diff --git a/.gitignore b/.gitignore index c608261..998d9a7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ .ansible/ __pycache__/ +infra-*/ .DS_Store diff --git a/README.md b/README.md index 4563803..9d99142 100644 --- a/README.md +++ b/README.md @@ -134,7 +134,7 @@ Fomctionnalités à ajouter: - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules) - Gestion des sessions - Whitelist -- Bad behavior +- Bad behavior (via Caddy events ?) - Authentification - Anti DDoS - Greylist @@ -156,3 +156,42 @@ Fomctionnalités à ajouter: Modules - []() - []() + + +### Installation d'Ansible avec pipx + +1. Désinstaller *Ansible* et *ansible-lint* s'ils sont déjà installés. Par + exemple avec *Homebrew*: + ``` + brew uninstall ansible ansible-lint + ``` +1. Installer *pipx*. Par exemple avec *Homebrew*: + ``` + brew install pipx + ``` +1. Inscrire le chemin de recherche des exécutables de *pipx* dans les + scripts d'ouverture de session (fermer le shell et en ouvrir un nouveau + pour activer ce chemin de recherche): + ``` + pipx ensurepath + ``` +1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour + être compatible avec *Mitogen*) dans un environnement isolé (qui sera + nommé `ansible`) puis injecter *ansible-lint* et les librairies requises + dans cet environnement: + ``` + pipx install ansible==12.3.0 --include-deps + pipx inject ansible ansible-lint --include-apps + pipx inject ansible requests + pipx inject ansible pip-system-certs + pipx inject ansible passlib # pour |password_hash sur macOS (et autres) + pipx inject ansible jmespath # pour |query_result + pipx inject ansible pytz # pour plugin inventory auto + pipx inject ansible mitogen # optionnel, pour utiliser Mitogen + ``` +1. Vérifier l'environnement: + ``` + pipx list --include-injected + ansible --version -> ansible [core 2.19.5] + ansible-lint --version -> ansible-lint 26.1.1 + ``` diff --git a/ansible/README.md b/ansible/README.md deleted file mode 100644 index 4774eb5..0000000 --- a/ansible/README.md +++ /dev/null @@ -1,37 +0,0 @@ -### Installation d'Ansible avec pipx - -1. Désinstaller *Ansible* et *ansible-lint* s'ils sont déjà installés. Par - exemple avec *Homebrew*: - ``` - brew uninstall ansible ansible-lint - ``` -1. Installer *pipx*. Par exemple avec *Homebrew*: - ``` - brew install pipx - ``` -1. Inscrire le chemin de recherche des exécutables de *pipx* dans les - scripts d'ouverture de session (fermer le shell et en ouvrir un nouveau - pour activer ce chemin de recherche): - ``` - pipx ensurepath - ``` -1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour - être compatible avec *Mitogen*) dans un environnement isolé (qui sera - nommé `ansible`) puis injecter *ansible-lint* et les librairies requises - dans cet environnement: - ``` - pipx install ansible==12.3.0 --include-deps - pipx inject ansible ansible-lint --include-apps - pipx inject ansible requests - pipx inject ansible pip-system-certs - pipx inject ansible passlib # pour |password_hash sur macOS (et autres) - pipx inject ansible jmespath # pour |query_result - pipx inject ansible pytz # pour plugin inventory auto - pipx inject ansible mitogen # optionnel, pour utiliser Mitogen - ``` -1. Vérifier l'environnement: - ``` - pipx list --include-injected - ansible --version -> ansible [core 2.19.5] - ansible-lint --version -> ansible-lint 26.1.1 - ``` diff --git a/ansible/.gitignore b/example/ansible/.gitignore similarity index 100% rename from ansible/.gitignore rename to example/ansible/.gitignore diff --git a/ansible/ansible.cfg b/example/ansible/ansible.cfg similarity index 100% rename from ansible/ansible.cfg rename to example/ansible/ansible.cfg diff --git a/ansible/ansible_local.env_example b/example/ansible/ansible_local.env_example similarity index 100% rename from ansible/ansible_local.env_example rename to example/ansible/ansible_local.env_example diff --git a/example/ansible/filter_plugins b/example/ansible/filter_plugins new file mode 120000 index 0000000..a4f518f --- /dev/null +++ b/example/ansible/filter_plugins @@ -0,0 +1 @@ +../../filter_plugins \ No newline at end of file diff --git a/ansible/inventory/groups.yml b/example/ansible/inventory/groups.yml similarity index 96% rename from ansible/inventory/groups.yml rename to example/ansible/inventory/groups.yml index 0625ed4..e825b06 100644 --- a/ansible/inventory/groups.yml +++ b/example/ansible/inventory/groups.yml @@ -18,7 +18,7 @@ waf: mysql: hosts: - mysql1: + sql1: nfs: hosts: diff --git a/ansible/inventory/multipass.sh b/example/ansible/inventory/multipass.sh similarity index 100% rename from ansible/inventory/multipass.sh rename to example/ansible/inventory/multipass.sh diff --git a/ansible/play-config.yml b/example/ansible/play-config.yml similarity index 100% rename from ansible/play-config.yml rename to example/ansible/play-config.yml diff --git a/ansible/play-main.yml b/example/ansible/play-main.yml similarity index 99% rename from ansible/play-main.yml rename to example/ansible/play-main.yml index 6102503..73d02dc 100644 --- a/ansible/play-main.yml +++ b/example/ansible/play-main.yml @@ -75,7 +75,7 @@ - name: "www" port: 443 check_http: "http://{{ ansible_default_ipv4.address }}:80/" -# keepalived_script_user: "caddy" +# keepalived_script_user: "byow" # keepalived_monitored_process: "caddy" # keepalived_vrrp_password: "{{ secrets.keepalived.secret }}" # keepalived_vrrp_ips: @@ -208,7 +208,7 @@ wordpress_admin_email: "seb@itik.fr" wordpress_themes: ["twentytwentyfive"] wordpress_active_theme: "twentytwentyfive" - wordpress_db_host: "mysql1" + wordpress_db_host: "sql1" wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}" consul_domain: "{{ common.consul.domain }}" consul_datacenter: "{{ common.consul.datacenter }}" diff --git a/example/ansible/roles b/example/ansible/roles new file mode 120000 index 0000000..b741aa3 --- /dev/null +++ b/example/ansible/roles @@ -0,0 +1 @@ +../../roles \ No newline at end of file diff --git a/ansible/run_ansible.sh b/example/ansible/run_ansible.sh similarity index 100% rename from ansible/run_ansible.sh rename to example/ansible/run_ansible.sh diff --git a/ansible/vars/common.yml b/example/ansible/vars/common.yml similarity index 100% rename from ansible/vars/common.yml rename to example/ansible/vars/common.yml diff --git a/ansible/vars/secrets.yml b/example/ansible/vars/secrets.yml similarity index 100% rename from ansible/vars/secrets.yml rename to example/ansible/vars/secrets.yml diff --git a/example/tofu/.gitignore b/example/tofu/.gitignore new file mode 100644 index 0000000..4ffb12a --- /dev/null +++ b/example/tofu/.gitignore @@ -0,0 +1,5 @@ +.terraform/ +.terraform.lock.hcl +.terraform.tfstate.lock.info +terraform.tfstate +terraform.tfstate.backup diff --git a/tofu/cloud-init.yml b/example/tofu/cloud-init.yml similarity index 100% rename from tofu/cloud-init.yml rename to example/tofu/cloud-init.yml diff --git a/example/tofu/infra.auto.tfvars b/example/tofu/infra.auto.tfvars new file mode 100644 index 0000000..eb3f9cd --- /dev/null +++ b/example/tofu/infra.auto.tfvars @@ -0,0 +1,10 @@ +vms = { + waf1 = {}, + waf2 = {}, + waf3 = {}, + sql1 = {}, + nfs1 = {}, + www1 = {}, + www2 = {}, + www3 = {}, +} diff --git a/tofu/main.tf b/example/tofu/main.tf similarity index 100% rename from tofu/main.tf rename to example/tofu/main.tf diff --git a/tofu/terraform.tf b/example/tofu/terraform.tf similarity index 100% rename from tofu/terraform.tf rename to example/tofu/terraform.tf diff --git a/tofu/variables.tf b/example/tofu/variables.tf similarity index 52% rename from tofu/variables.tf rename to example/tofu/variables.tf index cfa00b7..02998be 100644 --- a/tofu/variables.tf +++ b/example/tofu/variables.tf @@ -2,8 +2,8 @@ variable "vms" { description = "Liste des machines virtuelles" type = map(object({ cpus = optional(number, 2), - memory = optional(string, "2g"), + memory = optional(string, "3g"), disk = optional(string, "12g"), - image = optional(string, "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"), + image = optional(string, "24.04"), })) } diff --git a/ansible/filter_plugins/filters.py b/filter_plugins/filters.py similarity index 100% rename from ansible/filter_plugins/filters.py rename to filter_plugins/filters.py diff --git a/ansible/roles/caddy/.gitignore b/roles/caddy/.gitignore similarity index 100% rename from ansible/roles/caddy/.gitignore rename to roles/caddy/.gitignore diff --git a/ansible/roles/caddy/README.md b/roles/caddy/README.md similarity index 100% rename from ansible/roles/caddy/README.md rename to roles/caddy/README.md diff --git a/ansible/roles/caddy/defaults/main.yml b/roles/caddy/defaults/main.yml similarity index 99% rename from ansible/roles/caddy/defaults/main.yml rename to roles/caddy/defaults/main.yml index aa799e8..f27c58e 100644 --- a/ansible/roles/caddy/defaults/main.yml +++ b/roles/caddy/defaults/main.yml @@ -231,15 +231,15 @@ caddy_waf_defaults: # FIXME # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server - # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version + # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by delete_headers: - "Server" - - "X-Powered-By" + - "Via" - "X-AspNet-Version" - "X-AspNetMvc-Version" - - "Via" + - "X-Powered-By" custom_headers: {} # - name: @@ -253,6 +253,7 @@ caddy_waf_defaults: bot_barrier: false # corazawaf/coraza-caddy + enable_crs: true crs_plugins: [] log_only: false paranoia_level: 1 @@ -278,14 +279,14 @@ caddy_waf_defaults: - "POST" - "OPTIONS" allowed_request_content_type: - - "|application/x-www-form-urlencoded|" - - "|multipart/form-data|" - - "|text/xml|" - - "|application/xml|" - - "|application/soap+xml|" + - "|application/csp-report|" - "|application/json|" - "|application/reports+json|" - - "|application/csp-report|" + - "|application/soap+xml|" + - "|application/x-www-form-urlencoded|" + - "|application/xml|" + - "|multipart/form-data|" + - "|text/xml|" restricted_extensions: - ".ani/" - ".asa/" @@ -294,10 +295,10 @@ caddy_waf_defaults: - ".back/" - ".backup/" - ".bak/" + - ".bat/" - ".bck/" - ".bk/" - ".bkp/" - - ".bat/" - ".cdx/" - ".cer/" - ".cfg/" @@ -305,8 +306,8 @@ caddy_waf_defaults: - ".cnf/" - ".com/" - ".compositefont/" - - ".config/" - ".conf/" + - ".config/" - ".copy/" - ".crt/" - ".cs/" @@ -341,9 +342,9 @@ caddy_waf_defaults: - ".old/" - ".pass/" - ".pdb/" + - ".pem/" - ".pfx/" - ".pif/" - - ".pem/" - ".pol/" - ".prf/" - ".printer/" @@ -369,8 +370,8 @@ caddy_waf_defaults: - ".tmp/" - ".vb/" - ".vbe/" - - ".vbs/" - ".vbproj/" + - ".vbs/" - ".vsdisco/" - ".vxd/" - ".webinfo/" @@ -382,15 +383,15 @@ caddy_waf_defaults: - ".xsx/" restricted_headers_basic: - "/content-encoding/" - - "/proxy/" - - "/lock-token/" - "/content-range/" + - "/expect/" - "/if/" + - "/lock-token/" + - "/proxy/" - "/x-http-method-override/" - "/x-http-method/" - "/x-method-override/" - "/x-middleware-subrequest/" - - "/expect/" restricted_headers_extended: - "/accept-charset/" allowed_http_versions: diff --git a/ansible/roles/caddy/files/bot_barrier_template.html b/roles/caddy/files/bot_barrier_template.html similarity index 100% rename from ansible/roles/caddy/files/bot_barrier_template.html rename to roles/caddy/files/bot_barrier_template.html diff --git a/ansible/roles/caddy/handlers/main.yml b/roles/caddy/handlers/main.yml similarity index 100% rename from ansible/roles/caddy/handlers/main.yml rename to roles/caddy/handlers/main.yml diff --git a/ansible/roles/caddy/tasks/caddy_config.yml b/roles/caddy/tasks/caddy_config.yml similarity index 100% rename from ansible/roles/caddy/tasks/caddy_config.yml rename to roles/caddy/tasks/caddy_config.yml diff --git a/ansible/roles/caddy/tasks/caddy_install.yml b/roles/caddy/tasks/caddy_install.yml similarity index 100% rename from ansible/roles/caddy/tasks/caddy_install.yml rename to roles/caddy/tasks/caddy_install.yml diff --git a/ansible/roles/caddy/tasks/main.yml b/roles/caddy/tasks/main.yml similarity index 100% rename from ansible/roles/caddy/tasks/main.yml rename to roles/caddy/tasks/main.yml diff --git a/ansible/roles/caddy/tasks/plugin_install.yml b/roles/caddy/tasks/plugin_install.yml similarity index 100% rename from ansible/roles/caddy/tasks/plugin_install.yml rename to roles/caddy/tasks/plugin_install.yml diff --git a/ansible/roles/caddy/templates/Caddyfile b/roles/caddy/templates/Caddyfile similarity index 97% rename from ansible/roles/caddy/templates/Caddyfile rename to roles/caddy/templates/Caddyfile index bfb9b04..01cb850 100644 --- a/ansible/roles/caddy/templates/Caddyfile +++ b/roles/caddy/templates/Caddyfile @@ -14,7 +14,7 @@ log waf { format json include "http.handlers.waf" - output stdout + output file {{ caddy_log_dir }}/waf.log } {% if caddy_local_ca_name | default(None) != None %} @@ -96,6 +96,7 @@ window {{ site.rate_window | default('1m') }} } } +{% if site.enable_crs | default(caddy_waf_defaults.enable_crs) %} coraza_waf { load_owasp_crs @@ -115,6 +116,7 @@ SecRuleEngine On ` } +{% endif %} header { Content-Security-Policy "{{ caddy_waf_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}" diff --git a/ansible/roles/caddy/templates/caddy.service b/roles/caddy/templates/caddy.service similarity index 100% rename from ansible/roles/caddy/templates/caddy.service rename to roles/caddy/templates/caddy.service diff --git a/ansible/roles/caddy/templates/coraza.conf b/roles/caddy/templates/coraza.conf similarity index 100% rename from ansible/roles/caddy/templates/coraza.conf rename to roles/caddy/templates/coraza.conf diff --git a/ansible/roles/caddy/templates/crs-setup.conf b/roles/caddy/templates/crs-setup.conf similarity index 94% rename from ansible/roles/caddy/templates/crs-setup.conf rename to roles/caddy/templates/crs-setup.conf index e885249..569865f 100644 --- a/ansible/roles/caddy/templates/crs-setup.conf +++ b/roles/caddy/templates/crs-setup.conf @@ -123,7 +123,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:'tx.allowed_methods={{ site.allowed_methods | default(caddy_waf_defaults.allowed_methods) | join(" ") }}'" -# Content-Types that a client is allowed to send in a request +## Content-Types that a client is allowed to send in a request SecAction \ "id:900220,\ phase:1,\ @@ -178,7 +178,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:'tx.restricted_headers_extended={{ site.restricted_headers_extended | default(caddy_waf_defaults.restricted_headers_extended) | join(" ") }}'" -# Content-Types charsets that a client is allowed to send in a request +## Content-Types charsets that a client is allowed to send in a request SecAction \ "id:900280,\ phase:1,\ @@ -189,7 +189,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:'tx.allowed_request_content_type_charset={{ caddy_waf_defaults.allowed_request_content_type_charset | default(caddy_waf_defaults.allowed_request_content_type_charset) | join(" ") }}'" -# Block request if number of arguments is too high +## Block request if number of arguments is too high SecAction \ "id:900300,\ phase:1,\ @@ -200,7 +200,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:tx.max_num_args={{ site.max_num_args | default(caddy_waf_defaults.max_num_args) }}" -# Block request if the length of any argument name is too high +## Block request if the length of any argument name is too high SecAction \ "id:900310,\ phase:1,\ @@ -211,7 +211,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:tx.arg_name_length={{ site.arg_name_length | default(caddy_waf_defaults.arg_name_length) }}" -# Block request if the length of any argument value is too high +## Block request if the length of any argument value is too high SecAction \ "id:900320,\ phase:1,\ @@ -222,7 +222,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:tx.arg_length={{ site.arg_length | default(caddy_waf_defaults.arg_length) }}" -# Block request if the total length of all combined arguments is too high +## Block request if the total length of all combined arguments is too high SecAction \ "id:900330,\ phase:1,\ @@ -233,7 +233,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:tx.total_arg_length={{ site.total_arg_length | default(caddy_waf_defaults.total_arg_length) }}" -# Block request if the file size of any individual uploaded file is too high +## Block request if the file size of any individual uploaded file is too high SecAction \ "id:900340,\ phase:1,\ @@ -244,7 +244,7 @@ SecAction \ ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\ setvar:tx.max_file_size={{ site.max_file_size | default(caddy_waf_defaults.max_file_size) }}" -# Block request if the total size of all combined uploaded files is too high +## Block request if the total size of all combined uploaded files is too high SecAction \ "id:900350,\ phase:1,\ diff --git a/ansible/roles/caddy/templates/exclusions-request-before.conf b/roles/caddy/templates/exclusions-request-before.conf similarity index 100% rename from ansible/roles/caddy/templates/exclusions-request-before.conf rename to roles/caddy/templates/exclusions-request-before.conf diff --git a/ansible/roles/caddy/templates/exclusions-response-after.conf b/roles/caddy/templates/exclusions-response-after.conf similarity index 100% rename from ansible/roles/caddy/templates/exclusions-response-after.conf rename to roles/caddy/templates/exclusions-response-after.conf diff --git a/ansible/roles/caddy/vars/main.yml b/roles/caddy/vars/main.yml similarity index 100% rename from ansible/roles/caddy/vars/main.yml rename to roles/caddy/vars/main.yml diff --git a/ansible/roles/common/defaults/main.yml b/roles/common/defaults/main.yml similarity index 100% rename from ansible/roles/common/defaults/main.yml rename to roles/common/defaults/main.yml diff --git a/ansible/roles/common/tasks/main.yml b/roles/common/tasks/main.yml similarity index 100% rename from ansible/roles/common/tasks/main.yml rename to roles/common/tasks/main.yml diff --git a/ansible/roles/common/tasks/setup_packages.yml b/roles/common/tasks/setup_packages.yml similarity index 100% rename from ansible/roles/common/tasks/setup_packages.yml rename to roles/common/tasks/setup_packages.yml diff --git a/ansible/roles/common/tasks/setup_proxy_client.yml b/roles/common/tasks/setup_proxy_client.yml similarity index 100% rename from ansible/roles/common/tasks/setup_proxy_client.yml rename to roles/common/tasks/setup_proxy_client.yml diff --git a/ansible/roles/common/templates/apt_proxy.conf b/roles/common/templates/apt_proxy.conf similarity index 100% rename from ansible/roles/common/templates/apt_proxy.conf rename to roles/common/templates/apt_proxy.conf diff --git a/ansible/roles/consul/defaults/main.yml b/roles/consul/defaults/main.yml similarity index 100% rename from ansible/roles/consul/defaults/main.yml rename to roles/consul/defaults/main.yml diff --git a/ansible/roles/consul/handlers/main.yml b/roles/consul/handlers/main.yml similarity index 100% rename from ansible/roles/consul/handlers/main.yml rename to roles/consul/handlers/main.yml diff --git a/ansible/roles/consul/notes.txt b/roles/consul/notes.txt similarity index 79% rename from ansible/roles/consul/notes.txt rename to roles/consul/notes.txt index 5a61c34..e8a040c 100644 --- a/ansible/roles/consul/notes.txt +++ b/roles/consul/notes.txt @@ -6,6 +6,10 @@ Security: - Certificate authority +FIXME: +- Ne fonctionne pas sous Debian 13 + + "acl": { "enabled": true, {% if not consul_acl_bootstraped %} @@ -44,3 +48,15 @@ Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_incoming' fiel Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. + + +FIXME: +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/recordlabel +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/artist +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/album +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/concept +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v2/festival +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/exportedservices +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/namespaceexportedservices +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/partitionexportedservices +Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/internal/v1/tombstone diff --git a/ansible/roles/consul/tasks/main.yml b/roles/consul/tasks/main.yml similarity index 98% rename from ansible/roles/consul/tasks/main.yml rename to roles/consul/tasks/main.yml index 17c250e..73c3dbf 100644 --- a/ansible/roles/consul/tasks/main.yml +++ b/roles/consul/tasks/main.yml @@ -3,6 +3,7 @@ name: - "unzip" + # Not required for Ubuntu 24, was a test for Debian 13 - name: Disable IPv6 on all interfaces ansible.posix.sysctl: name: "net.ipv6.conf.all.disable_ipv6" diff --git a/ansible/roles/consul/templates/config.json b/roles/consul/templates/config.json similarity index 100% rename from ansible/roles/consul/templates/config.json rename to roles/consul/templates/config.json diff --git a/ansible/roles/consul/templates/consul.service b/roles/consul/templates/consul.service similarity index 100% rename from ansible/roles/consul/templates/consul.service rename to roles/consul/templates/consul.service diff --git a/ansible/roles/keepalived/defaults/main.yml b/roles/keepalived/defaults/main.yml similarity index 100% rename from ansible/roles/keepalived/defaults/main.yml rename to roles/keepalived/defaults/main.yml diff --git a/ansible/roles/keepalived/handlers/main.yml b/roles/keepalived/handlers/main.yml similarity index 100% rename from ansible/roles/keepalived/handlers/main.yml rename to roles/keepalived/handlers/main.yml diff --git a/ansible/roles/keepalived/tasks/main.yml b/roles/keepalived/tasks/main.yml similarity index 100% rename from ansible/roles/keepalived/tasks/main.yml rename to roles/keepalived/tasks/main.yml diff --git a/ansible/roles/keepalived/templates/keepalived.conf b/roles/keepalived/templates/keepalived.conf similarity index 100% rename from ansible/roles/keepalived/templates/keepalived.conf rename to roles/keepalived/templates/keepalived.conf diff --git a/ansible/roles/local_ca/defaults/main.yml b/roles/local_ca/defaults/main.yml similarity index 100% rename from ansible/roles/local_ca/defaults/main.yml rename to roles/local_ca/defaults/main.yml diff --git a/ansible/roles/local_ca/tasks/main.yml b/roles/local_ca/tasks/main.yml similarity index 100% rename from ansible/roles/local_ca/tasks/main.yml rename to roles/local_ca/tasks/main.yml diff --git a/ansible/roles/local_ca_certs/defaults/main.yml b/roles/local_ca_certs/defaults/main.yml similarity index 100% rename from ansible/roles/local_ca_certs/defaults/main.yml rename to roles/local_ca_certs/defaults/main.yml diff --git a/ansible/roles/local_ca_certs/handlers/main.yml b/roles/local_ca_certs/handlers/main.yml similarity index 100% rename from ansible/roles/local_ca_certs/handlers/main.yml rename to roles/local_ca_certs/handlers/main.yml diff --git a/ansible/roles/local_ca_certs/tasks/create_cert.yml b/roles/local_ca_certs/tasks/create_cert.yml similarity index 100% rename from ansible/roles/local_ca_certs/tasks/create_cert.yml rename to roles/local_ca_certs/tasks/create_cert.yml diff --git a/ansible/roles/local_ca_certs/tasks/main.yml b/roles/local_ca_certs/tasks/main.yml similarity index 100% rename from ansible/roles/local_ca_certs/tasks/main.yml rename to roles/local_ca_certs/tasks/main.yml diff --git a/ansible/roles/mysql/defaults/main.yml b/roles/mysql/defaults/main.yml similarity index 100% rename from ansible/roles/mysql/defaults/main.yml rename to roles/mysql/defaults/main.yml diff --git a/ansible/roles/mysql/handlers/main.yml b/roles/mysql/handlers/main.yml similarity index 100% rename from ansible/roles/mysql/handlers/main.yml rename to roles/mysql/handlers/main.yml diff --git a/ansible/roles/mysql/tasks/main.yml b/roles/mysql/tasks/main.yml similarity index 100% rename from ansible/roles/mysql/tasks/main.yml rename to roles/mysql/tasks/main.yml diff --git a/ansible/roles/nfs_client/defaults/main.yml b/roles/nfs_client/defaults/main.yml similarity index 100% rename from ansible/roles/nfs_client/defaults/main.yml rename to roles/nfs_client/defaults/main.yml diff --git a/ansible/roles/nfs_client/tasks/main.yml b/roles/nfs_client/tasks/main.yml similarity index 100% rename from ansible/roles/nfs_client/tasks/main.yml rename to roles/nfs_client/tasks/main.yml diff --git a/ansible/roles/nfs_server/defaults/main.yml b/roles/nfs_server/defaults/main.yml similarity index 100% rename from ansible/roles/nfs_server/defaults/main.yml rename to roles/nfs_server/defaults/main.yml diff --git a/ansible/roles/nfs_server/handlers/main.yml b/roles/nfs_server/handlers/main.yml similarity index 100% rename from ansible/roles/nfs_server/handlers/main.yml rename to roles/nfs_server/handlers/main.yml diff --git a/ansible/roles/nfs_server/tasks/main.yml b/roles/nfs_server/tasks/main.yml similarity index 100% rename from ansible/roles/nfs_server/tasks/main.yml rename to roles/nfs_server/tasks/main.yml diff --git a/ansible/roles/nfs_server/templates/exports b/roles/nfs_server/templates/exports similarity index 100% rename from ansible/roles/nfs_server/templates/exports rename to roles/nfs_server/templates/exports diff --git a/ansible/roles/ovh_ldp/defaults/main.yml b/roles/ovh_ldp/defaults/main.yml similarity index 100% rename from ansible/roles/ovh_ldp/defaults/main.yml rename to roles/ovh_ldp/defaults/main.yml diff --git a/ansible/roles/ovh_ldp/handlers/main.yml b/roles/ovh_ldp/handlers/main.yml similarity index 100% rename from ansible/roles/ovh_ldp/handlers/main.yml rename to roles/ovh_ldp/handlers/main.yml diff --git a/ansible/roles/ovh_ldp/tasks/main.yml b/roles/ovh_ldp/tasks/main.yml similarity index 100% rename from ansible/roles/ovh_ldp/tasks/main.yml rename to roles/ovh_ldp/tasks/main.yml diff --git a/ansible/roles/ovh_ldp/templates/ldp-ovh.conf b/roles/ovh_ldp/templates/ldp-ovh.conf similarity index 100% rename from ansible/roles/ovh_ldp/templates/ldp-ovh.conf rename to roles/ovh_ldp/templates/ldp-ovh.conf diff --git a/ansible/roles/unbound/defaults/main.yml b/roles/unbound/defaults/main.yml similarity index 100% rename from ansible/roles/unbound/defaults/main.yml rename to roles/unbound/defaults/main.yml diff --git a/ansible/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml similarity index 100% rename from ansible/roles/unbound/handlers/main.yml rename to roles/unbound/handlers/main.yml diff --git a/ansible/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml similarity index 100% rename from ansible/roles/unbound/tasks/main.yml rename to roles/unbound/tasks/main.yml diff --git a/ansible/roles/unbound/templates/unbound.conf b/roles/unbound/templates/unbound.conf similarity index 100% rename from ansible/roles/unbound/templates/unbound.conf rename to roles/unbound/templates/unbound.conf diff --git a/ansible/roles/wordpress/defaults/main.yml b/roles/wordpress/defaults/main.yml similarity index 100% rename from ansible/roles/wordpress/defaults/main.yml rename to roles/wordpress/defaults/main.yml diff --git a/ansible/roles/wordpress/handlers/main.yml b/roles/wordpress/handlers/main.yml similarity index 100% rename from ansible/roles/wordpress/handlers/main.yml rename to roles/wordpress/handlers/main.yml diff --git a/ansible/roles/wordpress/tasks/install_plugins.yml b/roles/wordpress/tasks/install_plugins.yml similarity index 100% rename from ansible/roles/wordpress/tasks/install_plugins.yml rename to roles/wordpress/tasks/install_plugins.yml diff --git a/ansible/roles/wordpress/tasks/main.yml b/roles/wordpress/tasks/main.yml similarity index 100% rename from ansible/roles/wordpress/tasks/main.yml rename to roles/wordpress/tasks/main.yml diff --git a/ansible/roles/wordpress/templates/nginx_vhost.conf b/roles/wordpress/templates/nginx_vhost.conf similarity index 100% rename from ansible/roles/wordpress/templates/nginx_vhost.conf rename to roles/wordpress/templates/nginx_vhost.conf diff --git a/tofu/.gitignore b/tofu/.gitignore deleted file mode 100644 index 8f59bb5..0000000 --- a/tofu/.gitignore +++ /dev/null @@ -1,4 +0,0 @@ -/.terraform/ -/.terraform.lock.hcl -terraform.tfstate -terraform.tfstate.backup diff --git a/tofu/infra.auto.tfvars b/tofu/infra.auto.tfvars deleted file mode 100644 index ba8263d..0000000 --- a/tofu/infra.auto.tfvars +++ /dev/null @@ -1,10 +0,0 @@ -vms = { - waf1 = {}, - waf2 = {}, - waf3 = {}, - mysql1 = {}, - nfs1 = {}, - www1 = {}, - www2 = {}, - www3 = {}, -}