initial commit
This commit is contained in:
Adrian Amaglio
commit
ca56c39651
2
.gitignore
vendored
Normal file
2
.gitignore
vendored
Normal file
@ -0,0 +1,2 @@
|
||||
installing/secrets
|
||||
installing/temporary_mount_point
|
||||
231
installing/debootstrap_ordis_portables.sh
Executable file
231
installing/debootstrap_ordis_portables.sh
Executable file
@ -0,0 +1,231 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Ce script est une base qu’il faut sûrement améliorer.
|
||||
# Il sert à installer un debian d’ordi portable JC pour le cluster SHLAGO
|
||||
# Le but est d’installer juste ce qu’il faut pour le le serveur tourne, le reste est laissé à ansible.
|
||||
# Il génère une clé SSH qui permettra d’accéder à la machine. C’est peut-être con, il faudrait plutôt le remplir de nos ssh publiques.
|
||||
|
||||
# https://github.com/adrianamaglio/driglibash
|
||||
declare -A usage
|
||||
declare -A varia
|
||||
driglibash_run_retry=true
|
||||
version="alpha nightly 0.0.1 pre-release unstable"
|
||||
summary="$0 [options]"
|
||||
|
||||
usage[m]="Path of the temporar mount point"
|
||||
varia[m]=mnt
|
||||
mnt="temporary_mount_point"
|
||||
|
||||
usage[a]="The architecture of installed system as supported by debootstrap"
|
||||
varia[a]=arch
|
||||
arch="amd64"
|
||||
|
||||
usage[r]="The release of installed system as supported by debootstrap"
|
||||
varia[r]=release
|
||||
release="bullseye"
|
||||
|
||||
usage[s]="Source repository of installed system"
|
||||
varia[s]=repo
|
||||
#repo=
|
||||
repo="http://ftp.fr.debian.org/debian"
|
||||
#repo="http://localhost:3142/ftp.fr.debian.org/debian"
|
||||
|
||||
usage[n]="The hostname"
|
||||
varia[n]=hostname
|
||||
hostname=""
|
||||
|
||||
usage[b]="The device where grub will be installed"
|
||||
varia[b]=boot_device
|
||||
boot_device=
|
||||
|
||||
usage[R]="The device where the system will be installed"
|
||||
varia[R]=boot_device
|
||||
boot_device=
|
||||
|
||||
usage[l]="System locale"
|
||||
varia[l]=locale
|
||||
locale="en_US.UTF-8 UTF-8\nfr_FR.UTF-8 UTF-8"
|
||||
|
||||
|
||||
. driglibash-args
|
||||
|
||||
|
||||
secret_dir=secrets
|
||||
secret_dir="$(realpath -m "$secret_dir/$hostname")"
|
||||
install="vim openssh-server git nginx"
|
||||
|
||||
|
||||
|
||||
###############################################################################
|
||||
# Actual script
|
||||
###############################################################################
|
||||
|
||||
. driglibash-base
|
||||
|
||||
chroot_run(){
|
||||
run echo "$@" | chroot "$mnt"
|
||||
if [ "$?" -ne 0 ] ; then
|
||||
die "Error, chroot command [$@] exited with code '$?'"
|
||||
fi
|
||||
}
|
||||
|
||||
wait_for_user(){
|
||||
section "Time for a pause"
|
||||
run echo "Press 'Enter' to continue"
|
||||
read
|
||||
}
|
||||
|
||||
mount_misc(){
|
||||
run mkdir -p "$mnt"/{proc,dev,sys}
|
||||
run mount -t proc none "$mnt/proc"
|
||||
clean "umount '$mnt/proc'"
|
||||
# To access physical devices
|
||||
run mount -o bind /dev "$mnt/dev"
|
||||
clean "umount '$mnt/dev'"
|
||||
run mount -o bind /dev/pts "$mnt/dev/pts"
|
||||
clean "umount '$mnt/dev/pts'"
|
||||
run mount -o bind /sys "$mnt/sys"
|
||||
clean "umount '$mnt/sys'"
|
||||
# mount /dev/pts ? apt install complain about its absence
|
||||
}
|
||||
|
||||
if [ -z "$hostname" ] ; then
|
||||
die "Hostname arg needed"
|
||||
fi
|
||||
|
||||
root_or_die
|
||||
|
||||
|
||||
section "Testing for existing secrets"
|
||||
if ! [ -d "$secret_dir" ] ; then
|
||||
run mkdir -p "$secret_dir"
|
||||
run chown -R root:root "$secret_dir"
|
||||
run chmod 700 "$secret_dir"
|
||||
fi
|
||||
|
||||
|
||||
section "debootstraping"
|
||||
# Debootstrap may fail when the target is an existing system
|
||||
#if [ -n "$(ls -A $mnt)" ]; then
|
||||
# die "Root dir '$mnt' is not empty. Won’t debootstrap it."
|
||||
#fi
|
||||
run debootstrap --verbose --arch "$arch" "$release" "$mnt" "$repo"
|
||||
|
||||
|
||||
section "Mounting additionnal items"
|
||||
mount_misc
|
||||
|
||||
|
||||
section "Installing selected software"
|
||||
#XXX use chroot_run
|
||||
chroot "$mnt" <<EOF
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update -q -y
|
||||
apt-get install -q -y linux-image-amd64 console-data grub2 locales $install
|
||||
EOF
|
||||
# TODO watershed ?
|
||||
|
||||
|
||||
|
||||
|
||||
section "Configuring new system"
|
||||
uuid=$(blkid | grep "$root_device" | cut -d ' ' -f 2)
|
||||
line_in_file "$uuid / ext4 errors=remount-ro 0 1" "$mnt/etc/fstab"
|
||||
line_in_file "proc /proc proc defaults" "$mnt/etc/fstab"
|
||||
# TODO set noauto to /boot if needed
|
||||
|
||||
# Set hostname
|
||||
run echo "$hostname" > "$mnt/etc/hostname"
|
||||
|
||||
# Fix path and remove noisy beep
|
||||
run cat > "$mnt/root/.bashrc" <<EOF
|
||||
PATH=$PATH:/usr/bin:/bin:/sbin:/usr/sbin:/sbin
|
||||
/usr/bin/setterm -blength 0
|
||||
xset b off
|
||||
EOF
|
||||
# Be sure this fucking beep is gone
|
||||
echo 'set bell-style none' >> "$mnt/etc/inputrc"
|
||||
# TODO find a third method to kill this doomed beep
|
||||
|
||||
|
||||
# boot crypted
|
||||
#section "Installing cryptsetup in initramfs"
|
||||
#run echo 'CRYPTSETUP=y' >> /etc/cryptsetup-initramfs/conf-hook
|
||||
#run cp key "$mnt/root/"
|
||||
#run echo 'FILES="/root/key"' >> /etc/initramfs-tools/initramfs.conf
|
||||
#run update-initramfs -ut
|
||||
#echo "$mnt/etc/initramfs-tools/conf.d/cryptsetup" <<EOF
|
||||
## This will setup non-us keyboards in early userspace,
|
||||
## necessary for punching in passphrases.
|
||||
#KEYMAP=y
|
||||
#
|
||||
## force busybox and cryptsetup on initramfs
|
||||
#BUSYBOX=y
|
||||
#CRYPTSETUP=y
|
||||
#
|
||||
## and for systems using plymouth instead, use the new option
|
||||
#FRAMEBUFFER=y
|
||||
#EOF
|
||||
#echo 'export CRYPTSETUP=y' >> "$mnt/etc/environment"
|
||||
#echo 'export FILES="./key"' >> "$mnt/etc/initramfs-tools/initramfs.conf"
|
||||
#chroot_run 'update-initramfs -ut'
|
||||
|
||||
|
||||
section "Set up networking"
|
||||
# Disable the unpredictable naming (since we are not on the future host)
|
||||
run ln -s /dev/null "$mnt/etc/udev/rules.d/80-net-setup-link.rules"
|
||||
run cat >> "$mnt/etc/network/interfaces" <<EOF
|
||||
auto enp1s0
|
||||
allow-hotplug enp1s0
|
||||
iface enp1s0 inet dhcp
|
||||
iface enp1s0 inet6 dhcp
|
||||
auto enp2s0
|
||||
allow-hotplug enp2s0
|
||||
iface enp2s0 inet dhcp
|
||||
iface enp2s0 inet6 dhcp
|
||||
auto eth0
|
||||
allow-hotplug eth0
|
||||
iface eth0 inet dhcp
|
||||
iface eth0 inet6 dhcp
|
||||
auto eth1
|
||||
allow-hotplug eth1
|
||||
iface eth1 inet dhcp
|
||||
iface eth1 inet6 dhcp
|
||||
EOF
|
||||
# TODO add dyndn service
|
||||
|
||||
|
||||
|
||||
section "Creating root SSH key to connect"
|
||||
if [ -n "$(ls -A $secret_dir)" ]; then
|
||||
#die "Secret dir '$secret_dir' is not empty"
|
||||
yell "Secret dir is not empty. Wont save ssh key."
|
||||
else
|
||||
run export HOSTNAME="$hostname" && ssh-keygen -b 4096 -f "$secret_dir/id_rsa" -P ''
|
||||
run mkdir -p "$mnt/root/.ssh/"
|
||||
cat "$secret_dir/id_rsa.pub" >> "$mnt/root/.ssh/authorized_keys"
|
||||
fi
|
||||
|
||||
|
||||
section "Generating locales"
|
||||
chroot_run echo -e "$locale" > "/etc/locale.gen"
|
||||
chroot_run locale-gen
|
||||
|
||||
|
||||
section "Installing grub"
|
||||
# Disable predictable name (again)
|
||||
run sed -i 's/GRUB_CMDLINE_LINUX=""/GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"/g' "$mnt/etc/default/grub"
|
||||
chroot_run update-grub
|
||||
chroot_run grub-install "$boot_device"
|
||||
|
||||
|
||||
|
||||
if [ "$arg_test" != "false" ] ; then
|
||||
section "Testing installed system"
|
||||
run qemu-system-x86_64 -m 1024M "$boot_device"
|
||||
fi
|
||||
|
||||
echo "To test the system with qemu type:"
|
||||
echo "qemu-system-x86_64 -m 1024M '$boot_device'"
|
||||
|
||||
clean
|
||||
3
provisioning/TODO
Normal file
3
provisioning/TODO
Normal file
@ -0,0 +1,3 @@
|
||||
add to /etc/sysctl.conf :
|
||||
fs.file-max = 4096
|
||||
net.ipv4.ip_forward = 1
|
||||
113
provisioning/group_vars/servers.yml
Executable file
113
provisioning/group_vars/servers.yml
Executable file
@ -0,0 +1,113 @@
|
||||
# Default registry
|
||||
#
|
||||
bootstrap_user: root
|
||||
|
||||
# For jean-cloud docker services
|
||||
new_nginx_conf_path: '/data/proxy/new-sites-enabled'
|
||||
new_blackbox_hosts_path: '/data/prometheus/new-blackbox-targets.yml'
|
||||
blackbox_hosts_path: '/data/prometheus/blackbox-targets.yml'
|
||||
|
||||
remote_docker_login_registry: registry.jean-cloud.net
|
||||
|
||||
# sudo configuration
|
||||
# using geerlingguy security
|
||||
# https://galaxy.ansible.com/grog/sudo
|
||||
#sudo_default_sudoers: yes
|
||||
#sudo_list:
|
||||
# - name: tits
|
||||
# sudo:
|
||||
# hosts: ALL
|
||||
# as: ALL:ALL
|
||||
# commands: ALL
|
||||
# nopasswd: yes
|
||||
|
||||
# Security geerlingguy
|
||||
security_ssh_port: 45985
|
||||
# IMPORTANT following values should be quoted. You can lock yourself out.
|
||||
security_ssh_password_authentication: "no"
|
||||
security_ssh_permit_root_login: "yes"
|
||||
security_ssh_usedns: "no"
|
||||
security_ssh_permit_empty_password: "no"
|
||||
security_ssh_challenge_response_auth: "no"
|
||||
security_ssh_gss_api_authentication: "no"
|
||||
security_ssh_x11_forwarding: "no"
|
||||
|
||||
# Auto upgrades
|
||||
security_autoupdate_enabled: true
|
||||
|
||||
# f2b
|
||||
security_fail2ban_enabled: false
|
||||
|
||||
#locales
|
||||
locales_default:
|
||||
lang: en_US.UTF-8
|
||||
lc_all: en_US.UTF-8
|
||||
|
||||
|
||||
# For unattended upgrade configuration
|
||||
unattended_upgrades_mail: contact@jean-cloud.org
|
||||
|
||||
# For ssh security
|
||||
# https://galaxy.ansible.com/dev-sec/ssh-hardening
|
||||
#network_ipv6_enable: true
|
||||
#ssh_server_ports: ['45985']
|
||||
#ssh_permit_root_login: no # TODO uncommenting that makes it bug
|
||||
|
||||
# Fail2ban
|
||||
# https://galaxy.ansible.com/oefenweb/fail2ban
|
||||
#fail2ban_filterd_path: ./fail2ban/etc/fail2ban/filter.d/
|
||||
#fail2ban_actiond_path: ./fail2ban/etc/fail2ban/action.d/
|
||||
#fail2ban_jaild_path: ./fail2ban/etc/fail2ban/jail.d/
|
||||
#fail2ban_services:
|
||||
# # In older versions of Fail2Ban this is called ssh
|
||||
# - name: sshd
|
||||
# port: 45985
|
||||
# maxretry: 3
|
||||
# bantime: -1
|
||||
# # - name: wplogin
|
||||
# # port: http,https
|
||||
# # filter: wplogin
|
||||
# # logpath: /var/lib/docker/containers/*/*-json.log
|
||||
# # banaction: docker-action
|
||||
# # maxretry: 5
|
||||
# # findtime: 120
|
||||
# # bantime: 86400
|
||||
#
|
||||
# https://galaxy.ansible.com/robertdebock/fail2ban
|
||||
|
||||
|
||||
# For Firewall
|
||||
# https://galaxy.ansible.com/geerlingguy/firewall
|
||||
firewall_state: started
|
||||
firewall_enabled_at_boot: true
|
||||
firewall_log_dropped_packets: true
|
||||
firewall_allowed_tcp_ports:
|
||||
- "45985"
|
||||
- "22529"
|
||||
- "80"
|
||||
- "443"
|
||||
- "53"
|
||||
- "5000"
|
||||
firewall_allowed_udp_ports:
|
||||
- "53"
|
||||
|
||||
# For rootkit protection
|
||||
# https://galaxy.ansible.com/mablanco/antirootkits
|
||||
antirootkits_mail_from: contact@jean-cloud.org
|
||||
antirootkits_mail_to: contact@jean-cloud.org
|
||||
antirootkits_log_expire: 90
|
||||
# TODO wtf is /home/docker ?
|
||||
shelldetector_scan_directory: /home/docker # Il va trouver trop de merde non ?
|
||||
shelldetector_cron_hour: '4'
|
||||
shelldetector_cron_minute: '00'
|
||||
|
||||
|
||||
# Timezone
|
||||
# https://galaxy.ansible.com/oefenweb/timezone
|
||||
timezone_zone: Europe/Paris
|
||||
|
||||
# NTP
|
||||
# https://galaxy.ansible.com/geerlingguy/ntp
|
||||
ntp_timezone: Europe/Paris
|
||||
ntp_daemon: ntp
|
||||
|
||||
1
provisioning/install.sh
Executable file
1
provisioning/install.sh
Executable file
@ -0,0 +1 @@
|
||||
ansible-galaxy install -r requirements.yml --force-with-deps
|
||||
8
provisioning/inventory.ini
Normal file
8
provisioning/inventory.ini
Normal file
@ -0,0 +1,8 @@
|
||||
[servers]
|
||||
#vandamme.jean-cloud.net
|
||||
#nougaro.jean-cloud.net
|
||||
tetede.jean-cloud.net
|
||||
#carcasse.jean-cloud.net
|
||||
#benevoles.karnaval.fr
|
||||
montbonnot.jean-cloud.net
|
||||
max.jean-cloud.net
|
||||
100
provisioning/playbook.yml
Executable file
100
provisioning/playbook.yml
Executable file
@ -0,0 +1,100 @@
|
||||
- name: server
|
||||
hosts: servers
|
||||
become: yes
|
||||
gather_facts: no
|
||||
roles:
|
||||
# Ansible prerequisites
|
||||
- schuerg.prerequisites
|
||||
|
||||
- name: server
|
||||
hosts: servers
|
||||
become: yes
|
||||
#gather_facts: no
|
||||
roles:
|
||||
# Ansible prerequisites
|
||||
#- robertdebock.bootstrap
|
||||
|
||||
# EPEL for centos
|
||||
#- geerlingguy.repo-epel
|
||||
|
||||
#NTP is important for curl and apt
|
||||
# - ericsysmin.system.ntp
|
||||
|
||||
- jean-cloud-common
|
||||
|
||||
|
||||
# Users
|
||||
#- sysadmins
|
||||
|
||||
# Locales
|
||||
# TODO set locales date and currency
|
||||
#- alvistack.locales
|
||||
- oefenweb.locales
|
||||
|
||||
# Sys update. Playbook bien fait.
|
||||
- robertdebock.update
|
||||
|
||||
# Manage sudoers
|
||||
#- GROG.sudo
|
||||
|
||||
# Unattended upgrades
|
||||
#- jnv.unattended-upgrades
|
||||
#- thorian93.unattended_upgrade
|
||||
#- racqspace.unattended_upgrades
|
||||
|
||||
# ssh security
|
||||
# using geerlingguy security
|
||||
#- dev-sec.ssh-hardening
|
||||
- geerlingguy.security
|
||||
|
||||
# fail2ban
|
||||
#- oefenweb.fail2ban
|
||||
#- robertdebock.fail2ban
|
||||
|
||||
# firewall conf
|
||||
# TODO it destroy the DOCKER rules…
|
||||
#- geerlingguy.firewall
|
||||
|
||||
# Rootkit protection
|
||||
#- mablanco.antirootkits
|
||||
|
||||
|
||||
# antivirus
|
||||
#- geerlingguy.clamav
|
||||
|
||||
# docker
|
||||
- geerlingguy.docker
|
||||
|
||||
# timezone
|
||||
- oefenweb.timezone
|
||||
|
||||
# ntp
|
||||
#- geerlingguy.ntp
|
||||
|
||||
# docker metrics proxy
|
||||
#- docker-metrics-proxy
|
||||
|
||||
# logrotate
|
||||
# - ontic/logrotate
|
||||
|
||||
# apparmor ?
|
||||
# - manala.apparmor
|
||||
|
||||
# autofs
|
||||
# - cmprescott.autofs_ng
|
||||
|
||||
# smart TODO
|
||||
#- stuvusit/smartd
|
||||
|
||||
# graylog Nope, too heavy…
|
||||
# TODO lininfile for prometheus
|
||||
# 127.0.1.1 docker-host
|
||||
|
||||
##- deploy_all
|
||||
|
||||
- name: shlago
|
||||
hosts: shlago
|
||||
become: yes
|
||||
gather_facts: no
|
||||
roles:
|
||||
- ordiportables
|
||||
28
provisioning/readme.md
Normal file
28
provisioning/readme.md
Normal file
@ -0,0 +1,28 @@
|
||||
# Provisioning
|
||||
|
||||
## Installer les dépendances pour les playbooks
|
||||
Il faut avoir installé ansible-playbook et ansible-galaxy. Puis faire ./install.sh
|
||||
-> Ce fichier contient trop de trucs, il faudrait le mettre à jour…
|
||||
|
||||
## Configurer un serveur
|
||||
Vérifier que le serveur est bien décommenté dans `inventory.ini`
|
||||
```
|
||||
ansible-playbook -i inventory.ini playbook.yml
|
||||
```
|
||||
|
||||
## Déployer des services sur un serveur
|
||||
Envoyer les fichiers de conf sur le serveur.
|
||||
```
|
||||
ansible-playbook -i inventory.ini services.yml
|
||||
```
|
||||
Déployer les services : (ssh sur le serveur)
|
||||
```
|
||||
/docker/_deployer/main.sh
|
||||
```
|
||||
|
||||
## Déployer des services (ancienne méthode)
|
||||
Cette méthode ne fonctionne pas avec le nouveau script de déploiement.
|
||||
```
|
||||
ansible-playbook -i inventory.ini services_vandamme.yml
|
||||
```
|
||||
|
||||
48
provisioning/requirements.yml
Executable file
48
provisioning/requirements.yml
Executable file
@ -0,0 +1,48 @@
|
||||
# Bootstrap
|
||||
- src: robertdebock.bootstrap
|
||||
# Locales
|
||||
- src: robertdebock.locale
|
||||
# System update
|
||||
- src: robertdebock.update
|
||||
|
||||
# Manage users
|
||||
- src: GROG.user
|
||||
# Manage sudoers
|
||||
- src: GROG.sudo
|
||||
# Manage authorized-keys
|
||||
- src: GROG.authorized-key
|
||||
# Unattended upgrades
|
||||
- src: jnv.unattended-upgrades
|
||||
# ssh security
|
||||
- src: dev-sec.ssh-hardening
|
||||
|
||||
# fail2ban
|
||||
- src: oefenweb.fail2ban
|
||||
# firewall conf
|
||||
# TODO it destroy the DOCKER rules…
|
||||
#- src: geerlingguy.firewall
|
||||
# Rootkit protection
|
||||
- src: mablanco.antirootkits
|
||||
# antivirus
|
||||
- src: geerlingguy.clamav
|
||||
# docker
|
||||
- src: geerlingguy.docker
|
||||
|
||||
# timezone
|
||||
- src: oefenweb.timezone
|
||||
# hostname
|
||||
- src: oefenweb.hostname
|
||||
# ntp
|
||||
- src: geerlingguy.ntp
|
||||
|
||||
# logrotate
|
||||
# - src: ontic/logrotate
|
||||
# apparmor ?
|
||||
# - src: manala.apparmor
|
||||
# autofs
|
||||
# - src: cmprescott.autofs_ng
|
||||
# smart TODO
|
||||
#- src: stuvusit/smartd
|
||||
# graylog Nope, too heavy…
|
||||
# TODO lininfile for prometheus
|
||||
# 127.0.1.1 docker-host
|
||||
155
provisioning/roles/deploy_all/files/bin/deployer.sh
Executable file
155
provisioning/roles/deploy_all/files/bin/deployer.sh
Executable file
@ -0,0 +1,155 @@
|
||||
#!/bin/bash
|
||||
|
||||
driglibash_run_retry=true
|
||||
. driglibash-base
|
||||
set -euo pipefail
|
||||
|
||||
###############################################################################
|
||||
# Variables
|
||||
###############################################################################
|
||||
|
||||
proxy_dir="/etc/nginx"
|
||||
nginx_conf_path="$proxy_dir/sites-enabled"
|
||||
new_nginx_conf_path="$proxy_dir/new-sites-enabled"
|
||||
|
||||
certs_path="/etc/letsencrypt/live"
|
||||
dummy_cert_path="$certs_path/dummy"
|
||||
|
||||
###############################################################################
|
||||
# Helpers
|
||||
###############################################################################
|
||||
|
||||
# Returns the public IP4 address of a domain name
|
||||
function ipof {
|
||||
resolv.sh "$1"
|
||||
}
|
||||
|
||||
# Path to this directory
|
||||
here="$(where 'follow_links')"
|
||||
|
||||
# Ip4 address
|
||||
my_ip="$(ipof "$(cat /etc/hostname)")"
|
||||
[ -z "$my_ip" ] && yell "Unable to find my IP" && exit 1
|
||||
|
||||
|
||||
###############################################################################
|
||||
# Nginx preparation
|
||||
###############################################################################
|
||||
|
||||
driglibash_section_prefix="[Prepare nginx] "
|
||||
section "Delete new conf directory (to recover)"
|
||||
run rm -rf "$new_nginx_conf_path"
|
||||
|
||||
section "Create new conf file (for tests purposes)"
|
||||
sed "s#$nginx_conf_path#$new_nginx_conf_path#" "/docker/_proxy/nginx.conf" > "$proxy_dir/new_nginx.conf"
|
||||
|
||||
section "Create proxy dir"
|
||||
run mkdir -p "$proxy_dir" /docker /data
|
||||
run chown root:root /docker
|
||||
run chown root:root /data
|
||||
run chmod 755 /docker
|
||||
run chmod 755 /data
|
||||
|
||||
section "Check dummy cert exists "
|
||||
#TODO check if expired
|
||||
if [ ! -f "$dummy_cert_path/privkey.pem" ] ; then
|
||||
echo "Dummy cert generation"
|
||||
run mkdir -p "$dummy_cert_path"
|
||||
run openssl req -x509 -newkey rsa:2048 -keyout /etc/letsencrypt/live/dummy/privkey.pem -out /etc/letsencrypt/live/dummy/fullchain.pem -days 365 -nodes -subj "/C=FR/ST=France/O=IT/CN=jean-cloud.net"
|
||||
fi
|
||||
|
||||
section "Create new conf directory"
|
||||
run mkdir -p "$new_nginx_conf_path"
|
||||
|
||||
###############################################################################
|
||||
# Deploy services
|
||||
###############################################################################
|
||||
|
||||
for dir in /docker/* ; do
|
||||
service="$(basename "$dir")"
|
||||
|
||||
# Ignore _ prefixed directories
|
||||
[ "${service::1}" == '_' ] && continue
|
||||
|
||||
docker_service="$(echo "$service" | tr '.' '_')"
|
||||
driglibash_section_prefix="[$service] "
|
||||
cd "/docker/$service"
|
||||
|
||||
# Is service meant to be on this server?
|
||||
ip="$(ipof "$service")"
|
||||
[ -z "$ip" ] && yell "No IP found for $service" && continue
|
||||
|
||||
if [ "$ip" != "$my_ip" ] ; then
|
||||
if [ -n "$(docker ps | grep "$docker_service")" ] ; then
|
||||
section "--------------------"
|
||||
section "Removing service"
|
||||
docker-compose down --rmi all --remove-orphans
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
# If there is a docker-compose file and it has services in it
|
||||
if [ -f "/docker/$service/docker-compose.yml" ] && [ -n "$(grep '^[^#]*services' "/docker/$service/docker-compose.yml")" ] ; then
|
||||
section "-------------------- $service"
|
||||
section "Logging to registry"
|
||||
# XXX Login to docker registry
|
||||
|
||||
section "Pulling images"
|
||||
run docker-compose pull
|
||||
|
||||
section "Starting service"
|
||||
run docker-compose up -d --remove-orphans
|
||||
fi
|
||||
|
||||
# If there is a nginx conf file
|
||||
if [ -f "/docker/$service/nginx_server.conf" ] ; then
|
||||
section "Copy nginx conf"
|
||||
run cp "/docker/$service/nginx_server.conf" "$new_nginx_conf_path/$service"
|
||||
|
||||
if [ -f "/docker/$service/.env" ] ; then
|
||||
section "Template nginx conf with vars from '.env' file"
|
||||
run template.sh "/docker/$service/.env" < "/docker/$service/nginx_server.conf" > "$new_nginx_conf_path/$service"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Do we need dummy cert?
|
||||
if [ ! -e "$certs_path/$service/fullchain.pem" ] ; then
|
||||
section "Create cert dir"
|
||||
run mkdir -p "$certs_path/$service"
|
||||
|
||||
section "Link dummy to cert"
|
||||
run ln -s "$dummy_cert_path/fullchain.pem" "$certs_path/$service"
|
||||
run ln -s "$dummy_cert_path/privkey.pem" "$certs_path/$service"
|
||||
fi
|
||||
|
||||
section "Testing nginx conf"
|
||||
run nginx -t -c /etc/nginx/new_nginx.conf
|
||||
|
||||
done
|
||||
|
||||
###############################################################################
|
||||
# Nginx restart
|
||||
###############################################################################
|
||||
|
||||
driglibash_section_prefix="[Restart nginx] "
|
||||
|
||||
section "Test if nginx conf is ok"
|
||||
run nginx -t -c "$proxy_dir/new_nginx.conf"
|
||||
|
||||
section "Update nginx conf"
|
||||
run rm -rf "$nginx_conf_path"
|
||||
run mv "$new_nginx_conf_path" "$nginx_conf_path"
|
||||
run cp "/docker/_proxy/nginx.conf" "$proxy_dir/nginx.conf"
|
||||
|
||||
section "Test nginx conf to be sure"
|
||||
run nginx -t
|
||||
|
||||
if [ -z "$(cat /var/run/nginx.pid)" ] ; then
|
||||
section "Start nginx"
|
||||
run nginx
|
||||
else
|
||||
section "Reload nginx"
|
||||
run nginx -s reload
|
||||
fi
|
||||
|
||||
clean
|
||||
90
provisioning/roles/deploy_all/files/bin/driglibash-args
Executable file
90
provisioning/roles/deploy_all/files/bin/driglibash-args
Executable file
@ -0,0 +1,90 @@
|
||||
#!/bin/bash
|
||||
|
||||
###############################################################################
|
||||
# https://github.com/adrianamaglio/driglibash-arg
|
||||
###############################################################################
|
||||
|
||||
|
||||
# Usage :
|
||||
#
|
||||
# version="alpha nightly 0.0.1 pre-release unstable"
|
||||
# summary="$0 [options] <device>"
|
||||
#
|
||||
# usage[t]="Start qemu after the installation"
|
||||
# varia[t]=tst
|
||||
# tst=false
|
||||
#
|
||||
# usage[i]="Install the provided package. Not implemented"
|
||||
# varia[i]=install
|
||||
# declare -a install
|
||||
#
|
||||
# usage[k]="Keep the temporar mountpoints"
|
||||
# varia[k]=keep
|
||||
# keep=false
|
||||
#
|
||||
# usage[e]="bash command file to execute in the chroot. - to read from stdin"
|
||||
# varia[e]=execute
|
||||
# declare -a execute
|
||||
|
||||
. driglibash-base
|
||||
|
||||
#TODO keep order usage options
|
||||
# Print usage and exit in error
|
||||
usage() {
|
||||
yell "Version: $version"
|
||||
yell "Usage: $summary"
|
||||
yell "Parameters:"
|
||||
yell " -h print this help, version and exit."
|
||||
for key in "${!usage[@]}" ; do
|
||||
if [ "$(driglibash_arg_type "$key")" == "single_value" ] ; then
|
||||
name="${varia[$key]}"
|
||||
default=" (default : ${!name})"
|
||||
else
|
||||
default=
|
||||
fi
|
||||
yell " -$key ${usage[$key]}$default"
|
||||
done
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Guess the variable type
|
||||
# Boolean, list or string
|
||||
driglibash_arg_type() {
|
||||
if [ $# -ne 1 ] ; then
|
||||
die "Bad driglibash_arg_type usage";
|
||||
fi
|
||||
|
||||
name="${varia[$1]}"
|
||||
if [ "$name" == "" ] ; then die "Variable name is empty for key $1" ; fi
|
||||
if [ "${!name}" == "false" ] ; then
|
||||
echo "boolean"
|
||||
elif [ -n "$( declare -p "$name" 2>/dev/null | grep 'declare \-a')" ] ; then
|
||||
echo "array"
|
||||
else
|
||||
echo "single_value"
|
||||
fi
|
||||
}
|
||||
|
||||
# Generate getopts string #
|
||||
getopts_string=":h"
|
||||
for key in ${!usage[@]} ; do
|
||||
needs_parameter=
|
||||
if [ "$(driglibash_arg_type "$key")" != "boolean" ] ; then needs_parameter=":" ; fi
|
||||
getopts_string="$getopts_string$key$needs_parameter"
|
||||
done
|
||||
|
||||
# Loop throught options #
|
||||
while getopts "$getopts_string" opt; do
|
||||
case $opt in
|
||||
h) usage;;
|
||||
:) die "Option -$OPTARG requires an argument.";;
|
||||
\?) die "Invalid option: -$OPTARG";;
|
||||
*)
|
||||
name="${varia[$opt]}"
|
||||
if [ "${!name}" == "false" ] ; then eval $name=true
|
||||
elif [ -n "$( declare -p "$name" 2>/dev/null | grep 'declare \-a')" ] ; then safe="${!name} $OPTARG" ; eval $name=\$safe
|
||||
else eval $name=\$OPTARG
|
||||
fi;;
|
||||
esac
|
||||
done ; shift $((OPTIND-1))
|
||||
|
||||
179
provisioning/roles/deploy_all/files/bin/driglibash-base
Executable file
179
provisioning/roles/deploy_all/files/bin/driglibash-base
Executable file
@ -0,0 +1,179 @@
|
||||
###############################################################################
|
||||
# Driglibash pack 1
|
||||
# Usual helper functions for bash scripts
|
||||
# https://github.com/adrianamaglio/driglibash
|
||||
###############################################################################
|
||||
|
||||
# Set to true to make a pause at each step
|
||||
driglibash_step_by_step=false
|
||||
|
||||
# Set to watever you want to have a prefix
|
||||
driglibash_section_prefix=""
|
||||
|
||||
|
||||
trap 'die "Received sigint"' INT
|
||||
|
||||
# Output on standard error output
|
||||
yell() {
|
||||
echo >&2 -e "$@"
|
||||
}
|
||||
|
||||
# Output first parameter, second parameter times
|
||||
repeat() {
|
||||
printf "$1"'%.s' $(eval "echo {1.."$(($2))"}")
|
||||
}
|
||||
|
||||
# Output a "section title" to visually separate different script part
|
||||
# TODO local variables
|
||||
# TODO fixed place left aligned
|
||||
section(){
|
||||
text="$driglibash_section_prefix$1"
|
||||
if [ -n "$text" ] ; then
|
||||
len="${#text}"
|
||||
max_len="$(($(tput cols)-2))"
|
||||
if [ "$len" -ge "$max_len" ] ; then
|
||||
right=5
|
||||
left=5
|
||||
else
|
||||
left="$((($max_len - $len)/2))"
|
||||
right="$left"
|
||||
fi
|
||||
else
|
||||
left=80
|
||||
right=0
|
||||
fi
|
||||
|
||||
# If the character number was rounded down
|
||||
if [ "$(($left + $right + $len +1 ))" -eq "$max_len" ] ; then
|
||||
left="$(($left+ 1))"
|
||||
fi
|
||||
|
||||
repeat '=' "$left"
|
||||
if [ "$right" -ge 1 ] ; then
|
||||
echo -n " $text "
|
||||
repeat '=' "$right"
|
||||
echo
|
||||
fi
|
||||
|
||||
if "$driglibash_step_by_step" ; then
|
||||
echo "Press enter to proceed"
|
||||
read
|
||||
fi
|
||||
}
|
||||
alias step=section
|
||||
|
||||
# Print an error, clean and exit
|
||||
die() {
|
||||
yell "$@"
|
||||
clean
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Exit on error if not root
|
||||
root_or_die() {
|
||||
if [ "$UID" -ne 0 ] ; then
|
||||
die "You need to be root"
|
||||
fi
|
||||
}
|
||||
|
||||
# Execute a command and die if it returns with error #
|
||||
run() {
|
||||
while true ; do
|
||||
"$@"
|
||||
code=$?
|
||||
if [ "$code" -ne 0 ] ; then
|
||||
yell "command [$*] failed with exit code '$code'"
|
||||
if [ -n "$driglibash_run_retry" ] ; then
|
||||
echo "Retry ? Retry (y), skip the command (s) or exit script(n) [Y/s/n] ?"
|
||||
read answer
|
||||
if [ "$answer" = "y" ] || [ "$answer" = "Y" ] || [ -z "$answer" ] ; then
|
||||
continue
|
||||
elif [ "$answer" = "s" ] || [ "$answer" = "S" ] ; then
|
||||
return "$code"
|
||||
fi
|
||||
fi
|
||||
die "Aborting"
|
||||
else
|
||||
break
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
# Execute a commad in background and return its pid
|
||||
start(){
|
||||
"$@" &
|
||||
pid=$!
|
||||
clean pre "kill $pid"
|
||||
return $pid
|
||||
}
|
||||
|
||||
# Clean exit #
|
||||
# Record command lines passed as argument and execute them all when called without args #
|
||||
# One argument = One command #
|
||||
# TODO append or prepend according to arg
|
||||
declare -a driglibash_clean_actions
|
||||
clean() {
|
||||
if [ "$#" -eq 0 ] ; then
|
||||
echo "Cleaning"
|
||||
for action in "${driglibash_clean_actions[@]}" ; do
|
||||
echo "driglibash_clean> $action"
|
||||
$action
|
||||
done
|
||||
elif [ "$#" -eq 1 ] ; then
|
||||
driglibash_clean_actions+=("$1")
|
||||
elif [ "$#" -eq 2 ] ; then
|
||||
case "$1" in
|
||||
"pre")
|
||||
declare -a tmp
|
||||
tmp=("${driglibash_clean_actions[@]}")
|
||||
driglibash_clean_actions=("$2")
|
||||
driglibash_clean_actions+=("${tmp[@]}")
|
||||
;;
|
||||
"post")
|
||||
driglibash_clean_actions+=("$2")
|
||||
;;
|
||||
"del")
|
||||
for i in "${!driglibash_clean_actions[@]}" ; do
|
||||
if [ "$2" = "${driglibash_clean_actions[$i]}" ] ; then
|
||||
unset driglibash_clean_actions[$i]
|
||||
break
|
||||
fi
|
||||
done
|
||||
;;
|
||||
*)
|
||||
die "driglibash_clean: action '$1' not supported"
|
||||
esac
|
||||
else
|
||||
die "driglibash_clean : Bad clean usage, receveid more than two args"
|
||||
fi
|
||||
}
|
||||
|
||||
# tells where your executable is (absolute path). Follow simlinks if any argument provided
|
||||
where() {
|
||||
if [ -z "$1" ] ; then
|
||||
echo "$( cd -P "$( dirname "$1" )" && pwd )"
|
||||
else
|
||||
SOURCE="$0"
|
||||
while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink
|
||||
DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
|
||||
SOURCE="$(readlink "$SOURCE")"
|
||||
[[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located
|
||||
done
|
||||
DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
|
||||
|
||||
echo $DIR
|
||||
fi
|
||||
}
|
||||
|
||||
# Add the line $1 in file $2 if not present
|
||||
line_in_file() {
|
||||
if [ "$#" -ne 2 ] ; then die "Bad usage of 'line_in_file'. Got '$#' parameters : '$@'" ; fi
|
||||
if [ -z "$1" ] ; then die "Line arg is emtpy in 'line_in_file'" ; fi
|
||||
line="$1"
|
||||
if [ -z "$2" ] ; then die "File arg is emtpy in 'line_in_file'" ; fi
|
||||
file="$2"
|
||||
if [ ! -f "$file" ] ; then run touch "$file" ; fi
|
||||
|
||||
grep -q -x -F "$line" "$file" || echo "$line" >> "$file"
|
||||
}
|
||||
105
provisioning/roles/deploy_all/files/bin/letsencrypt.sh
Executable file
105
provisioning/roles/deploy_all/files/bin/letsencrypt.sh
Executable file
@ -0,0 +1,105 @@
|
||||
#!/bin/bash
|
||||
# This script will run on new cert and on cron renew
|
||||
# there is one cert by service
|
||||
|
||||
# TODO make it an ansible script
|
||||
# No
|
||||
|
||||
# Les arguments du pauvre
|
||||
if [ "$#" -eq 1 ] && [ "$1" = '-v' ] ; then
|
||||
verbose=true
|
||||
else
|
||||
verbose=false
|
||||
fi
|
||||
|
||||
# Variable
|
||||
acmeroot=/var/www/letsencrypt
|
||||
|
||||
# Création du répertoire
|
||||
mkdir -p "$acmeroot"
|
||||
|
||||
# With trailing slash or it will be a prefix selector
|
||||
#nginx_sites_dir="/etc/nginx/sites-enabled/"
|
||||
nginx_sites_dir="/etc/nginx/sites-enabled/"
|
||||
|
||||
for file in "$nginx_sites_dir"* ; do
|
||||
if $verbose ; then
|
||||
echo '-------------------------'
|
||||
echo "$file"
|
||||
fi
|
||||
|
||||
service_name="$(basename "$file")"
|
||||
|
||||
# Getting just the domain names
|
||||
domains="$(grep '^[[:blank:]]*[^#][[:blank:]]*server_name' "$file" | sed 's/ _ / /g' | sed 's/server_name//g' | sed 's/default_server//g' | sed -e 's/^[[:space:]]*//' | cut -d ';' -f 1)"
|
||||
if [ -n "$domains" ] ; then
|
||||
# If using dummy cert, disabling it
|
||||
if [ "$(readlink "/etc/letsencrypt/live/$service_name/fullchain.pem")" = "/etc/letsencrypt/live/dummy/fullchain.pem" ] ; then
|
||||
rm -r "/etc/letsencrypt/live/$service_name"
|
||||
fi
|
||||
|
||||
# removing duplicates
|
||||
domains="$(echo $domains | awk '{for (i=1;i<=NF;i++) if (!a[$i]++) printf("%s%s",$i,FS)}{printf("\n")}')"
|
||||
echo "$domains"
|
||||
|
||||
# adding -d before every domain
|
||||
domains="-d $(echo $domains | sed 's/ / -d /g')"
|
||||
|
||||
# Run certbot
|
||||
command="certbot certonly -n --expand --agree-tos --webroot -w "$acmeroot" --email contact@jean-cloud.org --cert-name "$(basename $file)" $domains"
|
||||
if $verbose ; then
|
||||
echo $command
|
||||
fi
|
||||
out="$($command 2>&1)"
|
||||
result="$?"
|
||||
|
||||
if [ "$result" -eq 0 ] && [[ "$out" = *"Certificate not yet due for renewal; no action taken."* ]]; then
|
||||
echo "Cert still valid"
|
||||
elif [ "$result" -eq 0 ] ; then
|
||||
echo "Cert renewed or obtained"
|
||||
#new_cert="$(echo "$out" | grep -oE '/etc/letsencrypt/live/.*/fullchain.pem')"
|
||||
#echo "'$new_cert'"
|
||||
#new_cert_dir="$(dirname "$out")"
|
||||
#echo "'$new_cert_dir'"
|
||||
|
||||
#if [ -d "$new_cert_dir" ] ; then
|
||||
# echo "New cert dir : '$new_cert_dir'"
|
||||
# echo "cp '$new_cert_dir/*' '/data/proxy/certs/'"
|
||||
#else
|
||||
# echo "Error parsiong dir name"
|
||||
#fi
|
||||
|
||||
elif [ "$result" -eq 1 ] ; then
|
||||
echo "Cert failed"
|
||||
echo " ------------------------------------------"
|
||||
echo "$out"
|
||||
echo " ------------------------------------------"
|
||||
else
|
||||
echo "Unknown error : $result.\n$out"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
ls /etc/letsencrypt/live/*000* &> /dev/null
|
||||
if [ "$?" -eq 0 ] ; then
|
||||
echo " ---------------------------------------------------------------------------------------------"
|
||||
echo "Bad certs detected in letsencrypt dir. Nginx conf wont work…"
|
||||
echo "rm -r /etc/letsencrypt/live/*000* /etc/letsencrypt/archive/*000* /etc/letsencrypt/renewal/*000*"
|
||||
echo " ---------------------------------------------------------------------------------------------"
|
||||
fi
|
||||
|
||||
|
||||
nginx -t
|
||||
code="$?"
|
||||
if [ "$code" -ne 0 ] ; then
|
||||
echo "Nginx test error, can’t reloat it"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
nginx -s reload
|
||||
code="$?"
|
||||
if [ "$code" -ne 0 ] ; then
|
||||
echo "Nginx reload error, GENERAL ALEEEEEEEEERT!!!!!"
|
||||
exit 1
|
||||
fi
|
||||
echo "Done. No error detected."
|
||||
@ -0,0 +1,2 @@
|
||||
#!/bin/sh
|
||||
docker inspect -f $'{{.Name}}\t{{.GraphDriver.Data.MergedDir}}' $(docker ps -aq)
|
||||
61
provisioning/roles/deploy_all/files/bin/resolv.sh
Executable file
61
provisioning/roles/deploy_all/files/bin/resolv.sh
Executable file
@ -0,0 +1,61 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
########################### Helpers ###########################################
|
||||
|
||||
function yell {
|
||||
echo "$@" >&2
|
||||
}
|
||||
|
||||
function die {
|
||||
yell "$@"
|
||||
exit 1
|
||||
}
|
||||
|
||||
function say {
|
||||
if "$verbose" ; then
|
||||
yell "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
########################### Options ###########################################
|
||||
|
||||
verbose=false
|
||||
if [ "$1" = '-v' ] ; then
|
||||
verbose=true
|
||||
shift
|
||||
fi
|
||||
|
||||
########################### arguments ##########################################
|
||||
|
||||
if [ "$#" -ne 1 ] ; then
|
||||
die "Usage: $0 [options] <domain_name>
|
||||
options : -v verbose"
|
||||
fi
|
||||
|
||||
name="$1"
|
||||
|
||||
########################### script ############################################
|
||||
|
||||
while true ; do
|
||||
if "$verbose" ; then
|
||||
say "Querying $name"
|
||||
fi
|
||||
while read line ; do
|
||||
if [[ "$line" = *"is an alias for "* ]] ; then
|
||||
name="$(echo "$line" | cut -d ' ' -f 6)"
|
||||
break
|
||||
elif [[ "$line" = *" has address "* ]] ; then
|
||||
echo "$line" | cut -d ' ' -f 4
|
||||
exit 0
|
||||
elif [[ "$line" = *" not found: "* ]] ; then
|
||||
exit 0
|
||||
elif [[ "$line" = *" has no A record" ]] ; then
|
||||
exit 0
|
||||
else
|
||||
say "unmatched: $line"
|
||||
fi
|
||||
done <<< "$(host -W 2 -t A "$name" localhost)"
|
||||
done
|
||||
|
||||
8
provisioning/roles/deploy_all/files/bin/template.sh
Executable file
8
provisioning/roles/deploy_all/files/bin/template.sh
Executable file
@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
if [ "$#" -ne 1 ] ; then
|
||||
echo "Usage: $0 <env_file>" >&2
|
||||
echo "This script read env_file variables and replace theire occurences in stdin" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
bash -c 'set -a && . '"$1"' && envsubst "$(cat '"$1"' | grep -o ^.*= | sed "s/=//" | sed "s/^/$/")"'
|
||||
22
provisioning/roles/deploy_all/files/bind/db.amaglio.fr
Normal file
22
provisioning/roles/deploy_all/files/bind/db.amaglio.fr
Normal file
@ -0,0 +1,22 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.dahus.net. (
|
||||
2023041900 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ IN MX 10 mail.amaglio.fr.
|
||||
|
||||
mail IN A 91.216.107.37
|
||||
imap IN CNAME mail.amaglio.fr.
|
||||
pop IN CNAME mail.amaglio.fr.
|
||||
smtp IN CNAME mail.amaglio.fr.
|
||||
|
||||
@ -0,0 +1,30 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2020031104 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ 10800 IN MX 10 spool.mail.gandi.net.
|
||||
@ 10800 IN MX 50 fb.mail.gandi.net.
|
||||
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"
|
||||
|
||||
collectif-arthadie.fr. IN CAA 0 issue "letsencrypt.org"
|
||||
collectif-arthadie.fr. IN CAA 0 issuewild ";"
|
||||
|
||||
wordpress IN CNAME vandamme.jean-cloud.net.
|
||||
www.wordpress IN CNAME vandamme.jean-cloud.net.
|
||||
www IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
www.wordpress.collectif-arthadie.fr IN CAA 0 issue "letsencrypt.org"
|
||||
www.wordpress.collectif-arthadie.fr IN CAA 0 issuewild ";"
|
||||
@ -0,0 +1,16 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 172.104.154.21
|
||||
@ IN AAAA 2a01:7e01::f03c:92ff:fecf:e815
|
||||
@ -0,0 +1,30 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023020400 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
@ IN NS ns1.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.195.40.128
|
||||
@ IN AAAA 2001:41d0:701:1100::31f
|
||||
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
tetede IN A 51.255.33.248
|
||||
tetede IN AAAA 2001:41d0:701:1100::31f
|
||||
|
||||
|
||||
19
provisioning/roles/deploy_all/files/bind/db.hid
Normal file
19
provisioning/roles/deploy_all/files/bind/db.hid
Normal file
@ -0,0 +1,19 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023040300 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
radiodemo IN CNAME montbonnot.jean-cloud.net
|
||||
|
||||
15
provisioning/roles/deploy_all/files/bind/db.inurbe.fr
Normal file
15
provisioning/roles/deploy_all/files/bind/db.inurbe.fr
Normal file
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
146
provisioning/roles/deploy_all/files/bind/db.jean-cloud.net
Normal file
146
provisioning/roles/deploy_all/files/bind/db.jean-cloud.net
Normal file
@ -0,0 +1,146 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042400 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
@ IN NS ns1.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ 10800 IN MX 10 spool.mail.gandi.net.
|
||||
@ 10800 IN MX 50 fb.mail.gandi.net.
|
||||
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
;mail IN CNAME vandamme
|
||||
webmail IN CNAME vandamme
|
||||
vimbadmin IN CNAME vandamme
|
||||
|
||||
www IN CNAME vandamme
|
||||
|
||||
; Naming nodes
|
||||
vandamme IN A 51.255.33.248
|
||||
|
||||
local-adrian IN A 193.33.56.94
|
||||
|
||||
francois IN A 54.38.189.153
|
||||
|
||||
nougaro IN A 172.104.154.21
|
||||
nougaro IN AAAA 2a01:7e01::f03c:92ff:fecf:e815
|
||||
|
||||
tetede IN AAAA 2001:41d0:701:1100::31f
|
||||
tetede IN A 51.195.40.128
|
||||
|
||||
carcasse IN A 109.18.84.200
|
||||
carcasse IN AAAA 2a02:8434:1633:df01:adf9:74c3:b444:262f
|
||||
|
||||
heart IN A 109.18.84.200
|
||||
|
||||
max IN A 82.65.204.254
|
||||
max IN AAAA 2a01:e0a:c9d:81d0:a2b3:ccff:fe85:af97
|
||||
|
||||
montbonnot IN A 188.114.97.2
|
||||
montbonnot IN A 188.114.96.2
|
||||
montbonnot IN AAAA 2a06:98c1:3120::2
|
||||
montbonnot IN AAAA 2a06:98c1:3121::2
|
||||
|
||||
|
||||
; Carcasse
|
||||
dumbcluster IN A 109.18.84.200
|
||||
dumbcluster IN AAAA 2a02:8434:1633:df01:226:2dff:fe11:56af
|
||||
; Tetede
|
||||
dumbcluster IN A 51.195.40.128
|
||||
dumbcluster IN AAAA 2001:41d0:701:1100::31f
|
||||
|
||||
; services
|
||||
|
||||
nuage IN CNAME vandamme
|
||||
www.nuage IN CNAME vandamme
|
||||
calc.nuage IN CNAME vandamme
|
||||
pad.nuage IN CNAME vandamme
|
||||
|
||||
feteducourt IN CNAME vandamme
|
||||
www.feteducourt IN CNAME vandamme
|
||||
feteducourt2020 IN CNAME vandamme
|
||||
www.feteducourt2020 IN CNAME vandamme
|
||||
|
||||
git IN CNAME vandamme
|
||||
www.git IN CNAME vandamme
|
||||
|
||||
wiki-cgr IN CNAME vandamme
|
||||
www.wiki-cgr IN CNAME vandamme
|
||||
parsoid-wiki-cgr IN CNAME vandamme
|
||||
www.parsoid-wiki-cgr IN CNAME vandamme
|
||||
|
||||
cousinades IN CNAME vandamme
|
||||
www.cousinades IN CNAME vandamme
|
||||
|
||||
cousinadesi2 IN CNAME vandamme
|
||||
www.cousinades2 IN CNAME vandamme
|
||||
|
||||
velov IN CNAME vandamme
|
||||
www.velov IN CNAME vandamme
|
||||
|
||||
registry IN CNAME vandamme
|
||||
www.registry IN CNAME vandamme
|
||||
|
||||
inurbe IN CNAME vandamme
|
||||
www.inurbe IN CNAME vandamme
|
||||
|
||||
gmx-webmail IN CNAME vandamme
|
||||
www.gmx-webmail IN CNAME vandamme
|
||||
|
||||
rpnow IN CNAME vandamme
|
||||
www.rpnow IN CNAME vandamme
|
||||
test.rpnow IN CNAME vandamme
|
||||
www.test.rpnow IN CNAME vandamme
|
||||
|
||||
lalis IN CNAME vandamme
|
||||
www.lalis IN CNAME vandamme
|
||||
|
||||
metamorphose IN CNAME vandamme
|
||||
www.metamorphose IN CNAME vandamme
|
||||
|
||||
static IN CNAME vandamme
|
||||
www.static IN CNAME vandamme
|
||||
|
||||
;educloud IN CNAME tetede
|
||||
;www.educloud IN CNAME tetede
|
||||
;educloud2 IN CNAME tetede
|
||||
;www.educloud2 IN CNAME tetede
|
||||
|
||||
copaines IN CNAME tetede
|
||||
www.copaines IN CNAME tetede
|
||||
wordpress.copaines IN CNAME tetede
|
||||
www.wordpress.copaines IN CNAME tetede
|
||||
|
||||
feministesucl34 IN CNAME tetede
|
||||
www.feministesucl34 IN CNAME tetede
|
||||
wordpress.feministesucl34 IN CNAME tetede
|
||||
www.wordpress.feministesucl34 IN CNAME tetede
|
||||
|
||||
tracker IN CNAME tetede
|
||||
|
||||
raplacgr IN CNAME tetede
|
||||
|
||||
walou IN CNAME dumbcluster
|
||||
|
||||
nc-backup IN CNAME tetede
|
||||
|
||||
gypsy IN CNAME tetede
|
||||
|
||||
shlago.wireguard.jean-cloud.net IN CNAME teted
|
||||
20
provisioning/roles/deploy_all/files/bind/db.jean-cloud.org
Normal file
20
provisioning/roles/deploy_all/files/bind/db.jean-cloud.org
Normal file
@ -0,0 +1,20 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2021060600 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
604800 ) ; Negative Cache TTL
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ 10800 IN MX 10 spool.mail.gandi.net.
|
||||
@ 10800 IN MX 50 fb.mail.gandi.net.
|
||||
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"
|
||||
|
||||
ns1 IN A 51.255.33.248
|
||||
|
||||
27
provisioning/roles/deploy_all/files/bind/db.karnaval.fr
Normal file
27
provisioning/roles/deploy_all/files/bind/db.karnaval.fr
Normal file
@ -0,0 +1,27 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023020700 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
@ IN NS ns1.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.178.80.171
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
benevoles IN A 51.178.80.171
|
||||
benevoles31 IN A 51.178.80.171
|
||||
|
||||
15
provisioning/roles/deploy_all/files/bind/db.lalis.fr
Normal file
15
provisioning/roles/deploy_all/files/bind/db.lalis.fr
Normal file
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
15
provisioning/roles/deploy_all/files/bind/db.leida.fr
Normal file
15
provisioning/roles/deploy_all/files/bind/db.leida.fr
Normal file
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
58
provisioning/roles/deploy_all/files/bind/db.oma-radio.fr
Normal file
58
provisioning/roles/deploy_all/files/bind/db.oma-radio.fr
Normal file
@ -0,0 +1,58 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042200 ; Serial
|
||||
604800 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
604800 ) ; Negative Cache TTL
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns5.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ IN MX 1 mx1.mail.ovh.net.
|
||||
@ IN MX 5 mx2.mail.ovh.net.
|
||||
@ IN MX 10 mx3.mail.ovh.net.
|
||||
|
||||
www IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
www.registry IN CNAME nougaro.jean-cloud.net.
|
||||
registry IN CNAME nougaro.jean-cloud.net.
|
||||
services IN CNAME nougaro.jean-cloud.net.
|
||||
|
||||
radionimaitre IN CNAME tetede.jean-cloud.net.
|
||||
www.radionimaitre IN CNAME tetede.jean-cloud.net.
|
||||
paj IN CNAME nougaro.jean-cloud.net.
|
||||
www.paj IN CNAME nougaro.jean-cloud.net.
|
||||
radiodemo IN CNAME tetede.jean-cloud.net.
|
||||
radiodemo-back IN CNAME montbonnot.jean-cloud.net.
|
||||
|
||||
|
||||
_autodiscover._tcp IN SRV 0 0 443 mailconfig.ovh.net.
|
||||
_imaps._tcp IN SRV 0 0 993 ssl0.ovh.net.
|
||||
_submission._tcp IN SRV 0 0 465 ssl0.ovh.net.
|
||||
;autoconfig IN SRV mailconfig.ovh.net.
|
||||
imap IN CNAME ssl0.ovh.net.
|
||||
smtp IN CNAME ssl0.ovh.net.
|
||||
mail IN CNAME ssl0.ovh.net.
|
||||
pop3 IN CNAME ssl0.ovh.net.
|
||||
|
||||
stream.paj.ports IN TXT 9002
|
||||
control.paj.ports IN TXT 9492
|
||||
|
||||
pa1.studios IN CNAME carcasse.jean-cloud.net.
|
||||
montpellier1.studios IN CNAME tetede.jean-cloud.net.
|
||||
|
||||
npm IN CNAME vandamme.jean-cloud.net.
|
||||
www.npm IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
static IN CNAME vandamme.jean-cloud.net.
|
||||
www.static IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
discordbot IN CNAME vandamme.jean-cloud.net.
|
||||
www.discordbot IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
78
provisioning/roles/deploy_all/files/bind/named.conf.local
Normal file
78
provisioning/roles/deploy_all/files/bind/named.conf.local
Normal file
@ -0,0 +1,78 @@
|
||||
//
|
||||
// Do any local configuration here
|
||||
//
|
||||
|
||||
// Consider adding the 1918 zones here, if they are not used in your
|
||||
// organization
|
||||
//include "/etc/bind/zones.rfc1918";
|
||||
|
||||
|
||||
|
||||
zone "oma-radio.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.oma-radio.fr";
|
||||
};
|
||||
zone "jean-cloud.net"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.jean-cloud.net";
|
||||
};
|
||||
zone "jean-cloud.org"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.jean-cloud.org";
|
||||
};
|
||||
zone "karnaval.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.karnaval.fr";
|
||||
};
|
||||
zone "amaglio.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.amaglio.fr";
|
||||
};
|
||||
zone "collectif-arthadie.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.collectif-arthadie.fr";
|
||||
};
|
||||
zone "gypsylyonfestival.com"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.gypsylyonfestival.com";
|
||||
};
|
||||
zone "hid"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.hid";
|
||||
};
|
||||
zone "compagnienouvelle.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.compagnienouvelle.fr";
|
||||
};
|
||||
zone "inurbe.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.inurbe.fr";
|
||||
};
|
||||
zone "lalis.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.lalis.fr";
|
||||
};
|
||||
zone "leida.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.leida.fr";
|
||||
};
|
||||
zone "metamorphosemagazine.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.metamorphosemagazine.fr";
|
||||
};
|
||||
|
||||
|
||||
|
||||
18
provisioning/roles/deploy_all/files/bind/named.conf.options
Normal file
18
provisioning/roles/deploy_all/files/bind/named.conf.options
Normal file
@ -0,0 +1,18 @@
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
dnssec-validation auto;
|
||||
|
||||
auth-nxdomain no; # conform to RFC1035
|
||||
listen-on { any; };
|
||||
listen-on-v6 { any; };
|
||||
allow-update { none; };
|
||||
allow-recursion { none; };
|
||||
allow-recursion-on { none; };
|
||||
recursion no;
|
||||
notify yes;
|
||||
allow-transfer {
|
||||
none;
|
||||
#216.218.133.2; 2001:470:600::2; //he.net
|
||||
#172.104.154.21; 2a01:7e01::f03c:92ff:fecf:e815; // nougaro
|
||||
};
|
||||
};
|
||||
33
provisioning/roles/deploy_all/tasks/main.yml
Normal file
33
provisioning/roles/deploy_all/tasks/main.yml
Normal file
@ -0,0 +1,33 @@
|
||||
---
|
||||
# tasks file for deploy_all
|
||||
- name: sync services dirs
|
||||
ansible.posix.synchronize:
|
||||
src: ../services/
|
||||
dest: /docker/
|
||||
delete: true
|
||||
archive: false
|
||||
recursive: true
|
||||
|
||||
- name: Add binaries
|
||||
ansible.posix.synchronize:
|
||||
src: "{{ role_path }}/files/bin/"
|
||||
dest: "/usr/local/bin"
|
||||
|
||||
- name: Add bind conf
|
||||
ansible.posix.synchronize:
|
||||
src: "{{ role_path }}/files/bind/"
|
||||
dest: "/etc/bind/"
|
||||
|
||||
- name: make sure bind9 is started
|
||||
ansible.builtin.service:
|
||||
name: bind9
|
||||
state: started
|
||||
- name: Reload service bind9, in all cases
|
||||
ansible.builtin.service:
|
||||
name: bind9
|
||||
state: reloaded
|
||||
|
||||
#- name: Start the deployer
|
||||
# ansible.builtin.command:
|
||||
# command: /docker/_deployer/main.sh
|
||||
|
||||
155
provisioning/roles/jean-cloud-common/files/bin/deployer.sh
Executable file
155
provisioning/roles/jean-cloud-common/files/bin/deployer.sh
Executable file
@ -0,0 +1,155 @@
|
||||
#!/bin/bash
|
||||
|
||||
driglibash_run_retry=true
|
||||
. driglibash-base
|
||||
set -euo pipefail
|
||||
|
||||
###############################################################################
|
||||
# Variables
|
||||
###############################################################################
|
||||
|
||||
proxy_dir="/etc/nginx"
|
||||
nginx_conf_path="$proxy_dir/sites-enabled"
|
||||
new_nginx_conf_path="$proxy_dir/new-sites-enabled"
|
||||
|
||||
certs_path="/etc/letsencrypt/live"
|
||||
dummy_cert_path="$certs_path/dummy"
|
||||
|
||||
###############################################################################
|
||||
# Helpers
|
||||
###############################################################################
|
||||
|
||||
# Returns the public IP4 address of a domain name
|
||||
function ipof {
|
||||
resolv.sh "$1"
|
||||
}
|
||||
|
||||
# Path to this directory
|
||||
here="$(where 'follow_links')"
|
||||
|
||||
# Ip4 address
|
||||
my_ip="$(ipof "$(cat /etc/hostname)")"
|
||||
[ -z "$my_ip" ] && yell "Unable to find my IP" && exit 1
|
||||
|
||||
|
||||
###############################################################################
|
||||
# Nginx preparation
|
||||
###############################################################################
|
||||
|
||||
driglibash_section_prefix="[Prepare nginx] "
|
||||
section "Delete new conf directory (to recover)"
|
||||
run rm -rf "$new_nginx_conf_path"
|
||||
|
||||
section "Create new conf file (for tests purposes)"
|
||||
sed "s#$nginx_conf_path#$new_nginx_conf_path#" "/docker/_proxy/nginx.conf" > "$proxy_dir/new_nginx.conf"
|
||||
|
||||
section "Create proxy dir"
|
||||
run mkdir -p "$proxy_dir" /docker /data
|
||||
run chown root:root /docker
|
||||
run chown root:root /data
|
||||
run chmod 755 /docker
|
||||
run chmod 755 /data
|
||||
|
||||
section "Check dummy cert exists "
|
||||
#TODO check if expired
|
||||
if [ ! -f "$dummy_cert_path/privkey.pem" ] ; then
|
||||
echo "Dummy cert generation"
|
||||
run mkdir -p "$dummy_cert_path"
|
||||
run openssl req -x509 -newkey rsa:2048 -keyout /etc/letsencrypt/live/dummy/privkey.pem -out /etc/letsencrypt/live/dummy/fullchain.pem -days 365 -nodes -subj "/C=FR/ST=France/O=IT/CN=jean-cloud.net"
|
||||
fi
|
||||
|
||||
section "Create new conf directory"
|
||||
run mkdir -p "$new_nginx_conf_path"
|
||||
|
||||
###############################################################################
|
||||
# Deploy services
|
||||
###############################################################################
|
||||
|
||||
for dir in /docker/* ; do
|
||||
service="$(basename "$dir")"
|
||||
|
||||
# Ignore _ prefixed directories
|
||||
[ "${service::1}" == '_' ] && continue
|
||||
|
||||
docker_service="$(echo "$service" | tr '.' '_')"
|
||||
driglibash_section_prefix="[$service] "
|
||||
cd "/docker/$service"
|
||||
|
||||
# Is service meant to be on this server?
|
||||
ip="$(ipof "$service")"
|
||||
[ -z "$ip" ] && yell "No IP found for $service" && continue
|
||||
|
||||
if [ "$ip" != "$my_ip" ] ; then
|
||||
if [ -n "$(docker ps | grep "$docker_service")" ] ; then
|
||||
section "--------------------"
|
||||
section "Removing service"
|
||||
docker-compose down --rmi all --remove-orphans
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
# If there is a docker-compose file and it has services in it
|
||||
if [ -f "/docker/$service/docker-compose.yml" ] && [ -n "$(grep '^[^#]*services' "/docker/$service/docker-compose.yml")" ] ; then
|
||||
section "-------------------- $service"
|
||||
section "Logging to registry"
|
||||
# XXX Login to docker registry
|
||||
|
||||
section "Pulling images"
|
||||
run docker-compose pull
|
||||
|
||||
section "Starting service"
|
||||
run docker-compose up -d --remove-orphans
|
||||
fi
|
||||
|
||||
# If there is a nginx conf file
|
||||
if [ -f "/docker/$service/nginx_server.conf" ] ; then
|
||||
section "Copy nginx conf"
|
||||
run cp "/docker/$service/nginx_server.conf" "$new_nginx_conf_path/$service"
|
||||
|
||||
if [ -f "/docker/$service/.env" ] ; then
|
||||
section "Template nginx conf with vars from '.env' file"
|
||||
run template.sh "/docker/$service/.env" < "/docker/$service/nginx_server.conf" > "$new_nginx_conf_path/$service"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Do we need dummy cert?
|
||||
if [ ! -e "$certs_path/$service/fullchain.pem" ] ; then
|
||||
section "Create cert dir"
|
||||
run mkdir -p "$certs_path/$service"
|
||||
|
||||
section "Link dummy to cert"
|
||||
run ln -s "$dummy_cert_path/fullchain.pem" "$certs_path/$service"
|
||||
run ln -s "$dummy_cert_path/privkey.pem" "$certs_path/$service"
|
||||
fi
|
||||
|
||||
section "Testing nginx conf"
|
||||
run nginx -t -c /etc/nginx/new_nginx.conf
|
||||
|
||||
done
|
||||
|
||||
###############################################################################
|
||||
# Nginx restart
|
||||
###############################################################################
|
||||
|
||||
driglibash_section_prefix="[Restart nginx] "
|
||||
|
||||
section "Test if nginx conf is ok"
|
||||
run nginx -t -c "$proxy_dir/new_nginx.conf"
|
||||
|
||||
section "Update nginx conf"
|
||||
run rm -rf "$nginx_conf_path"
|
||||
run mv "$new_nginx_conf_path" "$nginx_conf_path"
|
||||
run cp "/docker/_proxy/nginx.conf" "$proxy_dir/nginx.conf"
|
||||
|
||||
section "Test nginx conf to be sure"
|
||||
run nginx -t
|
||||
|
||||
if [ -z "$(cat /var/run/nginx.pid)" ] ; then
|
||||
section "Start nginx"
|
||||
run nginx
|
||||
else
|
||||
section "Reload nginx"
|
||||
run nginx -s reload
|
||||
fi
|
||||
|
||||
clean
|
||||
90
provisioning/roles/jean-cloud-common/files/bin/driglibash-args
Executable file
90
provisioning/roles/jean-cloud-common/files/bin/driglibash-args
Executable file
@ -0,0 +1,90 @@
|
||||
#!/bin/bash
|
||||
|
||||
###############################################################################
|
||||
# https://github.com/adrianamaglio/driglibash-arg
|
||||
###############################################################################
|
||||
|
||||
|
||||
# Usage :
|
||||
#
|
||||
# version="alpha nightly 0.0.1 pre-release unstable"
|
||||
# summary="$0 [options] <device>"
|
||||
#
|
||||
# usage[t]="Start qemu after the installation"
|
||||
# varia[t]=tst
|
||||
# tst=false
|
||||
#
|
||||
# usage[i]="Install the provided package. Not implemented"
|
||||
# varia[i]=install
|
||||
# declare -a install
|
||||
#
|
||||
# usage[k]="Keep the temporar mountpoints"
|
||||
# varia[k]=keep
|
||||
# keep=false
|
||||
#
|
||||
# usage[e]="bash command file to execute in the chroot. - to read from stdin"
|
||||
# varia[e]=execute
|
||||
# declare -a execute
|
||||
|
||||
. driglibash-base
|
||||
|
||||
#TODO keep order usage options
|
||||
# Print usage and exit in error
|
||||
usage() {
|
||||
yell "Version: $version"
|
||||
yell "Usage: $summary"
|
||||
yell "Parameters:"
|
||||
yell " -h print this help, version and exit."
|
||||
for key in "${!usage[@]}" ; do
|
||||
if [ "$(driglibash_arg_type "$key")" == "single_value" ] ; then
|
||||
name="${varia[$key]}"
|
||||
default=" (default : ${!name})"
|
||||
else
|
||||
default=
|
||||
fi
|
||||
yell " -$key ${usage[$key]}$default"
|
||||
done
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Guess the variable type
|
||||
# Boolean, list or string
|
||||
driglibash_arg_type() {
|
||||
if [ $# -ne 1 ] ; then
|
||||
die "Bad driglibash_arg_type usage";
|
||||
fi
|
||||
|
||||
name="${varia[$1]}"
|
||||
if [ "$name" == "" ] ; then die "Variable name is empty for key $1" ; fi
|
||||
if [ "${!name}" == "false" ] ; then
|
||||
echo "boolean"
|
||||
elif [ -n "$( declare -p "$name" 2>/dev/null | grep 'declare \-a')" ] ; then
|
||||
echo "array"
|
||||
else
|
||||
echo "single_value"
|
||||
fi
|
||||
}
|
||||
|
||||
# Generate getopts string #
|
||||
getopts_string=":h"
|
||||
for key in ${!usage[@]} ; do
|
||||
needs_parameter=
|
||||
if [ "$(driglibash_arg_type "$key")" != "boolean" ] ; then needs_parameter=":" ; fi
|
||||
getopts_string="$getopts_string$key$needs_parameter"
|
||||
done
|
||||
|
||||
# Loop throught options #
|
||||
while getopts "$getopts_string" opt; do
|
||||
case $opt in
|
||||
h) usage;;
|
||||
:) die "Option -$OPTARG requires an argument.";;
|
||||
\?) die "Invalid option: -$OPTARG";;
|
||||
*)
|
||||
name="${varia[$opt]}"
|
||||
if [ "${!name}" == "false" ] ; then eval $name=true
|
||||
elif [ -n "$( declare -p "$name" 2>/dev/null | grep 'declare \-a')" ] ; then safe="${!name} $OPTARG" ; eval $name=\$safe
|
||||
else eval $name=\$OPTARG
|
||||
fi;;
|
||||
esac
|
||||
done ; shift $((OPTIND-1))
|
||||
|
||||
179
provisioning/roles/jean-cloud-common/files/bin/driglibash-base
Executable file
179
provisioning/roles/jean-cloud-common/files/bin/driglibash-base
Executable file
@ -0,0 +1,179 @@
|
||||
###############################################################################
|
||||
# Driglibash pack 1
|
||||
# Usual helper functions for bash scripts
|
||||
# https://github.com/adrianamaglio/driglibash
|
||||
###############################################################################
|
||||
|
||||
# Set to true to make a pause at each step
|
||||
driglibash_step_by_step=false
|
||||
|
||||
# Set to watever you want to have a prefix
|
||||
driglibash_section_prefix=""
|
||||
|
||||
|
||||
trap 'die "Received sigint"' INT
|
||||
|
||||
# Output on standard error output
|
||||
yell() {
|
||||
echo >&2 -e "$@"
|
||||
}
|
||||
|
||||
# Output first parameter, second parameter times
|
||||
repeat() {
|
||||
printf "$1"'%.s' $(eval "echo {1.."$(($2))"}")
|
||||
}
|
||||
|
||||
# Output a "section title" to visually separate different script part
|
||||
# TODO local variables
|
||||
# TODO fixed place left aligned
|
||||
section(){
|
||||
text="$driglibash_section_prefix$1"
|
||||
if [ -n "$text" ] ; then
|
||||
len="${#text}"
|
||||
max_len="$(($(tput cols)-2))"
|
||||
if [ "$len" -ge "$max_len" ] ; then
|
||||
right=5
|
||||
left=5
|
||||
else
|
||||
left="$((($max_len - $len)/2))"
|
||||
right="$left"
|
||||
fi
|
||||
else
|
||||
left=80
|
||||
right=0
|
||||
fi
|
||||
|
||||
# If the character number was rounded down
|
||||
if [ "$(($left + $right + $len +1 ))" -eq "$max_len" ] ; then
|
||||
left="$(($left+ 1))"
|
||||
fi
|
||||
|
||||
repeat '=' "$left"
|
||||
if [ "$right" -ge 1 ] ; then
|
||||
echo -n " $text "
|
||||
repeat '=' "$right"
|
||||
echo
|
||||
fi
|
||||
|
||||
if "$driglibash_step_by_step" ; then
|
||||
echo "Press enter to proceed"
|
||||
read
|
||||
fi
|
||||
}
|
||||
alias step=section
|
||||
|
||||
# Print an error, clean and exit
|
||||
die() {
|
||||
yell "$@"
|
||||
clean
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Exit on error if not root
|
||||
root_or_die() {
|
||||
if [ "$UID" -ne 0 ] ; then
|
||||
die "You need to be root"
|
||||
fi
|
||||
}
|
||||
|
||||
# Execute a command and die if it returns with error #
|
||||
run() {
|
||||
while true ; do
|
||||
"$@"
|
||||
code=$?
|
||||
if [ "$code" -ne 0 ] ; then
|
||||
yell "command [$*] failed with exit code '$code'"
|
||||
if [ -n "$driglibash_run_retry" ] ; then
|
||||
echo "Retry ? Retry (y), skip the command (s) or exit script(n) [Y/s/n] ?"
|
||||
read answer
|
||||
if [ "$answer" = "y" ] || [ "$answer" = "Y" ] || [ -z "$answer" ] ; then
|
||||
continue
|
||||
elif [ "$answer" = "s" ] || [ "$answer" = "S" ] ; then
|
||||
return "$code"
|
||||
fi
|
||||
fi
|
||||
die "Aborting"
|
||||
else
|
||||
break
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
# Execute a commad in background and return its pid
|
||||
start(){
|
||||
"$@" &
|
||||
pid=$!
|
||||
clean pre "kill $pid"
|
||||
return $pid
|
||||
}
|
||||
|
||||
# Clean exit #
|
||||
# Record command lines passed as argument and execute them all when called without args #
|
||||
# One argument = One command #
|
||||
# TODO append or prepend according to arg
|
||||
declare -a driglibash_clean_actions
|
||||
clean() {
|
||||
if [ "$#" -eq 0 ] ; then
|
||||
echo "Cleaning"
|
||||
for action in "${driglibash_clean_actions[@]}" ; do
|
||||
echo "driglibash_clean> $action"
|
||||
$action
|
||||
done
|
||||
elif [ "$#" -eq 1 ] ; then
|
||||
driglibash_clean_actions+=("$1")
|
||||
elif [ "$#" -eq 2 ] ; then
|
||||
case "$1" in
|
||||
"pre")
|
||||
declare -a tmp
|
||||
tmp=("${driglibash_clean_actions[@]}")
|
||||
driglibash_clean_actions=("$2")
|
||||
driglibash_clean_actions+=("${tmp[@]}")
|
||||
;;
|
||||
"post")
|
||||
driglibash_clean_actions+=("$2")
|
||||
;;
|
||||
"del")
|
||||
for i in "${!driglibash_clean_actions[@]}" ; do
|
||||
if [ "$2" = "${driglibash_clean_actions[$i]}" ] ; then
|
||||
unset driglibash_clean_actions[$i]
|
||||
break
|
||||
fi
|
||||
done
|
||||
;;
|
||||
*)
|
||||
die "driglibash_clean: action '$1' not supported"
|
||||
esac
|
||||
else
|
||||
die "driglibash_clean : Bad clean usage, receveid more than two args"
|
||||
fi
|
||||
}
|
||||
|
||||
# tells where your executable is (absolute path). Follow simlinks if any argument provided
|
||||
where() {
|
||||
if [ -z "$1" ] ; then
|
||||
echo "$( cd -P "$( dirname "$1" )" && pwd )"
|
||||
else
|
||||
SOURCE="$0"
|
||||
while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink
|
||||
DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
|
||||
SOURCE="$(readlink "$SOURCE")"
|
||||
[[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located
|
||||
done
|
||||
DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
|
||||
|
||||
echo $DIR
|
||||
fi
|
||||
}
|
||||
|
||||
# Add the line $1 in file $2 if not present
|
||||
line_in_file() {
|
||||
if [ "$#" -ne 2 ] ; then die "Bad usage of 'line_in_file'. Got '$#' parameters : '$@'" ; fi
|
||||
if [ -z "$1" ] ; then die "Line arg is emtpy in 'line_in_file'" ; fi
|
||||
line="$1"
|
||||
if [ -z "$2" ] ; then die "File arg is emtpy in 'line_in_file'" ; fi
|
||||
file="$2"
|
||||
if [ ! -f "$file" ] ; then run touch "$file" ; fi
|
||||
|
||||
grep -q -x -F "$line" "$file" || echo "$line" >> "$file"
|
||||
}
|
||||
105
provisioning/roles/jean-cloud-common/files/bin/letsencrypt.sh
Executable file
105
provisioning/roles/jean-cloud-common/files/bin/letsencrypt.sh
Executable file
@ -0,0 +1,105 @@
|
||||
#!/bin/bash
|
||||
# This script will run on new cert and on cron renew
|
||||
# there is one cert by service
|
||||
|
||||
# TODO make it an ansible script
|
||||
# No
|
||||
|
||||
# Les arguments du pauvre
|
||||
if [ "$#" -eq 1 ] && [ "$1" = '-v' ] ; then
|
||||
verbose=true
|
||||
else
|
||||
verbose=false
|
||||
fi
|
||||
|
||||
# Variable
|
||||
acmeroot=/var/www/letsencrypt
|
||||
|
||||
# Création du répertoire
|
||||
mkdir -p "$acmeroot"
|
||||
|
||||
# With trailing slash or it will be a prefix selector
|
||||
#nginx_sites_dir="/etc/nginx/sites-enabled/"
|
||||
nginx_sites_dir="/etc/nginx/sites-enabled/"
|
||||
|
||||
for file in "$nginx_sites_dir"* ; do
|
||||
if $verbose ; then
|
||||
echo '-------------------------'
|
||||
echo "$file"
|
||||
fi
|
||||
|
||||
service_name="$(basename "$file")"
|
||||
|
||||
# Getting just the domain names
|
||||
domains="$(grep '^[[:blank:]]*[^#][[:blank:]]*server_name' "$file" | sed 's/ _ / /g' | sed 's/server_name//g' | sed 's/default_server//g' | sed -e 's/^[[:space:]]*//' | cut -d ';' -f 1)"
|
||||
if [ -n "$domains" ] ; then
|
||||
# If using dummy cert, disabling it
|
||||
if [ "$(readlink "/etc/letsencrypt/live/$service_name/fullchain.pem")" = "/etc/letsencrypt/live/dummy/fullchain.pem" ] ; then
|
||||
rm -r "/etc/letsencrypt/live/$service_name"
|
||||
fi
|
||||
|
||||
# removing duplicates
|
||||
domains="$(echo $domains | awk '{for (i=1;i<=NF;i++) if (!a[$i]++) printf("%s%s",$i,FS)}{printf("\n")}')"
|
||||
echo "$domains"
|
||||
|
||||
# adding -d before every domain
|
||||
domains="-d $(echo $domains | sed 's/ / -d /g')"
|
||||
|
||||
# Run certbot
|
||||
command="certbot certonly -n --expand --agree-tos --webroot -w "$acmeroot" --email contact@jean-cloud.org --cert-name "$(basename $file)" $domains"
|
||||
if $verbose ; then
|
||||
echo $command
|
||||
fi
|
||||
out="$($command 2>&1)"
|
||||
result="$?"
|
||||
|
||||
if [ "$result" -eq 0 ] && [[ "$out" = *"Certificate not yet due for renewal; no action taken."* ]]; then
|
||||
echo "Cert still valid"
|
||||
elif [ "$result" -eq 0 ] ; then
|
||||
echo "Cert renewed or obtained"
|
||||
#new_cert="$(echo "$out" | grep -oE '/etc/letsencrypt/live/.*/fullchain.pem')"
|
||||
#echo "'$new_cert'"
|
||||
#new_cert_dir="$(dirname "$out")"
|
||||
#echo "'$new_cert_dir'"
|
||||
|
||||
#if [ -d "$new_cert_dir" ] ; then
|
||||
# echo "New cert dir : '$new_cert_dir'"
|
||||
# echo "cp '$new_cert_dir/*' '/data/proxy/certs/'"
|
||||
#else
|
||||
# echo "Error parsiong dir name"
|
||||
#fi
|
||||
|
||||
elif [ "$result" -eq 1 ] ; then
|
||||
echo "Cert failed"
|
||||
echo " ------------------------------------------"
|
||||
echo "$out"
|
||||
echo " ------------------------------------------"
|
||||
else
|
||||
echo "Unknown error : $result.\n$out"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
ls /etc/letsencrypt/live/*000* &> /dev/null
|
||||
if [ "$?" -eq 0 ] ; then
|
||||
echo " ---------------------------------------------------------------------------------------------"
|
||||
echo "Bad certs detected in letsencrypt dir. Nginx conf wont work…"
|
||||
echo "rm -r /etc/letsencrypt/live/*000* /etc/letsencrypt/archive/*000* /etc/letsencrypt/renewal/*000*"
|
||||
echo " ---------------------------------------------------------------------------------------------"
|
||||
fi
|
||||
|
||||
|
||||
nginx -t
|
||||
code="$?"
|
||||
if [ "$code" -ne 0 ] ; then
|
||||
echo "Nginx test error, can’t reloat it"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
nginx -s reload
|
||||
code="$?"
|
||||
if [ "$code" -ne 0 ] ; then
|
||||
echo "Nginx reload error, GENERAL ALEEEEEEEEERT!!!!!"
|
||||
exit 1
|
||||
fi
|
||||
echo "Done. No error detected."
|
||||
@ -0,0 +1,2 @@
|
||||
#!/bin/sh
|
||||
docker inspect -f $'{{.Name}}\t{{.GraphDriver.Data.MergedDir}}' $(docker ps -aq)
|
||||
61
provisioning/roles/jean-cloud-common/files/bin/resolv.sh
Executable file
61
provisioning/roles/jean-cloud-common/files/bin/resolv.sh
Executable file
@ -0,0 +1,61 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
########################### Helpers ###########################################
|
||||
|
||||
function yell {
|
||||
echo "$@" >&2
|
||||
}
|
||||
|
||||
function die {
|
||||
yell "$@"
|
||||
exit 1
|
||||
}
|
||||
|
||||
function say {
|
||||
if "$verbose" ; then
|
||||
yell "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
########################### Options ###########################################
|
||||
|
||||
verbose=false
|
||||
if [ "$1" = '-v' ] ; then
|
||||
verbose=true
|
||||
shift
|
||||
fi
|
||||
|
||||
########################### arguments ##########################################
|
||||
|
||||
if [ "$#" -ne 1 ] ; then
|
||||
die "Usage: $0 [options] <domain_name>
|
||||
options : -v verbose"
|
||||
fi
|
||||
|
||||
name="$1"
|
||||
|
||||
########################### script ############################################
|
||||
|
||||
while true ; do
|
||||
if "$verbose" ; then
|
||||
say "Querying $name"
|
||||
fi
|
||||
while read line ; do
|
||||
if [[ "$line" = *"is an alias for "* ]] ; then
|
||||
name="$(echo "$line" | cut -d ' ' -f 6)"
|
||||
break
|
||||
elif [[ "$line" = *" has address "* ]] ; then
|
||||
echo "$line" | cut -d ' ' -f 4
|
||||
exit 0
|
||||
elif [[ "$line" = *" not found: "* ]] ; then
|
||||
exit 0
|
||||
elif [[ "$line" = *" has no A record" ]] ; then
|
||||
exit 0
|
||||
else
|
||||
say "unmatched: $line"
|
||||
fi
|
||||
done <<< "$(host -W 2 -t A "$name" localhost)"
|
||||
done
|
||||
|
||||
8
provisioning/roles/jean-cloud-common/files/bin/template.sh
Executable file
8
provisioning/roles/jean-cloud-common/files/bin/template.sh
Executable file
@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
if [ "$#" -ne 1 ] ; then
|
||||
echo "Usage: $0 <env_file>" >&2
|
||||
echo "This script read env_file variables and replace theire occurences in stdin" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
bash -c 'set -a && . '"$1"' && envsubst "$(cat '"$1"' | grep -o ^.*= | sed "s/=//" | sed "s/^/$/")"'
|
||||
@ -0,0 +1,22 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.dahus.net. (
|
||||
2023041900 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ IN MX 10 mail.amaglio.fr.
|
||||
|
||||
mail IN A 91.216.107.37
|
||||
imap IN CNAME mail.amaglio.fr.
|
||||
pop IN CNAME mail.amaglio.fr.
|
||||
smtp IN CNAME mail.amaglio.fr.
|
||||
|
||||
@ -0,0 +1,30 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2020031104 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ 10800 IN MX 10 spool.mail.gandi.net.
|
||||
@ 10800 IN MX 50 fb.mail.gandi.net.
|
||||
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"
|
||||
|
||||
collectif-arthadie.fr. IN CAA 0 issue "letsencrypt.org"
|
||||
collectif-arthadie.fr. IN CAA 0 issuewild ";"
|
||||
|
||||
wordpress IN CNAME vandamme.jean-cloud.net.
|
||||
www.wordpress IN CNAME vandamme.jean-cloud.net.
|
||||
www IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
www.wordpress.collectif-arthadie.fr IN CAA 0 issue "letsencrypt.org"
|
||||
www.wordpress.collectif-arthadie.fr IN CAA 0 issuewild ";"
|
||||
@ -0,0 +1,16 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 172.104.154.21
|
||||
@ IN AAAA 2a01:7e01::f03c:92ff:fecf:e815
|
||||
@ -0,0 +1,30 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023020400 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
@ IN NS ns1.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.195.40.128
|
||||
@ IN AAAA 2001:41d0:701:1100::31f
|
||||
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
tetede IN A 51.255.33.248
|
||||
tetede IN AAAA 2001:41d0:701:1100::31f
|
||||
|
||||
|
||||
19
provisioning/roles/jean-cloud-common/files/bind/db.hid
Normal file
19
provisioning/roles/jean-cloud-common/files/bind/db.hid
Normal file
@ -0,0 +1,19 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023040300 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
radiodemo IN CNAME montbonnot.jean-cloud.net
|
||||
|
||||
15
provisioning/roles/jean-cloud-common/files/bind/db.inurbe.fr
Normal file
15
provisioning/roles/jean-cloud-common/files/bind/db.inurbe.fr
Normal file
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
@ -0,0 +1,148 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
@ IN NS ns1.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ 10800 IN MX 10 spool.mail.gandi.net.
|
||||
@ 10800 IN MX 50 fb.mail.gandi.net.
|
||||
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
;mail IN CNAME vandamme
|
||||
webmail IN CNAME vandamme
|
||||
vimbadmin IN CNAME vandamme
|
||||
|
||||
www IN CNAME vandamme
|
||||
|
||||
; Naming nodes
|
||||
vandamme IN A 51.255.33.248
|
||||
|
||||
local-adrian IN A 193.33.56.94
|
||||
|
||||
francois IN A 54.38.189.153
|
||||
|
||||
nougaro IN A 172.104.154.21
|
||||
nougaro IN AAAA 2a01:7e01::f03c:92ff:fecf:e815
|
||||
|
||||
tetede IN AAAA 2001:41d0:701:1100::31f
|
||||
tetede IN A 51.195.40.128
|
||||
|
||||
carcasse IN A 109.18.84.200
|
||||
carcasse IN AAAA 2a02:8434:1633:df01:adf9:74c3:b444:262f
|
||||
|
||||
gigi IN A 51.77.156.235
|
||||
gigi IN AAAA 2001:41d0:305:2100::10e1
|
||||
|
||||
max IN A 82.65.204.254
|
||||
max IN AAAA 2a01:e0a:c9d:81d0:a2b3:ccff:fe85:af97
|
||||
|
||||
montbonnot IN A 188.114.97.2
|
||||
montbonnot IN A 188.114.96.2
|
||||
montbonnot IN AAAA 2a06:98c1:3120::2
|
||||
montbonnot IN AAAA 2a06:98c1:3121::2
|
||||
|
||||
|
||||
; Carcasse
|
||||
dumbcluster IN A 109.18.84.200
|
||||
dumbcluster IN AAAA 2a02:8434:1633:df01:226:2dff:fe11:56af
|
||||
; Tetede
|
||||
dumbcluster IN A 51.195.40.128
|
||||
dumbcluster IN AAAA 2001:41d0:701:1100::31f
|
||||
|
||||
; services
|
||||
team IN CNAME tetede
|
||||
|
||||
nuage IN CNAME vandamme
|
||||
www.nuage IN CNAME vandamme
|
||||
calc.nuage IN CNAME vandamme
|
||||
pad.nuage IN CNAME vandamme
|
||||
|
||||
feteducourt IN CNAME vandamme
|
||||
www.feteducourt IN CNAME vandamme
|
||||
feteducourt2020 IN CNAME vandamme
|
||||
www.feteducourt2020 IN CNAME vandamme
|
||||
|
||||
git IN CNAME vandamme
|
||||
www.git IN CNAME vandamme
|
||||
|
||||
wiki-cgr IN CNAME vandamme
|
||||
www.wiki-cgr IN CNAME vandamme
|
||||
parsoid-wiki-cgr IN CNAME vandamme
|
||||
www.parsoid-wiki-cgr IN CNAME vandamme
|
||||
|
||||
cousinades IN CNAME vandamme
|
||||
www.cousinades IN CNAME vandamme
|
||||
|
||||
cousinadesi2 IN CNAME vandamme
|
||||
www.cousinades2 IN CNAME vandamme
|
||||
|
||||
velov IN CNAME vandamme
|
||||
www.velov IN CNAME vandamme
|
||||
|
||||
registry IN CNAME vandamme
|
||||
www.registry IN CNAME vandamme
|
||||
|
||||
inurbe IN CNAME vandamme
|
||||
www.inurbe IN CNAME vandamme
|
||||
|
||||
gmx-webmail IN CNAME vandamme
|
||||
www.gmx-webmail IN CNAME vandamme
|
||||
|
||||
rpnow IN CNAME vandamme
|
||||
www.rpnow IN CNAME vandamme
|
||||
test.rpnow IN CNAME vandamme
|
||||
www.test.rpnow IN CNAME vandamme
|
||||
|
||||
lalis IN CNAME vandamme
|
||||
www.lalis IN CNAME vandamme
|
||||
|
||||
metamorphose IN CNAME vandamme
|
||||
www.metamorphose IN CNAME vandamme
|
||||
|
||||
static IN CNAME vandamme
|
||||
www.static IN CNAME vandamme
|
||||
|
||||
;educloud IN CNAME tetede
|
||||
;www.educloud IN CNAME tetede
|
||||
;educloud2 IN CNAME tetede
|
||||
;www.educloud2 IN CNAME tetede
|
||||
|
||||
copaines IN CNAME tetede
|
||||
www.copaines IN CNAME tetede
|
||||
wordpress.copaines IN CNAME tetede
|
||||
www.wordpress.copaines IN CNAME tetede
|
||||
|
||||
feministesucl34 IN CNAME tetede
|
||||
www.feministesucl34 IN CNAME tetede
|
||||
wordpress.feministesucl34 IN CNAME tetede
|
||||
www.wordpress.feministesucl34 IN CNAME tetede
|
||||
|
||||
tracker IN CNAME tetede
|
||||
|
||||
raplacgr IN CNAME tetede
|
||||
|
||||
walou IN CNAME dumbcluster
|
||||
|
||||
nc-backup IN CNAME tetede
|
||||
|
||||
gypsy IN CNAME tetede
|
||||
|
||||
shlago.wireguard.jean-cloud.net IN CNAME teted
|
||||
@ -0,0 +1,20 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2021060600 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
604800 ) ; Negative Cache TTL
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ 10800 IN MX 10 spool.mail.gandi.net.
|
||||
@ 10800 IN MX 50 fb.mail.gandi.net.
|
||||
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"
|
||||
|
||||
ns1 IN A 51.255.33.248
|
||||
|
||||
@ -0,0 +1,27 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023020700 ; Serial
|
||||
7200 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL
|
||||
|
||||
; NS
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.jean-cloud.net.
|
||||
@ IN NS ns1.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.178.80.171
|
||||
|
||||
|
||||
; Resolving nameserver
|
||||
ns1 IN A 51.255.33.248
|
||||
ns2 IN A 172.104.154.21
|
||||
|
||||
benevoles IN A 51.178.80.171
|
||||
benevoles31 IN A 51.178.80.171
|
||||
|
||||
15
provisioning/roles/jean-cloud-common/files/bind/db.lalis.fr
Normal file
15
provisioning/roles/jean-cloud-common/files/bind/db.lalis.fr
Normal file
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
15
provisioning/roles/jean-cloud-common/files/bind/db.leida.fr
Normal file
15
provisioning/roles/jean-cloud-common/files/bind/db.leida.fr
Normal file
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
@ -0,0 +1,15 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042100 ; Serial
|
||||
604800 ; Refresh
|
||||
86400 ; Retry
|
||||
2419200 ; Expire
|
||||
7200 ) ; Negative Cache TTL (min before refresh)
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns2.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns5.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
@ -0,0 +1,58 @@
|
||||
$TTL 604800
|
||||
@ IN SOA ns1.jean-cloud.net. contact.jean-cloud.org. (
|
||||
2023042200 ; Serial
|
||||
604800 ; Refresh
|
||||
7200 ; Retry
|
||||
2419200 ; Expire
|
||||
604800 ) ; Negative Cache TTL
|
||||
|
||||
@ IN NS ns1.jean-cloud.net.
|
||||
@ IN NS ns5.he.net.
|
||||
@ IN NS ns4.he.net.
|
||||
@ IN NS ns3.he.net.
|
||||
@ IN NS ns2.he.net.
|
||||
|
||||
@ IN A 51.255.33.248
|
||||
|
||||
@ IN MX 1 mx1.mail.ovh.net.
|
||||
@ IN MX 5 mx2.mail.ovh.net.
|
||||
@ IN MX 10 mx3.mail.ovh.net.
|
||||
|
||||
www IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
www.registry IN CNAME nougaro.jean-cloud.net.
|
||||
registry IN CNAME nougaro.jean-cloud.net.
|
||||
services IN CNAME nougaro.jean-cloud.net.
|
||||
|
||||
radionimaitre IN CNAME tetede.jean-cloud.net.
|
||||
www.radionimaitre IN CNAME tetede.jean-cloud.net.
|
||||
paj IN CNAME nougaro.jean-cloud.net.
|
||||
www.paj IN CNAME nougaro.jean-cloud.net.
|
||||
radiodemo IN CNAME tetede.jean-cloud.net.
|
||||
radiodemo-back IN CNAME montbonnot.jean-cloud.net.
|
||||
|
||||
|
||||
_autodiscover._tcp IN SRV 0 0 443 mailconfig.ovh.net.
|
||||
_imaps._tcp IN SRV 0 0 993 ssl0.ovh.net.
|
||||
_submission._tcp IN SRV 0 0 465 ssl0.ovh.net.
|
||||
;autoconfig IN SRV mailconfig.ovh.net.
|
||||
imap IN CNAME ssl0.ovh.net.
|
||||
smtp IN CNAME ssl0.ovh.net.
|
||||
mail IN CNAME ssl0.ovh.net.
|
||||
pop3 IN CNAME ssl0.ovh.net.
|
||||
|
||||
stream.paj.ports IN TXT 9002
|
||||
control.paj.ports IN TXT 9492
|
||||
|
||||
pa1.studios IN CNAME carcasse.jean-cloud.net.
|
||||
montpellier1.studios IN CNAME tetede.jean-cloud.net.
|
||||
|
||||
npm IN CNAME vandamme.jean-cloud.net.
|
||||
www.npm IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
static IN CNAME vandamme.jean-cloud.net.
|
||||
www.static IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
discordbot IN CNAME vandamme.jean-cloud.net.
|
||||
www.discordbot IN CNAME vandamme.jean-cloud.net.
|
||||
|
||||
@ -0,0 +1,78 @@
|
||||
//
|
||||
// Do any local configuration here
|
||||
//
|
||||
|
||||
// Consider adding the 1918 zones here, if they are not used in your
|
||||
// organization
|
||||
//include "/etc/bind/zones.rfc1918";
|
||||
|
||||
|
||||
|
||||
zone "oma-radio.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.oma-radio.fr";
|
||||
};
|
||||
zone "jean-cloud.net"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.jean-cloud.net";
|
||||
};
|
||||
zone "jean-cloud.org"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.jean-cloud.org";
|
||||
};
|
||||
zone "karnaval.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.karnaval.fr";
|
||||
};
|
||||
zone "amaglio.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.amaglio.fr";
|
||||
};
|
||||
zone "collectif-arthadie.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.collectif-arthadie.fr";
|
||||
};
|
||||
zone "gypsylyonfestival.com"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.gypsylyonfestival.com";
|
||||
};
|
||||
zone "hid"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.hid";
|
||||
};
|
||||
zone "compagnienouvelle.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.compagnienouvelle.fr";
|
||||
};
|
||||
zone "inurbe.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.inurbe.fr";
|
||||
};
|
||||
zone "lalis.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.lalis.fr";
|
||||
};
|
||||
zone "leida.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.leida.fr";
|
||||
};
|
||||
zone "metamorphosemagazine.fr"{
|
||||
allow-update { none; }; # We are primary DNS
|
||||
type master;
|
||||
file "/etc/bind/db.metamorphosemagazine.fr";
|
||||
};
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
dnssec-validation auto;
|
||||
|
||||
auth-nxdomain no; # conform to RFC1035
|
||||
listen-on { any; };
|
||||
listen-on-v6 { any; };
|
||||
allow-update { none; };
|
||||
allow-recursion { none; };
|
||||
allow-recursion-on { none; };
|
||||
recursion no;
|
||||
notify yes;
|
||||
allow-transfer {
|
||||
none;
|
||||
#216.218.133.2; 2001:470:600::2; //he.net
|
||||
#172.104.154.21; 2a01:7e01::f03c:92ff:fecf:e815; // nougaro
|
||||
};
|
||||
};
|
||||
60
provisioning/roles/jean-cloud-common/tasks/main.yml
Normal file
60
provisioning/roles/jean-cloud-common/tasks/main.yml
Normal file
@ -0,0 +1,60 @@
|
||||
---
|
||||
# tasks file for jean-cloud-common
|
||||
|
||||
- name: Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{inventory_hostname}}"
|
||||
when: inventory_hostname is defined
|
||||
|
||||
- name: Set hostname IP
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/hosts
|
||||
line: "{{item}}"
|
||||
with_items:
|
||||
- "172.0.0.1 {{inventory_hostname}}"
|
||||
- "::1 {{inventory_hostname}}"
|
||||
|
||||
- name: Show last changed password for security
|
||||
copy:
|
||||
dest: /etc/profile.d/user_last_passwd.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
#!/bin/bash
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m' # No Color
|
||||
echo -e "Password last changed on $RED$(passwd -S $USER | cut -d ' ' -f 3)$NC"
|
||||
|
||||
|
||||
- name: Install some softwares
|
||||
apt:
|
||||
name: ['bind9', 'certbot', 'dnsutils', 'git', 'gnupg2', 'htop', 'netcat-openbsd', 'nginx', 'rsync', 'sshfs', 'vim', 'zip']
|
||||
state: latest
|
||||
|
||||
- name: create needed dirs
|
||||
ansible.builtin.file:
|
||||
path: "{{item}}"
|
||||
state: directory
|
||||
with_items:
|
||||
- /docker
|
||||
- /data
|
||||
- /etc/letsencrypt
|
||||
|
||||
- name: Install docker-compose bash autocompletion
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/docker/compose/1.29.2/contrib/completion/bash/docker-compose
|
||||
dest: /etc/bash_completion.d/docker-compose
|
||||
mode: '0705'
|
||||
owner: 'root'
|
||||
|
||||
- name: Add letsencrypt crontab
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/crontab
|
||||
line: '26 03 * * * root letsencrypt.sh'
|
||||
|
||||
#TODO add this to /etc/docker/daemon.json
|
||||
#{
|
||||
# "iptables": false
|
||||
#}
|
||||
|
||||
29
provisioning/roles/ordiportables/.travis.yml
Normal file
29
provisioning/roles/ordiportables/.travis.yml
Normal file
@ -0,0 +1,29 @@
|
||||
---
|
||||
language: python
|
||||
python: "2.7"
|
||||
|
||||
# Use the new container infrastructure
|
||||
sudo: false
|
||||
|
||||
# Install ansible
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- python-pip
|
||||
|
||||
install:
|
||||
# Install ansible
|
||||
- pip install ansible
|
||||
|
||||
# Check ansible version
|
||||
- ansible --version
|
||||
|
||||
# Create ansible.cfg with correct roles_path
|
||||
- printf '[defaults]\nroles_path=../' >ansible.cfg
|
||||
|
||||
script:
|
||||
# Basic role syntax check
|
||||
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
|
||||
|
||||
notifications:
|
||||
webhooks: https://galaxy.ansible.com/api/v1/notifications/
|
||||
7
provisioning/roles/ordiportables/tasks/main.yml
Normal file
7
provisioning/roles/ordiportables/tasks/main.yml
Normal file
@ -0,0 +1,7 @@
|
||||
---
|
||||
# tasks file for ordiportables
|
||||
|
||||
- name: Prevent suspend on lid close
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/systemd/logind.conf
|
||||
line: HandleLidSwitch=ignore
|
||||
11
provisioning/services.yml
Executable file
11
provisioning/services.yml
Executable file
@ -0,0 +1,11 @@
|
||||
# TODO ansible secrets
|
||||
# Oma-Radio host
|
||||
|
||||
- name: Deploy specific services
|
||||
hosts: servers
|
||||
become: yes
|
||||
gather_facts: no
|
||||
roles:
|
||||
- deploy_all
|
||||
|
||||
|
||||
64
provisioning/services_nougaro.yml
Executable file
64
provisioning/services_nougaro.yml
Executable file
@ -0,0 +1,64 @@
|
||||
# TODO ansible secrets
|
||||
# Oma-Radio host
|
||||
|
||||
- name: Deploy specific services
|
||||
hosts: nougaro.jean-cloud.net
|
||||
become: no
|
||||
roles:
|
||||
#- role: docker-network-setup
|
||||
|
||||
# The proxy docker stack must be the first to be deployed
|
||||
- role: prepare-nginx
|
||||
|
||||
- role: deploy
|
||||
service_name: proxy
|
||||
state: started
|
||||
monitored: false
|
||||
|
||||
- role: deploy
|
||||
service_name: nsslave.jean-cloud.net
|
||||
state: started
|
||||
monitored: false
|
||||
|
||||
- role: deploy
|
||||
service_name: registry.oma-radio.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: wordpress.inurbe.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: compagnienouvelle.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: icecast.oma-radio.fr
|
||||
state: started
|
||||
monitored: false
|
||||
remote_docker_login_user: oma
|
||||
remote_docker_login_pass: KkK8Aavmm4cN6nBM
|
||||
remote_docker_login_registry: http://registry.oma-radio.fr
|
||||
|
||||
- role: deploy
|
||||
service_name: soundbase.oma-radio.fr
|
||||
state: started
|
||||
monitored: false
|
||||
|
||||
- role: deploy
|
||||
service_name: paj.oma-radio.fr
|
||||
state: started
|
||||
monitored: false
|
||||
remote_docker_login_user: oma
|
||||
remote_docker_login_pass: KkK8Aavmm4cN6nBM
|
||||
remote_docker_login_registry: http://registry.oma-radio.fr
|
||||
|
||||
#- role: deploy
|
||||
# service_name: radionimaitre.oma-radio.fr
|
||||
# state: started
|
||||
# monitored: false
|
||||
# remote_docker_login_user: oma
|
||||
# remote_docker_login_pass: KkK8Aavmm4cN6nBM
|
||||
# remote_docker_login_registry: http://registry.oma-radio.fr
|
||||
|
||||
- role: restart-nginx
|
||||
132
provisioning/services_vandamme.yml
Executable file
132
provisioning/services_vandamme.yml
Executable file
@ -0,0 +1,132 @@
|
||||
# The host have:
|
||||
# - /data -> every data
|
||||
# - /docker -> deployed docker-compose files
|
||||
|
||||
- name: Deploy specific services
|
||||
hosts: vandamme.jean-cloud.net
|
||||
become: yes
|
||||
roles:
|
||||
#- role: docker-network-setup
|
||||
|
||||
# The proxy docker stack must be the first to be deployed
|
||||
- role: prepare-nginx
|
||||
|
||||
- role: deploy
|
||||
service_name: proxy
|
||||
state: started
|
||||
monitored: false
|
||||
|
||||
- role: deploy
|
||||
service_name: meta-morpho.se
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: mailer.jean-cloud.net
|
||||
state: started
|
||||
remote_docker_login_user: jean-cloud
|
||||
remote_docker_login_pass: KaJefxXiNr327EfG4suYD2PM4tYF5Jy8AhMYntfdjVhX
|
||||
monitored: false
|
||||
|
||||
- role: deploy
|
||||
service_name: static.jean-cloud.net
|
||||
state: started
|
||||
|
||||
|
||||
- role: deploy
|
||||
service_name: ssh
|
||||
state: started
|
||||
monitored: false
|
||||
|
||||
#- role: deploy
|
||||
# service_name: myrrdel.jean-cloud.net
|
||||
# state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: collectif-arthadie.fr
|
||||
state: started
|
||||
|
||||
#- role: deploy
|
||||
# service_name: karna.jean-cloud.net
|
||||
# state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: oma-radio.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: rpnow.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: ns.jean-cloud.org
|
||||
state: started
|
||||
monitored: false
|
||||
|
||||
- role: deploy
|
||||
service_name: gmx-webmail.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: registry.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: inurbe.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: feteducourt.jean-cloud.net
|
||||
state: started
|
||||
remote_docker_login_user: jean-cloud
|
||||
remote_docker_login_pass: KaJefxXiNr327EfG4suYD2PM4tYF5Jy8AhMYntfdjVhX
|
||||
|
||||
- role: deploy
|
||||
service_name: feteducourt2020.jean-cloud.net
|
||||
state: started
|
||||
remote_docker_login_user: jean-cloud
|
||||
remote_docker_login_pass: KaJefxXiNr327EfG4suYD2PM4tYF5Jy8AhMYntfdjVhX
|
||||
|
||||
- role: deploy
|
||||
service_name: leida.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: lalis.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: amaglio.fr
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: velov.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: cousinades.jean-cloud.net
|
||||
state: started
|
||||
monitored: false # web cant pass basic auth yet
|
||||
|
||||
- role: deploy
|
||||
service_name: cousinades2.jean-cloud.net
|
||||
state: started
|
||||
monitored: false # web cant pass basic auth yet
|
||||
|
||||
|
||||
- role: deploy
|
||||
service_name: nuage.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: git.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: wiki-cgr.jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: deploy
|
||||
service_name: jean-cloud.net
|
||||
state: started
|
||||
|
||||
- role: restart-nginx
|
||||
87
services/_proxy/nginx.conf
Executable file
87
services/_proxy/nginx.conf
Executable file
@ -0,0 +1,87 @@
|
||||
user www-data;
|
||||
worker_processes auto;
|
||||
pid /run/nginx.pid;
|
||||
include /etc/nginx/modules-enabled/*.conf;
|
||||
|
||||
events {
|
||||
worker_connections 768;
|
||||
# multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
##
|
||||
# Basic Settings
|
||||
##
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
# server_tokens off;
|
||||
|
||||
server_names_hash_bucket_size 128;
|
||||
# server_name_in_redirect off;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
##
|
||||
# SSL Settings
|
||||
##
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
access_log /var/log/nginx/access.log;
|
||||
error_log /var/log/nginx/error.log;
|
||||
log_format compression '$remote_addr - $remote_user [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent" "$gzip_ratio"';
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
|
||||
# gzip_vary on;
|
||||
# gzip_proxied any;
|
||||
# gzip_comp_level 6;
|
||||
# gzip_buffers 16 8k;
|
||||
# gzip_http_version 1.1;
|
||||
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
# Maintenance
|
||||
#error_page 503 https://jean-cloud.net/503;
|
||||
|
||||
# limit requests
|
||||
limit_req_status 429;
|
||||
limit_req_zone $binary_remote_addr zone=defaultlimit:10m rate=30r/s;
|
||||
limit_req zone=defaultlimit burst=100 nodelay;
|
||||
limit_conn_zone $request_uri zone=defaultconumber:10m;
|
||||
limit_conn defaultconumber 20;
|
||||
|
||||
##
|
||||
# Virtual Host Configs
|
||||
##
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
include /etc/nginx/sites-enabled/*;
|
||||
server{
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
location '/.well-known/acme-challenge' {
|
||||
root /var/www/letsencrypt;
|
||||
default_type "text/plain";
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
13
services/_proxy/readme
Executable file
13
services/_proxy/readme
Executable file
@ -0,0 +1,13 @@
|
||||
resolver
|
||||
Les adresse dns créées par docker à la volée lorsqu’un conteneur démarre ne sont pas forcemment toutes disponibles au lancement de nginx.
|
||||
Or nginx n’effectue par défaut qu’une résolution d’adresse : au démarrage du service.
|
||||
Pour avoir une résolution dynamique, il faut avoir une variable dans le nom de domaine et spécifier un résolveur:
|
||||
```
|
||||
set $empty '';
|
||||
resolver 127.0.0.11 valid=30m;
|
||||
fastcgi_pass files_jean-cloud_org$empty:9000;
|
||||
```
|
||||
CETTE SOLUTION EST COÙTEUSE LORS DES REQUÊTES
|
||||
Nous choisirons de conserver la configuration statique des noms et de tester qu’ils soient tous accessibles avant chaque redémarrage via la commande `nginx -t`
|
||||
|
||||
UPDATE 2022 : on utilise des IP, comme ça pas de surprises :p
|
||||
15
services/_ssh/docker-compose.yml
Normal file
15
services/_ssh/docker-compose.yml
Normal file
@ -0,0 +1,15 @@
|
||||
version: '3'
|
||||
services:
|
||||
sshd:
|
||||
image: atmoz/sftp
|
||||
volumes:
|
||||
- /data/ssh/ssh_host_ed25519_key:/etc/ssh/ssh_host_ed25519_key
|
||||
- /data/ssh/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key
|
||||
- /data/leida.fr:/home/leida/sftp
|
||||
- /data/lalis.fr:/home/lalis/sftp
|
||||
- /data/oma-radio.fr:/home/oma/sftp
|
||||
- /data/collectif-arthadie.fr/wordpress:/home/collectifarthadie/sftp
|
||||
- /data/ssh/users.conf:/etc/sftp/users.conf:ro
|
||||
ports:
|
||||
- '2222:22'
|
||||
|
||||
55
services/amaglio.fr/docker-compose.yml
Executable file
55
services/amaglio.fr/docker-compose.yml
Executable file
@ -0,0 +1,55 @@
|
||||
version: '3'
|
||||
services:
|
||||
roundcube:
|
||||
image: roundcube/roundcubemail:1.4.x-apache
|
||||
restart: "unless-stopped"
|
||||
depends_on:
|
||||
- db
|
||||
volumes:
|
||||
- /data/amaglio.fr/app/plugins/enigma/home:/var/www/html/plugins/enigma/home
|
||||
- /data/amaglio.fr/app/config/config.inc.php:/var/www/html/config/config.inc.php
|
||||
- /data/amaglio.fr/app/enigma_pgp_homedir:/data/enigma_pgp_homedir
|
||||
env_file: /data/amaglio.fr/env
|
||||
environment:
|
||||
ROUNDCUBEMAIL_DB_TYPE: pgsql
|
||||
ROUNDCUBEMAIL_DB_HOST: db
|
||||
ROUNDCUBEMAIL_DB_USER: postgres
|
||||
ROUNDCUBEMAIL_DB_NAME: postgres
|
||||
ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
|
||||
|
||||
# imap server
|
||||
ROUNDCUBEMAIL_DEFAULT_HOST: ssl://mail20.lwspanel.com
|
||||
ROUNDCUBEMAIL_DEFAULT_PORT: 993
|
||||
ROUNDCUBEMAIL_SMTP_SERVER: tls://mail20.lwspanel.com
|
||||
ROUNDCUBEMAIL_SMTP_PORT: 587
|
||||
ROUNDCUBEMAIL_PLUGINS: archive,zipdownload,enigma,attachment_reminder
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.5.100
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
db:
|
||||
# https://hub.docker.com/_/postgres?tab=description
|
||||
image: postgres:9.6-alpine
|
||||
restart: "unless-stopped"
|
||||
env_file: /data/amaglio.fr/env
|
||||
volumes:
|
||||
- /data/amaglio.fr/db:/var/lib/postgresql/data
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.5.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.5.0/24
|
||||
|
||||
40
services/amaglio.fr/nginx_server.conf
Executable file
40
services/amaglio.fr/nginx_server.conf
Executable file
@ -0,0 +1,40 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/amaglio.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/amaglio.fr/privkey.pem;
|
||||
|
||||
server_name amaglio.fr www.amaglio.fr;
|
||||
# root /data/amaglio.fr/app;
|
||||
#
|
||||
client_max_body_size 1024M;
|
||||
charset utf-8;
|
||||
#
|
||||
# index index.php;
|
||||
#
|
||||
# location ~ ^/roundcube/(bin|SQL|config|temp|logs)/ {
|
||||
# deny all;
|
||||
# }
|
||||
#
|
||||
# location ~ /roundcube/\.(js|css|png|jpg|jpeg|gif|ico)$ {
|
||||
# expires max;
|
||||
# log_not_found off;
|
||||
# }
|
||||
#
|
||||
location / {
|
||||
proxy_pass http://172.29.5.100;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
}
|
||||
#
|
||||
# location ~ \.php$ {
|
||||
# fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||
# include fastcgi_params;
|
||||
# fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
|
||||
# fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||
# fastcgi_pass amaglio.fr:9000;
|
||||
# fastcgi_index index.php;
|
||||
# }
|
||||
}
|
||||
|
||||
2
services/benevoles.karnaval.fr/.env
Normal file
2
services/benevoles.karnaval.fr/.env
Normal file
@ -0,0 +1,2 @@
|
||||
DATA_DIR=/data/benevoles.karnaval.fr
|
||||
JC_HOST=benevoles.karnaval.fr
|
||||
60
services/benevoles.karnaval.fr/docker-compose.yml
Executable file
60
services/benevoles.karnaval.fr/docker-compose.yml
Executable file
@ -0,0 +1,60 @@
|
||||
version: '3'
|
||||
services:
|
||||
app:
|
||||
image: jeancloud/site-benevole:dev-karna
|
||||
environment:
|
||||
UID: 33
|
||||
MOUNT: /
|
||||
volumes:
|
||||
- /tmp/uwsgi/$JC_HOST:/tmp/uwsgi
|
||||
- $DATA_DIR/assets:/usr/src/app/assets
|
||||
- $DATA_DIR/media:/usr/src/app/media
|
||||
- $DATA_DIR/local_settings.py:/usr/src/app/site_benevole/local_settings.py
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.17.100
|
||||
|
||||
db:
|
||||
image: postgres:9.6-alpine
|
||||
env_file: $DATA_DIR/postgres.env
|
||||
environment:
|
||||
POSTGRES_USER: benevoles
|
||||
POSTGRES_DB: benevoles
|
||||
volumes:
|
||||
- $DATA_DIR/db:/var/lib/postgresql/data
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.17.101
|
||||
app2:
|
||||
image: jeancloud/site-benevole:dev-karna-debian
|
||||
environment:
|
||||
UID: 33
|
||||
MOUNT: /
|
||||
volumes:
|
||||
- /tmp/uwsgi/app2/$JC_HOST:/tmp/uwsgi
|
||||
- $DATA_DIR/app2/assets:/usr/src/app/assets
|
||||
- $DATA_DIR/app2/media:/usr/src/app/media
|
||||
- $DATA_DIR/app2/local_settings.py:/usr/src/app/site_benevole/local_settings.py
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.17.110
|
||||
|
||||
db2:
|
||||
image: postgres:9.6-alpine
|
||||
env_file: $DATA_DIR/postgres.env
|
||||
environment:
|
||||
POSTGRES_USER: benevoles
|
||||
POSTGRES_DB: benevoles
|
||||
volumes:
|
||||
- $DATA_DIR/db2:/var/lib/postgresql/data
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.17.111
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.17.0/24
|
||||
110
services/benevoles.karnaval.fr/nginx_server.conf
Executable file
110
services/benevoles.karnaval.fr/nginx_server.conf
Executable file
@ -0,0 +1,110 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/$JC_HOST/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$JC_HOST/privkey.pem;
|
||||
server_name $JC_HOST benevoles31.karnaval.fr;
|
||||
|
||||
root /data/benevoles.karnaval.fr/assets;
|
||||
|
||||
gzip on;
|
||||
gzip_static on;
|
||||
gzip_types application/javascript image/* text/css application/font-woff application/font-woff2;
|
||||
gunzip on;
|
||||
|
||||
ssl_session_tickets off;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_buffer_size 4k;
|
||||
client_max_body_size 4M;
|
||||
|
||||
location / {
|
||||
include uwsgi_params;
|
||||
uwsgi_pass unix:/tmp/uwsgi/benevoles.karnaval.fr/uwsgi.sock;
|
||||
}
|
||||
|
||||
location = /favicon.ico {
|
||||
root /data/benevoles.karnaval.fr/assets/;
|
||||
}
|
||||
location = /favicon-admin.ico {
|
||||
root /data/benevoles.karnaval.fr/assets/;
|
||||
}
|
||||
|
||||
location /assets/ {
|
||||
alias /data/benevoles.karnaval.fr/assets/;
|
||||
access_log off;
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
sendfile_max_chunk 1m;
|
||||
keepalive_timeout 65;
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|woff|woff2)$ {
|
||||
access_log off;
|
||||
expires 5d;
|
||||
}
|
||||
}
|
||||
|
||||
location /media/ {
|
||||
alias /data/benevoles.karnaval.fr/media/;
|
||||
access_log off;
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
sendfile_max_chunk 1m;
|
||||
keepalive_timeout 65;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
server {
|
||||
listen 444 ssl http2;
|
||||
listen [::]:444 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/$JC_HOST/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$JC_HOST/privkey.pem;
|
||||
server_name $JC_HOST;
|
||||
|
||||
root /data/benevoles.karnaval.fr/app2/assets;
|
||||
|
||||
gzip on;
|
||||
gzip_static on;
|
||||
gzip_types application/javascript image/* text/css application/font-woff application/font-woff2;
|
||||
gunzip on;
|
||||
|
||||
ssl_session_tickets off;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_buffer_size 4k;
|
||||
client_max_body_size 4M;
|
||||
|
||||
location / {
|
||||
include uwsgi_params;
|
||||
uwsgi_pass unix:/tmp/uwsgi/app2/benevoles.karnaval.fr/app2/uwsgi.sock;
|
||||
}
|
||||
|
||||
location = /favicon.ico {
|
||||
root /data/benevoles.karnaval.fr/app2/assets/;
|
||||
}
|
||||
location = /favicon-admin.ico {
|
||||
root /data/benevoles.karnaval.fr/app2/assets/;
|
||||
}
|
||||
|
||||
location /assets/ {
|
||||
alias /data/benevoles.karnaval.fr/app2/assets/;
|
||||
access_log off;
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
sendfile_max_chunk 1m;
|
||||
keepalive_timeout 65;
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|woff|woff2)$ {
|
||||
access_log off;
|
||||
expires 5d;
|
||||
}
|
||||
}
|
||||
|
||||
location /media/ {
|
||||
alias /data/benevoles.karnaval.fr/app2/media/;
|
||||
access_log off;
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
sendfile_max_chunk 1m;
|
||||
keepalive_timeout 65;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
49
services/collectif-arthadie.fr/docker-compose.yml
Normal file
49
services/collectif-arthadie.fr/docker-compose.yml
Normal file
@ -0,0 +1,49 @@
|
||||
version: '3.1'
|
||||
|
||||
services:
|
||||
|
||||
wp:
|
||||
image: wordpress:5.3-apache
|
||||
restart: unless-stopped
|
||||
env_file: /data/collectif-arthadie.fr/env
|
||||
environment:
|
||||
WORDPRESS_DB_HOST: db
|
||||
WORDPRESS_DB_USER: wpdbuser
|
||||
WORDPRESS_DB_NAME: wpdb
|
||||
volumes:
|
||||
- /data/collectif-arthadie.fr/wordpress:/var/www/html
|
||||
- /data/collectif-arthadie.fr/static:/var/www/html/static
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.6.100
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
db:
|
||||
image: mariadb:10.4
|
||||
restart: unless-stopped
|
||||
env_file: /data/collectif-arthadie.fr/env
|
||||
environment:
|
||||
MYSQL_DATABASE: wpdb
|
||||
MYSQL_USER: wpdbuser
|
||||
MYSQL_RANDOM_ROOT_PASSWORD: 'yes'
|
||||
volumes:
|
||||
- /data/collectif-arthadie.fr/db:/var/lib/mysql
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.6.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.6.0/24
|
||||
|
||||
28
services/collectif-arthadie.fr/nginx_server.conf
Executable file
28
services/collectif-arthadie.fr/nginx_server.conf
Executable file
@ -0,0 +1,28 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/collectif-arthadie.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/collectif-arthadie.fr/privkey.pem;
|
||||
server_name wordpress.collectif-arthadie.fr www.wordpress.collectif-arthadie.fr;
|
||||
location / {
|
||||
client_max_body_size 2G;
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_pass http://172.29.6.100;
|
||||
proxy_redirect off;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/collectif-arthadie.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/collectif-arthadie.fr/privkey.pem;
|
||||
server_name collectif-arthadie.fr www.collectif-arthadie.fr;
|
||||
|
||||
location / {
|
||||
root /data/collectif-arthadie.fr/static;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
1
services/compagnienouvelle.fr/.env
Normal file
1
services/compagnienouvelle.fr/.env
Normal file
@ -0,0 +1 @@
|
||||
DATA_DIR=/data/compagnienouvelle.fr
|
||||
43
services/compagnienouvelle.fr/docker-compose.yml
Normal file
43
services/compagnienouvelle.fr/docker-compose.yml
Normal file
@ -0,0 +1,43 @@
|
||||
version: '3.1'
|
||||
|
||||
services:
|
||||
|
||||
wp:
|
||||
image: wordpress:5-apache
|
||||
restart: unless-stopped
|
||||
env_file: $DATA_DIR/wordpress.env
|
||||
environment:
|
||||
TZ: Europe/Paris
|
||||
volumes:
|
||||
- $DATA_DIR/wordpress:/var/www/html
|
||||
- $DATA_DIR/static:/var/www/html/static
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.7.100
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
db:
|
||||
image: mariadb:10.7
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
TZ: Europe/Paris
|
||||
volumes:
|
||||
- $DATA_DIR/db:/var/lib/mysql
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.7.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.7.0/24
|
||||
|
||||
30
services/compagnienouvelle.fr/nginx_server.conf
Executable file
30
services/compagnienouvelle.fr/nginx_server.conf
Executable file
@ -0,0 +1,30 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/compagnienouvelle.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/compagnienouvelle.fr/privkey.pem;
|
||||
server_name wordpress.compagnienouvelle.fr www.wordpress.compagnienouvelle.fr;
|
||||
location / {
|
||||
auth_basic "Mot de passe !";
|
||||
auth_basic_user_file /data/compagnienouvelle.fr/pass.txt;
|
||||
client_max_body_size 2G;
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_pass http://172.29.7.100;
|
||||
proxy_redirect off;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/compagnienouvelle.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/compagnienouvelle.fr/privkey.pem;
|
||||
server_name compagnienouvelle.fr www.compagnienouvelle.fr;
|
||||
|
||||
location / {
|
||||
root /data/compagnienouvelle.fr/static;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
58
services/compagnienouvelle.fr/tmp.log
Normal file
58
services/compagnienouvelle.fr/tmp.log
Normal file
@ -0,0 +1,58 @@
|
||||
[class-ss-plugin.php:232] Received request to start generating a static archive
|
||||
[class-ss-archive-creation-job.php:61] Starting a job; no job is presently running
|
||||
[class-ss-archive-creation-job.php:62] Here's our task list: setup, fetch_urls, transfer_files_locally, wrapup
|
||||
[class-ss-archive-creation-job.php:76] Pushing first task to queue: setup
|
||||
[class-ss-archive-creation-job.php:105] Current task: setup
|
||||
[class-ss-archive-creation-job.php:120] Performing task: setup
|
||||
[class-ss-task.php:38] Status message: [setup] Mise en place
|
||||
[class-ss-setup-task.php:23] Creating archive directory: /var/www/html/wp-content/plugins/simply-static/static-files/simply-static-1-1603638186/
|
||||
[class-ss-setup-task.php:57] Adding origin URL to queue: https://wordpress.mysite.com/
|
||||
[class-ss-setup-task.php:68] Adding additional URL to queue: https://wordpress.mysite.com/wp-includes/js/wp-emoji-release.min.js
|
||||
[class-ss-setup-task.php:99] Adding files from directory: /var/www/html/wp-content/uploads/
|
||||
[class-ss-archive-creation-job.php:142] We've found our next task: fetch_urls
|
||||
[class-ss-archive-creation-job.php:105] Current task: fetch_urls
|
||||
[class-ss-archive-creation-job.php:120] Performing task: fetch_urls
|
||||
[class-ss-fetch-urls-task.php:37] Total pages: 2; Pages remaining: 2
|
||||
[class-ss-fetch-urls-task.php:40] URL: https://wordpress.mysite.com/
|
||||
[class-ss-fetch-urls-task.php:50] URL is not being excluded
|
||||
[class-ss-url-fetcher.php:85] Fetching URL and saving it to: /tmp/5f9593ab13a6a-QXn1T1.tmp
|
||||
[class-ss-url-fetcher.php:89] Filesize: 26432 bytes
|
||||
[class-ss-url-fetcher.php:104] http_status_code: 200 | content_type: text/html; charset=UTF-8
|
||||
[class-ss-url-fetcher.php:180] New filename for static page: index.html
|
||||
[class-ss-url-fetcher.php:120] Renaming temp file from /tmp/5f9593ab13a6a-QXn1T1.tmp to /var/www/html/wp-content/plugins/simply-static/static-files/simply-static-1-1603638186/index.html
|
||||
[class-ss-fetch-urls-task.php:99] Extracting URLs and replacing URLs in the static file
|
||||
[class-ss-fetch-urls-task.php:106] Adding 0 URLs to the queue
|
||||
[class-ss-fetch-urls-task.php:117] We're saving this URL; keeping the static file
|
||||
[class-ss-fetch-urls-task.php:40] URL: https://wordpress.mysite.com/wp-includes/js/wp-emoji-release.min.js
|
||||
[class-ss-fetch-urls-task.php:50] URL is not being excluded
|
||||
[class-ss-url-fetcher.php:85] Fetching URL and saving it to: /tmp/5f9593ab2d225-A0zDVK.tmp
|
||||
[class-ss-url-fetcher.php:89] Filesize: 14246 bytes
|
||||
[class-ss-url-fetcher.php:104] http_status_code: 200 | content_type: application/javascript
|
||||
[class-ss-url-fetcher.php:180] New filename for static page: wp-includes/js/wp-emoji-release.min.js
|
||||
[class-ss-url-fetcher.php:120] Renaming temp file from /tmp/5f9593ab2d225-A0zDVK.tmp to /var/www/html/wp-content/plugins/simply-static/static-files/simply-static-1-1603638186/wp-includes/js/wp-emoji-release.min.js
|
||||
[class-ss-fetch-urls-task.php:99] Extracting URLs and replacing URLs in the static file
|
||||
[class-ss-fetch-urls-task.php:106] Adding 0 URLs to the queue
|
||||
[class-ss-fetch-urls-task.php:117] We're saving this URL; keeping the static file
|
||||
[class-ss-task.php:38] Status message: [fetch_urls] 0 pages/fichiers sur 2 générés
|
||||
[class-ss-archive-creation-job.php:147] We're not done with the fetch_urls task yet
|
||||
[class-ss-archive-creation-job.php:105] Current task: fetch_urls
|
||||
[class-ss-archive-creation-job.php:120] Performing task: fetch_urls
|
||||
[class-ss-fetch-urls-task.php:37] Total pages: 2; Pages remaining: 0
|
||||
[class-ss-task.php:38] Status message: [fetch_urls] 2 pages/fichiers sur 2 générés
|
||||
[class-ss-archive-creation-job.php:142] We've found our next task: transfer_files_locally
|
||||
[class-ss-archive-creation-job.php:105] Current task: transfer_files_locally
|
||||
[class-ss-archive-creation-job.php:120] Performing task: transfer_files_locally
|
||||
[class-ss-transfer-files-locally-task.php:64] Total pages: 2; Pages remaining: 2
|
||||
[class-ss-archive-creation-job.php:147] We're not done with the transfer_files_locally task yet
|
||||
[class-ss-archive-creation-job.php:105] Current task: transfer_files_locally
|
||||
[class-ss-archive-creation-job.php:120] Performing task: transfer_files_locally
|
||||
[class-ss-transfer-files-locally-task.php:64] Total pages: 2; Pages remaining: 0
|
||||
[class-ss-task.php:38] Status message: [transfer_files_locally] 2 fichiers sur 2 copiés
|
||||
[class-ss-archive-creation-job.php:142] We've found our next task: wrapup
|
||||
[class-ss-archive-creation-job.php:105] Current task: wrapup
|
||||
[class-ss-archive-creation-job.php:120] Performing task: wrapup
|
||||
[class-ss-wrapup-task.php:13] Deleting temporary files
|
||||
[class-ss-task.php:38] Status message: [wrapup] Fin du processus
|
||||
[class-ss-archive-creation-job.php:138] This task is done and there are no more tasks, time to complete the job
|
||||
[class-ss-archive-creation-job.php:161] Completing the job
|
||||
[class-ss-archive-creation-job.php:271] Status message: [done] Effectué ! Fini en 00:00:01
|
||||
2
services/copaines.jean-cloud.net/docker-compose.yml
Normal file
2
services/copaines.jean-cloud.net/docker-compose.yml
Normal file
@ -0,0 +1,2 @@
|
||||
version: '3.1'
|
||||
|
||||
30
services/copaines.jean-cloud.net/nginx_server.conf
Executable file
30
services/copaines.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,30 @@
|
||||
#server {
|
||||
# listen 443 ssl http2;
|
||||
# listen [::]:443 ssl http2;
|
||||
# ssl_certificate /etc/letsencrypt/live/copaines.jean-cloud.net/fullchain.pem;
|
||||
# ssl_certificate_key /etc/letsencrypt/live/copaines.jean-cloud.net/privkey.pem;
|
||||
# server_name wordpress.copaines.jean-cloud.net www.wordpress.copaines.jean-cloud.net;
|
||||
# location / {
|
||||
# auth_basic "Mot de passe !";
|
||||
# auth_basic_user_file /data/copaines.jean-cloud.net/pass.txt;
|
||||
# client_max_body_size 2G;
|
||||
# #proxy_set_header X-Real-IP $remote_addr;
|
||||
# proxy_set_header Host $http_host;
|
||||
# proxy_set_header X-Forwarded-Proto https;
|
||||
# proxy_pass http://wp.copainesjean-cloudnet.docker;
|
||||
# proxy_redirect off;
|
||||
# }
|
||||
#}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/copaines.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/copaines.jean-cloud.net/privkey.pem;
|
||||
server_name copaines.jean-cloud.net www.copaines.jean-cloud.net;
|
||||
|
||||
location / {
|
||||
root /data/copaines.jean-cloud.net/static;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
6
services/cousinades.jean-cloud.net/Dockerfile
Executable file
6
services/cousinades.jean-cloud.net/Dockerfile
Executable file
@ -0,0 +1,6 @@
|
||||
FROM php:7.2-fpm-alpine
|
||||
#RUN apt-get update && apt-get install -y libpq-dev && docker-php-ext-install pdo pdo_pgsql
|
||||
RUN set -ex \
|
||||
&& apk --no-cache add \
|
||||
postgresql-dev
|
||||
RUN docker-php-ext-install pdo_pgsql
|
||||
35
services/cousinades.jean-cloud.net/docker-compose.yml
Executable file
35
services/cousinades.jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1,35 @@
|
||||
version: '3'
|
||||
services:
|
||||
app:
|
||||
build: .
|
||||
volumes:
|
||||
- /data/cousinades.jean-cloud.net/public:/usr/src/app
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.4.100
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
|
||||
db:
|
||||
image: postgres:9.6-alpine
|
||||
volumes:
|
||||
- /data/cousinades.jean-cloud.net/db:/var/lib/postgresql/data
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.4.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.4.0/24
|
||||
25
services/cousinades.jean-cloud.net/nginx_server.conf
Executable file
25
services/cousinades.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,25 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/cousinades.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/cousinades.jean-cloud.net/privkey.pem;
|
||||
server_name cousinades.jean-cloud.net www.cousinades.jean-cloud.net;
|
||||
|
||||
index index.php;
|
||||
root /data/cousinades.jean-cloud.net/public;
|
||||
|
||||
location / {
|
||||
#auth_basic "Restricted";
|
||||
#auth_basic_user_file /data/cousinades.jean-cloud.net/private/passwords.txt;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass 172.29.4.100:9000;
|
||||
fastcgi_index index.php;
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME /usr/src/app/$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||
}
|
||||
}
|
||||
6
services/cousinades2.jean-cloud.net/Dockerfile
Executable file
6
services/cousinades2.jean-cloud.net/Dockerfile
Executable file
@ -0,0 +1,6 @@
|
||||
FROM php:7.2-fpm-alpine
|
||||
#RUN apt-get update && apt-get install -y libpq-dev && docker-php-ext-install pdo pdo_pgsql
|
||||
RUN set -ex \
|
||||
&& apk --no-cache add \
|
||||
postgresql-dev
|
||||
RUN docker-php-ext-install pdo_pgsql
|
||||
35
services/cousinades2.jean-cloud.net/docker-compose.yml
Executable file
35
services/cousinades2.jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1,35 @@
|
||||
version: '3'
|
||||
services:
|
||||
app:
|
||||
build: .
|
||||
volumes:
|
||||
- /data/cousinades2.jean-cloud.net/public:/usr/src/app
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.8.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
db:
|
||||
image: postgres:9.6-alpine
|
||||
volumes:
|
||||
- /data/cousinades2.jean-cloud.net/db:/var/lib/postgresql/data
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.8.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.8.0/24
|
||||
|
||||
25
services/cousinades2.jean-cloud.net/nginx_server.conf
Executable file
25
services/cousinades2.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,25 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/cousinades2.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/cousinades2.jean-cloud.net/privkey.pem;
|
||||
server_name cousinades2.jean-cloud.org www.cousinades2.jean-cloud.org;
|
||||
|
||||
index index.php;
|
||||
root /data/cousinades2.jean-cloud.net/public;
|
||||
|
||||
location / {
|
||||
#auth_basic "Restricted";
|
||||
#auth_basic_user_file /data/cousinades2.jean-cloud.net/private/passwords.txt;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass 172.29.8.100:9000;
|
||||
fastcgi_index index.php;
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME /usr/src/app/$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||
}
|
||||
}
|
||||
49
services/feministesucl34.jean-cloud.net/docker-compose.yml
Normal file
49
services/feministesucl34.jean-cloud.net/docker-compose.yml
Normal file
@ -0,0 +1,49 @@
|
||||
version: '3.1'
|
||||
|
||||
services:
|
||||
|
||||
wp:
|
||||
image: wordpress:5.8-apache
|
||||
restart: unless-stopped
|
||||
env_file: /data/feministesucl34.jean-cloud.net/env
|
||||
environment:
|
||||
WORDPRESS_DB_HOST: db
|
||||
WORDPRESS_DB_USER: wpdbuser
|
||||
WORDPRESS_DB_NAME: wpdb
|
||||
#WORDPRESS_CONFIG_EXTRA: "define( 'WP_HOME', 'https://feministesucl34.jean-cloud.net/wordpress' ); define( 'WP_SITEURL', 'https://feministesucl34.jean-cloud.net/wordpress' );"
|
||||
volumes:
|
||||
- /data/feministesucl34.jean-cloud.net/wordpress:/var/www/html
|
||||
- /data/feministesucl34.jean-cloud.net/static:/var/www/html/static
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.9.100
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
db:
|
||||
image: mariadb:10.4
|
||||
restart: unless-stopped
|
||||
env_file: /data/feministesucl34.jean-cloud.net/env
|
||||
environment:
|
||||
MYSQL_DATABASE: wpdb
|
||||
MYSQL_USER: wpdbuser
|
||||
MYSQL_RANDOM_ROOT_PASSWORD: 'yes'
|
||||
volumes:
|
||||
- /data/feministesucl34.jean-cloud.net/db:/var/lib/mysql
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.9.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.9.0/24
|
||||
|
||||
32
services/feministesucl34.jean-cloud.net/nginx_server.conf
Executable file
32
services/feministesucl34.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,32 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/feministesucl34.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/feministesucl34.jean-cloud.net/privkey.pem;
|
||||
server_name wordpress.feministesucl34.jean-cloud.net www.wordpress.feministesucl34.jean-cloud.net;
|
||||
location / {
|
||||
client_max_body_size 2G;
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_pass http://172.29.9.100;
|
||||
proxy_redirect off;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/feministesucl34.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/feministesucl34.jean-cloud.net/privkey.pem;
|
||||
server_name feministesucl34.jean-cloud.net www.feministesucl34.jean-cloud.net feministesucl34.communisteslibertaires.org;
|
||||
|
||||
location = /wp-login.php {
|
||||
return 301 https://wordpress.feministesucl34.jean-cloud.net/wp-login.php;
|
||||
}
|
||||
|
||||
location / {
|
||||
root /data/feministesucl34.jean-cloud.net/static;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
1
services/feteducourt.jean-cloud.net/docker-compose.yml
Executable file
1
services/feteducourt.jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1 @@
|
||||
version: '3'
|
||||
20
services/feteducourt.jean-cloud.net/nginx_server.conf
Executable file
20
services/feteducourt.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,20 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/feteducourt.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/feteducourt.jean-cloud.net/privkey.pem;
|
||||
server_name feteducourt.jean-cloud.net www.feteducourt.jean-cloud.net;
|
||||
#location /static {
|
||||
# alias /data/feteducourt.jean-cloud.net/app/static;
|
||||
# try_files $uri $uri/ =404;
|
||||
#}
|
||||
#location / {
|
||||
# proxy_pass http://app.feteducourtjean-cloudnet.docker;
|
||||
# proxy_set_header Host $host;
|
||||
#}
|
||||
location / {
|
||||
root /data/feteducourt.jean-cloud.net/static;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
|
||||
9
services/feteducourt2020.jean-cloud.net/docker-compose.yml
Executable file
9
services/feteducourt2020.jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1,9 @@
|
||||
version: '3'
|
||||
#services:
|
||||
# app:
|
||||
# image: registry.jean-cloud.net/feteducourt:2020
|
||||
# environment:
|
||||
# SECRET_KEY: azerty
|
||||
# volumes:
|
||||
# - /data/feteducourt2020.jean-cloud.net/db.sqlite3:/usr/src/app/db.sqlite3
|
||||
# - /data/feteducourt2020.jean-cloud.net/app/static:/usr/src/app/static
|
||||
22
services/feteducourt2020.jean-cloud.net/nginx_server.conf
Executable file
22
services/feteducourt2020.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,22 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/feteducourt2020.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/feteducourt2020.jean-cloud.net/privkey.pem;
|
||||
server_name feteducourt2020.jean-cloud.net www.feteducourt2020.jean-cloud.net;
|
||||
|
||||
#location /static {
|
||||
# alias /data/feteducourt2020.jean-cloud.net/app/static;
|
||||
# try_files $uri $uri/ =404;
|
||||
#}
|
||||
#location / {
|
||||
# proxy_pass http://app.feteducourt2020jean-cloudnet.docker;
|
||||
# proxy_set_header Host $host;
|
||||
#}
|
||||
|
||||
location / {
|
||||
root /data/feteducourt2020.jean-cloud.net/static;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
|
||||
41
services/git.jean-cloud.net/docker-compose.yml
Executable file
41
services/git.jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1,41 @@
|
||||
version: '3'
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:1.9.1
|
||||
depends_on:
|
||||
- db
|
||||
volumes:
|
||||
- /data/git.jean-cloud.net/web:/data
|
||||
ports:
|
||||
- "22529:22"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.10.100
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
|
||||
db:
|
||||
# https://hub.docker.com/_/postgres?tab=description
|
||||
image: postgres:9.6-alpine
|
||||
volumes:
|
||||
- /data/git.jean-cloud.net/db:/var/lib/postgresql/data
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.10.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.10.0/24
|
||||
|
||||
12
services/git.jean-cloud.net/nginx_server.conf
Executable file
12
services/git.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,12 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/git.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/git.jean-cloud.net/privkey.pem;
|
||||
server_name git.jean-cloud.net www.git.jean-cloud.net;
|
||||
location / {
|
||||
client_max_body_size 5G;
|
||||
proxy_pass http://172.29.10.100:3000;
|
||||
}
|
||||
}
|
||||
|
||||
18
services/gmx-webmail.jean-cloud.net/docker-compose.yml
Executable file
18
services/gmx-webmail.jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1,18 @@
|
||||
version: '3'
|
||||
services:
|
||||
roundcube:
|
||||
image: roundcube/roundcubemail:1.4.2-apache
|
||||
restart: "unless-stopped"
|
||||
depends_on:
|
||||
- db
|
||||
volumes:
|
||||
- /data/gmx-webmail.jean-cloud.net/app/plugins/:/var/www/html/plugins/
|
||||
- /data/gmx-webmail.jean-cloud.net/app/config/config.inc.php:/var/www/html/config/config.inc.php
|
||||
- /data/gmx-webmail.jean-cloud.net/app/enigma_pgp_homedir:/data/enigma_pgp_homedir
|
||||
|
||||
db:
|
||||
# https://hub.docker.com/_/postgres?tab=description
|
||||
image: postgres:9.6-alpine
|
||||
restart: "unless-stopped"
|
||||
volumes:
|
||||
- /data/gmx-webmail.jean-cloud.net/db:/var/lib/postgresql/data
|
||||
39
services/gmx-webmail.jean-cloud.net/nginx_server.conf
Executable file
39
services/gmx-webmail.jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,39 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/gmx-webmail.jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/gmx-webmail.jean-cloud.net/privkey.pem;
|
||||
|
||||
server_name gmx-webmail.jean-cloud.net www.gmx-webmail.jean-cloud.net;
|
||||
# root /data/gmx-webmail.jean-cloud.net/app;
|
||||
#
|
||||
client_max_body_size 1024M;
|
||||
charset utf-8;
|
||||
|
||||
# index index.php;
|
||||
#
|
||||
# location ~ ^/roundcube/(bin|SQL|config|temp|logs)/ {
|
||||
# deny all;
|
||||
# }
|
||||
#
|
||||
# location ~ /roundcube/\.(js|css|png|jpg|jpeg|gif|ico)$ {
|
||||
# expires max;
|
||||
# log_not_found off;
|
||||
# }
|
||||
|
||||
location / {
|
||||
proxy_pass http://roundcube.gmx-webmailjean-cloudnet.docker;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
}
|
||||
|
||||
# location ~ \.php$ {
|
||||
# fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||
# include fastcgi_params;
|
||||
# fastcgi_param SCRIPT_FILENAME /var/www/html/$fastcgi_script_name;
|
||||
# fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||
# fastcgi_pass gmx-webmail_jean-cloud_net:9000;
|
||||
# fastcgi_index index.php;
|
||||
# }
|
||||
}
|
||||
25
services/gypsylyonfestival.com/nginx_server.conf
Executable file
25
services/gypsylyonfestival.com/nginx_server.conf
Executable file
@ -0,0 +1,25 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/gypsylyonfestival.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/gypsylyonfestival.com/privkey.pem;
|
||||
#server_name gypsylyonfestival.com www.gypsylyonfestival.com;
|
||||
server_name gypsy.jean-cloud.net;
|
||||
root /data/gypsylyonfestival.com/output;
|
||||
|
||||
# Security headers
|
||||
# We can create a file with the base security headers and include it.
|
||||
# Will it be possible to overload them then ?
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
#add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self' https://unpkg.jean-cloud.net; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self'; base-uri 'self'; form-action 'self' always;
|
||||
add_header X-Content-Type-Options "nosniff";
|
||||
add_header X-Frame-Options SAMEORIGIN always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin";
|
||||
#add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
|
||||
|
||||
location / {
|
||||
index index.html;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
1
services/inurbe.fr/docker-compose.yml
Normal file
1
services/inurbe.fr/docker-compose.yml
Normal file
@ -0,0 +1 @@
|
||||
version: '3.1'
|
||||
12
services/inurbe.fr/nginx_server.conf
Executable file
12
services/inurbe.fr/nginx_server.conf
Executable file
@ -0,0 +1,12 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/inurbe.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/inurbe.fr/privkey.pem;
|
||||
server_name inurbe.fr www.inurbe.fr;
|
||||
|
||||
location / {
|
||||
root /data/inurbe.fr;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
2
services/jean-cloud.net/docker-compose.yml
Executable file
2
services/jean-cloud.net/docker-compose.yml
Executable file
@ -0,0 +1,2 @@
|
||||
version: '3'
|
||||
|
||||
33
services/jean-cloud.net/nginx_server.conf
Executable file
33
services/jean-cloud.net/nginx_server.conf
Executable file
@ -0,0 +1,33 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/jean-cloud.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/jean-cloud.net/privkey.pem;
|
||||
server_name jean-cloud.net www.jean-cloud.net jean-cloud.org www.jean-cloud.org;
|
||||
root /data/jean-cloud.net/public;
|
||||
|
||||
# Security headers
|
||||
# We can create a file with the base security headers and include it.
|
||||
# Will it be possible to overload them then ?
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self' https://unpkg.jean-cloud.net; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self' https://unpkg.jean-cloud.net; base-uri 'self'; form-action 'self' 'https://mailer.jean-cloud.net';" always;
|
||||
add_header X-Content-Type-Options "nosniff";
|
||||
add_header X-Frame-Options SAMEORIGIN always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin";
|
||||
add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';sync-xhr='https://mailer.jean-cloud.net';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';";
|
||||
|
||||
location / {
|
||||
index index.html;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
error_page 503 /503.html;
|
||||
location = /503.html {
|
||||
internal;
|
||||
}
|
||||
|
||||
location = /503 {
|
||||
return 503;
|
||||
}
|
||||
}
|
||||
2
services/lalis.fr/Dockerfile
Normal file
2
services/lalis.fr/Dockerfile
Normal file
@ -0,0 +1,2 @@
|
||||
FROM php:7.2-fpm-alpine
|
||||
RUN docker-php-ext-install mysqli
|
||||
22
services/lalis.fr/docker-compose.yml
Executable file
22
services/lalis.fr/docker-compose.yml
Executable file
@ -0,0 +1,22 @@
|
||||
version: '3'
|
||||
services:
|
||||
php:
|
||||
image: php:7.2-fpm-alpine
|
||||
build: .
|
||||
volumes:
|
||||
- /data/lalis.fr:/usr/src/app
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
default:
|
||||
ipv4_address: 172.29.11.101
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '0.50'
|
||||
memory: 100M
|
||||
networks:
|
||||
default:
|
||||
ipam:
|
||||
config:
|
||||
- subnet: 172.29.11.0/24
|
||||
|
||||
24
services/lalis.fr/nginx_server.conf
Executable file
24
services/lalis.fr/nginx_server.conf
Executable file
@ -0,0 +1,24 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/letsencrypt/live/lalis.fr/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/lalis.fr/privkey.pem;
|
||||
server_name lalis.fr lalis.jean-cloud.net www.lalis.jean-cloud.net;
|
||||
root /data/lalis.fr;
|
||||
|
||||
index index.php index.html;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass 172.29.11.100:9000;
|
||||
fastcgi_index index.php;
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME /usr/src/app/$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||||
}
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user