chore: add ansible backend docker frontend-prep
This commit is contained in:
@@ -0,0 +1,9 @@
|
||||
[defaults]
|
||||
inventory = inventory/host.ini
|
||||
host_key_checking = False
|
||||
interpreter_python = auto_silent
|
||||
|
||||
[privilege_escalation]
|
||||
become = True
|
||||
become_method = sudo
|
||||
become_user = root
|
||||
@@ -0,0 +1,49 @@
|
||||
postgres_version: "16"
|
||||
postgres_databases:
|
||||
- name: gestion_db
|
||||
owner: postgres
|
||||
postgres_password: "VotreMotDePasseSecure123!"
|
||||
|
||||
# Redis Configuration
|
||||
redis_bind: "127.0.0.1"
|
||||
redis_port: 6379
|
||||
redis_maxmemory: "512mb"
|
||||
redis_maxmemory_policy: "allkeys-lru"
|
||||
redis_password: "UltrasecretMdp123!"
|
||||
|
||||
# ============================================
|
||||
# Configuration Nginx et Applications
|
||||
# ============================================
|
||||
nginx_app_name: "nantais-livraison"
|
||||
nginx_domain: "{{ ansible_default_ipv4.address }}"
|
||||
directory: "/home/ubuntu"
|
||||
tunnel_log: "/var/log/tunnel.log"
|
||||
tunnel_log_error: "/var/log/tunnel-error.log"
|
||||
# Chemins des applications (bonnes pratiques)
|
||||
nginx_frontend_path: "/home/ubuntu/frontend"
|
||||
backend_dir: "/home/ubuntu/backend"
|
||||
backend_binary: "/home/ubuntu/backend/main"
|
||||
docker_dir: "/home/ubuntu/docker"
|
||||
frontend_port: 5173
|
||||
backend_dir_docker: "/home/ubuntu/backend/docker"
|
||||
# Utilisateurs et permissions
|
||||
user_web: "www-data" # Utilisateur pour les applications web
|
||||
user_deploy: "ubuntu" # Utilisateur pour le déploiement
|
||||
user_owner: "root" # Propriétaire des fichiers systemd
|
||||
docker_user: docker
|
||||
docker_group: docker
|
||||
# Backend
|
||||
backend_port: 8080
|
||||
|
||||
# Timeouts
|
||||
nginx_proxy_timeout: 60
|
||||
|
||||
# Cache Duration
|
||||
nginx_cache_static_duration: "1y"
|
||||
nginx_cache_media_duration: "1y"
|
||||
|
||||
# Upload Size
|
||||
nginx_max_body_size: "10M"
|
||||
|
||||
# Security
|
||||
nginx_enable_firewall: true
|
||||
@@ -0,0 +1,21 @@
|
||||
[all]
|
||||
vm-postgres ansible_host=192.168.1.65 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
vm-redis ansible_host=192.168.1.62 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
vm-nginx ansible_host=192.168.1.67 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
vm-backend ansible_host=192.168.1.72 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
|
||||
[postgres]
|
||||
vm-postgres ansible_host=192.168.1.65 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
|
||||
[redis]
|
||||
vm-redis ansible_host=192.168.1.62 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
|
||||
[nginx]
|
||||
vm-nginx ansible_host=192.168.1.67 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
|
||||
[backend]
|
||||
vm-backend ansible_host=192.168.1.72 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
|
||||
[services]
|
||||
vm-redis ansible_host=192.168.1.62 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
vm-postgres ansible_host=192.168.1.65 ansible_user=ubuntu ansible_ssh_pass=root
|
||||
@@ -0,0 +1,228 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: backend
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
- software-properties-common
|
||||
- acl
|
||||
state: present
|
||||
|
||||
- name: Create directory for Docker GPG key
|
||||
file:
|
||||
path: /etc/apt/keyrings
|
||||
state: directory
|
||||
mode: "0755"
|
||||
|
||||
- name: Add Docker GPG key
|
||||
apt_key:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
keyring: /etc/apt/keyrings/docker.gpg
|
||||
state: present
|
||||
|
||||
- name: Get system architecture
|
||||
command: dpkg --print-architecture
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Get Ubuntu codename
|
||||
command: lsb_release -cs
|
||||
register: ubuntu_codename
|
||||
changed_when: false
|
||||
|
||||
- name: Add Docker repository
|
||||
apt_repository:
|
||||
repo: "deb [arch={{ system_arch.stdout }} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ubuntu_codename.stdout }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
|
||||
- name: Update apt cache after adding repo
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Install Docker packages
|
||||
apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
- docker-buildx-plugin
|
||||
- docker-compose-plugin
|
||||
state: present
|
||||
|
||||
- name: Ensure Docker service is started and enabled
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Create docker group
|
||||
group:
|
||||
name: "{{ docker_group }}"
|
||||
state: present
|
||||
|
||||
- name: Create docker user
|
||||
user:
|
||||
name: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
|
||||
- name: Add ansible user to docker group
|
||||
user:
|
||||
name: "{{ ansible_user }}"
|
||||
groups: docker
|
||||
append: yes
|
||||
when: ansible_user is defined
|
||||
|
||||
- name: Verify Docker installation
|
||||
command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
|
||||
- name: Verify Docker Compose installation
|
||||
command: docker compose version
|
||||
register: compose_version
|
||||
changed_when: false
|
||||
|
||||
- name: Display versions
|
||||
debug:
|
||||
msg:
|
||||
- "{{ docker_version.stdout }}"
|
||||
- "{{ compose_version.stdout }}"
|
||||
|
||||
- name: Create frontend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Create backend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Synchronize frontend content (excluding node_modules and .git)
|
||||
ansible.builtin.synchronize:
|
||||
src: ../frontend-prep
|
||||
dest: "{{ nginx_frontend_path }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=node_modules"
|
||||
- "--exclude=.git"
|
||||
- "--exclude=dist"
|
||||
- "--exclude=build"
|
||||
delete: no
|
||||
recursive: yes
|
||||
tags: sync_frontend
|
||||
|
||||
- name: Set ownership for frontend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: sync_frontend
|
||||
|
||||
- name: Synchronize backend content (excluding node_modules and .git)
|
||||
ansible.builtin.synchronize:
|
||||
src: ../backend
|
||||
dest: "{{ backend_dir }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=node_modules"
|
||||
- "--exclude=.git"
|
||||
- "--exclude=dist"
|
||||
- "--exclude=build"
|
||||
delete: no
|
||||
recursive: yes
|
||||
tags: sync_backend
|
||||
|
||||
- name: Set ownership for backend directory
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
tags: sync_backend
|
||||
|
||||
- name: Copy Docker project
|
||||
ansible.builtin.copy:
|
||||
src: ../docker/
|
||||
dest: "{{ docker_dir }}/"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Ensure parent directory has correct permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
state: directory
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Set correct permissions for Docker files
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
recurse: yes
|
||||
|
||||
- name: Set permissions for .env file
|
||||
ansible.builtin.file:
|
||||
path: "{{ docker_dir }}/docker/.env"
|
||||
owner: "{{ docker_user }}"
|
||||
group: "{{ docker_group }}"
|
||||
mode: "0640"
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Build Docker project
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose -f docker-compose-prod.yml build
|
||||
chdir: "{{ docker_dir }}/docker"
|
||||
become: yes
|
||||
become_user: "{{ docker_user }}"
|
||||
tags: build
|
||||
|
||||
- name: Start Docker project
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose -f docker-compose-prod.yml up -d
|
||||
chdir: "{{ docker_dir }}/docker"
|
||||
become: yes
|
||||
become_user: "{{ docker_user }}"
|
||||
tags: start
|
||||
|
||||
- name: Show Docker containers
|
||||
ansible.builtin.command:
|
||||
cmd: docker compose ps
|
||||
chdir: "{{ docker_dir }}/docker"
|
||||
become: yes
|
||||
become_user: "{{ docker_user }}"
|
||||
register: docker_ps
|
||||
tags: start
|
||||
|
||||
- name: Display Docker containers
|
||||
debug:
|
||||
var: docker_ps.stdout_lines
|
||||
tags: start
|
||||
@@ -0,0 +1,234 @@
|
||||
---
|
||||
- name: Installation et configuration du frontend et backend
|
||||
hosts: nginx
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Update and upgrade
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
upgrade: "dist"
|
||||
|
||||
- name: install basic dependencies
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- curl
|
||||
- wget
|
||||
- tar
|
||||
- rsync
|
||||
- acl
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Download Go 1.23.0 tarball
|
||||
ansible.builtin.get_url:
|
||||
url: https://dl.google.com/go/go1.23.0.linux-amd64.tar.gz
|
||||
dest: /tmp/go1.23.0.linux-amd64.tar.gz
|
||||
mode: "0644"
|
||||
|
||||
- name: Extract Go 1.23.0
|
||||
ansible.builtin.unarchive:
|
||||
src: /tmp/go1.23.0.linux-amd64.tar.gz
|
||||
dest: /usr/local
|
||||
remote_src: yes
|
||||
|
||||
- name: Ensure Go 1.23 is in PATH for all users
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/profile.d/go.sh
|
||||
line: "export PATH=/usr/local/go/bin:$PATH"
|
||||
create: yes
|
||||
state: present
|
||||
mode: "0644"
|
||||
|
||||
- name: Setup Node.js 20 repository
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
||||
args:
|
||||
executable: /bin/bash
|
||||
|
||||
- name: Install Node.js 20
|
||||
ansible.builtin.apt:
|
||||
name: nodejs
|
||||
state: present
|
||||
update_cache: yes
|
||||
dpkg_options: "force-overwrite"
|
||||
|
||||
- name: Check Node.js, npm and Go versions
|
||||
ansible.builtin.shell: |
|
||||
echo "Node: $(node -v)"
|
||||
echo "npm: $(npm -v)"
|
||||
echo "Go: $(go version)"
|
||||
register: versions_check
|
||||
changed_when: false
|
||||
failed_when: versions_check.rc != 0
|
||||
|
||||
- name: Display all versions
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ versions_check.stdout_lines }}"
|
||||
|
||||
# ============================================
|
||||
# FRONTEND
|
||||
# ============================================
|
||||
|
||||
- name: Create /var/www if not exists
|
||||
ansible.builtin.file:
|
||||
path: /var/www
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
|
||||
- name: Ensure /home/ubuntu exists with correct permissions
|
||||
ansible.builtin.file:
|
||||
path: /home/ubuntu
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Remove old frontend directory if exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
state: absent
|
||||
|
||||
- name: Create frontend directory with deploy user ownership
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Synchronize frontend content (excluding node_modules and .git)
|
||||
ansible.builtin.synchronize:
|
||||
src: ../frontend/
|
||||
dest: "{{ nginx_frontend_path }}/"
|
||||
rsync_opts:
|
||||
- "--exclude=node_modules"
|
||||
- "--exclude=.git"
|
||||
- "--exclude=dist"
|
||||
- "--exclude=build"
|
||||
delete: no
|
||||
recursive: yes
|
||||
tags:
|
||||
- syncro
|
||||
|
||||
- name: Install npm dependencies as deploy user
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.shell: |
|
||||
export PATH=/usr/local/go/bin:$PATH
|
||||
npm install
|
||||
npm run build
|
||||
args:
|
||||
chdir: "{{ nginx_frontend_path }}"
|
||||
executable: /bin/bash
|
||||
|
||||
- name: Set ownership to www-data for runtime
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
recurse: yes
|
||||
|
||||
# ============================================
|
||||
# BACKEND
|
||||
# ============================================
|
||||
|
||||
- name: Remove old backend directory if exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
state: absent
|
||||
|
||||
- name: Create backend directory with deploy user ownership
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
state: directory
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy backend files
|
||||
ansible.builtin.copy:
|
||||
src: "../backendprod/gestion/"
|
||||
dest: "{{ backend_dir }}/"
|
||||
owner: "{{ user_deploy }}"
|
||||
group: "{{ user_deploy }}"
|
||||
mode: preserve
|
||||
directory_mode: "0755"
|
||||
|
||||
- name: Compile backend as deploy user
|
||||
become_user: "{{ user_deploy }}"
|
||||
ansible.builtin.shell: |
|
||||
export PATH=/usr/local/go/bin:$PATH
|
||||
go mod tidy
|
||||
go build -o main .
|
||||
args:
|
||||
chdir: "{{ backend_dir }}"
|
||||
executable: /bin/bash
|
||||
tags:
|
||||
- compile
|
||||
- name: Set ownership to www-data for runtime
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_dir }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
recurse: yes
|
||||
|
||||
- name: Set executable permission on backend binary
|
||||
ansible.builtin.file:
|
||||
path: "{{ backend_binary }}"
|
||||
owner: "{{ user_web }}"
|
||||
group: "{{ user_web }}"
|
||||
mode: "0755"
|
||||
|
||||
# ============================================
|
||||
# SYSTEMD SERVICES
|
||||
# ============================================
|
||||
|
||||
- name: Create systemd service for backend
|
||||
ansible.builtin.template:
|
||||
src: ./templates/backend.service.j2
|
||||
dest: /etc/systemd/system/backend.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Reload systemd daemon
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Enable and restart frontend service
|
||||
ansible.builtin.systemd:
|
||||
name: frontend
|
||||
enabled: yes
|
||||
state: restarted
|
||||
|
||||
- name: Enable and restart backend service
|
||||
ansible.builtin.systemd:
|
||||
name: backend
|
||||
enabled: yes
|
||||
state: restarted
|
||||
|
||||
- name: Wait for backend to be ready
|
||||
ansible.builtin.wait_for:
|
||||
port: "{{ backend_port }}"
|
||||
delay: 2
|
||||
timeout: 30
|
||||
|
||||
- name: Display service status
|
||||
ansible.builtin.shell: |
|
||||
echo "=== Frontend Service ==="
|
||||
systemctl status frontend --no-pager || true
|
||||
echo ""
|
||||
echo "=== Backend Service ==="
|
||||
systemctl status backend --no-pager || true
|
||||
register: service_status
|
||||
changed_when: false
|
||||
|
||||
- name: Show service status
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ service_status.stdout_lines }}"
|
||||
@@ -0,0 +1,108 @@
|
||||
---
|
||||
- name: Installation et configuration de Nginx
|
||||
hosts: nginx
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Installer Nginx
|
||||
ansible.builtin.apt:
|
||||
name: nginx
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Créer le répertoire frontend
|
||||
ansible.builtin.file:
|
||||
path: "{{ nginx_frontend_path }}"
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Créer le répertoire de logs
|
||||
ansible.builtin.file:
|
||||
path: /var/log/nginx
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: adm
|
||||
mode: "0755"
|
||||
|
||||
- name: Supprimer la config par défaut
|
||||
ansible.builtin.file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
|
||||
- name: Créer la configuration Nginx
|
||||
ansible.builtin.template:
|
||||
src: ./templates/nginx.conf.j2
|
||||
dest: /etc/nginx/sites-available/{{ nginx_app_name }}
|
||||
notify: Recharger Nginx
|
||||
|
||||
- name: Activer la configuration
|
||||
ansible.builtin.file:
|
||||
src: /etc/nginx/sites-available/{{ nginx_app_name }}
|
||||
dest: /etc/nginx/sites-enabled/{{ nginx_app_name }}
|
||||
state: link
|
||||
notify: Recharger Nginx
|
||||
|
||||
- name: Configurer Nginx global settings
|
||||
lineinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
insertafter: "http {"
|
||||
loop:
|
||||
- {
|
||||
regexp: '^\s*server_tokens',
|
||||
line: " server_tokens off;",
|
||||
}
|
||||
- {
|
||||
regexp: '^\s*client_max_body_size',
|
||||
line: " client_max_body_size {{ nginx_max_body_size }};",
|
||||
}
|
||||
notify: Recharger Nginx
|
||||
|
||||
- name: Tester la configuration Nginx
|
||||
command: nginx -t
|
||||
register: nginx_test
|
||||
changed_when: false
|
||||
|
||||
- name: Afficher le résultat du test
|
||||
debug:
|
||||
var: nginx_test.stderr_lines
|
||||
|
||||
- name: Démarrer Nginx
|
||||
ansible.builtin.systemd:
|
||||
name: nginx
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Configurer UFW - Autoriser HTTP
|
||||
ansible.builtin.ufw:
|
||||
rule: allow
|
||||
port: "80"
|
||||
proto: tcp
|
||||
when: nginx_enable_firewall | default(true)
|
||||
|
||||
- name: Configurer UFW - Bloquer accès direct au backend
|
||||
ansible.builtin.ufw:
|
||||
rule: deny
|
||||
port: "{{ backend_port }}"
|
||||
proto: tcp
|
||||
from_ip: any
|
||||
when: nginx_enable_firewall | default(true)
|
||||
|
||||
- name: Configurer le tunnel
|
||||
ansible.builtin.template:
|
||||
src: tunnel.conf.j2
|
||||
dest: /etc/tunnel.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: Recharger Nginx
|
||||
|
||||
handlers:
|
||||
- name: Recharger Nginx
|
||||
systemd:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
@@ -0,0 +1,229 @@
|
||||
---
|
||||
# ============================================
|
||||
# PostgreSQL Installation (vm-postgres uniquement)
|
||||
# ============================================
|
||||
- name: Installation et configuration de PostgreSQL
|
||||
hosts: postgres
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Installer les dépendances système
|
||||
apt:
|
||||
name:
|
||||
- wget
|
||||
- gnupg2
|
||||
- lsb-release
|
||||
- ca-certificates
|
||||
- apt-transport-https
|
||||
- acl # Nécessaire pour become_user
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Ajouter la clé GPG du dépôt PostgreSQL
|
||||
apt_key:
|
||||
url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
|
||||
state: present
|
||||
|
||||
- name: Ajouter le dépôt PostgreSQL
|
||||
apt_repository:
|
||||
repo: "deb http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main"
|
||||
state: present
|
||||
filename: pgdg
|
||||
|
||||
- name: Installer PostgreSQL {{ postgres_version }}
|
||||
apt:
|
||||
name:
|
||||
- postgresql-{{ postgres_version }}
|
||||
- postgresql-contrib-{{ postgres_version }}
|
||||
- python3-psycopg2
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: S'assurer que PostgreSQL est démarré
|
||||
systemd:
|
||||
name: postgresql
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
- name: Définir le mot de passe du user postgres
|
||||
postgresql_user:
|
||||
name: postgres
|
||||
password: "{{ postgres_password }}"
|
||||
state: present
|
||||
become_user: postgres
|
||||
|
||||
- name: Créer les bases de données PostgreSQL
|
||||
postgresql_db:
|
||||
name: "{{ item.name }}"
|
||||
owner: postgres
|
||||
state: present
|
||||
loop: "{{ postgres_databases }}"
|
||||
become_user: postgres
|
||||
|
||||
- name: Configurer pg_hba.conf pour autoriser le backend
|
||||
blockinfile:
|
||||
path: "/etc/postgresql/{{ postgres_version }}/main/pg_hba.conf"
|
||||
block: |
|
||||
# Connexions locales
|
||||
local all postgres peer
|
||||
host all postgres 127.0.0.1/32 scram-sha-256
|
||||
# Connexions backend LAN
|
||||
host all postgres 192.168.1.0/24 scram-sha-256
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||
notify: Redémarrer PostgreSQL
|
||||
tags:
|
||||
- reload
|
||||
|
||||
- name: Configurer PostgreSQL pour écouter sur toutes les interfaces
|
||||
lineinfile:
|
||||
path: "/etc/postgresql/{{ postgres_version }}/main/postgresql.conf"
|
||||
regexp: "^#?listen_addresses"
|
||||
line: "listen_addresses = '*'"
|
||||
state: present
|
||||
notify: Redémarrer PostgreSQL
|
||||
tags:
|
||||
- reload
|
||||
|
||||
handlers:
|
||||
- name: Redémarrer PostgreSQL
|
||||
systemd:
|
||||
name: postgresql
|
||||
state: restarted
|
||||
tags:
|
||||
- reload
|
||||
|
||||
# ============================================
|
||||
# Redis Installation (vm-redis uniquement)
|
||||
# ============================================
|
||||
- name: Installation et configuration de Redis
|
||||
hosts: redis
|
||||
become: true
|
||||
gather_facts: true
|
||||
|
||||
tasks:
|
||||
- name: Installer Redis
|
||||
apt:
|
||||
name:
|
||||
- redis-server
|
||||
- python3-redis
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Créer le répertoire de backup Redis
|
||||
file:
|
||||
path: /var/lib/redis/backup
|
||||
state: directory
|
||||
owner: redis
|
||||
group: redis
|
||||
mode: "0755"
|
||||
|
||||
- name: Configurer Redis - bind address (accepter connexions réseau)
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^bind"
|
||||
line: "bind 127.0.0.1 192.168.1.62"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - port
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^port"
|
||||
line: "port {{ redis_port }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - maxmemory
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?maxmemory"
|
||||
line: "maxmemory {{ redis_maxmemory }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - maxmemory-policy
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?maxmemory-policy"
|
||||
line: "maxmemory-policy {{ redis_maxmemory_policy }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer Redis - requirepass
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?requirepass"
|
||||
line: "requirepass {{ redis_password }}"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Activer AOF (Append Only File) pour Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^appendonly"
|
||||
line: "appendonly yes"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer la fréquence de sync AOF
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^# ?appendfsync"
|
||||
line: "appendfsync everysec"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Activer la persistance RDB (snapshots)
|
||||
blockinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
block: |
|
||||
save 900 1
|
||||
save 300 10
|
||||
save 60 10000
|
||||
marker: "# {mark} ANSIBLE MANAGED RDB PERSISTENCE"
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer le nom du fichier AOF
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^appendfilename"
|
||||
line: 'appendfilename "appendonly.aof"'
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Désactiver le mode protégé Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^protected-mode"
|
||||
line: "protected-mode no"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Configurer le répertoire de travail Redis
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^dir"
|
||||
line: "dir /var/lib/redis"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: Définir le niveau de log
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "^loglevel"
|
||||
line: "loglevel notice"
|
||||
state: present
|
||||
notify: Redémarrer Redis
|
||||
|
||||
- name: S'assurer que Redis est démarré
|
||||
systemd:
|
||||
name: redis-server
|
||||
state: started
|
||||
enabled: yes
|
||||
|
||||
handlers:
|
||||
- name: Redémarrer Redis
|
||||
systemd:
|
||||
name: redis-server
|
||||
state: restarted
|
||||
@@ -0,0 +1,12 @@
|
||||
[Unit]
|
||||
Description=Backend Golang API
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User={{ user_owner }}
|
||||
WorkingDirectory={{ backend_dir }}
|
||||
ExecStart={{ backend_binary }}
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,14 @@
|
||||
[Unit]
|
||||
Description=Frontend React Production (Vite)
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User={{ user_owner }}
|
||||
Group={{ user_owner }}
|
||||
WorkingDirectory={{ nginx_frontend_path }}
|
||||
ExecStart=/usr/bin/npm run preview -- --port {{ frontend_port }}
|
||||
Restart=always
|
||||
Environment=NODE_ENV=production
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,79 @@
|
||||
upstream backend {
|
||||
server 127.0.0.1:{{ backend_port }} max_fails=3 fail_timeout=30s;
|
||||
keepalive 32;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ nginx_domain }};
|
||||
root {{ nginx_frontend_path }}/dist;
|
||||
index index.html;
|
||||
|
||||
access_log /var/log/nginx/{{ nginx_app_name }}.access.log;
|
||||
error_log /var/log/nginx/{{ nginx_app_name }}.error.log;
|
||||
|
||||
client_max_body_size {{ nginx_max_body_size }};
|
||||
|
||||
location /api/ {
|
||||
limit_except GET POST PUT DELETE PATCH OPTIONS {
|
||||
deny all;
|
||||
}
|
||||
|
||||
proxy_pass http://backend/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_connect_timeout {{ nginx_proxy_timeout }}s;
|
||||
proxy_send_timeout {{ nginx_proxy_timeout }}s;
|
||||
proxy_read_timeout {{ nginx_proxy_timeout }}s;
|
||||
|
||||
proxy_buffering on;
|
||||
proxy_buffer_size 4k;
|
||||
proxy_buffers 8 4k;
|
||||
proxy_no_cache 1;
|
||||
proxy_cache_bypass 1;
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
||||
}
|
||||
|
||||
location ~* \.(css|js)$ {
|
||||
expires {{ nginx_cache_static_duration }};
|
||||
add_header Cache-Control "public, immutable";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||||
expires {{ nginx_cache_media_duration }};
|
||||
add_header Cache-Control "public, immutable";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location = /health {
|
||||
access_log off;
|
||||
return 200 "healthy\n";
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
||||
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
access_log off;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock)$ {
|
||||
deny all;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
[Unit]
|
||||
Description=Serveo Tunnel Service
|
||||
After=network-online.target nginx.service
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=ubuntu
|
||||
WorkingDirectory={{directory}}
|
||||
ExecStart=/usr/bin/ssh \
|
||||
-o ServerAliveInterval=60 \
|
||||
-o ServerAliveCountMax=3 \
|
||||
-o ExitOnForwardFailure=yes \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-R {{nginx_app_name}}:80:{{nginx_domain}}:80 \
|
||||
serveo.net
|
||||
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
|
||||
StandardOutput=append:{{tunnel_log}}
|
||||
StandardError=append:{{tunnel_log_error}}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Reference in New Issue
Block a user