161 lines
5.1 KiB
YAML
161 lines
5.1 KiB
YAML
# Alliance Boréale - Playbook Phase 1
|
|
# Déploiement DNS Fédéré (Couches C1-C2)
|
|
# Membre: Chezlepro Inc.
|
|
# Date: 2025-10-31
|
|
|
|
---
|
|
- name: "🌲 Phase 1 - Préparation des VMs (Common)"
|
|
hosts: all
|
|
become: true
|
|
gather_facts: true
|
|
|
|
pre_tasks:
|
|
- name: "🔍 Vérifier connectivité SSH"
|
|
ansible.builtin.ping:
|
|
tags: always
|
|
|
|
- name: "📋 Afficher informations hôte"
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Hôte: {{ inventory_hostname }}
|
|
IP: {{ ansible_host }}
|
|
VMID: {{ vmid | default('N/A') }}
|
|
Rôle DNS: {{ dns_role | default('N/A') }}
|
|
tags: always
|
|
|
|
roles:
|
|
- role: common
|
|
tags: common
|
|
|
|
post_tasks:
|
|
- name: "✅ Common role terminé"
|
|
ansible.builtin.debug:
|
|
msg: "✅ Hardening complété sur {{ inventory_hostname }}"
|
|
tags: always
|
|
|
|
# ============================================
|
|
- name: "🗄️ Phase 1 - PostgreSQL pour DNS"
|
|
hosts: dns_servers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
roles:
|
|
- role: postgresql
|
|
tags: postgresql
|
|
|
|
post_tasks:
|
|
- name: "✅ PostgreSQL terminé"
|
|
ansible.builtin.debug:
|
|
msg: "✅ PostgreSQL {{ postgresql.version }} configuré sur {{ inventory_hostname }}"
|
|
tags: always
|
|
|
|
# ============================================
|
|
- name: "🌐 Phase 1 - PowerDNS Master"
|
|
hosts: dns_masters
|
|
become: true
|
|
gather_facts: true
|
|
serial: 1 # Un à la fois pour éviter race conditions
|
|
|
|
roles:
|
|
- role: powerdns-authoritative
|
|
tags: powerdns
|
|
|
|
post_tasks:
|
|
- name: "✅ PowerDNS Master terminé"
|
|
ansible.builtin.debug:
|
|
msg: "✅ PowerDNS MASTER configuré sur {{ inventory_hostname }}"
|
|
tags: always
|
|
|
|
# ============================================
|
|
- name: "🌐 Phase 1 - PowerDNS Slave"
|
|
hosts: dns_slaves
|
|
become: true
|
|
gather_facts: true
|
|
|
|
roles:
|
|
- role: powerdns-authoritative
|
|
tags: powerdns
|
|
|
|
post_tasks:
|
|
- name: "✅ PowerDNS Slave terminé"
|
|
ansible.builtin.debug:
|
|
msg: "✅ PowerDNS SLAVE configuré sur {{ inventory_hostname }}"
|
|
tags: always
|
|
|
|
# ============================================
|
|
- name: "🧪 Phase 1 - Tests de validation"
|
|
hosts: dns_masters
|
|
become: false
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: "🧪 Test résolution DNS (zone primaire)"
|
|
ansible.builtin.command:
|
|
cmd: "dig @{{ ansible_host }} {{ member.domain_primary }} SOA +short"
|
|
delegate_to: localhost
|
|
register: dns_test
|
|
changed_when: false
|
|
|
|
- name: "✅ Résultat test DNS"
|
|
ansible.builtin.debug:
|
|
msg: "✅ DNS fonctionne: {{ dns_test.stdout }}"
|
|
|
|
- name: "🧪 Test AXFR (zone transfer)"
|
|
ansible.builtin.command:
|
|
cmd: "dig @{{ ansible_host }} {{ member.domain_primary }} AXFR +short"
|
|
delegate_to: localhost
|
|
register: axfr_test
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "✅ Résultat AXFR"
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
{% if axfr_test.rc == 0 %}
|
|
✅ AXFR fonctionne ({{ axfr_test.stdout_lines | length }} lignes)
|
|
{% else %}
|
|
⚠️ AXFR refusé (normal si ACL strictes configurées)
|
|
{% endif %}
|
|
|
|
# ============================================
|
|
- name: "📋 Phase 1 - Récapitulatif"
|
|
hosts: localhost
|
|
gather_facts: false
|
|
|
|
tasks:
|
|
- name: "🎉 Phase 1 terminée avec succès!"
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
|
|
═══════════════════════════════════════════════
|
|
🌲 PHASE 1 - DNS FÉDÉRÉ DÉPLOYÉ
|
|
═══════════════════════════════════════════════
|
|
|
|
✅ Serveurs DNS configurés:
|
|
{% for host in groups['dns_servers'] %}
|
|
- {{ host }} ({{ hostvars[host]['dns_role'] | upper }})
|
|
{% endfor %}
|
|
|
|
🌐 Zone primaire: {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }}
|
|
|
|
📋 Prochaines étapes:
|
|
|
|
1. Tester résolution DNS:
|
|
dig @{{ hostvars[groups['dns_masters'][0]]['ansible_host'] }} {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }} SOA
|
|
|
|
2. Exporter DS records pour DNSSEC:
|
|
ssh {{ hostvars[groups['dns_masters'][0]]['ansible_user'] }}@{{ hostvars[groups['dns_masters'][0]]['ansible_host'] }}
|
|
sudo pdnsutil show-zone {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }} | grep DS
|
|
|
|
3. Ajouter DS records chez votre registraire de domaine
|
|
|
|
4. Valider DNSSEC:
|
|
dig +dnssec {{ hostvars[groups['dns_masters'][0]]['member']['domain_primary'] }} @8.8.8.8
|
|
|
|
5. Mettre à jour Registraire YAML:
|
|
registraire/membres/m001-chezlepro.yml
|
|
|
|
6. Passer à Phase 2 (Keycloak + Forgejo)
|
|
|
|
═══════════════════════════════════════════════
|
|
tags: always
|