coimbrap/projet_serveur_krkn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Corrections et mise à jour

Browse Source
This commit is contained in:
Pierre Coimbra
2020-03-05 07:21:54 +01:00
parent 4ef032f0f2
commit 501c84ce42
6 changed files with 34 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
deploiement/sources/zone_dmz/ferm/dns_ferm.conf
View File

@@ -32,6 +32,10 @@
@def $UDP_OPEN_PORT_BACK_ACCESS = ();
# Besoin de VRRP sur IF_VRRP
@def $NEED_VRRP = 0; #0 pour NON 1 pour OUI
@def $IF_VRRP = eth0;
table filter {
chain INPUT {
policy DROP;
@@ -44,6 +48,10 @@ table filter {
interface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_REQUEST ACCEPT;
}
@if $NEED_VRRP {
interface $IF_VRRP proto vrrp ACCEPT;
}
@if $NEED_UDP_FRONT_REQUEST {
interface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_REQUEST ACCEPT;
}
@@ -71,6 +79,10 @@ table filter {
outerface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_ACCESS ACCEPT;
}
@if $NEED_VRRP {
outerface $IF_VRRP proto vrrp ACCEPT;
}
@if $NEED_UDP_FRONT_ACCESS {
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
}

15
deploiement/sources/zone_dmz/script_haproxy_deploy_cert.sh
View File

@@ -9,11 +9,12 @@ if [ "$(ip a | grep -c "10.0.0.8")" -ge 1 ]; then
then
other_ip=10.0.0.6
fi
certbot renew
rm -rf /etc/ssl/letsencrypt/*
for domain in $(ls /etc/letsencrypt/live); do
cat /etc/letsencrypt/live/$domain/privkey.pem /etc/letsencrypt/live/$domain/fullchain.pem > /etc/ssl/letsencrypt/$domain.pem
done
scp -r /etc/ssl/letsencrypt/* hasync@$other_ip:/etc/ssl/letsencrypt
else
rm -f /etc/letsencrypt/live/README
rm -rf /etc/ssl/letsencrypt/*
for domain in $(ls /etc/letsencrypt/live); do
cat /etc/letsencrypt/live/$domain/privkey.pem /etc/letsencrypt/live/$domain/fullchain.pem > /etc/ssl/letsencrypt/$domain.pem
done
scp -r /etc/ssl/letsencrypt/* root@$ct_ip:/etc/ssl/letsencrypt
ssh root@$ct_ip 'service haproxy reload'
service haproxy reload
fi

4
deploiement/sources/zone_proxy/ct_proxy.yml
View File

@@ -5,7 +5,7 @@
# Gateway 10.0.2.0/24 -> 10.0.2.254
# Gateway 10.1.0.0/24 -> 10.1.0.254
# Créer les containers, les mets à jours, configure les mises à jours de sécurité automatique,
# Créer les conteneurs, les mets à jours, configure les mises à jours de sécurité automatique,
# installe des paquets utile et ceux des services, met en place ferm via notre template.
- hosts: localhost
@@ -61,7 +61,7 @@
pubkey: "{{ ssh_pub }}"
state: present
- name: Start Proxy containers
- name: Start Proxy container
proxmox:
api_user: root@pam
api_password: "{{ pass_pve }}"