WIP

2026-01-19 15:06:34 +03:00
parent 278d1785cc
commit 3d9fe37983
59 changed files with 1084 additions and 9684 deletions
--- a/ansible/play-main.yml
+++ b/ansible/play-main.yml
@@ -24,20 +24,6 @@
  tags:
    - "local_ca"

- name: Proxy server
-  hosts: proxy
-  gather_facts: false
-  vars_files:
-    - "vars/common.yml"
-    - "vars/secrets.yml"
-  vars:
-    squid_authorized_networks:
-      - "{{ ansible_default_ipv4.network }}/24"
-  roles:
-    - "squid"
-  tags:
-    - "proxy"
-
 - name: Common
  hosts: all
  gather_facts: false
@@ -45,23 +31,17 @@
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
-    common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
+    common_default_packages:
+      - "net-tools"
+      - "htop"
+      - "aptitude"
+      - "screen"
+      - "tcpdump"
  roles:
    - "common"
  tags:
    - "common"

- name: HTTP Servers
-  hosts: www
-  gather_facts: false
-  vars_files:
-    - "vars/common.yml"
-    - "vars/secrets.yml"
-  roles:
-    - "www"
-  tags:
-    - "www"
-
 - name: Web Application Firewalls (install)
  hosts: waf
  gather_facts: false
@@ -69,12 +49,12 @@
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
-    certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
-    certs_default_country_name: "{{ common.certificates.country_name }}"
-    certs_default_locality_name: "{{ common.certificates.locality_name }}"
-    certs_default_organization_name: "{{ common.certificates.organization_name }}"
-    certs_default_email_address: "{{ common.certificates.email_address }}"
-    certs_list:
+    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
+    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
+    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
+    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
+    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
+    local_ca_certs_list:
      # Consul
      - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
        domains:
@@ -89,31 +69,132 @@
    consul_domain: "{{ common.consul.domain }}"
    consul_datacenter: "{{ common.consul.datacenter }}"
    consul_secret_key: "{{ secrets.consul.secret_key }}"
-    consul_nodes:
-      - "waf1"
-      - "waf2"
-      - "waf3"
-    # FIXME: -> Cady modules
-    waf_install_cluster: true
-    vip_script_user: "caddy"
-    vip_monitored_process: "caddy"
-    vip_vrrp_password: "{{ secrets.keepalived.secret }}"
-    vip_vrrp_ips:
-      - master: "waf1"
-        virtual_router_id: 11
-        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.250"
-      - master: "waf2"
-        virtual_router_id: 12
-        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.251"
-      - master: "waf3"
-        virtual_router_id: 13
-        addr: "{{ {{ ansible_default_ipv4.address }} | split('.')[0-3] | join('.') }}.252"
+    consul_servers: ["waf1", "waf2", "waf3"]
+    consul_server: true
+    consul_services:
+      - name: "in"
+        port: 443
+        check_http: "http://{{ ansible_default_ipv4.address }}:80/"
+#   keepalived_script_user: "caddy"
+#   keepalived_monitored_process: "caddy"
+#   keepalived_vrrp_password: "{{ secrets.keepalived.secret }}"
+#   keepalived_vrrp_ips:
+#     - master: "waf1"
+#       virtual_router_id: 251
+#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.251/24"
+#     - master: "waf2"
+#       virtual_router_id: 252
+#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.252/24"
+#     - master: "waf3"
+#       virtual_router_id: 253
+#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.253/24"
+#   # Multipass network doesn't seem to support well multicast.
+#   keepalived_unicast_peers:
+#     - "{{ hostvars['waf1'].ansible_default_ipv4.address }}"
+#     - "{{ hostvars['waf2'].ansible_default_ipv4.address }}"
+#     - "{{ hostvars['waf3'].ansible_default_ipv4.address }}"
+    unbound_listen_interfaces:
+      - "{{ ansible_default_ipv4.address }}"
+    unbound_stub_zones:
+      - name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}"
+        stub_to: "127.0.0.1@8600"
    waf_config_sites: "{{ common.sites }}"
+    ovh_ldp_cluster: "gra2.logs.ovh.com"
+    ovh_ldp_token: ¨{{ secrets.ovh_ldp.token }}
  roles:
-    - "certs"
+    - "local_ca_certs"
    - "consul"
    - "waf_install"
-    - "vip"
+#   - "keepalived"
    - "waf_config"
+    - "unbound"
+    - "ovh_ldp"
  tags:
    - "waf"
+
+- name: MySQL servers
+  hosts: mysql
+  gather_facts: false
+  vars_files:
+    - "vars/common.yml"
+    - "vars/secrets.yml"
+  vars:
+    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
+    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
+    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
+    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
+    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
+    local_ca_certs_list:
+      - cn: "{{ ansible_fqdn }}"
+        domains:
+          - "DNS:{{ ansible_fqdn }}"
+          - "DNS:{{ ansible_hostname }}"
+          - "IP:{{ ansible_default_ipv4.address }}"
+    mysql_databases:
+      - "wordpress"
+    mysql_users:
+      - name: "wordpress"
+        password: "{{ secrets.wordpress.mysql_password }}"
+        priv: "wordpress.*:ALL"
+        host: "{{ ansible_default_ipv4.network }}/255.255.255.0"
+    consul_domain: "{{ common.consul.domain }}"
+    consul_datacenter: "{{ common.consul.datacenter }}"
+    consul_secret_key: "{{ secrets.consul.secret_key }}"
+    consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
+    consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
+    consul_servers: ["waf1", "waf2", "waf3"]
+    consul_services:
+      - name: "test-lab-mysql"
+        port: 3306
+        check_tcp: "{{ ansible_default_ipv4.address }}:3306"
+  roles:
+    - "local_ca_certs"
+    - "mysql"
+    - "consul"
+  tags:
+    - "mysql"
+
+- name: HTTP Servers
+  hosts: www
+  gather_facts: false
+  vars_files:
+    - "vars/common.yml"
+    - "vars/secrets.yml"
+  vars:
+    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
+    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
+    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
+    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
+    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
+    local_ca_certs_list:
+      - cn: "{{ ansible_fqdn }}"
+        domains:
+          - "DNS:{{ ansible_fqdn }}"
+          - "DNS:{{ ansible_hostname }}"
+          - "IP:{{ ansible_default_ipv4.address }}"
+    wordpress_site: "test.lab"
+    wordpress_url: "test.lab"
+    wordpress_site_title: "Lab Test"
+    wordpress_admin_user: "spock"
+    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
+    wordpress_admin_email: "seb@itik.fr"
+    wordpress_themes: ["twentytwentyfive"]
+    wordpress_active_theme: "twentytwentyfive"
+    wordpress_db_host: "mysql1"
+    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
+    consul_domain: "{{ common.consul.domain }}"
+    consul_datacenter: "{{ common.consul.datacenter }}"
+    consul_secret_key: "{{ secrets.consul.secret_key }}"
+    consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
+    consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
+    consul_servers: ["waf1", "waf2", "waf3"]
+    consul_services:
+      - name: "test-lab-www"
+        port: 80
+        check_http: "http://localhost:80/"
+  roles:
+    - "local_ca_certs"
+    - "wordpress"
+    - "consul"
+  tags:
+    - "www"