bgwaf/example/ansible/play-main.yml

- name: Gather facts (implicit) and packages facts
  hosts: all
  tasks:
    - name: Gather packages facts
      ansible.builtin.package_facts:
  tags:
    - "always"

- name: Create local CA
  hosts: all
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_common_name: "Lab CA"
    local_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_country_name: "{{ common.certificates.country_name }}"
    local_ca_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_email_address: "{{ common.certificates.email_address }}"
  roles:
    - "local_ca"
  tags:
    - "local_ca"

# - name: Proxy server
#   hosts: proxy
#   gather_facts: false
#   vars_files:
#     - "vars/common.yml"
#     - "vars/secrets.yml"
#   vars:
#     squid_authorized_networks:
#       - "{{ ansible_default_ipv4.network }}/24"
#   roles:
#     - "squid"
#   tags:
#     - "proxy"

- name: Common
  hosts: all
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
#   common_proxy_server: "{{ hostvars['proxy1'].ansible_default_ipv4.address }}:3128"
    common_default_packages:
      - "net-tools"
      - "htop"
      - "aptitude"
      - "screen"
      - "tcpdump"
  roles:
    - "common"
  tags:
    - "common"

- name: Web Application Firewalls (install)
  hosts: waf
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    local_ca_certs_ca_passphrase: "{{ secrets.ca.passphrase }}"
    local_ca_certs_default_country_name: "{{ common.certificates.country_name }}"
    local_ca_certs_default_locality_name: "{{ common.certificates.locality_name }}"
    local_ca_certs_default_organization_name: "{{ common.certificates.organization_name }}"
    local_ca_certs_default_email_address: "{{ common.certificates.email_address }}"
    local_ca_certs_list:
      # Consul
      - cn: "server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
        domains:
          - "DNS:server.{{ common.consul.datacenter }}.{{ common.consul.domain }}"
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
      # Sites
      - cn: "test1.lab"
        domains:
          - "DNS:test1.lab"
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
      - cn: "test2.lab"
        domains:
          - "DNS:test2.lab"
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
      - cn: "test3.lab"
        domains:
          - "DNS:test3.lab"
          - "DNS:{{ ansible_fqdn }}"
          - "DNS:{{ ansible_hostname }}"
          - "IP:{{ ansible_default_ipv4.address }}"
    consul_server: true
    consul_domain: "{{ common.consul.domain }}"
    consul_datacenter: "{{ common.consul.datacenter }}"
    consul_bootstrap_secret: "{{ secrets.consul.bootstrap_secret }}"
    consul_secret_key: "{{ secrets.consul.secret_key }}"
    consul_servers: ["waf1", "waf2", "waf3"]
    consul_ui_secret_id: "{{ secrets.consul.ui_secret }}"
    consul_services:
      - name: "www"
        address: "{{ ansible_default_ipv4.address }}"
        port: 443
        check_http: "http://{{ ansible_default_ipv4.address }}:80/"
#   keepalived_script_user: "byow"
#   keepalived_monitored_process: "caddy"
#   keepalived_vrrp_password: "{{ secrets.keepalived.secret }}"
#   keepalived_vrrp_ips:
#     - master: "waf1"
#       virtual_router_id: 251
#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.251/24"
#     - master: "waf2"
#       virtual_router_id: 252
#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.252/24"
#     - master: "waf3"
#       virtual_router_id: 253
#       addr: "{{ ansible_default_ipv4.address | regex_replace('\\.[0-9]+$', '') }}.253/24"
#   # Multipass network doesn't seem to support well multicast.
#   keepalived_unicast_peers:
#     - "{{ hostvars['waf1'].ansible_default_ipv4.address }}"
#     - "{{ hostvars['waf2'].ansible_default_ipv4.address }}"
#     - "{{ hostvars['waf3'].ansible_default_ipv4.address }}"
    unbound_listen_interfaces:
      - "{{ ansible_default_ipv4.address }}"
    unbound_stub_zones:
      - name: "{{ common.consul.datacenter }}.{{ common.consul.domain }}"
        stub_to: "127.0.0.1@8600"
    caddy_crowdsec: true
    caddy_crowdsec_api_key: "{{ secrets.crowdsec.lapi_key }}"
    caddy_consul: true
    caddy_consul_delegate_to: "waf1"
    caddy_consul_admin_token: "{{ secrets.consul.bootstrap_secret }}"
    caddy_consul_aes_key: "{{ secrets.caddy.storage_consul_aes_key }}"
    caddy_consul_client_cert: "/etc/ssl/certs/server.lab.itik.fr.crt"
    caddy_consul_client_key: "/etc/ssl/private/server.lab.itik.fr.key"
    caddy_sites: "{{ common.sites }}"
#   ovh_ldp_cluster: "gra2.logs.ovh.com"
#   ovh_ldp_token: "{{ secrets.ovh_ldp.token }}"
  roles:
    - "local_ca_certs"
    - "consul"
    - "crowdsec"
    - "caddy"
#   - "keepalived"
    - "unbound"
#   - "ovh_ldp"
  tags:
    - "waf"

- name: MySQL servers
  hosts: bdd
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    mysql_databases:
      - "wordpress"
    mysql_users:
      - name: "wordpress"
        password: "{{ secrets.wordpress.mysql_password }}"
        priv: "wordpress.*:ALL"
        host: "{{ ansible_default_ipv4.network }}/255.255.255.0"
  roles:
    - "mysql"
  tags:
    - "bdd"

- name: NFS servers
  hosts: nfs
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    nfs_server_exports:
      - path: "/srv/wordpress"
        owner: 1001
        group: 33
        clients:
          - address: "www1"
            options: "rw,no_root_squash"
          - address: "www2"
            options: "rw,no_root_squash"
          - address: "www3"
            options: "rw,no_root_squash"
  roles:
    - "nfs_server"
  tags:
    - "nfs"

- name: HTTP Servers (test1.lab)
  hosts: test1
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    nfs_client_mounts:
      - mount_point: "/var/www/wordpress"
        server: "nfs1:/srv/wordpress"
        owner: 1001
        group: 33
    wordpress_create_master: "www1"
    wordpress_site: "test1.lab"
    wordpress_url: "test1.lab"
    wordpress_site_title: "Lab Test I"
    wordpress_admin_user: "spock1"
    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
    wordpress_admin_email: "seb@itik.fr"
    wordpress_themes: ["twentytwentyfive"]
    wordpress_active_theme: "twentytwentyfive"
    wordpress_db_host: "bdd1"
    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
  roles:
    - "nfs_client"
    - "wordpress"
  tags:
    - "test1"

- name: HTTP Server (test2.lab)
  hosts: test2
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    mysql_databases:
      - "wordpress"
    mysql_users:
      - name: "wordpress"
        password: "{{ secrets.wordpress.mysql_password }}"
        priv: "wordpress.*:ALL"
    wordpress_site: "test2.lab"
    wordpress_url: "test2.lab"
    wordpress_site_title: "Lab Test II"
    wordpress_admin_user: "spock2"
    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
    wordpress_admin_email: "seb@itik.fr"
    wordpress_themes: ["twentytwentyfive"]
    wordpress_active_theme: "twentytwentyfive"
    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
  roles:
    - "mysql"
    - "wordpress"
  tags:
    - "test2"

- name: HTTP Server (test3.lab)
  hosts: test3
  gather_facts: false
  vars_files:
    - "vars/common.yml"
    - "vars/secrets.yml"
  vars:
    mysql_databases:
      - "wordpress"
    mysql_users:
      - name: "wordpress"
        password: "{{ secrets.wordpress.mysql_password }}"
        priv: "wordpress.*:ALL"
    wordpress_site: "test3.lab"
    wordpress_url: "test3.lab"
    wordpress_site_title: "Lab Test III"
    wordpress_admin_user: "spock3"
    wordpress_admin_password: "{{ secrets.wordpress.admin_password }}"
    wordpress_admin_email: "seb@itik.fr"
    wordpress_themes: ["twentytwentyfive"]
    wordpress_active_theme: "twentytwentyfive"
    wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
  roles:
    - "mysql"
    - "wordpress"
  tags:
    - "test3"