Daniel Allaire
3fe7e3cea3
Le frontal derive ses vhosts des expositions publiques (meme derivation que l edge), filtre par ModSecurity v3 + OWASP CRS (DetectionOnly d abord, eprouve), refuse les noms inconnus, et ne sert plus rien lui-meme. Les sites statiques passent au dorsal, relaye par l edge et par le frontal. Sondes : frontal (nouvelle), sites-servis suit le dorsal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
115 lines
3.6 KiB
YAML
115 lines
3.6 KiB
YAML
---
|
|
# serveur_web_frontal — reverse proxy + WAF des services web PUBLICS. Voir defaults/main.yml.
|
|
- name: Installer nginx, ModSecurity et l'OWASP CRS
|
|
ansible.builtin.apt:
|
|
name: "{{ serveur_web_frontal_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Retirer le vhost nginx par defaut de Debian
|
|
ansible.builtin.file:
|
|
path: /etc/nginx/sites-enabled/default
|
|
state: absent
|
|
notify: Recharger nginx serveur_web_frontal
|
|
|
|
- name: Deployer le durcissement de base nginx
|
|
ansible.builtin.template:
|
|
src: durcissement.conf.j2
|
|
dest: /etc/nginx/conf.d/99-setops-frontal.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger nginx serveur_web_frontal
|
|
|
|
- name: Creer le repertoire du WAF
|
|
ansible.builtin.file:
|
|
path: "{{ serveur_web_frontal_waf_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Deployer la composition du WAF (ModSecurity + OWASP CRS)
|
|
ansible.builtin.template:
|
|
src: waf.conf.j2
|
|
dest: "{{ serveur_web_frontal_waf_dir }}/main.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger nginx serveur_web_frontal
|
|
|
|
# LES REGISTRES DU PLAN, COMME A L'EDGE : on releve d'abord ce qui existe, puis on charge.
|
|
# `domaines.yml` peut manquer (un plan sans domaine public) : les expositions sont alors vides.
|
|
- name: Quels registres du plan existent vraiment ?
|
|
ansible.builtin.stat:
|
|
path: "{{ item }}"
|
|
loop:
|
|
- "{{ setops_plan_dir }}/applications.yml"
|
|
- "{{ setops_plan_dir }}/domaines.yml"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: serveur_web_frontal_registres
|
|
when: serveur_web_frontal_publier_expositions | bool
|
|
|
|
- name: Charger les registres applications et domaines
|
|
ansible.builtin.include_vars:
|
|
file: "{{ item.item }}"
|
|
loop: "{{ serveur_web_frontal_registres.results | default([]) }}"
|
|
loop_control:
|
|
label: "{{ item.item | basename }}"
|
|
when:
|
|
- serveur_web_frontal_publier_expositions | bool
|
|
- item.stat.exists | default(false)
|
|
|
|
- name: Lister les expositions publiques destinees a ce frontal
|
|
ansible.builtin.set_fact:
|
|
serveur_web_frontal_expositions: >-
|
|
{{ {'applications': applications | default({})}
|
|
| expositions_des_applications({'domaines_publics': domaines_publics | default({})}, serveur_web_frontal_groupe) }}
|
|
when: serveur_web_frontal_publier_expositions | bool
|
|
|
|
- name: Deployer les vhosts du frontal (derives des expositions publiques)
|
|
ansible.builtin.template:
|
|
src: frontal.conf.j2
|
|
dest: /etc/nginx/sites-available/frontal.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger nginx serveur_web_frontal
|
|
|
|
- name: Activer les vhosts du frontal
|
|
ansible.builtin.file:
|
|
src: /etc/nginx/sites-available/frontal.conf
|
|
dest: /etc/nginx/sites-enabled/frontal.conf
|
|
state: link
|
|
notify: Recharger nginx serveur_web_frontal
|
|
|
|
- name: Valider la configuration nginx avant tout rechargement
|
|
ansible.builtin.command: nginx -t
|
|
changed_when: false
|
|
when: not ansible_check_mode
|
|
|
|
- name: Activer et demarrer nginx
|
|
ansible.builtin.systemd:
|
|
name: nginx
|
|
enabled: true
|
|
state: started
|
|
when: not ansible_check_mode
|
|
|
|
# LE ROLE QUI POSSEDE LA VERITE DEPOSE SA PROPRE SONDE.
|
|
- name: Assurer le repertoire des sondes de supervision
|
|
ansible.builtin.file:
|
|
path: /usr/local/lib/setops/sondes
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Deposer la sonde « frontal »
|
|
ansible.builtin.template:
|
|
src: sonde-frontal.sh.j2
|
|
dest: /usr/local/lib/setops/sondes/frontal.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|