NixOS est un system d’exploitation reproductible ce qui était nécéssaire dans notre cas car il y avait deux vm identique qui devais posséder la meme configuration.
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{
config,
pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
./haproxy.nix
./networking.nix
];
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# boot.loader.grub.efiSupport = true;
# boot.loader.grub.efiInstallAsRemovable = true;
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
networking.hostName = "haproxy"; # Define your hostname.
# Set your time zone.
time.timeZone = "Europe/Paris";
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.permitRootLogin = "yes";
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
networking.firewall.enable = false;
#NixOS Version
system.stateVersion = "22.11"; # Did you read the comment?
}
{ config, pkgs, ... }:{
services.haproxy = {
enable = true;
config = ''
#FRONTEND permet d'exposer en public les ports
frontend web
bind 10.2.10.10:80
#Permet d'exposer le site sur HAPROXY
bind 10.2.10.10:443 ssl crt /etc/ssl/certs/groupe2.pem # Il faut générer le certificat sinon cela ne marchera pas
mode http
default_backend web-servers
frontend dns
bind 10.2.10.10:53
mode dns
default_backend dns-servers
frontend ftp
bind 10.2.10.10:21
mode tcp
default_backend ftp-servers
#permet de se connecter au groupes de serveurs
backend web-servers
mode http
balance roundrobin
server server1 10.2.10.1:80 check
server server2 10.2.10.2:80 check
listen dns
bind 10.2.10.10:53
mode tcp
server dns1 10.2.10.1:53 check
server dns2 10.2.10.2:53 check
backend ftp-servers
mode tcp
balance roundrobin
server server1 10.2.10.1:21 check
server server2 10.2.10.2:21 check
'';
};
}
Il a fallut générer des certificats avec openssl
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout groupe2.key -out groupe2.crt
et ensuite en faire un certificat
cat groupe2.key groupe2.crt > /var/ssl/groupe2.pem
Voici haproxy de lancé