Set-OPS-Public/roles/serveur_web_frontal/tasks/main.yml

---
# serveur_web_frontal — reverse proxy + WAF des services web PUBLICS. Voir defaults/main.yml.
- name: Installer nginx, ModSecurity et l'OWASP CRS
  ansible.builtin.apt:
    name: "{{ serveur_web_frontal_paquets }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

# CE QUE LE CATALOGUE DE SAUVEGARDE DIT DU FRONTAL (2026-09-30). Il ne sert plus rien
# lui-meme — il relaie —, mais le catalogue emporte encore `/srv/web` : tant qu'il
# l'emporte, on le remet, quand la racine est vide.
- name: Restauration — la racine du frontal est-elle vierge ?
  ansible.builtin.find:
    paths: "{{ serveur_web_frontal_racine_base | default('/srv/web') }}"
    file_type: any
  register: serveur_web_frontal_racine_initiale

- name: Restauration — serveur_web_frontal d'une incarnation precedente ?
  ansible.builtin.include_role:
    name: client_backup
    tasks_from: restaurer.yml
  vars:
    client_backup_restaurer_jeu: serveur_web_frontal
    client_backup_restaurer_vierge: "{{ serveur_web_frontal_racine_initiale.matched | default(1) == 0 }}"

- name: Restauration — remettre serveur_web_frontal
  changed_when: true
  ansible.builtin.command:
    argv: >-
      {{ ['/usr/local/sbin/setops-restaurer', 'fichiers',
          '--instantane', client_backup_restauration.instantane]
         + client_backup_restauration.chemins }}      
  when: client_backup_restauration.etat == 'a_restaurer'

- name: Restauration — acter serveur_web_frontal
  ansible.builtin.include_role:
    name: client_backup
    tasks_from: acter.yml
  vars:
    client_backup_acter_etat: restaure
  when: client_backup_restauration.etat == 'a_restaurer'

- name: Retirer le vhost nginx par defaut de Debian
  ansible.builtin.file:
    path: /etc/nginx/sites-enabled/default
    state: absent
  notify: Recharger nginx serveur_web_frontal

- name: Deployer le durcissement de base nginx
  ansible.builtin.template:
    src: durcissement.conf.j2
    dest: /etc/nginx/conf.d/99-setops-frontal.conf
    owner: root
    group: root
    mode: "0644"
  notify: Recharger nginx serveur_web_frontal

- name: Creer le repertoire du WAF
  ansible.builtin.file:
    path: "{{ serveur_web_frontal_waf_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Deployer la composition du WAF (ModSecurity + OWASP CRS)
  ansible.builtin.template:
    src: waf.conf.j2
    dest: "{{ serveur_web_frontal_waf_dir }}/main.conf"
    owner: root
    group: root
    mode: "0644"
  notify: Recharger nginx serveur_web_frontal

# LES REGISTRES DU PLAN, COMME A L'EDGE : on releve d'abord ce qui existe, puis on charge.
# `domaines.yml` peut manquer (un plan sans domaine public) : les expositions sont alors vides.
- name: Quels registres du plan existent vraiment ?
  ansible.builtin.stat:
    path: "{{ item }}"
  loop:
    - "{{ setops_plan_dir }}/applications.yml"
    - "{{ setops_plan_dir }}/domaines.yml"
  delegate_to: localhost
  become: false
  register: serveur_web_frontal_registres
  when: serveur_web_frontal_publier_expositions | bool

- name: Charger les registres applications et domaines
  ansible.builtin.include_vars:
    file: "{{ item.item }}"
  loop: "{{ serveur_web_frontal_registres.results | default([]) }}"
  loop_control:
    label: "{{ item.item | basename }}"
  when:
    - serveur_web_frontal_publier_expositions | bool
    - item.stat.exists | default(false)

- name: Lister les expositions publiques destinees a ce frontal
  ansible.builtin.set_fact:
    serveur_web_frontal_expositions: >-
      {{ {'applications': applications | default({})}
         | expositions_des_applications({'domaines_publics': domaines_publics | default({})}, serveur_web_frontal_groupe) }}      
  when: serveur_web_frontal_publier_expositions | bool

- name: Creer la racine de la page 404
  ansible.builtin.file:
    path: "{{ serveur_web_frontal_racine_404 }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: serveur_web_frontal_page_404 | length > 0

- name: Deposer la page 404 du locataire
  ansible.builtin.copy:
    src: "{{ serveur_web_frontal_page_404 }}"
    dest: "{{ serveur_web_frontal_racine_404 }}/404.html"
    owner: root
    group: root
    mode: "0644"
  when: serveur_web_frontal_page_404 | length > 0

- name: Deployer les vhosts du frontal (derives des expositions publiques)
  ansible.builtin.template:
    src: frontal.conf.j2
    dest: /etc/nginx/sites-available/frontal.conf
    owner: root
    group: root
    mode: "0644"
  notify: Recharger nginx serveur_web_frontal

- name: Activer les vhosts du frontal
  ansible.builtin.file:
    src: /etc/nginx/sites-available/frontal.conf
    dest: /etc/nginx/sites-enabled/frontal.conf
    state: link
    # En simulation, le vhost n'a pas ete ecrit : le lien viserait un fichier absent.
    force: "{{ ansible_check_mode }}"
  notify: Recharger nginx serveur_web_frontal

- name: Valider la configuration nginx avant tout rechargement
  ansible.builtin.command: nginx -t
  changed_when: false
  when: not ansible_check_mode

- name: Activer et demarrer nginx
  ansible.builtin.systemd:
    name: nginx
    enabled: true
    state: started
  when: not ansible_check_mode

# LE ROLE QUI POSSEDE LA VERITE DEPOSE SA PROPRE SONDE.
- name: Assurer le repertoire des sondes de supervision
  ansible.builtin.file:
    path: /usr/local/lib/setops/sondes
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Deposer la sonde « frontal »
  ansible.builtin.template:
    src: sonde-frontal.sh.j2
    dest: /usr/local/lib/setops/sondes/frontal.sh
    owner: root
    group: root
    mode: "0750"