Ce qu'Ansible et AWX
peuvent faire pour vous.

---
- name: Provisioning serveur Linux
  hosts: new_servers
  become: true
  vars:
    base_packages:
      - curl
      - vim
      - git
      - fail2ban
      - auditd
    ntp_servers:
      - 0.fr.pool.ntp.org
      - 1.fr.pool.ntp.org

  tasks:
    - name: Mise à jour du cache apt
      apt:
        update_cache: true
        cache_valid_time: 3600

    - name: Installation des paquets de base
      apt:
        name: "{{ base_packages }}"
        state: present

    - name: Configuration du fuseau horaire
      timezone:
        name: Europe/Paris

    - name: Sécurisation SSH (désactivation root)
      lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^PermitRootLogin"
        line: "PermitRootLogin no"
      notify: restart sshd

    - name: Activation fail2ban
      service:
        name: fail2ban
        state: started
        enabled: true

---
- name: Patch management — Rolling update
  hosts: all
  serial: "25%"        # 25 % des serveurs simultanément
  max_fail_percentage: 5
  become: true

  pre_tasks:
    - name: Vérification charge système
      shell: uptime | awk '{print $10}' | tr -d ','
      register: load_avg
      failed_when: load_avg.stdout | float > 2.0

    - name: Snapshot si VM (VMware/KVM)
      vmware_guest_snapshot:
        hostname: "{{ vcenter_hostname }}"
        name: "{{ inventory_hostname }}"
        snapshot_name: "pre-patch-{{ ansible_date_time.date }}"
      delegate_to: localhost
      when: ansible_virtualization_type == "VMware"

  tasks:
    - name: Mise à jour des paquets (Debian/Ubuntu)
      apt:
        upgrade: dist
        update_cache: true
      when: ansible_os_family == "Debian"

    - name: Mise à jour des paquets (RHEL)
      dnf:
        name: "*"
        state: latest
        security: true
      when: ansible_os_family == "RedHat"

    - name: Reboot si noyau mis à jour
      reboot:
        reboot_timeout: 300
        test_command: systemctl is-active sshd

  post_tasks:
    - name: Validation des services critiques
      service_facts:
      register: service_state
    - name: Échec si service critique arrêté
      fail:
        msg: "Service {{ item }} arrêté après patch !"
      when: service_state.ansible_facts.services[item].state != "running"
      loop: "{{ critical_services }}"

---
- name: Configuration switch Cisco IOS
  hosts: cisco_access_switches
  gather_facts: false
  connection: network_cli
  vars:
    ansible_network_os: ios

    vlans:
      - id: 10
        name: PROD_SERVERS
      - id: 20
        name: DMZ
      - id: 100
        name: MANAGEMENT

    ntp_servers:
      - 192.168.100.10
      - 192.168.100.11

    syslog_servers:
      - 192.168.200.50

  tasks:
    - name: Création des VLANs
      cisco.ios.ios_vlans:
        config: "{{ vlans }}"
        state: merged

    - name: Configuration NTP
      cisco.ios.ios_ntp_global:
        config:
          servers:
            - server: "{{ item }}"
              prefer: "{{ loop.index == 1 }}"
        loop: "{{ ntp_servers }}"

    - name: Configuration Syslog
      cisco.ios.ios_logging_global:
        config:
          hosts:
            - host: "{{ item }}"
              severity: informational
        loop: "{{ syslog_servers }}"

    - name: Sauvegarde running-config → startup-config
      cisco.ios.ios_config:
        save_when: always

    - name: Archivage de la config dans Gitea
      net_get:
        src: running-config
        dest: "backups/{{ inventory_hostname }}/{{ ansible_date_time.date }}.cfg"