Amélioration du déploiement via Ansible
Pierre Coimbra
parent
8342918591
commit
a52a234214
|
|
@ -7,6 +7,11 @@ Avant de lancer la création et l'installation de tout les conteneurs il vous fa
|
|||
|
||||
Une fois que c'est fait, créer un conteneur Ansible avec un numéro élevée (253 max).
|
||||
|
||||
- Resource Pool : ADMIN
|
||||
- Disk size : 16 Gib
|
||||
- Cores : 1
|
||||
- Memory : 1024 Mib
|
||||
|
||||
### Réseau
|
||||
Au niveau des interfaces réseau, une sur la partie admin, l'autre sur le zone proxy pour l'accès au futur proxy interne.
|
||||
|
||||
|
|
@ -16,7 +21,17 @@ Au niveau des interfaces réseau, une sur la partie admin, l'autre sur le zone p
|
|||
### Configuration initiale
|
||||
Vous allez générer une clé ed25519 qui servira à l'administation des conteneurs.
|
||||
```
|
||||
ssh-keygen -o -a 100 -t ed25519 -f /root/.ssh/id_ed25519
|
||||
ssh-keygen -o -a 100 -t ed25519 -f /root/.ssh/id_ed25519_ansible
|
||||
```
|
||||
|
||||
La clé publique est dans `/root/.ssh/id_ed25519_ansible.pub`
|
||||
|
||||
### /etc/ssh/ssh_config
|
||||
```
|
||||
Host *
|
||||
StrictHostKeyChecking no
|
||||
UserKnownHostsFile=/dev/null
|
||||
IdentityFile ~/.ssh/id_ed25519_ansible
|
||||
```
|
||||
|
||||
Avant d'installer Ansible, il faut que vous mettiez en place (vous-même) le conteneur du proxy interne. C'est le seul conteneur, avec celui d'Ansible, que vous aurez à créer.
|
||||
|
|
@ -37,6 +52,7 @@ Acquire::http {
|
|||
};
|
||||
```
|
||||
|
||||
|
||||
## Installation d'Ansible
|
||||
|
||||
```
|
||||
|
|
@ -62,7 +78,6 @@ ssh_pub:
|
|||
|
||||
Par exemple, il y aura un groupe HAProxy regroupant tous les conteneurs HAProxy et un groupe DMZ regroupant tous les groupes de conteneurs DMZ.
|
||||
|
||||
|
||||
## Zone DMZ
|
||||
|
||||
Un playbook Ansible est disponible pour la préparation de la zone DMZ, il s'occupera de l'installation de base. A vous de suivre la documentation pour la suite des opérations (sauf mention contraire).
|
||||
|
|
@ -76,12 +91,16 @@ Ajoutez
|
|||
10.1.0.102 #HAProxy Alpha
|
||||
10.1.0.103 #HAProxy Beta
|
||||
|
||||
[proxyint] #Proxy Interne
|
||||
10.1.0.104
|
||||
|
||||
[dns]
|
||||
10.1.0.107 #DNS
|
||||
|
||||
[zonedmz:children]
|
||||
haproxy
|
||||
dmz
|
||||
proxyint
|
||||
dns
|
||||
```
|
||||
|
||||
Pour les mots de passe à vous de les générer, il vous faut ensuite les mettre dans ce fichier. Le mot de passe pour hasync et le même sur les deux HAProxy.
|
||||
|
|
@ -107,7 +126,12 @@ Lancez le avec
|
|||
ansible-playbook ct_dmz.yml
|
||||
```
|
||||
|
||||
Normalement tout est prêt, vous pouvez passer à la configuration des services.
|
||||
Normalement tout les conteneurs sont créer. Le playbook `configure_dmz.yml` permet de configurer automatiquement le proxy interne et le DNS. Pour le DNS si vous souhaitez modifier la configuration changé la configuration dans `sources/zone_dmz/dns/bind`.
|
||||
|
||||
Lancez le avec
|
||||
```
|
||||
ansible-playbook configure_dmz.yml
|
||||
```
|
||||
|
||||
## Zone PROXY
|
||||
|
||||
|
|
@ -122,21 +146,16 @@ Ajoutez
|
|||
10.1.0.104 #Reverse Alpha
|
||||
10.1.0.105 #Reverse Beta
|
||||
|
||||
[mailgw]
|
||||
10.1.0.109 #Mail Gateway
|
||||
|
||||
[zoneproxy:children]
|
||||
nginx
|
||||
mailgw
|
||||
```
|
||||
|
||||
Pour les mots de passe à vous de les générer, il vous faut ensuite les mettre dans ce fichier.
|
||||
|
||||
### /root/src/password_proxy.yml
|
||||
```
|
||||
pass_nginx_alpha:
|
||||
pass_nginx_beta:
|
||||
pass_mailgw:
|
||||
pass_nginx_master:
|
||||
pass_nginx_slave:
|
||||
```
|
||||
|
||||
### Templace Ferm pour les conteneurs
|
||||
|
|
@ -153,3 +172,55 @@ ansible-playbook ct_proxy.yml
|
|||
```
|
||||
|
||||
Normalement tout est prêt, vous pouvez passer à la configuration des services.
|
||||
|
||||
## Zone Interne
|
||||
|
||||
Comme pour les autres zones un playbook Ansible est disponible pour l'installation et la sécurisation de base des conteneurs de base de la zone Interne.
|
||||
|
||||
Voici les tâches à réaliser avant de lancer le playbook.
|
||||
|
||||
### /etc/ansible/hosts
|
||||
Ajoutez
|
||||
```
|
||||
[ldap]
|
||||
10.1.0.108 #LDAPMaster
|
||||
|
||||
[mail]
|
||||
10.1.0.109 #MailBackend
|
||||
|
||||
[webinterface]
|
||||
10.1.0.110 #LDAPUI
|
||||
10.1.0.111 #NextCloud
|
||||
10.1.0.112 #Gitea
|
||||
|
||||
[zoneinterne:children]
|
||||
ldap
|
||||
mail
|
||||
webinterface
|
||||
```
|
||||
|
||||
Pour les mots de passe à vous de les générer, il vous faut ensuite les mettre dans ce fichier.
|
||||
|
||||
### /root/src/password_interne.yml
|
||||
```
|
||||
pass_ldap_master:
|
||||
pass_mailback:
|
||||
pass_ldap_webui:
|
||||
pass_nextcloud:
|
||||
pass_gitea:
|
||||
```
|
||||
|
||||
### Templace Ferm pour les conteneurs
|
||||
|
||||
Le playbook Ansible s'occupe aussi de la mise en place d'un pare-feu. Une template a été réalisée pour la sécurisation des conteneurs avec ferm. Le détail de cette template est dans `proxmox/securisation/template_ferm.md`
|
||||
|
||||
Il vous faut mettre dans `/root/src/ferm/` les fichiers de configuration qui sont dans `sources/zone_interne`
|
||||
|
||||
Une fois que tout est fait, vous trouverez le playbook sous le nom de `ct_interne.yml` dans le dossier zone_interne.
|
||||
|
||||
Lancez le avec
|
||||
```
|
||||
ansible-playbook ct_interne.yml
|
||||
```
|
||||
|
||||
Normalement tout est prêt, vous pouvez passer à la configuration des services.
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ On alloue uniquement dmz et wan pour le moment
|
|||
|
||||
vmbr1.10 C9:64 (dmz) -> 10.0.0.{3,4}/24 GW None
|
||||
vmbr2.100 42:85 (admin)
|
||||
vmbr3 21:73 (wan) -> 10.2.0.3/24 GW 10.2.0.1
|
||||
vmbr0 vlan20 (wan) -> 10.2.0.3/24 GW 10.2.0.1
|
||||
|
||||
Attribution du sous réseau 10.2.0.0/24 au lien entre PVE et OPNSense
|
||||
PVE : 10.2.0.1
|
||||
|
|
@ -35,19 +35,15 @@ OPN : 10.2.0.3
|
|||
|
||||
Ferm nécessaire car pas d'IP publique possible sur les VM
|
||||
```
|
||||
@def $IF_OPN = lan;
|
||||
@def $IF_OPN = opnwan;
|
||||
@def $IF_EXT = vmbr0;
|
||||
@def $IF_DMZ = dmz;
|
||||
@def $IF_ADMIN = admin;
|
||||
@def $IF_ADMIN = admintask;
|
||||
|
||||
@def $IP_PUBLIQUE = 195.154.163.18;
|
||||
@def $IP_OPNSENSE = 10.2.0.3;
|
||||
@def $IP_OPNSENSE = 10.2.0.2;
|
||||
@def $NET_OPN = 10.2.0.0/24;
|
||||
|
||||
|
||||
@def $NET_INT = 10.0.2.0/24;
|
||||
@def $IP_PROXY = 10.0.1.10;
|
||||
|
||||
@def $PORTS_OPN = (80 443 8080);
|
||||
|
||||
@def &FORWARD_TCP($proto, $port, $dest) = {
|
||||
|
|
@ -74,7 +70,7 @@ table filter {
|
|||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
interface $IF_DMZ {
|
||||
interface $IF_OPN {
|
||||
outerface $IF_EXT ACCEPT;
|
||||
REJECT reject-with icmp-net-prohibited;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,51 @@
|
|||
# Zone DMZ
|
||||
|
||||
[haproxy]
|
||||
10.1.0.102 #HAProxy Alpha
|
||||
10.1.0.103 #HAProxy Beta
|
||||
|
||||
[proxyint] #Proxy Interne
|
||||
10.1.0.104
|
||||
|
||||
[dns]
|
||||
10.1.0.107 #DNS
|
||||
|
||||
[zonedmz:children]
|
||||
haproxy
|
||||
proxyint
|
||||
dmz
|
||||
|
||||
# Zone Proxy
|
||||
|
||||
[nginx]
|
||||
10.1.0.105 #Reverse Alpha
|
||||
10.1.0.106 #Reverse Beta
|
||||
|
||||
[zoneproxy:children]
|
||||
nginx
|
||||
|
||||
# Zone Interne
|
||||
|
||||
[ldap]
|
||||
10.1.0.107 #LDAP Master
|
||||
|
||||
[zoneinterne:children]
|
||||
ldap
|
||||
|
||||
# Zone Interne
|
||||
|
||||
[ldap]
|
||||
10.1.0.108 #LDAPMaster
|
||||
|
||||
[mail]
|
||||
10.1.0.109 #MailBackend
|
||||
|
||||
[webinterface]
|
||||
10.1.0.110 #LDAPUI
|
||||
10.1.0.111 #NextCloud
|
||||
10.1.0.112 #Gitea
|
||||
|
||||
[zoneinterne:children]
|
||||
ldap
|
||||
mail
|
||||
webinterface
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
- hosts: dns
|
||||
tasks:
|
||||
- name: Copy Bind configuration for DNS
|
||||
copy:
|
||||
src: /root/src/dns/bind/zones
|
||||
dest: /etc/bind
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Copy Bind configuration for DNS
|
||||
copy:
|
||||
src: /root/src/dns/bind/named.conf
|
||||
dest: /etc/bind
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Copy Bind configuration for DNS
|
||||
copy:
|
||||
src: /root/src/dns/bind/named.conf.options
|
||||
dest: /etc/bind
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Restart ferm for DNS
|
||||
systemd:
|
||||
name: "bind9"
|
||||
state: restarted
|
||||
|
|
@ -1,10 +1,13 @@
|
|||
# HAProxy et DNS
|
||||
# HAProxy, DNS et Proxy Interne
|
||||
# HAProxy Master (CT102) : 10.0.0.6 | 10.0.1.1 | 10.0.3.1 | 10.1.0.102
|
||||
# HAProxy Slave (CT103) : 10.0.0.7 | 10.0.1.2 10.0.3.2 | 10.1.0.103
|
||||
# Proxy Interne (CT104) : 10.0.0.9 | 10.0.1.252 | 10.0.2.252 | 10.0.3.252 | 10.0.4.252 | 10.1.0.104
|
||||
# DNS (CT107): 10.0.0.253 | | 10.0.1.253 | 10.0.2.253 | 10.1.0.107
|
||||
# Gateway 10.0.0.0/24 -> 10.0.0.254
|
||||
# Gateway 10.0.1.0/24 -> 10.0.1.254
|
||||
# Gateway 10.0.2.0/24 -> 10.0.3.254
|
||||
# Gateway 10.0.3.0/24 -> 10.0.3.254
|
||||
# Gateway 10.0.4.0/24 -> 10.0.3.254
|
||||
# Gateway 10.1.0.0/24 -> 10.1.0.254
|
||||
|
||||
# Créer les containers, les mets à jours, configure les mises à jours de sécurité automatique,
|
||||
|
|
@ -17,11 +20,11 @@
|
|||
- include_vars: /root/src/source_pve.yml
|
||||
- include_vars: /root/src/password_dmz.yml
|
||||
|
||||
- name: Create LXC for HAProxy Master (CT101)
|
||||
- name: Create LXC for HAProxy Master (CT102)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
|
|
@ -35,16 +38,16 @@
|
|||
vmid: 102
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.0.253'
|
||||
nameserver: '10.0.0.253 80.67.169.12'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.0.6/24,gw=10.0.0.254,bridge=vmbr1,tag=10","net1":"name=eth1,ip=10.0.1.1/24,gw=10.0.1.254,bridge=vmbr1,tag=20","net2":"name=eth2,ip=10.0.3.1/24,gw=10.0.3.254,bridge=vmbr1,tag=40","net3":"name=eth3,ip=10.1.0.102/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for HAProxy Slave (CT102)
|
||||
- name: Create LXC for HAProxy Slave (CT103)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
node: beta
|
||||
cpus: 1
|
||||
cores: 2
|
||||
|
|
@ -58,16 +61,16 @@
|
|||
vmid: 103
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.0.253'
|
||||
nameserver: '10.0.0.253 80.67.169.12'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.0.7/24,gw=10.0.0.254,bridge=vmbr1,tag=10","net1":"name=eth1,ip=10.0.1.2/24,gw=10.0.1.254,bridge=vmbr1,tag=20","net2":"name=eth2,ip=10.0.3.2/24,gw=10.0.3.254,bridge=vmbr1,tag=40","net3":"name=eth3,ip=10.1.0.103/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for Bind9 (CT106)
|
||||
- name: Create LXC for Bind9 (CT107)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
node: beta
|
||||
cpus: 1
|
||||
cores: 1
|
||||
|
|
@ -90,12 +93,13 @@
|
|||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
vmid: "{{ item }}"
|
||||
state: started
|
||||
with_items:
|
||||
- '102'
|
||||
- '103'
|
||||
- '104'
|
||||
- '107'
|
||||
|
||||
# Pas de config des proxy car sur accès au net depuis la DMZ.
|
||||
|
|
@ -136,6 +140,7 @@
|
|||
|
||||
- hosts: haproxy
|
||||
tasks:
|
||||
- include_vars: /root/src/password_dmz.yml
|
||||
- name: Install requirement for HAProxy
|
||||
apt:
|
||||
pkg:
|
||||
|
|
@ -147,7 +152,7 @@
|
|||
- keepalived
|
||||
|
||||
- name: Create hasync for HAProxy
|
||||
user:
|
||||
user:
|
||||
name: hasync
|
||||
password: "{{ pass_hasync_same }}"
|
||||
state: present
|
||||
|
|
@ -237,15 +242,6 @@
|
|||
with_items:
|
||||
- 'bind9'
|
||||
|
||||
- name: Prepare NGINX for Bind9
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- '/etc/nginx/sites-enabled/default'
|
||||
- '/etc/nginx/sites-available/default'
|
||||
- '/etc/letsencrypt/live/README'
|
||||
|
||||
- name: Prepare Bind9
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
|
|
@ -277,3 +273,27 @@
|
|||
systemd:
|
||||
name: "ferm"
|
||||
state: restarted
|
||||
|
||||
|
||||
- hosts: proxyint
|
||||
tasks:
|
||||
- name: Enable service for Proxy
|
||||
systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: yes
|
||||
with_items:
|
||||
- 'apt-cacher-ng'
|
||||
- 'squid'
|
||||
|
||||
- name: Copy ferm configuration for Proxy
|
||||
copy:
|
||||
src: /root/src/ferm/proxyint_ferm.conf
|
||||
dest: /etc/ferm/ferm.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Restart ferm for Proxy
|
||||
systemd:
|
||||
name: "ferm"
|
||||
state: restarted
|
||||
|
|
|
|||
|
|
@ -0,0 +1,49 @@
|
|||
include "/etc/bind/named.conf.options";
|
||||
|
||||
acl front {
|
||||
127.0.0.1;
|
||||
10.0.0.0/24;
|
||||
};
|
||||
acl back {
|
||||
10.0.1.0/24;
|
||||
10.0.2.0/24;
|
||||
};
|
||||
|
||||
view "internalfront" {
|
||||
recursion yes;
|
||||
match-clients {front;};
|
||||
allow-query {front;};
|
||||
allow-recursion {front;};
|
||||
allow-query-cache {front;};
|
||||
include "/etc/bind/named.conf.default-zones";
|
||||
include "/etc/bind/zones.rfc1918";
|
||||
zone "krhacken.org" {
|
||||
notify no;
|
||||
type master;
|
||||
file "/etc/bind/zones/db.krhacken.org.front";
|
||||
};
|
||||
zone "1.0.10.in-addr.arpa" {
|
||||
notify no;
|
||||
type master;
|
||||
file "/etc/bind/zones/db.krhacken.org.intrafront.rev";
|
||||
};
|
||||
};
|
||||
view "internalback" {
|
||||
recursion yes;
|
||||
match-clients {back;};
|
||||
allow-query {back;};
|
||||
allow-recursion {back;};
|
||||
allow-query-cache {back;};
|
||||
include "/etc/bind/named.conf.default-zones";
|
||||
include "/etc/bind/zones.rfc1918";
|
||||
zone "krhacken.org" {
|
||||
notify no;
|
||||
type master;
|
||||
file "/etc/bind/zones/db.krhacken.org.back";
|
||||
};
|
||||
zone "1.1.10.in-addr.arpa" {
|
||||
notify no;
|
||||
type master;
|
||||
file "/etc/bind/zones/db.krhacken.org.intraback.rev";
|
||||
};
|
||||
};
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
options {
|
||||
directory "/var/cache/bind";
|
||||
dnssec-validation auto;
|
||||
auth-nxdomain no;
|
||||
listen-on { any;};
|
||||
version "V1.0";
|
||||
forwarders {
|
||||
80.67.169.12;
|
||||
80.67.169.40;
|
||||
};
|
||||
forward only;
|
||||
};
|
||||
logging {
|
||||
channel query_log {
|
||||
file "/var/log/dns/query.log";
|
||||
severity debug 10;
|
||||
print-category yes;
|
||||
print-time yes;
|
||||
print-severity yes;
|
||||
};
|
||||
channel error_log {
|
||||
file "/var/log/dns/error.log";
|
||||
severity error;
|
||||
print-category yes;
|
||||
print-time yes;
|
||||
print-severity yes;
|
||||
};
|
||||
category queries { query_log;};
|
||||
category security { error_log;};
|
||||
};
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
$TTL 10800
|
||||
@ IN SOA dns.krhacken.org. (
|
||||
2015010101 ; Serial
|
||||
5400 ; Refresh
|
||||
2700 ; Retry
|
||||
2419200 ; Expire
|
||||
300 ) ; Negative TTL
|
||||
IN NS dns.krhacken.org. ;Nom du serveur
|
||||
alpha.haproxy IN A 10.0.1.1
|
||||
beta.haproxy IN A 10.0.1.2
|
||||
alpha.ldap IN A 10.0.2.1
|
||||
beta.ldap IN A 10.0.2.2
|
||||
vip.ldap IN A 10.0.2.3
|
||||
alpha.nginx IN A 10.0.2.4
|
||||
beta.nginx IN A 10.0.2.5
|
||||
dns IN A 10.0.2.253
|
||||
proxyint IN A 10.0.2.254
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
$TTL 10800
|
||||
@ IN SOA dns.krhacken.org. (
|
||||
2015010101 ; Serial
|
||||
5400 ; Refresh
|
||||
2700 ; Retry
|
||||
2419200 ; Expire
|
||||
300 ) ; Negative TTL
|
||||
IN NS dns.krhacken.org. ;Nom du serveur
|
||||
alpha.fw IN A 10.0.0.1
|
||||
beta.fw IN A 10.0.0.2
|
||||
vip.fw IN A 10.0.0.3
|
||||
alpha.haproxy IN A 10.0.0.4
|
||||
beta.haproxy IN A 10.0.0.5
|
||||
vip.haproxy IN A 10.0.0.6
|
||||
proxyint IN A 10.0.0.7
|
||||
mail IN A 10.0.0.10
|
||||
dns IN A 10.0.0.253
|
||||
alpha.nginx IN A 10.0.1.3
|
||||
beta.nginx IN A 10.0.1.4
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
REV
|
||||
$TTL 10800
|
||||
@ IN SOA dns.krhacken.org. (
|
||||
2015021102 ; Serial
|
||||
5400 ; Refresh
|
||||
2700 ; Retry
|
||||
2419200 ; Expire
|
||||
300 ) ; Negative TTL
|
||||
@ IN NS dns.krhacken.org.
|
||||
253 IN PTR dns.krhacken.org.
|
||||
1 IN PTR alpha.haproxy.krhacken.org.
|
||||
2 IN PTR beta.haproxy.krhacken.org.
|
||||
1 IN PTR alpha.ldap.krhacken.org.
|
||||
2 IN PTR beta.ldap.krhacken.org.
|
||||
3 IN PTR vip.ldap.krhacken.org.
|
||||
4 IN PTR alpha.nginx.krhacken.org.
|
||||
5 IN PTR beta.nginx.krhacken.org.
|
||||
254 IN PTR proxyint.krhacken.org.
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
REV
|
||||
$TTL 10800
|
||||
@ IN SOA dns.krhacken.org. (
|
||||
2015021102 ; Serial
|
||||
5400 ; Refresh
|
||||
2700 ; Retry
|
||||
2419200 ; Expire
|
||||
300 ) ; Negative TTL
|
||||
@ IN NS dns.krhacken.org.
|
||||
253 IN PTR dns.krhacken.org.
|
||||
1 IN PTR alpha.fw.krhacken.org.
|
||||
2 IN PTR beta.fw.krhacken.org.
|
||||
3 IN PTR vip.fw.krhacken.org.
|
||||
4 IN PTR alpha.haproxy.krhacken.org.
|
||||
5 IN PTR beta.haproxy.krhacken.org.
|
||||
6 IN PTR vip.haproxy.krhacken.org.
|
||||
7 IN PTR proxyint.krhacken.org.
|
||||
10 IN PTR mail.krhacken.org.
|
||||
3 IN PTR alpha.nginx.krhacken.org.
|
||||
4 IN PTR beta.nginx.krhacken.org.
|
||||
|
|
@ -13,10 +13,10 @@
|
|||
@def $UDP_OPEN_PORT_FRONT_REQUEST = (53);
|
||||
|
||||
# Depuis l'intérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = ();
|
||||
@def $NEED_UDP_FRONT_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = ();
|
||||
@def $HAVE_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (53);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = (53);
|
||||
|
||||
|
||||
# Depuis l'extérieur sur les interfaces secondaires
|
||||
|
|
@ -84,7 +84,7 @@ table filter {
|
|||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
|
|
|
|||
|
|
@ -14,8 +14,8 @@
|
|||
|
||||
# Depuis l'intérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (22 80 443 8006);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (22 80 443 8006 53);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = (53);
|
||||
|
||||
|
||||
|
|
@ -84,7 +84,7 @@ table filter {
|
|||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,102 @@
|
|||
@def $IF_ADMIN = eth5;
|
||||
@def $IF_FRONT = eth0;
|
||||
@def $IF_BACK = (eth1 eth2 eth3 eth4);
|
||||
|
||||
|
||||
# REQUEST : EXT -> INT | ACCESS : INT -> EXT
|
||||
|
||||
|
||||
# Depuis l'extérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_REQUEST = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_REQUEST = (3128 9999);
|
||||
@def $NEED_UDP_FRONT_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (10:65535);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = (53);
|
||||
|
||||
|
||||
# Depuis l'extérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_REQUEST = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_REQUEST = (3128 9999);
|
||||
@def $NEED_UDP_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_ACCESS = ();
|
||||
@def $NEED_UDP_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_ACCESS = ();
|
||||
|
||||
|
||||
# Besoin de VRRP sur IF_VRRP
|
||||
@def $NEED_VRRP = 0; #0 pour NON 1 pour OUI
|
||||
@def $IF_VRRP = eth0;
|
||||
|
||||
table filter {
|
||||
chain INPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
interface lo ACCEPT;
|
||||
interface $IF_ADMIN ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_VRRP {
|
||||
interface $IF_VRRP proto vrrp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
@if $HAVE_BACK_REQUEST {
|
||||
interface $IF_BACK proto tcp dport $OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_REQUEST {
|
||||
interface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
proto icmp icmp-type echo-request ACCEPT;
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
outerface lo ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto tcp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_VRRP {
|
||||
outerface $IF_VRRP proto vrrp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
outerface $IF_BACK proto tcp dport $OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
proto icmp ACCEPT;
|
||||
}
|
||||
|
||||
chain FORWARD policy DROP;
|
||||
}
|
||||
|
|
@ -0,0 +1,253 @@
|
|||
# Zone Interne
|
||||
# LDAP Master (CT108) : 10.0.2.1 | 10.1.0.108
|
||||
# Mail Backend (CT109) : 10.0.2.10 | 10.1.0.109
|
||||
# LDAP WebUI (CT110) : 10.0.2.15 | 10.1.0.110
|
||||
# NextCloud (CT111) : 10.0.2.20 | 10.1.0.111
|
||||
# Gitea (CT112) : 10.0.2.21 | 10.1.0.112
|
||||
# Gateway 10.0.2.0/24 -> 10.0.2.254
|
||||
# Gateway 10.1.0.0/24 -> 10.1.0.254
|
||||
|
||||
# Créer les conteneurs, les mets à jours, configure les mises à jours de sécurité automatique,
|
||||
# installe des paquets utile et ceux des services, met en place ferm via notre template.
|
||||
|
||||
|
||||
- hosts: localhost
|
||||
connection: local
|
||||
gather_facts: no
|
||||
tasks:
|
||||
- include_vars: /root/src/source_pve.yml
|
||||
- include_vars: /root/src/password_interne.yml
|
||||
|
||||
- name: Create LXC for LDAP Master (CT108)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
memory: 2048
|
||||
disk: 16
|
||||
swap: 1024
|
||||
storage: local-zfs
|
||||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_ldap_master }}"
|
||||
hostname: LDAPMaster
|
||||
vmid: 108
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.2.253'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.2.1/24,gw=10.0.2.254,bridge=vmbr1,tag=30","net1":"name=eth1,ip=10.1.0.108/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for Mail Backend (CT109)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
memory: 2048
|
||||
disk: 64
|
||||
swap: 1024
|
||||
storage: local-zfs
|
||||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_mailback }}"
|
||||
hostname: MailBackend
|
||||
vmid: 109
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.2.253'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.2.10/24,gw=10.0.2.254,bridge=vmbr1,tag=30","net1":"name=eth1,ip=10.1.0.109/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for LDAP Web UI (CT110)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
memory: 1024
|
||||
disk: 16
|
||||
swap: 1024
|
||||
storage: local-zfs
|
||||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_ldap_webui }}"
|
||||
hostname: LDAPUI
|
||||
vmid: 110
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.2.253'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.2.15/24,gw=10.0.2.254,bridge=vmbr1,tag=30","net1":"name=eth1,ip=10.1.0.110/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for NextCloud (CT110)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
memory: 2048
|
||||
disk: 16
|
||||
swap: 1024
|
||||
storage: local-zfs
|
||||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_nextcloud }}"
|
||||
hostname: NextCloud
|
||||
vmid: 111
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.2.253'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.2.20/24,gw=10.0.2.254,bridge=vmbr1,tag=30","net1":"name=eth1,ip=10.1.0.111/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for Gitea (CT111)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
memory: 2048
|
||||
disk: 16
|
||||
swap: 1024
|
||||
storage: local-zfs
|
||||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_gitea }}"
|
||||
hostname: Gitea
|
||||
vmid: 112
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.2.253'
|
||||
netif: '{"net0":"name=eth0,ip=10.0.2.21/24,gw=10.0.2.254,bridge=vmbr1,tag=30","net1":"name=eth1,ip=10.1.0.112/24,gw=10.1.0.254,bridge=vmbr2,tag=100"}'
|
||||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
|
||||
- name: Start Interne container
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.4'
|
||||
vmid: "{{ item }}"
|
||||
state: started
|
||||
with_items:
|
||||
- '108'
|
||||
- '109'
|
||||
- '110'
|
||||
- '111'
|
||||
- '112'
|
||||
|
||||
- hosts: zoneinterne
|
||||
tasks:
|
||||
- name: Set timezone for Interne
|
||||
timezone:
|
||||
name: Europe/Paris
|
||||
|
||||
- name: APT configuration for Interne
|
||||
copy:
|
||||
dest: "/etc/apt/apt.conf.d/01proxy"
|
||||
content: |
|
||||
Acquire::http {
|
||||
Proxy "http://10.0.2.252:9999";
|
||||
};
|
||||
|
||||
- name: WGET configuration for Interne
|
||||
copy:
|
||||
dest: "/root/.wgetrc"
|
||||
content: |
|
||||
http_proxy = http://10.0.2.252:3128/
|
||||
https_proxy = http://10.0.2.252:3128/
|
||||
use_proxy = on
|
||||
|
||||
- name: Apt Update for Interne
|
||||
apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Apt Upgrade for Interne
|
||||
apt:
|
||||
upgrade: dist
|
||||
|
||||
- name: Install utils for Interne
|
||||
apt:
|
||||
pkg:
|
||||
- vim
|
||||
- net-tools
|
||||
- nmap
|
||||
- dnsutils
|
||||
- ferm
|
||||
- unattended-upgrades
|
||||
- apt-listchanges
|
||||
- wget
|
||||
- curl
|
||||
- git
|
||||
|
||||
- name: Unattended-Upgrades Activation for Interne
|
||||
shell: |
|
||||
echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true | debconf-set-selections
|
||||
dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||
echo 'Unattended-Upgrade::Mail "root";' >> /etc/apt/apt.conf.d/50unattended-upgrades
|
||||
|
||||
- hosts: ldap
|
||||
tasks:
|
||||
- name: Install requirement for LDAP
|
||||
apt:
|
||||
pkg:
|
||||
- slapd
|
||||
- ldap-utils
|
||||
- gnutls-bin
|
||||
- ssl-cert
|
||||
|
||||
- name: Copy ferm configuration for LDAP
|
||||
copy:
|
||||
src: /root/src/ferm/ldap_ferm.conf
|
||||
dest: /etc/ferm/ferm.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Restart ferm for LDAP
|
||||
systemd:
|
||||
name: "ferm"
|
||||
state: restarted
|
||||
|
||||
|
||||
- hosts: webinterface
|
||||
tasks:
|
||||
- name: Copy ferm configuration for Web
|
||||
copy:
|
||||
src: /root/src/ferm/webinterface_ferm.conf
|
||||
dest: /etc/ferm/ferm.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Restart ferm for Web
|
||||
systemd:
|
||||
name: "ferm"
|
||||
state: restarted
|
||||
|
||||
- hosts: mail
|
||||
tasks:
|
||||
- name: Copy ferm configuration for Mail
|
||||
copy:
|
||||
src: /root/src/ferm/mail_ferm.conf
|
||||
dest: /etc/ferm/ferm.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: Restart ferm for Mail
|
||||
systemd:
|
||||
name: "ferm"
|
||||
state: restarted
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
@def $IF_ADMIN = eth2;
|
||||
@def $IF_FRONT = eth0;
|
||||
@def $IF_BACK = ();
|
||||
|
||||
|
||||
# REQUEST : EXT -> INT | ACCESS : INT -> EXT
|
||||
|
||||
|
||||
# Depuis l'extérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_REQUEST = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_REQUEST = (389);
|
||||
@def $NEED_UDP_FRONT_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (53);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = (53);
|
||||
|
||||
|
||||
# Depuis l'extérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_REQUEST = ();
|
||||
@def $NEED_UDP_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_ACCESS = (80);
|
||||
@def $NEED_UDP_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_ACCESS = ();
|
||||
|
||||
|
||||
table filter {
|
||||
chain INPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
interface lo ACCEPT;
|
||||
interface $IF_ADMIN ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
@if $HAVE_BACK_REQUEST {
|
||||
interface $IF_BACK proto tcp dport $OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_REQUEST {
|
||||
interface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
proto icmp icmp-type echo-request ACCEPT;
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
outerface lo ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
outerface $IF_BACK proto tcp dport $OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
proto icmp ACCEPT;
|
||||
}
|
||||
|
||||
chain FORWARD policy DROP;
|
||||
}
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
@def $IF_ADMIN = eth1;
|
||||
@def $IF_FRONT = eth0;
|
||||
@def $IF_BACK = ();
|
||||
|
||||
# REQUEST : EXT -> INT | ACCESS : INT -> EXT
|
||||
|
||||
# Depuis l'extérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_REQUEST = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_REQUEST = (25 465 587 143 993 4190);
|
||||
@def $NEED_UDP_FRONT_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (53);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = (53);
|
||||
|
||||
|
||||
# Depuis l'extérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_REQUEST = ();
|
||||
@def $NEED_UDP_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_ACCESS = ();
|
||||
@def $NEED_UDP_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_ACCESS = ();
|
||||
|
||||
# Besoin de VRRP sur IF_VRRP
|
||||
@def $NEED_VRRP = 0; #0 pour NON 1 pour OUI
|
||||
@def $IF_VRRP = eth0;
|
||||
|
||||
table filter {
|
||||
chain INPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
interface lo ACCEPT;
|
||||
interface $IF_ADMIN ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_VRRP {
|
||||
interface $IF_VRRP proto vrrp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
@if $HAVE_BACK_REQUEST {
|
||||
interface $IF_BACK proto tcp dport $OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_REQUEST {
|
||||
interface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
proto icmp icmp-type echo-request ACCEPT;
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
outerface lo ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_VRRP {
|
||||
outerface $IF_VRRP proto vrrp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
outerface $IF_BACK proto tcp dport $OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
proto icmp ACCEPT;
|
||||
}
|
||||
|
||||
chain FORWARD policy DROP;
|
||||
}
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
@def $IF_ADMIN = eth1;
|
||||
@def $IF_FRONT = eth0;
|
||||
@def $IF_BACK = ();
|
||||
|
||||
# REQUEST : EXT -> INT | ACCESS : INT -> EXT
|
||||
|
||||
# Depuis l'extérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_REQUEST = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_REQUEST = (80);
|
||||
@def $NEED_UDP_FRONT_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur l'interface principale
|
||||
@def $HAVE_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_FRONT_ACCESS = (53);
|
||||
@def $NEED_UDP_FRONT_ACCESS = 1; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_FRONT_ACCESS = (53);
|
||||
|
||||
|
||||
# Depuis l'extérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_REQUEST = ();
|
||||
@def $NEED_UDP_BACK_REQUEST = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_REQUEST = ();
|
||||
|
||||
# Depuis l'intérieur sur les interfaces secondaires
|
||||
@def $HAVE_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $OPEN_PORT_BACK_ACCESS = ();
|
||||
@def $NEED_UDP_BACK_ACCESS = 0; #0 pour NON 1 pour OUI
|
||||
@def $UDP_OPEN_PORT_BACK_ACCESS = ();
|
||||
|
||||
# Besoin de VRRP sur IF_VRRP
|
||||
@def $NEED_VRRP = 0; #0 pour NON 1 pour OUI
|
||||
@def $IF_VRRP = eth0;
|
||||
|
||||
table filter {
|
||||
chain INPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
interface lo ACCEPT;
|
||||
interface $IF_ADMIN ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_VRRP {
|
||||
interface $IF_VRRP proto vrrp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_REQUEST {
|
||||
interface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
@if $HAVE_BACK_REQUEST {
|
||||
interface $IF_BACK proto tcp dport $OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_REQUEST {
|
||||
interface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_REQUEST ACCEPT;
|
||||
}
|
||||
|
||||
|
||||
proto icmp icmp-type echo-request ACCEPT;
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
policy DROP;
|
||||
mod state state INVALID DROP;
|
||||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
outerface lo ACCEPT;
|
||||
|
||||
@if $HAVE_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_VRRP {
|
||||
outerface $IF_VRRP proto vrrp ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
outerface $IF_BACK proto tcp dport $OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_BACK_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_BACK_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
proto icmp ACCEPT;
|
||||
}
|
||||
|
||||
chain FORWARD policy DROP;
|
||||
}
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
# NGINX REVERSE
|
||||
# Nginx Alpha (CT105) : 10.0.1.3 | 10.0.2.4 | 10.1.0.105
|
||||
# Nginx Beta (CT106) : 10.0.1.4 | 10.0.2.5 | 10.1.0.106
|
||||
# Nginx Alpha (CT105) : 10.0.1.3 | 10.0.2.4 | 10.1.0.405
|
||||
# Nginx Beta (CT106) : 10.0.1.4 | 10.0.2.5 | 10.1.0.406
|
||||
# Gateway 10.0.1.0/24 -> 10.0.1.254
|
||||
# Gateway 10.0.2.0/24 -> 10.0.2.254
|
||||
# Gateway 10.1.0.0/24 -> 10.1.0.254
|
||||
|
|
@ -15,11 +15,11 @@
|
|||
- include_vars: /root/src/source_pve.yml
|
||||
- include_vars: /root/src/password_proxy.yml
|
||||
|
||||
- name: Create LXC for Nginx Master (CT104)
|
||||
- name: Create LXC for Nginx Master (CT105)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
node: alpha
|
||||
cpus: 1
|
||||
cores: 2
|
||||
|
|
@ -28,9 +28,9 @@
|
|||
swap: 1024
|
||||
storage: local-zfs
|
||||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_nginx_alpha }}"
|
||||
password: "{{ pass_nginx_master }}"
|
||||
hostname: NginxMaster
|
||||
vmid: 104
|
||||
vmid: 105
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.1.253'
|
||||
|
|
@ -38,11 +38,11 @@
|
|||
pubkey: "{{ ssh_pub }}"
|
||||
state: present
|
||||
|
||||
- name: Create LXC for Nginx Slave (CT105)
|
||||
- name: Create LXC for Nginx Slave (CT106)
|
||||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
node: beta
|
||||
cpus: 1
|
||||
cores: 2
|
||||
|
|
@ -53,7 +53,7 @@
|
|||
ostemplate: 'local:vztmpl/debian-10.0-standard_10.0-1_amd64.tar.gz'
|
||||
password: "{{ pass_nginx_slave }}"
|
||||
hostname: NginxSlave
|
||||
vmid: 105
|
||||
vmid: 106
|
||||
onboot: yes
|
||||
unprivileged: yes
|
||||
nameserver: '10.0.1.253'
|
||||
|
|
@ -65,12 +65,12 @@
|
|||
proxmox:
|
||||
api_user: root@pam
|
||||
api_password: "{{ pass_pve }}"
|
||||
api_host: '10.1.0.1'
|
||||
api_host: '10.1.0.4'
|
||||
vmid: "{{ item }}"
|
||||
state: started
|
||||
with_items:
|
||||
- '104'
|
||||
- '105'
|
||||
- '106'
|
||||
|
||||
- hosts: zoneproxy
|
||||
tasks:
|
||||
|
|
|
|||
|
|
@ -67,12 +67,12 @@ table filter {
|
|||
mod state state (ESTABLISHED RELATED) ACCEPT;
|
||||
outerface lo ACCEPT;
|
||||
|
||||
@if $_FRONT_ACCESS {
|
||||
@if $HAVE_FRONT_ACCESS {
|
||||
outerface $IF_FRONT proto tcp dport $OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $NEED_UDP_FRONT_ACCESS {
|
||||
outerface $IF_BACK proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
outerface $IF_FRONT proto udp dport $UDP_OPEN_PORT_FRONT_ACCESS ACCEPT;
|
||||
}
|
||||
|
||||
@if $HAVE_BACK_ACCESS {
|
||||
|
|
|
|||
Loading…
Reference in New Issue