88 lines
1.8 KiB
YAML
88 lines
1.8 KiB
YAML
|
- name: Gather facts (implicit) and packages facts
|
||
|
|
hosts: all
|
||
|
|
tasks:
|
||
|
|
- name: Gather packages facts
|
||
|
|
ansible.builtin.package_facts:
|
||
|
|
tags:
|
||
|
|
- "always"
|
||
|
|
|
||
|
|
- name: Create local CA
|
||
|
|
hosts: all
|
||
|
|
gather_facts: false
|
||
|
|
vars_files:
|
||
|
|
- "vars.yml"
|
||
|
|
vars:
|
||
|
|
local_ca_common_name: "Lab CA"
|
||
|
|
local_ca_passphrase: "{{ vault.ca.passphrase }}"
|
||
|
|
local_ca_country_name: "FR"
|
||
|
|
local_ca_locality_name: "Vannes"
|
||
|
|
local_ca_organization_name: "iTik"
|
||
|
|
local_ca_email_address: "ca@itik.fr"
|
||
|
|
roles:
|
||
|
|
- "local_ca"
|
||
|
|
tags:
|
||
|
|
- "local_ca"
|
||
|
|
|
||
|
|
- name: Proxy server
|
||
|
|
hosts: proxy
|
||
|
|
gather_facts: false
|
||
|
|
vars:
|
||
|
|
squid_authorized_networks:
|
||
|
|
- "{{ ansible_default_ipv4.network }}/24"
|
||
|
|
roles:
|
||
|
|
- "squid"
|
||
|
|
tags:
|
||
|
|
- "proxy"
|
||
|
|
|
||
|
|
- name: Common
|
||
|
|
hosts: all
|
||
|
|
gather_facts: false
|
||
|
|
vars_files:
|
||
|
|
- "vars.yml"
|
||
|
|
vars:
|
||
|
|
common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
|
||
|
|
roles:
|
||
|
|
- "common"
|
||
|
|
tags:
|
||
|
|
- "common"
|
||
|
|
|
||
|
|
- name: HTTP Servers
|
||
|
|
hosts: www
|
||
|
|
gather_facts: false
|
||
|
|
roles:
|
||
|
|
- "www"
|
||
|
|
tags:
|
||
|
|
- "www"
|
||
|
|
|
||
|
|
- name: Web Application Firewalls
|
||
|
|
hosts: waf
|
||
|
|
gather_facts: false
|
||
|
|
vars_files:
|
||
|
|
- "vars.yml"
|
||
|
|
vars:
|
||
|
|
cert_domains:
|
||
|
|
- "DNS:test.lab"
|
||
|
|
- "DNS:{{ ansible_fqdn }}"
|
||
|
|
- "DNS:{{ ansible_hostname }}"
|
||
|
|
- "IP:{{ ansible_default_ipv4.address }}"
|
||
|
|
- "DNS:server.{{ consul_datacenter }}.{{ consul_domain }}"
|
||
|
|
cert_country_name: "FR"
|
||
|
|
cert_locality_name: "Vannes"
|
||
|
|
cert_organization_name: "iTik"
|
||
|
|
cert_email_address: "ca@itik.fr"
|
||
|
|
consul_domain: "itik.fr"
|
||
|
|
consul_datacenter: "lab"
|
||
|
|
consul_secret_key: "{{ vault.consul.secret_key }}"
|
||
|
|
consul_nodes:
|
||
|
|
- "waf1"
|
||
|
|
- "waf2"
|
||
|
|
- "waf3"
|
||
|
|
bgwaf_cluster: false
|
||
|
|
bgwaf_sites: "{{ waf.sites }}"
|
||
|
|
roles:
|
||
|
|
- "cert"
|
||
|
|
- "consul"
|
||
|
|
- "bgwaf"
|
||
|
|
tags:
|
||
|
|
- "bgwaf"
|