117
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
include /etc/nginx/default.d/*.conf;
location / {
}
118
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
119
Приложение 2. Сценарий разворачивания виртуального сервера.
- hosts: centos7all
vars_promt:
- name: "container_name"
promt: "Please enter lxc name"
private: no
vars_promt:
- name: "container_ip"
promt: "Please enter container ip"
private: no
tasks:
- name: create container
command: "lxc-create -t download -n {{container_name }} -- --dist centos --
release 7 --arch amd64"
- name: Set up ip for container
template:
src: /etc/ansible/templates/etc/lxc/lxc_default_centos
dest: "/var/lib/lxc/{{container_name}}"
owner: root
group: root
mode: 0644
- name: try to start container
command: "lxc-start {{container_name}
120
Приложение 3. Cценарий постинсталляционной настройки ОС.
- hosts: centos7all
tasks:
- name: Installing epel repo package
yum:
name: epel-release
- name: Installing necessary base packages
yum:
name: "{{ item }}"
with_items:
- open-vm-tools
- nano
- mc
- nmap
- wget
- bind-utils
- fping
- net-tools
- screen
- traceroute
- rsync
- curl
- iftop
- ntpdate
- ntp
- htop
- iftop
state: present
- name: Install Zabbix 3.4 repo to system
yum:
name: http://repo.zabbix.com/zabbix/3.4/rhel/7/x86_64/zabbix-release-3.4-
2.el7.noarch.rpm
121
state: present
- name: Installing zabbix packages
yum:
name: "{{ item }}"
with_items:
- zabbix-agent
- zabbix-get
state: present
- name: Set up config zabbix_agentd.conf
template:
src: /etc/ansible/templates/etc/zabbix/zabbix_agentd.conf
dest: /etc/zabbix/zabbix_agentd.conf
owner: root
group: root
mode: 0644
- name: Copy Zabbix userparameters file
copy:
src: /etc/ansible/templates/etc/zabbix/userparameters.conf
dest: /etc/zabbix/userparameters.conf
owner: root
group: root
mode: 0644
- name: Enable and start zabbix service or reload if there is some changes
systemd:
name: zabbix-agent
state: started
enabled: True
- name: Enable and start zabbix service or reload if there is some changes
122
systemd:
name: zabbix-agent
state: restarted
- name: Install necessary software for netintel motd - epel-release
yum:
name: epel-release
state: present
- name: Install necessary software motd from epel-release
yum:
name: figlet
state: present
- name: Set up config file for motd
copy:
src: "{{item.src}}"
dest: "{{item.dest}}"
mode: "{{item.mode}}"
owner: "{{item.owner}}"
owner: "{{item.group}}"
with_items:
- { src: '/etc/ansible/templates/root/.bashrc', dest: '/root/.bashrc', mode: '0644',
owner: 'root', group: 'root' }
- { src: '/etc/ansible/templates/etc/motd', dest: '/etc/motd', mode: '0644',
owner: 'root', group: 'root' }
- name: Apply some security settings
copy:
src: "{{item.src}}"
dest: "{{item.dest}}"
mode: "{{item.mode}}"
owner: "{{item.owner}}"
123
owner: "{{item.group}}"
with_items:
- { src: '/etc/ansible/templates/etc/pam.d/su', dest: '/etc/pam.d/su', mode: '0644',
owner: 'root', group: 'root' }
- { src: '/etc/ansible/templates/etc/selinux/config', dest: '/etc/selinux/config',
mode: '0644', owner: 'root', group: 'root' }
- name: Set up sshd config
template:
src: /etc/ansible/templates/etc/ssh/sshd_config
dest: /etc/ssh/sshd_config
owner: root
group: root
mode: 0644
- name: Restart sshd after apply new config
systemd:
name: sshd
state: restarted
- name: Stop and disabling firewalld
systemd:
name: firewalld
state: stopped
enabled: False
- name: Copy ntp.conf template to destination config
copy:
src: /etc/ansible/templates/etc/ntp.conf
dest: /etc/ntp.conf
owner: root
group: root
mode: 0644
124
- name: Check if ntpd running and stop it for release socket
systemd:
name: ntpd
state: stopped
- name: First ntp synchronization with ru.pool.ntp.org
command: "{{ item }}"
with_items:
- ntpdate 3.ru.pool.ntp.org
- name: Enable and start ntpd service or reload if there is some changes
systemd:
name: ntpd
state: started
enabled: True
- name: Restart ntpd service or reload if there is some changes
systemd:
name: ntpd
state: restarted
- name: Making nano default editor
copy:
src: /etc/ansible/templates/etc/profile.d/nano.sh
dest: /etc/profile.d/nano.sh
owner: root
group: root
mode: 0644
125
Приложение 4. Типовой сценарий установки и настройки ПО.
- hosts: centos7all
tasks:
- name: Install PostgreSQL 10 repo to system
yum:
name: https://download.postgresql.org/pub/repos/yum/reporpms/EL-7-
x86_64/pgdg-redhat-repo-latest.noarch.rpm
state: present
- name: Ensure bash, OpenSSl, and libssl are the latest versions
yum:
name: "{{ item }}"
with_items:
- bash
- openssl
- mc
tags: packages
- name: Install PostgreSQL
yum:
name={{ item }}
with_items:
- postgresql10
- postgresql10-server
- postgresql10-contrib
tags: packages
- name: Ensure PostgreSQL database is initialized.
command: /usr/pgsql-10/bin/postgresql-10-setup initdb
- name: Ensure the PostgreSQL service is running
service: name=postgresql-10 state=started enabled=yes