PoC BunkerWeb 1.6.17 : docker-compose sur Proxmox, déployé par Ansible

Stack BunkerWeb (scheduler, UI, MariaDB, Redis), sites de test (nginx,
Juice Shop, go-httpbin), filtrage DOCKER-USER, script de tests, README
et schéma d'architecture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

roles/apps/tasks/main.yml

@@ -0,0 +1,68 @@
+---
+- name: Créer l'arborescence des applis
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - "{{ apps_dir }}"
+    - "{{ apps_dir }}/www"
+
+- name: Déposer la vitrine statique
+  ansible.builtin.template:
+    src: "www/{{ item }}.j2"
+    dest: "{{ apps_dir }}/www/{{ item }}"
+    mode: "0644"
+  loop:
+    - index.html
+    - contact.html
+
+- name: Créer le réseau partagé bw-services (mode single)
+  ansible.builtin.shell: docker network inspect bw-services >/dev/null 2>&1 || { docker network create bw-services && echo created; }
+  register: apps_net
+  changed_when: "'created' in apps_net.stdout"
+  when: poc_mode == 'single'
+
+- name: Générer le compose des applis
+  ansible.builtin.template:
+    src: compose.yml.j2
+    dest: "{{ apps_dir }}/compose.yml"
+    mode: "0644"
+    validate: docker compose -f %s config -q
+
+- name: Démarrer les applis
+  community.docker.docker_compose_v2:
+    project_src: "{{ apps_dir }}"
+    project_name: apps
+    pull: missing
+    remove_orphans: true
+    state: present
+
+- name: Filtrage des ports publiés (mode split)
+  when: poc_mode == 'split'
+  block:
+    - name: Installer iptables
+      ansible.builtin.apt:
+        name: iptables
+        state: present
+
+    - name: Déposer le script de filtrage
+      ansible.builtin.template:
+        src: bwpoc-firewall.sh.j2
+        dest: /usr/local/sbin/bwpoc-firewall.sh
+        mode: "0755"
+      notify: Recharger le filtrage applis
+
+    - name: Déposer l'unité systemd
+      ansible.builtin.copy:
+        src: bwpoc-firewall.service
+        dest: /etc/systemd/system/bwpoc-firewall.service
+        mode: "0644"
+      notify: Recharger le filtrage applis
+
+    - name: Activer le filtrage au démarrage
+      ansible.builtin.systemd_service:
+        name: bwpoc-firewall.service
+        enabled: true
+        state: started
+        daemon_reload: true