ansible. Role 11. Установка lamp+nginx

Данная роль установит apache, nginx, php, mysql и добавит виртуальные хосты.
создаём структуру директорий:
mkdir -p /etc/ansible/{playbooks/roles_play,roles/web-server-lamp-nginx/{handlers,tasks,templates,vars}}

В хостовом файле указываем на каком сервере что должно быть установлено:

cat /etc/ansible/hosts

[codesyntax lang="php"]

[web-server-LAMP:children]
nginx
apache
mysql
[nginx]
192.168.1.20
[apache]
192.168.1.21
[mysql]
192.168.1.22

[web-server-LAMP:children]

nginx

apache

mysql

[nginx]

192.168.1.20

[apache]

192.168.1.21

[mysql]

192.168.1.22

[/codesyntax]

в данном файле вы задаёте переменные ставить nginx mysql или нет, будет ли общая директория у nginx и apache какую версию php mysql надо поставить, какой пароль для базы задать, какой пользователь будет создан его домашняя директория его пароль. а так же какое доменное имя добавляем

cat /etc/ansible/playbooks/roles_play/web-server.yml

[codesyntax lang="php"]

---
- hosts: web-server-LAMP
  become: true
  ignore_errors: yes
  become_method: sudo
  gather_facts: yes
  vars:
   - nginx: true                 # true\false тут указываем нужно ли устанавливать nginx или нет
   - php: 7.4                    # (5.5; 5.6; 7.0; 7.1; 7.2; 7.3; 7.4) тут выбираем версию php
   - installdatabase: true       # true\false тут указываем нужно ли устанавливать базу данных
   - database: mariadb10_2       # (mysql56; mysql57; mariadb55; mariadb10_2) # тут выбираем версию базы данных
   - database_pass: G-rG1D6uOOhs # тут указываем пароль (он должен быть сложным так как иначе не применится по политикам безопасности базы)
   - user: test2                 # тут указываем пользователя под в домашнюю директорию которого будут ссылаться nginx и apache
   - user_pass: test2            # тут задаём пароль для пользователя
   - home_dir: /var/www          # !!! ОБЯЗАТЕЛЬНО без слеша '/' в конце!!!  тут задаём домашнюю директорию, в конечном виде она будет такой: "home_dir"/domain/
   - aggregate_home_dir: true    # true\false  #(общая домашняя директория true - если на одном сервере и httpd,nginx или стоит nfs сервер с шарой) если false - то ВСЕ запросы будут проксироваться сразу на апач
   - domain: test2.ru            # тут указываем домен который добавляем
  roles:
    - web-server-lamp-nginx
#  tasks:
#  - include_role:
#     name: name1
#     name: name2

---

- hosts: web-server-LAMP

become: true

ignore_errors: yes

become_method: sudo

gather_facts: yes

vars:

- nginx: true # true\false тут указываем нужно ли устанавливать nginx или нет

- php: 7.4 # (5.5; 5.6; 7.0; 7.1; 7.2; 7.3; 7.4) тут выбираем версию php

- installdatabase: true # true\false тут указываем нужно ли устанавливать базу данных

- database: mariadb10_2 # (mysql56; mysql57; mariadb55; mariadb10_2) # тут выбираем версию базы данных

- database_pass: G-rG1D6uOOhs # тут указываем пароль (он должен быть сложным так как иначе не применится по политикам безопасности базы)

- user: test2 # тут указываем пользователя под в домашнюю директорию которого будут ссылаться nginx и apache

- user_pass: test2 # тут задаём пароль для пользователя

- home_dir: /var/www # !!! ОБЯЗАТЕЛЬНО без слеша '/' в конце!!! тут задаём домашнюю директорию, в конечном виде она будет такой: "home_dir"/domain/

- aggregate_home_dir: true # true\false #(общая домашняя директория true - если на одном сервере и httpd,nginx или стоит nfs сервер с шарой) если false - то ВСЕ запросы будут проксироваться сразу на апач

- domain: test2.ru # тут указываем домен который добавляем

roles:

- web-server-lamp-nginx

# tasks:

# - include_role:

# name: name1

# name: name2

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/vars/main.yml

[codesyntax lang="php"]

listen_http: "80"
listen_https: "443"
nginx_user: "nginx"
worker_processes: "auto"
worker_connections: "512"
httpd_port_if_use_nginx: 8080

listen_http: "80"

listen_https: "443"

nginx_user: "nginx"

worker_processes: "auto"

worker_connections: "512"

httpd_port_if_use_nginx: 8080

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/handlers/main.yml

[codesyntax lang="php"]

---
- name: restart nginx
  service: name=nginx state=restarted enabled=yes

- name: restart httpd
  service: name=httpd state=restarted enabled=yes

- name: reload nginx
  service: name=nginx state=reloaded

- name: reload httpd
  service: name=httpd state=reloaded

- name: restart mysqld
  service: name=mysqld state=restarted

- name: restart mariadb
  service: name=mariadb state=restarted

---

- name: restart nginx

service: name=nginx state=restarted enabled=yes

- name: restart httpd

service: name=httpd state=restarted enabled=yes

- name: reload nginx

service: name=nginx state=reloaded

- name: reload httpd

service: name=httpd state=reloaded

- name: restart mysqld

service: name=mysqld state=restarted

- name: restart mariadb

service: name=mariadb state=restarted

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/templates/Mariadb.repo

[codesyntax lang="php"]

# MariaDB 10.2 CentOS repository list - created 2017-12-26 06:22 UTC
# http://downloads.mariadb.org/mariadb/repositories/
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.2/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1

# MariaDB 10.2 CentOS repository list - created 2017-12-26 06:22 UTC

# http://downloads.mariadb.org/mariadb/repositories/

[mariadb]

name = MariaDB

baseurl = http://yum.mariadb.org/10.2/centos7-amd64

gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB

gpgcheck=1

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/templates/nginx.conf

[codesyntax lang="php"]

user {{ nginx_user }};
worker_processes {{ worker_processes }};
pid /run/nginx.pid;

events {
        worker_connections {{ worker_connections }} ;
}


http {
        gzip on;
        gzip_disable "msie6";
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        log_format proxy  '[$time_local] $remote_addr - $server_name to:'
                  '$upstream_addr: $request upstream_response_time'
                  '$upstream_response_time msec $msec request_time $request_time';

        include /etc/nginx/conf.d/*.conf;
}

user {{ nginx_user }};

worker_processes {{ worker_processes }};

pid /run/nginx.pid;

events {

worker_connections {{ worker_connections }} ;

}

http {

gzip on;

gzip_disable "msie6";

sendfile on;

tcp_nopush on;

tcp_nodelay on;

keepalive_timeout 65;

types_hash_max_size 2048;

include /etc/nginx/mime.types;

default_type application/octet-stream;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

access_log /var/log/nginx/access.log;

error_log /var/log/nginx/error.log;

log_format proxy '[$time_local] $remote_addr - $server_name to:'

'$upstream_addr: $request upstream_response_time'

'$upstream_response_time msec $msec request_time $request_time';

include /etc/nginx/conf.d/*.conf;

}

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/templates/nginx_vhost.conf

[codesyntax lang="php"]

upstream proxy_to_httpd {
{% for item in groups['apache'] %}
    server {{ hostvars[item]['ansible_default_ipv4']['address'] }}:{{httpd_port_if_use_nginx}};
{% endfor %}
}

server {
       listen         {{ listen_http }} ;
       server_name    {{ domain }} www.{{ domain }};
       return         301 $scheme://{{ domain }}$request_uri;
}

server {
    server_name {{ domain }};
    listen {{ listen_http }} ;
#    listen  {{ listen_https }}  ssl;

    access_log /var/log/nginx/{{ domain }}-access.log proxy;
    error_log /var/log/nginx/{{ domain }}-error.log notice;
#    ssl on;
#    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
#    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
    root {{home_dir}}/{{ domain }};
    location ~ /.well-known {
        allow all;
    }

    location / {
        proxy_redirect          off;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-FORWARDED-PROTO https;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass_request_headers on;
        proxy_pass http://proxy_to_httpd$request_uri;
    }
}

upstream proxy_to_httpd {

{% for item in groups['apache'] %}

server {{ hostvars[item]['ansible_default_ipv4']['address'] }}:{{httpd_port_if_use_nginx}};

{% endfor %}

}

server {

listen {{ listen_http }} ;

server_name {{ domain }} www.{{ domain }};

return 301 $scheme://{{ domain }}$request_uri;

}

server {

server_name {{ domain }};

listen {{ listen_http }} ;

# listen {{ listen_https }} ssl;

access_log /var/log/nginx/{{ domain }}-access.log proxy;

error_log /var/log/nginx/{{ domain }}-error.log notice;

# ssl on;

# ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;

# ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;

root {{home_dir}}/{{ domain }};

location ~ /.well-known {

allow all;

}

location / {

proxy_redirect off;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-FORWARDED-PROTO https;

proxy_set_header X-Real-IP $remote_addr;

proxy_pass_request_headers on;

proxy_pass http://proxy_to_httpd$request_uri;

}

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/templates/nginx_vhost_without_aggregate_dir.yml

[codesyntax lang="php"]

upstream proxy_to_httpd {
{% for item in groups['apache'] %}
    server {{ hostvars[item]['ansible_default_ipv4']['address'] }}:{{httpd_port_if_use_nginx}};
{% endfor %}
}

server {
       listen         {{ listen_http }} ;
       server_name    {{ domain }} www.{{ domain }};
       return         301 $scheme://{{ domain }}$request_uri;
}

server {
    server_name {{ domain }};
    listen {{ listen_http }} ;
#    listen  {{ listen_https }}  ssl;

    access_log /var/log/nginx/{{ domain }}-access.log proxy;
    error_log /var/log/nginx/{{ domain }}-error.log notice;
#    ssl on;
#    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
#    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
    location ~ /.well-known {
        allow all;
    }

    location / {
        proxy_redirect          off;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-FORWARDED-PROTO https;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass_request_headers on;
        proxy_pass http://proxy_to_httpd$request_uri;
    }
}

upstream proxy_to_httpd {

{% for item in groups['apache'] %}

server {{ hostvars[item]['ansible_default_ipv4']['address'] }}:{{httpd_port_if_use_nginx}};

{% endfor %}

}

server {

listen {{ listen_http }} ;

server_name {{ domain }} www.{{ domain }};

return 301 $scheme://{{ domain }}$request_uri;

}

server {

server_name {{ domain }};

listen {{ listen_http }} ;

# listen {{ listen_https }} ssl;

access_log /var/log/nginx/{{ domain }}-access.log proxy;

error_log /var/log/nginx/{{ domain }}-error.log notice;

# ssl on;

# ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;

# ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;

location ~ /.well-known {

allow all;

}

location / {

proxy_redirect off;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-FORWARDED-PROTO https;

proxy_set_header X-Real-IP $remote_addr;

proxy_pass_request_headers on;

proxy_pass http://proxy_to_httpd$request_uri;

}

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/templates/httpd_vhost.conf

[codesyntax lang="php"]

&lt;VirtualHost *:{{httpd_port_if_use_nginx}}&gt;
  ServerAdmin webmaster@{{ domain }}
  DocumentRoot {{home_dir}}/{{ domain }}
  ServerName {{ domain }}
  ServerAlias www.{{ domain }}
    ErrorLog /var/log/httpd/{{ domain }}.error.log
    CustomLog /var/log/httpd/{{ domain }}.access.log common
&lt;/VirtualHost&gt;

ServerAdmin webmaster@{{ domain }}

DocumentRoot {{home_dir}}/{{ domain }}

ServerName {{ domain }}

ServerAlias www.{{ domain }}

ErrorLog /var/log/httpd/{{ domain }}.error.log

CustomLog /var/log/httpd/{{ domain }}.access.log common

</VirtualHost>

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/templates/httpd_vhost_without_nginx.conf

[codesyntax lang="php"]

&lt;VirtualHost *:{{listen_http}}&gt;
  ServerAdmin webmaster@{{ domain }}
  DocumentRoot {{home_dir}}/{{ domain }}
  ServerName {{ domain }}
  ServerAlias www.{{ domain }}
    ErrorLog /var/log/httpd/{{ domain }}.error.log
    CustomLog /var/log/httpd/{{ domain }}.access.log common
&lt;/VirtualHost&gt;

ServerAdmin webmaster@{{ domain }}

DocumentRoot {{home_dir}}/{{ domain }}

ServerName {{ domain }}

ServerAlias www.{{ domain }}

ErrorLog /var/log/httpd/{{ domain }}.error.log

CustomLog /var/log/httpd/{{ domain }}.access.log common

</VirtualHost>

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/add-user-homedir.yml

[codesyntax lang="php"]

- name: Add users "{{ user }}"
  user:
    name: "{{ user }}"
    shell: /bin/bash
    append: yes
    password: "{{ user_pass | password_hash('sha512') }}"
    home: "{{ home_dir }}"
    state: present
  when: "inventory_hostname in groups['apache']"

- name: Create homedir "{{ home_dir }}{{domain}}/"
  file:
    path: "{{ home_dir }}/{{domain}}/"
    state: directory
    recurse: yes
    owner: "{{ user }}"
    group: "{{ user }}"
  when: "inventory_hostname in groups['apache']"

- name: Add users "{{ user }}"

user:

shell: /bin/bash

append: yes

password: "{{ user_pass | password_hash('sha512') }}"

home: "{{ home_dir }}"

state: present

when: "inventory_hostname in groups['apache']"

- name: Create homedir "{{ home_dir }}{{domain}}/"

file:

path: "{{ home_dir }}/{{domain}}/"

state: directory

recurse: yes

owner: "{{ user }}"

group: "{{ user }}"

when: "inventory_hostname in groups['apache']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/change-httpd-main-config.yml

[codesyntax lang="php"]

- name: httpd listen on port {{ httpd_port_if_use_nginx }}
  lineinfile: dest=/etc/httpd/conf/httpd.conf regexp="^Listen 80" line="Listen 8080" state=present
  notify:
    - restart httpd
  when:
    - nginx
    - "inventory_hostname in groups['apache']"

- name: httpd change listen port if nginx absent
  lineinfile: dest=/etc/httpd/conf/httpd.conf regexp="^Listen 8080" line="Listen 80" state=present
  notify:
    - restart httpd
  when: "inventory_hostname in groups['apache'] and not {{ nginx }}"

- name: httpd servername
  lineinfile: dest=/etc/httpd/conf/httpd.conf regexp="^#ServerName www.example.com:80" line="ServerName _" state=present
  notify:
    - restart httpd
  when:
    - nginx
    - "inventory_hostname in groups['apache']"

- name: httpd listen on port {{ httpd_port_if_use_nginx }}

lineinfile: dest=/etc/httpd/conf/httpd.conf regexp="^Listen 80" line="Listen 8080" state=present

notify:

- restart httpd

when:

- nginx

- "inventory_hostname in groups['apache']"

- name: httpd change listen port if nginx absent

lineinfile: dest=/etc/httpd/conf/httpd.conf regexp="^Listen 8080" line="Listen 80" state=present

notify:

- restart httpd

when: "inventory_hostname in groups['apache'] and not {{ nginx }}"

- name: httpd servername

lineinfile: dest=/etc/httpd/conf/httpd.conf regexp="^#ServerName www.example.com:80" line="ServerName _" state=present

notify:

- restart httpd

when:

- nginx

- "inventory_hostname in groups['apache']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/check-packpages.yml

[codesyntax lang="php"]

- name: "Check PHP installed"
  package_facts:
    manager: "auto"

- name: "if NGINX installed all OK"
  debug:
   msg: "Packpage NGINX FOUND and all ok"
  when:
      - "'nginx' in ansible_facts.packages"
      - "inventory_hostname in groups['nginx']"

- name: "if APACHE installed all OK"
  debug:
   msg: "Packpage APACHE FOUND and all ok"
  when:
      - "'httpd' in ansible_facts.packages"
      - "inventory_hostname in groups['apache']"

- name: "if PHP installed all OK"
  debug:
   msg: "Packpage PHP FOUND and all ok"
  when:
      - "'php' in ansible_facts.packages"
      - "inventory_hostname in groups['apache']"

- name: "if MYSQL installed all OK"
  debug:
   msg: "Packpage mysql FOUND and all ok"
  when:
      - "'mysql-community-server' in ansible_facts.packages"
      - "inventory_hostname in groups['mysql']"

- name: "if mariadb-5.5 installed all OK"
  debug:
   msg: "Packpage mariadb-5.5 FOUND and all ok"
  when:
      - "'mariadb-server' in ansible_facts.packages"
      - "inventory_hostname in groups['mysql']"

- name: "if mariadb-10.2 installed all OK"
  debug:
   msg: "Packpage mariadb-10.2 FOUND and all ok"
  when:
      - "'MariaDB-server' in ansible_facts.packages"
      - "inventory_hostname in groups['mysql']"

- name: "Check PHP installed"

package_facts:

manager: "auto"

- name: "if NGINX installed all OK"

debug:

msg: "Packpage NGINX FOUND and all ok"

when:

- "'nginx' in ansible_facts.packages"

- "inventory_hostname in groups['nginx']"

- name: "if APACHE installed all OK"

debug:

msg: "Packpage APACHE FOUND and all ok"

when:

- "'httpd' in ansible_facts.packages"

- "inventory_hostname in groups['apache']"

- name: "if PHP installed all OK"

debug:

msg: "Packpage PHP FOUND and all ok"

when:

- "'php' in ansible_facts.packages"

- "inventory_hostname in groups['apache']"

- name: "if MYSQL installed all OK"

debug:

msg: "Packpage mysql FOUND and all ok"

when:

- "'mysql-community-server' in ansible_facts.packages"

- "inventory_hostname in groups['mysql']"

- name: "if mariadb-5.5 installed all OK"

debug:

msg: "Packpage mariadb-5.5 FOUND and all ok"

when:

- "'mariadb-server' in ansible_facts.packages"

- "inventory_hostname in groups['mysql']"

- name: "if mariadb-10.2 installed all OK"

debug:

msg: "Packpage mariadb-10.2 FOUND and all ok"

when:

- "'MariaDB-server' in ansible_facts.packages"

- "inventory_hostname in groups['mysql']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/configure-httpd.yml

[codesyntax lang="php"]

- name: httpd listen on port
  lineinfile: dest=/etc/apache2/ports.conf regexp="^Listen " line="Listen {{ http_port }}" state=present
  notify:
    - restart httpd

- name: httpd listen on port

lineinfile: dest=/etc/apache2/ports.conf regexp="^Listen " line="Listen {{ http_port }}" state=present

notify:

- restart httpd

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/install-packpages.yml

[codesyntax lang="php"]

- name: install default packages for all host
  yum:
    name: "{{item}}"
    state: present
  with_items:
    - yum-utils
    - vim

- name: install nginx to the "{{groups.nginx}}"
  yum:
    name: "{{item}}"
    state: present
  with_items:
    - nginx
  notify:
   - restart nginx
  when:
    - "inventory_hostname in groups['nginx']  and {{ nginx }}"
    - "'nginx' not in ansible_facts.packages"

- name: install apache to the "{{groups.apache}}"
  yum:
    name: "{{item}}"
    state: present
  with_items:
    - httpd
  notify:
   - restart httpd
  when:
    - "inventory_hostname in groups['apache']"
    - "'httpd' not in ansible_facts.packages"

- name: Disable ALL PHP versions
  command: "{{item}}"
  with_items:
    - yum-config-manager --disable remi-php55
    - yum-config-manager --disable remi-php56
    - yum-config-manager --disable remi-php70
    - yum-config-manager --disable remi-php71
    - yum-config-manager --disable remi-php72
    - yum-config-manager --disable remi-php73
    - yum-config-manager --disable remi-php74
  when: "inventory_hostname in groups['apache']"

- name: Enable php5.5
  command: yum-config-manager --enable remi-php55
  when: "inventory_hostname in groups['apache'] and 5.5 == {{ php }}"

- name: Enable php5.6
  command: yum-config-manager --enable remi-php56
  when: "inventory_hostname in groups['apache'] and 5.6 == {{ php }}"

- name: Enable php7.0
  command: yum-config-manager --enable remi-php70
  when: "inventory_hostname in groups['apache'] and 7.0 == {{ php }}"

- name: Enable php7.1
  command: yum-config-manager --enable remi-php71
  when: "inventory_hostname in groups['apache'] and 7.1 == {{ php }}"

- name: Enable php7.2
  command: yum-config-manager --enable remi-php72
  when: "inventory_hostname in groups['apache'] and 7.2 == {{ php }}"

- name: Enable php7.3
  command: yum-config-manager --enable remi-php73
  when: "inventory_hostname in groups['apache'] and 7.3 == {{ php }}"

- name: Enable php7.4
  command: yum-config-manager --enable remi-php74
  when: "inventory_hostname in groups['apache'] and 7.4 == {{ php }}"


#- name: "Ansible  Print a variable"
#  debug:
#    var: "{{item}}"
#  with_items:
#    - php
#  when: "inventory_hostname in groups['apache']"



- name: Install php {{php}}
  yum: name={{item}} state=present
  with_items:
    - php
    - php-common
    - php-opcache
    - php-mcrypt
    - php-cli
    - php-gd
    - php-curl
    - php-mysql
    - php-mbstring
    - php-mcrypt
    - php-soap
    - php-sqlite3
    - php-xml
    - php-zip
    - php-bcmath
    - php-ssh2
    - php-rrd
  when:
      - "inventory_hostname in groups['apache']"
      - "'php' not in ansible_facts.packages"

100

101

102

103

104

105

106

- name: install default packages for all host

yum:

state: present

with_items:

- yum-utils

- vim

- name: install nginx to the "{{groups.nginx}}"

yum:

state: present

with_items:

- nginx

notify:

- restart nginx

when:

- "inventory_hostname in groups['nginx'] and {{ nginx }}"

- "'nginx' not in ansible_facts.packages"

- name: install apache to the "{{groups.apache}}"

yum:

state: present

with_items:

- httpd

notify:

- restart httpd

when:

- "inventory_hostname in groups['apache']"

- "'httpd' not in ansible_facts.packages"

- name: Disable ALL PHP versions

command: "{{item}}"

with_items:

- yum-config-manager --disable remi-php55

- yum-config-manager --disable remi-php56

- yum-config-manager --disable remi-php70

- yum-config-manager --disable remi-php71

- yum-config-manager --disable remi-php72

- yum-config-manager --disable remi-php73

- yum-config-manager --disable remi-php74

when: "inventory_hostname in groups['apache']"

- name: Enable php5.5

command: yum-config-manager --enable remi-php55

when: "inventory_hostname in groups['apache'] and 5.5 == {{ php }}"

- name: Enable php5.6

command: yum-config-manager --enable remi-php56

when: "inventory_hostname in groups['apache'] and 5.6 == {{ php }}"

- name: Enable php7.0

command: yum-config-manager --enable remi-php70

when: "inventory_hostname in groups['apache'] and 7.0 == {{ php }}"

- name: Enable php7.1

command: yum-config-manager --enable remi-php71

when: "inventory_hostname in groups['apache'] and 7.1 == {{ php }}"

- name: Enable php7.2

command: yum-config-manager --enable remi-php72

when: "inventory_hostname in groups['apache'] and 7.2 == {{ php }}"

- name: Enable php7.3

command: yum-config-manager --enable remi-php73

when: "inventory_hostname in groups['apache'] and 7.3 == {{ php }}"

- name: Enable php7.4

command: yum-config-manager --enable remi-php74

when: "inventory_hostname in groups['apache'] and 7.4 == {{ php }}"

#- name: "Ansible Print a variable"

# debug:

# var: "{{item}}"

# with_items:

# - php

# when: "inventory_hostname in groups['apache']"

- name: Install php {{php}}

yum: name={{item}} state=present

with_items:

- php

- php-common

- php-opcache

- php-mcrypt

- php-cli

- php-gd

- php-curl

- php-mysql

- php-mbstring

- php-mcrypt

- php-soap

- php-sqlite3

- php-xml

- php-zip

- php-bcmath

- php-ssh2

- php-rrd

when:

- "inventory_hostname in groups['apache']"

- "'php' not in ansible_facts.packages"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/repo.yml

[codesyntax lang="php"]

- name: Import EPEL GPG key.
  rpm_key:
   key: /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}
   state: present

- name: Install EPEL repo.
  yum:
   name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm
   state: present

- name: Add nginx yum repository
  yum_repository:
    name: nginx
    description: Nginx Repository
    baseurl: http://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/
    gpgkey: http://nginx.org/packages/keys/nginx_signing.key
    gpgcheck: yes
  when: "inventory_hostname in groups['nginx']  and {{ nginx }}"

- name: Add PHP yum repository
  yum:
    name: http://rpms.remirepo.net/enterprise/remi-release-7.rpm
    state: present
  when: "inventory_hostname in groups['apache']"

- name: Import EPEL GPG key.

rpm_key:

key: /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}

state: present

- name: Install EPEL repo.

yum:

name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm

state: present

- name: Add nginx yum repository

yum_repository:

description: Nginx Repository

baseurl: http://nginx.org/packages/centos/{{ ansible_distribution_major_version }}/$basearch/

gpgkey: http://nginx.org/packages/keys/nginx_signing.key

gpgcheck: yes

when: "inventory_hostname in groups['nginx'] and {{ nginx }}"

- name: Add PHP yum repository

yum:

state: present

when: "inventory_hostname in groups['apache']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/mysql-5.6.yml

[codesyntax lang="php"]

- name: Install MySQL 5.6 repo
  yum:
   name: http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm
   state: present

- name: Install MySQL 5.6
  yum:
    name: "{{ item }}"
    state: present
  with_items:
    - mysql-community-server
    - mysql-community-client
    - MySQL-python

- name: Start the MySQL service
  service: name=mysqld state=started enabled=true

- name: Change mysql root password and keep track in
  shell: |
    mysql -uroot --connect-expired-password -e "SET PASSWORD FOR root@'localhost' = PASSWORD('{{database_pass}}'); flush privileges;"
  register: change_temp_pass
  notify: restart mysqld

- meta: flush_handlers
- debug:
    var: change_temp_pass


#- name: "Ansible  Print a variable"
#  debug:
#    var: "{{item}}"
#  with_items:
#    - database_pass
#    - installdatabase
#    - database
#    - password_match
#  when: "inventory_hostname in groups['mysql']"

- name: Install MySQL 5.6 repo

yum:

state: present

- name: Install MySQL 5.6

yum:

state: present

with_items:

- mysql-community-server

- mysql-community-client

- MySQL-python

- name: Start the MySQL service

service: name=mysqld state=started enabled=true

- name: Change mysql root password and keep track in

shell: |

mysql -uroot --connect-expired-password -e "SET PASSWORD FOR root@'localhost' = PASSWORD('{{database_pass}}'); flush privileges;"

notify: restart mysqld

- meta: flush_handlers

- debug:

var: change_temp_pass

#- name: "Ansible Print a variable"

# debug:

# var: "{{item}}"

# with_items:

# - database_pass

# - installdatabase

# - database

# - password_match

# when: "inventory_hostname in groups['mysql']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/mysql-5.7.yml

[codesyntax lang="php"]

- name: Install MySQL 5.7 repo
  yum:
   name: http://dev.mysql.com/get/mysql57-community-release-el7-8.noarch.rpm
   state: present

- name: Install MySQL 5.7
  yum:
    name: "{{ item }}"
    state: present
  with_items:
    - mysql-community-server
    - mysql-community-client
    - MySQL-python

- name: Start the MySQL service
  service: name=mysqld state=started enabled=true

- name: Change mysql root password and keep track in
  shell: |
    password_match=`awk '/A temporary password is generated for/ {a=$0} END{ print a }' /var/log/mysqld.log | awk '{print $(NF)}'`
    echo $password_match
    mysql -uroot -p$password_match --connect-expired-password -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '{{database_pass}}'; flush privileges; "
    echo "[client]"
    user=root
    password="{{database_pass}}" &gt; /root/.my.cnf
  args:
    creates: /root/.my.cnf
  register: change_temp_pass
  notify: restart mysqld

- meta: flush_handlers
- debug:
    var: change_temp_pass


#- name: "Ansible  Print a variable"
#  debug:
#    var: "{{item}}"
#  with_items:
#    - database_pass
#    - installdatabase
#    - database
#    - password_match
#  when: "inventory_hostname in groups['mysql']"

- name: Install MySQL 5.7 repo

yum:

state: present

- name: Install MySQL 5.7

yum:

state: present

with_items:

- mysql-community-server

- mysql-community-client

- MySQL-python

- name: Start the MySQL service

service: name=mysqld state=started enabled=true

- name: Change mysql root password and keep track in

shell: |

password_match=`awk '/A temporary password is generated for/ {a=$0} END{ print a }' /var/log/mysqld.log | awk '{print $(NF)}'`

echo $password_match

mysql -uroot -p$password_match --connect-expired-password -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '{{database_pass}}'; flush privileges; "

echo "[client]"

user=root

password="{{database_pass}}" > /root/.my.cnf

args:

creates: /root/.my.cnf

notify: restart mysqld

- meta: flush_handlers

- debug:

var: change_temp_pass

#- name: "Ansible Print a variable"

# debug:

# var: "{{item}}"

# with_items:

# - database_pass

# - installdatabase

# - database

# - password_match

# when: "inventory_hostname in groups['mysql']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/mariadb-5.5.yml

[codesyntax lang="php"]

- name: Install mariadb 5.5
  yum:
    name: "{{ item }}"
    state: present
  with_items:
    - mariadb
    - mariadb-server
    - mariadb-libs
    - mariadb-devel

- name: Start the mariadb service
  service: name=mariadb state=started enabled=true

- name: Change mariadb root password and keep track in
  shell: |
    mysql -uroot -e "SET PASSWORD FOR root@'localhost' = PASSWORD('{{database_pass}}'); flush privileges;"
  register: change_temp_pass
  notify: restart mariadb

- meta: flush_handlers
- debug:
    var: change_temp_pass


#- name: "Ansible  Print a variable"
#  debug:
#    var: "{{item}}"
#  with_items:
#    - database_pass
#    - installdatabase
#    - database
#    - password_match
#  when: "inventory_hostname in groups['mysql']"

- name: Install mariadb 5.5

yum:

state: present

with_items:

- mariadb

- mariadb-server

- mariadb-libs

- mariadb-devel

- name: Start the mariadb service

service: name=mariadb state=started enabled=true

- name: Change mariadb root password and keep track in

shell: |

mysql -uroot -e "SET PASSWORD FOR root@'localhost' = PASSWORD('{{database_pass}}'); flush privileges;"

notify: restart mariadb

- meta: flush_handlers

- debug:

var: change_temp_pass

#- name: "Ansible Print a variable"

# debug:

# var: "{{item}}"

# with_items:

# - database_pass

# - installdatabase

# - database

# - password_match

# when: "inventory_hostname in groups['mysql']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/mariadb-10.2.yml

[codesyntax lang="php"]

- name: Add repo for mariadb 10.2
  template:
    src=/etc/ansible/roles/web-server-lamp-nginx/templates/Mariadb.repo
    dest=/etc/yum.repos.d/Mariadb.repo
  when:
    - "inventory_hostname in groups['mysql']"
    - "'mysql-community-server' not in ansible_facts.packages"
    - "'mariadb-server' not in ansible_facts.packages"
    - "{{ database == 'mariadb10_2' }}"
    - "{{ installdatabase }}"



- name: Install mariadb 10.2
  yum:
    name: "{{ item }}"
    state: present
  with_items:
    - MariaDB-server
    - MariaDB-client

- name: Start the mariadb service
  service: name=mariadb state=started enabled=true

- name: Change mariadb root password and keep track in
  shell: |
    mysql -uroot -e "SET PASSWORD FOR root@'localhost' = PASSWORD('{{database_pass}}'); flush privileges;"
  register: change_temp_pass
  notify: restart mariadb

- meta: flush_handlers
- debug:
    var: change_temp_pass


#- name: "Ansible  Print a variable"
#  debug:
#    var: "{{item}}"
#  with_items:
#    - database_pass
#    - installdatabase
#    - database
#    - password_match
#  when: "inventory_hostname in groups['mysql']"

- name: Add repo for mariadb 10.2

template:

src=/etc/ansible/roles/web-server-lamp-nginx/templates/Mariadb.repo

dest=/etc/yum.repos.d/Mariadb.repo

when:

- "inventory_hostname in groups['mysql']"

- "'mysql-community-server' not in ansible_facts.packages"

- "'mariadb-server' not in ansible_facts.packages"

- "{{ database == 'mariadb10_2' }}"

- "{{ installdatabase }}"

- name: Install mariadb 10.2

yum:

state: present

with_items:

- MariaDB-server

- MariaDB-client

- name: Start the mariadb service

service: name=mariadb state=started enabled=true

- name: Change mariadb root password and keep track in

shell: |

mysql -uroot -e "SET PASSWORD FOR root@'localhost' = PASSWORD('{{database_pass}}'); flush privileges;"

notify: restart mariadb

- meta: flush_handlers

- debug:

var: change_temp_pass

#- name: "Ansible Print a variable"

# debug:

# var: "{{item}}"

# with_items:

# - database_pass

# - installdatabase

# - database

# - password_match

# when: "inventory_hostname in groups['mysql']"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/virtualhost.yml

[codesyntax lang="php"]

- name: Replace NGINX config
  template:
    src=/etc/ansible/roles/web-server-lamp-nginx/templates/nginx.conf
    dest=/etc/nginx/nginx.conf
  notify:
   - reload nginx
  when: "inventory_hostname in groups['nginx']  and {{ nginx }} and {{ aggregate_home_dir }}"

- name: Add NGINX virtualhost config for site "{{domain}}" without aggregate home dir
  template:
    src=/etc/ansible/roles/web-server-lamp-nginx/templates/nginx_vhost_without_aggregate_dir.yml
    dest=/etc/nginx/conf.d/{{ domain }}.conf
  notify:
   - reload nginx
  when: "inventory_hostname in groups['nginx']  and {{ nginx }} and not {{ aggregate_home_dir}}"

- name: Add NGINX virtualhost config for site "{{domain}}"
  template:
    src=/etc/ansible/roles/web-server-lamp-nginx/templates/nginx_vhost.conf
    dest=/etc/nginx/conf.d/{{ domain }}.conf
  notify:
   - reload nginx
  when: "inventory_hostname in groups['nginx']  and {{ nginx }} and {{ aggregate_home_dir}}"


- name: Add APACHE virtualhost config for site "{{domain}}"
  template:
    src=/etc/ansible/roles/web-server-lamp-nginx/templates/httpd_vhost.conf
    dest=/etc/httpd/conf.d/{{ domain }}.conf
  notify:
   - reload httpd
  when: "inventory_hostname in groups['apache'] and {{ nginx }}"


- name: Add APACHE virtualhost config for site "{{domain}}" without NGINX
  template:
    src=/etc/ansible/roles/web-server-lamp-nginx/templates/httpd_vhost_without_nginx.conf
    dest=/etc/httpd/conf.d/{{ domain }}.conf
  notify:
   - reload httpd
  when: "inventory_hostname in groups['apache'] and not {{ nginx }}"

- name: Replace NGINX config

template:

src=/etc/ansible/roles/web-server-lamp-nginx/templates/nginx.conf

dest=/etc/nginx/nginx.conf

notify:

- reload nginx

when: "inventory_hostname in groups['nginx'] and {{ nginx }} and {{ aggregate_home_dir }}"

- name: Add NGINX virtualhost config for site "{{domain}}" without aggregate home dir

template:

src=/etc/ansible/roles/web-server-lamp-nginx/templates/nginx_vhost_without_aggregate_dir.yml

dest=/etc/nginx/conf.d/{{ domain }}.conf

notify:

- reload nginx

when: "inventory_hostname in groups['nginx'] and {{ nginx }} and not {{ aggregate_home_dir}}"

- name: Add NGINX virtualhost config for site "{{domain}}"

template:

src=/etc/ansible/roles/web-server-lamp-nginx/templates/nginx_vhost.conf

dest=/etc/nginx/conf.d/{{ domain }}.conf

notify:

- reload nginx

when: "inventory_hostname in groups['nginx'] and {{ nginx }} and {{ aggregate_home_dir}}"

- name: Add APACHE virtualhost config for site "{{domain}}"

template:

src=/etc/ansible/roles/web-server-lamp-nginx/templates/httpd_vhost.conf

dest=/etc/httpd/conf.d/{{ domain }}.conf

notify:

- reload httpd

when: "inventory_hostname in groups['apache'] and {{ nginx }}"

- name: Add APACHE virtualhost config for site "{{domain}}" without NGINX

template:

src=/etc/ansible/roles/web-server-lamp-nginx/templates/httpd_vhost_without_nginx.conf

dest=/etc/httpd/conf.d/{{ domain }}.conf

notify:

- reload httpd

when: "inventory_hostname in groups['apache'] and not {{ nginx }}"

[/codesyntax]

cat /etc/ansible/roles/web-server-lamp-nginx/tasks/main.yml

[codesyntax lang="php"]

---
- import_tasks: repo.yml
  tags: repo
- import_tasks: check-packpages.yml
  tags: check-packpages
- import_tasks: install-packpages.yml
  tags: packpages
- import_tasks: change-httpd-main-config.yml
  tags: change-port-servername
- import_tasks: add-user-homedir.yml
  tags: add-user-homedir
- import_tasks: virtualhost.yml
  tags: virtualhost
- import_tasks: mysql-5.6.yml
  tag: mysql-5.6
  when:
    - "inventory_hostname in groups['mysql']"
    - "'mysql-community-server' not in ansible_facts.packages"
    - "'mariadb-server' not in ansible_facts.packages"
    - "'MariaDB-server' not in ansible_facts.packages"
    - "{{ database == 'mysql56' }}"
    - "{{ installdatabase }}"

- import_tasks: mysql-5.7.yml
  tag: mysql-5.7
  when:
    - "inventory_hostname in groups['mysql']"
    - "'mysql-community-server' not in ansible_facts.packages"
    - "'mariadb-server' not in ansible_facts.packages"
    - "'MariaDB-server' not in ansible_facts.packages"
    - "{{ database == 'mysql57' }}"
    - "{{ installdatabase }}"

- import_tasks: mariadb-5.5.yml
  tags: mariadb-5.5
  when:
    - "inventory_hostname in groups['mysql']"
    - "'mariadb-server' not in ansible_facts.packages"
    - "'MariaDB-server' not in ansible_facts.packages"
    - "'mysql-community-server' not in ansible_facts.packages"
    - "{{ database == 'mariadb55' }}"
    - "{{ installdatabase }}"

- import_tasks: mariadb-10.2.yml
  tags: mariadb-10.2
  when:
    - "inventory_hostname in groups['mysql']"
    - "'mariadb-server' not in ansible_facts.packages"
    - "'MariaDB-server' not in ansible_facts.packages"
    - "'mysql-community-server' not in ansible_facts.packages"
    - "{{ database == 'mariadb10_2' }}"
    - "{{ installdatabase }}"

---

- import_tasks: repo.yml

tags: repo

- import_tasks: check-packpages.yml

tags: check-packpages

- import_tasks: install-packpages.yml

tags: packpages

- import_tasks: change-httpd-main-config.yml

tags: change-port-servername

- import_tasks: add-user-homedir.yml

tags: add-user-homedir

- import_tasks: virtualhost.yml

tags: virtualhost

- import_tasks: mysql-5.6.yml

tag: mysql-5.6

when:

- "inventory_hostname in groups['mysql']"

- "'mysql-community-server' not in ansible_facts.packages"

- "'mariadb-server' not in ansible_facts.packages"

- "'MariaDB-server' not in ansible_facts.packages"

- "{{ database == 'mysql56' }}"

- "{{ installdatabase }}"

- import_tasks: mysql-5.7.yml

tag: mysql-5.7

when:

- "inventory_hostname in groups['mysql']"

- "'mysql-community-server' not in ansible_facts.packages"

- "'mariadb-server' not in ansible_facts.packages"

- "'MariaDB-server' not in ansible_facts.packages"

- "{{ database == 'mysql57' }}"

- "{{ installdatabase }}"

- import_tasks: mariadb-5.5.yml

tags: mariadb-5.5

when:

- "inventory_hostname in groups['mysql']"

- "'mariadb-server' not in ansible_facts.packages"

- "'MariaDB-server' not in ansible_facts.packages"

- "'mysql-community-server' not in ansible_facts.packages"

- "{{ database == 'mariadb55' }}"

- "{{ installdatabase }}"

- import_tasks: mariadb-10.2.yml

tags: mariadb-10.2

when:

- "inventory_hostname in groups['mysql']"

- "'mariadb-server' not in ansible_facts.packages"

- "'MariaDB-server' not in ansible_facts.packages"

- "'mysql-community-server' not in ansible_facts.packages"

- "{{ database == 'mariadb10_2' }}"

- "{{ installdatabase }}"

[/codesyntax]

Пн	Вт	Ср	Чт	Пт	Сб	Вс
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31

Centos

ansible. Role 11. Установка lamp+nginx

https://github.com/midnight47/