From ef39f4352fbea1d598be57846d0d12b643ea1db6 Mon Sep 17 00:00:00 2001 From: Daniel Allaire Date: Wed, 24 Jun 2026 09:03:04 -0400 Subject: [PATCH] Decouplage moteur/instance Phase 1b : neutraliser la marque chezlepro Les fichiers geres par les roles (99-chezlepro.conf, chezlepro_filter, chezlepro-bind.conf, /etc/redis/chezlepro.conf...) et les 14 templates correspondants passent a la marque neutre du moteur 'setops' (git mv + references src/dest). Un loup ne deploie plus de fichiers marques chezlepro. Coherence src <-> template verifiee, ansible-lint 0 echec, diff vide, syntax-check des playbooks de groupes OK. READMEs laisses (exemples). Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 1 + roles/auditd/tasks/main.yml | 4 ++-- .../templates/{99-chezlepro.rules.j2 => 99-setops.rules.j2} | 0 roles/cloud_init/tasks/main.yml | 4 ++-- .../templates/{99_chezlepro.cfg.j2 => 99_setops.cfg.j2} | 0 roles/core_dumps/tasks/main.yml | 4 ++-- ...epro-core-dumps.conf.j2 => 99-setops-core-dumps.conf.j2} | 0 roles/fail2ban_ssh/tasks/main.yml | 4 ++-- .../{sshd-chezlepro.local.j2 => sshd-setops.local.j2} | 0 roles/journald/tasks/main.yml | 4 ++-- .../templates/{99-chezlepro.conf.j2 => 99-setops.conf.j2} | 0 roles/nftables_baseline/templates/nftables.conf.j2 | 2 +- roles/serveur_grafana/tasks/main.yml | 6 +++--- .../templates/{chezlepro.conf.j2 => setops.conf.j2} | 0 roles/serveur_nginx/tasks/main.yml | 4 ++-- .../templates/{99-chezlepro.conf.j2 => 99-setops.conf.j2} | 0 roles/serveur_openldap/defaults/main.yml | 2 +- roles/serveur_postgresql/tasks/main.yml | 4 ++-- .../templates/{99-chezlepro.conf.j2 => 99-setops.conf.j2} | 0 roles/serveur_powerdns/tasks/main.yml | 4 ++-- .../{chezlepro-bind.conf.j2 => setops-bind.conf.j2} | 0 roles/serveur_redis/defaults/main.yml | 2 +- roles/serveur_redis/tasks/main.yml | 2 +- .../templates/{chezlepro.conf.j2 => setops.conf.j2} | 0 roles/ssh_baseline/tasks/main.yml | 4 ++-- .../templates/{10-chezlepro.conf.j2 => 10-setops.conf.j2} | 0 roles/ssh_hardening/tasks/main.yml | 4 ++-- ...zlepro-hardening.conf.j2 => 20-setops-hardening.conf.j2} | 0 roles/sysctl_hardening/tasks/main.yml | 4 ++-- ...zlepro-hardening.conf.j2 => 99-setops-hardening.conf.j2} | 0 roles/systemd_ssh_auto/tasks/main.yml | 6 +++--- ...md-ssh-auto.cfg.j2 => 99-setops-systemd-ssh-auto.cfg.j2} | 0 32 files changed, 33 insertions(+), 32 deletions(-) rename roles/auditd/templates/{99-chezlepro.rules.j2 => 99-setops.rules.j2} (100%) rename roles/cloud_init/templates/{99_chezlepro.cfg.j2 => 99_setops.cfg.j2} (100%) rename roles/core_dumps/templates/{99-chezlepro-core-dumps.conf.j2 => 99-setops-core-dumps.conf.j2} (100%) rename roles/fail2ban_ssh/templates/{sshd-chezlepro.local.j2 => sshd-setops.local.j2} (100%) rename roles/journald/templates/{99-chezlepro.conf.j2 => 99-setops.conf.j2} (100%) rename roles/serveur_grafana/templates/{chezlepro.conf.j2 => setops.conf.j2} (100%) rename roles/serveur_nginx/templates/{99-chezlepro.conf.j2 => 99-setops.conf.j2} (100%) rename roles/serveur_postgresql/templates/{99-chezlepro.conf.j2 => 99-setops.conf.j2} (100%) rename roles/serveur_powerdns/templates/{chezlepro-bind.conf.j2 => setops-bind.conf.j2} (100%) rename roles/serveur_redis/templates/{chezlepro.conf.j2 => setops.conf.j2} (100%) rename roles/ssh_baseline/templates/{10-chezlepro.conf.j2 => 10-setops.conf.j2} (100%) rename roles/ssh_hardening/templates/{20-chezlepro-hardening.conf.j2 => 20-setops-hardening.conf.j2} (100%) rename roles/sysctl_hardening/templates/{99-chezlepro-hardening.conf.j2 => 99-setops-hardening.conf.j2} (100%) rename roles/systemd_ssh_auto/templates/{99-chezlepro-systemd-ssh-auto.cfg.j2 => 99-setops-systemd-ssh-auto.cfg.j2} (100%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7f8ac05..546a5fc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## 2026-06-23 ### Modifié +- **Découpage moteur/instance — Phase 1b : neutraliser la marque `chezlepro`.** Les noms de fichiers gérés par les rôles (`99-chezlepro.conf`, `chezlepro_filter`, `chezlepro-bind.conf`, `/etc/redis/chezlepro.conf`, etc.) et les 14 templates correspondants passent à la marque neutre du moteur **`setops`** (`git mv` + références `src`/`dest`). Un loup ne déploie plus de fichiers marqués « chezlepro ». Cohérence `src ↔ template` vérifiée, `ansible-lint` 0 échec, diff vide. (Les README gardent leurs exemples ; génériciser plus tard.) - **Découpage moteur/instance — Phase 1 : délier les rôles du domaine Chezlepro.** Introduction d'une variable d'identité d'instance **`domaine_interne`** (dans `inventories/*/group_vars/all.yml`). Les 13 rôles qui codaient `chezlepro.internal` en dur (zones DNS, FQDN, relais SMTP, AC, etc.) utilisent désormais `{{ domaine_interne }}` ; le `base_dn` LDAP et le domaine court sont **dérivés** (`dc={{ domaine_interne.split('.') | join(',dc=') }}` → `dc=chezlepro,dc=internal`, ou `dc=acme,dc=local` pour un autre loup). Comportement **identique** pour Chezlepro (qui pose `domaine_interne: chezlepro.internal`), mais le moteur devient générique — première brique pour partager l'outil à la meute (`docs/positionnement.md`). Ajout d'`exemples/instance.exemple.yml`. Non destructif : diff de génération vide, `ansible-lint` 0 échec. *(La marque `chezlepro` sur les noms de fichiers gérés — `99-chezlepro.conf`, `chezlepro_filter` — sera neutralisée en Phase 1b ; sortie du plan en Phase 2 ; deux dépôts en Phase 3.)* ### Ajouté diff --git a/roles/auditd/tasks/main.yml b/roles/auditd/tasks/main.yml index 2ae21eb..c044848 100644 --- a/roles/auditd/tasks/main.yml +++ b/roles/auditd/tasks/main.yml @@ -8,8 +8,8 @@ - name: Déployer les règles auditd Chezlepro ansible.builtin.template: - src: 99-chezlepro.rules.j2 - dest: /etc/audit/rules.d/99-chezlepro.rules + src: 99-setops.rules.j2 + dest: /etc/audit/rules.d/99-setops.rules owner: root group: root mode: "0640" diff --git a/roles/auditd/templates/99-chezlepro.rules.j2 b/roles/auditd/templates/99-setops.rules.j2 similarity index 100% rename from roles/auditd/templates/99-chezlepro.rules.j2 rename to roles/auditd/templates/99-setops.rules.j2 diff --git a/roles/cloud_init/tasks/main.yml b/roles/cloud_init/tasks/main.yml index 2704d87..076c3c2 100644 --- a/roles/cloud_init/tasks/main.yml +++ b/roles/cloud_init/tasks/main.yml @@ -8,8 +8,8 @@ - name: Déployer la configuration cloud-init Chezlepro ansible.builtin.template: - src: 99_chezlepro.cfg.j2 - dest: /etc/cloud/cloud.cfg.d/99_chezlepro.cfg + src: 99_setops.cfg.j2 + dest: /etc/cloud/cloud.cfg.d/99_setops.cfg owner: root group: root mode: "0644" diff --git a/roles/cloud_init/templates/99_chezlepro.cfg.j2 b/roles/cloud_init/templates/99_setops.cfg.j2 similarity index 100% rename from roles/cloud_init/templates/99_chezlepro.cfg.j2 rename to roles/cloud_init/templates/99_setops.cfg.j2 diff --git a/roles/core_dumps/tasks/main.yml b/roles/core_dumps/tasks/main.yml index 8692f11..43ed63c 100644 --- a/roles/core_dumps/tasks/main.yml +++ b/roles/core_dumps/tasks/main.yml @@ -1,8 +1,8 @@ --- - name: Désactiver les core dumps via limits.d ansible.builtin.template: - src: 99-chezlepro-core-dumps.conf.j2 - dest: /etc/security/limits.d/99-chezlepro-core-dumps.conf + src: 99-setops-core-dumps.conf.j2 + dest: /etc/security/limits.d/99-setops-core-dumps.conf owner: root group: root mode: "0644" diff --git a/roles/core_dumps/templates/99-chezlepro-core-dumps.conf.j2 b/roles/core_dumps/templates/99-setops-core-dumps.conf.j2 similarity index 100% rename from roles/core_dumps/templates/99-chezlepro-core-dumps.conf.j2 rename to roles/core_dumps/templates/99-setops-core-dumps.conf.j2 diff --git a/roles/fail2ban_ssh/tasks/main.yml b/roles/fail2ban_ssh/tasks/main.yml index ef300c1..4cb6824 100644 --- a/roles/fail2ban_ssh/tasks/main.yml +++ b/roles/fail2ban_ssh/tasks/main.yml @@ -14,8 +14,8 @@ - name: Déployer la jail SSH Chezlepro ansible.builtin.template: - src: sshd-chezlepro.local.j2 - dest: /etc/fail2ban/jail.d/sshd-chezlepro.local + src: sshd-setops.local.j2 + dest: /etc/fail2ban/jail.d/sshd-setops.local owner: root group: root mode: "0644" diff --git a/roles/fail2ban_ssh/templates/sshd-chezlepro.local.j2 b/roles/fail2ban_ssh/templates/sshd-setops.local.j2 similarity index 100% rename from roles/fail2ban_ssh/templates/sshd-chezlepro.local.j2 rename to roles/fail2ban_ssh/templates/sshd-setops.local.j2 diff --git a/roles/journald/tasks/main.yml b/roles/journald/tasks/main.yml index 7fc604c..462cce3 100644 --- a/roles/journald/tasks/main.yml +++ b/roles/journald/tasks/main.yml @@ -9,8 +9,8 @@ - name: Déployer la configuration journald Chezlepro ansible.builtin.template: - src: 99-chezlepro.conf.j2 - dest: /etc/systemd/journald.conf.d/99-chezlepro.conf + src: 99-setops.conf.j2 + dest: /etc/systemd/journald.conf.d/99-setops.conf owner: root group: root mode: "0644" diff --git a/roles/journald/templates/99-chezlepro.conf.j2 b/roles/journald/templates/99-setops.conf.j2 similarity index 100% rename from roles/journald/templates/99-chezlepro.conf.j2 rename to roles/journald/templates/99-setops.conf.j2 diff --git a/roles/nftables_baseline/templates/nftables.conf.j2 b/roles/nftables_baseline/templates/nftables.conf.j2 index f4ff347..2d9f48a 100644 --- a/roles/nftables_baseline/templates/nftables.conf.j2 +++ b/roles/nftables_baseline/templates/nftables.conf.j2 @@ -3,7 +3,7 @@ flush ruleset -table inet chezlepro_filter { +table inet setops_filter { chain input { type filter hook input priority 0; policy {{ nftables_baseline_input_policy }}; diff --git a/roles/serveur_grafana/tasks/main.yml b/roles/serveur_grafana/tasks/main.yml index d912ef8..e19e773 100644 --- a/roles/serveur_grafana/tasks/main.yml +++ b/roles/serveur_grafana/tasks/main.yml @@ -36,7 +36,7 @@ - name: Provisionner les datasources (Prometheus + Loki) ansible.builtin.template: src: datasources.yaml.j2 - dest: /etc/grafana/provisioning/datasources/chezlepro.yaml + dest: /etc/grafana/provisioning/datasources/setops.yaml owner: root group: grafana mode: "0640" @@ -52,8 +52,8 @@ - name: Deployer la configuration d'environnement (domaine + secret) ansible.builtin.template: - src: chezlepro.conf.j2 - dest: /etc/systemd/system/grafana-server.service.d/chezlepro.conf + src: setops.conf.j2 + dest: /etc/systemd/system/grafana-server.service.d/setops.conf owner: root group: root mode: "0600" diff --git a/roles/serveur_grafana/templates/chezlepro.conf.j2 b/roles/serveur_grafana/templates/setops.conf.j2 similarity index 100% rename from roles/serveur_grafana/templates/chezlepro.conf.j2 rename to roles/serveur_grafana/templates/setops.conf.j2 diff --git a/roles/serveur_nginx/tasks/main.yml b/roles/serveur_nginx/tasks/main.yml index 039a940..d5e304f 100644 --- a/roles/serveur_nginx/tasks/main.yml +++ b/roles/serveur_nginx/tasks/main.yml @@ -8,8 +8,8 @@ - name: Deployer le durcissement de base nginx ansible.builtin.template: - src: 99-chezlepro.conf.j2 - dest: /etc/nginx/conf.d/99-chezlepro.conf + src: 99-setops.conf.j2 + dest: /etc/nginx/conf.d/99-setops.conf owner: root group: root mode: "0644" diff --git a/roles/serveur_nginx/templates/99-chezlepro.conf.j2 b/roles/serveur_nginx/templates/99-setops.conf.j2 similarity index 100% rename from roles/serveur_nginx/templates/99-chezlepro.conf.j2 rename to roles/serveur_nginx/templates/99-setops.conf.j2 diff --git a/roles/serveur_openldap/defaults/main.yml b/roles/serveur_openldap/defaults/main.yml index bfb1024..7e33a48 100644 --- a/roles/serveur_openldap/defaults/main.yml +++ b/roles/serveur_openldap/defaults/main.yml @@ -9,7 +9,7 @@ serveur_openldap_service: "slapd" # Identite de l'annuaire. serveur_openldap_domaine: "{{ domaine_interne }}" serveur_openldap_organisation: "Chezlepro Inc" -# Base DN derivee du domaine : {{ domaine_interne }} -> dc=chezlepro,dc=internal +# Base DN derivee du domaine interne (ex. acme.local -> dc=acme,dc=local). serveur_openldap_base_dn: "dc={{ serveur_openldap_domaine.split('.') | join(',dc=') }}" serveur_openldap_admin_dn: "cn=admin,{{ serveur_openldap_base_dn }}" diff --git a/roles/serveur_postgresql/tasks/main.yml b/roles/serveur_postgresql/tasks/main.yml index f358d93..40301b0 100644 --- a/roles/serveur_postgresql/tasks/main.yml +++ b/roles/serveur_postgresql/tasks/main.yml @@ -39,8 +39,8 @@ - name: Deployer la configuration Chezlepro ansible.builtin.template: - src: 99-chezlepro.conf.j2 - dest: "{{ serveur_postgresql_conf_dir }}/conf.d/99-chezlepro.conf" + src: 99-setops.conf.j2 + dest: "{{ serveur_postgresql_conf_dir }}/conf.d/99-setops.conf" owner: postgres group: postgres mode: "0640" diff --git a/roles/serveur_postgresql/templates/99-chezlepro.conf.j2 b/roles/serveur_postgresql/templates/99-setops.conf.j2 similarity index 100% rename from roles/serveur_postgresql/templates/99-chezlepro.conf.j2 rename to roles/serveur_postgresql/templates/99-setops.conf.j2 diff --git a/roles/serveur_powerdns/tasks/main.yml b/roles/serveur_powerdns/tasks/main.yml index 4e8460e..6d661af 100644 --- a/roles/serveur_powerdns/tasks/main.yml +++ b/roles/serveur_powerdns/tasks/main.yml @@ -16,8 +16,8 @@ - name: Déployer la configuration du backend BIND ansible.builtin.template: - src: chezlepro-bind.conf.j2 - dest: /etc/powerdns/pdns.d/chezlepro-bind.conf + src: setops-bind.conf.j2 + dest: /etc/powerdns/pdns.d/setops-bind.conf owner: root group: root mode: "0644" diff --git a/roles/serveur_powerdns/templates/chezlepro-bind.conf.j2 b/roles/serveur_powerdns/templates/setops-bind.conf.j2 similarity index 100% rename from roles/serveur_powerdns/templates/chezlepro-bind.conf.j2 rename to roles/serveur_powerdns/templates/setops-bind.conf.j2 diff --git a/roles/serveur_redis/defaults/main.yml b/roles/serveur_redis/defaults/main.yml index af64148..6afe718 100644 --- a/roles/serveur_redis/defaults/main.yml +++ b/roles/serveur_redis/defaults/main.yml @@ -4,7 +4,7 @@ serveur_redis_paquets: serveur_redis_service: "redis-server" serveur_redis_config_principal: "/etc/redis/redis.conf" -serveur_redis_config: "/etc/redis/chezlepro.conf" +serveur_redis_config: "/etc/redis/setops.conf" serveur_redis_port: 6379 serveur_redis_ecoute: diff --git a/roles/serveur_redis/tasks/main.yml b/roles/serveur_redis/tasks/main.yml index e5ee026..1eda148 100644 --- a/roles/serveur_redis/tasks/main.yml +++ b/roles/serveur_redis/tasks/main.yml @@ -14,7 +14,7 @@ - name: Deployer la surcharge de configuration Chezlepro ansible.builtin.template: - src: chezlepro.conf.j2 + src: setops.conf.j2 dest: "{{ serveur_redis_config }}" owner: redis group: redis diff --git a/roles/serveur_redis/templates/chezlepro.conf.j2 b/roles/serveur_redis/templates/setops.conf.j2 similarity index 100% rename from roles/serveur_redis/templates/chezlepro.conf.j2 rename to roles/serveur_redis/templates/setops.conf.j2 diff --git a/roles/ssh_baseline/tasks/main.yml b/roles/ssh_baseline/tasks/main.yml index daddc37..ff4c078 100644 --- a/roles/ssh_baseline/tasks/main.yml +++ b/roles/ssh_baseline/tasks/main.yml @@ -14,8 +14,8 @@ - name: Déployer la configuration SSH Chezlepro ansible.builtin.template: - src: 10-chezlepro.conf.j2 - dest: /etc/ssh/sshd_config.d/10-chezlepro.conf + src: 10-setops.conf.j2 + dest: /etc/ssh/sshd_config.d/10-setops.conf owner: root group: root mode: "0644" diff --git a/roles/ssh_baseline/templates/10-chezlepro.conf.j2 b/roles/ssh_baseline/templates/10-setops.conf.j2 similarity index 100% rename from roles/ssh_baseline/templates/10-chezlepro.conf.j2 rename to roles/ssh_baseline/templates/10-setops.conf.j2 diff --git a/roles/ssh_hardening/tasks/main.yml b/roles/ssh_hardening/tasks/main.yml index 4c635c9..b83de74 100644 --- a/roles/ssh_hardening/tasks/main.yml +++ b/roles/ssh_hardening/tasks/main.yml @@ -1,8 +1,8 @@ --- - name: Déployer le hardening SSH additionnel ansible.builtin.template: - src: 20-chezlepro-hardening.conf.j2 - dest: /etc/ssh/sshd_config.d/20-chezlepro-hardening.conf + src: 20-setops-hardening.conf.j2 + dest: /etc/ssh/sshd_config.d/20-setops-hardening.conf owner: root group: root mode: "0644" diff --git a/roles/ssh_hardening/templates/20-chezlepro-hardening.conf.j2 b/roles/ssh_hardening/templates/20-setops-hardening.conf.j2 similarity index 100% rename from roles/ssh_hardening/templates/20-chezlepro-hardening.conf.j2 rename to roles/ssh_hardening/templates/20-setops-hardening.conf.j2 diff --git a/roles/sysctl_hardening/tasks/main.yml b/roles/sysctl_hardening/tasks/main.yml index 189e62f..46d82df 100644 --- a/roles/sysctl_hardening/tasks/main.yml +++ b/roles/sysctl_hardening/tasks/main.yml @@ -1,8 +1,8 @@ --- - name: Déployer les paramètres sysctl de hardening ansible.builtin.template: - src: 99-chezlepro-hardening.conf.j2 - dest: /etc/sysctl.d/99-chezlepro-hardening.conf + src: 99-setops-hardening.conf.j2 + dest: /etc/sysctl.d/99-setops-hardening.conf owner: root group: root mode: "0644" diff --git a/roles/sysctl_hardening/templates/99-chezlepro-hardening.conf.j2 b/roles/sysctl_hardening/templates/99-setops-hardening.conf.j2 similarity index 100% rename from roles/sysctl_hardening/templates/99-chezlepro-hardening.conf.j2 rename to roles/sysctl_hardening/templates/99-setops-hardening.conf.j2 diff --git a/roles/systemd_ssh_auto/tasks/main.yml b/roles/systemd_ssh_auto/tasks/main.yml index e6311fa..e808c9b 100644 --- a/roles/systemd_ssh_auto/tasks/main.yml +++ b/roles/systemd_ssh_auto/tasks/main.yml @@ -1,8 +1,8 @@ --- - name: Déployer le paramètre GRUB pour désactiver systemd.ssh_auto ansible.builtin.template: - src: 99-chezlepro-systemd-ssh-auto.cfg.j2 - dest: /etc/default/grub.d/99-chezlepro-systemd-ssh-auto.cfg + src: 99-setops-systemd-ssh-auto.cfg.j2 + dest: /etc/default/grub.d/99-setops-systemd-ssh-auto.cfg owner: root group: root mode: "0644" @@ -11,7 +11,7 @@ - name: Supprimer le paramètre si désactivé ansible.builtin.file: - path: /etc/default/grub.d/99-chezlepro-systemd-ssh-auto.cfg + path: /etc/default/grub.d/99-setops-systemd-ssh-auto.cfg state: absent when: not (systemd_ssh_auto_disable | bool) notify: Update grub diff --git a/roles/systemd_ssh_auto/templates/99-chezlepro-systemd-ssh-auto.cfg.j2 b/roles/systemd_ssh_auto/templates/99-setops-systemd-ssh-auto.cfg.j2 similarity index 100% rename from roles/systemd_ssh_auto/templates/99-chezlepro-systemd-ssh-auto.cfg.j2 rename to roles/systemd_ssh_auto/templates/99-setops-systemd-ssh-auto.cfg.j2