Étude de cas : cloud (IaC)

# .cloud/app.yml — déclaration d'une app
name: granit-golem
type: compose
domain: granit-golem.tordu-jardin.fr
database:
  type: postgresql
  version: "17"
monitoring:
  prometheus: true
  alerts: true
deploy:
  strategy: blue-green

# roles/monitoring/tasks/main.yml
- name: Deploy Prometheus stack
  docker_compose:
    project_name: monitoring
    definition:
      services:
        prometheus:
          image: prom/prometheus:v2.51.0
          volumes:
            - ./prometheus.yml:/etc/prometheus/prometheus.yml
            - prometheus_data:/prometheus
          command:
            - '--config.file=/etc/prometheus/prometheus.yml'
            - '--storage.tsdb.retention.time=30d'

        grafana:
          image: grafana/grafana:11.0.0
          environment:
            GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
            GF_AUTH_GENERIC_OAUTH_NAME: "Authentik"
          labels:
            traefik.enable: "true"
            traefik.http.routers.grafana.rule: "Host(`grafana.tordu-jardin.fr`)"

        loki:
          image: grafana/loki:3.0.0
          volumes:
            - loki_data:/loki

        promtail:
          image: grafana/promtail:3.0.0
          volumes:
            - /var/log:/var/log:ro
            - /var/lib/docker/containers:/var/lib/docker/containers:ro

# roles/base-hardening/tasks/main.yml
- name: SSH hardening
  template:
    src: sshd_config.j2
    dest: /etc/ssh/sshd_config
  notify: restart sshd

- name: Configure UFW defaults
  ufw:
    state: enabled
    policy: deny
    direction: incoming

- name: Allow SSH via WireGuard only
  ufw:
    rule: allow
    port: "{{ ssh_port }}"
    interface: wg0

- name: Configure Fail2ban
  template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
  notify: restart fail2ban

- name: Enable AppArmor profiles
  command: aa-enforce /etc/apparmor.d/docker-*
  when: apparmor_profiles | length > 0

# roles/authentik/tasks/main.yml
- name: Deploy Authentik SSO
  docker_compose:
    project_name: authentik
    definition:
      services:
        server:
          image: ghcr.io/goauthentik/server:2024.4
          environment:
            AUTHENTIK_SECRET_KEY: "{{ vault_authentik_secret }}"
          labels:
            traefik.enable: "true"
            traefik.http.routers.authentik.rule: "Host(`auth.tordu-jardin.fr`)"

# roles/backup/tasks/main.yml
- name: Configure Restic backup
  template:
    src: backup.sh.j2
    dest: /opt/backup/backup.sh
    mode: '0700'

- name: Setup backup cron (daily 3am)
  cron:
    name: "restic-backup"
    hour: "3"
    minute: "0"
    job: "/opt/backup/backup.sh >> /var/log/backup.log 2>&1"

# templates/backup.sh.j2
#!/bin/bash
set -euo pipefail

# Restic snapshot
restic backup \
  --tag {{ inventory_hostname }} \
  --exclude-caches \
  /opt/docker /etc/traefik /etc/wireguard

# PostgreSQL WAL-G PITR
for db in {{ postgresql_databases | join(' ') }}; do
  wal-g backup-push --pgdata /var/lib/postgresql/data
done

# Retention: 7 daily, 4 weekly, 6 monthly
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

# Notify success
curl -s -d "Backup OK: {{ inventory_hostname }}" \
  {{ ntfy_url }}/backup-{{ inventory_hostname }}

# .gitlab-ci.yml
stages:
  - lint
  - validate
  - deploy

lint:
  stage: lint
  script:
    - ansible-lint playbook.yml
    - yamllint -c .yamllint.yml .

syntax-check:
  stage: validate
  script:
    - ansible-playbook playbook.yml --syntax-check
    - ansible-playbook playbook.yml --check --diff
  variables:
    ANSIBLE_HOST_KEY_CHECKING: "false"

deploy:
  stage: deploy
  script:
    - make deploy INSTANCE=tordu-jardin
  when: manual
  only:
    - main
  environment:
    name: production
    url: https://tordu-jardin.fr