: "1024mb" -redis_maxmemory_policy: "allkeys-lru" -redis_password: "uQ64h5UhFdrm!H|_cCQer" - -# ============================================ -# Configuration Nginx et Applications -# ============================================ - -directory: "/home/ubuntu" -backend_dir: "/home/ubuntu/backend" -backend_binary: "/home/ubuntu/backend/main" -uploads_dir: "/home/ubuntu/backend/uploads" -frontend_port: 5173 -domain_name: "uber-demo.club" -# Utilisateurs et permissions -user_web: "www-data" # Utilisateur pour les applications web -user_deploy: "ubuntu" # Utilisateur pour le déploiement -user_owner: "root" # Propriétaire des fichiers systemd -ip: "5.181.0.112" -# Backend -backend_local_port: 8080 -backend_port: 80 -# Timeouts -nginx_proxy_timeout: 60 - -# Upload Size -nginx_max_body_size: "10M" - -# Security -nginx_enable_firewall: true diff --git a/ansible/inventory/host.ini b/ansible/inventory/host.ini deleted file mode 100644 index 0c3ae1a6..00000000 --- a/ansible/inventory/host.ini +++ /dev/null @@ -1,13 +0,0 @@ -[all] -uber-stup ansible_host=5.252.20.129 ansible_user=root ansible_ssh_pass=rL9lY6YkcDQmfRuZ3Z -uber-stup-web ansible_host=185.234.9.102 ansible_user=root ansible_ssh_pass=hTASFYOydY46haeO3J -demo-uber ansible_host=5.181.0.112 ansible_user=root ansible_ssh_pass=jQCpl49FcISQfHaF8j - -[uber-stup] -uber-stup ansible_host=5.252.20.129 ansible_user=root ansible_ssh_pass=rL9lY6YkcDQmfRuZ3Z - -[uber-stup-web] -uber-stup-web ansible_host=185.234.9.102 ansible_user=root ansible_ssh_pass=hTASFYOydY46haeO3J - -[demo-uber] -demo-uber ansible_host=5.181.0.112 ansible_user=root ansible_ssh_pass=jQCpl49FcISQfHaF8j diff --git a/ansible/playbook-backend.yml b/ansible/playbook-backend.yml deleted file mode 100644 index 8e3d0edb..00000000 --- a/ansible/playbook-backend.yml +++ /dev/null @@ -1,316 +0,0 @@ ---- -- name: Installation et configuration du frontend et backend - hosts: demo-uber - become: true - gather_facts: true - - tasks: - - name: Update and upgrade - ansible.builtin.apt: - update_cache: yes - cache_valid_time: 3600 - upgrade: "dist" - - - name: install basic dependencies - ansible.builtin.apt: - name: - - curl - - wget - - tar - - rsync - - acl - - nginx - - certbot - - python3-certbot-nginx - state: present - update_cache: yes - - - name: Download Go 1.23.0 tarball - ansible.builtin.get_url: - url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz - dest: /tmp/go1.23.0.linux-amd64.tar.gz - mode: "0644" - - - name: Extract Go 1.23.0 - ansible.builtin.unarchive: - src: /tmp/go1.23.0.linux-amd64.tar.gz - dest: /usr/local - remote_src: yes - - - name: Ensure Go 1.23 is in PATH for all users - ansible.builtin.lineinfile: - path: /etc/profile.d/go.sh - line: "export PATH=/usr/local/go/bin:$PATH" - create: yes - state: present - mode: "0644" - - - name: Check Go versions - ansible.builtin.shell: | - echo "Go: $(go version)" - register: versions_check - changed_when: false - failed_when: versions_check.rc != 0 - - - name: Display all versions - ansible.builtin.debug: - msg: "{{ versions_check.stdout_lines }}" - - # ============================================ - # FRONTEND - # ============================================ - - - name: Create /var/www if not exists - ansible.builtin.file: - path: /var/www - state: directory - owner: root - group: root - mode: "0755" - - - name: Créer l'utilisateur de déploiement s'il n'existe pas - ansible.builtin.user: - name: "{{ user_deploy }}" - shell: /bin/bash - create_home: yes - state: present - - - name: Ensure /home/{{ user_deploy }} exists with correct permissions - ansible.builtin.file: - path: "/home/{{ user_deploy }}" - state: directory - owner: "{{ user_deploy }}" - group: "{{ user_deploy }}" - mode: "0755" - - # ============================================ - # BACKEND - # ============================================ - - - name: Create backend directory with deploy user ownership - ansible.builtin.file: - path: "{{ backend_dir }}" - state: directory - owner: "{{ user_deploy }}" - group: "{{ user_deploy }}" - mode: "0755" - - - name: Synchroniser le backend Go - ansible.builtin.synchronize: - src: ../backend/gestion/ - dest: "{{ backend_dir }}/" - rsync_opts: - - "--exclude=.git" - - "--exclude=.gitignore" - - "--exclude=docker-compose.yml" - - "--exclude=.env" - - "--no-owner" - - "--no-group" - delete: yes - recursive: yes - tags: backend - - - name: Fix backend ownership after rsync (rsync tourne en root) - ansible.builtin.file: - path: "{{ backend_dir }}" - owner: "{{ user_deploy }}" - group: "{{ user_deploy }}" - recurse: yes - tags: backend - - - name: Remove old binary if owned by another user - ansible.builtin.file: - path: "{{ backend_dir }}/main" - state: absent - tags: backend - - - name: Compile backend as deploy user - become_user: "{{ user_deploy }}" - ansible.builtin.shell: | - export PATH=/usr/local/go/bin:$PATH - go mod tidy - go build -o main . - args: - chdir: "{{ backend_dir }}" - executable: /bin/bash - tags: backend - - - name: Set ownership to www-data for runtime - ansible.builtin.file: - path: "{{ backend_dir }}" - owner: "{{ user_web }}" - group: "{{ user_web }}" - mode: "0755" - recurse: yes - tags: backend - - - name: Set executable permission on backend binary - ansible.builtin.file: - path: "{{ backend_binary }}" - owner: "{{ user_web }}" - group: "{{ user_web }}" - mode: "0755" - tags: backend - - # ============================================ - # SYSTEMD SERVICES - # ============================================ - - - name: Create systemd service for backend - ansible.builtin.template: - src: ./templates/backend.service.j2 - dest: /etc/systemd/system/backend.service - owner: root - group: root - mode: "0644" - tags: backend - - - name: Reload systemd daemon - ansible.builtin.systemd: - daemon_reload: yes - tags: backend - - - name: Enable and restart backend service - ansible.builtin.systemd: - name: backend - enabled: yes - state: restarted - tags: backend - - - name: Wait for backend to be ready - ansible.builtin.wait_for: - port: "{{ backend_local_port }}" - delay: 2 - timeout: 30 - tags: backend - - - name: Display service status - ansible.builtin.shell: | - echo "=== Backend Service ===" - systemctl status backend --no-pager || true - register: service_status - changed_when: false - tags: backend - - - name: Show service status - ansible.builtin.debug: - msg: "{{ service_status.stdout_lines }}" - tags: backend - - - name: Configuration UFW - ansible.builtin.ufw: - rule: allow - port: "{{ item }}" - proto: tcp - loop: - - 80 - - 22 - - - name: Activation du firewall - ansible.builtin.ufw: - state: enabled - - # - name: Vérifier si un certificat existe déjà - # ansible.builtin.stat: - # path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" - # register: cert_file - # tags: [certbot] - # - - name: Déployer la configuration Nginx HTTP - ansible.builtin.template: - src: templates/nginx2.conf.j2 - dest: /etc/nginx/sites-available/api - vars: - ssl_enabled: false - tags: [certbot] - - - name: Activation du site Nginx - ansible.builtin.file: - src: /etc/nginx/sites-available/api - dest: /etc/nginx/sites-enabled/api - state: link - force: yes - tags: [certbot] - - - name: Suppression du site par défaut - ansible.builtin.file: - path: /etc/nginx/sites-enabled/default - state: absent - tags: [certbot] - - - name: Test de la configuration Nginx - ansible.builtin.command: nginx -t - changed_when: false - tags: [certbot] - - - name: Redémarrage de Nginx - ansible.builtin.systemd: - name: nginx - state: restarted - enabled: yes - tags: [certbot] - - # ============================================================ - # Certificat SSL Let's Encrypt - # ============================================================ - # - name: Générer le certificat SSL avec Certbot - # ansible.builtin.command: > - # certbot certonly --nginx - # -d {{ domain_name }} - # --non-interactive - # --agree-tos - # --email admin@{{ domain_name }} - # tags: [certbot] - - # ============================================================ - # Nginx - reconfiguration HTTPS après certificat - # ============================================================ - # - name: Vérifier la présence du certificat - # ansible.builtin.stat: - # path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" - # register: cert_file_after - # tags: [nginx] - - #- name: Déployer la configuration Nginx HTTPS - # ansible.builtin.template: - # src: templates/nginx.conf.j2 - # dest: /etc/nginx/sites-available/api - # vars: - # ssl_enabled: true - # when: cert_file_after.stat.exists - # notify: Restart nginx - # tags: [nginx] - - #- name: Test de la configuration Nginx finale - # ansible.builtin.command: nginx -t - # changed_when: false - # tags: [nginx] - - # - name: Redémarrage de Nginx avec SSL - # ansible.builtin.systemd: - # name: nginx - # state: restarted - # when: cert_file_after.stat.exists - # tags: [nginx] - - # - name: Vérifier le renouvellement automatique - # ansible.builtin.command: certbot renew --dry-run - # register: certbot_renew - # changed_when: false - # failed_when: false - # tags: [certbot] - - # - name: Afficher le statut du renouvellement - # ansible.builtin.debug: - # msg: "{{ certbot_renew.stdout_lines }}" - # tags: [certbot] - - handlers: - - name: Reload systemd - ansible.builtin.systemd: - daemon_reload: yes - - - name: Restart nginx - ansible.builtin.systemd: - name: nginx - state: restarted diff --git a/ansible/playbook-docker.yml b/ansible/playbook-docker.yml deleted file mode 100644 index 562851ea..00000000 --- a/ansible/playbook-docker.yml +++ /dev/null @@ -1,198 +0,0 @@ ---- -- name: Installation et configuration du frontend et backend - hosts: backend - become: true - gather_facts: true - - tasks: - - name: Update apt cache - apt: - update_cache: yes - cache_valid_time: 3600 - - - name: Install required packages - apt: - name: - - apt-transport-https - - ca-certificates - - curl - - gnupg - - lsb-release - - software-properties-common - - acl - state: present - - - name: Create directory for Docker GPG key - file: - path: /etc/apt/keyrings - state: directory - mode: "0755" - - - name: Add Docker GPG key - apt_key: - url: https://download.docker.com/linux/ubuntu/gpg - keyring: /etc/apt/keyrings/docker.gpg - state: present - - - name: Get system architecture - command: dpkg --print-architecture - register: system_arch - changed_when: false - - - name: Get Ubuntu codename - command: lsb_release -cs - register: ubuntu_codename - changed_when: false - - - name: Add Docker repository - apt_repository: - repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable" - state: present - filename: docker - - - name: Update apt cache after adding repo - apt: - update_cache: yes - - - name: Install Docker packages - apt: - name: - - docker-ce - - docker-ce-cli - - containerd.io - - docker-buildx-plugin - - docker-compose-plugin - state: present - - - name: Ensure Docker service is started and enabled - systemd: - name: docker - state: started - enabled: yes - - - name: Create docker group - group: - name: "{{ docker_group }}" - state: present - - - name: Create docker user - user: - name: "{{ docker_user }}" - group: "{{ docker_group }}" - groups: docker - append: yes - shell: /bin/bash - create_home: yes - state: present - - - name: Add ansible user to docker group - user: - name: "{{ ansible_user }}" - groups: docker - append: yes - when: ansible_user is defined - - - name: Verify Docker installation - command: docker --version - register: docker_version - changed_when: false - - - name: Verify Docker Compose installation - command: docker compose version - register: compose_version - changed_when: false - - - name: Display versions - debug: - msg: - - "{{ docker_version.stdout }}" - - "{{ compose_version.stdout }}" - - - name: Create frontend directory - ansible.builtin.file: - path: "{{ nginx_frontend_path }}" - state: directory - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - mode: "0755" - - - name: Create backend directory - ansible.builtin.file: - path: "{{ backend_dir }}" - state: directory - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - mode: "0755" - - - name: Synchronize frontend content (excluding node_modules and .git) - ansible.builtin.synchronize: - src: ../frontend-prep - dest: "{{ nginx_frontend_path }}/" - rsync_opts: - - "--exclude=node_modules" - - "--exclude=.git" - - "--exclude=dist" - - "--exclude=build" - delete: no - recursive: yes - tags: sync_frontend - - - name: Set ownership for frontend directory - ansible.builtin.file: - path: "{{ nginx_frontend_path }}" - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - recurse: yes - tags: sync_frontend - - - name: Synchronize backend content (excluding node_modules and .git) - ansible.builtin.synchronize: - src: ../backend - dest: "{{ backend_dir }}/" - rsync_opts: - - "--exclude=node_modules" - - "--exclude=.git" - - "--exclude=dist" - - "--exclude=build" - delete: no - recursive: yes - tags: sync_backend - - - name: Set ownership for backend directory - ansible.builtin.file: - path: "{{ backend_dir }}" - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - recurse: yes - tags: sync_backend - - - name: Copy Docker project - ansible.builtin.copy: - src: ../docker/ - dest: "{{ docker_dir }}/" - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - mode: "0755" - - - name: Ensure parent directory has correct permissions - ansible.builtin.file: - path: "{{ docker_dir }}" - state: directory - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - mode: "0755" - - - name: Set correct permissions for Docker files - ansible.builtin.file: - path: "{{ docker_dir }}" - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - recurse: yes - - - name: Set permissions for .env file - ansible.builtin.file: - path: "{{ docker_dir }}/.env" - owner: "{{ docker_user }}" - group: "{{ docker_group }}" - mode: "0640" - ignore_errors: yes diff --git a/ansible/playbook-fail2ban.yml b/ansible/playbook-fail2ban.yml deleted file mode 100644 index 78056ec0..00000000 --- a/ansible/playbook-fail2ban.yml +++ /dev/null @@ -1,142 +0,0 @@ ---- -# ============================================ -# Fail2Ban Installation et configuration -# ============================================ -- name: Installation et configuration de Fail2Ban - hosts: uber-stup-web - become: true - gather_facts: true - - vars: - fail2ban_bantime: "1h" - fail2ban_findtime: "10m" - fail2ban_maxretry: 5 - fail2ban_ignoreip: "127.0.0.1/8 ::1" - - tasks: - # ============================================================ - # Installation - # ============================================================ - - name: Installer Fail2Ban - ansible.builtin.apt: - name: fail2ban - state: present - update_cache: yes - - # ============================================================ - # Configuration globale (jail.local) - # ============================================================ - - name: Créer jail.local avec la configuration globale - ansible.builtin.copy: - dest: /etc/fail2ban/jail.local - owner: root - group: root - mode: "0644" - content: | - [DEFAULT] - ignoreip = {{ fail2ban_ignoreip }} - bantime = {{ fail2ban_bantime }} - findtime = {{ fail2ban_findtime }} - maxretry = {{ fail2ban_maxretry }} - banaction = iptables-multiport - backend = systemd - loglevel = INFO - - # ============================================================ - # SSH - # ============================================================ - [sshd] - enabled = true - port = ssh - filter = sshd - logpath = %(sshd_log)s - maxretry = 3 - bantime = 24h - - # ============================================================ - # Nginx - requêtes trop fréquentes (rate limit) - # ============================================================ - [nginx-limit-req] - enabled = true - port = http,https - filter = nginx-limit-req - logpath = /var/log/nginx/error.log - maxretry = 10 - bantime = 1h - - # ============================================================ - # Nginx - 4xx répétés (scan, bot) - # ============================================================ - [nginx-http-auth] - enabled = true - port = http,https - filter = nginx-http-auth - logpath = /var/log/nginx/error.log - maxretry = 5 - bantime = 1h - - # ============================================================ - # Nginx - bad bots / scans (404 répétés) - # ============================================================ - [nginx-botsearch] - enabled = true - port = http,https - filter = nginx-botsearch - logpath = /var/log/nginx/access.log - maxretry = 10 - bantime = 2h - - # ============================================================ - # API Backend - brute force login (POST /api/v2/login) - # ============================================================ - [backend-login] - enabled = true - port = http,https - filter = backend-login - logpath = /var/log/nginx/access.log - maxretry = 10 - findtime = 5m - bantime = 2h - notify: Restart fail2ban - - # ============================================================ - # Filtre personnalisé - brute force login API - # ============================================================ - - name: Créer le filtre fail2ban pour le login API - ansible.builtin.copy: - dest: /etc/fail2ban/filter.d/backend-login.conf - owner: root - group: root - mode: "0644" - content: | - [Definition] - failregex = ^ .* "POST /api/v2/login HTTP/.*" (401|403) .*$ - ignoreregex = - notify: Restart fail2ban - - # ============================================================ - # Démarrage et activation - # ============================================================ - - name: Démarrer et activer Fail2Ban - ansible.builtin.systemd: - name: fail2ban - state: started - enabled: yes - - # ============================================================ - # Vérification - # ============================================================ - - name: Vérifier le statut de Fail2Ban - ansible.builtin.command: fail2ban-client status - register: fail2ban_status - changed_when: false - - - name: Afficher le statut des jails - ansible.builtin.debug: - msg: "{{ fail2ban_status.stdout_lines }}" - - handlers: - - name: Restart fail2ban - ansible.builtin.systemd: - name: fail2ban - state: restarted diff --git a/ansible/playbook-frontend.yml b/ansible/playbook-frontend.yml deleted file mode 100644 index 7f575e35..00000000 --- a/ansible/playbook-frontend.yml +++ /dev/null @@ -1,260 +0,0 @@ -- name: Déploiement complet Frontend - hosts: uber-stup-web - gather_facts: true - become: true - vars: - domain_name: mln-uber.club - frontend_dir: /home/ubuntu/frontend - frontend_port: 5173 - tasks: - - name: Update and upgrade - ansible.builtin.apt: - update_cache: yes - cache_valid_time: 3600 - upgrade: dist - - - name: Install basic dependencies - ansible.builtin.apt: - name: - - curl - - nginx - - tar - - build-essential - - certbot - - python3-certbot-nginx - state: present - - name: Créer l'utilisateur de déploiement s'il n'existe pas - ansible.builtin.user: - name: "{{ user_deploy }}" - shell: /bin/bash - create_home: yes - state: present - - - name: Ensure /home/{{ user_deploy }} exists with correct permissions - ansible.builtin.file: - path: "/home/{{ user_deploy }}" - state: directory - owner: "{{ user_deploy }}" - group: "{{ user_deploy }}" - mode: "0755" - - - name: Setup Node.js 20 repository - ansible.builtin.shell: | - curl -fsSL https://deb.nodesource.com/setup_20.x | bash - - args: - executable: /bin/bash - creates: /etc/apt/sources.list.d/nodesource.list - - - name: Install Node.js 20 - ansible.builtin.apt: - name: nodejs - state: present - update_cache: yes - dpkg_options: "force-overwrite" - - - name: Verify Node.js and npm versions - ansible.builtin.shell: | - node -v - npm -v - register: versions_check - changed_when: false - - - name: Show versions - ansible.builtin.debug: - msg: "{{ versions_check.stdout_lines }}" - - - name: Create folder for frontend - ansible.builtin.file: - path: "{{ frontend_dir }}" - state: directory - owner: "{{ user_deploy }}" - group: "{{ user_deploy }}" - mode: "0755" - tags: frontend - - - name: Synchroniser le frontend (excluant node_modules et .git) - become_user: "{{ user_deploy }}" - ansible.builtin.synchronize: - src: ../frontend-prep/ - dest: "{{ frontend_dir }}/" - rsync_opts: - - "--exclude=node_modules" - - "--exclude=.git" - - "--exclude=.gitignore" - - "--exclude=build" - delete: no - recursive: yes - perms: yes - owner: yes - rsync_path: rsync - tags: frontend - - - name: Install npm dependencies - become_user: "{{ user_deploy }}" - ansible.builtin.command: npm install - args: - chdir: "{{ frontend_dir }}" - tags: frontend - - - name: Build frontend - become_user: "{{ user_deploy }}" - ansible.builtin.command: npm run build - args: - chdir: "{{ frontend_dir }}" - tags: frontend - - - name: Install serve globally - ansible.builtin.command: npm install -g serve - tags: frontend - - - name: Création du fichier systemd pour le frontend - ansible.builtin.copy: - dest: /etc/systemd/system/frontend.service - owner: root - group: root - mode: "0644" - content: | - [Unit] - Description=Frontend React (serve) - After=network.target - - [Service] - User={{ user_deploy }} - WorkingDirectory={{ frontend_dir }} - ExecStart=/usr/bin/npx serve -s build -l {{ frontend_port }} - Restart=always - RestartSec=5 - Environment="NODE_ENV=production" - Environment="VITE_TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB" - [Install] - WantedBy=multi-user.target - notify: Reload systemd - tags: frontend - - - name: Enable and start frontend service - ansible.builtin.systemd: - name: frontend - state: started - enabled: yes - daemon_reload: yes - tags: frontend - - - name: Configuration UFW - ansible.builtin.ufw: - rule: allow - port: "{{ item }}" - proto: tcp - loop: - - "22" - - "80" - - "443" - - - name: Activation du firewall - ansible.builtin.ufw: - state: enabled - - - name: Vérifier si un certificat existe déjà - ansible.builtin.stat: - path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" - register: cert_file - tags: [certbot] - - - name: Déployer la configuration Nginx HTTP - ansible.builtin.template: - src: templates/nginx-frontend.conf.j2 - dest: /etc/nginx/sites-available/frontend - vars: - ssl_enabled: false - tags: [certbot] - - - name: Activation du site Nginx - ansible.builtin.file: - src: /etc/nginx/sites-available/frontend - dest: /etc/nginx/sites-enabled/frontend - state: link - force: yes - tags: [certbot] - - - name: Suppression du site par défaut - ansible.builtin.file: - path: /etc/nginx/sites-enabled/default - state: absent - tags: [certbot] - - - name: Test de la configuration Nginx - ansible.builtin.command: nginx -t - changed_when: false - tags: [certbot] - - - name: Redémarrage de Nginx - ansible.builtin.systemd: - name: nginx - state: restarted - enabled: yes - tags: [certbot] - - # ============================================================ - # Certificat SSL Let's Encrypt - # ============================================================ - - - name: Générer le certificat SSL avec Certbot - ansible.builtin.command: > - certbot certonly --nginx - -d {{ domain_name }} - --non-interactive - --agree-tos - --email admin@{{ domain_name }} - when: not cert_file.stat.exists - tags: [certbot] - - # ============================================================ - # Nginx - reconfiguration HTTPS après certificat - # ============================================================ - - name: Vérifier la présence du certificat - ansible.builtin.stat: - path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem" - register: cert_file_after - - - name: Déployer la configuration Nginx HTTPS - ansible.builtin.template: - src: templates/nginx-frontend.conf.j2 - dest: /etc/nginx/sites-available/frontend - vars: - ssl_enabled: true - when: cert_file_after.stat.exists - notify: Restart nginx - tags: [nginx] - - - name: Test de la configuration Nginx finale - ansible.builtin.command: nginx -t - changed_when: false - tags: [nginx] - - - name: Redémarrage de Nginx avec SSL - ansible.builtin.systemd: - name: nginx - state: restarted - when: cert_file_after.stat.exists - tags: [nginx] - - - name: Vérifier le renouvellement automatique - ansible.builtin.command: certbot renew --dry-run - register: certbot_renew - changed_when: false - failed_when: false - tags: [certbot] - - - name: Afficher le statut du renouvellement - ansible.builtin.debug: - msg: "{{ certbot_renew.stdout_lines }}" - tags: [certbot] - - handlers: - - name: Reload systemd - ansible.builtin.systemd: - daemon_reload: yes - - - name: Restart nginx - ansible.builtin.systemd: - name: nginx - state: restarted diff --git a/ansible/playbook.yml b/ansible/playbook.yml deleted file mode 100644 index 8ca647f5..00000000 --- a/ansible/playbook.yml +++ /dev/null @@ -1,308 +0,0 @@ ---- -# ============================================ -# PostgreSQL Installation (vm-postgres uniquement) -# ============================================ -- name: Installation et configuration de PostgreSQL - hosts: demo-uber - become: true - gather_facts: true - - tasks: - # ============================================================ - # Dépendances requises - # ============================================================ - - name: Installer les dépendances pour le dépôt APT - ansible.builtin.apt: - name: - - gnupg2 - - curl - - ca-certificates - - lsb-release - - python3-psycopg2 - - acl - state: present - update_cache: yes - - # ============================================================ - # Ajout du dépôt officiel PostgreSQL - # ============================================================ - - name: Ajouter la clé GPG du dépôt PostgreSQL - ansible.builtin.apt_key: - url: https://www.postgresql.org/media/keys/ACCC4CF8.asc - state: present - - - name: Ajouter le dépôt PostgreSQL 16 - ansible.builtin.apt_repository: - repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main" - state: present - filename: pgdg - - # ============================================================ - # Installation PostgreSQL 16 - # ============================================================ - - name: Installer PostgreSQL 16 - ansible.builtin.apt: - name: - - "postgresql-{{ pg_version }}" - - "postgresql-client-{{ pg_version }}" - - "postgresql-contrib-{{ pg_version }}" - state: present - update_cache: yes - - - name: Démarrer et activer PostgreSQL - ansible.builtin.systemd: - name: postgresql - state: started - enabled: yes - - # ============================================================ - # Configuration PostgreSQL - # ============================================================ - - name: Configurer l'écoute sur localhost - ansible.builtin.lineinfile: - path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf" - regexp: "^#?listen_addresses" - line: "listen_addresses = 'localhost'" - notify: Restart postgresql - - - name: Configurer le port - ansible.builtin.lineinfile: - path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf" - regexp: "^#?port" - line: "port = {{ db_port }}" - notify: Restart postgresql - - # ============================================================ - # Locale requise - # ============================================================ - - name: Générer la locale fr_FR.UTF-8 - ansible.builtin.command: locale-gen fr_FR.UTF-8 - register: locale_gen - changed_when: "'Generation complete' in locale_gen.stdout" - - - name: Mettre à jour les locales - ansible.builtin.command: update-locale - when: locale_gen.changed - - # ============================================================ - # Création de la base de données et configuration utilisateur - # ============================================================ - - name: Définir le mot de passe de l'utilisateur postgres - become_user: postgres - ansible.builtin.postgresql_user: - name: "{{ db_user }}" - password: "{{ db_password }}" - state: present - - - name: Vérifier si la base de données existe - become_user: postgres - ansible.builtin.command: psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{ db_name }}'" - register: db_exists - changed_when: false - - - name: Créer la base de données avec ICU - become_user: postgres - ansible.builtin.command: > - psql -c "CREATE DATABASE {{ db_name }} - OWNER {{ db_user }} - ENCODING 'UTF8' - LOCALE_PROVIDER icu - ICU_LOCALE 'fr-FR' - TEMPLATE template0" - when: db_exists.stdout != "1" - - - name: Accorder tous les privilèges sur la base - become_user: postgres - ansible.builtin.postgresql_privs: - db: "{{ db_name }}" - role: "{{ db_user }}" - type: database - privs: ALL - state: present - - # ============================================================ - # Authentification pg_hba.conf - # ============================================================ - - name: Configurer l'authentification md5 pour les connexions locales - ansible.builtin.postgresql_pg_hba: - dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf" - contype: host - databases: "{{ db_name }}" - users: "{{ db_user }}" - source: "127.0.0.1/32" - method: md5 - notify: Restart postgresql - - - name: Configurer l'authentification md5 pour IPv6 local - ansible.builtin.postgresql_pg_hba: - dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf" - contype: host - databases: "{{ db_name }}" - users: "{{ db_user }}" - source: "::1/128" - method: md5 - notify: Restart postgresql - - # ============================================================ - # Vérification - # ============================================================ - - name: Vérifier la version de PostgreSQL - become_user: postgres - ansible.builtin.command: psql --version - register: pg_version_check - changed_when: false - - - name: Afficher la version - ansible.builtin.debug: - msg: "{{ pg_version_check.stdout }}" - - - name: Vérifier que la base existe - become_user: postgres - ansible.builtin.command: psql -lqt - register: pg_databases - changed_when: false - - - name: Afficher les bases de données - ansible.builtin.debug: - msg: "{{ pg_databases.stdout_lines }}" - - handlers: - - name: Restart postgresql - ansible.builtin.systemd: - name: postgresql - state: restarted - -# ============================================ -# Redis Installation (vm-redis uniquement) -# ============================================ -- name: Installation et configuration de Redis - hosts: demo-uber - become: true - gather_facts: true - - tasks: - - name: Installer Redis - apt: - name: - - redis-server - - python3-redis - state: present - update_cache: yes - - - name: Créer le répertoire de backup Redis - file: - path: /var/lib/redis/backup - state: directory - owner: redis - group: redis - mode: "0755" - - - name: Configurer Redis - bind address (accepter connexions réseau) - lineinfile: - path: /etc/redis/redis.conf - regexp: "^bind" - line: "bind 127.0.0.1 192.168.1.62" - state: present - notify: Redémarrer Redis - - - name: Configurer Redis - port - lineinfile: - path: /etc/redis/redis.conf - regexp: "^port" - line: "port {{ redis_port }}" - state: present - notify: Redémarrer Redis - - - name: Configurer Redis - maxmemory - lineinfile: - path: /etc/redis/redis.conf - regexp: "^# ?maxmemory" - line: "maxmemory {{ redis_maxmemory }}" - state: present - notify: Redémarrer Redis - - - name: Configurer Redis - maxmemory-policy - lineinfile: - path: /etc/redis/redis.conf - regexp: "^# ?maxmemory-policy" - line: "maxmemory-policy {{ redis_maxmemory_policy }}" - state: present - notify: Redémarrer Redis - - - name: Configurer Redis - requirepass - lineinfile: - path: /etc/redis/redis.conf - regexp: "^# ?requirepass" - line: "requirepass {{ redis_password }}" - state: present - notify: Redémarrer Redis - - - name: Activer AOF (Append Only File) pour Redis - lineinfile: - path: /etc/redis/redis.conf - regexp: "^appendonly" - line: "appendonly yes" - state: present - notify: Redémarrer Redis - - - name: Configurer la fréquence de sync AOF - lineinfile: - path: /etc/redis/redis.conf - regexp: "^# ?appendfsync" - line: "appendfsync everysec" - state: present - notify: Redémarrer Redis - - - name: Activer la persistance RDB (snapshots) - blockinfile: - path: /etc/redis/redis.conf - block: | - save 900 1 - save 300 10 - save 60 10000 - marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE" - notify: Redémarrer Redis - - - name: Configurer le nom du fichier AOF - lineinfile: - path: /etc/redis/redis.conf - regexp: "^appendfilename" - line: 'appendfilename "appendonly.aof"' - state: present - notify: Redémarrer Redis - - - name: Désactiver le mode protégé Redis - lineinfile: - path: /etc/redis/redis.conf - regexp: "^protected-mode" - line: "protected-mode no" - state: present - notify: Redémarrer Redis - - - name: Configurer le répertoire de travail Redis - lineinfile: - path: /etc/redis/redis.conf - regexp: "^dir" - line: "dir /var/lib/redis" - state: present - notify: Redémarrer Redis - - - name: Définir le niveau de log - lineinfile: - path: /etc/redis/redis.conf - regexp: "^loglevel" - line: "loglevel notice" - state: present - notify: Redémarrer Redis - - - name: S'assurer que Redis est démarré - systemd: - name: redis-server - state: started - enabled: yes - - handlers: - - name: Redémarrer Redis - systemd: - name: redis-server - state: restarted diff --git a/ansible/templates/backend.service.j2 b/ansible/templates/backend.service.j2 deleted file mode 100644 index 252932d0..00000000 --- a/ansible/templates/backend.service.j2 +++ /dev/null @@ -1,28 +0,0 @@ -[Unit] -Description=Backend Golang API -After=network.target - -[Service] -User={{ user_owner }} -WorkingDirectory={{ backend_dir }} -Environment="PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" -Environment="USER_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlds" -Environment="DB_HOST=localhost" -Environment="DB_PORT=5432" -Environment="DB_USER=admin_gestion_commande_db" -Environment="DB_PASSWORD=hb-FS462(#I~6(4',Nt=3Rd4567890jsezZ" -Environment="DB_NAME=gestion_commande_db" -Environment="DB_SSLMODE=disable" -Environment="REDIS_HOST=127.0.0.1" -Environment="REDIS_PORT=6379" -Environment="REDIS_PASSWORD=uQ64h5UhFdrm!H|_cCQer" -Environment="SESSION_SECRET=jfWR21Ywbuy{Yq<1A26TV)jCe" -Environment="GIN_MODE=release" -Environment="TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB" -Environment="API_PORT={{ backend_local_port }}" -Environment="ADMIN_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlzZ" -ExecStart={{ backend_binary }} -Restart=always - -[Install] -WantedBy=multi-user.target diff --git a/ansible/templates/frontend.service.j2 b/ansible/templates/frontend.service.j2 deleted file mode 100644 index 37e51e8d..00000000 --- a/ansible/templates/frontend.service.j2 +++ /dev/null @@ -1,14 +0,0 @@ -[Unit] -Description=Frontend React Production (Vite) -After=network.target - -[Service] -User={{ user_owner }} -Group={{ user_owner }} -WorkingDirectory={{ nginx_frontend_path }} -ExecStart=/usr/bin/npm run preview -- --port {{ frontend_port }} -Restart=always -Environment=NODE_ENV=production - -[Install] -WantedBy=multi-user.target diff --git a/ansible/templates/nginx-frontend.conf.j2 b/ansible/templates/nginx-frontend.conf.j2 deleted file mode 100644 index b8c2308f..00000000 --- a/ansible/templates/nginx-frontend.conf.j2 +++ /dev/null @@ -1,191 +0,0 @@ -# ========================================================= -# Request ID for correlation -# ========================================================= -map $http_x_request_id $req_id { - default $http_x_request_id; - "" $request_id; -} - -# ========================================================= -# Backend distant -# ========================================================= -upstream backend { - server uber-stup.club:443; - keepalive 32; -} - -{% if ssl_enabled %} -# ========================================================= -# HTTP → HTTPS redirect + ACME challenge -# ========================================================= -server { - listen 80; - listen [::]:80; - server_name {{ domain_name }}; - - # Certbot renouvellement automatique - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - return 301 https://$host$request_uri; - } -} - -# ========================================================= -# HTTPS Server -# ========================================================= -server { - listen 443 ssl; - listen [::]:443 ssl; - server_name {{ domain_name }}; - - # ========================================================= - # SSL/TLS - Let's Encrypt - # ========================================================= - ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/{{ domain_name }}/chain.pem; - - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256; - ssl_prefer_server_ciphers off; - - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 1d; - ssl_session_tickets off; - - ssl_stapling on; - ssl_stapling_verify on; - resolver 1.1.1.1 8.8.8.8 valid=300s; - resolver_timeout 5s; - -{% else %} -# ========================================================= -# HTTP Server (phase pré-certificat) -# ========================================================= -server { - listen 80; - listen [::]:80; - server_name {{ domain_name }}; - - # ACME challenge accessible avant l'émission du certificat - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - -{% endif %} - root {{ frontend_dir }}/dist; - index index.html; - client_max_body_size {{ nginx_max_body_size }}; - - location /api/ { - limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; } - - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin' "$http_origin" always; - add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always; - add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always; - add_header 'Access-Control-Allow-Credentials' 'true' always; - add_header 'Access-Control-Max-Age' 86400 always; - add_header 'Content-Length' 0; - add_header 'Content-Type' 'text/plain charset=UTF-8'; - return 204; - } - - proxy_pass https://backend; - proxy_http_version 1.1; - - proxy_ssl_server_name on; - proxy_ssl_name uber-stup.club; - - proxy_set_header Host uber-stup.club; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Request-ID $req_id; - proxy_set_header Connection ""; - - proxy_connect_timeout {{ nginx_proxy_timeout }}s; - proxy_send_timeout {{ nginx_proxy_timeout }}s; - proxy_read_timeout {{ nginx_proxy_timeout }}s; - } - - location / { - try_files $uri $uri/ /index.html; - add_header Cache-Control "no-cache, no-store, must-revalidate" always; - add_header Pragma "no-cache" always; - add_header Expires "0" always; - } - - location /uploads/ { - alias {{ uploads_dir }}/; - expires 30d; - add_header Cache-Control "public, immutable"; - } - - location ^~ /uploads/images/ { - alias {{ uploads_dir }}/images/; - - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - - expires 30d; - add_header Cache-Control "public, immutable" always; - - types { - image/jpeg jpg jpeg; - image/png png; - image/gif gif; - image/webp webp; - image/svg+xml svg; - } - default_type image/jpeg; - } - - location ^~ /uploads/videos/ { - alias {{ uploads_dir }}/videos/; - - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - - expires 30d; - add_header Cache-Control "public, immutable" always; - - types { - video/mp4 mp4; - video/webm webm; - video/ogg ogv; - } - default_type video/mp4; - } - - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header Referrer-Policy "strict-origin-when-cross-origin" always; -{% if ssl_enabled %} - add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; -{% endif %} - add_header Content-Security-Policy " - default-src 'self'; - script-src 'self' 'unsafe-inline' 'unsafe-eval'; - style-src 'self' 'unsafe-inline'; - img-src 'self' data: https:; - font-src 'self' data:; - connect-src 'self' https://api.tomtom.com https://uber-stup.club; - " always; - - location ~ /\. { - deny all; - access_log off; - log_not_found off; - } - - location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ { - deny all; - access_log off; - log_not_found off; - } -} diff --git a/ansible/templates/nginx.conf.j2 b/ansible/templates/nginx.conf.j2 deleted file mode 100644 index 7570e2de..00000000 --- a/ansible/templates/nginx.conf.j2 +++ /dev/null @@ -1,170 +0,0 @@ -# ========================================================= -# Request ID for correlation -# ========================================================= -map $http_x_request_id $req_id { - default $http_x_request_id; - "" $request_id; -} - -# ========================================================= -# Rate limiting -# ========================================================= -limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m; -limit_req_zone $binary_remote_addr zone=uploads:10m rate=10r/m; - -# ========================================================= -# Upstream backend -# ========================================================= -upstream backend { - server 127.0.0.1:{{ backend_local_port }} max_fails=3 fail_timeout=30s; - keepalive 32; - keepalive_requests 100; - keepalive_timeout 60s; -} - -{% if ssl_enabled %} -# ========================================================= -# HTTP → HTTPS redirect -# ========================================================= -server { - listen 80; - listen [::]:80; - server_name {{ domain_name }}; - return 301 https://$host$request_uri; -} -{% endif %} - -# ========================================================= -# API Server -# ========================================================= -server { -{% if ssl_enabled %} - listen {{ backend_port }} ssl; - listen [::]:{{ backend_port }} ssl; - - ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; - ssl_prefer_server_ciphers off; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 1d; - ssl_session_tickets off; - add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; -{% else %} - listen {{ backend_port }}; - listen [::]:{{ backend_port }}; -{% endif %} - - server_name {{ domain_name }}; - client_max_body_size {{ nginx_max_body_size }}; - - server_tokens off; - - # ========================================================= - # Security headers - # ========================================================= - add_header X-Frame-Options "DENY" always; - add_header X-Content-Type-Options "nosniff" always; - add_header Referrer-Policy "strict-origin-when-cross-origin" always; - proxy_hide_header X-Powered-By; - proxy_hide_header Server; - - # ========================================================= - # API proxy - # ========================================================= - location / { - limit_req zone=api burst=20 nodelay; - - limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; } - - proxy_pass http://backend; - proxy_http_version 1.1; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Request-ID $req_id; - proxy_set_header Connection ""; - - proxy_connect_timeout 60s; - proxy_send_timeout 60s; - proxy_read_timeout 60s; - } - - # ========================================================= - # Uploads - # ========================================================= - location /uploads/ { - alias {{ uploads_dir }}/; - limit_req zone=uploads burst=20 nodelay; - limit_except GET HEAD { deny all; } - - # Bloquer les fichiers exécutables - location ~* \.(php|php5|phtml|sh|py|pl|cgi|exe|asp|aspx|jsp)$ { - deny all; - } - - expires 30d; - add_header Cache-Control "public, immutable"; - add_header X-Content-Type-Options "nosniff" always; - } - - location ^~ /uploads/images/ { - alias {{ uploads_dir }}/images/; - limit_req zone=uploads burst=20 nodelay; - limit_except GET HEAD OPTIONS { deny all; } - - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - add_header X-Content-Type-Options "nosniff" always; - - expires 30d; - add_header Cache-Control "public, immutable" always; - - types { - image/jpeg jpg jpeg; - image/png png; - image/gif gif; - image/webp webp; - image/svg+xml svg; - } - default_type image/jpeg; - } - - location ^~ /uploads/videos/ { - alias {{ uploads_dir }}/videos/; - limit_req zone=uploads burst=20 nodelay; - limit_except GET HEAD OPTIONS { deny all; } - - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - add_header X-Content-Type-Options "nosniff" always; - - expires 30d; - add_header Cache-Control "public, immutable" always; - - types { - video/mp4 mp4; - video/webm webm; - video/ogg ogv; - } - default_type video/mp4; - } - - # ========================================================= - # Deny hidden files and sensitive files - # ========================================================= - location ~ /\. { - deny all; - access_log off; - log_not_found off; - } - - location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ { - deny all; - access_log off; - log_not_found off; - } -} diff --git a/ansible/templates/nginx2.conf.j2 b/ansible/templates/nginx2.conf.j2 deleted file mode 100644 index 739bbcfd..00000000 --- a/ansible/templates/nginx2.conf.j2 +++ /dev/null @@ -1,142 +0,0 @@ -# ========================================================= -# Request ID for correlation -# ========================================================= -map $http_x_request_id $req_id { - default $http_x_request_id; - "" $request_id; -} - -# ========================================================= -# Rate limiting -# ========================================================= -limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m; -limit_req_zone $binary_remote_addr zone=uploads:10m rate=10r/m; - -# ========================================================= -# Upstream backend -# ========================================================= -upstream backend { - server 127.0.0.1:{{ backend_local_port }} max_fails=3 fail_timeout=30s; - keepalive 32; - keepalive_requests 100; - keepalive_timeout 60s; -} - -# ========================================================= -# API Server -# ========================================================= -server { - listen {{ backend_port }}; - listen [::]:{{ backend_port }}; - server_name {{ ip }}; - client_max_body_size {{ nginx_max_body_size }}; - - server_tokens off; - - # ========================================================= - # Security headers - # ========================================================= - add_header X-Frame-Options "DENY" always; - add_header X-Content-Type-Options "nosniff" always; - add_header Referrer-Policy "strict-origin-when-cross-origin" always; - proxy_hide_header X-Powered-By; - proxy_hide_header Server; - - # ========================================================= - # API proxy - # ========================================================= - location / { - limit_req zone=api burst=20 nodelay; - - limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; } - - proxy_pass http://backend; - proxy_http_version 1.1; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Request-ID $req_id; - proxy_set_header Connection ""; - - proxy_connect_timeout 60s; - proxy_send_timeout 60s; - proxy_read_timeout 60s; - } - - # ========================================================= - # Uploads - # ========================================================= - location /uploads/ { - alias {{ uploads_dir }}/; - limit_req zone=uploads burst=20 nodelay; - limit_except GET HEAD { deny all; } - - # Bloquer les fichiers exécutables - location ~* \.(php|php5|phtml|sh|py|pl|cgi|exe|asp|aspx|jsp)$ { - deny all; - } - - expires 30d; - add_header Cache-Control "public, immutable"; - add_header X-Content-Type-Options "nosniff" always; - } - - location ^~ /uploads/images/ { - alias {{ uploads_dir }}/images/; - limit_req zone=uploads burst=20 nodelay; - limit_except GET HEAD OPTIONS { deny all; } - - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - add_header X-Content-Type-Options "nosniff" always; - - expires 30d; - add_header Cache-Control "public, immutable" always; - - types { - image/jpeg jpg jpeg; - image/png png; - image/gif gif; - image/webp webp; - image/svg+xml svg; - } - default_type image/jpeg; - } - - location ^~ /uploads/videos/ { - alias {{ uploads_dir }}/videos/; - limit_req zone=uploads burst=20 nodelay; - limit_except GET HEAD OPTIONS { deny all; } - - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always; - add_header X-Content-Type-Options "nosniff" always; - - expires 30d; - add_header Cache-Control "public, immutable" always; - - types { - video/mp4 mp4; - video/webm webm; - video/ogg ogv; - } - default_type video/mp4; - } - - # ========================================================= - # Deny hidden files and sensitive files - # ========================================================= - location ~ /\. { - deny all; - access_log off; - log_not_found off; - } - - location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ { - deny all; - access_log off; - log_not_found off; - } -} diff --git a/ansible/templates/tunnel.service.j2 b/ansible/templates/tunnel.service.j2 deleted file mode 100644 index 7f85e1e8..00000000 --- a/ansible/templates/tunnel.service.j2 +++ /dev/null @@ -1,25 +0,0 @@ -[Unit] -Description=Serveo Tunnel Service -After=network-online.target nginx.service -Wants=network-online.target - -[Service] -Type=simple -User=ubuntu -WorkingDirectory={{directory}} -ExecStart=/usr/bin/ssh \ - -o ServerAliveInterval=60 \ - -o ServerAliveCountMax=3 \ - -o ExitOnForwardFailure=yes \ - -o StrictHostKeyChecking=no \ - -R {{nginx_app_name}}:80:{{nginx_domain}}:80 \ - serveo.net - -Restart=always -RestartSec=10 - -StandardOutput=append:{{tunnel_log}} -StandardError=append:{{tunnel_log_error}} - -[Install] -WantedBy=multi-user.target