231 lines
7.5 KiB
YAML
231 lines
7.5 KiB
YAML
- name: Gather facts (implicit) and packages facts
|
|
hosts: all
|
|
tasks:
|
|
- name: Gather packages facts
|
|
ansible.builtin.package_facts:
|
|
tags:
|
|
- "always"
|
|
|
|
- name: Create local CA
|
|
hosts: all
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
local_ca_common_name: "Lab CA"
|
|
local_ca_passphrase: "{{ secrets.ca.passphrase }}"
|
|
local_ca_country_name: "{{ common.certificates.country_name }}"
|
|
local_ca_locality_name: "{{ common.certificates.locality_name }}"
|
|
local_ca_organization_name: "{{ common.certificates.organization_name }}"
|
|
local_ca_email_address: "{{ common.certificates.email_address }}"
|
|
roles:
|
|
- "local_ca"
|
|
tags:
|
|
- "local_ca"
|
|
|
|
- name: Common
|
|
hosts: all
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
common_default_packages:
|
|
- "net-tools"
|
|
- "htop"
|
|
- "aptitude"
|
|
- "screen"
|
|
- "tcpdump"
|
|
roles:
|
|
- "common"
|
|
tags:
|
|
- "common"
|
|
|
|
- name: Web Application Firewalls (install)
|
|
hosts: waf
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
|
|
local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
|
|
local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
|
|
local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
|
|
local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
|
|
local_ca_certs_list:
|
|
# Consul
|
|
- cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
|
|
domains:
|
|
- "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
|
|
# Sites
|
|
- cn: "test.lab"
|
|
domains:
|
|
- "DNS:test.lab"
|
|
- "DNS:{{ ansible_fqdn }}"
|
|
- "DNS:{{ ansible_hostname }}"
|
|
- "IP:{{ ansible_default_ipv4.address }}"
|
|
consul_domain: "{{ common.consul.domain }}"
|
|
consul_datacenter: "{{ common.consul.datacenter }}"
|
|
consul_secret_key: "{{ secrets.consul.secret_key }}"
|
|
consul_servers: ["waf1", "waf2", "waf3"]
|
|
consul_server: true
|
|
consul_services:
|
|
- name: "www"
|
|
port: 443
|
|
check_http: "http://{{ ansible_default_ipv4.address }}:80/"
|
|
# keepalived_script_user: "caddy"
|
|
# keepalived_monitored_process: "caddy"
|
|
# keepalived_vrrp_password: "{{ secrets.keepalived.secret }}"
|
|
# keepalived_vrrp_ips:
|
|
# - master: "waf1"
|
|
# virtual_router_id: 251
|
|
# addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.251/24"
|
|
# - master: "waf2"
|
|
# virtual_router_id: 252
|
|
# addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.252/24"
|
|
# - master: "waf3"
|
|
# virtual_router_id: 253
|
|
# addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.253/24"
|
|
# # Multipass network doesn't seem to support well multicast.
|
|
# keepalived_unicast_peers:
|
|
# - "{{ hostvars['waf1'].ansible_default_ipv4.address }}"
|
|
# - "{{ hostvars['waf2'].ansible_default_ipv4.address }}"
|
|
# - "{{ hostvars['waf3'].ansible_default_ipv4.address }}"
|
|
unbound_listen_interfaces:
|
|
- "{{ ansible_default_ipv4.address }}"
|
|
unbound_stub_zones:
|
|
- name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}"
|
|
stub_to: "127.0.0.1@8600"
|
|
waf_config_sites: "{{ common.sites }}"
|
|
ovh_ldp_cluster: "gra2.logs.ovh.com"
|
|
ovh_ldp_token: ¨{{ secrets.ovh_ldp.token }}
|
|
roles:
|
|
- "local_ca_certs"
|
|
- "consul"
|
|
- "waf_install"
|
|
# - "keepalived"
|
|
- "waf_config"
|
|
- "unbound"
|
|
- "ovh_ldp"
|
|
tags:
|
|
- "waf"
|
|
|
|
- name: MySQL servers
|
|
hosts: mysql
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
|
|
local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
|
|
local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
|
|
local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
|
|
local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
|
|
local_ca_certs_list:
|
|
- cn: "{{ ansible_fqdn }}"
|
|
domains:
|
|
- "DNS:{{ ansible_fqdn }}"
|
|
- "DNS:{{ ansible_hostname }}"
|
|
- "IP:{{ ansible_default_ipv4.address }}"
|
|
mysql_databases:
|
|
- "wordpress"
|
|
mysql_users:
|
|
- name: "wordpress"
|
|
password: "{{ secrets.wordpress.mysql_password }}"
|
|
priv: "wordpress.*:ALL"
|
|
host: "{{ ansible_default_ipv4.network }}/255.255.255.0"
|
|
consul_domain: "{{ common.consul.domain }}"
|
|
consul_datacenter: "{{ common.consul.datacenter }}"
|
|
consul_secret_key: "{{ secrets.consul.secret_key }}"
|
|
consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
|
|
consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
|
|
consul_servers: ["waf1", "waf2", "waf3"]
|
|
consul_services:
|
|
- name: "test-lab-mysql"
|
|
port: 3306
|
|
check_tcp: "{{ ansible_default_ipv4.address }}:3306"
|
|
roles:
|
|
- "local_ca_certs"
|
|
- "mysql"
|
|
- "consul"
|
|
tags:
|
|
- "mysql"
|
|
|
|
- name: NFS servers
|
|
hosts: nfs
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
nfs_server_exports:
|
|
- path: "/srv/wordpress"
|
|
owner: 1001
|
|
group: 33
|
|
clients:
|
|
- address: "www1"
|
|
options: "rw,no_root_squash"
|
|
- address: "www2"
|
|
options: "rw,no_root_squash"
|
|
- address: "www3"
|
|
options: "rw,no_root_squash"
|
|
roles:
|
|
- "nfs_server"
|
|
tags:
|
|
- "nfs"
|
|
|
|
- name: HTTP Servers
|
|
hosts: www
|
|
gather_facts: false
|
|
vars_files:
|
|
- "vars/common.yml"
|
|
- "vars/secrets.yml"
|
|
vars:
|
|
local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
|
|
local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
|
|
local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
|
|
local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
|
|
local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
|
|
local_ca_certs_list:
|
|
- cn: "{{ ansible_fqdn }}"
|
|
domains:
|
|
- "DNS:{{ ansible_fqdn }}"
|
|
- "DNS:{{ ansible_hostname }}"
|
|
- "IP:{{ ansible_default_ipv4.address }}"
|
|
nfs_client_mounts:
|
|
- mount_point: "/var/www/wordpress"
|
|
server: "nfs1:/srv/wordpress"
|
|
owner: 1001
|
|
group: 33
|
|
wordpress_create_master: "www1"
|
|
wordpress_site: "test.lab"
|
|
wordpress_url: "test.lab"
|
|
wordpress_site_title: "Lab Test"
|
|
wordpress_admin_user: "spock"
|
|
wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
|
|
wordpress_admin_email: "seb@itik.fr"
|
|
wordpress_themes: ["twentytwentyfive"]
|
|
wordpress_active_theme: "twentytwentyfive"
|
|
wordpress_db_host: "mysql1"
|
|
wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
|
|
consul_domain: "{{ common.consul.domain }}"
|
|
consul_datacenter: "{{ common.consul.datacenter }}"
|
|
consul_secret_key: "{{ secrets.consul.secret_key }}"
|
|
consul_key_file: "/etc/ssl/private/{{ ansible_fqdn }}.key"
|
|
consul_cert_file: "/etc/ssl/certs/{{ ansible_fqdn }}.crt"
|
|
consul_servers: ["waf1", "waf2", "waf3"]
|
|
consul_services:
|
|
- name: "test-lab-www"
|
|
port: 80
|
|
check_http: "http://localhost:80/"
|
|
roles:
|
|
- "local_ca_certs"
|
|
- "nfs_client"
|
|
- "wordpress"
|
|
- "consul"
|
|
tags:
|
|
- "www"
|