387 lines
7.4 KiB
Markdown
387 lines
7.4 KiB
Markdown
# 🌲 Alliance Boréale - Phase 2 : Identité & Forge
|
|
|
|
Extension de l'infrastructure avec SSO (Keycloak) et Forge Git (Forgejo).
|
|
|
|
---
|
|
|
|
## 📋 SERVICES DÉPLOYÉS
|
|
|
|
| Service | VMID | FQDN | IP | Couche | Port(s) |
|
|
|---------|------|------|----|----|---------|
|
|
| **Keycloak** | 03010 | `sso.infra.chezlepro.ca` | 10.0.3.20 | C3 | 443 (HTTPS) |
|
|
| **Forgejo** | 04021 | `git.infra.chezlepro.ca` | 10.0.1.20 | C4 | 443 (HTTPS), 2222 (SSH) |
|
|
|
|
---
|
|
|
|
## 🚀 DÉPLOIEMENT PHASE 2
|
|
|
|
### 1. Créer les VMs
|
|
|
|
```bash
|
|
# VM Keycloak
|
|
VMID: 03010
|
|
RAM: 4GB (Keycloak = gourmand en Java)
|
|
CPU: 2 cores
|
|
Disk: 30GB
|
|
OS: Ubuntu 22.04 LTS
|
|
IP: 10.0.3.20
|
|
|
|
# VM Forgejo
|
|
VMID: 04021
|
|
RAM: 2GB
|
|
CPU: 2 cores
|
|
Disk: 50GB (repos Git)
|
|
OS: Ubuntu 22.04 LTS
|
|
IP: 10.0.1.20
|
|
```
|
|
|
|
### 2. Mettre à jour l'inventaire
|
|
|
|
```bash
|
|
# Copier le nouvel inventaire
|
|
cp inventories/production/hosts-phase2.yml inventories/production/hosts.yml
|
|
|
|
# Éditer les IPs si nécessaire
|
|
vi inventories/production/hosts.yml
|
|
```
|
|
|
|
### 3. Générer les secrets Phase 2
|
|
|
|
```bash
|
|
# Mots de passe
|
|
openssl rand -base64 24 # Keycloak admin
|
|
openssl rand -base64 24 # Keycloak DB
|
|
openssl rand -base64 24 # Forgejo admin
|
|
openssl rand -base64 24 # Forgejo DB
|
|
|
|
# Secrets Forgejo (64 chars hex)
|
|
openssl rand -hex 64 # secret_key
|
|
openssl rand -hex 64 # internal_token
|
|
openssl rand -hex 64 # jwt_secret
|
|
```
|
|
|
|
### 4. Mettre à jour le vault
|
|
|
|
```bash
|
|
# Éditer vault
|
|
ansible-vault edit vault/production.yml
|
|
|
|
# Ajouter les secrets Phase 2 (voir vault/production-phase2.yml.example)
|
|
```
|
|
|
|
### 5. Déployer Keycloak d'abord
|
|
|
|
```bash
|
|
# Déployer seulement Keycloak
|
|
ansible-playbook playbooks/phase2-deploy.yml --limit idp_servers --ask-vault-pass
|
|
```
|
|
|
|
### 6. Configurer Keycloak
|
|
|
|
```bash
|
|
# Accéder à Keycloak
|
|
https://sso.infra.chezlepro.ca
|
|
|
|
# Login admin (vault_keycloak_admin_password)
|
|
|
|
# Le realm "alliance-boreale" devrait être créé automatiquement
|
|
# Aller dans: Realm "alliance-boreale" → Clients → "forgejo"
|
|
```
|
|
|
|
### 7. Récupérer le Client Secret Forgejo
|
|
|
|
```
|
|
Keycloak UI:
|
|
1. Realm: alliance-boreale
|
|
2. Clients → forgejo
|
|
3. Credentials tab
|
|
4. Copier "Client Secret"
|
|
```
|
|
|
|
### 8. Ajouter le secret au vault
|
|
|
|
```bash
|
|
ansible-vault edit vault/production.yml
|
|
|
|
# Ajouter:
|
|
vault_keycloak_forgejo_client_secret: "<secret-copié-depuis-keycloak>"
|
|
```
|
|
|
|
### 9. Déployer Forgejo
|
|
|
|
```bash
|
|
# Déployer Forgejo avec SSO configuré
|
|
ansible-playbook playbooks/phase2-deploy.yml --limit forge_servers --ask-vault-pass
|
|
```
|
|
|
|
---
|
|
|
|
## ✅ VALIDATION POST-DÉPLOIEMENT
|
|
|
|
### Test Keycloak
|
|
|
|
```bash
|
|
# Accès web
|
|
curl -k https://sso.infra.chezlepro.ca/realms/alliance-boreale
|
|
|
|
# Devrait retourner du JSON avec config du realm
|
|
```
|
|
|
|
### Test Forgejo
|
|
|
|
```bash
|
|
# Accès web
|
|
curl -k https://git.infra.chezlepro.ca
|
|
|
|
# Devrait retourner HTML de la page d'accueil
|
|
|
|
# Test SSH
|
|
ssh -T -p 2222 git@git.infra.chezlepro.ca
|
|
# Devrait afficher: "Hi there, You've successfully authenticated..."
|
|
```
|
|
|
|
### Test SSO (Forgejo → Keycloak)
|
|
|
|
```
|
|
1. Aller sur https://git.infra.chezlepro.ca
|
|
2. Cliquer "Sign in with L'Alliance Boréale SSO"
|
|
3. Devrait rediriger vers Keycloak
|
|
4. Créer un compte ou se connecter
|
|
5. Devrait rediriger vers Forgejo connecté
|
|
```
|
|
|
|
---
|
|
|
|
## 👥 GESTION UTILISATEURS
|
|
|
|
### Créer des utilisateurs dans Keycloak
|
|
|
|
```
|
|
Keycloak UI:
|
|
1. Realm: alliance-boreale
|
|
2. Users → Add user
|
|
3. Remplir: username, email, first name, last name
|
|
4. Save
|
|
5. Credentials tab → Set Password
|
|
6. Temporary: OFF
|
|
7. Save
|
|
```
|
|
|
|
### Donner accès admin Forgejo
|
|
|
|
```
|
|
SSH sur serveur Forgejo:
|
|
ssh ansible@10.0.1.20
|
|
|
|
# Promouvoir utilisateur admin
|
|
sudo -u git /opt/forgejo/forgejo admin user change-password \
|
|
--username <username> \
|
|
--password <new-password> \
|
|
--config /etc/forgejo/app.ini
|
|
|
|
# Ou donner rôle admin
|
|
sudo -u git /opt/forgejo/forgejo admin user create \
|
|
--admin \
|
|
--username <username> \
|
|
--email <email> \
|
|
--password <password> \
|
|
--config /etc/forgejo/app.ini
|
|
```
|
|
|
|
---
|
|
|
|
## 📦 PREMIERS DÉPÔTS
|
|
|
|
### Créer organisation "alliance-boreale"
|
|
|
|
```
|
|
Forgejo UI:
|
|
1. Sign in via SSO
|
|
2. + → New Organization
|
|
3. Name: alliance-boreale
|
|
4. Visibility: Public
|
|
5. Create
|
|
```
|
|
|
|
### Créer dépôts essentiels
|
|
|
|
```
|
|
Dans l'organisation "alliance-boreale":
|
|
|
|
1. ansible-infrastructure
|
|
Description: Infrastructure as Code
|
|
Private: No
|
|
Initialize: Yes (README.md)
|
|
|
|
2. documentation
|
|
Description: Documentation technique
|
|
Private: No
|
|
|
|
3. registraire
|
|
Description: Registraire membres (Document 14)
|
|
Private: No
|
|
```
|
|
|
|
### Pousser ce dépôt Ansible
|
|
|
|
```bash
|
|
cd /chemin/vers/ansible
|
|
|
|
# Ajouter remote Forgejo
|
|
git remote add forgejo git@git.infra.chezlepro.ca:2222/alliance-boreale/ansible-infrastructure.git
|
|
|
|
# Pousser
|
|
git push -u forgejo main
|
|
```
|
|
|
|
---
|
|
|
|
## 🔄 INTÉGRATION CONTINUE (CI/CD)
|
|
|
|
Forgejo Actions (GitHub Actions compatible) est activé.
|
|
|
|
### Exemple workflow `.forgejo/workflows/lint.yml`
|
|
|
|
```yaml
|
|
name: Ansible Lint
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install Ansible
|
|
run: |
|
|
pip3 install ansible ansible-lint
|
|
|
|
- name: Run ansible-lint
|
|
run: |
|
|
ansible-lint playbooks/*.yml
|
|
```
|
|
|
|
---
|
|
|
|
## 🔐 SÉCURITÉ
|
|
|
|
### Certificats SSL
|
|
|
|
Phase 2 utilise des **certificats auto-signés** par défaut.
|
|
|
|
**Pour production** : Utiliser Let's Encrypt
|
|
|
|
```yaml
|
|
# Dans group_vars/idp_servers.yml et forge_servers.yml
|
|
nginx:
|
|
ssl:
|
|
cert_source: letsencrypt
|
|
letsencrypt_email: admin@chezlepro.ca
|
|
```
|
|
|
|
Puis redéployer :
|
|
```bash
|
|
ansible-playbook playbooks/phase2-deploy.yml --tags nginx
|
|
```
|
|
|
|
### Firewall
|
|
|
|
Les règles nftables sont automatiquement configurées :
|
|
|
|
```bash
|
|
# Vérifier sur les serveurs
|
|
sudo nft list ruleset | grep -A 10 "Keycloak\|Forgejo"
|
|
```
|
|
|
|
### Backups PostgreSQL
|
|
|
|
Configurés automatiquement :
|
|
- **Keycloak DB** : Backup quotidien à 3h, rétention 14 jours
|
|
- **Forgejo DB** : Backup quotidien à 4h, rétention 14 jours
|
|
|
|
Vérifier :
|
|
```bash
|
|
ls -lh /var/backups/postgresql/
|
|
```
|
|
|
|
---
|
|
|
|
## 🐛 DÉPANNAGE
|
|
|
|
### Keycloak ne démarre pas
|
|
|
|
```bash
|
|
# Logs
|
|
sudo journalctl -u keycloak -n 100 --no-pager
|
|
|
|
# Vérifier Java
|
|
java -version # Devrait être OpenJDK 17
|
|
|
|
# Vérifier PostgreSQL
|
|
sudo -u postgres psql keycloak -c "SELECT version();"
|
|
|
|
# Rebuild Keycloak
|
|
sudo -u keycloak /opt/keycloak/bin/kc.sh build
|
|
sudo systemctl restart keycloak
|
|
```
|
|
|
|
### Forgejo ne se connecte pas à Keycloak
|
|
|
|
```bash
|
|
# Vérifier logs Forgejo
|
|
sudo journalctl -u forgejo -n 100 --no-pager
|
|
|
|
# Tester découverte OpenID
|
|
curl -k https://sso.infra.chezlepro.ca/realms/alliance-boreale/.well-known/openid-configuration
|
|
|
|
# Vérifier client secret dans app.ini
|
|
sudo grep -A 5 "oauth2.alliance-boreale" /etc/forgejo/app.ini
|
|
```
|
|
|
|
### SSH Forgejo ne fonctionne pas
|
|
|
|
```bash
|
|
# Vérifier port SSH Forgejo
|
|
sudo ss -tulnp | grep 2222
|
|
|
|
# Tester localement
|
|
ssh -T -p 2222 git@localhost
|
|
|
|
# Vérifier firewall
|
|
sudo nft list ruleset | grep 2222
|
|
|
|
# Logs SSH Forgejo
|
|
sudo journalctl -u forgejo -f | grep SSH
|
|
```
|
|
|
|
---
|
|
|
|
## 📚 RÉFÉRENCES
|
|
|
|
- [Keycloak Documentation](https://www.keycloak.org/documentation)
|
|
- [Forgejo Documentation](https://forgejo.org/docs/)
|
|
- [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/)
|
|
- [OpenID Connect](https://openid.net/connect/)
|
|
|
|
---
|
|
|
|
## 🎯 PROCHAINE ÉTAPE : PHASE 3
|
|
|
|
**Phase 3 : FastAPI Pivot (C5)**
|
|
|
|
Services à déployer :
|
|
- FastAPI Admin Portal
|
|
- API Gateway
|
|
- Tenant provisioning
|
|
- Monitoring dashboard
|
|
|
|
---
|
|
|
|
**Version:** 1.0
|
|
**Date:** 2025-10-31
|
|
**Membre:** Chezlepro Inc.
|
|
**Phases:** 1 (DNS) + 2 (IdP + Forge)
|