80 lines
2.3 KiB
YAML
80 lines
2.3 KiB
YAML
|
---
|
||
|
|
# Bloc A (ADR 0006) : relais TURN sur 443 pour la visio. coturn n'écoute
|
||
|
|
# qu'en TLS, sur 127.0.0.1 : jamais directement sur l'IP publique — c'est le
|
||
|
|
# routeur Nginx par nom (rôle portail) qui lui amène le trafic du port 443.
|
||
|
|
- name: installer coturn
|
||
|
|
ansible.builtin.apt:
|
||
|
|
name: coturn
|
||
|
|
state: present
|
||
|
|
|
||
|
|
- name: vérifier si le secret existe déjà
|
||
|
|
ansible.builtin.stat:
|
||
|
|
path: "{{ turn_secret_fichier }}"
|
||
|
|
register: turn_secret_stat
|
||
|
|
|
||
|
|
- name: générer le secret partagé une seule fois
|
||
|
|
ansible.builtin.command: openssl rand -hex 32
|
||
|
|
register: turn_secret_genere
|
||
|
|
changed_when: false
|
||
|
|
when: not turn_secret_stat.stat.exists
|
||
|
|
|
||
|
|
- name: déposer le secret (une seule fois)
|
||
|
|
ansible.builtin.copy:
|
||
|
|
content: "{{ turn_secret_genere.stdout }}\n"
|
||
|
|
dest: "{{ turn_secret_fichier }}"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0600"
|
||
|
|
when: not turn_secret_stat.stat.exists
|
||
|
|
|
||
|
|
- name: lire le secret
|
||
|
|
ansible.builtin.slurp:
|
||
|
|
src: "{{ turn_secret_fichier }}"
|
||
|
|
register: turn_secret_lu
|
||
|
|
no_log: true
|
||
|
|
|
||
|
|
- name: créer le dossier de la copie lisible du certificat
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/turnserver/cert
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: turnserver
|
||
|
|
mode: "0750"
|
||
|
|
|
||
|
|
- name: déployer le script de copie du certificat (Ansible + renouvellement certbot)
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: turn-copier-certificat.sh.j2
|
||
|
|
dest: /usr/local/sbin/syllabus-turn-copier-certificat
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0750"
|
||
|
|
|
||
|
|
- name: brancher ce script sur le renouvellement automatique du certificat
|
||
|
|
ansible.builtin.file:
|
||
|
|
src: /usr/local/sbin/syllabus-turn-copier-certificat
|
||
|
|
dest: /etc/letsencrypt/renewal-hooks/deploy/90-turn-coturn.sh
|
||
|
|
state: link
|
||
|
|
|
||
|
|
- name: déployer la configuration de coturn
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: turnserver.conf.j2
|
||
|
|
dest: /etc/turnserver.conf
|
||
|
|
owner: root
|
||
|
|
group: turnserver
|
||
|
|
mode: "0640"
|
||
|
|
vars:
|
||
|
|
turn_secret: "{{ turn_secret_lu.content | b64decode | trim }}"
|
||
|
|
notify: redémarrer coturn
|
||
|
|
|
||
|
|
- name: activer coturn
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: coturn
|
||
|
|
enabled: true
|
||
|
|
|
||
|
|
- name: appliquer la configuration et la copie du certificat
|
||
|
|
ansible.builtin.meta: flush_handlers
|
||
|
|
|
||
|
|
- name: copier le certificat pour coturn et le démarrer avec la vraie configuration
|
||
|
|
ansible.builtin.command: /usr/local/sbin/syllabus-turn-copier-certificat
|
||
|
|
changed_when: true
|