Attention ! Gitlab fournissant maintenant nativement des certificats Let’s Encrypt aux domaines personnalisés des Gitlab Pages, nous avons coupé notre service qui le faisait automatiquement pour vous.

Il est impératif, pour que votre domaine personnalisé continue à avoir un certificat Let’s Encrypt à jour, d’activer la fonctionnalité native dans les paramètres de votre projet. Cette activation remplacera votre certificat actuel par un nouveau certificat Let’s Encrypt géré par Gitlab.

Voir les détails sur https://docs.framasoft.org/fr/gitlab/gitlab-pages-le.html

Commit ccc065e5 authored by Clément Igonet's avatar Clément Igonet

Add C.I. files

parent 6bbdaafb
This init step set ssh key pair for next ssh connection.
......@@ -5,9 +5,8 @@
tasks:
- name: install basic packages
apt: name={{ item }} state=present update_cache=yes
apt: name={{ item }} state=latest update_cache=yes
with_items:
- "sudo"
- "aptitude"
- "sshpass"
- "file"
......
......@@ -5,4 +5,3 @@ becky.framasoft.org
ansible_port=22
ansible_host=becky.framasoft.org
ansible_user=piz
ansible_ssh_private_key_file=~/.ssh/id_rsa_becky
---
- name: Set up iptables
hosts: all
become: yes
tasks:
- name: install basic packages
apt: name={{ item }} state=present update_cache=yes
with_items:
- "iptables"
- "iptables-persistent"
register: packages
- debug: var=packages.stdout_lines
# -A INPUT -i lo -j ACCEPT
- iptables: chain=INPUT in_interface=lo jump=ACCEPT
# -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
- iptables: chain=INPUT in_interface=!lo destination=127.0.0.0/8 jump=REJECT
# -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
- iptables: chain=INPUT ctstate=ESTABLISHED,RELATED jump=ACCEPT
# -A OUTPUT -j ACCEPT
- iptables: chain=OUTPUT jump=ACCEPT
# -A INPUT -p tcp -m state --state NEW --dport 11166 -j ACCEPT
- iptables: chain=INPUT protocol=tcp ctstate=NEW destination_port=22 jump=ACCEPT
- iptables: chain=INPUT protocol=tcp ctstate=NEW destination_port=11166 jump=ACCEPT
# -A INPUT -p tcp --dport 20 -j ACCEPT
- iptables: chain=INPUT protocol=tcp destination_port=20 jump=ACCEPT
# -A INPUT -p tcp --dport 21 -j ACCEPT
- iptables: chain=INPUT protocol=tcp destination_port=21 jump=ACCEPT
# -A INPUT -p tcp --dport 30000:30009 -j ACCEPT
- iptables: chain=INPUT protocol=tcp destination_port=30000:30009 jump=ACCEPT
#-A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
- iptables: chain=INPUT ctstate=NEW protocol=tcp destination_port=80 jump=ACCEPT
#-A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
- iptables: chain=INPUT ctstate=NEW protocol=tcp destination_port=443 jump=ACCEPT
# -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
- iptables: chain=INPUT protocol=icmp match=icmp icmp_type=8 jump=ACCEPT
# -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
- iptables: chain=INPUT match=limit limit=5/min jump=LOG
# -A INPUT -j REJECT
- iptables: chain=INPUT jump=REJECT
# -A FORWARD -j REJECT
- iptables: chain=FORWARD jump=REJECT
......@@ -5,13 +5,15 @@
tasks:
- name: install basic packages
apt: name={{ item }} state=present update_cache=yes
apt: name={{ item }} state=latest update_cache=yes
with_items:
- "sudo"
- "aptitude"
- "sshpass"
- "file"
- "screen"
- "cifs-utils"
- "nfs-common"
register: packages
become: yes
- debug: var=packages.stdout_lines
---
- name: docker
hosts: all
become: yes
tasks:
......@@ -9,42 +10,41 @@
with_items:
- apt-transport-https
- ca-certificates
sudo: yes
- name: install python-pip
easy_install: name=pip
sudo: yes
- name: install docker-py
pip: name=docker-py version=1.2.3
sudo: yes
- name: register apt docker key
apt_key:
keyserver: p80.pool.sks-keyservers.net
id: 58118E89F3A912897C070ADBF76221572C52609D
sudo: yes
- name: add docker repo
apt_repository: repo='deb https://apt.dockerproject.org/repo debian-wheezy main' state=present
sudo: yes
apt_repository: repo='deb https://apt.dockerproject.org/repo debian-jessie main' state=present
- name: Install docker packages
apt: name={{ item }} state=present update_cache=yes
apt: name={{ item }} state=latest update_cache=yes
with_items:
- docker-engine
sudo: yes
- name: Stop docker service
service:
name: docker
state: stopped
sudo: yes
- name: Setup docker daemon options
lineinfile:
dest: /etc/default/docker
state: present
regexp: '^DOCKER_OPTS'
line: 'DOCKER_OPTS="--iptalbes=true"'
- name: Set oev user properties
shell: |
usermod -a -G docker oev
sudo: yes
- name: Kill SSH
shell: sleep 1; pkill -u {{ ansible_ssh_user }} sshd
......@@ -56,4 +56,3 @@
name: docker
state: started
enabled: yes
sudo: yes
......@@ -7,8 +7,8 @@ ansible-playbook \
--private-key=~/.ssh/id_rsa_becky \
--user=oev \
--connection=ssh \
--inventory-file=./inventory \
--inventory-file=./ansible/inventory \
--limit='becky.framasoft.org' \
./playbook.yml \
-vvvv \
--extra-vars "ansible_sudo_pass=$1"
--extra-vars "ansible_sudo_pass=$1" \
./ansible/playbook.yml
......@@ -4,12 +4,11 @@ PYTHONUNBUFFERED=1 ANSIBLE_FORCE_COLOR=true \
ANSIBLE_HOST_KEY_CHECKING=false \
ANSIBLE_SSH_ARGS='-o UserKnownHostsFile=/dev/null -o ControlMaster=auto -o ControlPersist=60s' \
ansible-playbook \
--private-key=~/.ssh/id_rsa_becky \
--user=piz \
--connection=ssh \
--inventory-file=./inventory \
--inventory-file=./ansible-init/inventory \
--limit='becky.framasoft.org' \
./playbook.yml \
-vvvv \
--extra-vars "ansible_sudo_pass=$1"
--extra-vars "ansible_become_pass=$1" \
--extra-vars "ansible_ssh_pass=$1" \
./ansible-init/playbook.yml
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment