48 lines
1.5 KiB
Markdown
48 lines
1.5 KiB
Markdown
|
# CLAUDE.md
|
||
|
|
|
||
|
|
## Commandes Ansible
|
||
|
|
|
||
|
|
Toujours `--ask-vault-pass`, jamais `--vault-password-file`.
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# Déployer tout
|
||
|
|
ansible-playbook -i ansible/inventory/hosts.yml ansible/site.yml --ask-vault-pass
|
||
|
|
|
||
|
|
# Un seul playbook
|
||
|
|
ansible-playbook -i ansible/inventory/hosts.yml ansible/playbooks/forgejo.yml --ask-vault-pass
|
||
|
|
|
||
|
|
# Éditer le vault
|
||
|
|
ansible-vault edit ansible/inventory/group_vars/all/vault.yml --ask-vault-pass
|
||
|
|
```
|
||
|
|
|
||
|
|
## SSH agent (obligatoire avant Ansible)
|
||
|
|
|
||
|
|
```bash
|
||
|
|
eval $(ssh-agent -s) && ssh-add ~/.ssh/homelab
|
||
|
|
```
|
||
|
|
|
||
|
|
## Infrastructure
|
||
|
|
|
||
|
|
| Hôte | IP | Rôle |
|
||
|
|
|------|----|------|
|
||
|
|
| Proxmox | 192.168.1.242 | Hyperviseur |
|
||
|
|
| vm-gateway | 192.168.1.254 | WireGuard |
|
||
|
|
| vm-forgejo | 192.168.1.50 | Forgejo :3000 |
|
||
|
|
| vm-nextcloud | 192.168.1.51 | Nextcloud :8080 |
|
||
|
|
| vm-tools | 192.168.1.52 | Stirling PDF :8081 |
|
||
|
|
| VPS Scaleway | 51.158.126.113 | Caddy + WireGuard |
|
||
|
|
| QNAP | 192.168.1.208 | NAS NFS/SMB |
|
||
|
|
|
||
|
|
## Vault — variables clés
|
||
|
|
|
||
|
|
`vault_forgejo_db_password`, `vault_forgejo_domain`, `vault_nextcloud_db_password`,
|
||
|
|
`vault_nextcloud_admin_user`, `vault_nextcloud_admin_password`, `vault_nextcloud_domain`,
|
||
|
|
`vault_admin_password`, `vault_wg_*`
|
||
|
|
|
||
|
|
## Pièges connus
|
||
|
|
|
||
|
|
- Les VMs Rocky Linux utilisent `firewalld`, le VPS Debian utilise `ufw`
|
||
|
|
- Docker gère lui-même les règles firewalld — ne pas les gérer dans les playbooks
|
||
|
|
- `NEXTCLOUD_TRUSTED_DOMAINS` n'est lu qu'au premier démarrage — utiliser `occ` pour modifier après install
|
||
|
|
- Le VPS a `ansible_user: Elewyn` (root SSH désactivé)
|