Update hardening and add backup playbook

2024-03-31 12:09:09 +02:00
parent 7485cee556
commit 7c95663dd7
8 changed files with 134 additions and 23 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,2 @@
+backup/
+scaleway/
--- a/backup.yml
+++ b/backup.yml
@@ -0,0 +1,50 @@
+- hosts: controller
+  # vars:
+  # become: true
+  gather_facts: true
+  vars:
+    user: staffadmin
+    token: 86839ba0ace61ed3b28ead9d76e89701b22aa90f
+  tasks:
+
+    - name: Example clone of a single branch
+      ansible.builtin.git:
+        repo: https://{{ user }}:{{ token }}@gitea.jingoh.fr/staffadmin/backup.git
+        dest: "{{ playbook_dir }}/backup"
+        single_branch: yes
+        # version: masterls
+      delegate_to: localhost
+
+    - name: Specifying a path directly
+      ansible.builtin.fetch:
+        src: "{{ item }}"
+        dest: "{{ playbook_dir }}/backup/"
+      loop:
+      #! Docker-compose
+        - /opt/dockerapps/docker-compose.yml
+      #! Dex & traefik-forward
+        - /opt/dockerapps/appdata/dex/config.yml
+        - /opt/dockerapps/appdata/dex/traefik-auth-conf.env
+      #! Gitea & Runner
+        - /opt/dockerapps/appdata/gitea/gitea/gitea/conf/app.ini
+        - /opt/dockerapps/appdata/gitea/runner/config.yaml
+      #! Notification
+        - /opt/dockerapps/appdata/alertmanager/config/alertmanager.yml
+      #! Homepage
+        - /opt/dockerapps/appdata/homepage/homepage/bookmarks.yaml
+        - /opt/dockerapps/appdata/homepage/homepage/services.yaml
+        - /opt/dockerapps/appdata/homepage/homepage/settings.yaml
+      #! Semaphore
+        - /opt/dockerapps/appdata/semaphore/config/config.json
+
+    - name: Specifying a path directly
+      ansible.builtin.shell: |
+        git config user.email "stephane.gratiasquiquandon@gmail.com"
+        git config user.name "staffadmin"
+        git add .
+        git commit -m "Push Backup with access token"
+        git push https://{{ user }}:{{ token }}@gitea.jingoh.fr/staffadmin/backup.git
+      args:
+        chdir: "{{ playbook_dir }}/backup/"
+      run_once: true
+      delegate_to: localhost 
--- a/hardening.yml
+++ b/hardening.yml
@@ -1,4 +1,4 @@
- hosts: monitoring
+- hosts: test
  # vars:
  become: true
  gather_facts: true
@@ -82,19 +82,23 @@
 #||-----> GPG error: https://pkgs.netbird.io/debian stable InRelease: The following signatures couldn't be verified because the public key is not available

  # roles:
-    # - robertdebock.update
-    # - devsec.hardening.os_hardening
-    # - devsec.hardening.ssh_hardening
-    # - maxlareo.rkhunter
-    # - maxlareo.chkrootkit
-    # - robertdebock.auditd
-    # - geerlingguy.firewall
-    # - grog.management-user
-    # - GROG.user
-    # - GROG.authorized-key
-    # - GROG.sudo
-    # - ansible_unattended_upgrades
-    # - buluma.lynis
+  #   - robertdebock.update
+  #   - devsec.hardening.os_hardening
+  #   - devsec.hardening.ssh_hardening
+  #   - maxlareo.rkhunter
+  #   - maxlareo.chkrootkit
+  #   - robertdebock.auditd
+  #   - geerlingguy.firewall
+  #   - grog.management-user
+  #   - GROG.user
+  #   - GROG.authorized-key
+  #   - GROG.sudo
+  #   - ansible_unattended_upgrades
+  #   - buluma.lynis
+  
+  # roles:
+  #   - role: netways.elasticstack.elasticsearch
+  #     tags: test2
  tasks:

    - name: Retrieve private IP address netbird
@@ -121,13 +125,50 @@
    #     msg: "{{ group_names }}"
    #   when: group_names is search("monitoring") 

-    - ansible.builtin.import_role: 
-        name: prometheus.prometheus.node_exporter
+    # - ansible.builtin.import_role: 
+    #     name: prometheus.prometheus.node_exporter
+
+    # - ansible.builtin.import_role: 
+    #     name: prometheus.prometheus.prometheus
+    #   when: group_names is search("monitoring") 
+
+    # - ansible.builtin.import_role: 
+    #     name: ansible-role-labocbz-install-grafana
+    #   when: group_names is search("monitoring") 

    - ansible.builtin.import_role: 
-        name: prometheus.prometheus.prometheus
-      when: group_names is search("monitoring") 
+        name: netways.elasticstack.repos
+      tags: repo

+
+# to reset password
+#/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
+
+# xpack.security.http.ssl.verification_mode: none 
+
+# Add token for new node ?  
+# /usr/share/elasticsearch/elasticsearch-create-enrollment-token -s kibana
+# /usr/share/kibana/bin/kibana-encryption-keys generate --force
+# /usr/share/elasticsearch/bin# ./elasticsearch-service-tokens create elastic/kibana token
+# bin/elasticsearch-create-enrollment-token -s kibana --url "https://172.0.0.3:9200"
    - ansible.builtin.import_role: 
-        name: ansible-role-labocbz-install-grafana
-      when: group_names is search("monitoring") 
+        name: netways.elasticstack.elasticsearch
+      tags: elastic
+
+
+# Wait the end install to have th url to connect and put the enroll token
+    - ansible.builtin.import_role: 
+        name: netways.elasticstack.kibana
+      tags: kibana
+
+    # - ansible.builtin.import_role: 
+    #     name: netways.elasticstack.logstash
+    #   tags: test2
+
+# FileBEAT 
+# filebeat test config -e filebeat.yml
+# filebeat setup -e
+# restart filebeat
+    - ansible.builtin.import_role: 
+        name: netways.elasticstack.beats
+      tags: filebeat
--- a/host_vars/ovh01.yml
+++ b/host_vars/ovh01.yml
@@ -1,4 +1,8 @@
 ---
+
+#* SSH
+#ssh_listen_to: "{{ host_private_address }}"
+
 #* USERS 

 management_user_list:
--- a/host_vars/ubuntu.yml
+++ b/host_vars/ubuntu.yml
@@ -1,4 +1,12 @@
 ---
+
+# elasticstack_ca_pass: setuppassword
+elasticsearch_api_host: 192.168.0.26
+elasticsearch_http_publish_host: 192.168.0.26
+elasticsearch_network_host: 192.168.0.26
+elasticsearch_ssl_verification_mode: none
+# logstash_elasticsearch: 192.168.0.26
+
 #* USERS 

 management_user_list:
--- a/5
+++ b/5
@@ -17,8 +17,11 @@ scaleway ansible_host=163.172.84.28 ansible_user=stephane
 ovh01 ansible_host=5.135.181.11 ansible_user=stephane
 ; ubuntu ansible_host=192.168.0.22 ansible_user=vagrant ansible_password=vagrant

+[elasticsearch]
+ubuntu ansible_host=192.168.0.26 ansible_user=vagrant ansible_password=vagrant
+
 [test]
-ubuntu ansible_host=192.168.0.22 ansible_user=vagrant ansible_password=vagrant
+ubuntu ansible_host=192.168.0.26 ansible_user=vagrant ansible_password=vagrant

 ; # TO KNOW WHOIS CHISEL SERVER
 ; [server]
--- a/requirements.yml
+++ b/requirements.yml
@@ -3,4 +3,8 @@ collections:
  - name: prometheus.prometheus
  - name: community.crypto
  - name: ansible.utils
-  - name: community.grafana
+  - name: community.grafana
+  # - name: geerlingguy.redis
+  - name: git+https://github.com/netways/ansible-collection-elasticstack.git
+  # - name: elastic.elasticsearch
+  # - name: geerlingguy.kibana
--- a/roles/requirements.yml
+++ b/roles/requirements.yml
@@ -47,4 +47,3 @@
  src: git+https://gitlab.epfl.ch/ansible-sti-roles/ansible-unattended-upgrades.git
 - name: ansible-role-labocbz-install-grafana
  src: git+https://gitlab.com/cbz-d-velop/public-ansible/ansible-role-labocbz-install-grafana.git
-