diff --git a/.gitignore b/.gitignore index 7e166d0..6c20424 100644 --- a/.gitignore +++ b/.gitignore @@ -36,4 +36,7 @@ terraform.rc # ---> Ansible *.retry +vault_pass +# ---> vagrant +.vagrant diff --git a/Vagrantfile b/Vagrantfile new file mode 100644 index 0000000..752de8d --- /dev/null +++ b/Vagrantfile @@ -0,0 +1,22 @@ +VAGRANTFILE_API_VERSION = "2" + Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| + config.vm.box = "ubuntu/jammy64" + config.vm.define "web1" do |master| + master.vm.hostname = "web1" + master.vm.network "forwarded_port", guest: 80, host: 8080 + master.vm.network "private_network", ip: "192.168.56.2" + end + config.vm.define "web2" do |master| + master.vm.hostname = "web2" + master.vm.network "forwarded_port", guest: 80, host: 8081 + master.vm.network "private_network", ip: "192.168.56.3" + end + config.vm.provider "virtualbox" do |v| + v.memory = 1024 + v.cpus = 2 + end + config.vm.provision "ansible" do |ansible| + ansible.playbook = "ansible/playbook.yaml" + ansible.vault_password_file = "vault_pass" + end +end diff --git a/ansible/playbook.yaml b/ansible/playbook.yaml new file mode 100644 index 0000000..be03579 --- /dev/null +++ b/ansible/playbook.yaml @@ -0,0 +1,19 @@ +--- +- name: Setup LEMP stack + hosts: all + vars_files: + - vault.yaml + vars: + server_name: wordpress-jr.senecops.com + wordpress: + dir: /var/www/html/wordpress + db_name: wordpress + db_user: wp + db_pass: 12345678 + php: + version: 8.1 + roles: + - nginx + - mysql + - php + - wordpress diff --git a/ansible/roles/mysql/handlers/main.yaml b/ansible/roles/mysql/handlers/main.yaml new file mode 100644 index 0000000..808cb09 --- /dev/null +++ b/ansible/roles/mysql/handlers/main.yaml @@ -0,0 +1,7 @@ +--- +- name: restart mysql + ansible.builtin.service: + name: mysql + state: restarted + enabled: true + become: true diff --git a/ansible/roles/mysql/tasks/main.yaml b/ansible/roles/mysql/tasks/main.yaml new file mode 100644 index 0000000..3df6445 --- /dev/null +++ b/ansible/roles/mysql/tasks/main.yaml @@ -0,0 +1,46 @@ +--- +- name: Install relevant packages + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + name: + - mariadb-client + - mariadb-server + - python3-pymysql + state: present + become: true + +- name: Set new root user password + community.mysql.mysql_user: + name: root + password: "{{ mysql_root_password }}" + check_implicit_admin: true + login_unix_socket: /var/run/mysqld/mysqld.sock + become: true + +- name: Create wordpress user with password, grant wordpress permissions + community.mysql.mysql_user: + state: present + name: "{{ wordpress.db_user }}" + login_user: root + login_password: "{{ mysql_root_password }}" + password: "{{ wordpress.db_pass }}" + priv: + "wordpress.*": "ALL,GRANT" + login_unix_socket: /var/run/mysqld/mysqld.sock + become: true + +- name: Store the config for task indempotency as written in the mysql collection docs + ansible.builtin.template: + src: "my.cnf.j2" + dest: "/root/.my.cnf" + mode: "0400" + become: true + notify: restart mysql + +- name: Setup database for wordpress + community.mysql.mysql_db: + name: "{{ wordpress.db_name }}" + state: present + login_unix_socket: /var/run/mysqld/mysqld.sock + become: true diff --git a/ansible/roles/mysql/templates/my.cnf.j2 b/ansible/roles/mysql/templates/my.cnf.j2 new file mode 100644 index 0000000..b63b4e6 --- /dev/null +++ b/ansible/roles/mysql/templates/my.cnf.j2 @@ -0,0 +1,3 @@ +[client] +user=root +password={{ mysql_root_password }} diff --git a/ansible/roles/nginx/handlers/main.yaml b/ansible/roles/nginx/handlers/main.yaml new file mode 100644 index 0000000..261c28f --- /dev/null +++ b/ansible/roles/nginx/handlers/main.yaml @@ -0,0 +1,7 @@ +--- +- name: restart nginx + ansible.builtin.service: + name: nginx + state: restarted + enabled: true + become: true diff --git a/ansible/roles/nginx/tasks/main.yaml b/ansible/roles/nginx/tasks/main.yaml new file mode 100644 index 0000000..42c41f1 --- /dev/null +++ b/ansible/roles/nginx/tasks/main.yaml @@ -0,0 +1,21 @@ +--- +- name: Install packages + ansible.builtin.apt: + update_cache: true + cache_valid_time: 3600 + name: + - nginx + become: true + +- name: Remove default nginx config + ansible.builtin.file: + path: "/etc/nginx/sites-enabled/default" + state: absent + become: true + +- name: Copy wordpress nginx config + ansible.builtin.template: + src: "wordpress.conf.j2" + dest: "/etc/nginx/sites-enabled/wordpress.conf" + notify: restart nginx + become: true diff --git a/ansible/roles/nginx/templates/wordpress.conf.j2 b/ansible/roles/nginx/templates/wordpress.conf.j2 new file mode 100644 index 0000000..38cda0f --- /dev/null +++ b/ansible/roles/nginx/templates/wordpress.conf.j2 @@ -0,0 +1,36 @@ +server { + listen 80 default_server; + server_name {{ server_name }}; + root {{ wordpress.dir }}; + index index.php; + + # Deny access to any files with a .php extension in the uploads directory + location ~* /(?:uploads|files)/.*\.php$ { + deny all; + } + + location / { + try_files $uri $uri/ /index.php?$args; + } + + location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ { + expires max; + log_not_found off; + } + + location ~ \.php$ { + try_files $uri =404; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_pass unix:/var/run/php/wordpress.sock; + fastcgi_param SCRIPT_FILENAME + $document_root$fastcgi_script_name; + include fastcgi_params; + } + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } +} diff --git a/ansible/roles/php/handlers/main.yaml b/ansible/roles/php/handlers/main.yaml new file mode 100644 index 0000000..056585b --- /dev/null +++ b/ansible/roles/php/handlers/main.yaml @@ -0,0 +1,5 @@ +--- +- name: restart php-fpm + service: + name: php{{ php.version }}-fpm + state: restarted diff --git a/ansible/roles/php/tasks/main.yaml b/ansible/roles/php/tasks/main.yaml new file mode 100644 index 0000000..9d27271 --- /dev/null +++ b/ansible/roles/php/tasks/main.yaml @@ -0,0 +1,40 @@ +--- +- name: Install relevant packages + ansible.builtin.apt: + cache_valid_time: 3600 + update_cache: true + name: + - php{{ php.version }}-cli + - php{{ php.version }}-fpm + - php{{ php.version }}-mysql + - php{{ php.version }}-opcache + - php{{ php.version }}-mbstring + - php{{ php.version }}-xml + - php{{ php.version }}-gd + - php{{ php.version }}-curl + - php-json + state: present + become: true + +- name: Disable default pool + ansible.builtin.command: mv /etc/php/{{ php.version }}/fpm/pool.d/www.conf /etc/php/{{ php.version }}/fpm/pool.d/www.conf.disabled + args: + creates: /etc/php/{{ php.version }}/fpm/pool.d/www.conf.disabled + notify: restart php-fpm + become: true + +- name: Create socket + ansible.builtin.file: + path: /var/run/php/wordpress.sock + state: touch + owner: www-data + group: www-data + notify: restart php-fpm + become: true + +- name: Copy php-fpm configuration + ansible.builtin.template: + src: wordpress.conf.j2 + dest: "/etc/php/{{ php.version }}/fpm/pool.d/wordpress.conf" + notify: restart php-fpm + become: true diff --git a/ansible/roles/php/templates/wordpress.conf.j2 b/ansible/roles/php/templates/wordpress.conf.j2 new file mode 100644 index 0000000..96ba7b1 --- /dev/null +++ b/ansible/roles/php/templates/wordpress.conf.j2 @@ -0,0 +1,15 @@ +[wordpress] +listen = /var/run/php/wordpress.sock +listen.owner = www-data +listen.group = www-data +listen.mode = 0660 +user = wordpress +group = wordpress +pm = dynamic +pm.max_children = 10 +pm.start_servers = 1 +pm.min_spare_servers = 1 +pm.max_spare_servers = 3 +pm.max_requests = 500 +chdir = {{ wordpress.dir }} +php_admin_value[open_basedir] = {{ wordpress.dir }}:/tmp diff --git a/ansible/roles/wordpress/tasks/main.yaml b/ansible/roles/wordpress/tasks/main.yaml new file mode 100644 index 0000000..03e24a4 --- /dev/null +++ b/ansible/roles/wordpress/tasks/main.yaml @@ -0,0 +1,39 @@ +--- +- name: Download wordpress archive + ansible.builtin.get_url: + url: https://de.wordpress.org/latest-de_DE.tar.gz + dest: /tmp/wordpress.tar.gz + +- name: Extract wordpress + ansible.builtin.unarchive: + src: /tmp/wordpress.tar.gz + dest: "{{ wordpress.dir | dirname }}" + remote_src: true + become: true + +- name: Add wordpress group + ansible.builtin.group: + name: wordpress + become: true + +- name: Add wordpress user + ansible.builtin.user: + name: wordpress + group: www-data + become: true + +- name: Add wordpress config + ansible.builtin.template: + src: "wp-config.php.j2" + dest: "{{ wordpress.dir }}/wp-config.php" + become: true + +- name: Change ownership of wordpress installation + ansible.builtin.file: + path: "{{ wordpress.dir }}" + owner: wordpress + group: www-data + state: directory + recurse: true + become: true + diff --git a/ansible/roles/wordpress/templates/wp-config.php.j2 b/ansible/roles/wordpress/templates/wp-config.php.j2 new file mode 100644 index 0000000..cfca491 --- /dev/null +++ b/ansible/roles/wordpress/templates/wp-config.php.j2 @@ -0,0 +1,116 @@ +