Linux: 运维自运化之ANSIBLE

[root@ansible ~]#yum install ansible

yum -y install python-jinja2 PyYAML python-paramiko python-babel python-crypto
wget https://releases.ansible.com/ansible/ansible-1.5.4.tar.gz
tar xf ansible-1.5.4.tar.gz
cd ansible-1.5.4
python setup.py build
python setup.py install
mkdir /etc/ansible
cp -r examples/* /etc/ansible

git clone git://github.com/ansible/ansible.git --recursive
cd ./ansible
source ./hacking/env-setup

yum install python-pip python-devel
yum install gcc glibc-devel zibl-devel rpm-bulid openssl-devel
pip install --upgrade pip
pip install ansible --upgrade

[root@ansible ~]#ansible --version
ansible 2.9.5
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.6/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.6.8 (default, Nov 21 2019, 19:31:34) [GCC 8.3.1 20190507 (Red Hat 8.3.1-4)]

[defaults]
#inventory = /etc/ansible/hosts # 主机列表配置文件
#library = /usr/share/my_modules/ # 库文件存放目录
#remote_tmp = $HOME/.ansible/tmp #临时py命令文件存放在远程主机目录
#local_tmp = $HOME/.ansible/tmp # 本机的临时命令执行目录
#forks = 5 # 默认并发数
#sudo_user = root # 默认sudo 用户
#ask_sudo_pass = True #每次执行ansible命令是否询问ssh密码
#ask_pass = True
#remote_port = 22
#host_key_checking = False # 检查对应服务器的host_key，建议取消注释
#log_path=/var/log/ansible.log #日志文件，建议启用
#module_name = command #默认模块，可以修改为shell模块

ntp.cici.com
[webservers]
www1.cici.com:2222
www2.cici.com

[dbservers]
db1.cici.com
db2.cici.com
db3.cici.com

[websrvs]
www[1:100].example.com

[dbsrvs]
db-[a:f].example.com

[appsrvs]
10.0.0.[1:100]

[test]
10.0.0.8  ansible_connection=local  #指定本地连接,无需ssh配置

#ansible_connection=ssh 需要StrictHostKeyChecking no
10.0.0.7  ansible_connection=ssh  ansible_port=2222  ansible_user=wang ansible_password=magedu 
10.0.0.6  ansible_connection=ssh  ansible_user=root  ansible_password=123456 

ansible-doc [options] [module...]
-l, --list #列出可用模块
-s, --snippet #显示指定模块的playbook片段

#列出所有模块
ansible-doc -l
#查看指定模块帮助用法
ansible-doc ping
#查看指定模块帮助用法
ansible-doc -s ping

[root@ansible ~]#date
Wed Jun 17 16:08:09 CST 2020
[root@ansible ~]#ansible --version
ansible 2.9.9
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.6/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.6.8 (default, May 21 2019, 23:51:36) [GCC 8.2.1 20180905 (Red Hat 8.2.1-3)]

[root@ansible ~]#ansible-doc -l|wc -l
3387

[root@ansible ~]#ansible-doc -s ping
- name: Try to connect to host, verify a usable python and return `pong' on success
  ping:
      data:     # Data to return for the `ping' return value. If this                     parameter is set to `crash', the module will cause an                     exception.

[root@centos8 ~]#vim /etc/ssh/ssh_config
#修改下面一行
StrictHostKeyChecking no

[root@centos8 ~]#cat hosts.list
10.0.0.18
10.0.0.28
[root@centos8 ~]#vim push_ssh_key.sh
#!/bin/bash
rpm -q sshpass &> /dev/null || yum -y install sshpass
[ -f /root/.ssh/id_rsa ] || ssh-keygen -f /root/.ssh/id_rsa -P ''
export SSHPASS=cici
while read IP;do
    sshpass -e ssh-copy-id -o StrictHostKeyChecking=no $IP
done < hosts.list

IPLIST="
10.0.0.8
10.0.0.18
10.0.0.7
10.0.0.6
10.0.0.200"

rpm -q sshpass &> /dev/null || yum -y install sshpass
[ -f /root/.ssh/id_rsa ] || ssh-keygen -f /root/.ssh/id_rsa -P ''
export SSHPASS=centos
for IP in $IPLIST;do
    sshpass -e ssh-copy-id -o StrictHostKeyChecking=no $IP
done

ansible <host-pattern> [-m module_name] [-a args]
        主机清单列表         模块            参数

--version                #显示版本
-m module                 #指定模块，默认为command
-v                         #详细过程 –vv -vvv更详细
--list-hosts             #显示主机列表，可简写 --list
-k, --ask-pass             #提示输入ssh连接密码，默认Key验证
-C, --check             #检查，并不执行
-T, --timeout=TIMEOUT      #执行命令的超时时间，默认10s
-u, --user=REMOTE_USER     #执行远程执行的用户
-b, --become             #代替旧版的sudo 切换
--become-user=USERNAME  #指定sudo的runas用户，默认为root
-K, --ask-become-pass     #提示输入sudo时的口令

ansible all –m ping

[root@ansible ~]#ansible all --list
  hosts (5):
    10.0.0.8
    10.0.0.7
    10.0.0.6
    10.0.0.100
    10.0.0.18
[root@ansible ~]#ansible websrvs --list
  hosts (2):
    10.0.0.8
    10.0.0.7

ansible "*” -m ping
ansible 192.168.1.* -m ping
ansible "srvs” -m ping

ansible "websrvs:appsrvs" -m ping
ansible "192.168.1.10:192.168.1.20" -m ping

#在websrvs组并且在dbsrvs组中的主机
ansible "websrvs:&dbsrvs" –m ping

#在websrvs组，但不在dbsrvs组中的主机
#注意：此处为单引号
ansible 'websrvs:!dbsrvs' –m ping

ansible 'websrvs:dbsrvs:&appsrvs:!ftpsrvs' –m ping

ansible "websrvs:dbsrvs" –m ping
ansible "~(web|db).*\.cici\.com" –m ping

[root@kube-master1 ~]#ansible 'kube*:etcd:!10.0.0.101' -a reboot

[root@centos8 ~]#ansible appsrvs --list-hosts 
hosts (2):
  10.0.0.7
  10.0.0.8
[root@centos8 ~]#ansible "appsrvs:dbsrvs" --list-hosts 
hosts (3):
  10.0.0.7
  10.0.0.8
  10.0.0.6
[root@centos8 ~]#ansible "appsrvs:&dbsrvs" --list-hosts 
hosts (1):
  10.0.0.7
[root@centos8 ~]#ansible "appsrvs:!dbsrvs" --list-hosts 
-bash: !dbsrvs: event not found
[root@centos8 ~]#ansible 'appsrvs:!dbsrvs' --list-hosts 
hosts (1):
  10.0.0.8

[root@centos8 ~]#grep -A 14 '\[colors\]' /etc/ansible/ansible.cfg
[colors]
#highlight = white
#verbose = blue
#warn = bright purple
#error = red
#debug = dark gray
#deprecate = purple
#skip = cyan
#unreachable = red
#ok = green
#changed = yellow
#diff_add = green
#diff_remove = red
#diff_lines = cyan

#以wang用户执行ping存活检测
ansible all -m ping -u wang -k
#以wang sudo至root执行ping存活检测
ansible all -m ping -u wang -k -b
#以wang sudo至cici用户执行ping存活检测
ansible all -m ping -u wang -k -b --become-user=cici
#以wang sudo至root用户执行ls
ansible all -m command -u wang -a 'ls /root' -b --become-user=root -k -K

ansible-playbook hello.yml
cat hello.yml
---
#hello world yml file
- hosts: websrvs
  remote_user: root
  tasks:
    - name: hello world
      command: /usr/bin/wall hello world

ansible-vault [create|decrypt|edit|encrypt|rekey|view]

ansible-vault encrypt hello.yml #加密
ansible-vault decrypt hello.yml #解密
ansible-vault view hello.yml     #查看
ansible-vault edit hello.yml     #编辑加密文件
ansible-vault rekey hello.yml     #修改口令
ansible-vault create new.yml     #创建新文件

[root@ansible ~]#ansible-console
Welcome to the ansible console.
Type help or ? to list commands.

root@all (3)[f:5]$ list
10.0.0.8
10.0.0.7
10.0.0.6
root@all (3)[f:5]$ cd websrvs
root@websrvs (2)[f:5]$ list
10.0.0.7
10.0.0.8
root@websrvs (2)[f:5]$ forks 10
root@websrvs (2)[f:10]$ cd appsrvs
root@appsrvs (2)[f:5]$ yum name=httpd state=present
root@appsrvs (2)[f:5]$ service name=httpd state=started

#列出所有已安装的galaxy
ansible-galaxy list
#安装galaxy
ansible-galaxy install geerlingguy.mysql
ansible-galaxy install geerlingguy.redis
#删除galaxy
ansible-galaxy remove geerlingguy.redis

[root@ansible ~]#ansible websrvs -m command -a 'chdir=/etc cat centos-release'
10.0.0.7 | CHANGED | rc=0 >>
CentOS Linux release 7.7.1908 (Core)
10.0.0.8 | CHANGED | rc=0 >>
CentOS Linux release 8.1.1911 (Core)
[root@ansible ~]#ansible websrvs -m command -a 'chdir=/etc creates=/data/f1.txt
cat centos-release'
10.0.0.7 | CHANGED | rc=0 >>
CentOS Linux release 7.7.1908 (Core)
10.0.0.8 | SUCCESS | rc=0 >>
skipped, since /data/f1.txt exists
[root@ansible ~]#ansible websrvs -m command -a 'chdir=/etc removes=/data/f1.txt
cat centos-release'
10.0.0.7 | SUCCESS | rc=0 >>
skipped, since /data/f1.txt does not exist
10.0.0.8 | CHANGED | rc=0 >>
CentOS Linux release 8.1.1911 (Core)

ansible websrvs -m command -a ‘service vsftpd start’
ansible websrvs -m command -a ‘echo cici |passwd --stdin wang’
ansible websrvs -m command -a 'rm -rf /data/'
ansible websrvs -m command -a 'echo hello > /data/hello.log'
ansible websrvs -m command -a "echo $HOSTNAME"

[root@centos8 ~]#ansible websrvs -m shell -a "echo $HOSTNAME"
10.0.0.7 | CHANGED | rc=0 >>
centos8
10.0.0.8 | CHANGED | rc=0 >>
centos8
[root@centos8 ~]#ansible websrvs -m shell -a 'echo $HOSTNAME'
10.0.0.7 | CHANGED | rc=0 >>
Centos7.8
10.0.0.8 | CHANGED | rc=0 >>
centos8.1.cuiqinghe.com

[root@centos8 ~]#ansible websrvs -m shell -a 'echo centos | passwd --stdin cui'
10.0.0.7 | CHANGED | rc=0 >>
Changing password for user cui.
passwd: all authentication tokens updated successfully.
10.0.0.8 | CHANGED | rc=0 >>
Changing password for user cui.
passwd: all authentication tokens updated successfully.

[root@centos8 ~]#ansible websrvs -m shell -a 'ls -l /etc/shadow'
10.0.0.7 | CHANGED | rc=0 >>
---------- 1 root root 806 Jun 18 16:17 /etc/shadow
10.0.0.8 | CHANGED | rc=0 >>
---------- 1 root root 868 Jun 19 16:17 /etc/shadow

[root@centos8 ~]#ansible websrvs -m shell -a 'echo hello > /data/hello.log'
10.0.0.7 | CHANGED | rc=0 >>

10.0.0.8 | CHANGED | rc=0 >>

[root@centos8 ~]#ansible websrvs -m shell -a 'cat /data/hello.log'
10.0.0.7 | CHANGED | rc=0 >>
hello
10.0.0.8 | CHANGED | rc=0 >>
hello

[root@ansible ~]#vim /etc/ansible/ansible.cfg
#修改下面一行
module_name = shell

ansible websrvs -m script -a /data/test.sh

#如目标存在，默认覆盖，此处指定先备份
ansible websrvs -m copy -a "src=/root/test1.sh dest=/tmp/test2.sh owner=wang mode=600 backup=yes"
#指定内容，直接生成目标文件
ansible websrvs -m copy -a "content='test line1\ntest line2' dest=/tmp/test.txt"

#复制/etc目录自身,注意/etc/后面没有/   类似于rsync
ansible websrvs -m copy -a "src=/etc dest=/backup"

#复制/etc/下的文件，不包括/etc/目录自身,注意/etc/后面有/
ansible websrvs -m copy -a "src=/etc/ dest=/backup"

ansible websrvs -m fetch -a 'src=/root/test.sh dest=/data/scripts'

[root@ansible ~]#ansible all -m fetch -a 'src=/etc/os-release
dest=/data/os'
[root@ansible ~]#tree /data/os/
/data/
├── 10.0.0.7
│   └── etc
│       └── os-release
└── 10.0.0.8
    └── etc
        └── os-release

4 directories, 2 files

#创建空文件
ansible all -m file -a 'path=/data/test.txt state=touch'
ansible all -m file -a 'path=/data/test.txt state=absent'
ansible all -m file -a "path=/root/test.sh owner=wang mode=755"
#创建目录
ansible all -m file -a "path=/data/mysql state=directory owner=mysql
group=mysql"
#创建软链接
ansible all -m file -a 'src=/data/testfile dest=/data/testfile-link state=link’

#默认copy时yes,故省略
ansible all -m unarchive -a 'src=/data/foo.tgz dest=/var/lib/foo owner=wang group=bin'
#源包不在absible主机上,就要把copy设成no
ansible all -m unarchive -a 'src=/tmp/foo.zip dest=/data copy=no mode=0777'
ansible all -m unarchive -a 'src=https://example.com/example.zip dest=/data copy=no'

[root@ansible ~]#tar Jcvf etc.tar.xz /etc/
[root@ansible ~]#ll -h
-rw-------. 1 root root 1.6K Mar 11 22:26 anaconda-ks.cfg
-rw-r--r--  1 root root 3.8M Jun 20 09:27 etc.tar.xz
[root@ansible ~]#ansible all --list
  hosts (4):
    10.0.0.8
    10.0.0.7
    10.0.0.6
    10.0.0.100
[root@ansible ~]#ansible websrvs --list
  hosts (2):
    10.0.0.8
    10.0.0.7

[root@ansible ~]#ansible websrvs -m unarchive -a 'src=/root/etc.tar.xz dest=/data owner=cui group=bin'
10.0.0.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "dest": "/data",
    "extract_results": {
        "cmd": [
            "/usr/bin/gtar",
            "--extract",
            "-C",
            "/data",
            "--owner=cui",
            "--group=bin",
            "-f",
            "/root/.ansible/tmp/ansible-tmp-1592616801.5587249-8032-36480135360957/source"
        ],
        "err": "",
        "out": "",
        "rc": 0
    },
    "gid": 0,
    "group": "root",
    "handler": "TarArchive",
    "mode": "0755",
    "owner": "root",
    "size": 17,
    "src": "/root/.ansible/tmp/ansible-tmp-1592616801.5587249-8032-36480135360957/source",
    "state": "directory",
    "uid": 0
}
10.0.0.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": true,
    "dest": "/data",
    "extract_results": {
        "cmd": [
            "/usr/bin/gtar",
            "--extract",
            "-C",
            "/data",
            "--owner=cui",
            "--group=bin",
            "-f",
            "/root/.ansible/tmp/ansible-tmp-1592616801.5619113-8034-100361774048645/source"
        ],
        "err": "",
        "out": "",
        "rc": 0
    },
    "gid": 0,
    "group": "root",
    "handler": "TarArchive",
    "mode": "0755",
    "owner": "root",
    "size": 17,
    "src": "/root/.ansible/tmp/ansible-tmp-1592616801.5619113-8034-100361774048645/source",
    "state": "directory",
    "uid": 0
}

#目标主机
[root@centos8 ~]#ll /data/
total 12
drwxr-xr-x 134 cui bin 8192 Jun 20 08:48 etc

[root@Centos7 ~]#ll /data/
total 12
drwxr-xr-x 134 cui bin 8192 Jun 20 08:48 etc

[root@ansible ~]#ansible websrvs -a 'rm -rf /data/*'
[WARNING]: Consider using the file module with state=absent rather than running
'rm'.  If you need to use command because file is insufficient you can add 'warn:
false' to this command task or set 'command_warnings=False' in ansible.cfg to get
rid of this message.
10.0.0.7 | CHANGED | rc=0 >>

10.0.0.8 | CHANGED | rc=0 >>

[root@ansible ~]#ansible websrvs -a 'ls /data/*'
10.0.0.7 | FAILED | rc=2 >>
ls: cannot access /data/*: No such file or directorynon-zero return code
10.0.0.8 | FAILED | rc=2 >>
ls: cannot access '/data/*': No such file or directorynon-zero return code

[root@ansible ~]#ansible websrvs -m copy -a 'src=etc.tar.xz dest=/root/'
[root@ansible ~]#mv etc.tar.xz /opt/
[root@ansible ~]#ansible websrvs -m unarchive -a 'src=/root/etc.tar.xz dest=/data copy=no'

[root@centos8 ~]#ll /data/
total 12
drwxr-xr-x 134 root root 8192 Jun 20 08:48 etc

ansible websrvs -m archive -a 'path=/var/log/ dest=/data/log.tar.bz2 format=bz2 owner=wang mode=0600'

ansible node1 -m hostname -a “name=websrv”
ansible 192.168.100.18 -m hostname -a 'name=node18.cici.com'

[root@ansible ~]#ansible 10.0.0.6 -m hostname -a 'name=centos66.cuiqinghe.com'
[root@centos6 ~]#hostname
centos66.cuiqinghe.com
[root@centos6 ~]#cat /etc/sysconfig/network   #直接写到配置文件中了
NETWORKING=yes
HOSTNAME=centos66.cuiqinghe.com

#扩展:centos7,centos8,ubuntu的主机名都放在/etc/hostname中

#备份数据库脚本
[root@centos8 ~]#cat /root/mysql_backup.sh
#!/bin/bash
mysqldump -A -F --single-transaction --master-data=2 -q -uroot |gzip > /data/mysql_`date +%F_%T`.sql.gz
#-A全部数据库备份  -F刷新日志  --single-transaction启用事务  --master-data=2 记录备份点   -q快速备份

#创建任务
ansible 10.0.0.8 -m cron -a 'hour=2 minute=30 weekday=1-5 name="backup mysql" job=/root/mysql_backup.sh'
ansible websrvs -m cron -a "minute=*/5 job='/usr/sbin/ntpdate ntp.aliyun.com
&>/dev/null' name=Synctime"
#避免产生大量垃圾文件
#ntpdate ntp.aliyun.com 命令只有centos7和之前的版本有

#禁用计划任务
ansible websrvs -m cron -a "minute=*/5 job='/usr/sbin/ntpdate ntp.aliyun.com
&>/dev/null' name=Synctime disabled=yes"

#启用计划任务
ansible websrvs -m cron -a "minute=*/5 job='/usr/sbin/ntpdate ntp.aliyun.com
&>/dev/null' name=Synctime disabled=no"

#删除任务
ansible websrvs -m cron -a "name='backup mysql' state=absent"
ansible websrvs -m cron -a 'state=absent name=Synctime'

[root@ansible ~]#cat mysql_backup.sh 
#!/bin/bash
mysqldump -A -F --single-transaction --master-data=2 -q -uroot |gzip > /data/mysql_`date +%F_%T`.sql.gz
[root@ansible ~]#chmod +x mysql_backup.sh
[root@ansible ~]#ansible websrvs -m copy -a 'src=/root/mysql_backup.sh dest=/opt/'

[root@ansible ~]#ansible websrvs -a 'ls -l /opt/'
10.0.0.7 | CHANGED | rc=0 >>
total 4
-rw-r--r-- 1 root root 541 Jun 20 10:12 mysql_backup.sh
10.0.0.8 | CHANGED | rc=0 >>
total 4
-rw-r--r-- 1 root root 541 Jun 20 10:12 mysql_backup.sh

[root@ansible ~]#ansible websrvs -m cron -a 'hour=2 minute=30 weekday=1-5 name="backup mysql" job=/opt/mysql_backup.sh'
[root@ansible ~]#ansible websrvs -a 'crontab -l'
10.0.0.7 | CHANGED | rc=0 >>
#Ansible: backup mysql
30 2 * * 1-5 /opt/mysql_backup.sh
10.0.0.8 | CHANGED | rc=0 >>
#Ansible: backup mysql
30 2 * * 1-5 /opt/mysql_backup.sh

[root@Centos7 ~]#cat /var/spool/cron/root 
#Ansible: backup mysql
30 2 * * 1-5 /opt/mysql_backup.sh

ansible websrvs -m yum -a 'name=httpd state=present' #安装
ansible websrvs -m yum -a 'name=httpd state=absent' #删除

[root@ansible ~]#ansible websrvs -m yum -a 'name=iotop,cowsay'
[root@ansible ~]#ansible websrvs -a 'rpm -q iotop cowsay'

[root@centos8 ~]#ansible 10.0.0.100 -m apt -a 'name=bb,sl,cowsay,cmatrix,oneko,hollywood,boxes,libaa-bin,x11-apps'
[root@centos8 ~]#ansible websrvs -m apt -a 'name=rsync,psmisc state=absent'

- name: Install basic software
  yum:
    state: installed
    update_cache: yes
    name:
      - "vim"
      - "man"
      - "wget"
      - "tree"
      - "sysstat"

- name: install chronyd 
  package:
    name: chrony
    state: latest

#设为开机启动
ansible all -m service -a 'name=httpd state=started enabled=yes' 
#查看状态
ansible websrvs  -a 'systemctl is-enabled httpd'

ansible all -m service -a 'name=httpd state=stopped'
ansible all -m service -a 'name=httpd state=reloaded'
ansible all -m service -a 'name=httpd state=restarted'

#修改端口
ansible all -m shell -a "sed -i 's/^Listen 80/Listen 8080/' /etc/httpd/conf/httpd.conf"
[root@ansible ~]#ansible websrvs -a "grep Listen /etc/httpd/conf/httpd.conf"
10.0.0.7 | CHANGED | rc=0 >>
# Listen: Allows you to bind Apache to specific IP addresses and/or
# Change this to Listen on specific IP addresses as shown below to 
#Listen 12.34.56.78:80
Listen 8080
10.0.0.8 | CHANGED | rc=0 >>
# Listen: Allows you to bind Apache to specific IP addresses and/or
# Change this to Listen on specific IP addresses as shown below to 
#Listen 12.34.56.78:80
Listen 8080

#创建用户
ansible all -m user -a 'name=user1 comment="test user" uid=2048 home=/app/user1 group=root'

ansible all -m user -a 'name=nginx comment=nginx uid=88 group=nginx
groups="root,daemon" shell=/sbin/nologin system=yes create_home=no
home=/data/nginx non_unique=yes'

#remove=yes表示删除用户及家目录等数据,默认remove=no
ansible all -m user -a 'name=nginx state=absent remove=yes'

#创建组
ansible websrvs -m group -a 'name=nginx gid=88 system=yes'
#删除组
ansible websrvs -m group -a 'name=nginx state=absent'

ansible websrvs -m lineinfile -a "path=/etc/httpd/conf/httpd.conf
regexp='^Listen' line='Listen 80'"

ansible all -m lineinfile -a "path=/etc/selinux/config regexp='^SELINUX=' line='SELINUX=disabled'"

ansible all -m lineinfile -a 'dest=/etc/fstab state=absent regexp="^#"

ansible all -m replace -a "path=/etc/fstab regexp='^(UUID.*)' replace='#\1'"
ansible all -m replace -a "path=/etc/fstab regexp='^#(.*)' replace='\1'"

ansible all -m setup
ansible all -m setup -a "filter=ansible_nodename"
ansible all -m setup -a "filter=ansible_hostname"
ansible all -m setup -a "filter=ansible_domain"
ansible all -m setup -a "filter=ansible_memtotal_mb"
ansible all -m setup -a "filter=ansible_memory_mb"
ansible all -m setup -a "filter=ansible_memfree_mb"
ansible all -m setup -a "filter=ansible_os_family"
ansible all -m setup -a "filter=ansible_distribution_major_version"
ansible all -m setup -a "filter=ansible_distribution_version"
ansible all -m setup -a "filter=ansible_processor_vcpus"
ansible all -m setup -a "filter=ansible_all_ipv4_addresses"
ansible all -m setup -a "filter=ansible_architecture"
ansible all -m setup -a "filter=ansible_processor*"

[root@ansible ~]#ansible all -m setup -a 'filter=ansible_python_version' 
10.0.0.7 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "2.7.5",
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false
}
10.0.0.6 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "2.6.6",
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false
}
10.0.0.8 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "3.6.8",
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}
10.0.0.100 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "3.6.9",
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": false
}

#取所有IP
ansible 10.0.0.100 -m setup -a 'filter=ansible_all_ipv4_addresses'
10.0.0.100 | SUCCESS => {
    "ansible_facts": {
        "ansible_all_ipv4_addresses": [
            "10.0.0.100"
        ],
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": false
}

#取默认IP
[root@ansible ~]#ansible 10.0.0.8 -m setup -a 'filter="ansible_default_ipv4"'
10.0.0.8 | SUCCESS => {
    "ansible_facts": {
        "ansible_default_ipv4": {
            "address": "10.0.0.8",
            "alias": "eth0",
            "broadcast": "10.0.0.255",
            "gateway": "10.0.0.2",
            "interface": "eth0",
            "macaddress": "00:0c:29:30:80:0a",
            "mtu": 1500,
            "netmask": "255.255.255.0",
            "network": "10.0.0.0",
            "type": "ether"
        },
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}

---
- name: map hostname var
  set_fact:
    hostname: "{{ inventory_hostname }}"
  when: hostname is not defined

- name: disable_selinux
  selinux: state=disabled

- name: print data_disk_exist
  debug:
    msg: "{{data_disk_exist}}"

- name: mount data disk
  mount:
    name: '/data'
    src: '{{ data_disk }}'
    fstype: ext4
    state: mounted
  when: data_disk_exist.stdout is  match ("{{ data_disk }}:\ data")

- name: add tower key to root
  authorized_key:
    key: 'ssh-rsa AAAAB3NzaC1yc2ES1xX root@tower-1.ops.bj.tx.lan'
    user: root

- name: restart rsyslog
  systemd:
    name: rsyslog
    state: restarted
    enabled: true

- name: change PASS_MAX_DAYS for login.defs
  lineinfile:
     dest: /etc/login.defs
     regexp: '^PASS_MAX_DAYS   99999' 
     line: 'PASS_MAX_DAYS   90'

- name: change login 
  lineinfile:
     dest: /etc/pam.d/login
     state: present
     insertafter: '^auth       include'
     line: '{{ item }}'
  with_items:
  - "auth       required     pam_tally.so onerr=fail no_magic_root"
  - "account    required     pam_tally.so deny=3 no_magic_root reset"

one.example.com
one.example.com:two.example.com
192.168.1.50
192.168.1.*
Websrvs:dbsrvs         #或者，两个组的并集
Websrvs:&dbsrvs     #与，两个组的交集
webservers:!phoenix #在websrvs组，但不在dbsrvs组

- hosts: websrvs:appsrvs      hosts元素

- hosts: websrvs
  remote_user: root     #键值对

  tasks:
    - name: test connection
      ping:
      remote_user: cici
      sudo: yes             #默认sudo为root
      sudo_user:wang         #sudo为wang

action: module arguments
module: arguments 建议使用

---
- hosts: websrvs
  remote_user: root
  tasks:
    - name: install httpd
      yum: name=httpd
    - name: start httpd
      service: name=httpd state=started enabled=yes

#SHELL脚本实现
#!/bin/bash
# 安装Apache
yum install --quiet -y httpd
# 复制配置文件
cp /tmp/httpd.conf /etc/httpd/conf/httpd.conf
cp/tmp/vhosts.conf /etc/httpd/conf.d/
# 启动Apache，并设置开机启动
systemctl enable --now httpd

#Playbook实现
---
- hosts: websrvs
  remote_user: root
  tasks:
    - name: "安装Apache"
      yum: name=httpd
    - name: "复制配置文件"
      copy: src=/tmp/httpd.conf dest=/etc/httpd/conf/
    - name: "复制配置文件"
      copy: src=/tmp/vhosts.conf dest=/etc/httpd/conf.d/
    - name: "启动Apache，并设置开机启动"
      service: name=httpd state=started enabled=yes

---
- hosts: dbsrvs
  remote_user: root

  tasks:
    - {name: create group, group: name=mysql system=yes gid=306}
    - name: create user
    user: name=mysql shell=/sbin/nologin system=yes group=mysql uid=306 home=/data/mysql create_home=no

---
# install nginx
- hosts: websrvs
  remote_user: root
  tasks:
    - name: add group nginx
      user: name=nginx state=present
    - name: add user nginx
      user: name=nginx state=present group=nginx
    - name: Install Nginx
      yum: name=nginx state=present
    - name: web page
      copy: src=files/index.html dest=/usr/share/nginx/html/index.html
    - name: Start Nginx
      service: name=nginx state=started enabled=yes

---
#install httpd
- hosts: websrvs
  remote_user: root
  gather_facts: no
  tasks:
    - name: Install httpd
      yum: name=httpd state=present
    - name: Install configure file
      copy: src=files/httpd.conf dest=/etc/httpd/conf/
    - name: modify config
      lineinfile: path=/etc/httpd/conf/httpd.conf regexp='^Listen' line='Listen 8080'    
    - name: mkdir website dir
      file: path=/data/html state=directory
    - name: web html
      copy: src=files/index.html  dest=/data/html/
    - name: start service
      service: name=httpd state=started enabled=yes


ansible-playbook   install_httpd.yml --limit 10.0.0.8   #

#remove_httpd.yml
---
- hosts: websrvs
  remote_user: root
  tasks:
    - name: remove httpd package
      yum: name=httpd state=absent
    - name: remove apache user
      user: name=apache state=absent
    - name: remove config file
      file: name=/etc/httpd state=absent
    - name: remove web html
      file: name=/data/html/ state=absent

[root@ansible ~]#ls -l /data/ansible/files/mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz
-rw-r--r-- 1 root root 403177622 Dec 4 13:05 /data/ansible/files/mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz

[root@ansible ~]#cat /data/ansible/files/my.cnf
[mysqld]
socket=/tmp/mysql.sock
user=mysql
symbolic-links=0
datadir=/data/mysql
innodb_file_per_table=1
log-bin
pid-file=/data/mysql/mysqld.pid

[client]
port=3306
socket=/tmp/mysql.sock

[mysqld_safe]
log-error=/var/log/mysqld.log

#安全加固脚本,设密码
[root@ansible ~]#cat /data/ansible/files/secure_mysql.sh
#!/bin/bash
/usr/local/mysql/bin/mysql_secure_installation <<EOF

y
cici
cici
y
y 
y 
y
EOF

[root@ansible ~]#tree /data/ansible/files/
/data/ansible/files/
├── my.cnf
├── mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz
└── secure_mysql.sh

0 directories, 3 files

[root@ansible ~]#cat /data/ansible/install_mysql.yml
---
# install mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz
- hosts: dbsrvs
  remote_user: root
  gather_facts: no
  tasks:
    - name: install packages
      yum: name=libaio,perl-Data-Dumper,perl-Getopt-Long
    - name: create mysql group
      group: name=mysql gid=306
    - name: create mysql user
      user: name=mysql uid=306 group=mysql shell=/sbin/nologin system=yes
create_home=no home=/data/mysql
    - name: copy tar to remote host and file mode
      unarchive: src=/data/ansible/files/mysql-5.6.46-linux-glibc2.12-
x86_64.tar.gz dest=/usr/local/ owner=root group=root
    - name: create linkfile /usr/local/mysql
      file: src=/usr/local/mysql-5.6.46-linux-glibc2.12-x86_64
dest=/usr/local/mysql state=link
    - name: data dir
      shell: chdir=/usr/local/mysql/ ./scripts/mysql_install_db --
datadir=/data/mysql --user=mysql
      tags: data
    - name: config my.cnf
      copy: src=/data/ansible/files/my.cnf  dest=/etc/my.cnf
    - name: service script
      shell: /bin/cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqld
    - name: enable service
      shell: /etc/init.d/mysqld start;chkconfig --add mysqld;chkconfig mysqld on
      tags: service
    - name: PATH variable
      copy: content='PATH=/usr/local/mysql/bin:$PATH' dest=/etc/profile.d/mysql.sh
    - name: secure script
      script: /data/ansible/files/secure_mysql.sh
      tags: script
---
#Installing MariaDB Binary 

[root@ansible ansible]#ansible-playbook  install_mysql5.6.yml --limit 10.0.0.8
TASK [secure script] **************************************************************
fatal: [10.0.0.8]: FAILED! => {"changed": true, "msg": "non-zero return code", "rc": 29, "stderr": "Shared connection to 10.0.0.8 closed.\r\n", "stderr_lines": ["Shared connection to 10.0.0.8 closed."], "stdout": "Can't find a 'mysql' client in PATH or ./bin\r\nCleaning up...\r\nWarning: Could not unlink .my.cnf.3304: No such file or directory\r\nWarning: Could not unlink .mysql.3304: No such file or directory\r\n", "stdout_lines": ["Can't find a 'mysql' client in PATH or ./bin", "Cleaning up...", "Warning: Could not unlink .my.cnf.3304: No such file or directory", "Warning: Could not unlink .mysql.3304: No such file or directory"]}
PLAY RECAP ************************************************************************
10.0.0.8                   : ok=10   changed=10   unreachable=0    failed=1    skipped=0    rescued=0    ignored=0  

#打开目标主机,mysql端口已打开,但是命令找不到,别着急,退出重进
[root@centos8 ~]#ss -ntl
State    Recv-Q    Send-Q          Local Address:Port         Peer Address:Port    
LISTEN   0         128                   0.0.0.0:111               0.0.0.0:*       
LISTEN   0         128                   0.0.0.0:22                0.0.0.0:*       
LISTEN   0         128                   0.0.0.0:5355              0.0.0.0:*       
LISTEN   0         128                      [::]:111                  [::]:*       
LISTEN   0         128                      [::]:22                   [::]:*       
LISTEN   0         80                          *:3306                    *:*       
LISTEN   0         128                      [::]:5355                 [::]:*       
[root@centos8 ~]#mysql
-bash: mysql: command not found
[root@centos8 ~]#exit

#再次执行命令显示缺包
[root@centos8 ~]#mysql
mysql: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
[root@centos8 ~]#yum -y  install libaio numactl-libs ncurses-compat-libs libncurses.so.5

#登陆成功
[root@centos8 ~]#mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.6.47-log MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 

---
#Installing MariaDB Binary Tarballs
- hosts: dbsrvs
  remote_user: root
  gather_facts: no
  tasks:
    - name: create group
      group: name=mysql gid=27 system=yes
    - name: create user
      user: name=mysql uid=27 system=yes group=mysql shell=/sbin/nologin home=/data/mysql create_home=no
    - name: mkdir datadir
      file: path=/data/mysql owner=mysql group=mysql state=directory
    - name: unarchive package
      unarchive: src=/data/ansible/files/mariadb-10.2.27-linux-x86_64.tar.gz dest=/usr/local/ owner=root group=root
    - name: link
      file: src=/usr/local/mariadb-10.2.27-linux-x86_64 path=/usr/local/mysql state=link
    - name: install database
      shell: chdir=/usr/local/mysql   ./scripts/mysql_install_db -- datadir=/data/mysql --user=mysql
    - name: config file
      copy: src=/data/ansible/files/my.cnf  dest=/etc/ backup=yes
    - name: service script
      shell: /bin/cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqld
    - name: start service
      service: name=mysqld state=started enabled=yes
    - name: PATH variable
      copy: content='PATH=/usr/local/mysql/bin:$PATH' dest=/etc/profile.d/mysql.sh

ansible 10.0.0.101 -m setup -a 'filter="ansible_default_ipv4"'
10.0.0.101 | SUCCESS => {
    "ansible_facts": {
        "ansible_default_ipv4": {
            "address": "10.0.0.101",
            "alias": "eth0",
            "broadcast": "10.0.0.255",
            "gateway": "10.0.0.2",
            "interface": "eth0",
            "macaddress": "00:0c:29:e8:c7:9b",
            "mtu": 1500,
            "netmask": "255.255.255.0",
            "network": "10.0.0.0",
            "type": "ether"
        }
    },
    "changed": false
}

---
#var1.yml
- hosts: all
  remote_user: root
  gather_facts: yes
  tasks:
    - name: create log file
      file: name=/data/{{ ansible_nodename }}.log state=touch owner=cui mode=600

ansible-playbook var.yml

vim var2.yml
---
- hosts: websrvs
  remote_user: root
  tasks:
    - name: install package
      yum: name={{ pkname }} state=present

ansible-playbook –e pkname=httpd var2.yml

vim var3.yml
---
- hosts: websrvs
  remote_user: root
  vars:
    - username: user1
    - groupname: group1

  tasks:
    - name: create group
      group: name={{ groupname }} state=present
    - name: create user
      user: name={{ username }} group={{ groupname }} state=present

ansible-playbook -e "username=user2 groupname=group2" var3.yml
#-e的优先级比playbook中高

cat var4.yaml
---
  - hosts: websrvs
    remote_user: root
    vars:       #变量的定义方式,值从setup模块中来,生成一个和IP地址同名的文件夹
      collect_info: "/data/test/{{ansible_default_ipv4['address']}}/"

    tasks:
      - name: create IP directory
        file: name="{{collect_info}}" state=directory 

#执行结果
tree /data/test/
/data/test/
└── 10.0.0.102

1 directory, 0 files

vim vars.yml   #只负责定义变量
---
# variables file
package_name: mariadb-server
service_name: mariadb

vim var5.yml
---
#install package and start service
- hosts: dbsrvs
  remote_user: root
  vars_files:
    - vars.yml

  tasks:
    - name: install package
      yum: name={{ package_name }}
      tags: install
    - name: start service
      service: name={{ service_name }} state=started enabled=yes

cat vars2.yml
---
var1: httpd
var2: nginx

cat var6.yml
---        
- hosts: web
  remote_user: root
  vars_files:
    - vars2.yml

  tasks:
    - name: create httpd log
      file: name=/app/{{ var1 }}.log state=touch
    - name: create nginx log
      file: name=/app/{{ var2 }}.log state=touch

#准备templates/nginx.conf.j2文件
vim temnginx.yml
---
- hosts: websrvs
  remote_user: root

  tasks:
    - name: template config to remote hosts
      template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf

ansible-playbook temnginx.yml

#修改文件nginx.conf.j2
mkdir templates
vim templates/nginx.conf.j2
worker_processes {{ ansible_processor_vcpus }};   #cpu颗数

vim temnginx2.yml
---
- hosts: websrvs
  remote_user: root

  tasks:
    - name: install nginx
      yum: name=nginx
    - name: template config to remote hosts
      template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf  #这一步并不会原装复制,而是把目标文件调整修改之后生成新的conf文件
    - name: start service
      service: name=nginx state=started enabled=yes

ansible-playbook temnginx2.yml

#扩展:cpu颗数查看
[root@ansible ansible]#ansible websrvs -m setup -a 'filter=ansible_processor_vcpus'
10.0.0.7 | SUCCESS => {
    "ansible_facts": {
        "ansible_processor_vcpus": 2,
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false
}
10.0.0.8 | SUCCESS => {
    "ansible_facts": {
        "ansible_processor_vcpus": 1,
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}

vim nginx.conf.j2
worker_processes {{ ansible_processor_vcpus**2 }};    #2次方
worker_processes {{ ansible_processor_vcpus+2 }}; 

[root@ansible ansible]#vim templates/nginx.conf.j2
worker_processes {{ ansible_processor_vcpus**3 }};

[root@ansible ansible]#cat templnginx.yml
---
- hosts: websrvs
  remote_user: root

  tasks:
    - name: install nginx
      yum: name=nginx
    - name: template config to remote hosts
      template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
      notify: restart nginx
    - name: start service
      service: name=nginx state=started enabled=yes

  handlers:
    - name: restart nginx
      service: name=nginx state=restarted


ansible-playbook templnginx.yml --limit 10.0.0.8

#temlnginx2.yml
---
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:       #定义一个变量:由三个元素组成的一个列表
      - 81
      - 82
      - 83
  tasks:
    - name: template config
      template: src=nginx.conf.j2 dest=/data/nginx.conf

#templates/nginx2.conf.j2
{% for vhost in nginx_vhosts %}     #vhost会自动取81,82,83
server {
   listen {{ vhost }}
}
{% endfor %}

ansible-playbook -C templnginx2.yml --limit 10.0.0.8

#生成的结果：
server {
   listen 81  
}
server {
   listen 82  
}
server {
   listen 83  
}

#temlnginx3.yml
---
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - listen: 8080
  tasks:
    - name: config file
      template: src=nginx3.conf.j2 dest=/data/nginx3.conf

#templates/nginx3.conf.j2
{% for vhost in nginx_vhosts %}  
server {
  listen {{ vhost.listen }}
}
{% endfor %}

ansible-playbook   templnginx3.yml  --limit 10.0.0.8

#生成的结果
server {
  listen 8080
}

#templnginx4.yml
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - listen: 8080
        server_name: "web1.cici.com"
        root: "/var/www/nginx/web1/"
      - listen: 8081
        server_name: "web2.cici.com"
        root: "/var/www/nginx/web2/"
      - {listen: 8082, server_name: "web3.cici.com", root: "/var/www/nginx/web3/"}
  tasks:
    - name: template config
      template: src=nginx4.conf.j2 dest=/data/nginx4.conf


# templates/nginx.conf4.j2
{% for vhost in nginx_vhosts %}
server {
   listen {{ vhost.listen }}
   server_name {{ vhost.server_name }}
   root {{ vhost.root }}  
}
{% endfor %}

ansible-playbook templnginx4.yml --limit 10.0.0.8

#生成结果：
server {
    listen 8080
    server_name web1.cici.com
    root /var/www/nginx/web1/  
}
server {
    listen 8081
    server_name web2.cici.com
    root /var/www/nginx/web2/  
}
server {
    listen 8082
    server_name web3.cici.com
    root /var/www/nginx/web3/  
}

#templnginx5.yml
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - web1:
        listen: 8080
        root: "/var/www/nginx/web1/"
      - web2:
        listen: 8080
        server_name: "web2.cici.com"
        root: "/var/www/nginx/web2/"
      - web3:
        listen: 8080
        server_name: "web3.cici.com"
        root: "/var/www/nginx/web3/"
  tasks:
    - name: template config to
      template: src=nginx.conf5.j2 dest=/data/nginx5.conf
---

#templates/nginx.conf5.j2
#如果vhost.server_name定义过了,就生成server_name的值,没定义就不生成;即根据变量存在与否,来决定是否生成server_name

{% for vhost in nginx_vhosts %}
    server {
        listen {{ vhost.listen }}
            server_name {{ vhost.server_name }} #如果定义了vhost.server_name
        root  {{ vhost.root }}
    }
{% endfor %}

#生成的结果
server {
   listen 8080
   root /var/www/nginx/web1/
}
server {
   listen 8080
   server_name web2.cici.com
   root /var/www/nginx/web2/
}
server {
   listen 8080
   server_name web3.cici.com
   root /var/www/nginx/web3/
}

#创建角色相关的目录,默认在/etc/ansible/roles
mkdir -pv /data/ansible/roles/httpd/{tasks,handlers,files}

#创建角色相关的文件
cd /data/ansible/roles/httpd/

#main.yml 是task的入口文件
vim tasks/main.yml
- include: group.yml
- include: user.yml
- include: install.yml
- include: config.yml
- include: index.yml
- include: service.yml

vim tasks/group.yml
- name: create apache group
  group: name=apache system=yes gid=80

vim tasks/user.yml
- name: create apache user
  user: name=apache system=yes shell=/sbin/nologin home=/var/www/ uid=80 group=apache

vim tasks/install.yml
- name: install httpd package
  yum: name=httpd

vim tasks/config.yml
- name: config file
  copy: src=httpd.conf dest=/etc/httpd/conf/ backup=yes
  notify: restart

vim tasks/index.yml
- name: index.html
  copy: src=index.html dest=/var/www/html/

vim tasks/service.yml
- name: start service
  service: name=httpd state=started enabled=yes

vim handlers/main.yml
- name: restart
  service: name=httpd state=restarted

#在files目录下准备两个文件
ls files/
httpd.conf index.html

tree /data/ansible/roles/httpd/
/data/ansible/roles/httpd/
├── files
│   ├── httpd.conf
│   └── index.html
├── handlers
│   └── main.yml
└── tasks
   ├── config.yml
   ├── group.yml
   ├── index.yml
   ├── install.yml
   ├── main.yml
   ├── service.yml
   └── user.yml
3 directories, 10 files

#在playbook中调用角色
vim /data/ansible/role_httpd.yml
---
# httpd role
- hosts: websrvs
  remote_user: root

  roles:
    - httpd

#运行playbook
ansible-playbook /data/ansible/role_httpd.yml
mkdir -pv /data/ansible

mkdir -pv /data/ansible/roles/nginx/{tasks,handlers,templates,vars}

#创建task文件
cd /data/ansible/roles/nginx/

vim tasks/main.yml
- include: install.yml
- include: config.yml
- include: index.yml
- include: service.yml

vim tasks/install.yml
- name: install
  yum: name=nginx

vim tasks/config.yml
- name: config file for centos7
  template: src=nginx7.conf.j2 dest=/etc/nginx/nginx.conf
  when: ansible_distribution_major_version=="7"
  notify: restart

- name: config file for centos8
  template: src=nginx8.conf.j2 dest=/etc/nginx/nginx.conf
  when: ansible_distribution_major_version=="8"
  notify: restart

vim tasks/index.yml
- name: index.html
  copy: src=roles/httpd/files/index.html dest=/usr/share/nginx/html/

vim tasks/service.yml
- name: start service
  service: name=nginx state=started enabled=yes

#创建handler文件
cat handlers/main.yml
- name: restart
  service: name=nginx state=restarted

#创建两个template文件
cat templates/nginx7.conf.j2
...省略...
user {{user}};
worker_processes {{ansible_processor_vcpus+3}};   #修改此行
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
...省略...

cat templates/nginx8.conf.j2
...省略...
user nginx;
worker_processes {{ansible_processor_vcpus**3}};  #修改此行
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
...省略...

#创建变量文件
vim vars/main.yml
user: daemon

#目录结构如下
tree /data/ansible/roles/nginx/
/data/ansible/roles/nginx/
├── handlers
│   └── main.yml
├── tasks
│   ├── config.yml
│   ├── file.yml
│   ├── install.yml
│   ├── main.yml
│   └── service.yml
├── templates
│   ├── nginx7.conf.j2
│   └── nginx8.conf.j2
└── vars
   └── main.yml
4 directories, 9 files

#在playbook中调用角色
vim /data/ansible/role_nginx.yml
---
#nginx role
- hosts: websrvs

  roles:
    - role: nginx

#运行playbook
ansible-playbook /data/ansible/role_nginx.yml

mkdir -pv /data/ansible/roles/memcached/{tasks,templates}

cd /data/ansible/roles/memcached
vim tasks/main.yml
- include: install.yml
- include: config.yml
- include: service.yml

vim tasks/install.yml
- name: install
  yum: name=memcached

vim tasks/config.yml
- name: config file
  template: src=memcached.j2  dest=/etc/sysconfig/memcached
  vim tasks/service.yml
- name: service
  service: name=memcached state=started enabled=yes

#//整除
vim templates/memcached.j2
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="{{ansible_memtotal_mb//4}}"   
OPTIONS=""

tree /data/ansible/roles/memcached/
/data/ansible/roles/memcached/
├── tasks
│   ├── config.yml
│   ├── install.yml
│   ├── main.yml
│   └── service.yml
└── templates
   └── memcached.j2

2 directories, 5 files

vim /data/ansible/role_memcached.yml
---
- hosts: appsrvs

  roles:
    - role: memcached

ansible-play /data/ansible/role_memcached.yml 

[root@ansible ~]#cat /data/ansible/roles/mysql/files/my.cnf
[mysqld]
socket=/tmp/mysql.sock
user=mysql
symbolic-links=0
datadir=/data/mysql
innodb_file_per_table=1
log-bin
pid-file=/data/mysql/mysqld.pid

[client]
port=3306
socket=/tmp/mysql.sock

[mysqld_safe]
log-error=/var/log/mysqld.log

[root@ansible ~]#cat /data/ansible/roles/mysql/files/secure_mysql.sh
#!/bin/bash
/usr/local/mysql/bin/mysql_secure_installation <<EOF

y
cici
cici
y
y
y
y
EOF

[root@ansible ~]#chmod +x /data/ansible/roles/mysql/files/secure_mysql.sh

[root@ansible ~]#ls /data/ansible/roles/mysql/files/
my.cnf mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz secure_mysql.sh

[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/main.yml
- include: install.yml
- include: group.yml
- include: user.yml
- include: unarchive.yml
- include: link.yml
- include: data.yml
- include: config.yml
- include: service.yml
- include: path.yml
- include: secure.yml

[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/install.yml
- name: install packages                                            
  yum: name=libaio,perl-Data-Dumper,perl-Getopt-Long
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/group.yml
- name: create mysql group
  group: name=mysql gid=306
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/user.yml
- name: create mysql user
  user: name=mysql uid=306 group=mysql shell=/sbin/nologin system=yes
create_home=no home=/data/mysql
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/unarchive.yml
- name: copy tar to remote host and file mode
  unarchive: src=mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz dest=/usr/local/
owner=root group=root
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/link.yml
- name: mkdir /usr/local/mysql
  file: src=/usr/local/mysql-5.6.46-linux-glibc2.12-x86_64 dest=/usr/local/mysql state=link
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/data.yml
- name: data dir
  shell: chdir=/usr/local/mysql/ ./scripts/mysql_install_db --
datadir=/data/mysql --user=mysql
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/config.yml
- name: config my.cnf
  copy: src=my.cnf  dest=/etc/my.cnf
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/service.yml
- name: service script
  shell: /bin/cp /usr/local/mysql/support-files/mysql.server
/etc/init.d/mysqld;chkconfig --add mysqld;chkconfig mysqld on;/etc/init.d/mysqld start
[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/path.yml
- name: PATH variable
  copy: content='PATH=/usr/local/mysql/bin:$PATH' dest=/etc/profile.d/mysql.sh  

[root@ansible ~]#cat /data/ansible/roles/mysql/tasks/secure.yml
- name: secure script
  script: secure_mysql.sh

[root@ansible ~]#tree /data/ansible/roles/mysql/
/data/ansible/roles/mysql/
├── files
│   ├── my.cnf
│   ├── mysql-5.6.46-linux-glibc2.12-x86_64.tar.gz
│   └── secure_mysql.sh
└── tasks
   ├── config.yml
   ├── data.yml
   ├── group.yml
   ├── install.yml
   ├── link.yml
   ├── main.yml
   ├── path.yml
   ├── secure.yml
   ├── service.yml
   ├── unarchive.yml
   └── user.yml

2 directories, 14 files

[root@ansible ~]#cat /data/ansible/mysql_roles.yml
- hosts: dbsrvs
  remote_user: root
  roles:
    - {role: mysql,tags: ["mysql","db"]}
    - {role: nginx,tage: ["nginx","web"]}

[root@ansible ~]#ansible-playbook -t mysql /data/ansible/mysql_roles.yml

vim /data/ansible/role_httpd_nginx.yml
---
- hosts: websrvs

  roles:
    - {role: httpd,tags: [httpd,web], when:
ansible_distribution_major_version=="7" }
    - {role: nginx,tags: [nginx,web], when:
ansible_distribution_major_version=="8" }

ansible-playbook -t nginx /data/ansible/role_httpd_nginx.yml 

domain_cloud: tx
domain_group: ops
domain_region: bj