diff --git a/group_vars/all/vault b/group_vars/all/vault index 06c05b4..2afa306 100644 --- a/group_vars/all/vault +++ b/group_vars/all/vault @@ -1,19 +1,24 @@ $ANSIBLE_VAULT;1.1;AES256 -30313131626662343730326264376636313733356163633234333166313461626464306139663664 -3862353032373664326135313361616537313037356261640a646335363631303139623962336666 -65323365633437653666343132343965383732376335633833333235373237383533363764643737 -6130346135633637350a643364626532306535663363376239353537613532303862386231393631 -62363232303237643639333730346463623834626339333566623434396638303234323631643337 -36373362656233356532386234613764373539356232323935623636633938333135343963366236 -62383365346232663865333837636135646462613136353734333434313537316437363638373430 -64656433386366376361653363656631623363393034323239653135653963366263363562633535 -34663863643436313266363763396339346634343731333035663635643335656366636562636135 -64616536326165326263386431363662336234653430333531663539343733353239353062303430 -37643830343430616265623361363332646665326134366166353666633164363732656635323562 -37313130363832356431633862333233353632633161396535663463633565356435363663663431 -32613162356632666139373033613036316666366134376561643865323730373939333964613231 -33326332366438663865363437366363343335336431616161393530323066623538656662383832 -64623430653530356433386538343761363964373365343435353862656166653731363833663062 -33386263623834326166303161316466303530653935623533393064653562656230376439613862 -36336439383565343731646134646132373035326234613833623863646230313164346464663036 -6633623162396638356235393837646261626337343861626434 +62383664313030336230613936653439373863643231333139336331356237613831343333613163 +3137653661393266363133313965653834383266616531320a363130313239666461326334386331 +64613937353366643338376666633634326234393662336335666338626536626330366465366439 +3331626161386439380a336638336631363233383031346561393166666530356438366639333236 +35323565323166613337623435633135323333366561396235666435326661316464393433356266 +32653839316538373336663430373762656262663764363738613539633562306530323466373335 +37396465313766323235396338386362373765326432663362653733646339646261616466396164 +30353736663130333937346339303361663232643430666561376237316461383466363037653264 +62316161386539343738636162366638636261633866336136616132646365303563623131396336 +66396165623430343038386537613865316465363361633464383236393864663836323038653936 +65383965613861323337373438363431623665613563373764393336306431616566376437373664 +37303234326439393333656266356338346632363632643331363839353364633130333834613134 +33643164373231343765666239386439386139396166373061646431396439666632363564373034 +65383137356331363037346261613433396637643137383362653334633037656361626630343766 +66333030363062313365646366663034646331306563336262386266653431303064373734613231 +32656163363131626538333434376535303631613463636563313930323736356536623166366437 +32306538643638613565353265653761663431346334633339663939356264383630336535336335 +38323830646133363933633134323265353664356164636434353838363639633430383633653839 +39316333646130313863373163643239353264336565343430613731333665633566313934336261 +32316536303138316330326133363064376638336630363365343038633762356461326538633764 +39663264393437393630613665643865356337626537626531303763323634613036623630363935 +61386366323835663032383864373136653331373434653931316431303262323831313335613439 +333464616666376634383765393465616133 diff --git a/host_vars/jitsi.komuniki.fr.yml b/host_vars/jitsi.komuniki.fr.yml new file mode 100644 index 0000000..e058397 --- /dev/null +++ b/host_vars/jitsi.komuniki.fr.yml @@ -0,0 +1,3 @@ +--- +jitsi_logo: logo-komki.svg +jitsi_logo_url: https://komuniki.fr \ No newline at end of file diff --git a/host_vars/pp.visio.nereide.fr.yml b/host_vars/pp.visio.nereide.fr.yml index 7349b5a..e058397 100644 --- a/host_vars/pp.visio.nereide.fr.yml +++ b/host_vars/pp.visio.nereide.fr.yml @@ -1,5 +1,3 @@ --- -jitsi_user: nereide -jitsi_pass: ofbiz -jitsi_logo: logo_Nereide_monochrome-blanc.svg -jitsi_logo_url: https://nereide.fr +jitsi_logo: logo-komki.svg +jitsi_logo_url: https://komuniki.fr \ No newline at end of file diff --git a/host_vars/visio.nereide.fr.yml b/host_vars/visio.nereide.fr.yml deleted file mode 100644 index 640c42d..0000000 --- a/host_vars/visio.nereide.fr.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -jitsi_user: nereide -jitsi_pass: ofbiz -jitsi_logo: logo_Nereide_monochrome-blanc.svg -jitsi_logo_url: https://toto.fr diff --git a/inventory_prod b/inventory_prod index 3b4d78e..6a31c1a 100644 --- a/inventory_prod +++ b/inventory_prod @@ -1,4 +1,3 @@ -visio.nereide.fr ansible_user=root -visio443.champs-libres.be ansible_user=debian ansible_become=true +jitsi.komuniki.fr ansible_user=root visio.imio.be ansible_user=debian ansible_become=true jitsi.entrouvert.com ansible_user=root diff --git a/inventory_staging b/inventory_staging index 9334a36..76a82be 100644 --- a/inventory_staging +++ b/inventory_staging @@ -1,3 +1 @@ -visio.nereide.fr pp.visio.nereide.fr ansible_user=root -pp.imio.nereide.fr ansible_user=root diff --git a/playbook_prod.yml b/playbook_prod.yml index df20906..8e9e820 100644 --- a/playbook_prod.yml +++ b/playbook_prod.yml @@ -3,7 +3,6 @@ roles: - role: jitsi-pre-install - role: jitsi-install - - role: jitsi-enable-LE - role: jitsi-enable-fr-ln - role: jitsi-add-logo - role: jitsi-enable-video-optimisation @@ -11,23 +10,23 @@ tags: - imio -- hosts: visio.nereide.fr +- hosts: jitsi.komuniki.fr roles: - role: jitsi-pre-install - role: jitsi-install - - role: jitsi-enable-LE + - role: jitsi-enable-prejoinPage - role: jitsi-enable-stats - role: jitsi-enable-fr-ln - role: jitsi-enable-video-optimisation - role: jitsi-add-logo + - role: jitsi-enable-calendar tags: - - nrd + - komki - hosts: visio443.champs-libres.be roles: - role: jitsi-pre-install - role: jitsi-install - - role: jitsi-enable-LE - role: jitsi-enable-fr-ln - role: jitsi-enable-video-optimisation - role: jitsi-enable-stats @@ -39,7 +38,6 @@ - hosts: jitsi.entrouvert.com roles: - role: jitsi-pre-install - - role: jitsi-enable-LE - role: jitsi-enable-fr-ln - role: jitsi-enable-video-optimisation tags: diff --git a/playbook_staging.yml b/playbook_staging.yml index 7901797..486fe35 100644 --- a/playbook_staging.yml +++ b/playbook_staging.yml @@ -1,39 +1,14 @@ -#Roles possible: -# - role: jitsi-pre-install -# - role: jitsi-install -# - role: jitsi-enable-LE -# - role: jitsi-enable-fr-ln -# - role: jitsi-enable-video-optimisation -# - role: jitsi-enable-stats -# - role: jitsi-enable-auth - +#Roles possible: cf dossier roles --- - hosts: pp.visio.nereide.fr roles: + - role: jitsi-pre-install + - role: jitsi-install + - role: jitsi-enable-prejoinPage + - role: jitsi-add-logo + - role: jitsi-enable-fr-ln + - role: jitsi-enable-video-optimisation - role: jitsi-enable-stats + - role: jitsi-enable-calendar tags: - ppnrd - -- hosts: pp.visio.nereide.fr - roles: - - role: jitsi-enable-LE - - role: jitsi-enable-fr-ln - - role: jitsi-enable-video-optimisation - - role: jitsi-enable-stats - tags: - - ppnrd-post-install - -- hosts: pp.imio.nereide.fr - roles: - - role: jitsi-pre-install - tags: - - ppimio-pre-install - -- hosts: pp.imio.nereide.fr - roles: - - role: jitsi-enable-LE - - role: jitsi-enable-fr-ln - - role: jitsi-enable-video-optimisation - - role: jitsi-enable-stats - tags: - - ppimio-post-install \ No newline at end of file diff --git a/roles/jitsi-add-logo/files/logo-komki.svg b/roles/jitsi-add-logo/files/logo-komki.svg new file mode 100644 index 0000000..a5acade --- /dev/null +++ b/roles/jitsi-add-logo/files/logo-komki.svg @@ -0,0 +1,135 @@ + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + diff --git a/roles/jitsi-add-logo/tasks/main.yml b/roles/jitsi-add-logo/tasks/main.yml index cf67141..ab152dd 100644 --- a/roles/jitsi-add-logo/tasks/main.yml +++ b/roles/jitsi-add-logo/tasks/main.yml @@ -3,12 +3,14 @@ template: src: ../files/{{ jitsi_logo }} dest: /usr/share/jitsi-meet/images/ + mode: u=rw,g=r,o=r -- name: Modif du css pour appliquer le nouveau logo - replace: - path: /usr/share/jitsi-meet/css/all.css - regexp: 'watermark.png' - replace: "{{ jitsi_logo }}" +- name: Application du logo si déclaré dans les variables + lineinfile: + path: /usr/share/jitsi-meet/interface_config.js + regexp: "DEFAULT_LOGO_URL: " + line: "DEFAULT_LOGO_URL: 'images/{{ jitsi_logo }}'," + when: jitsi_logo is defined - name: Application de l'url si déclaré dans les variables lineinfile: diff --git a/roles/jitsi-enable-LE/tasks/main.yml b/roles/jitsi-enable-LE/tasks/main.yml deleted file mode 100644 index 79f36b2..0000000 --- a/roles/jitsi-enable-LE/tasks/main.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- -- name: Conf let's encrypt - désactivation de la demande du mail de supervision - replace: - path: /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh - regexp: "^read EMAIL" - replace: | - #read EMAIL - EMAIL=supervision@nereide.fr - -- name: Exécution du script lets encrypt - shell: /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh >> jitsi-le.log diff --git a/roles/jitsi-enable-calendar/tasks/main.yml b/roles/jitsi-enable-calendar/tasks/main.yml new file mode 100644 index 0000000..fcd9afa --- /dev/null +++ b/roles/jitsi-enable-calendar/tasks/main.yml @@ -0,0 +1,9 @@ +--- +- name: Conf Jitsi - Activation de la connexion au google calendar + blockinfile: + path: /etc/jitsi/meet/{{ inventory_hostname }}-config.js + marker: "// {mark} ANSIBLE MANAGED BLOCK CALENDAR" + insertafter: "[^?]// enableCalendarIntegration: false," + block: | + enableCalendarIntegration: true, + googleApiApplicationClientID: "{{ vault_google_api_client_id }}", diff --git a/roles/jitsi-enable-fr-ln/tasks/main.yml b/roles/jitsi-enable-fr-ln/tasks/main.yml index d872eaf..200d7e3 100644 --- a/roles/jitsi-enable-fr-ln/tasks/main.yml +++ b/roles/jitsi-enable-fr-ln/tasks/main.yml @@ -1,10 +1,4 @@ --- -- name: Conf Jitsi - UI en fr - lineinfile: - path: /etc/jitsi/meet/{{ inventory_hostname }}-config.js - insertafter: "[^?]// defaultLanguage: 'en'" - line: " defaultLanguage: 'fr'," - - name: Conf Jitsi - UI en fr lineinfile: path: /usr/share/jitsi-meet/interface_config.js diff --git a/roles/jitsi-enable-prejoinPage/tasks/main.yml b/roles/jitsi-enable-prejoinPage/tasks/main.yml new file mode 100644 index 0000000..fbf1af8 --- /dev/null +++ b/roles/jitsi-enable-prejoinPage/tasks/main.yml @@ -0,0 +1,6 @@ +--- +- name: Conf Jitsi - Activation de la page de pré-connexion a la room + lineinfile: + path: /etc/jitsi/meet/{{ inventory_hostname }}-config.js + insertafter: "[^?]// prejoinPageEnabled: false," + line: " prejoinPageEnabled: true," diff --git a/roles/jitsi-enable-stats/tasks/main.yml b/roles/jitsi-enable-stats/tasks/main.yml index ca36134..521b3e2 100644 --- a/roles/jitsi-enable-stats/tasks/main.yml +++ b/roles/jitsi-enable-stats/tasks/main.yml @@ -42,20 +42,14 @@ template: src: ../templates/telegraf-input-jitsi.conf dest: /etc/telegraf/telegraf.d/jitsi.conf + mode: u=rw,g=r,o=r notify: - restart telegraf -- name: Question - pause: - prompt: "Vers quel influxdb/grafana souhaitez vous envoyer les metrics?\n1- Néréide\n2- Champs-Libres\n" - register: prompt_input - - name: Application de la conf Telegraf - vars: - outputnrd: prompt_input.user_input == "1" - outputcl: prompt_input.user_input == "2" template: src: ../templates/telegraf-general.conf.j2 dest: /etc/telegraf/telegraf.conf + mode: u=rw,g=r,o=r notify: - - restart telegraf \ No newline at end of file + - restart telegraf diff --git a/roles/jitsi-enable-stats/templates/telegraf-general.conf.j2 b/roles/jitsi-enable-stats/templates/telegraf-general.conf.j2 index b3ba4f0..7ab1275 100644 --- a/roles/jitsi-enable-stats/templates/telegraf-general.conf.j2 +++ b/roles/jitsi-enable-stats/templates/telegraf-general.conf.j2 @@ -21,11 +21,12 @@ ############################################################################### [[outputs.influxdb]] -{% if outputnrd %} urls = [ "https://influxdb.nereide.fr" ] username = "telegraf" password = "{{ vault_telegraf_nrd_passwd }}" -{% elif outputcl %} + +{% if "visio.imio.be" == inventory_hostname %} + [[outputs.influxdb]] urls = [ "https://influxdb.gra1.metrics.ovh.net" ] username = "metrics" password = "{{ vault_telegraf_cl_passwd }}" @@ -35,14 +36,27 @@ # INPUTS # ############################################################################### -[[inputs.processes]] [[inputs.cpu]] - percpu = false + percpu = true + totalcpu = true + fielddrop = ["time_*"] + [[inputs.disk]] - interval = "3600s" - ignore_fs = ["tmpfs", "devtmpfs", "devfs", "iso9660", "overlay", "aufs", "squashfs"] - fielddrop = ["total","used","inodes_free","inodes_total","inodes_used"] + ignore_fs = ["tmpfs", "devtmpfs", "none", "iso9660", "overlay", "aufs", "squashfs"] + +[[inputs.diskio]] + +[[inputs.kernel]] + [[inputs.mem]] - fielddrop=["buffered","cached","slab","available_percent","used_percent","wired","commit_limit","commited_as","dirty","high_free","high_total","huge_page_size","huge_pages_free","huge_pages_total","low_free","low_total","mapped","page_tables","shared","sreclaimable","sunreclaim","swap_total","vmalloc_chunk","vmalloc_total","vmalloc_used","write_back","write_back_tmp"] + +[[inputs.swap]] + +[[inputs.net]] + fieldpass = [ "bytes*" ] + +[[inputs.netstat]] + +[[inputs.processes]] + [[inputs.system]] - fielddrop=["n_users","uptime_format","uptime","n_cpus"] diff --git a/roles/jitsi-install/tasks/main.yml b/roles/jitsi-install/tasks/main.yml index 1cd3548..5da2b98 100644 --- a/roles/jitsi-install/tasks/main.yml +++ b/roles/jitsi-install/tasks/main.yml @@ -2,3 +2,16 @@ - name: installation de jitsi apt: name: jitsi-meet + +- name: Conf let's encrypt - désactivation de la demande du mail de supervision + replace: + path: /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh + regexp: "^read EMAIL" + replace: | + #read EMAIL + EMAIL=supervision@nereide.fr + +- name: Exécution du script lets encrypt + shell: + cmd: /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh >> jitsi-le.log + removes: /etc/letsencrypt/live/jitsi.komuniki.fr/fullchain.pem diff --git a/roles/jitsi-pre-install/tasks/main.yml b/roles/jitsi-pre-install/tasks/main.yml index 73c113c..509e6be 100644 --- a/roles/jitsi-pre-install/tasks/main.yml +++ b/roles/jitsi-pre-install/tasks/main.yml @@ -1,11 +1,12 @@ --- -- name: Installation de fail2ban, nftables, gnupg2, apt-transport-https +- name: Installation de fail2ban, nftables, gnupg2, apt-transport-https, ufw apt: name: - fail2ban - nftables - gnupg2 - apt-transport-https + - ufw update_cache: true state: present @@ -36,6 +37,20 @@ - restart nftables - restart fail2ban +- name: Mise en place des règle firewall tcp et udp + #source : https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-quickstart#setup-and-configure-your-firewall + ufw: + state: enabled + rule: allow + port: '{{ item[0] }}' + proto: '{{ item[1] }}' + loop: + - ['80','tcp'] + - ['443','tcp'] + - ['4443','tcp'] + - ['22','tcp'] + - ['10000','udp'] + - name: Ajout de la clé GPG pour le depot jitsi apt_key: url: http://download.jitsi.org/jitsi-key.gpg.key