Образовательный проект «SnakeProject» Михаила Козлова

⇒ FreeBSD and Nix ⇐

CISCO

Voice(Asterisk\Cisco)

Microsoft

Powershell

Python

SQL\T-SQL

1С

Общая

WEB Разработка

ORACLE SQL \ JAVA

Мото

Стрельба, пневматика, оружие

Саморазвитие и психология

Gitlab ansible nginx генерируем конфиги

Gitlab ansible nginx генерируем конфиги

Два сервера - продакшн и тестовый
Конфиги для примера слегка различаются
По коду примера все в принципе понятно, тест автоматом, продакшн руками
Есть интеграция с сервисом клоудфлэйра

Файл для пайплайна, передаем переменные в ансибл:

.gitlab-ci.yml stages: - deploy .deploy: &deploy stage: deploy before_script: - echo "$PASS" > pass script: - ansible-playbook --vault-password-file pass tasks.yml --extra-vars "env=$DOMAIN ansible_vars_files=$VARS" after_script: - > if [ $CI_JOB_STATUS == 'success' ]; then echo "BUILD '$CI_PIPELINE_ID' '$CI_PROJECT_NAME' '$CI_COMMIT_REF_NAME' прошел успешно на '$CI_ENVIRONMENT_NAME'" else echo "BUILD '$CI_PIPELINE_ID' '$CI_PROJECT_NAME' '$CI_COMMIT_REF_NAME' провален на '$CI_ENVIRONMENT_NAME'" fi only: - main prestage: variables: ENV: prestage DOMAIN: "b" VARS: vars.yml tags: - my_prestage_web_server environment: name: $ENV <<: *deploy prod: variables: ENV: prod DOMAIN: "" VARS: vars.yml tags: - my_production_web_server when: manual environment: name: $ENV <<: *deploy

Собственно сами переменные:
vars.yml --- app1: 1: [test.local, a.test.local] app2: 2: [b.test.local] dns_records: - zone: "test.local" record: "test.local" value: "1.1.1.1" state: "present" solo: "true" - zone: "test.local" record: "*" value: "1.1.1.1" state: "present" solo: "false" - zone: "test.local" record: "b" value: "2.2.2.2" state: "present" solo: "false" path: - nginx app1_cloudflare_flag: 101: true

Задачи, передаваемые ansible:

tasks.yml --- - hosts: localhost become: true become_user: root gather_facts: no vars_files: - vars.yml tasks: - name: Create DNS record in cloudflare service cloudflare_dns: account_email: "{{ email }}" account_api_token: "{{ token }}" zone: "{{ item.zone }}" record: "{{ item.record }}" type: "A" value: "{{ item.value }}" state: "{{ item.state }}" solo: "{{ item.solo }}" loop: "{{ dns_records }}" ignore_errors: true tags: - add_dns - name: Create backup of nginx dirs copy: src: "/etc/{{ item }}" dest: "/etc/{{ item }}_{{ lookup('pipe', 'date +%Y-%m-%d') }}.backup" remote_src: true with_items: - "{{ path }}" tags: - backup - name: Create nginx conf for app1_server template: src: ./template/nginx_conf_app1.j2 dest: "/etc/nginx/sites-enabled/{{ item.value[0] }}.conf" with_dict: "{{ app1 }}" tags: - config vars: env: "{{ env }}" cloudflare_flag: "{{ app1_cloudflare_flag[item.key] | default(false) }}" - name: Create nginx conf for app2_server template: src: ./template/nginx_conf_app2.j2 dest: "/etc/nginx/sites-enabled/{{ item.value[0] }}.conf" with_dict: "{{ app2 }}" ignore_errors: true tags: - config vars: env: "{{ env }}"

Конфиг ngix для продакшна:
template/nginx_conf_app1.j2 {% for domain in item.value %} server { listen 80; server_name {{ [env, domain]|join('.') if env else domain }} {{ '*' ~ '.' ~ [env, domain]|join('.') if env else '*.' ~ domain }}; large_client_header_buffers 4 32k; #access_log /var/log/nginx/{{ domain }}-access.log; #error_log /var/log/nginx/{{ domain }}-error.log; location / { {% if cloudflare_flag %} if ($allowed_country = no) { return 204; } {% else %} {% endif %} proxy_pass http://application1:{{ item.key }}; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; } } {% endfor %}

Конфиг ngix для теста:

template/nginx_conf_app2.j2 {% for domain in item.value %} server { listen 80; server_name {{ [env, domain]|join('.') if env else domain }} {{ '*' ~ '.' ~ [env, domain]|join('.') if env else '*.' ~ domain }}; large_client_header_buffers 4 32k; access_log /var/log/nginx/{{ domain }}-access.log; error_log /var/log/nginx/{{ domain }}-error.log; location / { proxy_pass http://application2:{{ item.key }}; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; } } {% endfor %}

Комментарии пользователей