diff --git a/.ansible-lint b/.ansible-lint index d98efd4..0e01ba3 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -2,6 +2,7 @@ skip_list: - no-changed-when - load-failure - document-start + - meta-no-info warn_list: - experimental # all rules tagged as experimental diff --git a/bdd.yml b/bdd.yml new file mode 100644 index 0000000..7a0bf6c --- /dev/null +++ b/bdd.yml @@ -0,0 +1,7 @@ +#!/usr/bin/env ansible-playbook +--- +# Install and configure bdd servers at Saclay and at OVH +- hosts: bdd + roles: + - postgresql_server +... diff --git a/docker-ansible-lint/Dockerfile b/docker-ansible-lint/Dockerfile index 5d60549..1db9744 100644 --- a/docker-ansible-lint/Dockerfile +++ b/docker-ansible-lint/Dockerfile @@ -2,6 +2,6 @@ FROM python:3.9-alpine LABEL description="Aurore's docker image for ansible-lint" RUN apk add --no-cache gcc musl-dev python3-dev libffi-dev openssl-dev cargo -RUN pip install "yamllint>=1.26.0,<2.0" -RUN pip install "ansible-lint==5.0.0" -RUN pip install "ansible>=2.10,<2.11" +RUN pip install --no-cache-dir "yamllint>=1.26.0,<2.0" +RUN pip install --no-cache-dir "ansible-lint==5.0.0" +RUN pip install --no-cache-dir "ansible>=2.10,<2.11" diff --git a/group_vars/all/vars.yml b/group_vars/all/vars.yml index 599e834..6244182 100644 --- a/group_vars/all/vars.yml +++ b/group_vars/all/vars.yml @@ -17,9 +17,17 @@ ldap_admin_password: "{{ vault_ldap_admin_password }}" ldap_admin_hashed_passwd: "{{ vault_ldap_admin_hashed_passwd }}" # Databases -postgresql_services_url: 'services-bdd.adm.auro.re' +postgresql_services_url: 'bdd-ovh.adm.auro.re' postgresql_synapse_passwd: "{{ vault_postgresql_synapse_passwd }}" postgresql_codimd_passwd: "{{ vault_postgresql_codimd_passwd }}" +postgresql_etherpad_passwd: "{{ vault_postgresql_etherpad_passwd }}" +postgresql_kanboard_passwd: "{{ vault_postgresql_kanboard_passwd }}" +postgresql_grafana_passwd: "{{ vault_postgresql_grafana_passwd }}" +postgresql_cas_passwd: "{{ vault_postgresql_cas_passwd }}" +postgresql_drone_passwd: "{{ vault_postgresql_drone_passwd }}" +postgresql_wikijs_passwd: "{{ vault_postgresql_wikijs_passwd }}" +postgresql_nextcloud_passwd: "{{ vault_postgresql_nextcloud_passwd }}" +postgresql_gitea_passwd: "{{ vault_postgresql_gitea_passwd }}" # Scripts will tell users to go there to manage their account intranet_url: 'https://re2o.auro.re/' @@ -89,3 +97,9 @@ apartment_block_dhcp: "{{ apartment_block }}" ipv6_base_prefix: "2a09:6840" is_aurore_host: "{{ 'aurore_vm' in group_names }}" + +rsyslog_outputs: + - proto: relp + address: 10.128.0.241 + port: 20514 +... diff --git a/group_vars/all/vault.yml b/group_vars/all/vault.yml index 1a6af68..aba5f3e 100644 --- a/group_vars/all/vault.yml +++ b/group_vars/all/vault.yml @@ -1,181 +1,210 @@ $ANSIBLE_VAULT;1.1;AES256 -31333135363439623565336435306566656236316266316330623236643862616666326332633937 -3130356563393965626334373564623336633061303264660a646662636364313031316438396439 -36653532656533626535376662393061666430666536356430623030376335636530313237623038 -6133333636323234320a323433376539333265333837303631316637346561383861656662633536 -32313839336431663466633764363937316439636439373732646163663664363665623065616335 -39376463656566376666303635323830613533363638623436396536626634613137353232656434 -63646233636666363932616432663536386630613466386437643534643136383362633264383232 -38386335376635383465393465343065636330383664386435643762353435623161613235643934 -35393038633163343862616633313836626138663237313062356330343562383964383031663834 -31313338633063343665323438313162643039653136373163623533626630356534636436396237 -65363238613665326437386233613861666638316362343337323462623736383263383231383663 -35393832363231363163646430363263326538306136303864393830373163663036383364666563 -64356561656537353965396631343261643431323034386263313139303932663932306631373932 -65616132666631666266353935363262343733646431333436396438313466366566366231313236 -61346539616131316562343939623432303236386662303036643131323632366231626330333333 -62353533613264313434643834386462386139306362373039663730323263326239386130376162 -33383161666538643535646132306262366535666563366661386132376162336237613164313634 -66316530393164376537666135636632373735336636303634323866333930613362643439373331 -65353736333264333636336238653064376538623135313730393634623939636365383932326338 -30333231376366323033316364326330323065643364613538306661303032303239613335646237 -39333335366163383561336233643830626432623336333864343239643534376339303231323563 -31343539616266383461613666356665353036343533626332376661303565376162313666333338 -37323332303765396362643732343935656664396136396361336533663335353663326233373664 -63396265656538623238363532613532623633386531336236363363383765366335396532653161 -63613736653863336235356336393839336530333930663539663536353963336331646630333334 -30313436313335383365306463316338623033306634316332373732346630646430613630616236 -61373430653238373161626436303264363662313565623862356266313930623162626535363765 -64653136356364326238313136336335396131393637363432383961616636373839303132353932 -30623366626236373861303838396562653131633436303862393166353930336636303765383438 -36663863323337393061333735306663636564313966326561666436393562626562653764336162 -62383235646539323861663438373365373239323731626236333263383037333065646433363464 -66386435363938646538343262636331353064646330623439303166643538306130616236313532 -31663238326465646562306265346132346138346363313532363566373436356630323130306363 -35346463326136303532386433336137656639616165646562373533653663643031343533346565 -65633237333431643038653830383836313538343033386665346431336235636133353637643234 -32666361656137323130656331643562353135643861323438396135376532373437616333336631 -35393366336438383666656165313634336133653238653464343730333739323539386331336461 -32653563353032643730633530303636636439316139653231343738616131626438633561363239 -37383533616565373162373832653730646265663864316335393938303465653035306138633437 -62306433656365333561643333656564666565633638353730353764336561333536666136313235 -35333133396332626637373962376130303838633131656538333634653861613639653165363930 -32313436396161306235323861363265626134656566626132353362313830383638643739333765 -65346636306366343863386238316530623338613038643933353839366434316339333430336230 -63353839356536666165326138376163386534616661323834336163306632343536613034316335 -64386433386637666430303338626635386131373134393530643963613966363965623763393133 -38333337663630656366393338383230396431616535323864383235636337363336313036323139 -32626566353261653734366237363131323431396665333638376637316536656434303434343133 -61316564333536643331613437623764396232636461326435343735383563353236313238643638 -32366463363530343866333334356166393433376563333563353135633336666434643435373766 -33663130383436333961373535626334333931643030303834373330396530643837386364393933 -33623835663833376263303237653063313861386333393262326335333365653164343561643135 -66393962613933653762396566316338333861656361303939393631323163373133653135396237 -34376232383638303861383462366564316537663064373865343037303638363337373435613433 -38653137383561646634306334393766343837666333313135616365373633326230303437306566 -31373161666463313131383434333530363163376637373637353531383463613364613032393638 -31333938626464656465366639353631316337376135393765383562306166633364396536356633 -63346434636636393736386234616534393462306335303135386566666635623431306133366665 -36333762353130303264613232323362383762653837616432353561643030656439616163396664 -66313735366266643364333665343765393264646630653638363563313338316633303639646563 -36306538616237343064366139313533386639333734333131636636343064623237626365313163 -30323438613564633739613733386430633839303331303238303762643664343132346637386465 -31323732313166383562323161316139333532636238613661373639383539366231663436346664 -33363439313964613938666338333135396633396635383964613736306436636364616131656533 -62326263313935393339373837633132653339366133653136653032666563613839643334396131 -38353032316336343765366439326230333535653630313065366632643133393063353438633362 -39346132623530336437623530623662333438393361633861356535356535306137666334373232 -64313465303961616133666335643338316331373164663966333762643964363538323637643338 -66323563653364303538633630316562386230303634323966313935363439666464396262396564 -37633636623835373832396462613665316461396662356664383938333963333566643861306363 -34663461663633386464643961393137636365343566373262376432613264393536326136613763 -66396139663861336432386233333335383165663434356563373031656330386664353635616363 -32363963336463623131383536313233646462643137366365366337303430313131393764396537 -65376438663733626636653564386631396337343236353631353638626330313763343632303963 -38323035333737366562356431383535333639353866613264656336636330323637623033336165 -36326136333232643539336230353165623835356665623736313166613262336136326432323163 -39626337333464376331616664653366333430363631623138383861393366646437353364623838 -34363063653830316339303131306537346137653166316633343764363630646133313062363962 -36336530626162393733303432656133663233633765656239353161303431633164653331346664 -36666465656264643737383031623834643334346637653162343436376631366534623863626431 -38313766396366646634613533623231393632366562323263326461653239663037656539366333 -38303562653839313266616266383666346438343963633231326266653562663462633534383063 -62663665383237623632376461363834396637626537613834626132643165323735646139386232 -32353034313330383835366464663838306133613430316237303831343935653238353565666666 -37666364323939303164323463313636613861623963333534323033326662313662336132333565 -63643935353432643332323932333735643564313231313563366464666132646333336230653066 -37393564643734323634383266616632336430396530633732306566376564656434313762323863 -35346439393330616234666638653036363034643064366436363638383664626530653463636536 -39356135633836613430346532323732396538363735343232653666323963366433643238346134 -39363637353939356464373064373063663730386334366433386134656265613731353231393333 -31333830303966636130303463336566386266326338333663656635356139373039666435316137 -34353934646136383263353336363134383331656333366463646630646264343533653735303161 -65613666353339663565623230656162653135323163656435633132663265386233363930386165 -31663861373162303338313265613536393533313738626464336238303830366636303131623863 -37656330616336633437383937383235616439376532343166643966623437303137306262653036 -61636237656332613232356130333237346239616639616234656534303837343832316330333266 -30353235626666646136326666373030303963326533336365366466313637626466376261386132 -39303164396236303232346234303265333531353031633937633236626664346130336535646133 -36333833386362393935303663353062653836356564346338613938313532313637306230326465 -33393464366231643033363230356566383938353434613737346233376530336537306562353034 -31313938613732383330383239323564643531363733633666326664353330386137383263623330 -61623534646463663231333561333431643563633065663864613562326464386330633839363065 -32396266356462613562373533306432663866636165326330396634653332323165313565353635 -32343533306564306631626331303634633036613730326636643961663064353138633362356630 -33373235656561303738303263663436396162643532303264333137626138353938643261353564 -36363465386339326634663563616662633634363337333462653166333233343038633062663334 -32356435663738643531333539663936316535333836323934663831623039323264356562663463 -63323165663836616364393932333137363037323034323632323165396664353766343138306431 -65393165373561373064396530633230383963333562636661653062616437333037316462663335 -34613661653663376663613531383764646438396666623661363461653133303939626665366430 -37613331666333356566356432313831663737386362363436636239306431373534366164346631 -32306361336363376337376333303035333763306138333238303030346434363662653766323635 -36653336663635323939623430316330643837376332326136643136653039613366336438383437 -66623530363333313339646233373430646163306165353430363663353331613762623031623935 -33633062343562646235333130393263373936633731663362346631653731363765646361353436 -63663532313130653634316530663361323536373031373031316561656238653333333331376436 -31646636393062656166316161343438326564373333356465626463346139633836366634316238 -34313166613666356535306534646163363664363066393331666564613230303362613666313938 -37383065633064303661663666386566613664616163343034383766376638623364396136373839 -37303035383733336662643932393636393037643861613633333265643333333332386366626164 -63633436396264383035666334633336633065326339303062366334633865336134623134316238 -64396266323139396238616137623166373362323364313936396266366532613261353735336133 -64303935323231656237653134396134316130376262323633333863333238363137646131386634 -31616133306531643338356235613837356135303938626539323139326633633939613330653434 -37333263633739326230666339646463633933343163323365363761353166353066373430646432 -31386535633661643862356663353166396236633266333635353864303532363362643561313334 -38303364396661316266626335396265363234373532353130353639646331626230303932393136 -38613463306561653765666562656136353531313433643162313137633535313263373035616233 -62363339313662373833333630376466396265336638373361646434666636396333383063636462 -33396236653130363862336630313362643565613962396439326531336339373466383138303861 -64306135386337323437386331346436653466653863353836623339663037666235653962373832 -36393036353533313437333033366266653964613766663331393363626532343866616538633264 -63336461623838376234343265663933613965646666633132346433353463383839383263613530 -36396361346534353834633835346362336164343932386363383637326433326439623532623634 -38613335343734613335373761663935626539373534383335613966373334353763323135643666 -32353530613163303866343832323131363363306638613336366132343633623861626630613866 -31393261316637323764656535643837333265616562336634383464393561363932313237613162 -32616562336335613864363063336564393536373734373930353436653563643935346636333631 -33633766666635393232636464313063646463303564656663613666303234363138613533376138 -30613935663362626432303266356435653566363439663763306233663261633465323933326437 -32663962663932326263666461613365623264346539343033663566366137313732383839343633 -39616363656434623666316639616136333431613136386439373739363862663466383234393962 -35373966386235343535663362343464333531623136326565333633386561633132623762306466 -32626166333430303161366638346336386534303838653737393731333238346435383134396561 -32376435663363373037613332653333656166353530393635636466666438306531633535346630 -63623831303435643761313836316435656465366331363930343637663439613738653363366438 -35316337626234393932306432363631656364356237316233306638396438326339373866613063 -64346338336239636535386130396465323333313337366263623362353838653938663161333539 -64303063323838303030303635653038353432313333346632626330313539613266613362333837 -63643735613363313163346233353535333434316337643961353635353465363238616432366434 -35383736343765643166633033643462396634306163346235306438323264383438653635346433 -38326431666336623635633531366562343830646434343964303837393864303836313434626230 -35613437383034303761333763303432666630356135653637373936363331643032376437646630 -64663561666238386536616630343763333661643762396462616239396536386634353431376266 -34316433623037366330346633656365356136626363343461353137646632343533323361636336 -62323939323732346232626264373964303134626532323937666537356361393461366133633731 -62383037326563386266656464313331383733303837343465393234343730646138636263396636 -38353262323064313131623738633835316338666530383335363565306432376132656634313264 -33663237316437396432386130646664623065353361346263623637383630323136643262343865 -62616230623631333864643831393438373964383037616265316337623335313265323135353935 -33396530333935646437613931383137646233346664636363623561393336623062623039306362 -62653966623636363562393336646164663631366334346361663039313161663765326634656238 -35613239653536663639666137393963613231323134343639343061663935626162316664316539 -32313639363335613063303664646163663264333565323934323264656438343831643964393635 -62333061323861373433363638336363653265613331653665396563386362326336313430646438 -30343936393166323033666131653734366439623937616665656133646639333739323538343764 -62373335363038616239626638643933336433663631353263346365616366343061306430333031 -39623466373633363565626331303463363964313638356632626663633533373764626664626434 -34366336626466356332393335626433636438623866383232663937653465313439316635643334 -30663861383261363830303863373961653135393764613435363939356266363836363066333835 -30626263376438353765376235663339366336653337333638343666373235646339313139333966 -66373262306164643536376539653432633265623437306634636132303934313036623736613337 -64353638373262346564653563653966636137383633366264306630326337396132633231343831 -31663439643737636661343834663364313734326437373430306430303134613933326633383838 -38356630386566313830363464313262653038353064363466323064656433636663633637656631 -62663233623766353962666332663064653266393937346162643731633139326362316134353438 -38383765343631396132636663363465633533636532393835383730393066306633326364646337 -32363238363365366331303665313634653635303032356137663364343161326132613039343162 -35386633366464383138646630653365636133313964333435373533313163343235643036343531 -63356139353739633565363165356464396332663564646466383637643837623565613837376431 -61643538326230623763 +64396638346335393963396239326463353436373937386664393164373338376461636666326432 +3839376164613031613166313535346136396465383365660a376666373138363930393761376166 +35663763316466336162316335623362633131636264663239316264666234393637333931616139 +3434636563363237300a663032636362343739343363356363643035363431373963316161303666 +30343866336465623738613739333030323537376663383265306237346537313839656137353565 +61303237643462626564346539343933313334663330323565396438663633316239333064376664 +31356233363431313161643131303234616162613164643539643563613339313432333235383863 +61376431316661626465383562386235616166353839616235356366386534393334373064616636 +32623832643533663536626130333234366366366635393038393437313139383061633030653235 +63666366333732626166653831613731363865313461636262346635666363373938316266383738 +33306632353536663138663961623964636436373564376431623165623031353737366539313966 +36373533653139373866666435343730613530646665343333643764666263626433363262313337 +65396332666632323531333364666330366430356437383338303665646233383931306166326435 +35653538643332353536626336323034353630353564633264333334613531363839653362663730 +36326562383934363034363830313139393361363638623139663538653138393533626238303836 +38326561366536353036356163656130633430306635393763663664643936306136346163383237 +37653465656335306565333432643863623762366134313137326138613336323664323333313166 +66363438636161613362346633346434663364396536613932616461613963383339336262313731 +36636432366332356435643266353362333437333131343961336639343234363636353535636464 +39353330643136613463343435623939653964346334616131393566623330386131333262666539 +35656662323332373330353231393462646564393431646238653438386563633365333162656263 +62623536316165316662653832393364316439303865326631636337373365333035336339666666 +31323864303136616365643735306332326237666136306435626534363739373332656332336639 +38343566643062616434656338646235343234333031343038346630306639633732623733313039 +33393965653839396166326565653963303137316666663135373338613265613239643661336537 +62306634326266323662623733346164383039653936326162663165316439653332313730313535 +66613335653463396662626230653232383664363137323462353037303633633666626433306630 +39623933343736616630333539393365396636366331393136343866323766656435613262383938 +65383663663237386631333236363061306131643133336432313035396264346631656264356530 +30663636653434323531343233633431313838636434666537373439333364666635363731316464 +61623666653561623233623131666464396530316439626135653933343531303938313965393438 +30346636363136386264643161666231396533323765343434346633303162383762663763616537 +38656436353661326165393934613235376565316663643930656338333932633664643562633235 +61656232613164643735626439393731626430343437303732393163616432616336323436643737 +63626564363464396561356366616466363035663864306561616164373639376431633264633532 +37316565313636363536666566313663653637333665343036363261373765306233386535326463 +34316461346364323837326462386363313338666563623135376163656330393830663031326536 +35373935636538656566646336633435643830346136663262386463366563613665613032336533 +36373837616132666630393634656232303362613038353764353362303830323536373639306666 +66306230336430666435663061616264343137303564303764356130396434666138373132323066 +33623465663535643736383032396236613632643537633064346631383539366330363436666633 +34323133626638613936636264346662373739616136663165626339326333623365336161653230 +65626131643832306664666364333961633535313164376533343334613666303331333036643431 +65626566613937633137343538323563373737623265353436336234316439316434613962313030 +36366634383633363437373862323764366263623063653932383534353538363866643437303637 +32346533643438323632653830626163666463343366346531383830353833346164313537326332 +62623462316161663731653832653064313436633931393565323631306134613962396338353039 +39323037366235336239646539643265303061623935636263336435653831373463313131343866 +61666265616335356530376633343762343734373539613865333065343066343963383634653436 +34363431356264373166663632643232646261323332636263383065356564383663363439373732 +31636238346661616563646262353962393266613137363536346534313764376666313737306530 +63666263346231353765623130396530623362383165373863383537633464636136313130373566 +33396137366538656430653065373230376236626439316232396630326537653936356461623534 +65623562306131613633373632356264366439373137356132333062343839383132643834323463 +31353034306339663365343234396466396463663634613433663262623038363331363161623831 +33366137643963633066323837363563326137383834346430316262353834353238336264373235 +63353330656166333132306665623835316439623239333539626364313535616230626430313663 +32323335653433303233343336663935653861393961626636623264333030383365623838653862 +37663336346537336530656161613539666431366239666461343139343461613033336535306263 +66326365663132333165666239306532386338323237653832363763386464333634383731393033 +31666431366432303036313765616432353061616462393236383131373938353238613966383232 +35376635326534386533653834353966633765303165633036343133393836316637313531636333 +32376532383865323731306237633565663032666631616463636237313938663034396363373632 +62613030666166343262333865636363346131393664373633313064656463366533336335316435 +31653531366436646365636139663236393464636366666334336433396365663634336263323835 +64653634326638393133346335343665343265333133363236343566366561653831313561326239 +66393663336632333931383766633966333763333632393633353537333834643465373237386435 +33366638643861386431313030623465633938313932326264396136353336653163373636633762 +35313463313066373236623466356333616238343034616436333437363033343436353265613932 +36646538663734346434313861363664316538663766383462633434343666343230306261663231 +33643031313432333330363664396438663933636465303731373065386539363762353530323063 +34383434393062623037356637323264663961383166373736376136336237613662363038343931 +39393766323163333431373466303739363566623464646532666330653132376466346136303735 +30303537353863623164373362306334333134616364323366326636323463346461326366303034 +33646230333263366137313234646265653339326533666361363632653166326364336639333131 +66346234366334316539343734633164656132343130303939613030346263616632616434653362 +66316165626236343464373631623034396634313637303737643165303939333130313333393732 +34663134373864626466376332373731393039336336383937646535666362386666663765623132 +66313363313162323663356230383231376539363732396630623061663361373866316432623066 +36643739363361373833616237353664313666613036666161623935343233346266626165393134 +32346361323462393830366161646630303836376431316566613631343938316362383663343233 +64376265353166303032373664336632616337353339643061623661663066363433616239356561 +34633339323161396466663435396565383636653830373865346363333531396637633332653866 +38633535333035343630323633363564613030653834333538616461653566636638646137396266 +66613235306361653463643532313435383366326430383031306665373764643632653962623535 +61363438336136383635386336363533613863346264353530303565353761626466636136306335 +31383035326163393563383038383037353037666661363531633836376638393935336639333761 +62333030326639623034326331643033326431396337376630333937623063313634353032326530 +66393261663331313139643232313661356664653536326665363065646163626236306637666163 +33373837343331306632623865316461336466656131303638303035366564336330613234616535 +35356361623634646163646436623364353539623131333966383632383566313363613032393363 +65313136383834366564643234643039386664376362353435613433373266616261633263386334 +34616633653735373361656461363462636666656661326637363262363539613164336464336631 +31326535626635333662346433656262633031643134623862653831643333396633363062356361 +37343530643633663261323037333830393737366134303035333232343232333835653731623332 +62333739346563353737386664663864343561306164333432306231626233646131333264656666 +30356138376336373436333732383835303230323039326165633834336634626162326439613961 +39613435326330383662373732373537633535633032366131633062386332343264363135383038 +63643661653838636565616239353566636137656139323265326534386434306333343631353762 +32616466323663653564363832613265323534336664353965363138623762376539346338316135 +65303334313362303532653438313837336334333831343331396563626131633937386437333133 +36663834303337666461313564366561353265363263316438303235393465646434663961646137 +37646332306539393162633339643434396531663534633763616433326363383332373233636437 +61643037396361623938386466313736313235323165343964346463346339626632383535323630 +33396135303434666233353631616436653262646136623035376232316264343930626435303634 +32646133303963343239383931653631653036353535333665373536366464366466646330656466 +66623136333437346637343534396430313838636665663933376263623362363134396330356566 +37616361326463323164663036386439373539663164393038663636643166383131616164643765 +63303339653835353161663637323138376233613265373461316430353331633938336662656464 +66613464666634363931303232326461653239396234303863386533333832663530346261353135 +63656636306539353139353763663461336630373463353162623566383230366366653665326166 +31393333376434313039396234393839643863346363383535653465323261666432633935336135 +63363864386135313438373532353266353334616635653433613765393265363465656439356139 +30643864343166353263633262663036613766396633343564363633303165373631633965373730 +64636561663438646562363765623435313866303534623038383731396638306536323732626231 +63343538616631363736336164316531653137646537303436343336653434646133336534356539 +64306139643537393361666161623261353763646631386361666637656137633266343238656632 +32333866666233636164313131363666376261663930653330393436666464653731333164643836 +63386163363463343737386338653636323230653336393765386538393563356435646439626565 +38623439623364326634616639303734383330613133393665643963313932316365656563383039 +61643739333434366162663438613966343534393438373135643064623465386236353632646562 +64346137393231313461393436626335626461343661653430396536373437306336666630313934 +38616638336638303530346164663033613332366133656435656131356262343635386136636361 +39623161383636373664396535366531396231643162353938663230373762626633663638343937 +66326533386564353336366561316361646333393130316530366434383931666661646636373835 +64323135356630656134366231646130626162356237613337386232636333383261376535653032 +36366338636565616537313337323964613030393035393839626134373135646663636263633964 +66623036633266623566646566386234356562396164366166656230663738633665333531653730 +61383263656235313463666439666563656432363332616633646139363135316638613464383239 +32633732653837326332326363326265336130633065623963636338323662383234623438623333 +64653038323566326366336634313637363132343030633966313363646665313835343833376632 +39616364616236396265643232336365356235333064323432326561633730386533633064393832 +33313838373236386463366162386437356365346631633639613436356635396238646361376434 +34626238333366343831393364653064656166396535343133343131316537653263646239323061 +65393761326462656265393235663037323638333831623733323430623238626234303031303866 +64336130333164306530333062343161653532383031336464363237656264363665373739626630 +64353861383364386632613335646562623535353031303831653436633330663337613338666331 +37396466633231303032656334313033633865636231613564303733633462366162383835623563 +32616439333064663234663037623832633933303664383732646238376465353763646637623137 +66623664333364653039326431333439373934383735316231373164376365646231353935623664 +64653839613332626638623039366165356630383539333736383738326561313838383131633236 +30306537383865326533623337346138376533376137336536343163326534396564656130326361 +61623063636138323965643737313262616532346533333137346232396561373735376130356132 +37646639383430336637646134353732323262333732323434353265376262353039633963313061 +63363663353532633437333335306662313133306565623537666232353665333631653263663463 +63656264333064333662343836366131333534386662303933336665353361663938346430653264 +66383539643537313436373434363536376137333636363833626361376131633537643334383864 +34626264666437323930396562626134653063396533323139616264313063343535623636626238 +38366437626534376364623535613432313636366332353830616238666534363561646438343235 +62613664313631643137643765626437363962636137343765343562613761396266626461393236 +63613134303065623031396231366130373432633738393139393331323764623963346565373839 +64356439663964333032366363343461353130326136363731386535313661663135303237386638 +39336531333064613731323066376461373732323437386462353432613464663666363832653866 +62666461313734643562346335393434653933313661336236383933363738323066636562363230 +34666136626566376264623734393837353466616461666132623333656135346534646462633739 +36363331383337343561326536303263303739656562653536363234636130633563663161353631 +66613338323461623534613935396638343230643330636562353936343333383834303466643939 +36346532663237616132633166323630623434353338366534373366326234366566383931343837 +34613134646563383662656533666163653265326433643832626435663361336361376362633938 +38326235383664653366353162393034323866653339383139306630663835306537663563366231 +35306362663930326133363835643262393439346437653935343030653161303361303939323235 +34363438313763623934613534613334333464366361323164323337316531303332663433376363 +39326239653731653766303135343437333431636362666231393938316634663631353539386463 +66623730356336633536336634313264336236633664303864373735663837316563363666363037 +39303330623765316334666132326134376636303633393736343030323837383666333832613937 +31383033663638373666626336636539636665386465666237323232643466383236313262383235 +63303866366162393434633631323539633565363036326264376339666637316133376537633163 +66353264353337653733353034643030333932313463393132396632353030656134313064326466 +65636330346433643732313033643032393261313736343533636535643439336530663261353961 +63326231643131613665306563646331323536396232633366313036623136623636376336383438 +31363764323335666464623330333265386236643038353164303863356261653634316536303734 +33356630346666393539393931393661656666386635663965346537353365396330613061663939 +37386638653737383434393438366661303337636263666665373935316439386363663936646639 +65333532636161353538363161363138356364303661396166643435386234336132393733663562 +64383030656332343736626161653034333539343562303530336165373961356532663234366237 +38666632616439343437333366623362626339363535623162303437306334643731633662343162 +32623537383966623866613361383266353936643462613964646139653532633864643931376631 +62633433613435356561316536663364656639373733646539316566373334636133383936303166 +64366139616164636336303930306138316161306563623366633130386662306163386361353464 +30393231666266383064343234636430356564323534353339396637636632303962633665363661 +63303733333137393261316436373864333734613136373633343564373537653935366333363464 +63346430643030323039343539356364313635653863373465303134353361653664333333356132 +37623062333663323135613133373662626663353838623233386166623739656535613732636564 +63333937613233643035353136386463376661346131616562393236623338636661636661373166 +62663962666237613431396436343434353031303165363130663163616633336134353430326634 +66383463363266346630646339643563633235623065666265643066313134383534666530356561 +62373737313834373239396262663463613835643737383439653837376135303733366436333733 +36363436386233663135646134386462306434303339656632313562623037633664346562323034 +33303833373733383338306333323561656333313430323136326234343032323034646663333436 +30316661636237333266656430376535366135353534633932356135383333646261663935363734 +30666263643265306434333535346330313231386339363865643862366639663832366431663161 +37646632376633323862303764363437613332643131623138393330353633323634303337616431 +66336366646138653737333137396338646138613339336466356537626461346330646434613933 +61633835653235333637623635353565376331623464636137393861633064353739323262653166 +66393533656435306530653034313034356231616563393438333162393630306462313530353535 +31656537626163316535376234393236336631366262666539613337633461396134396563326532 +30386538383136356632653962643538613261356462323637316335323864613133316364663933 +37633661306635323361336639633561663738396133623362316437303733313838313332303264 +36363932633136373762363762303933306637646230303564313965383335386333646161353261 +31663836366639326438626463326631343162616537653266366334343538643634663831343736 +61626666616463303034323730653966383365613637633539646263396238656630333766633134 +37326438366434333066666334323137343635396464366430633931366335353231643630383161 +64353034313338346162653237666266333466313630313363636135393433653761326134353464 +62306233663930383166313033373561366231313865303662316662663236343638383731633132 +62663061613837633833613737666633343063333963626265303236366365303736636361336337 +35666536383738636239626139633031376262306165386362386462346330386334333331376338 +30386235333963333732343930613562316464323632663638323536613232666230303631336436 +37643131353437393661663934306332343037323866656665613436393237333236636661333064 +62303063393239373065346461326464396232356531393932623739643835356637 diff --git a/host_vars/bdd-ovh.adm.auro.re.yml b/host_vars/bdd-ovh.adm.auro.re.yml new file mode 100644 index 0000000..2164cb6 --- /dev/null +++ b/host_vars/bdd-ovh.adm.auro.re.yml @@ -0,0 +1,70 @@ +--- +postgresql: + version: 13 + +postgresql_hosts: + - database: etherpad + user: etherpad + net: 10.128.0.150/32 + method: md5 + - database: codimd + user: codimd + net: 10.128.0.150/32 + method: md5 + - database: synapse + user: synapse + net: 10.128.0.56/32 + method: md5 + - database: kanboard + user: kanboard + net: 10.128.0.150/32 + method: md5 + - database: grafana + user: grafana + net: 10.128.0.150/32 + method: md5 + - database: cas + user: cas + net: 10.128.0.150/32 + method: md5 + +postgresql_databases: + - synapse + - codimd + - etherpad + - kanboard + - grafana + - cas + +postgresql_users: + - name: synapse + database: synapse + password: "{{ postgresql_synapse_passwd }}" + privs: + - ALL + - name: codimd + database: codimd + password: "{{ postgresql_codimd_passwd }}" + privs: + - ALL + - name: etherpad + database: etherpad + password: "{{ postgresql_etherpad_passwd }}" + privs: + - ALL + - name: kanboard + database: kanboard + password: "{{ postgresql_kanboard_passwd }}" + privs: + - ALL + - name: grafana + database: grafana + password: "{{ postgresql_grafana_passwd }}" + privs: + - ALL + - name: cas + database: cas + password: "{{ postgresql_cas_passwd }}" + privs: + - ALL +... diff --git a/host_vars/bdd.adm.auro.re.yml b/host_vars/bdd.adm.auro.re.yml new file mode 100644 index 0000000..f782355 --- /dev/null +++ b/host_vars/bdd.adm.auro.re.yml @@ -0,0 +1,50 @@ +--- +postgresql: + version: 13 + +postgresql_hosts: + - database: nextcloud + user: nextcloud + net: 10.128.0.58/32 + method: md5 + - database: gitea + user: gitea + net: 10.128.0.60/32 + method: md5 + - database: wikijs + user: wikijs + net: 10.128.0.66/32 + method: md5 + - database: drone + user: drone + net: 10.128.0.64/32 + method: md5 + +postgresql_databases: + - nextcloud + - gitea + - wikijs + - drone + +postgresql_users: + - name: nextcloud + database: nextcloud + password: "{{ postgresql_nextcloud_passwd }}" + privs: + - ALL + - name: gitea + database: gitea + password: "{{ postgresql_gitea_passwd }}" + privs: + - ALL + - name: wikijs + database: wikijs + password: "{{ postgresql_wikijs_passwd }}" + privs: + - ALL + - name: drone + database: drone + password: "{{ postgresql_drone_passwd }}" + privs: + - ALL +... diff --git a/host_vars/log.adm.auro.re.yml b/host_vars/log.adm.auro.re.yml new file mode 100644 index 0000000..1c2ba97 --- /dev/null +++ b/host_vars/log.adm.auro.re.yml @@ -0,0 +1,9 @@ +--- +rsyslog_collector_base_dir: /var/log/remote +rsyslog_inputs: + - proto: relp + port: 20514 + - proto: udp + port: 514 +rsyslog_outputs: [] +... diff --git a/hosts b/hosts index 7cf9128..f075a8a 100644 --- a/hosts +++ b/hosts @@ -29,14 +29,16 @@ stream.adm.auro.re re2o-server.adm.auro.re re2o-ldap.adm.auro.re re2o-db.adm.auro.re -services-bdd-local.adm.auro.re +#services-bdd-local.adm.auro.re backup.adm.auro.re -services-web.adm.auro.re mail.adm.auro.re wikijs.adm.auro.re prometheus-aurore.adm.auro.re portail.adm.auro.re jitsi-aurore.adm.auro.re +log.adm.auro.re +bdd.adm.auro.re +bdd-ovh.adm.auro.re [aurore_testing_vm] pendragon.adm.auro.re @@ -49,7 +51,7 @@ horus.adm.auro.re [ovh_container] synapse.adm.auro.re -services-bdd.adm.auro.re +#services-bdd.adm.auro.re phabricator.adm.auro.re wiki.adm.auro.re www.adm.auro.re @@ -508,3 +510,7 @@ reverseproxy [reverseproxy] proxy-ovh.adm.auro.re proxy.adm.auro.re + +[bdd] +bdd.adm.auro.re +bdd-ovh.adm.auro.re diff --git a/log.yml b/log.yml new file mode 100644 index 0000000..8c8fc15 --- /dev/null +++ b/log.yml @@ -0,0 +1,5 @@ +--- +- hosts: log.adm.auro.re + roles: + - rsyslog_collector +... diff --git a/monitoring.yml b/monitoring.yml index 6d40d0a..c48550c 100755 --- a/monitoring.yml +++ b/monitoring.yml @@ -4,6 +4,7 @@ vars: prometheus_alertmanager: docker-ovh.adm.auro.re:9093 snmp_unifi_password: "{{ vault_snmp_unifi_password }}" + snmp_switch_community: "{{ vault_snmp_switch_community }}" # Prometheus targets.json prometheus_targets: @@ -18,6 +19,7 @@ vars: prometheus_alertmanager: docker-ovh.adm.auro.re:9093 snmp_unifi_password: "{{ vault_snmp_unifi_password }}" + snmp_switch_community: "{{ vault_snmp_switch_community }}" # Prometheus targets.json prometheus_targets: @@ -27,6 +29,7 @@ - targets: "{{ groups['pacaterie_unifi'] | list | sort }}" prometheus_ups_snmp_targets: - ups-pn-1.ups.auro.re + - ups-ps-1.ups.auro.re roles: - prometheus @@ -34,10 +37,12 @@ vars: prometheus_alertmanager: docker-ovh.adm.auro.re:9093 snmp_unifi_password: "{{ vault_snmp_unifi_password }}" + snmp_switch_community: "{{ vault_snmp_switch_community }}" # Prometheus targets.json prometheus_ups_snmp_targets: - ups-ec-1.ups.auro.re + - ups-ec-2.ups.auro.re prometheus_targets: - targets: | @@ -51,6 +56,7 @@ vars: prometheus_alertmanager: docker-ovh.adm.auro.re:9093 snmp_unifi_password: "{{ vault_snmp_unifi_password }}" + snmp_switch_community: "{{ vault_snmp_switch_community }}" # Prometheus targets.json prometheus_targets: @@ -67,6 +73,7 @@ vars: prometheus_alertmanager: docker-ovh.adm.auro.re:9093 snmp_unifi_password: "{{ vault_snmp_unifi_password }}" + snmp_switch_community: "{{ vault_snmp_switch_community }}" # Prometheus targets.json prometheus_ups_snmp_targets: @@ -113,6 +120,7 @@ vars: prometheus_alertmanager: docker-ovh.adm.auro.re:9093 snmp_unifi_password: "{{ vault_snmp_unifi_password }}" + snmp_switch_community: "{{ vault_snmp_switch_community }}" # Prometheus targets.json prometheus_targets: diff --git a/roles/baseconfig/files/update-motd.d/10-uname b/roles/baseconfig/files/update-motd.d/10-uname deleted file mode 100755 index 4586095..0000000 --- a/roles/baseconfig/files/update-motd.d/10-uname +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh -# {{ ansible_managed }} -uname -snrvm diff --git a/roles/baseconfig/tasks/main.yml b/roles/baseconfig/tasks/main.yml index 0c13978..cdedd37 100644 --- a/roles/baseconfig/tasks/main.yml +++ b/roles/baseconfig/tasks/main.yml @@ -9,8 +9,6 @@ - aptitude # nice to have for Ansible - bash-completion # because bash - curl # better than wget - - emacs-nox # for maman - - fish # to motivate @edpibu - git # code versioning - htop # better than top - iotop # monitor i/o @@ -18,29 +16,21 @@ - lsb-release - molly-guard # prevent reboot - nano # for vulcain - - net-tools - ntp # network time sync - - oidentd # postgresql identification - screen # Vulcain asked for this - sudo - tmux # For shirenn - tree # create a graphical tree of files - vim # better than nano - zsh # to be able to ssh @erdnaxe + - dnsutils # dig update_cache: true register: apt_result retries: 3 until: apt_result is succeeded -# Pimp my server -- name: Customize motd - copy: - src: "update-motd.d/{{ item }}" - dest: "/etc/update-motd.d/{{ item }}" - mode: 0755 - loop: - - 00-logo - - 10-uname +- include_role: + name: update_motd - name: Remove Debian warranty motd file: diff --git a/roles/ldap_client/tasks/main.yml b/roles/ldap_client/tasks/main.yml index 8599950..968b42f 100644 --- a/roles/ldap_client/tasks/main.yml +++ b/roles/ldap_client/tasks/main.yml @@ -21,4 +21,4 @@ user: root key: "{{ ssh_pub_keys }}" state: present -# exclusive: True + exclusive: true diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml index 210c7f0..a8fb885 100644 --- a/roles/nginx/tasks/main.yml +++ b/roles/nginx/tasks/main.yml @@ -29,6 +29,24 @@ dest: "/etc/nginx/sites-enabled/default" state: absent +- name: Add 'extended' log format + template: + src: nginx/conf.d/extended_log.conf.j2 + dest: /etc/nginx/conf.d/extended_log.conf + owner: root + group: root + mode: 0644 + notify: Reload nginx + +- name: Add syslog snippet + template: + src: nginx/snippets/syslog.conf.j2 + dest: /etc/nginx/snippets/syslog.conf + owner: root + group: root + mode: 0644 + notify: Reload nginx + - name: Copy reverse proxy sites when: reverseproxy is defined template: diff --git a/roles/nginx/templates/nginx/conf.d/extended_log.conf.j2 b/roles/nginx/templates/nginx/conf.d/extended_log.conf.j2 new file mode 100644 index 0000000..b28809f --- /dev/null +++ b/roles/nginx/templates/nginx/conf.d/extended_log.conf.j2 @@ -0,0 +1,7 @@ +{{ ansible_managed | comment }} + +log_format extended + '$remote_addr - $http_x_forwarded_for - $connection ' + '$remote_user [$time_local] ' + '"$host" "$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent"'; diff --git a/roles/nginx/templates/nginx/sites-available/redirect.j2 b/roles/nginx/templates/nginx/sites-available/redirect.j2 index 2543400..9e8e687 100644 --- a/roles/nginx/templates/nginx/sites-available/redirect.j2 +++ b/roles/nginx/templates/nginx/sites-available/redirect.j2 @@ -8,6 +8,8 @@ server { server_name {{ site.from }}; + include "/etc/nginx/snippets/syslog.conf"; + {% for realip in nginx.real_ip_from %} set_real_ip_from {{ realip }}; {% endfor %} @@ -25,6 +27,8 @@ server { server_name {{ site.from }}; + include "/etc/nginx/snippets/syslog.conf"; + # SSL common conf include "/etc/nginx/snippets/options-ssl.{{ site.ssl|default(nginx.default_ssl_domain) }}.conf"; @@ -52,6 +56,8 @@ server { server_name {{ from }}; + include "/etc/nginx/snippets/syslog.conf"; + {% for realip in nginx.real_ip_from %} set_real_ip_from {{ realip }}; {% endfor %} @@ -72,6 +78,8 @@ server { # SSL common conf include "/etc/nginx/snippets/options-ssl.{{ site.ssl|default(nginx.default_ssl_domain) }}.conf"; + include "/etc/nginx/snippets/syslog.conf"; + {% for realip in nginx.real_ip_from %} set_real_ip_from {{ realip }}; {% endfor %} diff --git a/roles/nginx/templates/nginx/sites-available/reverseproxy.j2 b/roles/nginx/templates/nginx/sites-available/reverseproxy.j2 index ae2d7a6..699d6d5 100644 --- a/roles/nginx/templates/nginx/sites-available/reverseproxy.j2 +++ b/roles/nginx/templates/nginx/sites-available/reverseproxy.j2 @@ -15,6 +15,8 @@ server { server_name {{ site.from }}; + include "/etc/nginx/snippets/syslog.conf"; + {% for realip in nginx.real_ip_from %} set_real_ip_from {{ realip }}; {% endfor %} @@ -39,6 +41,8 @@ server { access_log /var/log/nginx/{{ site.from }}.log; error_log /var/log/nginx/{{ site.from }}_error.log; + include "/etc/nginx/snippets/syslog.conf"; + # Keep the TCP connection open a bit for faster browsing keepalive_timeout 70; diff --git a/roles/nginx/templates/nginx/sites-available/reverseproxy_redirect_dname.j2 b/roles/nginx/templates/nginx/sites-available/reverseproxy_redirect_dname.j2 index 819fd7a..f90d53b 100644 --- a/roles/nginx/templates/nginx/sites-available/reverseproxy_redirect_dname.j2 +++ b/roles/nginx/templates/nginx/sites-available/reverseproxy_redirect_dname.j2 @@ -12,6 +12,8 @@ server { server_name {{ from }}; + include "/etc/nginx/snippets/syslog.conf"; + {% for realip in nginx.real_ip_from %} set_real_ip_from {{ realip }}; {% endfor %} @@ -29,6 +31,8 @@ server { server_name {{ from }}; + include "/etc/nginx/snippets/syslog.conf"; + # SSL common conf include "/etc/nginx/snippets/options-ssl.{{ site.ssl|default(nginx.default_ssl_domain) }}.conf"; diff --git a/roles/nginx/templates/nginx/sites-available/service.j2 b/roles/nginx/templates/nginx/sites-available/service.j2 index 39f25eb..77c3d74 100644 --- a/roles/nginx/templates/nginx/sites-available/service.j2 +++ b/roles/nginx/templates/nginx/sites-available/service.j2 @@ -19,6 +19,9 @@ upstream {{ upstream.name }} { server { listen 443 default_server ssl; listen [::]:443 default_server ssl; + + include "/etc/nginx/snippets/syslog.conf"; + include "/etc/nginx/snippets/options-ssl.{{ nginx.default_ssl_domain }}.conf"; server_name _; @@ -50,6 +53,8 @@ server { # Hide Nginx version server_tokens off; + include "/etc/nginx/snippets/syslog.conf"; + {% for realip in nginx.real_ip_from %} set_real_ip_from {{ realip }}; {% endfor %} @@ -71,6 +76,8 @@ server { server_name {{ server.server_name|join(" ") }}; charset utf-8; + include "/etc/nginx/snippets/syslog.conf"; + # Hide Nginx version server_tokens off; @@ -98,6 +105,8 @@ server { server_name {{ server.server_name|join(" ") }}; charset utf-8; + include "/etc/nginx/snippets/syslog.conf"; + # Hide Nginx version server_tokens off; diff --git a/roles/nginx/templates/nginx/snippets/syslog.conf.j2 b/roles/nginx/templates/nginx/snippets/syslog.conf.j2 new file mode 100644 index 0000000..b34867c --- /dev/null +++ b/roles/nginx/templates/nginx/snippets/syslog.conf.j2 @@ -0,0 +1,4 @@ +{{ ansible_managed | comment }} + +access_log syslog:server=unix:/dev/log,tag=nginx,nohostname,severity=info extended; +error_log syslog:server=unix:/dev/log,tag=nginx,nohostname,severity=error; diff --git a/roles/postgresql_server/defaults/main.yml b/roles/postgresql_server/defaults/main.yml new file mode 100644 index 0000000..8eb5639 --- /dev/null +++ b/roles/postgresql_server/defaults/main.yml @@ -0,0 +1,5 @@ +--- +postgresql_hosts: [] +postgresql_databases: [] +postgresql_users: [] +... diff --git a/roles/postgresql_server/handlers/main.yml b/roles/postgresql_server/handlers/main.yml new file mode 100644 index 0000000..731acb9 --- /dev/null +++ b/roles/postgresql_server/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: restart postgresql + service: + name: postgresql + state: restarted + enabled: true diff --git a/roles/postgresql_server/tasks/main.yml b/roles/postgresql_server/tasks/main.yml new file mode 100644 index 0000000..ed45e1a --- /dev/null +++ b/roles/postgresql_server/tasks/main.yml @@ -0,0 +1,74 @@ +--- +- name: Install postgresql and psycopg2 + apt: + update_cache: true + pkg: + - postgresql + - python3-psycopg2 + state: present + register: apt_result + retries: 3 + until: apt_result is succeeded + +- name: Ensure main postgresql directory exists + file: + path: /etc/postgresql/{{ postgresql.version }}/main/ + state: directory + owner: postgres + group: postgres + mode: 0755 + +- name: Ensure configuration directory exists + file: + path: /etc/postgresql/{{ postgresql.version }}/main/conf.d + state: directory + owner: postgres + group: postgres + mode: 0755 + +- name: Configuration of postgresql {{ postgresql.version }} + template: + src: postgresql/{{ item }}.j2 + dest: /etc/postgresql/{{ postgresql.version }}/main/{{ item }} + mode: 0640 + owner: postgres + group: postgres + loop: + - pg_hba.conf + - postgresql.conf + notify: + - restart postgresql + +- name: Create databases + become: true + become_user: postgres + postgresql_db: + name: "{{ item }}" + encoding: UTF-8 + lc_collate: en_US.UTF-8 + lc_ctype: en_US.UTF-8 + template: template0 + loop: "{{ postgresql_databases }}" + +- name: Create users + become: true + become_user: postgres + postgresql_user: + db: "{{ item.database }}" + name: "{{ item.name }}" + password: "{{ item.password }}" + no_log: true + loop: "{{ postgresql_users }}" + +- name: Grant privileges to users + become: true + become_user: postgres + postgresql_privs: + db: postgres + type: database + role: "{{ item.name }}" + privs: "{{ item.privs | join(',') }}" + obj: "{{ item.database }}" + no_log: true + loop: "{{ postgresql_users }}" +... diff --git a/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 b/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 new file mode 100644 index 0000000..3a56905 --- /dev/null +++ b/roles/postgresql_server/templates/postgresql/pg_hba.conf.j2 @@ -0,0 +1,20 @@ +{{ ansible_managed | comment }} + +# TYPE DATABASE USER ADDRESS METHOD + +# DO NOT DISABLE! +# If you change this first entry you will need to make sure that the +# database superuser can access the database using some other method. +# Noninteractive access to all databases is required during automatic +# maintenance (custom daily cronjobs, replication, and similar tasks). +# +# Database administrative login by Unix domain socket +local all postgres peer + + +# "local" is for Unix domain socket connections only +local all all peer + +{% for host in postgresql_hosts %} +host "{{ host.database }}" "{{ host.user }}" {{ host.net }} {{ host.method }} +{% endfor %} diff --git a/roles/postgresql_server/templates/postgresql/postgresql.conf.j2 b/roles/postgresql_server/templates/postgresql/postgresql.conf.j2 new file mode 100644 index 0000000..f28c61e --- /dev/null +++ b/roles/postgresql_server/templates/postgresql/postgresql.conf.j2 @@ -0,0 +1,695 @@ +{{ ansible_managed | comment }} + +# ----------------------------- +# PostgreSQL configuration file +# ----------------------------- +# +# This file consists of lines of the form: +# +# name = value +# +# (The "=" is optional.) Whitespace may be used. Comments are introduced with +# "#" anywhere on a line. The complete list of parameter names and allowed +# values can be found in the PostgreSQL documentation. +# +# The commented-out settings shown in this file represent the default values. +# Re-commenting a setting is NOT sufficient to revert it to the default value; +# you need to reload the server. +# +# This file is read on server startup and when the server receives a SIGHUP +# signal. If you edit the file on a running system, you have to SIGHUP the +# server for the changes to take effect, run "pg_ctl reload", or execute +# "SELECT pg_reload_conf()". Some parameters, which are marked below, +# require a server shutdown and restart to take effect. +# +# Any parameter can also be given as a command-line option to the server, e.g., +# "postgres -c log_connections=on". Some parameters can be changed at run time +# with the "SET" SQL command. +# +# Memory units: kB = kilobytes Time units: ms = milliseconds +# MB = megabytes s = seconds +# GB = gigabytes min = minutes +# TB = terabytes h = hours +# d = days + + +#------------------------------------------------------------------------------ +# FILE LOCATIONS +#------------------------------------------------------------------------------ + +# The default values of these variables are driven from the -D command-line +# option or PGDATA environment variable, represented here as ConfigDir. +# All changes to this section REQUIRES restart + +# use data in another directory +data_directory = '/var/lib/postgresql/{{ postgresql.version }}/main' +# host-based authentication file +hba_file = '/etc/postgresql/{{ postgresql.version }}/main/pg_hba.conf' + +# If external_pid_file is not explicitly set, no extra PID file is written. +external_pid_file = '/run/postgresql/{{ postgresql.version }}-main.pid' +# write an extra PID file + + +#------------------------------------------------------------------------------ +# CONNECTIONS AND AUTHENTICATION +#------------------------------------------------------------------------------ + +# - Connection Settings - + +listen_addresses = '0.0.0.0, ::' +# listen_addresses = * # listen to all +#listen_addresses = 'localhost' # what IP address(es) to listen on; + # comma-separated list of addresses; + # defaults to 'localhost'; use '*' for all + # (change requires restart) +port = 5432 # (change requires restart) +max_connections = 100 # (change requires restart) +#superuser_reserved_connections = 3 # (change requires restart) +unix_socket_directories = '/var/run/postgresql' # comma-separated list of directories + # (change requires restart) +#unix_socket_group = '' # (change requires restart) +#unix_socket_permissions = 0777 # begin with 0 to use octal notation + # (change requires restart) +#bonjour = off # advertise server via Bonjour + # (change requires restart) +#bonjour_name = '' # defaults to the computer name + # (change requires restart) + +# - TCP Keepalives - +# see "man 7 tcp" for details + +#tcp_keepalives_idle = 0 # TCP_KEEPIDLE, in seconds; + # 0 selects the system default +#tcp_keepalives_interval = 0 # TCP_KEEPINTVL, in seconds; + # 0 selects the system default +#tcp_keepalives_count = 0 # TCP_KEEPCNT; + # 0 selects the system default + + +# - Authentication - + +#authentication_timeout = 1min # 1s-600s +#password_encryption = md5 # md5 or scram-sha-256 +#db_user_namespace = off + +# GSSAPI using Kerberos +#krb_server_keyfile = '' +#krb_caseins_users = off + +# - SSL - + +ssl = on +#ssl_ca_file = '' +ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem' +#ssl_crl_file = '' +ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key' +#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers +#ssl_prefer_server_ciphers = on +#ssl_ecdh_curve = 'prime256v1' +#ssl_dh_params_file = '' +#ssl_passphrase_command = '' +#ssl_passphrase_command_supports_reload = off + + +#------------------------------------------------------------------------------ +# RESOURCE USAGE (except WAL) +#------------------------------------------------------------------------------ + +# - Memory - + +shared_buffers = 128MB # min 128kB + # (change requires restart) +#huge_pages = try # on, off, or try + # (change requires restart) +#temp_buffers = 8MB # min 800kB +#max_prepared_transactions = 0 # zero disables the feature + # (change requires restart) +# Caution: it is not advisable to set max_prepared_transactions nonzero unless +# you actively intend to use prepared transactions. +#work_mem = 4MB # min 64kB +#maintenance_work_mem = 64MB # min 1MB +#autovacuum_work_mem = -1 # min 1MB, or -1 to use maintenance_work_mem +#max_stack_depth = 2MB # min 100kB +dynamic_shared_memory_type = posix # the default is the first option + # supported by the operating system: + # posix + # sysv + # windows + # mmap + # (change requires restart) + +# - Disk - + +#temp_file_limit = -1 # limits per-process temp file space + # in kB, or -1 for no limit + +# - Kernel Resources - + +#max_files_per_process = 1000 # min 25 + # (change requires restart) + +# - Cost-Based Vacuum Delay - + +#vacuum_cost_delay = 0 # 0-100 milliseconds (0 disables) +#vacuum_cost_page_hit = 1 # 0-10000 credits +#vacuum_cost_page_miss = 10 # 0-10000 credits +#vacuum_cost_page_dirty = 20 # 0-10000 credits +#vacuum_cost_limit = 200 # 1-10000 credits + +# - Background Writer - + +#bgwriter_delay = 200ms # 10-10000ms between rounds +#bgwriter_lru_maxpages = 100 # max buffers written/round, 0 disables +#bgwriter_lru_multiplier = 2.0 # 0-10.0 multiplier on buffers scanned/round +#bgwriter_flush_after = 512kB # measured in pages, 0 disables + +# - Asynchronous Behavior - + +#effective_io_concurrency = 1 # 1-1000; 0 disables prefetching +#max_worker_processes = 8 # (change requires restart) +#max_parallel_maintenance_workers = 2 # taken from max_parallel_workers +#max_parallel_workers_per_gather = 2 # taken from max_parallel_workers +#parallel_leader_participation = on +#max_parallel_workers = 8 # maximum number of max_worker_processes that + # can be used in parallel operations +#old_snapshot_threshold = -1 # 1min-60d; -1 disables; 0 is immediate + # (change requires restart) +#backend_flush_after = 0 # measured in pages, 0 disables + + +#------------------------------------------------------------------------------ +# WRITE-AHEAD LOG +#------------------------------------------------------------------------------ + +# - Settings - + +#wal_level = replica # minimal, replica, or logical + # (change requires restart) +#fsync = on # flush data to disk for crash safety + # (turning this off can cause + # unrecoverable data corruption) +#synchronous_commit = on # synchronization level; + # off, local, remote_write, remote_apply, or on +#wal_sync_method = fsync # the default is the first option + # supported by the operating system: + # open_datasync + # fdatasync (default on Linux) + # fsync + # fsync_writethrough + # open_sync +#full_page_writes = on # recover from partial page writes +#wal_compression = off # enable compression of full-page writes +#wal_log_hints = off # also do full page writes of non-critical updates + # (change requires restart) +#wal_buffers = -1 # min 32kB, -1 sets based on shared_buffers + # (change requires restart) +#wal_writer_delay = 200ms # 1-10000 milliseconds +#wal_writer_flush_after = 1MB # measured in pages, 0 disables + +#commit_delay = 0 # range 0-100000, in microseconds +#commit_siblings = 5 # range 1-1000 + +# - Checkpoints - + +#checkpoint_timeout = 5min # range 30s-1d +max_wal_size = 1GB +min_wal_size = 80MB +#checkpoint_completion_target = 0.5 # checkpoint target duration, 0.0 - 1.0 +#checkpoint_flush_after = 256kB # measured in pages, 0 disables +#checkpoint_warning = 30s # 0 disables + +# - Archiving - + +#archive_mode = off # enables archiving; off, on, or always + # (change requires restart) +#archive_command = '' # command to use to archive a logfile segment + # placeholders: %p = path of file to archive + # %f = file name only + # e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f' +#archive_timeout = 0 # force a logfile segment switch after this + # number of seconds; 0 disables + + +#------------------------------------------------------------------------------ +# REPLICATION +#------------------------------------------------------------------------------ + +# - Sending Servers - + +# Set these on the master and on any standby that will send replication data. + +#max_wal_senders = 10 # max number of walsender processes + # (change requires restart) +#wal_keep_segments = 0 # in logfile segments; 0 disables +#wal_sender_timeout = 60s # in milliseconds; 0 disables + +#max_replication_slots = 10 # max number of replication slots + # (change requires restart) +#track_commit_timestamp = off # collect timestamp of transaction commit + # (change requires restart) + +# - Master Server - + +# These settings are ignored on a standby server. + +#synchronous_standby_names = '' # standby servers that provide sync rep + # method to choose sync standbys, number of sync standbys, + # and comma-separated list of application_name + # from standby(s); '*' = all +#vacuum_defer_cleanup_age = 0 # number of xacts by which cleanup is delayed + +# - Standby Servers - + +# These settings are ignored on a master server. + +#hot_standby = on # "off" disallows queries during recovery + # (change requires restart) +#max_standby_archive_delay = 30s # max delay before canceling queries + # when reading WAL from archive; + # -1 allows indefinite delay +#max_standby_streaming_delay = 30s # max delay before canceling queries + # when reading streaming WAL; + # -1 allows indefinite delay +#wal_receiver_status_interval = 10s # send replies at least this often + # 0 disables +#hot_standby_feedback = off # send info from standby to prevent + # query conflicts +#wal_receiver_timeout = 60s # time that receiver waits for + # communication from master + # in milliseconds; 0 disables +#wal_retrieve_retry_interval = 5s # time to wait before retrying to + # retrieve WAL after a failed attempt +# - Subscribers - + +# These settings are ignored on a publisher. + +#max_logical_replication_workers = 4 # taken from max_worker_processes + # (change requires restart) +#max_sync_workers_per_subscription = 2 # taken from max_logical_replication_workers + + +#------------------------------------------------------------------------------ +# QUERY TUNING +#------------------------------------------------------------------------------ + +# - Planner Method Configuration - + +#enable_bitmapscan = on +#enable_hashagg = on +#enable_hashjoin = on +#enable_indexscan = on +#enable_indexonlyscan = on +#enable_material = on +#enable_mergejoin = on +#enable_nestloop = on +#enable_parallel_append = on +#enable_seqscan = on +#enable_sort = on +#enable_tidscan = on +#enable_partitionwise_join = off +#enable_partitionwise_aggregate = off +#enable_parallel_hash = on +#enable_partition_pruning = on + +# - Planner Cost Constants - + +#seq_page_cost = 1.0 # measured on an arbitrary scale +#random_page_cost = 4.0 # same scale as above +#cpu_tuple_cost = 0.01 # same scale as above +#cpu_index_tuple_cost = 0.005 # same scale as above +#cpu_operator_cost = 0.0025 # same scale as above +#parallel_tuple_cost = 0.1 # same scale as above +#parallel_setup_cost = 1000.0 # same scale as above + +#jit_above_cost = 100000 # perform JIT compilation if available + # and query more expensive than this; + # -1 disables +#jit_inline_above_cost = 500000 # inline small functions if query is + # more expensive than this; -1 disables +#jit_optimize_above_cost = 500000 # use expensive JIT optimizations if + # query is more expensive than this; + # -1 disables + +#min_parallel_table_scan_size = 8MB +#min_parallel_index_scan_size = 512kB +#effective_cache_size = 4GB + +# - Genetic Query Optimizer - + +#geqo = on +#geqo_threshold = 12 +#geqo_effort = 5 # range 1-10 +#geqo_pool_size = 0 # selects default based on effort +#geqo_generations = 0 # selects default based on effort +#geqo_selection_bias = 2.0 # range 1.5-2.0 +#geqo_seed = 0.0 # range 0.0-1.0 + +# - Other Planner Options - + +#default_statistics_target = 100 # range 1-10000 +#constraint_exclusion = partition # on, off, or partition +#cursor_tuple_fraction = 0.1 # range 0.0-1.0 +#from_collapse_limit = 8 +#join_collapse_limit = 8 # 1 disables collapsing of explicit + # JOIN clauses +#force_parallel_mode = off +#jit = on # allow JIT compilation +#plan_cache_mode = auto # auto, force_generic_plan or + # force_custom_plan + + +#------------------------------------------------------------------------------ +# REPORTING AND LOGGING +#------------------------------------------------------------------------------ + +# - Where to Log - + +#log_destination = 'stderr' # Valid values are combinations of + # stderr, csvlog, syslog, and eventlog, + # depending on platform. csvlog + # requires logging_collector to be on. + +# This is used when logging to stderr: +#logging_collector = off # Enable capturing of stderr and csvlog + # into log files. Required to be on for + # csvlogs. + # (change requires restart) + +# These are only used if logging_collector is on: +#log_directory = 'log' # directory where log files are written, + # can be absolute or relative to PGDATA +#log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log' # log file name pattern, + # can include strftime() escapes +#log_file_mode = 0600 # creation mode for log files, + # begin with 0 to use octal notation +#log_truncate_on_rotation = off # If on, an existing log file with the + # same name as the new log file will be + # truncated rather than appended to. + # But such truncation only occurs on + # time-driven rotation, not on restarts + # or size-driven rotation. Default is + # off, meaning append to existing files + # in all cases. +#log_rotation_age = 1d # Automatic rotation of logfiles will + # happen after that time. 0 disables. +#log_rotation_size = 10MB # Automatic rotation of logfiles will + # happen after that much log output. + # 0 disables. + +# These are relevant when logging to syslog: +#syslog_facility = 'LOCAL0' +#syslog_ident = 'postgres' +#syslog_sequence_numbers = on +#syslog_split_messages = on + +# This is only relevant when logging to eventlog (win32): +# (change requires restart) +#event_source = 'PostgreSQL' + +# - When to Log - + +#log_min_messages = warning # values in order of decreasing detail: + # debug5 + # debug4 + # debug3 + # debug2 + # debug1 + # info + # notice + # warning + # error + # log + # fatal + # panic + +#log_min_error_statement = error # values in order of decreasing detail: + # debug5 + # debug4 + # debug3 + # debug2 + # debug1 + # info + # notice + # warning + # error + # log + # fatal + # panic (effectively off) + +#log_min_duration_statement = -1 # -1 is disabled, 0 logs all statements + # and their durations, > 0 logs only + # statements running at least this number + # of milliseconds + + +# - What to Log - + +#debug_print_parse = off +#debug_print_rewritten = off +#debug_print_plan = off +#debug_pretty_print = on +#log_checkpoints = off +#log_connections = off +#log_disconnections = off +#log_duration = off +#log_error_verbosity = default # terse, default, or verbose messages +#log_hostname = off +log_line_prefix = '%m [%p] %q%u@%d ' # special values: + # %a = application name + # %u = user name + # %d = database name + # %r = remote host and port + # %h = remote host + # %p = process ID + # %t = timestamp without milliseconds + # %m = timestamp with milliseconds + # %n = timestamp with milliseconds (as a Unix epoch) + # %i = command tag + # %e = SQL state + # %c = session ID + # %l = session line number + # %s = session start timestamp + # %v = virtual transaction ID + # %x = transaction ID (0 if none) + # %q = stop here in non-session + # processes + # %% = '%' + # e.g. '<%u%%%d> ' +#log_lock_waits = off # log lock waits >= deadlock_timeout +#log_statement = 'none' # none, ddl, mod, all +#log_replication_commands = off +#log_temp_files = -1 # log temporary files equal or larger + # than the specified size in kilobytes; + # -1 disables, 0 logs all temp files +log_timezone = 'Europe/Paris' + +#------------------------------------------------------------------------------ +# PROCESS TITLE +#------------------------------------------------------------------------------ + +cluster_name = '{{ postgresql.version }}/main' # added to process titles if nonempty + # (change requires restart) +#update_process_title = on + + +#------------------------------------------------------------------------------ +# STATISTICS +#------------------------------------------------------------------------------ + +# - Query and Index Statistics Collector - + +#track_activities = on +#track_counts = on +#track_io_timing = off +#track_functions = none # none, pl, all +#track_activity_query_size = 1024 # (change requires restart) +stats_temp_directory = '/var/run/postgresql/{{ postgresql.version }}-main.pg_stat_tmp' + + +# - Monitoring - + +#log_parser_stats = off +#log_planner_stats = off +#log_executor_stats = off +#log_statement_stats = off + + +#------------------------------------------------------------------------------ +# AUTOVACUUM +#------------------------------------------------------------------------------ + +#autovacuum = on # Enable autovacuum subprocess? 'on' + # requires track_counts to also be on. +#log_autovacuum_min_duration = -1 # -1 disables, 0 logs all actions and + # their durations, > 0 logs only + # actions running at least this number + # of milliseconds. +#autovacuum_max_workers = 3 # max number of autovacuum subprocesses + # (change requires restart) +#autovacuum_naptime = 1min # time between autovacuum runs +#autovacuum_vacuum_threshold = 50 # min number of row updates before + # vacuum +#autovacuum_analyze_threshold = 50 # min number of row updates before + # analyze +#autovacuum_vacuum_scale_factor = 0.2 # fraction of table size before vacuum +#autovacuum_analyze_scale_factor = 0.1 # fraction of table size before analyze +#autovacuum_freeze_max_age = 200000000 # maximum XID age before forced vacuum + # (change requires restart) +#autovacuum_multixact_freeze_max_age = 400000000 # maximum multixact age + # before forced vacuum + # (change requires restart) +#autovacuum_vacuum_cost_delay = 2ms # default vacuum cost delay for + # autovacuum, in milliseconds; + # -1 means use vacuum_cost_delay +#autovacuum_vacuum_cost_limit = -1 # default vacuum cost limit for + # autovacuum, -1 means use + # vacuum_cost_limit + + +#------------------------------------------------------------------------------ +# CLIENT CONNECTION DEFAULTS +#------------------------------------------------------------------------------ + +# - Statement Behavior - + +#client_min_messages = notice # values in order of decreasing detail: + # debug5 + # debug4 + # debug3 + # debug2 + # debug1 + # log + # notice + # warning + # error +#search_path = '"$user", public' # schema names +#row_security = on +#default_tablespace = '' # a tablespace name, '' uses the default +#temp_tablespaces = '' # a list of tablespace names, '' uses + # only default tablespace +#check_function_bodies = on +#default_transaction_isolation = 'read committed' +#default_transaction_read_only = off +#default_transaction_deferrable = off +#session_replication_role = 'origin' +#statement_timeout = 0 # in milliseconds, 0 is disabled +#lock_timeout = 0 # in milliseconds, 0 is disabled +#idle_in_transaction_session_timeout = 0 # in milliseconds, 0 is disabled +#vacuum_freeze_min_age = 50000000 +#vacuum_freeze_table_age = 150000000 +#vacuum_multixact_freeze_min_age = 5000000 +#vacuum_multixact_freeze_table_age = 150000000 +#vacuum_cleanup_index_scale_factor = 0.1 # fraction of total number of tuples + # before index cleanup, 0 always performs + # index cleanup +#bytea_output = 'hex' # hex, escape +#xmlbinary = 'base64' +#xmloption = 'content' +#gin_fuzzy_search_limit = 0 +#gin_pending_list_limit = 4MB + +# - Locale and Formatting - + +datestyle = 'iso, dmy' +#intervalstyle = 'postgres' +timezone = 'Europe/Paris' +#timezone_abbreviations = 'Default' # Select the set of available time zone + # abbreviations. Currently, there are + # Default + # Australia (historical usage) + # India + # You can create your own file in + # share/timezonesets/. +#extra_float_digits = 1 # min -15, max 3; any value >0 actually + # selects precise output mode +#client_encoding = sql_ascii # actually, defaults to database + # encoding + +# These settings are initialized by initdb, but they can be changed. +lc_messages = 'en_US.UTF-8' +lc_monetary = 'en_US.UTF-8' +lc_numeric = 'en_US.UTF-8' +lc_time = 'en_US.UTF-8' + +# default configuration for text search +default_text_search_config = 'pg_catalog.french' + +# - Shared Library Preloading - + +#shared_preload_libraries = '' # (change requires restart) +#local_preload_libraries = '' +#session_preload_libraries = '' +#jit_provider = 'llvmjit' # JIT library to use + +# - Other Defaults - + +#dynamic_library_path = '$libdir' + + +#------------------------------------------------------------------------------ +# LOCK MANAGEMENT +#------------------------------------------------------------------------------ + +#deadlock_timeout = 1s +#max_locks_per_transaction = 64 # min 10 + # (change requires restart) +#max_pred_locks_per_transaction = 64 # min 10 + # (change requires restart) +#max_pred_locks_per_relation = -2 # negative values mean + # (max_pred_locks_per_transaction + # / -max_pred_locks_per_relation) - 1 +#max_pred_locks_per_page = 2 # min 0 + + +#------------------------------------------------------------------------------ +# VERSION AND PLATFORM COMPATIBILITY +#------------------------------------------------------------------------------ + +# - Previous PostgreSQL Versions - + +#array_nulls = on +#backslash_quote = safe_encoding # on, off, or safe_encoding +#default_with_oids = off +#escape_string_warning = on +#lo_compat_privileges = off +#operator_precedence_warning = off +#quote_all_identifiers = off +#standard_conforming_strings = on +#synchronize_seqscans = on + +# - Other Platforms and Clients - + +#transform_null_equals = off + + +#------------------------------------------------------------------------------ +# ERROR HANDLING +#------------------------------------------------------------------------------ + +#exit_on_error = off # terminate session on any error? +#restart_after_crash = on # reinitialize after backend crash? +#data_sync_retry = off # retry or panic on failure to fsync + # data? + # (change requires restart) + + +#------------------------------------------------------------------------------ +# CONFIG FILE INCLUDES +#------------------------------------------------------------------------------ + +# These options allow settings to be loaded from files other than the +# default postgresql.conf. Note that these are directives, not variable +# assignments, so they can usefully be given more than once. + +include_dir = 'conf.d' # include files ending in '.conf' from + # a directory, e.g., 'conf.d' +#include_if_exists = '...' # include file only if it exists +#include = '...' # include file + + +#------------------------------------------------------------------------------ +# CUSTOMIZED OPTIONS +#------------------------------------------------------------------------------ + +# Add settings for extensions here diff --git a/roles/prometheus/tasks/main.yml b/roles/prometheus/tasks/main.yml index a820190..a3d2063 100644 --- a/roles/prometheus/tasks/main.yml +++ b/roles/prometheus/tasks/main.yml @@ -84,8 +84,11 @@ enabled: true state: started -- name: Indicate role in motd - template: - src: update-motd.d/05-service.j2 - dest: /etc/update-motd.d/05-prometheus - mode: 0755 +- include_role: + name: update_motd + vars: + motd_messages: + - key: 05-prometheus + message: >- + Prometheus est déployé sur cette machine (voir /etc/prometheus) +... diff --git a/roles/prometheus/templates/prometheus/alert.rules.yml.j2 b/roles/prometheus/templates/prometheus/alert.rules.yml.j2 index 028d5d0..bf4127b 100644 --- a/roles/prometheus/templates/prometheus/alert.rules.yml.j2 +++ b/roles/prometheus/templates/prometheus/alert.rules.yml.j2 @@ -119,7 +119,7 @@ groups: summary: "La tension de sortie de {{ $labels.instance }} est de {{ $value }}V." - alert: UpsTimeRemainingWarning - expr: upsEstimatedMinutesRemaining < 15 + expr: upsEstimatedMinutesRemaining < 8 for: 1m labels: severity: warning diff --git a/roles/prometheus/templates/prometheus/snmp.yml.j2 b/roles/prometheus/templates/prometheus/snmp.yml.j2 index 8757d79..7f543db 100644 --- a/roles/prometheus/templates/prometheus/snmp.yml.j2 +++ b/roles/prometheus/templates/prometheus/snmp.yml.j2 @@ -14,6 +14,7 @@ eatonups: - 1.3.6.1.2.1.33.1.3 - 1.3.6.1.2.1.33.1.4 - 1.3.6.1.4.1.534.1.6 + - 1.3.6.1.4.1.318.1.1.10.2.3.2.1.4 get: - 1.3.6.1.2.1.1.3.0 metrics: @@ -68,9 +69,10 @@ eatonups: - labelname: upsOutputLineIndex type: gauge - name: xupsEnvRemoteTemp - oid: 1.3.6.1.4.1.534.1.6.5 +# oid: 1.3.6.1.4.1.534.1.6.5 + oid: 1.3.6.1.4.1.318.1.1.10.2.3.2.1.4 type: gauge - help: The reading of an EMP's temperature sensor. - 1.3.6.1.4.1.534.1.6.5 + help: The reading of an EMP's temperature sensor. - 1.3.6.1.4.1.318.1.1.10.2.3.2.1.4 - name: xupsEnvRemoteHumidity oid: 1.3.6.1.4.1.534.1.6.6 type: gauge diff --git a/roles/prometheus/templates/update-motd.d/05-service.j2 b/roles/prometheus/templates/update-motd.d/05-service.j2 deleted file mode 100755 index f027dc4..0000000 --- a/roles/prometheus/templates/update-motd.d/05-service.j2 +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# {{ ansible_managed }} -echo "> prometheus a été déployé sur cette machine." -echo " Voir /etc/prometheus/" diff --git a/roles/prometheus_federate/tasks/main.yml b/roles/prometheus_federate/tasks/main.yml index f168f1f..73ae803 100644 --- a/roles/prometheus_federate/tasks/main.yml +++ b/roles/prometheus_federate/tasks/main.yml @@ -38,9 +38,12 @@ enabled: true state: started -- name: Indicate role in motd - template: - src: update-motd.d/05-service.j2 - dest: /etc/update-motd.d/05-prometheus - mode: 0755 +- include_role: + name: update_motd + vars: + motd_messages: + - key: 05-prometheus-federate + message: >- + Prometheus (en configuration fédération) est déployé sur cette + machine (voir /etc/prometheus) ... diff --git a/roles/prometheus_federate/templates/update-motd.d/05-service.j2 b/roles/prometheus_federate/templates/update-motd.d/05-service.j2 deleted file mode 100755 index f027dc4..0000000 --- a/roles/prometheus_federate/templates/update-motd.d/05-service.j2 +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# {{ ansible_managed }} -echo "> prometheus a été déployé sur cette machine." -echo " Voir /etc/prometheus/" diff --git a/roles/router/templates/firewall_config.py b/roles/router/templates/firewall_config.py index 9971765..07e25e0 100644 --- a/roles/router/templates/firewall_config.py +++ b/roles/router/templates/firewall_config.py @@ -36,6 +36,11 @@ interfaces_type = { 'admin' : ['ens18'] } +log_ignore_v4 = [ + '224.0.0.0/24', + '224.0.1.0/24', + '239.0.0.0/8', +] ### Specify nat settings: name, interfaces with range, and global range for nat ### WARNING : "interface_ip_to_nat' MUST contain /24 ranges, and ip_sources MUST diff --git a/roles/router/templates/firewall_config_aurore.py b/roles/router/templates/firewall_config_aurore.py index 9565e3b..91a4808 100644 --- a/roles/router/templates/firewall_config_aurore.py +++ b/roles/router/templates/firewall_config_aurore.py @@ -33,6 +33,12 @@ interfaces_type = { 'admin' : ['ens19', 'ens20', 'ens23'] } +log_ignore_v4 = [ + '224.0.0.0/24', + '224.0.1.0/24', + '239.0.0.0/8', +] + ### Specify nat settings: name, interfaces with range, and global range for nat ### WARNING : "interface_ip_to_nat' MUST contain /24 ranges, and ip_sources MUST ### contain /16 range diff --git a/roles/router/templates/interfaces-aurore b/roles/router/templates/interfaces-aurore index 401e5aa..7a5ef1d 100644 --- a/roles/router/templates/interfaces-aurore +++ b/roles/router/templates/interfaces-aurore @@ -11,7 +11,6 @@ iface lo inet loopback auto ens18 iface ens18 inet static address 10.129.0.{{ router_hard_ip_suffix }}/16 - gateway 10.129.0.1 iface ens18 inet6 static address 2a09:6840:129::0:{{ router_hard_ip_suffix }}/64 diff --git a/roles/router/templates/keepalived-aurore.conf b/roles/router/templates/keepalived-aurore.conf index cd22a5b..b8882fd 100644 --- a/roles/router/templates/keepalived-aurore.conf +++ b/roles/router/templates/keepalived-aurore.conf @@ -39,7 +39,7 @@ vrrp_instance VI_ROUT_aurore_IPv4 { 10.129.0.254/16 brd 10.129.255.255 dev ens18 scope global # Adm - 10.128.0.254/16 brd 10.129.255.255 dev ens19 scope global + 10.128.0.254/16 brd 10.128.255.255 dev ens19 scope global # Switches 10.130.0.254/16 brd 10.130.255.255 dev ens20 scope global diff --git a/roles/rsyslog_collector/defaults/main.yml b/roles/rsyslog_collector/defaults/main.yml new file mode 100644 index 0000000..6ded0ef --- /dev/null +++ b/roles/rsyslog_collector/defaults/main.yml @@ -0,0 +1,7 @@ +--- +rsyslog_inputs: [] +rsyslog_collector_base_dir: /var/log/remote +rsyslog_collector_rotate_path: /usr/local/sbin/rotate_remote_logs +rsyslog_collector_keep_days: 0 +rsyslog_collector_compress_days: 1 +... diff --git a/roles/rsyslog_collector/files/rotate b/roles/rsyslog_collector/files/rotate new file mode 100644 index 0000000..6dc23e0 --- /dev/null +++ b/roles/rsyslog_collector/files/rotate @@ -0,0 +1,60 @@ +#!/usr/bin/env python3 +import argparse +import datetime +import logging +import pathlib +import subprocess + + +def compress_file(filename): + subprocess.run(["xz", "-z", str(filename)]) + + +def find_files(base_dir, extension, days): + delta = datetime.timedelta(days=days) + now = datetime.datetime.now() + for path in base_dir.rglob(f"*{extension}"): + stem = path.name.removesuffix(extension) + date = datetime.datetime.fromisoformat(stem) + if date < now - delta: + yield path + + +def compress_logs(base_dir, days): + for path in find_files(base_dir, ".log", days): + logging.info("Compressing log file %s", str(path)) + compress_file(path) + + +def remove_logs(base_dir, days): + for path in find_files(base_dir, ".log.xz", days): + logging.info("Removing log file %s", str(path)) + path.unlink() + + +def main(): + + parser = argparse.ArgumentParser() + parser.add_argument("--compress-days", type=int, default=0) + parser.add_argument("--keep-days", type=int, default=0) + parser.add_argument( + "--base-dir", type=pathlib.Path, default="/var/log/remote" + ) + + args = parser.parse_args() + + logging.basicConfig(format="%(levelname)s %(message)s", level=logging.INFO) + + logging.info("Rotate script started") + + if args.compress_days > 0: + compress_logs(args.base_dir, args.compress_days) + + if args.keep_days > 0: + remove_logs(args.base_dir, args.keep_days) + + logging.info("Rotate script done") + + +if __name__ == "__main__": + main() diff --git a/roles/rsyslog_collector/handlers/main.yml b/roles/rsyslog_collector/handlers/main.yml new file mode 100644 index 0000000..60f493a --- /dev/null +++ b/roles/rsyslog_collector/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Run systemd daemon-reload + systemd: + daemon_reload: true +... diff --git a/roles/rsyslog_collector/meta/main.yml b/roles/rsyslog_collector/meta/main.yml new file mode 100644 index 0000000..8e7f44c --- /dev/null +++ b/roles/rsyslog_collector/meta/main.yml @@ -0,0 +1,4 @@ +--- +dependencies: + - role: rsyslog_common +... diff --git a/roles/rsyslog_collector/tasks/main.yml b/roles/rsyslog_collector/tasks/main.yml new file mode 100644 index 0000000..dc64fcc --- /dev/null +++ b/roles/rsyslog_collector/tasks/main.yml @@ -0,0 +1,57 @@ +--- +- name: Install rsyslog-relp if needed + become: true + apt: + name: rsyslog-relp + state: present + when: "rsyslog_inputs | selectattr('proto', 'eq', 'relp') | list" + +- name: Ensure log storage directory exists + become: true + file: + path: "{{ rsyslog_collector_base_dir }}" + state: directory + owner: root + group: adm + mode: u=rwx,g=rwx,o= + +- name: Deploy rsyslog input configuration file + become: true + template: + src: 20-collector.conf.j2 + dest: /etc/rsyslog.d/20-collector.conf + owner: root + group: root + mode: u=rw,g=r,o=r + notify: Restart rsyslog + +- name: Install rotate script + become: true + copy: + src: rotate + dest: "{{ rsyslog_collector_rotate_path }}" + owner: root + group: root + mode: u=rwx,g=rx,o= + +- name: Install timer and service for rotate script + become: true + template: + src: "{{ item }}.j2" + dest: "/etc/systemd/system/{{ item }}" + owner: root + group: root + mode: u=rw,g=r,o= + loop: + - rotate-remote-logs.timer + - rotate-remote-logs.service + notify: + - Run systemd daemon-reload + +- name: Enable timer for log rotation + become: true + systemd: + name: rotate-remote-logs.timer + enabled: true + state: started +... diff --git a/roles/rsyslog_collector/templates/20-collector.conf.j2 b/roles/rsyslog_collector/templates/20-collector.conf.j2 new file mode 100644 index 0000000..897945f --- /dev/null +++ b/roles/rsyslog_collector/templates/20-collector.conf.j2 @@ -0,0 +1,54 @@ +{{ ansible_managed | comment }} + +module(load="mmrm1stspace") + +{% + set input_modules = { + "relp": "imrelp", + "udp": "imudp", + } +%} + +{% + for module in rsyslog_inputs + | map(attribute="proto") + | map("extract", input_modules) + | list + | unique +%} +module(load="{{ module }}") +{% endfor %} + +template(name="incomingFilename" type="list") { + constant(value="{{ rsyslog_collector_base_dir }}/") + property(name="fromhost-ip") + constant(value="/") + property(name="timegenerated" dateFormat="year") + constant(value="-") + property(name="timegenerated" dateFormat="month") + constant(value="-") + property(name="timegenerated" dateFormat="day") + constant(value=".log") +} + +ruleset(name="handleIncomingLogs") { + action(type="mmrm1stspace") + action( + type="omfile" + dynaFile="incomingFilename" + template="RSYSLOG_FileFormat" + ) + call sendLogsToRemote +} + +# TODO: add protocol-specific options (eg. TLS) +{% for input in rsyslog_inputs %} +input( + type="{{ input_modules[input.proto] }}" +{% if "address" in input %} + address="{{ input.address }}" +{% endif %} + port="{{ input.port }}" + ruleset="handleIncomingLogs" +) +{% endfor %} diff --git a/roles/rsyslog_collector/templates/rotate-remote-logs.service.j2 b/roles/rsyslog_collector/templates/rotate-remote-logs.service.j2 new file mode 100644 index 0000000..0e75a2b --- /dev/null +++ b/roles/rsyslog_collector/templates/rotate-remote-logs.service.j2 @@ -0,0 +1,12 @@ +{{ ansible_managed | comment }} + +[Unit] +Description=Rotate remote logs + +[Service] +User=root +Type=simple +ExecStart={{ rsyslog_collector_rotate_path }} \ + --base-dir {{ rsyslog_collector_base_dir }} \ + --compress-days {{ rsyslog_collector_compress_days }} \ + --keep-days {{ rsyslog_collector_keep_days }} diff --git a/roles/rsyslog_collector/templates/rotate-remote-logs.timer.j2 b/roles/rsyslog_collector/templates/rotate-remote-logs.timer.j2 new file mode 100644 index 0000000..f4b1151 --- /dev/null +++ b/roles/rsyslog_collector/templates/rotate-remote-logs.timer.j2 @@ -0,0 +1,10 @@ +{{ ansible_managed | comment }} + +[Unit] +Description=Rotate remote logs daily + +[Timer] +OnCalendar=daily + +[Install] +WantedBy=timers.target diff --git a/roles/rsyslog_common/defaults/main.yml b/roles/rsyslog_common/defaults/main.yml new file mode 100644 index 0000000..e5e6024 --- /dev/null +++ b/roles/rsyslog_common/defaults/main.yml @@ -0,0 +1,3 @@ +--- +rsyslog_outputs: [] +... diff --git a/roles/rsyslog_common/handlers/main.yml b/roles/rsyslog_common/handlers/main.yml new file mode 100644 index 0000000..563f2fc --- /dev/null +++ b/roles/rsyslog_common/handlers/main.yml @@ -0,0 +1,13 @@ +--- +- name: Restart rsyslog + become: true + systemd: + name: rsyslog.service + state: restarted + +- name: Restart systemd-journald + become: true + systemd: + name: systemd-journald.service + state: restarted +... diff --git a/roles/rsyslog_common/tasks/main.yml b/roles/rsyslog_common/tasks/main.yml new file mode 100644 index 0000000..030fd10 --- /dev/null +++ b/roles/rsyslog_common/tasks/main.yml @@ -0,0 +1,60 @@ +--- +- name: Install rsyslog + become: true + apt: + name: rsyslog + state: present + +- name: Install rsyslog modules if needed + become: true + apt: + name: "{{ item.pkg }}" + state: present + when: "rsyslog_outputs | selectattr('proto', 'eq', item.proto) | list" + loop: + - proto: relp + pkg: rsyslog-relp + - proto: redis + pkg: rsyslog-hiredis + +- name: Deploy main rsyslog configuration + become: true + template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: root + group: root + mode: u=rw,g=r,o=r + loop: + - src: rsyslog.conf.j2 + dest: /etc/rsyslog.conf + - src: 10-common.conf.j2 + dest: /etc/rsyslog.d/10-common.conf + notify: Restart rsyslog + +- name: Create journald.conf.d directory + become: true + file: + path: /etc/systemd/journald.conf.d + state: directory + owner: root + group: root + mode: u=rwx,g=rx,o=rx + +- name: Deploy journald configuration + become: true + template: + src: forward-syslog.conf.j2 + dest: /etc/systemd/journald.conf.d/forward-syslog.conf + owner: root + group: root + mode: u=rw,g=r,o=r + notify: Restart systemd-journald + +- name: Enable rsyslog service + become: true + systemd: + name: rsyslog.service + state: started + enabled: true +... diff --git a/roles/rsyslog_common/templates/10-common.conf.j2 b/roles/rsyslog_common/templates/10-common.conf.j2 new file mode 100644 index 0000000..36cd4dc --- /dev/null +++ b/roles/rsyslog_common/templates/10-common.conf.j2 @@ -0,0 +1,105 @@ +{{ ansible_managed | comment }} + +{% + set output_modules = { + "relp": "omrelp", + "udp": "omfwd", + "redis": "omhiredis", + } +%} + +global( + workDirectory="/var/spool/rsyslog" + preserveFQDN="on" +) + +# Collect logs via /dev/log +module(load="imuxsock") + +# Collect kernel logs +module(load="imklog") + +# Parse CEE logs +module(load="mmjsonparse") + +# Load export modules +{% + for module in rsyslog_outputs + | map(attribute="proto") + | map("extract", output_modules) + | list + | unique +%} +module(load="{{ module }}") +{% endfor %} + +# FIXME: Attention, il faut voir si rsyslog arrive bien à créer +# les fichiers de plusieurs jours (le 1er est peut-être crée avant +# de dropper les privilèges, mais les suivants je pense pas). +module( + load="builtin:omfile" + # Format avec dates précises + template="RSYSLOG_FileFormat" + fileOwner="root" + fileGroup="adm" + fileCreateMode="0640" + dirCreateMode="0755" +) + +template(name="templateJson" type="list" option.jsonf="on") { + property(outname="hostname_reported" name="hostname" format="jsonf") + property(outname="src" name="fromhost-ip" format="jsonf") + property(outname="facility" name="syslogfacility-text" format="jsonf") + property(outname="program" name="programname" format="jsonf") + property(outname="pid" name="procid" format="jsonf") + property(outname="time_reported" name="timereported" format="jsonf" + dateformat="rfc3339") + property(outname="time_generated" name="timegenerated" format="jsonf" + dateformat="rfc3339") + property(outname="message" name="msg" format="jsonf") +} + +ruleset(name="sendLogsToDisk") { + auth,authpriv.* action(type="omfile" file="/var/log/auth.log") + mail.* action(type="omfile" file="/var/log/mail.log" sync="off") + kern.* action(type="omfile" file="/var/log/kern.log") + *.*;auth,authpriv,mail,kern.none action(type="omfile" + file="/var/log/syslog.log" sync="off") +} + +# Send logs to remote collector(s) +ruleset(name="sendLogsToRemote") { +{% for output in rsyslog_outputs %} + action( + type="{{ output_modules[output.proto] }}" + +{% if output_modules[output.proto] == "omfwd" %} + protocol="{{ output.proto }}" + target="{{ output.address }}" + port="{{ output.port }}" +{% elif output_modules[output.proto] == "omhiredis" %} + server="{{ output.address }}" + serverport="{{ output.port }}" + mode="publish" + key="{{ output.key }}" + template="templateJson" +{% if output.password is defined %} + serverpassword="{{ output.password }}" +{% endif %} +{% elif output_modules[output.proto] == "omrelp" %} + target="{{ output.address }}" + port="{{ output.port }}" +{% endif %} + +{% if loop.index > 1 and output.fallback %} + action.execOnlyWhenPreviousIsSuspended="on" +{% endif %} + ) +{% endfor %} +} + +# Send local logs to files (useful for debugging or if the collector is down) +call sendLogsToDisk + +# Send local logs to the remote collector +call sendLogsToRemote diff --git a/roles/rsyslog_common/templates/forward-syslog.conf.j2 b/roles/rsyslog_common/templates/forward-syslog.conf.j2 new file mode 100644 index 0000000..c332de6 --- /dev/null +++ b/roles/rsyslog_common/templates/forward-syslog.conf.j2 @@ -0,0 +1,5 @@ +{{ ansible_managed | comment }} + +[Journal] +ForwardToSyslog=yes +MaxLevelSyslog=debug diff --git a/roles/rsyslog_common/templates/rsyslog.conf.j2 b/roles/rsyslog_common/templates/rsyslog.conf.j2 new file mode 100644 index 0000000..9c4c687 --- /dev/null +++ b/roles/rsyslog_common/templates/rsyslog.conf.j2 @@ -0,0 +1,3 @@ +{{ ansible_managed | comment }} + +include(file="/etc/rsyslog.d/*.conf") diff --git a/roles/update_motd/handlers/main.yml b/roles/update_motd/handlers/main.yml new file mode 100644 index 0000000..41dcc84 --- /dev/null +++ b/roles/update_motd/handlers/main.yml @@ -0,0 +1,10 @@ +--- +- name: Remove cached motd + become: true + file: + path: "{{ item }}" + state: absent + loop: + - /var/run/motd.dynamic + - /var/run/motd.dynamic.new +... diff --git a/roles/update_motd/tasks/main.yml b/roles/update_motd/tasks/main.yml new file mode 100644 index 0000000..f4a125d --- /dev/null +++ b/roles/update_motd/tasks/main.yml @@ -0,0 +1,53 @@ +--- +- name: Ensure update-motd.d exists + become: true + file: + path: /etc/update-motd.d + state: directory + mode: u=rwx,g=rx,o=rx + owner: root + group: root + +- name: Customize motd + become: true + template: + src: "{{ item }}" + dest: "/etc/update-motd.d/{{ item }}" + mode: u=rwx,g=rx,o=rx + owner: root + group: root + loop: + - 00-logo + - 10-messages + - 20-uname + notify: Remove cached motd + +- name: Remove Debian warranty motd + become: true + file: + path: /etc/motd + state: absent + notify: Remove cached motd + +- name: Ensure motd-messages exists + become: true + file: + path: /etc/motd-messages + state: directory + mode: u=rwx,g=rx,o=rx + owner: root + group: root + notify: Remove cached motd + +- name: Install additional motd messages + become: true + copy: + content: "✨ {{ item.message }}\n" + dest: "/etc/motd-messages/{{ item.key }}" + mode: u=rwx,g=rx,o=rx + owner: root + group: root + loop: "{{ motd_messages }}" + notify: Remove cached motd + when: motd_messages is defined +... diff --git a/roles/baseconfig/files/update-motd.d/00-logo b/roles/update_motd/templates/00-logo old mode 100755 new mode 100644 similarity index 87% rename from roles/baseconfig/files/update-motd.d/00-logo rename to roles/update_motd/templates/00-logo index 025257f..4456160 --- a/roles/baseconfig/files/update-motd.d/00-logo +++ b/roles/update_motd/templates/00-logo @@ -1,23 +1,23 @@ #!/bin/sh -# {{ ansible_managed }} +{{ ansible_managed | comment }} # Pretty uptime upSeconds="$(/usr/bin/cut -d. -f1 /proc/uptime)" -mins=$((${upSeconds}/60%60)) -hours=$((${upSeconds}/3600%24)) -days=$((${upSeconds}/86400)) -UPTIME=`printf "%d jours, %02dh%02dm" "$days" "$hours" "$mins"` +mins="$((upSeconds / 60 % 60))" +hours="$((upSeconds / 3600 % 24))" +days="$((upSeconds / 86400))" +UPTIME="$(printf "%d jours, %02dh%02dm" "$days" "$hours" "$mins")" # RAM -RAM=`free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2 }'` -DISK=`df -h | awk '$NF=="/"{printf "%d/%dGB (%s)\n", $3,$2,$5}'` +RAM="$(free -m | awk 'NR==2{printf "%s/%sMB (%.2f%%)\n", $3,$2,$3*100/$2}')" +DISK="$(df -h | awk '$NF=="/"{printf "%d/%dGB (%s)\n", $3,$2,$5}')" # Text font -bold=$(tput bold) -normal=$(tput sgr0) +bold="$(tput bold)" +normal="$(tput sgr0)" # Logo -cat << EOF +cat <