From c826b3a390a6d909d97b1f26cfeb11f2c81a2a06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= Date: Fri, 6 Feb 2026 17:33:56 +0300 Subject: [PATCH] example: tests --- example/ansible/play-config.yml | 5 +++++ example/ansible/play-debug.yml | 4 ++++ example/ansible/play-main.yml | 37 ++++++++++----------------------- example/ansible/vars/common.yml | 5 +++-- example/tofu/infra.auto.tfvars | 2 +- 5 files changed, 24 insertions(+), 29 deletions(-) diff --git a/example/ansible/play-config.yml b/example/ansible/play-config.yml index 9a70a67..cb9e59c 100644 --- a/example/ansible/play-config.yml +++ b/example/ansible/play-config.yml @@ -17,6 +17,11 @@ - "DNS:{{ ansible_hostname }}" - "IP:{{ ansible_default_ipv4.address }}" caddy_config_only: true + caddy_consul: true + caddy_consul: true + caddy_consul_delegate_to: "waf1" + caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}" + caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}" caddy_sites: "{{ common.sites }}" roles: - "local_ca_certs" diff --git a/example/ansible/play-debug.yml b/example/ansible/play-debug.yml index 3bfa050..8d9e944 100644 --- a/example/ansible/play-debug.yml +++ b/example/ansible/play-debug.yml @@ -6,6 +6,10 @@ vars: caddy_debug: true caddy_config_only: true + caddy_consul: true + caddy_consul_delegate_to: "waf1" + caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}" + caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}" caddy_sites: "{{ common.sites }}" roles: - "caddy" diff --git a/example/ansible/play-main.yml b/example/ansible/play-main.yml index 913a084..11c2542 100644 --- a/example/ansible/play-main.yml +++ b/example/ansible/play-main.yml @@ -81,13 +81,16 @@ - "DNS:{{ ansible_fqdn }}" - "DNS:{{ ansible_hostname }}" - "IP:{{ ansible_default_ipv4.address }}" + consul_server: true consul_domain: "{{ common.consul.domain }}" consul_datacenter: "{{ common.consul.datacenter }}" + consul_bootstrap_secret: "{{ secrets.consul.bootstrap_secret }}" consul_secret_key: "{{ secrets.consul.secret_key }}" consul_servers: ["waf1", "waf2", "waf3"] - consul_server: true + consul_ui_secret_id: "{{ secrets.consul.ui_secret }}" consul_services: - name: "www" + address: "{{ ansible_default_ipv4.address }}" port: 443 check_http: "http://{{ ansible_default_ipv4.address }}:80/" # keepalived_script_user: "byow" @@ -113,6 +116,10 @@ unbound_stub_zones: - name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}" stub_to: "127.0.0.1@8600" + caddy_consul: true + caddy_consul_delegate_to: "waf1" + caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}" + caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}" caddy_sites: "{{ common.sites }}" # ovh_ldp_cluster: "gra2.logs.ovh.com" # ovh_ldp_token: "{{ secrets.ovh_ldp.token }}" @@ -127,7 +134,7 @@ - "waf" - name: MySQL servers - hosts: mysql + hosts: bdd gather_facts: false vars_files: - "vars/common.yml" @@ -151,22 +158,11 @@ password: "{{ secrets.wordpress.mysql_password }}" priv: "wordpress.*:ALL" host: "{{ ansible_default_ipv4.network }}/255.255.255.0" - consul_domain: "{{ common.consul.domain }}" - consul_datacenter: "{{ common.consul.datacenter }}" - consul_secret_key: "{{ secrets.consul.secret_key }}" - consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key" - consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt" - consul_servers: ["waf1", "waf2", "waf3"] - consul_services: - - name: "test-lab-mysql" - port: 3306 - check_tcp: "{{ ansible_default_ipv4.address }}:3306" roles: - "local_ca_certs" - "mysql" - - "consul" tags: - - "mysql" + - "bdd" - name: NFS servers hosts: nfs @@ -223,22 +219,11 @@ wordpress_admin_email: "seb@itik.fr" wordpress_themes: ["twentytwentyfive"] wordpress_active_theme: "twentytwentyfive" - wordpress_db_host: "sql1" + wordpress_db_host: "bdd1" wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}" - consul_domain: "{{ common.consul.domain }}" - consul_datacenter: "{{ common.consul.datacenter }}" - consul_secret_key: "{{ secrets.consul.secret_key }}" - consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key" - consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt" - consul_servers: ["waf1", "waf2", "waf3"] - consul_services: - - name: "test-lab-www" - port: 80 - check_http: "http://localhost:80/" roles: - "local_ca_certs" - "nfs_client" - "wordpress" - - "consul" tags: - "www" diff --git a/example/ansible/vars/common.yml b/example/ansible/vars/common.yml index 14b6031..a422916 100644 --- a/example/ansible/vars/common.yml +++ b/example/ansible/vars/common.yml @@ -20,6 +20,7 @@ common: - "http://www3" proxy_lb_policy: "random" proxy_active_checks: true + proxy_active_checks_status: "301" proxy_passive_checks: false custom_cert: true custom_cert_file: "/etc/ssl/certs/test.lab.crt" @@ -31,8 +32,8 @@ common: # Cf. https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x) # before_request: # - 'SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" "id:1,nolog,ctl:ruleRemoveById=932260"' - after_response: - - 'SecRuleUpdateTargetById 932260 "!ARGS:tag-name"' +# after_response: +# - 'SecRuleUpdateTargetById 932260 "!ARGS:tag-name"' header_cross_origin_embedder_policy: "unsafe-none" header_content_security_policy: worker-src: "'self' blob:" diff --git a/example/tofu/infra.auto.tfvars b/example/tofu/infra.auto.tfvars index 9103dbf..3573f60 100644 --- a/example/tofu/infra.auto.tfvars +++ b/example/tofu/infra.auto.tfvars @@ -11,7 +11,7 @@ vms = { waf3 = { cpus = 4 }, - sql1 = {}, + bdd1 = {}, nfs1 = {}, www1 = {}, www2 = {},