From 660aee91fa341b36abaffa94f6c5a62023933c54 Mon Sep 17 00:00:00 2001 From: Daniel Allaire Date: Sat, 4 Jul 2026 21:15:00 -0400 Subject: [PATCH] =?UTF-8?q?Z=C3=A9ro-confiance=20:=20flux=20Logs=20chiffr?= =?UTF-8?q?=C3=A9=20(Loki=20HTTPS=20+=20Alloy=20push=20https)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Loki sert son API en HTTPS via le cert step-ca (http_tls_config + cert-sync owned loki, motif .path). Alloy pousse en https + tls_config (ca=root_ca). Vars : serveur_loki_tls_actif, client_journal_loki_tls. Prouvé : Loki HTTPS /ready 200 (vérif root_ca), HTTP rejeté (400), 4 hôtes expédient des logs en https, 0 erreur loki.write après la transition. Co-Authored-By: Claude Opus 4.8 --- roles/client_journal/defaults/main.yml | 4 + .../client_journal/templates/config.alloy.j2 | 5 ++ roles/serveur_loki/defaults/main.yml | 6 ++ roles/serveur_loki/tasks/main.yml | 73 +++++++++++++++++++ roles/serveur_loki/templates/config.yml.j2 | 5 ++ .../templates/setops-loki-cert-sync.path.j2 | 10 +++ .../setops-loki-cert-sync.service.j2 | 7 ++ .../templates/setops-loki-cert-sync.sh.j2 | 16 ++++ 8 files changed, 126 insertions(+) create mode 100644 roles/serveur_loki/templates/setops-loki-cert-sync.path.j2 create mode 100644 roles/serveur_loki/templates/setops-loki-cert-sync.service.j2 create mode 100644 roles/serveur_loki/templates/setops-loki-cert-sync.sh.j2 diff --git a/roles/client_journal/defaults/main.yml b/roles/client_journal/defaults/main.yml index 1727abd..8ee303c 100644 --- a/roles/client_journal/defaults/main.yml +++ b/roles/client_journal/defaults/main.yml @@ -13,3 +13,7 @@ client_journal_loki_url: "http://10.0.14.11:3100/loki/api/v1/push" client_journal_depot_cle_url: "https://apt.grafana.com/gpg-full.key" client_journal_depot_cle_fichier: "/etc/apt/keyrings/grafana.asc" client_journal_depot_source: "deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main" + +# --- TLS (zero-confiance) : Alloy pousse vers Loki en https + verifie root_ca --- +client_journal_loki_tls: false +client_journal_loki_ca: "/etc/step/certs/root_ca.crt" diff --git a/roles/client_journal/templates/config.alloy.j2 b/roles/client_journal/templates/config.alloy.j2 index f1c7450..8b0eebb 100644 --- a/roles/client_journal/templates/config.alloy.j2 +++ b/roles/client_journal/templates/config.alloy.j2 @@ -3,6 +3,11 @@ loki.write "loki" { endpoint { url = "{{ client_journal_loki_url }}" +{% if client_journal_loki_tls | default(false) %} + tls_config { + ca_file = "{{ client_journal_loki_ca }}" + } +{% endif %} } } diff --git a/roles/serveur_loki/defaults/main.yml b/roles/serveur_loki/defaults/main.yml index 32ce9ba..1c47b17 100644 --- a/roles/serveur_loki/defaults/main.yml +++ b/roles/serveur_loki/defaults/main.yml @@ -12,3 +12,9 @@ serveur_loki_retention: "744h" # 31 jours serveur_loki_depot_cle_url: "https://apt.grafana.com/gpg-full.key" serveur_loki_depot_cle_fichier: "/etc/apt/keyrings/grafana.asc" serveur_loki_depot_source: "deb [signed-by=/etc/apt/keyrings/grafana.asc] https://apt.grafana.com stable main" + +# --- TLS (zero-confiance) : Loki sert son API HTTP en HTTPS (cert step_ca) --- +serveur_loki_tls_actif: false +serveur_loki_tls_dir: "/etc/loki/tls" +serveur_loki_tls_source_cert: "/etc/step/certs/{{ ansible_fqdn | default(ansible_hostname) }}.crt" +serveur_loki_tls_source_cle: "/etc/step/certs/{{ ansible_fqdn | default(ansible_hostname) }}.key" diff --git a/roles/serveur_loki/tasks/main.yml b/roles/serveur_loki/tasks/main.yml index 889d251..d01c8ba 100644 --- a/roles/serveur_loki/tasks/main.yml +++ b/roles/serveur_loki/tasks/main.yml @@ -45,6 +45,79 @@ group: loki mode: "0750" +# --- TLS : synchroniser le cert step_ca AVANT d'activer http_tls_config --- +- name: TLS — repertoire des certificats (loki) + ansible.builtin.file: + path: "{{ serveur_loki_tls_dir }}" + state: directory + owner: loki + group: loki + mode: "0700" + when: serveur_loki_tls_actif | bool + +- name: TLS — script de synchronisation du certificat + ansible.builtin.template: + src: setops-loki-cert-sync.sh.j2 + dest: /usr/local/sbin/setops-loki-cert-sync + owner: root + group: root + mode: "0755" + when: serveur_loki_tls_actif | bool + +- name: TLS — unites de synchronisation (service + path) + ansible.builtin.template: + src: "{{ item.s }}" + dest: "{{ item.d }}" + owner: root + group: root + mode: "0644" + loop: + - { s: "setops-loki-cert-sync.service.j2", d: "/etc/systemd/system/setops-loki-cert-sync.service" } + - { s: "setops-loki-cert-sync.path.j2", d: "/etc/systemd/system/setops-loki-cert-sync.path" } + loop_control: + label: "{{ item.d | basename }}" + when: serveur_loki_tls_actif | bool + +- name: TLS — activer la surveillance du certificat (path) + ansible.builtin.systemd: + name: setops-loki-cert-sync.path + enabled: true + state: started + daemon_reload: true + when: + - serveur_loki_tls_actif | bool + - not ansible_check_mode + +- name: TLS — synchroniser le certificat maintenant + ansible.builtin.command: /usr/local/sbin/setops-loki-cert-sync + changed_when: false + when: + - serveur_loki_tls_actif | bool + - not ansible_check_mode + +- name: TLS — verifier la presence du certificat synchronise + ansible.builtin.stat: + path: "{{ serveur_loki_tls_dir }}/{{ item }}" + register: serveur_loki_tls_stat + loop: + - loki.crt + - loki.key + when: + - serveur_loki_tls_actif | bool + - not ansible_check_mode + +- name: TLS — garde-fou, ne pas activer sans certificat en place + ansible.builtin.assert: + that: + - item.stat.exists + fail_msg: "Cert Loki absent ({{ item.item }}) — TLS non active." + loop: "{{ serveur_loki_tls_stat.results | default([]) }}" + loop_control: + label: "{{ item.item }}" + when: + - serveur_loki_tls_actif | bool + - not ansible_check_mode + - name: Deployer la configuration Loki ansible.builtin.template: src: config.yml.j2 diff --git a/roles/serveur_loki/templates/config.yml.j2 b/roles/serveur_loki/templates/config.yml.j2 index eb62be7..0aba418 100644 --- a/roles/serveur_loki/templates/config.yml.j2 +++ b/roles/serveur_loki/templates/config.yml.j2 @@ -4,6 +4,11 @@ auth_enabled: false server: http_listen_port: {{ serveur_loki_port }} grpc_listen_port: 9096 +{% if serveur_loki_tls_actif | default(false) %} + http_tls_config: + cert_file: {{ serveur_loki_tls_dir }}/loki.crt + key_file: {{ serveur_loki_tls_dir }}/loki.key +{% endif %} common: path_prefix: {{ serveur_loki_chemin }} diff --git a/roles/serveur_loki/templates/setops-loki-cert-sync.path.j2 b/roles/serveur_loki/templates/setops-loki-cert-sync.path.j2 new file mode 100644 index 0000000..58cac87 --- /dev/null +++ b/roles/serveur_loki/templates/setops-loki-cert-sync.path.j2 @@ -0,0 +1,10 @@ +# Gere par Set-OPS (role serveur_loki). Ne pas editer a la main. +[Unit] +Description=Set-OPS — surveille le certificat step_ca de Loki + +[Path] +PathChanged={{ serveur_loki_tls_source_cert }} +Unit=setops-loki-cert-sync.service + +[Install] +WantedBy=multi-user.target diff --git a/roles/serveur_loki/templates/setops-loki-cert-sync.service.j2 b/roles/serveur_loki/templates/setops-loki-cert-sync.service.j2 new file mode 100644 index 0000000..a98609e --- /dev/null +++ b/roles/serveur_loki/templates/setops-loki-cert-sync.service.j2 @@ -0,0 +1,7 @@ +# Gere par Set-OPS (role serveur_loki). Ne pas editer a la main. +[Unit] +Description=Set-OPS — synchronise le certificat step_ca vers Loki + +[Service] +Type=oneshot +ExecStart=/usr/local/sbin/setops-loki-cert-sync diff --git a/roles/serveur_loki/templates/setops-loki-cert-sync.sh.j2 b/roles/serveur_loki/templates/setops-loki-cert-sync.sh.j2 new file mode 100644 index 0000000..777f3dc --- /dev/null +++ b/roles/serveur_loki/templates/setops-loki-cert-sync.sh.j2 @@ -0,0 +1,16 @@ +#!/bin/sh +# Gere par Set-OPS (role serveur_loki). Ne pas editer a la main. +# Synchronise le cert step_ca (client_pki, root:root) vers un emplacement lisible +# par 'loki'. Cle en 0600. Idempotent ; appele au deploiement ET au renouvellement. +set -eu + +SRC_CERT="{{ serveur_loki_tls_source_cert }}" +SRC_KEY="{{ serveur_loki_tls_source_cle }}" +DST="{{ serveur_loki_tls_dir }}" + +[ -f "$SRC_CERT" ] && [ -f "$SRC_KEY" ] || exit 0 + +install -o loki -g loki -m 0644 "$SRC_CERT" "$DST/loki.crt" +install -o loki -g loki -m 0600 "$SRC_KEY" "$DST/loki.key" + +systemctl try-reload-or-restart {{ serveur_loki_service }} 2>/dev/null || true