From a49efc53fd138ade2ce1e104b157f482f92810d4 Mon Sep 17 00:00:00 2001 From: Stephane M Date: Wed, 16 Jul 2025 23:32:34 +0200 Subject: [PATCH] debian_fullserver_web.yml: update --- ansible/install_fullserver_web.sh | 2 +- ansible/inventory/inventory.ini | 31 ++--- .../action/__pycache__/normal.cpython-311.pyc | Bin 1696 -> 1696 bytes .../action/__pycache__/shell.cpython-311.pyc | Bin 1598 -> 1598 bytes .../filter/__pycache__/core.cpython-311.pyc | Bin 30801 -> 30801 bytes .../__pycache__/encryption.cpython-311.pyc | Bin 5040 -> 5040 bytes .../__pycache__/mathstuff.cpython-311.pyc | Bin 11767 -> 11767 bytes .../filter/__pycache__/urls.cpython-311.pyc | Bin 887 -> 887 bytes .../__pycache__/urlsplit.cpython-311.pyc | Bin 3062 -> 3062 bytes .../test/__pycache__/core.cpython-311.pyc | Bin 12428 -> 12428 bytes .../test/__pycache__/files.cpython-311.pyc | Bin 1282 -> 1282 bytes .../__pycache__/mathstuff.cpython-311.pyc | Bin 1783 -> 1783 bytes .../test/__pycache__/uri.cpython-311.pyc | Bin 2153 -> 2153 bytes .../utils/__pycache__/encrypt.cpython-311.pyc | Bin 9275 -> 9275 bytes .../utils/__pycache__/unicode.cpython-311.pyc | Bin 758 -> 758 bytes .../utils/__pycache__/version.cpython-311.pyc | Bin 12855 -> 12855 bytes .../__pycache__/__init__.cpython-311.pyc | Bin 281 -> 281 bytes .../passlib/__pycache__/exc.cpython-311.pyc | Bin 17259 -> 17259 bytes .../passlib/__pycache__/hash.cpython-311.pyc | Bin 2480 -> 2480 bytes .../passlib/__pycache__/ifc.cpython-311.pyc | Bin 8306 -> 8306 bytes .../__pycache__/registry.cpython-311.pyc | Bin 20697 -> 20697 bytes .../__pycache__/__init__.cpython-311.pyc | Bin 285 -> 285 bytes .../__pycache__/sha2_crypt.cpython-311.pyc | Bin 16710 -> 16710 bytes .../__pycache__/__init__.cpython-311.pyc | Bin 43859 -> 43859 bytes .../utils/__pycache__/binary.cpython-311.pyc | Bin 33081 -> 33081 bytes .../utils/__pycache__/decor.cpython-311.pyc | Bin 9570 -> 9570 bytes .../__pycache__/handlers.cpython-311.pyc | Bin 100192 -> 100192 bytes .../__pycache__/__init__.cpython-311.pyc | Bin 16081 -> 16081 bytes ansible/playbooks/debian_fullserver_web.yml | 123 +++++++++--------- 29 files changed, 78 insertions(+), 78 deletions(-) diff --git a/ansible/install_fullserver_web.sh b/ansible/install_fullserver_web.sh index d704184d0..7d34e84d0 100755 --- a/ansible/install_fullserver_web.sh +++ b/ansible/install_fullserver_web.sh @@ -47,7 +47,7 @@ cat < "$vars_file" EOF # Exécuter le playbook Ansible -ansible-playbook -i "$inventory_file" -u root --ask-become-pass playbooks/debian_fullserver_web.yml -e "@$vars_file" +ansible-playbook -i "$inventory_file" -u root --ask-become-pass playbooks/debian_fullserver_web.yml -e "@$vars_file" --ask-vault-pass # Supprimer les fichiers temporaires rm -f "$inventory_file" "$vars_file" diff --git a/ansible/inventory/inventory.ini b/ansible/inventory/inventory.ini index 121bacf2c..8cb587478 100644 --- a/ansible/inventory/inventory.ini +++ b/ansible/inventory/inventory.ini @@ -1,19 +1,20 @@ [debians] -website-mc ansible_host=10.0.0.2 ansible_port=22 -ids-01 ansible_host=10.0.0.6 ansible_port=22 -db-02 ansible_host=10.0.0.7 ansible_port=22 -steph ansible_host=10.0.0.9 ansible_port=51474 -revproxy-01 ansible_host=10.0.0.4 ansible_port=59512 -minecraft ansible_host=10.0.0.5 ansible_port=59008 -evotechsphere ansible_host=10.0.0.11 ansible_port=22 -collaboraonline ansible_host=10.0.0.12 ansible_port=22 -n8n ansible_host=10.0.0.13 ansible_port=22 -bookstack ansible_host=10.0.0.17 ansible_port=22 -gitea ansible_host=10.0.0.19 ansible_port=22 -website ansible_host=10.0.0.10 ansible_port=59513 -cloud-01 ansible_host=10.0.0.3 ansible_port=22 -netbox ansible_host=10.0.0.16 ansible_port=22 -rustdesk ansible_host=10.0.0.18 ansible_port=22 +website-mc ansible_host=10.0.0.2 ansible_port=22 +ids-01 ansible_host=10.0.0.6 ansible_port=22 +db-02 ansible_host=10.0.0.7 ansible_port=22 +steph ansible_host=10.0.0.9 ansible_port=51474 +revproxy-01 ansible_host=10.0.0.4 ansible_port=59512 +minecraft ansible_host=10.0.0.5 ansible_port=59008 +evotechsphere ansible_host=10.0.0.11 ansible_port=22 +collaboraonline ansible_host=10.0.0.12 ansible_port=22 +n8n ansible_host=10.0.0.13 ansible_port=22 +bookstack ansible_host=10.0.0.17 ansible_port=22 +gitea ansible_host=10.0.0.19 ansible_port=22 +website ansible_host=10.0.0.10 ansible_port=59513 +cloud-01 ansible_host=10.0.0.3 ansible_port=22 +netbox ansible_host=10.0.0.16 ansible_port=22 +rustdesk ansible_host=10.0.0.18 ansible_port=22 +website-02 ansible_host=192.168.1.164 ansible_port=22 [server_web] diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/action/__pycache__/normal.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/action/__pycache__/normal.cpython-311.pyc index 52b5d70121772bd539d63970304a19e7469133e1..83d46f5f38460042d37666b7fafc5e8eaa6ad844 100644 GIT binary patch delta 20 acmZ3$yMUK_IWI340}%W=w0R@+IWI340}%W=w0R@9F&h9pdIiq_ delta 20 acmdnTvyX>+IWI340}%YYwR0o4F&h9qAqDIJ diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/core.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/core.cpython-311.pyc index c77878db2be0b40e37870feb46c396cc1f369df6..7067abb300f126c19360595ff2fb749060ea5c34 100644 GIT binary patch delta 22 ccmcckf$`!8M(*Xjyj%=G@axd#jofY(0A*eXL;wH) delta 22 ccmcckf$`!8M(*Xjyj%=G@blKrjofY(0A>XUVE_OC diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/encryption.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/encryption.cpython-311.pyc index f3d420f84d6210f03f0809dd0a579999e4bb9293..a346ad47ad1733d0454b88ee11ee1c6b43fde5b2 100644 GIT binary patch delta 20 acmdm>zCoRPIWI340}%W=w0R@zCoRPIWI340}%YYwR0o)Qegl;$_9l1 diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/mathstuff.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/mathstuff.cpython-311.pyc index db9b477d9d2f40f4d09547e54422a0e662b308f5..df23c467dae514402c8f6bba51df436c1d73d994 100644 GIT binary patch delta 20 acmew!{XLp{IWI340}%W=w0R@<8(jcVr3b$N delta 20 acmew!{XLp{IWI340}%YYwR0o)8(jcWOb6Tm diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/urls.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/urls.cpython-311.pyc index 0262f74fa75109dc0340c6485fe4a653a76cd287..f8e49d7711ea412bb89cc54c3fd3d7bb907880b9 100644 GIT binary patch delta 20 acmey)_MMG;IWI340}%W=w0R?U4l@8mhX!i^ delta 20 acmey)_MMG;IWI340}%YYwR0nP4l@8nE(VAI diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/urlsplit.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/filter/__pycache__/urlsplit.cpython-311.pyc index 25c82a12a39b693964626e362a4d78af63726673..709a00963b2fb6188e363fc62bd920f267350788 100644 GIT binary patch delta 20 acmew+{!N^FIWI340}%W=w0R@`CNa&dbZi00h4dZQjV;XaE2~$Oer7 delta 20 acmeB4>`CNa&dbZi00cj8?cB)SXaE30Zw9IW diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/test/__pycache__/files.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/test/__pycache__/files.cpython-311.pyc index e1bc239ebc3f374419da93db8de8d12e543e5f54..982cc683a8018b2992949a52e33ee35827a9ecee 100644 GIT binary patch delta 20 acmZqTYU1Kv&dbZi00h4dZQjWJodp0i&;}I% delta 20 acmZqTYU1Kv&dbZi00cj8?cB)yodp0jcLp*5 diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/test/__pycache__/mathstuff.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/test/__pycache__/mathstuff.cpython-311.pyc index 517400792d334efc1235622789901e8ea5de6195..004ebc0e7593f600ab5677ae4027fb44d8e62d8a 100644 GIT binary patch delta 20 acmey)`<<72IWI340}%W=w0R@<8#Vw&h6elq delta 20 acmey)`<<72IWI340}%YYwR0o)8#Vw(Ee9C@ diff --git a/ansible/lib/python3.11/site-packages/ansible/plugins/test/__pycache__/uri.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/plugins/test/__pycache__/uri.cpython-311.pyc index 078f7425e52ab5bd526be55f77b6a6dd86885f86..fa6185bef12fc7f5a2c5ada93265d1b3b00cfcbc 100644 GIT binary patch delta 20 acmaDU@KS(#IWI340}%W=w0R?U90veH#0FXb delta 20 acmaDU@KS(#IWI340}%YYwR0nP90veIYX)}! diff --git a/ansible/lib/python3.11/site-packages/ansible/utils/__pycache__/encrypt.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/utils/__pycache__/encrypt.cpython-311.pyc index 95c6adaf525e287c247b09d5bfcc888c5961b714..587be4cc9a95b9cd34899fbaa12e44283c7d6c62 100644 GIT binary patch delta 20 acmdn(vD<@tIWI340}%W=w0R@9feHXbkOo`; delta 20 acmdn(vD<@tIWI340}%YYwR0o4feHXcHwJkC diff --git a/ansible/lib/python3.11/site-packages/ansible/utils/__pycache__/unicode.cpython-311.pyc b/ansible/lib/python3.11/site-packages/ansible/utils/__pycache__/unicode.cpython-311.pyc index cc18811effb56d432ded4763836430ec8c7a6812..ac507952e3da3e5cb3bbb814cecf923bba4170ad 100644 GIT binary patch delta 20 acmeyy`i+%)IWI340}%W=w0R@|Hj}ZVc@dTX! delta 20 acmbQqG?R&YIWI340}%YawR0mkA0q%Y`UPeH diff --git a/ansible/lib/python3.11/site-packages/passlib/__pycache__/exc.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/__pycache__/exc.cpython-311.pyc index 54b68a4faf8b2fe0f5e9a0b41d17d186b16e0a0f..fc37a9bd0764e96245f6e0d113eaf563429db625 100644 GIT binary patch delta 22 ccmaFe#`wC8k$X8WFBbz4EY91qkvqW|096eJ-v9sr delta 22 ccmaFe#`wC8k$X8WFBbz4{JynwBX@!`09qCYr~m)} diff --git a/ansible/lib/python3.11/site-packages/passlib/__pycache__/hash.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/__pycache__/hash.cpython-311.pyc index 69fbd39ffde6d03fb35db5c9da0f5fdc6f49314b..cd03fc193d657ebcaa6fd21d7de021da3027c360 100644 GIT binary patch delta 20 acmdlWyg`_IIWI340}w3E+p>{+DJK9o^#zOo delta 20 acmdlWyg`_IIWI340}%YawR0o)QceIo{svV5 diff --git a/ansible/lib/python3.11/site-packages/passlib/__pycache__/ifc.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/__pycache__/ifc.cpython-311.pyc index 2d8261e151ce81f47830fcc3dbce746a3db9228f..27c57c403c25ae892ae3e694c880efff170c46f2 100644 GIT binary patch delta 20 acmez5@X3LDIWI340}w3E+p>{6T>$_`um(c_ delta 20 acmez5@X3LDIWI340}%YawR0nPx&i=9xd#jY diff --git a/ansible/lib/python3.11/site-packages/passlib/__pycache__/registry.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/__pycache__/registry.cpython-311.pyc index cba4c3a73cb7ee3bf025be8ea4e368da027eef42..7cfeffba8e0a513d3d57508655d4f01aab0565a8 100644 GIT binary patch delta 22 ccmcb)kn!e1M(*Xjyj%=GusCnaM(%R~09P>wYybcN delta 22 ccmcb)kn!e1M(*Xjyj%=G@cY)zjojw~09-l{ch!FrWkp!s# delta 20 acmbQsG?$5cIWI340}%YawR0o45F-FKngwzI diff --git a/ansible/lib/python3.11/site-packages/passlib/handlers/__pycache__/sha2_crypt.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/handlers/__pycache__/sha2_crypt.cpython-311.pyc index 246d6d63bcab14caaeb5bcff128db7756f45667f..7d27c5a280b35e1e1f00229a6469a7c9ad871443 100644 GIT binary patch delta 22 ccmX@s#CWWUk$X8WFBbz4EY91qk=xo408TgtW&i*H delta 22 ccmX@s#CWWUk$X8WFBbz4{JynwBe%6908>E+F8}}l diff --git a/ansible/lib/python3.11/site-packages/passlib/utils/__pycache__/__init__.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/utils/__pycache__/__init__.cpython-311.pyc index 28d3e3be4001624f32550e3826f626175a97f87a..286cf7ba62a7184a8ebb66af7cc089e1678aeba0 100644 GIT binary patch delta 22 ccmcb7jp_0=Chq0Dyj%=GusCnaMsAPQ0A0cdp#T5? delta 22 ccmcb7jp_0=Chq0Dyj%=G@cY)zjocoq0b{6TonLDodzrb delta 20 acmaFl^~j5RIWI340}%YawR0nPxGDfkrUvx@ diff --git a/ansible/lib/python3.11/site-packages/passlib/utils/__pycache__/handlers.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/utils/__pycache__/handlers.cpython-311.pyc index 32b3517cceabd14a3085dc509c4c1fb2cbeb508c..4670320c02145257956dbb56a2e0025bbc60bcc6 100644 GIT binary patch delta 25 fcmaFR$M&F)je9vSFBbz4EY91~$i0=DF|-{3YLN%6 delta 25 fcmaFR$M&F)je9vSFBbz4{Jyobk$WpQV`w`7arFpx diff --git a/ansible/lib/python3.11/site-packages/passlib/utils/compat/__pycache__/__init__.cpython-311.pyc b/ansible/lib/python3.11/site-packages/passlib/utils/compat/__pycache__/__init__.cpython-311.pyc index 2cdc80d4f65721a9206181b9db0dbceaaf865281..ffa15de56cabc98f8653638c13ea21ca600f863d 100644 GIT binary patch delta 20 acmcaud$E>#IWI340}w3E+p>}Sm>mF2ItKUv delta 20 acmcaud$E>#IWI340}%YawR0o)F*^WJLkGbC diff --git a/ansible/playbooks/debian_fullserver_web.yml b/ansible/playbooks/debian_fullserver_web.yml index 624ad02e9..a01f6f9e3 100644 --- a/ansible/playbooks/debian_fullserver_web.yml +++ b/ansible/playbooks/debian_fullserver_web.yml @@ -3,108 +3,113 @@ user: "smauro" root_password: "testtest" tasks: - # 1. Passer à root et installer sudo (si pas déjà installé) - - name: Passer à root et installer sudo + + # 0. Supprimer les lignes CD-ROM du sources.list (empêche apt de planter) + - name: Supprimer les lignes cdrom dans /etc/apt/sources.list + lineinfile: + path: /etc/apt/sources.list + regexp: '^deb cdrom:' + state: absent become: yes - become_user: root - become_method: su - command: apt install sudo -y - vars: - ansible_become_pass: "{{ root_password }}" - register: result - when: ansible_facts.packages['sudo'] is not defined - - name: Afficher le résultat de l'installation de sudo - debug: - var: result + # 1. Mettre à jour le fichier sources.list (sources HTTP officielles) + - name: Remplacer le fichier sources.list par les dépôts HTTP Debian Bookworm + copy: + dest: /etc/apt/sources.list + content: | + deb http://deb.debian.org/debian/ bookworm main non-free-firmware + deb-src http://deb.debian.org/debian/ bookworm main non-free-firmware - # 2. Ajouter l'utilisateur au groupe sudo + deb http://security.debian.org/debian-security bookworm-security main non-free-firmware + deb-src http://security.debian.org/debian-security bookworm-security main non-free-firmware + + deb http://deb.debian.org/debian/ bookworm-updates main non-free-firmware + deb-src http://deb.debian.org/debian/ bookworm-updates main non-free-firmware + become: yes + + # 2. Mettre à jour les paquets (apt update) + - name: Mettre à jour le cache apt + apt: + update_cache: yes + become: yes + + # 3. Collecter la liste des paquets installés + - name: Récupérer la liste des paquets installés + package_facts: + manager: apt + become: yes + + # 4. Installer sudo si non présent + - name: Installer sudo si non présent + apt: + name: sudo + state: present + become: yes + when: "'sudo' not in ansible_facts.packages" + + # 5. Ajouter l'utilisateur au groupe sudo - name: Ajouter l'utilisateur au groupe sudo user: name: "{{ user }}" groups: sudo append: yes become: yes - become_user: root - when: ansible_facts.packages['sudo'] is defined + when: "'sudo' in ansible_facts.packages" - # 3. Modifier le fichier sources.list - - name: Modifier le fichier sources.list - copy: - dest: /etc/apt/sources.list - content: | - deb http://deb.debian.org/debian/ bookworm main non-free-firmware - deb-src http://deb.debian.org/debian/ bookworm main non-free-firmware - - deb http://security.debian.org/debian-security bookworm-security main non-free-firmware - deb-src http://security.debian.org/debian-security bookworm-security main non-free-firmware - - # bookworm-updates, to get updates before a point release is made; - # see https://www.debian.org/doc/manuals/debian-reference/ch02.en.html#_updates_and_backports - deb http://deb.debian.org/debian/ bookworm-updates main non-free-firmware - deb-src http://deb.debian.org/debian/ bookworm-updates main non-free-firmware - become: yes - - # 4. Mettre à jour les paquets - - name: Mettre à jour les paquets - apt: - update_cache: yes - become: yes - - # 5. Configurer le hostname + # 6. Configurer le hostname - name: Configurer le hostname hostname: name: "{{ ansible_hostname }}" become: yes - # 6. Changer le mot de passe root + # 7. Changer le mot de passe root - name: Changer le mot de passe root user: name: root password: "{{ root_password | password_hash('sha512') }}" become: yes - # 7. Configurer l'utilisateur smauro + # 8. Configurer l'utilisateur smauro - name: Configurer l'utilisateur smauro user: name: "{{ user }}" - password: "{{ user_password | password_hash('sha512') }}" # Utilisation de la variable dynamique + password: "{{ user_password | password_hash('sha512') }}" shell: /bin/bash groups: sudo state: present become: yes - # 8. Installer les paquets nécessaires + # 9. Installer les paquets nécessaires - name: Installer les paquets nécessaires apt: name: ["sudo", "vim", "curl", "git", "htop", "gnupg", "apache2", "net-tools"] state: present become: yes - # 9. Installer les dépendances requises pour ajouter un dépôt + # 10. Installer les dépendances requises pour ajouter un dépôt - name: Installer les dépendances requises pour ajouter un dépôt apt: name: ["apt-transport-https", "ca-certificates", "lsb-release", "curl"] state: present become: yes - # 10. Ajouter le dépôt Sury pour PHP 8.3 + # 11. Ajouter le dépôt Sury pour PHP 8.3 - name: Ajouter le dépôt Sury pour PHP 8.3 shell: echo "deb https://packages.sury.org/php/ bookworm main" | tee /etc/apt/sources.list.d/sury-php.list become: yes - + - name: Ajouter la clé GPG du dépôt Sury shell: curl -fsSL https://packages.sury.org/php/apt.gpg | tee /etc/apt/trusted.gpg.d/sury-php.gpg > /dev/null become: yes - # 11. Mettre à jour et upgrader le système + # 12. Mettre à jour et upgrader le système - name: Mettre à jour et upgrader le système apt: update_cache: yes upgrade: dist become: yes - # 12. Installer PHP 8.3 et modules requis + # 13. Installer PHP 8.3 et modules requis - name: Installer PHP 8.3 et modules requis apt: name: @@ -126,25 +131,26 @@ state: restarted become: yes - # 13. Redémarrer Apache + # 14. Redémarrer Apache - name: Redémarrer Apache systemd: name: apache2 state: restarted become: yes - # 14. Activer les modules rewrite et expires dans Apache + # 15. Activer les modules rewrite et expires dans Apache - name: Activer les modules rewrite et expires dans Apache command: a2enmod rewrite expires become: yes - # 15. Redémarrer Apache après activation des modules + # 16. Redémarrer Apache après activation des modules - name: Redémarrer Apache après activation des modules systemd: name: apache2 state: restarted become: yes + # 17. Mettre à jour /etc/hosts avec le hostname - name: Mettre à jour /etc/hosts avec le hostname lineinfile: path: /etc/hosts @@ -153,7 +159,7 @@ state: present become: yes - # 17. Retirer 'PermitRootLogin yes' dans /etc/ssh/sshd_config + # 18. Retirer 'PermitRootLogin yes' dans /etc/ssh/sshd_config - name: Retirer ou modifier 'PermitRootLogin yes' dans /etc/ssh/sshd_config lineinfile: path: /etc/ssh/sshd_config @@ -162,27 +168,20 @@ state: present become: yes + # 19. Déployer le script MOTD personnalisé - name: Déployer le script MOTD personnalisé copy: - src: ../sources/99-motd # Chemin relatif depuis où tu exécutes le playbook + src: ../sources/99-motd dest: /etc/update-motd.d/99-motd owner: root group: root mode: '0755' become: yes + # 20. Redémarrer la machine (non bloquant) - name: Redémarrer la machine command: "nohup bash -c 'sleep 5 && reboot' &" async: 1 poll: 0 ignore_errors: yes become: yes - - - # 18. Redémarrer la machine - #- name: Redémarrer la machine - # reboot: - #msg: "Redémarrage après configuration." - #pre_reboot_delay: 5 - #become: yes - #ignore_errors: yes