<?xml version="1.0" encoding="utf-8"?>

<creole>
    <files>
        <service servicelist='dyn_route'>quagga</service>
        <file name='/etc/eole/ssl/ca-sphynx.conf' mkdir="True"/>
        <file name='/etc/eole/ssl/certif-vpn.conf' mkdir="True"/>
        <file name='/etc/arv/arv.conf'/>
        <file name='/usr/share/eole/bastion/data/60-Sphynx_rules' mode='755' />
        <file filelist='dyn_route' name='/etc/quagga/zebra.conf'/>
        <file filelist='dyn_route' name='/etc/quagga/debian.conf' source='quagga.conf'/>
        <file filelist='dyn_route' name='/etc/quagga/daemons' source='quagga-daemons'/>
        <file filelist='dyn_route' name='/etc/quagga/ospfd.conf'/>
        <file filelist='dyn_route' name='/etc/quagga/ripd.conf'/>
    </files>

    <variables>

        <family name='general'>
            <variable name='nombre_interfaces' redefine='True' hidden='True'>
                <value>2</value>
            </variable>
            <variable name='eole_module' redefine='True'>
                <value>sphynx</value>
            </variable>
        </family>

        <family name='services'>
            <variable name='dyn_route' type='oui/non' description="Activer le routage dynamique sur l'interface interne 1" >
                 <value>non</value>
            </variable>
        </family>

        <family name='Interface-0'>
            <variable name='eth0_method' redefine='True' hidden='True' >
                <value>statique</value>
            </variable>
            <variable name='admin_eth0' redefine='True' description='Autoriser les connexions pour administrer le serveur (EAD, ARV, ...)'/>
        </family>

        <family name='Interface-1'>
            <variable name='eth1_method' redefine='True' hidden='True' >
                <value>statique</value>
            </variable>
            <variable name='admin_eth1' redefine='True' description='Autoriser les connexions pour administrer le serveur (EAD, ARV, ...)'/>
        </family>

        <family name='réseau avancé' mode='expert'>
            <variable name='activer_routage_ipv4'  redefine='True' hidden='True'>
                <value>oui</value>
            </variable>
            <variable name="activer_firewall" redefine='True' hidden='True'>
                <value>oui</value>
            </variable>
        </family>

        <family name='arv' icon='certificate'>
            <variable name='arv_allow_user' type='string' description='Utilisateurs autorisés à se connecter sur ARV' multi='True'>
                <value>root</value>
                <value>eole</value>
            </variable>
            <variable name='arv_port' type='number' description='Port du serveur ARV' mode='expert' mandatory='True' >
                <value>8088</value>
            </variable>
        </family>

        <family name='rvp' >
            <variable name='ip_test_rvp' redefine='True' hidden='True' />
            <variable name='sw_forceencap' type='oui/non' description="Forcer l'encapsulation (Détection NAT)" mandatory='True' mode='expert' >
                <value>non</value>
            </variable>
            <variable name='sw_mobike' type='oui/non' description="Autoriser le changement d'adresse IP d'une extrémité de connexion" mandatory='True' mode='expert' >
                <value>non</value>
            </variable>
        </family>
        <family name='vpn-pki' icon='key'>
            <variable name='use_pncn' type='oui/non' description='Utiliser la PKI PNCN'>
                <value>oui</value>
            </variable>
            <variable name='x509_default_key_bits' type='number' description='Taille de la clé RSA' mandatory='True'>
                <value>2048</value>
            </variable>
            <variable name='x509_country_name' type='string' description='Nom du pays (2 caractères) (C=)' mandatory='True' hidden='True'/>
            <variable name='x509_locality_name' type='string' description='Localité (L=)' mandatory='True'/>
            <variable name='x509_organization_name' type='string' description="Nom de l'organisation (O=)" mandatory='True'/>
            <variable name='x509_organization_unit_name' type='string' description="Nom de l'unité de l'organisation (OU=)" multi='True' mandatory='True'/>
            <variable name='ou_old_pki' hidden='True' type='string' description="OU ancienne PKI" multi='True'/>
            <variable name='ou_pncn_pki' hidden='True' type='string' description="OU PKI PNCN" multi='True'/>
            <variable name='url_crl' type='string' description='URL des listes de révocation de certificats (sinon rien)' multi='True'/>
            <variable name='fw_interetab_accept' type='oui/non' description='Autoriser les réseaux établissements à communiquer entre eux' >
                <value>non</value>
            </variable>
            <variable name='val_mtu_interetab' type='string' description="Valeur du mtu pour les connexions intersite (ou rien)"/>
            <variable name='ip_source_etab' type='ip' description="Adresse source à autoriser" multi='True'>
                <value>0.0.0.0</value>
            </variable>
            <variable name='netmask_source_etab' type='netmask' description="Adresse netmask de l'IP source à autoriser">
                <value>0.0.0.0</value>
            </variable>
            <variable name='ip_dest_etab' type='ip' description="Adresse destination à autoriser">
                <value>0.0.0.0</value>
            </variable>
            <variable name='netmask_dest_etab' type='netmask' description="Adresse netmask de l'IP destination à autoriser">
                <value>0.0.0.0</value>
            </variable>
            <variable name='proto_dest_etab' type='string' description="Protocole destination à autoriser">
                <value>tout</value>
            </variable>
            <variable name='port_dest_etab' type='string' description="Port destination à autoriser pour TCP et UDP (plage possible)">
                <value>0:65535</value>
            </variable>
        </family>

        <family name='quagga' icon='road'>
            <variable name='dyn_route_type' type='string' description='Choix du protocole de routage a mettre en oeuvre' >
                <value>rip</value>
            </variable>
            <variable name='dyn_route_network' type='ip' description="Adresses reseau autorisee a ajouter des routes dynamiquement" multi='True' />
            <variable name='dyn_route_netmask' type='netmask' description="Masque de sous reseau associee a cette adresse" />
        </family>

        <family name='haute-dispo'>
            <variable name='corosync_dial_if' redefine='True'>
                <value>2</value>
            </variable>
            <variable name='vip_externe' type='ip' description='Adresse IP externe redondée (VIP)' mandatory='True' />
            <variable name='vip_interne' type='ip' description='Adresse IP interne redondée (VIP)' mandatory='True' />
            <variable name='vip_resource_name' redefine='True' mandatory='True' />
            <variable name='activer_resource_arv' type='oui/non' description='Superviser le service ARV' />
            <variable name='service_resource_arv_startdelay' type='number' description="Délai d'attente au lancement d'ARV avant supervision (en secondes)">
                <value>30</value>
            </variable>
            <variable name='synchro_fichiers' redefine ='True' />
        </family>

        <separators>
           <separator name='adresse_ip_eth0'>Configuration de l'interface</separator>
           <separator name='adresse_ip_eth1'>Configuration de l'interface</separator>
           <separator name='x509_default_key_bits'>Paramètres des certificats</separator>
           <separator name='fw_interetab_accept'>Filtrage des tunnels</separator>
           <separator name='vip_externe'>Adresses IP redondées (VIP)</separator>
           <separator name='activer_resource_arv'>Superviser le service ARV</separator>
        </separators>
    </variables>
<!--************************************************************************************************* -->

    <constraints>
        <!-- Sphynx >= 2 cartes réseau ou 3 si haute dispo activée -->
        <check name="valid_enum" target="nombre_interfaces">
            <param>['2','3']</param>
        </check>

        <!-- **** Listes deroulantes **** -->
        <check name="valid_enum" target='proto_dest_etab'>
            <param>['tcp','udp','icmp','tout']</param>
        </check>
        <check name="valid_enum" target='dyn_route_type'>
            <param>['rip','ocsp']</param>
        </check>
        <check name="valid_in_network" target="vip_externe" level="warning">
            <param type='eole' hidden="False">adresse_network_eth0</param>
            <param type='eole'>adresse_netmask_eth0</param>
        </check>
        <check name="valid_in_network" target="vip_interne" level="warning">
            <param type='eole' hidden="False">adresse_network_eth1</param>
            <param type='eole'>adresse_netmask_eth1</param>
        </check>
        <check name="valid_differ" target="vip_externe">
            <param type='eole' hidden="False">adresse_ip_eth0</param>
        </check>
        <check name="valid_differ" target="vip_interne">
            <param type='eole' hidden="False">adresse_ip_eth1</param>
        </check>

        <!-- **** Conditions **** -->
        <condition name='disabled_if_in' source='activer_haute_dispo'>
            <param>non</param>
            <param>esclave</param>
            <target type='variable'>vip_externe</target>
            <target type='variable'>vip_interne</target>
            <target type='variable'>activer_resource_arv</target>
            <target type='variable'>service_resource_arv_startdelay</target>
        </condition>
        <condition name='disabled_if_in' source='activer_resource_arv'>
            <param>non</param>
            <target>service_resource_arv_startdelay</target>
        </condition>

        <condition name='disabled_if_in' source='fw_interetab_accept'>
            <param>non</param>
            <target type='variable'>val_mtu_interetab</target>
            <target type='variable'>ip_source_etab</target>
            <target type='variable'>netmask_source_etab</target>
            <target type='variable'>ip_dest_etab</target>
            <target type='variable'>netmask_dest_etab</target>
            <target type='variable'>proto_dest_etab</target>
            <target type='variable'>port_dest_etab</target>
        </condition>

        <condition name='disabled_if_in' source='dyn_route'>
            <param>non</param>
            <target type='filelist'>dyn_route</target>
            <target type='family'>quagga</target>
            <target type='servicelist'>dyn_route</target>
        </condition>

        <condition name='disabled_if_in' source='use_pncn'>
            <param>non</param>
            <target type='variable'>x509_locality_name</target>
        </condition>

        <!-- **** fill **** -->
        <fill name='calc_multi_val' target='ou_old_pki'>
            <param>education</param>
            <param type='eole' >nom_academie</param>
        </fill>
        <fill name='calc_multi_val' target='ou_pncn_pki'>
            <param>0002 110043015</param>
        </fill>
        <fill name='calc_multi_condition' target='x509_organization_name'>
            <param>non</param>
            <param type='eole' name='condition_1'>use_pncn</param>
            <param name='match'>gouv</param>
            <param name='mismatch'>Education Nationale</param>
        </fill>
        <fill name='calc_multi_condition' target='x509_organization_unit_name'>
            <param>non</param>
            <param type='eole' name='condition_1'>use_pncn</param>
            <param type='eole' name='match'>ou_old_pki</param>
            <param type='eole' name='mismatch'>ou_pncn_pki</param>
        </fill>

        <!-- **** auto **** -->
        <auto name='auto_copy_val' target='x509_country_name'>
            <param type='eole'>ssl_country_name</param>
        </auto>
        <auto name='calc_multi_val' target='synchro_fichiers'>
            <param>/etc/ipsec.conf</param>
            <param>/etc/ipsec.secrets</param>
            <param>/etc/ipsec.d/</param>
            <param>/etc/arv/arv.conf</param>
            <param>/var/lib/arv/db/</param>
            <param>/var/lib/arv/CA/</param>
            <param>/home/data/</param>
        </auto>
        <auto name='calc_multi_condition' target='nombre_interfaces'>
            <param>non</param>
            <param type='eole' name='condition_1'>activer_haute_dispo</param>
            <param name='match'>2</param>
            <param name='mismatch'>3</param>
        </auto>
        <auto name='calc_multi_val' target='vip_resource_name'>
             <param>VIP_externe</param>
             <param>VIP_interne</param>
        </auto>
        <auto name='calc_multi_val' target='vip_resource_if'>
             <param>0</param>
             <param>1</param>
        </auto>
        <auto name='calc_multi_val' target='vip_resource_location'>
             <param>maitre</param>
             <param>maitre</param>
        </auto>
        <auto name='calc_multi_val' target='vip_resource_adresseip'>
             <param type='eole'>vip_externe</param>
             <param type='eole'>vip_interne</param>
        </auto>
        <auto name='calc_multi_val' target='vip_resource_netmask'>
             <param type='eole'>adresse_netmask_eth0</param>
             <param type='eole'>adresse_netmask_eth1</param>
        </auto>
        <auto name='calc_val' target='activer_service_resource'>
             <param>oui</param>
        </auto>
        <auto name='calc_multi_condition' target='service_resource_name'>
            <param>non</param>
            <param type='eole' name='condition_1'>activer_resource_arv</param>
            <param name='match'>ipsec_rsc</param>
            <param name='mismatch'>[u'ipsec_rsc', u'arv_rsc']</param>
            <param name='eval_mismatch'>True</param>
        </auto>
        <auto name='calc_multi_condition' target='service_resource_script'>
            <param>non</param>
            <param type='eole' name='condition_1'>activer_resource_arv</param>
            <param name='match'>strongswan</param>
            <param name='mismatch'>[u'strongswan', u'arv']</param>
            <param name='eval_mismatch'>True</param>
        </auto>
        <auto name='calc_multi_condition' target='service_resource_interval'>
            <param>non</param>
            <param type='eole' name='condition_1'>activer_resource_arv</param>
            <param name='match' type='number'>10</param>
            <param name='mismatch'>[10, 10]</param>
            <param name='eval_mismatch'>True</param>
        </auto>
        <auto name='calc_multi_condition' target='service_resource_timeout'>
            <param>non</param>
            <param type='eole' name='condition_1'>activer_resource_arv</param>
            <param name='match' type='number'>30</param>
            <param name='mismatch'>[30, 30]</param>
            <param name='eval_mismatch'>True</param>
        </auto>
        <auto name='calc_multi_val' target='service_resource_startdelay'>
            <param type='number'>15</param>
            <param type='eole' hidden='False' optional='True'>service_resource_arv_startdelay</param>
        </auto>

        <!-- **** Groupes **** -->
        <group master='ip_source_etab'>
            <slave>netmask_source_etab</slave>
            <slave>ip_dest_etab</slave>
            <slave>netmask_dest_etab</slave>
            <slave>proto_dest_etab</slave>
            <slave>port_dest_etab</slave>
        </group>
        <group master='dyn_route_network'>
            <slave>dyn_route_netmask</slave>
        </group>
    </constraints>

    <help>
        <family name='arv'>Paramétrage de l'interface de génération des configurations RVP</family>
        <family name='quagga'>Configuration du routage dynamique</family>
        <variable name='arv_allow_user'>Utilisateurs système de Sphynx et utilisateurs authorisés dans Zéphir </variable>
        <variable name='url_crl'>URL complète du serveur primaire permettant de télécharger la liste de révocation lorsqu'on utilise des certificats X509 (de la forme http://serveur/fic_crl.crl). Paramètre facultatif (si utilisation de certificats auto-signés ou si L'URL est dans le certificat).</variable>
        <variable name='sw_forceencap'>* UDP/500 si valeur à non et pas de NAT détecté;
* UDP/4500 si valeur à non et NAT détecté ou si valeur à oui.</variable>
        <variable name='sw_mobike'>* UDP/500 si valeur à non;
* UDP/4500 si valeur à oui.</variable>
        <family name='vpn-pki'>Paramètres concernant l'utilisation d'une PKI</family>
        <variable name='use_pncn'>'non' pour configurer Openssl pour l'ancienne PKI ou 'oui' pour le Pôle National de Confiance Numérique (PNCN)</variable>
        <variable name='port_dest_etab'>Port ou plage de ports (exemple: 53 ou 0:65535) pour les protocoles TCP et UDP.
Pour "tout" les protocoles et l'ICMP cette variable est inutile.</variable>
        <variable name='dyn_route'>Activation du routage dynamique</variable>
        <variable name='vip_externe'>Adresse IP externe partagée dans le cluster</variable>
        <variable name='vip_interne'>Adresse IP interne partagée dans le cluster</variable>
        <variable name='activer_resource_arv'>Superviser le service ARV avec pacemaker</variable>
        <variable name='service_resource_arv_startdelay'>Délai avant de contrôler l'état d'ARV. Cela lui laisse le temps de démarrer.</variable>
    </help>

</creole>
<!-- vim: ts=4 sw=4 expandtab
-->
