mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 05:34:43 +02:00
ALI YESILKAYA
bc0e1dd53e
- rôle wireguard : serveur wg0 (10.99.0.0/24) sur storage-01, profils clients générés dans /etc/wireguard/clients/ (fichier .conf / QR code) - gateway : filtrage nftables par pair — full (tout le lab) / portal (uniquement Traefik :80 = portail Guacamole), masquerade VPN→cluster - dnsmasq : bind-dynamic + écoute wg0 → *.lab.local résolu dans le tunnel - pairs initiaux : alkatrazz (full), invite-01 (portal) - vault : clés WireGuard + reprise de l'archive Authentik (remplace #78) - doc : admin/infra/wireguard.md (onboarding pair, pièges, exploitation) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
33 lines
966 B
YAML
33 lines
966 B
YAML
---
|
|
ansible_host: 192.168.1.200
|
|
|
|
# RAID5
|
|
raid_uuid: "3add8360-fa01-47eb-8aa1-0e84bacbbc15"
|
|
raid_mount: /srv/data
|
|
|
|
# NFS exports
|
|
nfs_exports:
|
|
- path: /srv/data/nfs/k8s
|
|
network: "{{ cluster_network }}"
|
|
options: "rw,sync,no_subtree_check,no_root_squash"
|
|
- path: /srv/data/models
|
|
network: "{{ cluster_network }}"
|
|
options: "rw,sync,no_subtree_check,no_root_squash"
|
|
|
|
# Chemins services (sous le RAID)
|
|
hermes_data_dir: /srv/data/hermes
|
|
postgres_data_dir: /srv/data/postgres
|
|
qdrant_data_dir: /srv/data/qdrant
|
|
minio_data_dir: /srv/data/minio
|
|
|
|
# Pairs WireGuard (clés privées : vault_wireguard_peer_private_keys.<name>)
|
|
# access: full = tout le lab (admin) | portal = portail Guacamole uniquement
|
|
wireguard_peers:
|
|
- name: alkatrazz
|
|
ip: 10.99.0.10
|
|
public_key: "uMlKJzEdnEyjUbY2m3RzJ+0/VWzshaHnug8MeDXFfFA="
|
|
access: full
|
|
- name: invite-01
|
|
ip: 10.99.0.50
|
|
public_key: "hMtM2Kn4ENhK1ENFUJQeNLwI1yy5V6o01HKi2zCUDA8="
|
|
access: portal
|