Daniel Allaire
27cba5442c
- flux-genere/ : ruleset nftables et sonde de connectivite des neuf machines, derives du registre des flux (make flux). Sans eux, le pare-feu retombait sur son gabarit generique. - plan/10-intrants.yml : forge_ssh_cle_hote, relevee a la source sur site-forge-01 et identique a ce que la forge presente sur le reseau. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
190 lines
3.1 KiB
JSON
190 lines
3.1 KiB
JSON
{
|
|
"hote": "site-backup-01",
|
|
"genere_par": "scripts/resoudre_flux.py (make flux) — ne pas editer",
|
|
"sorties": [
|
|
{
|
|
"vers": "site-cache-01",
|
|
"ip": "10.31.33.21",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-cache-01",
|
|
"ip": "10.31.33.21",
|
|
"proto": "tcp",
|
|
"port": "3142",
|
|
"role": "serveur_artefacts"
|
|
},
|
|
{
|
|
"vers": "site-dns-01",
|
|
"ip": "10.31.34.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-dns-01",
|
|
"ip": "10.31.34.11",
|
|
"proto": "tcp",
|
|
"port": "53",
|
|
"role": "serveur_resolveur"
|
|
},
|
|
{
|
|
"vers": "site-dnspub-01",
|
|
"ip": "10.31.37.21",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-edge-01",
|
|
"ip": "10.31.37.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-edge-01",
|
|
"ip": "10.31.37.11",
|
|
"proto": "tcp",
|
|
"port": "443",
|
|
"role": "serveur_nginx"
|
|
},
|
|
{
|
|
"vers": "site-forge-01",
|
|
"ip": "10.31.33.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-forge-01",
|
|
"ip": "10.31.33.11",
|
|
"proto": "tcp",
|
|
"port": "443",
|
|
"role": "serveur_forgejo"
|
|
},
|
|
{
|
|
"vers": "site-mon-01",
|
|
"ip": "10.31.36.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-mon-01",
|
|
"ip": "10.31.36.11",
|
|
"proto": "tcp",
|
|
"port": "3100",
|
|
"role": "serveur_loki"
|
|
},
|
|
{
|
|
"vers": "site-mon-01",
|
|
"ip": "10.31.36.11",
|
|
"proto": "tcp",
|
|
"port": "5665",
|
|
"role": "serveur_icinga"
|
|
},
|
|
{
|
|
"vers": "site-ops-01",
|
|
"ip": "10.31.31.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-pki-01",
|
|
"ip": "10.31.32.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-pki-01",
|
|
"ip": "10.31.32.11",
|
|
"proto": "tcp",
|
|
"port": "8443",
|
|
"role": "serveur_step_ca"
|
|
}
|
|
],
|
|
"entrees": [
|
|
{
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique",
|
|
"sources": [
|
|
"10.31.36.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_backup",
|
|
"sources": [
|
|
"10.31.32.11",
|
|
"10.31.33.11",
|
|
"10.31.36.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_backup_site",
|
|
"sources": [
|
|
"10.17.0.0/16",
|
|
"10.23.0.0/16"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian",
|
|
"sources": [
|
|
"10.31.31.11",
|
|
"10.31.32.11",
|
|
"10.31.33.11",
|
|
"10.31.33.21",
|
|
"10.31.34.11",
|
|
"10.31.35.11",
|
|
"10.31.36.11",
|
|
"10.31.37.11",
|
|
"10.31.37.21"
|
|
]
|
|
},
|
|
{
|
|
"proto": "icmp",
|
|
"port": "frag-needed",
|
|
"role": "serveur_debian",
|
|
"sources": [
|
|
"0.0.0.0/0"
|
|
]
|
|
},
|
|
{
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian",
|
|
"sources": [
|
|
"10.31.36.11"
|
|
]
|
|
}
|
|
],
|
|
"admin_ssh": [
|
|
"10.31.0.0/24",
|
|
"10.31.31.0/24",
|
|
"10.31.31.1/32",
|
|
"10.31.32.1/32",
|
|
"10.31.33.1/32",
|
|
"10.31.34.1/32",
|
|
"10.31.35.1/32",
|
|
"10.31.36.1/32",
|
|
"10.31.37.1/32"
|
|
],
|
|
"sorties_externes": [
|
|
{
|
|
"proto": "icmp",
|
|
"port": "frag-needed",
|
|
"role": "serveur_debian"
|
|
}
|
|
]
|
|
}
|