ื ืื ืืึทื ื ืฆืืจืืง ืืื ืืืจืฃ ืฆื ืฉืจืืึทืื ืขืืืขืืข Ansible ืคึผืืืึทืืึธืึธืงืก ืฆื ืฆืืืจืืืื ืื ืกืขืจืืืขืจ ืคึฟืึทืจ ืืืคึผืืืืื ื ืึท ืจืึทืืืก ืึทืคึผืืึทืงืืืฉืึทื. ืืื, ืกืึทืคึผืจืืืืื ืืื, ืืื ืงืขื ื ืืฉื ืืขืคึฟืื ืขื ืึท ืคึผืฉืื ืฉืจืื-ืืืจื-ืฉืจืื ืืึทื ืืึทื. ืืื ืืึธื ื ืืฉื ืืขืืืึธืื ื ืึธืืืึทืื ืึทื ืึทื ืืขืจืก ืฉืคึผืืืืึธืึธืง ืึธื ืคึฟืึทืจืฉืืืื ืืืึธืก ืืื ืืขืฉืขื, ืืื ืฆืื ืกืืฃ ืืึธื ืืื ืืขืืืื ืืืืขื ืขื ืื ืืึทืงืืืืขื ืืึทืฆืืข, ืึทืืฒื ืึทืืฆืืื ื ืฆืื ืืืคึฟืงืืฒึทืื. ืืึธืืขืจ ืืื ืงืขื ืขื ืืขืืคึฟื ืขืืขืฆืขืจ ืฆื ืคืึทืจืืืืขืจื ืืขื ืคึผืจืึธืฆืขืก ืืื ืื ืืืืฃ ืคืื ืืขื ืึทืจืืืงื.
ืืขืจ ืขืจืฉืืขืจ ืืึทื ืฆื ืคึฟืึทืจืฉืืืื ืืื ืึทื ืึทื ืกืืืืข ืืื ืืืจ ืึท ืืึทืงืืืขื ืฆืืืื ื ืฆื ืืืจืืคืืจื ืึท ืคึผืจืขืืขืคืื ืขื ืจืฉืืื ืคืื ืึทืงืฉืึทื ื ืืืืฃ ืึท ืืืืึทื ืกืขืจืืืขืจ (s) ืืืจื SSH. ืขืก ืืื ืงืืื ืืึทืืืฉ ืืึธ, ืืืจ ืงืขื ืขื ื ืืฉื ืื ืกืืึทืืืจื ืึท ืคึผืืืืื ืืื ืืึทืงืืืขื ืึท ื ืื ืืึทืื ืืืื ืืืคึผืืืืืึทื ื ืคืื ืืืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืึธืงืงืขืจ, ืืึธื ืืืึธืจืื ื ืืื ืื ืืขืจืข ืืืืื ืืืืก ืคืื ืื ืงืขืกืื. ืืื ืกืืจ ืฆื ืฉืจืืึทืื ืึท ืคึผืืืึทืืึธืึธืง, ืืืจ ืืืื ืืืืกื ืืืึธืก ืคึผืื ืงื ืืืจ ืืืืื ืฆื ืืึธื ืืื ืืื ืฆื ืืึธื ืืึธืก. ืืขืจืคึฟืึทืจ ืืื ืืื ื ืืฉื ืฆืืคึฟืจืืื ืืื ืืจืืื-ืืขืืืื ืคึผืืืึทืืึธืึธืงืก ืคึฟืื GitHub, ืึธืืขืจ ืึทืจืืืงืืขื ืืื: "ืงืึธืคึผื ืืื ืืืืคื, ืขืก ืืืขื ืึทืจืืขืื."
ืืืึธืก ืืืจ ืืึทืจืคึฟื?
ืืื ืืื ืืื ืฉืืื ืืขืืืื, ืฆื ืฉืจืืึทืื ืึท ืคึผืืืึทืืึธืึธืง ืืืจ ืืึทืจืคึฟื ืฆื ืืืืกื ืืืึธืก ืืืจ ืืืืื ืฆื ืืึธื ืืื ืืื ืฆื ืืึธื ืืึธืก. ืืื ืก ืืึทืฉืืืกื ืืืึธืก ืืืจ ืืึทืจืคึฟื. ืคึฟืึทืจ ืึท ืจืึทืื ืึทืคึผืืึทืงืืืฉืึทื ืืืจ ืืึทืจืคึฟื ืขืืืขืืข ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื: nginx, postgresql (ืจืขืืืก, ืขืืง). ืืื ืืขืจืฆื, ืืืจ ืืึทืจืคึฟื ืึท ืกืคึผืขืฆืืคืืฉ ืืืขืจืกืืข ืคืื โโืจืืืื. ืขืก ืืื ืืขืกืืขืจ ืฆื ืื ืกืืึทืืืจื ืขืก ืืืจื rbenv (rvm, asdf ...). ืคืืืกื ืืืง ืึทืืข ืืขื ืืื ืึท ืืืึธืจืฆื ืืึทื ืืฆืขืจ ืืื ืฉืืขื ืืืง ืึท ืฉืืขืื ืืขืืึทื ืง, ืึทืืื ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืืึทืืื ืืขืจ ืืึทื ืืฆืขืจ ืืื ืงืึทื ืคืืืืขืจ ืืืื ืจืขืื. ื ืึธื ืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืฆืืคึฟืขืืืงืขืจ ืืื ืืืขืจ ืงืึธื ืฆื ืื ืกืขืจืืืขืจ, ื ืึธืืืึทืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืคึฟืึทืจ nginx, postgres, ืขืืง ืืื ืึธื ืืืืื ืึทืืข ืื ืกืขืจืืืืกืขืก.
ืืื ืึท ืจืขืืืืืึทื, ืื ืกืืงืืืึทื ืก ืคืื ืึทืงืฉืึทื ื ืืื ืืื ืืืื:
- ืืึธืืื ืืื ืืืึธืจืฆื
- ืื ืกืืึทืืืจื ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื
- ืฉืึทืคึฟื ืึท ื ืืึทืข ืืึทื ืืฆืขืจ, ืงืึทื ืคืืืืขืจ ืจืขืื, ssh key
- ืงืึทื ืคืืืืขืจ ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื (ื ืืื ืงืก ืขืืง) ืืื ืืืืคื ืืื
- ืืืจ ืืึทืื ืึท ืืึทื ืืฆืขืจ ืืื ืื ืืึทืืึทืืืืก (ืืืจ ืงืขื ื ืืืืื ืฉืึทืคึฟื ืึท ืืึทืืึทืืืืก)
- ืืึธืืื ืืื ืึท ื ืืึทืข ืืึทื ืืฆืขืจ
- ืื ืกืืึทืืืจื rbenv ืืื ruby
- ืื ืกืืึทืืืจื ืื ืืื ืืืขืจ
- ืืคึผืืึธืึทืืื ื ืื ืึทืคึผืืึทืงืืืฉืึทื ืงืึธื
- ืืึธื ืืฉืื ื ืื Puma ืกืขืจืืืขืจ
ืืขืจืฆื, ืื ืืขืฆืืข ืกืืึทืืขืก ืงืขื ืขื ืืืื ืืืจืืืขืงืึธืื ืืื ืงืึทืคึผืืกืืจืึทื ืึธ, ืืื ืืื ืืกืืขืจ ืืืืก ืคืื ืื ืงืขืกืื ืขืก ืงืขื ืขื ื ืึธืืืึทืื ืงืึธื ืืื ืืขืืืื ื ืืืืจืขืงืืขืจืื, ืืึทืฉืืืืขื ืื ืืขืืืื ื ืืื ืึท ืกืืืืื ืง ืืื ืืฆืืื ืืืคึผืืืืืึทื ื, ื ืึธืืืึทืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืคืื ืึท ืฉืขืจื ืืืขืืืืืึทืืขืจ, ืจืืกืืึทืจื ืคึผืืืึท, ืขืืง. ืึทืืข ืืขื ืงืขื ืขื ืืืื ืืขืืื ืืื Ansible, ืึธืืขืจ ืืืึธืก?
ืืขืงืข ืกืืจืืงืืืจ
ืึทื ืกืืืืข ืืื ืฉืืจืขื ื ืคึฟืึทืจ ืึทืืข ืืืื ืืขืงืขืก, ืึทืืื ืขืก ืืื ืืขืกืืขืจ ืฆื ืืึทืืื ืขืก ืึทืืข ืืื ืึท ืืึทืืื ืืขืจ ืืืขืืืืืึทืืขืจ. ืืขืจืฆื, ืขืก ืืื ื ืืฉื ืึทืืื ืืืืืืืง ืฆื ืขืก ืืืขื ืืืื ืืื ืื ืจืืืื ืึทืคึผืืึทืงืืืฉืึทื ืืื, ืึธืืขืจ ืกืขืคึผืขืจืึทืืื. ืืืจ ืงืขื ืขื ืงืจืึธื ืืขืงืขืก ืืื ืึท ืืึทืืื ืืขืจ ืืื ืจืืคึผืึทืืึทืืึธืจื. ืคึผืขืจืกื ืึทืื, ืืื ืืขืคึฟืื ืขื ืขืก ืืขืจืกื ืืึทืงืืืขื ืฆื ืฉืึทืคึฟื ืึทื ืึธื ืืืขื ืืืขื ืืืขืืืืืึทืืขืจ ืืื ืื / config ืืืขืืืืืึทืืขืจ ืคืื ืื ืจืืืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืงืจืึธื ืึทืืฅ ืืื ืืืื ืจืืคึผืึทืืึทืืึธืจื.
ืคึผืฉืื ืคึผืืืึทืืึธืึธืง
ืคึผืืืึทืืึธืึธืง ืืื ืึท ืืื ืืขืงืข ืืืึธืก, ื ืืฆื ืกืคึผืขืฆืืขื ืกืื ืืึทืงืก, ืืืฉืจืืืื ืืืึธืก Ansible ืืึธื ืืึธื ืืื ืืื. ืืึธืืืจ ืืึทืื ืื ืขืจืฉืืขืจ ืคึผืืืึทืืึธืึธืง ืืืึธืก ืืื ืืึธืจื ืืฉื:
---
- name: Simple playbook
hosts: allืืึธ ืืืจ ืคืฉืื ืืึธืื ืึทื ืืื ืืืขืจ ืคึผืืืึทืืึธืึธืง ืืื ืืขืจืืคื Simple Playbook ืืื ืึทื ืืืึทื ืืื ืืึทืื ืืึธื ืืืื ืขืงืกืึทืงืืืืึทื ืคึฟืึทืจ ืึทืืข ืืื ืืช. ืืืจ ืงืขื ืขื ืจืึทืืขืืืขื ืขืก ืืื / ืึทื ืกืึทืืึทื ืืืขืืืืืึทืืขืจ ืืื ืืขื ื ืึธืืขื playbook.yml ืืื ืคึผืจืืืืจื ืฆื ืืืืคื:
ansible-playbook ./playbook.yml
PLAY [Simple Playbook] ************************************************************************************************************************************
skipping: no hosts matchedAnsible ืืืื ืึทื ืขืก ืงืขื ื ืืฉื ืงืืื ืืึธืกืฅ ืืืึธืก ืืืืึทืื ืื ืึทืืข ืจืฉืืื. ืืื ืืืื ืืืื ืืืกืืขื ืืื ืึท ืกืคึผืขืฆืืขืืข .
ืืื ืก ืืึทืื ืขืก ืืื ืืขืจ ืืขืืืืงืขืจ ืึทื ืกืึทืืึทื ืืืขืืืืืึทืืขืจ:
123.123.123.123ืืึธืก ืืื ืืื ืืืจ ืคืฉืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืึทืืขืืึธืก (ืืืืืื ืืขืจ ืืึทืืขืืึธืก ืคืื ืืื ืืืขืจ ืืืคึผืก ืคึฟืึทืจ ืืขืกืืื ื, ืึธืืขืจ ืืืจ ืงืขื ืขื ืคืึทืจืฉืจืืึทืื ืืึธืงืึทืืืึธืกื) ืืื ืจืึทืืขืืืขื ืขืก ืืื ืืขืจ ืืขื ื ืึธืืขื inventory.
ืืืจ ืงืขื ืขื ืคึผืจืืืืจื ืฆื ืืืืคื ืึทื ืกืึทืืึทื ืืื ืึทื ืื ืืืขืจืึธืจื ืืขืงืข:
ansible-playbook ./playbook.yml -i inventory
PLAY [Simple Playbook] ************************************************************************************************************************************
TASK [Gathering Facts] ************************************************************************************************************************************
PLAY RECAP ************************************************************************************************************************************ืืืื ืืืจ ืืึธืื ssh ืึทืงืกืขืก ืฆื ืื ืกืคึผืขืกืืคืืขื ืืึทืืขืืึธืก, ืึทื ืกืืืืข ืืืขื ืคืึทืจืืื ืื ืืื ืงืืืึทืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืืืืึทื ืกืืกืืขื. (ืคืขืืืงืืึทื TASK [ืงืืืึทืื Facts]) ื ืึธื ืืืึธืก ืขืก ืืืขื ืืขืื ืึท ืงืืจืฅ ืืึทืจืืื ืืืืฃ ืืขืจ ืืืจืืคืืจืื ื (PLAY RECAP).
ืืืจื ืคืขืืืงืืึทื, ืื ืงืฉืจ ื ืืฆื ืื ื ืืืขื ืืื ืืขืจ ืืืึธืก ืืืจ ืืขื ื ืืึธืื ืืื ืื ืกืืกืืขื. ืขืก ืจืืึฟ ืืกืชึผืื ืืืขื ื ืืฉื ืืืื ืืืืฃ ืืขืจ ืืึทืืขืืึธืก. ืืื ืื ืคึผืืืึทืืึธืึธืง ืืขืงืข, ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืืืึธืก ืืึทื ืืฆืขืจ ืฆื ื ืืฆื ืฆื ืคืึทืจืืื ืื ืืื ืื ืจืืืึธืื_ืืกืขืจ ืืืจืขืงืืืื. ืืืื, ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืึท ืืืืึทื ืกืืกืืขื ืงืขื ืึธืคื ืืืื ืืื ืืืืืง ืคึฟืึทืจ ืืืจ ืืื ืืืจ ืืึธื ื ืืฉื ืืืืกื ืฆืืื ืฆื ืืึทืืืขื ืขืก. ืื ืึทืจืืขื ืงืขื ืขื ืืืื ืืืื ืคืึทืจืงืจืืคึผืื:
---
- name: Simple playbook
hosts: all
remote_user: root
become: true
gather_facts: noืคึผืจืึผืืื ืืืืคื ืื ืคึผืืืึทืืึธืึธืง ืืืืืขืจ ืืื ืืึทืื ืืืืขืจ ืึทื ืื ืงืฉืจ ืืื ืืจืืขืื. (ืืืื ืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืึธืจืฆื ืืึทื ืืฆืขืจ, ืืืจ ืืืื ืืึทืจืคึฟื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืขืจื: ืืืช ืืืจืขืงืืืื ืืื ืกืืจ ืฆื ืืขืืืื ืขื ืขืืขืืืึทืืขื ืจืขืื. ืืื ืืขืฉืจืืื ืืื ืื ืืึทืงืืืืขื ืืืืฉืึทื: become set to โtrueโ/โyesโ to activate privilege escalation. ืืึธืืฉ ืขืก ืืื ื ืืฉื ืืึธืจ ืงืืึธืจ ืืืึธืก).
ืืึธืืขืจ ืืืจ ืืืขื ืืึทืงืืืขื ืึท ืืขืืช ืืขืคึฟืืจื ืืืจื ืื ืคืึทืงื ืึทื ืึทื ืกืืืืข ืงืขื ื ืืฉื ืืึทืฉืืืกื ืื ืคึผืืืืึธื ืืืขืจืืขืฆืขืจ, ืืขืืึธืื ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืขืก ืืึทื ืืืึทืื:
ansible_python_interpreter: /usr/bin/python3 ืืืจ ืงืขื ืขื ืืขืคึฟืื ืขื ืืืืก ืืื ืืืจ ืืึธืื ืคึผืืืืึธื ืืื ืืขื ืืึทืคึฟืขื whereis python.
ืื ืกืืึธืืื ื ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื
ืื ื ืึธืจืืึทื ืคืึทืจืฉืคึผืจืืืืื ื ืคืื Ansible ืืืื ืคืืืข ืืึทืืืฉืืื ืคึฟืึทืจ ืืจืืขืื ืืื ืคืึทืจืฉืืื ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื, ืึทืืื ืืืจ ืืึธื ื ืื ืืึธืื ืฆื ืฉืจืืึทืื ืืึทืฉ ืกืงืจืืคึผืก ืคึฟืึทืจ ืงืืื ืกืืื. ืืืฆื ืืืจ ืืึทืจืคึฟื ืืืื ืขืจ ืคืื ืื ืืึทืืืฉืืื ืฆื ืืขืจืืืึทื ืืืงื ืื ืกืืกืืขื ืืื ืื ืกืืึทืืืจื ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื. ืืื ืืึธืื ืืืื ืื ืืื ืืงืก ืืืืฃ ืืืื ืืืคึผืก, ืึทืืื ืฆื ืื ืกืืึทืืืจื ืคึผืึทืงืึทืืืฉืึทื ืืื ื ืืฆื apt-get ะธ . ืืืื ืืืจ ื ืืฆื ืึท ืึทื ืืขืจืฉ ืึธืคึผืขืจืืืืื ื ืกืืกืืขื, ืืืจ ืงืขื ืืึทืจืคึฟื ืึท ืึทื ืืขืจืฉ ืืึธืืืืข (ืืขืืขื ืงืขื, ืืื ืืขืืืื ืืื ืื ืึธื ืืืื ืึทื ืืืจ ืืึทืจืคึฟื ืฆื ืืืืกื ืืื ืฉืืืึทืื ืืืึธืก ืืื ืืื ืืืจ ืืืขืื ืืึธื). ืึธืืขืจ, ืื ืกืื ืืึทืงืก ืืืขื ืจืืึฟ ืืกืชึผืื ืืืื ืขื ืืขื.
ืืื ืก ืืขืกืึธืคืข ืืื ืืืขืจ ืคึผืืืึทืืึธืึธืง ืืื ืื ืขืจืฉืืขืจ ืืึทืกืงืก:
---
- name: Simple playbook
hosts: all
remote_user: root
become: true
gather_facts: no
tasks:
- name: Update system
apt: update_cache=yes
- name: Install system dependencies
apt:
name: git,nginx,redis,postgresql,postgresql-contrib
state: presentืึทืจืืขื ืืื ืคึผืื ืงื ืื ืึทืจืืขื ืืืึธืก Ansible ืืืขื ืืืจืืคืืจื ืืืืฃ ืืืืึทื ืกืขืจืืืขืจืก. ืืืจ ืืขืื ืื ืึทืจืืขื ืึท ื ืึธืืขื ืึทืืื ืืืจ ืงืขื ืขื ืฉืคึผืืจ ืืืึทื ืืืจืืคืืจืื ื ืืื ืื ืงืืึธืฅ. ืืื ืืืจ ืืึทืฉืจืืึทืื, ื ืืฆื ืื ืกืื ืืึทืงืก ืคืื ืึท ืกืคึผืขืฆืืคืืฉ ืืึธืืืืข, ืืืึธืก ืขืก ืืึทืจืฃ ืฆื ืืึธื. ืืื ืืขื ืคืึทื apt: update_cache=yes - ืืืื ืฆื ืืขืจืืืึทื ืืืงื ืกืืกืืขื ืคึผืึทืงืึทืืืฉืึทื ื ืืฆื ืื ืคืืืืง ืืึธืืืืข. ืื ืฆืืืืืืข ืืึทืคึฟืขื ืืื ืึท ืืืกื ืืขืจ ืงืึธืืคึผืืืฆืืจื. ืืืจ ืคืึธืจื ืึท ืจืฉืืื ืคืื ืคึผืึทืงืึทืืืฉืึทื ืฆื ืื ืคืืืืง ืืึธืืืืข ืืื ืืึธืื ืึทื ืืื ืืขื ืขื state ืืึธื ืืืขืจื present, ืืึธืก ืืื, ืืืจ ืืึธืื ืื ืกืืึทืืืจื ืื ืคึผืึทืงืึทืืืฉืึทื. ืืื ืึท ืขื ืืขื ืืืขื, ืืืจ ืงืขื ืขื ืืึธืื ืืื ืฆื ืืืกืืขืงื ืืื, ืึธืืขืจ ืืขืจืืืึทื ืืืงื ืืื ืืืจื ืคืฉืื ืืฉืึทื ืืื ื state. ืืืืข ืืึธื ืึทื ืคึฟืึทืจ ืจืืืื ืฆื ืึทืจืืขืื ืืื postgresql, ืืืจ ืืึทืจืคึฟื ืื postgresql-contrib ืคึผืขืงื, ืืืึธืก ืืืจ ืื ืกืืึทืืืจื ืืืฆื. ืืืืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืกื ืืื ืืึธื ืืึธืก; ืึทื ืกืืืืข ืืืืฃ ืืื ืืืขื ื ืืฉื ืืึธื ืืึธืก.
ืคึผืจืึผืืื ืืืืคื ืื ืคึผืืืึทืืึธืึธืง ืืืืืขืจ ืืื ืงืึธื ืืจืึธืืืจื ืึทื ืื ืคึผืึทืงืึทืืืฉืึทื ืืขื ืขื ืืื ืกืืึทืืืจื.
ืงืจืืืืืื ื ื ืืึท ื ืืฆืขืจืก.
ืฆื ืึทืจืืขืื ืืื ืืืืขืจื, Ansible ืืืื ืืื ืึท ืืึธืืืืข - ืืึทื ืืฆืขืจ. ืืึธืืืจ ืฆืืืขืื ื ืึธื ืึท ืึทืจืืขื (ืืื ืืึธื ืืึทืืึทืืื ืื ืฉืืื ืืึทืืืืกื ืืืืื ืคืื ืื ืคึผืืืึทืืึธืึธืง ืืื ืืขืจ ืื ืืึทืืขืจืงืื ืืขื ืึทืืื ื ืืฉื ืฆื ื ืึธืืืึทืื ืขืก ืืื ืืื ืฆื ืืขืืขืจ ืืึธื):
---
- name: Simple playbook
# ...
tasks:
# ...
- name: Add a new user
user:
name: my_user
shell: /bin/bash
password: "{{ 123qweasd | password_hash('sha512') }}"ืืืจ ืืึทืื ืึท ื ืืึทืข ืืึทื ืืฆืขืจ, ืฉืืขืื ืึท ืกืืฉืขืื ืืื ืคึผืึทืจืึธื ืคึฟืึทืจ ืืื. ืืื ืืขืืึธืื ืืืจ ืืืืคื ืืื ืขืืืขืืข ืคึผืจืึธืืืขืืก. ืืืึธืก ืืืื ืื ืืึทื ืืฆืขืจ ื ืขืืขื ืืึธื ืืืื ืึทื ืืขืจืฉ ืคึฟืึทืจ ืคืึทืจืฉืืืขื ืข ืืื ืืช? ืืื ืกืืึธืจืื ื ืื ืคึผืึทืจืึธื ืืื ืงืืึธืจ ืืขืงืกื ืืื ืื ืคึผืืืึทืืึธืึธืง ืืื ืึท ืืืืขืจ ืฉืืขืื ืืขืืึทื ืง. ืฆื ืึธื ืืืืื ืืื, ืืึธืืืจ ืฉืืขืื ืื ื ืืืขื ืืื ืคึผืึทืจืึธื ืืื ืืืขืจืืึทืืึทืื, ืืื ืืื ืื ืกืืฃ ืคืื ืืขื ืึทืจืืืงื ืืื ืืืขื ืืืืึทืื ืืื ืฆื ืขื ืงืจืืคึผื ืื ืคึผืึทืจืึธื.
---
- name: Simple playbook
# ...
tasks:
# ...
- name: Add a new user
user:
name: "{{ user }}"
shell: /bin/bash
password: "{{ user_password | password_hash('sha512') }}"ืืืขืจืืึทืืึทืื ืืขื ืขื ืฉืืขืื ืืื ืคึผืืืึทืืึธืึธืงืก ื ืืฆื ืืึธืคึผื ืืขืืจืืึทืืื ืืจืืืกืึทื.
ืืืจ ืืืขืื ืึธื ืืืืึทืื ืื ืืืึทืืืขืก ืคืื ืื ืืืขืจืืึทืืึทืื ืืื ืื ืื ืืืึทื ืืึธืจื ืืขืงืข:
123.123.123.123
[all:vars]
user=my_user
user_password=123qweasdืืืืข ืืึธื ืื ืืืจืขืงืืืื [all:vars] - ืขืก ืืืื ืึทื ืืขืจ ืืืืึทืืขืจ ืืืึธืง ืคืื ืืขืงืกื ืืื ืืืขืจืืึทืืึทืื (ืืืึทืจืก) ืืื ืืื ืืขื ืขื ืึธื ืืืขื ืืืขื ืฆื ืึทืืข ืืื ืืช (ืึทืืข).
ืืขืจ ืคึผืืึทื ืืื ืืืื ืืฉืืงืึทืืืข "{{ user_password | password_hash('sha512') }}". ืื ืืึทื ืืื ืึทื ืึทื ืกืืืืข ืืื ื ืืฉื ืื ืกืืึทืืืจื ืื ืืึทื ืืฆืขืจ ืืืจื user_add ืืื ืืืจ ืืืึธืื ืืึธื ืขืก ืืึทื ืืืึทืื. ืืื ืขืก ืกืึทืืืขืก ืึทืืข ืืึทืื ืืืืึทื, ืืืึธืก ืืื ืืืึธืก ืืืจ ืืืื ืืืื ืืขืจ ืื ืคึผืึทืจืึธื ืืื ืึท ืืึทืฉ ืืื ืฉืืืึทืื, ืืืึธืก ืืื ืืืึธืก ืืขื ืืึทืคึฟืขื ืืื.
ืืึธืืืจ ืืืืื ืืื ืืืขืจ ืืึทื ืืฆืขืจ ืฆื ืื ืกืืืึธ ืืจืืคึผืข. ืึธืืขืจ, ืืืืืขืจ ืืขื ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืื ืืืืขืจ ืึทื ืึทืืึท ืึท ืืจืืคึผืข ืืืืืกืฅ ืืืืึทื ืงืืื ืืืื ืขืจ ืืืขื ืืึธื ืืึธืก ืคึฟืึทืจ ืืื ืื:
---
- name: Simple playbook
# ...
tasks:
# ...
- name: Ensure a 'sudo' group
group:
name: sudo
state: present
- name: Add a new user
user:
name: "{{ user }}"
shell: /bin/bash
password: "{{ user_password | password_hash('sha512') }}"
groups: "sudo"ืึทืืฅ ืืื ืืึทื ืฅ ืคึผืฉืื, ืืืจ ืืืื ืืึธืื ืึท ืืจืืคึผืข ืืึธืืืืข ืคึฟืึทืจ ืงืจืืืืืื ื ืืจืืคึผืขืก, ืืื ืึท ืกืื ืืึทืงืก ืืืืขืจ ืขื ืืขื ืฆื ืคืืืืง. ืืขืจื ืึธื ืขืก ืืื ืืขื ืื ืฆื ืคืึทืจืฉืจืืึทืื ืืขื ืืจืืคึผืข ืฆื ืืขืจ ืืึทื ืืฆืขืจ (groups: "sudo").
ืขืก ืืื ืืืื ื ืืฆืืง ืฆื ืืืืื ืึท ssh ืฉืืืกื ืฆื ืืขื ืืึทื ืืฆืขืจ ืึทืืื ืึทื ืืืจ ืงืขื ืขื ืงืืึธืฅ ืืื ื ืืฆื ืขืก ืึธื ืึท ืคึผืึทืจืึธื:
---
- name: Simple playbook
# ...
tasks:
# ...
- name: Ensure a 'sudo' group
group:
name: sudo
state: present
- name: Add a new user
user:
name: "{{ user }}"
shell: /bin/bash
password: "{{ user_password | password_hash('sha512') }}"
groups: "sudo"
- name: Deploy SSH Key
authorized_key:
user: "{{ user }}"
key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
state: presentืืื ืืขื ืคืึทื, ืื ืคึผืืึทื ืืื ืืฉืืงืึทืืืข "{{ lookup('file', '~/.ssh/id_rsa.pub') }}" - ืขืก ืงืึทืคึผืื ืื ืืื ืืึทืื ืคืื ืื id_rsa.pub ืืขืงืข (ืืืื ื ืึธืืขื ืงืขื ืืืื ืึทื ืืขืจืฉ), ืืึธืก ืืื, ืืขืจ ืฆืืืืจ ืืืื ืคืื ืื ssh ืฉืืืกื ืืื ืืคึผืืึธืึทืืก ืขืก ืฆื ืืขืจ ืจืฉืืื ืคืื ืึธืืขืจืืืื ืฉืืืกืืขื ืคึฟืึทืจ ืื ืืึทื ืืฆืขืจ ืืืืฃ ืื ืกืขืจืืืขืจ.
ืจืึธืืขืก
ืึทืืข ืืจืื ืืึทืกืงืก ืคึฟืึทืจ ืฉืืคื ื ืืฆื ืงืขื ืขื ืืืืื ืืืื ืงืืึทืกืึทืคืืื ืืื ืืืื ืืจืืคึผืข ืคืื โโืืึทืกืงืก, ืืื ืขืก ืืืึธืื ืืืื ืึท ืืืืข ืืขืืึทื ืง ืฆื ืงืจืึธื ืื ืืจืืคึผืข ืกืขืคึผืขืจืึทืืื ืคืื ืื ืืืืคึผื ืคึผืืืึทืืึธืึธืง ืึทืืื ืึทื ืขืก ืืืขื ื ืืฉื ืืืึทืงืกื ืฆื ืืจืืืก. ืคึฟืึทืจ ืืขื ืฆืืืขืง, Ansible ืืื .
ืืืื ืืขืจ ืืขืงืข ืกืืจืืงืืืจ ืืืึธืก ืืื ืื ืืขืืืืื ืืื ืื ืึธื ืืืื, ืื ืจืึธืืขืก ืืืื ืืืื ืืขืฉืืขืื ืืื ืึท ืืึทืืื ืืขืจ ืจืึธืืข Directory, ืคึฟืึทืจ ืืขืืขืจ ืจืึธืืข ืขืก ืืื ืึท ืืึทืืื ืืขืจ ืืืขืืืืืึทืืขืจ ืืื ืื ืืขืืืข ื ืึธืืขื, ืืื ืื ืืึทืกืงืก, ืืขืงืขืก, ืืขืืคึผืืึทืืขืก, ืขืืง.
ืืึธืืืจ ืืึทืื ืึท ืืขืงืข ืกืืจืืงืืืจ: ./ansible/roles/user/tasks/main.yml (ืืืื ืืื ืื ืืืืคึผื ืืขืงืข ืืืึธืก ืืืขื ืืืื ืืึธืืืื ืืื ืขืงืกืึทืงืืืืึทื ืืืขื ืึท ืจืึธืืข ืืื ืงืึธื ื ืขืงืืขื ืฆื ืื ืคึผืืืึทืืึธืึธืง; ืื ืืขืจืข ืจืึธืืข ืืขืงืขืก ืงืขื ืขื ืืืื ืงืึธื ื ืขืงืืขื ืฆื ืขืก). ืืืฆื ืืืจ ืงืขื ืขื ืึทืจืืืขืจืคืืจื ืึทืืข ืืึทืกืงืก ืฉืืึทืืืช ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืฆื ืืขื ืืขืงืข:
# Create user and add him to groups
- name: Ensure a 'sudo' group
group:
name: sudo
state: present
- name: Add a new user
user:
name: "{{ user }}"
shell: /bin/bash
password: "{{ user_password | password_hash('sha512') }}"
groups: "sudo"
- name: Deploy SSH Key
authorized_key:
user: "{{ user }}"
key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
state: presentืืื ืื ืืืืคึผื ืคึผืืืึทืืึธืึธืง, ืืืจ ืืืื ืกืคึผืขืฆืืคืืฆืืจื ืฆื ื ืืฆื ืื ืืึทื ืืฆืขืจ ืจืึธืืข:
---
- name: Simple playbook
hosts: all
remote_user: root
gather_facts: no
tasks:
- name: Update system
apt: update_cache=yes
- name: Install system dependencies
apt:
name: git,nginx,redis,postgresql,postgresql-contrib
state: present
roles:
- userืืืื, ืขืก ืงืขื ืืืื ืืื ืขื ืฆื ืืขืจืืืึทื ืืืงื ืื ืกืืกืืขื ืืืืืขืจ ืึทืืข ืื ืืขืจืข ืืึทืกืงืก; ืฆื ืืึธื ืืึธืก, ืืืจ ืงืขื ืขื ืจืขื ืึทืืข ืืขื ืืืึธืง tasks ืืื ืืืึธืก ืืื ืืขื ืขื ืืืคืืื ื ืืื pre_tasks.
ืืึทืฉืืขืืืงื nginx
ืืืจ ืืึธื ืฉืืื ืืึธืื ื ืืื ืงืก ืืื ืกืืึทืืืจื; ืืืจ ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืขืก ืืื ืืืืคื ืขืก. ืืื ืก ืืึธื ืขืก ืจืขืื ืึทืืืขืง ืืื ืืขืจ ืจืึธืืข. ืืึธืืืจ ืืึทืื ืึท ืืขืงืข ืกืืจืืงืืืจ:
- ansible
- roles
- nginx
- files
- tasks
- main.yml
- templatesืืืฆื ืืืจ ืืึทืจืคึฟื ืืขืงืขืก ืืื ืืขืืคึผืืึทืืขืก. ืืขืจ ืืืืืง ืฆืืืืฉื ืืื ืืื ืึทื ืึทื ืกืืืืข ืงืึทืคึผืื ืื ืืขืงืขืก ืืืืึทื, ืืื ืืื. ืืื ืืขืืคึผืืึทืืขืก ืืืื ืืึธืื ืื j2 ืคืึทืจืืขื ืืขืจืื ื ืืื ืืื ืงืขื ืขื ื ืืฆื ืืืึทืืขืืืืืง ืืืึทืืืขืก ืืื ืื ืืขืืืข ืืึธืคึผื ืืขืืจืืึทืืื ืืจืืืกืึทื.
ืืื ืก ืืขืื nginx ืืื main.yml ืืขืงืข. ืคึฟืึทืจ ืืขื ืืืจ ืืึธืื ืึท ืกืืกืืขื ืืึธืืืืข:
# Copy nginx configs and start it
- name: enable service nginx and start
systemd:
name: nginx
state: started
enabled: yesืืึธ ืืืจ ืืึธืื ื ืื ืืืืื ืึทื nginx ืืืื ืืืื ืกืืึทืจืืขื (ืืึธืก ืืื, ืืืจ ืงืึทืืขืจ ืขืก), ืึธืืขืจ ืืืจ ืืืืื ืืึธืื ืึทื ืขืก ืืืื ืืืื ืขื ืืืืึทืื.
ืืืฆื ืืึธืื ืืื ืื ื ืึธืืืึทืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก:
# Copy nginx configs and start it
- name: enable service nginx and start
systemd:
name: nginx
state: started
enabled: yes
- name: Copy the nginx.conf
copy:
src: nginx.conf
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: '0644'
backup: yes
- name: Copy template my_app.conf
template:
src: my_app_conf.j2
dest: /etc/nginx/sites-available/my_app.conf
owner: root
group: root
mode: '0644'ืืืจ ืืึทืื ืื ืืืืคึผื nginx ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข (ืืืจ ืงืขื ืขื ื ืขืืขื ืขืก ืืืืึทื ืคืื ืื ืกืขืจืืืขืจ, ืึธืืขืจ ืฉืจืืึทืื ืขืก ืืื). ืืื ืืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืคึฟืึทืจ ืืื ืืืขืจ ืึทืคึผืืึทืงืืืฉืึทื ืืื ืื ืืืืืืขื_ืึทืืืึทืืืึทืืืข ืืืขืืืืืึทืืขืจ (ืืึธืก ืืื ื ืื ื ืืืืืง ืึธืืขืจ ื ืืฆืืง). ืืื ืืขืจ ืขืจืฉืืขืจ ืคืึทื, ืืืจ ื ืืฆื ืื ืงืึธืคึผืืข ืืึธืืืืข ืฆื ืฆืืืืขื ืขื ืืขืงืขืก (ืื ืืขืงืข ืืืื ืืืื ืืื /ansible/roles/nginx/files/nginx.conf). ืืื ืื ืจืืข, ืืืจ ื ืึธืืืึทืื ืื ืืืกืืขืจ, ืคืึทืจืืืึทืื ืื ืืืึทืืืขืก ืคืื ืื ืืืขืจืืึทืืึทืื. ืืขืจ ืืืกืืขืจ ืืึธื ืืืื ืืื /ansible/roles/nginx/templates/my_app.j2). ืืื ืขืก ืงืขื ืืืื ืขืคึผืขืก ืืื ืืึธืก:
upstream {{ app_name }} {
server unix:{{ app_path }}/shared/tmp/sockets/puma.sock;
}
server {
listen 80;
server_name {{ server_name }} {{ inventory_hostname }};
root {{ app_path }}/current/public;
try_files $uri/index.html $uri.html $uri @{{ app_name }};
....
}ืืึทืฆืึธืื ืืคืืขืจืงืืึทืืงืืึทื ืฆื ืื ืื ืกืขืจืฅ {{ app_name }}, {{ app_path }}, {{ server_name }}, {{ inventory_hostname }} - ืืึธืก ืืขื ืขื ืึทืืข ืืืขืจืืึทืืึทืื ืืืขืืขื ืก ืืืึทืืืขืก Ansible ืืืขื ืคืึทืจืืืึทืื ืื ืืืกืืขืจ ืืืืืขืจ ืงืึทืคึผืืื ื. ืืึธืก ืืื ื ืืฆืืง ืืืื ืืืจ ื ืืฆื ืึท ืคึผืืืึทืืึธืึธืง ืคึฟืึทืจ ืคืึทืจืฉืืืขื ืข ืืจืืคึผืขืก ืคืื ืืื ืืช. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจ ืงืขื ืขื ืืืืื ืืื ืืืขืจ ืื ืืืึทื ืืึธืจื ืืขืงืข:
[production]
123.123.123.123
[staging]
231.231.231.231
[all:vars]
user=my_user
user_password=123qweasd
[production:vars]
server_name=production
app_path=/home/www/my_app
app_name=my_app
[staging:vars]
server_name=staging
app_path=/home/www/my_stage
app_name=my_stage_appืืืื ืืืจ ืืืฆื ืงืึทืืขืจ ืืื ืืืขืจ ืคึผืืืึทืืึธืึธืง, ืขืก ืืืขื ืืืจืืคืืจื ืื ืกืคึผืขืกืืคืืขื ืืึทืกืงืก ืคึฟืึทืจ ืืืืืข ืืื ืืช. ืึธืืขืจ ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืคึฟืึทืจ ืึท ืกืืึทืืื ื ืืึทืืขืืึธืก, ืื ืืืขืจืืึทืืึทืื ืืืขื ืืืื ืึทื ืืขืจืฉ ืคืื ืื ืคึผืจืึธืืืงืฆืืข ืึธื ืขืก, ืืื ื ืื ืืืืื ืืื ืจืึธืืขืก ืืื ืคึผืืืึทืืึธืึธืงืก, ืึธืืขืจ ืืืื ืืื nginx ืงืึทื ืคืืืืขืจืืืฉืึทื ื. {{ inventory_hostname }} ืืึธื ื ืื ืืึทืจืคึฟื ืฆื ืืืื ืกืคึผืขืกืืคืืขื ืืื ืื ืื ืืืึทื ืืึธืจื ืืขืงืข - ืืึธืก ืืื ืืขืจ ืืึทืืขืืึธืก ืคึฟืึทืจ ืืืึธืก ืื ืคึผืืืึทืืึธืึธืง ืืื ืืืฆื ืคืืืกื ืืืง ืืื ืกืืึธืจื ืืึธืจื.
ืืืื ืืืจ ืืืืื ืฆื ืืึธืื ืึท ืื ืืืึทื ืืึธืจื ืืขืงืข ืคึฟืึทืจ ืขืืืขืืข ืืื ืืช, ืึธืืขืจ ืืืืื ืืืืคื ืคึฟืึทืจ ืืืื ืืจืืคึผืข, ืืึธืก ืงืขื ืืืื ืืขืืื ืืื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื:
ansible-playbook -i inventory ./playbook.yml -l "staging"ืื ืื ืืขืจ ืึธืคึผืฆืืข ืืื ืฆื ืืึธืื ืืึทืืื ืืขืจ ืื ืืืึทื ืืึธืจื ืืขืงืขืก ืคึฟืึทืจ ืคืึทืจืฉืืืขื ืข ืืจืืคึผืขืก. ืึธืืขืจ ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืื ืฆืืืื ืึทืคึผืจืึธืืืฉืื ืืืื ืืืจ ืืึธืื ืคืืืข ืคืึทืจืฉืืืขื ืข ืืื ืืช.
ืืึธืืืจ ืืืื ืฆืืจืืง ืฆื ืืึทืฉืืขืืืงื nginx. ื ืึธื ืงืึทืคึผืืื ื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืกืืืืื ืง ืืื sitest_enabled ืฆื my_app.conf ืคึฟืื sites_available. ืืื ืจืืกืืึทืจื nginx.
... # old code in mail.yml
- name: Create symlink to sites-enabled
file:
src: /etc/nginx/sites-available/my_app.conf
dest: /etc/nginx/sites-enabled/my_app.conf
state: link
- name: restart nginx
service:
name: nginx
state: restartedืึทืืฅ ืืื ืคึผืฉืื ืืึธ - ืืืืืขืจ ืึทื ืกืึทืืึทื ืืึทืืืฉืืื ืืื ืึท ืคืขืจืื ื ืึธืจืืึทื ืกืื ืืึทืงืก. ืืืขืจ ืขืก ืืื ืืืื ืคืื ื. ืขืก ืืื ืงืืื ืคืื ื ืฆื ืจืืกืืึทืจืืื ื nginx ืืขืืขืจ ืืึธื. ืืึธืื ืืืจ ืืืืขืจืงื ืึทื ืืืจ ืืึธื ื ืื ืฉืจืืึทืื ืงืึทืืึทื ืื ืืื: "ืืึธื ืืึธืก ืืื ืืึธืก", ืื ืกืื ืืึทืงืก ืงืืงื ืืขืจ ืืื "ืืึธืก ืืึธื ืืึธืื ืืขื ืฉืืึทื". ืืื ืจืืึฟ ืึธืคื ืืึธืก ืืื ืคึผืื ืงื ืืื ืึทื ืกืึทืืึทื ืึทืจืืขื. ืืืื ืื ืืจืืคึผืข ืฉืืื ืืืืืกืฅ, ืึธืืขืจ ืื ืกืืกืืขื ืคึผืขืงื ืืื ืฉืืื ืืื ืกืืึทืืืจื, ืึทื ืกืืืืข ืืืขื ืงืึธื ืืจืึธืืืจื ืคึฟืึทืจ ืืขื ืืื ืืึธืคึผืงืขื ืื ืึทืจืืขื. ืืืื, ืืขืงืขืก ืืืขื ื ืืฉื ืืืื ืงืึทืคึผืื ืืืื ืืื ืืึธืจ ืืืืึทืื ืืืึธืก ืืื ืฉืืื ืืืืฃ ืื ืกืขืจืืืขืจ. ืืืจ ืงืขื ืขื ื ืืฆื ืืขื ืืื ืจืืกืืึทืจื nginx ืืืืื ืืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก ืืขื ืขื ืืฉืืื ืืืฉื. ืขืก ืืื ืึท ืจืขืืืกืืจืืจื ืืืจืขืงืืืื ืคึฟืึทืจ ืืขื:
# Copy nginx configs and start it
- name: enable service nginx and start
systemd:
name: nginx
state: started
enabled: yes
- name: Copy the nginx.conf
copy:
src: nginx.conf
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: '0644'
backup: yes
register: restart_nginx
- name: Copy template my_app.conf
template:
src: my_app_conf.j2
dest: /etc/nginx/sites-available/my_app.conf
owner: root
group: root
mode: '0644'
register: restart_nginx
- name: Create symlink to sites-enabled
file:
src: /etc/nginx/sites-available/my_app.conf
dest: /etc/nginx/sites-enabled/my_app.conf
state: link
- name: restart nginx
service:
name: nginx
state: restarted
when: restart_nginx.changedืืืื ืืืื ืขืจ ืคืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก ืขื ืืขืจืื ืืขื, ืึท ืงืึธืคึผืืข ืืืขื ืืืื ืืขืืืื ืืื ืื ืืืึทืืขืืืืืง ืืืขื ืืืื ืจืขืืืกืืจืืจื restart_nginx. ืืื ืืืืื ืืืื ืื ืืืขืจืืึทืืึทืื ืืื ืจืขืืืกืืจืืจื, ืื ืกืขืจืืืืก ืืืขื ืืืื ืจืืกืืึทืจืืื.
ืืื, ืคืื ืงืืจืก, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืื ืื nginx ืจืึธืืข ืฆื ืื ืืืืคึผื ืคึผืืืึทืืึธืึธืง.
ืืึทืฉืืขืืืงื postgresql
ืืืจ ืืึทืจืคึฟื ืฆื ืืขืื Postgresql ื ืืฆื systemd ืืื ืื ืืขืืืข ืืืขื ืืื ืืืจ ืืึธืื ืืื nginx, ืืื ืืืื ืฉืึทืคึฟื ืึท ืืึทื ืืฆืขืจ ืืืึธืก ืืืจ ืืืขืื ื ืืฆื ืฆื ืึทืงืกืขืก ืื ืืึทืืึทืืืืก ืืื ืื ืืึทืืึทืืืืก ืืื.
ืืึธืืืจ ืืึทืื ืึท ืจืึธืืข /ansible/roles/postgresql/tasks/main.yml:
# Create user in postgresql
- name: enable postgresql and start
systemd:
name: postgresql
state: started
enabled: yes
- name: Create database user
become_user: postgres
postgresql_user:
name: "{{ db_user }}"
password: "{{ db_password }}"
role_attr_flags: SUPERUSER
- name: Create database
become_user: postgres
postgresql_db:
name: "{{ db_name }}"
encoding: UTF-8
owner: "{{ db_user }}"ืืื ืืืขื ื ืืฉื ืืึทืฉืจืืึทืื ืืื ืฆื ืืืืื ืืืขืจืืึทืืึทืื ืฆื ืื ืืืึทื ืืึธืจื, ืืึธืก ืืื ืฉืืื ืืขืืื ืคืืืข ืืึธื, ืืื ืืขืืื ื ืืื ืื ืกืื ืืึทืงืก ืคืื ืื postgresql_db ืืื postgresql_user ืืึทืืืฉืืื. ืืขืจ ืืื ืคึฟืึธืจืืึทืฆืืข ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื ืืื ืื ืืึทืงืืืืขื ืืืืฉืึทื. ืื ืืขืจืกื ืืฉืืงืึทืืืข ืืืจืขืงืืืื ืืึธ ืืื become_user: postgres. ืืขืจ ืคืึทืงื ืืื ืึทื ืืืจื ืคืขืืืงืืึทื, ืืืืื ืืขืจ ืคึผืึธืกืืืจืขืก ืืึทื ืืฆืขืจ ืืื ืึทืงืกืขืก ืฆื ืื ืคึผืึธืกืืืจืขืกืงื ืืึทืืึทืืืืก ืืื ืืืืื ืืึธืืงืึทืื. ืืขืจ ืืืจืขืงืืืื ืึทืืึทืื ืืื ืื ืฆื ืืืกืคืืจื ืงืึทืืึทื ืื ืืืืฃ ืืืืึทืฃ ืคืื ืืขื ืืึทื ืืฆืขืจ (ืืืื ืืืจ ืืึธืื ืึทืงืกืขืก, ืคืื ืืืืฃ).
ืืืื, ืืืจ ืงืขื ืืึธืื ืฆื ืืืืื ืึท ืฉืืจื ืฆื pg_hba.conf ืฆื ืืึธืื ืึท ื ืืึทืข ืืึทื ืืฆืขืจ ืึทืงืกืขืก ืฆื ืื ืืึทืืึทืืืืก. ืืขื ืงืขื ืขื ืืืื ืืขืืื ืืื ืื ืืขืืืข ืืืขื ืืื ืืืจ ืืฉืืื ืืืฉื ืื nginx config.
ืืื ืืึธื ืืืจ ืืึทืจืคึฟื ืฆื ืืืืื ืื postgresql ืจืึธืืข ืฆื ืื ืืืืคึผื ืคึผืืืึทืืึธืึธืง.
ืื ืกืืึธืืื ื ืจืืื ืืืจื rbenv
Ansible ืืื ื ืืฉื ืืึธืื ืืึทืืืฉืืื ืคึฟืึทืจ ืืจืืขืื ืืื rbenv, ืึธืืขืจ ืขืก ืืื ืืื ืกืืึทืืืจื ืืืจื ืงืืึธืื ืื ื ืึท ืืื ืจืืคึผืึทืืึทืืึธืจื. ืืขืจืืืขืจ, ืืขื ืคึผืจืึธืืืขื ืืืขืจื ืื ืืขืจืกื ื ืื-ื ืึธืจืืึทื. ืืึธืืืจ ืืึทืื ืคึฟืึทืจ ืืืจ ืึท ืจืึธืืข /ansible/roles/ruby_rbenv/main.yml ืืื ืืืืืจ ืื ืืืืื ืืืืกืคืืื:
# Install rbenv and ruby
- name: Install rbenv
become_user: "{{ user }}"
git: repo=https://github.com/rbenv/rbenv.git dest=~/.rbenvืืืจ ืืืืืขืจ ื ืืฆื ืื word_user ืืืจืขืงืืืื ืฆื ืึทืจืืขืื ืืื ืืขืจ ืืขืจ ืืึทื ืืฆืขืจ ืืืึธืก ืืืจ ืืืฉืืคื ืคึฟืึทืจ ืื ืฆืืืขืงื. ืืื ื rbenv ืืื ืืื ืกืืึทืืืจื ืืื ืืืื ืืืื ืืืขืืืืืึทืืขืจ, ืืื ื ืืฉื ืืืึธืืืึทืื. ืืื ืืืจ ืืืื ื ืืฆื ืื ืืื ืืึธืืืืข ืฆื ืงืืึธืื ืื ืจืืคึผืึทืืึทืืึธืจื, ืกืคึผืขืฆืืคืืฆืืจื ืจืขืคึผืึธ ืืื ืืขืกื.
ืืขืจื ืึธื, ืืืจ ืืึทืจืคึฟื ืฆื ืจืขืืืกืืจืืจื rbenv init ืืื bashrc ืืื ืืืืื rbenv ืฆื PATH ืืึธืจื. ืคึฟืึทืจ ืืขื ืืืจ ืืึธืื ืื lineinfile ืืึธืืืืข:
- name: Add rbenv to PATH
become_user: "{{ user }}"
lineinfile:
path: ~/.bashrc
state: present
line: 'export PATH="${HOME}/.rbenv/bin:${PATH}"'
- name: Add rbenv init to bashrc
become_user: "{{ user }}"
lineinfile:
path: ~/.bashrc
state: present
line: 'eval "$(rbenv init -)"'ืืขืจื ืึธื ืืืจ ืืึทืจืคึฟื ืฆื ืื ืกืืึทืืืจื ruby_build:
- name: Install ruby-build
become_user: "{{ user }}"
git: repo=https://github.com/rbenv/ruby-build.git dest=~/.rbenv/plugins/ruby-buildืืื ืืขืกืึธืฃ ืื ืกืืึทืืืจื ืจืืืื. ืืึธืก ืืื ืืืจืืืขืงืึธืื ืืืจื ืจืื ื, ืืึธืก ืืืืกื, ืคืฉืื ืืื ืืขืจ ืืึทืคืขื ืืึทืฉ:
- name: Install ruby
become_user: "{{ user }}"
shell: |
export PATH="${HOME}/.rbenv/bin:${PATH}"
eval "$(rbenv init -)"
rbenv install {{ ruby_version }}
args:
executable: /bin/bashืืืจ ืืึธืื ืืืึธืก ืืึทืคึฟืขื ืฆื ืืืกืคืืจื ืืื ืืื ืืืึธืก. ืึธืืขืจ, ืืึธ ืืืจ ืืจืขืคื ืื ืคืึทืงื ืึทื ืึทื ืกืืืืข ืงืขื ื ืืฉื ืืืืคื ืื ืงืึธื ืงืึทื ืืืื ื ืืื bashrc ืืืืืขืจ ืคืืืกื ืืืง ืื ืงืึทืืึทื ืื. ืืขื ืืืื ืึทื rbenv ืืืขื ืืืื ืืืคืืื ื ืืืืึทื ืืื ืื ืืขืืืข ืฉืจืืคื.
ืืขืจ ืืืืึทืืขืจ ืคึผืจืึธืืืขื ืืื ืจืขืื ืฆื ืืขื ืคืึทืงื ืึทื ืื ืฉืึธื ืืึทืคึฟืขื ืืื ืงืืื ืฉืืึทื ืคืื ืึท ืึทื ืกืึทืืึทื ืคืื ื ืคืื ืืืื ืื ื. ืึทื ืืื, ืขืก ืืืขื ืืืื ืงืืื ืึธืืึทืืึทืืืง ืืฉืขืง ืฆื ืื ืืืขืจืกืืข ืคืื โโืจืืื ืืื ืืื ืกืืึทืืืจื ืึธืืขืจ ื ืืฉื. ืืืจ ืงืขื ืขื ืืึธื ืืึธืก ืืื:
- name: Install ruby
become_user: "{{ user }}"
shell: |
export PATH="${HOME}/.rbenv/bin:${PATH}"
eval "$(rbenv init -)"
if ! rbenv versions | grep -q {{ ruby_version }}
then rbenv install {{ ruby_version }} && rbenv global {{ ruby_version }}
fi
args:
executable: /bin/bashืึทืืข ืืืึธืก ืืืืืื ืืื ืฆื ืื ืกืืึทืืืจื ืืื ืืืขืจ:
- name: Install bundler
become_user: "{{ user }}"
shell: |
export PATH="${HOME}/.rbenv/bin:${PATH}"
eval "$(rbenv init -)"
gem install bundlerืืื ืืืืืขืจ, ืืืืื ืืื ืืืขืจ ืจืึธืืข ruby_rbenv ืฆื ืื ืืืืคึผื ืคึผืืืึทืืึธืึธืง.
ืฉืขืจื ืืขืงืขืก.
ืืื ืึทืืืขืืืื, ืื ืกืขืืึทืคึผ ืงืขื ืืืื ืืขืขื ืืืงื ืืึธ. ืืืืึทืืขืจ, ืึทืืข ืืืึธืก ืืืืืื ืืื ืฆื ืืืืคื ืงืึทืคึผืืกืืจืึทื ืึธ ืืื ืขืก ืืืขื ื ืึธืืืึทืื ืื ืงืึธื ืืื, ืืึทืื ืื ื ืืืืืง ืืืืจืขืงืืขืจืื ืืื ืงืึทืืขืจ ืื ืึทืคึผืืึทืงืืืฉืึทื (ืืืื ืึทืืฅ ืืื ืงืึทื ืคืืืืขืจื ืจืืืืืง). ืึธืืขืจ, ืงืึทืคึผืืกืืจืึทื ืึธ ืึธืคื ืจืืงืืืืืขืจื ื ืึธื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก, ืึทืืึท ืืื database.yml ืึธืืขืจ .env ืืื ืงืขื ืขื ืืืื ืงืึทืคึผืื ืคึผืื ืงื ืืื ืืขืงืขืก ืืื ืืขืืคึผืืึทืืขืก ืคึฟืึทืจ nginx. ืขืก ืืื ืืืืื ืืืื ืกืึทืืึทืืื. ืืืืืขืจ ืงืึทืคึผืืื ื ืืขืงืขืก, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืืืขืืืืืึทืืขืจ ืกืืจืืงืืืจ ืคึฟืึทืจ ืืื, ืขืคึผืขืก ืืื ืืึธืก:
# Copy shared files for deploy
- name: Ensure shared dir
become_user: "{{ user }}"
file:
path: "{{ app_path }}/shared/config"
state: directoryืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืืืืื ืืืื ืืืขืืืืืึทืืขืจ ืืื ืึทื ืกืืืืข ืืืขื ืืืืืึธืืึทืืืฉ ืฉืึทืคึฟื ืคืึธืืขืจ ืึธื ืขืก ืืืื ื ืืืืืง.
ืึทื ืกืืืืข ืืืึธืื
ืืืจ ืืึธืื ืฉืืื ืืขืคึฟืื ืขื ืืขื ืคืึทืงื ืึทื ืืืขืจืืึทืืึทืื ืงืขื ืขื ืึทื ืืืึทืืื ืกืื ืืึทืื ืึทืืึท ืืื ืื ืคึผืึทืจืึธื ืคืื ืื ืืึทื ืืฆืขืจ. ืืืื ืืืจ ืืึธื ืืืฉืืคื .env ืืขืงืข ืคึฟืึทืจ ืื ืึทืคึผืืึทืงืืืฉืึทื, ืืื database.yml ืืขืืึธืื ืขืก ืืืื ืืืื ืืคืืื ืืขืจ ืึทืืึท ืงืจืืืืฉ ืืึทืื. ืขืก ืืืึธืื ืืืื ืืื ืฆื ืืึทืืึทืืื ืืื ืคืื ืคึผืจืืื ื ืืืืื. ืคึฟืึทืจ ืืขื ืฆืืืขืง ืขืก ืืื ืืขื ืืฆื .
ืืื ืก ืืึทืื ืึท ืืขืงืข ืคึฟืึทืจ ืืืขืจืืึทืืึทืื /ansible/vars/all.yml (ืืึธ ืืืจ ืงืขื ืขื ืืึทืื ืคืึทืจืฉืืืขื ืข ืืขืงืขืก ืคึฟืึทืจ ืคืึทืจืฉืืืขื ืข ืืจืืคึผืขืก ืคืื ืืื ืืช, ืคึผืื ืงื ืืื ืืื ืื ืื ืืืึทื ืืึธืจื ืืขืงืข: production.yml, staging.yml, ืขืืง).
ืึทืืข ืืืขืจืืึทืืึทืื ืืืึธืก ืืืื ืืืื ืื ืงืจืืคึผืืื ืืืื ืืืื ืืจืึทื ืกืคืขืจื ืฆื ืืขื ืืขืงืข ืืื ื ืึธืจืืึทื ืืื ืกืื ืืึทืงืก:
# System vars
user_password: 123qweasd
db_password: 123qweasd
# ENV vars
aws_access_key_id: xxxxx
aws_secret_access_key: xxxxxx
aws_bucket: bucket_name
rails_secret_key_base: very_secret_key_baseื ืึธื ืืืึธืก ืื ืืขืงืข ืงืขื ืขื ืืืื ืื ืงืจืืคึผืืื ืืื ืื ืืึทืคึฟืขื:
ansible-vault encrypt ./vars/all.ymlืืขืืืืื ืืืขื, ืืืขื ืขื ืงืจืืคึผืืื ื, ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืฉืืขืื ืึท ืคึผืึทืจืึธื ืคึฟืึทืจ ืืขืงืจืืคึผืืืึธื. ืืืจ ืงืขื ืขื ืืขื ืืืึธืก ืืืขื ืืืื ืื ืืขืจ ืืขืงืข ื ืึธื ืจืืคื ืืขื ืืึทืคึฟืขื.
ืืืจื ืืืื ืคืื ansible-vault decrypt ืื ืืขืงืข ืงืขื ืขื ืืืื ืืขืงืจืืคึผืืื, ืืึทืืึทืคืืื ืืื ืืขืืึธืื ืื ืงืจืืคึผืืื ืืืืืขืจ.
ืืืจ ืืึธื ื ืื ืืึทืจืคึฟื ืฆื ืืขืงืจืืคึผื ืื ืืขืงืข ืฆื ืึทืจืืขืื. ืืืจ ืงืจืึธื ืขืก ืื ืงืจืืคึผืืื ืืื ืืืืคื ืื ืคึผืืืึทืืึธืึธืง ืืื ืื ืึทืจืืืืขื ื --ask-vault-pass. Ansible ืืืขื ืคืจืขืื ืคึฟืึทืจ ืื ืคึผืึทืจืึธื, ืฆืืจืืงืงืจืืื ืื ืืืขืจืืึทืืึทืื ืืื ืืืกืคืืจื ืื ืืึทืกืงืก. ืึทืืข ืืึทืื ืืืขื ืืืื ืื ืงืจืืคึผืืื.
ืื ืืึทื ืฅ ืืึทืคึฟืขื ืคึฟืึทืจ ืขืืืขืืข ืืจืืคึผืขืก ืคืื ืืื ืืช ืืื ืึทื ืกืึทืืึทื ืืืึธืื ืืืขื ืงืืงื ืขืคึผืขืก ืืื ืืึธืก:
ansible-playbook -i inventory ./playbook.yml -l "staging" --ask-vault-passืึธืืขืจ ืืื ืืืขื ื ืืฉื ืืขืื ืืืจ ืื ืคืื ืืขืงืกื ืคืื ืคึผืืืึทืืึธืึธืงืก ืืื ืจืึธืืขืก, ืฉืจืืึทืื ืขืก ืืื. ืืืืึทื ืึทื ืกืึทืืึทื ืืื ืึทืืื - ืืืื ืืืจ ืืึธื ื ืื ืคึฟืึทืจืฉืืืื ืืืึธืก ืืึทืจืฃ ืฆื ืืืื ืืขืืื, ืขืก ืืืขื ื ืืฉื ืืึธื ืืึธืก ืคึฟืึทืจ ืืืจ.
ืืงืืจ: www.habr.com