ajout de passwordpusher

playbooks/deploy_passwordpusher.yml

@@ -0,0 +1,117 @@
+---
+# Playbook: deploy-passwordpusher.yml
+#
+# But:
+# - Copier le docker-compose.yml Password Pusher sur le LXC
+# - Generer le fichier .env.runtime sur le LXC si absent
+# - Garder les secrets hors Git
+# - Demarrer la stack Docker Compose
+# - Verifier que le port 5100 repond
+
+- name: Deployer Password Pusher
+  hosts: passwordpusher_servers
+  become: true
+  gather_facts: false
+
+  vars_prompt:
+    - name: smtp_address
+      prompt: "SMTP address"
+      private: false
+
+    - name: smtp_user
+      prompt: "SMTP username"
+      private: false
+
+    - name: smtp_password
+      prompt: "SMTP password"
+      private: true
+
+  vars:
+    stack_name: passwordpusher
+    stack_path: /opt/stacks/passwordpusher
+    compose_source: "{{ playbook_dir }}/../services/passwordpusher/docker-compose.yml"
+
+  tasks:
+    - name: Verifier que Docker est installe
+      command: docker --version
+      changed_when: false
+
+    - name: Verifier que Docker Compose est installe
+      command: docker compose version
+      changed_when: false
+
+    - name: Creer le dossier de la stack
+      file:
+        path: "{{ stack_path }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0750"
+
+    - name: Creer le dossier de stockage
+      file:
+        path: "{{ stack_path }}/storage"
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Generer le fichier env runtime si absent
+      shell: |
+        set -e
+        umask 077
+
+        if [ ! -f "{{ stack_path }}/.env.runtime" ]; then
+          SECRET_KEY_BASE="$(openssl rand -hex 64)"
+          PWPUSH_MASTER_KEY="$(openssl rand -hex 32)"
+
+          {
+            printf 'SECRET_KEY_BASE=%s\n' "$SECRET_KEY_BASE"
+            printf 'PWPUSH_MASTER_KEY=%s\n' "$PWPUSH_MASTER_KEY"
+            printf 'PWP__MAIL__SMTP_ADDRESS=%s\n' "{{ smtp_address }}"
+            printf 'PWP__MAIL__SMTP_USER_NAME=%s\n' "{{ smtp_user }}"
+            printf 'PWP__MAIL__SMTP_PASSWORD=%s\n' "{{ smtp_password }}"
+          } > "{{ stack_path }}/.env.runtime"
+        fi
+
+        chown root:root "{{ stack_path }}/.env.runtime"
+        chmod 600 "{{ stack_path }}/.env.runtime"
+      args:
+        executable: /bin/bash
+      no_log: true
+      changed_when: true
+      
+    - name: Copier le fichier Docker Compose
+      copy:
+        src: "{{ compose_source }}"
+        dest: "{{ stack_path }}/docker-compose.yml"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Telecharger les images Docker
+      command: docker compose pull
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Demarrer la stack Password Pusher
+      command: docker compose up -d
+      args:
+        chdir: "{{ stack_path }}"
+
+    - name: Attendre le port Password Pusher
+      wait_for:
+        host: 127.0.0.1
+        port: 5100
+        timeout: 180
+
+    - name: Afficher les conteneurs de la stack
+      command: docker compose ps
+      args:
+        chdir: "{{ stack_path }}"
+      register: compose_ps
+      changed_when: false
+
+    - name: Afficher le statut Docker Compose
+      debug:
+        var: compose_ps.stdout_lines

services/passwordpusher/docker-compose.yml

@@ -0,0 +1,84 @@
+---
+services:
+  passwordpusher:
+    image: docker.io/pglombardo/pwpush:stable
+    container_name: passwordpusher
+    restart: unless-stopped
+    platform: linux/amd64
+
+    ports:
+      - "5100:5100"
+
+    env_file:
+      - .env.runtime
+
+    environment:
+      TZ: Europe/Paris
+
+      # URL publique via Caddy
+      PWP__HOST_DOMAIN: passwordpusher.thomasmlg.fr
+      PWP__HOST_PROTOCOL: https
+      PWP__OVERRIDE_BASE_URL: https://passwordpusher.thomasmlg.fr
+      PWP__ALLOWED_HOSTS: "passwordpusher.thomasmlg.fr passwordpusher.thomasmlg.fr:443 10.100.5.104 10.100.5.104:5100 localhost localhost:5100"
+
+      # Cookies securises car l acces public passe par HTTPS via Caddy
+      PWP__SECURE_COOKIES: "true"
+
+      # Pas d acces anonyme
+      PWP__ALLOW_ANONYMOUS: "false"
+
+      # Phase initiale: inscriptions ouvertes pour creer ton compte
+      # Apres creation du compte, passer PWP__DISABLE_SIGNUPS a "true"
+      PWP__DISABLE_SIGNUPS: "false"
+      PWP__DISABLE_LOGINS: "false"
+      PWP__ENABLE_USER_ACCOUNT_EMAILS: "true"
+
+      # SMTP non sensible
+      PWP__MAIL__RAISE_DELIVERY_ERRORS: "true"
+      PWP__MAIL__SMTP_ADDRESS: ssl0.ovh.net
+      PWP__MAIL__SMTP_DOMAIN: thomasmlg.fr
+      PWP__MAIL__SMTP_PORT: "587"
+      PWP__MAIL__SMTP_AUTHENTICATION: plain
+      PWP__MAIL__SMTP_ENABLE_STARTTLS_AUTO: "true"
+      PWP__MAIL__SMTP_OPEN_TIMEOUT: "10"
+      PWP__MAIL__SMTP_READ_TIMEOUT: "10"
+      PWP__MAIL__MAILER_SENDER: passwordpusher@thomasmlg.fr
+
+      # Fonctionnalites
+      PWP__ENABLE_URL_PUSHES: "true"
+      PWP__ENABLE_FILE_PUSHES: "false"
+      PWP__ENABLE_QR_PUSHES: "true"
+      
+      # Branding
+      PWP__BRAND__TITLE: "Thomas MALGOUYRES"
+      PWP__BRAND__TAGLINE: "Partage securisé de mots de passe"
+      PWP__BRAND__DISCLAIMER: "Instance privée reservée a un usage personnel."
+      PWP__BRAND__SHOW_FOOTER_MENU: "false"
+
+      # Theme
+      PWP__THEME: darkly
+
+      # Securite et confidentialite
+      PWP__NOINDEX: "true"
+      PWP__SHOW_VERSION: "false"
+      PWP__THROTTLING__MINUTE: "60"
+      PWP__THROTTLING__SECOND: "10"
+
+      # Interface et logs
+      PWP__DEFAULT_LOCALE: fr
+      PWP__LOG_LEVEL: warn
+      PWP__LOG_TO_STDOUT: "true"
+    volumes:
+      - pwpush-storage:/opt/PasswordPusher/storage
+
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f -H 'Host: passwordpusher.thomasmlg.fr' || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+volumes:
+  pwpush-storage:
+    name: passwordpusher-storage
+    driver: local