rework all
This commit is contained in:
parent
cc7cb56aa3
commit
8ba4e824fc
12
ansible/Jenkinsfile
vendored
12
ansible/Jenkinsfile
vendored
@ -5,6 +5,10 @@ pipeline {
|
|||||||
VAULT_PASSWORD = credentials('vault_password')
|
VAULT_PASSWORD = credentials('vault_password')
|
||||||
}
|
}
|
||||||
|
|
||||||
|
environment {
|
||||||
|
ANSIBLE_HOST_KEY_CHECKING = 'false'
|
||||||
|
}
|
||||||
|
|
||||||
parameters {
|
parameters {
|
||||||
choice(name: 'SITE_OPTION', choices: ['SiteA', 'SiteB', 'SiteA&B'], description: 'Select which site to deploy')
|
choice(name: 'SITE_OPTION', choices: ['SiteA', 'SiteB', 'SiteA&B'], description: 'Select which site to deploy')
|
||||||
string(name: 'ADDITIONAL_CONTENT', defaultValue: 'Новое сообщение', description: 'Additional content to be included in the site')
|
string(name: 'ADDITIONAL_CONTENT', defaultValue: 'Новое сообщение', description: 'Additional content to be included in the site')
|
||||||
@ -38,19 +42,17 @@ pipeline {
|
|||||||
def sanitized_content = params.ADDITIONAL_CONTENT.replaceAll("'", "\\'").replaceAll('"', '\\"')
|
def sanitized_content = params.ADDITIONAL_CONTENT.replaceAll("'", "\\'").replaceAll('"', '\\"')
|
||||||
|
|
||||||
def siteOption = params.SITE_OPTION
|
def siteOption = params.SITE_OPTION
|
||||||
def hostsFile = env.HOSTS_FILE
|
|
||||||
|
|
||||||
def targetGroups = ''
|
def targetGroups = ''
|
||||||
if (siteOption == 'SiteA') {
|
if (siteOption == 'SiteA') {
|
||||||
targetGroups = 'SiteA'
|
targetGroups = 'SiteA,proxy'
|
||||||
} else if (siteOption == 'SiteB') {
|
} else if (siteOption == 'SiteB') {
|
||||||
targetGroups = 'SiteB'
|
targetGroups = 'SiteB,proxy'
|
||||||
} else if (siteOption == 'SiteA&B') {
|
} else if (siteOption == 'SiteA&B') {
|
||||||
targetGroups = 'SiteA,SiteB,proxy'
|
targetGroups = 'SiteA,SiteB,proxy'
|
||||||
}
|
}
|
||||||
|
|
||||||
ansiblePlaybook(
|
ansiblePlaybook(
|
||||||
playbook: 'ansible/playbook.yml',
|
playbook: 'ansible/playbooks/playbook.yml',
|
||||||
inventory: "ansible/inventory.yml",
|
inventory: "ansible/inventory.yml",
|
||||||
extraVars: [
|
extraVars: [
|
||||||
additional_content: sanitized_content,
|
additional_content: sanitized_content,
|
||||||
|
|||||||
4
ansible/ansible.cfg
Normal file
4
ansible/ansible.cfg
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
[defaults]
|
||||||
|
inventory = inventory.yml
|
||||||
|
roles_path = ./roles
|
||||||
|
host_key_checking = False
|
||||||
@ -1,240 +0,0 @@
|
|||||||
- hosts: SiteA
|
|
||||||
become: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Install Nginx
|
|
||||||
zypper:
|
|
||||||
name: nginx
|
|
||||||
state: present
|
|
||||||
force: yes
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Create site directories
|
|
||||||
file:
|
|
||||||
path: /var/www/SiteA
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: Deploy site content
|
|
||||||
copy:
|
|
||||||
content: |
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<meta charset="UTF-8">
|
|
||||||
<title>SiteA</title>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<h1>SiteA</h1>
|
|
||||||
<p>{{ additional_content | string }}</p>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
dest: /var/www/SiteA/index.html
|
|
||||||
|
|
||||||
- name: Configure Nginx for SiteA
|
|
||||||
copy:
|
|
||||||
content: |
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name SiteA;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
root /var/www/SiteA;
|
|
||||||
index index.html;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
dest: /etc/nginx/conf.d/SiteA.conf
|
|
||||||
|
|
||||||
- name: Restart Nginx
|
|
||||||
service:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
|
|
||||||
- name: Start and enable firewalld
|
|
||||||
service:
|
|
||||||
name: firewalld
|
|
||||||
state: started
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
- name: Open port 80 for HTTP
|
|
||||||
ansible.builtin.firewalld:
|
|
||||||
port: 80/tcp
|
|
||||||
permanent: true
|
|
||||||
state: enabled
|
|
||||||
immediate: yes
|
|
||||||
|
|
||||||
- name: Open port 443 for HTTPS
|
|
||||||
ansible.builtin.firewalld:
|
|
||||||
port: 443/tcp
|
|
||||||
permanent: true
|
|
||||||
state: enabled
|
|
||||||
immediate: yes
|
|
||||||
|
|
||||||
- name: Reload firewalld to apply changes
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: firewalld
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- hosts: SiteB
|
|
||||||
become: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Install Nginx
|
|
||||||
zypper:
|
|
||||||
name: nginx
|
|
||||||
state: present
|
|
||||||
force: yes
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Create site directories
|
|
||||||
file:
|
|
||||||
path: /var/www/SiteB
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: Deploy site content
|
|
||||||
copy:
|
|
||||||
content: |
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<meta charset="UTF-8">
|
|
||||||
<title>SiteB</title>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<h1>SiteB</h1>
|
|
||||||
<p>{{ additional_content | string }}</p>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
dest: /var/www/SiteB/index.html
|
|
||||||
|
|
||||||
- name: Configure Nginx for SiteB
|
|
||||||
copy:
|
|
||||||
content: |
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name SiteB;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
root /var/www/SiteB;
|
|
||||||
index index.html;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
dest: /etc/nginx/conf.d/SiteB.conf
|
|
||||||
|
|
||||||
- name: Restart Nginx
|
|
||||||
service:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
|
|
||||||
- name: Start and enable firewalld
|
|
||||||
service:
|
|
||||||
name: firewalld
|
|
||||||
state: started
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
- name: Open port 80 for HTTP
|
|
||||||
ansible.builtin.firewalld:
|
|
||||||
port: 80/tcp
|
|
||||||
permanent: true
|
|
||||||
state: enabled
|
|
||||||
immediate: yes
|
|
||||||
|
|
||||||
- name: Open port 443 for HTTPS
|
|
||||||
ansible.builtin.firewalld:
|
|
||||||
port: 443/tcp
|
|
||||||
permanent: true
|
|
||||||
state: enabled
|
|
||||||
immediate: yes
|
|
||||||
|
|
||||||
- name: Reload firewalld to apply changes
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: firewalld
|
|
||||||
state: reloaded
|
|
||||||
|
|
||||||
- hosts: proxy
|
|
||||||
become: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Install Nginx
|
|
||||||
zypper:
|
|
||||||
name: nginx
|
|
||||||
state: present
|
|
||||||
force: yes
|
|
||||||
update_cache: yes
|
|
||||||
|
|
||||||
- name: Ensure SSL directory exists
|
|
||||||
file:
|
|
||||||
path: /etc/nginx/ssl
|
|
||||||
state: directory
|
|
||||||
mode: '0700'
|
|
||||||
|
|
||||||
- name: Generate private key
|
|
||||||
openssl_privatekey:
|
|
||||||
path: /etc/nginx/ssl/vlad4.key
|
|
||||||
size: 2048
|
|
||||||
type: RSA
|
|
||||||
mode: '0600'
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
|
|
||||||
- name: Generate self-signed SSL certificate
|
|
||||||
openssl_certificate:
|
|
||||||
path: /etc/nginx/ssl/vlad4.crt
|
|
||||||
privatekey_path: /etc/nginx/ssl/vlad4.key
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0600'
|
|
||||||
provider: selfsigned
|
|
||||||
|
|
||||||
- name: Configure Nginx as HTTPS proxy
|
|
||||||
copy:
|
|
||||||
content: |
|
|
||||||
upstream backend_servers {
|
|
||||||
server 192.168.0.61:80;
|
|
||||||
server 192.168.0.62:80;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name vlad4;
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 443 ssl;
|
|
||||||
server_name vlad4;
|
|
||||||
|
|
||||||
ssl_certificate /etc/nginx/ssl/vlad4.crt;
|
|
||||||
ssl_certificate_key /etc/nginx/ssl/vlad4.key;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
proxy_pass http://backend_servers;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
dest: /etc/nginx/conf.d/proxy.conf
|
|
||||||
|
|
||||||
- name: Restart Nginx
|
|
||||||
service:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
|
|
||||||
- name: Start and enable firewalld
|
|
||||||
service:
|
|
||||||
name: firewalld
|
|
||||||
state: started
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
- name: Open port 443 for HTTPS
|
|
||||||
ansible.builtin.firewalld:
|
|
||||||
port: 443/tcp
|
|
||||||
permanent: true
|
|
||||||
state: enabled
|
|
||||||
immediate: yes
|
|
||||||
|
|
||||||
- name: Reload firewalld to apply changes
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: firewalld
|
|
||||||
state: reloaded
|
|
||||||
5
ansible/playbooks/playbook.yml
Normal file
5
ansible/playbooks/playbook.yml
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
- hosts: all
|
||||||
|
become: true
|
||||||
|
roles:
|
||||||
|
- role: site_setup
|
||||||
25
ansible/roles/site_setup/tasks/configure.yml
Normal file
25
ansible/roles/site_setup/tasks/configure.yml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
- name: Create site directories
|
||||||
|
file:
|
||||||
|
path: "/var/www/html/{{ site_name }}"
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
tags: configure
|
||||||
|
|
||||||
|
- name: Deploy site content
|
||||||
|
template:
|
||||||
|
src: site_index.html.j2
|
||||||
|
dest: "/var/www/html/{{ site_name }}/index.html"
|
||||||
|
tags: configure
|
||||||
|
|
||||||
|
- name: Configure Nginx for {{ site_name }}
|
||||||
|
template:
|
||||||
|
src: nginx_site.conf.j2
|
||||||
|
dest: "/etc/nginx/conf.d/{{ site_name }}.conf"
|
||||||
|
tags: configure
|
||||||
|
|
||||||
|
- name: Restart Nginx
|
||||||
|
service:
|
||||||
|
name: nginx
|
||||||
|
state: restarted
|
||||||
|
tags: configure
|
||||||
29
ansible/roles/site_setup/tasks/firewall.yml
Normal file
29
ansible/roles/site_setup/tasks/firewall.yml
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
---
|
||||||
|
- name: Start and enable firewalld
|
||||||
|
service:
|
||||||
|
name: firewalld
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
tags: firewall
|
||||||
|
|
||||||
|
- name: Open port 80 for HTTP
|
||||||
|
ansible.builtin.firewalld:
|
||||||
|
port: 80/tcp
|
||||||
|
permanent: true
|
||||||
|
state: enabled
|
||||||
|
immediate: yes
|
||||||
|
tags: firewall
|
||||||
|
|
||||||
|
- name: Open port 443 for HTTPS
|
||||||
|
ansible.builtin.firewalld:
|
||||||
|
port: 443/tcp
|
||||||
|
permanent: true
|
||||||
|
state: enabled
|
||||||
|
immediate: yes
|
||||||
|
tags: firewall
|
||||||
|
|
||||||
|
- name: Reload firewalld to apply changes
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: firewalld
|
||||||
|
state: reloaded
|
||||||
|
tags: firewall
|
||||||
24
ansible/roles/site_setup/tasks/generate_ssl.yml
Normal file
24
ansible/roles/site_setup/tasks/generate_ssl.yml
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
---
|
||||||
|
- name: Ensure SSL directory exists
|
||||||
|
file:
|
||||||
|
path: /etc/nginx/ssl
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
tags: ssl
|
||||||
|
|
||||||
|
- name: Generate self-signed SSL certificate
|
||||||
|
openssl_certificate:
|
||||||
|
path: /etc/nginx/ssl/{{ proxy_name }}.crt
|
||||||
|
privatekey_path: /etc/nginx/ssl/{{ proxy_name }}.key
|
||||||
|
common_name: "{{ proxy_name }}"
|
||||||
|
state: present
|
||||||
|
selfsigned: yes
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0644'
|
||||||
|
subject:
|
||||||
|
- organizationName: "Example Company"
|
||||||
|
- organizationalUnitName: "IT"
|
||||||
|
- localityName: "City"
|
||||||
|
- countryName: "US"
|
||||||
|
tags: ssl
|
||||||
8
ansible/roles/site_setup/tasks/install.yml
Normal file
8
ansible/roles/site_setup/tasks/install.yml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
- name: Install Nginx
|
||||||
|
zypper:
|
||||||
|
name: nginx
|
||||||
|
state: present
|
||||||
|
force: yes
|
||||||
|
update_cache: yes
|
||||||
|
tags: install
|
||||||
12
ansible/roles/site_setup/tasks/main.yml
Normal file
12
ansible/roles/site_setup/tasks/main.yml
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
- import_tasks: install.yml
|
||||||
|
tags: install
|
||||||
|
|
||||||
|
- import_tasks: configure.yml
|
||||||
|
tags: configure
|
||||||
|
|
||||||
|
- import_tasks: proxy.yml
|
||||||
|
tags: proxy
|
||||||
|
|
||||||
|
- import_tasks: firewall.yml
|
||||||
|
tags: firewall
|
||||||
26
ansible/roles/site_setup/tasks/proxy.yml
Normal file
26
ansible/roles/site_setup/tasks/proxy.yml
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
---
|
||||||
|
- name: Configure Nginx load balancer with SSL
|
||||||
|
template:
|
||||||
|
src: nginx_proxy_ssl.conf.j2
|
||||||
|
dest: "/etc/nginx/conf.d/proxy.conf"
|
||||||
|
tags: proxy
|
||||||
|
|
||||||
|
- name: Ensure SSL directory exists
|
||||||
|
file:
|
||||||
|
path: /etc/nginx/ssl
|
||||||
|
state: directory
|
||||||
|
mode: '0755'
|
||||||
|
tags: proxy
|
||||||
|
|
||||||
|
- name: Copy Diffie-Hellman parameters
|
||||||
|
copy:
|
||||||
|
src: dhparam.pem
|
||||||
|
dest: /etc/nginx/ssl/dhparam.pem
|
||||||
|
mode: '0600'
|
||||||
|
tags: proxy
|
||||||
|
|
||||||
|
- name: Restart Nginx after configuration
|
||||||
|
service:
|
||||||
|
name: nginx
|
||||||
|
state: restarted
|
||||||
|
tags: proxy
|
||||||
31
ansible/roles/site_setup/templates/nginx_proxy.conf.j2
Normal file
31
ansible/roles/site_setup/templates/nginx_proxy.conf.j2
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
upstream backend_servers {
|
||||||
|
server {{ backend_ip_1 }}:80;
|
||||||
|
server {{ backend_ip_2 }}:80;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name {{ proxy_name }};
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
server_name {{ proxy_name }};
|
||||||
|
|
||||||
|
ssl_certificate /etc/nginx/ssl/{{ proxy_name }}.crt;
|
||||||
|
ssl_certificate_key /etc/nginx/ssl/{{ proxy_name }}.key;
|
||||||
|
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
|
||||||
|
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384";
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://backend_servers;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
}
|
||||||
|
}
|
||||||
9
ansible/roles/site_setup/templates/nginx_site.conf.j2
Normal file
9
ansible/roles/site_setup/templates/nginx_site.conf.j2
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name {{ site_name }};
|
||||||
|
|
||||||
|
location / {
|
||||||
|
root /var/www/html/{{ site_name }};
|
||||||
|
index index.html;
|
||||||
|
}
|
||||||
|
}
|
||||||
10
ansible/roles/site_setup/templates/site_index.html.j2
Normal file
10
ansible/roles/site_setup/templates/site_index.html.j2
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<title>{{ site_name }}</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>{{ site_name }}</h1>
|
||||||
|
<p>{{ additional_content }}</p>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
6
ansible/roles/site_setup/vars/main.yml
Normal file
6
ansible/roles/site_setup/vars/main.yml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
site_name: "example_site"
|
||||||
|
proxy_name: "proxy_server"
|
||||||
|
backend_ip_1: "192.168.0.61"
|
||||||
|
backend_ip_2: "192.168.0.62"
|
||||||
|
additional_content: "Welcome to {{ site_name }}"
|
||||||
Loading…
Reference in New Issue
Block a user