121
echo -e "\n$(date +"%d-%b-%Y-%H-%M-%S") | Installing NGINX from .deb
package...\n" |& tee -a ${INSTALL_LOG_FILE_PATH}
# Install the .deb package, this allows uninstall via apt-get
sudo dpkg -i ${DEB_PKG_FILE} |& tee -a ${INSTALL_LOG_FILE_PATH}
echo "$(date +"%d-%b-%Y-%H-%M-%S") | Install completed successfully,
creating archive of source files..." |& tee -a ${INSTALL_LOG_FILE_PATH}
# Move the .deb package to a new folder since we are going to create an
# archive from the directory containing the downloaded source code files,
# which is our current working directory
sudo mv ${DEB_PKG_FILE}
${DEB_PKG_FOLDER_PATH}/${DEB_PKG_FILE} >>
${INSTALL_LOG_FILE_PATH} 2>&1
# Create an archive containing all the source files needed to build NGINX and
# compress the files using the .tar.gz format
cd $SRC_FOLDER_PATH/ && sudo tar -zcf ../$ALL_SRC_FILES_TAR . >>
${INSTALL_LOG_FILE_PATH} 2>&1
cd ..
sudo mv $ALL_SRC_FILES_TAR $DEB_PKG_FOLDER_PATH >>
${INSTALL_LOG_FILE_PATH} 2>&1
# Make both .deb package and source files archive executable by all users
sudo chmod 755 ${DEB_PKG_FOLDER_PATH}/nginx*.* >>
${INSTALL_LOG_FILE_PATH} 2>&1
122
Конфигурация Nginx после установки
#!/bin/bash -e
GEOIP1_PRE=GeoLite2-City
GEOIP2_PRE=GeoLite2-Country
EXT=.tar.gz
EXT_DB=.mmdb
SRC_FOLDER_PATH=${WORKING_DIR}/${SRC_FOLDER}
DEB_PKG_FOLDER_PATH=${WORKING_DIR}/${DEB_PKG_FOLDER
}
INSTALL_LOG_FOLDER_PATH=${WORKING_DIR}/${LOG_FOLDER
}
INSTALL_LOG_FILE_PATH=${INSTALL_LOG_FOLDER_PATH}/${LO
G_FILE}
GEOIP1_DB_TAR=${GEOIP1_PRE}${EXT}
GEOIP2_DB_TAR=${GEOIP2_PRE}${EXT}
GEOIP1_DB_FOLDER=${GEOIP1_PRE}_${GEOIP_VER}
GEOIP2_DB_FOLDER=${GEOIP2_PRE}_${GEOIP_VER}
GEOIP1_DB_FILE=${GEOIP1_PRE}${EXT_DB}
GEOIP2_DB_FILE=${GEOIP2_PRE}${EXT_DB}
##############################################################
############
123
# Create a directory at /var/lib/nginx to prevent the NGINX config
# file from failing verification in next command (sudo nginx -t)
sudo mkdir -p /var/lib/nginx >> ${INSTALL_LOG_FILE_PATH} 2>&1
echo -e "\n$(date +"%d-%b-%Y-%H-%M-%S") | Verify configuration file
syntax is correct and test is successful:\n" |& tee -a ${INSTALL_LOG_FILE_PATH}
&& \
# This command tests the nginx.conf file for syntax errors and other
# potential issues like file access, permissions, etc.
sudo nginx -t |& tee -a ${INSTALL_LOG_FILE_PATH} && \
echo -e "\n$(date +"%d-%b-%Y-%H-%M-%S") | Verify NGINX version
and configure arguments match your selections:\n" |& tee -a
${INSTALL_LOG_FILE_PATH} && \
# Verify NGINX version and verify configuration options match what
# was specified with the ./configure command
sudo nginx -V |& tee -a ${INSTALL_LOG_FILE_PATH} && \
echo -e "\n$(date +"%d-%b-%Y-%H-%M-%S") | Creating folders for
nginx virtual hosts..." |& tee -a ${INSTALL_LOG_FILE_PATH} && \
# Create folders for nginx virtual hosts
cd /etc/nginx
sudo mkdir sites-available >> ${INSTALL_LOG_FILE_PATH} 2>&1
sudo mkdir sites-enabled >> ${INSTALL_LOG_FILE_PATH} 2>&1
#echo -e "$(date +"%d-%b-%Y-%H-%M-%S") | Downloading GeoIP2
database files..." |& tee -a ${INSTALL_LOG_FILE_PATH} && \
## Create directory for GeoIP2 databases
#sudo mkdir -p /etc/nginx/geoip2 >> ${INSTALL_LOG_FILE_PATH} 2>&1
124
#
## Download latest versions of GeoIP2 databases and extract database files
#sudo wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-
City.tar.gz >> ${INSTALL_LOG_FILE_PATH} 2>&1 && \
# sudo tar -xzf $GEOIP1_DB_TAR
$GEOIP1_DB_FOLDER/$GEOIP1_DB_FILE --strip-components 1 >>
${INSTALL_LOG_FILE_PATH} 2>&1
#sudo wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-
Country.tar.gz >> ${INSTALL_LOG_FILE_PATH} 2>&1 && \
# sudo tar -zxf $GEOIP2_DB_TAR
$GEOIP2_DB_FOLDER/$GEOIP2_DB_FILE --strip-components 1 >>
${INSTALL_LOG_FILE_PATH} 2>&1
#
## Move GeoIP2 database files to NGINX config directory and remove .tar.gz
archives
#sudo mv *.mmdb /etc/nginx/geoip2 >> ${INSTALL_LOG_FILE_PATH}
2>&1
#sudo rm *.tar.gz |& tee >> ${INSTALL_LOG_FILE_PATH} 2>&1
echo "$(date +"%d-%b-%Y-%H-%M-%S") | Configuring firewall app
profile..." |& tee -a ${INSTALL_LOG_FILE_PATH}
# Move the UFW app profile uploaded by the previous script to
# the correct location. UFW is disabled by default
sudo mv ${DEB_PKG_FOLDER_PATH}/nginx
/etc/ufw/applications.d/nginx
echo "$(date +"%d-%b-%Y-%H-%M-%S") | Configuring systemd unit file..."
|& tee -a ${INSTALL_LOG_FILE_PATH}
# Move the file to correct location so NGINX can be started,
# stopped and reloaded with global commands
125
sudo mv /${DEB_PKG_FOLDER_PATH}/nginx.service
/etc/systemd/system/nginx.service
echo "$(date +"%d-%b-%Y-%H-%M-%S") | Setting permissions for NGINX
user account..." |& tee -a ${INSTALL_LOG_FILE_PATH}
sudo touch /run/nginx.pid
sudo chown www-data:www-data /run/nginx.pid
sudo chmod 755 /run/nginx.pid
sudo chown -R www-data:www-data /var/log/nginx/*
sudo chown -R www-data:www-data /var/lib/nginx/*
sudo chown -R www-data:www-data /etc/nginx/*
echo "$(date +"%d-%b-%Y-%H-%M-%S") | Installation and configuration is
complete, removing source files..." |& tee -a ${INSTALL_LOG_FILE_PATH}
# Remove all source files
sudo rm -rf $SRC_FOLDER_PATH
echo -e "$(date +"%d-%b-%Y-%H-%M-%S") | Starting NGINX, verify
service is active:\n" |& tee -a ${INSTALL_LOG_FILE_PATH} && \
# Start and enable NGINX service
sudo systemctl start nginx.service >> ${INSTALL_LOG_FILE_PATH}
2>&1 && \
sudo systemctl enable nginx.service >> ${INSTALL_LOG_FILE_PATH}
2>&1 && \
# Verify NGINX is running
sudo systemctl status nginx.service |& tee -a
${INSTALL_LOG_FILE_PATH} && \
126
sudo systemctl status nginx.service | grep -q 'Active: active (running)' >
/dev/null 2>&1
if [ "$?" -gt "0" ]; then
# if the NGINX service is not Active, there is a configuration
# error, so the exit code is set to 1 and the script is aborted
echo -e "\n$(date +"%d-%b-%Y-%H-%M-%S") | NGINX did not start
correctly, aborting script" |& tee -a ${INSTALL_LOG_FILE_PATH}
exit 1
fi
# Reboot the server
echo -e "\n$(date +"%d-%b-%Y-%H-%M-%S") | NGINX is successfully
installed and configured" |& tee -a ${INSTALL_LOG_FILE_PATH}
echo "$(date +"%d-%b-%Y-%H-%M-%S") | Rebooting server to verify
NGINX starts automatically..." |& tee -a ${INSTALL_LOG_FILE_PATH}
sudo shutdown -r now
Создание образа Ubuntu 18.04.04 и установка Nginx из исходного
кода в AWS с помощью Packer
{
"variables": {
"nginx_ver": "1.17.7",
"pcre_ver": "8.42",
"zlib_ver": "1.2.11",
"openssl_ver": "1.1.0h",
"geoip_ver": "20180605",
"headers_more_ver":"v0.33",
"working_dir": "/opt",
"src_folder": "src_files",
"deb_pkg_folder": "deb_pkg",
"log_folder": "log",
"log_file": "install_source.log"
},
"builders": [{
"type": "amazon-ebs",
"access_key": "{{user `aws_access_key`}}",
"secret_key": "{{user `aws_secret_key`}}",
"region": "eu-north-1",
"source_ami_filter": {
"filters": {
"virtualization-type": "hvm",
127
"name": "ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*",
"root-device-type": "ebs"
},
"owners": ["099720109477"],
"most_recent": true
},
"instance_type": "t2.micro",
"ssh_username": "ubuntu",
"ssh_keypair_name": "id_rsa",
"ssh_private_key_file": "/home/akilin/.ssh/id_rsa",
"ami_name": "custom_nginx_ubuntu_{{timestamp}}",
"associate_public_ip_address": "true"
}],
"provisioners": [{
"type": "shell",
"inline": ["sudo mkdir -p {{user `working_dir`}}/{{user `src_folder`}}",
"sudo chown ubuntu:ubuntu {{user `working_dir`}}/{{user `src_folder`}}",
"sudo mkdir -p {{user `working_dir`}}/{{user `deb_pkg_folder`}}/",
"sudo chown ubuntu:ubuntu {{user `working_dir`}}/{{user `deb_pkg_folder`}}"]
},{
"type": "file",
"source": "./upload/",
"destination": "{{user `working_dir`}}/{{user `deb_pkg_folder`}}"
},{
"type": "shell",
"scripts": ["./bash-scripts/00--nginx-prep_install.sh",
"./bash-scripts/01a-nginx-install_from_source.sh",
"./bash-scripts/02--nginx-configure_post_install.sh",
"./bash-scripts/01c-ansible-install_from_apt.sh"],
"expect_disconnect": true,
"environment_vars": [
"NGINX_VER={{user `nginx_ver`}}",
"PCRE_VER={{user `pcre_ver`}}",
"ZLIB_VER={{user `zlib_ver`}}",
"OPENSSL_VER={{user `openssl_ver`}}",
"HEADERS_MORE_VER={{user `headers_more_ver`}}",
"GEOIP_VER={{user `geoip_ver`}}",
"WORKING_DIR={{user `working_dir`}}",
"SRC_FOLDER={{user `src_folder`}}",
"DEB_PKG_FOLDER={{user `deb_pkg_folder`}}",
"LOG_FOLDER={{user `log_folder`}}",
"LOG_FILE={{user `log_file`}}"]
},{
"type": "shell",
"script": "./bash-scripts/03--nginx-verify_install.sh",
"pause_before": "10s",
"environment_vars": [
"WORKING_DIR={{user `working_dir`}}",
"LOG_FOLDER={{user `log_folder`}}",
"LOG_FILE={{user `log_file`}}"]
},{
"type": "file",
"source": "{{user `working_dir`}}/{{user `deb_pkg_folder`}}/",
"destination": "./download",
128
"direction": "download"
},{
"type": "ansible-local",
"playbook_file": "./upload/nginx.yml"
},{
"type": "file",
"source": "{{user `working_dir`}}/{{user `log_folder`}}/",
"destination": "./download",
"direction": "download"
}]
}
Разворачивание инфраструктуры внутри AWS с помощью Terraform
скрипта
/*====
Variables used across all modules
======*/
locals {
production_availability_zones = ["eu-central-1a", "eu-central-1b"]
}
#
# Provider. We assume access keys are provided via environment variables.
#
provider "aws" {
region = "${var.aws_region}"
}
#
# Network. We create a VPC, gateway, subnets and security groups.
#
resource "aws_vpc" "vpc_main" {
cidr_block = "10.0.0.0/16"
enable_dns_support = true
enable_dns_hostnames = true
tags {
Name = "Main VPC"
}
}
data "aws_availability_zone" "a" {
name = "eu-central-1a"
}
data "aws_availability_zone" "b" {
name = "eu-central-1b"
}
129
resource "aws_internet_gateway" "default" {
vpc_id = "${aws_vpc.vpc_main.id}"
}
resource "aws_route" "internet_access" {
route_table_id = "${aws_vpc.vpc_main.main_route_table_id}"
destination_cidr_block = "0.0.0.0/0"
gateway_id = "${aws_internet_gateway.default.id}"
}
# Create a public subnet to launch our load balancers
resource "aws_subnet" "public1" {
vpc_id = "${aws_vpc.vpc_main.id}"
cidr_block = "10.0.7.0/24" # 10.0.0.0 - 10.0.0.255 (256)
map_public_ip_on_launch = true
availability_zone = "${data.aws_availability_zone.a.name}"
}
resource "aws_subnet" "public2" {
vpc_id = "${aws_vpc.vpc_main.id}"
cidr_block = "10.0.8.0/24" # 10.0.0.0 - 10.0.0.255 (256)
map_public_ip_on_launch = true
availability_zone = "${data.aws_availability_zone.b.name}"
}
# Create a private subnet to launch our backend instances
resource "aws_subnet" "private1" {
vpc_id = "${aws_vpc.vpc_main.id}"
cidr_block = "10.0.10.0/24" # 10.0.1.0 - 10.0.1.255 (256)
// map_public_ip_on_launch = true
// availability_zone = "${data.aws_availability_zone.names[count.index]}"
// availability_zone = ["eu-central-1b","eu-central-1a"]
availability_zone = "${data.aws_availability_zone.a.name}"
}
resource "aws_subnet" "private2" {
vpc_id = "${aws_vpc.vpc_main.id}"
cidr_block = "10.0.11.0/24" # 10.0.1.0 - 10.0.1.255 (256)
// map_public_ip_on_launch = true
// availability_zone = "${data.aws_availability_zone.names[count.index]}"
// availability_zone = ["eu-central-1b","eu-central-1a"]
availability_zone = "${data.aws_availability_zone.b.name}"
}
# A security group for the ELB so it is accessible via the web
resource "aws_security_group" "elb" {
name = "sec_group_elb"
description = "Security group for public facing ELBs"
vpc_id = "${aws_vpc.vpc_main.id}"
# HTTP access from anywhere
ingress {
from_port = 80
to_port = 80
130
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# HTTPS access from anywhere
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# Outbound internet access
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
data "aws_security_group" "db" {
vpc_id = "${aws_vpc.vpc_main.id}"
name = "default"
}
# Our default security group to access the instances over SSH and HTTP
resource "aws_security_group" "bastion" {
name = "sec_group_private"
description = "Security group for backend servers and private ELBs"
vpc_id = "${aws_vpc.vpc_main.id}"
tags {
Name = "HapiProdBastion_SG"
}
# SSH access from anywhere
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# Allow all from private subnet
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["${aws_subnet.private1.cidr_block}"]
}
# Outbound internet access
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}