From cda556eec6534a22dbd858e95e3dce0b5b12f22c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= Date: Tue, 20 Jan 2026 15:16:28 +0300 Subject: [PATCH] WIP --- README.md | 8 ++--- ansible/README.md | 9 ++--- ansible/inventory/groups.yml | 4 +++ ansible/roles/consul/notes.txt | 40 ++++++++++++++++++++++ ansible/roles/consul/tasks/main.yml | 6 ++++ ansible/roles/consul/templates/config.json | 14 +------- tofu/terraform.tf | 2 +- tofu/variables.tf | 2 +- 8 files changed, 59 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index f516595..4563803 100644 --- a/README.md +++ b/README.md @@ -77,14 +77,14 @@ Fonctionnalités déjà implémentées: - Alias avec redirection optionnelle vers nom canonique - Redirection HTTP vers HTTPS - Certificats SSL (personnalisés automatiques via Let's Encrypt) -- Filtrage par: +- Filtrage (blacklists) par: - adresses IP - réseaux IP - Antibot par: - défi JavaScript - Passive backend checks - Compression Gzip et zstd -- Mode détection sans blocage +- Mode détection sans blocage par les CRS - Filtrage par: - méthode HTTP - En-têtes de sécurité: @@ -104,7 +104,7 @@ Urgemment: - Connexion à consul, ACL consul - Collection Ansible -- Gestion CORS +- Revérifier gestion CORS - Active backend checks - Correction de la collecte des logs via OVH LDP @@ -129,7 +129,6 @@ Fomctionnalités à ajouter: - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents, /etc/hapee-1.9/blacklist.acl) - Client cache - Proxy cache -- Filtrage par pays - Compression Brotli - Reverse scan - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules) @@ -142,7 +141,6 @@ Fomctionnalités à ajouter: - HTML injection - Metrics (Elasticsearch + Metabase) - Static files et FastCGI pour PHP (est-ce une bonne idée ?!) -- Lire doc. config JSON de Caddy - Crowdsec - https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list diff --git a/ansible/README.md b/ansible/README.md index 6278000..4774eb5 100644 --- a/ansible/README.md +++ b/ansible/README.md @@ -15,7 +15,7 @@ ``` pipx ensurepath ``` -1. Installer *Ansible* (version 11, et au moins version core 2.16.9, pour +1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour être compatible avec *Mitogen*) dans un environnement isolé (qui sera nommé `ansible`) puis injecter *ansible-lint* et les librairies requises dans cet environnement: @@ -27,14 +27,11 @@ pipx inject ansible passlib # pour |password_hash sur macOS (et autres) pipx inject ansible jmespath # pour |query_result pipx inject ansible pytz # pour plugin inventory auto - pipx inject ansible pynetbox # pour collection netbox.netbox - pipx inject ansible netaddr # pour les rôles CheckMK pipx inject ansible mitogen # optionnel, pour utiliser Mitogen ``` - 1. Vérifier l'environnement: ``` pipx list --include-injected - ansible --version -> ansible [core 2.16.9] - ansible-lint --version -> ansible-lint 24.7.0 + ansible --version -> ansible [core 2.19.5] + ansible-lint --version -> ansible-lint 26.1.1 ``` diff --git a/ansible/inventory/groups.yml b/ansible/inventory/groups.yml index 7f9cd35..0625ed4 100644 --- a/ansible/inventory/groups.yml +++ b/ansible/inventory/groups.yml @@ -2,6 +2,10 @@ linux: vars: ansible_user: "root" +debian13: + vars: + ansible_python_interpreter: "/usr/bin/python3.13" + ubuntu24: vars: ansible_python_interpreter: "/usr/bin/python3.12" diff --git a/ansible/roles/consul/notes.txt b/ansible/roles/consul/notes.txt index 7a9e4f1..5a61c34 100644 --- a/ansible/roles/consul/notes.txt +++ b/ansible/roles/consul/notes.txt @@ -4,3 +4,43 @@ Security: - Consul agent communication - mTLS for authentitication and encryption - Certificate authority + + + "acl": { + "enabled": true, +{% if not consul_acl_bootstraped %} + "default_policy": "allow", +{% else %} + "default_policy": "deny", + "tokens": { + "agent": "FIXME" + }, +{% endif %} + "down_policy": "extend-cache" + }, + + +FIXME: +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: bootstrap_expect > 0: expecting 3 servers +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: bootstrap_expect > 0: expecting 3 servers +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead. +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead. +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. +Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. diff --git a/ansible/roles/consul/tasks/main.yml b/ansible/roles/consul/tasks/main.yml index 7a61dc7..17c250e 100644 --- a/ansible/roles/consul/tasks/main.yml +++ b/ansible/roles/consul/tasks/main.yml @@ -3,6 +3,12 @@ name: - "unzip" +- name: Disable IPv6 on all interfaces + ansible.posix.sysctl: + name: "net.ipv6.conf.all.disable_ipv6" + value: "1" + sysctl_set: true + - name: Create Consul directory ansible.builtin.file: path: "/usr/local/consul-{{ consul_version }}" diff --git a/ansible/roles/consul/templates/config.json b/ansible/roles/consul/templates/config.json index 4634975..19abe06 100644 --- a/ansible/roles/consul/templates/config.json +++ b/ansible/roles/consul/templates/config.json @@ -18,23 +18,11 @@ "client_addr": "{{ consul_client_addr }}", "bind_addr": "{{ consul_bind_addr }}", "advertise_addr": "{{ consul_advertise_addr }}", - "bootstrap_expect": {{ consul_servers | length }}, + "bootstrap_expect": {{ (consul_servers | length) - 1 }}, "enable_syslog": true, "performance": { "raft_multiplier": 1 }, - "acl": { - "enabled": true, -{% if not consul_acl_bootstraped %} - "default_policy": "allow", -{% else %} - "default_policy": "deny", - "tokens": { - "agent": "FIXME" - }, -{% endif %} - "down_policy": "extend-cache" - }, {% endif %} "retry_join": ["{{ consul_servers | join('", "') }}"] } diff --git a/tofu/terraform.tf b/tofu/terraform.tf index 4a0b157..78ad8e3 100644 --- a/tofu/terraform.tf +++ b/tofu/terraform.tf @@ -2,7 +2,7 @@ terraform { required_providers { multipass = { source = "larstobi/multipass" - version = "~> 1.4.2" + version = "1.4.3" } } } diff --git a/tofu/variables.tf b/tofu/variables.tf index a4ad7e2..cfa00b7 100644 --- a/tofu/variables.tf +++ b/tofu/variables.tf @@ -4,6 +4,6 @@ variable "vms" { cpus = optional(number, 2), memory = optional(string, "2g"), disk = optional(string, "12g"), - image = optional(string, "24.04"), + image = optional(string, "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"), })) }