Merge branch 'aurore-dev' into 'master'
Aurore dev See merge request aurore/ansible!47
This commit is contained in:
Alexandre IOOSS
commit
e42bdd53a8
31 changed files with 1023 additions and 325 deletions
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -1,2 +1,2 @@
|
||||||
*.retry
|
*.retry
|
||||||
__pycache__
|
ldap-password.txt
|
||||||
|
|
|
||||||
|
|
@ -88,8 +88,7 @@ Dans la configuration SSH :
|
||||||
```
|
```
|
||||||
# Use a proxy jump server to log on all Aurore inventory
|
# Use a proxy jump server to log on all Aurore inventory
|
||||||
Host 10.128.0.* *.adm.auro.re
|
Host 10.128.0.* *.adm.auro.re
|
||||||
IdentityFile ~/.ssh/id_rsa
|
ProxyJump passerelle.auro.re
|
||||||
ProxyJump auro.re
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Il faut sa clé SSH configurée sur le serveur que l'on déploit.
|
Il faut sa clé SSH configurée sur le serveur que l'on déploit.
|
||||||
|
|
|
||||||
|
|
@ -33,3 +33,4 @@ become_ask_pass = True
|
||||||
# TO know what changed
|
# TO know what changed
|
||||||
always = yes
|
always = yes
|
||||||
|
|
||||||
|
scp_if_ssh = True
|
||||||
|
|
|
||||||
6
base.yml
6
base.yml
|
|
@ -12,6 +12,6 @@
|
||||||
|
|
||||||
# Clone LDAP on local geographic location
|
# Clone LDAP on local geographic location
|
||||||
# DON'T DO THIS AS IT RECREATES THE REPLICA
|
# DON'T DO THIS AS IT RECREATES THE REPLICA
|
||||||
# - hosts: ldap-replica
|
#- hosts: ldap-replica
|
||||||
# roles:
|
# roles:
|
||||||
# - ldap-replica
|
# - ldap-replica
|
||||||
|
|
|
||||||
17
copy-keys.sh
Executable file
17
copy-keys.sh
Executable file
|
|
@ -0,0 +1,17 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Grab valid unique hostnames from the Ansible inventory.
|
||||||
|
HOSTS=$(grep -ve '^[#\[]' hosts \
|
||||||
|
| grep -ve '^$' \
|
||||||
|
| grep -F adm.auro.re \
|
||||||
|
| grep -vf ssh-blacklist.txt \
|
||||||
|
| sort -u)
|
||||||
|
|
||||||
|
for host in $HOSTS; do
|
||||||
|
echo "Handling host $host"
|
||||||
|
|
||||||
|
# sshpass can be used for non-interactive password authentication.
|
||||||
|
# place your password in ldap-password.txt.
|
||||||
|
sshpass -f ldap-password.txt ssh-copy-id "$host"
|
||||||
|
done
|
||||||
|
|
@ -6,7 +6,7 @@ ansible_python_interpreter: /usr/bin/python3
|
||||||
# You can hash LDAP passwords with `slappasswd` tool
|
# You can hash LDAP passwords with `slappasswd` tool
|
||||||
ldap_base: 'dc=auro,dc=re'
|
ldap_base: 'dc=auro,dc=re'
|
||||||
ldap_master_ipv4: '10.128.0.11'
|
ldap_master_ipv4: '10.128.0.11'
|
||||||
ldap_master_uri: "ldap://{{ ldap_master_ipv4 }}"
|
ldap_master_uri: "ldap://re2o-ldap.adm.auro.re"
|
||||||
ldap_user_tree: "cn=Utilisateurs,{{ ldap_base }}"
|
ldap_user_tree: "cn=Utilisateurs,{{ ldap_base }}"
|
||||||
ldap_nslcd_bind_dn: "cn=nslcd,ou=service-users,{{ ldap_base }}"
|
ldap_nslcd_bind_dn: "cn=nslcd,ou=service-users,{{ ldap_base }}"
|
||||||
ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"
|
ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"
|
||||||
|
|
@ -36,3 +36,18 @@ monitoring_mail: 'monitoring.aurore@lists.crans.org'
|
||||||
matrix_webhooks_secret: "{{ vault_matrix_webhooks_secret }}"
|
matrix_webhooks_secret: "{{ vault_matrix_webhooks_secret }}"
|
||||||
matrix_discord_client_id: "559305991494303747"
|
matrix_discord_client_id: "559305991494303747"
|
||||||
matrix_discord_bot_token: "{{ vault_matrix_discord_bot_token }}"
|
matrix_discord_bot_token: "{{ vault_matrix_discord_bot_token }}"
|
||||||
|
|
||||||
|
###
|
||||||
|
# DNS
|
||||||
|
###
|
||||||
|
|
||||||
|
# Dernier octet (en décimal) de l'addresse des serveurs DNS récursifs de chaque
|
||||||
|
# résidence.
|
||||||
|
dns_host_suffix_main: 253
|
||||||
|
dns_host_suffix_backup: 153
|
||||||
|
|
||||||
|
backup_dns_servers:
|
||||||
|
- "80.67.169.12" # French Data Network (FDN) (ns0.fdn.fr)
|
||||||
|
|
||||||
|
|
||||||
|
mtu: 1400
|
||||||
|
|
|
||||||
4
group_vars/dhcp/vars.yml
Normal file
4
group_vars/dhcp/vars.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
---
|
||||||
|
dhcp_failover:
|
||||||
|
primary_host: dhcp-{{ apartment_block }}.adm.auro.re
|
||||||
|
secondary_host: dhcp-{{ apartment_block }}-backup.adm.auro.re
|
||||||
4
group_vars/edc/ldap_local_replica.yml
Normal file
4
group_vars/edc/ldap_local_replica.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
---
|
||||||
|
ldap_local_replica_uri:
|
||||||
|
- 'ldap://ldap-replica-edc.adm.auro.re'
|
||||||
|
|
||||||
8
group_vars/fleming/main.yml
Normal file
8
group_vars/fleming/main.yml
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
---
|
||||||
|
apartment_block: fleming
|
||||||
|
|
||||||
|
subnet_ids:
|
||||||
|
ap: 141
|
||||||
|
users_wired: 10
|
||||||
|
users_wifi: 11
|
||||||
|
|
||||||
7
group_vars/pacaterie/main.yml
Normal file
7
group_vars/pacaterie/main.yml
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
---
|
||||||
|
apartment_block: pacaterie
|
||||||
|
|
||||||
|
subnet_ids:
|
||||||
|
ap: 142
|
||||||
|
users_wired: 20
|
||||||
|
users_wifi: 21
|
||||||
375
hosts
375
hosts
|
|
@ -4,146 +4,56 @@
|
||||||
# > We name servers according to location, then type.
|
# > We name servers according to location, then type.
|
||||||
# > Then we regroup everything in global geographic and type groups.
|
# > Then we regroup everything in global geographic and type groups.
|
||||||
|
|
||||||
[ovh_physical]
|
[aurore_pve]
|
||||||
horus.adm.auro.re
|
#merlin.adm.auro.re
|
||||||
|
|
||||||
|
[aurore_vm]
|
||||||
|
#radius-aurore.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_pve]
|
||||||
|
#horus.adm.auro.re
|
||||||
|
|
||||||
[ovh_container]
|
[ovh_container]
|
||||||
synapse.adm.auro.re
|
#synapse.adm.auro.re
|
||||||
services-bdd.adm.auro.re
|
#services-bdd.adm.auro.re
|
||||||
phabricator.adm.auro.re
|
#phabricator.adm.auro.re
|
||||||
wiki.adm.auro.re
|
#wiki.adm.auro.re
|
||||||
www.adm.auro.re
|
#www.adm.auro.re
|
||||||
proxy.adm.auro.re
|
#proxy.adm.auro.re
|
||||||
matrix-services.adm.auro.re
|
#matrix-services.adm.auro.re
|
||||||
|
|
||||||
[ovh_vm]
|
[ovh_vm]
|
||||||
re2o-server.adm.auro.re
|
#re2o-server.adm.auro.re
|
||||||
re2o-ldap.adm.auro.re
|
#re2o-ldap.adm.auro.re
|
||||||
re2o-db.adm.auro.re
|
#re2o-db.adm.auro.re
|
||||||
serge.adm.auro.re
|
#serge.adm.auro.re
|
||||||
passbolt.adm.auro.re
|
#passbolt.adm.auro.re
|
||||||
vpn-ovh.adm.auro.re
|
#vpn-ovh.adm.auro.re
|
||||||
docker-ovh.adm.auro.re
|
#docker-ovh.adm.auro.re
|
||||||
switchs-manager.adm.auro.re
|
#switchs-manager.adm.auro.re
|
||||||
|
#radius-aurore.adm.auro.re
|
||||||
|
|
||||||
[fleming_physical]
|
[ovh_testing_vm]
|
||||||
|
#re2o-test.adm.auro.re
|
||||||
|
|
||||||
|
[fleming_pve]
|
||||||
freya.adm.auro.re
|
freya.adm.auro.re
|
||||||
marki.adm.auro.re
|
marki.adm.auro.re
|
||||||
|
|
||||||
[fleming_vm]
|
[fleming_vm]
|
||||||
ldap-replica-fleming1.adm.auro.re
|
ldap-replica-fleming.adm.auro.re
|
||||||
#ldap-replica-fleming-fo.adm.auro.re
|
ldap-replica-fleming-backup.adm.auro.re
|
||||||
dhcp-fleming.adm.auro.re
|
dhcp-fleming.adm.auro.re
|
||||||
#dhcp-fleming-fo.adm.auro.re
|
dhcp-fleming-backup.adm.auro.re
|
||||||
dns-fleming.adm.auro.re
|
dns-fleming.adm.auro.re
|
||||||
#dns-fleming-fo.adm.auro.re
|
dns-fleming-backup.adm.auro.re
|
||||||
prometheus-fleming.adm.auro.re
|
prometheus-fleming.adm.auro.re
|
||||||
#prometheus-fleming-fo.adm.auro.re
|
#prometheus-fleming-fo.adm.auro.re
|
||||||
radius-fleming.adm.auro.re
|
radius-fleming.adm.auro.re
|
||||||
#radius-fleming-fo.adm.auro.re
|
radius-fleming-backup.adm.auro.re
|
||||||
unifi-fleming.adm.auro.re
|
unifi-fleming.adm.auro.re
|
||||||
routeur-fleming.adm.auro.re
|
routeur-fleming.adm.auro.re
|
||||||
#routeur-fleming-fo.adm.auro.re
|
routeur-fleming-backup.adm.auro.re
|
||||||
|
|
||||||
[fleming_unifi]
|
|
||||||
fa-0-1.borne.auro.re
|
|
||||||
fa-1-1.borne.auro.re
|
|
||||||
fa-2-1.borne.auro.re
|
|
||||||
#fa-2-2.borne.auro.re
|
|
||||||
fa-3-1.borne.auro.re
|
|
||||||
fa-4-1.borne.auro.re
|
|
||||||
fb-0-1.borne.auro.re
|
|
||||||
fb-1-1.borne.auro.re
|
|
||||||
#fb-1-2.borne.auro.re
|
|
||||||
fb-2-1.borne.auro.re
|
|
||||||
#fb-2-2.borne.auro.re
|
|
||||||
fb-3-1.borne.auro.re
|
|
||||||
#fb-3-2.borne.auro.re
|
|
||||||
fb-4-1.borne.auro.re
|
|
||||||
#fb-4-2.borne.auro.re
|
|
||||||
fc-0-1.borne.auro.re
|
|
||||||
fc-1-1.borne.auro.re
|
|
||||||
fc-2-1.borne.auro.re
|
|
||||||
fc-3-1.borne.auro.re
|
|
||||||
fc-4-1.borne.auro.re
|
|
||||||
fd-0-1.borne.auro.re
|
|
||||||
fd-1-1.borne.auro.re
|
|
||||||
fd-2-1.borne.auro.re
|
|
||||||
fd-3-1.borne.auro.re
|
|
||||||
#fd-4-1.borne.auro.re
|
|
||||||
fe-0-1.borne.auro.re
|
|
||||||
fe-1-1.borne.auro.re
|
|
||||||
fe-1-2.borne.auro.re
|
|
||||||
fe-2-1.borne.auro.re
|
|
||||||
fe-2-2.borne.auro.re
|
|
||||||
fe-3-1.borne.auro.re
|
|
||||||
fe-3-2.borne.auro.re
|
|
||||||
fe-4-1.borne.auro.re
|
|
||||||
fe-4-2.borne.auro.re
|
|
||||||
ff-0-1.borne.auro.re
|
|
||||||
ff-0-f.borne.auro.re
|
|
||||||
ff-1-1.borne.auro.re
|
|
||||||
ff-1-2.borne.auro.re
|
|
||||||
ff-2-1.borne.auro.re
|
|
||||||
ff-2-2.borne.auro.re
|
|
||||||
ff-3-1.borne.auro.re
|
|
||||||
ff-3-2.borne.auro.re
|
|
||||||
ff-4-1.borne.auro.re
|
|
||||||
ff-4-2.borne.auro.re
|
|
||||||
fg-0-1.borne.auro.re
|
|
||||||
fg-1-1.borne.auro.re
|
|
||||||
#fg-1-2.borne.auro.re
|
|
||||||
fg-2-1.borne.auro.re
|
|
||||||
fg-2-2.borne.auro.re
|
|
||||||
fg-3-1.borne.auro.re
|
|
||||||
fg-3-2.borne.auro.re
|
|
||||||
fg-4-1.borne.auro.re
|
|
||||||
#fg-4-2.borne.auro.re
|
|
||||||
fh-0-1.borne.auro.re
|
|
||||||
fh-1-1.borne.auro.re
|
|
||||||
fh-1-2.borne.auro.re
|
|
||||||
fh-2-1.borne.auro.re
|
|
||||||
fh-2-2.borne.auro.re
|
|
||||||
fh-3-1.borne.auro.re
|
|
||||||
fh-3-2.borne.auro.re
|
|
||||||
fh-4-1.borne.auro.re
|
|
||||||
fh-4-2.borne.auro.re
|
|
||||||
fi-0-1.borne.auro.re
|
|
||||||
fi-1-1.borne.auro.re
|
|
||||||
fi-1-2.borne.auro.re
|
|
||||||
fi-2-1.borne.auro.re
|
|
||||||
fi-2-2.borne.auro.re
|
|
||||||
fi-3-1.borne.auro.re
|
|
||||||
fi-3-2.borne.auro.re
|
|
||||||
fi-4-1.borne.auro.re
|
|
||||||
fi-4-2.borne.auro.re
|
|
||||||
fj-0-1.borne.auro.re
|
|
||||||
fj-1-1.borne.auro.re
|
|
||||||
fj-1-2.borne.auro.re
|
|
||||||
fj-2-1.borne.auro.re
|
|
||||||
fj-2-2.borne.auro.re
|
|
||||||
fj-3-1.borne.auro.re
|
|
||||||
fj-3-2.borne.auro.re
|
|
||||||
fj-4-1.borne.auro.re
|
|
||||||
fj-4-2.borne.auro.re
|
|
||||||
fk-0-1.borne.auro.re
|
|
||||||
fk-1-1.borne.auro.re
|
|
||||||
fk-1-2.borne.auro.re
|
|
||||||
fk-2-1.borne.auro.re
|
|
||||||
fk-2-2.borne.auro.re
|
|
||||||
fk-3-1.borne.auro.re
|
|
||||||
fk-3-2.borne.auro.re
|
|
||||||
fk-4-1.borne.auro.re
|
|
||||||
fk-4-2.borne.auro.re
|
|
||||||
fl-0-1.borne.auro.re
|
|
||||||
fl-1-1.borne.auro.re
|
|
||||||
fl-1-2.borne.auro.re
|
|
||||||
fl-2-1.borne.auro.re
|
|
||||||
fl-2-2.borne.auro.re
|
|
||||||
fl-3-1.borne.auro.re
|
|
||||||
fl-3-2.borne.auro.re
|
|
||||||
fl-4-1.borne.auro.re
|
|
||||||
fl-4-2.borne.auro.re
|
|
||||||
|
|
||||||
[pacaterie_physical]
|
[pacaterie_physical]
|
||||||
mordred.adm.auro.re
|
mordred.adm.auro.re
|
||||||
|
|
@ -151,130 +61,43 @@ titan.adm.auro.re
|
||||||
|
|
||||||
[pacaterie_vm]
|
[pacaterie_vm]
|
||||||
ldap-replica-pacaterie.adm.auro.re
|
ldap-replica-pacaterie.adm.auro.re
|
||||||
#ldap-replica-pacaterie-fo.adm.auro.re
|
ldap-replica-pacaterie-backup.adm.auro.re
|
||||||
dhcp-pacaterie.adm.auro.re
|
dhcp-pacaterie.adm.auro.re
|
||||||
#dhcp-pacaterie-fo.adm.auro.re
|
dhcp-pacaterie-backup.adm.auro.re
|
||||||
dns-pacaterie.adm.auro.re
|
dns-pacaterie.adm.auro.re
|
||||||
#dns-pacaterie-fo.adm.auro.re
|
dns-pacaterie-backup.adm.auro.re
|
||||||
prometheus-pacaterie.adm.auro.re
|
prometheus-pacaterie.adm.auro.re
|
||||||
#prometheus-pacaterie-fo.adm.auro.re
|
#prometheus-pacaterie-fo.adm.auro.re
|
||||||
radius-pacaterie.adm.auro.re
|
radius-pacaterie.adm.auro.re
|
||||||
#radius-pacaterie-fo.adm.auro.re
|
radius-pacaterie-backup.adm.auro.re
|
||||||
unifi-pacaterie.adm.auro.re
|
unifi-pacaterie.adm.auro.re
|
||||||
routeur-pacaterie.adm.auro.re
|
routeur-pacaterie.adm.auro.re
|
||||||
#routeur-pacaterie-fo.adm.auro.re
|
routeur-pacaterie-backup.adm.auro.re
|
||||||
|
|
||||||
[pacaterie_unifi]
|
[edc_pve]
|
||||||
pc-1-1.borne.auro.re
|
|
||||||
pn-0-1.borne.auro.re
|
|
||||||
pn-0-2.borne.auro.re
|
|
||||||
pn-0-3.borne.auro.re
|
|
||||||
pn-1-1.borne.auro.re
|
|
||||||
pn-1-2.borne.auro.re
|
|
||||||
pn-1-3.borne.auro.re
|
|
||||||
pn-2-1.borne.auro.re
|
|
||||||
pn-2-2.borne.auro.re
|
|
||||||
pn-2-3.borne.auro.re
|
|
||||||
pn-3-1.borne.auro.re
|
|
||||||
pn-3-2.borne.auro.re
|
|
||||||
pn-3-3.borne.auro.re
|
|
||||||
pn-4-1.borne.auro.re
|
|
||||||
pn-4-2.borne.auro.re
|
|
||||||
pn-4-3.borne.auro.re
|
|
||||||
ps-0-1.borne.auro.re
|
|
||||||
ps-0-2.borne.auro.re
|
|
||||||
ps-0-3.borne.auro.re
|
|
||||||
ps-1-1.borne.auro.re
|
|
||||||
ps-1-2.borne.auro.re
|
|
||||||
ps-1-3.borne.auro.re
|
|
||||||
ps-2-1.borne.auro.re
|
|
||||||
ps-2-2.borne.auro.re
|
|
||||||
ps-2-3.borne.auro.re
|
|
||||||
ps-3-1.borne.auro.re
|
|
||||||
ps-3-2.borne.auro.re
|
|
||||||
ps-4-1.borne.auro.re
|
|
||||||
ps-4-2.borne.auro.re
|
|
||||||
ps-4-3.borne.auro.re
|
|
||||||
|
|
||||||
[edc_physical]
|
|
||||||
chapalux.adm.auro.re
|
chapalux.adm.auro.re
|
||||||
|
|
||||||
[edc_vm]
|
[edc_vm]
|
||||||
ldap-replica-edc.adm.auro.re
|
|
||||||
ldap-replica-edc-fo.adm.auro.re
|
|
||||||
dhcp-edc.adm.auro.re
|
|
||||||
dhcp-edc-fo.adm.auro.re
|
|
||||||
dns-edc.adm.auro.re
|
|
||||||
dns-edc-fo.adm.auro.re
|
|
||||||
prometheus-edc.adm.auro.re
|
|
||||||
prometheus-edc-fo.adm.auro.re
|
|
||||||
radius-edc.adm.auro.re
|
|
||||||
radius-edc-fo.adm.auro.re
|
|
||||||
unifi-edc.adm.auro.re
|
|
||||||
routeur-edc.adm.auro.re
|
routeur-edc.adm.auro.re
|
||||||
routeur-edc-fo.adm.auro.re
|
dns-edc.adm.auro.re
|
||||||
|
dhcp-edc.adm.auro.re
|
||||||
|
unifi-edc.adm.auro.re
|
||||||
|
radius-edc.adm.auro.re
|
||||||
|
routeur-aurore.adm.auro.re
|
||||||
|
ldap-replica-edc.adm.auro.re
|
||||||
|
#ldap-replica-edc-backup.adm.auro.re
|
||||||
|
|
||||||
[edc_unifi]
|
[gs_pve]
|
||||||
ep-0-1.borne.auro.re
|
#perceval.adm.auro.re
|
||||||
|
|
||||||
[georgesand_physical]
|
[gs_vm]
|
||||||
perceval.adm.auro.re
|
routeur-gs.adm.auro.re
|
||||||
|
unifi-gs.adm.auro.re
|
||||||
[georgesand_vm]
|
radius-gs.adm.auro.re
|
||||||
ldap-replica-georgesand.adm.auro.re
|
dns-gs.adm.auro.re
|
||||||
ldap-replica-georgesand-fo.adm.auro.re
|
dhcp-gs.adm.auro.re
|
||||||
dhcp-georgesand.adm.auro.re
|
#ldap-replica-gs.adm.auro.re
|
||||||
dhcp-georgesand-fo.adm.auro.re
|
#ldap-replica-gs-backup.adm.auro.re
|
||||||
dns-georgesand.adm.auro.re
|
|
||||||
dns-georgesand-fo.adm.auro.re
|
|
||||||
prometheus-georgesand.adm.auro.re
|
|
||||||
prometheus-georgesand-fo.adm.auro.re
|
|
||||||
radius-georgesand.adm.auro.re
|
|
||||||
radius-georgesand-fo.adm.auro.re
|
|
||||||
unifi-georgesand.adm.auro.re
|
|
||||||
routeur-georgesand.adm.auro.re
|
|
||||||
routeur-georgesand-fo.adm.auro.re
|
|
||||||
|
|
||||||
[georgesand_unifi]
|
|
||||||
ga-0-1.borne.auro.re
|
|
||||||
ga-1-1.borne.auro.re
|
|
||||||
ga-2-1.borne.auro.re
|
|
||||||
ga-3-1.borne.auro.re
|
|
||||||
ga-4-1.borne.auro.re
|
|
||||||
ga-5-1.borne.auro.re
|
|
||||||
ga-5-2.borne.auro.re
|
|
||||||
gb-1-1.borne.auro.re
|
|
||||||
gb-2-1.borne.auro.re
|
|
||||||
gb-3-1.borne.auro.re
|
|
||||||
gb-4-1.borne.auro.re
|
|
||||||
gb-5-1.borne.auro.re
|
|
||||||
gc-1-1.borne.auro.re
|
|
||||||
gc-2-1.borne.auro.re
|
|
||||||
gc-3-1.borne.auro.re
|
|
||||||
gc-4-1.borne.auro.re
|
|
||||||
gc-5-1.borne.auro.re
|
|
||||||
gd-1-1.borne.auro.re
|
|
||||||
gd-2-1.borne.auro.re
|
|
||||||
gd-3-1.borne.auro.re
|
|
||||||
gd-4-1.borne.auro.re
|
|
||||||
gd-5-1.borne.auro.re
|
|
||||||
gd-garage-1.borne.auro.re
|
|
||||||
ge-0-1.borne.auro.re
|
|
||||||
ge-1-1.borne.auro.re
|
|
||||||
ge-2-1.borne.auro.re
|
|
||||||
ge-3-1.borne.auro.re
|
|
||||||
ge-4-1.borne.auro.re
|
|
||||||
ge-5-1.borne.auro.re
|
|
||||||
gf-0-1.borne.auro.re
|
|
||||||
gf-1-1.borne.auro.re
|
|
||||||
gf-2-1.borne.auro.re
|
|
||||||
gf-3-1.borne.auro.re
|
|
||||||
gf-4-1.borne.auro.re
|
|
||||||
gf-5-1.borne.auro.re
|
|
||||||
|
|
||||||
#####################
|
|
||||||
# Geographic groups #
|
|
||||||
#####################
|
|
||||||
|
|
||||||
# everything at ovh
|
# everything at ovh
|
||||||
[ovh:children]
|
[ovh:children]
|
||||||
|
|
@ -296,19 +119,13 @@ pacaterie_unifi
|
||||||
|
|
||||||
# everything at edc
|
# everything at edc
|
||||||
[edc:children]
|
[edc:children]
|
||||||
edc_physical
|
edc_pve
|
||||||
edc_vm
|
edc_vm
|
||||||
edc_unifi
|
|
||||||
|
|
||||||
# everything at georgesand
|
# everything at georgesand
|
||||||
[georgesand:children]
|
[gs:children]
|
||||||
georgesand_physical
|
gs_pve
|
||||||
georgesand_vm
|
gs_vm
|
||||||
georgesand_unifi
|
|
||||||
|
|
||||||
#####################
|
|
||||||
# Type groups #
|
|
||||||
#####################
|
|
||||||
|
|
||||||
# every LXC container
|
# every LXC container
|
||||||
[container:children]
|
[container:children]
|
||||||
|
|
@ -320,23 +137,59 @@ ovh_vm
|
||||||
fleming_vm
|
fleming_vm
|
||||||
pacaterie_vm
|
pacaterie_vm
|
||||||
edc_vm
|
edc_vm
|
||||||
georgesand_vm
|
gs_vm
|
||||||
|
|
||||||
# every physical
|
# every PVE
|
||||||
[physical:children]
|
[pve:children]
|
||||||
ovh_physical
|
ovh_pve
|
||||||
fleming_physical
|
fleming_pve
|
||||||
pacaterie_physical
|
pacaterie_pve
|
||||||
edc_physical
|
edc_pve
|
||||||
georgesand_physical
|
gs_pve
|
||||||
|
|
||||||
# every unifi access point
|
[dhcp]
|
||||||
[unifi:children]
|
dhcp-fleming.adm.auro.re
|
||||||
fleming_unifi
|
dhcp-fleming-backup.adm.auro.re
|
||||||
pacaterie_unifi
|
#dhcp-pacaterie.adm.auro.re
|
||||||
edc_unifi
|
#dhcp-pacaterie-backup.adm.auro.re
|
||||||
georgesand_unifi
|
#dhcp-edc.adm.auro.re
|
||||||
|
#dhcp-gs.adm.auro.re
|
||||||
|
|
||||||
[all:vars]
|
[recursive_dns:children]
|
||||||
# Force remote to use Python 3
|
rdns_main
|
||||||
ansible_python_interpreter=/usr/bin/python3
|
rdns_backup
|
||||||
|
|
||||||
|
[rdns_main]
|
||||||
|
dns-fleming.adm.auro.re
|
||||||
|
dns-pacaterie.adm.auro.re
|
||||||
|
|
||||||
|
[rdns_backup]
|
||||||
|
dns-fleming-backup.adm.auro.re
|
||||||
|
dns-pacaterie-backup.adm.auro.re
|
||||||
|
|
||||||
|
|
||||||
|
# FIXME:
|
||||||
|
#dns-edc.adm.auro.re
|
||||||
|
#dns-gs.adm.auro.re
|
||||||
|
|
||||||
|
[ldap_replica:children]
|
||||||
|
ldap_replica_fleming
|
||||||
|
ldap_replica_pacaterie
|
||||||
|
ldap_replica_edc
|
||||||
|
ldap_replica_gs
|
||||||
|
|
||||||
|
[ldap_replica_fleming]
|
||||||
|
ldap-replica-fleming.adm.auro.re
|
||||||
|
ldap-replica-fleming-backup.adm.auro.re
|
||||||
|
|
||||||
|
[ldap_replica_pacaterie]
|
||||||
|
ldap-replica-pacaterie.adm.auro.re
|
||||||
|
ldap-replica-pacaterie-backup.adm.auro.re
|
||||||
|
|
||||||
|
[ldap_replica_edc]
|
||||||
|
ldap-replica-edc.adm.auro.re
|
||||||
|
ldap-replica-edc-backup.adm.auro.re
|
||||||
|
|
||||||
|
[ldap_replica_gs]
|
||||||
|
ldap-replica-gs.adm.auro.re
|
||||||
|
ldap-replica-gs-backup.adm.auro.re
|
||||||
|
|
|
||||||
131
hosts.save
Normal file
131
hosts.save
Normal file
|
|
@ -0,0 +1,131 @@
|
||||||
|
# Aurore servers inventory
|
||||||
|
|
||||||
|
# How to name your server ?
|
||||||
|
# > We name servers according to location, then type.
|
||||||
|
# > So all containers at OVH are in ovh-container.
|
||||||
|
# > Then we regroup everything in global geographic and type groups.
|
||||||
|
|
||||||
|
[ovh_pve]
|
||||||
|
#horus.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_container]
|
||||||
|
#synapse.adm.auro.re
|
||||||
|
#services-bdd.adm.auro.re
|
||||||
|
#phabricator.adm.auro.re
|
||||||
|
#wiki.adm.auro.re
|
||||||
|
#www.adm.auro.re
|
||||||
|
#proxy.adm.auro.re
|
||||||
|
#matrix-services.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_vm]
|
||||||
|
#re2o-server.adm.auro.re
|
||||||
|
#re2o-ldap.adm.auro.re
|
||||||
|
#re2o-db.adm.auro.re
|
||||||
|
#serge.adm.auro.re
|
||||||
|
#passbolt.adm.auro.re
|
||||||
|
#vpn-ovh.adm.auro.re
|
||||||
|
#docker-ovh.adm.auro.re
|
||||||
|
#switchs-manager.adm.auro.re
|
||||||
|
#radius-aurore.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_testing_vm]
|
||||||
|
#re2o-test.adm.auro.re
|
||||||
|
|
||||||
|
[fleming_pve]
|
||||||
|
#freya.adm.auro.re
|
||||||
|
|
||||||
|
[fleming_vm]
|
||||||
|
#ldap-replica-fleming1.adm.auro.re
|
||||||
|
#ldap-replica-fleming2.adm.auro.re
|
||||||
|
#dhcp-fleming.adm.auro.re
|
||||||
|
#dhcp-fleming-backup.adm.auro.re
|
||||||
|
#dns-fleming.adm.auro.re
|
||||||
|
#dns-fleming-backup.adm.auro.re
|
||||||
|
#radius-fleming.adm.auro.re
|
||||||
|
#radius-fleming-backup.adm.auro.re
|
||||||
|
#routeur-fleming.adm.auro.re
|
||||||
|
#routeur-fleming-backup.adm.auro.re
|
||||||
|
#unifi-fleming.adm.auro.re
|
||||||
|
#prometheus
|
||||||
|
|
||||||
|
[pacaterie_pve]
|
||||||
|
#mordred.adm.auro.re
|
||||||
|
|
||||||
|
[pacaterie_vm]
|
||||||
|
#ldap-replica-pacaterie.adm.auro.re
|
||||||
|
#dhcp-pacaterie.adm.auro.re
|
||||||
|
#dns-pacaterie.adm.auro.re
|
||||||
|
#prometheus-pacaterie.adm.auro.re
|
||||||
|
#radius-pacaterie.adm.auro.re
|
||||||
|
#unifi-pacaterie.adm.auro.re
|
||||||
|
#routeur-pacaterie.adm.auro.re
|
||||||
|
|
||||||
|
[edc_pve]
|
||||||
|
#chapalux.adm.auro.re
|
||||||
|
|
||||||
|
[edc_vm]
|
||||||
|
#routeur-edc.adm.auro.re
|
||||||
|
#dns-edc.adm.auro.re
|
||||||
|
#dhcp-edc.adm.auro.re
|
||||||
|
#unifi-edc.adm.auro.re
|
||||||
|
#radius-edc.adm.auro.re
|
||||||
|
#routeur-aurore.adm.auro.re
|
||||||
|
#10.128.0.254
|
||||||
|
|
||||||
|
[georgesand_pve]
|
||||||
|
#perceval.adm.auro.re
|
||||||
|
|
||||||
|
[georgesand_vm]
|
||||||
|
#routeur-gs.adm.auro.re
|
||||||
|
#unifi-gs.adm.auro.re
|
||||||
|
#radius-gs.adm.auro.re
|
||||||
|
#dns-gs.adm.auro.re
|
||||||
|
#dhcp-gs.adm.auro.re
|
||||||
|
|
||||||
|
# everything at ovh
|
||||||
|
[ovh:children]
|
||||||
|
ovh_pve
|
||||||
|
ovh_container
|
||||||
|
ovh_vm
|
||||||
|
|
||||||
|
# everything at ovh_testing
|
||||||
|
[ovh_testing:children]
|
||||||
|
ovh_testing_vm
|
||||||
|
|
||||||
|
# everything at fleming
|
||||||
|
[fleming:children]
|
||||||
|
fleming_pve
|
||||||
|
fleming_vm
|
||||||
|
|
||||||
|
# everything at pacaterie
|
||||||
|
[pacaterie:children]
|
||||||
|
pacaterie_pve
|
||||||
|
pacaterie_vm
|
||||||
|
|
||||||
|
# everything at edc
|
||||||
|
[edc:children]
|
||||||
|
edc_pve
|
||||||
|
edc_vm
|
||||||
|
|
||||||
|
# everything at georgesand
|
||||||
|
[georgesand:children]
|
||||||
|
georgesand_pve
|
||||||
|
georgesand_vm
|
||||||
|
|
||||||
|
# every LXC container
|
||||||
|
[container:children]
|
||||||
|
ovh_container
|
||||||
|
|
||||||
|
# every virtual machine
|
||||||
|
[vm:children]
|
||||||
|
ovh_vm
|
||||||
|
fleming_vm
|
||||||
|
pacaterie_vm
|
||||||
|
|
||||||
|
# every PVE
|
||||||
|
[pve:children]
|
||||||
|
ovh_pve
|
||||||
|
fleming_pve
|
||||||
|
pacaterie_pve
|
||||||
|
edc_pve
|
||||||
|
georgesand_pve
|
||||||
165
hosts.save.1
Normal file
165
hosts.save.1
Normal file
|
|
@ -0,0 +1,165 @@
|
||||||
|
# Aurore servers inventory
|
||||||
|
|
||||||
|
# How to name your server ?
|
||||||
|
# > We name servers according to location, then type.
|
||||||
|
# > So all containers at OVH are in ovh-container.
|
||||||
|
# > Then we regroup everything in global geographic and type groups.
|
||||||
|
|
||||||
|
[aurore_pve]
|
||||||
|
merlin.adm.auro.re
|
||||||
|
|
||||||
|
[aurore_vm]
|
||||||
|
radius-aurore.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_pve]
|
||||||
|
horus.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_container]
|
||||||
|
synapse.adm.auro.re
|
||||||
|
services-bdd.adm.auro.re
|
||||||
|
phabricator.adm.auro.re
|
||||||
|
wiki.adm.auro.re
|
||||||
|
www.adm.auro.re
|
||||||
|
proxy.adm.auro.re
|
||||||
|
matrix-services.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_vm]
|
||||||
|
re2o-server.adm.auro.re
|
||||||
|
re2o-ldap.adm.auro.re
|
||||||
|
re2o-db.adm.auro.re
|
||||||
|
serge.adm.auro.re
|
||||||
|
passbolt.adm.auro.re
|
||||||
|
vpn-ovh.adm.auro.re
|
||||||
|
docker-ovh.adm.auro.re
|
||||||
|
switchs-manager.adm.auro.re
|
||||||
|
radius-aurore.adm.auro.re
|
||||||
|
|
||||||
|
[ovh_testing_vm]
|
||||||
|
re2o-test.adm.auro.re
|
||||||
|
|
||||||
|
[fleming_pve]
|
||||||
|
freya.adm.auro.re
|
||||||
|
marki.adm.auro.re
|
||||||
|
|
||||||
|
[fleming_vm]
|
||||||
|
ldap-replica-fleming.adm.auro.re
|
||||||
|
ldap-replica-fleming-backup.adm.auro.re
|
||||||
|
dhcp-fleming.adm.auro.re
|
||||||
|
dhcp-fleming-backup.adm.auro.re
|
||||||
|
dns-fleming.adm.auro.re
|
||||||
|
dns-fleming-backup.adm.auro.re
|
||||||
|
prometheus-fleming.adm.auro.re
|
||||||
|
radius-fleming.adm.auro.re
|
||||||
|
radius-fleming-backup.adm.auro.re
|
||||||
|
unifi-fleming.adm.auro.re
|
||||||
|
routeur-fleming.adm.auro.re
|
||||||
|
routeur-fleming-backup.adm.auro.re
|
||||||
|
|
||||||
|
[pacaterie_pve]
|
||||||
|
mordred.adm.auro.re
|
||||||
|
titan.adm.auro.re
|
||||||
|
|
||||||
|
[pacaterie_vm]
|
||||||
|
ldap-replica-pacaterie.adm.auro.re
|
||||||
|
ldap-replica-pacaterie-backup.adm.auro.re
|
||||||
|
dhcp-pacaterie.adm.auro.re
|
||||||
|
dhcp-pacaterie-backup.adm.auro.re
|
||||||
|
dns-pacaterie.adm.auro.re
|
||||||
|
dns-pacaterie-backup.adm.auro.re
|
||||||
|
prometheus-pacaterie.adm.auro.re
|
||||||
|
radius-pacaterie.adm.auro.re
|
||||||
|
radius-pacaterie-backup.adm.auro.re
|
||||||
|
unifi-pacaterie.adm.auro.re
|
||||||
|
routeur-pacaterie.adm.auro.re
|
||||||
|
routeur-pacaterie-backup.adm.auro.re
|
||||||
|
|
||||||
|
[edc_pve]
|
||||||
|
chapalux.adm.auro.re
|
||||||
|
|
||||||
|
[edc_vm]
|
||||||
|
routeur-edc.adm.auro.re
|
||||||
|
dns-edc.adm.auro.re
|
||||||
|
dhcp-edc.adm.auro.re
|
||||||
|
unifi-edc.adm.auro.re
|
||||||
|
radius-edc.adm.auro.re
|
||||||
|
routeur-aurore.adm.auro.re
|
||||||
|
|
||||||
|
[gs_pve]
|
||||||
|
perceval.adm.auro.re
|
||||||
|
|
||||||
|
[gs_vm]
|
||||||
|
routeur-gs.adm.auro.re
|
||||||
|
unifi-gs.adm.auro.re
|
||||||
|
radius-gs.adm.auro.re
|
||||||
|
dns-gs.adm.auro.re
|
||||||
|
dhcp-gs.adm.auro.re
|
||||||
|
|
||||||
|
# everything at ovh
|
||||||
|
[ovh:children]
|
||||||
|
ovh_pve
|
||||||
|
ovh_container
|
||||||
|
ovh_vm
|
||||||
|
|
||||||
|
# everything at ovh_testing
|
||||||
|
[ovh_testing:children]
|
||||||
|
ovh_testing_vm
|
||||||
|
|
||||||
|
# everything at fleming
|
||||||
|
[fleming:children]
|
||||||
|
fleming_pve
|
||||||
|
fleming_vm
|
||||||
|
|
||||||
|
# everything at pacaterie
|
||||||
|
[pacaterie:children]
|
||||||
|
pacaterie_pve
|
||||||
|
pacaterie_vm
|
||||||
|
|
||||||
|
# everything at edc
|
||||||
|
[edc:children]
|
||||||
|
edc_pve
|
||||||
|
edc_vm
|
||||||
|
|
||||||
|
# everything at georgesand
|
||||||
|
[gs:children]
|
||||||
|
gs_pve
|
||||||
|
gs_vm
|
||||||
|
|
||||||
|
# every LXC container
|
||||||
|
[container:children]
|
||||||
|
ovh_container
|
||||||
|
|
||||||
|
# every virtual machine
|
||||||
|
[vm:children]
|
||||||
|
ovh_vm
|
||||||
|
fleming_vm
|
||||||
|
pacaterie_vm
|
||||||
|
gs_vm
|
||||||
|
|
||||||
|
# every PVE
|
||||||
|
[pve:children]
|
||||||
|
ovh_pve
|
||||||
|
fleming_pve
|
||||||
|
pacaterie_pve
|
||||||
|
edc_pve
|
||||||
|
gs_pve
|
||||||
|
|
||||||
|
[dhcp]
|
||||||
|
dhcp-fleming.adm.auro.re
|
||||||
|
dhcp-fleming-backup.adm.auro.re
|
||||||
|
dhcp-pacaterie.adm.auro.re
|
||||||
|
dhcp-pacaterie-backup.adm.auro.re
|
||||||
|
dhcp-edc.adm.auro.re
|
||||||
|
dhcp-gs.adm.auro.re
|
||||||
|
|
||||||
|
[dns]
|
||||||
|
dns-fleming.adm.auro.re
|
||||||
|
dns-fleming-backup.adm.auro.re
|
||||||
|
dns-pacaterie.adm.auro.re
|
||||||
|
dns-pacaterie-backup.adm.auro.re
|
||||||
|
dns-edc.adm.auro.re
|
||||||
|
dns-gs.adm.auro.re
|
||||||
|
|
||||||
|
[ldap-replica]
|
||||||
|
ldap-replica-fleming.adm.auro.re
|
||||||
|
ldap-replica-fleming-backup.adm.auro.re
|
||||||
|
ldap-replica-pacaterie-backup.adm.auro.re
|
||||||
67
network.yml
67
network.yml
|
|
@ -1,47 +1,54 @@
|
||||||
---
|
---
|
||||||
# Deploy DHCP
|
# Set up DHCP servers.
|
||||||
- hosts: dhcp-fleming.adm.auro.re,dhcp-pacaterie.adm.auro.re
|
- hosts: dhcp
|
||||||
vars:
|
vars:
|
||||||
service_repo: https://gitlab.federez.net/re2o/dhcp.git
|
service_repo: https://gitlab.federez.net/re2o/dhcp.git
|
||||||
service_name: dhcp
|
service_name: dhcp
|
||||||
service_version: master
|
service_version: master
|
||||||
service_config:
|
service_config:
|
||||||
hostname: re2o-server.adm.auro.re
|
hostname: re2o.auro.re
|
||||||
username: service-user
|
username: service-user
|
||||||
password: "{{ vault_serviceuser_passwd }}"
|
password: "{{ vault_serviceuser_passwd }}"
|
||||||
dhcp:
|
|
||||||
authoritative: yes
|
|
||||||
roles:
|
roles:
|
||||||
- re2o-service
|
- re2o-service
|
||||||
- isc-dhcp-server
|
- isc-dhcp-server
|
||||||
|
|
||||||
# Deploy DNS
|
|
||||||
- hosts: serge.adm.auro.re
|
|
||||||
vars:
|
# Deploy unbound DNS server (recursive).
|
||||||
service_repo: https://gitlab.crans.org/nounous/re2o-dns.git
|
- hosts: recursive_dns
|
||||||
service_name: dns
|
|
||||||
service_version: crans
|
|
||||||
service_config:
|
|
||||||
hostname: re2o-server.adm.auro.re
|
|
||||||
username: service-user
|
|
||||||
password: "{{ vault_serviceuser_passwd }}"
|
|
||||||
roles:
|
roles:
|
||||||
- re2o-service
|
- unbound
|
||||||
|
|
||||||
|
|
||||||
|
# WIP: Deploy authoritative DNS servers
|
||||||
|
# - hosts: authoritative_dns
|
||||||
|
# vars:
|
||||||
|
# service_repo: https://gitlab.crans.org/nounous/re2o-dns.git
|
||||||
|
# service_name: dns
|
||||||
|
# service_version: crans
|
||||||
|
# service_config:
|
||||||
|
# hostname: re2o-server.adm.auro.re
|
||||||
|
# username: service-user
|
||||||
|
# password: "{{ vault_serviceuser_passwd }}"
|
||||||
|
# roles:
|
||||||
|
# - re2o-service
|
||||||
|
|
||||||
|
|
||||||
# Deploy Unifi Controller
|
# Deploy Unifi Controller
|
||||||
- hosts: unifi-fleming.adm.auro.re,unifi-pacaterie.adm.auro.re
|
#- hosts: unifi-fleming.adm.auro.re,unifi-pacaterie.adm.auro.re
|
||||||
roles:
|
# roles:
|
||||||
- unifi-controller
|
# - unifi-controller
|
||||||
|
|
||||||
# Deploy Re2o switch service
|
# Deploy Re2o switch service
|
||||||
- hosts: switchs-manager.adm.auro.re
|
#- hosts: switchs-manager.adm.auro.re
|
||||||
vars:
|
# vars:
|
||||||
service_repo: https://gitlab.federez.net/re2o/switchs.git
|
# service_repo: https://gitlab.federez.net/re2o/switchs.git
|
||||||
service_name: switchs
|
# service_name: switchs
|
||||||
service_version: master
|
# service_version: master
|
||||||
service_config:
|
# service_config:
|
||||||
hostname: re2o-server.adm.auro.re
|
# hostname: re2o-server.adm.auro.re
|
||||||
username: service-user
|
# username: service-user
|
||||||
password: "{{ vault_serviceuser_passwd }}"
|
# password: "{{ vault_serviceuser_passwd }}"
|
||||||
roles:
|
# roles:
|
||||||
- re2o-service
|
# - re2o-service
|
||||||
|
|
|
||||||
155
proxmox.yml
155
proxmox.yml
|
|
@ -3,6 +3,161 @@
|
||||||
- hosts: proxy.adm.auro.re # Host with python-proxmoxer and python-requests
|
- hosts: proxy.adm.auro.re # Host with python-proxmoxer and python-requests
|
||||||
become: false # We do not need root as we use Proxmox API
|
become: false # We do not need root as we use Proxmox API
|
||||||
|
|
||||||
|
vars:
|
||||||
|
vm_definitions:
|
||||||
|
|
||||||
|
# Réseau Pacaterie
|
||||||
|
- name: ldap-replica-pacaterie
|
||||||
|
virtu: mordred
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dhcp-pacaterie
|
||||||
|
virtu: mordred
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dns-pacaterie
|
||||||
|
virtu: mordred
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: prometheus-pacaterie
|
||||||
|
virtu: mordred
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: radius-pacaterie
|
||||||
|
virtu: mordred
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: unifi-pacaterie
|
||||||
|
virtu: mordred
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-9.9.0-amd64-netinst.iso
|
||||||
|
|
||||||
|
# Réseau Fleming
|
||||||
|
- name: ldap-replica-fleming1
|
||||||
|
virtu: freya
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dhcp-fleming
|
||||||
|
virtu: freya
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dns-fleming
|
||||||
|
virtu: freya
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: prometheus-fleming
|
||||||
|
virtu: freya
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: radius-fleming
|
||||||
|
virtu: freya
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: unifi-fleming
|
||||||
|
virtu: freya
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-9.9.0-amd64-netinst.iso
|
||||||
|
|
||||||
|
# Réseau EdC
|
||||||
|
- name: ldap-replica-edc1
|
||||||
|
virtu: chapalux
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dhcp-edc
|
||||||
|
virtu: chapalux
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dns-edc
|
||||||
|
virtu: chapalux
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: prometheus-edc
|
||||||
|
virtu: chapalux
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: radius-edc
|
||||||
|
virtu: chapalux
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: unifi-edc
|
||||||
|
virtu: chapalux
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-9.9.0-amd64-netinst.iso
|
||||||
|
|
||||||
|
# Réseau George Sand
|
||||||
|
- name: ldap-replica-gs1
|
||||||
|
virtu: perceval
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dhcp-gs
|
||||||
|
virtu: perceval
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: dns-gs
|
||||||
|
virtu: perceval
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: prometheus-gs
|
||||||
|
virtu: perceval
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: radius-gs
|
||||||
|
virtu: perceval
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-10.0.0-amd64-netinst.iso
|
||||||
|
- name: unifi-gs
|
||||||
|
virtu: perceval
|
||||||
|
cores: 2 # 2 mimimum, 10 maximum
|
||||||
|
memory: 1024 # M
|
||||||
|
disksize: 16 # G
|
||||||
|
installiso: debian-9.9.0-amd64-netinst.iso
|
||||||
|
|
||||||
vars_prompt:
|
vars_prompt:
|
||||||
- name: "password"
|
- name: "password"
|
||||||
prompt: "Enter LDAP password for your user"
|
prompt: "Enter LDAP password for your user"
|
||||||
|
|
|
||||||
|
|
@ -8,14 +8,58 @@
|
||||||
retries: 3
|
retries: 3
|
||||||
until: apt_result is succeeded
|
until: apt_result is succeeded
|
||||||
|
|
||||||
- name: Configure isc-dhcp-server
|
- name: Ensure dhcp log directory exists
|
||||||
|
file:
|
||||||
|
path: /var/log/dhcp
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: u=rwx,g=rx,a=rx
|
||||||
|
state: directory
|
||||||
|
|
||||||
|
- name: Ensure rsyslog knows where to send dhcp logs
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/rsyslog.conf
|
||||||
|
line: "local7.* /var/log/dhcp/dhcpd.log"
|
||||||
|
|
||||||
|
- name: Configure dhcp log rotation
|
||||||
|
template:
|
||||||
|
src: logrotate.d/dhcp.j2
|
||||||
|
dest: /etc/logrotate.d/dhcp
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
- name: set up cron to reload dhcp re2o service
|
||||||
|
cron:
|
||||||
|
# Do not change this name or idempotence *might* be lost.
|
||||||
|
name: dhcp-re2o-service
|
||||||
|
cron_file: re2o-services
|
||||||
|
minute: "*"
|
||||||
|
hour: "*"
|
||||||
|
day: "*"
|
||||||
|
weekday: "*"
|
||||||
|
month: "*"
|
||||||
|
user: root
|
||||||
|
job: "/usr/bin/python3 /var/local/re2o-services/dhcp/main.py"
|
||||||
|
|
||||||
|
- name: restart rsyslog
|
||||||
|
systemd:
|
||||||
|
name: rsyslog
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: Configure /etc/default/isc-dhcp-server
|
||||||
|
template:
|
||||||
|
src: default/isc-dhcp-server.j2
|
||||||
|
dest: /etc/default/isc-dhcp-server
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
- name: Configure dhcp-failover.conf
|
||||||
|
template:
|
||||||
|
src: dhcp/dhcp-failover.conf.j2
|
||||||
|
dest: /etc/dhcp/dhcp-failover.conf
|
||||||
|
mode: 0600
|
||||||
|
when: dhcp_failover is defined
|
||||||
|
|
||||||
|
- name: Configure dhcpd.conf
|
||||||
template:
|
template:
|
||||||
src: dhcp/dhcpd.conf.j2
|
src: dhcp/dhcpd.conf.j2
|
||||||
dest: /etc/dhcp/dhcpd.conf
|
dest: /etc/dhcp/dhcpd.conf
|
||||||
mode: 0600
|
mode: 0600
|
||||||
|
|
||||||
- name: Ensure that isc-dhcp-server is started
|
|
||||||
systemd:
|
|
||||||
name: isc-dhcp-server
|
|
||||||
state: started
|
|
||||||
enabled: true
|
|
||||||
|
|
|
||||||
4
roles/isc-dhcp-server/templates/cron.d/re2o-services
Normal file
4
roles/isc-dhcp-server/templates/cron.d/re2o-services
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
# Régénération des services re2o
|
||||||
|
|
||||||
|
# Régénération du dhcp
|
||||||
|
* * * * * root /usr/bin/python3 /var/local/re2o-services/dhcp/main.py
|
||||||
18
roles/isc-dhcp-server/templates/default/isc-dhcp-server.j2
Normal file
18
roles/isc-dhcp-server/templates/default/isc-dhcp-server.j2
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
# Defaults for isc-dhcp-server (sourced by /etc/init.d/isc-dhcp-server)
|
||||||
|
|
||||||
|
# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
|
||||||
|
#DHCPDv4_CONF=/etc/dhcp/dhcpd.conf
|
||||||
|
#DHCPDv6_CONF=/etc/dhcp/dhcpd6.conf
|
||||||
|
|
||||||
|
# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
|
||||||
|
#DHCPDv4_PID=/var/run/dhcpd.pid
|
||||||
|
#DHCPDv6_PID=/var/run/dhcpd6.pid
|
||||||
|
|
||||||
|
# Additional options to start dhcpd with.
|
||||||
|
# Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
|
||||||
|
#OPTIONS=""
|
||||||
|
|
||||||
|
# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
|
||||||
|
# Separate multiple interfaces with spaces, e.g. "eth0 eth1".
|
||||||
|
INTERFACESv4="ens19 ens20 ens21"
|
||||||
|
INTERFACESv6=""
|
||||||
31
roles/isc-dhcp-server/templates/dhcp/dhcp-failover.conf.j2
Normal file
31
roles/isc-dhcp-server/templates/dhcp/dhcp-failover.conf.j2
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
failover peer "dhcp-failover" {
|
||||||
|
{% if inventory_hostname == dhcp_failover.primary_host %}
|
||||||
|
primary;
|
||||||
|
|
||||||
|
# MCLT = Maximum Client Lead Time.
|
||||||
|
# Must be specified on the primary, forbidden on the secondary.
|
||||||
|
mclt 3600;
|
||||||
|
|
||||||
|
# Address or DNS name on which this node listens for connections
|
||||||
|
# from its failover peer.
|
||||||
|
address {{ dhcp_failover.primary_host }};
|
||||||
|
peer address {{ dhcp_failover.secondary_host }};
|
||||||
|
|
||||||
|
# Load balancing.
|
||||||
|
split 128;
|
||||||
|
{% endif %}
|
||||||
|
{% if inventory_hostname == dhcp_failover.secondary_host %}
|
||||||
|
secondary;
|
||||||
|
# Address and peer address are reversed on the secondary node.
|
||||||
|
address {{ dhcp_failover.secondary_host }};
|
||||||
|
peer address {{ dhcp_failover.primary_host }};
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
# The following options can be shared between primary and
|
||||||
|
# secondary failover peers.
|
||||||
|
port 647;
|
||||||
|
peer port 647;
|
||||||
|
max-response-delay 30;
|
||||||
|
max-unacked-updates 10;
|
||||||
|
load balance max seconds 3;
|
||||||
|
}
|
||||||
|
|
@ -1,15 +1,12 @@
|
||||||
# dhcpd.conf
|
|
||||||
# {{ ansible_managed }}
|
# {{ ansible_managed }}
|
||||||
|
|
||||||
# option definitions common to all supported networks...
|
default-lease-time 86400;
|
||||||
#option domain-name "example.org";
|
max-lease-time 86400;
|
||||||
#option domain-name-servers ns1.example.org, ns2.example.org;
|
|
||||||
|
|
||||||
# We have tagged network so use last 4 bytes for tag (1500 max)
|
# Option definitions common to all supported networks.
|
||||||
option interface-mtu 1496;
|
|
||||||
|
|
||||||
default-lease-time 600;
|
option interface-mtu {{ mtu }};
|
||||||
max-lease-time 7200;
|
option root-path "/";
|
||||||
|
|
||||||
# The ddns-updates-style parameter controls whether or not the server will
|
# The ddns-updates-style parameter controls whether or not the server will
|
||||||
# attempt to do a DNS update when a lease is confirmed. We default to the
|
# attempt to do a DNS update when a lease is confirmed. We default to the
|
||||||
|
|
@ -19,15 +16,65 @@ ddns-update-style none;
|
||||||
|
|
||||||
# If this DHCP server is the official DHCP server for the local
|
# If this DHCP server is the official DHCP server for the local
|
||||||
# network, the authoritative directive should be uncommented.
|
# network, the authoritative directive should be uncommented.
|
||||||
{% if dhcp.authoritative %}
|
|
||||||
authoritative;
|
authoritative;
|
||||||
{% else %}
|
|
||||||
#authoritative;
|
log-facility local7;
|
||||||
|
|
||||||
|
{% if dhcp_failover is defined %}
|
||||||
|
include "/etc/dhcp/dhcp-failover.conf";
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
# Use this to send dhcp log messages to a different log file (you also
|
# Bornes WiFi
|
||||||
# have to hack syslog.conf to complete the redirection).
|
subnet 10.{{ subnet_ids.ap }}.0.0 netmask 255.255.0.0 {
|
||||||
#log-facility local7;
|
interface "ens19";
|
||||||
|
option subnet-mask 255.255.0.0;
|
||||||
|
option broadcast-address 10.{{ subnet_ids.ap }}.255.255;
|
||||||
|
option routers 10.{{ subnet_ids.ap }}.0.250;
|
||||||
|
option domain-name "borne.auro.re";
|
||||||
|
option domain-search "borne.auro.re";
|
||||||
|
|
||||||
|
option domain-name-servers 10.{{ subnet_ids.ap }}.0.{{ dns_host_suffix_main }}, 10.{{ subnet_ids.ap }}.0.{{ dns_host_suffix_backup }}, {{ backup_dns_servers|join(', ') }};
|
||||||
|
include "/var/local/re2o-services/dhcp/generated/dhcp.borne.auro.re.list";
|
||||||
|
|
||||||
|
deny unknown-clients;
|
||||||
|
}
|
||||||
|
|
||||||
|
# Users filaire
|
||||||
|
subnet 10.{{ subnet_ids.users_wired }}.0.0 netmask 255.255.0.0 {
|
||||||
|
interface "ens20";
|
||||||
|
option subnet-mask 255.255.0.0;
|
||||||
|
option broadcast-address 10.{{ subnet_ids.users_wired }}.255.255;
|
||||||
|
option routers 10.{{ subnet_ids.users_wired }}.0.240;
|
||||||
|
option domain-name "fil.{{ apartment_block }}.auro.re";
|
||||||
|
option domain-search "auro.re";
|
||||||
|
|
||||||
|
option domain-name-servers 10.{{ subnet_ids.users_wired }}.0.{{ dns_host_suffix_main }}, 10.{{ subnet_ids.users_wired }}.0.{{ dns_host_suffix_backup }}, {{ backup_dns_servers|join(', ') }};
|
||||||
|
|
||||||
|
include "/var/local/re2o-services/dhcp/generated/dhcp.fil.{{ apartment_block }}.auro.re.list";
|
||||||
|
|
||||||
|
deny unknown-clients;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# Users WiFi
|
||||||
|
subnet 10.{{ subnet_ids.users_wifi }}.0.0 netmask 255.255.0.0 {
|
||||||
|
interface "ens21";
|
||||||
|
option subnet-mask 255.255.0.0;
|
||||||
|
option broadcast-address 10.{{ subnet_ids.users_wifi }}.255.255;
|
||||||
|
option routers 10.{{ subnet_ids.users_wifi }}.0.240;
|
||||||
|
option domain-name "wifi.{{ apartment_block }}.auro.re";
|
||||||
|
option domain-search "auro.re";
|
||||||
|
|
||||||
|
option domain-name-servers 10.{{ subnet_ids.users_wifi }}.0.{{ dns_host_suffix_main }}, 10.{{ subnet_ids.users_wifi }}.0.{{ dns_host_suffix_backup }}, {{ backup_dns_servers|join(', ') }};
|
||||||
|
|
||||||
|
include "/var/local/re2o-services/dhcp/generated/dhcp.wifi.{{ apartment_block }}.auro.re.list";
|
||||||
|
|
||||||
|
pool {
|
||||||
|
range 10.{{ subnet_ids.users_wifi }}.8.0 10.{{ subnet_ids.users_wifi }}.10.255;
|
||||||
|
|
||||||
|
{% if dhcp_failover is defined %}
|
||||||
|
failover peer "dhcp-failover";
|
||||||
|
{% endif %}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
# Aurore topology
|
|
||||||
# TODO
|
|
||||||
|
|
|
||||||
11
roles/isc-dhcp-server/templates/logrotate.d/dhcp.j2
Normal file
11
roles/isc-dhcp-server/templates/logrotate.d/dhcp.j2
Normal file
|
|
@ -0,0 +1,11 @@
|
||||||
|
/var/log/dhcp/dhcpd.log {
|
||||||
|
# common options
|
||||||
|
daily
|
||||||
|
rotate 365
|
||||||
|
missingok
|
||||||
|
compress
|
||||||
|
delaycompress
|
||||||
|
notifempty
|
||||||
|
|
||||||
|
copytruncate
|
||||||
|
}
|
||||||
|
|
@ -5,9 +5,24 @@ uid nslcd
|
||||||
gid nslcd
|
gid nslcd
|
||||||
|
|
||||||
# The location at which the LDAP server(s) should be reachable.
|
# The location at which the LDAP server(s) should be reachable.
|
||||||
{% if ldap_local_replica_uri is defined %}
|
{% if 'fleming_vm' in group_names or 'fleming_pve' in group_names %}
|
||||||
{% for uri in ldap_local_replica_uri %}
|
{% for uri in groups['ldap_replica_fleming'] %}
|
||||||
uri {{ uri }}
|
uri ldap://{{ uri }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endif %}
|
||||||
|
{% if 'pacaterie_vm' in group_names or 'pacaterie_pve' in group_names %}
|
||||||
|
{% for uri in groups['ldap_replica_pacaterie'] %}
|
||||||
|
uri ldap://{{ uri }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endif %}
|
||||||
|
{% if 'edc_vm' in group_names or 'edc_pve' in group_names %}
|
||||||
|
{% for uri in groups['ldap_replica_edc'] %}
|
||||||
|
uri ldap://{{ uri }}
|
||||||
|
{% endfor %}
|
||||||
|
{% endif %}
|
||||||
|
{% if 'gs_vm' in group_names or 'gs_pve' in group_names %}
|
||||||
|
{% for uri in groups['ldap_replica_gs'] %}
|
||||||
|
uri ldap://{{ uri }}
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
uri {{ ldap_master_uri }}
|
uri {{ ldap_master_uri }}
|
||||||
|
|
@ -35,4 +50,3 @@ tls_cacertfile /etc/ssl/certs/ca-certificates.crt
|
||||||
|
|
||||||
# The search scope.
|
# The search scope.
|
||||||
#scope sub
|
#scope sub
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -9,6 +9,7 @@
|
||||||
repo: "{{ service_repo }}"
|
repo: "{{ service_repo }}"
|
||||||
dest: "{{ service_homedir }}/{{ service_name }}"
|
dest: "{{ service_homedir }}/{{ service_name }}"
|
||||||
version: "{{ service_version }}"
|
version: "{{ service_version }}"
|
||||||
|
force: true
|
||||||
become: true
|
become: true
|
||||||
become_user: "{{ service_user }}"
|
become_user: "{{ service_user }}"
|
||||||
|
|
||||||
|
|
|
||||||
7
roles/unbound/handlers/main.yml
Normal file
7
roles/unbound/handlers/main.yml
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
- name: restart unbound
|
||||||
|
systemd:
|
||||||
|
state: restarted
|
||||||
|
name: unbound
|
||||||
|
|
||||||
|
- name: read unbound apparmor config
|
||||||
|
command: apparmor_parser -r /etc/apparmor.d/usr.sbin.unbound
|
||||||
62
roles/unbound/tasks/main.yml
Normal file
62
roles/unbound/tasks/main.yml
Normal file
|
|
@ -0,0 +1,62 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
# This is used to let unbound bind to the right IP addresses.
|
||||||
|
- name: set dns_host_suffix (main)
|
||||||
|
set_fact:
|
||||||
|
dns_host_suffix: "{{ dns_host_suffix_main }}"
|
||||||
|
when: "'rdns_main' in group_names"
|
||||||
|
|
||||||
|
- name: set dns_host_suffix (backup)
|
||||||
|
set_fact:
|
||||||
|
dns_host_suffix: "{{ dns_host_suffix_backup }}"
|
||||||
|
when: "'rdns_backup' in group_names"
|
||||||
|
|
||||||
|
|
||||||
|
- name: install unbound
|
||||||
|
apt:
|
||||||
|
update_cache: true
|
||||||
|
name: unbound
|
||||||
|
state: present
|
||||||
|
register: unbound_install
|
||||||
|
|
||||||
|
- name: add unbound-control configuration
|
||||||
|
template:
|
||||||
|
src: unbound-control.conf.j2
|
||||||
|
dest: /etc/unbound/unbound.conf.d/unbound-control.conf
|
||||||
|
mode: 0644
|
||||||
|
notify: restart unbound
|
||||||
|
|
||||||
|
- name: setup main unbound config file
|
||||||
|
template:
|
||||||
|
src: unbound.conf.j2
|
||||||
|
dest: /etc/unbound/unbound.conf
|
||||||
|
mode: 0644
|
||||||
|
notify: restart unbound
|
||||||
|
|
||||||
|
- name: ensure unbound log directory exists
|
||||||
|
file:
|
||||||
|
path: /var/log/unbound
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
owner: unbound
|
||||||
|
group: unbound
|
||||||
|
|
||||||
|
- name: ask apparmor to allow unbound to write to log file
|
||||||
|
template:
|
||||||
|
src: unbound-apparmor-config
|
||||||
|
dest: /etc/apparmor.d/local/usr.sbin.unbound
|
||||||
|
mode: '0644'
|
||||||
|
notify: read unbound apparmor config
|
||||||
|
|
||||||
|
- name: setup unbound log rotation
|
||||||
|
template:
|
||||||
|
src: unbound-logrotate.j2
|
||||||
|
dest: /etc/logrotate.d/unbound
|
||||||
|
mode: 0644
|
||||||
|
|
||||||
|
- name: setup recursive DNS server config
|
||||||
|
template:
|
||||||
|
src: recursive.conf.j2
|
||||||
|
dest: /etc/unbound/unbound.conf.d/recursive.conf
|
||||||
|
mode: 0644
|
||||||
|
notify: restart unbound
|
||||||
48
roles/unbound/templates/recursive.conf.j2
Normal file
48
roles/unbound/templates/recursive.conf.j2
Normal file
|
|
@ -0,0 +1,48 @@
|
||||||
|
# {{ ansible_managed }}
|
||||||
|
|
||||||
|
server:
|
||||||
|
# Timestamps use UTC ASCII instead of UNIX epoch.
|
||||||
|
log-time-ascii: yes
|
||||||
|
|
||||||
|
# Only log errors.
|
||||||
|
verbosity: 0
|
||||||
|
log-servfail: yes
|
||||||
|
|
||||||
|
logfile: "/var/log/unbound/unbound.log"
|
||||||
|
|
||||||
|
do-ip4: yes
|
||||||
|
# FIXME: IPv6 deployment... someday...
|
||||||
|
do-ip6: no
|
||||||
|
|
||||||
|
# IP addresses on which to listen.
|
||||||
|
interface: 10.{{ subnet_ids.ap }}.0.{{ dns_host_suffix }}
|
||||||
|
interface: 10.{{ subnet_ids.users_wired }}.0.{{ dns_host_suffix }}
|
||||||
|
interface: 10.{{ subnet_ids.users_wifi }}.0.{{ dns_host_suffix }}
|
||||||
|
|
||||||
|
|
||||||
|
# By default, anything other than localhost is refused.
|
||||||
|
# Whitelist some subnets:
|
||||||
|
access-control: 10.{{ subnet_ids.ap }}.0.0/16 allow
|
||||||
|
access-control: 10.{{ subnet_ids.users_wired }}.0.0/16 allow
|
||||||
|
access-control: 10.{{ subnet_ids.users_wifi }}.0.0/16 allow
|
||||||
|
|
||||||
|
num-threads: {{ ansible_processor_vcpus }}
|
||||||
|
|
||||||
|
private-address: 10.0.0.0/8
|
||||||
|
|
||||||
|
# The host cache TTL affects blacklisting of supposedly bogus hosts.
|
||||||
|
# The default was 900 (15 minutes).
|
||||||
|
infra-host-ttl: 60
|
||||||
|
|
||||||
|
|
||||||
|
# The following is vital, we were having issues
|
||||||
|
# with DNSSEC that turned out to be due to UDP responses that were too
|
||||||
|
# large.
|
||||||
|
|
||||||
|
# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
|
||||||
|
# is set with msg-buffer-size). 1472 can solve fragmentation (timeouts)
|
||||||
|
edns-buffer-size: {{ mtu }}
|
||||||
|
|
||||||
|
# Maximum UDP response size (not applied to TCP response).
|
||||||
|
# Suggested values are 512 to 4096. Default is 4096. 65536 disables it.
|
||||||
|
max-udp-size: {{ mtu }}
|
||||||
1
roles/unbound/templates/unbound-apparmor-config
Normal file
1
roles/unbound/templates/unbound-apparmor-config
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
/var/log/unbound/unbound.log rw,
|
||||||
15
roles/unbound/templates/unbound-control.conf.j2
Normal file
15
roles/unbound/templates/unbound-control.conf.j2
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
remote-control:
|
||||||
|
# Enable remote control with unbound-control(8) here.
|
||||||
|
# set up the keys and certificates with unbound-control-setup.
|
||||||
|
control-enable: yes
|
||||||
|
|
||||||
|
# what interfaces are listened to for remote control.
|
||||||
|
# give 0.0.0.0 and ::0 to listen to all interfaces.
|
||||||
|
control-interface: 127.0.0.1
|
||||||
|
|
||||||
|
# port number for remote control operations.
|
||||||
|
control-port: 8953
|
||||||
|
|
||||||
|
# Disable the use of certificates for unbound-control.
|
||||||
|
# It's only listening locally, there's no need for the added complexity.
|
||||||
|
control-use-cert: "no"
|
||||||
13
roles/unbound/templates/unbound-logrotate.j2
Normal file
13
roles/unbound/templates/unbound-logrotate.j2
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
/var/log/unbound/*.log {
|
||||||
|
daily
|
||||||
|
rotate 30
|
||||||
|
missingok
|
||||||
|
notifempty
|
||||||
|
compress
|
||||||
|
delaycompress
|
||||||
|
sharedscripts
|
||||||
|
create 644
|
||||||
|
postrotate
|
||||||
|
/usr/local/sbin/unbound-control log_reopen
|
||||||
|
endscript
|
||||||
|
}
|
||||||
12
roles/unbound/templates/unbound.conf.j2
Normal file
12
roles/unbound/templates/unbound.conf.j2
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
# {{ ansible_managed }}
|
||||||
|
#
|
||||||
|
# Unbound configuration file for Debian.
|
||||||
|
#
|
||||||
|
# See the unbound.conf(5) man page.
|
||||||
|
#
|
||||||
|
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
|
||||||
|
# reference config file.
|
||||||
|
#
|
||||||
|
# The following line includes additional configuration files from the
|
||||||
|
# /etc/unbound/unbound.conf.d directory.
|
||||||
|
include: "/etc/unbound/unbound.conf.d/*.conf"
|
||||||
4
ssh-blacklist.txt
Normal file
4
ssh-blacklist.txt
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
ldap-replica-edc-backup.adm.auro.re
|
||||||
|
ldap-replica-fleming-backup.adm.auro.re
|
||||||
|
ldap-replica-gs.adm.auro.re
|
||||||
|
ldap-replica-gs-backup.adm.auro.re
|
||||||
Loading…
Reference in a new issue