Ansible一键部署实例（三）

阅读量

Ansible一键部署实例（三）

业务部署代码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# wordpress业务部署
[root@ansible ~/roles/wordpress]#tree
.
├── files
│   ├── wordpress.conf
│   ├── wordpress.sql
│   └── wordpress.tar.gz
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 6 files
[root@ansible ~/roles/wordpress]#cat tasks/main.yml
---
# tasks file for wordpress

- name: remove nginx default.conf
  shell: rm -rf /etc/nginx/conf.d/default.conf warn=false
  when: ansible_hostname is match "web"

- name: configure wordpress nginx server
  copy:
    src: wordpress.conf
    dest: /etc/nginx/conf.d
  notify: restart web nginx
  when: ansible_hostname is match "web"

- name: create wordpress code dir
  file:
    path: /code/wordpress
    owner: www
    group: www
    state: directory
  when: ansible_hostname is match "web"

- name: Extract wordpress.tar.gz into web /code
  unarchive:
    src: wordpress.tar.gz
    dest: /code/wordpress
  when: ansible_hostname is match "web"

- name: Modify directory permissions
  shell: chown -R www.www /code warn=false
  when: ansible_hostname is match "web"

- name: sent wordpress.sql to db
  copy:
    src: wordpress.sql
    dest: /tmp
  when: ansible_hostname is match "db"

- name: import wordpress.sql
  mysql_db:
    name: all
    state: import
    target: /tmp/wordpress.sql
  register: result
  when: ansible_hostname is match "db"

- name: restart nginx service
  systemd:
    name: nginx
    state: restarted
  when: ansible_hostname is match "web"

- name: restart mariadb service
  systemd:
    name: mariadb
    state: restarted
  when: ansible_hostname is match "db"

- name: mount dir to nfs1
  mount:
    src: 172.16.1.31:/data/wordpress
    path: /code/wordpress/wp-content/uploads
    fstype: nfs
    state: mounted
  when: ansible_hostname is match "web"

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# kod业务部署
[root@ansible ~/roles/kod]#tree
.
├── files
│   ├── kod.conf
│   ├── kod.sql
│   └── kod.tar.gz
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 6 files
[root@ansible ~/roles/kod]#cat tasks/main.yml
---
# tasks file for kod

- name: remove nginx default.conf
  shell: rm -rf /etc/nginx/conf.d/default.conf warn=false
  when: ansible_hostname is match "web"

- name: configure kod nginx server
  copy:
    src: kod.conf
    dest: /etc/nginx/conf.d
  notify: restart web nginx
  when: ansible_hostname is match "web"

- name: create kod code dir
  file:
    path: /code/kod
    owner: www
    group: www
    state: directory
  when: ansible_hostname is match "web"

- name: Extract kod.tar.gz into web /code
  unarchive:
    src: kod.tar.gz
    dest: /code/kod
  when: ansible_hostname is match "web"

- name: Modify directory permissions
  shell: chown -R www.www /code warn=false
  when: ansible_hostname is match "web"

- name: sent kod.sql to db
  copy:
    src: kod.sql
    dest: /tmp
  when: ansible_hostname is match "db"

- name: import kod.sql
  mysql_db:
    name: all
    state: import
    target: /tmp/kod.sql
  register: result
  when: ansible_hostname is match "db"

- name: restart nginx service
  systemd:
    name: nginx
    state: restarted
  when: ansible_hostname is match "web"

- name: restart mariadb service
  systemd:
    name: mariadb
    state: restarted
  when: ansible_hostname is match "db"

- name: mount dir to nfs1
  mount:
    src: 172.16.1.31:/data/kod
    path: /code/kod/data/files
    fstype: nfs
    state: mounted
  when: ansible_hostname is match "web"

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# 部署tomcat服务
[root@ansible ~/roles/tomcat]#tree
.
├── files
│   ├── context.xml
│   ├── jdk.rpm
│   ├── redis-data-cache.properties
│   ├── tomcat.service
│   ├── tomcat_session.tar.gz
│   └── tomcat.tar.gz
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 9 files
[root@ansible ~/roles/tomcat]#cat tasks/main.yml
---
# tasks file for tomcat

- name: sent jdk.rpm and tomcat.service to web
  copy:
    src: "{{ item }}"
    dest: /tmp
  loop:
    - jdk.rpm
    - tomcat.service

- name: install java environment
  shell: yum -y localinstall /tmp/jdk.rpm warn=false

- name: configure systemctl for tomcat
  copy:
    src: tomcat.service
    dest: /usr/lib/systemd/system

- name: create soft dir for tomcat
  file:
    path: /soft
    state: directory

- name: Extract tomcat.tar.gz into web /soft
  unarchive:
    src: tomcat.tar.gz
    dest: /soft

- name: create tomcat link
  file:
    src: /soft/apache-tomcat-9.0.84
    dest: /soft/tomcat
    state: link

- name: Extract tomcat_session.tar.gz into web tomcat for session share
  unarchive:
    src: tomcat_session.tar.gz
    dest: /soft/tomcat/lib

- name: cp redis-data-cache.properties and context.xml to tomcat for session share
  copy:
    src: "{{ item }}"
    dest: /soft/tomcat/conf
  loop:
    - redis-data-cache.properties
    - context.xml

- name: reload by systemctl
  shell: "{{ item }}"
  loop:
    - systemctl daemon-reload
    - systemctl restart tomcat
    - systemctl enable tomcat

- name: remove remains for tomcat
  shell:  rm -rf /tmp/jdk.rpm /tmp/sys_tomcat warn=false

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# zrlog服务部署
[root@ansible ~/roles/zrlog]#tree
.
├── files
│   ├── server.xml
│   ├── zrlog.sql
│   └── zrlog.tar.gz
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 6 files
[root@ansible ~/roles/zrlog]#cat tasks/main.yml
---
# tasks file for zrlog

- name: configure zrlog server
  copy:
    src: server.xml
    dest: /soft/tomcat/conf
  when: ansible_hostname is match "web"

- name: create zrlog code dir
  file:
    path: /code/zrlog/ROOT
    state: directory
  when: ansible_hostname is match "web"

- name: sent zrlog.sql to db
  copy:
    src: zrlog.sql
    dest: /tmp
  when: ansible_hostname is match "db"

- name: import zrlog.sql
  mysql_db:
    name: all
    state: import
    target: /tmp/zrlog.sql
  register: result
  when: ansible_hostname is match "db"

- name: restart mariadb service
  systemd:
    name: mariadb
    state: restarted
  when: ansible_hostname is match "db"

- name: Extract zrlog.tar.gz into web /code/zrlog/ROOT
  unarchive:
    src: zrlog.tar.gz
    dest: /code/zrlog/ROOT
  ignore_errors: yes
  when: ansible_hostname is match "web"

- name: restart tomcat service
  shell: systemctl restart tomcat
  when: ansible_hostname is match "web"

- name: mount dir to nfs1
  mount:
    src: 172.16.1.31:/data/zrlog
    path: /code/zrlog/ROOT/attached
    fstype: nfs
    state: mounted
  when: ansible_hostname is match "web"

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# phpmyadmin部署
[root@ansible ~/roles/phpadmin]#tree
.
├── files
│   ├── admin.conf
│   └── phpadmin.tar.gz
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 5 files
[root@ansible ~/roles/phpadmin]#cat tasks/main.yml
---
# tasks file for phpadmin

- name: remove nginx default.conf
  shell: rm -rf /etc/nginx/conf.d/default.conf warn=false
  when: ansible_hostname is match "web"

- name: configure admin server
  copy:
    src: admin.conf
    dest: /etc/nginx/conf.d
  notify: restart nginx

- name: create admin code dir
  file:
    path: /code/phpadmin
    state: directory

- name: Extract phpadmin.tar.gz into web code_dir
  unarchive:
    src: phpadmin.tar.gz
    dest: /code/phpadmin

- name: Modify directory permissions
  shell: chown -R www.www /code warn=false

...
服务部署代码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
# 负载均衡配置
[root@ansible ~/roles/lb_nginx]#tree
.
├── files
│   ├── proxy.conf
│   └── proxy_params
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 5 files
[root@ansible ~/roles/lb_nginx]#cat tasks/main.yml
---
# tasks file for lb_nginx

- name: remove nginx default.conf
  shell: rm -rf /etc/nginx/conf.d/default.conf warn=false

- name: Reverse proxy proxy_params and Proxy server
  copy:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  loop:
    - { src: proxy_params,dest: /etc/nginx }
    - { src: proxy.conf,dest: /etc/nginx/conf.d }

- name: Restart nginx
  systemd:
    name: nginx
    state: restarted

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# 负载均衡高可用
[root@ansible ~/roles/keepalived]#tree
.
├── files
│   └── keep_nginxcheck.sh
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
│   └── keepalived.conf.j2
└── vars
    └── main.yml

5 directories, 5 files
[root@ansible ~/roles/keepalived]#cat tasks/main.yml
---
# tasks file for keepalived

- name: Istall keepalived service
  yum:
    name: keepalived
    state: present

- name: create shell dir
  file:
    path: /script
    state: directory

- name: Sent nginx check shell
  copy:
    src: keep_nginxcheck.sh
    dest: /script
    mode: '0755'

- name: Configure keepalived service
  template:
    src: keepalived.conf.j2
    dest: /etc/keepalived/keepalived.conf
  notify: Restart keepalived

- name: Start keepalived service
  systemd:
    name: keepalived
    state: started
    enabled: yes

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# 全网定时备份
[root@ansible ~/roles/backup]#tree
.
├── files
│   └── backup.sh
└── tasks
    └── main.yml

2 directories, 2 files
[root@ansible ~/roles/backup]#cat tasks/main.yml
---
# tasks file for backup

- name: Create shell dir
  file:
    path: /script/autobackup
    state: directory
  when: ansible_hostname is not match "backup"

- name: Sent backup.sh all except backup
  copy:
    src: backup.sh
    dest: /script/autobackup
    mode: '0755'
  when: ansible_hostname is not match "backup"

- name: Write in cron tasks for web
  cron:
    name: "{{ item.name}}"
    minute: "*/5"
    #hour: "02"
    job: "{{ item.job }}"
  loop:
    - { name: "Code scheduled backup",job: /bin/bash /script/autobackup/backup.sh /code > /dev/null }
    - { name: "Nginx scheduled backup",job: /bin/bash /script/autobackup/backup.sh /etc/nginx > /dev/null }
  when: ansible_hostname is match "web"

- name: Write in cron tasks for lb
  cron:
    name: "Nginx scheduled backup"
    minute: "*/5"
    #hour: "02"
    job: "{{ item }}"
  loop:
    - /bin/bash /script/autobackup/backup.sh /etc/nginx > /dev/null
  when: ansible_hostname is match "lb"

- name: Write in cron tasks for nfs
  cron:
    name: "Data share scheduled backup"
    minute: "*/5"
    #hour: "02"
    job: "{{ item }}"
  loop:
    - /bin/bash /script/autobackup/backup.sh /data > /dev/null
  when: ansible_hostname is match "nfs"

- name: Write in cron tasks for db
  cron:
    name: "{{ item.name }}"
    minute: "*/5"
    #hour: "02"
    job: "{{ item.job }}"
  loop:
    - { name: "Mysql conf scheduled backup",job: /bin/bash /script/autobackup/backup.sh /etc/my.cnf.d > /dev/null }
    - { name: "Mysql file scheduled backup",job: /bin/bash /script/autobackup/backup.sh /var/lib/mysql > /dev/null }
  when: ansible_hostname is match "db"

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# 配置https
[root@ansible ~/roles/https]#tree
.
├── files
│   ├── proxy.conf
│   ├── server.crt
│   └── server.key
├── handlers
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
└── vars
    └── main.yml

5 directories, 6 files
[root@ansible ~/roles/https]#cat tasks/main.yml
---
# tasks file for https

- name: Create ssl_key dir
  file:
    path: /etc/nginx/ssl_key
    state: directory
  when: ansible_hostname is match "lb"

- name: Key distribution
  copy:
    src: "{{ item }}"
    dest: /etc/nginx/ssl_key
  loop:
    - server.crt
    - server.key
  when: ansible_hostname is match "lb"

- name: Modifying agent configuration
  copy:
    src: proxy.conf
    dest: /etc/nginx/conf.d
  notify: Restart nginx
  when: ansible_hostname is match "lb"

- name: Modifying web configuration
  lineinfile:
    path: "{{ item.path }}"
    regexp: "{{ item.regex }}"
    line: "{{ item.line }}"
  loop:
    - { path: /etc/nginx/conf.d/wordpress.conf,regex: '^#fastcgi_param',line: "fastcgi_param HTTPS on;" }
    - { path: /etc/nginx/conf.d/admin.conf,regex: '^#fastcgi_param',line: "fastcgi_param HTTPS on;" }
    - { path: /etc/nginx/conf.d/kod.conf,regex: '^#fastcgi_param',line: "fastcgi_param HTTPS on;" }
  when: ansible_hostname is match "web"

- name: Restart web nginx
  systemd:
    name: nginx
    state: restarted
  when: ansible_hostname is match "web"

- name: Configure port 443 for tomcat
  lineinfile:
    path: /soft/tomcat/conf/server.xml
    regexp: 'redirectPort="8443"'
    line: ' redirectPort="443" proxyPort="443" scheme="https" secure="true" SSLEnabled="true" '
  when: ansible_hostname is match "web"

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# 配置防火墙策略
[root@ansible ~/roles/iptables]#tree
.
├── tasks
│   └── main.yml
└── templates
    └── iptables_strategy.j2

2 directories, 2 files
[root@ansible ~/roles/iptables]#cat tasks/main.yml
---
# tasks file for iptables

- name: Stop local firewalld
  systemd:
    name: firewalld
    state: stopped

- name: Prohibit self start
  shell: systemctl disable firewalld

- name: Install iptables-services
  yum:
    name: iptables-services
    state: present

- name: Start iptables
  systemd:
    name: iptables.service
    state: started
    enabled: yes

- name: Insert configuration in rc.local
  blockinfile:
    path: /etc/rc.d/rc.local
    block: |
      modprobe ip_tables
      modprobe iptable_filter
      modprobe iptable_nat
      modprobe ip_contrack
      modprobe ip_conntrack_ftp
      modprobe ip_nat_ftp
      modprobe ipt_state

- name: Execute permission for rc.local
  shell: chmod 0755 /etc/rc.d/rc.local warn=false

- name: Sent iptables_strategy to lb
  template:
    src: iptables_strategy.j2
    dest: /tmp/iptables_strategy

- name: Import iptables_strategy
  shell: iptables-restore < /tmp/iptables_strategy

- name: Remove /tmp/iptables_strategy
  shell: rm -rf /tmp/iptables_strategy warn=false

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# 内部服务器访问公网
[root@ansible ~/roles/access_net]#tree
.
└── tasks
    └── main.yml

1 directory, 1 file
[root@ansible ~/roles/access_net]#cat tasks/main.yml
---
# tasks file for access_net

- name: Modifying eth1 network configuration
  blockinfile:
    path: /etc/sysconfig/network-scripts/ifcfg-eth1
    block: |
      GATEWAY=172.16.1.6
  when: ansible_hostname is not match "lb"

- name: Restart the network
  shell: systemctl restart network warn=false
  when: ansible_hostname is not match "lb"

- name: switch on kernel forward
  blockinfile:
    path: /etc/sysctl.conf
    block: |
      net.ipv4.ip_forward = 1
  when: ansible_hostname is match "lb"

- name: load configuration
  shell: sysctl -p warn=false
  when: ansible_hostname is match "lb"


#- name: switch off eth0
#  shell: ifdown eth0 warn=false
#  when: ansible_hostname is not match "lb"
#- name: Modifying eth0 network configuration
#  lineinfile:
#    path: /etc/sysconfig/network-scripts/ifcfg-eth0
#    regexp: '^ONBOOT'
#    line: 'ONBOOT=yes'
#  when: ansible_hostname is not match "lb"

...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# 时间服务器配置
[root@ansible ~/roles/ntpdate]#tree
.
├── handlers
│   └── main.yml
└── tasks
    └── main.yml

2 directories, 2 files
[root@ansible ~/roles/ntpdate]#cat tasks/main.yml
---
# tasks file for ntpdata

- name: Install ntp
  yum:
    name: ntp
    state: present

- name: Configure cron task in server
  cron:
    name: "TimeSync as Server"
    minute: "*/10"
    job: "/usr/sbin/ntpdate ntp1.aliyun.com && hwclock -w > /dev/null"
  when: ansible_hostname is not match "nfs"

- name: Modifying configure for server
  blockinfile:
    path: /etc/ntp.conf
    block: |
      SYNC_HWCLOCK=yes
  notify: Restart ntpd
  when: ansible_hostname is not match "nfs"

- name: Remove server on client
  lineinfile:
    path: /etc/ntp.conf
    regexp: '^server'
    state: absent
  when: ansible_hostname is not match "nfs"

- name: Modifying configure for client
  blockinfile:
    path: /etc/ntp.conf
    block: |
      server 172.16.1.32 prefer
      server 172.16.1.31
  notify: Restart ntpd
  when: ansible_hostname is not match "nfs"

- name: Start ntpd service
  systemd:
    name: ntpd
    state: started
    enabled: yes

- name: Configure cron task in client
  cron:
    name: "TimeSync as Server"
    minute: "*/10"
    job: "/usr/sbin/ntpdate 172.16.1.32 && hwclock -w > /dev/null"
  when: ansible_hostname is not match "nfs"

...
赏

谢谢你请我吃糖果

支付宝
微信

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

努力做一只<br>会发光的萤火虫<br><br><br>希望我的分享<br>可以给大家带来帮助和乐趣...