ansible部署LAMP架构

简介

ansible是新出现的自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。
ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
(1)、连接插件connection plugins：负责和被监控端实现通信；
(2)、host inventory：指定操作的主机，是一个配置文件里面定义监控的主机；
(3)、各种模块核心模块、command模块、自定义模块；
(4)、借助于插件完成记录日志邮件等功能；
(5)、playbook：剧本执行多个任务时，非必需可以让节点一次性运行多个任务

Ansible的特点有：
1、不需要在部署机器上安装客户端
2、没有服务端，使用时直接执行命令即可
3、基于模块工作，可以使用任意语言对模块进行开发
4、使用yaml语言来定制编排剧本
5、可实现多级指挥
6、支持sudo
7、支持邮件、日志等多种功能

准备四台主机

配置IP地址和hostname，关闭防火墙和selinux，服务器时间同步
修改/etc/hosts配置文件进行hostname和IP地址映射

hostname	ip
httpd	192.168.153.130
php	192.168.153.131
mysql	192.168.153.132
ansible	192.168.153.129

添加域名解析

[root@ansible ~]# cat /etc/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.153.130 httpd
192.168.153.131 php
192.168.153.132 mysql

配合SSH免密登陆

[root@ansible ~]# ssh-keygen -t rsa  #生成密钥，指定加密方式 ，下面默认一路回车即可
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:m9UgEbkFLID4MnlRrsmn76K0ARRhb6NEScTM1etAfEM root@ansible
The key's randomart image is:
+---[RSA 3072]----+
|*O=+=E .++       |
|+==+ +. o..      |
| =.=o o..o.      |
|*.=+..  .. o     |
|.=+ +   S . .    |
|.  o .   +       |
| o.     o        |
|. +.             |
|.o oo            |
+----[SHA256]-----+

[root@ansible ~]# ssh-copy-id root@httpd   #传递公钥
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host 'httpd (192.168.153.130)' can't be established.
ECDSA key fingerprint is SHA256:+wH81RHiBmLpbkuk2OWGZxVRziiaNwJ9KAVjGtEM8zs.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@httpd's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@httpd'"
and check to make sure that only the key(s) you wanted were added.

注意：php主机和mysql主机的传递公钥过程一样，因为太长在这里省略

安装ansible

[root@ansible ~]#yum install epel-release #安装epel源
[root@ansible ~]#yum makecache
[root@ansible ~]#yum install ansible
[root@ansible ~]#systemctl start ansible
[root@ansible ~]#systemctl enable ansible

配置ansible

配置主机组信息

[root@ansible ]# vi /opt/inventory
[webserver]
httpd
php
mysql

创建项目文件夹

[root@ansible ~]# tree /opt/
/opt/
├── ansible.cfg  #ansible配置文件，将inventory  改为当前目录下的inventory
├── inventory  #存放主机的清单文件
└── playbook  
    ├── firewalld     
    │   └── firewalld.yaml  #关闭防火墙
    ├── httpd
    │   └── install
    │       ├── httpd.conf  #已修改好的配置文件，用于替换安装的配置文件，文章最下面有修改方式
    │       └── httpd-install.yaml #安装httpd服务，并重启
    ├── mariadb
    │   └── mariadb.yaml  #安装mariadb服务，并重启
    ├── php
    │   ├── index
    │   │   └── index.yaml  #创建index.php文件
    │   └── install
    │       ├── php-fpm-install.yaml #安装php服务，并重启
    │       └── www.conf  #已修改好的配置文件，用于替换安装的配置文件，文章最下面有修改方式
    ├── repo
    │   └── repo.yaml  #下载网络源
    └── site
        └── site.yaml  #一键部署lamp架构

编写关闭防火墙firewalld.yaml文件

[root@ansible ~]# vim /opt/playbook/firewalld/firewalld.yaml 
---
  - name: firewalld
    hosts: webserver
    tasks:

      - name: stop firewalld
        service:
          name: firewalld
          state: stopped
          enabled: no

      - name: stop selinux
        lineinfile:
          path: /etc/selinux/config
          regexp: "^SELINUX=enforcing"
          line: SELINUX=disabled

      - name: setenforce 0
        shell: "setenforce 0"
        failed_when: false

编写下载网络源repo.yaml文件

[root@ansible ~]# vim /opt/playbook/repo/repo.yaml
---
  - name: wget yum
    hosts: webserver
    tasks:

      - name:  test
        get_url:
          url: https://mirrors.aliyun.com/repo/Centos-8.repo
          dest: /etc/yum.repos.d/CentOS-Base.repo

编写安装httpd服务httpd-install.yaml文件

[root@ansible ~]# vi /opt/playbook/httpd/install/httpd-install.yaml
---
  - name: httpd-install
    hosts: httpd
    tasks:
      - name: install httpd service
        yum:
           name: httpd*
           state: present

      - name: copy httpd.conf
        copy:
          src: httpd.conf
          dest: /etc/httpd/conf/httpd.conf

      - name: start httpd
        service:
          name: httpd
          state: started
          enabled: yes

编写安装php服务php-fpm-install.yaml文件

[root@ansible ~]# vi /opt/playbook/php/install/php-fpm-install.yaml
---
  - name: php-install
    hosts: php
    tasks:
      - name: install php-fpm service
        yum:
          name: php*
          state: present

      - name: copy www.conf
        copy:
          src: www.conf
          dest: /etc/php-fpm.d/www.conf

      - name: start php-fpm service
        service:
          name: php-fpm
          state: started
          enabled: yes

编写创建index.php文件index.yaml文件

[root@ansible ~]# vi /opt/playbook/php/index/index.yaml
---
  - name: index
    hosts: php
    tasks:
      - name: Create directory /web/www/html
        file:
          path: /web/www/html
          state: directory
          mode: 0775

      - name:  Create a file if it does not exist
        file:
          path: /web/www/html/index.php
          state: touch
          mode: 0775

      - name: index.php
        lineinfile:
          path: /web/www/html/index.php
          line: |
            <?php
              phpinfo();
            ?>

编写安装数据库服务mariadb.yaml文件

[root@ansible ~]# vi /opt/playbook/mariadb/mariadb.yaml 
---
  - name: install mariadb service
    hosts: mysql
    tasks:
      - name: install mariadb
        yum:
         name: mariadb*
         state: present

      - name: start mariadb
        service:
          name: mariadb
          state: started
          enabled: yes

编写一键部署文件site.yaml文件

[root@ansible ~]# vi /opt/playbook/site/site.yaml 
---
  - name: stop firewalld
    import_playbook: /opt/playbook/firewalld/firewalld.yaml
  - name: wget
    import_playbook: /opt/playbook/repo/repo.yaml
  - name: Install httpd service
    import_playbook: /opt/playbook/httpd/install/httpd-install.yaml
  - name: Install php-fpm service
    import_playbook: /opt/playbook/php/install/php-fpm-install.yaml
  - name: touch index.php
    import_playbook: /opt/playbook/php/index/index.yaml
  - name: Install mariadb service
    import_playbook: /opt/playbook/mariadb/mariadb.yaml

执行playbook文件

[root@ansible opt]# ansible-playbook playbook/site/site.yaml  #只能在/opt目录下才能执行此命令

在浏览器用HTTP主机IP访问

修改httpd服务默认配置文件httpd.conf文件

在默认配置文件最后加入下面的参数
[root@ansible ]# vi /opt/playbook/httpd/install/httpd.conf
<VirtualHost *:80>
DocumentRoot "/web/www/html"  #php主机上的网站站点目录，用于后面存放index.php文件
ServerName www.chenshunli.com  #域名 可自行更改
 ProxyRequests Off
 ProxyPassMatch ^/(.*\.php)$ fcgi://192.168.153.131:9000/web/www/html/$1  #此行IP地址为php主机的IP地址
<Directory "/web/www/html">
Options none
AllowOverride none
Require all granted
</Directory>
</VirtualHost>

注意：以上是在配置文件最后加入的内容，以下只有带有注释 ~~添加~~  的两行需要添加 


搜索AddType，添加以下内容
    # If the AddEncoding directives above are commented-out, then you
    # probably should define those extensions to indicate media types:
    #
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType application/x-httpd-php .php        #添加此行
    AddType application/x-httpd-php-source .phps        #添加此行

修改php服务的默认配置文件www.conf文件

编辑配置文件，过滤下面两行内容并修改，保存退出即可
[root@ansible opt]# vi /opt/playbook/php/install/www.conf

listen = 192.168.153.131:9000  #此处IP地址改为php主机本机的IP地址

listen.allowed_clients = 192.168.153.130 #此处改为httpd主机的IP地址