模拟真实企业架构之使用ansible批量配置主机并发布APP

2021年6月14日 221点热度 2人点赞 0条评论

文章简介

本文根据上篇文章中模拟的架构,再次模拟了企业中使用ansible的playbook和roles编排并发布了wordpress和phpmyadmin的集群服务,其中涉及了MySQL+NFS+Redis+Nginx+php+lvs+keepalived+dns,并使用了https加密访问。

一、使用ansible编排base基本环境

实现:根据不同类型的主机,分配不同基础环境

例如:

1、只有web和proxy主机含有nginx源

2、只有web主机含有php源

3、其他主机只有base源

4、dns主机不需要创建www用户

5、dns、Ib、nfs不需要安装mariadb和MySQL-python

(一)编写base的roles

[root@ansible ~]# cat ansible/roles/base/tasks/main.yml 
- name: Clear Old yum repo
  shell:
    cmd: 'gzip *.repo'
    chdir: /etc/yum.repos.d/

- name: Config Base yum repo
  yum_repository:
    name: Base
    description: Base yum repo
    baseurl: http://mirrors.linux98.com/centos/$releasever/base/
    enabled: yes
    gpgcheck: no

- name: Config Epel yum repo
  yum_repository:
    name: Epel
    description: Epel yum repo
    baseurl: http://mirrors.linux98.com/centos/$releasever/epel/
    enabled: yes
    gpgcheck: no


- name: Config Nginx yum repo
  yum_repository:
    name: Nginx
    description: Nginx yum repo
    baseurl: http://mirrors.linux98.com/centos/$releasever/nginx-stable/
    enabled: yes
    gpgcheck: no
  when: ( ansible_hostname is match ("web*") ) or ( ansible_hostname is match ("proxy*") )


- name: Config Php yum repo
  yum_repository:
    name: Php
    description: Php yum repo
    baseurl: http://mirrors.linux98.com/centos/$releasever/php/ 
    enabled: yes
    gpgcheck: no
  when: ( ansible_hostname is match ("web*") )

- name: Add Process Group
  group:
    name: www
    gid: 666
  when: ( ansible_hostname is not match ("dns*") )

- name: Add Process User
  user:
    name: www
    uid: 666
    group: www
    create_home: no
    shell: /sbin/nologin
  when: ( ansible_hostname is not match ("dns*") )

- name: Installed Base Software
  yum:
    name: "{{ item }}"
    state: present
  loop:
    - wget
    - httpd-tools
    - lrzsz
    - nfs-utils
    - bind-utils
    - net-tools
    - unzip
    - vim
    - gcc
    - git

- name: Installed Base Software other
  yum:
    name: "{{ item }}"
    state: present
  loop:
    - mariadb
    - MySQL-python
  when: ( ansible_hostname is not match ("dns*") ) or ( ansible_hostname is not match ("Ib*") ) or ( ansible_hostname is not match ("nfs*") )

(二)运行效果

运行效果

base和epel 的yum源所有主机都有

image-20210612105103788

nginx的yum源只有web和proxy节点有

php只有web节点有

image-20210612105141626

除了dns节点都创建了www用户和组

image-20210612105211868

二、使用ansible的roles编排底层环境(NFS-server、MYSQL、redis)

(一)编写NFS-server的roles

1、创建目录

[root@ansible ansible]# mkdir roles/{nfs}/{tasks,handlers,templates,files,meta,vars} -p

2、先编写tasks

[root@ansible ansible]# cat roles/nfs/tasks/main.yml 
- name: Install NFS Server SoftWare
  yum:
    name: nfs-utils
    state: present

- name: Configure NFS Server
  template:
    src: exports.j2
    dest: /etc/exports
  notify: Restart NFS Server

- name: INIT NFS Server
  file:
    path: "{{ nfs_share_directory }}"
    state: directory
    owner: "{{ user }}"
    group: "{{ group }}"

- name: Started NFS Server
  systemd:
    name: nfs
    state: started
    enabled: yes

3、根据tasks编写handlers

[root@ansible ansible]# cat roles/nfs/handlers/main.yml 
- name: Restart NFS Server
  systemd:
    name: nfs
    state: restarted

4、根据tasks编写template

[root@ansible ansible]# cat roles/nfs/templates/exports.j2 
{{ nfs_share_directory }} {{ nfs_share_ip_pool }}(rw,sync,anonuid={{ user_id }},anonuid={{ group_id }})

5、添加整体环境变量

创建/root/ansible/group_vars/all 整体变量文件,并将nfs的tasks中的变量赋值

[root@ansible ansible]# cat group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

6、编写playbook指定nfsservers主机群组进行部署

[root@ansible ansible]# cat test.yml 
- name: Install NFS
  hosts: nfsservers
  roles:
    - nfs

7、使用redis01作为客户端测试

[root@redis01 ~]# showmount -e 10.10.100.31
Export list for 10.10.100.31:
/ansible_data 10.10.100.0/24

(二)编写mysql的roles

1、创建目录

[root@ansible ansible]# mkdir roles/{nfs}/{tasks,handlers,templates,files,meta,vars} -p

2、编写tasks

[root@ansible ~]# cat ansible/roles/mysql/tasks/main.yml 
- name: Install Mariadb-Server SoftWare
  yum:
    name: mariadb-server
    state: present

- name: Configure Mariadb-Server Root User
  shell:
    cmd: mysqladmin -u root password "{{ mysql_root_pw }}"

- name: Started Mariadb-Server Service
  systemd:
    name: mariadb
    state: started
    enabled: yes

- name: Create App Grant User
  mysql_user:
    login_user: root
    login_password: "{{ mysql_root_pw }}"
    name: ansible_all
    password: linux98.com123
    update_password: on_create
    host: '%'
    priv: '*.*:ALL'
    state: present

3、根据tasks向group_vars/all中添加变量

[root@ansible ~]# cat ansible/group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

#mysql
mysql_root_pw: linux98.com@123

4、编写playbook将mysqlserver部署mariadb-server服务

[root@ansible ~]# cat ansible/test.yml 
- name: Install Mariadb-Server
  hosts: mysqlservers
  roles:
    - mysql

5、测试root用户及其他用户是否能正常登录

[root@nfs ~]# mysql -uansible_all -plinux98.com123 -h 10.10.100.51 -P3306
MariaDB [(none)]> exit
Bye

(三)编写redis的roles

1、编写tasks

#创建目录
[root@ansible roles]# mkdir -pv redis/{files,tasks,templates,handlers,meta}
[root@ansible ansible]# cat roles/redis/tasks/main.yml 
- name: Install Redis Server
  yum:
    name: redis
    state: present

- name: Configure Redis Server
  template:
    src: redis.conf.j2
    dest: /etc/redis.conf
    owner: 'redis'
    group: 'redis'
    mode: '0640'
  notify: Restart Redis Server

- name: Started Redis Server
  systemd:
    name: redis
    state: started
    enabled: yes

2、根据tasks编写handlers

[root@ansible ansible]# cat roles/redis/handlers/main.yml 
- name: Restart Redis Server
  systemd:
    name: redis
    state: restarted

3、根据tasks编写templates

[root@ansible ansible]# cat roles/redis/templates/redis.conf.j2 
bind 127.0.0.1 {{ ansible_default_ipv4.address }} 
protected-mode yes
port 6379
tcp-backlog 511
timeout 0
tcp-keepalive 300
daemonize no
supervised no
pidfile /var/run/redis_6379.pid
loglevel notice
logfile /var/log/redis/redis.log
databases 16
save 900 1
save 300 10
save 60 10000
stop-writes-on-bgsave-error yes
rdbcompression yes
rdbchecksum yes
dbfilename dump.rdb
dir /var/lib/redis
slave-serve-stale-data yes
slave-read-only yes
repl-diskless-sync no
repl-diskless-sync-delay 5
repl-disable-tcp-nodelay no
slave-priority 100
appendonly no
appendfilename "appendonly.aof"
appendfsync everysec
no-appendfsync-on-rewrite no
auto-aof-rewrite-percentage 100
auto-aof-rewrite-min-size 64mb
aof-load-truncated yes
lua-time-limit 5000
slowlog-log-slower-than 10000
slowlog-max-len 128
latency-monitor-threshold 0
notify-keyspace-events ""
hash-max-ziplist-entries 512
hash-max-ziplist-value 64
list-max-ziplist-size -2
list-compress-depth 0
set-max-intset-entries 512
zset-max-ziplist-entries 128
zset-max-ziplist-value 64
hll-sparse-max-bytes 3000
activerehashing yes
client-output-buffer-limit normal 0 0 0
client-output-buffer-limit slave 256mb 64mb 60
client-output-buffer-limit pubsub 32mb 8mb 60
hz 10
aof-rewrite-incremental-fsync yes

4、编写playbook

[root@ansible ansible]# cat test.yml 
- name: Install Redis-Server
  hosts: redisserver 
  roles:
    - redis

5、登录redis查看效果

[root@ansible ansible]# ssh root@10.10.100.41
[root@redis01 ~]# redis-cli 

三、编写中层服务的roles(nginx、php)

(一)编写nignx的roles

1、创建目录

[root@ansible roles]# mkdir -pv nginx/{files,tasks,templates,handlers,meta}

 

2、编写tasks

[root@ansible ansible]# cat roles/nginx/tasks/main.yml 
- name: Installed Nginx SoftWare
  yum:
    name: nginx
    state: present

- name: Configure Nginx Server
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: Restart Nginx Server

- name: Started Nginx Server
  systemd:
    name: nginx
    state: started
    enabled: yes

3、根据tasks编写handlers

[root@ansible ansible]# cat roles/nginx/handlers/main.yml 
- name: Restart Nginx Server
  systemd:
    name: nginx
    state: restarted

4、根据tasks编写templates

[root@ansible ansible]# cat roles/nginx/templates/nginx.conf.j2 
user  {{ user }};
worker_processes  {{ ansible_processor_vcpus }};

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  25565;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;
    keepalive_timeout  65;
    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

5、编写playbook进行测试

[root@ansible ansible]# cat test.yml 
- name: Install Nginx-server
  hosts: webservers
  roles:
    - nginx

6、客户端验证

[root@ansible ansible]# curl http://10.10.100.21
...
<title>Welcome to nginx!</title>
...

 

(二)编写php的roles

1、创建目录

[root@ansible roles]# mkdir -pv php/{files,tasks,templates,handlers,meta}

 

2、编写tasks

[root@ansible ansible]# cat roles/php/tasks/main.yml
- name: Install PHP server
  yum:
    name: "{{ item }}"
    state: present
  loop:
    - php71w
    - php71w-cli
    - php71w-common
    - php71w-devel
    - php71w-embedded
    - php71w-gd
    - php71w-mcrypt
    - php71w-mbstring
    - php71w-pdo
    - php71w-xml
    - php71w-fpm
    - php71w-mysqlnd
    - php71w-opcache
    - php71w-pecl-memcached
    - php71w-pecl-redis
    - php71w-pecl-mongodb

- name: Configure PHP Server
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    mode: "{{ item.mode }}"
  loop:
    - { src: "php.ini.j2", dest: "/etc/php.ini", mode: "0644" }
    - { src: "php-fpm.d.www.conf.j2", dest: "/etc/php-fpm.d/www.conf", mode: "0644" }
  notify: Restart PHP-FPM Server

- name: Started PHP Server
  systemd:
    name: php-fpm
    state: started
    enabled: yes

3、根据tasks编写handlers

[root@ansible ansible]# cat roles/php/handlers/main.yml 
- name: Restart PHP-FPM Server
  systemd:
    name: php-fpm
    state: restarted

4、根据tasks编写templates

[root@ansible ansible]# cat roles/php/templates/php.ini.j2 
[PHP]
engine = On
short_open_tag = Off
precision = 14
output_buffering = 4096
zlib.output_compression = Off
implicit_flush = Off
unserialize_callback_func =
serialize_precision = 17
disable_functions =
disable_classes =
zend.enable_gc = On
expose_php = On
max_execution_time = 30
max_input_time = 60
memory_limit = 128M
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
display_errors = Off
display_startup_errors = Off
log_errors = On
log_errors_max_len = 1024
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
track_errors = Off
html_errors = On
variables_order = "GPCS"
request_order = "GP"
register_argc_argv = Off
auto_globals_jit = On
post_max_size = 8M
auto_prepend_file =
auto_append_file =
default_mimetype = "text/html"
default_charset = "UTF-8"
doc_root =
user_dir =
enable_dl = Off
file_uploads = On
upload_max_filesize = 16M
max_file_uploads = 20
allow_url_fopen = On
allow_url_include = Off
default_socket_timeout = 60
[CLI Server]
cli_server.color = On
[Date]
[filter]
[iconv]
[intl]
[sqlite]
[sqlite3]
[Pcre]
[Pdo]
[Pdo_mysql]
pdo_mysql.cache_size = 2000
pdo_mysql.default_socket=
[Phar]
[mail function]
sendmail_path = /usr/sbin/sendmail -t -i
mail.add_x_header = On
[SQL]
sql.safe_mode = Off
[ODBC]
odbc.allow_persistent = On
odbc.check_persistent = On
odbc.max_persistent = -1
odbc.max_links = -1
odbc.defaultlrl = 4096
odbc.defaultbinmode = 1
[Interbase]
ibase.allow_persistent = 1
ibase.max_persistent = -1
ibase.max_links = -1
ibase.timestampformat = "%Y-%m-%d %H:%M:%S"
ibase.dateformat = "%Y-%m-%d"
ibase.timeformat = "%H:%M:%S"
[MySQLi]
mysqli.max_persistent = -1
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.cache_size = 2000
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
[mysqlnd]
mysqlnd.collect_statistics = On
mysqlnd.collect_memory_statistics = Off
[OCI8]
[PostgreSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0
[bcmath]
bcmath.scale = 0
[browscap]
[Session]
session.save_handler = redis
session.save_path = "tcp://{{ redis_server_ip }}:{{ redis_server_port }}"
session.use_strict_mode = 0
session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly =
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor = 1000
session.gc_maxlifetime = 1440
session.referer_check =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
session.hash_function = 0
session.hash_bits_per_character = 5
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
[Assertion]
zend.assertions = -1
[mbstring]
[gd]
[exif]
[Tidy]
tidy.clean_output = Off
[soap]
soap.wsdl_cache_enabled=1
soap.wsdl_cache_dir="/tmp"
soap.wsdl_cache_ttl=86400
soap.wsdl_cache_limit = 5
[sysvshm]
[ldap]
ldap.max_links = -1
[mcrypt]
[dba]
[curl]
[openssl]

 

[root@ansible ansible]# cat roles/php/templates/php-fpm.d.www.conf.j2 
[www]
user = {{ user }}
group = {{ group }}
listen = 127.0.0.1:9000
listen.allowed_clients = 127.0.0.1
pm = dynamic
pm.max_children = 50
pm.start_servers = 20
pm.min_spare_servers = 10
pm.max_spare_servers = 35
slowlog = /var/log/php-fpm/www-slow.log
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
php_value[soap.wsdl_cache_dir]  = /var/lib/php/wsdlcache

 

5、根据tasks给group_vars/all添加变量

[root@ansible ansible]# vim group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

#mysql
mysql_root_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

6、使用playbook测试roles

[root@ansible ansible]# cat test.yml 
- name: Install Nginx-server
  hosts: webservers
  roles:
    - php

(三)测试php-test的roles测试php是否正确安装

1、创建文件夹

[root@ansible roles]# mkdir -pv php-test/{files,tasks,templates,handlers,meta}

 

2、编写tasks

[root@ansible ansible]# cat roles/php-test/tasks/main.yml 
- name: Add Nginx Config
  template:
    src: php.conf.j2
    dest: /etc/nginx/conf.d/php.conf
  notify: Restart Nginx server 


- name: Add Test Code
  copy:
    src: info.php
    dest: /usr/share/nginx/html/info.php
    owner: "{{ user }}"
    group: "{{ group }}"
    mode: '0755'

3、创建模板

[root@ansible ansible]# cat roles/php-test/templates/php.conf.j2 
server {
        listen 80;
        server_name php.linux98.com;
        root /usr/share/nginx/html/;
        index index.php index.html;
        
        location ~ \.php$ {
                fastcgi_pass    127.0.0.1:9000; 
                fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
        }
}

4、编写handlers

[root@ansible ansible]# cat roles/php-test/handlers/main.yml 
- name: Restart Nginx server
  systemd:
    name: nginx
    state: restarted

5、准备网页文件

[root@ansible ansible]# cat roles/php-test/files/info.php 
<?php
        phpinfo();
?>

6、使用playbook执行

[root@ansible ansible]# cat test.yml
- name: Install Nginx-server
  hosts: webservers
  roles:
    - php-test

7、使用浏览器测试

image-20210612112100359

四、使用中层服务部署WordPress、PHPmyadmin

(一)部署WordPress

1、创建目录

[root@ansible roles]# mkdir -pv wordpress-web/{files,tasks,templates,handlers,meta}
[root@ansible ansible]# tree roles/wordpress-web/
roles/wordpress-web/
├── files
│   ├── ansible_wordpress.sql
│   └── wordpress.tar.gz
├── handlers
├── meta
│   └── main.yml
├── tasks
│   └── main.yml
└── templates
    └── example.linux98.com.conf.j2

2、编写tasks

[root@ansible ansible]# cat roles/wordpress-web/tasks/main.yml 
- name: Add Wordpress VHost Confgiure
  template:
    src: example.linux98.com.conf.j2
    dest: /etc/nginx/conf.d/example.linux98.com.conf
  notify: Restart Nginx Server

- name: Create Wordpress Site Directory
  file:
    path: "{{ wordpress_root_path }}"
    state: directory
    owner: "{{ user }}"
    group: "{{ group }}"

- name: Copy Wordpress Code
  unarchive:
    src: wordpress.tar.gz 
    dest: "{{ wordpress_root_path }}"
    owner: "{{ user }}"
    group: "{{ group }}"

- name: Copy App Databases
  copy:
    src: ansible_wordpress.sql
    dest: /tmp/

- name: Import App Databases
  mysql_db:
    login_host: "{{ dbserver_ipaddress }}"
    login_user: "{{ mysql_app_user }}" 
    login_password: "{{ mysql_app_pw }}"
    name: ansible_wordpress
    state: import
    target: /tmp/ansible_wordpress.sql

3、编写handlers

[root@ansible wordpress-web]# vim handlers/main.yml
- name: Restart Nginx Server
  systemd:
    name: nginx
    state: restarted

4、创建模板

[root@ansible wordpress-web]# cat templates/example.linux98.com.conf.j2 
server {
        listen {{ wordpress_listen_port }};
        server_name {{ wordpress_server_name }};
        root {{ wordpress_root_path }};

        location / {
                index index.php;
        }

        location ~ \.php$ {
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                fastcgi_param HTTPS {{ wordpress_fastcgi_https }};
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
        }
}

5、上传文件

文件地址:

wordpress.tar.gz https://gitee.com/lichunpeng12/ansible/raw/master/roles/wordpress-web/files/wordpress.tar.gz

ansible_wordpress.sql https://gitee.com/lichunpeng12/ansible/blob/master/roles/wordpress-web/files/ansible_wordpress.sql

[root@ansible wordpress-web]# tree
.
├── files
│   ├── ansible_wordpress.sql
│   └── wordpress.tar.gz
├── handlers
│   └── main.yml
├── meta
│   └── main.yml
├── tasks
│   └── main.yml
└── templates
    └── example.linux98.com.conf.j2

6、编写meta依赖

[root@ansible wordpress-web]# cat meta/main.yml 
dependencies:
  - { role: nginx }
  - { role: php }

7、增加全局变量

[root@ansible wordpress-web]# cat /root/ansible/group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#wordpress-proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress-web
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "off"  #这里只是部署后端web节点,如果开启fastcgi https,页面会不正常

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80

#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

8、编写playbook测试

[root@ansible wordpress-web]# cat /root/ansible/test.yml 
- name: Depoly Wordpress App
  hosts: webservers
  roles:
    - wordpress-web

9、测试效果

#此处应该是10.10.100.21、22、23

测试第一次

测试第二次

测试第三次

(二)部署PHPmyadmin

1、创建目录

[root@ansible roles]# mkdir -pv phpmyadmin/{files,tasks,templates,handlers,meta}

2、编写tasks

[root@ansible ansible]# cat roles/phpmyadmin/tasks/main.yml 
- name: Create code directory
  file:
    path: "{{ phpmyadmin_root_path }}"
    state: directory
    owner: "{{ user }}"
    group: "{{ group }}"

- name: Copy phpmyadmin code
  unarchive:
    src: phpmyamdin.tar.gz 
    dest: "{{ phpmyadmin_root_path }}"
    owner: "{{ user }}"
    group: "{{ group }}"

- name: Configure phpmyadmin config
  template:
    src: config.inc.php.j2
    dest: "{{ phpmyadmin_root_path }}/config.inc.php"

- name: Configure Nginx Virtualhost
  template:
    src: phpmyadmin.linux98.com.conf.j2
    dest: /etc/nginx/conf.d/phpmyadmin.linux98.com.conf
  notify: Restart Nginx Server

3、编写handlers

[root@ansible ansible]# cat roles/phpmyadmin/handlers/main.yml 
- name: Restart Nginx Server
  systemd:
    name: nginx
    state: restarted

- name: Restart PHP-fpm Server
  systemd:
    name: php-fpm
    state: restarted

4、编写模板

[root@ansible ansible]# cat roles/phpmyadmin/templates/config.inc.php.j2 
<?php
$cfg['blowfish_secret'] = ''; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */

$i = 0;

$i++;
$cfg['Servers'][$i]['auth_type'] = 'cookie';
$cfg['Servers'][$i]['host'] = '{{ dbserver_ipaddress }}';
$cfg['Servers'][$i]['compress'] = false;
$cfg['Servers'][$i]['AllowNoPassword'] = false;

$cfg['UploadDir'] = '';
[root@ansible ansible]# cat roles/phpmyadmin/templates/phpmyadmin.linux98.com.conf.j2 
server {
        listen {{ phpmyadmin_listen_port }};
        server_name {{ phpmyadmin_server_name }};
        root {{ phpmyadmin_root_path }};

        location / {
                index index.php;
        }

        location ~ \.php$ {
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                fastcgi_param HTTPS {{ phpmyadmin_fastcgi_https }};
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
        }
}

5、上传phpmyadmin安装包

包链接:https://gitee.com/lichunpeng12/ansible/raw/master/roles/phpmyadmin/files/phpmyamdin.tar.gz

上传到roles/phpmyadmin/files/

上传完之后的样子

[root@ansible ansible]# tree roles/phpmyadmin
roles/phpmyadmin
├── files
│   └── phpmyamdin.tar.gz
├── handlers
│   └── main.yml
├── meta
│   └── main.yml
├── tasks
│   └── main.yml
└── templates
    ├── config.inc.php.j2
    └── phpmyadmin.linux98.com.conf.j2

6、配置全局环境变量

[root@ansible ansible]# cat group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#wordpress-proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress-web
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "off"  #这里只是部署后端web节点,如果开启fastcgi https,页面会不正常

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80
phpmyadmin_fastcgi_https: "off"


#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

7、测试直接访问web节点

测试访问时可以右键刷新,点清空缓存并硬性重新加载

下面的地址应该是10.10开头

image-20210612112655040

image-20210612112719563

image-20210612112739321

五、配置Nginx的7层代理(WordPress、PHPmyadmin)

(一)WordPress-proxy

1、创建目录

[root@ansible roles]# tree wordpress-proxy/
wordpress-proxy/
├── files
│   ├── 5681611_example.linux98.com.key
│   └── 5681611_example.linux98.com.pem
├── handlers
│   └── main.yml
├── meta
│   └── main.yml
├── tasks
│   └── main.yml
├── templates
│   ├── example.linux98.com.conf.j2
│   └── proxy_params.j2
└── vars

2、编写tasks

[root@ansible roles]# cat wordpress-proxy/tasks/main.yml 
- name: Add Proxy Nginx Vhost 
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  loop:
    - { src: "example.linux98.com.conf.j2", dest: "/etc/nginx/conf.d/proxy_example.linux98.com.conf" }
    - { src: "proxy_params.j2", dest: "/etc/nginx/proxy_params" }

- name: Add Proxy SSL Key Direction
  file:
    path: /etc/nginx/ssl_keys/
    state: directory

- name: Copy SSL Key
  copy:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  loop:
    - { src: "5681611_example.linux98.com.key", dest: "/etc/nginx/ssl_keys/5681611_example.linux98.com.key" }
    - { src: "5681611_example.linux98.com.pem", dest: "/etc/nginx/ssl_keys/5681611_example.linux98.com.pem" }
  notify: Restart Nginx Server

3、编写handlers

[root@ansible wordpress-proxy]# cat handlers/main.yml 
- name: Restart Nginx Server
  systemd:
    name: nginx
    state: restarted

4、编写meta

[root@ansible wordpress-proxy]# cat meta/main.yml 
dependencies:
  - { role: nginx }

5、编写模板

[root@ansible wordpress-proxy]# cat templates/example.linux98.com.conf.j2 
upstream {{ wordpress_server_name }} {
{% for host in groups["webservers"]%}
        server {{ host }}:{{ wordpress_listen_port }};
{% endfor %}
}

#https
server {
        listen {{ wordpress_proxy_port }} ssl;
        server_name {{ wordpress_server_name }};
        ssl_certificate ssl_keys/5681611_example.linux98.com.pem;
        ssl_certificate_key ssl_keys/5681611_example.linux98.com.key;

        location / {
                proxy_pass http://{{ wordpress_server_name }};
                include proxy_params;
        }
}

#http-->https
server {
        listen 80;
        server_name {{ wordpress_server_name }};
        return 302 https://$server_name$request_uri;
}
[root@ansible wordpress-proxy]# cat templates/proxy_params.j2 
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 30;
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_buffering on;
proxy_buffer_size 64k;
proxy_buffers 4 64k;

 

6、上传SSL证书

上传ssl证书

[root@ansible wordpress-proxy]# tree files/
files/
├── 5681611_example.linux98.com.key
└── 5681611_example.linux98.com.pem

 

7、配置全局变量

[root@ansible wordpress-proxy]# cat /root/ansible/group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "on"

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80

#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

8、使用playbook执行

[root@ansible ansible]# cat test.yml 
- name: Depoly Wordpress App
  hosts: webservers
  roles:
    - wordpress-web
- name: Set Wordpress Proxy
  hosts: proxyservers
  roles:
    - wordpress-proxy

9、验证

下面的地址应该是10.10开头

image-20210612154403371

image-20210612154536101

image-20210612154643616

 

(二)PHPmyadmin-proxy

1、创建目录

[root@ansible ansible]# tree roles/phpmyadmin-proxy/
roles/phpmyadmin-proxy/
├── files
│   ├── 5755021_phpmyadmin.linux98.com.key
│   └── 5755021_phpmyadmin.linux98.com.pem
├── handlers
│   └── main.yml
├── meta
│   └── main.yml
├── tasks
│   └── main.yml
└── templates
    ├── phpmyadmin.linux98.com.conf.j2
    └── proxy_params.j2

2、编写tasks

[root@ansible ansible]# cat roles/phpmyadmin-proxy/tasks/main.yml 
- name: Add Proxy Nginx Vhost 
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  loop:
    - { src: "phpmyadmin.linux98.com.conf.j2", dest: "/etc/nginx/conf.d/proxy_phpmyadmin.linux98.com.conf" }
    - { src: "proxy_params.j2", dest: "/etc/nginx/proxy_params" }

- name: Add Proxy SSL Key Direction
  file:
    path: /etc/nginx/ssl_keys/
    state: directory

- name: Copy SSL Key
  copy:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  loop:
    - { src: "5755021_phpmyadmin.linux98.com.key", dest: "/etc/nginx/ssl_keys/5755021_phpmyadmin.linux98.com.key" }
    - { src: "5755021_phpmyadmin.linux98.com.pem", dest: "/etc/nginx/ssl_keys/5755021_phpmyadmin.linux98.com.pem" }
  notify: Restart Nginx Server

 

3、编写handlers

[root@ansible ansible]# cat roles/phpmyadmin-proxy/handlers/main.yml 
- name: Restart Nginx Server
  systemd:
    name: nginx
    state: restarted

 

4、编写meta

[root@ansible ansible]# cat roles/phpmyadmin-proxy/meta/main.yml 
dependencies:
  - { role: nginx }

5、编写模板

[root@ansible ansible]# cat roles/phpmyadmin-proxy/templates/phpmyadmin.linux98.com.conf.j2 
upstream {{ phpmyadmin_server_name }} {
{% for host in groups["webservers"]%}
        server {{ host }}:{{ phpmyadmin_listen_port }};
{% endfor %}
}

#https
server {
        listen {{ phpmyadmin_proxy_port }} ssl;
        server_name {{ phpmyadmin_server_name }};
        ssl_certificate ssl_keys/5755021_phpmyadmin.linux98.com.pem;
        ssl_certificate_key ssl_keys/5755021_phpmyadmin.linux98.com.key;

        location / {
                proxy_pass http://{{ phpmyadmin_server_name }};
                include proxy_params;
        }
}

#http-->https
server {
        listen 80;
        server_name {{ phpmyadmin_server_name }};
        return 302 https://$server_name$request_uri;
}
[root@ansible ansible]# cat roles/phpmyadmin-proxy/templates/proxy_params.j2 
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 30;
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_buffering on;
proxy_buffer_size 64k;
proxy_buffers 4 64k;

6、上传SSL证书

[root@ansible ansible]# tree roles/phpmyadmin-proxy/files/
roles/phpmyadmin-proxy/files/
├── 5755021_phpmyadmin.linux98.com.key
└── 5755021_phpmyadmin.linux98.com.pem

7、配置全局变量

[root@ansible ansible]# cat group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#wordpress-proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "on"

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80
phpmyadmin_fastcgi_https: "on"

#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

8、使用playbook执行

[root@ansible ansible]# vim test.yml
- name: Depoly PHPmyadmin App
  hosts: webservers
  roles:
    - phpmyadmin
- name: Set PHPmyadmin Proxy
  hosts: proxyservers
  roles:
    - phpmyadmin-proxy

9、验证

image-20210612155901945

image-20210612160000539

image-20210612160057073

image-20210612160419421

六、将wordpress中的图片资源迁移到NFS共享存储上

(一)创建NFS-client的roles

1、创建文件夹

[root@ansible roles]# mkdir -pv nfs-client/{files,tasks,templates,handlers,meta}

2、编写tasks

[root@ansible ansible]# cat roles/nfs-client/tasks/main.yml 
- name: Create Wordpress Image Directory
  file:
    path: "{{ wordpress_root_path }}/wp-content/uploads/"
    state: directory
    mode: '0755'
    owner: "{{ user }}"
    group: "{{ group }}"



- name: Configure Permanent Storage
  mount:
    backup: yes
    path: "{{ wordpress_root_path }}/wp-content/uploads/"
    src: "{{ nfs_server_ip }}:{{ nfs_share_directory }}"
    fstype: nfs
    state: mounted

 

3、配置全局环境变量

[root@ansible ansible]# cat group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24
nfs_server_ip: 10.10.100.31

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#wordpress-proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "on"

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80
phpmyadmin_fastcgi_https: "on"

#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

 

4、使用web访问wordpress并上传一张图片

未配置nfs时:图片只存在一个主机上,只有多次刷新才能访问到图片

image-20210612172807785

image-20210612172821703

 

5、使用playbook将web节点全部挂载nfs

[root@ansible ansible]# cat nfs-client.yml 
- name: Configure Webserver NFS-Client
  hosts: webservers
  roles:
    - nfs-client

6、再次上传图片并刷新测试

image-20210612173355104

多次刷新后图片依然可以访问,证明wordpress静态资源使用NFS共享配置成功

 

七、配置LVS+Keepalived四层代理

(一)编写RS节点的roles

1、创建文件夹

[root@ansible roles]# tree lvs-RS/
lvs-RS/
├── files
├── tasks
│   └── main.yml
└── templates
    └── rs_install.sh.j2

2、编写tasks

[root@ansible roles]# cat lvs-RS/tasks/main.yml 
- name: Config RS Scripts
  template:
    src: rs_install.sh.j2
    dest: /tmp/rs_install.sh

- name: Bash RS Scripts
  shell:
    cmd: 'sh /tmp/rs_install.sh'

3、编写模板脚本

[root@ansible roles]# cat lvs-RS/templates/rs_install.sh.j2 
VIP={{ lvs_vip_address }}
DEV=lo:0

cat  >/etc/sysconfig/network-scripts/ifcfg-${DEV}  <<-EOF
DEVICE=lo:0
IPADDR=${VIP}
#NETMASK=255.0.0.0
PREFIX=32
ONBOOT=yes
NAME=loopback
EOF

systemctl restart network

#配置ARP,不对外宣告本机VIP地址
echo "1" >/proc/sys/net/ipv4/conf/all/arp_ignore
echo "1" >/proc/sys/net/ipv4/conf/default/arp_ignore
echo "1" >/proc/sys/net/ipv4/conf/lo/arp_ignore

echo "2" >/proc/sys/net/ipv4/conf/all/arp_announce
echo "2" >/proc/sys/net/ipv4/conf/default/arp_announce
echo "2" >/proc/sys/net/ipv4/conf/lo/arp_announce

(二)编排keepalived的roles

1、创建文件夹

[root@ansible tasks]# tree /root/ansible/roles/lvs/
/root/ansible/roles/lvs/
├── files
├── handlers
├── meta
├── tasks
│   └── main.yml
├── templates
└── vars

2、编写tasks

[root@ansible roles]# cat lvs/tasks/main.yml 
- name: Enable Kernel Forward
  shell:
    cmd: 'echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf && sysctl -p'

- name: Install Keepalived SoftWare
  yum:
    name: 
      - keepalived
      - ipvsadm
    state: present

- name: Configure Keeplaived config
  template:
    src: keepalived.conf.j2
    dest: /etc/keepalived/keepalived.conf
  notify: Restart Keepalived Service

- name: Configure Keepalived Service
  systemd:
    name: keepalived
    state: started
    enabled: yes

3、编写handlers

[root@ansible roles]# cat lvs/handlers/main.yml 
- name: Restart Keepalived Service
  systemd:
    name: keepalived
    state: restarted

4、编写templates文件

[root@ansible roles]# cat lvs/templates/keepalived.conf.j2 
global_defs {
    router_id {{ ansible_hostname }}
}

vrrp_instance VI_1 {

{% if ansible_hostname == "Ib01" %}
    state MASTER
    priority 200
{% elif ansible_hostname == "Ib02" %}
    state BACKUP
    priority 150
{% endif %}

    interface eth0
    virtual_router_id 50
    advert_int 3
    authentication {
        auth_type PASS
        auth_pass 1111
 }
    virtual_ipaddress {
        {{ lvs_vip_address }}
    }
}

# 配置集群地址访问的IP+Port
virtual_server {{ lvs_vip_address }} {{ lvs_cluster_port }} {
    delay_loop 6
    lb_algo wlc
    lb_kind DR
    perssisstence_timeout 5
    protocol TCP

{% for realserver_ip in groups["proxyservers"] %}
    real_server {{ realserver_ip }} {{ realserver_port }} {
        weight 1
        TCP_CHECK {
            connect_port {{ realserver_port }}
            connect_timeout 3
            nb_get_retry 2
            delay_beefore_retry 3
        }
    }
{% endfor %}
}

virtual_server {{ lvs_vip_address }} {{ lvs_cluster_https_port }} {
    delay_loop 6
    lb_algo wlc
    lb_kind DR
    perssisstence_timeout 5
    protocol TCP

{% for realserver_ip in groups["proxyservers"] %}
    real_server {{ realserver_ip }} {{ realserver_https_port }} {
        weight 1
        TCP_CHECK {
            connect_port {{ realserver_port }}
            connect_timeout 3
            nb_get_retry 2
            delay_beefore_retry 3
        }
    }
{% endfor %}
}

5、添加全局环境变量

[root@ansible ansible]# cat group_vars/all 
#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24
nfs_server_ip: 10.10.100.31

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#wordpress-proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "on"

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80
phpmyadmin_fastcgi_https: "on"

#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

#Ibserver
lvs_vip_address: 10.10.100.100
lvs_cluster_port: 80
realserver_port: 80
realserver_https_port: 443
lvs_cluster_https_port: 443

#dns
dns_master_ip: 10.10.100.91
dns_slave_ip: 10.10.100.92

6、编写playbook进行测试

[root@ansible ansible]# cat lvs.yml 
- name: Install Base
  hosts:
    - Ibservers
  roles:
    - base

- name: Install Keepalived and lvs
  hosts: Ibservers
  roles:
    - lvs

- name: Install RS Server
  hosts: proxyservers
  roles:
    - lvs-RS

7、route节点配置DNAT

[root@route ~]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  0.0.0.0/0            172.20.254.192       tcp dpt:443 to:10.10.100.100:443
DNAT       tcp  --  0.0.0.0/0            172.20.254.192       tcp dpt:80 to:10.10.100.100:80

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  10.10.100.0/24      0.0.0.0/0            to:172.20.254.192
[root@route ~]# iptables -t nat -I PREROUTING -p tcp --dport 80 -d 172.20.254.192 -j DNAT --to 10.10.100.100:80
[root@route ~]# iptables -t nat -I PREROUTING -p tcp --dport 443 -d 172.20.254.192 -j DNAT --to 10.10.100.100:443
[root@route ~]# sysctl -p
net.ipv4.ip_forward = 1

8、使用client进行测试

image-20210613110053766

八、配置DNS并使用全局DNS

(一)编写DNS(bind)的roles

1、创建文件夹

[root@ansible ansible]# tree roles/dns/
roles/dns/
├── files
├── handlers
│   └── main.yml
├── meta
├── tasks
│   └── main.yml
├── templates
│   ├── linux98.com.zone.j2
│   ├── named.conf.j2
│   └── named.linux98.zones.j2
└── vars

2、编写tasks

[root@ansible ansible]# cat roles/dns/tasks/main.yml 
- name: Install bind software
  yum:
    name: bind
    state: present

- name: Config
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: "root"
    group: "named"
    mode: "0640"
  loop:
    - { src: "named.conf.j2", dest: "/etc/named.conf" }
    - { src: "linux98.com.zone.j2", dest: "/var/named/linux98.com.zone" }
    - { src: "named.linux98.zones.j2", dest: "/etc/named.linux98.zones" }
  notify: Restart named service

- name: systemd
  systemd:
    name: named
    state: started
    enabled: yes

3、编写handlers

[root@ansible ansible]# cat roles/dns/handlers/main.yml 
- name: Restart named service
  systemd:
    name: named
    state: restarted

4、编写templates

[root@ansible ansible]# cat roles/dns/templates/linux98.com.zone.j2 
$TTL 600
linux98.com. IN SOA ns.linux98.com. qq.linux98.com. (
    2021051909
    10800
    900
    604800
    86400
)


linux98.com. IN NS ns1.linux98.com.

ns1.linux98.com. IN A {{ dns_master_ip }}

{% for host in groups.all %}
{{ hostvars[host].ansible_hostname }}.linux98.com. IN A {{ hostvars[host].ansible_default_ipv4.address }}
{% endfor %}

mirrors.linux98.com. IN A 172.20.254.191
example.linux98.com. IN A 172.20.254.192
phpmyadmin.linux98.com. IN A 172.20.254.192
[root@ansible ansible]# cat roles/dns/templates/named.conf.j2 
options {
  listen-on port 53 { localhost; }; 
  directory "/var/named";
  dump-file "/var/named/data/cache_dump.db"; 
  statistics-file "/var/named/data/named_stats.txt"; 
  memstatistics-file "/var/named/data/named_mem_stats.txt"; 
  recursing-file "/var/named/data/named.recursing"; 
  secroots-file "/var/named/data/named.secroots"; 
  allow-query { any; };

{% if ansible_hostname == "dns-master" %}
  allow-transfer { {{ dns_slave_ip }};};   
  also-notify { {{ dns_slave_ip }};}; 
{% elif ansible_hostname == "dns-slave" %}
  masterfile-format text;
{% endif %}

  recursion yes;
  dnssec-enable yes; 
  dnssec-validation yes;
  
  /* Path to ISC DLV key */
  bindkeys-file "/etc/named.root.key";
  managed-keys-directory "/var/named/dynamic";
  pid-file "/run/named/named.pid";
  session-keyfile "/run/named/session.key";
};


logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
            };
};

zone "." IN {
    type hint;
    file "named.ca"; 
};

include "/etc/named.rfc1912.zones"; 
include "/etc/named.root.key";
include "/etc/named.linux98.zones";
[root@ansible ansible]# cat roles/dns/templates/named.linux98.zones.j2 
{% if ansible_hostname == "dns-master" %}
zone "linux98.com" IN {
    type master;
    file "linux98.com.zone";
    notify yes;
};
{% elif ansible_hostname == "dns-slave" %}
zone "linux98.com" IN {
    type slave;
    file "slaves/linux98.com.zone";
    masters { {{ dns_master_ip }};};
};
{% endif %}

5、添加全局环境变量

#all
user: www
group: www
user_id: 666
group_id: 666


#NFS
nfs_share_directory: /ansible_data
nfs_share_ip_pool: 10.10.100.0/24
nfs_server_ip: 10.10.100.31

#mysql
mysql_root_pw: linux98.com@123
mysql_app_user: ansible_all
mysql_app_pw: linux98.com@123

#php
redis_server_ip: 10.10.100.41
redis_server_port: 6379

#wordpress-proxy
wordpress_server_name: example.linux98.com
wordpress_listen_port: 80
wordpress_proxy_port: 443

#wordpress
wordpress_root_path: /ansible_wordpress
dbserver_ipaddress: 10.10.100.51
wordpress_fastcgi_https: "on"

#phpmyadmin
phpmyadmin_root_path: /ansible_phpmyadmin
phpmyadmin_server_name: phpmyadmin.linux98.com
phpmyadmin_listen_port: 80
phpmyadmin_fastcgi_https: "on"

#phpmyadmin-proxy
phpmyadmin_proxy_port: 443

#Ibserver
lvs_vip_address: 10.10.100.100
lvs_cluster_port: 80
realserver_port: 80
realserver_https_port: 443
lvs_cluster_https_port: 443

#dns
dns_master_ip: 10.10.100.91
dns_slave_ip: 10.10.100.92

6、编写playbook进行测试

[root@ansible ansible]# cat dns.yml 
- name: Get facts
  hosts: all

- name: Install Base and dns software
  hosts: dnsservers
  roles:
    - base
    - dns

(二)编写dns-client的roles

1、创建文件夹

[root@ansible ansible]# tree roles/dns-client/
roles/dns-client/
├── handlers
│   └── main.yml
└── tasks
    └── main.yml

2、编写tasks

[root@ansible ansible]# cat roles/dns-client/tasks/main.yml 
- name: Notes old Network DNS Config
  lineinfile:
    backup: yes
    path: /etc/sysconfig/network-scripts/ifcfg-eth0
    state: absent
    regexp: '^DNS' 

- name: Add New Network DNS Config
  lineinfile:
    backup: yes
    path: /etc/sysconfig/network-scripts/ifcfg-eth0
    state: present
    line: "{{ item }}"
  loop:
    - 'DNS1={{ dns_master_ip }}'
    - 'DNS2={{ dns_slave_ip }}'
  notify: Restart Network Service

3、编写handlers

[root@ansible ansible]# cat roles/dns-client/handlers/main.yml 
- name: Restart Network Service
  systemd:
    name: network
    state: restarted

4、编写playbook进行测试

[root@ansible ansible]# cat dns-client.yml 
- name: Config Host DNS
  hosts:
    - webservers
  roles:
    - dns-client

5、查看测试结果

[root@ansible ansible]# ansible webservers -m shell -a 'cat /etc/sysconfig/network-scripts/ifcfg-eth0 | grep DNS'
10.10.100.22 | CHANGED | rc=0 >>
DNS1=10.10.100.91
DNS2=10.10.100.92
10.10.100.21 | CHANGED | rc=0 >>
DNS1=10.10.100.91
DNS2=10.10.100.92
10.10.100.23 | CHANGED | rc=0 >>
DNS1=10.10.100.91
DNS2=10.10.100.92

九、初始化全部主机测试各个roles

(一)还原主机快照

1、在VMware vCenter上还原节点快照(重装系统)

将hosts清单内的主机全部还原快照(还原前保留一下快照,可以先关机再对快照进行操作)

2、使用ansible确认所有主机已经在线并检查时间是否同步

[root@ansible ansible]# ansible all -m shell -a 'date'
10.10.100.22 | CHANGED | rc=0 >>
Sun Jun 13 17:45:24 CST 2021
10.10.100.6 | CHANGED | rc=0 >>
Sun Jun 13 17:45:24 CST 2021
10.10.100.23 | CHANGED | rc=0 >>
Sun Jun 13 17:45:24 CST 2021
10.10.100.5 | CHANGED | rc=0 >>
Sun Jun 13 17:45:24 CST 2021
10.10.100.21 | CHANGED | rc=0 >>
Sun Jun 13 17:45:24 CST 2021
10.10.100.11 | CHANGED | rc=0 >>
Sun Jun 13 17:45:25 CST 2021
10.10.100.13 | CHANGED | rc=0 >>
Sun Jun 13 17:45:25 CST 2021
10.10.100.31 | CHANGED | rc=0 >>
Sun Jun 13 17:45:25 CST 2021
10.10.100.12 | CHANGED | rc=0 >>
Sun Jun 13 17:45:25 CST 2021
10.10.100.41 | CHANGED | rc=0 >>
Sun Jun 13 17:45:25 CST 2021
10.10.100.51 | CHANGED | rc=0 >>
Sun Jun 13 17:45:26 CST 2021
10.10.100.91 | CHANGED | rc=0 >>
Sun Jun 13 17:45:26 CST 2021
10.10.100.92 | CHANGED | rc=0 >>
Sun Jun 13 17:45:26 CST 2021
10.10.100.93 | CHANGED | rc=0 >>
Sun Jun 13 17:45:26 CST 2021

 

(二)使用playbook编排roles执行顺序

需要注意的地方:如果一起部署wordpress和phpmyadin,需要将phpmyadmin的roles里meta文件修改名称。

[root@ansible ansible]# cat wordpress-cluster.yml 
- name: Get facts
  hosts: all

- name: Install Base Software
  hosts: all
  roles:
    - base

- name: Install DNS Server
  hosts:
    - dnsservers
    

- name: Configure Servers DNS Config
  hosts:
    - Ibservers
    - proxyservers
    - webservers
    - nfsservers
    - redisserver
    - mysqlservers
  roles:
    - dns-client

- name: Configure NFS Servers
  hosts: nfsservers
  roles:
    - nfs

- name: Configure Mysql Servers
  hosts: mysqlservers
  roles: 
    - mysql

- name: Configure Redis Servers
  hosts: redisserver
  roles:
    - redis

- name: Configure WordPress Web and NFS Share Client
  hosts: webservers
  roles:
    - wordpress-web
    - nfs-client

- name: Configure WordPress Proxy and lvs-RS
  hosts: proxyservers
  roles:
    - wordpress-proxy
    - lvs-RS

- name: Configure LVS Server
  hosts: Ibservers
  roles:
    - lvs

 

(三)客户端测试

在测试机上设置host劫持 172.20.254.192 example.linux98.com phpmyadmin.linux98.com

1、测试wordpress

访问 example.linux98.com/wp-amdin在后台上传一个图片,多次刷新测试共享存储

image-20210613182328650

2、测试phpmyadmin

访问phpmyadmin.linux98.com 登录并多次刷新查看地址

image-20210613183437655

image-20210613183359049

image-20210613183328424

 

小李

学无止境,勇攀高峰。