Commit initial : infrastructure Ansible pour homeserver

- Playbooks Ansible avec rôles (common, cockpit, docker, services)
- 30+ stacks Docker Compose avec reverse proxy Traefik
- Ansible Vault pour gestion secrets
- Intégration CrowdSec pour détection intrusions
- Versions images Docker fixées pour reproductibilité

stacks/headscale/compose.yml

@@ -0,0 +1,52 @@
+services:
+  tailscale:
+    image: headscale/headscale:0.25
+    container_name: tailscale
+    restart: always
+    environment:
+      - TZ=Europe/Paris
+    volumes:
+      - ./conf:/etc/headscale
+      - ./data:/var/lib/headscale
+    entrypoint: headscale serve
+    networks:
+      - traefik_network
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik_network
+      # Router vers tailscale.tellserv.fr
+      - traefik.http.routers.tailscale.rule=Host(`tailscale.tellserv.fr`)
+      - traefik.http.routers.tailscale.entryPoints=websecure
+      - traefik.http.routers.tailscale.tls=true
+      - traefik.http.routers.tailscale.tls.certResolver=cloudflare
+      - traefik.http.services.tailscale.loadbalancer.server.port=8080
+      - traefik.http.services.tailscale.loadbalancer.server.scheme=http
+      # Middleware CORS pour l’admin
+      - traefik.http.middlewares.headscale-cors.headers.accesscontrolallowmethods=GET,POST,PUT,PATCH,DELETE,OPTIONS
+      - traefik.http.middlewares.headscale-cors.headers.accesscontrolallowheaders=*
+      - traefik.http.middlewares.headscale-cors.headers.accesscontrolalloworiginlist=https://headscale.local.tellserv.fr
+      - traefik.http.middlewares.headscale-cors.headers.accesscontrolmaxage=100
+      - traefik.http.middlewares.headscale-cors.headers.addvaryheader=true
+      - traefik.http.routers.tailscale.middlewares=headscale-cors
+      # UDP ports
+      - traefik.udp.services.tailscale-udp-41641.loadbalancer.server.port=41641
+      - traefik.udp.services.tailscale-udp-3478.loadbalancer.server.port=3478
+  headscale:
+    image: goodieshq/headscale-admin:0.25
+    container_name: headscale
+    restart: unless-stopped
+    networks:
+      - traefik_network
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik_network
+      # Router vers headscale.local.tellserv.fr
+      - traefik.http.routers.headscale.rule=Host(`headscale.local.tellserv.fr`)
+      - traefik.http.routers.headscale.entryPoints=local
+      - traefik.http.routers.headscale.tls=true
+      - traefik.http.routers.headscale.tls.certResolver=cloudflare-local
+      - traefik.http.services.headscale.loadbalancer.server.port=80
+      - traefik.http.services.headscale.loadbalancer.server.scheme=http
+networks:
+  traefik_network:
+    external: true

stacks/headscale/conf/config.yaml

@@ -0,0 +1,72 @@
+server_url: https://tailscale.tellserv.fr
+
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 0.0.0.0:9090
+grpc_listen_addr: 0.0.0.0:50443
+grpc_allow_insecure: false
+
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+prefixes:
+  v6: fd7a:115c:a1e0::/48
+  v4: 100.64.0.0/10
+  allocation: sequential
+
+derp:
+  server:
+    enabled: false
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+
+database:
+  type: sqlite
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+
+log:
+  format: text
+  level: info
+
+policy:
+  path: ""
+
+dns:
+  nameservers:
+    global:
+      - 100.64.0.2
+  search_domains: []
+  magic_dns: false
+  base_domain: example.com
+
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+
+logtail:
+  enabled: false
+
+randomize_client_port: false