Ansible项目实战（六）

#1. 下载 epel 源

[root@manager ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

[root@manager ~]# yum install ansible redis -y

[root@manager ~]# systemctl start redis && systemctl enable redis

#2. 查看版本

[root@manager ~]# ansible --version

#3. 安装 Python3 配置缓存 facts 变量

[root@manager ~]# yum install openssl-devel bzip2-devel expat-devel gdbm-devel readline-devel \

sqlite-devel gcc gcc-c++ openssl-develzlib zlib-devel python3 python3-devel -y

[root@manager ~]# pip3 install -i https://mirrors.aliyun.com/pypi/simple/ --upgrade pip

[root@manager roles]# pip3 install redis==2.10.6

[root@manager ~]# cd /etc/ansible/roles/

[root@manager roles]# cp /etc/ansible/ansible.cfg ./

[root@manager roles]# cp /etc/ansible/hosts ./

#Ansible 配置内容

[root@manager roles]# vim /etc/ansible/roles/ansible.cfg

...

[defaults]

inventory      = ./hosts

host_key_checking = False

forks          = 50

gathering = smart

fact_caching = redis

fact_caching_timeout = 86400

fact_caching_connection = localhost:6379

...

[root@manager roles]# cat hosts 

[dnsservers]

172.16.1.91

172.16.1.92

[routes]

172.16.1.200

[lbservers]

172.16.1.3

172.16.1.4

[proxyservers]

172.16.1.5

172.16.1.6

[webservers]

172.16.1.7

172.16.1.8 

172.16.1.9

[dbservers]

172.16.1.51

[redisservers]

172.16.1.41

[nfsservers]

172.16.1.32

[backupservers]

172.16.1.31

#1. 免密登录脚本

[root@manager ~]# mkdir /scripts

[root@manager ~]# cat login.sh 

#!/bin/bash

#Description: 多机器密码不一致的情况下，实现如何批量免密登陆操作

#**************************************************************

work_dir=/scripts

pub_file=/root/.ssh/id_rsa.pub

yum install expect -y &> /dev/null

function_upssh()

{

expect -c "

  spawn ssh-copy-id -i ${pub_file} root@$1

  expect {

    \"*yes/no*\" {send \"yes\r\";exp_continue}

    \"*password*\" {send $2\r;exp_continue}}"

}

[ -f ${pub_file} ] || ssh-keygen -t rsa -P '' -f /root/.ssh/id_rsa

for Ip in $(awk '{print $1}' ${work_dir}/hosts.txt)

do

  Passwd=$(awk -v I=${Ip} '{if(I==$1) print $2}' ${work_dir}/hosts.txt)

  function_upssh ${Ip} ${Passwd}

done

#2. 主机密码文件

[root@manager ~]# cat hosts.txt 

172.16.1.91 talent

172.16.1.92 talent

172.16.1.200 talent

172.16.1.3 talent

172.16.1.4 talent

172.16.1.5 talent

172.16.1.6 talent

172.16.1.7 talent

172.16.1.8 talent

172.16.1.9 talent

172.16.1.51 talent

172.16.1.41 talent

172.16.1.32 talent

172.16.1.31 talent

#3. 执行脚本实现免密登录

[root@manager scripts]# sh login.sh

[root@manager ~]# ansible all -m ping

[root@manager roles]# mkdir group_vars

[root@manager roles]# touch group_vars/all

#1. 网络配置初始化

[root@manager roles]# cat network_init.yml 

- hosts: all:!dnsservers:!routes

  tasks:

    - name: debug

      debug:

        msg: "test"

    - name: Delete Gateway

      lineinfile:

        path: /etc/sysconfig/network-scripts/ifcfg-eth1

        regexp: '^GATEWAY='

        state: absent

    - name: Delete DNS

      lineinfile:

        path: /etc/sysconfig/network-scripts/ifcfg-eth1

        regexp: '^DNS*'

        state: absent

    - name: Add  DNS

      lineinfile:

        path: /etc/sysconfig/network-scripts/ifcfg-eth1

        line: "DNS1=223.5.5.5"

    - name: Add Gateway

      lineinfile:

        path: /etc/sysconfig/network-scripts/ifcfg-eth1

        line: "GATEWAY=172.16.1.200"

    - name: Restart Network

      systemd:

        name: network

        state: restarted

#2. 执行 playbook  

[root@manager roles]# ansible-playbook network_init.yml

[root@manager roles]# mkdir base/{vars,tasks,templates,handlers,files} -p

[root@manager roles]# cd base/tasks/

[root@manager tasks]# cat firewall.yml 

- name: Disable Selinux Firewall

  selinux:

    state: disabled

- name: Disable Firewalld

  systemd:

    name: firewalld

    state: stopped

    enabled: no

[root@manager tasks]# cat user.yml 

- name: Create Group User

  group:

    name: ""

    gid: ""

- name: Create User 

  user:

    name: ""

    uid: ""

    group: ""

    create_home: no

    shell: /sbin/nologin

[root@manager tasks]# cat yum_repository.yml

- name: Add Base Yum Repository

  ansible.builtin.get_url:

    url: "https://mirrors.aliyun.com/repo/Centos-7.repo"

    dest: "/etc/yum.repos.d/Centos-7.repo"

    mode: '0644'

- name: Add Epel Yum Repository

  ansible.builtin.get_url:

    url: "https://mirrors.aliyun.com/repo/epel-7.repo"

    dest: "/etc/yum.repos.d/epel.repo"

    mode: '0644'

- name: Add Nginx Yum Repository

  yum_repository:

    name: nginx

    description: Nginx Repository

    baseurl: http://nginx.org/packages/centos/7/$basearch/

    gpgcheck: no

- name: Add PHP Yum Repository

  yum_repository:

    name: php71w

    description: php Repository

    baseurl: http://us-east.repo.webtatic.com/yum/el7/x86_64/

    gpgcheck: no

[root@manager tasks]# cat yum_pkg.yml 

- name: Installed Packages All

  yum:

    name: ""

    state: present

  loop:

      - rsync

      - nfs-utils

      - net-tools

      - bind-utils

      - wget

      - tree

      - lrzsz

      - vim

      - unzip

      - httpd-tools

      - bash-completion

      - iotop

      - gzip

      - psmisc

      - yum-utils

      - telnet

      - jq

      - git

      - ntpdate

      - nfs-utils

      - dos2unix

      - lvm2

      - device-mapper-persistent-data

      - MySQL-python

      - iftop

      - glances

[root@manager tasks]# cat limits.yml 

- name: Change Limit /etc/security/limit.conf

  pam_limits:

    domain: "*"

    limit_type: ""

    limit_item: ""

    value: ""

  loop:

    - { limit_type: 'soft', limit_item: 'nofile',value: '100000' }

    - { limit_type: 'hard', limit_item: 'nofile',value: '100000' }

[root@manager tasks]# cat kernel.yml 

- name: Change Port Range

  sysctl:

    name: net.ipv4.ip_local_port_range

    value: '1024 65000'

    sysctl_set: yes

- name: Enabled Forward

  sysctl:

    name: net.ipv4.ip_forward

    value: '1'

    sysctl_set: yes

- name: Enabled tcp_reuse

  sysctl:

    name: net.ipv4.tcp_tw_reuse

    value: '1'

    sysctl_set: yes

- name: Chanage tcp tw_buckets

  sysctl:

    name: net.ipv4.tcp_max_tw_buckets

    value: '5000'

    sysctl_set: yes

- name: Chanage tcp_syncookies

  sysctl:

    name: net.ipv4.tcp_syncookies

    value: '1'

    sysctl_set: yes

- name: Chanage tcp max_syn_backlog

  sysctl:

    name: net.ipv4.tcp_max_syn_backlog

    value: '8192'

    sysctl_set: yes

- name: Chanage tcp Established Maxconn

  sysctl:

    name: net.core.somaxconn

    value: '32768'

    sysctl_set: yes

    state: present

- name: Chanage tcp_syn_retries

  sysctl:

    name: net.ipv4.tcp_syn_retries

    value: '2'

    sysctl_set: yes

    state: present

- name: Chanage net.ipv4.tcp_synack_retries

  sysctl:

    name: net.ipv4.tcp_synack_retries

    value: '2'

    sysctl_set: yes

    state: present

[root@manager tasks]# cat rsyn_time.yml 

- name: Rsync Host Time

  cron:

    name: Rsync Host Time

    minute: '*/5'

    job: /usr/sbin/ntpdate ntp1.aliyun.com &> /dev/null

[root@manager tasks]# cat main.yml 

- name: Firewalld

  include: firewall.yml

- name: Kernel Parameters

  include: kernel.yml

- name: limits

  include: limits.yml

- name: user

  include: user.yml

- name: yum_repository

  include: yum_repository.yml

- name: yum packages

  include: yum_pkg.yml

- name: rsyn time

  include: rsyn_time.yml

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── hosts

└── network_init.yml

#2. 执行 base roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

[root@manager roles]# ansible-playbook top.yml -t base

[root@manager roles]# mkdir nfs-server/{vars,tasks,templates,handlers,files} -p

[root@manager roles]# cd nfs-server/

[root@manager nfs-server]# cat templates/expots.j2 

<!--swig9--> <!--swig10-->(rw,all_squash,anonuid=<!--swig11-->,anongid=<!--swig12-->) 

<!--swig13--> <!--swig14-->(rw,all_squash,anonuid=<!--swig15-->,anongid=<!--swig16-->)

[root@manager nfs-server]# cat tasks/main.yml 

- name: Configre NFS Server

  template:

    src: expots.j2

    dest: /etc/exports

    owner: root

    group: root

    mode: '0644'

  notify: Restart NFS Server

- name: Create NFS dir

  file:

    path: ""

    state: directory

    owner: ""

    group: ""

    mode: '0755'

    recurse: yes

  loop:

    - ""

    - ""

- name: Start NFS Server

  systemd:

    name: nfs

    state: started

[root@manager nfs-server]# cat handlers/main.yml 

- name: Restart NFS Server

 systemd:

   name: nfs

   state: restarted

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

# nfs

nfs_share_zrlog: /data/zrlog

nfs_share_blog: /data/blog

nfs_allow_ip: 172.16.1.0/24

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── hosts

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

└── top.yml

#2. 执行 nfs roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs

[root@manager roles]# ansible-playbook top.yml -t nfs

#3. 验证测试

[root@manager roles]# showmount -e 172.16.1.32

Export list for 172.16.1.32:

/data/zrlog 172.16.1.0/24

/data/blog  172.16.1.0/24

[root@manager roles]# mkdir mysql-server/{vars,tasks,templates,handlers,files} -p

[root@manager roles]# cat mysql-server/tasks/main.yml 

# 1. 配置 YUM 源

- name: Add MySQL <!--swig22--> Yum Repository

  yum_repository:

    name: mysql-community

    description: MySQL <!--swig23--> Community Server

    baseurl: https://repo.mysql.com/yum/mysql-5.7-community/el/7/$basearch/

    gpgkey: https://repo.mysql.com/RPM-GPG-KEY-mysql-2022

    gpgcheck: yes

    enabled: yes

    sslverify: yes

# 2. 导入 MySQL KEY

- name: Import MySQL GPG key

  rpm_key:

    key: https://repo.mysql.com/RPM-GPG-KEY-mysql-2022

    state: present

# 3. 安装 MySQL Server

- name: Installed MySQL Server <!--swig24-->

  yum:

    name: "mysql-community-server"

    state: present

# 4. 启动并设置开机自启

- name: Start MySQL Server

  service:

    name: mysqld

    state: started

    enabled: yes

# 5. 获取初始临时密码

- name: Get MySQL Init Passwd

  shell: grep 'temporary password' /var/log/mysqld.log | awk '{print $NF}'

  register: mysql_temp_password

  changed_when: false

# 6. 修改 root 密码（首次登录必须修改）

- name: Change MySQL Root Passwd

  shell: |

    mysql -u root -p'' --connect-expired-password \

    -e "ALTER USER 'root'@'localhost' IDENTIFIED BY ''; flush privileges;"

  ignore_errors: yes  # 忽略可能的临时密码失效问题（如已手动修改过）

# 7. 删除 MySQL 中匿名用户账号

- name: Removes all anonymous user accounts

  mysql_user:

    login_user: root

    login_password: ""

    name: ''

    host_all: yes

    state: absent

# 8. 创建用户

- name: Create Super User <!--swig28-->

  mysql_user:

    name: ""

    host: ""  # 允许所有 IP（可指定具体 IP 如 192.168.1.%）

    password: ""

    priv: ""

    state: present

    login_user: root

    login_password: ""

  when: mysql_root_password is defined

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

# nfs

nfs_share_zrlog: /data/zrlog

nfs_share_blog: /data/blog

nfs_allow_ip: 172.16.1.0/24

# mysql

mysql_super_user: app

mysql_super_pass: Superman*2025

mysql_super_user_priv: '*.*:ALL'

mysql_allow_ip: '172.16.1.%'

mysql_server_ip: 172.16.1.51

mysql_root_password: "Superman*2025"

mysql_version: "5.7"

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── hosts

├── mysql-server

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   └── vars

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

└── top.yml

#2. 执行 mysql roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs-server

- hosts: dbservers

  roles:

    - role: mysql-server

      tags: mysql

[root@manager roles]# ansible-playbook top.yml -t mysql

[root@manager roles]# mkdir redis/{tasks,templates,handlers,files} -p

[root@manager roles]# cat redis/tasks/main.yml 

- name: Installed Redis Server

  yum:

    name: redis

    state: present

- name: Configure Redis Server

  template:

    src: redis.conf.j2

    dest: /etc/redis.conf

    owner: redis

    group: root

    mode: '0640'

  notify: Restart Redis Server

- name: Start Redis Server

  systemd:

    name: redis

    state: started

    enabled: yes

[root@manager roles]# cat redis/templates/redis.conf.j2 

...

bind 127.0.0.1 <!--swig34-->

...

[root@manager roles]# cat redis/handlers/main.yml 

- name: Restart Redis Server

  systemd:

    name: redis

    state: restarted

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── hosts

├── mysql-server

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   └── vars

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

├── redis

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── redis.conf.j2

└── top.yml

#2. 执行 redis roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs

- hosts: dbservers

  roles:

    - role: mysql-server

      tags: mysql

- hosts: redisservers

  roles:

    - role: redis

      tags: redis

[root@manager roles]# ansible-playbook top.yml -t redis

[root@manager roles]# mkdir nginx/{tasks,templates,handlers,files} -p

[root@manager roles]# cat nginx/tasks/main.yml 

- name: Install Nginx Server

  yum:

    name: nginx

    enablerepo: nginx

    state: present

- name: Configure Nginx nginx.conf

  template:

    src: nginx.conf.j2

    dest: ""

  notify: Restart Nginx Server

- name: Start Nginx Server

  systemd:

    name: nginx 

    state: started

    enabled: yes

[root@manager roles]# cat nginx/templates/nginx.conf.j2 

user <!--swig36-->;

worker_processes  <!--swig37-->;

error_log  /var/log/nginx/error.log notice;

pid        /var/run/nginx.pid;

events {

    worker_connections  <!--swig38-->;

}

http {

    include       /etc/nginx/mime.types;

    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '

                      '$status $body_bytes_sent "$http_referer" '

                      '"$http_user_agent" "$http_x_forwarded_for" "$http_x_via"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include <!--swig39-->;

}

[root@manager roles]# cat nginx/handlers/main.yml 

- name: Restart Nginx Server

  systemd:

    name: nginx

    state: restarted

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

# nfs

nfs_share_zrlog: /data/zrlog

nfs_share_blog: /data/blog

nfs_allow_ip: 192.168.1.0/24

# mysql

mysql_super_user: app

mysql_super_pass: Superman*2025

mysql_super_user_priv: '*.*:ALL'

mysql_allow_ip: '192.168.1.%'

mysql_server_ip: 192.168.1.51

mysql_root_password: "Superman*2025"

mysql_version: "5.7"

# nginx

nginx_conf_path: /etc/nginx/nginx.conf

nginx_include_dir: /etc/nginx/conf.d

nginx_include_path: /etc/nginx/conf.d/*.conf

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── hosts

├── mysql-server

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   └── vars

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

├── nginx

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── nginx.conf.j2

├── redis

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── redis.conf.j2

└── top.yml

#2. 执行 nginx roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs

- hosts: dbservers

  roles:

    - role: mysql-server

      tags: mysql

- hosts: redisservers

  roles:

    - role: redis

      tags: redis

- hosts: webservers

  roles:

    - role: nginx

      tags: nginx

[root@manager roles]# ansible-playbook top.yml -t nginx

[root@manager roles]# mkdir php-fpm/{tasks,templates,handlers,files} -p

[root@manager roles]# cat php-fpm/tasks/main.yml

- name: Installed PHP-FPM Server

  yum: 

    name: "" 

    enablerepo: php71w

    state: present

  loop:

      - php71w 

      - php71w-cli 

      - php71w-common 

      - php71w-devel 

      - php71w-embedded 

      - php71w-gd 

      - php71w-mcrypt 

      - php71w-mbstring 

      - php71w-pdo 

      - php71w-xml 

      - php71w-fpm 

      - php71w-mysqlnd 

      - php71w-opcache 

      - php71w-pecl-memcached 

      - php71w-pecl-redis 

      - php71w-pecl-mongodb

- name: Configure PHP php.ini php-fpm

  template:

    src: ""

    dest: ""

  loop:

    - {src: php.ini.j2 , dest: "" }

    - { src: fpm-www.conf.j2 ,dest: "" }

  notify: Restart PHP Server

- name: Start PHP-FPM Server

  systemd:

    name: php-fpm

    state: started

    enabled: yes

[root@manager roles]# cat php-fpm/templates/fpm-www.conf.j2 

[www]

user = <!--swig45-->

group = <!--swig46-->

listen = 127.0.0.1:9000

listen.allowed_clients = 127.0.0.1

pm = dynamic

pm.max_children = <!--swig47-->

pm.start_servers = <!--swig48-->

pm.min_spare_servers = <!--swig49-->

pm.max_spare_servers = <!--swig50-->

slowlog = /var/log/php-fpm/www-slow.log

php_admin_value[error_log] = /var/log/php-fpm/www-error.log

php_admin_flag[log_errors] = on

php_value[soap.wsdl_cache_dir]  = /var/lib/php/wsdlcache

[root@manager roles]# cat php-fpm/templates/php.ini.j2 

...

session.save_handler = <!--swig51-->

session.save_path = ""

...

[root@manager roles]# cat php-fpm/handlers/main.yml 

- name: Restart PHP Server

  systemd:

    name: php-fpm

    state: restarted

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

# nfs

nfs_share_zrlog: /data/zrlog

nfs_share_blog: /data/blog

nfs_allow_ip: 172.16.1.0/24

# mysql

mysql_super_user: app

mysql_super_pass: Superman*2025

mysql_super_user_priv: '*.*:ALL'

mysql_allow_ip: '172.16.1.%'

mysql_server_ip: 172.16.1.51

mysql_root_password: "Superman*2025"

mysql_version: "5.7"

# nginx

nginx_conf_path: /etc/nginx/nginx.conf

nginx_include_dir: /etc/nginx/conf.d

nginx_include_path: /etc/nginx/conf.d/*.conf

# php-fpm

php_ini_path: /etc/php.ini

php_fpm_path: /etc/php-fpm.d/www.conf

session_method: redis

session_redis_path: "tcp://172.16.1.41:6379?weight=1&timeout=2.5"

fpm_max_process: 200

fpm_start_process: 20

fpm_min_spare_servers: 10

fpm_max_spare_servers: 50

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── hosts

├── mysql-server

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   └── vars

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

├── nginx

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── nginx.conf.j2

├── php-fpm

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       ├── fpm-www.conf.j2

│       └── php.ini.j2

├── redis

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── redis.conf.j2

└── top.yml

#2. 执行 php-fpm roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs

- hosts: dbservers

  roles:

    - role: mysql-server

      tags: mysql

- hosts: redisservers

  roles:

    - role: redis

      tags: redis

- hosts: webservers

  roles:

    - role: nginx

      tags: nginx

- hosts: webservers

  roles:

    - role: php-fpm

      tags: php-fpm    

[root@manager roles]# ansible-playbook top.yml -t php-fpm

[root@manager roles]# mkdir haproxy/{tasks,templates,handlers,files} -p

[root@manager roles]# cat haproxy/tasks/main.yml 

- name: Unarchive /tmp Directory

  unarchive:

    src: haproxy22.rpm.tar.gz

    dest: /tmp

    creates: /tmp/haproxy

- name: Installed Haproxy

  yum:

    name: ""

  vars:

    pack:

      - /tmp/haproxy/haproxy22-2.2.9-3.el7.ius.x86_64.rpm

      - /tmp/haproxy/lua53u-5.3.4-1.ius.el7.x86_64.rpm

      - /tmp/haproxy/lua53u-devel-5.3.4-1.ius.el7.x86_64.rpm

      - /tmp/haproxy/lua53u-libs-5.3.4-1.ius.el7.x86_64.rpm

      - /tmp/haproxy/lua53u-static-5.3.4-1.ius.el7.x86_64.rpm

    remote_src: no

- name: Configure Haproxy Server

  template:

    src: haproxy.cfg.j2

    dest: /etc/haproxy/haproxy.cfg

  notify: Restart Haproxy Server

- name: Create Haproxy Include Dir

  file:

    path: ""

    state: directory

- name: Change Service Configure Add

  lineinfile:

    path: /usr/lib/systemd/system/haproxy.service

    insertafter: '^\[Service\]'

    line: 'Environment="CONFIG_D="'

- name: Change Service Configure ExecStart

  lineinfile:

    path: /usr/lib/systemd/system/haproxy.service

    regexp: '^ExecStart='

    line: 'ExecStart=/usr/sbin/haproxy -Ws -f $CONFIG -f $CONFIG_D -p $PIDFILE $OPTIONS'

- name: Change Service Configure ExecStartPre

  lineinfile:

    path: /usr/lib/systemd/system/haproxy.service

    regexp: '^ExecStartPre='

    line: 'ExecStartPre=/usr/sbin/haproxy -f $CONFIG -f $CONFIG_D -c -q $OPTIONS'

- name: Start Haproxy Server

  systemd:

    name: haproxy

    state: started

    daemon_reload: yes

    enabled: yes

[root@manager roles]# cat haproxy/templates/haproxy.cfg.j2 

#---------------------------------------------------------------------

# Global settings

#---------------------------------------------------------------------

global

    log         127.0.0.1 local2

    chroot      /var/lib/haproxy

    pidfile     /var/run/haproxy.pid

    maxconn     4000

    user        haproxy

    group       haproxy

    daemon

    # turn on stats unix socket

    stats socket /var/lib/haproxy/stats level admin

    #nbproc 4

	nbthread 8

    cpu-map 1 0

    cpu-map 2 1

    cpu-map 3 2

    cpu-map 4 3

defaults

    mode                    http

    log                     global

    option                  httplog

    option                  dontlognull

    option http-server-close

    option forwardfor       except 127.0.0.0/8

    option                  redispatch

    retries                 3

    timeout http-request    10s

    timeout queue           1m

    timeout connect         10s

    timeout client          1m

    timeout server          1m

    timeout http-keep-alive 10s

    timeout check           10s

    maxconn                 3000

#---------------------------------------------------------------------

# main frontend which proxys to the backends

#---------------------------------------------------------------------

#----------------------------------------------------------------

# Listen settings

#----------------------------------------------------------------

##

listen haproxy-stats_2

        bind *:9999

        stats enable

	stats refresh 1s

        stats hide-version

        stats uri /haproxy?stats

        stats realm "HAProxy statistics"

        stats auth admin:123456

        stats admin if TRUE

[root@manager roles]# ll haproxy/files/haproxy22.rpm.tar.gz 

-rw-r--r-- 1 root root 2344836 Nov  3 17:25 haproxy/files/haproxy22.rpm.tar.gz

[root@manager roles]# cat haproxy/handlers/main.yml 

- name: Restart Haproxy Server

  systemd:

    name: haproxy

    state: restarted

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

# nfs

nfs_share_zrlog: /data/zrlog

nfs_share_blog: /data/blog

nfs_allow_ip: 172.16.1.0/24

# mysql

mysql_super_user: app

mysql_super_pass: Superman*2025

mysql_super_user_priv: '*.*:ALL'

mysql_allow_ip: '172.16.1.%'

mysql_server_ip: 172.16.1.51

mysql_root_password: "Superman*2025"

mysql_version: "5.7"

# nginx

nginx_conf_path: /etc/nginx/nginx.conf

nginx_include_dir: /etc/nginx/conf.d

nginx_include_path: /etc/nginx/conf.d/*.conf

# php-fpm

php_ini_path: /etc/php.ini

php_fpm_path: /etc/php-fpm.d/www.conf

session_method: redis

session_redis_path: "tcp://172.16.1.41:6379?weight=1&timeout=2.5"

fpm_max_process: 200

fpm_start_process: 20

fpm_min_spare_servers: 10

fpm_max_spare_servers: 50

# haproxy

haproxy_include_path: /etc/haproxy/conf.d/

proxy_vip: 172.16.1.100

haproxy_port: 80

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── haproxy

│   ├── files

│   │   └── haproxy22.rpm.tar.gz

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── haproxy.cfg.j2

├── hosts

├── mysql-server

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   └── vars

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

├── nginx

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── nginx.conf.j2

├── php-fpm

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       ├── fpm-www.conf.j2

│       └── php.ini.j2

├── redis

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── redis.conf.j2

└── top.yml

#2. 执行 haproxy roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs

- hosts: dbservers

  roles:

    - role: mysql-server

      tags: mysql

- hosts: redisservers

  roles:

    - role: redis

      tags: redis

- hosts: webservers

  roles:

    - role: nginx

      tags: nginx

- hosts: webservers

  roles:

    - role: php-fpm

      tags: php-fpm

- hosts: proxyservers

  roles:

    - role: haproxy

      tags: haproxy

[root@manager roles]# ansible-playbook top.yml -t haproxy

[root@manager roles]# mkdir keepalived/{tasks,templates,handlers,files} -p

[root@manager roles]# cat keepalived/tasks/main.yml 

- name: Install Keepalived Server

  yum:

    name: keepalived

    state: present

- name: Configure Keepalived Server

  template:

    src: keepalived.conf.j2

    dest: /etc/keepalived/keepalived.conf

  notify: Restart Keepalived Server

- name: Started Keepalived Server

  systemd:

    name: keepalived

    state: started

    enabled: yes

[root@manager roles]# cat keepalived/templates/keepalived.conf.j2 

global_defs {     

    router_id <!--swig56-->

}

vrrp_instance VI_1 {

<!--swig57-->

    interface  eth1            # 绑定当前虚拟路由使用的物理接口；

    virtual_router_id 49            # 当前虚拟路由标识，VRID；

    advert_int 3                    # vrrp 通告时间间隔，默认 1s；

    #nopreempt

    authentication {

        auth_type PASS              # 密码类型，简单密码；

        auth_pass 1111              # 密码不超过 8 位字符；

    }

    virtual_ipaddress {

       <!--swig58-->

    }

}

[root@manager roles]# cat keepalived/handlers/main.yml 

- name: Restart Keepalived Server

  systemd:

    name: keepalived

    state: restarted

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── haproxy

│   ├── files

│   │   └── haproxy22.rpm.tar.gz

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── haproxy.cfg.j2

├── hosts

├── keepalived

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── keepalived.conf.j2

├── mysql-server

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   └── vars

├── network_init.yml

├── nfs-server

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   ├── templates

│   │   └── expots.j2

│   └── vars

├── nginx

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── nginx.conf.j2

├── php-fpm

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       ├── fpm-www.conf.j2

│       └── php.ini.j2

├── redis

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── redis.conf.j2

└── top.yml

#2. 执行 keepalived roles

[root@manager roles]# cat top.yml 

- hosts: all

  roles:

    - role: base

      tags: base 

- hosts: nfsservers

  roles:

    - role: nfs-server

      tags: nfs

- hosts: dbservers

  roles:

    - role: mysql-server

      tags: mysql

- hosts: redisservers

  roles:

    - role: redis

      tags: redis

- hosts: webservers

  roles:

    - role: nginx

      tags: nginx

- hosts: webservers

  roles:

    - role: php-fpm

      tags: php-fpm

- hosts: proxyservers

  roles:

    - role: haproxy

      tags: haproxy

- hosts: proxyservers

  roles:

    - role: keepalived

      tags: keepalived

[root@manager roles]# ansible-playbook top.yml -t keepalived

#3. 测试验证

[root@proxy01 ~]# ip addr |grep 172.16.1.100

    inet 172.16.1.100/32 scope global eth1

[root@manager roles]# mkdir lvs/{tasks,templates,handlers,files,meta} -p

[root@manager roles]# cat lvs/meta/main.yml 

dependencies:

 - { role: keepalived }

[root@manager roles]# cat lvs/tasks/main.yml 

- name: Install Ipvsadm Packages

  yum:

    name: ipvsadm

    state: present

- name: Configure LVS Keepalived

  template:

    src: keepalived.conf.j2

    dest: /etc/keepalived/keepalived.conf

  notify: Restart Keepalived Server

- name: Start LVS Keepalived

  systemd:

    name: keepalived

    state: started

    enabled: yes

[root@manager roles]# cat lvs/templates/keepalived.conf.j2 

global_defs {

    router_id <!--swig59-->

}

vrrp_instance VI_1 {

<!--swig60-->

    interface eth1

    virtual_router_id 50

    advert_int 1

    authentication {

        auth_type PASS

        auth_pass 1111

 }

    virtual_ipaddress {

        <!--swig61-->

    }

}

#Http

virtual_server <!--swig62--> <!--swig63--> {

    delay_loop 6

    lb_algo rr

    lb_kind DR

    protocol TCP

<!--swig64-->

}

#Https

virtual_server <!--swig65--> <!--swig66--> {

    delay_loop 6

    lb_algo rr

    lb_kind DR

    protocol TCP

<!--swig67-->

}

[root@manager roles]# cat group_vars/all 

#base

all_group: www

all_user: www

all_uid: 666

all_gid: 666

# nfs

nfs_share_zrlog: /data/zrlog

nfs_share_blog: /data/blog

nfs_allow_ip: 172.16.1.0/24

# mysql

mysql_super_user: app

mysql_super_pass: Superman*2025

mysql_super_user_priv: '*.*:ALL'

mysql_allow_ip: '172.16.1.%'

mysql_server_ip: 172.16.1.51

mysql_root_password: "Superman*2025"

mysql_version: "5.7"

# nginx

nginx_conf_path: /etc/nginx/nginx.conf

nginx_include_dir: /etc/nginx/conf.d

nginx_include_path: /etc/nginx/conf.d/*.conf

# php-fpm

php_ini_path: /etc/php.ini

php_fpm_path: /etc/php-fpm.d/www.conf

session_method: redis

session_redis_path: "tcp://172.16.1.41:6379?weight=1&timeout=2.5"

fpm_max_process: 200

fpm_start_process: 20

fpm_min_spare_servers: 10

fpm_max_spare_servers: 50

# haproxy

haproxy_include_path: /etc/haproxy/conf.d/

proxy_vip: 172.16.1.100

haproxy_port: 80

# lvs

lvs_vip: 172.16.1.100

lvs_port_http: 80

lvs_port_https: 443

lvs_rs_network: lo:0

#1. 目录结构

[root@manager roles]# tree

.

├── ansible.cfg

├── base

│   ├── files

│   ├── handlers

│   ├── tasks

│   │   ├── firewall.yml

│   │   ├── kernel.yml

│   │   ├── limits.yml

│   │   ├── main.yml

│   │   ├── rsyn_time.yml

│   │   ├── user.yml

│   │   ├── yum_pkg.yml

│   │   └── yum_repository.yml

│   ├── templates

│   └── vars

├── group_vars

│   └── all

├── haproxy

│   ├── files

│   │   └── haproxy22.rpm.tar.gz

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── haproxy.cfg.j2

├── hosts

├── keepalived

│   ├── files

│   ├── handlers

│   │   └── main.yml

│   ├── tasks

│   │   └── main.yml

│   └── templates

│       └── keepalived.conf.j2