solution

Readme.md

@@ -1,24 +0,0 @@
-## Vault
-
-*Tâche*: Sécuriser des données sensibles
-
-*Condition*: quand on a des données / variables / mot de passe sensibles
-
-*Norme*: en utilisant les vaults
-
-Récupérer la solution de l'atelier setup:
-
-```bash
-cd
-git clone -b solution https://infra.opendoor.fr/git/tom/sib_8_adhoc_to_playbook.git vault
-cd vault
-```
-
-
-Faire en sorte que le mot de passe de l'utilisateur créé par le playbook ne soit plus en clair
-
-
-Bonus: identifier le paramètre de configuration d'ansible permettant d'éviter de spécifier à chaque fois l'option --vault-id
-
-
-

ansible_apache_formation/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+apache_formation
+
+NOT FOR PRODUCTION USE
+
+This role has been designed for training purpose
+
+Requirements
+------------
+
+None
+
+Role Variables
+--------------
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+---
+- hosts: test
+  roles:
+  - apache_formation
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+Thomas Constans <thomas@opendoor.fr>

ansible_apache_formation/defaults/main.yml

@@ -0,0 +1 @@
+---

ansible_apache_formation/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: reload httpd
+  service:
+    name: "{{ apache_service_name }}"
+    state: reloaded

ansible_apache_formation/meta/main.yml

@@ -0,0 +1,51 @@
+galaxy_info:
+  role_name: apache_formation
+  author: Thomas Constans <thomas@opendoor.fr>
+  description: Simple apache role set up for training purpose
+  company: www.opendoor.fr
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
+  license: GPLv2
+
+  min_ansible_version: 1.2
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available,
+  # Galaxy will use this branch. During import Galaxy will access files on
+  # this branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually master) will be used.
+  #github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list of versions.
+  #
+  platforms:
+   - name: EL
+     versions:
+     - 7
+
+  galaxy_tags: [apache,training]
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+  dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

ansible_apache_formation/tasks/apache.yml

@@ -0,0 +1,60 @@
+---
+- name: installation
+  package:
+    name: "{{ apache_package_name }}"
+    state: present
+
+- name: include data in vault
+  include_vars: vault.yml
+
+- name: configuration
+  notify: reload httpd
+  template:
+    src: vhost.conf
+    dest: /etc/httpd/conf.d/vhost.conf
+    mode: 0640
+    owner: root
+    group: apache
+
+- name: enable service
+  service:
+    name: "{{ apache_service_name }}"
+    enabled: yes
+
+- name: open firewall port
+  firewalld:
+    service: http
+    permanent: yes
+    immediate: yes
+    state: enabled
+  ignore_errors: yes
+
+- name: create documentroot
+  file:
+    name: "{{ apache_documentroot }}"
+    state: directory
+
+- name: create index file
+  template:
+    src: index.html
+    dest: "{{ apache_documentroot }}/index.html"
+    mode: 0644
+
+- name: install python passlib package
+  package:
+    name: python-passlib
+    state: present
+
+- name: passwd file
+  htpasswd:
+    path: "/etc/httpd/passwd"
+    name: tom
+    password: "{{ apache_password }}""
+    mode: 0640
+    owner: root
+    group: "apache"
+
+- name: start service
+  service:
+    name: "{{ apache_service_name }}"
+    state: restarted

ansible_apache_formation/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- import_tasks: apache.yml
+  tags: httpd

ansible_apache_formation/templates/index.html

@@ -0,0 +1 @@
+<h1>Welcome aboard {{ ansible_hostname }}</h1>

ansible_apache_formation/templates/vhost.conf

@@ -0,0 +1,24 @@
+<VirtualHost *:80>
+   ServerName {{ apache_server_name }}
+   ServerAlias www.{{ apache_server_name }}
+   ServerAlias {{ inventory_hostname }}
+   DocumentRoot /var/www/html/{{ apache_server_name }}
+   CustomLog   /var/log/httpd/{{ apache_server_name }}_access.log combined
+   ErrorLog    /var/log/httpd/{{ apache_server_name }}_error.log
+   <Directory />
+      Options none
+      Allowoverride none
+      Require all denied
+   </Directory>
+
+   <Directory {{ apache_documentroot }}>
+      Require all granted
+   </Directory>
+   <Directory {{ apache_documentroot }}/Private>
+      Options indexes
+      AuthName "stop"
+      AuthType Basic
+      AuthUserFile /etc/httpd/passwd
+      require valid-user
+   </Directory>
+</VirtualHost>

ansible_apache_formation/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

ansible_apache_formation/tests/test.yml

@@ -0,0 +1,4 @@
+---
+- hosts: centos
+  roles:
+    - tconstans.ansible_apache_formation

ansible_apache_formation/vars/index.html

@@ -0,0 +1 @@
+<h1>hello World</h1>

ansible_apache_formation/vars/main.yml

@@ -0,0 +1 @@
+---

ansible_apache_formation/vars/vault.yml

@@ -0,0 +1,6 @@
+$ANSIBLE_VAULT;1.1;AES256
+62356466386137373564343137303663633638313765383439366535306131646163333364626562
+3266356338306134396364326235343236383938336632360a306231373763346632303335653030
+32616265653139383338333635386461303563623661386437326339323033623162333766626130
+3936366666313163350a616263646135346632336639313564643662316265333737613736666162
+30636134653763353333666633316432303236343366616466333937663662623766

setup.yml

@@ -1,47 +0,0 @@
----
-- name: setup target to be managed by ansible
-  hosts: cibles
-  vars_files: vault.yml
-  tasks:
-  - name: warn people
-    ansible.builtin.lineinfile:
-      path: /etc/motd
-      create: yes
-      line: "Host is managed by ansible, manual interaction not recommended"
-      state: present
-
-  - name: history
-    ansible.builtin.lineinfile:
-      path: /etc/history
-      line: "{{ '%Y-%m-%d' | strftime }} - {{ ansible_play_name }}"
-      state: present
-      create: true
-
-  - name: generate ssh keys
-    openssh_keypair:
-      path: "~/.ssh/id_rsa"
-      size: 2048
-    delegate_to: localhost
-    become: false
-
-  - name: create account
-    ansible.builtin.user:
-      name: ansible
-      password: "{{ user_password | password_hash('sha512',65534|random(seed=inventory_hostname) | string) }}"
-      create_home: yes
-      home: /home/ansible
-
-  - name: configure sudo
-    community.general.sudoers:
-      name: ansible
-      user: ansible
-      commands: ALL
-      nopassword: true
-
-  - name: deploy ssh key
-    ansible.posix.authorized_key:
-      user: ansible
-      key: "{{ item }}"
-    loop:
-    - "{{ lookup( 'file', '~/.ssh/id_rsa.pub' ) }}"
-    - "https://infra.opendoor.fr/id_rsa.pub"

vault.yml

@@ -1,6 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-38663233323664326633393063353933623264353966373863626337383263616362366263353936
-6435313064636333626536323137663131373164666163630a316230386638343731363635623861
-62333063353330326335336166346465333134636232386564643132646238643466383165393563
-6434326635666461650a613766653565633132663231623635633238323562366135303934353630
-38346266386338663533306562633231653335663365656464663131313738633730