🐳 Guide Portainer Complet

# Déploiement de la stack Portainer
docker stack deploy -c portainer-swarm-stack.yml portainer

# Vérification du déploiement
docker stack ls
docker stack services portainer
docker service logs portainer_portainer

# Vérification des agents
docker service ps portainer_agent

# Ajout du repository Helm Portainer
helm repo add portainer https://portainer.github.io/k8s/
helm repo update

# Installation de Portainer
helm install portainer portainer/portainer \
  --create-namespace \
  --namespace portainer \
  --set service.type=LoadBalancer \
  --set tls.force=true

# Vérification du déploiement
kubectl get all -n portainer

# Récupération de l'IP externe
kubectl get svc -n portainer

apiVersion: v1
kind: Namespace
metadata:
  name: portainer
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: portainer-sa-clusteradmin
  namespace: portainer
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: portainer-crb-clusteradmin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: portainer-sa-clusteradmin
  namespace: portainer
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: portainer-pvc
  namespace: portainer
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: portainer
  namespace: portainer
spec:
  replicas: 1
  selector:
    matchLabels:
      app: portainer
  template:
    metadata:
      labels:
        app: portainer
    spec:
      serviceAccountName: portainer-sa-clusteradmin
      containers:
      - name: portainer
        image: portainer/portainer-ce:latest
        ports:
        - containerPort: 9000
        - containerPort: 9443
        - containerPort: 8000
        volumeMounts:
        - name: data
          mountPath: /data
        resources:
          limits:
            memory: "512Mi"
            cpu: "500m"
          requests:
            memory: "256Mi"
            cpu: "250m"
        livenessProbe:
          httpGet:
            path: /api/status
            port: 9000
          initialDelaySeconds: 30
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /api/status
            port: 9000
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: portainer-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: portainer
  namespace: portainer
spec:
  type: LoadBalancer
  ports:
  - port: 9000
    targetPort: 9000
    name: http
  - port: 9443
    targetPort: 9443
    name: https
  - port: 8000
    targetPort: 8000
    name: edge
  selector:
    app: portainer

# Application des manifestes
kubectl apply -f portainer-k8s.yaml

# Vérification du déploiement
kubectl get pods -n portainer
kubectl get svc -n portainer

# Vérification des logs
kubectl logs -n portainer deployment/portainer

# Port-forward pour accès local (si pas de LoadBalancer)
kubectl port-forward -n portainer svc/portainer 9000:9000 9443:9443

# Installation de Certbot
sudo apt install -y certbot python3-certbot-nginx

# Génération du certificat
sudo certbot --nginx -d portainer.votre-domaine.com

# Configuration Nginx pour Portainer
cat > /etc/nginx/sites-available/portainer << 'EOF'
server {
    listen 80;
    server_name portainer.votre-domaine.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name portainer.votre-domaine.com;

    ssl_certificate /etc/letsencrypt/live/portainer.votre-domaine.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/portainer.votre-domaine.com/privkey.pem;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://localhost:9000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 86400;
    }
}
EOF

# Activation du site
sudo ln -s /etc/nginx/sites-available/portainer /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# Configuration Docker avec restriction IP
docker run -d \
  --name portainer \
  --restart=always \
  -p 127.0.0.1:9000:9000 \
  -p 127.0.0.1:9443:9443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:latest

# Configuration UFW pour restriction
sudo ufw deny 9000
sudo ufw deny 9443
sudo ufw allow from 192.168.1.0/24 to any port 9000
sudo ufw allow from 192.168.1.0/24 to any port 9443

# Fail2ban pour Portainer
cat > /etc/fail2ban/jail.d/portainer.conf << 'EOF'
[portainer]
enabled = true
port = 9000,9443
filter = portainer
logpath = /var/lib/docker/containers/*/portainer*-json.log
maxretry = 3
bantime = 3600
findtime = 600
EOF

# Filtre Fail2ban
cat > /etc/fail2ban/filter.d/portainer.conf << 'EOF'
[Definition]
failregex = .*Invalid credentials.*.*
ignoreregex =
EOF

sudo systemctl restart fail2ban

# Génération de la commande Edge Agent depuis Portainer UI
# Environments > Add environment > Edge Agent

# Exemple de commande générée
docker run -d \
  --name portainer_edge_agent \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/lib/docker/volumes:/var/lib/docker/volumes \
  -v /:/host \
  -v portainer_agent_data:/data \
  --label "io.portainer.agent=true" \
  -e EDGE=1 \
  -e EDGE_ID=votre-edge-id \
  -e EDGE_KEY=votre-edge-key \
  -e CAP_HOST_MANAGEMENT=1 \
  portainer/agent:latest

# Configuration du tunnel (si nécessaire)
# Pour les environnements derrière NAT/Firewall

#!/bin/bash
# portainer-multi-env-setup.sh

PORTAINER_URL="https://portainer.votre-domaine.com"
USERNAME="admin"
PASSWORD="VotreMotDePasse"

# Liste des environnements à ajouter
declare -A ENVIRONMENTS=(
    ["prod-web"]="tcp://prod-web.domain.com:2376"
    ["staging"]="tcp://staging.domain.com:2376"
    ["dev"]="tcp://dev.domain.com:2376"
)

# Authentification
TOKEN=$(curl -s -X POST "$PORTAINER_URL/api/auth" \
  -H "Content-Type: application/json" \
  -d "{\"Username\":\"$USERNAME\",\"Password\":\"$PASSWORD\"}" \
  --insecure | jq -r '.jwt')

# Fonction pour ajouter un environnement
add_environment() {
    local name=$1
    local url=$2
    
    echo "Ajout de l'environnement: $name ($url)"
    
    curl -s -X POST "$PORTAINER_URL/api/endpoints" \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d "{
        \"Name\": \"$name\",
        \"URL\": \"$url\",
        \"EndpointCreationType\": 1,
        \"TLS\": true,
        \"TLSSkipVerify\": true
      }" \
      --insecure
}

# Ajout de tous les environnements
for env_name in "${!ENVIRONMENTS[@]}"; do
    add_environment "$env_name" "${ENVIRONMENTS[$env_name]}"
    sleep 2
done

echo "Configuration multi-environnements terminée!"