itik/bgwaf
Private
Public Access
2
0
Fork 0
Code Issues Pull Requests Releases 9 Activity

WIP

Browse Source
This commit is contained in:
Sébastien NAMECHE
2026-01-20 15:16:28 +03:00
parent f70924d910
commit cda556eec6
8 changed files with 59 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ansible/README.md
View File

@@ -15,7 +15,7 @@
```
pipx ensurepath
```
1. Installer *Ansible* (version 11, et au moins version core 2.16.9, pour
1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour
être compatible avec *Mitogen*) dans un environnement isolé (qui sera
nommé `ansible`) puis injecter *ansible-lint* et les librairies requises
dans cet environnement:
@@ -27,14 +27,11 @@
pipx inject ansible passlib # pour |password_hash sur macOS (et autres)
pipx inject ansible jmespath # pour |query_result
pipx inject ansible pytz # pour plugin inventory auto
pipx inject ansible pynetbox # pour collection netbox.netbox
pipx inject ansible netaddr # pour les rôles CheckMK
pipx inject ansible mitogen # optionnel, pour utiliser Mitogen
```
1. Vérifier l'environnement:
```
pipx list --include-injected
ansible --version -> ansible [core 2.16.9]
ansible-lint --version -> ansible-lint 24.7.0
ansible --version -> ansible [core 2.19.5]
ansible-lint --version -> ansible-lint 26.1.1
```

4
ansible/inventory/groups.yml
View File

@@ -2,6 +2,10 @@ linux:
vars:
ansible_user: "root"
debian13:
vars:
ansible_python_interpreter: "/usr/bin/python3.13"
ubuntu24:
vars:
ansible_python_interpreter: "/usr/bin/python3.12"

40
ansible/roles/consul/notes.txt
View File

@@ -4,3 +4,43 @@ Security:
- Consul agent communication
- mTLS for authentitication and encryption
- Certificate authority
"acl": {
"enabled": true,
{% if not consul_acl_bootstraped %}
"default_policy": "allow",
{% else %}
"default_policy": "deny",
"tokens": {
"agent": "FIXME"
},
{% endif %}
"down_policy": "extend-cache"
},
FIXME:
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: bootstrap_expect > 0: expecting 3 servers
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: bootstrap_expect > 0: expecting 3 servers
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead.
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead.
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.

6
ansible/roles/consul/tasks/main.yml
View File

@@ -3,6 +3,12 @@
name:
- "unzip"
- name: Disable IPv6 on all interfaces
ansible.posix.sysctl:
name: "net.ipv6.conf.all.disable_ipv6"
value: "1"
sysctl_set: true
- name: Create Consul directory
ansible.builtin.file:
path: "/usr/local/consul-{{ consul_version }}"

14
ansible/roles/consul/templates/config.json
View File

@@ -18,23 +18,11 @@
"client_addr": "{{ consul_client_addr }}",
"bind_addr": "{{ consul_bind_addr }}",
"advertise_addr": "{{ consul_advertise_addr }}",
"bootstrap_expect": {{ consul_servers | length }},
"bootstrap_expect": {{ (consul_servers | length) - 1 }},
"enable_syslog": true,
"performance": {
"raft_multiplier": 1
},
"acl": {
"enabled": true,
{% if not consul_acl_bootstraped %}
"default_policy": "allow",
{% else %}
"default_policy": "deny",
"tokens": {
"agent": "FIXME"
},
{% endif %}
"down_policy": "extend-cache"
},
{% endif %}
"retry_join": ["{{ consul_servers | join('", "') }}"]
}