Skip to content

Commit 41f8406

Browse files
vitabaksvitabaks
committed
add ansible playbook
1 parent 781999e commit 41f8406

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+3514
-0
lines changed

‎ansible.cfg

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[defaults]
2+
inventory = ./inventory
3+
display_skipped_hosts = false
4+
remote_tmp = /tmp/${USER}/ansible
5+
host_key_checking = false
6+
timeout=60
7+
8+
[persistent_connection]
9+
retries = 3
10+
connect_timeout = 60
11+
command_timeout = 30
12+
13+
14+
# https://raw.githubusercontent.com/ansible/ansible/devel/examples/ansible.cfg

‎deploy_pgcluster.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
3+
- name: Deploy PostgreSQL High-Availability Cluster (based on "Patroni" and "DCS(etcd)")
4+
hosts: postgres-cluster
5+
become: true
6+
become_method: sudo
7+
any_errors_fatal: true
8+
gather_facts: true
9+
vars_files:
10+
- vars/main.yml
11+
- "vars/{{ ansible_os_family }}.yml"
12+
13+
14+
pre_tasks:
15+
- import_tasks: tasks/check_system.yml
16+
17+
- import_tasks: tasks/add-repository.yml
18+
tags: [ add_repo, configure ]
19+
20+
- import_tasks: tasks/packages.yml
21+
tags: [ install_packages, install_postgres ]
22+
23+
- import_tasks: tasks/sudo.yml
24+
tags: [ sudo, postgres_sudo, configure ]
25+
26+
- import_tasks: tasks/configure.yml
27+
tags: configure
28+
29+
roles:
30+
- role: ansible-role-firewall
31+
tags: firewall
32+
33+
tasks:
34+
- meta: flush_handlers
35+
36+
- import_tasks: tasks/etcd.yml
37+
when: dcs_exists == "false" and dcs_type == "etcd"
38+
tags: [ etcd, etcd_cluster ]
39+
40+
- import_tasks: tasks/patroni.yml
41+
tags: patroni
42+
43+
- import_tasks: tasks/pgbouncer.yml
44+
when: install_pgbouncer == "true"
45+
tags: pgbouncer
46+
47+
- import_tasks: tasks/haproxy.yml
48+
when: with_haproxy_load_balancing == "true" and cluster_vip | length > 0
49+
tags: [ haproxy, load_balancing ]
50+
51+
- import_tasks: tasks/vip-manager.yml
52+
when: with_haproxy_load_balancing != "true" and cluster_vip | length > 0
53+
tags: [ vip, vip_manager ]
54+
55+
# optional
56+
- import_tasks: tasks/postgresql-users.yml
57+
when: is_master == "true" and postgresql_users | length > 0
58+
tags: postgresql_users
59+
60+
- import_tasks: tasks/postgresql-databases.yml
61+
when: is_master == "true" and postgresql_databases | length > 0
62+
tags: postgresql_databases
63+
64+
- import_tasks: tasks/postgresql-extensions.yml
65+
when: is_master == "true" and postgresql_extensions | length > 0
66+
tags: postgresql_extensions
67+
68+
# finish (info)
69+
- import_tasks: tasks/deploy_finish.yml
70+
tags: [ cluster_info, cluster_status ]
71+
72+
73+

‎files/requirements.txt

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
psycopg2>=2.8
2+
urllib3>=1.19.1,!=1.21,<1.25
3+
boto
4+
PyYAML
5+
requests
6+
six >= 1.7
7+
kazoo>=1.3.1
8+
python-etcd>=0.4.3,<0.5
9+
python-consul>=0.7.0
10+
click>=4.1
11+
prettytable>=0.7
12+
tzlocal
13+
python-dateutil
14+
psutil>=2.0.0
15+
cdiff

‎files/vip-manager

14.3 MB
Binary file not shown.

‎group_vars/master

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
3+
is_master: 'true'
4+
postgresql_exists: 'false'

‎group_vars/replica

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
3+
is_master: 'false'
4+
postgresql_exists: 'false'

‎inventory

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# This is example inventory file!
2+
# Please specify the ip addresses and connection settings for your environment
3+
4+
# "postgresql_exists='true'" if PostgreSQL is already exists and runing
5+
# "hostname=" variable is optional (used to change the server name)
6+
7+
[master]
8+
10.128.64.140 postgresql_exists='false' hostname=pgnode01
9+
10+
[replica]
11+
10.128.64.142 hostname=pgnode02
12+
10.128.64.143 hostname=pgnode03
13+
14+
15+
[postgres-cluster:children]
16+
master
17+
replica
18+
19+
20+
# Connection settings
21+
[all:vars]
22+
ansible_connection='ssh'
23+
ansible_ssh_port='22'
24+
ansible_user='root'
25+
ansible_ssh_pass='testpas' # "sshpass" package is required for use "ansible_ssh_pass"
26+
#ansible_ssh_private_key_file=
27+
# ansible_python_interpreter='/usr/bin/python3' # is required for use python3
28+

‎roles/ansible-role-firewall/.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*.retry
2+
*/__pycache__
3+
*.pyc

‎roles/ansible-role-firewall/.travis.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
language: python
3+
services: docker
4+
5+
env:
6+
global:
7+
- ROLE_NAME: firewall
8+
matrix:
9+
- MOLECULE_DISTRO: centos7
10+
- MOLECULE_DISTRO: centos6
11+
- MOLECULE_DISTRO: ubuntu1804
12+
- MOLECULE_DISTRO: ubuntu1604
13+
- MOLECULE_DISTRO: debian9
14+
15+
install:
16+
# Install test dependencies.
17+
- pip install molecule docker
18+
19+
before_script:
20+
# Use actual Ansible Galaxy role name for the project directory.
21+
- cd ../
22+
- mv ansible-role-$ROLE_NAME geerlingguy.$ROLE_NAME
23+
- cd geerlingguy.$ROLE_NAME
24+
25+
script:
26+
# Run tests.
27+
- molecule test
28+
29+
notifications:
30+
webhooks: https://galaxy.ansible.com/api/v1/notifications/

‎roles/ansible-role-firewall/LICENSE

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2017 Jeff Geerling
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy of
6+
this software and associated documentation files (the "Software"), to deal in
7+
the Software without restriction, including without limitation the rights to
8+
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
9+
the Software, and to permit persons to whom the Software is furnished to do so,
10+
subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
17+
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
18+
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
19+
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
20+
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎roles/ansible-role-firewall/README.md

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Ansible Role: Firewall (iptables)
2+
3+
[![Build Status](https://travis-ci.org/geerlingguy/ansible-role-firewall.svg?branch=master)](https://travis-ci.org/geerlingguy/ansible-role-firewall)
4+
5+
Installs an iptables-based firewall for Linux. Supports both IPv4 (`iptables`) and IPv6 (`ip6tables`).
6+
7+
This firewall aims for simplicity over complexity, and only opens a few specific ports for incoming traffic (configurable through Ansible variables). If you have a rudimentary knowledge of `iptables` and/or firewalls in general, this role should be a good starting point for a secure system firewall.
8+
9+
After the role is run, a `firewall` init service will be available on the server. You can use `service firewall [start|stop|restart|status]` to control the firewall.
10+
11+
## Requirements
12+
13+
None.
14+
15+
## Role Variables
16+
17+
Available variables are listed below, along with default values (see `defaults/main.yml`):
18+
19+
firewall_state: started
20+
firewall_enabled_at_boot: true
21+
22+
Controls the state of the firewall service; whether it should be running (`firewall_state`) and/or enabled on system boot (`firewall_enabled_at_boot`).
23+
24+
firewall_allowed_tcp_ports:
25+
- "22"
26+
- "80"
27+
...
28+
firewall_allowed_udp_ports: []
29+
30+
A list of TCP or UDP ports (respectively) to open to incoming traffic.
31+
32+
firewall_forwarded_tcp_ports:
33+
- { src: "22", dest: "2222" }
34+
- { src: "80", dest: "8080" }
35+
firewall_forwarded_udp_ports: []
36+
37+
Forward `src` port to `dest` port, either TCP or UDP (respectively).
38+
39+
firewall_additional_rules: []
40+
firewall_ip6_additional_rules: []
41+
42+
Any additional (custom) rules to be added to the firewall (in the same format you would add them via command line, e.g. `iptables [rule]`/`ip6tables [rule]`). A few examples of how this could be used:
43+
44+
# Allow only the IP 167.89.89.18 to access port 4949 (Munin).
45+
firewall_additional_rules:
46+
- "iptables -A INPUT -p tcp --dport 4949 -s 167.89.89.18 -j ACCEPT"
47+
48+
# Allow only the IP 214.192.48.21 to access port 3306 (MySQL).
49+
firewall_additional_rules:
50+
- "iptables -A INPUT -p tcp --dport 3306 -s 214.192.48.21 -j ACCEPT"
51+
52+
See [Iptables Essentials: Common Firewall Rules and Commands](https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands) for more examples.
53+
54+
firewall_log_dropped_packets: true
55+
56+
Whether to log dropped packets to syslog (messages will be prefixed with "Dropped by firewall: ").
57+
58+
firewall_disable_firewalld: false
59+
firewall_disable_ufw: false
60+
61+
Set to `true` to disable firewalld (installed by default on RHEL/CentOS) or ufw (installed by default on Ubuntu), respectively.
62+
63+
## Dependencies
64+
65+
None.
66+
67+
## Example Playbook
68+
69+
- hosts: server
70+
vars_files:
71+
- vars/main.yml
72+
roles:
73+
- { role: geerlingguy.firewall }
74+
75+
*Inside `vars/main.yml`*:
76+
77+
firewall_allowed_tcp_ports:
78+
- "22"
79+
- "25"
80+
- "80"
81+
82+
## TODO
83+
84+
- Make outgoing ports more configurable.
85+
- Make other firewall features (like logging) configurable.
86+
87+
## License
88+
89+
MIT / BSD
90+
91+
## Author Information
92+
93+
This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).

‎roles/ansible-role-firewall/defaults/main.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
firewall_state: started
3+
firewall_enabled_at_boot: true
4+
5+
firewall_allowed_tcp_ports:
6+
- "22"
7+
- "25"
8+
- "80"
9+
- "443"
10+
firewall_allowed_udp_ports: []
11+
firewall_forwarded_tcp_ports: []
12+
firewall_forwarded_udp_ports: []
13+
firewall_additional_rules: []
14+
firewall_ip6_additional_rules: []
15+
firewall_log_dropped_packets: true
16+
17+
# Set to true to ensure other firewall management software is disabled.
18+
firewall_disable_firewalld: false
19+
firewall_disable_ufw: false

‎roles/ansible-role-firewall/handlers/main.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
- name: restart firewall
3+
service: name=firewall state=restarted

‎roles/ansible-role-firewall/meta/main.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
dependencies: []
3+
4+
galaxy_info:
5+
author: geerlingguy
6+
description: Simple iptables firewall for most Unix-like systems.
7+
company: "Midwestern Mac, LLC"
8+
license: "license (BSD, MIT)"
9+
min_ansible_version: 2.4
10+
platforms:
11+
- name: EL
12+
versions:
13+
- all
14+
- name: Debian
15+
versions:
16+
- all
17+
- name: Ubuntu
18+
versions:
19+
- all
20+
galaxy_tags:
21+
- networking
22+
- system
23+
- security
24+
- firewall
25+
- iptables
26+
- tcp

‎roles/ansible-role-firewall/molecule/default/molecule.yml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
dependency:
3+
name: galaxy
4+
driver:
5+
name: docker
6+
lint:
7+
name: yamllint
8+
options:
9+
config-file: molecule/default/yaml-lint.yml
10+
platforms:
11+
- name: instance
12+
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
13+
command: ${MOLECULE_DOCKER_COMMAND:-""}
14+
volumes:
15+
- /sys/fs/cgroup:/sys/fs/cgroup:ro
16+
privileged: true
17+
pre_build_image: true
18+
provisioner:
19+
name: ansible
20+
lint:
21+
name: ansible-lint
22+
playbooks:
23+
converge: ${MOLECULE_PLAYBOOK:-playbook.yml}
24+
scenario:
25+
name: default
26+
test_sequence:
27+
- lint
28+
- destroy
29+
- dependency
30+
- syntax
31+
- create
32+
- prepare
33+
- converge
34+
- idempotence
35+
- check
36+
- side_effect
37+
- verify
38+
- destroy
39+
verifier:
40+
name: testinfra
41+
lint:
42+
name: flake8

0 commit comments

Comments
 (0)