bgwaf/example/ansible/play-main.yml

- name: Gather facts (implicit) and packages facts
  hosts: all
  tasks:
    - name: Gather packages facts
      ansible.builtin.package_facts:
  tags:
    - "always"

- name: Create local CA
  hosts: all
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_common_name: "Lab CA"
    local_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_country_name: "{{ common.certificates.country_name }}"
    local_ca_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_email_address: "{{ common.certificates.email_address }}"
  roles:
    - "local_ca"
  tags:
    - "local_ca"

- name: Proxy server
  hosts: proxy
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    squid_authorized_networks:
      - "{{ ansible_default_ipv4.network }}/24"
  roles:
    - "squid"
  tags:
    - "proxy"

- name: Common
  hosts: all
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
    common_default_packages:
      - "net-tools"
      - "htop"
      - "aptitude"
      - "screen"
      - "tcpdump"
  roles:
    - "common"
  tags:
    - "common"

- name: Web Application Firewalls (install)
  hosts: waf
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
    local_ca_certs_list:
      # Consul
      - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
        domains:
          - "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
      # Sites
      - cn: "test.lab"
        domains:
          - "DNS:test.lab"
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
    consul_domain: "{{ common.consul.domain }}"
    consul_datacenter: "{{ common.consul.datacenter }}"
    consul_secret_key: "{{ secrets.consul.secret_key }}"
    consul_servers: ["waf1", "waf2", "waf3"]
    consul_server: true
    consul_services:
      - name: "www"
        port: 443
        check_http: "http://{{ ansible_default_ipv4.address }}:80/"
#   keepalived_script_user: "byow"
#   keepalived_monitored_process: "caddy"
#   keepalived_vrrp_password: "{{ secrets.keepalived.secret }}"
#   keepalived_vrrp_ips:
#     - master: "waf1"
#       virtual_router_id: 251
#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.251/24"
#     - master: "waf2"
#       virtual_router_id: 252
#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.252/24"
#     - master: "waf3"
#       virtual_router_id: 253
#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.253/24"
#   # Multipass network doesn't seem to support well multicast.
#   keepalived_unicast_peers:
#     - "{{ hostvars['waf1'].ansible_default_ipv4.address }}"
#     - "{{ hostvars['waf2'].ansible_default_ipv4.address }}"
#     - "{{ hostvars['waf3'].ansible_default_ipv4.address }}"
    unbound_listen_interfaces:
      - "{{ ansible_default_ipv4.address }}"
    unbound_stub_zones:
      - name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}"
        stub_to: "127.0.0.1@8600"
    caddy_sites: "{{ common.sites }}"
#   ovh_ldp_cluster: "gra2.logs.ovh.com"
#   ovh_ldp_token: "{{ secrets.ovh_ldp.token }}"
  roles:
    - "local_ca_certs"
    - "consul"
    - "caddy"
#   - "keepalived"
    - "unbound"
#   - "ovh_ldp"
  tags:
    - "waf"

- name: MySQL servers
  hosts: mysql
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
    local_ca_certs_list:
      - cn: "{{ ansible_fqdn }}"
        domains:
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
    mysql_databases:
      - "wordpress"
    mysql_users:
      - name: "wordpress"
        password: "{{ secrets.wordpress.mysql_password }}"
        priv: "wordpress.*:ALL"
        host: "{{ ansible_default_ipv4.network }}/255.255.255.0"
    consul_domain: "{{ common.consul.domain }}"
    consul_datacenter: "{{ common.consul.datacenter }}"
    consul_secret_key: "{{ secrets.consul.secret_key }}"
    consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
    consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
    consul_servers: ["waf1", "waf2", "waf3"]
    consul_services:
      - name: "test-lab-mysql"
        port: 3306
        check_tcp: "{{ ansible_default_ipv4.address }}:3306"
  roles:
    - "local_ca_certs"
    - "mysql"
    - "consul"
  tags:
    - "mysql"

- name: NFS servers
  hosts: nfs
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    nfs_server_exports:
      - path: "/srv/wordpress"
        owner: 1001
        group: 33
        clients:
          - address: "www1"
            options: "rw,no_root_squash"
          - address: "www2"
            options: "rw,no_root_squash"
          - address: "www3"
            options: "rw,no_root_squash"
  roles:
    - "nfs_server"
  tags:
    - "nfs"

- name: HTTP Servers
  hosts: www
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
    local_ca_certs_list:
      - cn: "{{ ansible_fqdn }}"
        domains:
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
    nfs_client_mounts:
      - mount_point: "/var/www/wordpress"
        server: "nfs1:/srv/wordpress"
        owner: 1001
        group: 33
    wordpress_create_master: "www1"
    wordpress_site: "test.lab"
    wordpress_url: "test.lab"
    wordpress_site_title: "Lab Test"
    wordpress_admin_user: "spock"
    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
    wordpress_admin_email: "seb@itik.fr"
    wordpress_themes: ["twentytwentyfive"]
    wordpress_active_theme: "twentytwentyfive"
    wordpress_db_host: "sql1"
    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
    consul_domain: "{{ common.consul.domain }}"
    consul_datacenter: "{{ common.consul.datacenter }}"
    consul_secret_key: "{{ secrets.consul.secret_key }}"
    consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
    consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
    consul_servers: ["waf1", "waf2", "waf3"]
    consul_services:
      - name: "test-lab-www"
        port: 80
        check_http: "http://localhost:80/"
  roles:
    - "local_ca_certs"
    - "nfs_client"
    - "wordpress"
    - "consul"
  tags:
    - "www"