linux系统初始化ansible-playbook文件

yunson_Liu

1106人浏览 · 2022-01-06 15:29:41

yunson_Liu · 2022-01-06 15:29:41 发布

promtail部署方式

[root@ip-172-63-251-171 ansible]# ls /root/work/promtail-loki
config.yaml  host  promtail-linux-amd64  promtail-linux-amd64.service  promtail-linux-amd64.zip  runpromtail.yaml
[root@ip-172-63-251-171 ansible]# cd /root/work/promtail-loki
[root@ip-172-63-251-171 promtail-loki]# cat config.yaml 
server:
  http_listen_port: 9080
  grpc_listen_port: 0

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki.server:3100/loki/api/v1/push

scrape_configs:
  - job_name: jarlog
    pipeline_stages:
    static_configs:
    - targets:
       - localhost
      labels:
       job: jar-logs
       host: prod
       __path__: /data/deploy/*/log*/*.log

  - job_name: jarlog1
    pipeline_stages:
    static_configs:
    - targets:
       - localhost
      labels:
       job: jar1-logs
       host: prod
       __path__: /data/deploy/*/*/*/*/*.log 

  - job_name: jarlog2
    pipeline_stages:
    static_configs:
    - targets:
       - localhost
      labels:
       job: jar2-logs
       host: prod
       __path__: /data/logs/*/*.log 

  - job_name: tomcatlog
    pipeline_stages:
    static_configs:
    - targets:
       - localhost
      labels:
       job: tomcat-logs
       host: prod
       __path__: /data/deploy/*/logs/*.out

[root@ip-172-63-251-171 promtail-loki]# cat promtail-linux-amd64.service 
[Unit]
Description=promtail-linux-amd64
After=network.target
[Service]
Type=simple
ExecStart=/data/soft/promtail/promtail-linux-amd64 --config.file=/data/soft/promtail/config.yaml
Restart=on-failure
[Install]
WantedBy=multi-user.target
[root@ip-172-63-251-171 promtail-loki]# cat runpromtail.yaml 
---
  - hosts: app
    remote_user: root
    tasks:
      - name: sync config
        synchronize:
          src: /root/work/promtail-loki/ 
          dest: /data/soft/promtail/
          mode: push
      - name: copy service
        copy:
          src: /root/work/promtail-loki/promtail-linux-amd64.service
          dest: /lib/systemd/system/promtail-linux-amd64.service
      - name: reload
        shell: systemctl daemon-reload
      - name: start
        shell: systemctl start promtail-linux-amd64.service
      - name: enable 
        shell: systemctl enable promtail-linux-amd64.service
      #- name: start promtail-linux-amd64
      #  shell: "nohup /data/soft/promtail/promtail-linux-amd64 --config.file=/data/soft/promtail/config.yaml >/dev/null 2>&1 &"

创建一份ansible-playbook服务器初始化文件
centos系统

---
- hosts: "{{host}}"
  gather_facts: no
  user: centos
  become: yes
  become_user: root
  become_method: sudo
  tasks:
  - name: 替换key
    copy:
      src: "/root/ops/prod-authorized_keys"
      dest: "/root/.ssh/authorized_keys"
      mode: "0755"
      owner: root
      group: root
      backup: yes

  - name: 更改profile
    copy: 'src=/root/ops/init.sh dest=/etc/profile.d/init.sh'

  - name: Selinux dsiable
    lineinfile:
      dest: /etc/selinux/config
      regexp: '^SELINUX='
      line: 'SELINUX=disabled'

  - name: Selinux stop
    selinux: state=disabled

  - name: Firewalld disable
    service: name=firewalld state=stopped enabled=no
    ignore_errors: true



#  - name: mkdir  back 
#    shell: 'if [ ! -d /etc/yum.repos.d/back ];then mkdir /etc/yum.repos.d/back -p;fi'
#    ignore_errors: true

#  - name:  back .repos
#    shell: 'cd /etc/yum.repos.d/ && mv *.repo back/'
#    ignore_errors: true

#  - name: copy local.repo 
#    copy: 'src=/root/ops/local.repo dest=/etc/yum.repos.d/local.repo'
#    ignore_errors: true

#  - name: cleal
#    shell: yum clean all
#    ignore_errors: true

  #- name: Basicinstall
  #  yum: 
  #    name: 'epel-release'
  #    state: installed
  #    update_cache: yes
  #  ignore_errors: true
  - name: Basicinstall
    yum: 
      name: ['net-tools','zip', 'lrzsz','nethogs', 'tree', 'wget', 'telnet', 'iotop', 'vim','rkhunter','cronolog','epel-release','htop','mlocate']
      state: installed
      update_cache: yes
    ignore_errors: true

########Ulimit Init########
  - name: Ulimit change
    shell: ulimit -SHn 1000000

  - name: Ulimit change rc.local
    lineinfile:
      dest: /etc/rc.local
      regexp: 'ulimit -SHn 1000000'
      backrefs: no
      line: 'ulimit -SHn 1000000'

  - name: Change limits.conf soft
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: '\* soft nofile [0-9]+'
      backrefs: no
      line: '* soft nofile 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: '\* hard nofile [0-9]+'
      backrefs: no
      line: '* hard nofile 1000000'

  - name: Change system.conf DefaultLimitCORE
    lineinfile:
      dest: /etc/systemd/system.conf
      regexp: 'DefaultLimitCORE'
      backrefs: no
      line: 'DefaultLimitCORE=infinity'

  - name: Change system.conf DefaultLimitNOFILE
    lineinfile:
      dest: /etc/systemd/system.conf
      regexp: 'DefaultLimitNOFILE'
      backrefs: no
      line: 'DefaultLimitNOFILE=1000000'

  - name: Change system.conf 
    lineinfile:
      dest: /etc/systemd/system.conf
      regexp: 'DefaultLimitNPROC'
      backrefs: no
      line: 'DefaultLimitNPROC=1000000'

########Create Directory########
  - name: Create Directory
    file: path={{ item }} state=directory
    with_items:
      - /data/
      - /data/deploy/
      - /data/logs/
      - /data/soft/
      - /data/scripts/
      - /data/files/
      - /data/logs/check/

########rc-local########
  - service: name=rc-local enabled=yes state=restarted
    tags: rc-local

  - name: /etc/rc.d/rc.local
    file: 'path=/etc/rc.d/rc.local mode=0755'
    tags: rc-local

########添加DNS#######
  - name: 更改ifcfg-eth0
    lineinfile:
      dest: /etc/sysconfig/network-scripts/ifcfg-eth0
      line: "PEERDNS=yes"
    ignore_errors: true
  - name: 更改ifcfg-eth0
    lineinfile:
      dest: /etc/sysconfig/network-scripts/ifcfg-eth0
      line: 'DNS1=172.63.251.171'
    ignore_errors: true

  - name: 更改ifcfg-ens5
    lineinfile:
      dest: /etc/sysconfig/network-scripts/ifcfg-ens5
      line: "PEERDNS=yes"
    ignore_errors: true
  - name: 更改ifcfg-ens5
    lineinfile:
      dest: /etc/sysconfig/network-scripts/ifcfg-ens5
      line: 'DNS1=172.63.251.171'
    ignore_errors: true

  - name: 更改resolv.conf
    lineinfile:
      dest: /etc/resolv.conf
      regexp: '^nameserver'
      backrefs: yes
      line: 'nameserver 172.63.251.171'

  - name: 更改cloud.cfg
    lineinfile:
      dest: /etc/cloud/cloud.cfg
      insertbefore: '^# vim:syntax=yaml'
      line: 'network:'
    ignore_errors: true

  - name: 更改cloud.cfg2
    lineinfile:
      dest: /etc/cloud/cloud.cfg
      insertbefore: '^# vim:syntax=yaml'
      line: '  config: disabled' 
    ignore_errors: true

########时区#######
  - name: 修改时区
    shell: 'timedatectl set-timezone Asia/Shanghai && timedatectl set-ntp yes'

  - name: Restart crond
    service: name=crond state=restarted enabled=yes

  - name: Restart rsyslog
    service: name=rsyslog state=restarted enabled=yes

  - name: sysctl.conf
    copy: 
      src: /root/ops/sysctl.conf
      dest: /etc/sysctl.conf
      mode: "0644"
      owner: root
      group: root
  - name: sysctl.conf
    shell: 'sysctl -p'

#安装prometheus node
  - name: 新建prometheus组
    group:
      name: prometheus
      state: present
    tags: adduser
    tags: prometheus
  - name: 新建prometheus用户
    user:
      name: prometheus
      create_home: false
      shell: /sbin/nologin
      groups: prometheus
    tags: adduser
    tags: prometheus
  - name: copy node文件
    get_url: 'url=http://172.63.251.171:81/tools/node_exporter dest=/usr/local/bin/node_exporter mode=0755 '
   #synchronize: "src=/root/ops/prometheus/node_exporter dest=/usr/local/bin/node_exporter perms=yes rsync_timeout=2"
    tags: prometheus
  - name: copy node脚本
    copy: 'src=/root/ops/prometheus/node-exporter.service dest=/lib/systemd/system/node-exporter.service'
    tags: prometheus
  - name: 启动prometheus node
    service: name=node-exporter state=restarted enabled=yes
    tags: prometheus

#jdk
  - name: jdk
    unarchive: 'src=http://172.63.251.171:81/tools/jdk-8u251-linux-x64.tar.gz dest=/usr/local copy=no'
    tags: jdk
  - name: create links
    file: src=/usr/local/jdk1.8.0_251 dest=/usr/local/java state=link
    tags: jdk
  - name: java_profile config
    shell: /bin/echo {{ item }} >> /etc/profile
    with_items:
        - export JAVA_HOME=/usr/local/java
        - export JRE_HOME=/usr/local/java/jre
        - export CLASSPATH=.:\$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:\$JRE_HOME/lib:\$CLASSPATH
        - export PATH=\$JAVA_HOME/bin:\$PATH
    tags: jdk
  - name: take effect
    shell: source /etc/profile
    tags: jdk

  - name: sync config
    synchronize:
       src: /root/work/promtail-loki/ 
       dest: /data/soft/promtail/
       mode: push
  - name: copy service
    copy:
       src: /root/work/promtail-loki/promtail-linux-amd64.service
       dest: /lib/systemd/system/promtail-linux-amd64.service
  - name: reload
    shell: systemctl daemon-reload
  - name: start
    shell: systemctl start promtail-linux-amd64.service
  - name: enable 
    shell: systemctl enable promtail-linux-amd64.service
  - name: start promtail-linux-amd64
    shell: "nohup /data/soft/promtail/promtail-linux-amd64 --config.file=/data/soft/promtail/config.yaml >/dev/null 2>&1 &"

#传输jmx
  - name: 传输jmx
    synchronize: "src=/data/jmx dest=/data/ perms=yes rsync_timeout=2"

#每日巡检
  - name: copy检查脚本
    copy: 'src=/root/ops/scripts/check.sh dest=/data/scripts/check.sh'
  - name: 检查脚本-定时任务
    cron: 'name=check minute=30 hour=23 job="sh /data/scripts/check.sh > /data/logs/check/check-`date +"\%F"`.log"'
  - name: 定时清理日志
    cron: 'name=del-java-log minute=5 hour=0 job="find /data/deploy/*/*log*/ -type f \( -iname "*.zip" -o -iname "*.out" -o -iname "*.log" -o -iname "*.txt" \) -a -mtime +1|xargs rm -f"'

  - name: 定时清理日志
    cron: 'name=del-java-log minute=5 hour=0 state=present job="find /data/deploy/*/*log*/ -type f \( -iname "*.zip" -o -iname "*.out" -o -iname "*.log" -o -iname "*.txt" \) -a -mtime +3|xargs rm -rf"'
  - name: sync time
    cron:
      name: 时间同步任务
      minute: "*/5"
      hour: "*"
      day: "*"
      month: "*"
      weekday: "*"
      job: /sbin/ntpdate ntp1.aliyun.com >/dev/null 2>&1
      #state: absent  # start/absent/present
      state: present  # start/absent/present


  - name: reboot
    reboot:
    tags: reboot

ubuntu系统

---
- hosts: "{{host}}"
  gather_facts: no
  user: ubuntu
  become: yes
  become_user: root
  become_method: sudo
  tasks:
  - name: 替换key
    copy:
      src: "/root/ops/prod-authorized_keys"
      dest: "/root/.ssh/authorized_keys"
      mode: "0755"
      owner: root
      group: root
      backup: yes

  - name: Disable ufw
    ufw: state=disabled

  - name: Basicinstall
    apt: 
      name: ['net-tools','zip', 'lrzsz','nethogs', 'tree', 'wget', 'telnet', 'iotop', 'vim','rkhunter']
      state: present
      update_cache: yes
    ignore_errors: true

########Ulimit Init########
  - name: Ulimit change
    shell: ulimit -SHn 1000000

  - name: Change limits.conf soft
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: '\* soft nofile [0-9]+'
      backrefs: no
      line: '* soft nofile 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: '\* hard nofile [0-9]+'
      backrefs: no
      line: '* hard nofile 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: '\* soft nproc [0-9]+'
      backrefs: no
      line: '* soft nproc 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: '\* hard nproc [0-9]+'
      backrefs: no
      line: '* hard nproc 1000000'

  - name: Change limits.conf soft
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: 'root soft nofile [0-9]+'
      backrefs: no
      line: 'root soft nofile 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: 'root hard nofile [0-9]+'
      backrefs: no
      line: 'root hard nofile 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: 'root soft nproc [0-9]+'
      backrefs: no
      line: 'root soft nproc 1000000'

  - name: Change limits.conf hard
    lineinfile:
      dest: /etc/security/limits.conf
      regexp: 'root hard nproc [0-9]+'
      backrefs: no
      line: 'root hard nproc 1000000'

  - name: Change system.conf DefaultLimitCORE
    lineinfile:
      dest: /etc/systemd/system.conf
      regexp: 'DefaultLimitCORE'
      backrefs: no
      line: 'DefaultLimitCORE=infinity'

  - name: Change system.conf DefaultLimitNOFILE
    lineinfile:
      dest: /etc/systemd/system.conf
      regexp: 'DefaultLimitNOFILE'
      backrefs: no
      line: 'DefaultLimitNOFILE=1000000'

  - name: Change system.conf 
    lineinfile:
      dest: /etc/systemd/system.conf
      regexp: 'DefaultLimitNPROC'
      backrefs: no
      line: 'DefaultLimitNPROC=1000000'

########Create Directory########
  - name: Create Directory
    file: path={{ item }} state=directory
    with_items:
      - /data/
      - /data/deploy/
      - /data/logs/
      - /data/soft/
      - /data/scripts/
      - /data/files/
      - /data/logs/check/

########添加DNS#######
  - name: DNS
    lineinfile:
      dest: /etc/systemd/resolved.conf
      line: 'DNS=172.63.251.171'
    tags: dns

########时区#######
  - name: 修改时区
    shell: 'timedatectl set-timezone Asia/Shanghai && timedatectl set-ntp yes'

  - name: Restart cron
    service: name=cron state=restarted enabled=yes

  - name: Restart rsyslog
    service: name=rsyslog state=restarted enabled=yes

  - name: sysctl.conf
    copy: 
      src: /root/ops/sysctl.conf
      dest: /etc/sysctl.conf
      mode: "0644"
      owner: root
      group: root
  #- name: sysctl.conf
  #  shell: 'sysctl -p'

#安装prometheus node
  - name: 新建prometheus组
    group:
      name: prometheus
      state: present
    tags: prometheus
  - name: 新建prometheus用户
    user:
      name: prometheus
      create_home: false
      shell: /sbin/nologin
      groups: prometheus
    tags: prometheus
  - name: copy node文件
    get_url: 'url=http://172.63.251.171:81/tools/node_exporter dest=/usr/local/bin/node_exporter mode=0755 '
   #synchronize: "src=/root/ops/prometheus/node_exporter dest=/usr/local/bin/node_exporter perms=yes rsync_timeout=2"
    tags: prometheus
  - name: copy node脚本
    copy: 'src=/root/ops/prometheus/node-exporter.service dest=/lib/systemd/system/node-exporter.service'
    tags: prometheus
  - name: 启动prometheus node
    service: name=node-exporter state=restarted enabled=yes
    tags: prometheus

#jdk
  - name: jdk
    unarchive: 'src=http://172.63.251.171:81/tools/jdk-8u251-linux-x64.tar.gz dest=/usr/local copy=no'
    tags: jdk
  - name: create links
    file: src=/usr/local/jdk1.8.0_251 dest=/usr/local/java state=link
    tags: jdk
  - name: java_profile config
    shell: /bin/echo {{ item }} >> /etc/profile
    with_items:
        - export JAVA_HOME=/usr/local/java
        - export JRE_HOME=/usr/local/java/jre
        - export CLASSPATH=.:\$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:\$JRE_HOME/lib:\$CLASSPATH
        - export PATH=\$JAVA_HOME/bin:\$PATH
    tags: jdk
#  - name: take effect
#    shell: source /etc/profile
#    tags: jdk

#传输jmx
  - name: 传输jmx
    synchronize: "src=/data/jmx dest=/data/ perms=yes rsync_timeout=2"

#每日巡检
  - name: copy检查脚本
    copy: 'src=/root/ops/scripts/check.sh dest=/data/scripts/check.sh'
  - name: 检查脚本-定时任务
    cron: 'name=check minute=30 hour=23 job="sh /data/scripts/check.sh > /data/logs/check/check-`date +"\%F"`.log"'

  - name: reboot
    reboot:
    tags: reboot