reqwizz/coursework
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rework all

Browse Source
This commit is contained in:
reqwizz 2024-11-11 13:48:06 +03:00
parent cc7cb56aa3
commit 8ba4e824fc
14 changed files with 196 additions and 245 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ansible/Jenkinsfile vendored
View File

@ -5,6 +5,10 @@ pipeline {
VAULT_PASSWORD = credentials('vault_password')
}
environment {
ANSIBLE_HOST_KEY_CHECKING = 'false'
}
parameters {
choice(name: 'SITE_OPTION', choices: ['SiteA', 'SiteB', 'SiteA&B'], description: 'Select which site to deploy')
string(name: 'ADDITIONAL_CONTENT', defaultValue: 'Новое сообщение', description: 'Additional content to be included in the site')
@ -38,19 +42,17 @@ pipeline {
def sanitized_content = params.ADDITIONAL_CONTENT.replaceAll("'", "\\'").replaceAll('"', '\\"')
def siteOption = params.SITE_OPTION
def hostsFile = env.HOSTS_FILE
def targetGroups = ''
if (siteOption == 'SiteA') {
targetGroups = 'SiteA'
targetGroups = 'SiteA,proxy'
} else if (siteOption == 'SiteB') {
targetGroups = 'SiteB'
targetGroups = 'SiteB,proxy'
} else if (siteOption == 'SiteA&B') {
targetGroups = 'SiteA,SiteB,proxy'
}
ansiblePlaybook(
playbook: 'ansible/playbook.yml',
playbook: 'ansible/playbooks/playbook.yml',
inventory: "ansible/inventory.yml",
extraVars: [
additional_content: sanitized_content,

4
ansible/ansible.cfg Normal file
View File

@ -0,0 +1,4 @@
[defaults]
inventory = inventory.yml
roles_path = ./roles
host_key_checking = False

240
ansible/playbook.yml
View File

@ -1,240 +0,0 @@
- hosts: SiteA
become: true
tasks:
- name: Install Nginx
zypper:
name: nginx
state: present
force: yes
update_cache: yes
- name: Create site directories
file:
path: /var/www/SiteA
state: directory
mode: '0755'
- name: Deploy site content
copy:
content: |
<html>
<head>
<meta charset="UTF-8">
<title>SiteA</title>
</head>
<body>
<h1>SiteA</h1>
<p>{{ additional_content | string }}</p>
</body>
</html>
dest: /var/www/SiteA/index.html
- name: Configure Nginx for SiteA
copy:
content: |
server {
listen 80;
server_name SiteA;
location / {
root /var/www/SiteA;
index index.html;
}
}
dest: /etc/nginx/conf.d/SiteA.conf
- name: Restart Nginx
service:
name: nginx
state: restarted
- name: Start and enable firewalld
service:
name: firewalld
state: started
enabled: true
- name: Open port 80 for HTTP
ansible.builtin.firewalld:
port: 80/tcp
permanent: true
state: enabled
immediate: yes
- name: Open port 443 for HTTPS
ansible.builtin.firewalld:
port: 443/tcp
permanent: true
state: enabled
immediate: yes
- name: Reload firewalld to apply changes
ansible.builtin.service:
name: firewalld
state: reloaded
- hosts: SiteB
become: true
tasks:
- name: Install Nginx
zypper:
name: nginx
state: present
force: yes
update_cache: yes
- name: Create site directories
file:
path: /var/www/SiteB
state: directory
mode: '0755'
- name: Deploy site content
copy:
content: |
<html>
<head>
<meta charset="UTF-8">
<title>SiteB</title>
</head>
<body>
<h1>SiteB</h1>
<p>{{ additional_content | string }}</p>
</body>
</html>
dest: /var/www/SiteB/index.html
- name: Configure Nginx for SiteB
copy:
content: |
server {
listen 80;
server_name SiteB;
location / {
root /var/www/SiteB;
index index.html;
}
}
dest: /etc/nginx/conf.d/SiteB.conf
- name: Restart Nginx
service:
name: nginx
state: restarted
- name: Start and enable firewalld
service:
name: firewalld
state: started
enabled: true
- name: Open port 80 for HTTP
ansible.builtin.firewalld:
port: 80/tcp
permanent: true
state: enabled
immediate: yes
- name: Open port 443 for HTTPS
ansible.builtin.firewalld:
port: 443/tcp
permanent: true
state: enabled
immediate: yes
- name: Reload firewalld to apply changes
ansible.builtin.service:
name: firewalld
state: reloaded
- hosts: proxy
become: true
tasks:
- name: Install Nginx
zypper:
name: nginx
state: present
force: yes
update_cache: yes
- name: Ensure SSL directory exists
file:
path: /etc/nginx/ssl
state: directory
mode: '0700'
- name: Generate private key
openssl_privatekey:
path: /etc/nginx/ssl/vlad4.key
size: 2048
type: RSA
mode: '0600'
owner: root
group: root
- name: Generate self-signed SSL certificate
openssl_certificate:
path: /etc/nginx/ssl/vlad4.crt
privatekey_path: /etc/nginx/ssl/vlad4.key
owner: root
group: root
mode: '0600'
provider: selfsigned
- name: Configure Nginx as HTTPS proxy
copy:
content: |
upstream backend_servers {
server 192.168.0.61:80;
server 192.168.0.62:80;
}
server {
listen 80;
server_name vlad4;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name vlad4;
ssl_certificate /etc/nginx/ssl/vlad4.crt;
ssl_certificate_key /etc/nginx/ssl/vlad4.key;
location / {
proxy_pass http://backend_servers;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
dest: /etc/nginx/conf.d/proxy.conf
- name: Restart Nginx
service:
name: nginx
state: restarted
- name: Start and enable firewalld
service:
name: firewalld
state: started
enabled: true
- name: Open port 443 for HTTPS
ansible.builtin.firewalld:
port: 443/tcp
permanent: true
state: enabled
immediate: yes
- name: Reload firewalld to apply changes
ansible.builtin.service:
name: firewalld
state: reloaded

5
ansible/playbooks/playbook.yml Normal file
View File

@ -0,0 +1,5 @@
---
- hosts: all
become: true
roles:
- role: site_setup

25
ansible/roles/site_setup/tasks/configure.yml Normal file
View File

@ -0,0 +1,25 @@
---
- name: Create site directories
file:
path: "/var/www/html/{{ site_name }}"
state: directory
mode: '0755'
tags: configure
- name: Deploy site content
template:
src: site_index.html.j2
dest: "/var/www/html/{{ site_name }}/index.html"
tags: configure
- name: Configure Nginx for {{ site_name }}
template:
src: nginx_site.conf.j2
dest: "/etc/nginx/conf.d/{{ site_name }}.conf"
tags: configure
- name: Restart Nginx
service:
name: nginx
state: restarted
tags: configure

29
ansible/roles/site_setup/tasks/firewall.yml Normal file
View File

@ -0,0 +1,29 @@
---
- name: Start and enable firewalld
service:
name: firewalld
state: started
enabled: true
tags: firewall
- name: Open port 80 for HTTP
ansible.builtin.firewalld:
port: 80/tcp
permanent: true
state: enabled
immediate: yes
tags: firewall
- name: Open port 443 for HTTPS
ansible.builtin.firewalld:
port: 443/tcp
permanent: true
state: enabled
immediate: yes
tags: firewall
- name: Reload firewalld to apply changes
ansible.builtin.service:
name: firewalld
state: reloaded
tags: firewall

24
ansible/roles/site_setup/tasks/generate_ssl.yml Normal file
View File

@ -0,0 +1,24 @@
---
- name: Ensure SSL directory exists
file:
path: /etc/nginx/ssl
state: directory
mode: '0755'
tags: ssl
- name: Generate self-signed SSL certificate
openssl_certificate:
path: /etc/nginx/ssl/{{ proxy_name }}.crt
privatekey_path: /etc/nginx/ssl/{{ proxy_name }}.key
common_name: "{{ proxy_name }}"
state: present
selfsigned: yes
owner: root
group: root
mode: '0644'
subject:
- organizationName: "Example Company"
- organizationalUnitName: "IT"
- localityName: "City"
- countryName: "US"
tags: ssl

8
ansible/roles/site_setup/tasks/install.yml Normal file
View File

@ -0,0 +1,8 @@
---
- name: Install Nginx
zypper:
name: nginx
state: present
force: yes
update_cache: yes
tags: install

12
ansible/roles/site_setup/tasks/main.yml Normal file
View File

@ -0,0 +1,12 @@
---
- import_tasks: install.yml
tags: install
- import_tasks: configure.yml
tags: configure
- import_tasks: proxy.yml
tags: proxy
- import_tasks: firewall.yml
tags: firewall

26
ansible/roles/site_setup/tasks/proxy.yml Normal file
View File

@ -0,0 +1,26 @@
---
- name: Configure Nginx load balancer with SSL
template:
src: nginx_proxy_ssl.conf.j2
dest: "/etc/nginx/conf.d/proxy.conf"
tags: proxy
- name: Ensure SSL directory exists
file:
path: /etc/nginx/ssl
state: directory
mode: '0755'
tags: proxy
- name: Copy Diffie-Hellman parameters
copy:
src: dhparam.pem
dest: /etc/nginx/ssl/dhparam.pem
mode: '0600'
tags: proxy
- name: Restart Nginx after configuration
service:
name: nginx
state: restarted
tags: proxy

31
ansible/roles/site_setup/templates/nginx_proxy.conf.j2 Normal file
View File

@ -0,0 +1,31 @@
upstream backend_servers {
server {{ backend_ip_1 }}:80;
server {{ backend_ip_2 }}:80;
}
server {
listen 80;
server_name {{ proxy_name }};
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name {{ proxy_name }};
ssl_certificate /etc/nginx/ssl/{{ proxy_name }}.crt;
ssl_certificate_key /etc/nginx/ssl/{{ proxy_name }}.key;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384";
location / {
proxy_pass http://backend_servers;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

9
ansible/roles/site_setup/templates/nginx_site.conf.j2 Normal file
View File

@ -0,0 +1,9 @@
server {
listen 80;
server_name {{ site_name }};
location / {
root /var/www/html/{{ site_name }};
index index.html;
}
}

10
ansible/roles/site_setup/templates/site_index.html.j2 Normal file
View File

@ -0,0 +1,10 @@
<html>
<head>
<meta charset="UTF-8">
<title>{{ site_name }}</title>
</head>
<body>
<h1>{{ site_name }}</h1>
<p>{{ additional_content }}</p>
</body>
</html>

6
ansible/roles/site_setup/vars/main.yml Normal file
View File

@ -0,0 +1,6 @@
---
site_name: "example_site"
proxy_name: "proxy_server"
backend_ip_1: "192.168.0.61"
backend_ip_2: "192.168.0.62"
additional_content: "Welcome to {{ site_name }}"