add netbird
This commit is contained in:
@@ -19,9 +19,19 @@ firewall_allowed_tcp_ports:
|
|||||||
- "80"
|
- "80"
|
||||||
- "443"
|
- "443"
|
||||||
- "9100"
|
- "9100"
|
||||||
|
#! Kubernetes control plane ports
|
||||||
|
- "6443"
|
||||||
|
- "2379"
|
||||||
|
- "2380"
|
||||||
|
- "10250"
|
||||||
|
- "10259"
|
||||||
|
- "10257"
|
||||||
# - "9090"
|
# - "9090"
|
||||||
# - "3000"
|
# - "3000"
|
||||||
# - "9323"
|
# - "9323"
|
||||||
|
#! Kubernetes Worker ports
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#* NETBIRD
|
#* NETBIRD
|
||||||
|
|
||||||
|
|||||||
@@ -1,99 +0,0 @@
|
|||||||
# ---
|
|
||||||
# package_list:
|
|
||||||
# - name: python3-pip
|
|
||||||
|
|
||||||
# sshd_skip_defaults: true
|
|
||||||
# sshd_config_file: /etc/ssh/sshd_config
|
|
||||||
# sshd_AuthorizedKeysFile: .ssh/authorized_keys
|
|
||||||
# sshd_AcceptEnv: "LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT LC_IDENTIFICATION LC_ALL"
|
|
||||||
# sshd_Protocol: 2
|
|
||||||
# sshd_LoginGraceTime: 30
|
|
||||||
# sshd_SyslogFacility: AUTH
|
|
||||||
# sshd_LogLevel: VERBOSE
|
|
||||||
# sshd_PermitRootLogin: 'no'
|
|
||||||
# sshd_StrictModes: 'yes'
|
|
||||||
# sshd_IgnoreRhosts: 'yes'
|
|
||||||
# sshd_HostbasedAuthentication: 'no'
|
|
||||||
# sshd_PasswordAuthentication: 'no'
|
|
||||||
# sshd_PermitEmptyPasswords: 'no'
|
|
||||||
# sshd_ChallengeResponseAuthentication: 'no'
|
|
||||||
# sshd_GSSAPIAuthentication: 'no'
|
|
||||||
# sshd_X11DisplayOffset: 10
|
|
||||||
# sshd_PrintMotd: 'yes'
|
|
||||||
# sshd_PrintLastLog: 'yes'
|
|
||||||
# sshd_TCPKeepAlive: 'yes'
|
|
||||||
# sshd_Subsystem: "sftp /usr/lib/openssh/sftp-server"
|
|
||||||
# sshd_UsePAM: 'yes'
|
|
||||||
# sshd_UseDNS: 'no'
|
|
||||||
# sshd_KexAlgorithms: "curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256"
|
|
||||||
# sshd_Ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr"
|
|
||||||
# sshd_MACs: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com"
|
|
||||||
# sshd_HostKey:
|
|
||||||
# - /etc/ssh/ssh_host_rsa_key
|
|
||||||
|
|
||||||
# #######
|
|
||||||
# # APT #
|
|
||||||
# #######
|
|
||||||
|
|
||||||
# apt_repositories_sources:
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal main restricted
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal-updates main restricted
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal universe
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal-updates universe
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal multiverse
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal-updates multiverse
|
|
||||||
# - deb http://nova.clouds.archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse
|
|
||||||
# - deb http://security.ubuntu.com/ubuntu focal-security main restricted
|
|
||||||
# - deb http://security.ubuntu.com/ubuntu focal-security universe
|
|
||||||
# - deb http://security.ubuntu.com/ubuntu focal-security multiverse
|
|
||||||
|
|
||||||
|
|
||||||
# ########
|
|
||||||
# # KUBE #
|
|
||||||
# ########
|
|
||||||
|
|
||||||
# disable_firewall: true
|
|
||||||
# # Need public_network for argocd
|
|
||||||
# # I use any because both worker and master are not on the same network (
|
|
||||||
# # They have only one public IP
|
|
||||||
# kubernetes_subnet: 0.0.0.0/0
|
|
||||||
|
|
||||||
# # vip control plan 192.168.25.255
|
|
||||||
# setup_vip: false
|
|
||||||
# install_nginx_ingress: false
|
|
||||||
# install_longhorn: false
|
|
||||||
|
|
||||||
# # This variable is used when the cluster is bootstrapped for the first time
|
|
||||||
# kubernetes_init_host: ovh-master
|
|
||||||
|
|
||||||
# kubernetes_init_app: true
|
|
||||||
|
|
||||||
# kubernetes_app:
|
|
||||||
# - url: https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
|
|
||||||
# namespace: argocd
|
|
||||||
|
|
||||||
# kubernetes_alias_bashrc:
|
|
||||||
# - path: "/root/.bashrc"
|
|
||||||
# regexp: "^source /usr/share/bash-completion/bash_completion"
|
|
||||||
# state: present
|
|
||||||
# line: "source /usr/share/bash-completion/bash_completion"
|
|
||||||
# - path: "/root/.bashrc"
|
|
||||||
# regexp: "^source /etc/bash_completion"
|
|
||||||
# state: present
|
|
||||||
# line: "source /etc/bash_completion"
|
|
||||||
# - path: "/root/.bashrc"
|
|
||||||
# regexp: "^source <(kubectl completion bash)"
|
|
||||||
# state: present
|
|
||||||
# line: "source <(kubectl completion bash)"
|
|
||||||
# - path: "/root/.bashrc"
|
|
||||||
# regexp: "^alias k=kubectl"
|
|
||||||
# state: present
|
|
||||||
# line: "alias k=kubectl"
|
|
||||||
# - path: "/root/.bashrc"
|
|
||||||
# regexp: "^complete -F __start_kubectl k"
|
|
||||||
# state: present
|
|
||||||
# line: "complete -F __start_kubectl k"
|
|
||||||
# - path: "/root/.bashrc"
|
|
||||||
# regexp: '^alias kname="kubectl config set-context --current --namespace="'
|
|
||||||
# state: present
|
|
||||||
# line: '^alias kname="kubectl config set-context --current --namespace="'
|
|
||||||
@@ -1,250 +0,0 @@
|
|||||||
---
|
|
||||||
|
|
||||||
##########
|
|
||||||
# DOCKER #
|
|
||||||
##########
|
|
||||||
|
|
||||||
|
|
||||||
dockerapp_tree_base_dir:
|
|
||||||
- "/opt"
|
|
||||||
# - "/opt/entreprise/dockerapps"
|
|
||||||
|
|
||||||
#docker_install_compose: false
|
|
||||||
|
|
||||||
# boostrap dockerapp:
|
|
||||||
dockerapp_service: dockerapps
|
|
||||||
|
|
||||||
dockerapp_tree_volumes:
|
|
||||||
- "gitlab"
|
|
||||||
- "gitlab/config"
|
|
||||||
- "gitlab/data"
|
|
||||||
- "gitlab/docker"
|
|
||||||
- "gitlab/logs"
|
|
||||||
- "gitlab-runner"
|
|
||||||
- "gitlab-runner/certs"
|
|
||||||
- "gitlab-runner/docker"
|
|
||||||
- "pypi-mirror"
|
|
||||||
- "pypi-mirror/etc"
|
|
||||||
- "sonarqube"
|
|
||||||
- "sonarqube/postgresql"
|
|
||||||
- "sonarqube/sonarqube"
|
|
||||||
- "sonarqube/sonarqube/data"
|
|
||||||
- "sonarqube/sonarqube/extensions"
|
|
||||||
- "sonarqube/sonarqube/key"
|
|
||||||
- "sonarqube/sonarqube/logs"
|
|
||||||
- "traefik/certs"
|
|
||||||
|
|
||||||
# generate docker-compose.yml
|
|
||||||
dockerapp_compose:
|
|
||||||
version: '3.9'
|
|
||||||
networks:
|
|
||||||
t2_proxy:
|
|
||||||
name: t2_proxy
|
|
||||||
driver: bridge
|
|
||||||
ipam:
|
|
||||||
config:
|
|
||||||
- subnet: 192.168.90.0/24
|
|
||||||
default:
|
|
||||||
driver: bridge
|
|
||||||
socket_proxy:
|
|
||||||
name: socket_proxy
|
|
||||||
driver: bridge
|
|
||||||
ipam:
|
|
||||||
config:
|
|
||||||
- subnet: 192.168.91.0/24
|
|
||||||
x-environment: &default-tz-puid-pgid
|
|
||||||
TZ: Europe/Paris
|
|
||||||
PUID: 1000
|
|
||||||
PGID: 1000
|
|
||||||
# Proxy Network and Security
|
|
||||||
x-network-and-security: &network-and-security
|
|
||||||
networks:
|
|
||||||
- t2_proxy
|
|
||||||
security_opt:
|
|
||||||
- no-new-privileges:true
|
|
||||||
# Keys common to some of the services in basic-services.txt
|
|
||||||
x-common-keys-core: &common-keys-core
|
|
||||||
<<: *network-and-security
|
|
||||||
restart: always
|
|
||||||
# profiles:
|
|
||||||
# - basic
|
|
||||||
# Keys common to some of the dependent services/apps
|
|
||||||
x-common-keys-apps: &common-keys-apps
|
|
||||||
<<: *network-and-security
|
|
||||||
restart: unless-stopped
|
|
||||||
# profiles:
|
|
||||||
# - apps
|
|
||||||
services:
|
|
||||||
pypi-mirror:
|
|
||||||
image: "pypa/bandersnatch:latest"
|
|
||||||
restart: always
|
|
||||||
networks:
|
|
||||||
dev_net:
|
|
||||||
ipv4_address: 10.10.20.9
|
|
||||||
command: python /bandersnatch/src/runner.py 3600
|
|
||||||
logging:
|
|
||||||
driver: "json-file"
|
|
||||||
options:
|
|
||||||
max-size: "10m"
|
|
||||||
max-file: "10"
|
|
||||||
volumes:
|
|
||||||
- "{{ dockerapp_tree_base_dir | last }}/{{ dockerapp_service }}/pypi-mirror/etc/bandersnatch.conf:/conf/bandersnatch.conf"
|
|
||||||
# Traefik 2 - Reverse Proxy
|
|
||||||
# Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
|
|
||||||
# touch $DOCKERDIR/traefik2/acme/acme.json
|
|
||||||
# chmod 600 $DOCKERDIR/traefik2/acme/acme.json
|
|
||||||
# touch $DOCKERDIR/logs/homeserver/traefik.log # customize this
|
|
||||||
|
|
||||||
#### LETSENCRYPT CHALLENGE ######
|
|
||||||
# https://doc.traefik.io/traefik/user-guides/docker-compose/acme-http/
|
|
||||||
# Add new https services/fqdn
|
|
||||||
# uncomment acme.caserver line and remove appdata/traefik2/acme/letsencrypt/acme.json file
|
|
||||||
# Down all containers and up all (docker-compose down/up -d), wait for news cert/key on acme.json
|
|
||||||
# At this moment, cert/key are staging, you need to comment acme.caserver line and remove acme.json file then restart traefik
|
|
||||||
traefik:
|
|
||||||
<<: *common-keys-core # See EXTENSION FIELDS at the top
|
|
||||||
container_name: traefik
|
|
||||||
image: traefik:latest
|
|
||||||
command: # CLI arguments
|
|
||||||
- --global.checkNewVersion=true
|
|
||||||
- --global.sendAnonymousUsage=true
|
|
||||||
- --entryPoints.http.address=:80/tcp
|
|
||||||
- --entryPoints.https.address=:443/tcp
|
|
||||||
- --entryPoints.wireguard.address=:443/udp
|
|
||||||
- --api=true
|
|
||||||
- --api.dashboard=true
|
|
||||||
- --log=true
|
|
||||||
- --log.level=WARN # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
|
|
||||||
- --accessLog=true
|
|
||||||
- --accessLog.filePath=/traefik.log
|
|
||||||
- --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
|
|
||||||
- --providers.docker=true
|
|
||||||
- --providers.docker.endpoint=tcp://socket-proxy:2375
|
|
||||||
- --providers.docker.exposedByDefault=false
|
|
||||||
- --providers.docker.network=t2_proxy
|
|
||||||
- --providers.docker.swarmMode=false
|
|
||||||
- --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
|
|
||||||
- --providers.file.watch=true # Only works on top level files in the rules folder
|
|
||||||
- --metrics.prometheus=true
|
|
||||||
- --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
|
|
||||||
- --metrics.prometheus.addEntryPointsLabels=true
|
|
||||||
- --metrics.prometheus.addrouterslabels=true
|
|
||||||
- --metrics.prometheus.addServicesLabels=true
|
|
||||||
- --metrics.prometheus.manualrouting=true
|
|
||||||
- --certificatesresolvers.letsencrypt-resolver.acme.tlschallenge=true
|
|
||||||
#- --certificatesresolvers.letsencrypt-resolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
|
|
||||||
- --certificatesresolvers.letsencrypt-resolver.acme.email=stephane.gratiasquiquandon@gmail.com
|
|
||||||
- --certificatesresolvers.letsencrypt-resolver.acme.storage=/letsencrypt/acme.json
|
|
||||||
networks:
|
|
||||||
t2_proxy:
|
|
||||||
ipv4_address: 192.168.90.254 # You can specify a static IP
|
|
||||||
socket_proxy:
|
|
||||||
environment:
|
|
||||||
<<: *default-tz-puid-pgid
|
|
||||||
ports:
|
|
||||||
- target: 80
|
|
||||||
published: 80
|
|
||||||
protocol: tcp
|
|
||||||
mode: host
|
|
||||||
- target: 443
|
|
||||||
published: 443
|
|
||||||
protocol: tcp
|
|
||||||
mode: host
|
|
||||||
- target: 443
|
|
||||||
published: 443
|
|
||||||
protocol: udp
|
|
||||||
mode: host
|
|
||||||
volumes:
|
|
||||||
- ./appdata/traefik2/rules/homeserver:/rules # file provider directory
|
|
||||||
- ./appdata/traefik2/acme/letsencrypt:/letsencrypt
|
|
||||||
#- ./appdata/traefik2/acme/acme.json:/acme.json # cert location - you must touch this file and change permissions to 600
|
|
||||||
- ./logs/homeserver/traefik.log:/traefik.log # for fail2ban - make sure to touch file before starting container
|
|
||||||
- /etc/timezone:/etc/timezone:ro
|
|
||||||
- /etc/localtime:/etc/localtime:ro
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
# HTTP-to-HTTPS Redirect
|
|
||||||
- "traefik.http.routers.http-catchall.entrypoints=http"
|
|
||||||
- "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
|
|
||||||
- "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
|
|
||||||
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
|
|
||||||
- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
|
|
||||||
# HTTP Routers
|
|
||||||
- "traefik.http.routers.traefik-rtr.entrypoints=https"
|
|
||||||
- "traefik.http.routers.traefik-rtr.rule=Host(`traefik.jingoh.fr`)"
|
|
||||||
## Services - API
|
|
||||||
- "traefik.http.routers.traefik-rtr.service=api@internal"
|
|
||||||
- "traefik.http.routers.traefik-rtr.tls=true"
|
|
||||||
## MONITORING
|
|
||||||
- traefik.http.routers.prometheus.entrypoints=https
|
|
||||||
- traefik.http.routers.prometheus.rule=Host(`traefik.jingoh.fr`) && PathPrefix(`/metrics`)
|
|
||||||
- traefik.http.routers.prometheus.service=prometheus@internal
|
|
||||||
- traefik.http.routers.prometheus.middlewares=traefik-basic
|
|
||||||
## Middlewares
|
|
||||||
# echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
|
|
||||||
## Middlewares
|
|
||||||
- "traefik.http.routers.traefik-rtr.middlewares=traefik-basic"
|
|
||||||
- "traefik.http.middlewares.traefik-basic.basicauth.users=jingohtraf:$$2y$$05$$JO8mJnOV2PARzEcVj.Grp.H.JbkWYneAIjgMt7c0.5NTyBNDkRIiW"
|
|
||||||
#- "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.average=10"
|
|
||||||
# - "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.burst=10"
|
|
||||||
# - "traefik.http.middlewares.traefik-rtr-ratelimit.ratelimit.period=1"
|
|
||||||
# - "traefik.http.routers.traefik-rtr-ratelimit.middlewares=traefik-rtr-ratelimit@docker"
|
|
||||||
## TLS
|
|
||||||
- "traefik.http.routers.traefik-rtr.tls.certresolver=letsencrypt-resolver"
|
|
||||||
- "traefik.http.routers.prometheus.tls.certresolver=letsencrypt-resolver"
|
|
||||||
# Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
|
|
||||||
socket-proxy:
|
|
||||||
<<: *common-keys-core # See EXTENSION FIELDS at the top
|
|
||||||
container_name: socket-proxy
|
|
||||||
image: tecnativa/docker-socket-proxy:latest
|
|
||||||
networks:
|
|
||||||
socket_proxy:
|
|
||||||
ipv4_address: 192.168.91.254 # You can specify a static IP
|
|
||||||
volumes:
|
|
||||||
- "/var/run/docker.sock:/var/run/docker.sock"
|
|
||||||
environment:
|
|
||||||
- LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
|
|
||||||
## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
|
|
||||||
# 0 to revoke access.
|
|
||||||
# 1 to grant access.
|
|
||||||
## Granted by Default
|
|
||||||
- EVENTS=1
|
|
||||||
- PING=1
|
|
||||||
- VERSION=1
|
|
||||||
## Revoked by Default
|
|
||||||
# Security critical
|
|
||||||
- AUTH=0
|
|
||||||
- SECRETS=0
|
|
||||||
- POST=0 # Watchtower
|
|
||||||
# Not always needed
|
|
||||||
- BUILD=0
|
|
||||||
- COMMIT=0
|
|
||||||
- CONFIGS=0
|
|
||||||
- CONTAINERS=1 # Traefik, portainer, etc.
|
|
||||||
- DISTRIBUTION=0
|
|
||||||
- EXEC=0
|
|
||||||
- IMAGES=0 # Portainer
|
|
||||||
- INFO=0 # Portainer
|
|
||||||
- NETWORKS=0 # Portainer
|
|
||||||
- NODES=0
|
|
||||||
- PLUGINS=0
|
|
||||||
- SERVICES=0 # Portainer
|
|
||||||
- SESSION=0
|
|
||||||
- SWARM=0
|
|
||||||
- SYSTEM=0
|
|
||||||
- TASKS=0 # Portainer
|
|
||||||
- VOLUMES=0 # Portainer
|
|
||||||
|
|
||||||
##############
|
|
||||||
# KUBERNETES #
|
|
||||||
##############
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
kubernetes_tree_base_dir:
|
|
||||||
- /opt
|
|
||||||
- /opt/kubernetes
|
|
||||||
|
|
||||||
kubernetes_service: infra
|
|
||||||
@@ -115,20 +115,6 @@
|
|||||||
# tags: test2
|
# tags: test2
|
||||||
tasks:
|
tasks:
|
||||||
|
|
||||||
- name: Update repositories and install py3-pip package
|
|
||||||
community.general.apk:
|
|
||||||
name: python3-pip
|
|
||||||
update_cache: true
|
|
||||||
delegate_to: localhost
|
|
||||||
|
|
||||||
- name: Install pip package
|
|
||||||
ansible.builtin.pip:
|
|
||||||
name: "{{ item }}"
|
|
||||||
loop:
|
|
||||||
- setuptools
|
|
||||||
- netaddr
|
|
||||||
delegate_to: localhost
|
|
||||||
|
|
||||||
- name: Tcheck ssh conf for phone connection
|
- name: Tcheck ssh conf for phone connection
|
||||||
ansible.builtin.lineinfile:
|
ansible.builtin.lineinfile:
|
||||||
path: /etc/ssh/ssh_config
|
path: /etc/ssh/ssh_config
|
||||||
|
|||||||
11
hosts
11
hosts
@@ -3,13 +3,20 @@ scale01 ansible_host=163.172.209.36 ansible_user=stephane
|
|||||||
ovh01 ansible_host=5.135.181.11 ansible_user=stephane
|
ovh01 ansible_host=5.135.181.11 ansible_user=stephane
|
||||||
scaleway ansible_host=163.172.84.28 ansible_user=stephane
|
scaleway ansible_host=163.172.84.28 ansible_user=stephane
|
||||||
|
|
||||||
[controller]
|
[tower]
|
||||||
scaleway ansible_host=163.172.84.28 ansible_user=stephane
|
scaleway ansible_host=163.172.84.28 ansible_user=stephane
|
||||||
|
|
||||||
[kubernetes]
|
|
||||||
|
[control]
|
||||||
scale01 ansible_host=163.172.209.36 ansible_user=stephane
|
scale01 ansible_host=163.172.209.36 ansible_user=stephane
|
||||||
ovh01 ansible_host=5.135.181.11 ansible_user=stephane
|
ovh01 ansible_host=5.135.181.11 ansible_user=stephane
|
||||||
|
|
||||||
|
[worker]
|
||||||
|
|
||||||
|
[kubernetes:children]
|
||||||
|
control
|
||||||
|
worker
|
||||||
|
|
||||||
[vagrant]
|
[vagrant]
|
||||||
v1 ansible_host=192.168.121.2 ansible_user=vagrant ansible_ssh_pass=vagrant
|
v1 ansible_host=192.168.121.2 ansible_user=vagrant ansible_ssh_pass=vagrant
|
||||||
v2 ansible_host=192.168.121.240 ansible_user=vagrant ansible_ssh_pass=vagrant
|
v2 ansible_host=192.168.121.240 ansible_user=vagrant ansible_ssh_pass=vagrant
|
||||||
Reference in New Issue
Block a user