DevOps Tools: Ansible

Showing posts with label Ansible. Show all posts

Ansible - Server-Setup

Ansible Playbook For Initial Server Setup

====================================================================

List of Tasks:

System Update
Essential packages
CSF Firewall Install
Maldet Install

Features:

- Tested on both Debian and CentOS/RedHat Distributions

- If needed you can add/remove packages in file 'essn-packages.yml'. Make sure to check correct syntax before editing.

- Customized CSF configuration including popular blacklists. Add/Remove ports according to your needs in 'csf.conf '.

Execution:

1) Download Playbook from Github: https://github.com/firazahamed/Server-Setup

2) Upload files to the required directory

root@ansible-g:~/Server-Setup# ls
MainFile.yml     csf.blocklists essn-packages.yml   system-update.yml
csf-install.yml csf.conf        maldet-install.yml

Run the main playbook file MainFile.yml

root@ansible-g:~/Server-Setup# ansible-playbook MainFile.yml

PLAY [Server Initial Setup] **************************************************************************

TASK [Gathering Facts] *******************************************************************************
ok: [35.213.xxx.xxx]

TASK [System Update] *********************************************************************************
included: /root/Server-Setup/system-update.yml for 35.213.xxx.xxx

TASK [System update - Debian] ************************************************************************
changed: [35.213.xxx.xxx]

TASK [System update - RedHat] ************************************************************************
skipping: [35.213.xxx.xxx]

TASK [Essential packages] ****************************************************************************
included: /root/Server-Setup/essn-packages.yml for 35.213.xxx.xxx

TASK [YUM] *******************************************************************************************
skipping: [35.213.xxx.xxx]

TASK [APT] *******************************************************************************************
ok: [35.213.xxx.xxx]

TASK [CSF Firewall Install] **************************************************************************
included: /root/Server-Setup/csf-install.yml for 35.213.xxx.xxx

TASK [Download Package] ******************************************************************************
changed: [35.213.xxx.xxx]

TASK [Extracting package] ****************************************************************************
changed: [35.213.xxx.xxx]

TASK [Executing install script] **********************************************************************
changed: [35.213.xxx.xxx]

TASK [Copy config file] ******************************************************************************
changed: [35.213.xxx.xxx]

TASK [Copy blocklists file] **************************************************************************
changed: [35.213.xxx.xxx]

TASK [Restarting CSF and LFD] ************************************************************************
changed: [35.213.xxx.xxx] => (item=csf)
changed: [35.213.xxx.xxx] => (item=lfd)

TASK [Maldet Install] ********************************************************************************
included: /root/Server-Setup/maldet-install.yml for 35.213.xxx.xxx

TASK [Download Package] ******************************************************************************
ok: [35.213.xxx.xxx]

TASK [Create LMD's download dir] *********************************************************************
ok: [35.213.xxx.xxx]

TASK [Extracting package] ****************************************************************************
skipping: [35.213.xxx.xxx]

TASK [Executing install script] **********************************************************************
skipping: [35.213.xxx.xxx]

TASK [Updating Maldet] *******************************************************************************
changed: [35.213.xxx.xxx]

PLAY RECAP *******************************************************************************************
35.213.xxx.xxx : ok=16 changed=8 unreachable=0 failed=0

Ansible - LAMP Setup

Ansible Playbook to setup LAMP

====================================================================
---
- name: 'LAMP Setup'
hosts: all
become: yes
gather_facts: no
vars:
mysql_root: ans@root#mysql

tasks:
- name: 'Install Apache, MySQL, PHP/Modules'
yum:
name:
- httpd
- php
- mariadb-server
- php-mysql
- MySQL-python
state: present

- name: 'Restarting Services'
service:
name: "{{ item }}"
state: restarted
enabled: yes
with_items:
- httpd
- mariadb

- name: 'Create info.php'
copy:
content: '<?php phpinfo(); ?>'
dest: /var/www/html/info.php

- name: "Setup MySQL root password"
ignore_errors: yes
mysql_user:
login_user: root
login_password: ''
name: root
host_all: yes
password: "{{mysql_root}}"

- name: "Removing anonymous Users from Mysql DB"
mysql_user:
login_user: root
login_password: "{{mysql_root}}"
name: ''
host_all: yes
state: absent

====================================================================

Ansible - WordPress Install

Ansible Playbook to Install WordPress

====================================================================

---
- name: 'WordPress installation'
hosts: all
become: yes
gather_facts: no
vars_files:
- vars.yml

tasks:
- name: 'Downloading Wordpress'
get_url:
url: "{{WP_URL}}"
dest: "{{DEST}}/wordpress.tar.gz"

- name: 'Extracting Wordpress Package'
unarchive:
src: "{{DEST}}/wordpress.tar.gz"
dest: "{{DEST}}"
remote_src: yes

- name: 'Setting Permissions and ownership'
file:
dest: "{{DEST}}"
owner: root
group: root
recurse: yes

- name: "Creating Wordpress Database"
mysql_db:
login_user: root
login_password: "{{MYSQL_ROOT}}"
db: "{{DB_NAME}}"
state: present

- name: "Creating Wordpress User"
mysql_user:
login_user: root
login_password: "{{MYSQL_ROOT}}"
name: "{{DB_USER}}"
host: localhost
password: "{{DB_PASSWORD}}"
priv: "{{DB_NAME}}.*:ALL"

- name: 'Wordpress - Generating wp-config.php'
template:
src: wp-config.php.j2
dest: "{{DEST}}/wordpress/wp-config.php"

====================================================================

vars.yml

====================================================================

---
MYSQL_ROOT: ans@root#mysql
DB_NAME: wp_db
DB_USER: wp_ans
DB_PASSWORD: WP123!@#
WP_URL: https://wordpress.org/latest.tar.gz
DEST: /var/www/html/

====================================================================

wp-config.php.j2

====================================================================

<?php
define('DB_NAME', '{{DB_NAME}}');

define('DB_USER', '{{DB_USER}}');

define('DB_PASSWORD', '{{DB_PASSWORD}}');

define('DB_HOST', 'localhost');

define('DB_CHARSET', 'utf8');

define('DB_COLLATE', '');

define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
define('AUTH_SALT', 'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT', 'put your unique phrase here');
define('NONCE_SALT', 'put your unique phrase here');

$table_prefix = 'wp_';

define('WP_DEBUG', false);

if ( !defined('ABSPATH') )
define('ABSPATH', dirname(__FILE__) . '/');

require_once(ABSPATH . 'wp-settings.php');

====================================================================

Ansible - Install CSF

Ansible Playbook to Install CSF

====================================================================
---
- name: "Install CSF Firewall"
hosts: all
become: yes
tasks:

- name: 'Download CSF package'
get_url:
url: https://download.configserver.com/csf.tgz
dest: /usr/src/csf.tgz

- name: 'Extracting CSF package'
unarchive:
src: /usr/src/csf.tgz
dest: /usr/src/
remote_src: yes

- name: 'Executing CSF install script'
shell:
cmd: sh install.sh
chdir: /usr/src/csf/

- name: 'Disabling TESTING mode'
lineinfile:
path: /etc/csf/csf.conf
regexp: '^TESTING ='
line: TESTING = "0"

- name: "Restarting CSF"
service:
name: csf
state: restarted

- name: "Restarting LFD"
service:
name: lfd
state: restarted

====================================================================

Ansible - Update Systems

Ansible Playbook to update Debian and RedHat machines

====================================================================

---
- name: "Updating all systems"
hosts: all
become: yes
tasks:
- name: 'System update - Debian'
when: ansible_os_family == "Debian"
apt:
update-cache: yes
force_apt_get: yes
- name: 'System update - RedHat'
when: ansible_os_family == "RedHat"
yum:
name: '*'
state: latest

====================================================================

Click to Download this playbook

Execution:

35.187.240.19 - Debian system

172.31.30.124 - RedHat system

[ec2-user@ansible ~]$ ansible-playbook system-update.yml

PLAY [Updating all systems] ***************************************************************************

TASK [Gathering Facts] ********************************************************************************

ok: [172.31.30.124]

ok: [35.187.240.19]

TASK [System update - Debian] *************************************************************************

skipping: [172.31.30.124]

changed: [35.187.240.19]

TASK [System update - RedHat] *************************************************************************

skipping: [35.187.240.19]

changed: [172.31.30.124]

PLAY RECAP ********************************************************************************************

172.31.30.124 : ok=2 changed=1 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0

35.187.240.19 : ok=2 changed=1 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0