Merge pull request 'alternate' (#3) from alternate into master

Reviewed-on: #3

blacklist/vps-host/etc/sentinel/blacklist

@@ -0,0 +1,78 @@
+51.222.107.37
+45.33.110.22
+185.142.236.35
+164.92.135.200
+46.101.166.31
+195.181.163.29
+206.189.47.168
+103.74.54.128
+185.180.143.140
+146.0.77.38
+172.104.249.218
+137.184.200.131
+128.90.135.254
+134.209.70.98
+3.235.198.47
+71.6.199.23
+20.84.48.39
+193.42.33.15
+167.235.148.2
+54.74.107.180
+170.187.229.101
+165.227.89.199
+165.22.98.234
+34.122.37.133
+167.172.141.44
+167.172.142.119
+134.209.207.188
+34.125.93.26
+34.162.183.125
+139.59.138.104
+35.245.198.244
+143.198.85.144
+157.245.136.150
+185.134.23.83
+20.125.115.103
+185.163.109.66
+128.199.85.172
+148.153.45.238
+185.142.236.34
+45.13.227.172
+18.204.48.86
+34.106.22.184
+51.222.107.37
+106.75.176.55
+146.190.84.120
+143.198.213.67
+34.125.234.83
+43.130.152.82
+45.59.163.17
+172.94.9.227
+148.153.45.236
+68.183.183.237
+89.187.162.187
+206.189.38.98
+2.57.122.253
+172.105.190.200
+15.188.26.9
+13.49.23.69
+20.87.214.199
+45.55.64.12
+188.166.187.222
+167.71.24.123
+185.213.174.115
+165.232.174.66
+161.35.153.48
+54.219.74.101
+2.57.122.81
+165.22.96.121
+43.153.118.27
+43.153.12.17
+185.180.143.141
+18.144.156.146
+193.56.29.113
+3.129.42.4
+169.197.143.220
+3.15.142.108
+139.162.34.62
+80.66.79.22

inventory/host_vars/vps-host

@@ -1,18 +1,36 @@
 $ANSIBLE_VAULT;1.1;AES256
-62643736353737643733623031373139626437396435656664636661373730646535326539303362
-3562383661323166643437636233633838303861373230380a623939366265356531356131343062
-65306666333065336633333036626163313633646233313238373032323561626665356531653661
-6661393439386438360a376339663536313366653633363362323264346565313332366230326331
-66333630383639626262386332633462653635386137396231363763373466663463343961356137
-38643432316330366432333534343639663433333361343665376461333465306236353833313866
-37643531396639626461303538313465323663396436393365323663333363653835366637356339
-63316435346132383766363562356262396565303233336337366430323034383832633738616135
-64646232646237613736643134653264383963373935333766626461383939663538346466383731
-37643131663830653630633864306439613637363836646164356464623732356137656331343233
-66356534396239646266313063356333353232343263323139386337306135623063316439643861
-36323839393536323562323462376161376561653934366135376165656338656361333530646431
-39396461353432316537366433353765663234393932393536323963643631306563663133323930
-32396465646635336566623636353437626232343135623762343338323661363332653837316363
-39346334616339643062623731353035363433653163303062636362353235636265623533636634
-62326461356462363562373537363630303263653864323334326561326637636166346364626563
-3761
+65333737373761626438343263333163623934626161313738303239383134333133313661333739
+3765666232653562383861643033356535383230613564330a343931393265303332346339373161
+31653534646463333138633564663238323664313432343666613633353538323530323631326665
+3133303461303966310a626664396637313532313666386236303765613530343863636636346334
+33633536656337643962663564656465666636623734376162366233643431343966373737613064
+62336665386635316433636166353263356131383632616665643935616131333230343965613834
+63323363616535363437306362613934633533386438353466353138386438313063316565616636
+66643535356364396230653032643661316534356266333035323766306165383562653836313532
+31396432316564633933363338393535363937386533343137373664366538323836343038313062
+61383630386233313034353966383265333735303064333535643738633362336362323565326131
+66666565376663383733616136386462353937613364653932353062386665623439613933366535
+61343134323031343133626265336231306131376661396163333939643561356363306333666637
+64353137643238653562643034383262356266366636333135616262643436363638666166336565
+63346131346238666166303338303264363634373635663830663636656661303935623239346339
+33306564313566343339626362333735343737333763616330303266353836303438323131306161
+61303633636335636335383734326638663238313961653561613164333865383364323234383133
+65626130376434343165373531643935616431316631636165323365376564646535613534616237
+65303430373336383436373162376536376563623730343237366435653163613337303538643062
+66643361613732366431336231363133326435623361663366646537386433613262326161303966
+39363732653361646534653866326436666462346235376664623039343431373938666266313034
+62373639323039656266623562326634633131623964313666646463383064303266643162636362
+35646563623533303466636631646339626464306665383266643839653734373465313538363035
+33313762313934396137323433313238393239623831663430396530303764336338356366646264
+36393038633033303066346339663939653964333735303465626139613464313437356264373562
+34376230333834373831363661636461383763383138653537383235343132623830326532393564
+61646265303835306534346433303138306632306163613336393834313337306233376665313262
+35396630666162373432313939646537666335343835613363653334313234356564373431366537
+37323838323835386538343261633762303035336665656638636165303130343733633766656333
+33623861633664626232316434326138303539363130333561323630393932363735363362663832
+64393965346131396236653864323930633763303435613330386236633164636465646664396530
+35343838323364643236383334663432316339613231613030643935333932633732313635633164
+63663861323663613931636238313862326364396538616463376533396136653266393136663265
+65613862333066643030656263333534343161613638356264663635643430356563313561633535
+30303165663931633761363633383237333765383332363962353530313036346561383539643966
+336562336464303538313234386162383165

playbook.yml

@@ -1,5 +1,5 @@
 ---
 - hosts: all
-  remote_user: admloc
+  remote_user: valentin
   roles:
     - deploy-web

roles/deploy-web/files/blacklist.sh

@@ -3,11 +3,28 @@ MAIL=/tmp/mail
 SERVER_LOG=/var/log/nginx
 HOST=($(cat /etc/sentinel/virtualhost))
 BLACKLIST=/etc/sentinel/blacklist
-chain_count=$(iptables -L BLACKLIST -n | wc -l)
+EXCLUDE=/etc/sentinel/exclude
+SENDER=/etc/sentinel/ip
+SSH=$(cat /etc/sentinel/ssh_port)
+IP=$(hostname -I |awk '{print $1}')
+chain_count=$(/usr/sbin/iptables -L BLACKLIST -n | wc -l)
 if [ ${chain_count} -eq 0 ]; then
 	bash /usr/local/bin/sentinel/refill_blacklist.sh
 fi
 
+list_sender=($(cat ${SENDER}))
+
+for i in ${list_sender[@]}
+do
+	if [ -f /tmp/blacklist_${i} ]; then
+		count_ip=$(cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -ui |wc -l) 
+		cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -u >> ${BLACKLIST}
+		if [ ${count_ip} -ne 0 ]; then
+			bash /usr/local/bin/sentinel/refill_blacklist.sh
+		fi
+	fi
+done
+
 for i in ${HOST[@]}
 do
 	log_access=${SERVER_LOG}/${i}_access.log
@@ -16,10 +33,10 @@ do
 	cat /tmp/error_$i | awk -F "|" '{ if($2 == "400") print $1}' > /tmp/400_$i
 	cat /tmp/404_$i | sort | uniq -c | awk '{ if($1 >= 5) print $2}' > /tmp/blacklist_404
 	cat /tmp/400_$i |sort | uniq -c |awk '{ if($1 >= 5) print $2}' > /tmp/blacklist_400
-	count=$(cat /tmp/blacklist_404 /tmp/blacklist_400 |grep -f ${BLACKLIST} -v |sort |uniq |wc -l)
+	count=$(cat /tmp/blacklist_404 /tmp/blacklist_400 |grep -f ${BLACKLIST} -v |grep -f ${EXCLUDE} -v |sort |uniq |wc -l)
 	if [ ${count} -ne 0 ]; then
 		echo "Nouvelle IP blacklisté" > ${MAIL}
-		list_ip=($(cat /tmp/blacklist_400 /tmp/blacklist_404 |grep -f ${BLACKLIST} -v  |sort |uniq))
+		list_ip=($(cat /tmp/blacklist_400 /tmp/blacklist_404 |grep -f ${BLACKLIST} -v  |grep -f ${EXCLUDE} -v |sort |uniq))
 		for j in ${list_ip[@]}
 		do
 			echo ${j} >> ${MAIL}
@@ -28,10 +45,15 @@ do
 			cat /tmp/error_$i | grep ${j} >> ${MAIL} 
 			echo "" >> ${MAIL}
 			echo ${j} >> ${BLACKLIST}
-			iptables -A BLACKLIST -s ${j} -j DROP
+			/usr/sbin/iptables -A BLACKLIST -s ${j} -j DROP
+		done
+		for j in ${list_sender}
+		do
+			scp -i /home/valentin/.ssh-blacklist/id_rsa -P ${SSH} ${BLACKLIST} blacklist_user@${j}:/tmp/blacklist_${IP}
 		done
 		echo "IP dejà blacklisté : " >> ${MAIL}
 		cat ${BLACKLIST} >> ${MAIL}
 		cat ${MAIL} |mail -s "Blacklist IP ${i}" valczebackup@gmail.com
 	fi
 done
+

roles/deploy-web/files/getinfo_day.sh

@@ -2,7 +2,7 @@
 MAIL=/tmp/mail
 DIRECTORY=/home/valentin/mail
 SERVER_LOG=/var/log/nginx
-TOKEN={{ token_ipinfo }}
+TOKEN=$(cat /etc/sentinel/token)
 DATE=$(date +%Y%m%d-%H%M%S)
 HOST=($(cat /etc/sentinel/virtualhost))
 WEEK=$(date +%V)
@@ -26,6 +26,7 @@ do
 	cat $log_access | grep "|" | awk -F "|" '{print $1}' | sort | uniq > $directory_host/list_$DATE
 	cat $log_access | awk -F "|" '{ if($2 == "404") print $1}' > $directory_host/404_$DATE
 	cat $log_access | awk -F "|" '{ if($2 == "400") print $1}' > $directory_host/400_$DATE
+	grep robots.txt $log_access | awk -F '|' '{print $3}' > $directory_host/robots_$DATE
 	while read line; do
 		if grep $line $DIRECTORY/*/*/output_*.txt > /dev/null 2>&1; then
 			grep -h -B1 -A8 $line $DIRECTORY/*/*/output_*.txt |head -10 >> $directory_host/output_$DATE.txt
@@ -50,6 +51,9 @@ do
 		cat $directory_host/${j}_$DATE |sort |uniq -c >> ${MAIL}
 		echo "--------" >> ${MAIL}
 	done
+	echo "nombre de robots " >> ${MAIL}
+	cat $directory_host/robots_$DATE |sort |uniq -c >> ${MAIL}
+	echo "---------" >> ${MAIL}
 	cat ${MAIL} |mail -s "Rapport reverse proxy $DATE" -A $directory_host/output_$DATE.txt valczebackup@gmail.com
 	#rm $directory_host/*
 done

roles/deploy-web/files/getinfo_month.sh

@@ -23,6 +23,10 @@ do
 		cat $directory_host/${j}_* |sort |uniq -c >> ${MAIL}
 		echo "----------------" >> ${MAIL}
 	done
+	echo "nombre de robots :" >> ${MAIL}
+	cat $directory_host/robots_* |sort |uniq -c >> ${MAIL}
+	echo "----------------" >> ${MAIL}
+
 	cat ${MAIL} |mail -s "Rapport mensuel reverse proxy ${i} $DATE" valczebackup@gmail.com
 	rm -rf $directory_host
 done

roles/deploy-web/files/getinfo_week.sh

@@ -36,6 +36,9 @@ do
 		cat $directory_host/${j}_* |sort |uniq -c >> ${MAIL}
 		echo "----------------" >> ${MAIL}
 	done
+	echo "nombre de robots :" >> ${MAIL}
+	cat $directory_host/robots_* |sort |uniq -c >> ${MAIL}
+	echo "----------------" >> ${MAIL}
 	cat ${MAIL} |mail -s "Rapport hebdomadaire reverse proxy ${i} $DATE" valczebackup@gmail.com
 	#rm $directory_host/*
 done

roles/deploy-web/files/gouter

@@ -1,9 +1,20 @@
 server {
+	if ($host = clarissariviere.fr) {
+        	return 301 https://"www.clarissariviere.fr"$request_uri;
+    	} # managed by Certbot
+
+
+    	if ($host = clarissariviere.com) {
+        	return 301 https://"www.clarissariviere.com"$request_uri;
+    	} # managed by Certbot
+
+
 	access_log /var/log/nginx/clarissa_access.log main;
 	error_log /var/log/nginx/clarissa_error.log;
 	#gzip_static off;
 	server_name clarissariviere.com clarissariviere.fr www.clarissariviere.fr www.clarissariviere.com;
         add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
+	add_header Link "<https://www.clarissariviere.com;> rel=\"canonical\", <https://www.clarissariviere.fr;> rel=\"alternate\" hreflang=\"fr\"";
 	proxy_cache STATIC;	
 	location / {
 		# First attempt to serve request as file, then
@@ -11,6 +22,7 @@ server {
 		#try_files $uri $uri/ =404;
 	        proxy_set_header Accept-Encoding "";
 		proxy_pass http://gouters.canalblog.com/;
+                #add_header Link "<https://www.clarissariviere.com; rel=\"canonical\">";
 		#proxy_redirect off;
                 #proxy_set_header Host $host;
 		#proxy_buffering        on;
@@ -25,6 +37,8 @@ server {
                 #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 		#proxy_set_header X-Forwarded-Proto $scheme;
 		sub_filter 'gouters.canalblog.com' "$host";
+		sub_filter '<meta name="generator" content="CanalBlog - https://www.canalblog.com" />' '';
+		#sub_filter '</head>' '<script async src="https://www.googletagmanager.com/gtag/js?id=G-MV336S1G9W"></script><script>window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag("js", new Date()); gtag("config", "G-MV336S1G9W");</script></head>';
 		sub_filter_types text/html text/xml text/plain text/css;
 		sub_filter_once off;	
 	
@@ -33,6 +47,14 @@ server {
 	location /googlebbc3cfa6d1866691.html {
 		root /var/www/gouter/;
 	}
+
+	location /yandex_93259fe4480c9828.html {
+		root /var/www/gouter/;
+	}
+
+	location /yandex_f07f7ace7d8459d8.html {
+		root /var/www/gouter/;
+	}
     listen 443 ssl; # managed by Certbot
     ssl_certificate /etc/letsencrypt/live/clarissariviere.com/fullchain.pem; # managed by Certbot
     ssl_certificate_key /etc/letsencrypt/live/clarissariviere.com/privkey.pem; # managed by Certbot
@@ -56,12 +78,12 @@ server {
 
 
     if ($host = clarissariviere.fr) {
-        return 301 https://$host$request_uri;
+        return 301 https://"www.clarissariviere.fr"$request_uri;
     } # managed by Certbot
 
 
     if ($host = clarissariviere.com) {
-        return 301 https://$host$request_uri;
+        return 301 https://"www.clarissariviere.com"$request_uri;
     } # managed by Certbot
 
 

roles/deploy-web/files/refill_blacklist.sh

@@ -1,11 +1,12 @@
 #!/bin/bash
 
+IPTABLES=/usr/sbin/iptables
 BLACKLIST=/etc/sentinel/blacklist
-chain_count=$(iptables -L BLACKLIST -n | wc -l)
+chain_count=$(${IPTABLES} -L BLACKLIST -n | wc -l)
 if [ ${chain_count} -eq 0 ]; then
-	iptables -N BLACKLIST
-	iptables -A INPUT -p tcp -m tcp --dport 80 -j BLACKLIST
-	iptables -A INPUT -p tcp -m tcp --dport 443 -j BLACKLIST
+	${IPTABLES} -N BLACKLIST
+	${IPTABLES} -I INPUT 1 -p tcp -m tcp --dport 80 -j BLACKLIST
+	${IPTABLES} -I INPUT 1 -p tcp -m tcp --dport 443 -j BLACKLIST
 
 fi
 if [ ! -f ${BLACKLIST} ]; then
@@ -13,7 +14,7 @@ if [ ! -f ${BLACKLIST} ]; then
 fi
 if [ ${chain_count} -gt 2 ]; then
 	chain_count=$(echo ${chain_count}-2 |bc)
-	iptables_ip=($(iptables -nvL BLACKLIST | tail -n ${chain_count}  | awk '{print $8}'))
+	iptables_ip=($(${IPTABLES} -nvL BLACKLIST | tail -n ${chain_count}  | awk '{print $8}'))
 	for i in $(cat ${BLACKLIST})
 	do
 		block_ip=1
@@ -24,13 +25,13 @@ if [ ${chain_count} -gt 2 ]; then
 			fi
 		done
 		if [ ${block_ip} -eq 1 ]; then
-			iptables -A BLACKLIST -s ${i} -j DROP
+			${IPTABLES} -A BLACKLIST -s ${i} -j DROP
 		fi
 	done
 else
 	for i in $(cat ${BLACKLIST})
 	do
-		iptables -A BLACKLIST -s ${i} -j DROP
+		${IPTABLES} -A BLACKLIST -s ${i} -j DROP
 	done
 fi
 

roles/deploy-web/files/scw-backup.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+LOGFILE_RECENT="/var/log/scw-log/logfile-recent.log"
+LOGFILE="/var/log/scw-log/logfile.log"
+DUPLICITY=/usr/local/bin/duplicity
+log () {
+	    date=`date +%Y-%m-%d`
+	    hour=`date +%H:%M:%S`
+	    echo "$date $hour $*" >> ${LOGFILE_RECENT}
+}
+
+rotate_log() {
+	cat ${LOGFILE_RECENT} >> ${LOGFILE}
+	status="OK"
+	if [ $(grep "Errors 0" ${LOGFILE_RECENT} |wc -l) -eq 0 ]; then
+		status="ALERTE FAIL !!!"
+	fi
+	cat ${LOGFILE_RECENT} |mail -s "${status} | Backup ${SCW_BUCKET} `date +%Y-%m-%d`" valczebackup@gmail.com 
+}
+USER=$(whoami)
+currently_backuping=$(ps -ef | grep duplicity  | grep python |grep ${USER}  | wc -l)
+
+if [ $currently_backuping -eq 0 ]; then
+	if [ ${#} -ne 1 ]; then
+		log ">>> Il manque un paramètre ${0} : <CONFIGFILE>"
+		rotate_log
+		exit 1
+	fi
+	if [ ! -f ${1} ]; then
+		log ">>> Le paramètre n'est pas un fichier ${USER} : ${1}"
+		rotate_log
+		exit 1
+	fi
+	source "$1"
+	echo > ${LOGFILE_RECENT}
+	log ">>> removing old backups"
+	${DUPLICITY} remove-older-than --s3-endpoint-url ${SCW_ENDPOINT_URL} --s3-region-name ${SCW_REGION} ${KEEP_BACKUP_TIME} ${SCW_BUCKET} --force >> ${LOGFILE_RECENT} 2>&1
+       	log ">>> creating and uploading backup to c14 cold storage ${SOURCE}"
+     	${DUPLICITY} \
+	    	incr --full-if-older-than ${FULL_BACKUP_TIME} \
+		--s3-endpoint-url ${SCW_ENDPOINT_URL} \
+		--s3-region-name ${SCW_REGION} \ 
+	    	--asynchronous-upload \
+	    	--s3-use-glacier \
+	    	--encrypt-key=${GPG_FINGERPRINT} \
+	    	--sign-key=${GPG_FINGERPRINT} \
+		${SOURCE} ${SCW_BUCKET} >> ${LOGFILE_RECENT} 2>&1
+	rotate_log
+else
+	log ">>> Duplicity déjà en cours de route sur cette utilisateur ${USER}"	
+	rotate_log
+fi

roles/deploy-web/files/scw-restore.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+  if [ $# -lt 3 ]; then
+    echo -e "Usage $0 <scw_configrc> <time or delta> [file to restore] <restore to>
+Exemple:
+\t$ $0 2018-7-21 recovery/  ## recovers * from closest backup to date
+  \t$ $0 0D secret data/  ## recovers most recent file nammed 'secret'";
+  exit; fi
+
+source $1
+shift
+
+
+  if [ $# -eq 2 ]; then
+    duplicity \
+      --s3-endpoint-url ${SCW_ENDPOINT_URL} \
+      --s3-region-name ${SCW_REGION} \
+      --time $1 \
+      ${SCW_BUCKET} $2
+  fi
+
+  if [ $# -eq 3 ]; then
+    duplicity \
+      --s3-endpoint-url ${SCW_ENDPOINT_URL} \
+      --s3-region-name ${SCW_REGION} \
+      --time $1 \
+      --file-to-restore $2 \
+      ${SCW_BUCKET} $3
+  fi

roles/deploy-web/tasks/backup.yml

@@ -0,0 +1,50 @@
+# tasks file for stats script
+
+- name: "Create log for backup script"
+  file:
+    path: "{{ item }}"
+    state: directory
+  with_items:
+    - "/var/log/scw-log"
+    - "/root/log"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Copy scw backup and restore script
+  copy:
+    src: "{{ item }}"
+    dest: "/opt/{{ item }}"
+    mode: "0500"
+  with_items:
+    - "scw-backup.sh"
+    - "scw-restore.sh"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Copy scw backup config
+  template:
+    src: "scw-configrc.j2"
+    dest: "/root/.scw-configrc"
+    mode: "0400"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+
+#- name: Crontab blacklist
+#  ansible.builtin.cron:
+#    name: "blacklist script"
+#    cron_file: "blacklist_cron"
+#    minute: "*/5"
+#    job: "bash /usr/local/bin/sentinel/blacklist.sh"
+#    user: root
+#
+#  vars:
+#    ansible_become: yes
+#    ansible_become_method: sudo
+#    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/tasks/blacklist.yml

@@ -0,0 +1,27 @@
+# tasks file for stats script
+
+- name: Copy blacklist script
+  copy:
+    src: "{{ item }}.sh"
+    dest: "/usr/local/bin/sentinel/{{ item }}.sh"
+    mode: "0555"
+  with_items:
+    - blacklist
+    - refill_blacklist
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Crontab blacklist
+  ansible.builtin.cron:
+    name: "blacklist script"
+    cron_file: "blacklist_cron"
+    minute: "*/5"
+    job: "bash /usr/local/bin/sentinel/blacklist.sh"
+    user: root
+
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/tasks/configure.yml

@@ -1,12 +1,54 @@
+- name: Create sentinel directory
+  file:
+    state: directory
+    path: "{{ item }}/sentinel"
+  with_items: 
+    - /usr/local/bin
+    - /etc
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Template virtualhost
+  template:
+    src: virtualhost.j2
+    dest: /etc/sentinel/virtualhost
+    mode: "0444"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+  tags: [ "configure_blacklist" ]
+
+- name: Copy blacklist
+  copy:
+    src: "{{ playbook_dir }}/blacklist/{{ inventory_hostname }}/etc/sentinel/blacklist"
+    dest: /etc/sentinel/blacklist
+    mode: "0644"
+  when: script is not defined or script == "blacklist"
+  ignore_errors: true
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+  tags: [ "restore_blacklist" ]
+
 - name: Deploy stats script
   import_tasks: stats.yml
-  tags: [ "configure", "stats"]
+  tags: [ "configure_stats" ]
 
 - name: Configure blacklist script
   import_tasks: blacklist.yml
-  tags: [ "configure", "blacklist" ]
-
+  tags: [ "configure_blacklist" ]
 
 - name: Configure supervision script
   import_tasks: supervision.yml
-  tags: [ "configure", "supervision" ]
+  tags: [ "configure_supervision" ]
+
+- name: Configure backup script
+  import_tasks: backup.yml
+  tags: [ "configure_backup" ]
+
+
+

roles/deploy-web/tasks/deconfigure.yml

@@ -0,0 +1,36 @@
+- name: Backup blacklist
+  fetch:
+    src: /etc/sentinel/blacklist
+    dest: blacklist
+  tags: [ "backup_blacklist" ]
+
+
+- name: Deconfigure stats script
+  import_tasks: deconfigure_stats.yml
+  tags: [ "deconfigure_stats" ]
+
+- name: Deconfigure blacklist script
+  import_tasks: deconfigure_blacklist.yml
+  tags: [ "deconfigure_blacklist" ]
+
+
+- name: Deconfigure supervision script
+  import_tasks: deconfigure_supervision.yml
+  tags: [ "deconfigure_supervision" ]
+
+- name: Deconfigure backup script
+  import_tasks: deconfigure_backup.yml
+  tags: [ "deconfigure_backup" ]
+
+
+- name: Remove sentinel directory
+  file:
+    state: absent
+    path: "{{ item }}/sentinel"
+  with_items: 
+    - /usr/local/bin
+    - /etc
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/tasks/deconfigure_backup.yml

@@ -0,0 +1,31 @@
+# tasks file for stats script
+
+- name: "Create log for backup script"
+  file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - "/var/log/scw-log"
+    - "/root/log"
+    - "/opt/scw-backup.sh"
+    - "/opt/scw-restore.sh"
+    - "/root/.scw-configrc"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+
+
+#- name: Crontab blacklist
+#  ansible.builtin.cron:
+#    name: "blacklist script"
+#    cron_file: "blacklist_cron"
+#    minute: "*/5"
+#    job: "bash /usr/local/bin/sentinel/blacklist.sh"
+#    user: root
+#
+#  vars:
+#    ansible_become: yes
+#    ansible_become_method: sudo
+#    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/tasks/deconfigure_blacklist.yml

@@ -0,0 +1,25 @@
+# tasks file for stats script
+
+
+- name: Remove crontab blacklist
+  ansible.builtin.cron:
+    name: "blacklist script"
+    cron_file: "blacklist_cron"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Remove blacklist script
+  copy:
+    src: "{{ item }}.sh"
+    state: absent
+  with_items:
+    - blacklist
+    - refill_blacklist
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+

roles/deploy-web/tasks/deconfigure_stats.yml

@@ -0,0 +1,64 @@
+# tasks file for stats script
+
+
+- name: Remove crontab get info day
+  ansible.builtin.cron:
+    name: "get info day"
+    cron_file: "get_info_day_cron"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Remove crontab get info week
+  ansible.builtin.cron:
+    name: "get info week"
+    cron_file: "get_info_week_cron"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Remove crontab get info month
+  ansible.builtin.cron:
+    name: "get info month"
+    cron_file: "get_info_month_cron"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+
+- name: Remove getinfo script
+  file:
+    path: "/usr/local/bin/sentinel/getinfo_{{ item }}.sh"
+    state: absent
+  with_items:
+    - day
+    - week
+    - month
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Remove token
+  file:
+    path: "/etc/sentinel/token"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Remove template virtualhost
+  file:
+    path: /etc/sentinel/virtualhost
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/tasks/deconfigure_supervision.yml

@@ -0,0 +1,22 @@
+# tasks file for stats script
+
+- name: Remove crontab blacklist
+  ansible.builtin.cron:
+    name: "check ssl script"
+    cron_file: "check_ssl_cron"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+
+- name: Remove check_ssl script
+  file:
+    path: "/usr/local/bin/sentinel/check_ssl.sh"
+    state: absent
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+

roles/deploy-web/tasks/main.yml

@@ -10,3 +10,7 @@
 - name: Destrpy project web
   import_tasks: destroy.yml
   tags: ["destroy"]
+
+- name: Deconfigure project web
+  import_tasks: deconfigure.yml
+  tags: [ "deconfigure" ]

roles/deploy-web/tasks/stats.yml

@@ -1,43 +1,22 @@
 # tasks file for stats script
 
-- name: Create sentinel directory
-  file:
-    state: directory
-    path: "{{ item }}/sentinel"
-  with_items: 
-    - /usr/local/bin
-    - /etc
-  vars:
-    ansible_become: yes
-    ansible_become_method: sudo
-    ansible_become_password: "{{ sudo_password }}"
-
-- name: Template virtualhost
+- name: Template token ipinfo
   template:
-    src: virtualhost.j2
-    dest: /etc/sentinel/virtualhost
-    mode: "0755"
+    src: token.j2
+    dest: /etc/sentinel/token
+    mode: "0555"
   vars:
     ansible_become: yes
     ansible_become_method: sudo
     ansible_become_password: "{{ sudo_password }}"
 
-- name: Template getinfo day script
-  template:
-    src: getinfo_day.sh.j2
-    dest: /usr/local/bin/sentinel/getinfo_day.sh
-    mode: "0755"
-  vars:
-    ansible_become: yes
-    ansible_become_method: sudo
-    ansible_become_password: "{{ sudo_password }}"
-
-- name: Template getinfo month and week script
+- name: Copy getinfo script
   copy:
-    src: "getinfo_{{ item }}.sh.j2"
+    src: "getinfo_{{ item }}.sh"
     dest: "/usr/local/bin/sentinel/getinfo_{{ item }}.sh"
-    mode: "0755"
+    mode: "0555"
   with_items:
+    - day
     - week
     - month
   vars:
@@ -48,8 +27,10 @@
 - name: Crontab get info day
   ansible.builtin.cron:
     name: "get info day"
+    cron_file: "get_info_day_cron"
     minute: "0"
     hour: "3"
+    user: root
     job: "bash /usr/local/bin/sentinel/getinfo_day.sh"
   vars:
     ansible_become: yes
@@ -59,9 +40,11 @@
 - name: Crontab get info week
   ansible.builtin.cron:
     name: "get info week"
+    cron_file: "get_info_week_cron"
     minute: "15"
     hour: "3"
     weekday: "1"
+    user: root
     job: "bash /usr/local/bin/sentinel/getinfo_week.sh"
   vars:
     ansible_become: yes
@@ -70,13 +53,14 @@
 
 - name: Crontab get info month
   ansible.builtin.cron:
-    name: "get info mongth"
+    name: "get info month"
+    cron_file: "get_info_month_cron"
     minute: "30"
     hour: "3"
     day: "1"
+    user: root
     job: "bash /usr/local/bin/sentinel/getinfo_month.sh"
   vars:
     ansible_become: yes
     ansible_become_method: sudo
     ansible_become_password: "{{ sudo_password }}"
-

roles/deploy-web/tasks/supervision.yml

@@ -0,0 +1,36 @@
+# tasks file for stats script
+
+
+- name: Create supervision directory
+  file:
+    state: directory
+    path: "{{ item }}/supervision"
+  with_items: 
+    - /usr/local/bin
+    - /etc
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Copy check_ssl script
+  copy:
+    src: "check_ssl.sh"
+    dest: "/usr/local/bin/supervision/check_ssl.sh"
+    mode: "0555"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"
+
+- name: Crontab check_ssl
+  ansible.builtin.cron:
+    name: "check ssl script"
+    cron_file: "check_ssl_cron"
+    minute: "*/30"
+    user: root
+    job: "bash /usr/local/bin/supervision/check_ssl.sh"
+  vars:
+    ansible_become: yes
+    ansible_become_method: sudo
+    ansible_become_password: "{{ sudo_password }}"

roles/deploy-web/templates/exclude.j2

@@ -0,0 +1,3 @@
+{% for host in ip_exclude_blacklist %}
+{{ host }}
+{% endfor %}

roles/deploy-web/templates/ip.j2

@@ -0,0 +1,3 @@
+{% for host in ip_sender_blacklist %}
+{{ host }}
+{% endfor %}

roles/deploy-web/templates/scw-configrc.j2

@@ -0,0 +1,28 @@
+export AWS_ACCESS_KEY_ID="{{ aws_access_key_id }}"
+export AWS_SECRET_ACCESS_KEY="{{ aws_secret_access_key }}"
+export SCW_REGION="{{ scw_region }}"
+export SCW_ENDPOINT_URL="https://s3.${SCW_REGION}.scw.cloud"
+export SCW_BUCKET="s3://{{ scw_directory }}"
+
+# GPG Key information
+export PASSPHRASE="{{ passphrase }}"
+export GPG_FINGERPRINT="{{ gpg_fingerprint }}"
+# Folder to backup
+export SOURCE="--exclude /sys --exclude /proc --exclude /opt --exclude /tmp --exclude /mnt --exclude /home /"
+
+# Will keep backup up to 1 month
+export KEEP_BACKUP_TIME="1M"
+
+# Will make a full backup every 10 days
+export FULL_BACKUP_TIME="10D"
+
+# Log files
+export LOGFILE_RECENT="/root/log/logfile-recent.log"
+export LOGFILE="/root/log/logfile.log"
+
+ log () {
+	    date=`date +%Y-%m-%d`
+	    hour=`date +%H:%M:%S`
+	    echo "$date $hour $*" >> ${LOGFILE_RECENT}
+}
+export -f log

roles/deploy-web/templates/ssh_port.j2

@@ -0,0 +1 @@
+{{ ssh_port_blacklist }}

roles/deploy-web/templates/token.j2

@@ -0,0 +1 @@
+{{ token_ipinfo }}

roles/deploy-web/templates/virtualhost.j2

@@ -1,3 +1,3 @@
 {% for host in virtualhosts %}
-    {{ host }}
+{{ host }}
 {% endfor %}