documentation/Machines virtuelles/gestion.md

Machine virtuelle GESTION

Cette machine est destinée à accueillir le logiciel de comptabilité et gestion des membres de l'association.

Matériel virtuel

CPU : 4
RAM : 3000 Mio Stockage de masse : 50 Gio

Logiciel

Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
Noyau : Linux-libre LTS (linux-libre-lts des dépôts https://linux-libre.fsfla.org)
Sécurités de la maintenance : etckeeper, mollyguard, git, tig, screen
Compta et gestion des membres : garradin
Mail Transfer Agent : postfix

Caractéristiques notables

Domaine : gestion.a-lec.org
Adresse ipv4 publique : 80.67.179.96
Adresse ipv4 interne : 192.169.1.236
Adresse ipv6 publique : 2001:910:1360::1ab

Configuration réseau

/etc/network/interfaces

# The primary network interface
allow-hotplug enp1s0
iface enp1s0 inet dhcp
iface enp1s0 inet6 static
        address 2001:910:1360::1ab/128
        gateway 2001:910:1360::

/etc/host.allow

sshd: 192.169.1.0/24, [2001:910:1360::]/48

/etc/host/deny

sshd: ALL

Configuration MTA

/etc/postfix/transport

a-lec.org    :
*              discard:

/etc/postfix/virtual

@localhost admin@a-lec.org
@gestion.a-lec.org admin@a-lec.org

Configuration serveur web (nginx)

server {
  server_name coffre.a-lec.org;

  set_real_ip_from  192.169.1.1;
  real_ip_header proxy_protocol;

  # Allow large attachments
  client_max_body_size 128M;

  location / {
    proxy_pass http://127.0.0.1:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /notifications/hub {
    proxy_pass http://127.0.0.1:3012;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }

  location /notifications/hub/negotiate {
    proxy_pass http://127.0.0.1:8000;
  }

   listen 443 ssl http2 proxy_protocol; # managed by Certbot
   listen [::]:443 ssl http2; # managed by Certbot
   ssl_certificate /etc/letsencrypt/live/coffre.a-lec.org/fullchain.pem; # managed by Certbot
   ssl_certificate_key /etc/letsencrypt/live/coffre.a-lec.org/privkey.pem; # managed by Certbot
   include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
   ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = coffre.a-lec.org) {
        return 302 https://$host$request_uri;
    } # managed by Certbot

   server_name coffre.a-lec.org;

    listen 80;
    return 404; # managed by Certbot
}

server {

    root /usr/share/garradin/www; # Remplacer par le chemin adéquat vers le dossier public de garradin (ici c'est le défaut du paquet Debian)

    server_name gestion.a-lec.org; # Remplacer par votre nom de domaine
    
    set_real_ip_from  192.169.1.1;
    real_ip_header proxy_protocol;

    location / {
        try_files $uri $uri/ /_route.php?$query_string;
        index index.php /_route.php;
    }

    location ~ \.php {
        try_files $uri $uri/ /_route.php?$query_string;
        include fastcgi.conf;
        #fastcgi_pass 127.0.0.1:9000; # Si vous utilisez PHP-FPM (ou autre) en mode TCP et non sur une socket
        fastcgi_pass unix:/var/run/php/php7.4-garradin.sock; # Si vous utilisez PHP-FPM en mode socket        
    }

    listen 443 ssl proxy_protocol; # managed by Certbot
    listen [::]:443 ssl;
    ssl_certificate /etc/letsencrypt/live/gestion.a-lec.org/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/gestion.a-lec.org/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = gestion.a-lec.org) {
        return 302 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    listen [::]:80;

    server_name gestion.a-lec.org;
    return 404; # managed by Certbot
}