Ansible角色#

[TOC]

彩蛋#

Ansible 有一个非常有趣的小彩蛋：当它检测到你的系统中安装了 cowsay 时,就会自动调用它,把原本枯燥的任务名称（比如 PLAY RECAP、TASK [...]）放进小牛的对话气泡里,让输出界面变得生动有趣

1
 ____________
2
< PLAY RECAP >
3
 ------------
4
        \   ^__^
5
         \  (oo)\_______
6
            (__)\       )\/\
7
                ||----w |
8
                ||     ||
9
Client: ok=5  changed=3  failed=0  skipped=0  ignored=0
10
Server: ok=8  changed=6  failed=0  skipped=0  ignored=0

除了默认的小牛,cowsay 还有很多其他 ASCII 艺术图案

查看可用图案：你可以运行 cowsay -l 来查看所有可用的图案

1
[root@Zabbix ~]# cowsay -l
2
Cow files in /usr/share/cowsay:
3
cheese cower default dragon dragon-and-cow elephant elephant-in-snake eyes milk.....

指定图案：你可以通过修改 Ansible 的配置文件 /etc/ansible/ansible.cfg 来指定默认使用的图案

1
# 在 [defaults] 部分添加或修改
2
[defaults]
3
# 设置为 'dragon',下次运行就会看到一条龙在说话
4
cow_selection = dragon

🚫 觉得太花哨？关掉它！

个人觉得比默认的 * 好玩多了

编辑 Ansible 的主配置文件 /etc/ansible/ansible.cfg

1
# 在 [defaults] 部分
2
[defaults]
3
nocows = 1

概述#

==roles== 是对playbook的一种重新编排

1
🛠️ 如何创建角色？
2
'ansible-galaxy init 角色名'
3
# 它能一键生成标准的目录结构
4
[root@m01 ansible]# mkdir roles
5
[root@m01 ansible]# cd roles/
6
[root@m01 roles]# ansible-galaxy init backup
7
- Role backup was created successfully
8
# roles/backup--->专门用来备份
9
'当然我们还可以在roles目录下创建别的'
10
[root@m01 roles]# tree ./backup/
11
./backup/
12
├── defaults ❌️
13
│   └── main.yml
14
├── files
15
├── handlers
16
│   └── main.yml
17
├── meta ❌️
18
│   └── main.yml
19
├── README.md ❌️
20
├── tasks
21
│   └── main.yml
22
├── templates
23
├── tests ❌️
24
│   ├── inventory
25
│   └── test.yml
26
└── vars
27
    └── main.yml
28
# 我们先把没有用的删除掉!
29
[root@m01 roles]# cd backup/
30
[root@m01 backup]# rm -rf defaults/ meta/ tests/ README.md
31
[root@m01 backup]# tree
32
.
33
├── files    # 静态文件
34
├── handlers  # 触发器
35
│   └── main.yml✅️自动创建
36
├── tasks    # 核心任务
37
│   └── main.yml✅️自动创建
38
├── templates  # 模版文件(.j2)
39
└── vars    # 固定变量
40
    └── main.yml✅️自动创建
41
# 我们经常用的就这几个!
42
✅️我们直接在main.yml里面编写即可!

backup重构#

1
1)拷贝配置文件
2
# 到template目录下
3
[root@m01 backup]# cp ~/rsyncd.conf ./templates/rsyncd.conf.j2
4
# rsync的配置文件
5
[root@m01 backup]# cd templates/
6
[root@m01 templates]# echo rsync_backup:123 > rsync.passwd.j2
7
[root@m01 templates]# ls
8
rsyncd.conf.j2  rsync.passwd.j2
9
# 配置文件和密码文件
10
[root@m01 templates]# tree ../templates/
11
../templates/
12
├── rsyncd.conf.j2
13
└── rsync.passwd.j2
14

15
2)编辑核心剧本
16
[root@m01 templates]# cd ..
17
[root@m01 backup]# cd ..
18
# 要在roles目录下创建playbook
19
[root@m01 roles]# vim site.yml
20
# 从hosts开始写
21
- hosts: backup
22
# 后面要改为all,会有不同的角色!
23
  roles:
24
    - role: backup
25
      when: ansible_hostname is match "backup"
26
      # when判断和role对齐
27
      # 只有主机为backup才执行
28

29
3)恢复快照&&免密登录
30
[root@m01 roles]# ssh-copy-id -i ~/.ssh/my_key.pub 172.16.1.41
31
[root@m01 roles]# ssh backup "hostname -I"
32
10.0.0.41 172.16.1.41
33
'密码成功'
34

35
4)检测与测试
36
[root@m01 roles]# ansible-playbook --syntax-check site.yml
37
playbook: site.yml
38
[root@m01 roles]# ansible-playbook site.yml
39
PLAY [backup]
40
**********************
41
TASK [Gathering Facts]
42
ok: [backup]
43
'收集信息'
44
**********************
45
TASK [backup : Install rsync server]
46
ok: [backup]
47
'安装rsync'
48
**********************
49
TASK [backup : Configure rsync file]
50
changed: [backup] => (item={'src': 'rsyncd.conf.j2', 'dest': '/etc/rsyncd.conf', 'mode': '0644'})
51
changed: [backup] => (item={'src': 'rsync.passwd.j2', 'dest': '/etc/rsync.passwd', 'mode': '0600'})
52
# 拷贝文件--->配置文&&密码文件
53
**********************
54
TASK [backup : Create group "www"]
55
changed: [backup]
56
"创建组"
57
**********************
58
TASK [backup : Create user "www"]
59
changed: [backup]
60
'创建用户'
61
**********************
62
TASK [backup : Create dir]
63
changed: [backup] => (item=/backup)
64
changed: [backup] => (item=/data)
65
'创建目录'
66
**********************
67
TASK [backup : Start rsync server]
68
changed: [backup]
69
'启动&&开机自启'
70

71
'测试验证'
72
[root@m01 roles]# rsync -avz /etc/passwd rsync_backup@172.16.1.41::backup
73
Password: ---'密码123'
74
sent 841 bytes  received 43 bytes  353.60 bytes/sec
75
[root@backup ~]#ls /backup/passwd
76
/backup/passwd

roles/backup/vars/main.yml
- 存放着固定变量

1
user: www
2
uid: 888
3
rc_port: 873
4
dir_1: /backup
5
dir_2: /data

roles/backup/template/rsyncd.conf.j2
- 模版配置文件

1
uid = {{user}}
2
gid = {{user}}
3
port = {{rc_port}}
4
fake super = yes
5
use chroot = no
6
max connections = 200
7
timeout = 600
8
ignore errors
9
read only = false
10
list = false
11
auth users = rsync_backup
12
secrets file = /etc/rsync.passwd
13
pid file = /var/run/rsyncd.pid
14
lock file = /var/run/rsync.lock
15
log file =/var/log/rsyncd.log
16
############################
17
[backup]
18
path = {{dir_1}}
19
[data]
20
path = {{dir_2}}

roles/backup/tasks/main.yml
- 任务核心

1
- name: Install rsync server
2
  yum:
3
    name: rsync
4
    state: present
5

6
- name: Configure rsync file
7
  template:
8
    src: "{{item.src}}"
9
    dest: "{{item.dest}}"
10
    mode: "{{item.mode}}"
11
  notify: Restart rsync
12
  # 只要修改了,就触发handler重启
13
  loop:
14
    # src能够自动识别template里面的模版文件
15
    - src: rsyncd.conf.j2
16
      dest: /etc/rsyncd.conf
17
      mode: "0644"
18
    - src: rsync.passwd.j2
19
      dest: /etc/rsync.passwd
20
      mode: "0600"
21

22
- name: Create group "{{user}}"
23
  group:
24
    name: "{{user}}"
25
    gid: "{{uid}}"
26

27
- name: Create user "{{user}}"
28
  user:
29
    name: "{{user}}"
30
    uid: "{{uid}}"
31
    group: "{{user}}"
32
    shell: /sbin/nologin
33
    create_home: false
34

35
- name: Create dir
36
  file:
37
    path: "{{item}}"
38
    state: directory
39
    owner: "{{user}}"
40
    group: "{{user}}"
41
  loop:
42
  # 因为变量没有在路径中所以要加引号
43
  # /tmp/{{dir}}-->这种不需要加引号
44
    - "{{dir_1}}"
45
    - "{{dir_2}}"
46

47
- name: Start rsync server
48
  systemd:
49
    name: rsyncd
50
    state: started
51
    enabled: yes

roles/backup/handlers/main.yml
- 触发器,修改配置文件--->给handler发信号

1
- name: Restart rsync
2
# 和notify的名字相同
3
  systemd:
4
    name: rsyncd
5
    state: restarted

nfs重构#

1
1)恢复快照&&免密
2
[root@m01 roles]# ssh-copy-id -i ~/.ssh/my_key.pub 172.16.1.31
3
[root@m01 roles]# ssh nfs01 "hostname -I"
4
10.0.0.31 172.16.1.31
5

6
2)创建角色
7
[root@m01 roles]# ansible-galaxy init nfs
8
- Role nfs was created successfully
9
[root@m01 roles]# cd nfs/
10
[root@m01 nfs]# ls
11
defaults  files  handlers  meta  README.md  tasks  templates  tests  vars
12
[root@m01 nfs]# rm -rf defaults/ meta/ README.md tests/
13
[root@m01 nfs]# ls
14
files  handlers  tasks  templates  vars
15

16
3)拷贝配置文件
17
[root@m01 nfs]# cp /home/ansible/exports ./templates/exports.j2
18
[root@m01 nfs]# cat ./templates/exports.j2
19
{{dir}} 172.16.1.0/24(rw,sync,all_squash,anonuid={{ id }},anongid={{ id }})
20

21
4)编辑核心剧本
22
[root@m01 nfs]# cd ..
23
# 继续上一个的写!
24
[root@m01 roles]# vim site.yml
25
- hosts: all
26
# 注意看自己的主机清单!
27
  roles:
28
    - role: backup
29
      when: ansible_hostname is match "backup"
30
      # when判断和role对齐
31
      # 只有主机为backup才执行
32
    - role: nfs
33
      when: ansible_hostname is match "nfs"
34
[root@m01 roles]# tree nfs/
35
nfs/
36
├── files
37
├── handlers
38
│   └── main.yml
39
├── tasks
40
│   └── main.yml
41
├── templates
42
│   └── exports.j2
43
└── vars
44
    └── main.yml
45

46
5)测试&验证
47
[root@m01 roles]# ansible-playbook --syntax-check site.yml
48
playbook: site.yml
49
[root@m01 roles]# showmount -e 172.16.1.31
50
clnt_create: RPC: ❌️Unable to receive
51
[root@m01 roles]# ansible-playbook site.yml
52
TASK [backup : Install rsync server]
53
skipping: [db02]
54
skipping: [nfs01]
55
skipping: [web01]
56
skipping: [web02]
57
ok: [backup]
58
'只有backup执行,其他都跳过'
59
**********************
60
.................
61
'先跑第一个角色backup,再跑nfs'
62
**********************
63
TASK [nfs : Install nfs server]
64
skipping: [db02]
65
skipping: [backup]
66
skipping: [web02]
67
skipping: [web01]
68
ok: [nfs01]
69
'只有nfs执行!!'
70
**********************
71
nfs01  : ok=7    changed=6
72
[root@m01 roles]# showmount -e 172.16.1.31
73
Export list for 172.16.1.31:
74
/data/wp 172.16.1.0/24✅️
75
'没问题👌'

1
user: www
2
dir: /data/wp
3
id : 888

1
- name: Install nfs server
2
  yum:
3
    name: nfs-utils
4
    state: present
5

6
- name: Configure nfs file
7
  template:
8
    src: exports.j2
9
    dest: /etc/exports
10
  notify: Restart nfs
11

12
- name: Create group "{{user}}"
13
  group:
14
    name: "{{user}}"
15
    gid: "{{id}}"
16

17
- name: Create user "{{user}}"
18
  user:
19
    name: "{{user}}"
20
    uid: "{{id}}"
21
    group: "{{user}}"
22
    shell: /sbin/nologin
23
    create_home: false
24

25
- name: Create dir "{{dir}}"
26
# 递归创建了目录/data/wp
27
# 这两个目录的属主都是www
28
  file:
29
    path: "{{dir}}"
30
    state: directory
31
    owner: "{{user}}"
32
    group: "{{user}}"
33

34
- name: Start NFS Server
35
  systemd:
36
    name: nfs
37
    state: started
38
    enabled: yes

1
- name: Restart nfs
2
  systemd:
3
    name: nfs
4
    state: restarted

主配置文件#

1
[root@Zabbix ~]# tree /ansible/
2
/ansible/
3
└── roles
4
    ├── Client
5
    │ ......
6
    ├── Server
7
    │ ......
8
    └── site.yml
9

10
'hosts可以写在 - name '
11

12
- name: 配置 Server 主机
13
  hosts: Server
14
  roles:
15
    - Server
16

17
- name: 配置 Client 主机
18
  hosts: Client
19
  roles:
20
    - Client
21

22
- name: Server 测试验证
23
  hosts: Server
24
  tasks:
25
    - name: Result test
26
      shell: 'unbound-control dump_cache | grep jd.com'
27
      register: result_end
28

29
    - name: Print result_end
30
      debug:
31
        msg: "{{result_end.stdout_lines}}"

面试题#

1
请问用过ansible吗？
2
你都用来干啥？
3
用过、--->配置变更、数据收集facts模块(资产管理)、批量安装部署服务
4
那你用过哪些模块？
5
file copy template yum systemd cron handles vars when loop
6
我执行一条命令、但是看不到结果怎么办？
7
使用变量注册 register

项目实训#

短主机名	FQDN	管理 IP (ens1)	NAT IP (ens0)	业务 IP (ens2)	存储 IP (ens3)
ops-admin	ops-admin.example.com	10.2.1.10	10.0.0.10	-	-
gitlab-server	gitlab-server.example.com	10.2.1.20	10.0.0.20	-	-
zabbix-server	zabbix-server.example.com	10.2.1.30	10.0.0.30	-	-
jumpserver	jumpserver.example.com	10.2.1.40	10.0.0.40	-	-
waf01	waf01.example.com	10.2.1.50	10.0.0.50	10.2.2.50	-
lb01	lb01.example.com	10.2.1.60	10.0.0.60	10.2.2.60	-
web01	web01.example.com	10.2.1.71	10.0.0.71	10.2.2.71	10.2.3.71
web02	web02.example.com	10.2.1.72	10.0.0.72	10.2.2.72	10.2.3.72
share01	share01.example.com	10.2.1.80	10.0.0.80	-	10.2.3.80
client	client.example.com	-	10.0.0.90	10.2.2.90	-

网卡	Connection ID
ens0	ens0-nat
ens1	ens1-mg
ens2	ens2-bi
ens3	ens3-st

Ansible管理#

环境准备#

1
[root@ops-admin ~]# yum -y install tar zip
2
[root@ops-admin ~]# curl -LsSf https://astral.sh/uv/install.sh | bash
3
downloading uv 0.11.25 x86_64-unknown-linux-gnu
4
installing to /root/.local/bin
5
  uv
6
  uvx
7
everything's installed!
8
[root@ops-admin ~]# echo 'eval "$(uv generate-shell-completion bash)"' >> ~/.bashrc
9
[root@ops-admin ~]# echo 'eval "$(uvx --generate-shell-completion bash)"' >> ~/.bashrc
10
[root@ops-admin ~]# echo 'export UV_INDEX_URL="https://mirrors.aliyun.com/pypi/simple/"' >> ~/.bashrc
11
[root@ops-admin ~]# source ~/.bashrc
12
[root@ops-admin ~]# mkdir /Projects
13
[root@ops-admin ~]# cd /Projects/
14
[root@ops-admin Projects]# python3 --version
15
Python 3.12.13
16
[root@ops-admin Projects]# uv venv .venv --python 3.12
17
Using CPython 3.12.13 interpreter at: /usr/bin/python3.12
18
Creating virtual environment at: .venv
19
Activate with: source .venv/bin/activate
20
[root@ops-admin Projects]# source .venv/bin/activate
21
(.venv) [root@ops-admin Projects]# uv pip install ansible
22
Resolved 10 packages in 3.51s
23
Prepared 10 packages in 8.88s
24
Installed 10 packages in 3.89s
25
 + ansible==14.1.0
26
 + ansible-core==2.21.1
27
 + cffi==2.0.0
28
 + cryptography==49.0.0
29
 + jinja2==3.1.6
30
 + markupsafe==3.0.3
31
 + packaging==26.2
32
 + pycparser==3.0
33
 + pyyaml==6.0.3
34
 + resolvelib==1.2.1
35
(.venv) [root@ops-admin Projects]# ansible --version
36
ansible [core 2.21.1]
37
(.venv) [root@ops-admin Projects]# cat > ./ansible.cfg <<EOF
38
[defaults]
39
host_key_checking = False
40
deprecation_warnings = False
41
interpreter_python = auto_silent
42
inventory = ./inventory
43
gathering = smart
44
# 开启智能模式：如果有缓存就用缓存，没有才去收集
45
fact_caching = jsonfile
46
# 指定缓存方式为 jsonfile（存成本地文件）
47
fact_caching_connection = /tmp/ansible_fact_cache
48
# 指定缓存文件存到哪里
49
fact_caching_timeout = 86400
50
# 缓存多久失效（秒），这里设置 24 小时
51
[privilege_escalation]
52
become = true
53
become_method = sudo
54
become_user = root
55
become_ask_pass = false
56
EOF
57
(.venv) [root@ops-admin Projects]# ssh-keygen -t rsa -b 4096 -f ~/.ssh/my_rsa -N ''
58
Generating public/private rsa key pair.
59
Your identification has been saved in /root/.ssh/my_rsa
60
Your public key has been saved in /root/.ssh/my_rsa.pub
61
The key fingerprint is:
62
SHA256:ySF1tKhH31U5H9ZlMXlHrHSB3dgRuAJs1d32l0hnCn4 root@ops-admin
63
The key's randomart image is:
64
+---[RSA 4096]----+
65
|        o.+.. =@^|
66
|       . * o =o&%|
67
|      . = + o.O+O|
68
|       = + + E..+|
69
|      . S . +   .|
70
|       .         |
71
|                 |
72
|                 |
73
|                 |
74
+----[SHA256]-----+
75
(.venv) [root@ops-admin Projects]# sed -i '/id_rsa/a\IdentityFile ~/.ssh/my_rsa' /etc/ssh/ssh_config
76
(.venv) [root@ops-admin Projects]# grep -A1 id_rsa /etc/ssh/ssh_config
77
#   IdentityFile ~/.ssh/id_rsa
78
IdentityFile ~/.ssh/my_rsa
79
(.venv) [root@ops-admin Projects]# systemctl restart sshd
80
(.venv) [root@ops-admin Projects]# cat > /etc/hosts <<EOF
81
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
82
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
83
10.2.1.10  ops-admin    ops-admin.example.com
84
10.2.1.20  gitlab-server  gitlab-server.example.com
85
10.2.1.30  zabbix-server  zabbix-server.example.com
86
10.2.1.40  jumpserver    jumpserver.example.com
87
10.2.1.50  waf01      waf01.example.com
88
10.2.1.60  lb01        lb01.example.com
89
10.2.1.71  web01      web01.example.com
90
10.2.1.72  web02      web02.example.com
91
10.2.1.80  share01      share01.example.com
92
EOF
93
(.venv) [root@ops-admin Projects]# awk '/^10\.2\.1/ {print $2}' /etc/hosts | grep -v ops-admin > ./inventory
94
# 排除自身 ops-admin
95
(.venv) [root@ops-admin Projects]# cat ./inventory
96
gitlab-server
97
zabbix-server
98
jumpserver
99
waf01
100
lb01
101
web01
102
web02
103
share01
104
[root@ops-admin ~]# ll ~/.ssh/my_rsa.pub
105
# 如何批量分发密钥呢？-i指定公钥
106
(.venv) [root@ops-admin Projects]# vim /server/sh/ssh-key.sh

密钥分发#

1
#!/bin/bash
2
# ============================================
3
# 批量分发 SSH 公钥脚本
4
# 从 /etc/hosts 读取 10.2.1.x 网段主机，
5
# 通过管理网将公钥分发到所有节点
6
# ============================================
7

8
# ---- 配置区 ----
9
PUBKEY="$HOME/.ssh/my_rsa.pub"       # 要分发的公钥路径
10
PASSWORD="1"                         # 目标主机的 root 密码
11
# -----------------
12

13
echo "========================================"
14
echo "  批量分发 SSH 公钥"
15
echo "  公钥: $PUBKEY"
16
echo "========================================"
17
echo ""
18

19
# 检查公钥是否存在
20
if [ ! -f "$PUBKEY" ]; then
21
    echo "错误: 公钥文件 $PUBKEY 不存在，请先生成!"
22
    exit 1
23
fi
24

25
# 检查 sshpass 是否安装
26
if ! command -v sshpass &>/dev/null; then
27
    echo "sshpass 未安装，正在安装..."
28
    dnf install -y sshpass &>/dev/null || yum install -y sshpass &>/dev/null
29
fi
30

31
# 从 /etc/hosts 提取所有 10.2.1.x 的短主机名
32
# awk: 匹配 10.2.1 开头的行，打印第二列(短名)
33
HOSTS=$(awk '/^10\.2\.1/ {print $2}' /etc/hosts)
34

35
if [ -z "$HOSTS" ]; then
36
    echo "错误: /etc/hosts 中没有找到 10.2.1.x 的主机!"
37
    exit 1
38
fi
39

40
echo "目标主机列表:"
41
echo "$HOSTS" | tr '\n' ' '
42
echo ""
43
echo ""
44

45
# 逐个分发
46
for host in $HOSTS; do
47
    echo ">>> 分发到 $host ..."
48

49
    # sshpass: 自动输入密码
50
    # ssh-copy-id: 将公钥复制到目标主机
51
    #   -i: 指定公钥文件
52
    #   -o StrictHostKeyChecking=no: 跳过首次连接 yes/no 确认
53
    #   -o UserKnownHostsFile=/dev/null: 不记录主机指纹(可选，干净)
54
    sshpass -p "$PASSWORD" ssh-copy-id \
55
        -i "$PUBKEY" \
56
        -o StrictHostKeyChecking=no \
57
        -o UserKnownHostsFile=/dev/null \
58
        root@$host 2>/dev/null
59

60
    if [ $? -eq 0 ]; then
61
        echo "    ✓ $host 分发成功"
62
    else
63
        echo "    ✗ $host 分发失败，请检查网络和密码"
64
    fi
65
    echo ""
66
done
67

68
echo "========================================"
69
echo "  分发完成！验证免密登录:"
70
echo "  ssh root@ops-admin"
71
echo "========================================"

1
(.venv) [root@ops-admin Projects]# ansible --version | grep 'config file'
2
  config file = /Projects/ansible.cfg
3
(.venv) [root@ops-admin Projects]# grep inventory ./ansible.cfg
4
inventory = ./inventory
5
(.venv) [root@ops-admin Projects]# ansible all -m ping
6
jumpserver | SUCCESS => {
7
    "ansible_facts": {
8
        "discovered_interpreter_python": "/usr/bin/python3.12"
9
    },
10
    "changed": false,
11
    "ping": "pong"
12
}
13
waf01 | SUCCESS => {
14
    "ansible_facts": {
15
        "discovered_interpreter_python": "/usr/bin/python3.12"
16
    },
17
    "changed": false,
18
    "ping": "pong"
19
}
20
gitlab-server | SUCCESS => {
21
    "ansible_facts": {
22
        "discovered_interpreter_python": "/usr/bin/python3.12"
23
    },
24
    "changed": false,
25
    "ping": "pong"
26
}
27
zabbix-server | SUCCESS => {
28
    "ansible_facts": {
29
        "discovered_interpreter_python": "/usr/bin/python3.12"
30
    },
31
    "changed": false,
32
    "ping": "pong"
33
}
34
lb01 | SUCCESS => {
35
    "ansible_facts": {
36
        "discovered_interpreter_python": "/usr/bin/python3.12"
37
    },
38
    "changed": false,
39
    "ping": "pong"
40
}
41
share01 | SUCCESS => {
42
    "ansible_facts": {
43
        "discovered_interpreter_python": "/usr/bin/python3.12"
44
    },
45
    "changed": false,
46
    "ping": "pong"
47
}
48
web01 | SUCCESS => {
49
    "ansible_facts": {
50
        "discovered_interpreter_python": "/usr/bin/python3.12"
51
    },
52
    "changed": false,
53
    "ping": "pong"
54
}
55
web02 | SUCCESS => {
56
    "ansible_facts": {
57
        "discovered_interpreter_python": "/usr/bin/python3.12"
58
    },
59
    "changed": false,
60
    "ping": "pong"
61
}

📌 当前环境

组件	路径/状态
Ansible 项目	`/Projects/`
虚拟环境	需手动 `source venv/bin/activate`
配置文件	`/Projects/ansible.cfg`（已配置提权）
Inventory	`/Projects/inventory`（8 台受控节点）
控制节点	ops-admin (10.2.1.10)

1
(.venv) [root@ops-admin Projects]# vim playbook-init.yml

1
---
2
# ============================================
3
# Ansible 初始化剧本 — 第二组
4
# 用法: cd /Projects && source venv/bin/activate && ansible-playbook playbook-init.yml
5
# ============================================
6

7
- hosts: all
8
  gather_facts: yes
9
  tasks:
10

11
    # ---- 主机名解析 ----
12
    - name: "拷贝 /etc/hosts 到所有节点"
13
      copy:
14
        src: /etc/hosts
15
        dest: /etc/hosts
16
        owner: root
17
        group: root
18
        mode: '0644'
19

20
    # ---- 软件包 ----
21
    - name: "安装必要软件包"
22
      package:
23
        name:
24
          - tar
25
          - zip
26
          - unzip
27
        state: present
28

29
    # ---- 创建 dev 用户和组 ----
30
    - name: "创建开发组 dev (gid=1024)"
31
      group:
32
        name: dev
33
        gid: 1024
34
        state: present
35

36
    - name: "创建开发用户 dev (uid=1024)"
37
      user:
38
        name: dev
39
        uid: 1024
40
        group: dev
41
        shell: /bin/bash
42
        create_home: yes
43
        state: present
44

45
    # ---- NTP 时钟同步 ----
46
    - name: "配置 NTP 上游服务器为腾讯云"
47
      lineinfile:
48
        path: /etc/chrony.conf
49
        regexp: '^pool'
50
        line: server ntp.tencent.com iburst
51

52
    - name: "重启 chronyd 服务"
53
      systemd:
54
        name: chronyd
55
        state: restarted
56

57
    - name: "检查时钟同步状态"
58
      shell: chronyc sources
59
      register: ntp_result
60

61
    - name: "打印时钟同步结果"
62
      debug:
63
        msg: "{{ ntp_result.stdout_lines }}"

序号	任务	模块	说明
1	拷贝 /etc/hosts	copy	将 ops-admin 的 hosts 分发到所有节点
2	安装软件包	package	安装 tar、zip
3	创建 dev 组	group	gid=1024
4	创建 dev 用户	user	uid=1024，shell=/bin/bash
5	配置 NTP	lineinfile	上游服务器改为 ntp.tencent.com
6	重启 chronyd	systemd	使 NTP 配置生效
7	检查同步状态	command	chronyc sources
8	打印结果	debug	输出同步状态

时钟同步#

1
[root@ops-admin ~]# chronyc  sources
2
MS Name/IP address         Stratum Poll Reach LastRx Last sample
3
===============================================================================
4
^? 118.31.40.99                  0   6     0     -     +0ns[   +0ns] +/-    0ns
5
^? 118.31.3.89                   0   6     0     -     +0ns[   +0ns] +/-    0ns
6
^? 47.96.149.233                 0   6     0     -     +0ns[   +0ns] +/-    0ns
7
^? 116.62.13.223                 0   6     0     -     +0ns[   +0ns] +/-    0ns
8
# 所有源的状态都是 ^?（不可达/未同步）
9
[root@ops-admin ~]# egrep -v '^$|^#' /etc/chrony.conf
10
pool ntp1.aliyun.com iburst 'nts' ❌
11
# 阿里云公共 NTP 服务器（ntp1.aliyun.com）不支持 NTS 协议
12
# 要去掉 nts 参数
13
sourcedir /run/chrony-dhcp
14
driftfile /var/lib/chrony/drift
15
makestep 1.0 3
16
rtcsync
17
ntsdumpdir /var/lib/chrony
18
logdir /var/log/chrony
19
[root@ops-admin ~]# sed -i '/^pool ntp1/c\server ntp.tencent.com iburst' /etc/chrony.conf
20
'如果原来有的话要注释掉原来的'
21
[root@ops-admin ~]# systemctl restart chronyd
22
[root@ops-admin ~]# chronyc sources
23
MS Name/IP address         Stratum Poll Reach LastRx Last sample
24
===============================================================================
25
^* 106.55.184.199                2   6    13     0   +637us[ +246ms] +/-   70ms
26
✅ `*`  当前 `最佳同步源`（被选中用来同步系统时间）

1
(.venv) [root@ops-admin Projects]# ansible-playbook playbook-init.yml
2
 ____________
3
< PLAY [all] >
4
 ------------
5
        \   ^__^
6
         \  (oo)\_______
7
            (__)\       )\/\
8
                ||----w |
9
                ||     ||
10

11
 ________________________
12
< TASK [Gathering Facts] >
13
 ------------------------
14
        \   ^__^
15
         \  (oo)\_______
16
            (__)\       )\/\
17
                ||----w |
18
                ||     ||
19

20
ok: [gitlab-server]
21
ok: [lb01]
22
ok: [waf01]
23
ok: [zabbix-server]
24
ok: [jumpserver]
25
ok: [web01]
26
ok: [web02]
27
ok: [share01]
28
 __________________________________________
29
< TASK [拷贝 /etc/hosts 到所有节点] >
30
 ------------------------------------------
31
        \   ^__^
32
         \  (oo)\_______
33
            (__)\       )\/\
34
                ||----w |
35
                ||     ||
36

37
changed: [waf01]
38
changed: [jumpserver]
39
changed: [zabbix-server]
40
changed: [gitlab-server]
41
changed: [lb01]
42
changed: [web01]
43
changed: [web02]
44
changed: [share01]
45
 ______________________________
46
< TASK [安装必要软件包] >
47
 ------------------------------
48
        \   ^__^
49
         \  (oo)\_______
50
            (__)\       )\/\
51
                ||----w |
52
                ||     ||
53

54
changed: [jumpserver]
55
changed: [waf01]
56
changed: [lb01]
57
changed: [zabbix-server]
58
changed: [gitlab-server]
59
changed: [web01]
60
changed: [web02]
61
changed: [share01]
62
 _______________________________________
63
< TASK [创建开发组 dev (gid=1024)] >
64
 ---------------------------------------
65
        \   ^__^
66
         \  (oo)\_______
67
            (__)\       )\/\
68
                ||----w |
69
                ||     ||
70

71
changed: [waf01]
72
changed: [gitlab-server]
73
changed: [jumpserver]
74
changed: [zabbix-server]
75
changed: [lb01]
76
changed: [web01]
77
changed: [web02]
78
changed: [share01]
79
 __________________________________________
80
< TASK [创建开发用户 dev (uid=1024)] >
81
 ------------------------------------------
82
        \   ^__^
83
         \  (oo)\_______
84
            (__)\       )\/\
85
                ||----w |
86
                ||     ||
87

88
changed: [gitlab-server]
89
changed: [waf01]
90
changed: [zabbix-server]
91
changed: [jumpserver]
92
changed: [lb01]
93
changed: [web01]
94
changed: [web02]
95
changed: [share01]
96
 _______________________________________________
97
< TASK [配置 NTP 上游服务器为腾讯云] >
98
 -----------------------------------------------
99
        \   ^__^
100
         \  (oo)\_______
101
            (__)\       )\/\
102
                ||----w |
103
                ||     ||
104

105
changed: [gitlab-server]
106
changed: [jumpserver]
107
changed: [waf01]
108
changed: [zabbix-server]
109
changed: [lb01]
110
changed: [web01]
111
changed: [web02]
112
changed: [share01]
113
 ______________________________
114
< TASK [重启 chronyd 服务] >
115
 ------------------------------
116
        \   ^__^
117
         \  (oo)\_______
118
            (__)\       )\/\
119
                ||----w |
120
                ||     ||
121

122
changed: [zabbix-server]
123
changed: [waf01]
124
changed: [jumpserver]
125
changed: [lb01]
126
changed: [gitlab-server]
127
changed: [web01]
128
changed: [web02]
129
changed: [share01]
130
 _________________________________
131
< TASK [检查时钟同步状态] >
132
 ---------------------------------
133
        \   ^__^
134
         \  (oo)\_______
135
            (__)\       )\/\
136
                ||----w |
137
                ||     ||
138

139
changed: [waf01]
140
changed: [gitlab-server]
141
changed: [jumpserver]
142
changed: [lb01]
143
changed: [zabbix-server]
144
changed: [web01]
145
changed: [web02]
146
changed: [share01]
147
 _________________________________
148
< TASK [打印时钟同步结果] >
149
 ---------------------------------
150
        \   ^__^
151
         \  (oo)\_______
152
            (__)\       )\/\
153
                ||----w |
154
                ||     ||
155

156
ok: [gitlab-server] => {
157
    "msg": [
158
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
159
        "=========================================================",
160
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
161
    ]
162
}
163
ok: [zabbix-server] => {
164
    "msg": [
165
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
166
        "=========================================================",
167
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
168
    ]
169
}
170
ok: [jumpserver] => {
171
    "msg": [
172
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
173
        "=========================================================",
174
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
175
    ]
176
}
177
ok: [waf01] => {
178
    "msg": [
179
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
180
        "=========================================================",
181
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
182
    ]
183
}
184
ok: [lb01] => {
185
    "msg": [
186
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
187
        "=========================================================",
188
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
189
    ]
190
}
191
ok: [web01] => {
192
    "msg": [
193
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
194
        "=========================================================",
195
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
196
    ]
197
}
198
ok: [web02] => {
199
    "msg": [
200
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
201
        "=========================================================",
202
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
203
    ]
204
}
205
ok: [share01] => {
206
    "msg": [
207
        "MS Name/IP address  Stratum Poll Reach LastRx Last sample",
208
        "=========================================================",
209
        "^* 106.55.184.199   2   6     1     1   -673ms   67ms"
210
    ]
211
}
212
 ____________
213
< PLAY RECAP >
214
 ------------
215
        \   ^__^
216
         \  (oo)\_______
217
            (__)\       )\/\
218
                ||----w |
219
                ||     ||
220

221
gitlab-server              : ok=9    changed=7
222
jumpserver                 : ok=9    changed=7
223
lb01                       : ok=9    changed=7
224
share01                    : ok=9    changed=7
225
waf01                      : ok=9    changed=7
226
web01                      : ok=9    changed=7
227
web02                      : ok=9    changed=7
228
zabbix-server              : ok=9    changed=7

GitLab 代码仓库#

在gitlab-server安装极狐gitlab

节点：gitlab-server.example.com (10.2.1.20)
域名：gitlab-server.example.com
协议：HTTPS 自签名证书

环境要求与准备#

（1）主机名解析

/etc/hosts 已通过 Ansible playbook-init.yml 分发到所有节点，无需手动配置。管理网 IP 解析：10.2.1.20 gitlab-server gitlab-server.example.com

验证：

1
ping -c1 gitlab-server.example.com
2
# 自己ping自己
3
64 bytes from gitlab-server (10.2.1.20): icmp_seq=1 ttl=64 time=0.025 ms

（2）添加官方仓库并安装

1
curl -s https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.rpm.sh | bash
2
dnf install -y gitlab-ce

（3）生成自签名证书

1
mkdir -p /etc/gitlab/ssl
2
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
3
  -keyout /etc/gitlab/ssl/gitlab-server.example.com.key \
4
  -out /etc/gitlab/ssl/gitlab-server.example.com.crt \
5
  -subj "/C=CN/ST=Beijing/L=Beijing/O=Group2/CN=gitlab-server.example.com"

（4）配置 HTTPS

编辑 /etc/gitlab/gitlab.rb：

1
cat > /etc/gitlab/gitlab.rb << 'EOF'
2
external_url "https://gitlab-server.example.com"
3
nginx["redirect_http_to_https"] = true
4
nginx["ssl_certificate"] = "/etc/gitlab/ssl/gitlab-server.example.com.crt"
5
nginx["ssl_certificate_key"] = "/etc/gitlab/ssl/gitlab-server.example.com.key"
6
EOF

（5）应用配置（约 5-10 分钟）

1
gitlab-ctl reconfigure

（6）获取初始 root 密码

1
cat /etc/gitlab/initial_root_password
2
# Password: O/WfB1SI77/4WmHsY5OcyhqQxUzJkl4iai5GvVObUIQ=
3

4
jiuzhao@Ubuntu ~$ sudo vim /etc/hosts
5
10.0.0.20  gitlab-server.example.com
6
# 添加这个解析
7
https://gitlab-server.example.com

初始化配置#

（1）修改 root 密码

1
gitlab-rails runner "
2
u = User.find_by_username('root')
3
u.password = 'redhat123'
4
u.password_confirmation = 'redhat123'
5
u.save!
6
"

（2）创建普通用户 devuser

1
gitlab-rails runner "
2
org = Organizations::Organization.default_organization
3
u = User.new(
4
  username: 'devuser',
5
  email: 'developer@localhost.com',
6
  name: 'devuser',
7
  password: 'redhat123',
8
  password_confirmation: 'redhat123',
9
  confirmed_at: Time.now,
10
  skip_confirmation: true,
11
  organization_id: org.id
12
)
13
ns = Namespace.new(
14
  name: 'devuser',
15
  path: 'devuser',
16
  type: 'User',
17
  owner: u,
18
  organization: org
19
)
20
u.namespace = ns
21
u.save!
22
puts 'devuser created'
23
"

（3）创建项目并添加成员

1
gitlab-rails runner "
2
# 以 devuser 创建项目
3
dev = User.find_by_username('devuser')
4
project = Projects::CreateService.new(
5
  dev,
6
  name: 'automation_project',
7
  path: 'automation_project',
8
  visibility_level: Gitlab::VisibilityLevel::PRIVATE
9
).execute
10
puts project.full_path
11
"

Ansible 剧本 — 安装 Git#

📌 ops-admin 本机
剧本路径：/Projects/playbook-git.yml
说明：ops-admin 作为 Ansible 控制节点，本身也要安装 git 才能推送代码。因 ops-admin 不在 inventory 中，使用 hosts: localhost + connection: local 在本机执行。

1
- hosts: localhost
2
  gather_facts: yes
3
  tasks:
4
    - name: "安装 git"
5
      package:
6
        name: git
7
        state: present
8

9
    - name: "配置 git 用户名"
10
      # git_config 是 ansible 内置模块，等价于: git config --global user.name "root"
11
      git_config:
12
        name: user.name
13
        value: "root"
14
        scope: global
15

16
    - name: "配置 git 邮箱"
17
      # 等价于: git config --global user.email "root@ops-admin.example.com"
18
      git_config:
19
        name: user.email
20
        value: "root@ops-admin.example.com"
21
        scope: global
22

23
    - name: "跳过 SSL 验证（自签证书用）"
24
      # 等价于: git config --global http.sslVerify false
25
      git_config:
26
        name: http.sslVerify
27
        value: "false"
28
        scope: global

执行：

1
cd /Projects && source venv/bin/activate
2
ansible-playbook playbook-git.yml

推送代码到 GitLab#

GitLab Web 页面：https://gitlab-server.example.com（HTTPS 443 端口，非 8888）
自签证书浏览器会报警告，点”高级 → 继续访问”即可

Tip

GitLab CE 自带中文，登录后在右上角头像 → Preferences → Localization → Language → 简体中文。但是部分页面还是英文

1
'在ops-admin中操作即可'
2
cd /Projects
3
# 进入本地项目目录
4

5
git config --global init.defaultBranch main
6
# 设默认分支为 main（消除 init 时的提示）
7

8
git init
9
# 把当前目录变成 git 仓库（不再是 master 而是 main）
10
(.venv) [root@ops-admin Projects]# ls -lha | grep git
11
drwxr-xr-x   6 root root  103 Jun 30 16:30 .git ✅
12
# 如果没设上面那个全局配置，就 init 后手动改名：
13
# git branch -m master main
14

15
echo "# automation_project" > README.md
16
# 随便写个文件
17

18
git add README.md
19
# 告诉 git："这个文件我要提交"
20

21
git commit -m "init: 初始化自动化项目"
22
# 确认提交（拍个快照），加个备注
23
# 1 file changed, 1 insertion(+)
24
# create mode 100644 README.md
25

26
git -c http.sslVerify=false push \
27
  https://root:redhat123@gitlab-server.example.com/root/automation_project.git main
28
# 推送至远程仓库，自签证书跳过 SSL 验证
29
# - https 开头 = HTTPS 协议
30
# - root:redhat123 = 用户名:密码
31
# - gitlab-server.example.com = 目标主机
32
# - /root/automation_project.git = 远程仓库路径
33
# - main = 推送的分支名
34
  # -c 跳过证书校验（因为是自签名的，不受信任）
35
# 推送到远程（自签证书跳过验证）
36
 https://root:redhat123@gitlab-server.example.com/root/automation_project.git main
37
Enumerating objects: 3, done.
38
Counting objects: 100% (3/3), done.
39
Writing objects: 100% (3/3), 267 bytes | 267.00 KiB/s, done.
40
Total 3 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)
41
To https://gitlab-server.example.com/root/automation_project.git
42
 * [new branch]      main -> main

改成这样	效果
https://root:redhat123@…	以 root（管理员）推送
https://devuser:redhat123@…	以 devuser（普通用户）推送

Lb负载&Web服务#

基础环境准备#

1
(.venv) [root@ops-admin Projects]# mkdir nginx
2
(.venv) [root@ops-admin Projects]# cat > ./nginx/nginx.conf <<'EOF'
3
user  www;
4
worker_processes  auto;
5
worker_cpu_affinity auto;   # cpu亲和
6
pid  /run/nginx.pid;
7
error_log  /var/log/nginx/error.log  notice;
8
worker_rlimit_nofile 65535;  # 每个work能打开的文件描述符
9

10
events {
11
    worker_connections  32768;
12
    # 每个worker进程可以同时处理最大连接数
13
    # 一个连接平均占用两个文件描述符
14
    multi_accept  on;
15
    use  epoll;
16
}
17

18
http {
19
    include       mime.types;
20
    default_type  application/octet-stream;
21

22
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
23
                      '$status $body_bytes_sent "$http_referer" '
24
                      '"$http_user_agent" "$http_x_forwarded_for"';
25

26
    access_log  /var/log/nginx/access.log  main;
27

28
    server_tokens off;  # 禁止浏览器显示nginx版本号
29
    client_max_body_size 20m;   # 文件上传大小限制调整 默认1M
30
    sendfile        on;
31
    tcp_nopush      on;
32
    # tcp_nodelay     on;
33
    keepalive_timeout  65;
34

35
    # Gzip
36
    gzip on;
37
    # 小于1KB的文件不压缩（避免小文件压缩后反而变大）
38
    gzip_min_length  1k;
39
    gzip_comp_level  6;     #  压缩等级6（通用）
40
    gzip_types  text/plain application/javascript text/css application/xml application/json;
41
    # 压缩的类型：必须用空格隔开
42

43
    # 子配置目录
44
    include /etc/nginx/conf.d/*.conf;
45
}
46
EOF
47
======================================
48
(.venv) [root@ops-admin Projects]# cat > ./nginx/www.conf <<'EOF'
49
[www]
50
user = www
51
group = www
52
listen = 127.0.0.1:9000
53
listen.acl_users = apache,nginx
54
listen.allowed_clients = 127.0.0.1
55
pm = dynamic
56
pm.max_children = 50
57
pm.start_servers = 5
58
pm.min_spare_servers = 5
59
pm.max_spare_servers = 35
60
slowlog = /var/log/php-fpm/www-slow.log
61
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
62
php_admin_flag[log_errors] = on
63
php_value[session.save_handler] = files
64
php_value[session.save_path]    = /var/lib/php/session
65
php_value[soap.wsdl_cache_dir]  = /var/lib/php/wsdlcache
66
EOF
67
======================================
68
(.venv) [root@ops-admin Projects]# cat > ./nginx/php.ini <<'EOF'
69
[PHP]
70
engine = On
71
short_open_tag = Off
72
precision = 14
73
output_buffering = 4096
74
zlib.output_compression = Off
75
implicit_flush = Off
76
unserialize_callback_func =
77
serialize_precision = -1
78
disable_functions =
79
disable_classes =
80
zend.enable_gc = On
81
zend.exception_ignore_args = On
82
zend.exception_string_param_max_len = 0
83
expose_php = On
84
max_execution_time = 300
85
max_input_time = 300
86
memory_limit = 256M
87
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
88
display_errors = Off
89
display_startup_errors = Off
90
log_errors = On
91
ignore_repeated_errors = Off
92
ignore_repeated_source = Off
93
report_memleaks = On
94
variables_order = "GPCS"
95
request_order = "GP"
96
register_argc_argv = Off
97
auto_globals_jit = On
98
post_max_size = 64M
99
auto_prepend_file =
100
auto_append_file =
101
default_mimetype = "text/html"
102
default_charset = "UTF-8"
103
doc_root =
104
user_dir =
105
enable_dl = Off
106
file_uploads = On
107
upload_max_filesize = 64M
108
max_file_uploads = 20
109
allow_url_fopen = On
110
allow_url_include = Off
111
default_socket_timeout = 60
112
[CLI Server]
113
cli_server.color = On
114
[Date]
115
date.timezone = Asia/Shanghai
116
[filter]
117
[iconv]
118
[imap]
119
[intl]
120
[sqlite3]
121
[Pcre]
122
pcre.jit=0
123
[Pdo]
124
[Pdo_mysql]
125
pdo_mysql.default_socket=
126
[Phar]
127
[mail function]
128
sendmail_path = /usr/sbin/sendmail -t -i
129
mail.add_x_header = Off
130
mail.mixed_lf_and_crlf = Off
131
[ODBC]
132
odbc.allow_persistent = On
133
odbc.check_persistent = On
134
odbc.max_persistent = -1
135
odbc.max_links = -1
136
odbc.defaultlrl = 4096
137
odbc.defaultbinmode = 1
138
[MySQLi]
139
mysqli.max_persistent = -1
140
mysqli.allow_persistent = On
141
mysqli.max_links = -1
142
mysqli.default_port = 3306
143
mysqli.default_socket =
144
mysqli.default_host =
145
mysqli.default_user =
146
mysqli.default_pw =
147
[mysqlnd]
148
mysqlnd.collect_statistics = On
149
mysqlnd.collect_memory_statistics = Off
150
[PostgreSQL]
151
pgsql.allow_persistent = On
152
pgsql.auto_reset_persistent = Off
153
pgsql.max_persistent = -1
154
pgsql.max_links = -1
155
pgsql.ignore_notice = 0
156
pgsql.log_notice = 0
157
[bcmath]
158
bcmath.scale = 0
159
[browscap]
160
[Session]
161
session.save_handler = files
162
session.use_strict_mode = 0
163
session.use_cookies = 1
164
session.use_only_cookies = 1
165
session.name = PHPSESSID
166
session.auto_start = 0
167
session.cookie_lifetime = 0
168
session.cookie_path = /
169
session.cookie_domain =
170
session.cookie_httponly =
171
session.cookie_samesite =
172
session.serialize_handler = php
173
session.gc_probability = 1
174
session.gc_divisor = 1000
175
session.gc_maxlifetime = 1440
176
session.referer_check =
177
session.cache_limiter = nocache
178
session.cache_expire = 180
179
session.use_trans_sid = 0
180
session.sid_length = 26
181
session.trans_sid_tags = "a=href,area=href,frame=src,form="
182
session.sid_bits_per_character = 5
183
[Assertion]
184
zend.assertions = -1
185
[mbstring]
186
[gd]
187
[exif]
188
[Tidy]
189
tidy.clean_output = Off
190
[soap]
191
soap.wsdl_cache_enabled=1
192
soap.wsdl_cache_dir="/tmp"
193
soap.wsdl_cache_ttl=86400
194
soap.wsdl_cache_limit = 5
195
[sysvshm]
196
[ldap]
197
ldap.max_links = -1
198
[dba]
199
[opcache]
200
[curl]
201
[openssl]
202
[ffi]
203
EOF
204
======================================
205
(.venv) [root@ops-admin Projects]# cat > ./nginx/default.conf.j2 <<'EOF'
206
server {
207
    listen {{ansible_ens2.ipv4.address}}:8000 default_server;
208
    server_name _;
209
    root /usr/share/nginx/html;
210

211
    location / {
212
        index index.html index.php;
213
        # 先静态后PHP
214
    }
215

216
    error_page 500 502 503 504 /50x.html;
217

218
    location ~ \.php$ {
219
        fastcgi_pass 127.0.0.1:9000;
220
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
221
        include fastcgi_params;
222
    }
223
}
224
EOF
225
======================================
226
(.venv) [root@ops-admin Projects]# cat > ./nginx/proxy_set <<'EOF'
227
proxy_set_header Host $http_host;
228
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
229
proxy_http_version 1.1;
230

231
proxy_connect_timeout 30;
232
proxy_send_timeout 60;
233
proxy_read_timeout 60;
234

235
proxy_buffering on;
236
proxy_buffer_size 32k;
237
proxy_buffers 4 128k;
238
EOF
239
======================================
240
(.venv) [root@ops-admin Projects]# cat > ./nginx/lb.conf <<'EOF'
241
upstream webs {
242
    server 10.2.2.71:8000;
243
    server 10.2.2.72:8000;
244
}
245

246
server {
247
    listen 10.2.2.60:80;
248
    server_name www.wp.com;
249

250
    location / {
251
        proxy_pass http://webs;
252
        include proxy_set;
253
    }
254
}
255
EOF

index.html#

1
(.venv) [root@ops-admin Projects]# vim ./nginx/index.html.j2

1
<!DOCTYPE html>
2
<html lang="zh-CN">
3
<head>
4
  <meta charset="UTF-8">
5
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.5, user-scalable=yes">
6
  <title>web默认页 - {{ ansible_hostname }}</title>
7
  <style>
8
    * { margin: 0; padding: 0; box-sizing: border-box; }
9
    body {
10
      background: linear-gradient(145deg, #f0f4f8 0%, #e9eff5 100%);
11
      font-family: 'Segoe UI', 'Roboto', system-ui, sans-serif;
12
      min-height: 100vh; display: flex; justify-content: center; align-items: center;
13
      padding: 2rem 1rem; color: #1e293b;
14
    }
15
    .dashboard {
16
      max-width: 1100px; width: 100%; background: #ffffff;
17
      box-shadow: 0 25px 50px -12px rgba(0,0,0,0.15);
18
      border-radius: 2.5rem; padding: 2.5rem;
19
    }
20
    @media (max-width: 640px) { .dashboard { padding: 1.8rem; border-radius: 2rem; } }
21
    .header {
22
      display: flex; flex-wrap: wrap; align-items: baseline; justify-content: space-between;
23
      margin-bottom: 2rem; border-bottom: 2px dashed #cbd5e1; padding-bottom: 1.2rem;
24
    }
25
    .host-badge { display: flex; flex-wrap: wrap; align-items: center; gap: 1.2rem; }
26
    .hostname {
27
      font-size: 2.5rem; font-weight: 700;
28
      background: linear-gradient(135deg, #0f2b5c, #1e4b6e);
29
      -webkit-background-clip: text; -webkit-text-fill-color: transparent;
30
      background-clip: text; letter-spacing: -0.5px;
31
    }
32
    .ip-address {
33
      background: #e0e7ff; padding: 0.5rem 1.3rem; border-radius: 3rem;
34
      font-weight: 600; font-size: 1.1rem; color: #1e3a8a;
35
      display: inline-flex; align-items: center; gap: 0.3rem;
36
    }
37
    .ip-address::before { content: "🌐"; }
38
    .php-status {
39
      background: #f1f5f9; border-radius: 2rem; padding: 0.4rem 1.4rem;
40
      font-weight: 600; display: flex; align-items: center; gap: 0.4rem;
41
    }
42
    .badge-success { background: #dcfce7; color: #166534; border-left: 4px solid #22c55e; }
43
    .badge-fail { background: #fee2e2; color: #991b1b; border-left: 4px solid #ef4444; }
44
    .grid-main {
45
      display: grid; grid-template-columns: 1fr 1fr; gap: 2rem;
46
      margin: 2rem 0 2.2rem;
47
    }
48
    @media (max-width: 750px) { .grid-main { grid-template-columns: 1fr; } }
49
    .card {
50
      background: #f8fafc; border-radius: 1.8rem; padding: 1.8rem;
51
      box-shadow: 0 10px 25px -8px rgba(0,0,0,0.08); border: 1px solid #e9eef2;
52
      transition: transform 0.2s;
53
    }
54
    .card:hover { transform: translateY(-3px); box-shadow: 0 20px 30px -12px rgba(0,0,0,0.12); }
55
    .card h3 { font-size: 1.5rem; font-weight: 600; margin-bottom: 1.3rem; display: flex; align-items: center; gap: 0.5rem; color: #0c4a6e; }
56
    .upload-area {
57
      border: 2px dashed #94a3b8; border-radius: 1.2rem; padding: 2rem 1rem;
58
      text-align: center; background: #ffffff; cursor: pointer; transition: 0.25s; margin-bottom: 1.2rem;
59
    }
60
    .upload-area:hover { border-color: #2563eb; background: #f0f4ff; }
61
    #file-input { display: none; }
62
    .preview-img {
63
      max-width: 100%; max-height: 150px; margin-top: 1rem;
64
      border-radius: 1rem; box-shadow: 0 8px 18px rgba(0,0,0,0.1); display: none;
65
    }
66
    .btn {
67
      background: #f1f5f9; border: 1px solid #cbd5e1; padding: 0.7rem 1.8rem;
68
      border-radius: 2.5rem; font-weight: 600; cursor: pointer; transition: 0.2s;
69
      display: inline-flex; align-items: center; gap: 0.3rem; font-size: 0.95rem;
70
    }
71
    .btn-primary {
72
      background: linear-gradient(135deg, #1e293b, #0f172a); color: white; border: none;
73
      box-shadow: 0 8px 18px rgba(15,23,42,0.3);
74
    }
75
    .btn-primary:hover { background: #1e293b; }
76
    .btn-danger {
77
      background: #dc2626; color: white; border: none; margin-left: 0.5rem;
78
    }
79
    .btn-danger:hover { background: #b91c1c; }
80
    .db-panel { display: flex; flex-direction: column; gap: 1rem; }
81
    .form-row { display: flex; flex-wrap: wrap; align-items: center; gap: 0.8rem; }
82
    .form-row label { font-weight: 600; min-width: 55px; color: #334155; }
83
    input, select {
84
      background: white; border: 1px solid #d1d5db; border-radius: 2rem;
85
      padding: 0.7rem 1.2rem; font-size: 0.95rem; flex: 1; outline: none;
86
      transition: 0.2s; font-family: inherit;
87
    }
88
    input:focus, select:focus { border-color: #2563eb; box-shadow: 0 0 0 3px rgba(37,99,235,0.2); }
89
    .db-result, .upload-status { margin-top: 0.5rem; font-weight: 600; }
90
    .file-info { margin-top: 1rem; background: #f1f5f9; padding: 0.8rem; border-radius: 1rem; display: none; }
91
    .file-info p { margin: 0.3rem 0; font-size: 0.9rem; }
92

93
    /* 图片画廊 */
94
    .gallery-title { margin-top: 1.8rem; margin-bottom: 0.8rem; font-weight: 600; color: #334155; }
95
    .gallery {
96
      display: flex; flex-wrap: wrap; gap: 0.8rem; max-height: 200px; overflow-y: auto;
97
      padding: 0.5rem; background: #ffffff; border-radius: 1rem; border: 1px solid #e2e8f0;
98
    }
99
    .gallery-item {
100
      width: 80px; height: 80px; border-radius: 0.8rem; overflow: hidden;
101
      cursor: pointer; border: 2px solid transparent; transition: 0.2s;
102
      position: relative; flex-shrink: 0;
103
    }
104
    .gallery-item img {
105
      width: 100%; height: 100%; object-fit: cover;
106
    }
107
    .gallery-item:hover { border-color: #2563eb; transform: scale(1.05); }
108
    .gallery-item .delete-icon {
109
      position: absolute; top: 2px; right: 2px; background: rgba(0,0,0,0.6);
110
      color: white; border-radius: 50%; width: 20px; height: 20px;
111
      display: flex; align-items: center; justify-content: center;
112
      font-size: 12px; display: none;
113
    }
114
    .gallery-item:hover .delete-icon { display: flex; }
115

116
    /* 详情弹窗 */
117
    .modal {
118
      display: none; position: fixed; z-index: 100; left: 0; top: 0;
119
      width: 100%; height: 100%; background: rgba(0,0,0,0.6);
120
      justify-content: center; align-items: center;
121
    }
122
    .modal.active { display: flex; }
123
    .modal-content {
124
      background: white; border-radius: 2rem; padding: 2rem;
125
      max-width: 500px; width: 90%; text-align: center;
126
      position: relative; animation: fadeIn 0.3s;
127
    }
128
    @keyframes fadeIn { from { opacity: 0; transform: translateY(-20px); } to { opacity: 1; transform: translateY(0); } }
129
    .modal img { max-width: 100%; max-height: 250px; border-radius: 1rem; margin-bottom: 1rem; }
130
    .modal .detail-row { display: flex; justify-content: space-between; margin: 0.5rem 0; font-size: 0.95rem; }
131
    .close-btn {
132
      position: absolute; top: 1rem; right: 1.5rem; font-size: 1.8rem;
133
      cursor: pointer; color: #64748b;
134
    }
135
    hr { margin: 1.5rem 0 1rem; border: 0.5px solid #e2e8f0; }
136
    .footer-note { text-align: right; font-size: 0.9rem; color: #64748b; margin-top: 1rem; }
137
    button:disabled { opacity: 0.6; cursor: not-allowed; }
138
  </style>
139
</head>
140
<body>
141
<div class="dashboard">
142
  <div class="header">
143
    <div class="host-badge">
144
      <span class="hostname">{{ ansible_hostname }}</span>
145
      <span class="ip-address">{{ ansible_ens2.ipv4.address }}</span>
146
    </div>
147
    <div id="php-indicator" class="php-status badge-success"></div>
148
  </div>
149

150
  <div class="grid-main">
151
    <!-- 图片管理卡片 -->
152
    <div class="card">
153
      <h3><span>📁</span> 图片管理</h3>
154
      <!-- 上传区域 -->
155
      <div id="upload-box" class="upload-area">
156
        <div class="upload-icon">📤</div>
157
        <p><strong>点击或拖拽上传</strong></p>
158
        <p style="font-size:0.8rem; color:#64748b;">JPG, PNG, GIF</p>
159
        <input type="file" id="file-input" accept="image/*">
160
        <img id="preview-image" class="preview-img" alt="预览">
161
      </div>
162
      <div style="display: flex; justify-content: space-between; align-items: center;">
163
        <button id="upload-btn" class="btn btn-primary">⬆️ 上传</button>
164
        <span id="upload-message" class="upload-status"></span>
165
      </div>
166

167
      <!-- 已上传图片列表 -->
168
      <div class="gallery-title">🖼️ 已上传图片</div>
169
      <div id="gallery" class="gallery">
170
        <!-- 动态填充缩略图 -->
171
      </div>
172
    </div>
173

174
    <!-- 数据库卡片保持不变 -->
175
    <div class="card">
176
      <h3><span>🗄️</span> 数据库连通性测试</h3>
177
      <div class="db-panel">
178
        <div class="form-row">
179
          <label>主机</label>
180
          <input type="text" id="db-host" placeholder="192.168.1.100" value="192.168.1.100">
181
        </div>
182
        <div class="form-row">
183
          <label>端口</label>
184
          <input type="number" id="db-port" placeholder="3306" value="3306">
185
        </div>
186
        <div class="form-row">
187
          <label>用户</label>
188
          <input type="text" id="db-user" placeholder="root" value="root">
189
        </div>
190
        <div class="form-row">
191
          <label>密码</label>
192
          <input type="password" id="db-pass" placeholder="数据库密码">
193
        </div>
194
        <div class="form-row">
195
          <label>库名</label>
196
          <input type="text" id="db-name" placeholder="test" value="test">
197
        </div>
198
        <button id="test-db-btn" class="btn btn-primary" style="justify-content:center;">🔌 测试连接</button>
199
        <div id="db-result" class="db-result"></div>
200
        <div id="tables-info" style="display:none; margin-top:0.3rem;">
201
          <div id="tables-count" style="font-weight:600;"></div>
202
          <div id="tables-list" class="tables-list"></div>
203
        </div>
204
      </div>
205
    </div>
206
  </div>
207

208
  <hr>
209
  <div style="display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap;">
210
    <div style="display: flex; gap: 1.5rem;">
211
      <span><strong>PHP状态：</strong><span id="php-text">检测中</span></span>
212
      <span><strong>服务器时间：</strong><span id="server-time">--</span></span>
213
    </div>
214
    <div class="footer-note">Ansible 部署 • {{ ansible_hostname }}</div>
215
  </div>
216
</div>
217

218
<!-- 图片详情模态框 -->
219
<div id="imageModal" class="modal">
220
  <div class="modal-content">
221
    <span class="close-btn" id="closeModal">&times;</span>
222
    <img id="modal-img" src="" alt="大图">
223
    <div class="detail-row"><strong>文件名：</strong><span id="modal-name"></span></div>
224
    <div class="detail-row"><strong>大小：</strong><span id="modal-size"></span></div>
225
    <div class="detail-row"><strong>修改时间：</strong><span id="modal-mtime"></span></div>
226
    <div class="detail-row"><strong>属主：</strong><span id="modal-owner"></span></div>
227
    <div style="margin-top:1.5rem; display: flex; justify-content: center; gap:1rem;">
228
      <a id="modal-link" href="#" target="_blank" class="btn">🔍 查看原图</a>
229
      <button id="modal-delete" class="btn btn-danger">🗑️ 删除图片</button>
230
    </div>
231
  </div>
232
</div>
233

234
<script>
235
  // ---------- 全局 DOM ----------
236
  const uploadBox = document.getElementById('upload-box');
237
  const fileInput = document.getElementById('file-input');
238
  const previewImg = document.getElementById('preview-image');
239
  const uploadBtn = document.getElementById('upload-btn');
240
  const uploadMessage = document.getElementById('upload-message');
241
  const galleryDiv = document.getElementById('gallery');
242
  const phpIndicator = document.getElementById('php-indicator');
243
  const phpTextSpan = document.getElementById('php-text');
244
  const serverTimeSpan = document.getElementById('server-time');
245
  const testDbBtn = document.getElementById('test-db-btn');
246
  const dbResultDiv = document.getElementById('db-result');
247
  const tablesInfoDiv = document.getElementById('tables-info');
248
  const tablesCountSpan = document.getElementById('tables-count');
249
  const tablesListDiv = document.getElementById('tables-list');
250

251
  // 模态框元素
252
  const modal = document.getElementById('imageModal');
253
  const closeModal = document.getElementById('closeModal');
254
  const modalImg = document.getElementById('modal-img');
255
  const modalName = document.getElementById('modal-name');
256
  const modalSize = document.getElementById('modal-size');
257
  const modalMtime = document.getElementById('modal-mtime');
258
  const modalOwner = document.getElementById('modal-owner');
259
  const modalLink = document.getElementById('modal-link');
260
  const modalDelete = document.getElementById('modal-delete');
261

262
  let selectedFile = null;
263

264
  // 更新时间
265
  function updateServerTime() {
266
    serverTimeSpan.textContent = new Date().toLocaleString('zh-CN', { hour12: false });
267
  }
268
  updateServerTime();
269
  setInterval(updateServerTime, 1000);
270

271
  // PHP状态检测
272
  async function checkPhpStatus() {
273
    try {
274
      const res = await fetch('index.php?action=phpinfo', { cache: 'no-store' });
275
      if (res.ok) {
276
        const data = await res.json();
277
        if (data && data.php === 'active') {
278
          phpIndicator.className = 'php-status badge-success';
279
          phpIndicator.innerHTML = '✅ PHP 已连接';
280
          phpTextSpan.textContent = '运行正常';
281
          return true;
282
        }
283
      }
284
      throw new Error('PHP异常');
285
    } catch (e) {
286
      phpIndicator.className = 'php-status badge-fail';
287
      phpIndicator.innerHTML = '❌ PHP 未连接';
288
      phpTextSpan.textContent = '不可用';
289
      return false;
290
    }
291
  }
292

293
  // ---------- 图片列表加载 ----------
294
  async function loadImageList() {
295
    try {
296
      const res = await fetch('index.php?action=listimages');
297
      const data = await res.json();
298
      if (data.status === 'success' && Array.isArray(data.images)) {
299
        renderGallery(data.images);
300
      } else {
301
        galleryDiv.innerHTML = '<span style="color:#64748b; font-size:0.9rem;">暂无图片</span>';
302
      }
303
    } catch (e) {
304
      galleryDiv.innerHTML = '<span style="color:#ef4444;">加载图片列表失败</span>';
305
    }
306
  }
307

308
  function renderGallery(images) {
309
    if (images.length === 0) {
310
      galleryDiv.innerHTML = '<span style="color:#64748b; font-size:0.9rem;">暂无图片</span>';
311
      return;
312
    }
313
    galleryDiv.innerHTML = images.map(img => `
314
      <div class="gallery-item" data-filename="${img.name}" onclick="openImageDetail('${img.name}')">
315
        <img src="img/${img.name}" alt="${img.name}">
316
        <span class="delete-icon" onclick="event.stopPropagation(); deleteImage('${img.name}')">✕</span>
317
      </div>
318
    `).join('');
319
  }
320

321
  // 打开详情弹窗
322
  async function openImageDetail(filename) {
323
    // 请求该图片的详细信息
324
    try {
325
      const res = await fetch(`index.php?action=imageinfo&file=${encodeURIComponent(filename)}`);
326
      const data = await res.json();
327
      if (data.status === 'success') {
328
        modalImg.src = `img/${filename}`;
329
        modalName.textContent = filename;
330
        modalSize.textContent = data.size;
331
        modalMtime.textContent = data.mtime;
332
        modalOwner.textContent = data.owner;
333
        modalLink.href = `img/${filename}`;
334
        modalDelete.setAttribute('data-filename', filename);
335
        modal.classList.add('active');
336
      } else {
337
        alert('获取图片信息失败');
338
      }
339
    } catch (e) {
340
      alert('请求失败');
341
    }
342
  }
343

344
  // 关闭弹窗
345
  closeModal.addEventListener('click', () => modal.classList.remove('active'));
346
  window.addEventListener('click', (e) => {
347
    if (e.target === modal) modal.classList.remove('active');
348
  });
349

350
  // 删除图片
351
  async function deleteImage(filename) {
352
    if (!confirm(`确定要删除 ${filename} 吗？`)) return;
353
    try {
354
      const formData = new FormData();
355
      formData.append('action', 'deleteimage');
356
      formData.append('filename', filename);
357
      const res = await fetch('index.php', { method: 'POST', body: formData });
358
      const data = await res.json();
359
      if (data.status === 'success') {
360
        loadImageList();
361
        // 如果模态框正显示该图片则关闭
362
        if (modalDelete.getAttribute('data-filename') === filename) {
363
          modal.classList.remove('active');
364
        }
365
      } else {
366
        alert('删除失败: ' + data.message);
367
      }
368
    } catch (e) {
369
      alert('删除请求异常');
370
    }
371
  }
372

373
  // 模态框内删除按钮
374
  modalDelete.addEventListener('click', () => {
375
    const filename = modalDelete.getAttribute('data-filename');
376
    if (filename) deleteImage(filename);
377
  });
378

379
  // ---------- 上传逻辑 ----------
380
  uploadBox.addEventListener('click', () => fileInput.click());
381
  uploadBox.addEventListener('dragover', e => {
382
    e.preventDefault();
383
    uploadBox.style.borderColor = '#2563eb';
384
    uploadBox.style.background = '#f0f4ff';
385
  });
386
  uploadBox.addEventListener('dragleave', () => {
387
    uploadBox.style.borderColor = '#94a3b8';
388
    uploadBox.style.background = '#ffffff';
389
  });
390
  uploadBox.addEventListener('drop', e => {
391
    e.preventDefault();
392
    uploadBox.style.borderColor = '#94a3b8';
393
    uploadBox.style.background = '#ffffff';
394
    if (e.dataTransfer.files.length > 0) handleFileSelect(e.dataTransfer.files[0]);
395
  });
396
  fileInput.addEventListener('change', e => {
397
    if (e.target.files.length > 0) handleFileSelect(e.target.files[0]);
398
  });
399

400
  function handleFileSelect(file) {
401
    if (!file.type.startsWith('image/')) {
402
      alert('请选择图片文件');
403
      return;
404
    }
405
    selectedFile = file;
406
    const reader = new FileReader();
407
    reader.onload = e => {
408
      previewImg.src = e.target.result;
409
      previewImg.style.display = 'block';
410
    };
411
    reader.readAsDataURL(file);
412
    uploadMessage.textContent = `已选择: ${file.name}`;
413
  }
414

415
  uploadBtn.addEventListener('click', async () => {
416
    if (!selectedFile) {
417
      uploadMessage.textContent = '⚠️ 请先选择图片';
418
      return;
419
    }
420
    const formData = new FormData();
421
    formData.append('image', selectedFile);
422
    uploadBtn.disabled = true;
423
    uploadMessage.textContent = '⏳ 上传中...';
424

425
    try {
426
      const res = await fetch('index.php?action=upload', { method: 'POST', body: formData });
427
      const result = await res.json();
428
      if (result.status === 'success') {
429
        uploadMessage.textContent = '✅ 上传成功';
430
        previewImg.style.display = 'none';
431
        selectedFile = null;
432
        fileInput.value = '';
433
        loadImageList(); // 刷新列表
434
      } else {
435
        uploadMessage.textContent = `❌ ${result.message || '上传失败'}`;
436
      }
437
    } catch (err) {
438
      uploadMessage.textContent = '❌ 网络错误或PHP未响应';
439
    } finally {
440
      uploadBtn.disabled = false;
441
    }
442
  });
443

444
  // ---------- 数据库测试 ----------
445
  testDbBtn.addEventListener('click', async () => {
446
    const host = document.getElementById('db-host').value.trim();
447
    const port = document.getElementById('db-port').value.trim();
448
    const user = document.getElementById('db-user').value.trim();
449
    const pass = document.getElementById('db-pass').value;
450
    const dbname = document.getElementById('db-name').value.trim();
451

452
    if (!host || !port || !user) {
453
      dbResultDiv.innerHTML = '⚠️ 主机、端口、用户不能为空';
454
      dbResultDiv.style.color = '#b45309';
455
      tablesInfoDiv.style.display = 'none';
456
      return;
457
    }
458

459
    dbResultDiv.innerHTML = '⏳ 正在测试连接...';
460
    dbResultDiv.style.color = '#1e293b';
461
    tablesInfoDiv.style.display = 'none';
462
    testDbBtn.disabled = true;
463

464
    try {
465
      const formData = new FormData();
466
      formData.append('action', 'dbtest');
467
      formData.append('db_host', host);
468
      formData.append('db_port', port);
469
      formData.append('db_user', user);
470
      formData.append('db_pass', pass);
471
      formData.append('db_name', dbname);
472

473
      const res = await fetch('index.php', { method: 'POST', body: formData });
474
      const result = await res.json();
475
      if (result.status === 'success') {
476
        dbResultDiv.innerHTML = '✅ 数据库连接成功';
477
        dbResultDiv.style.color = '#166534';
478
        await fetchTableList(host, port, user, pass, dbname);
479
      } else {
480
        dbResultDiv.innerHTML = `❌ 连接失败: ${result.message || '未知错误'}`;
481
        dbResultDiv.style.color = '#991b1b';
482
      }
483
    } catch (err) {
484
      dbResultDiv.innerHTML = '❌ 请求异常，PHP可能未运行';
485
      dbResultDiv.style.color = '#991b1b';
486
    } finally {
487
      testDbBtn.disabled = false;
488
    }
489
  });
490

491
  async function fetchTableList(host, port, user, pass, dbname) {
492
    tablesInfoDiv.style.display = 'none';
493
    try {
494
      const formData = new FormData();
495
      formData.append('action', 'listtables');
496
      formData.append('db_host', host);
497
      formData.append('db_port', port);
498
      formData.append('db_user', user);
499
      formData.append('db_pass', pass);
500
      formData.append('db_name', dbname);
501

502
      const res = await fetch('index.php', { method: 'POST', body: formData });
503
      const data = await res.json();
504
      if (data.status === 'success') {
505
        tablesCountSpan.textContent = `📊 当前数据库共有 ${data.table_count} 张表`;
506
        tablesListDiv.innerHTML = data.tables && data.tables.length
507
          ? data.tables.map(t => `<span style="background:#e2e8f0; padding:0.2rem 0.6rem; border-radius:1rem; margin:0.2rem; display:inline-block;">${t}</span>`).join('')
508
          : '（无表）';
509
        tablesInfoDiv.style.display = 'block';
510
      } else {
511
        tablesInfoDiv.innerHTML = `<span style="color:#991b1b;">❌ 获取表信息失败: ${data.message}</span>`;
512
        tablesInfoDiv.style.display = 'block';
513
      }
514
    } catch (e) {
515
      tablesInfoDiv.innerHTML = '<span style="color:#991b1b;">❌ 查询表请求异常</span>';
516
      tablesInfoDiv.style.display = 'block';
517
    }
518
  }
519

520
  // 页面初始化
521
  checkPhpStatus();
522
  loadImageList();
523
</script>
524
</body>
525
</html>

index.php#

1
(.venv) [root@ops-admin Projects]# vim ./nginx/index.php

1
<?php
2
/**
3
 * 运维默认页后端接口
4
 * 支持：PHP状态、图片上传/列表/详情/删除、数据库连接/表查询
5
 */
6
header('Access-Control-Allow-Origin: *');
7
header('Content-Type: application/json; charset=utf-8');
8

9
$action = $_GET['action'] ?? $_POST['action'] ?? '';
10

11
switch ($action) {
12
    case 'phpinfo':
13
        echo json_encode(['php' => 'active', 'version' => PHP_VERSION]);
14
        break;
15
    case 'upload':
16
        handleUpload();
17
        break;
18
    case 'listimages':
19
        listImages();
20
        break;
21
    case 'imageinfo':
22
        imageInfo();
23
        break;
24
    case 'deleteimage':
25
        deleteImage();
26
        break;
27
    case 'dbtest':
28
        testDatabaseConnection();
29
        break;
30
    case 'listtables':
31
        listTables();
32
        break;
33
    default:
34
        http_response_code(400);
35
        echo json_encode(['status' => 'error', 'message' => '未知操作']);
36
}
37

38
/**
39
 * 图片上传
40
 */
41
function handleUpload() {
42
    $uploadDir = __DIR__ . '/img/';
43
    if (!is_dir($uploadDir)) {
44
        mkdir($uploadDir, 0755, true);
45
    }
46

47
    if (!isset($_FILES['image'])) {
48
        echo json_encode(['status' => 'error', 'message' => '没有收到文件']);
49
        return;
50
    }
51

52
    $file = $_FILES['image'];
53
    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
54
    if (!in_array($file['type'], $allowedTypes)) {
55
        echo json_encode(['status' => 'error', 'message' => '仅支持 JPG/PNG/GIF']);
56
        return;
57
    }
58

59
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
60
    $newName = uniqid('img_', true) . '.' . $ext;
61
    $destPath = $uploadDir . $newName;
62

63
    if (!move_uploaded_file($file['tmp_name'], $destPath)) {
64
        echo json_encode(['status' => 'error', 'message' => '文件移动失败，检查权限']);
65
        return;
66
    }
67

68
    echo json_encode(['status' => 'success', 'message' => '上传成功', 'filename' => $newName]);
69
}
70

71
/**
72
 * 列出所有图片（简单列表，含文件名）
73
 */
74
function listImages() {
75
    $imgDir = __DIR__ . '/img/';
76
    if (!is_dir($imgDir)) {
77
        echo json_encode(['status' => 'success', 'images' => []]);
78
        return;
79
    }
80

81
    $files = array_diff(scandir($imgDir), ['.', '..']);
82
    $images = [];
83
    foreach ($files as $file) {
84
        $ext = strtolower(pathinfo($file, PATHINFO_EXTENSION));
85
        if (in_array($ext, ['jpg', 'jpeg', 'png', 'gif'])) {
86
            $images[] = ['name' => $file];
87
        }
88
    }
89
    echo json_encode(['status' => 'success', 'images' => array_values($images)]);
90
}
91

92
/**
93
 * 获取单张图片详细信息
94
 */
95
function imageInfo() {
96
    $filename = $_GET['file'] ?? '';
97
    if (empty($filename)) {
98
        echo json_encode(['status' => 'error', 'message' => '缺少文件名']);
99
        return;
100
    }
101

102
    // 安全检查：不允许路径遍历
103
    if (strpos($filename, '/') !== false || strpos($filename, '\\') !== false || $filename === '.' || $filename === '..') {
104
        echo json_encode(['status' => 'error', 'message' => '非法的文件名']);
105
        return;
106
    }
107

108
    $filePath = __DIR__ . '/img/' . $filename;
109
    if (!file_exists($filePath)) {
110
        echo json_encode(['status' => 'error', 'message' => '文件不存在']);
111
        return;
112
    }
113

114
    $size = filesize($filePath);
115
    $mtime = date("Y-m-d H:i:s", filemtime($filePath));
116
    $owner = 'unknown';
117
    if (function_exists('posix_getpwuid')) {
118
        $ownerInfo = posix_getpwuid(fileowner($filePath));
119
        $owner = $ownerInfo ? $ownerInfo['name'] : 'unknown';
120
    }
121

122
    echo json_encode([
123
        'status' => 'success',
124
        'size' => formatBytes($size),
125
        'mtime' => $mtime,
126
        'owner' => $owner
127
    ]);
128
}
129

130
/**
131
 * 删除图片
132
 */
133
function deleteImage() {
134
    $filename = $_POST['filename'] ?? '';
135
    if (empty($filename)) {
136
        echo json_encode(['status' => 'error', 'message' => '缺少文件名']);
137
        return;
138
    }
139

140
    // 路径遍历检查
141
    if (strpos($filename, '/') !== false || strpos($filename, '\\') !== false || $filename === '.' || $filename === '..') {
142
        echo json_encode(['status' => 'error', 'message' => '非法的文件名']);
143
        return;
144
    }
145

146
    $filePath = __DIR__ . '/img/' . $filename;
147
    if (!file_exists($filePath)) {
148
        echo json_encode(['status' => 'error', 'message' => '文件不存在']);
149
        return;
150
    }
151

152
    if (unlink($filePath)) {
153
        echo json_encode(['status' => 'success', 'message' => '删除成功']);
154
    } else {
155
        echo json_encode(['status' => 'error', 'message' => '删除失败，权限不足']);
156
    }
157
}
158

159
// 以下为原有数据库相关函数（略作保留，内容不变）
160
function testDatabaseConnection() {
161
    $host = $_POST['db_host'] ?? '';
162
    $port = $_POST['db_port'] ?? '3306';
163
    $user = $_POST['db_user'] ?? '';
164
    $pass = $_POST['db_pass'] ?? '';
165
    $dbname = $_POST['db_name'] ?? '';
166

167
    if (empty($host) || empty($user)) {
168
        echo json_encode(['status' => 'error', 'message' => '主机和用户不能为空']);
169
        return;
170
    }
171

172
    try {
173
        $dsn = "mysql:host=$host;port=$port;dbname=$dbname;charset=utf8mb4";
174
        $pdo = new PDO($dsn, $user, $pass, [
175
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
176
            PDO::ATTR_TIMEOUT => 3
177
        ]);
178
        echo json_encode(['status' => 'success', 'message' => '数据库连接成功']);
179
    } catch (PDOException $e) {
180
        echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
181
    }
182
}
183

184
function listTables() {
185
    $host = $_POST['db_host'] ?? '';
186
    $port = $_POST['db_port'] ?? '3306';
187
    $user = $_POST['db_user'] ?? '';
188
    $pass = $_POST['db_pass'] ?? '';
189
    $dbname = $_POST['db_name'] ?? '';
190

191
    if (empty($host) || empty($user) || empty($dbname)) {
192
        echo json_encode(['status' => 'error', 'message' => '参数不完整']);
193
        return;
194
    }
195

196
    try {
197
        $dsn = "mysql:host=$host;port=$port;dbname=$dbname;charset=utf8mb4";
198
        $pdo = new PDO($dsn, $user, $pass, [
199
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
200
            PDO::ATTR_TIMEOUT => 3
201
        ]);
202
        $stmt = $pdo->query("SHOW TABLES");
203
        $tables = $stmt->fetchAll(PDO::FETCH_COLUMN);
204
        echo json_encode([
205
            'status' => 'success',
206
            'table_count' => count($tables),
207
            'tables' => $tables
208
        ]);
209
    } catch (PDOException $e) {
210
        echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
211
    }
212
}
213

214
function formatBytes($bytes, $precision = 2) {
215
    $units = ['B', 'KB', 'MB', 'GB', 'TB'];
216
    $bytes = max($bytes, 0);
217
    $pow = floor(($bytes ? log($bytes) : 0) / log(1024));
218
    $pow = min($pow, count($units) - 1);
219
    return round($bytes / (1024 ** $pow), $precision) . ' ' . $units[$pow];
220
}

playbook#

1
(.venv) [root@ops-admin Projects]# vim playbook-nginx.yml

1
- hosts: lb01,web01,web02
2
  tasks:
3
    - name: "配置nginx的源"
4
      yum_repository:
5
        name: nginx-stable
6
        description: nginx stable repo
7
        baseurl: https://nginx.org/packages/centos/$releasever/$basearch/
8
        gpgcheck: no
9
        enabled: yes
10
    - name: "安装nginx"
11
      package:
12
        name: nginx
13
        state: present
14
    - name: "创建www组"
15
      group:
16
        name: www
17
        gid: 888
18
    - name: "创建www用户"
19
      user:
20
        name: www
21
        uid: 888
22
        group: www
23
        shell: /sbin/nologin
24
        create_home: false
25
    - name: "配置Nginx的主配置文件"
26
      copy:
27
        src: ./nginx/nginx.conf
28
        dest: /etc/nginx/
29
    - name: "启动nginx"
30
      systemd:
31
        name: nginx
32
        state: started
33
        enabled: yes
34

35
- hosts:
36
    - web01
37
    - web02
38
  tasks:
39
    - name: "安装php服务"
40
      package:
41
        name:
42
          - php
43
          - php-bcmath
44
          - php-cli
45
          - php-common
46
          - php-devel
47
          - php-embedded
48
          - php-fpm
49
          - php-gd
50
          - php-intl
51
          - php-mbstring
52
          - php-mysqlnd
53
          - php-opcache
54
          - php-pdo
55
          - php-process
56
          - php-xml
57
          - php-json
58
        state: present
59
    - name: "拷贝配置文件"
60
      copy:
61
        src: "{{ item.src }}"
62
        dest: "{{ item.dest }}"
63
      loop:
64
       - src: ./nginx/www.conf
65
         dest: /etc/php-fpm.d/
66
       - src: ./nginx/php.ini
67
         dest: /etc/
68
       - src: ./nginx/index.php
69
         dest: /usr/share/nginx/html
70
    - name: "启动php服务"
71
      systemd:
72
        name: php-fpm
73
        state: started
74
        enabled: yes
75
    - name: "拷贝index.html和default.conf"
76
      template:
77
        src: "{{ item.src }}"
78
        dest: "{{ item.dest }}"
79
      loop:
80
        - src: ./nginx/default.conf.j2
81
          dest: /etc/nginx/conf.d/default.conf
82
        - src: ./nginx/index.html.j2
83
          dest: /usr/share/nginx/html/index.html
84
    - name: "创建img目录存在"
85
      file:
86
        path: /usr/share/nginx/html/img
87
        state: directory
88
        owner: www
89
        group: www
90
        mode: '0755'
91
    - name: "递归修改站点目录属主"
92
      file:
93
        path: /usr/share/nginx/html
94
        state: directory
95
        owner: www
96
        group: www
97
        recurse: yes
98

99
- hosts: lb01
100
  tasks:
101
    - name: "拷贝lb配置文件"
102
      copy:
103
        src: "{{ item.src }}"
104
        dest: "{{ item.dest }}"
105
      loop:
106
       - src: ./nginx/lb.conf
107
         dest: /etc/nginx/conf.d/
108
       - src: ./nginx/proxy_set
109
         dest: /etc/nginx/
110

111
- hosts: lb01,web01,web02
112
  tasks:
113
    - name: "重启nginx服务"
114
      systemd:
115
        name: nginx
116
        state: restarted

1
(.venv) [root@ops-admin Projects]# ansible-playbook playbook-nginx.yml

share共享存储#

在share01节点部署mysql和nfs
在mysql中创建测试库表
数据库不允许匿名访问，设置root密码为Redhat@123，创建php用于连接的用户webuser，设置密码为Redhat@123
在nfs中创建共享目录/webshare,共享web页面（test.html、test.php）
test.php用于展示mysql测试库表的内容
将nfs的共享目录挂载到web01和web02的web根目录/webdir
web01和web02与share01的服务通信（php-fpm和nfs）使用ens3网卡

基础配置#

1
(.venv) [root@ops-admin Projects]# mkdir -p share
2
(.venv) [root@ops-admin Projects]# cat > ./share/exports.j2 <<'EOF'
3
{{dir}} 10.2.3.0/24(rw,sync,all_squash,anonuid={{uid}},anongid={{uid}})
4
{{wpdir}} 10.2.3.0/24(rw,sync,all_squash,anonuid={{uid}},anongid={{uid}})
5
EOF

mysql安装脚本#

1
(.venv) [root@ops-admin sh]# pwd
2
/server/sh
3
(.venv) [root@ops-admin sh]# vim install_mysql.sh

1
#!/bin/bash
2

3
# ============================================================
4
# 脚本功能：在 Rocky Linux 9 上通过本地 RPM 包离线安装 MySQL 8.0.36
5
# 适用场景：已将 mysql-8.0.36-1.el9.x86_64.rpm-bundle.tar 解压到 /tmp 目录
6
# ============================================================
7

8
# ------ 颜色定义（方便提示） ------
9
RED='\033[31m'
10
GREEN='\033[32m'
11
YELLOW='\033[33m'
12
BLUE='\033[34m'
13
NC='\033[0m' # 无颜色
14

15
# ------ 检查是否以 root 运行 ------
16
if [ "$EUID" -ne 0 ]; then
17
    echo -e "${RED}错误：请使用 root 用户执行此脚本！${NC}"
18
    exit 1
19
fi
20

21
# ------ 检查是否已安装 MySQL ------
22
if rpm -q mysql-community-server &>/dev/null; then
23
    echo -e "${YELLOW}警告：检测到 MySQL 已安装，为避免冲突，脚本退出。${NC}"
24
    echo -e "${YELLOW}如需重新安装，请先卸载现有版本。${NC}"
25
    exit 0
26
fi
27

28
# ------ 定义变量 ------
29
RPM_DIR="/tmp"
30
LOG_FILE="/var/log/mysqld.log"
31
TEMP_PASS=""
32
NEW_PASS="passwd"          # 最终设置的 root 密码
33
DB_NAME="wp"
34
DB_USER="wpuser"
35
DB_PASS="passwd"
36

37
echo -e "${BLUE}>>> 步骤1：切换到 RPM 包目录 ${RPM_DIR}${NC}"
38
cd "$RPM_DIR" || { echo -e "${RED}错误：无法进入目录 $RPM_DIR${NC}"; exit 1; }
39

40
# ------ 安装 RPM 包（使用 dnf 自动解决依赖） ------
41
echo -e "${BLUE}>>> 步骤2：安装 MySQL 8.0.36 RPM 包${NC}"
42
dnf install -y \
43
    mysql-community-common-8.0.36-1.el9.x86_64.rpm \
44
    mysql-community-icu-data-files-8.0.36-1.el9.x86_64.rpm \
45
    mysql-community-libs-8.0.36-1.el9.x86_64.rpm \
46
    mysql-community-client-plugins-8.0.36-1.el9.x86_64.rpm \
47
    mysql-community-client-8.0.36-1.el9.x86_64.rpm \
48
    mysql-community-server-8.0.36-1.el9.x86_64.rpm \
49
    mysql-community-devel-8.0.36-1.el9.x86_64.rpm
50

51
if [ $? -ne 0 ]; then
52
    echo -e "${RED}错误：RPM 安装失败，请检查包是否完整。${NC}"
53
    exit 1
54
fi
55
echo -e "${GREEN}✓ RPM 安装完成${NC}"
56

57
# ------ 清理安装包（删除 /tmp 下所有 .rpm 文件） ------
58
echo -e "${BLUE}>>> 步骤3：删除临时 RPM 文件${NC}"
59
ls | grep -v mysql-community-server-8.0.36-1.el9.x86_64.rpm | xargs rm -rf "$RPM_DIR"/*.rpm
60
echo -e "${GREEN}✓ 清理完成${NC}"
61

62
# ------ 启动 MySQL 服务 ------
63
echo -e "${BLUE}>>> 步骤4：启动 mysqld 并设置开机自启${NC}"
64
systemctl enable --now mysqld &>/dev/null
65
if [ $? -ne 0 ]; then
66
    echo -e "${RED}错误：MySQL 服务启动失败，请检查日志 $LOG_FILE${NC}"
67
    exit 1
68
fi
69
echo -e "${GREEN}✓ MySQL 服务已启动${NC}"
70

71
# ------ 等待服务完全就绪（避免日志尚未生成） ------
72
sleep 3
73

74
# ------ 从日志中提取临时密码 ------
75
echo -e "${BLUE}>>> 步骤5：获取 root 临时密码${NC}"
76
TEMP_PASS=$(grep 'temporary password' "$LOG_FILE" | awk '{print $NF}')
77
if [ -z "$TEMP_PASS" ]; then
78
    echo -e "${RED}错误：未找到临时密码，请检查 $LOG_FILE${NC}"
79
    exit 1
80
fi
81
echo -e "${GREEN}✓ 临时密码获取成功${NC}"
82

83
# ------ 连接数据库并执行初始化 SQL ------
84
echo -e "${BLUE}>>> 步骤6：修改密码策略并配置数据库${NC}"
85

86
# 注意：临时密码可能包含特殊字符，使用双引号包裹，并用 --connect-expired-password 选项
87
mysql --connect-expired-password -uroot -p"$TEMP_PASS" <<EOF
88
-- 1. 先修改 root 密码为复杂密码（必须符合默认策略：长度≥8，含大小写字母、数字、特殊字符）
89
ALTER USER 'root'@'localhost' IDENTIFIED BY 'Oldboy123.com';
90

91
-- 2. 调整密码策略（允许简单密码）
92
SET GLOBAL validate_password.length = 6;
93
SET GLOBAL validate_password.policy = 0;
94

95
-- 3. 修改 root 密码为 'passwd'
96
ALTER USER 'root'@'localhost' IDENTIFIED BY '${NEW_PASS}';
97

98
-- 4. 设置全局时区（东八区）
99
SET GLOBAL time_zone = '+8:00';
100

101
-- 5. 创建数据库（指定字符集）
102
CREATE DATABASE IF NOT EXISTS ${DB_NAME} CHARACTER SET utf8 COLLATE utf8_bin;
103

104
-- 6. 创建用户（允许任何主机连接，生产环境请按需修改）
105
CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASS}';
106

107
-- 7. 使用 mysql_native_password 插件（兼容旧客户端）
108
ALTER USER '${DB_USER}'@'%' IDENTIFIED WITH mysql_native_password BY '${DB_PASS}';
109

110
-- 8. 授权：授予 ${DB_NAME} 库的所有权限
111
GRANT ALL PRIVILEGES ON ${DB_NAME}.* TO '${DB_USER}'@'%';
112

113
-- 9. 允许普通用户创建函数和触发器（Zabbix 等可能需要）
114
SET GLOBAL log_bin_trust_function_creators = 1;
115

116
-- 10. 刷新权限
117
FLUSH PRIVILEGES;
118
EOF
119

120
if [ $? -eq 0 ]; then
121
    echo -e "${GREEN}✓ 数据库初始化完成！${NC}"
122
    echo -e "${GREEN}=========================================${NC}"
123
    echo -e "${GREEN}  安装成功！${NC}"
124
    echo -e "${GREEN}  root 密码：${NEW_PASS}${NC}"
125
    echo -e "${GREEN}  数据库：${DB_NAME}${NC}"
126
    echo -e "${GREEN}  用户：${DB_USER}@'%'  密码：${DB_PASS}${NC}"
127
    echo -e "${GREEN}  时区已设置为东八区（+8:00）${NC}"
128
    echo -e "${GREEN}=========================================${NC}"
129
else
130
    echo -e "${RED}错误：SQL 执行失败，请检查日志。${NC}"
131
    exit 1
132
fi
133

134
# ------ 可选：重启服务使时区设置生效（其实动态设置已生效） ------
135
# systemctl restart mysqld
136

137
echo -e "${BLUE}>>> 安装全部完成，脚本结束。${NC}"

playbook#

1
- hosts: share01
2
  vars:
3
    dir: /webshare
4
    wpdir: /wp
5
    uid: 888
6
    user: www
7
  tasks:
8
    - name: "安装nfs服务"
9
      package:
10
        name: nfs-utils
11
        state: present
12
    - name: "拷贝配置文件"
13
      template:
14
        src: ./share/exports.j2
15
        dest: /etc/exports
16
    - name: "创建www组"
17
      group:
18
        name: "{{user}}"
19
        gid: "{{uid}}"
20
    - name: "创建www用户"
21
      user:
22
        name: "{{user}}"
23
        uid: "{{uid}}"
24
        group: "{{user}}"
25
        shell: /sbin/nologin
26
        create_home: false
27
    - name: "创建挂载目录"
28
      file:
29
        path: "{{dir}}"
30
        state: directory
31
        owner: "{{user}}"
32
        group: "{{user}}"
33
    - name: "启动nfs服务"
34
      systemd:
35
        name: nfs-server
36
        state: started
37
        enabled: yes
38
    - name: "解压MySQL压缩包"
39
      unarchive:
40
        src: ./share/mysql-8.0.36-1.el9.x86_64.rpm-bundle.tar
41
        dest: /tmp/
42
        remote_src: no
43
        creates: /tmp/mysql-community-server-8.0.36-1.el9.x86_64.rpm
44
        # 只要这个rpm包存在就不会重复解压
45
    - name: "拷贝mysql执行脚本"
46
      copy:
47
        src: /server/sh/install_mysql.sh
48
        dest: /server/sh/
49
    - name: "执行mysql安装脚本"
50
      shell: "bash /server/sh/install_mysql.sh"
51
      register: install_result
52
      ignore_errors: yes
53
    - name: "如果脚本执行失败，打印错误并中止"
54
      fail:
55
      # fail 模块：主动触发失败，并输出自定义消息
56
        msg: "❌ MySQL 安装失败，错误信息：{{ install_result.stderr_lines }}"
57
      when: install_result.rc != 0
58
      # 当脚本执行失败才执行
59
    - name: "脚本执行成功时打印成功信息"
60
      debug:
61
        msg: "✅ MySQL 安装成功！{{ install_result.stderr_lines }}"
62
      when: install_result.rc == 0
63

64
- hosts: web01,web02
65
  vars:
66
    dir: /webshare
67
  tasks:
68
    - name: "web服务安装nfs工具包"
69
      package:
70
        name: nfs-utils
71
        state: present
72
    - name: "web服务挂载共享目录"
73
      mount:
74
        src: 10.2.3.80:/{{dir}}
75
        path: /usr/share/nginx/html/img
76
        fstype: nfs
77
        state: mounted

Wordpress部署#

基础配置#

1
(.venv) [root@ops-admin Projects]# vim ./nginx/wp.conf

1
server {
2
    listen 80;
3
    server_name www.wp.com;
4
    root /code/wordpress;
5

6
    location / {
7
        index index.php index.html;
8
        }
9

10
    location ~ \.php$ {
11
        fastcgi_pass 127.0.0.1:9000;
12
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
13
        include fastcgi_params;
14
        }
15
}

Redis缓存#

1
(.venv) [root@ops-admin Projects]# vim ./share/valkey.conf
2
# 拷贝至 /etc/valkey/valkey.conf

1
bind 127.0.0.1 10.2.3.80
2
protected-mode yes
3
port 6379
4
tcp-backlog 511
5
unixsocket /run/valkey/valkey.sock
6
timeout 0
7
tcp-keepalive 300
8
daemonize no
9
pidfile /run/valkey/valkey.pid
10
loglevel notice
11
logfile /var/log/valkey/valkey.log
12
databases 16
13
always-show-logo no
14
hide-user-data-from-log yes
15
set-proc-title yes
16
proc-title-template "{title} {listen-addr} {server-mode}"
17
locale-collate ""
18
stop-writes-on-bgsave-error yes
19
rdbcompression yes
20
rdbchecksum yes
21
dbfilename dump.rdb
22
rdb-del-sync-files no
23
dir ./
24
replica-serve-stale-data yes
25
replica-read-only yes
26
repl-diskless-sync yes
27
repl-diskless-sync-delay 5
28
repl-diskless-sync-max-replicas 0
29
repl-diskless-load disabled
30
dual-channel-replication-enabled no
31
repl-disable-tcp-nodelay no
32
replica-priority 100
33
acllog-max-len 128
34
requirepass 123456
35
lazyfree-lazy-eviction yes
36
lazyfree-lazy-expire yes
37
lazyfree-lazy-server-del yes
38
replica-lazy-flush yes
39
lazyfree-lazy-user-del yes
40
lazyfree-lazy-user-flush yes
41
oom-score-adj no
42
oom-score-adj-values 0 200 800
43
disable-thp yes
44
appendonly no
45
appendfilename "appendonly.aof"
46
appenddirname "appendonlydir"
47
appendfsync everysec
48
no-appendfsync-on-rewrite no
49
auto-aof-rewrite-percentage 100
50
auto-aof-rewrite-min-size 64mb
51
aof-load-truncated yes
52
aof-use-rdb-preamble yes
53
aof-timestamp-enabled no
54

55
slowlog-log-slower-than 10000
56
slowlog-max-len 128
57
latency-monitor-threshold 0
58
notify-keyspace-events ""
59
hash-max-listpack-entries 512
60
hash-max-listpack-value 64
61
list-max-listpack-size -2
62
list-compress-depth 0
63
set-max-intset-entries 512
64
set-max-listpack-entries 128
65
set-max-listpack-value 64
66
zset-max-listpack-entries 128
67
zset-max-listpack-value 64
68
hll-sparse-max-bytes 3000
69
stream-node-max-bytes 4096
70
stream-node-max-entries 100
71
activerehashing yes
72
client-output-buffer-limit normal 0 0 0
73
client-output-buffer-limit replica 256mb 64mb 60
74
client-output-buffer-limit pubsub 32mb 8mb 60
75
hz 10
76
dynamic-hz yes
77
aof-rewrite-incremental-fsync yes
78
rdb-save-incremental-fsync yes
79
jemalloc-bg-thread yes

1
(.venv) [root@ops-admin Projects]# vim ./share/wp-config.php
2
# 拷贝至 /wp/wordpress/wp-config.php

1
<?php
2

3
define( 'DB_NAME', 'wp' );
4

5
define( 'DB_USER', 'wpuser' );
6

7
define( 'DB_PASSWORD', 'passwd' );
8

9
define( 'DB_HOST', '10.2.3.80' );
10

11
define( 'DB_CHARSET', 'utf8mb4' );
12

13
define( 'DB_COLLATE', '' );
14

15
define( 'AUTH_KEY',         'YYpir)>G!LZ53VG&{hG8j7$M+`Vc`a0S;uj*o)Cz$2vp>AZI-mt_c4`oVvZw:f7P' );
16
define( 'SECURE_AUTH_KEY',  '.Z$ntLw%}<7Cb9h2zA_].4k%ME6#Mkl^b@&F%s?ke<.Cnwt>WvEGJhL0:vl@e}m ' );
17
define( 'LOGGED_IN_KEY',    '8l=Atror^mZ>JkyzS`GlrR{muk8aZ=Jwy2<*s*|p@$DKBcxW{4S7vb@s*EbwP`bN' );
18
define( 'NONCE_KEY',        'pqS&i&3-r#PhgGS{ {7/Sg}+Jk%{G9Zt+4NsD80&n!a.8%Cr_,o^Ex2xRbTy-zsa' );
19
define( 'AUTH_SALT',        '+SluVE?F;||2f0&a&`;-b=K{}_(5h6Gx(~=&S8&R_+mr[b/H](8*5ES&r(Yb[<(G' );
20
define( 'SECURE_AUTH_SALT', 'O`SY9|ks|,}SSk3#7m`I6HYav,(rNQDVXt#ETaduD#A@V,Y&EsAN-x-vf{wGUdX>' );
21
define( 'LOGGED_IN_SALT',   '$1VZ-eT5d4;:h#NppV]ROT:$>j]W Dbgx{#MxrV[}.E|@g#Sj=$;:!V#^~=Vs= }' );
22
define( 'NONCE_SALT',       'qc.s=BnM}uFC{Ws{JKkl@=0A+1*,RKuDw*+X7`;11u?3eT.a?X}N!&Oi5e$C6U)m' );
23

24
$table_prefix = 'wp_';
25

26
define( 'WP_DEBUG', false );
27

28
/* Add any custom values between this line and the "stop editing" line. */
29

30
define('WP_REDIS_HOST', '10.2.3.80');
31
define('WP_REDIS_PORT', 6379);
32
define('WP_REDIS_PASSWORD', '123456');
33

34
/* That's all, stop editing! Happy publishing. */
35

36
if ( ! defined( 'ABSPATH' ) ) {
37
  define( 'ABSPATH', __DIR__ . '/' );
38
}
39

40
require_once ABSPATH . 'wp-settings.php';

playbook#

1
(.venv) [root@ops-admin Projects]# vim playbook-wp.yml

1
- hosts: share01
2
  vars:
3
    wpdir: /wp
4
    dir: /webshare
5
    user: www
6
    uid: 888
7
  tasks:
8
    - name: "拷贝配置文件"
9
      template:
10
        src: ./share/exports.j2
11
        dest: /etc/exports
12
    - name: "创建挂载目录"
13
      file:
14
        path: "{{wpdir}}"
15
        state: directory
16
        owner: "{{user}}"
17
        group: "{{user}}"
18
    - name: "重启nfs服务"
19
      systemd:
20
        name: nfs-server
21
        state: restarted
22
    - name: "下载wordpress包"
23
      get_url:
24
        url: https://cn.wordpress.org/latest-zh_CN.zip
25
        dest: /tmp/
26
        force: no
27
    - name: "解压WordPress"
28
      unarchive:
29
        src: /tmp/wordpress-7.0-zh_CN.zip
30
        remote_src: yes
31
        dest: "{{wpdir}}"
32
        creates: "{{wpdir}}/wordpress"
33
    - name: "递归修改wordpress目录下的属主&属组"
34
      file:
35
        path: "{{wpdir}}/wordpress"
36
        owner: www
37
        group: www
38
        recurse: yes
39
    - name: "下载valkey缓存"
40
      package:
41
        name: valkey
42
        state: present
43
    - name: "拷贝配置文件 varkey.conf & wp-config.php"
44
      copy:
45
        src: "{{item.src}}"
46
        dest: "{{item.dest}}"
47
      loop:
48
        - src: ./share/valkey.conf
49
          dest: /etc/valkey/valkey.conf
50
        - src: ./share/wp-config.php
51
          dest: /wp/wordpress/wp-config.php
52
    - name: "启动 & 开机自启"
53
      systemd:
54
        name: valkey
55
        state: started
56
        enabled: yes
57

58
- hosts: web01,web02
59
  vars:
60
    wpdir: /wp
61
  tasks:
62
    - name: "下载php-redis插件"
63
      package:
64
        name: php-redis
65
        state: present
66
    - name: "拷贝配置文件"
67
      copy:
68
        src: ./nginx/wp.conf
69
        dest: /etc/nginx/conf.d/
70
    - name: "创建code目录"
71
      file:
72
        path: /code/
73
        state: directory
74
        owner: www
75
        group: www
76
    - name: "web服务挂载共享目录"
77
      mount:
78
        src: "10.2.3.80:{{wpdir}}"
79
        path: /code
80
        fstype: nfs
81
        state: mounted
82
    - name: "重启nginx & php-fpm服务"
83
      systemd:
84
        name: "{{item.name}}"
85
        state: restarted
86
      loop:
87
        - name: nginx
88
        - name: php-fpm
89

90
- hosts: lb01
91
  tasks:
92
    - name: "修改lb.conf配置文件"
93
      lineinfile:
94
        path: /etc/nginx/conf.d/lb.conf
95
        regexp: "{{item.regexp}}"
96
        line: "{{item.line}}"
97
      loop:
98
        - regexp: "server.*71:8000;"
99
          line: "    server 10.2.2.71:80;"
100
        - regexp: "server.*72:8000;"
101
          line: "    server 10.2.2.72:80;"
102
    - name: "重启nginx服务"
103
      systemd:
104
        name: nginx
105
        state: restarted

Note

数据库root用户：passwd

WordPress数据库：wp
用户：wpuser
密码：passwd
默认的表前缀

管理员用户：admin
密码：Oldboy123.com

Tip

WordPress 博客安装 redis 插件，并启用

Waf雷池#

在waf01节点部署雷池waf

参考雷池 WAF 帮助文档
所需变量写入vars.yml文件中

图形化安装#

1
'最小化节点没有浏览器，所以需要安装图形化'
2
# 雷池的应用证书，应该在雷池节点导入
3

4
yum -y groupinstall 'Server with GUI'
5
# 安装图形化
6
systemctl set-default graphical.target
7
# 设置默认进入图形界面
8
systemctl isolate graphical.target
9
# 切换到图形界面

安装脚本#

1
#!/bin/bash
2
set -e  # 遇到错误立即退出
3

4
# ===== 1. 安装 iptables-nft（如果未安装） =====
5
if ! rpm -q iptables-nft &>/dev/null; then
6
    echo "正在安装 iptables-nft..."
7
    dnf install -y iptables-nft
8
else
9
    echo "iptables-nft 已安装，跳过。"
10
fi
11

12
# ===== 2. 安装 Docker（如果未安装） =====
13
if ! command -v docker &>/dev/null; then
14
    echo "Docker 未安装，开始安装..."
15
    curl -sSL kpyun.fun/scripts/install-docker.sh | bash -s i
16
else
17
    echo "Docker 已安装，跳过。"
18
fi
19

20
# ===== 新增：创建 Docker Compose 插件软链接（仅当不存在时） =====
21
mkdir -p /usr/libexec/docker/cli-plugins/
22
# 先判断软链接是否存在，已存在则跳过
23
if [ ! -L /usr/libexec/docker/cli-plugins/docker-compose ]; then
24
    # 软链接不存在，再判断源文件是否存在，避免无效链接
25
    if [ -f /usr/local/docker/docker-compose ]; then
26
      # 源文件存在，且软链接不存在则，创建软链接
27
        ln -s /usr/local/docker/docker-compose /usr/libexec/docker/cli-plugins/docker-compose
28
        echo "软链接已创建：/usr/libexec/docker/cli-plugins/docker-compose -> /usr/local/docker/docker-compose"
29
    else
30
        echo "警告：源文件 /usr/local/docker/docker-compose 不存在，跳过软链接创建。"
31
    fi
32
else
33
    echo "软链接已存在，跳过。"
34
fi
35

36
# ===== 3. 准备 WAF 目录和 compose 文件 =====
37
mkdir -p /wp && cd /wp
38

39
# compose.yaml 每次都重新下载（文件小无需判断）
40
echo "下载 compose.yaml..."
41
wget -q -O compose.yaml "https://waf-ce.chaitin.cn/release/latest/compose.yaml"
42

43
# ===== 4. 生成 .env 环境变量文件（幂等：内容不变就不重复写） =====
44
# 用临时文件对比，避免每次都触发 docker-compose 重新创建
45
cat > .env.tmp <<'EOF'
46
SAFELINE_DIR=/wp
47
IMAGE_TAG=9.1.0-lts
48
MGT_PORT=9443
49
POSTGRES_PASSWORD=Redhat123
50
SUBNET_PREFIX=172.22.222
51
IMAGE_PREFIX=chaitin
52
ARCH_SUFFIX=
53
RELEASE=
54
REGION=
55
MGT_PROXY=0
56
EOF
57

58
if ! cmp -s .env .env.tmp 2>/dev/null; then
59
    mv .env.tmp .env
60
    echo ".env 文件已更新。"
61
else
62
    rm -f .env.tmp
63
    echo ".env 文件无变化，跳过。"
64
fi
65

66
# ===== 5. 导入 Docker 镜像（仅当镜像包存在时） =====
67
if [ -f /tmp/all-9.1.0-lts.tar ]; then
68
    echo "导入 Docker 镜像..."
69
    docker image load < /tmp/all-9.1.0-lts.tar
70
    rm -f /tmp/all-9.1.0-lts.tar
71
else
72
    echo "未找到镜像包 /tmp/all-9.1.0-lts.tar，跳过导入。"
73
fi
74

75
# ===== 6. 启动容器（docker-compose up -d 本身幂等） =====
76
docker-compose up -d
77

78
# ===== 7. 生成自签名证书（如果不存在） =====
79
mkdir -p ./ssl
80
if [ ! -f ./ssl/www.wp.com.key ] || [ ! -f ./ssl/www.wp.com.crt ]; then
81
    echo "生成自签名证书..."
82
    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
83
      -keyout ./ssl/www.wp.com.key \
84
      -out ./ssl/www.wp.com.crt \
85
      -subj "/C=CN/ST=Beijing/L=Beijing/O=Group2/CN=www.wp.com"
86
else
87
    echo "证书已存在，跳过生成。"
88
fi
89

90
echo "✅ 所有步骤完成。"

playbook#

1
- hosts: waf01,lb01,web01,web02
2
  tasks:
3
    - name: "添加 hosts 解析记录"
4
      lineinfile:
5
        path: /etc/hosts
6
        line: "10.2.2.50  www.wp.com"
7

8
- hosts: waf01
9
  vars:
10
    waf_image: "all-9.1.0-lts.tar"
11
    remote_image_path: "/tmp/{{ waf_image }}"
12
    compose_dir: "/wp"
13
  tasks:
14
    # 1. 安装 iptables-nft（yum/dnf 模块天然幂等）
15
    - name: "安装 iptables-nft 兼容包"
16
      dnf:
17
        name: iptables-nft
18
        state: present
19

20
    # 2. 安装 Docker（如果未安装则执行安装脚本，利用 creates 实现幂等）
21
    - name: "安装 Docker（若尚未安装）"
22
      shell: "curl -sSL kpyun.fun/scripts/install-docker.sh | bash -s i"
23
      args:
24
        creates: "/usr/bin/docker"   # 若 docker 二进制已存在，跳过执行
25

26
    # ***** 新增：创建 docker compose 插件软链接（仅当不存在时） *****
27
    - name: "创建 docker compose 插件软链接"
28
      shell: "ln -s /usr/local/docker/docker-compose /usr/libexec/docker/cli-plugins/docker-compose"
29
      args:
30
        creates: "/usr/libexec/docker/cli-plugins/docker-compose"   # 若目标链接已存在，跳过
31

32
    # ***** 新增：检查 safeline-mgt 镜像是否存在（用于后续条件判断） *****
33
    - name: "检查 safeline-mgt 镜像是否存在"
34
      shell: "docker image inspect chaitin/safeline-mgt:9.1.0-lts >/dev/null 2>&1"
35
      register: image_check
36
      failed_when: false  # 强制任务永远成功，不会标记为 failed
37
      changed_when: false   # 该任务不会改变系统状态，抑制changed
38

39
    # 3. 拷贝镜像包（copy 模块幂等：内容不变则不重复拷贝）
40
    - name: "拷贝雷池镜像包到远程"
41
      copy:
42
        src: "./waf/{{ waf_image }}"
43
        dest: "{{ remote_image_path }}"
44

45
    # 4. 创建工作目录并下载 compose.yaml
46
    - name: "创建 /wp 目录"
47
      file:
48
        path: "{{ compose_dir }}"
49
        state: directory
50

51
    - name: "下载最新 compose.yaml"
52
      get_url:
53
        url: "https://waf-ce.chaitin.cn/release/latest/compose.yaml"
54
        dest: "{{ compose_dir }}/compose.yaml"
55
        force: no
56
        # 如果存在，则不进行下载，不强制更新
57

58
    # 5. 生成 .env 文件（template 模块可控制幂等，但这里用 copy 提供固定内容）
59
    - name: "生成 .env 环境变量文件"
60
      copy:
61
        content: |
62
          SAFELINE_DIR=/wp
63
          IMAGE_TAG=9.1.0-lts
64
          MGT_PORT=9443
65
          POSTGRES_PASSWORD=Redhat123
66
          SUBNET_PREFIX=172.22.222
67
          IMAGE_PREFIX=chaitin
68
          ARCH_SUFFIX=
69
          RELEASE=
70
          REGION=
71
          MGT_PROXY=0
72
        dest: "{{ compose_dir }}/.env"
73
      # 如果文件内容不变，则不会触发变更
74

75
    # 6. 导入 Docker 镜像（仅当镜像包存在时执行）
76
    - name: "导入 Docker 镜像"
77
      shell: "docker image load < {{ remote_image_path }}"
78
      args:
79
        removes: "{{ remote_image_path }}"   # 只有文件存在时才执行，不存在则跳过
80
      # 执行后删除镜像包（可选）
81
      notify: "清理镜像包"
82

83
    # ***** 修改：7. 启动容器，仅在镜像不存在时执行 *****
84
    - name: "启动雷池容器（若镜像不存在）"
85
      community.docker.docker_compose_v2:
86
        project_src: "{{ compose_dir }}"
87
        state: present
88
      when: image_check.rc != 0   # 只有当镜像不存在时才启动
89

90
    # 8. 生成自签名证书
91
    - name: "确保 ssl 目录存在"
92
      file:
93
        path: "{{ compose_dir }}/ssl"
94
        state: directory
95

96
    - name: "生成自签名证书"
97
      shell: |
98
        openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
99
          -keyout /wp/ssl/www.wp.com.key \
100
          -out /wp/ssl/www.wp.com.crt \
101
          -subj "/C=CN/ST=Beijing/L=Beijing/O=Group2/CN=www.wp.com"
102
      args:
103
        creates: "/wp/ssl/www.wp.com.crt"   # 证书已存在则跳过，保证幂等
104

105
  handlers:
106
    - name: "清理镜像包"
107
      file:
108
        path: "{{ remote_image_path }}"
109
        state: absent

Note

creates 是 Ansible 为 shell/command 这类天然非幂等模块提供的最简幂等保障机制，用文件存在性作为”任务是否已完成”的判断依据

⚠️ 注意：creates 只检查文件/目录是否存在，不检查内容、版本或权限。如果 /usr/bin/docker 已存在但版本不对，任务仍会被跳过。

参数	逻辑	场景
`creates`	文件存在则跳过	安装/创建资源
`removes`	文件不存在则跳过	删除/清理资源

1
[root@waf01 wp]# docker exec safeline-mgt resetadmin
2
# 每次执行 resetadmin 会生成新密码
3
[INFO] Initial username：admin
4
[INFO] Initial password：5zb7qCqS
5
[INFO] Done
6
# 在打开页面之前生成一次密码，并在屏幕中捕获它~
7
# https://10.2.2.50:9443

1
[root@waf01 wp]# mkdir -p /usr/libexec/docker/cli-plugins/
2
[root@waf01 wp]# ln -s /usr/local/docker/docker-compose /usr/libexec/docker/cli-plugins/docker-compose
3
[root@waf01 wp]# docker compose version
4
Docker Compose version v2.29.2

Jumpserver#

1
[root@jumpserver ~]# dnf install -y iptables-nft
2
[root@jumpserver ~]# ls /tmp/
3
jumpserver-ce-v4.10.16-x86_64.tar.gz
4
[root@jumpserver ~]# tar xf /tmp/jumpserver-ce-v4.10.16-x86_64.tar.gz -C /opt/
5
[root@jumpserver ~]# cd /opt/jumpserver-ce-v4.10.16-x86_64/
6
[root@jumpserver jumpserver-ce-v4.10.16-x86_64]# ./jmsctl.sh install
7
>>> The Installation is Complete
8
1. You can use the following command to start, and then visit
9
cd /opt/jumpserver-ce-v4.10.16-x86_64
10
./jmsctl.sh start
11

12
2. Other management commands
13
./jmsctl.sh stop
14
./jmsctl.sh restart
15
./jmsctl.sh backup
16
./jmsctl.sh upgrade
17
For more commands, you can enter ./jmsctl.sh --help to understand
18

19
3. Web access
20
http://10.0.0.40:80
21
Default username: admin  Default password: ChangeMe
22

23
 More information
24
Official Website: https://www.jumpserver.com/
25
Documentation: https://www.jumpserver.com/docs
26

27

28
curl -sSL https://resource.fit2cloud.com/jumpserver/jumpserver/releases/latest/download/quick_start.sh | bash

音乐

音乐

Ansible角色#

彩蛋#

概述#

backup重构#

nfs重构#

主配置文件#

面试题#

项目实训#

Ansible管理#

环境准备#

密钥分发#

时钟同步#

GitLab 代码仓库#

环境要求与准备#

初始化配置#

Ansible 剧本 — 安装 Git#

推送代码到 GitLab#

Lb负载&Web服务#

基础环境准备#

index.html#

index.php#

playbook#

share共享存储#

基础配置#

mysql安装脚本#

playbook#

Wordpress部署#

基础配置#

Redis缓存#

playbook#

Waf雷池#

图形化安装#

安装脚本#

playbook#

Jumpserver#

文章分享

评论区

文章目录