40 lines
1.1 KiB
Markdown
40 lines
1.1 KiB
Markdown
|
## Checklist trimestrielle — Pile opérateur (C1–C5)
|
|||
|
|
|
|||
|
|
### C1
|
|||
|
|
|
|||
|
|
- [ ] C1-E1 Inventaire Proxmox
|
|||
|
|
- [ ] C1-E2 Santé Ceph + capacité
|
|||
|
|
- [ ] C1-E3 Restore test (preuve)
|
|||
|
|
- [ ] C1-E4 TrueNAS (si activé)
|
|||
|
|
|
|||
|
|
### C2
|
|||
|
|
|
|||
|
|
- [ ] C2-E1 Export OPNsense + matrice flux
|
|||
|
|
- [ ] C2-E2 Test non-bypass / adjacent-only
|
|||
|
|
- [ ] C2-E3 Inventaire PowerDNS + ΔLog
|
|||
|
|
- [ ] C2-E4 WireGuard (pairs + logs + runbook)
|
|||
|
|
|
|||
|
|
### C3
|
|||
|
|
|
|||
|
|
- [ ] C3-E1 Export Keycloak + RBAC
|
|||
|
|
- [ ] C3-E2 BPM “auditeur” (exports)
|
|||
|
|
- [ ] C3-E3 Checks Icinga + historique
|
|||
|
|
- [ ] C3-E4 Prometheus targets + Alertmanager rules
|
|||
|
|
- [ ] C3-E5 Dashboards Grafana (exports)
|
|||
|
|
- [ ] C3-E6 Loki (labels/rétention/requêtes)
|
|||
|
|
|
|||
|
|
### C4
|
|||
|
|
|
|||
|
|
- [ ] C4-E1 Règles Forgejo (PR/branches) + ΔLog
|
|||
|
|
- [ ] C4-E2 Logs Forgejo Actions (CI)
|
|||
|
|
- [ ] C4-E3 Harbor (RBAC/rétention/provenance)
|
|||
|
|
- [ ] C4-E4 Vault (policies/audit/rotation)
|
|||
|
|
- [ ] C4-E5 IaC validation (lint/plan attaché PR)
|
|||
|
|
|
|||
|
|
### C5
|
|||
|
|
|
|||
|
|
- [ ] C5-E1 Config NGINX + ModSecurity + TLS
|
|||
|
|
- [ ] C5-E2 Logs NGINX (preuve médiation)
|
|||
|
|
- [ ] C5-E3 FastAPI (OpenAPI/logs/admission/quotas)
|
|||
|
|
- [ ] C5-E4 Unbound (ACL/logs)
|
|||
|
|
- [ ] C5-E5 Runner IaC (logs apply + liens PR→exécution)
|