💻

Client Windows (naboo / coruscant)

Outils de gestion de l'infra

mise

tf · packer · kubectl · helm

Task

task drp · task validate:L0

SOPS + age

chiffrement secrets

Bitwarden CLI

bootstrap credentials

WSL2 / Ansible

config playbooks

PowerShell

12 modules pwsh.*

↕

📦

minfra-v2 GitLab CE kamino

Monorepo IaC — 10 submodules • mirrors → GitHub / GitLab.com / Gitea

infra/

TF · Packer · Ansible · Puppet

docker/

stacks compose + platform

network/

OPNsense IaC

security/

Vault · PKI · RBAC

monitoring/

Prometheus · Grafana

storage/

NAS · Minio · NFS

endpoints/

Windows · edge

packaging/

choco · deb · OVA

dev/

scripts · CI/CD

sandbox/

expérimentations

↕ Terraform + Ansible

🔐

Couche Platform deploy first

Déployée AVANT les autres services

step-ca 1er

PKI interne ACME

*.minfra.internal

Traefik 2e

Reverse proxy + TLS

*.sta4ck.eu · OVH DNS

Authentik 3e

SSO / OIDC forward-auth

blueprints as-code

Unbound DNS

DNS interne (OPNsense)

minfra.internal

↕

⚙️

Services applicatifs (Docker Compose stacks)

Déployés après la couche platform

GitLab CE

kamino VM

Nexus3

registry artefacts

Minio

TF state backend

Vaultwarden

coffre secrets

Grafana / Prom

monitoring

Foreman

provision bare-metal

Choco CCM

mustafar VM

+ media · AI · bots

stacks additionnelles

↕ sur

🖥️

VMs — Proxmox (coruscant) primary + vSphere/ESXi (yavin4) secondary

Templates via Packer · Provisionnées via Terraform · Configurées via Ansible

kamino

GitLab CE

10.0.2.x

kalevala

monitoring stack

10.0.2.x

tatooine

platform (Traefik…)

10.0.2.x

mustafar

Choco CCM

10.0.2.x

hoth

Minio / storage

10.0.2.x

+ templates

debian · ubuntu · win

↕ VLAN 30 — 10.0.2.0/24

🌐

Réseau — OPNsense

Box SFR (DMZ) → OPNsense → VLANs → switches

Box SFR

XGS-PON · Wi-Fi 6

192.168.1.1

OPNsense

Pare-feu · WireGuard

10.0.1.1 · 10.0.2.1

Netgear GS108T

VLANs 802.1Q garage

10.0.1.3

TP-Link SG108PE

8× GbE · 4× PoE salon

10.0.1.2

↕ sur

🏠

Physique — Garage

coruscant

Proxmox primary

Core Ultra 7 265K · 128G · RTX 5080

yavin4

ESXi 8 secondary

NUC 14 Pro · 96G DDR5

endor

Mac Mini M2

Runner CI/CD ARM64

dagobah

Raspberry Pi 4

Watchdog · monitoring

💾

Stockage

jedha

Synology DS1819+

8×8 To SHR-1 ≈ 48 To

APC BR1600MI

UPS 1600 VA

20–30 min autonomie

Google Drive → Bitwarden

Télécharger bw_bootstrap.age

↓

task drp:bootstrap

pwsh Bootstrap.ps1

↓

task drp:secrets

bash bootstrap/bitwarden-init.sh

↓

task drp:repo

git clone git@github.com:sacha-minard/minfra-v2.git

↓

task drp:infra

terraform apply → ansible-playbook site.yml

↓

task drp:platform

stack:deploy platform/pki → traefik → authentik

↓

task drp:services

deploy:core-services

VLAN	Nom	Subnet	Usage
10	Management	10.0.1.0/24	Gestion physiques
20	WAN	192.168.1.0/24	Accès Internet
30	Servers	10.0.2.0/24	VMs applicatives
40	IoT	10.0.4.0/24	Domotique
60	TV / Media	10.0.6.0/24	PS5, Apple TV...

①

step-ca

PKI interne ACME

↓

②

Traefik

Reverse proxy + TLS

↓

③

Authentik

SSO / OIDC

📂 infra/

TF · Packer · Ansible

📂 network/

OPNsense IaC

📂 docker/

Compose stacks

📂 security/

Vault · PKI