# SecourIT - Architecture Infrastructure
Vue d'ensemble de l'infrastructure hébergée sur Proxmox VE.
## Cartographie globale
```mermaid
graph TB
subgraph Internet
User[Utilisateurs]
DNS[Infomaniak DNS]
end
subgraph "OVH KS-2 (51.195.5.147)"
subgraph "Proxmox VE"
subgraph "LXC 100 - nginx-proxy (10.10.10.2)"
NPM[Nginx Proxy Manager]
Secourit[secourit.fr
Site statique]
Wolfsoul[wolfsoulbikers.fr
Site statique]
AJD[ajd.secourit.fr
Site statique]
end
subgraph "LXC 101 - postgres (10.10.10.10)"
PG[(PostgreSQL 17)]
end
subgraph "LXC 102 - mariadb (10.10.10.11)"
MDB[(MariaDB)]
end
subgraph "LXC 103 - dyna-prod (10.10.10.20)"
DynaBack[Dyna Backend
Express :3000]
DynaFront[Dyna Frontend
React/Vite :3001]
end
subgraph "LXC 104 - gestion-prod (10.10.10.21)"
Gestion[Gestion
Next.js :3005]
end
subgraph "LXC 105 - jellyfin (10.10.10.22)"
Jellyfin[Jellyfin
Media Server :8096]
end
subgraph "LXC 106 - csv-prod (10.10.10.23)"
CSVBack[CSV Backend
Express :3002]
CSVFront[CSV Frontend
React/Vite :3003]
end
subgraph "LXC 107 - web-prod (10.10.10.24)"
Wycz[Wycz
Express :3004]
Portugais[Portugais
Express :3007]
end
subgraph "LXC 108 - gitea (10.10.10.25)"
Gitea[Gitea
Git Server :3000]
end
subgraph "LXC 110 - preprod (10.10.10.30)"
DynaPre[Dyna Preprod
:3100 + :3101]
GestionPre[Gestion Preprod
:3105]
end
end
subgraph "Stockage"
RAID[RAID5 md0
/srv/media
3.6 To]
KDrive[kDrive
Backups]
end
subgraph "Backups clients WordPress"
FTP[vsftpd
Proxmox Host]
EventDir[/srv/backups/event-solutions/uploads/]
BonelliDir[/srv/backups/bonelli/uploads/]
end
end
DNS --> NPM
User --> DNS
NPM --> Secourit
NPM --> Wolfsoul
NPM --> AJD
NPM --> DynaFront
NPM --> Gestion
NPM --> Jellyfin
NPM --> CSVFront
NPM --> Wycz
NPM --> Portugais
NPM --> Gitea
NPM --> DynaPre
NPM --> GestionPre
DynaFront --> DynaBack
DynaBack --> MDB
Gestion --> PG
CSVFront --> CSVBack
CSVBack --> MDB
DynaPre --> MDB
GestionPre --> PG
Jellyfin -.->|lecture| RAID
KDrive -.->|backup| MDB
KDrive -.->|backup| PG
FTP -.->|chroot| EventDir
FTP -.->|chroot| BonelliDir
```
## Flux réseau
```mermaid
graph LR
subgraph "WAN (vmbr0)"
WAN[51.195.5.147]
end
subgraph "NAT/DNAT"
DNAT[DNAT Rules]
end
subgraph "LAN (localnet 10.10.10.0/24)"
LXC100[10.10.10.2
NPM]
LXC101[10.10.10.10
PostgreSQL]
LXC102[10.10.10.11
MariaDB]
LXC103[10.10.10.20
Dyna]
LXC104[10.10.10.21
Gestion]
LXC105[10.10.10.22
Jellyfin]
LXC106[10.10.10.23
CSV]
LXC107[10.10.10.24
Web]
LXC108[10.10.10.25
Gitea]
LXC110[10.10.10.30
Preprod]
end
WAN -->|80,443| DNAT
DNAT --> LXC100
WAN -->|8096| LXC105
WAN -->|3001| LXC103
WAN -->|3005| LXC104
```
## Dépendances entre projets
```mermaid
graph TD
subgraph "Bases de données"
MariaDB[(MariaDB
LXC 102)]
PostgreSQL[(PostgreSQL
LXC 101)]
end
subgraph "Applications"
Dyna[Dyna
LXC 103]
Gestion[Gestion
LXC 104]
CSV[CSV
LXC 106]
DynaPre[Dyna Preprod
LXC 110]
GestionPre[Gestion Preprod
LXC 110]
end
subgraph "Infrastructure"
NPM[Nginx Proxy Manager
LXC 100]
Gitea[Gitea
LXC 108]
Backup[Backup Script
Proxmox Host]
end
Dyna -->|dynasqy| MariaDB
Dyna -->|dynasqy_preprod| MariaDB
CSV -->|csv| MariaDB
CSV -->|csv_preprod| MariaDB
Gestion -->|gestion_secourit| PostgreSQL
Gestion -->|gestion_secourit_preprod| PostgreSQL
DynaPre -->|dynasqy_preprod| MariaDB
GestionPre -->|gestion_secourit_preprod| PostgreSQL
NPM -.->|SSL + proxy| Dyna
NPM -.->|SSL + proxy| Gestion
NPM -.->|SSL + proxy| CSV
Backup -.->|dump MariaDB| MariaDB
Backup -.->|dump PostgreSQL| PostgreSQL
Backup -.->|upload| KDrive[kDrive]
```
## Domaines et SSL
```mermaid
graph LR
subgraph "Domaines wildcard"
A[secourit.fr] -->|A record| IP[51.195.5.147]
B[*.secourit.fr] -->|A record| IP
end
subgraph "Certificats Let's Encrypt"
C1[dyna.secourit.fr]
C2[gestion.secourit.fr]
C3[secourit.fr]
C4[wolfsoulbikers.fr]
C5[ajd.secourit.fr]
C6[tv.secourit.fr]
C7[csv.secourit.fr]
C8[wycz.fr + www]
C9[portugal.secourit.fr]
C10[git.secourit.fr]
C11[dyna-preprod.secourit.fr]
C12[gestion-preprod.secourit.fr]
end
```
## Sauvegardes
```mermaid
graph LR
subgraph "Proxmox Host"
Cron[Cron
Dim 3h00]
Script[/usr/local/bin/
proxmox-backup.sh]
VSFTPD[vsftpd
Port 21]
end
subgraph "Sources"
MariaDB[(MariaDB)]
PG[(PostgreSQL)]
Nginx[/etc/nginx/
sites/]
DynaData[/opt/dyna/
uploads + gallery]
GestionData[/opt/gestion/
app]
GiteaData[/opt/gitea/
data]
PVEConf[/etc/pve/]
end
subgraph "Destination backup interne"
KDrive[kDrive
rclone]
end
subgraph "Backups clients WordPress"
WPEvent[event-solutions.fr
o2switch
UpdraftPlus FTP]
WPBonelli[bonelliphotographie.fr
Infomaniak
UpdraftPlus FTP]
EventDir[/srv/backups/event-solutions/uploads/]
BonelliDir[/srv/backups/bonelli/uploads/]
end
Cron --> Script
Script --> MariaDB
Script --> PG
Script --> Nginx
Script --> DynaData
Script --> GestionData
Script --> GiteaData
Script --> PVEConf
Script --> KDrive
KDrive -.->|Retention 3| Old[Suppression
anciens backups]
WPEvent -.->|FTP| VSFTPD
WPBonelli -.->|FTP| VSFTPD
VSFTPD -.->|chroot| EventDir
VSFTPD -.->|chroot| BonelliDir
```
## Sécurité
| Mesure | Détail |
|--------|--------|
| SSH | Clé SSH uniquement (pas de mot de passe) |
| fail2ban | Protection brute force SSH |
| SSL | Let's Encrypt sur tous les domaines via NPM |
| Firewall | UFW sur Proxmox host |
| Isolation | Chaque service dans son propre LXC |
| BDD | Utilisateurs dédiés par appli, pas d'accès root |
| FTP | vsftpd sur Proxmox host, chroot par user, userlist |
## Fichiers clés
| Fichier | Emplacement | Description |
|---------|-------------|-------------|
| Backup script | `/usr/local/bin/proxmox-backup.sh` | Script hebdomadaire de sauvegarde |
| rclone config | `/root/.config/rclone/rclone.conf` | Config kDrive |
| Backup log | `/var/log/proxmox-backup.log` | Log des sauvegardes |
| vsftpd config | `/etc/vsftpd.conf` | Serveur FTP pour backups clients |
| vsftpd userlist | `/etc/vsftpd.userlist` | Users FTP autorisés |
| NPM config | LXC 100, Docker volume | Nginx Proxy Manager |
| Gitea data | LXC 108, Docker volume | Données Git |