Daniel Allaire
8f6de3ebe2
Registres (source unique): - docs/nomenclature.yml: domaines, VMID, plan d'adressage 10.1.0.0/16 segmente. - docs/bases-donnees.yml: bases applicatives (1 appli -> 1 base -> 1 owner -> 1 DSN). Roles de service: - Reseau/edge/PKI/mail: nginx, step_ca, sendmail. - Donnees/identite: postgresql (consommateur du registre BD), redis, openldap, keycloak. - Observabilite: prometheus, loki, grafana. - Supervision: icinga (coeur; Icinga Web 2 differe). Forge: forgejo. Integrations clientes: - clients_metriques, clients_journaux, clients_pki, clients_ldap, clients_smtp. Inventaire et outillage: - make inventaire-ui: refonte (cartes, theme sombre, onglets, vue Chaine VM->groupes-> playbooks->roles), saisie du provisioning, auto-proposition depuis la nomenclature, deploiement securise (verifier/deployer, jeton anti-CSRF, verrou, mot de passe vault), robustesse reseau (connexions fermees, favicon). - Makefile: cible verifier-deploiement; detection d'un group_vars de production chiffre. - Scission serveurs_web -> serveurs_web_frontaux/dorsaux; migration de l'adressage vers 10.1.x; retrait des hotes de test; planification des hotes; requirements.yml. Chaque role valide en --syntax-check et ansible-lint (profil production). Secrets references depuis Ansible Vault (jamais en clair); roles non testes live. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
104 lines
2.9 KiB
YAML
104 lines
2.9 KiB
YAML
---
|
|
- name: Exiger les secrets PKI (Vault)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- clients_pki_ca_fingerprint | length > 0
|
|
- clients_pki_provisioner_password | length > 0
|
|
fail_msg: >-
|
|
clients_pki_ca_fingerprint et clients_pki_provisioner_password
|
|
sont requis (a fournir via Ansible Vault).
|
|
|
|
- name: Assurer le repertoire des trousseaux apt
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Telecharger la cle de signature Smallstep
|
|
ansible.builtin.get_url:
|
|
url: "{{ clients_pki_depot_cle_url }}"
|
|
dest: "{{ clients_pki_depot_cle_fichier }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Ajouter le depot apt Smallstep
|
|
ansible.builtin.template:
|
|
src: smallstep.sources.j2
|
|
dest: /etc/apt/sources.list.d/smallstep.sources
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Installer step-cli
|
|
ansible.builtin.apt:
|
|
name: "{{ clients_pki_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Creer le repertoire STEPPATH des certificats
|
|
ansible.builtin.file:
|
|
path: "{{ clients_pki_steppath }}/certs"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Deployer le mot de passe du provisioner
|
|
ansible.builtin.copy:
|
|
content: "{{ clients_pki_provisioner_password }}"
|
|
dest: "{{ clients_pki_steppath }}/provisioner.pass"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Etablir la confiance dans l'AC interne (bootstrap + installation racine)
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca bootstrap
|
|
--ca-url {{ clients_pki_ca_url }}
|
|
--fingerprint {{ clients_pki_ca_fingerprint }}
|
|
--install --force
|
|
creates: "{{ clients_pki_steppath }}/certs/root_ca.crt"
|
|
environment:
|
|
STEPPATH: "{{ clients_pki_steppath }}"
|
|
|
|
- name: Obtenir le certificat d'hote
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
step ca certificate {{ clients_pki_nom_cert }}
|
|
{{ clients_pki_cert }} {{ clients_pki_cle }}
|
|
--provisioner {{ clients_pki_provisioner }}
|
|
--provisioner-password-file {{ clients_pki_steppath }}/provisioner.pass
|
|
--force
|
|
creates: "{{ clients_pki_cert }}"
|
|
environment:
|
|
STEPPATH: "{{ clients_pki_steppath }}"
|
|
|
|
- name: Deployer l'unite systemd de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.service.j2
|
|
dest: /etc/systemd/system/cert-renewer@.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Deployer le minuteur de renouvellement
|
|
ansible.builtin.template:
|
|
src: cert-renewer@.timer.j2
|
|
dest: /etc/systemd/system/cert-renewer@.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Activer le renouvellement automatique du certificat d'hote
|
|
ansible.builtin.systemd:
|
|
name: "cert-renewer@{{ clients_pki_nom_cert }}.timer"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|