Merge branch 'hodaur' into 'newinfra'

Reverse proxy + first vm migration

See merge request nounous/ansible!56

group_vars/reverseproxy.yml

@@ -0,0 +1,81 @@
+certbot:
+  dns_rfc2136_name: certbot_challenge.
+  dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
+  mail: root@crans.org
+  certname: crans.org
+  domains: "crans.org, *.crans.org, crans.fr, *.crans.fr, crans.eu, *.crans.eu"
+
+nginx:
+  contact: contact@crans.org
+  who: "l'équipe technique du Cr@ns"
+  ssl:
+    cert: /etc/letsencrypt/live/crans.org/fullchain.pem
+    cert_key: /etc/letsencrypt/live/crans.org/privkey.pem
+    trusted_cert: /etc/letsencrypt/live/crans.org/chain.pem
+
+  redirect_dnames:
+    - crans.eu
+    - crans.fr
+
+  reverseproxy_sites:
+    # Services web Crans
+    #    - {from: lutim.crans.org, to: 10.231.136.69}
+    #    - {from: zero.crans.org, to: 10.231.136.76}
+    #    - {from: pad.crans.org, to: "10.231.136.76:9001"}
+    #    - {from: ethercalc.crans.org, to: "10.231.136.203:8000"}
+    #    - {from: mediadrop.crans.org, to: 10.231.136.106}
+    #    - {from: videos.crans.org, to: 10.231.136.106}
+    #    - {from: video.crans.org, to: 10.231.136.106}
+    #    - {from: roundcube.crans.org, to: 10.231.136.105}
+    #    - {from: phabricator.crans.org, to: 10.231.136.123}
+    #    - {from: trackerusercontent.crans.org, to: 10.231.136.123}
+    #    - {from: cas.crans.org, to: 10.231.136.18}
+    #    - {from: auth.crans.org, to: 10.231.136.18}
+    #    - {from: login.crans.org, to: 10.231.136.18}
+    #    - {from: webmail.crans.org, to: 10.231.136.107}
+    #    - {from: horde.crans.org, to: 10.231.136.107}
+    #    - {from: owncloud.crans.org, to: 10.231.136.26}
+    #    - {from: ftps.crans.org, to: 10.231.136.98}
+    #    - {from: wiki.crans.org, to: 10.231.136.204}
+    #    - {from: www.crans.org, to: 10.231.136.46}
+    #    - {from: doc.crans.org, to: 10.231.136.46}
+    #    - {from: limesurvey.crans.org, to: 10.231.136.253}
+    #    - {from: perso.crans.org, to: 10.231.136.1}
+    #    - {from: webnews.crans.org, to: 10.231.136.63}
+    #    - {from: re2o.crans.org, to: 10.231.136.9}
+    #    - {from: intranet.crans.org, to: 10.231.136.9}
+    #    - {from: autoconfig.crans.org, to: 10.231.136.46}
+    #    - {from: grafana.crans.org, to: "10.231.136.102:3000"}
+    #    - {from: webirc.crans.org, to: "10.231.136.1:9000"}
+    - {from: framadate.crans.org, to: 172.16.10.109}
+    #    - {from: mailman.crans.org, to: 10.231.136.180}
+    #
+    #    # Zamok
+    #    - {from: install-party.crans.org, to: 10.231.136.1}
+    #    - {from: med.crans.org, to: 10.231.136.1}
+    #    - {from: med-cartons.crans.org, to: 10.231.136.1}
+    #    - {from: amap.crans.org, to: 10.231.136.1}
+    #    - {from: pot-vieux.crans.org, to: 10.231.136.1}
+    #    - {from: bonvivens.crans.org, to: 10.231.136.1}
+    #
+  redirect_sites: []
+    #    - {from: crans.org, to: www.crans.org}
+    #
+    #    # Aliases or legacy support
+    #    - {from: factures.crans.org, to: intranet.crans.org}
+    #    - {from: accounts.crans.org, to: intranet.crans.org}
+    #    - {from: intranet2.crans.org, to: intranet.crans.org}
+    #    - {from: clubs.crans.org, to: perso.crans.org}
+    #    - {from: task.crans.org, to: phabricator.crans.org}
+    #    - {from: adopteunpingouin.crans.org, to: install-party.crans.org}
+    #    - {from: i-p.crans.org, to: install-party.crans.org}
+    #
+    #    # To the wiki
+    #    - {from: wikipedia.crans.org, to: wiki.crans.org}
+    #    - {from: wifi.crans.org, to: wiki.crans.org/CransD%C3%A9marrage}
+    #    - {from: television.crans.org, to: wiki.crans.org/CransTv}
+    #    - {from: tv.crans.org, to: wiki.crans.org/CransTv}
+    #
+    #    # ENS Cachan
+    #    - {from: crans.ens-cachan.fr, to: www.crans.org}
+    #    - {from: install-party.ens-cachan.fr, to: install-party.crans.org}

hosts

@@ -25,6 +25,10 @@
 # [test_vm]
 # re2o-test.adm.crans.org
 
+[reverseproxy]
+hodaur.adm.crans.org
+frontdaur.adm.crans.org
+
 [radius]
 routeur-sam.adm.crans.org
 
@@ -67,11 +71,13 @@ daniel.adm.crans.org
 jack.adm.crans.org
 
 [crans_vm]
+voyager.adm.crans.org
 silice.adm.crans.org
 routeur-sam.adm.crans.org
 routeur-daniel.adm.crans.org
 belenios # on changera plus tard
 re2o-ldap.adm.crans.org
+hodaur.adm.crans.org
 
 [ovh_physical]
 sputnik.adm.crans.org

plays/reverse-proxy.yml

@@ -1,53 +1,6 @@
 #!/usr/bin/env ansible-playbook
 ---
-# Deploy reverse proxy
+- hosts: reverseproxy
-# Frontdaur is the backup of bakdaur (keepalived)
+  roles:
-- hosts: bakdaur.adm.crans.org,frontdaur.adm.crans.org
+    - certbot
-  vars:
+    - nginx-reverseproxy
-    certbot:
-      dns_rfc2136_name: certbot_challenge.
-      dns_rfc2136_secret: "{{ vault_certbot_dns_secret }}"
-      mail: root@crans.org
-      certname: crans.org
-      domains: "crans.org, *.crans.org, crans.fr, *.crans.fr, crans.eu, *.crans.eu"
-    bind:
-      masters: "{{ lookup('re2oapi', 'get_role', 'dns-authoritary-master')[0] }}"
-    nginx:
-      ssl:
-        cert: /etc/letsencrypt/live/crans.org/fullchain.pem
-        cert_key: /etc/letsencrypt/live/crans.org/privkey.pem
-        trusted_cert: /etc/letsencrypt/live/crans.org/chain.pem
-
-      redirect_dnames:
-        - crans.eu
-        - crans.fr
-
-      reverseproxy_sites:
-        # Services web Crans
-        - {from: lutim.crans.org, to: 10.231.136.69}
-        - {from: zero.crans.org, to: 10.231.136.76}
-        - {from: pad.crans.org, to: "10.231.136.76:9001"}
-        - {from: ethercalc.crans.org, to: "10.231.136.203:8000"}
-        - {from: mediadrop.crans.org, to: 10.231.136.106}
-        - {from: videos.crans.org, to: 10.231.136.106}
-        - {from: video.crans.org, to: 10.231.136.106}
-        - {from: roundcube.crans.org, to: 10.231.136.105}
-        - {from: phabricator.crans.org, to: 10.231.136.123}
-        - {from: trackerusercontent.crans.org, to: 10.231.136.123}
-        - {from: cas.crans.org, to: 10.231.136.18}
-        - {from: auth.crans.org, to: 10.231.136.18}
-        - {from: login.crans.org, to: 10.231.136.18}
-        - {from: webmail.crans.org, to: 10.231.136.107}
-        - {from: horde.crans.org, to: 10.231.136.107}
-        - {from: owncloud.crans.org, to: 10.231.136.26}
-        - {from: ftps.crans.org, to: 10.231.136.98}
-        - {from: wiki.crans.org, to: 10.231.136.204}
-        - {from: calendrier.crans.org, to: 10.231.136.204}
-        - {from: www.crans.org, to: 10.231.136.46}
-        - {from: doc.crans.org, to: 10.231.136.46}
-        - {from: limesurvey.crans.org, to: 10.231.136.253}
-        - {from: perso.crans.org, to: 10.231.136.1}
-        - {from: webnews.crans.org, to: 10.231.136.63}
-        - {from: re2o.crans.org, to: 10.231.136.9}
-        - {from: intranet.crans.org, to: 10.231.136.9}
-        - {from: autoconfig.crans.org, to: 10.231.136.46}

roles/certbot/tasks/main.yml

@@ -12,7 +12,9 @@
 
 - name: Lookup DNS masters IPv4
   set_fact:
-    dns_masters_ipv4: "{{ bind.masters | json_query('servers[].interface[?vlan_id==`2`].ipv4[]') }}"
+    #dns_masters_ipv4: "{{ bind.masters | json_query('servers[].interface[?vlan_id==`2`].ipv4[]') }}"
+    dns_masters_ipv4:
+      - "185.230.79.9"
     cacheable: true
 
 - name: Add DNS credentials

roles/nginx-reverseproxy/tasks/main.yml

@@ -15,16 +15,10 @@
     - options-ssl.conf
     - options-proxypass.conf
 
-- name: Has dhparam been copied?
-  stat:
-    path: /etc/letsencrypt/dhparam
-  register: stat_result
-
 - name: Copy dhparam
   template:
     src: letsencrypt/dhparam.j2
     dest: /etc/letsencrypt/dhparam
-  when: not stat_result.stat.exists
 
 - name: Copy reverse proxy sites
   template:
@@ -46,6 +40,7 @@
     - reverseproxy_redirect_dname
     - redirect
   notify: Reload nginx
+  ignore_errors: "{{ ansible_check_mode }}"
 
 - name: Copy 50x error page
   template:

roles/nginx-reverseproxy/templates/www/html/50x.html.j2

@@ -57,7 +57,7 @@
     <h1>502</h1>
     <p>Whoops, le service prend trop de temps à répondre…</p>
     <p>Essayez de rafraîchir la page. Si le problème persiste, pensez
-    à contacter <a href="mailto:contact@crans.org">l'équipe technique du Cr@ns</a>.</p>
+    à contacter <a href="mailto:{{ nginx.contact }}">{{ nginx.who }}</a>.</p>
 </body>
 </html>