536 commits

Author	SHA1	Message	Date
Jeltz	21a3d5af2a	Add bullseye support in 'prometheus_node'	2021-03-15 10:50:40 +01:00
jeltz	4305a60639	Merge pull request 'Backups with borg and borgmatic' (#39) from backups into master ... Reviewed-on: Aurore/ansible#39	2021-03-15 07:53:33 +01:00
Jeltz	3f3f688da4	Use 'present' instead of 'latest' (ansible-lint)	2021-03-15 07:51:48 +01:00
Jeltz	6713b550b6	Merge branch 'master' into backups	2021-03-15 07:50:11 +01:00
Jeltz	cb3ec07121	Use 'inventory_hostname' instead of 'ansible_fqdn' ... While 'ansible_fdqn' can be changed by a compromised host, 'inventory_hostname' can't (hopefully). It should therefore no longer be possible for the said host to access the backups of another host.	2021-03-15 07:25:09 +01:00
Solal Nathan	243ec1fe9d	[borgbackup_client] VaRi0u5 f1X3s	2021-03-15 01:04:42 +01:00
Jeltz	f15b222cdc	Allow root to log as postgres	2021-03-14 23:45:36 +01:00
Solal Nathan	7480a7c565	[borgbackup_client] precedence rules and sain defaults for borg config	2021-03-14 22:02:34 +01:00
Solal Nathan	b14b359027	[borgbackup_client] add exlude path to conf	2021-03-14 19:21:15 +01:00
Solal Nathan	33a1ec02f3	[borgbackup_client] update config directory to be homogeneous	2021-03-14 19:07:02 +01:00
Solal Nathan	ebfc4f2a26	[borgbackup_client] do update cache	2021-03-14 19:03:44 +01:00
Jeltz	86f8b31159	Delegate facts for borgbackup_client	2021-03-14 18:44:13 +01:00
Jeltz	d9f1104309	Move id_remote to /etc/borgmatic	2021-03-14 18:42:26 +01:00
Solal Nathan	c6cae75031	[borgbackup_server] fix /borg permissions	2021-03-14 18:29:33 +01:00
Solal Nathan	46d10022ea	[borgbackup_client] fix rentention date to int and list correctly source directories	2021-03-14 18:24:36 +01:00
Solal Nathan	ff750c5b63	[borgbackup_client] remove 1 minute sleep and fix verbosity	2021-03-14 18:23:44 +01:00
Solal Nathan	2651432582	[WIP] various fixes	2021-03-14 18:22:52 +01:00
Solal Nathan	d928c7f7f0	[borgbackup_client] rename variable correclty	2021-03-14 16:11:40 +01:00
Solal Nathan	021a5ef1e8	[borgbackup_client] various fixes for ssh keys	2021-03-14 16:11:18 +01:00
Jeltz	c99b611b8f	Various fixes	2021-03-14 14:17:36 +01:00
Jeltz	8112788396	[borgbackup_client] Add 'user:' in authorized_key	2021-03-14 13:18:30 +01:00
Jeltz	2f2f71422f	[borgbackup_client] Move some handlers to tasks	2021-03-14 13:16:08 +01:00
Jeltz	637b74a2ad	Fix some linter issues	2021-03-13 05:05:30 +01:00
Jeltz	f45cd77510	Merge branch 'master' into logs-first-phase	2021-03-13 05:02:30 +01:00
pz2891	f6e1949c21	Adding master VM for Rives and adapt radius role for bullseye	2021-03-12 12:29:52 +01:00
Otthorn	965bbe62a4	[borgbackup_client] configure encryption passphrase and storage	2021-03-12 01:46:35 +01:00
Otthorn	3f8ffbe164	[borgbackup_client] Add borg username and group defaults	2021-03-12 00:01:11 +01:00
Otthorn	531f7593d2	[borgbackup_client] fix identation	2021-03-11 23:37:55 +01:00
Otthorn	313314a674	[borgbackup_client] fix risky file permission on apt config for pinning version	2021-03-11 23:36:27 +01:00
Otthorn	4642395330	[borgbackup_client] Add initial role defintion	2021-03-11 23:29:57 +01:00
Jeltz	f0f56ecd3f	Fix linter-related issues	2021-03-11 20:15:35 +01:00
Jeltz	db8dbb6c7a	Add borgbackup_server role	2021-03-11 20:08:41 +01:00
jeltz	2a6c2b30de	Merge pull request 'Rôle pour motd' (#38) from update_motd into master ... Reviewed-on: Aurore/ansible#38	2021-03-11 19:34:41 +01:00
pz2891	6125856c60	Merge branch 'monitoring_ups'	2021-03-11 14:06:38 +01:00
pz2891	d233fc2759	Update of threesold for warning battery	2021-03-11 13:23:15 +01:00
Jeltz	6095d9cef9	Add 'no_log' for postgres passwords	2021-03-10 18:18:08 +01:00
Jeltz	d16f444130	Use a dict for HBA hosts	2021-03-10 15:59:21 +01:00
Jeltz	4f6eda8329	Use /run instead of /var/run to please systemd	2021-03-10 15:57:19 +01:00
Jeltz	628e11488d	Switch postgresql to english	2021-03-10 15:22:01 +01:00
Jeltz	bd05b702bb	Use '::' in place of '[::]'	2021-03-10 15:19:39 +01:00
Jeltz	06b54d5f89	Use postgresql_privs	2021-03-10 14:27:14 +01:00
Jeltz	40eadf802c	Add template and no_log for postgresql_user	2021-03-10 13:58:40 +01:00
Jeltz	8e855d7009	Listen addresses must be quoted	2021-03-10 13:36:10 +01:00
Jeltz	7a07155237	Install python3-psycopg2 (required by Ansible)	2021-03-10 13:35:18 +01:00
Jeltz	36b04239fd	Rename 'postgresql_db' to 'postgresql_databases'	2021-03-10 13:34:58 +01:00
Jeltz	f919ec689a	Fix 'ansible_header' → 'ansible_managed'	2021-03-10 13:25:36 +01:00
Jeltz	9ef6202fdf	Add configuration for users and databases	2021-03-10 13:23:52 +01:00
pz2891	bbf4ac323c	Moniroting of ups environmental temperature	2021-03-10 12:55:11 +01:00
Otthorn	8b9bef865e	postgresql listen on pseudo-address	2021-03-10 12:26:18 +01:00
Otthorn	dbbaf0d26d	remove tailling whitespaces	2021-03-10 12:11:02 +01:00
Otthorn	a4c393d3fb	fix yaml ci truthy value	2021-03-10 12:10:06 +01:00
Otthorn	d14306a86c	fix syntax for CI	2021-03-10 12:08:05 +01:00
Otthorn	a625a58ddd	create role postgresql_server	2021-03-10 12:01:32 +01:00
Jeltz	2c0727a419	Update the list of packages installed via baseconfig	2021-03-07 21:41:42 +01:00
jeltz	41779fb172	Merge pull request 'Add backup root SSH keys' (#27) from add-ssh-keys into master ... Reviewed-on: Aurore/ansible#27	2021-03-07 21:30:38 +01:00
Jeltz	deb4372588	Merge branch 'master' into add-ssh-keys	2021-03-07 21:29:57 +01:00
Jeltz	929baa300f	Use 'update_motd' in 'prometheus_federate' (again)	2021-03-06 04:48:39 +01:00
Jeltz	71ee06c9c0	Fix typo	2021-03-06 04:45:00 +01:00
Jeltz	bc2701d8ba	Use 'update_motd' in 'prometheus_federate'	2021-03-06 04:43:09 +01:00
Jeltz	2353589da6	Ensures /etc/update-motd.d exists	2021-03-06 04:42:21 +01:00
Jeltz	1d0200a1f0	Use 'update_motd' in 'prometheus'	2021-03-06 04:32:06 +01:00
Jeltz	b81600aef8	Use 'update_motd' in 'baseconfig'	2021-03-06 04:31:20 +01:00
Jeltz	7e92fdfab7	Create an 'update_motd' role	2021-03-06 04:30:32 +01:00
Jeltz	cf07de4ec4	Fetch switch_snmp jobs	2021-03-06 02:41:58 +01:00
Jeltz	8abca7916f	Add switch_snmp job for prometheus	2021-03-06 01:57:32 +01:00
Jeltz	763cc2eb51	Generate targets_switch_snmp.json	2021-03-06 01:57:08 +01:00
Jeltz	eaa0d2e0fc	Fix bad indent in snmp.yml.j2	2021-03-06 01:56:18 +01:00
Jeltz	21fed6ae3f	Add useful lookups for switchs interfaces	2021-03-06 00:58:46 +01:00
Jeltz	52124d2cad	Cleanup prometheus_federate's prometheus.yml.j2	2021-03-06 00:46:13 +01:00
Jeltz	7d527be1c0	Remove duplicate alerts from 'prometheus-federate'	2021-03-06 00:45:43 +01:00
Jeltz	32669e1fb1	Don't load Django rules prometheus-federate	2021-03-06 00:44:22 +01:00
Jeltz	4ca7ebd144	Add a unique exported label (useful for federation)	2021-03-06 00:40:44 +01:00
Jeltz	802bfcc698	'prometheus-federate' must not retrieve its own federated metrics	2021-03-06 00:38:36 +01:00
Jeltz	958eaa1bcb	Use label federated_instance instead of instance	2021-03-05 00:54:44 +01:00
Jeltz	6525508401	Forward journald logs to rsyslog	2021-03-02 01:24:53 +01:00
Jeltz	77a5fdac6f	Remove some duplicate logs from syslog.log	2021-03-02 00:56:28 +01:00
Jeltz	529550f594	Don't use 'imjournal' ('imuxsock' is already used) ... I still don't understand why it increased the size of the firewall logs by a factor of 5 to 10, but we don't really need structured logs from systemd-journald and the author seems to discourage it's use, so I will not investigate further.	2021-03-02 00:46:16 +01:00
Jeltz	ee041b9ead	Use 'simple' instead of 'oneshot' (rotate service)	2021-03-02 00:14:25 +01:00
Jeltz	1f6bfeee23	Fix broadcast address on routeur-aurore	2021-03-01 20:04:38 +01:00
Jeltz	0f55b90de9	Remove 10.129.0.1 gateway on routeur-aurore-*	2021-03-01 20:04:02 +01:00
Jeltz	b13b22da05	Add ignored destinations for firewall logs	2021-03-01 19:39:11 +01:00
Jeltz	8f815a30c5	Remove useless date (already added by journald)	2021-03-01 17:47:12 +01:00
Jeltz	acd5721a5b	Fix typos in rotate-remote-logs.service.j2	2021-03-01 17:45:17 +01:00
Jeltz	9547868c7d	Send nginx logs to local syslog	2021-03-01 17:40:05 +01:00
Jeltz	cdb9f88614	Do not rate limit collection of journald logs	2021-03-01 16:31:52 +01:00
Jeltz	9eeb8ccd73	Remove non-Ansible SSH root keys	2021-03-01 16:08:08 +01:00
Jeltz	9252249d18	Use 'true' instead of 'yes'	2021-03-01 04:15:54 +01:00
Jeltz	e4b58c0bf4	Fix typo in 20-collector.conf.j2	2021-03-01 04:07:17 +01:00
Jeltz	c65b3f090b	Compress and delete old remote logs ... Logrotate is not used because I didn't found an easy way to configure it to handle the compression/deletion of log files already rotated by rsyslog (it is probably possible, but I found the script to be easier).	2021-03-01 03:58:58 +01:00
Jeltz	f7183095c1	Add explicit permissions for directories	2021-03-01 02:26:22 +01:00
Jeltz	ba8b4e8c29	Fix the ordering of rsyslog.d files ... A call to sendLogsToRemote for logs received through RELP/UDP has been added (to send them to Logstash/Redis/…), so common.conf's prefix must be lower than collector.conf's. Note: future "third-party" config files will also call sendLogsToRemote and thus will also have to use a prefix higher than 10.	2021-03-01 02:15:28 +01:00
Jeltz	7fd1b5ff5d	Add rsyslog_collector role	2021-03-01 01:27:56 +01:00
Jeltz	6263c31785	Add rsyslog_common role	2021-03-01 01:27:30 +01:00
Yohann D'ANELLO	ba6da939ab	[certbot] Fix certificates for auro.re ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-24 13:57:59 +01:00
Yohann D'ANELLO	ae151321db	[nginx/certbot] Clone roles from Crans ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-24 11:46:37 +01:00
pz2891	d7d0676f5e	Remove .save file; remove fo fleming prometheus	2021-02-18 17:53:15 +01:00
pz2891	74c30b81df	Merge branch 'master' into Global_monitoring	2021-02-17 19:41:06 +01:00
pz2891	b278b02bc2	Remove percentage sign for load alert	2021-02-17 19:37:33 +01:00
pz2891	0b90c9944b	Fix CI warning from last commit	2021-02-17 18:15:31 +01:00
pz2891	61001e09f5	Add alert for load usage	2021-02-17 18:08:39 +01:00
pz2891	a5b4deacee	Rename federate role; update of alerts of federate prometheus; update of configuration of federate prometheus	2021-02-17 17:42:24 +01:00
Solal Nathan	5b2580056d	🐛 Final fix, should stop sending ill-formed mail from now on	2021-02-16 18:10:39 +01:00
Solal Nathan	f607a76ec8	🐛 Fix a small bug. Postfix does not accept trailing comments	2021-02-16 13:13:26 +01:00
Solal Nathan	3fceeff74f	Fix ansible lint for rule [208] always specify mode and owner for template	2021-02-16 02:47:04 +01:00
Solal Nathan	3925e32188	Repect ansible-lint [106] for role names	2021-02-16 02:45:35 +01:00
Solal Nathan	69d732e612	Fix case	2021-02-16 02:42:08 +01:00
Solal Nathan	ab3659adc2	Also config hostname just in case	2021-02-16 02:32:46 +01:00
Solal Nathan	1ca75ccfb0	Add postfix non mailhost conf	2021-02-16 02:22:41 +01:00
Solal Nathan	f08b11445d	Add postfix non mailhost task	2021-02-16 02:15:52 +01:00
Solal Nathan	a9b03aed82	Add postfix non mailhost handlers	2021-02-16 02:02:15 +01:00
pz2891	6ec449c3b3	Fix restarting prometheus snmp (not installed)	2021-02-10 20:43:43 +01:00
pz2891	d8924abe66	Add prometheus-federate role	2021-02-10 20:42:37 +01:00
pz2891	4308bedf8f	Monitoring of docker containers	2021-02-10 19:06:28 +01:00
pz2891	bd5b88c4fc	Correcting format of percentage	2021-02-08 18:22:08 +01:00
pz2891	428b6f5733	Correcting grafana stats for wireless	2021-02-08 13:57:32 +01:00
pz2891	8bfe83f73c	Adaptation of UPS alerts	2021-02-08 13:52:17 +01:00
Otthorn	faf5fc7362	fix re2o-service -> re2o_service role name	2021-02-07 17:39:04 +01:00
Otthorn	e6b853a552	fix role name	2021-02-07 17:33:29 +01:00
Otthorn	679daa633f	Fix ansible lint	2021-02-07 17:32:44 +01:00
Otthorn	1e136e3736	Remove rules from warn list when it is not needed	2021-02-07 17:31:21 +01:00
ynerant	f9e83e514e	Merge pull request 'Captive portal' (#11) from accueil into master ... Reviewed-on: Aurore/ansible#11	2021-02-05 20:39:50 +01:00
Yohann D'ANELLO	0e224df41f	Install ipset on each router ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:26 +01:00
Yohann D'ANELLO	c527ce16b0	Use good output interface for the main router ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Yohann D'ANELLO	a82edc3e24	Firewall configuration without MASQUERADE ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Yohann D'ANELLO	bbac76023c	Update masquerade configuration for the captive portal ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Yohann D'ANELLO	7e4a2d20c0	Clone nginx role from Crans ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Yohann D'ANELLO	889cb764c1	Clone certbot role from Crans ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Yohann D'ANELLO	154cbedec2	Deploy firewall config for the captive portal ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Yohann D'ANELLO	9bd06520fb	Add reverse-proxy for Re2o on the portal VM ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:39:25 +01:00
Jeltz	e02670afb0	Les caches unbound renvoie les addresses en 10/8	2021-02-05 20:38:50 +01:00
Yohann D'ANELLO	a7b073e1cc	Add captive portal firewall configuration ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:38:50 +01:00
Yohann D'ANELLO	89ebbd423e	Use the local firewall repository ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:38:50 +01:00
Yohann D'ANELLO	5a09b77070	Resolve DNS for the accueil vlan ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-05 20:38:49 +01:00
Jeltz	5fc2d0a3f9	Ajout d'accueil dans keepalived	2021-02-05 20:38:49 +01:00
Jeltz	7cdef7ee96	Fix: keep the logs for 90 days	2021-02-05 20:38:49 +01:00
Yohann D'ANELLO	3eb48edccd	Tmux everywhere ... Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>	2021-02-02 23:17:47 +01:00
otthorn	f6c9208a41	Merge pull request 'Limit floats in alerts to 2 decimal places' (#5) from human_readable_altermanager into master ... Reviewed-on: Aurore/ansible#5	2021-01-29 20:48:43 +01:00
otthorn	c9352fb9ab	Merge pull request 'Use unattended-upgrades for Debian-Security' (#4) from unattended into master ... Reviewed-on: Aurore/ansible#4	2021-01-29 20:42:24 +01:00
otthorn	a8af3c9c72	Merge branch 'master' into monitoring_pdu	2021-01-29 20:29:28 +01:00
pz2891	eecf807b53	Delte main.yml.save	2021-01-29 20:15:21 +01:00
pz2891	a12bcbc97f	Correct yamlint	2021-01-29 20:12:14 +01:00
Solal Nathan	6ec89b88d8	Limit floats in alerts to 2 decimal places	2021-01-29 19:33:38 +01:00
Jeltz	d59cb41d5e	Use unattended-upgrades for Debian-Security	2021-01-28 03:42:07 +01:00
pz2891	e3ae912f44	Add prometheus-aurore to monitor all service VM and physical servers. Modifying monitoring role to exclude wireless access points when running the role on all hosts	2021-01-23 22:10:57 +01:00
pz2891	bac377f634	Update alert rules of UPS	2021-01-23 19:01:27 +01:00
Solal Nathan	fff6ec5807	fix typo: restart -> reload	2021-01-23 16:04:09 +01:00
Solal Nathan	795ee3846f	fix indent	2021-01-23 16:02:10 +01:00
Solal Nathan	e6af0f2bd7	fix typo: groupe -> group	2021-01-23 15:59:03 +01:00
Solal Nathan	e1a961273d	fix typo: dst -> dest	2021-01-23 15:42:52 +01:00
Otthorn	73142dbe03	Fix yaml syntax	2021-01-23 14:41:25 +01:00