254 lines
6.5 KiB
Markdown
254 lines
6.5 KiB
Markdown
# SecourIT - Architecture Infrastructure
|
|
|
|
Vue d'ensemble de l'infrastructure hébergée sur Proxmox VE.
|
|
|
|
## Cartographie globale
|
|
|
|
```mermaid
|
|
graph TB
|
|
subgraph Internet
|
|
User[Utilisateurs]
|
|
DNS[Infomaniak DNS]
|
|
end
|
|
|
|
subgraph "OVH KS-2 (51.195.5.147)"
|
|
subgraph "Proxmox VE"
|
|
subgraph "LXC 100 - nginx-proxy (10.10.10.2)"
|
|
NPM[Nginx Proxy Manager]
|
|
Secourit[secourit.fr<br/>Site statique]
|
|
Wolfsoul[wolfsoulbikers.fr<br/>Site statique]
|
|
AJD[ajd.secourit.fr<br/>Site statique]
|
|
end
|
|
|
|
subgraph "LXC 101 - postgres (10.10.10.10)"
|
|
PG[(PostgreSQL 17)]
|
|
end
|
|
|
|
subgraph "LXC 102 - mariadb (10.10.10.11)"
|
|
MDB[(MariaDB)]
|
|
end
|
|
|
|
subgraph "LXC 103 - dyna-prod (10.10.10.20)"
|
|
DynaBack[Dyna Backend<br/>Express :3000]
|
|
DynaFront[Dyna Frontend<br/>React/Vite :3001]
|
|
end
|
|
|
|
subgraph "LXC 104 - gestion-prod (10.10.10.21)"
|
|
Gestion[Gestion<br/>Next.js :3005]
|
|
end
|
|
|
|
subgraph "LXC 105 - jellyfin (10.10.10.22)"
|
|
Jellyfin[Jellyfin<br/>Media Server :8096]
|
|
end
|
|
|
|
subgraph "LXC 106 - csv-prod (10.10.10.23)"
|
|
CSVBack[CSV Backend<br/>Express :3002]
|
|
CSVFront[CSV Frontend<br/>React/Vite :3003]
|
|
end
|
|
|
|
subgraph "LXC 107 - web-prod (10.10.10.24)"
|
|
Wycz[Wycz<br/>Express :3004]
|
|
Portugais[Portugais<br/>Express :3007]
|
|
end
|
|
|
|
subgraph "LXC 108 - gitea (10.10.10.25)"
|
|
Gitea[Gitea<br/>Git Server :3000]
|
|
end
|
|
|
|
subgraph "LXC 110 - preprod (10.10.10.30)"
|
|
DynaPre[Dyna Preprod<br/>:3100 + :3101]
|
|
GestionPre[Gestion Preprod<br/>:3105]
|
|
end
|
|
end
|
|
|
|
subgraph "Stockage"
|
|
RAID[RAID5 md0<br/>/srv/media<br/>3.6 To]
|
|
KDrive[kDrive<br/>Backups]
|
|
end
|
|
end
|
|
|
|
DNS --> NPM
|
|
User --> DNS
|
|
NPM --> Secourit
|
|
NPM --> Wolfsoul
|
|
NPM --> AJD
|
|
NPM --> DynaFront
|
|
NPM --> Gestion
|
|
NPM --> Jellyfin
|
|
NPM --> CSVFront
|
|
NPM --> Wycz
|
|
NPM --> Portugais
|
|
NPM --> Gitea
|
|
NPM --> DynaPre
|
|
NPM --> GestionPre
|
|
|
|
DynaFront --> DynaBack
|
|
DynaBack --> MDB
|
|
Gestion --> PG
|
|
CSVFront --> CSVBack
|
|
CSVBack --> MDB
|
|
|
|
DynaPre --> MDB
|
|
GestionPre --> PG
|
|
|
|
Jellyfin -.->|lecture| RAID
|
|
|
|
KDrive -.->|backup| MDB
|
|
KDrive -.->|backup| PG
|
|
```
|
|
|
|
## Flux réseau
|
|
|
|
```mermaid
|
|
graph LR
|
|
subgraph "WAN (vmbr0)"
|
|
WAN[51.195.5.147]
|
|
end
|
|
|
|
subgraph "NAT/DNAT"
|
|
DNAT[DNAT Rules]
|
|
end
|
|
|
|
subgraph "LAN (localnet 10.10.10.0/24)"
|
|
LXC100[10.10.10.2<br/>NPM]
|
|
LXC101[10.10.10.10<br/>PostgreSQL]
|
|
LXC102[10.10.10.11<br/>MariaDB]
|
|
LXC103[10.10.10.20<br/>Dyna]
|
|
LXC104[10.10.10.21<br/>Gestion]
|
|
LXC105[10.10.10.22<br/>Jellyfin]
|
|
LXC106[10.10.10.23<br/>CSV]
|
|
LXC107[10.10.10.24<br/>Web]
|
|
LXC108[10.10.10.25<br/>Gitea]
|
|
LXC110[10.10.10.30<br/>Preprod]
|
|
end
|
|
|
|
WAN -->|80,443| DNAT
|
|
DNAT --> LXC100
|
|
WAN -->|8096| LXC105
|
|
WAN -->|3001| LXC103
|
|
WAN -->|3005| LXC104
|
|
```
|
|
|
|
## Dépendances entre projets
|
|
|
|
```mermaid
|
|
graph TD
|
|
subgraph "Bases de données"
|
|
MariaDB[(MariaDB<br/>LXC 102)]
|
|
PostgreSQL[(PostgreSQL<br/>LXC 101)]
|
|
end
|
|
|
|
subgraph "Applications"
|
|
Dyna[Dyna<br/>LXC 103]
|
|
Gestion[Gestion<br/>LXC 104]
|
|
CSV[CSV<br/>LXC 106]
|
|
DynaPre[Dyna Preprod<br/>LXC 110]
|
|
GestionPre[Gestion Preprod<br/>LXC 110]
|
|
end
|
|
|
|
subgraph "Infrastructure"
|
|
NPM[Nginx Proxy Manager<br/>LXC 100]
|
|
Gitea[Gitea<br/>LXC 108]
|
|
Backup[Backup Script<br/>Proxmox Host]
|
|
end
|
|
|
|
Dyna -->|dynasqy| MariaDB
|
|
Dyna -->|dynasqy_preprod| MariaDB
|
|
CSV -->|csv| MariaDB
|
|
CSV -->|csv_preprod| MariaDB
|
|
Gestion -->|gestion_secourit| PostgreSQL
|
|
Gestion -->|gestion_secourit_preprod| PostgreSQL
|
|
DynaPre -->|dynasqy_preprod| MariaDB
|
|
GestionPre -->|gestion_secourit_preprod| PostgreSQL
|
|
|
|
NPM -.->|SSL + proxy| Dyna
|
|
NPM -.->|SSL + proxy| Gestion
|
|
NPM -.->|SSL + proxy| CSV
|
|
|
|
Backup -.->|dump MariaDB| MariaDB
|
|
Backup -.->|dump PostgreSQL| PostgreSQL
|
|
Backup -.->|upload| KDrive[kDrive]
|
|
```
|
|
|
|
## Domaines et SSL
|
|
|
|
```mermaid
|
|
graph LR
|
|
subgraph "Domaines wildcard"
|
|
A[secourit.fr] -->|A record| IP[51.195.5.147]
|
|
B[*.secourit.fr] -->|A record| IP
|
|
end
|
|
|
|
subgraph "Certificats Let's Encrypt"
|
|
C1[dyna.secourit.fr]
|
|
C2[gestion.secourit.fr]
|
|
C3[secourit.fr]
|
|
C4[wolfsoulbikers.fr]
|
|
C5[ajd.secourit.fr]
|
|
C6[tv.secourit.fr]
|
|
C7[csv.secourit.fr]
|
|
C8[wycz.fr + www]
|
|
C9[portugal.secourit.fr]
|
|
C10[git.secourit.fr]
|
|
C11[dyna-preprod.secourit.fr]
|
|
C12[gestion-preprod.secourit.fr]
|
|
end
|
|
```
|
|
|
|
## Sauvegardes
|
|
|
|
```mermaid
|
|
graph LR
|
|
subgraph "Proxmox Host"
|
|
Cron[Cron<br/>Dim 3h00]
|
|
Script[/usr/local/bin/<br/>proxmox-backup.sh]
|
|
end
|
|
|
|
subgraph "Sources"
|
|
MariaDB[(MariaDB)]
|
|
PG[(PostgreSQL)]
|
|
Nginx[/etc/nginx/<br/>sites/]
|
|
DynaData[/opt/dyna/<br/>uploads + gallery]
|
|
GestionData[/opt/gestion/<br/>app]
|
|
GiteaData[/opt/gitea/<br/>data]
|
|
PVEConf[/etc/pve/]
|
|
end
|
|
|
|
subgraph "Destination"
|
|
KDrive[kDrive<br/>rclone]
|
|
end
|
|
|
|
Cron --> Script
|
|
Script --> MariaDB
|
|
Script --> PG
|
|
Script --> Nginx
|
|
Script --> DynaData
|
|
Script --> GestionData
|
|
Script --> GiteaData
|
|
Script --> PVEConf
|
|
Script --> KDrive
|
|
|
|
KDrive -.->|Retention 3| Old[Suppression<br/>anciens backups]
|
|
```
|
|
|
|
## Sécurité
|
|
|
|
| Mesure | Détail |
|
|
|--------|--------|
|
|
| SSH | Clé SSH uniquement (pas de mot de passe) |
|
|
| fail2ban | Protection brute force SSH |
|
|
| SSL | Let's Encrypt sur tous les domaines via NPM |
|
|
| Firewall | UFW sur Proxmox host |
|
|
| Isolation | Chaque service dans son propre LXC |
|
|
| BDD | Utilisateurs dédiés par appli, pas d'accès root |
|
|
|
|
## Fichiers clés
|
|
|
|
| Fichier | Emplacement | Description |
|
|
|---------|-------------|-------------|
|
|
| Backup script | `/usr/local/bin/proxmox-backup.sh` | Script hebdomadaire de sauvegarde |
|
|
| rclone config | `/root/.config/rclone/rclone.conf` | Config kDrive |
|
|
| Backup log | `/var/log/proxmox-backup.log` | Log des sauvegardes |
|
|
| NPM config | LXC 100, Docker volume | Nginx Proxy Manager |
|
|
| Gitea data | LXC 108, Docker volume | Données Git |
|