alliance-boreale/docs/architecture/templates_automation.md

Templates Ansible & Terraform - Nomenclature v2.0

L'Alliance Boréale

Version: 1.0

Date: 21 octobre 2025

Licence: AGPL-3.0

################################################################################

PARTIE 1: TEMPLATES ANSIBLE

################################################################################

==============================================================================

1. Inventaire Dynamique Proxmox

==============================================================================

inventory/proxmox.yml

---

plugin: community.general.proxmox url: https://proxmox.example.com:8006 user: ansible@pve password: !vault | $ANSIBLE_VAULT;1.1;AES256 ... validate_certs: no

Grouper automatiquement par tags

compose: ansible_host: proxmox_ipconfig0.ip | regex_replace('/.*', '')

keyed_groups:

Grouper par couche (infrastructure)

• prefix: layer key: proxmox_tags | select('match', '^layer-[1-4]$') | first | default('unknown')

Grouper par tenant

• prefix: tenant key: proxmox_tags | select('match', '^tenant-t[0-9]{3}$') | first | default('none')

Grouper par environnement

• prefix: env key: proxmox_tags | select('match', '^(prod|stg|dev|test)$') | first | default('unknown')

Grouper par catégorie

• prefix: category key: proxmox_tags | select('match', '^(infrastructure|tenant)$') | first | default('unknown')

==============================================================================

2. Playbook de Création VM Infrastructure

==============================================================================

playbooks/create-infra-vm.yml

---

• name: Créer VM Infrastructure selon nomenclature v2.0 hosts: localhost gather_facts: no

  vars_prompt:

  • name: vm_layer prompt: "Couche (1-4)" private: no

  • name: vm_type prompt: "Type service (ex: 00=DNS, 10=VPN, 20=Git)" private: no

  • name: vm_instance prompt: "Instance (01-99)" private: no

  • name: vm_service_name prompt: "Nom du service (ex: dns-master, ansible-ctrl)" private: no

  • name: vm_environment prompt: "Environnement (prod/stg/dev/test)" private: no default: "prod"

  vars: member_id: "{{ lookup('env', 'MEMBER_ID') | default('czp', true) }}"

  Calcul VMID

  vmid: "{{ '%s%02d' | format(tenant_id, vm_instance|int) }}"

  Construction nom VM

  vm_name: "{{ member_id }}-t{{ tenant_id }}-{{ vm_service_type }}-{{ vm_environment }}-{{ '%02d' | format(vm_instance|int) }}"

  Allocation IP (via script ou manuel)

  vm_ip: "{{ lookup('pipe', 'allocate-ip.sh ' + tenant_id) | regex_search('\d+\.\d+\.\d+\.\d+') }}"

  DNS

  vm_dns: "{{ vm_service_type }}.t{{ tenant_id }}.{{ member_id }}.alliance-boreale.ca"

  tasks:

  • name: Afficher plan de création debug: msg: - "VMID: {{ vmid }}" - "Nom: {{ vm_name }}" - "IP: {{ vm_ip }}/23" - "DNS: {{ vm_dns }}" - "Tenant: {{ tenant_id }}"

  • name: Confirmer création pause: prompt: "Créer cette VM? (Ctrl+C pour annuler)"

  • name: Créer VM dans Proxmox community.general.proxmox_kvm: api_host: "{{ proxmox_host }}" api_user: "{{ proxmox_user }}" api_password: "{{ proxmox_password }}" node: "{{ proxmox_node }}"

    vmid: "{{ vmid }}" name: "{{ vm_name }}"

    clone: "{{ vm_template | default('debian-12-template') }}" full: yes

    cores: "{{ vm_cores | default(2) }}" memory: "{{ vm_memory | default(2048) }}"

    net: net0: "virtio,bridge=vmbr0,tag=10"

    ipconfig: ipconfig0: "ip={{ vm_ip }}/23,gw=10.0.0.1"

    tags: - tenant - "tenant-t{{ tenant_id }}" - "{{ vm_environment }}" - "service-{{ vm_service_type }}"

    state: present

  • name: Enregistrer IP dans IPAM ansible.builtin.lineinfile: path: "/etc/alliance-boreale/ipam.txt" line: "{{ tenant_id }} {{ vm_ip }} {{ ansible_date_time.date }} {{ vmid }}" create: yes

  • name: Créer entrée DNS ansible.builtin.lineinfile: path: "/var/lib/alliance-boreale/dns-records.zone" line: "{{ vm_dns }}. IN A {{ vm_ip }}" delegate_to: "{{ dns_master_host }}"

  • name: Démarrer la VM community.general.proxmox_kvm: api_host: "{{ proxmox_host }}" api_user: "{{ proxmox_user }}" api_password: "{{ proxmox_password }}" vmid: "{{ vmid }}" state: started

==============================================================================

4. Role Ansible - Conformité Nomenclature

==============================================================================

roles/nomenclature_compliance/tasks/main.yml

---

• name: Vérifier que le VMID est conforme ansible.builtin.assert: that: - inventory_hostname_short | regex_search('^[a-z]+-((infra)|(t[0-9]{3}))-') fail_msg: "Nom VM non conforme au standard v2.0" success_msg: "Nom VM conforme"

• name: Extraire les informations de nomenclature ansible.builtin.set_fact: vm_member: "{{ inventory_hostname_short | regex_replace('^([a-z]+)-.', '\1') }}" vm_category: "{{ 'infrastructure' if 'infra' in inventory_hostname_short else 'tenant' }}" vm_tenant_id: "{{ inventory_hostname_short | regex_replace('.-(t[0-9]{3})-.*', '\1') if 'infra' not in inventory_hostname_short else 'N/A' }}"

• name: Afficher informations extraites debug: msg: - "Membre: {{ vm_member }}" - "Catégorie: {{ vm_category }}" - "Tenant: {{ vm_tenant_id }}"

• name: Vérifier cohérence IP ansible.builtin.assert: that: - ansible_default_ipv4.address | regex_search('^10\.0\.') fail_msg: "IP hors de la plage 10.0.0.0/8" success_msg: "IP dans la plage correcte"

• name: Appliquer tags de conformité ansible.builtin.set_fact: nomenclature_compliant: true nomenclature_version: "v2.0" nomenclature_validated_date: "{{ ansible_date_time.iso8601 }}"

==============================================================================

5. Playbook d'Audit Ansible

==============================================================================

playbooks/audit-nomenclature-ansible.yml

---

• name: Audit de conformité Nomenclature v2.0 via Ansible hosts: all gather_facts: yes

  tasks:

  • name: Vérifier nom VM ansible.builtin.set_fact: name_compliant: "{{ inventory_hostname_short | regex_search('^[a-z]+-(infra|t[0-9]{3})-[a-z0-9-]+-[a-z]+-[0-9]{2}

  vars: member_id: "{{ lookup('env', 'MEMBER_ID') | default('czp', true) }}"

  Calcul VMID

  vmid: "{{ '0%s%02d%02d' | format(vm_layer, vm_type|int, vm_instance|int) }}"

  Construction nom VM

  vm_name: "{{ member_id }}-infra-{{ vm_service_name }}-{{ vm_environment }}-{{ '%02d' | format(vm_instance|int) }}"

  Calcul IP selon couche

  vm_ip: >- {{ ('10.0.0.' if vm_layer == '1' else '10.0.1.' if vm_layer == '4' else '10.0.2.' if vm_layer == '2' else '10.0.3.') + (vm_type|int * 10 + vm_instance|int)|string }}

  DNS

  vm_dns: "{{ vm_service_name }}.infra.{{ member_id }}.alliance-boreale.ca"

  tasks:

  • name: Afficher plan de création debug: msg: - "VMID: {{ vmid }}" - "Nom: {{ vm_name }}" - "IP: {{ vm_ip }}/24" - "DNS: {{ vm_dns }}"

  • name: Confirmer création pause: prompt: "Créer cette VM? (Ctrl+C pour annuler, Entrée pour continuer)"

  • name: Créer VM dans Proxmox community.general.proxmox_kvm: api_host: "{{ proxmox_host }}" api_user: "{{ proxmox_user }}" api_password: "{{ proxmox_password }}" node: "{{ proxmox_node }}"

    vmid: "{{ vmid }}" name: "{{ vm_name }}"

    clone: "debian-12-template" full: yes

    cores: 2 memory: 2048

    net: net0: "virtio,bridge=vmbr0,tag={{ '2' if vm_layer == '2' else '1' }}"

    ipconfig: ipconfig0: "ip={{ vm_ip }}/24,gw=10.0.0.1"

    tags: - infrastructure - "layer-{{ vm_layer }}" - "{{ vm_environment }}" - "service-{{ vm_service_name }}"

    state: present register: vm_created

  • name: Démarrer la VM community.general.proxmox_kvm: api_host: "{{ proxmox_host }}" api_user: "{{ proxmox_user }}" api_password: "{{ proxmox_password }}" vmid: "{{ vmid }}" state: started

  • name: Créer entrée DNS ansible.builtin.lineinfile: path: "/var/lib/alliance-boreale/dns-records.zone" line: "{{ vm_dns }}. IN A {{ vm_ip }}" create: yes delegate_to: "{{ dns_master_host }}"

  • name: Ajouter au monitoring ansible.builtin.template: src: templates/icinga2-host.conf.j2 dest: "/etc/icinga2/conf.d/hosts/{{ vm_name }}.conf" delegate_to: "{{ monitoring_host }}" notify: Reload Icinga2

==============================================================================

3. Playbook de Création VM Tenant

==============================================================================

playbooks/create-tenant-vm.yml

---

• name: Créer VM Tenant selon nomenclature v2.0 hosts: localhost gather_facts: no

  vars_prompt:

  • name: tenant_id prompt: "Tenant ID (001-999)" private: no

  • name: vm_instance prompt: "Instance (01-99)" private: no

  • name: vm_service_type prompt: "Type (web/api/db/cache/worker)" private: no

  • name: vm_environment prompt: "Environnement (prod/stg/dev) is not none }}"

  • name: Vérifier IP dans plage correcte ansible.builtin.set_fact: ip_compliant: "{{ ansible_default_ipv4.address | regex_search('^10\.0\.') is not none }}"

  • name: Extraire VMID si possible ansible.builtin.shell: | qm list | awk -v host="{{ inventory_hostname_short }}" '$2 == host {print $1}' register: vmid_check delegate_to: "{{ proxmox_node }}" changed_when: false failed_when: false

  • name: Valider VMID ansible.builtin.command: validate-vmid.sh {{ vmid_check.stdout }} register: vmid_validation delegate_to: localhost changed_when: false failed_when: false when: vmid_check.stdout != ""

  • name: Générer rapport ansible.builtin.set_fact: compliance_report: hostname: "{{ inventory_hostname }}" name_compliant: "{{ name_compliant }}" ip_compliant: "{{ ip_compliant }}" vmid: "{{ vmid_check.stdout | default('N/A') }}" vmid_compliant: "{{ vmid_validation.rc == 0 if vmid_check.stdout != '' else false }}" overall_compliant: "{{ name_compliant and ip_compliant and (vmid_validation.rc == 0 if vmid_check.stdout != '' else false) }}"

  • name: Afficher résultat ansible.builtin.debug: var: compliance_report

  • name: Sauvegarder rapport ansible.builtin.copy: content: "{{ compliance_report | to_nice_json }}" dest: "/var/lib/alliance-boreale/compliance/{{ inventory_hostname }}.json" delegate_to: localhost

################################################################################

PARTIE 2: TEMPLATES TERRAFORM

################################################################################

==============================================================================

6. Module Terraform - VM Infrastructure

==============================================================================

modules/infra-vm/main.tf

terraform { required_providers { proxmox = { source = "telmate/proxmox" version = "~> 2.9" } } }

variable "member_id" { description = "ID du membre (ex: czp, nul, tli)" type = string }

variable "layer" { description = "Couche (1-4)" type = number validation { condition = var.layer >= 1 && var.layer <= 4 error_message = "La couche doit être entre 1 et 4." } }

variable "service_type" { description = "Type de service (00-99)" type = number }

variable "instance" { description = "Numéro d'instance (01-99)" type = number }

variable "service_name" { description = "Nom du service (ex: dns-master, ansible-ctrl)" type = string }

variable "environment" { description = "Environnement (prod/stg/dev/test)" type = string default = "prod" }

variable "cores" { description = "Nombre de CPU cores" type = number default = 2 }

variable "memory" { description = "RAM en MB" type = number default = 2048 }

variable "disk_size" { description = "Taille disque en GB" type = string default = "20G" }

Calculs locaux

locals {

VMID: 0CTTII

vmid = format("0%d%02d%02d", var.layer, var.service_type, var.instance)

Nom VM: -infra---

vm_name = format("%s-infra-%s-%s-%02d", var.member_id, var.service_name, var.environment, var.instance )

IP selon couche

ip_base = var.layer == 1 ? "10.0.0" : ( var.layer == 2 ? "10.0.2" : ( var.layer == 3 ? "10.0.3" : "10.0.1"))

vm_ip = format("%s.%d", local.ip_base, var.service_type * 10 + var.instance)

DNS

vm_dns = format("%s.infra.%s.alliance-boreale.ca", var.service_name, var.member_id ) }

resource "proxmox_vm_qemu" "infra_vm" { name = local.vm_name vmid = local.vmid target_node = var.proxmox_node

clone = "debian-12-template" full_clone = true

cores = var.cores memory = var.memory

network { model = "virtio" bridge = "vmbr0" tag = var.layer == 2 ? 2 : 1 }

disk { type = "scsi" storage = "local-lvm" size = var.disk_size }

ipconfig0 = "ip=${local.vm_ip}/24,gw=10.0.0.1"

tags = join(";", [ "infrastructure", "layer-${var.layer}", var.environment, "service-${var.service_name}", "nomenclature-v2" ])

lifecycle { ignore_changes = [ network, ] } }

output "vmid" { value = local.vmid }

output "vm_name" { value = local.vm_name }

output "vm_ip" { value = local.vm_ip }

output "vm_dns" { value = local.vm_dns }

==============================================================================

7. Module Terraform - VM Tenant

==============================================================================

modules/tenant-vm/main.tf

terraform { required_providers { proxmox = { source = "telmate/proxmox" version = "~> 2.9" } } }

variable "member_id" { description = "ID du membre" type = string }

variable "tenant_id" { description = "Tenant ID (001-999)" type = string validation { condition = can(regex("^[0-9]{3}$", var.tenant_id)) error_message = "Tenant ID doit être au format NNN (ex: 001)." } }

variable "instance" { description = "Numéro d'instance (01-99)" type = number }

variable "service_type" { description = "Type de service (web/api/db/cache/worker)" type = string }

variable "environment" { description = "Environnement" type = string default = "prod" }

variable "ip_address" { description = "Adresse IP (optionnel, auto-alloué si vide)" type = string default = "" }

variable "cores" { type = number default = 2 }

variable "memory" { type = number default = 2048 }

locals {

VMID: TTTII

vmid = format("%s%02d", var.tenant_id, var.instance)

Nom VM

vm_name = format("%s-t%s-%s-%s-%02d", var.member_id, var.tenant_id, var.service_type, var.environment, var.instance )

IP (utiliser celle fournie ou calculer)

vm_ip = var.ip_address != "" ? var.ip_address : format("10.0.10.%d", (tonumber(var.tenant_id) - 1) * 10 + var.instance )

DNS

vm_dns = format("%s.t%s.%s.alliance-boreale.ca", var.service_type, var.tenant_id, var.member_id ) }

resource "proxmox_vm_qemu" "tenant_vm" { name = local.vm_name vmid = local.vmid target_node = var.proxmox_node

clone = var.vm_template full_clone = true

cores = var.cores memory = var.memory

network { model = "virtio" bridge = "vmbr0" tag = 10 }

disk { type = "scsi" storage = "local-lvm" size = var.disk_size }

ipconfig0 = "ip=${local.vm_ip}/23,gw=10.0.0.1"

tags = join(";", [ "tenant", "tenant-t${var.tenant_id}", var.environment, "service-${var.service_type}", "nomenclature-v2" ]) }

Enregistrer dans IPAM

resource "null_resource" "register_ipam" { provisioner "local-exec" { command = "echo '${var.tenant_id} ${local.vm_ip} ${timestamp()} ${local.vmid}' >> /etc/alliance-boreale/ipam.txt" }

depends_on = [proxmox_vm_qemu.tenant_vm] }

output "vmid" { value = local.vmid }

output "vm_name" { value = local.vm_name }

output "vm_ip" { value = local.vm_ip }

output "vm_dns" { value = local.vm_dns }

==============================================================================

8. Exemple d'Utilisation Terraform

==============================================================================

main.tf - Exemple de déploiement complet

terraform { required_version = ">= 1.0"

required_providers { proxmox = { source = "telmate/proxmox" version = "~> 2.9" } } }

provider "proxmox" { pm_api_url = var.proxmox_api_url pm_user = var.proxmox_user pm_password = var.proxmox_password pm_tls_insecure = true }

variable "proxmox_api_url" {} variable "proxmox_user" {} variable "proxmox_password" {} variable "proxmox_node" { default = "pve1" } variable "member_id" { default = "czp" }

Infrastructure minimale Bronze

module "dns_master" { source = "./modules/infra-vm"

member_id = var.member_id layer = 2 service_type = 0 # DNS instance = 1 service_name = "dns-master"

cores = 2 memory = 4096 }

module "ansible_controller" { source = "./modules/infra-vm"

member_id = var.member_id layer = 4 service_type = 0 # Ansible instance = 1 service_name = "ansible-ctrl" }

module "backup_server" { source = "./modules/infra-vm"

member_id = var.member_id layer = 3 service_type = 30 # Backup instance = 1 service_name = "pbs-backup"

cores = 4 memory = 8192 disk_size = "500G" }

Premier tenant - Stack complète

module "tenant001_web" { source = "./modules/tenant-vm"

member_id = var.member_id tenant_id = "001" instance = 1 service_type = "web" }

module "tenant001_api" { source = "./modules/tenant-vm"

member_id = var.member_id tenant_id = "001" instance = 11 service_type = "api-fastapi" }

module "tenant001_db" { source = "./modules/tenant-vm"

member_id = var.member_id tenant_id = "001" instance = 21 service_type = "db-postgres"

cores = 4 memory = 8192 }

Outputs

output "infrastructure" { value = { dns_master = { vmid = module.dns_master.vmid name = module.dns_master.vm_name ip = module.dns_master.vm_ip dns = module.dns_master.vm_dns } ansible = { vmid = module.ansible_controller.vmid name = module.ansible_controller.vm_name ip = module.ansible_controller.vm_ip dns = module.ansible_controller.vm_dns } } }

output "tenant_001" { value = { web = module.tenant001_web api = module.tenant001_api db = module.tenant001_db } }

==============================================================================

9. Variables Terraform

==============================================================================

variables.tf

variable "member_id" { description = "ID du membre de L'Alliance Boréale" type = string

validation { condition = can(regex("^[a-z]{2,4}$", var.member_id)) error_message = "member_id doit être 2-4 lettres minuscules." } }

variable "proxmox_node" { description = "Nœud Proxmox cible" type = string default = "pve1" }

variable "dns_domain" { description = "Domaine DNS de L'Alliance" type = string default = "alliance-boreale.ca" }

variable "vm_template" { description = "Template VM par défaut" type = string default = "debian-12-template" }

==============================================================================

10. Makefile pour Automatisation

==============================================================================

Makefile

.PHONY: help audit migrate plan apply destroy

help: @echo "Commandes disponibles:" @echo " make audit - Audit de conformité" @echo " make plan - Plan Terraform" @echo " make apply - Appliquer Terraform" @echo " make destroy - Détruire infrastructure Terraform" @echo " make ansible - Exécuter playbooks Ansible"

audit: @echo "=== Audit Nomenclature v2.0 ===" audit-nomenclature.sh ansible-playbook playbooks/audit-nomenclature-ansible.yml

plan: terraform plan -out=tfplan

apply: terraform apply tfplan

destroy: terraform destroy

ansible: ansible-playbook playbooks/configure-all.yml -i inventory/proxmox.yml

==============================================================================

FIN DES TEMPLATES

==============================================================================

vars: member_id: "{{ lookup('env', 'MEMBER_ID') | default('czp', true) }}"

# Calcul VMID
vmid: "{{ '0%s%02d%02d' | format(vm_layer, vm_type|int, vm_instance|int) }}"

# Construction nom VM
vm_name: "{{ member_id }}-infra-{{ vm_service_name }}-{{ vm_environment }}-{{ '%02d' | format(vm_instance|int) }}"

# Calcul IP selon couche
vm_ip: >-
  {{
    ('10.0.0.' if vm_layer == '1' else
     '10.0.1.' if vm_layer == '4' else
     '10.0.2.' if vm_layer == '2' else
     '10.0.3.') + (vm_type|int * 10 + vm_instance|int)|string
  }}

# DNS
vm_dns: "{{ vm_service_name }}.infra.{{ member_id }}.alliance-boreale.ca"

tasks: - name: Afficher plan de création debug: msg: - "VMID: {{ vmid }}" - "Nom: {{ vm_name }}" - "IP: {{ vm_ip }}/24" - "DNS: {{ vm_dns }}"

- name: Confirmer création
  pause:
    prompt: "Créer cette VM? (Ctrl+C pour annuler, Entrée pour continuer)"

- name: Créer VM dans Proxmox
  community.general.proxmox_kvm:
    api_host: "{{ proxmox_host }}"
    api_user: "{{ proxmox_user }}"
    api_password: "{{ proxmox_password }}"
    node: "{{ proxmox_node }}"
    
    vmid: "{{ vmid }}"
    name: "{{ vm_name }}"
    
    clone: "debian-12-template"
    full: yes
    
    cores: 2
    memory: 2048
    
    net:
      net0: "virtio,bridge=vmbr0,tag={{ '2' if vm_layer == '2' else '1' }}"
    
    ipconfig:
      ipconfig0: "ip={{ vm_ip }}/24,gw=10.0.0.1"
    
    tags:
      - infrastructure
      - "layer-{{ vm_layer }}"
      - "{{ vm_environment }}"
      - "service-{{ vm_service_name }}"
    
    state: present
  register: vm_created

- name: Démarrer la VM
  community.general.proxmox_kvm:
    api_host: "{{ proxmox_host }}"
    api_user: "{{ proxmox_user }}"
    api_password: "{{ proxmox_password }}"
    vmid: "{{ vmid }}"
    state: started

- name: Créer entrée DNS
  ansible.builtin.lineinfile:
    path: "/var/lib/alliance-boreale/dns-records.zone"
    line: "{{ vm_dns }}. IN A {{ vm_ip }}"
    create: yes
  delegate_to: "{{ dns_master_host }}"

- name: Ajouter au monitoring
  ansible.builtin.template:
    src: templates/icinga2-host.conf.j2
    dest: "/etc/icinga2/conf.d/hosts/{{ vm_name }}.conf"
  delegate_to: "{{ monitoring_host }}"
  notify: Reload Icinga2

==============================================================================

3. Playbook de Création VM Tenant

==============================================================================

playbooks/create-tenant-vm.yml

---

• name: Créer VM Tenant selon nomenclature v2.0 hosts: localhost gather_facts: no

  vars_prompt:

  • name: tenant_id prompt: "Tenant ID (001-999)" private: no

  • name: vm_instance prompt: "Instance (01-99)" private: no

  • name: vm_service_type prompt: "Type (web/api/db/cache/worker)" private: no

  • name: vm_environment prompt: "Environnement (prod/stg/dev