ansible.note

noteId: WEBda1876b980dbce0c3d541ef1371af44d · 原始路径：/ALL/世赛题目（练习） - 笔记/第48届/08-集训队解题/A/ansible.note · 图片：2 · 附件待处理：1

·ansible服务：

chrony、ca、ocsp、bind9、postfix、slapd

1、先在 SRV 上配置好所有服务：

直接复制目录，ansible部署时也是直接copy目录

# 先配置好所有服务，然后将目录copy 给ansible：
ssh-keygen    //配个密钥快一些
ssh-copy-id root@172.16.10.20
scp -r /etc/ssl root@172.16.10.20:/data
scp -r /etc/postfix root@172.16.10.20:/data
scp -r /etc/bind root@172.16.10.20:/data
scp -r /etc/ldap root@172.16.10.20:/data
scp -r /root/demoCA root@172.16.10.20:/data
scp /etc/chrony/chrony.conf root@172.16.10.20:/data
scp /usr/share/dns/root.hints root@172.16.10.20:/data
scp /root/ca.crt root@172.16.10.20:/data
scp /root/ocsp.crt root@172.16.10.20:/data
scp /root/ocsp.key root@172.16.10.20:/data
scp /var/lib/ldap/ root@172.16.10.20:/data/db    //lock.mdb、data.mdb文件

在 /data 上删除 ssl目录下的 certs 目录，因为它有很多文件，会大大拖慢ansible运行

rm -rf /data/ssl/certs

2、ansible剧本：

vim /usr/bin/ansible-deploy-srv

---
- name: ansible
  hosts: all
  gather_facts: false
  tasks:
    - name: CA
      file:
        path: /etc/ssl/globalcorp-ca
        state: directory
      register: file
 
    - name: install
      apt:
        name:
          - postfix
          - chrony
          - slapd
          - openssl
          - bind9
          - dnsutils
          - dbus
          - nmap
          - curl
          - net-tools
        update_cache: false
 
    - name: start dbus
      raw: |
        systemctl start dbus
      when: file.changed
 
    - name: hostname
      hostname:
        name: "{{ inventory_hostname }}"
 
    - name: bind9
      copy:
        src: /data/bind/
        dest: /etc/bind/
 
    - name: root hints
      copy:
        src: /data/root.hints
        dest: /usr/share/dns
 
    - name: postfix
      copy:
        src: /data/postfix/
        dest: /etc/postfix/
 
    - name: ssl
      copy:
        src: /data/ssl/
        dest: /etc/ssl/
 
    - name: slapd
      copy:
        src: /data/ldap/
        dest: /etc/ldap/
 
    - name: slapd
      copy:
        src: /data/slapd.d
        dest: /etc/default
 
    - name: slapd
      copy:
        src: /data/db/
        dest: /var/lib/ldap/
 
    - name: ldap port
      copy:
        src: /data/slapd
        dest: /etc/default
 
    - name: chrony
      copy:
        src: /data/chrony.conf
        dest: /etc/chrony
 
    - name: ca
      copy: 
        src: /data/demoCA/
        dest: /root/demoCA/
 
    - name: ca
      copy: 
        src: /data/ca.crt
        dest: /usr/local/share/ca-certificates
 
    - name: ca trust
      raw: |
        /usr/sbin/update-ca-certificates
      when: file.changed
 
    - name: ocsp
      copy:
        src: /data/ocsp.crt
        dest: /root
 
    - name: ocsp
      copy:
        src: /data/ocsp.key
        dest: /root
 
    - name: ocsp
      copy:
        src: /data/ca.crt
        dest: /root
 
    - name: ocsp
      lineinfile:
        path: /etc/crontab
        line: "@reboot root /usr/bin/openssl ocsp -index /root/demoCA/index.txt -port 8080 -rsigner /root/ocsp.crt -rkey /root/ocsp.key -CA /root/ca.crt -text"
 
    - name: restart
      raw: |
        chown openldap /etc/ssl/globalcorp-ca/*
        chown -R openldap:openldap /etc/ldap/slapd.d/
        systemctl restart bind9 slapd postfix chrony
      when: file.changed
 
    - name: reboot
      reboot:
        reboot_timeout: 3600
      when: file.changed

有的服务器需要配置 mailname

3、配置 ansible 离线包：