chore: delete ansible
This commit is contained in:
+1
-1
@@ -2,4 +2,4 @@
|
|||||||
**/.expo/
|
**/.expo/
|
||||||
test_address.sh
|
test_address.sh
|
||||||
easpip
|
easpip
|
||||||
ansible
|
ansible/
|
||||||
|
|||||||
@@ -1,9 +0,0 @@
|
|||||||
[defaults]
|
|
||||||
inventory = inventory/host.ini
|
|
||||||
host_key_checking = False
|
|
||||||
interpreter_python = auto_silent
|
|
||||||
|
|
||||||
[privilege_escalation]
|
|
||||||
become = True
|
|
||||||
become_method = sudo
|
|
||||||
become_user = root
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
pg_version: "16"
|
|
||||||
db_user: admin_gestion_commande_db
|
|
||||||
db_name: gestion_commande_db
|
|
||||||
db_password: "hb-FS462(#I~6(4',Nt=3Rd4567890jsezZ"
|
|
||||||
db_host: "localhost"
|
|
||||||
db_port: 5432
|
|
||||||
# Redis Configuration
|
|
||||||
redis_bind: "127.0.0.1"
|
|
||||||
redis_port: 6379
|
|
||||||
redis_maxmemory: "1024mb"
|
|
||||||
redis_maxmemory_policy: "allkeys-lru"
|
|
||||||
redis_password: "uQ64h5UhFdrm!H|_cCQer"
|
|
||||||
|
|
||||||
# ============================================
|
|
||||||
# Configuration Nginx et Applications
|
|
||||||
# ============================================
|
|
||||||
|
|
||||||
directory: "/home/ubuntu"
|
|
||||||
backend_dir: "/home/ubuntu/backend"
|
|
||||||
backend_binary: "/home/ubuntu/backend/main"
|
|
||||||
uploads_dir: "/home/ubuntu/backend/uploads"
|
|
||||||
frontend_port: 5173
|
|
||||||
domain_name: "uber-demo.club"
|
|
||||||
# Utilisateurs et permissions
|
|
||||||
user_web: "www-data" # Utilisateur pour les applications web
|
|
||||||
user_deploy: "ubuntu" # Utilisateur pour le déploiement
|
|
||||||
user_owner: "root" # Propriétaire des fichiers systemd
|
|
||||||
ip: "5.181.0.112"
|
|
||||||
# Backend
|
|
||||||
backend_local_port: 8080
|
|
||||||
backend_port: 80
|
|
||||||
# Timeouts
|
|
||||||
nginx_proxy_timeout: 60
|
|
||||||
|
|
||||||
# Upload Size
|
|
||||||
nginx_max_body_size: "10M"
|
|
||||||
|
|
||||||
# Security
|
|
||||||
nginx_enable_firewall: true
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
[all]
|
|
||||||
uber-stup ansible_host=5.252.20.129 ansible_user=root ansible_ssh_pass=rL9lY6YkcDQmfRuZ3Z
|
|
||||||
uber-stup-web ansible_host=185.234.9.102 ansible_user=root ansible_ssh_pass=hTASFYOydY46haeO3J
|
|
||||||
demo-uber ansible_host=5.181.0.112 ansible_user=root ansible_ssh_pass=jQCpl49FcISQfHaF8j
|
|
||||||
|
|
||||||
[uber-stup]
|
|
||||||
uber-stup ansible_host=5.252.20.129 ansible_user=root ansible_ssh_pass=rL9lY6YkcDQmfRuZ3Z
|
|
||||||
|
|
||||||
[uber-stup-web]
|
|
||||||
uber-stup-web ansible_host=185.234.9.102 ansible_user=root ansible_ssh_pass=hTASFYOydY46haeO3J
|
|
||||||
|
|
||||||
[demo-uber]
|
|
||||||
demo-uber ansible_host=5.181.0.112 ansible_user=root ansible_ssh_pass=jQCpl49FcISQfHaF8j
|
|
||||||
@@ -1,316 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Installation et configuration du frontend et backend
|
|
||||||
hosts: demo-uber
|
|
||||||
become: true
|
|
||||||
gather_facts: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Update and upgrade
|
|
||||||
ansible.builtin.apt:
|
|
||||||
update_cache: yes
|
|
||||||
cache_valid_time: 3600
|
|
||||||
upgrade: "dist"
|
|
||||||
|
|
||||||
- name: install basic dependencies
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name:
|
|
||||||
- curl
|
|
||||||
- wget
|
|
||||||
- tar
|
|
||||||
- rsync
|
|
||||||
- acl
|
|
||||||
- nginx
|
|
||||||
- certbot
|
|
||||||
- python3-certbot-nginx
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Download Go 1.23.0 tarball
|
|
||||||
ansible.builtin.get_url:
|
|
||||||
url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz
|
|
||||||
dest: /tmp/go1.23.0.linux-amd64.tar.gz
|
|
||||||
mode: "0644"
|
|
||||||
|
|
||||||
- name: Extract Go 1.23.0
|
|
||||||
ansible.builtin.unarchive:
|
|
||||||
src: /tmp/go1.23.0.linux-amd64.tar.gz
|
|
||||||
dest: /usr/local
|
|
||||||
remote_src: yes
|
|
||||||
|
|
||||||
- name: Ensure Go 1.23 is in PATH for all users
|
|
||||||
ansible.builtin.lineinfile:
|
|
||||||
path: /etc/profile.d/go.sh
|
|
||||||
line: "export PATH=/usr/local/go/bin:$PATH"
|
|
||||||
create: yes
|
|
||||||
state: present
|
|
||||||
mode: "0644"
|
|
||||||
|
|
||||||
- name: Check Go versions
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
echo "Go: $(go version)"
|
|
||||||
register: versions_check
|
|
||||||
changed_when: false
|
|
||||||
failed_when: versions_check.rc != 0
|
|
||||||
|
|
||||||
- name: Display all versions
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ versions_check.stdout_lines }}"
|
|
||||||
|
|
||||||
# ============================================
|
|
||||||
# FRONTEND
|
|
||||||
# ============================================
|
|
||||||
|
|
||||||
- name: Create /var/www if not exists
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /var/www
|
|
||||||
state: directory
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Créer l'utilisateur de déploiement s'il n'existe pas
|
|
||||||
ansible.builtin.user:
|
|
||||||
name: "{{ user_deploy }}"
|
|
||||||
shell: /bin/bash
|
|
||||||
create_home: yes
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Ensure /home/{{ user_deploy }} exists with correct permissions
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "/home/{{ user_deploy }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ user_deploy }}"
|
|
||||||
group: "{{ user_deploy }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
# ============================================
|
|
||||||
# BACKEND
|
|
||||||
# ============================================
|
|
||||||
|
|
||||||
- name: Create backend directory with deploy user ownership
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_dir }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ user_deploy }}"
|
|
||||||
group: "{{ user_deploy }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Synchroniser le backend Go
|
|
||||||
ansible.builtin.synchronize:
|
|
||||||
src: ../backend/gestion/
|
|
||||||
dest: "{{ backend_dir }}/"
|
|
||||||
rsync_opts:
|
|
||||||
- "--exclude=.git"
|
|
||||||
- "--exclude=.gitignore"
|
|
||||||
- "--exclude=docker-compose.yml"
|
|
||||||
- "--exclude=.env"
|
|
||||||
- "--no-owner"
|
|
||||||
- "--no-group"
|
|
||||||
delete: yes
|
|
||||||
recursive: yes
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Fix backend ownership after rsync (rsync tourne en root)
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_dir }}"
|
|
||||||
owner: "{{ user_deploy }}"
|
|
||||||
group: "{{ user_deploy }}"
|
|
||||||
recurse: yes
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Remove old binary if owned by another user
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_dir }}/main"
|
|
||||||
state: absent
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Compile backend as deploy user
|
|
||||||
become_user: "{{ user_deploy }}"
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
export PATH=/usr/local/go/bin:$PATH
|
|
||||||
go mod tidy
|
|
||||||
go build -o main .
|
|
||||||
args:
|
|
||||||
chdir: "{{ backend_dir }}"
|
|
||||||
executable: /bin/bash
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Set ownership to www-data for runtime
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_dir }}"
|
|
||||||
owner: "{{ user_web }}"
|
|
||||||
group: "{{ user_web }}"
|
|
||||||
mode: "0755"
|
|
||||||
recurse: yes
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Set executable permission on backend binary
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_binary }}"
|
|
||||||
owner: "{{ user_web }}"
|
|
||||||
group: "{{ user_web }}"
|
|
||||||
mode: "0755"
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
# ============================================
|
|
||||||
# SYSTEMD SERVICES
|
|
||||||
# ============================================
|
|
||||||
|
|
||||||
- name: Create systemd service for backend
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: ./templates/backend.service.j2
|
|
||||||
dest: /etc/systemd/system/backend.service
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: "0644"
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Reload systemd daemon
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
daemon_reload: yes
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Enable and restart backend service
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: backend
|
|
||||||
enabled: yes
|
|
||||||
state: restarted
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Wait for backend to be ready
|
|
||||||
ansible.builtin.wait_for:
|
|
||||||
port: "{{ backend_local_port }}"
|
|
||||||
delay: 2
|
|
||||||
timeout: 30
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Display service status
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
echo "=== Backend Service ==="
|
|
||||||
systemctl status backend --no-pager || true
|
|
||||||
register: service_status
|
|
||||||
changed_when: false
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Show service status
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ service_status.stdout_lines }}"
|
|
||||||
tags: backend
|
|
||||||
|
|
||||||
- name: Configuration UFW
|
|
||||||
ansible.builtin.ufw:
|
|
||||||
rule: allow
|
|
||||||
port: "{{ item }}"
|
|
||||||
proto: tcp
|
|
||||||
loop:
|
|
||||||
- 80
|
|
||||||
- 22
|
|
||||||
|
|
||||||
- name: Activation du firewall
|
|
||||||
ansible.builtin.ufw:
|
|
||||||
state: enabled
|
|
||||||
|
|
||||||
# - name: Vérifier si un certificat existe déjà
|
|
||||||
# ansible.builtin.stat:
|
|
||||||
# path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
||||||
# register: cert_file
|
|
||||||
# tags: [certbot]
|
|
||||||
#
|
|
||||||
- name: Déployer la configuration Nginx HTTP
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: templates/nginx2.conf.j2
|
|
||||||
dest: /etc/nginx/sites-available/api
|
|
||||||
vars:
|
|
||||||
ssl_enabled: false
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Activation du site Nginx
|
|
||||||
ansible.builtin.file:
|
|
||||||
src: /etc/nginx/sites-available/api
|
|
||||||
dest: /etc/nginx/sites-enabled/api
|
|
||||||
state: link
|
|
||||||
force: yes
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Suppression du site par défaut
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /etc/nginx/sites-enabled/default
|
|
||||||
state: absent
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Test de la configuration Nginx
|
|
||||||
ansible.builtin.command: nginx -t
|
|
||||||
changed_when: false
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Redémarrage de Nginx
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
enabled: yes
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Certificat SSL Let's Encrypt
|
|
||||||
# ============================================================
|
|
||||||
# - name: Générer le certificat SSL avec Certbot
|
|
||||||
# ansible.builtin.command: >
|
|
||||||
# certbot certonly --nginx
|
|
||||||
# -d {{ domain_name }}
|
|
||||||
# --non-interactive
|
|
||||||
# --agree-tos
|
|
||||||
# --email admin@{{ domain_name }}
|
|
||||||
# tags: [certbot]
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Nginx - reconfiguration HTTPS après certificat
|
|
||||||
# ============================================================
|
|
||||||
# - name: Vérifier la présence du certificat
|
|
||||||
# ansible.builtin.stat:
|
|
||||||
# path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
||||||
# register: cert_file_after
|
|
||||||
# tags: [nginx]
|
|
||||||
|
|
||||||
#- name: Déployer la configuration Nginx HTTPS
|
|
||||||
# ansible.builtin.template:
|
|
||||||
# src: templates/nginx.conf.j2
|
|
||||||
# dest: /etc/nginx/sites-available/api
|
|
||||||
# vars:
|
|
||||||
# ssl_enabled: true
|
|
||||||
# when: cert_file_after.stat.exists
|
|
||||||
# notify: Restart nginx
|
|
||||||
# tags: [nginx]
|
|
||||||
|
|
||||||
#- name: Test de la configuration Nginx finale
|
|
||||||
# ansible.builtin.command: nginx -t
|
|
||||||
# changed_when: false
|
|
||||||
# tags: [nginx]
|
|
||||||
|
|
||||||
# - name: Redémarrage de Nginx avec SSL
|
|
||||||
# ansible.builtin.systemd:
|
|
||||||
# name: nginx
|
|
||||||
# state: restarted
|
|
||||||
# when: cert_file_after.stat.exists
|
|
||||||
# tags: [nginx]
|
|
||||||
|
|
||||||
# - name: Vérifier le renouvellement automatique
|
|
||||||
# ansible.builtin.command: certbot renew --dry-run
|
|
||||||
# register: certbot_renew
|
|
||||||
# changed_when: false
|
|
||||||
# failed_when: false
|
|
||||||
# tags: [certbot]
|
|
||||||
|
|
||||||
# - name: Afficher le statut du renouvellement
|
|
||||||
# ansible.builtin.debug:
|
|
||||||
# msg: "{{ certbot_renew.stdout_lines }}"
|
|
||||||
# tags: [certbot]
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Reload systemd
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
daemon_reload: yes
|
|
||||||
|
|
||||||
- name: Restart nginx
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
@@ -1,198 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Installation et configuration du frontend et backend
|
|
||||||
hosts: backend
|
|
||||||
become: true
|
|
||||||
gather_facts: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Update apt cache
|
|
||||||
apt:
|
|
||||||
update_cache: yes
|
|
||||||
cache_valid_time: 3600
|
|
||||||
|
|
||||||
- name: Install required packages
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- apt-transport-https
|
|
||||||
- ca-certificates
|
|
||||||
- curl
|
|
||||||
- gnupg
|
|
||||||
- lsb-release
|
|
||||||
- software-properties-common
|
|
||||||
- acl
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Create directory for Docker GPG key
|
|
||||||
file:
|
|
||||||
path: /etc/apt/keyrings
|
|
||||||
state: directory
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Add Docker GPG key
|
|
||||||
apt_key:
|
|
||||||
url: https://download.docker.com/linux/ubuntu/gpg
|
|
||||||
keyring: /etc/apt/keyrings/docker.gpg
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Get system architecture
|
|
||||||
command: dpkg --print-architecture
|
|
||||||
register: system_arch
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Get Ubuntu codename
|
|
||||||
command: lsb_release -cs
|
|
||||||
register: ubuntu_codename
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Add Docker repository
|
|
||||||
apt_repository:
|
|
||||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
|
||||||
state: present
|
|
||||||
filename: docker
|
|
||||||
|
|
||||||
- name: Update apt cache after adding repo
|
|
||||||
apt:
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Install Docker packages
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- docker-ce
|
|
||||||
- docker-ce-cli
|
|
||||||
- containerd.io
|
|
||||||
- docker-buildx-plugin
|
|
||||||
- docker-compose-plugin
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Ensure Docker service is started and enabled
|
|
||||||
systemd:
|
|
||||||
name: docker
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
- name: Create docker group
|
|
||||||
group:
|
|
||||||
name: "{{ docker_group }}"
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Create docker user
|
|
||||||
user:
|
|
||||||
name: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
groups: docker
|
|
||||||
append: yes
|
|
||||||
shell: /bin/bash
|
|
||||||
create_home: yes
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Add ansible user to docker group
|
|
||||||
user:
|
|
||||||
name: "{{ ansible_user }}"
|
|
||||||
groups: docker
|
|
||||||
append: yes
|
|
||||||
when: ansible_user is defined
|
|
||||||
|
|
||||||
- name: Verify Docker installation
|
|
||||||
command: docker --version
|
|
||||||
register: docker_version
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Verify Docker Compose installation
|
|
||||||
command: docker compose version
|
|
||||||
register: compose_version
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Display versions
|
|
||||||
debug:
|
|
||||||
msg:
|
|
||||||
- "{{ docker_version.stdout }}"
|
|
||||||
- "{{ compose_version.stdout }}"
|
|
||||||
|
|
||||||
- name: Create frontend directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ nginx_frontend_path }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Create backend directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_dir }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Synchronize frontend content (excluding node_modules and .git)
|
|
||||||
ansible.builtin.synchronize:
|
|
||||||
src: ../frontend-prep
|
|
||||||
dest: "{{ nginx_frontend_path }}/"
|
|
||||||
rsync_opts:
|
|
||||||
- "--exclude=node_modules"
|
|
||||||
- "--exclude=.git"
|
|
||||||
- "--exclude=dist"
|
|
||||||
- "--exclude=build"
|
|
||||||
delete: no
|
|
||||||
recursive: yes
|
|
||||||
tags: sync_frontend
|
|
||||||
|
|
||||||
- name: Set ownership for frontend directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ nginx_frontend_path }}"
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
recurse: yes
|
|
||||||
tags: sync_frontend
|
|
||||||
|
|
||||||
- name: Synchronize backend content (excluding node_modules and .git)
|
|
||||||
ansible.builtin.synchronize:
|
|
||||||
src: ../backend
|
|
||||||
dest: "{{ backend_dir }}/"
|
|
||||||
rsync_opts:
|
|
||||||
- "--exclude=node_modules"
|
|
||||||
- "--exclude=.git"
|
|
||||||
- "--exclude=dist"
|
|
||||||
- "--exclude=build"
|
|
||||||
delete: no
|
|
||||||
recursive: yes
|
|
||||||
tags: sync_backend
|
|
||||||
|
|
||||||
- name: Set ownership for backend directory
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ backend_dir }}"
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
recurse: yes
|
|
||||||
tags: sync_backend
|
|
||||||
|
|
||||||
- name: Copy Docker project
|
|
||||||
ansible.builtin.copy:
|
|
||||||
src: ../docker/
|
|
||||||
dest: "{{ docker_dir }}/"
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Ensure parent directory has correct permissions
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ docker_dir }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Set correct permissions for Docker files
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ docker_dir }}"
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
recurse: yes
|
|
||||||
|
|
||||||
- name: Set permissions for .env file
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ docker_dir }}/.env"
|
|
||||||
owner: "{{ docker_user }}"
|
|
||||||
group: "{{ docker_group }}"
|
|
||||||
mode: "0640"
|
|
||||||
ignore_errors: yes
|
|
||||||
@@ -1,142 +0,0 @@
|
|||||||
---
|
|
||||||
# ============================================
|
|
||||||
# Fail2Ban Installation et configuration
|
|
||||||
# ============================================
|
|
||||||
- name: Installation et configuration de Fail2Ban
|
|
||||||
hosts: uber-stup-web
|
|
||||||
become: true
|
|
||||||
gather_facts: true
|
|
||||||
|
|
||||||
vars:
|
|
||||||
fail2ban_bantime: "1h"
|
|
||||||
fail2ban_findtime: "10m"
|
|
||||||
fail2ban_maxretry: 5
|
|
||||||
fail2ban_ignoreip: "127.0.0.1/8 ::1"
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
# ============================================================
|
|
||||||
# Installation
|
|
||||||
# ============================================================
|
|
||||||
- name: Installer Fail2Ban
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name: fail2ban
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Configuration globale (jail.local)
|
|
||||||
# ============================================================
|
|
||||||
- name: Créer jail.local avec la configuration globale
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: /etc/fail2ban/jail.local
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: "0644"
|
|
||||||
content: |
|
|
||||||
[DEFAULT]
|
|
||||||
ignoreip = {{ fail2ban_ignoreip }}
|
|
||||||
bantime = {{ fail2ban_bantime }}
|
|
||||||
findtime = {{ fail2ban_findtime }}
|
|
||||||
maxretry = {{ fail2ban_maxretry }}
|
|
||||||
banaction = iptables-multiport
|
|
||||||
backend = systemd
|
|
||||||
loglevel = INFO
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# SSH
|
|
||||||
# ============================================================
|
|
||||||
[sshd]
|
|
||||||
enabled = true
|
|
||||||
port = ssh
|
|
||||||
filter = sshd
|
|
||||||
logpath = %(sshd_log)s
|
|
||||||
maxretry = 3
|
|
||||||
bantime = 24h
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Nginx - requêtes trop fréquentes (rate limit)
|
|
||||||
# ============================================================
|
|
||||||
[nginx-limit-req]
|
|
||||||
enabled = true
|
|
||||||
port = http,https
|
|
||||||
filter = nginx-limit-req
|
|
||||||
logpath = /var/log/nginx/error.log
|
|
||||||
maxretry = 10
|
|
||||||
bantime = 1h
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Nginx - 4xx répétés (scan, bot)
|
|
||||||
# ============================================================
|
|
||||||
[nginx-http-auth]
|
|
||||||
enabled = true
|
|
||||||
port = http,https
|
|
||||||
filter = nginx-http-auth
|
|
||||||
logpath = /var/log/nginx/error.log
|
|
||||||
maxretry = 5
|
|
||||||
bantime = 1h
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Nginx - bad bots / scans (404 répétés)
|
|
||||||
# ============================================================
|
|
||||||
[nginx-botsearch]
|
|
||||||
enabled = true
|
|
||||||
port = http,https
|
|
||||||
filter = nginx-botsearch
|
|
||||||
logpath = /var/log/nginx/access.log
|
|
||||||
maxretry = 10
|
|
||||||
bantime = 2h
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# API Backend - brute force login (POST /api/v2/login)
|
|
||||||
# ============================================================
|
|
||||||
[backend-login]
|
|
||||||
enabled = true
|
|
||||||
port = http,https
|
|
||||||
filter = backend-login
|
|
||||||
logpath = /var/log/nginx/access.log
|
|
||||||
maxretry = 10
|
|
||||||
findtime = 5m
|
|
||||||
bantime = 2h
|
|
||||||
notify: Restart fail2ban
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Filtre personnalisé - brute force login API
|
|
||||||
# ============================================================
|
|
||||||
- name: Créer le filtre fail2ban pour le login API
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: /etc/fail2ban/filter.d/backend-login.conf
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: "0644"
|
|
||||||
content: |
|
|
||||||
[Definition]
|
|
||||||
failregex = ^<HOST> .* "POST /api/v2/login HTTP/.*" (401|403) .*$
|
|
||||||
ignoreregex =
|
|
||||||
notify: Restart fail2ban
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Démarrage et activation
|
|
||||||
# ============================================================
|
|
||||||
- name: Démarrer et activer Fail2Ban
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: fail2ban
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Vérification
|
|
||||||
# ============================================================
|
|
||||||
- name: Vérifier le statut de Fail2Ban
|
|
||||||
ansible.builtin.command: fail2ban-client status
|
|
||||||
register: fail2ban_status
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Afficher le statut des jails
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ fail2ban_status.stdout_lines }}"
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart fail2ban
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: fail2ban
|
|
||||||
state: restarted
|
|
||||||
@@ -1,260 +0,0 @@
|
|||||||
- name: Déploiement complet Frontend
|
|
||||||
hosts: uber-stup-web
|
|
||||||
gather_facts: true
|
|
||||||
become: true
|
|
||||||
vars:
|
|
||||||
domain_name: mln-uber.club
|
|
||||||
frontend_dir: /home/ubuntu/frontend
|
|
||||||
frontend_port: 5173
|
|
||||||
tasks:
|
|
||||||
- name: Update and upgrade
|
|
||||||
ansible.builtin.apt:
|
|
||||||
update_cache: yes
|
|
||||||
cache_valid_time: 3600
|
|
||||||
upgrade: dist
|
|
||||||
|
|
||||||
- name: Install basic dependencies
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name:
|
|
||||||
- curl
|
|
||||||
- nginx
|
|
||||||
- tar
|
|
||||||
- build-essential
|
|
||||||
- certbot
|
|
||||||
- python3-certbot-nginx
|
|
||||||
state: present
|
|
||||||
- name: Créer l'utilisateur de déploiement s'il n'existe pas
|
|
||||||
ansible.builtin.user:
|
|
||||||
name: "{{ user_deploy }}"
|
|
||||||
shell: /bin/bash
|
|
||||||
create_home: yes
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Ensure /home/{{ user_deploy }} exists with correct permissions
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "/home/{{ user_deploy }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ user_deploy }}"
|
|
||||||
group: "{{ user_deploy }}"
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Setup Node.js 20 repository
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
|
||||||
args:
|
|
||||||
executable: /bin/bash
|
|
||||||
creates: /etc/apt/sources.list.d/nodesource.list
|
|
||||||
|
|
||||||
- name: Install Node.js 20
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name: nodejs
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
dpkg_options: "force-overwrite"
|
|
||||||
|
|
||||||
- name: Verify Node.js and npm versions
|
|
||||||
ansible.builtin.shell: |
|
|
||||||
node -v
|
|
||||||
npm -v
|
|
||||||
register: versions_check
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Show versions
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ versions_check.stdout_lines }}"
|
|
||||||
|
|
||||||
- name: Create folder for frontend
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ frontend_dir }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ user_deploy }}"
|
|
||||||
group: "{{ user_deploy }}"
|
|
||||||
mode: "0755"
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Synchroniser le frontend (excluant node_modules et .git)
|
|
||||||
become_user: "{{ user_deploy }}"
|
|
||||||
ansible.builtin.synchronize:
|
|
||||||
src: ../frontend-prep/
|
|
||||||
dest: "{{ frontend_dir }}/"
|
|
||||||
rsync_opts:
|
|
||||||
- "--exclude=node_modules"
|
|
||||||
- "--exclude=.git"
|
|
||||||
- "--exclude=.gitignore"
|
|
||||||
- "--exclude=build"
|
|
||||||
delete: no
|
|
||||||
recursive: yes
|
|
||||||
perms: yes
|
|
||||||
owner: yes
|
|
||||||
rsync_path: rsync
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Install npm dependencies
|
|
||||||
become_user: "{{ user_deploy }}"
|
|
||||||
ansible.builtin.command: npm install
|
|
||||||
args:
|
|
||||||
chdir: "{{ frontend_dir }}"
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Build frontend
|
|
||||||
become_user: "{{ user_deploy }}"
|
|
||||||
ansible.builtin.command: npm run build
|
|
||||||
args:
|
|
||||||
chdir: "{{ frontend_dir }}"
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Install serve globally
|
|
||||||
ansible.builtin.command: npm install -g serve
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Création du fichier systemd pour le frontend
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: /etc/systemd/system/frontend.service
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: "0644"
|
|
||||||
content: |
|
|
||||||
[Unit]
|
|
||||||
Description=Frontend React (serve)
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
User={{ user_deploy }}
|
|
||||||
WorkingDirectory={{ frontend_dir }}
|
|
||||||
ExecStart=/usr/bin/npx serve -s build -l {{ frontend_port }}
|
|
||||||
Restart=always
|
|
||||||
RestartSec=5
|
|
||||||
Environment="NODE_ENV=production"
|
|
||||||
Environment="VITE_TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB"
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
notify: Reload systemd
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Enable and start frontend service
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: frontend
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
daemon_reload: yes
|
|
||||||
tags: frontend
|
|
||||||
|
|
||||||
- name: Configuration UFW
|
|
||||||
ansible.builtin.ufw:
|
|
||||||
rule: allow
|
|
||||||
port: "{{ item }}"
|
|
||||||
proto: tcp
|
|
||||||
loop:
|
|
||||||
- "22"
|
|
||||||
- "80"
|
|
||||||
- "443"
|
|
||||||
|
|
||||||
- name: Activation du firewall
|
|
||||||
ansible.builtin.ufw:
|
|
||||||
state: enabled
|
|
||||||
|
|
||||||
- name: Vérifier si un certificat existe déjà
|
|
||||||
ansible.builtin.stat:
|
|
||||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
||||||
register: cert_file
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Déployer la configuration Nginx HTTP
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: templates/nginx-frontend.conf.j2
|
|
||||||
dest: /etc/nginx/sites-available/frontend
|
|
||||||
vars:
|
|
||||||
ssl_enabled: false
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Activation du site Nginx
|
|
||||||
ansible.builtin.file:
|
|
||||||
src: /etc/nginx/sites-available/frontend
|
|
||||||
dest: /etc/nginx/sites-enabled/frontend
|
|
||||||
state: link
|
|
||||||
force: yes
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Suppression du site par défaut
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: /etc/nginx/sites-enabled/default
|
|
||||||
state: absent
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Test de la configuration Nginx
|
|
||||||
ansible.builtin.command: nginx -t
|
|
||||||
changed_when: false
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Redémarrage de Nginx
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
enabled: yes
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Certificat SSL Let's Encrypt
|
|
||||||
# ============================================================
|
|
||||||
|
|
||||||
- name: Générer le certificat SSL avec Certbot
|
|
||||||
ansible.builtin.command: >
|
|
||||||
certbot certonly --nginx
|
|
||||||
-d {{ domain_name }}
|
|
||||||
--non-interactive
|
|
||||||
--agree-tos
|
|
||||||
--email admin@{{ domain_name }}
|
|
||||||
when: not cert_file.stat.exists
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Nginx - reconfiguration HTTPS après certificat
|
|
||||||
# ============================================================
|
|
||||||
- name: Vérifier la présence du certificat
|
|
||||||
ansible.builtin.stat:
|
|
||||||
path: "/etc/letsencrypt/live/{{ domain_name }}/fullchain.pem"
|
|
||||||
register: cert_file_after
|
|
||||||
|
|
||||||
- name: Déployer la configuration Nginx HTTPS
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: templates/nginx-frontend.conf.j2
|
|
||||||
dest: /etc/nginx/sites-available/frontend
|
|
||||||
vars:
|
|
||||||
ssl_enabled: true
|
|
||||||
when: cert_file_after.stat.exists
|
|
||||||
notify: Restart nginx
|
|
||||||
tags: [nginx]
|
|
||||||
|
|
||||||
- name: Test de la configuration Nginx finale
|
|
||||||
ansible.builtin.command: nginx -t
|
|
||||||
changed_when: false
|
|
||||||
tags: [nginx]
|
|
||||||
|
|
||||||
- name: Redémarrage de Nginx avec SSL
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
when: cert_file_after.stat.exists
|
|
||||||
tags: [nginx]
|
|
||||||
|
|
||||||
- name: Vérifier le renouvellement automatique
|
|
||||||
ansible.builtin.command: certbot renew --dry-run
|
|
||||||
register: certbot_renew
|
|
||||||
changed_when: false
|
|
||||||
failed_when: false
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
- name: Afficher le statut du renouvellement
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ certbot_renew.stdout_lines }}"
|
|
||||||
tags: [certbot]
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Reload systemd
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
daemon_reload: yes
|
|
||||||
|
|
||||||
- name: Restart nginx
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
@@ -1,308 +0,0 @@
|
|||||||
---
|
|
||||||
# ============================================
|
|
||||||
# PostgreSQL Installation (vm-postgres uniquement)
|
|
||||||
# ============================================
|
|
||||||
- name: Installation et configuration de PostgreSQL
|
|
||||||
hosts: demo-uber
|
|
||||||
become: true
|
|
||||||
gather_facts: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
# ============================================================
|
|
||||||
# Dépendances requises
|
|
||||||
# ============================================================
|
|
||||||
- name: Installer les dépendances pour le dépôt APT
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name:
|
|
||||||
- gnupg2
|
|
||||||
- curl
|
|
||||||
- ca-certificates
|
|
||||||
- lsb-release
|
|
||||||
- python3-psycopg2
|
|
||||||
- acl
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Ajout du dépôt officiel PostgreSQL
|
|
||||||
# ============================================================
|
|
||||||
- name: Ajouter la clé GPG du dépôt PostgreSQL
|
|
||||||
ansible.builtin.apt_key:
|
|
||||||
url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Ajouter le dépôt PostgreSQL 16
|
|
||||||
ansible.builtin.apt_repository:
|
|
||||||
repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main"
|
|
||||||
state: present
|
|
||||||
filename: pgdg
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Installation PostgreSQL 16
|
|
||||||
# ============================================================
|
|
||||||
- name: Installer PostgreSQL 16
|
|
||||||
ansible.builtin.apt:
|
|
||||||
name:
|
|
||||||
- "postgresql-{{ pg_version }}"
|
|
||||||
- "postgresql-client-{{ pg_version }}"
|
|
||||||
- "postgresql-contrib-{{ pg_version }}"
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Démarrer et activer PostgreSQL
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: postgresql
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Configuration PostgreSQL
|
|
||||||
# ============================================================
|
|
||||||
- name: Configurer l'écoute sur localhost
|
|
||||||
ansible.builtin.lineinfile:
|
|
||||||
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
|
||||||
regexp: "^#?listen_addresses"
|
|
||||||
line: "listen_addresses = 'localhost'"
|
|
||||||
notify: Restart postgresql
|
|
||||||
|
|
||||||
- name: Configurer le port
|
|
||||||
ansible.builtin.lineinfile:
|
|
||||||
path: "/etc/postgresql/{{ pg_version }}/main/postgresql.conf"
|
|
||||||
regexp: "^#?port"
|
|
||||||
line: "port = {{ db_port }}"
|
|
||||||
notify: Restart postgresql
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Locale requise
|
|
||||||
# ============================================================
|
|
||||||
- name: Générer la locale fr_FR.UTF-8
|
|
||||||
ansible.builtin.command: locale-gen fr_FR.UTF-8
|
|
||||||
register: locale_gen
|
|
||||||
changed_when: "'Generation complete' in locale_gen.stdout"
|
|
||||||
|
|
||||||
- name: Mettre à jour les locales
|
|
||||||
ansible.builtin.command: update-locale
|
|
||||||
when: locale_gen.changed
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Création de la base de données et configuration utilisateur
|
|
||||||
# ============================================================
|
|
||||||
- name: Définir le mot de passe de l'utilisateur postgres
|
|
||||||
become_user: postgres
|
|
||||||
ansible.builtin.postgresql_user:
|
|
||||||
name: "{{ db_user }}"
|
|
||||||
password: "{{ db_password }}"
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Vérifier si la base de données existe
|
|
||||||
become_user: postgres
|
|
||||||
ansible.builtin.command: psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{ db_name }}'"
|
|
||||||
register: db_exists
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Créer la base de données avec ICU
|
|
||||||
become_user: postgres
|
|
||||||
ansible.builtin.command: >
|
|
||||||
psql -c "CREATE DATABASE {{ db_name }}
|
|
||||||
OWNER {{ db_user }}
|
|
||||||
ENCODING 'UTF8'
|
|
||||||
LOCALE_PROVIDER icu
|
|
||||||
ICU_LOCALE 'fr-FR'
|
|
||||||
TEMPLATE template0"
|
|
||||||
when: db_exists.stdout != "1"
|
|
||||||
|
|
||||||
- name: Accorder tous les privilèges sur la base
|
|
||||||
become_user: postgres
|
|
||||||
ansible.builtin.postgresql_privs:
|
|
||||||
db: "{{ db_name }}"
|
|
||||||
role: "{{ db_user }}"
|
|
||||||
type: database
|
|
||||||
privs: ALL
|
|
||||||
state: present
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Authentification pg_hba.conf
|
|
||||||
# ============================================================
|
|
||||||
- name: Configurer l'authentification md5 pour les connexions locales
|
|
||||||
ansible.builtin.postgresql_pg_hba:
|
|
||||||
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
|
||||||
contype: host
|
|
||||||
databases: "{{ db_name }}"
|
|
||||||
users: "{{ db_user }}"
|
|
||||||
source: "127.0.0.1/32"
|
|
||||||
method: md5
|
|
||||||
notify: Restart postgresql
|
|
||||||
|
|
||||||
- name: Configurer l'authentification md5 pour IPv6 local
|
|
||||||
ansible.builtin.postgresql_pg_hba:
|
|
||||||
dest: "/etc/postgresql/{{ pg_version }}/main/pg_hba.conf"
|
|
||||||
contype: host
|
|
||||||
databases: "{{ db_name }}"
|
|
||||||
users: "{{ db_user }}"
|
|
||||||
source: "::1/128"
|
|
||||||
method: md5
|
|
||||||
notify: Restart postgresql
|
|
||||||
|
|
||||||
# ============================================================
|
|
||||||
# Vérification
|
|
||||||
# ============================================================
|
|
||||||
- name: Vérifier la version de PostgreSQL
|
|
||||||
become_user: postgres
|
|
||||||
ansible.builtin.command: psql --version
|
|
||||||
register: pg_version_check
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Afficher la version
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ pg_version_check.stdout }}"
|
|
||||||
|
|
||||||
- name: Vérifier que la base existe
|
|
||||||
become_user: postgres
|
|
||||||
ansible.builtin.command: psql -lqt
|
|
||||||
register: pg_databases
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Afficher les bases de données
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "{{ pg_databases.stdout_lines }}"
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Restart postgresql
|
|
||||||
ansible.builtin.systemd:
|
|
||||||
name: postgresql
|
|
||||||
state: restarted
|
|
||||||
|
|
||||||
# ============================================
|
|
||||||
# Redis Installation (vm-redis uniquement)
|
|
||||||
# ============================================
|
|
||||||
- name: Installation et configuration de Redis
|
|
||||||
hosts: demo-uber
|
|
||||||
become: true
|
|
||||||
gather_facts: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Installer Redis
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- redis-server
|
|
||||||
- python3-redis
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Créer le répertoire de backup Redis
|
|
||||||
file:
|
|
||||||
path: /var/lib/redis/backup
|
|
||||||
state: directory
|
|
||||||
owner: redis
|
|
||||||
group: redis
|
|
||||||
mode: "0755"
|
|
||||||
|
|
||||||
- name: Configurer Redis - bind address (accepter connexions réseau)
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^bind"
|
|
||||||
line: "bind 127.0.0.1 192.168.1.62"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer Redis - port
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^port"
|
|
||||||
line: "port {{ redis_port }}"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer Redis - maxmemory
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^# ?maxmemory"
|
|
||||||
line: "maxmemory {{ redis_maxmemory }}"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer Redis - maxmemory-policy
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^# ?maxmemory-policy"
|
|
||||||
line: "maxmemory-policy {{ redis_maxmemory_policy }}"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer Redis - requirepass
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^# ?requirepass"
|
|
||||||
line: "requirepass {{ redis_password }}"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Activer AOF (Append Only File) pour Redis
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^appendonly"
|
|
||||||
line: "appendonly yes"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer la fréquence de sync AOF
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^# ?appendfsync"
|
|
||||||
line: "appendfsync everysec"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Activer la persistance RDB (snapshots)
|
|
||||||
blockinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
block: |
|
|
||||||
save 900 1
|
|
||||||
save 300 10
|
|
||||||
save 60 10000
|
|
||||||
marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE"
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer le nom du fichier AOF
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^appendfilename"
|
|
||||||
line: 'appendfilename "appendonly.aof"'
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Désactiver le mode protégé Redis
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^protected-mode"
|
|
||||||
line: "protected-mode no"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Configurer le répertoire de travail Redis
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^dir"
|
|
||||||
line: "dir /var/lib/redis"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: Définir le niveau de log
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/redis/redis.conf
|
|
||||||
regexp: "^loglevel"
|
|
||||||
line: "loglevel notice"
|
|
||||||
state: present
|
|
||||||
notify: Redémarrer Redis
|
|
||||||
|
|
||||||
- name: S'assurer que Redis est démarré
|
|
||||||
systemd:
|
|
||||||
name: redis-server
|
|
||||||
state: started
|
|
||||||
enabled: yes
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
- name: Redémarrer Redis
|
|
||||||
systemd:
|
|
||||||
name: redis-server
|
|
||||||
state: restarted
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Backend Golang API
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
User={{ user_owner }}
|
|
||||||
WorkingDirectory={{ backend_dir }}
|
|
||||||
Environment="PATH=/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
|
||||||
Environment="USER_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlds"
|
|
||||||
Environment="DB_HOST=localhost"
|
|
||||||
Environment="DB_PORT=5432"
|
|
||||||
Environment="DB_USER=admin_gestion_commande_db"
|
|
||||||
Environment="DB_PASSWORD=hb-FS462(#I~6(4',Nt=3Rd4567890jsezZ"
|
|
||||||
Environment="DB_NAME=gestion_commande_db"
|
|
||||||
Environment="DB_SSLMODE=disable"
|
|
||||||
Environment="REDIS_HOST=127.0.0.1"
|
|
||||||
Environment="REDIS_PORT=6379"
|
|
||||||
Environment="REDIS_PASSWORD=uQ64h5UhFdrm!H|_cCQer"
|
|
||||||
Environment="SESSION_SECRET=jfWR21Ywbuy{Yq<1A26TV)jCe"
|
|
||||||
Environment="GIN_MODE=release"
|
|
||||||
Environment="TOMTOM_API_KEY=MERY8I7LMeYVSLKO5WuV73W9rKJpBLoB"
|
|
||||||
Environment="API_PORT={{ backend_local_port }}"
|
|
||||||
Environment="ADMIN_JWT_SECRET=TheAmaziNgSecretJwtMotherFuckerInThEbitCh3232131231313443jqfdksdjfjsldfjlzZ"
|
|
||||||
ExecStart={{ backend_binary }}
|
|
||||||
Restart=always
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Frontend React Production (Vite)
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
User={{ user_owner }}
|
|
||||||
Group={{ user_owner }}
|
|
||||||
WorkingDirectory={{ nginx_frontend_path }}
|
|
||||||
ExecStart=/usr/bin/npm run preview -- --port {{ frontend_port }}
|
|
||||||
Restart=always
|
|
||||||
Environment=NODE_ENV=production
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,191 +0,0 @@
|
|||||||
# =========================================================
|
|
||||||
# Request ID for correlation
|
|
||||||
# =========================================================
|
|
||||||
map $http_x_request_id $req_id {
|
|
||||||
default $http_x_request_id;
|
|
||||||
"" $request_id;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Backend distant
|
|
||||||
# =========================================================
|
|
||||||
upstream backend {
|
|
||||||
server uber-stup.club:443;
|
|
||||||
keepalive 32;
|
|
||||||
}
|
|
||||||
|
|
||||||
{% if ssl_enabled %}
|
|
||||||
# =========================================================
|
|
||||||
# HTTP → HTTPS redirect + ACME challenge
|
|
||||||
# =========================================================
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name {{ domain_name }};
|
|
||||||
|
|
||||||
# Certbot renouvellement automatique
|
|
||||||
location /.well-known/acme-challenge/ {
|
|
||||||
root /var/www/certbot;
|
|
||||||
}
|
|
||||||
|
|
||||||
location / {
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# HTTPS Server
|
|
||||||
# =========================================================
|
|
||||||
server {
|
|
||||||
listen 443 ssl;
|
|
||||||
listen [::]:443 ssl;
|
|
||||||
server_name {{ domain_name }};
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# SSL/TLS - Let's Encrypt
|
|
||||||
# =========================================================
|
|
||||||
ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;
|
|
||||||
ssl_trusted_certificate /etc/letsencrypt/live/{{ domain_name }}/chain.pem;
|
|
||||||
|
|
||||||
ssl_protocols TLSv1.2 TLSv1.3;
|
|
||||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
|
|
||||||
ssl_prefer_server_ciphers off;
|
|
||||||
|
|
||||||
ssl_session_cache shared:SSL:10m;
|
|
||||||
ssl_session_timeout 1d;
|
|
||||||
ssl_session_tickets off;
|
|
||||||
|
|
||||||
ssl_stapling on;
|
|
||||||
ssl_stapling_verify on;
|
|
||||||
resolver 1.1.1.1 8.8.8.8 valid=300s;
|
|
||||||
resolver_timeout 5s;
|
|
||||||
|
|
||||||
{% else %}
|
|
||||||
# =========================================================
|
|
||||||
# HTTP Server (phase pré-certificat)
|
|
||||||
# =========================================================
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name {{ domain_name }};
|
|
||||||
|
|
||||||
# ACME challenge accessible avant l'émission du certificat
|
|
||||||
location /.well-known/acme-challenge/ {
|
|
||||||
root /var/www/certbot;
|
|
||||||
}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
root {{ frontend_dir }}/dist;
|
|
||||||
index index.html;
|
|
||||||
client_max_body_size {{ nginx_max_body_size }};
|
|
||||||
|
|
||||||
location /api/ {
|
|
||||||
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
|
|
||||||
|
|
||||||
if ($request_method = 'OPTIONS') {
|
|
||||||
add_header 'Access-Control-Allow-Origin' "$http_origin" always;
|
|
||||||
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
|
|
||||||
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always;
|
|
||||||
add_header 'Access-Control-Allow-Credentials' 'true' always;
|
|
||||||
add_header 'Access-Control-Max-Age' 86400 always;
|
|
||||||
add_header 'Content-Length' 0;
|
|
||||||
add_header 'Content-Type' 'text/plain charset=UTF-8';
|
|
||||||
return 204;
|
|
||||||
}
|
|
||||||
|
|
||||||
proxy_pass https://backend;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
|
|
||||||
proxy_ssl_server_name on;
|
|
||||||
proxy_ssl_name uber-stup.club;
|
|
||||||
|
|
||||||
proxy_set_header Host uber-stup.club;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header X-Request-ID $req_id;
|
|
||||||
proxy_set_header Connection "";
|
|
||||||
|
|
||||||
proxy_connect_timeout {{ nginx_proxy_timeout }}s;
|
|
||||||
proxy_send_timeout {{ nginx_proxy_timeout }}s;
|
|
||||||
proxy_read_timeout {{ nginx_proxy_timeout }}s;
|
|
||||||
}
|
|
||||||
|
|
||||||
location / {
|
|
||||||
try_files $uri $uri/ /index.html;
|
|
||||||
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
|
||||||
add_header Pragma "no-cache" always;
|
|
||||||
add_header Expires "0" always;
|
|
||||||
}
|
|
||||||
|
|
||||||
location /uploads/ {
|
|
||||||
alias {{ uploads_dir }}/;
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable";
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /uploads/images/ {
|
|
||||||
alias {{ uploads_dir }}/images/;
|
|
||||||
|
|
||||||
add_header Access-Control-Allow-Origin "*" always;
|
|
||||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable" always;
|
|
||||||
|
|
||||||
types {
|
|
||||||
image/jpeg jpg jpeg;
|
|
||||||
image/png png;
|
|
||||||
image/gif gif;
|
|
||||||
image/webp webp;
|
|
||||||
image/svg+xml svg;
|
|
||||||
}
|
|
||||||
default_type image/jpeg;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /uploads/videos/ {
|
|
||||||
alias {{ uploads_dir }}/videos/;
|
|
||||||
|
|
||||||
add_header Access-Control-Allow-Origin "*" always;
|
|
||||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable" always;
|
|
||||||
|
|
||||||
types {
|
|
||||||
video/mp4 mp4;
|
|
||||||
video/webm webm;
|
|
||||||
video/ogg ogv;
|
|
||||||
}
|
|
||||||
default_type video/mp4;
|
|
||||||
}
|
|
||||||
|
|
||||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
add_header X-XSS-Protection "1; mode=block" always;
|
|
||||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
||||||
{% if ssl_enabled %}
|
|
||||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
||||||
{% endif %}
|
|
||||||
add_header Content-Security-Policy "
|
|
||||||
default-src 'self';
|
|
||||||
script-src 'self' 'unsafe-inline' 'unsafe-eval';
|
|
||||||
style-src 'self' 'unsafe-inline';
|
|
||||||
img-src 'self' data: https:;
|
|
||||||
font-src 'self' data:;
|
|
||||||
connect-src 'self' https://api.tomtom.com https://uber-stup.club;
|
|
||||||
" always;
|
|
||||||
|
|
||||||
location ~ /\. {
|
|
||||||
deny all;
|
|
||||||
access_log off;
|
|
||||||
log_not_found off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
|
|
||||||
deny all;
|
|
||||||
access_log off;
|
|
||||||
log_not_found off;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,170 +0,0 @@
|
|||||||
# =========================================================
|
|
||||||
# Request ID for correlation
|
|
||||||
# =========================================================
|
|
||||||
map $http_x_request_id $req_id {
|
|
||||||
default $http_x_request_id;
|
|
||||||
"" $request_id;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Rate limiting
|
|
||||||
# =========================================================
|
|
||||||
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
|
|
||||||
limit_req_zone $binary_remote_addr zone=uploads:10m rate=10r/m;
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Upstream backend
|
|
||||||
# =========================================================
|
|
||||||
upstream backend {
|
|
||||||
server 127.0.0.1:{{ backend_local_port }} max_fails=3 fail_timeout=30s;
|
|
||||||
keepalive 32;
|
|
||||||
keepalive_requests 100;
|
|
||||||
keepalive_timeout 60s;
|
|
||||||
}
|
|
||||||
|
|
||||||
{% if ssl_enabled %}
|
|
||||||
# =========================================================
|
|
||||||
# HTTP → HTTPS redirect
|
|
||||||
# =========================================================
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name {{ domain_name }};
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# API Server
|
|
||||||
# =========================================================
|
|
||||||
server {
|
|
||||||
{% if ssl_enabled %}
|
|
||||||
listen {{ backend_port }} ssl;
|
|
||||||
listen [::]:{{ backend_port }} ssl;
|
|
||||||
|
|
||||||
ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;
|
|
||||||
ssl_protocols TLSv1.2 TLSv1.3;
|
|
||||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
|
||||||
ssl_prefer_server_ciphers off;
|
|
||||||
ssl_session_cache shared:SSL:10m;
|
|
||||||
ssl_session_timeout 1d;
|
|
||||||
ssl_session_tickets off;
|
|
||||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
||||||
{% else %}
|
|
||||||
listen {{ backend_port }};
|
|
||||||
listen [::]:{{ backend_port }};
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
server_name {{ domain_name }};
|
|
||||||
client_max_body_size {{ nginx_max_body_size }};
|
|
||||||
|
|
||||||
server_tokens off;
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Security headers
|
|
||||||
# =========================================================
|
|
||||||
add_header X-Frame-Options "DENY" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
||||||
proxy_hide_header X-Powered-By;
|
|
||||||
proxy_hide_header Server;
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# API proxy
|
|
||||||
# =========================================================
|
|
||||||
location / {
|
|
||||||
limit_req zone=api burst=20 nodelay;
|
|
||||||
|
|
||||||
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
|
|
||||||
|
|
||||||
proxy_pass http://backend;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header X-Request-ID $req_id;
|
|
||||||
proxy_set_header Connection "";
|
|
||||||
|
|
||||||
proxy_connect_timeout 60s;
|
|
||||||
proxy_send_timeout 60s;
|
|
||||||
proxy_read_timeout 60s;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Uploads
|
|
||||||
# =========================================================
|
|
||||||
location /uploads/ {
|
|
||||||
alias {{ uploads_dir }}/;
|
|
||||||
limit_req zone=uploads burst=20 nodelay;
|
|
||||||
limit_except GET HEAD { deny all; }
|
|
||||||
|
|
||||||
# Bloquer les fichiers exécutables
|
|
||||||
location ~* \.(php|php5|phtml|sh|py|pl|cgi|exe|asp|aspx|jsp)$ {
|
|
||||||
deny all;
|
|
||||||
}
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable";
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /uploads/images/ {
|
|
||||||
alias {{ uploads_dir }}/images/;
|
|
||||||
limit_req zone=uploads burst=20 nodelay;
|
|
||||||
limit_except GET HEAD OPTIONS { deny all; }
|
|
||||||
|
|
||||||
add_header Access-Control-Allow-Origin "*" always;
|
|
||||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable" always;
|
|
||||||
|
|
||||||
types {
|
|
||||||
image/jpeg jpg jpeg;
|
|
||||||
image/png png;
|
|
||||||
image/gif gif;
|
|
||||||
image/webp webp;
|
|
||||||
image/svg+xml svg;
|
|
||||||
}
|
|
||||||
default_type image/jpeg;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /uploads/videos/ {
|
|
||||||
alias {{ uploads_dir }}/videos/;
|
|
||||||
limit_req zone=uploads burst=20 nodelay;
|
|
||||||
limit_except GET HEAD OPTIONS { deny all; }
|
|
||||||
|
|
||||||
add_header Access-Control-Allow-Origin "*" always;
|
|
||||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable" always;
|
|
||||||
|
|
||||||
types {
|
|
||||||
video/mp4 mp4;
|
|
||||||
video/webm webm;
|
|
||||||
video/ogg ogv;
|
|
||||||
}
|
|
||||||
default_type video/mp4;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Deny hidden files and sensitive files
|
|
||||||
# =========================================================
|
|
||||||
location ~ /\. {
|
|
||||||
deny all;
|
|
||||||
access_log off;
|
|
||||||
log_not_found off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
|
|
||||||
deny all;
|
|
||||||
access_log off;
|
|
||||||
log_not_found off;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,142 +0,0 @@
|
|||||||
# =========================================================
|
|
||||||
# Request ID for correlation
|
|
||||||
# =========================================================
|
|
||||||
map $http_x_request_id $req_id {
|
|
||||||
default $http_x_request_id;
|
|
||||||
"" $request_id;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Rate limiting
|
|
||||||
# =========================================================
|
|
||||||
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
|
|
||||||
limit_req_zone $binary_remote_addr zone=uploads:10m rate=10r/m;
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Upstream backend
|
|
||||||
# =========================================================
|
|
||||||
upstream backend {
|
|
||||||
server 127.0.0.1:{{ backend_local_port }} max_fails=3 fail_timeout=30s;
|
|
||||||
keepalive 32;
|
|
||||||
keepalive_requests 100;
|
|
||||||
keepalive_timeout 60s;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# API Server
|
|
||||||
# =========================================================
|
|
||||||
server {
|
|
||||||
listen {{ backend_port }};
|
|
||||||
listen [::]:{{ backend_port }};
|
|
||||||
server_name {{ ip }};
|
|
||||||
client_max_body_size {{ nginx_max_body_size }};
|
|
||||||
|
|
||||||
server_tokens off;
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Security headers
|
|
||||||
# =========================================================
|
|
||||||
add_header X-Frame-Options "DENY" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
||||||
proxy_hide_header X-Powered-By;
|
|
||||||
proxy_hide_header Server;
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# API proxy
|
|
||||||
# =========================================================
|
|
||||||
location / {
|
|
||||||
limit_req zone=api burst=20 nodelay;
|
|
||||||
|
|
||||||
limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
|
|
||||||
|
|
||||||
proxy_pass http://backend;
|
|
||||||
proxy_http_version 1.1;
|
|
||||||
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_set_header X-Request-ID $req_id;
|
|
||||||
proxy_set_header Connection "";
|
|
||||||
|
|
||||||
proxy_connect_timeout 60s;
|
|
||||||
proxy_send_timeout 60s;
|
|
||||||
proxy_read_timeout 60s;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Uploads
|
|
||||||
# =========================================================
|
|
||||||
location /uploads/ {
|
|
||||||
alias {{ uploads_dir }}/;
|
|
||||||
limit_req zone=uploads burst=20 nodelay;
|
|
||||||
limit_except GET HEAD { deny all; }
|
|
||||||
|
|
||||||
# Bloquer les fichiers exécutables
|
|
||||||
location ~* \.(php|php5|phtml|sh|py|pl|cgi|exe|asp|aspx|jsp)$ {
|
|
||||||
deny all;
|
|
||||||
}
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable";
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /uploads/images/ {
|
|
||||||
alias {{ uploads_dir }}/images/;
|
|
||||||
limit_req zone=uploads burst=20 nodelay;
|
|
||||||
limit_except GET HEAD OPTIONS { deny all; }
|
|
||||||
|
|
||||||
add_header Access-Control-Allow-Origin "*" always;
|
|
||||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable" always;
|
|
||||||
|
|
||||||
types {
|
|
||||||
image/jpeg jpg jpeg;
|
|
||||||
image/png png;
|
|
||||||
image/gif gif;
|
|
||||||
image/webp webp;
|
|
||||||
image/svg+xml svg;
|
|
||||||
}
|
|
||||||
default_type image/jpeg;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ^~ /uploads/videos/ {
|
|
||||||
alias {{ uploads_dir }}/videos/;
|
|
||||||
limit_req zone=uploads burst=20 nodelay;
|
|
||||||
limit_except GET HEAD OPTIONS { deny all; }
|
|
||||||
|
|
||||||
add_header Access-Control-Allow-Origin "*" always;
|
|
||||||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
|
|
||||||
expires 30d;
|
|
||||||
add_header Cache-Control "public, immutable" always;
|
|
||||||
|
|
||||||
types {
|
|
||||||
video/mp4 mp4;
|
|
||||||
video/webm webm;
|
|
||||||
video/ogg ogv;
|
|
||||||
}
|
|
||||||
default_type video/mp4;
|
|
||||||
}
|
|
||||||
|
|
||||||
# =========================================================
|
|
||||||
# Deny hidden files and sensitive files
|
|
||||||
# =========================================================
|
|
||||||
location ~ /\. {
|
|
||||||
deny all;
|
|
||||||
access_log off;
|
|
||||||
log_not_found off;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
|
|
||||||
deny all;
|
|
||||||
access_log off;
|
|
||||||
log_not_found off;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Serveo Tunnel Service
|
|
||||||
After=network-online.target nginx.service
|
|
||||||
Wants=network-online.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
User=ubuntu
|
|
||||||
WorkingDirectory={{directory}}
|
|
||||||
ExecStart=/usr/bin/ssh \
|
|
||||||
-o ServerAliveInterval=60 \
|
|
||||||
-o ServerAliveCountMax=3 \
|
|
||||||
-o ExitOnForwardFailure=yes \
|
|
||||||
-o StrictHostKeyChecking=no \
|
|
||||||
-R {{nginx_app_name}}:80:{{nginx_domain}}:80 \
|
|
||||||
serveo.net
|
|
||||||
|
|
||||||
Restart=always
|
|
||||||
RestartSec=10
|
|
||||||
|
|
||||||
StandardOutput=append:{{tunnel_log}}
|
|
||||||
StandardError=append:{{tunnel_log_error}}
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
Reference in New Issue
Block a user