Table des matières
- 2026:
- 2025:
4 billet(s) pour juillet 2026
| Procédure simple augmentation de la SWAP | 2026/07/17 15:49 | Jean-Baptiste |
| Exemple git clone avec Ansible | 2026/07/16 14:47 | Jean-Baptiste |
| Windows exe - Comparaison de fichiers binaires | 2026/07/16 10:25 | Jean-Baptiste |
| Pb git | 2026/07/01 17:36 | Jean-Baptiste |
Notes gitlab - certificats CA
cp -p *.crt /usr/local/share/ca-certificates/ update-ca-certificates
# curl -I https://arty.acme.local curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
# curl --cacert /usr/local/share/ca-certificates/acme-subca1.crt -I https://arty.acme.local HTTP/1.1 200 OK ...
# wget https://arty.acme.local --2026-06-11 11:41:00-- https://arty.acme.local/ Resolving arty.acme.local (arty.acme.local)... 10.245.208.69, 10.245.208.36 Connecting to arty.acme.local (arty.acme.local)|10.245.208.69|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 23381 (23K) [text/html] Saving to: ‘index.html’ index.html 100%[====================================================================================================================>] 22.83K --.-KB/s in 0.02s 2026-06-11 11:41:00 (1.00 MB/s) - ‘index.html’ saved [23381/23381]
# which curl /opt/gitlab/embedded/bin/curl
# cat /opt/gitlab/etc/gitaly/env/SSL_CERT_DIR ; echo /opt/gitlab/embedded/ssl/certs/ # cat /opt/gitlab/embedded/ssl/certs/README This directory is managed by omnibus-gitlab. Any file placed in this directory will be ignored . Place certificates in /etc/gitlab/trusted-certs. # ls -l /etc/gitlab/trusted-certs total 0
Solution
cp -p /usr/local/share/ca-certificates/* /etc/gitlab/trusted-certs/
Redémarrer Gitlab
Notes Gitlab-ci pipeline - API
Voir :
Exemple 1 - avec Access Token ou Personnal Access tokens
Avec Access Token (associé au projet)
- Aller dans le projet - puis : Settings / Access tokens
- Attention : par défaut les Access Tokens ont une date d'expiration
Avec Personnal Access tokens (associé au compte utilisateur)
- Profile / Edit profile / Access Token / Personal Access Tokens
- Attention : par défaut les Personal Access Tokens ont une date d'expiration
Launch pipeline with API call - with Private / Personal access tokens
curl --request POST \ --header "PRIVATE-TOKEN: saltxx-8888888888" \ --header "Content-Type: application/json" \ --data '{ "ref": "master", "variables": [ {"key": "VAR1", "value": "plop"}, {"key": "VAR2", "value": "plop"}, {"key": "VAR3", "value": "plop"}, {"key": "VAR4", "value": ""} ] }' \ --url "${CI_API_V4_URL}/projects/100/pipeline"
Notes
CI_API_V4_URL est une variable magique dont la valeur est de la forme : http://gitlab.acme.local/api/v4
Dans notre cas la variable ref correspond au nom de la branche
Exemple 2 - Avec Trigger Tokens
Voir :
Voir aussi :
Aller dans le projet, puis Settings/ CI/CD / Pipeline trigger tokens
Trigger pipeline with the API / Pass CI/CD variables in the API call
curl --request POST \ --form token=glptt-99999999999999 \ --form ref=master \ --form "variables[VAR1]=plop" \ --form "variables[VAR2]=plop" \ --form "variables[VAR3]=plop" \ --form "variables[VAR4]=plop" \ "${CI_API_V4_URL}/projects/100/trigger/pipeline"
Avec Ansible
.gitlab-ci.yml
launch: tags: # - gitlab-runner-sh-001 - gitlab-runner-docker-001 image: registry.acme.local/repository/local-docker/ansible-builder:0.0.4 stage: build script: ansible-playbook play-launch-ci.yml -e url="${CI_API_V4_URL}" -e token="${TRIGGER_TOKEN}"
play-launch-ci.yml
#! /usr/bin/env ansible-playbook --- - name: Launch CI gather_facts: false hosts: localhost vars: branch: "{{ lookup('env', 'BRANCH') }}" line: "{{ lookup('env', 'LINE') }}" kind: "{{ lookup('env', 'KIND') }}" tasks: - name: Assert check environment vars are correctly defined ansible.builtin.assert: that: - url is defined and url != '' - token is defined and token != '' - branch is defined and branch != '' - line is defined and line != '' - kind is defined and kind != '' msg: "Env var must be defined" - name: Call API # no_log: true register: reg_uri until: reg_uri.status == 201 retries: 3 delay: 5 # Every 5 seconds ansible.builtin.uri: url: "{{ url }}/projects/100/trigger/pipeline" # validate_certs: false status_code: 201 follow_redirects: none method: POST body_format: json headers: Content-Type: "application/json" body: | { "ref": "main", "token": "{{ token }}", "variables": { "BRANCH": "{{ branch }}", "KIND": "{{ kind }}", "LINE": "{{ line }}" } }
Autres
000-colo-switch:prod: stage: deploy variables: PROJECT: "projectname" rules: # whether to include the job in the pipeline - if: $CI_PIPELINE_SOURCE == "trigger" when: always - when: never
Source: https://forum.gitlab.com/t/triggering-a-specific-job-of-the-pipeline-via-api/42397/2
Notes API - REST - outils
Voir :
Outils API
- Advanced REST
- HttpRequester
- RESTClient
- REST-assured
- hoppscotch
- FastAPI (Python)
- Tuto
Voir : https://en.wikipedia.org/wiki/Microservices#Criticism_and_concerns
Low-code :
GUI
- SoapUI
CLI like curl
- HTTPie
Serveur proxy MITM
- Paros
- mitmproxy
Extension Firefox / Chromium :
- Postman ?
- Live HTTP headers
Dev
OpenAPI / Swagger
- hippie-swagger
Autres :
- AsyncAPI & AsyncAPI Generator
API Gateway
- WSO2
PKI - CA - Cert - Ajouter une autorité de certification
Source : https://gist.github.com/cmwylie19/39da645a979d9f514402c67619ae1b45
Voir aussi :
Adding trusted root certificates to the server
Linux (Ubuntu, Debian)
apt install ca-certificates # Copy your CA to dir /usr/local/share/ca-certificates/ sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt sudo update-ca-certificates # To remove/rebuild sudo update-ca-certificates --fresh
Linux (CentOS 6)
yum install ca-certificates #Enable the dynamic CA configuration feature: update-ca-trust force-enable #Add it as a new file to /etc/pki/ca-trust/source/anchors/: cp foo.crt /etc/pki/ca-trust/source/anchors/ update-ca-trust extract
Linux (CentOS 5)
#Append your trusted certificate to file /etc/pki/tls/certs/ca-bundle.crt cat foo.crt >> /etc/pki/tls/certs/ca-bundle.crt
Mac OS X
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/new-root-certificate.crt sudo security delete-certificate -c "<name of existing certificate>"
windows
certutil -addstore -f "ROOT" new-root-certificate.crt certutil -delstore "ROOT" serial-number-hex
Ajouter une CA
Voir :
curl http://satellite.example.com/pub/katello-server-ca.crt -o /etc/pki/ca-trust/source/anchors/satellite-ca.crt update-ca-trust
Pb DNS bind9
Err - address not available resolving
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:503:c27::2:30#53 18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:7fd::1#53 18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:500:200::b#53 18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:500:12::d0d#53
Solution
Pb IPv6. Il faut lancer le daemon avec l'option -4
Err - resolver priming query complete: timed out
10-Jun-2026 17:02:54.990 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete) 17:04:24 [18/1937]10-Jun-2026 17:02:54.990 managed-keys-zone: Key 38696 for zone . is now trusted (acceptance timer complete) 10-Jun-2026 17:03:04.986 resolver priming query complete: timed out 10-Jun-2026 17:03:11.222 chase DS servers resolving 'platform.aws.gts/DS/IN': 192.168.10.1#53 10-Jun-2026 17:03:11.234 chase DS servers resolving 'platform.aws.gts/DS/IN': 192.168.10.2#53 10-Jun-2026 17:03:21.192 resolver priming query complete: timed out 10-Jun-2026 17:03:21.219 broken trust chain resolving 'z1.acme.local/A/IN': 192.168.10.1#53
Solution : Ajouter dnssec-validation no;
named.conf
options { forwarders { 8.8.8.8; 8.8.4.4; }; dnssec-validation no; allow-recursion { trusted; }; allow-query { trusted; }; };
DNSSEC resolution on BIND in 'forwarder' mode fails with SERVFAIL or 'broken trust chain' errors
Source : https://access.redhat.com/solutions/5633621
BIND server fails with resolution of DNSSEC addresses.
The logs contain following errors:
broken trust chain resolving 'DDD.CCC.BBB.AAA.in-addr.arpa/PTR/IN' client ... (DDD.CCC.BBB.AAA.in-addr.arpa): view internal: query failed (SERVFAIL) for DDD.CCC.BBB.AAA.in-addr.arpa/IN/PTR at ../../../bin/named/query.c:8580
Deactivation of DNSSEC resolution restores main DNS functionality:
dnssec-enable no; dnssec-validation no;
Note : Il suffit parfois de dnssec-validation no;
Autres
options { minimal-responses yes; edns-udp-size 512; dnssec-validation auto; };
