Daniel Allaire
b5d68fe0c5
- underlay.yml : reseau inter-sites (172.31.0.0/30), requin (frontiere) et bifrost-1 (frontiere_pair, site SITE-Chezlepro) avec leurs cles publiques. - flux-genere/site-mon-01.nft : la patte du relais n'est plus une source de journaux. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
421 lines
7.1 KiB
JSON
421 lines
7.1 KiB
JSON
{
|
|
"hote": "site-mon-01",
|
|
"genere_par": "scripts/resoudre_flux.py (make flux) — ne pas editer",
|
|
"sorties": [
|
|
{
|
|
"vers": "site-backup-01",
|
|
"ip": "10.31.35.11",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-backup-01",
|
|
"ip": "10.31.35.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_backup"
|
|
},
|
|
{
|
|
"vers": "site-backup-01",
|
|
"ip": "10.31.35.11",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-cache-01",
|
|
"ip": "10.31.33.21",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-cache-01",
|
|
"ip": "10.31.33.21",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-cache-01",
|
|
"ip": "10.31.33.21",
|
|
"proto": "tcp",
|
|
"port": "3142",
|
|
"role": "serveur_artefacts"
|
|
},
|
|
{
|
|
"vers": "site-cache-01",
|
|
"ip": "10.31.33.21",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-dns-01",
|
|
"ip": "10.31.34.11",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-dns-01",
|
|
"ip": "10.31.34.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-dns-01",
|
|
"ip": "10.31.34.11",
|
|
"proto": "tcp",
|
|
"port": "53",
|
|
"role": "serveur_resolveur"
|
|
},
|
|
{
|
|
"vers": "site-dns-01",
|
|
"ip": "10.31.34.11",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-dnspub-01",
|
|
"ip": "10.31.37.21",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-dnspub-01",
|
|
"ip": "10.31.37.21",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-dnspub-01",
|
|
"ip": "10.31.37.21",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-edge-01",
|
|
"ip": "10.31.37.11",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-edge-01",
|
|
"ip": "10.31.37.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-edge-01",
|
|
"ip": "10.31.37.11",
|
|
"proto": "tcp",
|
|
"port": "443",
|
|
"role": "serveur_nginx"
|
|
},
|
|
{
|
|
"vers": "site-edge-01",
|
|
"ip": "10.31.37.11",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-forge-01",
|
|
"ip": "10.31.33.11",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-forge-01",
|
|
"ip": "10.31.33.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-forge-01",
|
|
"ip": "10.31.33.11",
|
|
"proto": "tcp",
|
|
"port": "443",
|
|
"role": "serveur_forgejo"
|
|
},
|
|
{
|
|
"vers": "site-forge-01",
|
|
"ip": "10.31.33.11",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-ops-01",
|
|
"ip": "10.31.31.11",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-ops-01",
|
|
"ip": "10.31.31.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-ops-01",
|
|
"ip": "10.31.31.11",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
},
|
|
{
|
|
"vers": "site-pki-01",
|
|
"ip": "10.31.32.11",
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-pki-01",
|
|
"ip": "10.31.32.11",
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"vers": "site-pki-01",
|
|
"ip": "10.31.32.11",
|
|
"proto": "tcp",
|
|
"port": "8443",
|
|
"role": "serveur_step_ca"
|
|
},
|
|
{
|
|
"vers": "site-pki-01",
|
|
"ip": "10.31.32.11",
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique"
|
|
}
|
|
],
|
|
"entrees": [
|
|
{
|
|
"proto": "tcp",
|
|
"port": "9100",
|
|
"role": "client_metrique",
|
|
"sources": [
|
|
"10.31.36.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "22",
|
|
"role": "serveur_debian",
|
|
"sources": [
|
|
"10.31.31.11",
|
|
"10.31.32.11",
|
|
"10.31.33.11",
|
|
"10.31.33.21",
|
|
"10.31.34.11",
|
|
"10.31.35.11",
|
|
"10.31.36.11",
|
|
"10.31.37.11",
|
|
"10.31.37.21"
|
|
]
|
|
},
|
|
{
|
|
"proto": "icmp",
|
|
"port": "frag-needed",
|
|
"role": "serveur_debian",
|
|
"sources": [
|
|
"0.0.0.0/0"
|
|
]
|
|
},
|
|
{
|
|
"proto": "icmp",
|
|
"port": "echo-request",
|
|
"role": "serveur_debian",
|
|
"sources": [
|
|
"10.31.36.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "3000",
|
|
"role": "serveur_grafana",
|
|
"sources": [
|
|
"10.31.0.0/24",
|
|
"10.31.31.0/24",
|
|
"10.31.31.1/32",
|
|
"10.31.32.1/32",
|
|
"10.31.33.1/32",
|
|
"10.31.34.1/32",
|
|
"10.31.35.1/32",
|
|
"10.31.36.1/32",
|
|
"10.31.37.1/32",
|
|
"10.31.37.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "5665",
|
|
"role": "serveur_icinga",
|
|
"sources": [
|
|
"10.31.32.11",
|
|
"10.31.33.11",
|
|
"10.31.36.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "5665",
|
|
"role": "serveur_icinga",
|
|
"sources": [
|
|
"10.31.35.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "5665",
|
|
"role": "serveur_icinga",
|
|
"sources": [
|
|
"10.31.31.11",
|
|
"10.31.32.11",
|
|
"10.31.33.11",
|
|
"10.31.33.21",
|
|
"10.31.34.11",
|
|
"10.31.35.11",
|
|
"10.31.36.11",
|
|
"10.31.37.11",
|
|
"10.31.37.21"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "8080",
|
|
"role": "serveur_icingaweb2",
|
|
"sources": [
|
|
"10.31.0.0/24",
|
|
"10.31.31.0/24",
|
|
"10.31.31.1/32",
|
|
"10.31.32.1/32",
|
|
"10.31.33.1/32",
|
|
"10.31.34.1/32",
|
|
"10.31.35.1/32",
|
|
"10.31.36.1/32",
|
|
"10.31.37.1/32",
|
|
"10.31.37.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "3100",
|
|
"role": "serveur_loki",
|
|
"sources": [
|
|
"10.31.31.11",
|
|
"10.31.32.11",
|
|
"10.31.33.11",
|
|
"10.31.33.21",
|
|
"10.31.34.11",
|
|
"10.31.35.11",
|
|
"10.31.36.11",
|
|
"10.31.37.11",
|
|
"10.31.37.21"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "3100",
|
|
"role": "serveur_loki",
|
|
"sources": [
|
|
"10.0.4.1",
|
|
"10.0.4.11",
|
|
"10.31.0.1",
|
|
"10.31.0.11",
|
|
"10.31.31.1",
|
|
"10.31.32.1",
|
|
"10.31.33.1",
|
|
"10.31.34.1",
|
|
"10.31.35.1",
|
|
"10.31.36.1",
|
|
"10.31.37.1",
|
|
"10.31.50.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "1514",
|
|
"role": "serveur_loki",
|
|
"sources": [
|
|
"10.0.4.1",
|
|
"10.0.4.11",
|
|
"10.31.0.1",
|
|
"10.31.0.11",
|
|
"10.31.31.1",
|
|
"10.31.32.1",
|
|
"10.31.33.1",
|
|
"10.31.34.1",
|
|
"10.31.35.1",
|
|
"10.31.36.1",
|
|
"10.31.37.1",
|
|
"10.31.50.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "25",
|
|
"role": "serveur_postfix",
|
|
"sources": [
|
|
"0.0.0.0/0"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "5432",
|
|
"role": "serveur_postgresql",
|
|
"sources": [
|
|
"10.31.33.11",
|
|
"10.31.36.11"
|
|
]
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "9187",
|
|
"role": "serveur_postgresql",
|
|
"sources": [
|
|
"10.31.36.11"
|
|
]
|
|
}
|
|
],
|
|
"admin_ssh": [
|
|
"10.31.0.0/24",
|
|
"10.31.31.0/24",
|
|
"10.31.31.1/32",
|
|
"10.31.32.1/32",
|
|
"10.31.33.1/32",
|
|
"10.31.34.1/32",
|
|
"10.31.35.1/32",
|
|
"10.31.36.1/32",
|
|
"10.31.37.1/32"
|
|
],
|
|
"sorties_externes": [
|
|
{
|
|
"proto": "icmp",
|
|
"port": "frag-needed",
|
|
"role": "serveur_debian"
|
|
},
|
|
{
|
|
"proto": "tcp",
|
|
"port": "25",
|
|
"role": "serveur_postfix"
|
|
}
|
|
]
|
|
}
|