add redirect www.clarissariviere.fr

Reviewed-on: #3

blacklist/vps-host/etc/sentinel/blacklist

@@ -53,3 +53,26 @@
 89.187.162.187
 206.189.38.98
 2.57.122.253
+172.105.190.200
+15.188.26.9
+13.49.23.69
+20.87.214.199
+45.55.64.12
+188.166.187.222
+167.71.24.123
+185.213.174.115
+165.232.174.66
+161.35.153.48
+54.219.74.101
+2.57.122.81
+165.22.96.121
+43.153.118.27
+43.153.12.17
+185.180.143.141
+18.144.156.146
+193.56.29.113
+3.129.42.4
+169.197.143.220
+3.15.142.108
+139.162.34.62
+80.66.79.22

inventory/host_vars/vps-host

@@ -1,18 +1,36 @@
 $ANSIBLE_VAULT;1.1;AES256
-31393265313635666339373930656266363533626234383533313734323964386463363739363664
-3362323965366165643139326433646535303931616338390a316232656464383534383361313032
-39303032376339303830643866356464303235633736623134313334646361363265393330653432
-6338626261383734380a333662613238323038616637643162626436376536326461396461303866
-36383835363639633530653238353564643438616238663263363837343436636531656332303266
-37303663303139393636663334313130356231643639633833636563356137393930383639613337
-31353336346531313561336464643332333234656236386330316236376234306463663164623435
-62386665383332316133383035366162323636323638323965643532356634333836323562303132
-61396539633336346436346466306339316461613732383738666663366233373261396366353039
-61303966326130326531393837333562383337646463393435643336303465393935623938346530
-64623864313332613633333162623736643030363833346133643838383534656430336332333331
-61383661353932383961303537306233333864623531316239653131346436313035643461633032
-33376338326466616230373465643236343937653839316562633630393162373936306364633765
-32306337656639386330386334653262313663363062356263623165366164663764646430373162
-36353539376234386465393637303533323662353965663936623464633066386239623637373539
-39323637653361663730633735396133636539303133306164373838623930663364306135353938
-3935
+65333737373761626438343263333163623934626161313738303239383134333133313661333739
+3765666232653562383861643033356535383230613564330a343931393265303332346339373161
+31653534646463333138633564663238323664313432343666613633353538323530323631326665
+3133303461303966310a626664396637313532313666386236303765613530343863636636346334
+33633536656337643962663564656465666636623734376162366233643431343966373737613064
+62336665386635316433636166353263356131383632616665643935616131333230343965613834
+63323363616535363437306362613934633533386438353466353138386438313063316565616636
+66643535356364396230653032643661316534356266333035323766306165383562653836313532
+31396432316564633933363338393535363937386533343137373664366538323836343038313062
+61383630386233313034353966383265333735303064333535643738633362336362323565326131
+66666565376663383733616136386462353937613364653932353062386665623439613933366535
+61343134323031343133626265336231306131376661396163333939643561356363306333666637
+64353137643238653562643034383262356266366636333135616262643436363638666166336565
+63346131346238666166303338303264363634373635663830663636656661303935623239346339
+33306564313566343339626362333735343737333763616330303266353836303438323131306161
+61303633636335636335383734326638663238313961653561613164333865383364323234383133
+65626130376434343165373531643935616431316631636165323365376564646535613534616237
+65303430373336383436373162376536376563623730343237366435653163613337303538643062
+66643361613732366431336231363133326435623361663366646537386433613262326161303966
+39363732653361646534653866326436666462346235376664623039343431373938666266313034
+62373639323039656266623562326634633131623964313666646463383064303266643162636362
+35646563623533303466636631646339626464306665383266643839653734373465313538363035
+33313762313934396137323433313238393239623831663430396530303764336338356366646264
+36393038633033303066346339663939653964333735303465626139613464313437356264373562
+34376230333834373831363661636461383763383138653537383235343132623830326532393564
+61646265303835306534346433303138306632306163613336393834313337306233376665313262
+35396630666162373432313939646537666335343835613363653334313234356564373431366537
+37323838323835386538343261633762303035336665656638636165303130343733633766656333
+33623861633664626232316434326138303539363130333561323630393932363735363362663832
+64393965346131396236653864323930633763303435613330386236633164636465646664396530
+35343838323364643236383334663432316339613231613030643935333932633732313635633164
+63663861323663613931636238313862326364396538616463376533396136653266393136663265
+65613862333066643030656263333534343161613638356264663635643430356563313561633535
+30303165663931633761363633383237333765383332363962353530313036346561383539643966
+336562336464303538313234386162383165

playbook.yml

@@ -1,5 +1,5 @@
 ---
 - hosts: all
-  remote_user: admloc
+  remote_user: valentin
   roles:
     - deploy-web

roles/deploy-web/files/backup_canalblog.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+TAR=/usr/bin/tar
+PYTHON=/usr/bin/python3
+GZIP=/usr/bin/gzip
+SCRIPTDIR=/home/valentin/script
+WEBSCRAP=${SCRIPTDIR}/web_scrap.py
+URL=www.clarissariviere.com
+DATE=$(date +%Y%m%d)
+DIRECTORY=/home/valentin/backup
+BACKUPDIR=/home/valentin/backup_clarissa
+LIST=${BACKUPDIR}/backup.list
+fileBackup="backup-clarissa-${DATE}"
+LOGFILE=web_scrap.txt
+SENDER="valczebackup@gmail.com"
+if [ $(date +%u) -eq 1 ]; then
+	echo > ${LIST}
+	rm -rf "${BACKUPDIR}/*-incr.tar.gz"
+	fileBackup="${fileBackup}-full"
+	subject="Sauvegarde full"	
+else
+	fileBackup="${fileBackup}-incr"
+	subject="Sauvegarde incremental"
+fi
+subject="${subject} ${URL} ${DATE}"
+echo > ${BACKUPDIR}/${LOGFILE}
+${PYTHON} ${WEBSCRAP} --url ${URL} --dir ${DIRECTORY}  --logfile ${BACKUPDIR}/${LOGFILE} --quiet
+if [ ${?} -ne 0 ]; then
+	subject="FAIL : ${subject} : recuperation page"
+	echo ${subject} | mail -s "${subject}" -A ${BACKUPDIR}/${LOGFILE} ${SENDER}
+	exit 1
+fi
+${TAR} --create --file="${BACKUPDIR}/${fileBackup}.tar" --listed-incremental=${LIST} ${DIRECTORY}
+if [ ${?} -ne 0 ]; then
+	subject="FAIL : ${subject} : archivage page "
+	echo ${subject} | mail -s "${subject}" -A ${BACKUPDIR}/${LOGFILE} ${SENDER}
+	exit 1
+fi
+${GZIP} -f -9 "${BACKUPDIR}/${fileBackup}.tar"
+if [ ${?} -ne 0 ]; then
+	subject="FAIL :  ${subject} : compression archive "
+	echo ${subject} | mail -s "${subject}" -A ${BACKUPDIR}/${LOGFILE} ${SENDER}
+	exit 1
+fi
+subject="OK : ${subject}"
+echo ${subject}| mail -s "${subject}" -A ${BACKUPDIR}/${LOGFILE} ${SENDER}
+find ${BACKUPDIR} -name "*.tar.gz" -type f -ctime +90 -exec rm {} \;
+exit 0

roles/deploy-web/files/blacklist.sh

@@ -3,11 +3,28 @@ MAIL=/tmp/mail
 SERVER_LOG=/var/log/nginx
 HOST=($(cat /etc/sentinel/virtualhost))
 BLACKLIST=/etc/sentinel/blacklist
-chain_count=$(iptables -L BLACKLIST -n | wc -l)
+EXCLUDE=/etc/sentinel/exclude
+SENDER=/etc/sentinel/ip
+SSH=$(cat /etc/sentinel/ssh_port)
+IP=$(hostname -I |awk '{print $1}')
+chain_count=$(/usr/sbin/iptables -L BLACKLIST -n | wc -l)
 if [ ${chain_count} -eq 0 ]; then
 	bash /usr/local/bin/sentinel/refill_blacklist.sh
 fi
 
+list_sender=($(cat ${SENDER}))
+
+for i in ${list_sender[@]}
+do
+	if [ -f /tmp/blacklist_${i} ]; then
+		count_ip=$(cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -ui |wc -l) 
+		cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -u >> ${BLACKLIST}
+		if [ ${count_ip} -ne 0 ]; then
+			bash /usr/local/bin/sentinel/refill_blacklist.sh
+		fi
+	fi
+done
+
 for i in ${HOST[@]}
 do
 	log_access=${SERVER_LOG}/${i}_access.log
@@ -16,10 +33,10 @@ do
 	cat /tmp/error_$i | awk -F "|" '{ if($2 == "400") print $1}' > /tmp/400_$i
 	cat /tmp/404_$i | sort | uniq -c | awk '{ if($1 >= 5) print $2}' > /tmp/blacklist_404
 	cat /tmp/400_$i |sort | uniq -c |awk '{ if($1 >= 5) print $2}' > /tmp/blacklist_400
-	count=$(cat /tmp/blacklist_404 /tmp/blacklist_400 |grep -f ${BLACKLIST} -v |sort |uniq |wc -l)
+	count=$(cat /tmp/blacklist_404 /tmp/blacklist_400 |grep -f ${BLACKLIST} -v |grep -f ${EXCLUDE} -v |sort |uniq |wc -l)
 	if [ ${count} -ne 0 ]; then
 		echo "Nouvelle IP blacklisté" > ${MAIL}
-		list_ip=($(cat /tmp/blacklist_400 /tmp/blacklist_404 |grep -f ${BLACKLIST} -v  |sort |uniq))
+		list_ip=($(cat /tmp/blacklist_400 /tmp/blacklist_404 |grep -f ${BLACKLIST} -v  |grep -f ${EXCLUDE} -v |sort |uniq))
 		for j in ${list_ip[@]}
 		do
 			echo ${j} >> ${MAIL}
@@ -28,10 +45,20 @@ do
 			cat /tmp/error_$i | grep ${j} >> ${MAIL} 
 			echo "" >> ${MAIL}
 			echo ${j} >> ${BLACKLIST}
-			iptables -A BLACKLIST -s ${j} -j DROP
+			/usr/sbin/iptables -A BLACKLIST -s ${j} -j DROP
+		done
+		for j in ${list_sender[@]}
+		do
+			echo "Blacklist envoye a ${j}" >> ${MAIL}
+			echo "scp -i /home/valentin/.ssh-blacklist/id_rsa -P ${SSH} ${BLACKLIST} blacklist_user@${j}:/tmp/blacklist_${IP}" >> ${MAIL}
+			scp -i /home/valentin/.ssh-blacklist/id_rsa -P ${SSH} ${BLACKLIST} blacklist_user@${j}:/tmp/blacklist_${IP}i
+			if [ ${?} -ne 0 ]; then
+				echo "Error SCP for ${j}" >> ${MAIL}
+			fi
 		done
 		echo "IP dejà blacklisté : " >> ${MAIL}
 		cat ${BLACKLIST} >> ${MAIL}
 		cat ${MAIL} |mail -s "Blacklist IP ${i}" valczebackup@gmail.com
 	fi
 done
+

roles/deploy-web/files/getinfo_day.sh

@@ -26,6 +26,7 @@ do
 	cat $log_access | grep "|" | awk -F "|" '{print $1}' | sort | uniq > $directory_host/list_$DATE
 	cat $log_access | awk -F "|" '{ if($2 == "404") print $1}' > $directory_host/404_$DATE
 	cat $log_access | awk -F "|" '{ if($2 == "400") print $1}' > $directory_host/400_$DATE
+	grep robots.txt $log_access | awk -F '|' '{print $3}' > $directory_host/robots_$DATE
 	while read line; do
 		if grep $line $DIRECTORY/*/*/output_*.txt > /dev/null 2>&1; then
 			grep -h -B1 -A8 $line $DIRECTORY/*/*/output_*.txt |head -10 >> $directory_host/output_$DATE.txt
@@ -50,6 +51,9 @@ do
 		cat $directory_host/${j}_$DATE |sort |uniq -c >> ${MAIL}
 		echo "--------" >> ${MAIL}
 	done
+	echo "nombre de robots " >> ${MAIL}
+	cat $directory_host/robots_$DATE |sort |uniq -c >> ${MAIL}
+	echo "---------" >> ${MAIL}
 	cat ${MAIL} |mail -s "Rapport reverse proxy $DATE" -A $directory_host/output_$DATE.txt valczebackup@gmail.com
 	#rm $directory_host/*
 done

roles/deploy-web/files/getinfo_month.sh

@@ -23,6 +23,10 @@ do
 		cat $directory_host/${j}_* |sort |uniq -c >> ${MAIL}
 		echo "----------------" >> ${MAIL}
 	done
+	echo "nombre de robots :" >> ${MAIL}
+	cat $directory_host/robots_* |sort |uniq -c >> ${MAIL}
+	echo "----------------" >> ${MAIL}
+
 	cat ${MAIL} |mail -s "Rapport mensuel reverse proxy ${i} $DATE" valczebackup@gmail.com
 	rm -rf $directory_host
 done

roles/deploy-web/files/getinfo_week.sh

@@ -36,6 +36,9 @@ do
 		cat $directory_host/${j}_* |sort |uniq -c >> ${MAIL}
 		echo "----------------" >> ${MAIL}
 	done
+	echo "nombre de robots :" >> ${MAIL}
+	cat $directory_host/robots_* |sort |uniq -c >> ${MAIL}
+	echo "----------------" >> ${MAIL}
 	cat ${MAIL} |mail -s "Rapport hebdomadaire reverse proxy ${i} $DATE" valczebackup@gmail.com
 	#rm $directory_host/*
 done

roles/deploy-web/files/gouter

@@ -1,16 +1,37 @@
 server {
+	if ($host = clarissariviere.fr) {
+        	return 301 "https://www.clarissariviere.com$request_uri";
+    	} # managed by Certbot
+	if ($host = www.clarissariviere.fr) {
+        	return 301 "https://www.clarissariviere.com$request_uri";
+    	} # managed by Certbot
+
+
+    	if ($host = clarissariviere.com) {
+        	return 301 "https://www.clarissariviere.com$request_uri";
+    	} # managed by Certbot
 	access_log /var/log/nginx/clarissa_access.log main;
 	error_log /var/log/nginx/clarissa_error.log;
 	#gzip_static off;
 	server_name clarissariviere.com clarissariviere.fr www.clarissariviere.fr www.clarissariviere.com;
         add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
+	#add_header Link "<https://www.clarissariviere.com$request_uri;> rel=\"canonical\", <https://www.clarissariviere.fr$request_uri;> rel=\"alternate\" hreflang=\"fr\"";
 	proxy_cache STATIC;	
+	set $header "<https://$host$request_uri;> rel=\"canonical\"";
+	if ($request_uri ~ "/tag/") {
+		set $header "<https://$host;> rel=\"canonical\"";
+		set $link "";
+
+	}
+	add_header Link $header;
+
 	location / {
 		# First attempt to serve request as file, then
 		# as directory, then fall back to displaying a 404.
 		#try_files $uri $uri/ =404;
 	        proxy_set_header Accept-Encoding "";
 		proxy_pass http://gouters.canalblog.com/;
+                #add_header Link "<https://www.clarissariviere.com; rel=\"canonical\">";
 		#proxy_redirect off;
                 #proxy_set_header Host $host;
 		#proxy_buffering        on;
@@ -24,7 +45,9 @@ server {
 		#proxy_set_header X-Real-IP $remote_addr;
                 #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 		#proxy_set_header X-Forwarded-Proto $scheme;
-		sub_filter 'gouters.canalblog.com' "$host";
+		sub_filter 'http://gouters.canalblog.com' "https://$host";
+		sub_filter '<meta name="generator" content="CanalBlog - https://www.canalblog.com" />' '';
+		sub_filter '<meta name="Keywords" content="' '<meta name="Keywords" content="clarissa, riviere, ';
 		sub_filter_types text/html text/xml text/plain text/css;
 		sub_filter_once off;	
 	
@@ -33,6 +56,14 @@ server {
 	location /googlebbc3cfa6d1866691.html {
 		root /var/www/gouter/;
 	}
+
+	location /yandex_93259fe4480c9828.html {
+		root /var/www/gouter/;
+	}
+
+	location /yandex_f07f7ace7d8459d8.html {
+		root /var/www/gouter/;
+	}
     listen 443 ssl; # managed by Certbot
     ssl_certificate /etc/letsencrypt/live/clarissariviere.com/fullchain.pem; # managed by Certbot
     ssl_certificate_key /etc/letsencrypt/live/clarissariviere.com/privkey.pem; # managed by Certbot
@@ -56,12 +87,12 @@ server {
 
 
     if ($host = clarissariviere.fr) {
-        return 301 https://$host$request_uri;
+        return 301 https://"www.clarissariviere.fr"$request_uri;
     } # managed by Certbot
 
 
     if ($host = clarissariviere.com) {
-        return 301 https://$host$request_uri;
+        return 301 https://"www.clarissariviere.com"$request_uri;
     } # managed by Certbot
 
 

roles/deploy-web/files/refill_blacklist.sh

@@ -1,11 +1,12 @@
 #!/bin/bash
 
+IPTABLES=/usr/sbin/iptables
 BLACKLIST=/etc/sentinel/blacklist
-chain_count=$(iptables -L BLACKLIST -n | wc -l)
+chain_count=$(${IPTABLES} -L BLACKLIST -n | wc -l)
 if [ ${chain_count} -eq 0 ]; then
-	iptables -N BLACKLIST
-	iptables -A INPUT -p tcp -m tcp --dport 80 -j BLACKLIST
-	iptables -A INPUT -p tcp -m tcp --dport 443 -j BLACKLIST
+	${IPTABLES} -N BLACKLIST
+	${IPTABLES} -I INPUT 1 -p tcp -m tcp --dport 80 -j BLACKLIST
+	${IPTABLES} -I INPUT 1 -p tcp -m tcp --dport 443 -j BLACKLIST
 
 fi
 if [ ! -f ${BLACKLIST} ]; then
@@ -13,7 +14,7 @@ if [ ! -f ${BLACKLIST} ]; then
 fi
 if [ ${chain_count} -gt 2 ]; then
 	chain_count=$(echo ${chain_count}-2 |bc)
-	iptables_ip=($(iptables -nvL BLACKLIST | tail -n ${chain_count}  | awk '{print $8}'))
+	iptables_ip=($(${IPTABLES} -nvL BLACKLIST | tail -n ${chain_count}  | awk '{print $8}'))
 	for i in $(cat ${BLACKLIST})
 	do
 		block_ip=1
@@ -24,13 +25,13 @@ if [ ${chain_count} -gt 2 ]; then
 			fi
 		done
 		if [ ${block_ip} -eq 1 ]; then
-			iptables -A BLACKLIST -s ${i} -j DROP
+			${IPTABLES} -A BLACKLIST -s ${i} -j DROP
 		fi
 	done
 else
 	for i in $(cat ${BLACKLIST})
 	do
-		iptables -A BLACKLIST -s ${i} -j DROP
+		${IPTABLES} -A BLACKLIST -s ${i} -j DROP
 	done
 fi
 

roles/deploy-web/files/scw-backup.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+LOGFILE_RECENT="/var/log/scw-log/logfile-recent.log"
+LOGFILE="/var/log/scw-log/logfile.log"
+DUPLICITY=/usr/local/bin/duplicity
+log () {
+	    date=`date +%Y-%m-%d`
+	    hour=`date +%H:%M:%S`
+	    echo "$date $hour $*" >> ${LOGFILE_RECENT}
+}
+
+rotate_log() {
+	cat ${LOGFILE_RECENT} >> ${LOGFILE}
+	status="OK"
+	if [ $(grep "Errors 0" ${LOGFILE_RECENT} |wc -l) -eq 0 ]; then
+		status="ALERTE FAIL !!!"
+	fi
+	cat ${LOGFILE_RECENT} |mail -s "${status} | Backup ${SCW_BUCKET} `date +%Y-%m-%d`" valczebackup@gmail.com 
+}
+USER=$(whoami)
+currently_backuping=$(ps -ef | grep duplicity  | grep python |grep ${USER}  | wc -l)
+
+if [ $currently_backuping -eq 0 ]; then
+	if [ ${#} -ne 1 ]; then
+		log ">>> Il manque un paramètre ${0} : <CONFIGFILE>"
+		rotate_log
+		exit 1
+	fi
+	if [ ! -f ${1} ]; then
+		log ">>> Le paramètre n'est pas un fichier ${USER} : ${1}"
+		rotate_log
+		exit 1
+	fi
+	source "$1"
+	echo > ${LOGFILE_RECENT}
+	log ">>> removing old backups"
+	${DUPLICITY} remove-older-than --s3-endpoint-url ${SCW_ENDPOINT_URL} --s3-region-name ${SCW_REGION} ${KEEP_BACKUP_TIME} ${SCW_BUCKET} --force >> ${LOGFILE_RECENT} 2>&1
+       	log ">>> creating and uploading backup to c14 cold storage ${SOURCE}"
+     	${DUPLICITY} \
+	    	incr --full-if-older-than ${FULL_BACKUP_TIME} \
+		--s3-endpoint-url ${SCW_ENDPOINT_URL} \
+		--s3-region-name ${SCW_REGION} \ 
+	    	--asynchronous-upload \
+	    	--s3-use-glacier \
+	    	--encrypt-key=${GPG_FINGERPRINT} \
+	    	--sign-key=${GPG_FINGERPRINT} \
+		${SOURCE} ${SCW_BUCKET} >> ${LOGFILE_RECENT} 2>&1
+	rotate_log
+else
+	log ">>> Duplicity déjà en cours de route sur cette utilisateur ${USER}"	
+	rotate_log
+fi

roles/deploy-web/files/scw-restore.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+  if [ $# -lt 3 ]; then
+    echo -e "Usage $0 <scw_configrc> <time or delta> [file to restore] <restore to>
+Exemple:
+\t$ $0 2018-7-21 recovery/  ## recovers * from closest backup to date
+  \t$ $0 0D secret data/  ## recovers most recent file nammed 'secret'";
+  exit; fi
+
+source $1
+shift
+
+
+  if [ $# -eq 2 ]; then
+    duplicity \
+      --s3-endpoint-url ${SCW_ENDPOINT_URL} \
+      --s3-region-name ${SCW_REGION} \
+      --time $1 \
+      ${SCW_BUCKET} $2
+  fi
+
+  if [ $# -eq 3 ]; then
+    duplicity \
+      --s3-endpoint-url ${SCW_ENDPOINT_URL} \
+      --s3-region-name ${SCW_REGION} \
+      --time $1 \
+      --file-to-restore $2 \
+      ${SCW_BUCKET} $3
+  fi

roles/deploy-web/tasks/backup.yml

@@ -0,0 +1,50 @@
+# tasks file for stats script
+
+- name: "Create log for backup script"
+  file:
+    path: "{{ item }}"
+    state: directory
+  with_items:
+    - "/var/log/scw-log"
+    - "/root/log"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Copy scw backup and restore script
+  copy:
+    src: "{{ item }}"
+    dest: "/opt/{{ item }}"
+    mode: "0500"
+  with_items:
+    - "scw-backup.sh"
+    - "scw-restore.sh"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Copy scw backup config
+  template:
+    src: "scw-configrc.j2"
+    dest: "/root/.scw-configrc"
+    mode: "0400"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+
+#- name: Crontab blacklist
+#  ansible.builtin.cron:
+#    name: "blacklist script"
+#    cron_file: "blacklist_cron"
+#    minute: "*/5"
+#    job: "bash /usr/local/bin/sentinel/blacklist.sh"
+#    user: root
+#
+#  vars:
+#    ansible_become: yes
+#    ansible_become_method: sudo
+#    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/tasks/configure.yml

@@ -9,18 +9,22 @@
     ansible_become: yes
     ansible_become_method: sudo
     ansible_become_password: "{{ sudo_password }}"
-  when: script is not defined
 
 - name: Template virtualhost
   template:
     src: virtualhost.j2
     dest: /etc/sentinel/virtualhost
     mode: "0444"
+  with_items:
+    - virtualhost
+    - ip
+    - ssh_port
+    - exclude
   vars:
     ansible_become: yes
     ansible_become_method: sudo
     ansible_become_password: "{{ sudo_password }}"
-  when: script is not defined or script == "blacklist"
+  tags: [ "configure_blacklist" ]
 
 - name: Copy blacklist
   copy:
@@ -33,17 +37,23 @@
     ansible_become: yes
     ansible_become_method: sudo
     ansible_become_password: "{{ sudo_password }}"
-  tags: [ "restore" ]
+  tags: [ "restore_blacklist" ]
 
 - name: Deploy stats script
   import_tasks: stats.yml
-  when: script is not defined or script == "stats"
+  tags: [ "configure_stats" ]
 
 - name: Configure blacklist script
   import_tasks: blacklist.yml
-  when: script is not defined or script == "blacklist"
+  tags: [ "configure_blacklist" ]
 
 - name: Configure supervision script
   import_tasks: supervision.yml
-  when: script is not defined or script == "supervision"
+  tags: [ "configure_supervision" ]
+
+- name: Configure backup script
+  import_tasks: backup.yml
+  tags: [ "configure_backup" ]
+
+
 

roles/deploy-web/tasks/deconfigure.yml

@@ -2,23 +2,26 @@
   fetch:
     src: /etc/sentinel/blacklist
     dest: blacklist
-  when: script is not defined or script == "blacklist"
-  tags: [ "backup" ]
+  tags: [ "backup_blacklist" ]
 
 
 - name: Deconfigure stats script
   import_tasks: deconfigure_stats.yml
-  when: script is not defined or script == "stats"
+  tags: [ "deconfigure_stats" ]
 
 - name: Deconfigure blacklist script
   import_tasks: deconfigure_blacklist.yml
-  when: script is not defined or script == "blacklist"
-
+  tags: [ "deconfigure_blacklist" ]
 
 
 - name: Deconfigure supervision script
   import_tasks: deconfigure_supervision.yml
-  when: script is not defined or script == "supervision"
+  tags: [ "deconfigure_supervision" ]
+
+- name: Deconfigure backup script
+  import_tasks: deconfigure_backup.yml
+  tags: [ "deconfigure_backup" ]
+
 
 - name: Remove sentinel directory
   file:
@@ -31,4 +34,3 @@
     ansible_become: yes
     ansible_become_method: sudo
     ansible_become_password: "{{ sudo_password }}"
-  when: script is not defined

roles/deploy-web/tasks/deconfigure_backup.yml

@@ -0,0 +1,31 @@
+# tasks file for stats script
+
+- name: "Create log for backup script"
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - "/var/log/scw-log"
+    - "/root/log"
+    - "/opt/scw-backup.sh"
+    - "/opt/scw-restore.sh"
+    - "/root/.scw-configrc"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+
+
+#- name: Crontab blacklist
+#  ansible.builtin.cron:
+#    name: "blacklist script"
+#    cron_file: "blacklist_cron"
+#    minute: "*/5"
+#    job: "bash /usr/local/bin/sentinel/blacklist.sh"
+#    user: root
+#
+#  vars:
+#    ansible_become: yes
+#    ansible_become_method: sudo
+#    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/templates/exclude.j2

@@ -0,0 +1,3 @@
+{% for host in ip_exclude_blacklist %}
+{{ host }}
+{% endfor %}

roles/deploy-web/templates/ip.j2

@@ -0,0 +1,3 @@
+{% for host in ip_sender_blacklist %}
+{{ host }}
+{% endfor %}

roles/deploy-web/templates/scw-configrc.j2

@@ -0,0 +1,28 @@
+export AWS_ACCESS_KEY_ID="{{ aws_access_key_id }}"
+export AWS_SECRET_ACCESS_KEY="{{ aws_secret_access_key }}"
+export SCW_REGION="{{ scw_region }}"
+export SCW_ENDPOINT_URL="https://s3.${SCW_REGION}.scw.cloud"
+export SCW_BUCKET="s3://{{ scw_directory }}"
+
+# GPG Key information
+export PASSPHRASE="{{ passphrase }}"
+export GPG_FINGERPRINT="{{ gpg_fingerprint }}"
+# Folder to backup
+export SOURCE="--exclude /sys --exclude /proc --exclude /opt --exclude /tmp --exclude /mnt --exclude /home /"
+
+# Will keep backup up to 1 month
+export KEEP_BACKUP_TIME="1M"
+
+# Will make a full backup every 10 days
+export FULL_BACKUP_TIME="10D"
+
+# Log files
+export LOGFILE_RECENT="/root/log/logfile-recent.log"
+export LOGFILE="/root/log/logfile.log"
+
+ log () {
+	    date=`date +%Y-%m-%d`
+	    hour=`date +%H:%M:%S`
+	    echo "$date $hour $*" >> ${LOGFILE_RECENT}
+}
+export -f log

roles/deploy-web/templates/ssh_port.j2

@@ -0,0 +1 @@
+{{ ssh_port_blacklist }}

roles/deploy-web/templates/virtualhost.j2

@@ -1,3 +1,3 @@
 {% for host in virtualhosts %}
-    {{ host }}
+{{ host }}
 {% endfor %}