Update seb4itik/byow/galaxy.yml

.gitignore

@@ -3,3 +3,5 @@
 __pycache__/
 infra-*/
 .DS_Store
+/seb4itik/byow/roles/elastic/
+/seb4itik/byow/roles/metabase/

example/ansible/inventory/groups.yml

@@ -5,3 +5,17 @@ linux:
 ubuntu2404lts:
   vars:
     ansible_python_interpreter: "/usr/bin/python3.12"
+
+test1:
+  hosts:
+    www1:
+    www2:
+    www3:
+
+test2:
+  hosts:
+    www4:
+
+test3:
+  hosts:
+    www5:

example/ansible/play-main.yml

@@ -77,9 +77,21 @@
           - "DNS:{{ ansible_fqdn }}"
           - "DNS:{{ ansible_hostname }}"
       # Sites
-      - cn: "test.lab"
+      - cn: "test1.lab"
         domains:
-          - "DNS:test.lab"
+          - "DNS:test1.lab"
+          - "DNS:{{ ansible_fqdn }}"
+          - "DNS:{{ ansible_hostname }}"
+          - "IP:{{ ansible_default_ipv4.address }}"
+      - cn: "test2.lab"
+        domains:
+          - "DNS:test2.lab"
+          - "DNS:{{ ansible_fqdn }}"
+          - "DNS:{{ ansible_hostname }}"
+          - "IP:{{ ansible_default_ipv4.address }}"
+      - cn: "test3.lab"
+        domains:
+          - "DNS:test3.lab"
           - "DNS:{{ ansible_fqdn }}"
           - "DNS:{{ ansible_hostname }}"
           - "IP:{{ ansible_default_ipv4.address }}"
@@ -144,17 +156,6 @@
     - "vars/common.yml"
     - "vars/secrets.yml"
   vars:
-    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
-    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
-    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
-    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
-    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
-    local_ca_certs_list:
-      - cn: "{{ ansible_fqdn }}"
-        domains:
-          - "DNS:{{ ansible_fqdn }}"
-          - "DNS:{{ ansible_hostname }}"
-          - "IP:{{ ansible_default_ipv4.address }}"
     mysql_databases:
       - "wordpress"
     mysql_users:
@@ -163,7 +164,6 @@
         priv: "wordpress.*:ALL"
         host: "{{ ansible_default_ipv4.network }}/255.255.255.0"
   roles:
-    - "local_ca_certs"
     - "mysql"
   tags:
     - "bdd"
@@ -191,34 +191,23 @@
   tags:
     - "nfs"
 
-- name: HTTP Servers
-  hosts: www
+- name: HTTP Servers (test1.lab)
+  hosts: test1
   gather_facts: false
   vars_files:
     - "vars/common.yml"
     - "vars/secrets.yml"
   vars:
-    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
-    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
-    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
-    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
-    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
-    local_ca_certs_list:
-      - cn: "{{ ansible_fqdn }}"
-        domains:
-          - "DNS:{{ ansible_fqdn }}"
-          - "DNS:{{ ansible_hostname }}"
-          - "IP:{{ ansible_default_ipv4.address }}"
     nfs_client_mounts:
       - mount_point: "/var/www/wordpress"
         server: "nfs1:/srv/wordpress"
         owner: 1001
         group: 33
     wordpress_create_master: "www1"
-    wordpress_site: "test.lab"
-    wordpress_url: "test.lab"
-    wordpress_site_title: "Lab Test"
-    wordpress_admin_user: "spock"
+    wordpress_site: "test1.lab"
+    wordpress_url: "test1.lab"
+    wordpress_site_title: "Lab Test I"
+    wordpress_admin_user: "spock1"
     wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
     wordpress_admin_email: "seb@itik.fr"
     wordpress_themes: ["twentytwentyfive"]
@@ -226,8 +215,63 @@
     wordpress_db_host: "bdd1"
     wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
   roles:
-    - "local_ca_certs"
     - "nfs_client"
     - "wordpress"
   tags:
-    - "www"
+    - "test1"
+
+- name: HTTP Server (test2.lab)
+  hosts: test2
+  gather_facts: false
+  vars_files:
+    - "vars/common.yml"
+    - "vars/secrets.yml"
+  vars:
+    mysql_databases:
+      - "wordpress"
+    mysql_users:
+      - name: "wordpress"
+        password: "{{ secrets.wordpress.mysql_password }}"
+        priv: "wordpress.*:ALL"
+    wordpress_site: "test2.lab"
+    wordpress_url: "test2.lab"
+    wordpress_site_title: "Lab Test II"
+    wordpress_admin_user: "spock2"
+    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
+    wordpress_admin_email: "seb@itik.fr"
+    wordpress_themes: ["twentytwentyfive"]
+    wordpress_active_theme: "twentytwentyfive"
+    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
+  roles:
+    - "mysql"
+    - "wordpress"
+  tags:
+    - "test2"
+
+- name: HTTP Server (test3.lab)
+  hosts: test3
+  gather_facts: false
+  vars_files:
+    - "vars/common.yml"
+    - "vars/secrets.yml"
+  vars:
+    mysql_databases:
+      - "wordpress"
+    mysql_users:
+      - name: "wordpress"
+        password: "{{ secrets.wordpress.mysql_password }}"
+        priv: "wordpress.*:ALL"
+    wordpress_site: "test3.lab"
+    wordpress_url: "test3.lab"
+    wordpress_site_title: "Lab Test III"
+    wordpress_admin_user: "spock3"
+    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
+    wordpress_admin_email: "seb@itik.fr"
+    wordpress_themes: ["twentytwentyfive"]
+    wordpress_active_theme: "twentytwentyfive"
+    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
+  roles:
+    - "mysql"
+    - "wordpress"
+  tags:
+    - "test3"

example/ansible/vars/common.yml

@@ -11,8 +11,9 @@ common:
     datacenter: "lab"
 
   sites:
-    - id: "test"
-      name: "test.lab"
+
+    - id: "test1"
+      name: "test1.lab"
       paths:
         - addrs:
             - "http://www1"
@@ -23,8 +24,8 @@ common:
       proxy_active_checks_status: "301"
       proxy_passive_checks: false
       custom_cert: true
-      custom_cert_file: "/etc/ssl/certs/test.lab.crt"
-      custom_cert_key_file: "/etc/ssl/private/test.lab.key"
+      custom_cert_file: "/etc/ssl/certs/test1.lab.crt"
+      custom_cert_key_file: "/etc/ssl/private/test1.lab.key"
       rate_limit_events: 10
       rate_limit_window: "1m"
 #     filter_whitelist: ["10.60.117.1"]
@@ -46,3 +47,45 @@ common:
         style-src-attr: "'self' 'unsafe-inline'"
         style-src-elem: "'self' 'unsafe-inline'"
         frame-src: "'self' blob:"
+
+    - id: "test2"
+      name: "test2.lab"
+      paths:
+        - addrs:
+            - "http://www4"
+      custom_cert: true
+      custom_cert_file: "/etc/ssl/certs/test2.lab.crt"
+      custom_cert_key_file: "/etc/ssl/private/test2.lab.key"
+      crs_plugins:
+        - "wordpress-rule-exclusions"
+      header_cross_origin_embedder_policy: "unsafe-none"
+      header_content_security_policy:
+        worker-src: "'self' blob:"
+        img-src: "'self' data: https://secure.gravatar.com/avatar/ https://s.w.org/images/"
+        font-src: "'self' data:"
+        script-src: "'self' 'unsafe-eval'"
+        script-src-elem: "'self' 'unsafe-inline'"
+        style-src-attr: "'self' 'unsafe-inline'"
+        style-src-elem: "'self' 'unsafe-inline'"
+        frame-src: "'self' blob:"
+
+    - id: "test3"
+      name: "test3.lab"
+      paths:
+        - addrs:
+            - "http://www4"
+      custom_cert: true
+      custom_cert_file: "/etc/ssl/certs/test3.lab.crt"
+      custom_cert_key_file: "/etc/ssl/private/test3.lab.key"
+      crs_plugins:
+        - "wordpress-rule-exclusions"
+      header_cross_origin_embedder_policy: "unsafe-none"
+      header_content_security_policy:
+        worker-src: "'self' blob:"
+        img-src: "'self' data: https://secure.gravatar.com/avatar/ https://s.w.org/images/"
+        font-src: "'self' data:"
+        script-src: "'self' 'unsafe-eval'"
+        script-src-elem: "'self' 'unsafe-inline'"
+        style-src-attr: "'self' 'unsafe-inline'"
+        style-src-elem: "'self' 'unsafe-inline'"
+        frame-src: "'self' blob:"

example/ansible/vars/secrets.yml

@@ -1,24 +1,29 @@
 $ANSIBLE_VAULT;1.1;AES256
-30356233646632316565363533613033376333306433626366623230633838356230363461383135
-3834363137353762316262363134643763353632306362640a613538306235633565356563613532
-64643862613431313666363130376338356538323035346532636331316637646235346236333331
-6336313466313434640a316437343866343061383838383362633638363633363535363330333463
-64616330333361643166663061306338616265316262646339663438306465623231336139653764
-63353862303538636636306430333464383339316233326133623564613337306266353730616564
-63366562626135626136663665353663323265346438346131363838383263663665653937393066
-32353061396661346138386561633734353634363164663438656331383663323035613264653265
-38646164633465363238623232393731633761393466326466653430316532633139636533613033
-39303764363861353666356239306366633662643865663033383235336663623632373566383330
-32363334653936393962633266666439623130616161373231313037343735616361303131383230
-62333863313432353536363962623161383434363136316264663061343038633065316232313334
-38653233356135623431343166356464666663636330373663303663326561363333633837303337
-66616464393661653835636665353439353539393530623730656331316235643032336337616436
-64373163373932653038613765633061306331363962333932383564333735353534646637303237
-62376561303364386662343331373631343166326261636362623432323437643735663437333564
-39323961626131616334323131393963323231626638393231326631306337306230666138323830
-63373331636234646431666332633633353637313338353536663539303531663938336132356134
-30323631646666396239323261366435656434623537343935393531633966643135633561633636
-31626266366432613936643937646537636164646334316562396639363132313862616433653535
-34666537653433663466323730373363363064393334386133366365383435616436623963626634
-31376162306565623262663732356463616464376231356432316137373138356466393663653035
-613336396164633836626637393036303336
+64353736626438653965303633376231356361353433626432333862363638353937386635396430
+6339336333323062333732626539333761396234316535360a376361326263393431626638373165
+34663632643038643630386331663035383738333364393636376137643037623939313136373665
+3238356630313039310a636661613764373133323033356339373334613331366337343935313334
+30326631386562666336363735316234616339396633356633343339313562386530303863613331
+30646638313535316433393361613461613932393933613932656362653666383638333739383831
+64363266336438373635376663616432346464303365316564326536623133356264326462393537
+38646261303962373465663266643139393366616133346662666331326539353635616662326138
+64393163396339336231303765366130323530336433666361353161376536326465333438326337
+64633731626636666430656335303431623663333464383138393231633435323338303862666634
+33373664383663393637623735656338346566626431333964366637636431653461656363396463
+65343033326433343863393865663236623133306663636237383532306137316534313436323137
+66346630383133383430383263656137653462656665313664626366613135323463613737346261
+32643833616135363066633632313863373563366362366534353762616162626239306135356164
+31323631323939343763643964656330363133383437306236646466326266333964613162623666
+61623139616466653438663065373635653162653461613131383531373632633235336332333935
+30666430396634373563646439353563646536353966653635323932306261383863653137333766
+39616564373330366230333562626435343934333331623761373336393937376562343433386334
+31386663613031613835353662373138663835373235613462316232373533626439343631353632
+36366133313862336336663134353935306661613935363331663136323930616361396431653439
+37356666363331303637326663623561346236356266323731383632323835336362633362646237
+31376230633165306135306537656434666630343865343333663762646361323462303031303935
+36356132313934323235343436303032623461343630623464353663303138653566313938653635
+36613037376430313966356237323362353862626139663339323834326637313636326534343031
+37373664653361373064666362343165613063303336663330643064643331383432653333353330
+38646535363835653039636531616632313130313963656435303739326530633434316237303562
+66646631393563356136303537303563346537366633316437373231313265633133653431323031
+33393937356430363739

example/tofu/infra.auto.tfvars

@@ -16,4 +16,6 @@ vms = {
   www1 = {},
   www2 = {},
   www3 = {},
+  www4 = {},
+  www5 = {},
 }

seb4itik/byow/galaxy.yml

@@ -1,6 +1,6 @@
 namespace: "seb4itik"
 name: "byow"
-version: "0.2.1"
+version: "0.3.1"
 readme: "README.md"
 authors:
 - "S. Namèche <sebastien@itik.fr>"

seb4itik/byow/roles/local_ca_certs/defaults/main.yml

@@ -8,7 +8,7 @@ local_ca_certs_default_not_before: "-1d"   # valid since yesterday
 
 # Required
 local_ca_certs_ca_passphrase: null
-local_ca_certs_list: {}
+local_ca_certs_list: []
 # - cn: <string>
 #   domains: <array of strings>
 #   country_name: <string>

seb4itik/byow/roles/mysql/defaults/main.yml

@@ -4,3 +4,4 @@ mysql_users: []
 # - name: <string
 #   password: <string>
 #   priv: <string>
+#   host: <string>  (default "127.0.0.1")

seb4itik/byow/roles/mysql/tasks/main.yml

@@ -28,4 +28,4 @@
     name: "{{ item.name }}"
     password: "{{ item.password }}"
     priv: "{{ item.priv }}"
-    host: "{{ item.host }}"
+    host: "{{ item.host | default('127.0.0.1') }}"

seb4itik/byow/roles/squid/README.md

@@ -0,0 +1,5 @@
+# BYOW - Build Your Own WAF
+
+A WAF _à la carte_.
+
+## Squid

seb4itik/byow/roles/wordpress/defaults/main.yml

@@ -13,7 +13,7 @@ wordpress_active_theme: null
 wordpress_user: "wordpress"
 wordpress_plugins: []
 wordpress_locale: "fr_FR"
-wordpress_db_host: "localhost"
+wordpress_db_host: "127.0.0.1"
 wordpress_db_name: "{{ wordpress_user }}"
 wordpress_db_user: "{{ wordpress_user }}"
 wordpress_db_prefix: "wp_"

seb4itik/byow/roles/wordpress/tasks/install_wordpress.yml

@@ -0,0 +1,133 @@
+- name: Téléchargement de Wordpress
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp core download --locale='{{ wordpress_locale }}' --skip-content"
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-config-sample.php"
+
+# TODO: https://make.wordpress.org/cli/handbook/references/config/#config-files
+- name: Configuration de Wordpress
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.shell:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      wp config create \
+        --dbhost='{{ wordpress_db_host }}' \
+        --dbname='{{ wordpress_db_name }}' \
+        --dbuser='{{ wordpress_db_user }}' \
+        --dbpass='{{ wordpress_db_pass }}' \
+        --dbprefix='{{ wordpress_db_prefix }}' \
+        --dbcharset='{{ wordpress_db_charset }}' \
+        --extra-php <<PHP
+      define('FS_METHOD', 'direct');
+      define('FORCE_SSL_ADMIN', false);
+      define('WP_HOME', 'https://{{ wordpress_site }}');
+      define('WP_SITEURL', 'https://{{ wordpress_site }}');
+
+      error_reporting(0);
+      @ini_set('display_errors', 0);
+      define('DISALLOW_FILE_EDIT', true);
+
+      if (isset(\$_SERVER['HTTP_X_FORWARDED_PROTO']) && \$_SERVER['HTTP_X_FORWARDED_PROTO']=='https')
+          \$_SERVER['HTTPS'] = 'on';
+      PHP
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-config.php"
+  notify:
+    - "Flush Wordpress"
+
+- name: Create Wordpress database tables
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: >
+      wp core install
+      --url='{{ wordpress_url }}'
+      --title='{{ wordpress_site_title }}'
+      --admin_user='{{ wordpress_admin_user }}'
+      --admin_password='{{ wordpress_admin_password }}'
+      --admin_email='{{ wordpress_admin_email }}'
+      --locale='{{ wordpress_locale }}'
+      --skip-email
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/uploads/ }}"
+  register: "wordpress_out_core_install"
+  changed_when: "'Success: WordPress installed successfully.' in wordpress_out_core_install.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Installation des thèmes Wordpress
+  become: true
+  become_user: "{{ wordpress_user }}"
+  loop: "{{ wordpress_themes }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp theme install '{{ item }}'"
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/themes/{{ item | basename | splitext | first }}"
+  register: "wordpress_out_theme_install"
+  changed_when: "'Success: Installed 1 of 1 themes' in wordpress_out_theme_install.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Activation du thème Wordpress
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp theme activate '{{ wordpress_active_theme }}'"
+  register: "wordpress_out_theme_activate"
+  changed_when: "'Success: Switched to ' in wordpress_out_theme_activate.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Installation des plugins wordpress-importer et one-click-demo-import
+  vars:
+    wordpress_plugins_to_install:
+      - "wordpress-importer"
+      - "one-click-demo-import"
+  ansible.builtin.include_tasks: "install_plugins.yml"
+
+- name: Importation des plugins OCDI
+  become: true
+  become_user: "{{ wordpress_user }}"
+  loop: "{{ wordpress_import_ocdi_indexes }}"
+  ansible.builtin.shell:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      wp ocdi import --predefined='{{ item }}' \
+      && touch /var/www/{{ wordpress_user }}/{{ wordpress_site }}/.ocdi_index{{ item }}_imported
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/.ocdi_index{{ item }}_imported"
+  register: "wordpress_out_ocdi_import"
+  changed_when: "'Success: Content import finished!' in wordpress_out_ocdi_import.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Installation des plugins Wordpress
+  vars:
+    wordpress_plugins_to_install: "{{ wordpress_plugins }}"
+  ansible.builtin.include_tasks: "install_plugins.yml"
+
+- name: Création du répertoire cache de Wordpress
+  ansible.builtin.file:
+    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/cache"
+    state: "directory"
+    owner: "{{ wordpress_user }}"
+    group: "www-data"
+    mode: "0750"
+
+- name: Apply permissions
+  loop:
+    - "cache"
+    - "upgrade"
+    - "uploads"
+  ansible.builtin.file:
+    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/{{ item }}/"
+    owner: "{{ wordpress_user }}"
+    group: "www-data"
+    mode: "u=rwX,g=rwX,o=rX"
+    recurse: true

seb4itik/byow/roles/wordpress/tasks/main.yml

@@ -16,7 +16,6 @@
       - "zip"
 
 - name: Installation de wp-cli
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
   ansible.builtin.get_url:
     url: "https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar"
     dest: "/usr/local/bin/wp"
@@ -42,148 +41,8 @@
     mode: "0750"
 
 - name: Installation de Wordpress
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  become: true
-  become_user: "{{ wordpress_user }}"
-  ansible.builtin.command:
-    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
-    cmd: "wp core download --locale='{{ wordpress_locale }}' --skip-content"
-    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-config-sample.php"
-
-# TODO: https://make.wordpress.org/cli/handbook/references/config/#config-files
-- name: Configuration de Wordpress
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  become: true
-  become_user: "{{ wordpress_user }}"
-  ansible.builtin.shell:
-    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
-    executable: "/usr/bin/bash"
-    cmd: |
-      set -o pipefail
-      wp config create \
-        --dbhost='{{ wordpress_db_host }}' \
-        --dbname='{{ wordpress_db_name }}' \
-        --dbuser='{{ wordpress_db_user }}' \
-        --dbpass='{{ wordpress_db_pass }}' \
-        --dbprefix='{{ wordpress_db_prefix }}' \
-        --dbcharset='{{ wordpress_db_charset }}' \
-        --extra-php <<PHP
-      define('FS_METHOD', 'direct');
-      define('FORCE_SSL_ADMIN', false);
-      define('WP_HOME', 'https://{{ wordpress_site }}');
-      define('WP_SITEURL', 'https://{{ wordpress_site }}');
-
-      error_reporting(0);
-      @ini_set('display_errors', 0);
-      define('DISALLOW_FILE_EDIT', true);
-
-      if (isset(\$_SERVER['HTTP_X_FORWARDED_PROTO']) && \$_SERVER['HTTP_X_FORWARDED_PROTO']=='https')
-          \$_SERVER['HTTPS'] = 'on';
-      PHP
-    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-config.php"
-  notify:
-    - "Flush Wordpress"
-
-- name: Create Wordpress database tables
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  become: true
-  become_user: "{{ wordpress_user }}"
-  ansible.builtin.command:
-    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
-    cmd: >
-      wp core install
-      --url='{{ wordpress_url }}'
-      --title='{{ wordpress_site_title }}'
-      --admin_user='{{ wordpress_admin_user }}'
-      --admin_password='{{ wordpress_admin_password }}'
-      --admin_email='{{ wordpress_admin_email }}'
-      --locale='{{ wordpress_locale }}'
-      --skip-email
-    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/uploads/ }}"
-  register: "wordpress_out_core_install"
-  changed_when: "'Success: WordPress installed successfully.' in wordpress_out_core_install.stdout"
-  notify:
-    - "Flush Wordpress"
-
-- name: Installation des thèmes Wordpress
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  become: true
-  become_user: "{{ wordpress_user }}"
-  loop: "{{ wordpress_themes }}"
-  ansible.builtin.command:
-    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
-    cmd: "wp theme install '{{ item }}'"
-    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/themes/{{ item | basename | splitext | first }}"
-  register: "wordpress_out_theme_install"
-  changed_when: "'Success: Installed 1 of 1 themes' in wordpress_out_theme_install.stdout"
-  notify:
-    - "Flush Wordpress"
-
-- name: Activation du thème Wordpress
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  become: true
-  become_user: "{{ wordpress_user }}"
-  ansible.builtin.command:
-    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
-    cmd: "wp theme activate '{{ wordpress_active_theme }}'"
-  register: "wordpress_out_theme_activate"
-  changed_when: "'Success: Switched to ' in wordpress_out_theme_activate.stdout"
-  notify:
-    - "Flush Wordpress"
-
-- name: Installation des plugins wordpress-importer et one-click-demo-import
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  vars:
-    wordpress_plugins_to_install:
-      - "wordpress-importer"
-      - "one-click-demo-import"
-  ansible.builtin.include_tasks: "install_plugins.yml"
-
-- name: Importation des plugins OCDI
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  become: true
-  become_user: "{{ wordpress_user }}"
-  loop: "{{ wordpress_import_ocdi_indexes }}"
-  ansible.builtin.shell:
-    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
-    executable: "/usr/bin/bash"
-    cmd: |
-      set -o pipefail
-      wp ocdi import --predefined='{{ item }}' \
-      && touch /var/www/{{ wordpress_user }}/{{ wordpress_site }}/.ocdi_index{{ item }}_imported
-    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/.ocdi_index{{ item }}_imported"
-  register: "wordpress_out_ocdi_import"
-  changed_when: "'Success: Content import finished!' in wordpress_out_ocdi_import.stdout"
-  notify:
-    - "Flush Wordpress"
-
-- name: Installation des plugins Wordpress
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  vars:
-    wordpress_plugins_to_install: "{{ wordpress_plugins }}"
-  ansible.builtin.include_tasks: "install_plugins.yml"
-
-- name: Création du répertoire cache de Wordpress
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  ansible.builtin.file:
-    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/cache"
-    state: "directory"
-    owner: "{{ wordpress_user }}"
-    group: "www-data"
-    mode: "0750"
-
-- name: Apply permissions
-  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
-  loop:
-    - "cache"
-    - "upgrade"
-    - "uploads"
-  ansible.builtin.file:
-    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/{{ item }}/"
-    owner: "{{ wordpress_user }}"
-    group: "www-data"
-    mode: "u=rwX,g=rwX,o=rX"
-    recurse: true
+  when: "wordpress_create_master == None or wordpress_create_master == ansible_hostname"
+  ansible.builtin.include_tasks: "install_wordpress.yml"
 
 - name: Configuration de Nginx
   ansible.builtin.template: