# Document 14 : Structure YAML du Registraire ## L'Alliance Boréale — Source de Vérité Unique **Version :** 1.0 **Date :** 20 octobre 2025 **Statut :** Production **Auteur :** L'Alliance Boréale --- ## 📋 Table des matières 1. [Philosophie du Registraire](#1-philosophie-du-registraire) 2. [Architecture des Fichiers](#2-architecture-des-fichiers) 3. [Schéma : Fiche Membre (partner.yml)](#3-schéma-fiche-membre-partneryml) 4. [Schéma : Allocations Réseau (network/allocations.yml)](#4-schéma-allocations-réseau) 5. [Schéma : Labels et Conformité (labels/)](#5-schéma-labels-et-conformité) 6. [Schéma : Gouvernance (governance/)](#6-schéma-gouvernance) 7. [Schéma : Topologie VPN (network/topology.yml)](#7-schéma-topologie-vpn) 8. [Processus de Mise à Jour](#8-processus-de-mise-à-jour) 9. [Validation et Intégrité](#9-validation-et-intégrité) 10. [Exemples Complets](#10-exemples-complets) --- ## 1. Philosophie du Registraire ### 1.1 Principes fondateurs Le **Registraire de L'Alliance Boréale** est la **source de vérité unique** pour : - L'identité de chaque membre - Les allocations réseau (/16 par membre) - Les niveaux de label et dates d'expiration - La topologie VPN et tunnels peer-to-peer - Les décisions de gouvernance et audits ### 1.2 Caractéristiques clés | Caractéristique | Description | |----------------|-------------| | **Lisibilité** | YAML humain ET machine | | **Versionnement** | Git avec signatures PGP | | **Transparence** | Public par défaut (sauf secrets) | | **Décentralisation** | Miroirs chez chaque membre | | **Automatisation** | Consommable par Ansible/scripts | ### 1.3 Localisation ``` registry.alliance-boreale.ca/ ├── README.md ├── members/ # Fiches individuelles ├── network/ # Allocations IP et VPN ├── labels/ # Historique des labels ├── governance/ # Décisions et cercles └── schemas/ # Validation JSONSchema ``` **URL publique :** `https://registry.alliance-boreale.ca` **Dépôt Git :** `git@forge.alliance-boreale.ca:alliance/registry.git` --- ## 2. Architecture des Fichiers ### 2.1 Arborescence complète ``` registry.alliance-boreale.ca/ │ ├── members/ │ ├── czp-001-chezlepro.yml # Chezlepro inc. │ ├── nul-002-nuagelibre.yml # Nuage Libre │ ├── tli-003-technolibre.yml # TechnoLibre │ └── ... │ ├── network/ │ ├── allocations.yml # Blocs /16 par membre │ ├── topology.yml # Tunnels VPN déclarés │ └── dns-zones.yml # Zones DNS fédérées │ ├── labels/ │ ├── 2025-Q1.yml # Labels attribués Q1 2025 │ ├── 2025-Q2.yml │ └── history/ │ └── czp-001-label-history.yml # Historique Chezlepro │ ├── governance/ │ ├── circles.yml # Composition des cercles │ ├── decisions/ │ │ ├── 2025-001-admission-nuagelibre.yml │ │ └── 2025-002-allocation-10.1.0.0.yml │ └── resolutions/ │ └── 2025-R01-constitution-pilote.yml │ └── schemas/ ├── member-schema.json # Validation fiches membres ├── network-schema.json └── label-schema.json ``` ### 2.2 Conventions de nommage | Élément | Format | Exemple | |---------|--------|---------| | **ID Membre** | `[aaa]-[nnn]` | `czp-001` | | **Fichier Membre** | `[id]-[shortname].yml` | `czp-001-chezlepro.yml` | | **Bloc Réseau** | `10.[N].0.0/16` | `10.0.0.0/16` | | **Décision** | `YYYY-[NNN]-[titre].yml` | `2025-001-admission.yml` | --- ## 3. Schéma : Fiche Membre (partner.yml) ### 3.1 Schéma complet ```yaml # members/czp-001-chezlepro.yml # ═══════════════════════════════════════════════════════ # IDENTITÉ # ═══════════════════════════════════════════════════════ id: czp-001 status: active # active | probation | suspended | exited shortname: chezlepro legal: name: "Chezlepro inc." type: corporation # corporation | cooperative | npo | sole_proprietorship jurisdiction: QC registration_number: "1234567890 QC" founded: 2018-03-15 headquarters: city: "Saint-Bruno-de-Montarville" province: "Québec" country: "Canada" # ═══════════════════════════════════════════════════════ # CONTACTS # ═══════════════════════════════════════════════════════ contacts: legal: email: legal@chezlepro.ca pgp: "0xABCD1234" security: email: security@chezlepro.ca pgp: "0xEF567890" phone: "+1-450-555-0100" noc: # Network Operations Center email: noc@chezlepro.ca phone: "+1-450-555-0101" oncall: "https://status.chezlepro.ca/oncall" privacy: email: privacy@chezlepro.ca officer: "Daniel Laroche" # ═══════════════════════════════════════════════════════ # ADHÉSION # ═══════════════════════════════════════════════════════ membership: joined: 2025-01-15 probation_end: 2025-04-15 sponsor: null # Membre fondateur founding_member: true roles: - "Membre fondateur" - "Gardien temporaire" - "Coordinateur technique" # ═══════════════════════════════════════════════════════ # LABEL DE CONFORMITÉ # ═══════════════════════════════════════════════════════ label: level: gold # bronze | silver | gold | platinum score: 88 issued: 2025-10-12 valid_until: 2026-10-12 auditor: nul-002 # Audité par Nuage Libre domains: governance: 5 security: 5 privacy: 4 interoperability: 5 operations: 5 sustainability: 4 # ═══════════════════════════════════════════════════════ # RÉSEAU & DNS # ═══════════════════════════════════════════════════════ network: ipv4_block: 10.0.0.0/16 segments: management: 10.0.0.0/24 platform: 10.0.1.0/24 public_dns: 10.0.2.0/24 tenant_infra: 10.0.10.0/23 reserved: 10.0.20.0/22 expansion: 10.0.128.0/17 gateway: 10.0.0.1 dns: primary: 10.0.2.10 secondary: 10.0.2.11 public_nameservers: - name: ns1.chezlepro.ca ipv4: 203.0.113.10 ipv6: 2001:db8:czp::10 - name: ns2.chezlepro.ca ipv4: 203.0.113.11 ipv6: 2001:db8:czp::11 asn: null # Optionnel si BGP # ═══════════════════════════════════════════════════════ # VPN & FÉDÉRATION # ═══════════════════════════════════════════════════════ vpn: topology: selective # complete | regional | selective wireguard: public_key: "AbCdEf1234567890+GhIjKlMnOpQrStUvWxYz=" endpoint: vpn.chezlepro.ca:51820 allowed_ips: - 10.0.0.0/16 tunnels: - peer_id: nul-002 subnet: 10.200.0.0/30 status: active established: 2025-02-20 - peer_id: tli-003 subnet: 10.200.0.4/30 status: active established: 2025-03-10 # ═══════════════════════════════════════════════════════ # SERVICES OFFERTS # ═══════════════════════════════════════════════════════ services: dns: enabled: true role: primary zones: - chezlepro.ca - alliance-boreale.ca # Zone fédérée email: enabled: true domains: - chezlepro.ca mx_records: - mx1.chezlepro.ca (priority 10) - mx2.chezlepro.ca (priority 20) identity: enabled: true provider: keycloak url: https://id.chezlepro.ca realms: - boreal # Realm fédéré - chezlepro # Realm interne federation_metadata: https://id.chezlepro.ca/realms/boreal/.well-known/openid-configuration files: enabled: true platform: nextcloud url: https://nuage.chezlepro.ca federation: true forge: enabled: true platform: forgejo url: https://forge.chezlepro.ca federation: true monitoring: enabled: true platform: prometheus-grafana public_status: https://status.chezlepro.ca federation_metrics: https://metrics.chezlepro.ca/federated # ═══════════════════════════════════════════════════════ # URLS PUBLIQUES # ═══════════════════════════════════════════════════════ public_urls: website: https://chezlepro.ca status: https://status.chezlepro.ca policies: https://chezlepro.ca/policies privacy_policy: https://chezlepro.ca/policies/privacy security_policy: https://chezlepro.ca/policies/security sustainability: https://chezlepro.ca/sustainability federation_metadata: https://id.chezlepro.ca/.well-known/openid-configuration # ═══════════════════════════════════════════════════════ # VALEURS & ENGAGEMENTS # ═══════════════════════════════════════════════════════ values: open_source: true local_hosting: true privacy_first: true sustainability: true libre_software: true software_stack: os: "Debian 12" virtualization: "Proxmox VE 8" storage: "Ceph Quincy" orchestration: "Ansible" monitoring: "Prometheus + Grafana" dns: "PowerDNS" identity: "Keycloak" # ═══════════════════════════════════════════════════════ # CONTRIBUTIONS À L'ALLIANCE # ═══════════════════════════════════════════════════════ contributions: timebank_balance: 42 # Crédits banque de temps audits_performed: - member_id: nul-002 date: 2025-09-15 level: silver - member_id: tli-003 date: 2025-08-20 level: bronze tools_contributed: - name: ansible-role-powerdns repo: https://forge.alliance-boreale.ca/tools/ansible-powerdns license: MIT - name: monitoring-dashboard-boreal repo: https://forge.alliance-boreale.ca/tools/grafana-boreal license: AGPL-3.0 documentation: - title: "Guide DNS Fédéré" url: https://docs.alliance-boreale.ca/dns-federe - title: "Template Proxmox SDN" url: https://docs.alliance-boreale.ca/proxmox-sdn # ═══════════════════════════════════════════════════════ # MÉTADONNÉES # ═══════════════════════════════════════════════════════ metadata: created: 2025-01-15T10:00:00Z updated: 2025-10-12T14:30:00Z schema_version: "1.0" signatures: - signer: "Daniel Laroche (Chezlepro)" pgp: "0xABCD1234" date: 2025-10-12 signature: "-----BEGIN PGP SIGNATURE-----..." ``` --- ## 4. Schéma : Allocations Réseau ### 4.1 Fichier global (network/allocations.yml) ```yaml # network/allocations.yml # ═══════════════════════════════════════════════════════ # ALLOCATIONS IPv4 (/16 par membre) # ═══════════════════════════════════════════════════════ allocations: - member_id: czp-001 block: 10.0.0.0/16 assigned: 2025-01-15 status: active notes: "Membre fondateur - Chezlepro inc." - member_id: nul-002 block: 10.1.0.0/16 assigned: 2025-02-20 status: active notes: "Nuage Libre - Québec" - member_id: tli-003 block: 10.2.0.0/16 assigned: 2025-03-10 status: active notes: "TechnoLibre - Saguenay" # Blocs réservés pour croissance reserved: - block: 10.3.0.0/16 reserved_for: future_member - block: 10.4.0.0/16 reserved_for: future_member - block: 10.255.0.0/16 reserved_for: infrastructure_shared # ═══════════════════════════════════════════════════════ # RÈGLES D'ALLOCATION # ═══════════════════════════════════════════════════════ allocation_policy: block_size: /16 range_start: 10.0.0.0/16 range_end: 10.254.0.0/16 sequential: true segments_standard: management: /24 platform: /24 public_dns: /24 tenant_infra: /23 reserved: /22 expansion: /17 ``` --- ## 5. Schéma : Labels et Conformité ### 5.1 Labels trimestriels (labels/2025-Q4.yml) ```yaml # labels/2025-Q4.yml # ═══════════════════════════════════════════════════════ # LABELS ATTRIBUÉS - Q4 2025 # ═══════════════════════════════════════════════════════ quarter: 2025-Q4 issued_date: 2025-10-01 expires_date: 2026-10-01 labels: - member_id: czp-001 member_name: "Chezlepro inc." level: gold score: 88 issued: 2025-10-12 valid_until: 2026-10-12 auditor: nul-002 scores: governance: 5 security: 5 privacy: 4 interoperability: 5 operations: 5 sustainability: 4 notes: "Excellent. Recommandation pour Platine en 2026." - member_id: nul-002 member_name: "Nuage Libre" level: silver score: 72 issued: 2025-09-15 valid_until: 2026-09-15 auditor: czp-001 scores: governance: 4 security: 4 privacy: 5 interoperability: 4 operations: 3 sustainability: 4 notes: "Solide. Plan d'amélioration pour Or en cours." - member_id: tli-003 member_name: "TechnoLibre" level: bronze score: 63 issued: 2025-08-20 valid_until: 2026-08-20 auditor: czp-001 scores: governance: 3 security: 3 privacy: 4 interoperability: 4 operations: 3 sustainability: 3 notes: "Conforme. Progression vers Argent planifiée." # ═══════════════════════════════════════════════════════ # STATISTIQUES # ═══════════════════════════════════════════════════════ statistics: total_members: 3 platinum: 0 gold: 1 silver: 1 bronze: 1 average_score: 74.3 ``` ### 5.2 Historique individuel (labels/history/czp-001-label-history.yml) ```yaml # labels/history/czp-001-label-history.yml member_id: czp-001 member_name: "Chezlepro inc." history: - quarter: 2025-Q4 level: gold score: 88 issued: 2025-10-12 auditor: nul-002 progression: +3 # Progression depuis dernier audit - quarter: 2025-Q2 level: gold score: 85 issued: 2025-04-15 auditor: external progression: "initial" trends: governance: stable security: stable privacy: improving interoperability: stable operations: stable sustainability: improving ``` --- ## 6. Schéma : Gouvernance ### 6.1 Composition des cercles (governance/circles.yml) ```yaml # governance/circles.yml # ═══════════════════════════════════════════════════════ # CERCLES SOCIOCRATIQUES # ═══════════════════════════════════════════════════════ version: "1.0" updated: 2025-10-12 cercle_strategique: mandate: "Vision, orientation, admission nouveaux membres" term_months: 12 decision_mode: consentement members: - member_id: czp-001 role: "Président & Fondateur" joined: 2025-01-15 term_end: 2026-01-15 - member_id: nul-002 role: "Membre permanent" joined: 2025-02-20 term_end: 2026-02-20 - member_id: tli-003 role: "Membre permanent" joined: 2025-03-10 term_end: 2026-03-10 next_meeting: 2025-11-15T14:00:00Z meeting_frequency: quarterly cercle_operationnel: mandate: "Coordination technique, infrastructure, outils communs" term_months: 6 decision_mode: consentement_avec_vote_majoritaire members: - member_id: czp-001 role: "Coordinateur technique" term_end: 2026-04-15 - member_id: nul-002 role: "Responsable DNS" term_end: 2026-04-15 - member_id: tli-003 role: "Responsable VPN/Réseau" term_end: 2026-04-15 next_meeting: 2025-11-01T10:00:00Z meeting_frequency: monthly cercle_ethique_conformite: mandate: "Label, audits, arbitrages, communication publique" term_months: 24 decision_mode: consentement_renforce members: - member_id: czp-001 role: "Président comité éthique" term_end: 2027-01-15 - member_id: nul-002 role: "Auditeur principal" term_end: 2027-02-20 next_meeting: 2025-11-08T13:00:00Z meeting_frequency: biweekly ``` ### 6.2 Décisions (governance/decisions/2025-001-admission-nuagelibre.yml) ```yaml # governance/decisions/2025-001-admission-nuagelibre.yml decision_id: 2025-001 type: admission title: "Admission de Nuage Libre comme membre" proposed_by: member_id: czp-001 date: 2025-02-10 proposal: subject: "Admission de Nuage Libre (Québec)" justification: | Nuage Libre remplit tous les critères: - Hébergeur local québécois - 100% logiciels libres - Valeurs alignées - Infrastructure compatible requested_block: 10.1.0.0/16 probation_period: 90_days discussion_period: start: 2025-02-10 end: 2025-02-24 comments: 3 vote: method: consentement date: 2025-02-20 result: adopted votes: - member_id: czp-001 vote: consent comment: "Excellent partenaire" - member_id: tli-003 vote: consent comment: "Infrastructure solide" decision: status: adopted implemented: 2025-02-20 notes: "Allocation 10.1.0.0/16 effectuée. Probation jusqu'au 2025-05-20." signatures: - member_id: czp-001 role: "Président Cercle Stratégique" date: 2025-02-20 pgp_signature: "-----BEGIN PGP SIGNATURE-----..." ``` --- ## 7. Schéma : Topologie VPN ### 7.1 Tunnels déclarés (network/topology.yml) ```yaml # network/topology.yml # ═══════════════════════════════════════════════════════ # TOPOLOGIE VPN PEER-TO-PEER # ═══════════════════════════════════════════════════════ version: "1.0" updated: 2025-10-12 tunnels: - tunnel_id: t001 peers: - member_id: czp-001 endpoint: vpn.chezlepro.ca:51820 public_key: "AbCdEf1234567890+GhIjKlMnOpQrStUvWxYz=" - member_id: nul-002 endpoint: vpn.nuagelibre.ca:51820 public_key: "ZyXwVuTsRqPoNmLkJiHgFeDcBa0987654321+=" subnet: 10.200.0.0/30 czp_ip: 10.200.0.1 nul_ip: 10.200.0.2 status: active established: 2025-02-20 last_seen: 2025-10-12T14:25:00Z metrics: latency_ms: 12 packet_loss: 0.01 bandwidth_mbps: 1000 - tunnel_id: t002 peers: - member_id: czp-001 endpoint: vpn.chezlepro.ca:51820 public_key: "AbCdEf1234567890+GhIjKlMnOpQrStUvWxYz=" - member_id: tli-003 endpoint: vpn.technolibre.org:51820 public_key: "1234567890AbCdEfGhIjKlMnOpQrStUvWxYz+=" subnet: 10.200.0.4/30 czp_ip: 10.200.0.5 tli_ip: 10.200.0.6 status: active established: 2025-03-10 last_seen: 2025-10-12T14:26:00Z metrics: latency_ms: 25 packet_loss: 0.02 bandwidth_mbps: 500 - tunnel_id: t003 peers: - member_id: nul-002 endpoint: vpn.nuagelibre.ca:51821 public_key: "ZyXwVuTsRqPoNmLkJiHgFeDcBa0987654321+=" - member_id: tli-003 endpoint: vpn.technolibre.org:51821 public_key: "1234567890AbCdEfGhIjKlMnOpQrStUvWxYz+=" subnet: 10.200.0.8/30 nul_ip: 10.200.0.9 tli_ip: 10.200.0.10 status: active established: 2025-04-05 last_seen: 2025-10-12T14:27:00Z metrics: latency_ms: 18 packet_loss: 0.00 bandwidth_mbps: 750 # ═══════════════════════════════════════════════════════ # STATISTIQUES RÉSEAU # ═══════════════════════════════════════════════════════ statistics: total_tunnels: 3 active_tunnels: 3 total_members: 3 full_mesh: true average_latency_ms: 18.3 average_packet_loss: 0.01 ``` --- ## 8. Processus de Mise à Jour ### 8.1 Workflow Git ```bash # Modification d'une fiche membre cd registry.alliance-boreale.ca git checkout -b update-czp-001-label # Éditer la fiche vim members/czp-001-chezlepro.yml # Valider avec schema yamllint members/czp-001-chezlepro.yml jsonschema -i members/czp-001-chezlepro.yml schemas/member-schema.json # Commit signé PGP git add members/czp-001-chezlepro.yml git commit -S -m "Update: Chezlepro label Gold → Platinum - Score: 88 → 92 - Sustainability: 4 → 5 - Valid until: 2026-10-12 Audited by: nul-002 Signed-off-by: Daniel Laroche " # Push et merge request git push origin update-czp-001-label ``` ### 8.2 Validation automatique ```yaml # .gitlab-ci.yml stages: - validate - publish validate_yaml: stage: validate script: - yamllint members/*.yml - yamllint network/*.yml - yamllint labels/*.yml - python3 validate-schemas.py only: - merge_requests validate_signatures: stage: validate script: - ./scripts/verify-pgp-signatures.sh only: - merge_requests publish_registry: stage: publish script: - rsync -av . registry.alliance-boreale.ca:/var/www/registry/ - ./scripts/generate-static-site.sh only: - main ``` --- ## 9. Validation et Intégrité ### 9.1 JSONSchema pour validation ```json { "$schema": "http://json-schema.org/draft-07/schema#", "title": "Alliance Boréale Member Schema", "type": "object", "required": ["id", "status", "legal", "contacts", "network"], "properties": { "id": { "type": "string", "pattern": "^[a-z]{3}-[0-9]{3}$" }, "status": { "type": "string", "enum": ["active", "probation", "suspended", "exited"] }, "legal": { "type": "object", "required": ["name", "type", "jurisdiction"], "properties": { "name": {"type": "string"}, "type": { "type": "string", "enum": ["corporation", "cooperative", "npo", "sole_proprietorship"] } } }, "network": { "type": "object", "required": ["ipv4_block"], "properties": { "ipv4_block": { "type": "string", "pattern": "^10\\.[0-9]{1,3}\\.0\\.0/16$" } } } } } ``` ### 9.2 Signatures PGP Chaque modification critique doit être signée : ```bash # Signer un commit git commit -S -m "Critical: Update member czp-001" # Vérifier les signatures git log --show-signature # Vérifier l'intégrité du registre ./scripts/verify-registry-integrity.sh ``` --- ## 10. Exemples Complets ### 10.1 Scénario : Nouveau membre ```yaml # members/abc-004-nouveau.yml id: abc-004 status: probation shortname: nouveau legal: name: "Nouveau Hébergeur Coop" type: cooperative jurisdiction: QC registration_number: "9876543210 QC" founded: 2023-06-01 contacts: legal: email: legal@nouveau.coop security: email: security@nouveau.coop noc: email: noc@nouveau.coop membership: joined: 2025-10-20 probation_end: 2026-01-20 sponsor: czp-001 label: level: null # Pas encore évalué score: null network: ipv4_block: 10.3.0.0/16 gateway: 10.3.0.1 dns: primary: 10.3.2.10 secondary: 10.3.2.11 vpn: topology: selective wireguard: public_key: "NewPublicKey123456789+=" endpoint: vpn.nouveau.coop:51820 tunnels: [] # Aucun tunnel établi encore services: dns: enabled: false # En configuration email: enabled: true identity: enabled: false # Planifié public_urls: website: https://nouveau.coop status: https://status.nouveau.coop values: open_source: true local_hosting: true privacy_first: true sustainability: true contributions: timebank_balance: 0 audits_performed: [] tools_contributed: [] metadata: created: 2025-10-20T09:00:00Z updated: 2025-10-20T09:00:00Z schema_version: "1.0" ``` ### 10.2 Commande d'allocation réseau ```bash #!/bin/bash # scripts/allocate-network.sh MEMBER_ID="abc-004" MEMBER_NAME="Nouveau Hébergeur Coop" # Trouver le prochain /16 disponible NEXT_BLOCK=$(python3 scripts/find-next-block.py) echo "Allocating: $NEXT_BLOCK to $MEMBER_ID" # Créer l'entrée dans allocations.yml cat >> network/allocations.yml <