文章目录Ansible Playbook示例——httpd示例——返回httpd网页内容示例——keepalived示例——批量创建用户ansible-vault文件变量示例——zabbixzabbix—serverzabbix-agentansible relos编写示例apache示例nginx示例redisgit上传脚本将仓库角色安装至角色目录通过外部仓库的角色创建虚拟主机Ansible Playbook示例——httpd--- - hosts: web become:yestasks: - name: Install the Apache ansible.builtin.yum: name: httpd state: present - name: Startservicehttpd,ifnot started ansible.builtin.service: name: httpd state: started enable:yes- name: creat index.html ansible.builtin.copy: content:www.westos.org\ndest: /var/www/html/index.html测试运行[devopsserver1 ansible]$ ansible-playbook apache.yml[devopsserver1 ~]$curlserver2示例——返回httpd网页内容--- - hosts: lamp become: yes tasks: - name: Install the Apache ansible.builtin.yum: name: httpd state: present - name: Start service httpd, if not started ansible.builtin.service: name: httpd state: started enabled: yes - name: creat index.html ansible.builtin.copy: content: {{ ansible_hostname }}\n dest: /var/www/html/index.html - name: Ensure the default Apaceh port is 80 ansible.builtin.lineinfile: path: /etc/httpd/conf/httpd.conf regexp: ^Listen insertafter: ^#Listen line: Listen 80 notify: restart service httpd handlers: - name: restart service httpd ansible.builtin.service: name: httpd state: restarted - hosts: localhost gather_facts: false become: false tasks: - name: Check that you can connect (GET) to a page and it returns a status 200 ansible.builtin.uri: url: http://192.168.234.162 return_content: true register: result - name: Print return information from the previous task ansible.builtin.debug: var: result示例——keepalived[devopsserver1 root]$cd/home/devops/ansible/[devopsserver1 ansible]$sudovim/etc/ansible/hosts[hacluster]192.168.234.161 stateMASTER pri100192.168.234.162 stateBACKUP pri80[hacluster:vars]interfaceeth0router_id61vip192.168.234.200[devopsserver1 ansible]$vimkeepalived.yml --- - hosts: hacluster#become: yestasks: - name: Install the keepalived ansible.builtin.yum: name: keepalived state: present - name: configure the keepalived ansible.builtin.template: src: keepalived.conf.j2 dest: /etc/keepalived/keepalived.conf notify: restartservicekeepalived - name: Startservicekepalived ansible.builtin.service: name: keepalived state: started enabled:yeshandlers: - name: restartservicekeepalived ansible.builtin.service: name: keepalived state: restarted[devopsserver1 ansible]$ yuminstall-ykeepalived.x86_64[devopsserver1 ansible]$cd[devopsserver1 ~]$cd/etc/keepalived/[devopsserver1 keepalived]$lskeepalived.conf[devopsserver1 keepalived]$cpkeepalived.conf /home/devops/ansible/[devopsserver1 keepalived]$cd/home/devops/ansible/[devopsserver1 ansible]$lsapache.yml keepalived.conf keepalived.yml[devopsserver1 ansible]$mvkeepalived.conf keepalived.conf.j2[devopsserver1 ansible]$vimkeepalived.conf.j2[devopsserver1 ansible]$sudoansible-playbook keepalived.yml! Configuration File for keepalivedglobal_defs {router_id LVS_DEVELvrrp_skip_check_adv_addrvrrp_garp_interval 0vrrp_gna_interval 0}vrrp_instance VI_1 {state {{ state }}interface {{ interface }}virtual_router_id {{ router_id }}priority {{ pri }}advert_int 1authentication {auth_type PASSauth_pass 1111}virtual_ipaddress {{{ vip }}}}运行[devopsserver1 ansible]$ ansible-playbook keepalived.yml测试[devopsserver1 ansible]$ipa示例——批量创建用户[devopsserver1 ansible]$vimuser.yml --- - hosts: db tasks: - name: Add the user ansible.builtin.user: name:{{ item.user }}password:{{ item.pass | password_hash(sha512) }}state: present loop: -{user: user1, pass: pass1}-{user: user2, pass: pass2}运行[devopsserver1 ansible]$ ansible-playbook user.yml[rootnode1 ~]# cat /etc/shadow示例——结合haproxy[devopsserver1 ansible]$ vim hosts[devopsserver1 ansible]$ vim haproxy.yml --- - hosts: haproxy,webservers become: yes tasks: - name: deploy haproxy block: - name: Install the haproxy ansible.builtin.yum: name: haproxy state: present - name: configure the haproxy ansible.builtin.template: src: haproxy.cfg.j2 dest: /etc/haproxy/haproxy.cfg notify: restart service haproxy - name: Start service haproxy ansible.builtin.service: name: haproxy state: started enabled: yes when: ansible_hostname server1 - name: deploy apache block: - name: Install the Apache ansible.builtin.yum: name: httpd state: present - name: Start service httpd ansible.builtin.service: name: httpd state: started enabled: yes - name: creat index.html ansible.builtin.copy: content: {{ ansible_hostname }}\n dest: /var/www/html/index.html - name: Ensure the default Apaceh port is {{ http_port }} ansible.builtin.template: src: httpd.conf.j2 dest: /etc/httpd/conf/httpd.conf notify: restart service httpd when: ansible_hostname in groups[webservers] handlers: - name: restart service haproxy ansible.builtin.service: name: haproxy state: restarted - name: restart service httpd ansible.builtin.service: name: httpd state: restarted运行测试[devopsserver1 ansible]$ ansible-playbook haproxy.ymlansible-vault常用参数create Create new vault encryptedfiledecrypt Decrypt vault encryptedfileedit Edit vault encryptedfileview View vault encryptedfileencrypt Encrypt YAMLfileencrypt_string Encrypt a string rekey Re-key a vault encryptedfile示例加密文件[devopsserver1 ansible]$ ansible-vault encrypt userlist.yml New Vault password: Confirm New Vault password: Encryption successful[devopsserver1 ansible]$catuserlist.yml示例解密文件[devopsserver1 ansible]$ ansible-vault decrypt userlist.yml Vault password: Decryption successful[devopsserver1 ansible]$catuserlist.yml文件变量示例[devopsserver1 ansible]$ vim user.yml[devopsserver1 ansible]$ vim userlist.yml[devopsserver1 ansible]$ sudo ansible-playbook user.yml管理方式示例——zabbixzabbix—server[devopsserver1 ansible]$vimzabbix.yml内容如下----hosts:zabbix_serverbecome:yestasks:-name:add zabbix repoansible.builtin.yum:name:https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-latest-6.0.el9.noarch.rpmstate:presentdisable_gpg_check:yes-name:install zabbix-serveransible.builtin.yum:name:-zabbix-server-mysql-zabbix-web-mysql-zabbix-apache-conf-zabbix-sql-scripts-zabbix-selinux-policy-zabbix-agentstate:presentdisablerepo:epel-name:install mysql-serveransible.builtin.yum:name:-mysql-server-python3-PyMySQLstate:present-name:enable mysql-serveransible.builtin.service:name:mysqldstate:startedenabled:yes-name:init mysql databasecommunity.mysql.mysql_db:name:zabbixstate:presentencoding:utf8mb4collation:utf8mb4_binlogin_user:root-name:create zabbix usercommunity.mysql.mysql_user:name:zabbixhost:localhoststate:presentpassword:zabbixpriv:*.*:ALL-name:set global log_bin_trust_function_creators 1community.mysql.mysql_variables:variable:log_bin_trust_function_creatorsvalue:1-name:import zabbix sql scriptansible.builtin.shell:zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz|mysql--default-character-setutf8mb4-uzabbix-pzabbix zabbixtouch /etc/zabbix/.init_db_sql.lockargs:creates:/etc/zabbix/.init_db_sql.lock-name:set global log_bin_trust_function_creators 0community.mysql.mysql_variables:variable:log_bin_trust_function_creatorsvalue:0-name:modify zabbix.confansible.builtin.lineinfile:path:/etc/zabbix/zabbix_server.confregexp:^DBPasswordinsertafter:^# DBPassword line:DBPasswordzabbix-name:enable service zabbix_serveransible.builtin.service:name:{{ item }}state:startedenabled:yesloop:-zabbix-server-zabbix-agent-httpd-php-fpm浏览网页zabbix-agent[devopsserver1 ansible]$vimzabbix_agent.yml内容如下----hosts:zabbix_agentbecome:yestasks:-name:add zabbix repoansible.builtin.yum:name:https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-latest-6.0.el9.noarch.rpmstate:presentdisable_gpg_check:yes-name:install zabbix-agentansible.builtin.yum:name:-zabbix-agentstate:presentdisablerepo:epel-name:modify zabbix.confansible.builtin.lineinfile:path:/etc/zabbix/zabbix_agentd.confregexp:{{ item.reg }}line:{{ item.val }}backrefs:yesloop:-{reg:^#?Server,val:Server192.168.234.162}-{reg:^#?ServerActive,val:ServerActive192.168.234.162}-{reg:^#?Hostname,val:Hostname{{ inventory_hostname }}}-name:enable zabbix_agentansible.builtin.service:name:zabbix-agentstate:startedenabled:yes网页添加主机ansible relos编写示例apache创建目录[devopsserver1 ansible]$mkdirroles初始化角色[devopsserver1 ansible]$cdroles/[devopsserver1 roles]$ ansible-galaxy role init apache进入apache目录[devopsserver1 roles]$lsapache[devopsserver1 roles]$cdapache/[devopsserver1 apache]$lsdefaults files handlers meta README.md tasks templates tests vars配置角色[devopsserver1 apache]$cdtasks/[devopsserver1 tasks]$vimmain.yml[devopsserver1 tasks]$cd..[devopsserver1 apache]$cdhandlers/[devopsserver1 handlers]$vimmain.yml[devopsserver1 handlers]$cd..[devopsserver1 apache]$cdtemplates/[devopsserver1 templates]$cp/home/devops/ansible/httpd.conf.j2 ./[devopsserver1 templates]$cd..[devopsserver1 apache]$cdvars/[devopsserver1 vars]$vimmain.yml配置apache_roles文件[devopsserver1 ansible]$vimapache_roles.yml运行[devopsserver1 ansible]$ ansible-playbook apache_roles.yml导入firewalld和selinux服务----hosts:node1become:yesvars:http_port:82roles:-apachepre_tasks:-name:Enable service firewalldansible.builtin.service:name:firewalldstate:startedenabled:yes-name:Permanently enable httpansible.posix.firewalld:service:httpstate:enabledpermanent:trueimmediate:true-name:Permanently enable https serviceansible.posix.firewalld:service:httpsstate:enabledpermanent:trueimmediate:true-name:add portansible.posix.firewalld:port:{{ http_port }}/tcpstate:enabledpermanent:trueimmediate:true-name:selinux playbookimport_playbook:selinux.yml-name:apache_url playbookimport_playbook:apache_url.yml其中selinux.yml----name:Manage SELinux policy examplehosts:node1become:yesvars:selinux_policy:targetedselinux_state:enforcingselinux_fcontexts:-target:/www(/.*)?setype:httpd_sys_content_tftype:dstate:presentselinux_restore_dirs:-/wwwselinux_ports:-ports:82proto:tcpsetype:http_port_tstate:presenttasks:-name:Creates directoryfile:path:/wwwstate:directorymode:0755-name:Execute the role and reboot in a rescue blockblock:-name:Include selinux roleinclude_role:name:rhel-system-roles.selinuxrescue:-name:-Fail if failed for a different reason than selinux_reboot_requiredfail:msg:role failedwhen:not selinux_reboot_required-name:Restart managed hostreboot:-name:Wait for managed host to come backwait_for_connection:delay:10timeout:300-name:Reapply the roleinclude_role:name:rhel-system-roles.selinuxapache_url.yml-hosts:localhostgather_facts:falsebecome:falsetasks:-name:Check that you can connect (GET) to a page and it returns a status 200ansible.builtin.uri:url:http://192.168.234.171:82return_content:trueregister:result-name:Print return information from the previous taskansible.builtin.debug:var:result.content运行示例nginx[devopsserver1 ansible]$ ansible-galaxy roleinstallgeerlingguy.nginx[devopsserver1 ansible]$cd/home/devops/ansible/roles[devopsserver1 roles]$vimnginx.yml测试[devopsserver1 ansible]$curlserver2示例redis[devopsserver1 ansible]$ ansible-galaxy roleinstallgeerlingguy.redis[devopsserver1 ansible]$vimnginx.yml运行[devopsserver1 ansible]$ ansible-playbook nginx.yml[rootserver2 ~]# redis-cligit上传脚本注册gitee账户设置界面找到ssh公钥[devopsserver1 ansible]$ cd [devopsserver1 ~]$ cd .ssh/ [devopsserver1 .ssh]$ ls authorized_keys id_rsa id_rsa.pub known_hosts known_hosts.old [devopsserver1 .ssh]$ cat id_rsa.pub devopsserver1 .ssh]$ cat id_rsa.pub ssh-rsa .............将完整公钥填入下图创建仓库上传数据[devopsserver1 ansible]$cdrole/apache/[devopsserver1 apache]$gitinit[devopsserver1 apache]$gitconfig--globaluser.name你的用户名[devopsserver1 apache]$gitconfig--globaluser.email绑定邮箱[devopsserver1 apache]$cd.git/[devopsserver1 .git]$lsconfig description HEAD hooks info objects refs[devopsserver1 .git]$cd..[devopsserver1 apache]$gitadd.[devopsserver1 apache]$gitcommit-mansible-role-apache[devopsserver1 apache]$gitremoteaddorigin https://gitee.com/ZJY-8957/ansible-role-apache.git[devopsserver1 apache]$gitpush-uoriginmaster此时刷新网页发现成功上传将仓库角色安装至角色目录[devopsserver1 ansible]$ ansible-galaxy role remove apache - successfully removed apache[devopsserver1 ansible]$vimrole/requirements.yml --- - src: gitgitee.com:zjy-8957/ansible-role-apache.git scm:gitversion: master name: apache[devopsserver1 ansible]$ ansible-galaxy roleinstall-rrole/requirements.yml-prole/[devopsserver1 ansible]$cdrole/[devopsserver1 role]$lsapache deploy_apache deploy_vhost remove_apache requirements.yml通过外部仓库的角色创建虚拟主机[devopsserver1 ansible]$vimapache_role.yml --- - name: selinux playbook import_playbook: selinux.yml - hosts:nodevars: http_port:82roles: - role: apache pre_tasks: - name:enablethe firewalld ansible.builtin.service: name: firewalld state: started enabled:yestasks: - name: Permanentlyenablehttp service, alsoenableit immediatelyifposs ible ansible.posix.firewalld: service: http state: enabled permanent:trueimmediate:true- name: Permanentlyenablehttpsserviceansible.posix.firewalld: service: https state: enabled permanent:trueimmediate:true- name:addhttp port ansible.posix.firewalld: port:{{ http_port }}/tcpstate: enabled permanent:trueimmediate:true- name:addseport redhat.rhel_system_roles.seport: ports:{{ http_port }}proto: tcp setype: http_port_t state: present post_tasks: - name:addvhost include_role: name: deploy_vhost - name: test_uri playbook import_playbook: test_uri.yml[devopsserver1 ansible]$ ansible-playbook apache_role.yml Ansible编写示例与Ansible roles编写示例
文章目录Ansible Playbook示例——httpd示例——返回httpd网页内容示例——keepalived示例——批量创建用户ansible-vault文件变量示例——zabbixzabbix—serverzabbix-agentansible relos编写示例apache示例nginx示例redisgit上传脚本将仓库角色安装至角色目录通过外部仓库的角色创建虚拟主机Ansible Playbook示例——httpd--- - hosts: web become:yestasks: - name: Install the Apache ansible.builtin.yum: name: httpd state: present - name: Startservicehttpd,ifnot started ansible.builtin.service: name: httpd state: started enable:yes- name: creat index.html ansible.builtin.copy: content:www.westos.org\ndest: /var/www/html/index.html测试运行[devopsserver1 ansible]$ ansible-playbook apache.yml[devopsserver1 ~]$curlserver2示例——返回httpd网页内容--- - hosts: lamp become: yes tasks: - name: Install the Apache ansible.builtin.yum: name: httpd state: present - name: Start service httpd, if not started ansible.builtin.service: name: httpd state: started enabled: yes - name: creat index.html ansible.builtin.copy: content: {{ ansible_hostname }}\n dest: /var/www/html/index.html - name: Ensure the default Apaceh port is 80 ansible.builtin.lineinfile: path: /etc/httpd/conf/httpd.conf regexp: ^Listen insertafter: ^#Listen line: Listen 80 notify: restart service httpd handlers: - name: restart service httpd ansible.builtin.service: name: httpd state: restarted - hosts: localhost gather_facts: false become: false tasks: - name: Check that you can connect (GET) to a page and it returns a status 200 ansible.builtin.uri: url: http://192.168.234.162 return_content: true register: result - name: Print return information from the previous task ansible.builtin.debug: var: result示例——keepalived[devopsserver1 root]$cd/home/devops/ansible/[devopsserver1 ansible]$sudovim/etc/ansible/hosts[hacluster]192.168.234.161 stateMASTER pri100192.168.234.162 stateBACKUP pri80[hacluster:vars]interfaceeth0router_id61vip192.168.234.200[devopsserver1 ansible]$vimkeepalived.yml --- - hosts: hacluster#become: yestasks: - name: Install the keepalived ansible.builtin.yum: name: keepalived state: present - name: configure the keepalived ansible.builtin.template: src: keepalived.conf.j2 dest: /etc/keepalived/keepalived.conf notify: restartservicekeepalived - name: Startservicekepalived ansible.builtin.service: name: keepalived state: started enabled:yeshandlers: - name: restartservicekeepalived ansible.builtin.service: name: keepalived state: restarted[devopsserver1 ansible]$ yuminstall-ykeepalived.x86_64[devopsserver1 ansible]$cd[devopsserver1 ~]$cd/etc/keepalived/[devopsserver1 keepalived]$lskeepalived.conf[devopsserver1 keepalived]$cpkeepalived.conf /home/devops/ansible/[devopsserver1 keepalived]$cd/home/devops/ansible/[devopsserver1 ansible]$lsapache.yml keepalived.conf keepalived.yml[devopsserver1 ansible]$mvkeepalived.conf keepalived.conf.j2[devopsserver1 ansible]$vimkeepalived.conf.j2[devopsserver1 ansible]$sudoansible-playbook keepalived.yml! Configuration File for keepalivedglobal_defs {router_id LVS_DEVELvrrp_skip_check_adv_addrvrrp_garp_interval 0vrrp_gna_interval 0}vrrp_instance VI_1 {state {{ state }}interface {{ interface }}virtual_router_id {{ router_id }}priority {{ pri }}advert_int 1authentication {auth_type PASSauth_pass 1111}virtual_ipaddress {{{ vip }}}}运行[devopsserver1 ansible]$ ansible-playbook keepalived.yml测试[devopsserver1 ansible]$ipa示例——批量创建用户[devopsserver1 ansible]$vimuser.yml --- - hosts: db tasks: - name: Add the user ansible.builtin.user: name:{{ item.user }}password:{{ item.pass | password_hash(sha512) }}state: present loop: -{user: user1, pass: pass1}-{user: user2, pass: pass2}运行[devopsserver1 ansible]$ ansible-playbook user.yml[rootnode1 ~]# cat /etc/shadow示例——结合haproxy[devopsserver1 ansible]$ vim hosts[devopsserver1 ansible]$ vim haproxy.yml --- - hosts: haproxy,webservers become: yes tasks: - name: deploy haproxy block: - name: Install the haproxy ansible.builtin.yum: name: haproxy state: present - name: configure the haproxy ansible.builtin.template: src: haproxy.cfg.j2 dest: /etc/haproxy/haproxy.cfg notify: restart service haproxy - name: Start service haproxy ansible.builtin.service: name: haproxy state: started enabled: yes when: ansible_hostname server1 - name: deploy apache block: - name: Install the Apache ansible.builtin.yum: name: httpd state: present - name: Start service httpd ansible.builtin.service: name: httpd state: started enabled: yes - name: creat index.html ansible.builtin.copy: content: {{ ansible_hostname }}\n dest: /var/www/html/index.html - name: Ensure the default Apaceh port is {{ http_port }} ansible.builtin.template: src: httpd.conf.j2 dest: /etc/httpd/conf/httpd.conf notify: restart service httpd when: ansible_hostname in groups[webservers] handlers: - name: restart service haproxy ansible.builtin.service: name: haproxy state: restarted - name: restart service httpd ansible.builtin.service: name: httpd state: restarted运行测试[devopsserver1 ansible]$ ansible-playbook haproxy.ymlansible-vault常用参数create Create new vault encryptedfiledecrypt Decrypt vault encryptedfileedit Edit vault encryptedfileview View vault encryptedfileencrypt Encrypt YAMLfileencrypt_string Encrypt a string rekey Re-key a vault encryptedfile示例加密文件[devopsserver1 ansible]$ ansible-vault encrypt userlist.yml New Vault password: Confirm New Vault password: Encryption successful[devopsserver1 ansible]$catuserlist.yml示例解密文件[devopsserver1 ansible]$ ansible-vault decrypt userlist.yml Vault password: Decryption successful[devopsserver1 ansible]$catuserlist.yml文件变量示例[devopsserver1 ansible]$ vim user.yml[devopsserver1 ansible]$ vim userlist.yml[devopsserver1 ansible]$ sudo ansible-playbook user.yml管理方式示例——zabbixzabbix—server[devopsserver1 ansible]$vimzabbix.yml内容如下----hosts:zabbix_serverbecome:yestasks:-name:add zabbix repoansible.builtin.yum:name:https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-latest-6.0.el9.noarch.rpmstate:presentdisable_gpg_check:yes-name:install zabbix-serveransible.builtin.yum:name:-zabbix-server-mysql-zabbix-web-mysql-zabbix-apache-conf-zabbix-sql-scripts-zabbix-selinux-policy-zabbix-agentstate:presentdisablerepo:epel-name:install mysql-serveransible.builtin.yum:name:-mysql-server-python3-PyMySQLstate:present-name:enable mysql-serveransible.builtin.service:name:mysqldstate:startedenabled:yes-name:init mysql databasecommunity.mysql.mysql_db:name:zabbixstate:presentencoding:utf8mb4collation:utf8mb4_binlogin_user:root-name:create zabbix usercommunity.mysql.mysql_user:name:zabbixhost:localhoststate:presentpassword:zabbixpriv:*.*:ALL-name:set global log_bin_trust_function_creators 1community.mysql.mysql_variables:variable:log_bin_trust_function_creatorsvalue:1-name:import zabbix sql scriptansible.builtin.shell:zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz|mysql--default-character-setutf8mb4-uzabbix-pzabbix zabbixtouch /etc/zabbix/.init_db_sql.lockargs:creates:/etc/zabbix/.init_db_sql.lock-name:set global log_bin_trust_function_creators 0community.mysql.mysql_variables:variable:log_bin_trust_function_creatorsvalue:0-name:modify zabbix.confansible.builtin.lineinfile:path:/etc/zabbix/zabbix_server.confregexp:^DBPasswordinsertafter:^# DBPassword line:DBPasswordzabbix-name:enable service zabbix_serveransible.builtin.service:name:{{ item }}state:startedenabled:yesloop:-zabbix-server-zabbix-agent-httpd-php-fpm浏览网页zabbix-agent[devopsserver1 ansible]$vimzabbix_agent.yml内容如下----hosts:zabbix_agentbecome:yestasks:-name:add zabbix repoansible.builtin.yum:name:https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-latest-6.0.el9.noarch.rpmstate:presentdisable_gpg_check:yes-name:install zabbix-agentansible.builtin.yum:name:-zabbix-agentstate:presentdisablerepo:epel-name:modify zabbix.confansible.builtin.lineinfile:path:/etc/zabbix/zabbix_agentd.confregexp:{{ item.reg }}line:{{ item.val }}backrefs:yesloop:-{reg:^#?Server,val:Server192.168.234.162}-{reg:^#?ServerActive,val:ServerActive192.168.234.162}-{reg:^#?Hostname,val:Hostname{{ inventory_hostname }}}-name:enable zabbix_agentansible.builtin.service:name:zabbix-agentstate:startedenabled:yes网页添加主机ansible relos编写示例apache创建目录[devopsserver1 ansible]$mkdirroles初始化角色[devopsserver1 ansible]$cdroles/[devopsserver1 roles]$ ansible-galaxy role init apache进入apache目录[devopsserver1 roles]$lsapache[devopsserver1 roles]$cdapache/[devopsserver1 apache]$lsdefaults files handlers meta README.md tasks templates tests vars配置角色[devopsserver1 apache]$cdtasks/[devopsserver1 tasks]$vimmain.yml[devopsserver1 tasks]$cd..[devopsserver1 apache]$cdhandlers/[devopsserver1 handlers]$vimmain.yml[devopsserver1 handlers]$cd..[devopsserver1 apache]$cdtemplates/[devopsserver1 templates]$cp/home/devops/ansible/httpd.conf.j2 ./[devopsserver1 templates]$cd..[devopsserver1 apache]$cdvars/[devopsserver1 vars]$vimmain.yml配置apache_roles文件[devopsserver1 ansible]$vimapache_roles.yml运行[devopsserver1 ansible]$ ansible-playbook apache_roles.yml导入firewalld和selinux服务----hosts:node1become:yesvars:http_port:82roles:-apachepre_tasks:-name:Enable service firewalldansible.builtin.service:name:firewalldstate:startedenabled:yes-name:Permanently enable httpansible.posix.firewalld:service:httpstate:enabledpermanent:trueimmediate:true-name:Permanently enable https serviceansible.posix.firewalld:service:httpsstate:enabledpermanent:trueimmediate:true-name:add portansible.posix.firewalld:port:{{ http_port }}/tcpstate:enabledpermanent:trueimmediate:true-name:selinux playbookimport_playbook:selinux.yml-name:apache_url playbookimport_playbook:apache_url.yml其中selinux.yml----name:Manage SELinux policy examplehosts:node1become:yesvars:selinux_policy:targetedselinux_state:enforcingselinux_fcontexts:-target:/www(/.*)?setype:httpd_sys_content_tftype:dstate:presentselinux_restore_dirs:-/wwwselinux_ports:-ports:82proto:tcpsetype:http_port_tstate:presenttasks:-name:Creates directoryfile:path:/wwwstate:directorymode:0755-name:Execute the role and reboot in a rescue blockblock:-name:Include selinux roleinclude_role:name:rhel-system-roles.selinuxrescue:-name:-Fail if failed for a different reason than selinux_reboot_requiredfail:msg:role failedwhen:not selinux_reboot_required-name:Restart managed hostreboot:-name:Wait for managed host to come backwait_for_connection:delay:10timeout:300-name:Reapply the roleinclude_role:name:rhel-system-roles.selinuxapache_url.yml-hosts:localhostgather_facts:falsebecome:falsetasks:-name:Check that you can connect (GET) to a page and it returns a status 200ansible.builtin.uri:url:http://192.168.234.171:82return_content:trueregister:result-name:Print return information from the previous taskansible.builtin.debug:var:result.content运行示例nginx[devopsserver1 ansible]$ ansible-galaxy roleinstallgeerlingguy.nginx[devopsserver1 ansible]$cd/home/devops/ansible/roles[devopsserver1 roles]$vimnginx.yml测试[devopsserver1 ansible]$curlserver2示例redis[devopsserver1 ansible]$ ansible-galaxy roleinstallgeerlingguy.redis[devopsserver1 ansible]$vimnginx.yml运行[devopsserver1 ansible]$ ansible-playbook nginx.yml[rootserver2 ~]# redis-cligit上传脚本注册gitee账户设置界面找到ssh公钥[devopsserver1 ansible]$ cd [devopsserver1 ~]$ cd .ssh/ [devopsserver1 .ssh]$ ls authorized_keys id_rsa id_rsa.pub known_hosts known_hosts.old [devopsserver1 .ssh]$ cat id_rsa.pub devopsserver1 .ssh]$ cat id_rsa.pub ssh-rsa .............将完整公钥填入下图创建仓库上传数据[devopsserver1 ansible]$cdrole/apache/[devopsserver1 apache]$gitinit[devopsserver1 apache]$gitconfig--globaluser.name你的用户名[devopsserver1 apache]$gitconfig--globaluser.email绑定邮箱[devopsserver1 apache]$cd.git/[devopsserver1 .git]$lsconfig description HEAD hooks info objects refs[devopsserver1 .git]$cd..[devopsserver1 apache]$gitadd.[devopsserver1 apache]$gitcommit-mansible-role-apache[devopsserver1 apache]$gitremoteaddorigin https://gitee.com/ZJY-8957/ansible-role-apache.git[devopsserver1 apache]$gitpush-uoriginmaster此时刷新网页发现成功上传将仓库角色安装至角色目录[devopsserver1 ansible]$ ansible-galaxy role remove apache - successfully removed apache[devopsserver1 ansible]$vimrole/requirements.yml --- - src: gitgitee.com:zjy-8957/ansible-role-apache.git scm:gitversion: master name: apache[devopsserver1 ansible]$ ansible-galaxy roleinstall-rrole/requirements.yml-prole/[devopsserver1 ansible]$cdrole/[devopsserver1 role]$lsapache deploy_apache deploy_vhost remove_apache requirements.yml通过外部仓库的角色创建虚拟主机[devopsserver1 ansible]$vimapache_role.yml --- - name: selinux playbook import_playbook: selinux.yml - hosts:nodevars: http_port:82roles: - role: apache pre_tasks: - name:enablethe firewalld ansible.builtin.service: name: firewalld state: started enabled:yestasks: - name: Permanentlyenablehttp service, alsoenableit immediatelyifposs ible ansible.posix.firewalld: service: http state: enabled permanent:trueimmediate:true- name: Permanentlyenablehttpsserviceansible.posix.firewalld: service: https state: enabled permanent:trueimmediate:true- name:addhttp port ansible.posix.firewalld: port:{{ http_port }}/tcpstate: enabled permanent:trueimmediate:true- name:addseport redhat.rhel_system_roles.seport: ports:{{ http_port }}proto: tcp setype: http_port_t state: present post_tasks: - name:addvhost include_role: name: deploy_vhost - name: test_uri playbook import_playbook: test_uri.yml[devopsserver1 ansible]$ ansible-playbook apache_role.yml