First commit

ansible/play-main.yml

@@ -0,0 +1,87 @@
+- name: Gather facts (implicit) and packages facts
+  hosts: all
+  tasks:
+    - name: Gather packages facts
+      ansible.builtin.package_facts:
+  tags:
+    - "always"
+
+- name: Create local CA
+  hosts: all
+  gather_facts: false
+  vars_files:
+    - "vars.yml"
+  vars:
+    local_ca_common_name: "Lab CA"
+    local_ca_passphrase: "{{ vault.ca.passphrase }}"
+    local_ca_country_name: "FR"
+    local_ca_locality_name: "Vannes"
+    local_ca_organization_name: "iTik"
+    local_ca_email_address: "ca@itik.fr"
+  roles:
+    - "local_ca"
+  tags:
+    - "local_ca"
+
+- name: Proxy server
+  hosts: proxy
+  gather_facts: false
+  vars:
+    squid_authorized_networks:
+      - "{{ ansible_default_ipv4.network }}/24"
+  roles:
+    - "squid"
+  tags:
+    - "proxy"
+
+- name: Common
+  hosts: all
+  gather_facts: false
+  vars_files:
+    - "vars.yml"
+  vars:
+    common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
+  roles:
+    - "common"
+  tags:
+    - "common"
+
+- name: HTTP Servers
+  hosts: www
+  gather_facts: false
+  roles:
+    - "www"
+  tags:
+    - "www"
+
+- name: Web Application Firewalls
+  hosts: waf
+  gather_facts: false
+  vars_files:
+    - "vars.yml"
+  vars:
+    cert_domains:
+      - "DNS:test.lab"
+      - "DNS:{{ ansible_fqdn }}"
+      - "DNS:{{ ansible_hostname }}"
+      - "IP:{{ ansible_default_ipv4.address }}"
+      - "DNS:server.{{ consul_datacenter }}.{{ consul_domain }}"
+    cert_country_name: "FR"
+    cert_locality_name: "Vannes"
+    cert_organization_name: "iTik"
+    cert_email_address: "ca@itik.fr"
+    consul_domain: "itik.fr"
+    consul_datacenter: "lab"
+    consul_secret_key: "{{ vault.consul.secret_key }}"
+    consul_nodes:
+      - "waf1"
+      - "waf2"
+      - "waf3"
+    bgwaf_cluster: false
+    bgwaf_sites: "{{ waf.sites }}"
+  roles:
+    - "cert"
+    - "consul"
+    - "bgwaf"
+  tags:
+    - "bgwaf"