实战ansible playbook

克隆我的ansible playbook：

git clone https://github.com/donxan/ansible_playbooks.git

初始化

批量推送公钥到被控制机

生成IP list; 编写自动推送脚本

[root@izbp115lristfdwfgjwd52z ~]# vim pushkeys.sh
#!/bin/bash
#Author: Aiker
#mail: donxan@gmail.com
keypath=/root/.ssh
iplist=/root/ip.txt
[[ -e ${iplist} ]] && > ${iplist}
for i in `seq 81 91`
do
   echo -E "192.168.118.$i" >> ${iplist}
   ssh-keyscan 192.168.118.$i >> ${keypath}/known_hosts
done
cat ${iplist}
[ -d {keypath} ] || mkdir -p ${keypath}
rpm -q expect &> /dev/null || yum install expect -y
[[ -e ${keypath}/id_rsa.pub ]] || ssh-keygen -t rsa -f ${keypath}/id_rsa -P ""
password=OezywIq36
while read ip;do
expect << EOF
set timeout 5
spawn ssh-copy-id $ip
expect {

“yes/no” { send "yes\n";exp_continue }
"password" { send "$password\n"  }

}
expect off
EOF
done < ${iplist}

执行脚本：

[root@izbp115lristfdwfgjwd52z ~]# sh pushkeys.sh 
# 192.168.118.82:22 SSH-2.0-OpenSSH_7.4
# 192.168.118.82:22 SSH-2.0-OpenSSH_7.4
。。。
spawn ssh-copy-id 192.168.118.102
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

公钥已经推送到被控制机

执行初始化

yum -y install ansible lrzsz git //安装需要使用的工具

vim /etc/ansible/hosts //增加
[all]
s082    ansible_host=192.168.118.82
s083    ansible_host=192.168.118.83
s084    ansible_host=192.168.118.84
s085    ansible_host=192.168.118.85
s086    ansible_host=192.168.118.86
s087    ansible_host=192.168.118.87
s088    ansible_host=192.168.118.88
s089    ansible_host=192.168.118.89
s090    ansible_host=192.168.118.90
s081    ansible_host=192.168.118.81
s091    ansible_host=192.168.118.91
s106    ansible_host=192.168.118.106

# vim /etc/hosts //增加
192.168.118.81  s081
192.168.118.82  s082
192.168.118.83  s083
192.168.118.84  s084
192.168.118.85  s085
192.168.118.86  s086
192.168.118.87  s087
192.168.118.88  s088
192.168.118.89  s089
192.168.118.90  s090
192.168.118.91  s091
192.168.118.106 s106

外网主机启用iptables：

安装iptable iptable-service

#先检查是否安装了iptables
service iptables status
#安装iptables
yum install -y iptables
#升级iptables
yum update iptables 
#安装iptables-services
yum install iptables-services

禁用/停止自带的firewalld服务

#停止firewalld服务
systemctl stop firewalld
#禁用firewalld服务
systemctl mask firewalld

设置现有规则

[root@s18105 ~]# vim iptables.sh 
# cat iptables.sh
#!/bin/bash
service iptables restart
iptables -L -n
#先允许所有,不然有可能会杯具
#iptables -P INPUT ACCEPT
#清空所有默认规则
iptables -F
#清空所有自定义规则
iptables -X
#所有计数器归0
iptables -Z
#允许来自于lo接口的数据包(本地访问)
iptables -A INPUT -i lo -j ACCEPT
#开放22端口
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#开放21端口(FTP)
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#开放80端口(HTTP)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#开放443端口(HTTPS)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

#允许ping
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
#如果要添加内网ip信任（接受其所有TCP请求）
iptables -A INPUT -p tcp -s 192.168.118.0/24 -j ACCEPT
#允许接受本机请求之后的返回数据 RELATED,是为FTP设置的
#iptables -A INPUT -m state --state  RELATED,ESTABLISHED -j ACCEPT
#其他入站一律丢弃
iptables -P INPUT DROP
#所有出站一律绿灯
iptables -P OUTPUT ACCEPT
#所有转发一律丢弃
#iptables -P FORWARD DROP
#过滤所有非以上规则的请求
iptables -P INPUT DROP
#要封停一个IP，使用下面这条命令：
#iptables -I INPUT -s 100.100.100.100 -j DROP
#要解封一个IP，使用下面这条命令:
#iptables -D INPUT -s 100.100.100.100 -j DROP
service iptables save
systemctl restart iptables.service
#相当于以前的chkconfig iptables on
systemctl enable iptables.service
#开启服务
#systemctl start iptables.service
#查看状态
systemctl status iptables.service

#重新设置iptables设置
#iptables -A INPUT -m state --state  RELATED,ESTABLISHED -j ACCEPT

#解决vsftpd在iptables开启后,无法使用被动模式的问题
#首先在/etc/sysconfig/iptables-config中修改或者添加以下内容
#添加以下内容,注意顺序不能调换
#IPTABLES_MODULES="ip_conntrack_ftp"
#IPTABLES_MODULES="ip_nat_ftp"

执行脚本快速配置iptables。

配置squid
安装squid：

yum install squid

配置squid及透明模式
备份squid的配置文件

cp /etc/squid/squid.conf /etc/squid/squid.conf.bak

修改squid的配置文件：

vim /etc/squid/squid.conf

根据自己的需要添加对应的IP，端口
如果你要使用透明模式，在端口后面添加关键字“transparent”

Squid normally listens to port 3128

http_port 3128 transparent

在配置文件的最下方添加这条语句，否则squid不能启动！

visible_hostname localhost

4.启动squid

service squid restart

[root@s18105 playbooks]# cat squid.sh 
#!/bin/bash
echo "1" > /proc/sys/net/ipv4/ip_forward
modprobe iptable_nat
/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
#将对squid代理服务器DNS的请求转到8.8.8.8上
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to 8.8.8.8
iptables -t nat -A PREROUTING -i eth0 -p tcp -s 192.168.118.0/24 --dport 80 -j REDIRECT --to-ports 3128

执行脚本

部署nginx

vim /etc/ansible/hosts

[nginxservers]
s082
s083
s084
s085
s106

[root@s18105 playbooks]# vim nginx/install.yml 
---
- hosts: nginxservers
  remote_user: root
  gather_facts: True
  roles:
    - common
    - install

[root@s18105 playbooks]# ansible-playbook nginx/install.yml

PLAY [nginxservers] *****************************************************************************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************************************************************************
ok: [s084]
ok: [s085]
ok: [s083]
ok: [s106]

TASK [common : Install initializtion require software] ******************************************************************************************************************************************************
ok: [s085] => (item=[u'zlib-devel', u'pcre-devel'])
ok: [s083] => (item=[u'zlib-devel', u'pcre-devel'])
ok: [s084] => (item=[u'zlib-devel', u'pcre-devel'])
ok: [s106] => (item=[u'zlib-devel', u'pcre-devel'])

TASK [common : create nginx group] **************************************************************************************************************************************************************************
ok: [s085]
ok: [s084]
ok: [s083]
ok: [s106]

TASK [common : create nginx user] ***************************************************************************************************************************************************************************
ok: [s085]
ok: [s083]
ok: [s084]
ok: [s106]

TASK [common : copy shell to client] ************************************************************************************************************************************************************************
changed: [s085]
changed: [s084]
changed: [s083]

...
s083                       : ok=19   changed=10   unreachable=0    failed=0   
s084                       : ok=19   changed=11   unreachable=0    failed=0   
s085                       : ok=19   changed=11   unreachable=0    failed=0   
s106                       : ok=19   changed=10   unreachable=0    failed=0   

nginx部署完毕

部署mysql

[root@s18105 playbooks]# vim /etc/ansible/hosts 
[mysqlservers]
s086    ansible_host=192.168.118.86
s087    ansible_host=192.168.118.87
s088    ansible_host=192.168.118.88

[root@s18105 playbooks]# vim mysql/roles/vars/master_slaves.yaml 
#在创建一主多从环境时会用到的变量
master_ip: 192.168.118.86
  ave_ips:
  - 192.168.118.87
  - 192.168.118.88

上传mysql二进制安装包到ansible的/usr/local/src
mysql密码：

mysql_data_dir_base: /data/mysql/
mysql_port: 3306
mysql_root_password: egts9758
mysql_zabbix_password: mtls
mysql_rple_user: repl
mysql_rple_password: repl9758
mysql_mha_user: mha
mysql_mha_password: egts9758
mysql_app_user: appuser
mysql_app_password: egts9758
mysql_monitor_user: monitor
mysql_monitor_password: monitor9758
mysql_backup_user: backuper
mysql_backup_password: backuper9758

[root@s061 playbooks]# scp /usr/local/src/mysql-5.7.21-linux-glibc2.12-x86_64.tar.gz 116.62.199.117:/usr/local/src/
mysql-5.7.21-linux-glibc2.12-x86_64.tar.gz                                                                     100%  612MB   7.7MB/s   01:20 

[root@s18105 playbooks]# ansible-playbook mysql/roles/install_master_slaves.yaml

PLAY [mysqlservers] *****************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************
ok: [s088]
ok: [s086]
ok: [s087]

TASK [create mysql user] ************************************************************************************************************************
ok: [s087]
ok: [s086]
ok: [s088]

TASK [config /etc/my.cnf for mysql-5.6.x] *******************************************************************************************************
skipping: [s086]
skipping: [s087]
skipping: [s088]

...
TASK [clear temp file tmp/master_slaves.sql] ****************************************************************************************************
ok: [s086]
ok: [s088]
ok: [s087]

PLAY RECAP **************************************************************************************************************************************
s086                       : ok=27   changed=20   unreachable=0    failed=0   
s087                       : ok=27   changed=20   unreachable=0    failed=0   
s088                       : ok=27   changed=20   unreachable=0    failed=0   

验证：

[root@s18105 playbooks]# ansible mysqlservers -m command -a "mysql -uroot -pegts9758 -e 'show master status \G'"
s087 | SUCCESS | rc=0 >>
*************************** 1. row ***************************
             File: mysql-bin.000002
         Position: 595
     Binlog_Do_DB: 
 Binlog_Ignore_DB: 
Executed_Gtid_Set: 3399cfa8-9660-11e8-930e-00163e0cb6e5:1-2mysql: [Warning] Using a password on the command line interface can be insecure.

s086 | SUCCESS | rc=0 >>
*************************** 1. row ***************************
             File: mysql-bin.000002
         Position: 595
     Binlog_Do_DB: 
 Binlog_Ignore_DB: 
Executed_Gtid_Set: 3399cfa8-9660-11e8-930e-00163e0cb6e5:1-2mysql: [Warning] Using a password on the command line interface can be insecure.

s088 | SUCCESS | rc=0 >>
*************************** 1. row ***************************
             File: mysql-bin.000002
         Position: 595
     Binlog_Do_DB: 
 Binlog_Ignore_DB: 
Executed_Gtid_Set: 3399cfa8-9660-11e8-930e-00163e0cb6e5:1-2mysql: [Warning] Using a password on the command line interface can be insecure.

mysql主从搭建完毕

mycat实现读写分离

上传mycat到ansible的package目录

scp /usr/local/mytools/deploy/packages/mycat/mycat-server-1.6.5-linux.tar.gz 116.62.199.117:/usr/local/mytools/deploy/packages/mycat/

vim /etc/ansible/hosts
[mycat]
s082     ansible_host=192.168.118.82

在数据库中创建用户、mycat会有这个用户连接数据库 用户名、密码引用自mycat/roles/common/var/main.yml中的mysql_app_user、mysql_app_password 在主库上执行如下代码

create user appuser@'%' identified by 'egts9758';
create database ultrax default character set utf8;
create database DedeCMS default character set utf8;
create database zrlog default character set utf8;
grant all on ultrax.* to 'appuser'@'%';
grant all on DedeCMS.* to 'appuser'@'%';
grant all on zrlog.* to 'appuser'@'%';
flush privileges;

编辑mycat/roles/vars/var_mycat.yaml

[root@s18105 playbooks]# vim mycat/roles/vars/var_mycat.yaml 
master_ip: "192.168.118.86"

slave_ips:
 - "192.168.118.87"
 - "192.168.118.88"

修改mycat/roles/install_mycat.yaml中的host为需要安装mycat的host

[root@s18105 playbooks]# vim mycat/roles/install_mycat.yaml 
---
 - hosts: s082
   remote_user: root
   become_user: root
   vars_files:
    - common/vars/main.yml
    - vars/var_mycat.yaml

   tasks:
    - name: install dependents
      import_tasks: common/install_dependents.yaml

    - name: install mycat
      import_tasks: common/install_mycat.yaml

    - name: start mycat
      import_tasks: common/start_mycat.yaml

执行剧本：

[root@s18105 playbooks]# ansible-playbook mycat/roles/install_mycat.yaml   

PLAY [s082] *************************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************
ok: [s082]

TASK [install java-1.7.0-openjdk] ***************************************************************************************************************
ok: [s082]

TASK [create mycat user] ************************************************************************************************************************
ok: [s082]

TASK [trasfer mycat-server-1.6.5-linux.tar.gz to remonte host] **********************************************************************************
changed: [s082]

TASK [export MYCAT_HOME env to /etc/profile] ****************************************************************************************************
changed: [s082]

TASK [config schema.xml] ************************************************************************************************************************
changed: [s082]

TASK [config server.xml] ************************************************************************************************************************
changed: [s082]

TASK [transfer start_mycat.sh to remonte /tmp/] *************************************************************************************************
changed: [s082]

TASK [start mycat] ******************************************************************************************************************************
changed: [s082]

TASK [remove start_mycat.sh] ********************************************************************************************************************
changed: [s082]

PLAY RECAP **************************************************************************************************************************************
s082                       : ok=10   changed=7    unreachable=0    failed=0  

检查mycat是否启动：

[root@s18105 playbooks]# ansible s082 -m shell -a "ps -ef | grep mycat"    
s082 | SUCCESS | rc=0 >>
root     12210 12209  0 23:10 pts/1    00:00:00 /bin/sh -c ps -ef | grep mycat
root     12212 12210  0 23:10 pts/1    00:00:00 grep mycat

此处有坑：

没有启动，注意，这是java vm不能分配内存

 echo 1 > /proc/sys/vm/overcommit_memory

永久更改：

vim /etc/sysctl.conf

修改参数

vm.overcommit_memory = 1

sysctl -p

修改Mycat服务器参数调整和用户授权的配置文件server.xml。主要修改配置段如下：

# vim /usr/local/mycat/conf/server.xml
增加以下：
        # root用户对逻辑数据库ultrax,DedeCMS,zrlog具有增删改查的权限
        <user name="root">
                <property name="password">egts9758</property>
                <property name="schemas">ultrax,DedeCMS,zrlog</property>
        </user>

        # discuz用户对逻辑数据库ultrax具有增删改查的权限
        <user name="discuz">
                <property name="password">egts9758</property>
                <property name="schemas">ultrax</property>
        </user>

        # dedecms用户对逻辑数据库DedeCMS具有增删改查的权限
        <user name="dedecms">
                <property name="password">egts9758</property>
                <property name="schemas">DedeCMS</property>
        </user>

        # zrlog用户对逻辑数据库zrlog具有增删改查的权限
        <user name="zrlog">
                <property name="password">egts9758</property>
                <property name="schemas">zrlog</property>
        </user>

        # 该用户对逻辑数据库ultrax,DedeCMS,zrlog仅有只读的权限
        <user name="user">
                <property name="password">egts9758</property>
                <property name="schemas">ultrax,DedeCMS,zrlog</property>
                <property name="readOnly">true</property>
        </user>

修改逻辑库定义和表及分片定义的配置文件schema.xml：

# 把配置文件备份:
cp /usr/local/mycat/conf/schema.xml /usr/local/mycat/conf/schema.xml.bak

配置内容如下：

# cat /usr/local/mycat/conf/schema.xml
<?xml version="1.0"?>
<!DOCTYPE mycat:schema SYSTEM "schema.dtd">
<mycat:schema xmlns:mycat="http://io.mycat/">

        <schema name="ultrax" checkSQLschema="false" sqlMaxLimit="100000" dataNode="dnultrax">
        </schema>
        <schema name="DedeCMS" checkSQLschema="false" sqlMaxLimit="100000" dataNode="dnDedeCMS">
        </schema>
        <schema name="zrlog" checkSQLschema="false" sqlMaxLimit="100000" dataNode="dnzrlog">
        </schema>

        <dataNode name="dnultrax" dataHost="dh01" database="ultrax">
        </dataNode>
        <dataNode name="dnDedeCMS" dataHost="dh01" database="DedeCMS">
        </dataNode>
        <dataNode name="dnzrlog" dataHost="dh01" database="zrlog">
        </dataNode>

        <dataHost name="dh01" maxCon="128" minCon="10" balance="3" writeType="1"   dbType="mysql" dbDriver="native">

                  <heartbeat>
                    select user()
                  </heartbeat>

                  <writeHost host="master1" url="192.168.118.86:3306" user="appuser" password="egts9758">
                        <readHost host="slave1" url="192.168.118.87:3306" user="appuser" password="egts9758">
                        </readHost>
                        <readHost host="slave2" url="192.168.118.88:3306" user="appuser" password="egts9758">
                        </readHost>
                  </writeHost>
        </dataHost>

修改后：

部署php-fpm

vim /etc/ansible/hosts

添加以下：

[phpservers]
s083
s084
s085

执行剧本

[root@s18105 playbooks]# ansible-playbook php/install.yml 

PLAY [phpservers] *******************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************
ok: [s085]
ok: [s083]
ok: [s084]

TASK [Uncompression php setup] ******************************************************************************************************************
changed: [s083]
changed: [s084]
changed: [s085]

TASK [Uncompression php.bin] ********************************************************************************************************************
changed: [s084]
changed: [s083]
changed: [s085]
。。。

TASK [restart nginx] ****************************************************************************************************************************
changed: [s084]
changed: [s083]
changed: [s085]

PLAY RECAP **************************************************************************************************************************************
s083                       : ok=13   changed=12   unreachable=0    failed=0   
s084                       : ok=13   changed=12   unreachable=0    failed=0   
s085                       : ok=13   changed=12   unreachable=0    failed=0   

验证：

[root@s18105 playbooks]# ansible phpservers -m shell -a "ps -ef | grep php"              
s084 | SUCCESS | rc=0 >>
root     23583     1  0 00:19 ?        00:00:00 php-fpm: master process (/usr/local/php/etc/php-fpm.conf)
www      23584 23583  0 00:19 ?        00:00:00 php-fpm: pool www
www      23585 23583  0 00:19 ?        00:00:00 php-fpm: pool www
www      23586 23583  0 00:19 ?        00:00:00 php-fpm: pool www
www      23587 23583  0 00:19 ?        00:00:00 php-fpm: pool www
www      23588 23583  0 00:19 ?        00:00:00 php-fpm: pool www
www      23589 23583  0 00:19 ?        00:00:00 php-fpm: pool www
...

php-fpm安装完毕

安装apache tomcat

先安装apache

# vim /etc/ansible/hosts 

增加以下

[apacheservers]
s089    ansible_host=192.168.118.89

[tomcatservers]
s083    ansible_host=192.168.118.83
s084    ansible_host=192.168.118.84
s085    ansible_host=192.168.118.85

apache的安装包路径,上传文件到此路径

/usr/local/mytoos/deploy/packages/httpd

[root@s18105 playbooks]# ls /usr/local/mytools/deploy/packages/httpd/ 
apr-1.6.2.tar.gz  apr-util-1.6.0.tar.gz  httpd-2.4.28.tar.gz

[root@s18105 playbooks]# ansible-playbook httpd/install_httpd.yaml 

PLAY [apacheservers] ****************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************
ok: [s089]

TASK [install gcc] ******************************************************************************************************************************
ok: [s089]
...
TASK [enable httpd.service] *********************************************************************************************************************
changed: [s089]

PLAY RECAP **************************************************************************************************************************************
s089                       : ok=25   changed=18   unreachable=0    failed=0   

验证：

[root@s18105 playbooks]# ansible s089 -m shell -a "ps -ef | grep httpd"     
s089 | SUCCESS | rc=0 >>
root     31745     1  0 00:43 ?        00:00:00 /usr/local/httpd/bin/httpd -DFOREGROUND
daemon   31783 31745  0 00:43 ?        00:00:00 /usr/local/httpd/bin/httpd -DFOREGROUND
daemon   31784 31745  0 00:43 ?        00:00:00 /usr/local/httpd/bin/httpd -DFOREGROUND
daemon   31785 31745  0 00:43 ?        00:00:00 /usr/local/httpd/bin/httpd -DFOREGROUND
root     32394 32393  0 01:25 pts/1    00:00:00 /bin/sh -c ps -ef | grep httpd
root     32396 32394  0 01:25 pts/1    00:00:00 grep httpd

Apache安装完成。

安装tomcat

先上传jdk和tomcat tar包到/usr/local/src

[root@s18105 playbooks]# ls /usr/local/src/ -h 
apache-tomcat-8.5.32.tar.gz  jdk-8u161-linux-x64.tar.gz 

mycat安装zookeeper

zookeeeper

wget http://mirrors.hust.edu.cn/apache/zookeeper/zookeeper-3.4.13/zookeeper-3.4.13.tar.gz

tar zxf zookeeper-3.4.13.tar.gz
cd zookeeper-3.4.13/
cp conf/zoo_sample.cfg conf/zoo.cfg
sh bin/zkServer.sh start

可以看到如下信息：

ZooKeeper JMX enabled by default
Using config: /root/zookeeper-3.4.13/bin/../conf/zoo.cfg
Starting zookeeper ... STARTED

mycat-web

wget http://dl.mycat.io/mycat-web-1.0/Mycat-web-1.0-SNAPSHOT-20170102153329-linux.tar.gz

tar zxf Mycat-web-1.0-SNAPSHOT-20170102153329-linux.tar.gz 
 cd mycat-web/
 vim mycat-web/WEB-INF/classes/mycat.properties
 #
#Mon Jan 16 15:37:36 CST 2012
show.period=3000000
zookeeper=localhost:2181

mycat_warn_mail=[{"cc"\:"sohudo@mycat.io","index"\:1,"mangerPort"\:"465","smtpHost"\:"smtp.139.
com","smtpPassword"\:"123456","smtpProtocol"\:"smtp","smtpUser"\:"agile_louie@139.com","to"\:"9
183838@qq.com"}]
##sql\u4E0A\u7EBF\u76F8\u5173\u914D\u7F6E
sqlonline.server=192.168.118.82
sqlonline.user=appuser
sqlonline.passwd=egts9758

转载于:https://blog.51cto.com/m51cto/2155951