HANDBOOK
webmin部署
部署webmin, 起因是要找一个管理bind和nginx的web ui界面, 找了一圈, 装了很多开源方案, 也没找着一个合适的, 后来发现webmin很强大, 完全符合需要, 现在把使用ansible部署webmin的方法记录一下. webmin官网地址:http://www.webmin.com/, 基本上所有包和使用文档都能从官网获取, 安装有两个方式, rpm包和tar包, tar包方式是直接运行setup.sh, 方便自定义. webmin和virtualmin Virtualmin/Webmin其实是两个不同的管理系统。Webmin是一个基于WEB的用户界面，主要就是帮助服务器管理通过Web的界面方式来管理服务器，例如管理系统用户、配置Web服务器、DNS解析以及服务器之间的文件共享，是一个强大的Unix系统管理面板。而Virtualmin是Webmin的模块，从名字就可以看出来Virtualmin主要作用就是管理虚拟主机，也就是我们常用的建站主机。例如Virtualmin支持配置Apache、BIND DNS解析系统、MySQL数据库、 Sendmail 或者 Postfix邮箱和别名的创建和管理等等 部署 ansible版本需要2.9以上， 下面是ansible playbook脚本: webmin.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
--- - name: Provision webmin role hosts: all pre_tasks: - name: Override variables for MySQL. set_fact: mysql_databases: - name: dc-mysql-yyuap-io login: root pass: aaa*123 port: 3306 mysql_data: /data/mysql roles: - { role: webmin } |
roles/webmin/defaults/main.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
--- # defaults file for webmin webmin_version: 1.941 virtualmin_version: 6.09.gpl webmin_dir: /etc/webmin uninstall_webmin: false upgrade_webmin: false webmin_packages: - perl - perl-libwww-perl - perl-DBI - perl-DBD-MySQL - perl-GD - perl-HTML-Parser - perl-devel - openssl - perl-Encode-Detect - perl-Net-SSLeay - perl-Socket6 - perl-IO-Socket-INET6 mysql_database: ns_domain: yyuap.com |
roles/webmin/handlers/main.yml
|
1 2 3 4 5 6 7 8 9 |
--- # handlers file for webmin - name: restart webmin systemd: name: webmin enabled: true state: restarted daemon_reload: yes |
roles/webmin/templates/run_perl.j2
|
1 2 3 4 5 6 7 8 9 10 11 12 |
#!/usr/bin/perl open(CONF, "/etc/webmin/miniserv.conf") || die "Failed to open /etc/webmin/miniserv.conf : $!"; while(<CONF>) { $root = $1 if (/^root=(.*)/); } close(CONF); $root || die "No root= line found in /etc/webmin/miniserv.conf"; $ENV{'PERLLIB'} = "$root"; $ENV{'WEBMIN_CONFIG'} = "/etc/webmin"; $ENV{'WEBMIN_VAR'} = "/var/webmin"; chdir("$root/{{ script_dir }}"); exec("$root/{{ script_dir }}/{{ script }}", @ARGV) || die "Failed to run $root/{{ script_dir }}/{{ script }} : $!"; |
roles/webmin/templates/webmin.service.j2
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
[Unit] Description=Webmin Requires=local-fs.target After=basic.target Conflicts=shutdown.target [Service] Type=oneshot RemainAfterExit=yes ExecStart={{ webmin_dir }}/start ExecStop={{ webmin_dir }}/stop ExecReload={{ webmin_dir }}/reload [Install] WantedBy=multi-user.target |
roles/webmin/files/目录包括：authentic-theme mysql.wbm.gz nginx-0.11.wbm_.gz virtual-server-6.0.9.gpl.wbm.gz webmin-1.941.tar.gz roles/webmin/tasks/main.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
--- # tasks file for webmin # - name: Include global task include_tasks: global.yml when: - not uninstall_webmin - not upgrade_webmin - name: Include nginx task include_tasks: nginx.yml when: - not uninstall_webmin - not upgrade_webmin - groups['nginx'] | length > 0 - name: Include bind task include_tasks: bind.yml when: - not uninstall_webmin - not upgrade_webmin - groups['bind-dns'] | length > 0 - name: Include rsyslog task include_tasks: rsyslog.yml when: - not uninstall_webmin - not upgrade_webmin - groups['log-collector'] | length > 0 - name: Include cluster task include_tasks: cluster.yml when: - not uninstall_webmin - not upgrade_webmin - groups['deploy'] | length > 0 - name: Include mysql task include_tasks: mysql.yml when: - not uninstall_webmin - not upgrade_webmin - groups['mysql'] | length > 0 - name: Include proxy task include_tasks: proxy.yml when: - not uninstall_webmin - not upgrade_webmin - name: Stop running instance before restarting under systemd command: /etc/webmin/stop register: webmin_service changed_when: "'Stopping Webmin server' in webmin_service.stdout" notify: restart webmin when: - not uninstall_webmin - not upgrade_webmin - name: upgrade webmin include: upgrade.yml when: upgrade_webmin - name: Uninstall webmin include: uninstall.yml when: uninstall_webmin |
roles/webmin/tasks/global.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 |
# ---- start for global config # 安装依赖包 - name: Perl | Make sure the related packages are installed package: name: "{{ item }}" state: present with_items: "{{ webmin_packages }}" ignore_errors: yes - name: "copy packages to remote servers" copy: src: "{{ role_path }}/files/{{ item }}" dest: /tmp/{{ item }} mode: 0755 with_items: - webmin-{{ webmin_version }}.tar.gz - virtual-server-{{ virtualmin_version }}.wbm.gz # ----start install on deploy server # deploy主机用setup.sh方式安装(生成/etc/webmin配置, 启用20000端口, 关闭SSL, 增加用户admin) - name: "Unarchive webmin file" shell: mkdir /usr/local/webmin; tar -zxPf /tmp/webmin-{{ webmin_version }}.tar.gz -C /usr/local/webmin --strip-components 1 - name: "install webmin through script" # Usage: setup.sh port user password ssl (default: 20000 admin admin123 1) shell: "/usr/local/webmin/setup.sh 20000 admin admin123 0" # ----end install on deploy server - name: "install virtualmin" shell: perl /usr/local/webmin/install-module.pl /tmp/virtual-server-{{ virtualmin_version }}.wbm.gz /etc/webmin/ - name: "add admin user for all servers" lineinfile: dest: /etc/webmin/miniserv.users line: "admin:$1$XXXXXXXX$dtKvUVr39e5qIRG2tW07//:0" - name: "modify admin user acl" replace: path: /etc/webmin/webmin.acl regexp: '^root:' replace: 'admin:' # - name: "add config for automatic discovery servers" # shell: # cmd: | # cat >> /etc/webmin/servers/config << 'EOF' # auto_user=admin # auto_pass=admin123 # auto_self=0 # auto_smtp= # auto_net={{ network }} # auto_type=centos # auto_cluster-software=0 # auto_remove=1 # auto_email= # EOF # run_once: true # delegate_to: "{{ groups['deploy']|first }}" - name: "create crontab file" file: path: "/var/spool/cron/root" state: touch mode: 0600 run_once: true delegate_to: "{{ groups['deploy']|first }}" # - name: "copy auto discovery script" # copy: # src: "{{ role_path }}/files/auto.pl" # dest: /etc/webmin/servers/auto.pl # mode: "0755" # run_once: true # delegate_to: "{{ groups['deploy']|first }}" # - name: define parameter for auto.pl # set_fact: # script_dir: "servers" # script: "auto.pl" # - name: create script # template: # src: run_perl.j2 # dest: /etc/webmin/{{ script_dir }}/{{ script }} # mode: 0755 # run_once: true # delegate_to: "{{ groups['deploy']|first }}" # - name: "add cron job for automatic discovery servers" # lineinfile: # dest: /var/spool/cron/root # line: "0,10,20,30,40,50 * * * * /etc/webmin/servers/auto.pl" # run_once: true # delegate_to: "{{ groups['deploy']|first }}" - name: "set language to zh_CN for user admin" lineinfile: dest: /etc/webmin/config line: '{{ item }}' with_items: - 'lang_admin=zh_CN.UTF-8' - name: "set no feedback to webmin mail box" lineinfile: dest: /etc/webmin/config line: '{{ item }}' with_items: - 'nofeedbackcc=2' - 'feedback_to=' # ---- end for global config - name: "ensure ssl is disabled" replace: path: /etc/webmin/miniserv.conf regexp: '^ssl=1' replace: 'ssl=0' # fold the left menu - name: "config theme to fold the left menu" copy: src: "{{ role_path }}/files/authentic-theme" dest: /etc/webmin/ mode: "0755" # ---- final - name: Remove Webmin packages file: path: "/tmp/{{ item }}" state: absent with_items: - webmin-{{ webmin_version }}.tar.gz - virtual-server-{{ virtualmin_version }}.wbm.gz - name: Configure Webmin systemd service template: src: webmin.service.j2 dest: /etc/systemd/system/webmin.service mode: 0755 # - name: Stop running instance before restarting under systemd # command: /etc/webmin/stop # register: webmin_service # changed_when: "'Stopping Webmin server' in webmin_service.stdout" # notify: restart webmin # ---- open detailed opration log for audit - name: "open detailed opration log - miniserv.conf" replace: path: /etc/webmin/miniserv.conf regexp: "^{{ item.key }}=.*" replace: "{{ item.key }}={{ item.value }}" with_items: - { key: 'logtime', value: '240' } - name: "open detailed opration log - miniserv.conf" lineinfile: dest: /etc/webmin/miniserv.conf line: '{{ item }}' with_items: - logclear=1 - loghost=0 - nolog=.*xhr.* - logouttimes= - logclf=1 - loghost=0 - name: "open detailed opration log - config" lineinfile: dest: /etc/webmin/config line: '{{ item }}' with_items: - logfiles=1 - logfullfiles=1 - logtime=480 - logclear=1 - logsched=0 - name: "set referers_none=0" lineinfile: dest: /etc/webmin/config state: present regexp: "^referers_none=.*" line: "referers_none=0" |
roles/webmin/tasks/nginx.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
# ---- start install nginx module - name: "copy nginx module to remote servers" copy: src: "{{ role_path }}/files/nginx-0.11.wbm_.gz" dest: "/tmp/nginx-0.11.wbm_.gz" mode: 0755 run_once: true delegate_to: "{{item}}" loop: "{{ groups['nginx'] }}" - name: "install nginx module to remote servers" shell: perl /usr/local/webmin/install-module.pl /tmp/nginx-0.11.wbm_.gz /etc/webmin/ run_once: true delegate_to: "{{item}}" loop: "{{ groups['nginx'] }}" - name: "modify config for nginx module" shell: cmd: | cat > /etc/webmin/nginx/config << 'EOF' virt_name=gpaas link_dir=/data/iuap/middleware/nginx/sites-enabled mime_types=/data/iuap/middleware/nginx/mime.types stop_cmd=systemctl stop nginx pid_file=/run/nginx.pid max_servers=30 test_nginx=1 virt_dir=/data/iuap/middleware/nginx/conf.d show_order=0 start_cmd=systemctl start nginx nginx_version= nginx_dir=/data/iuap/middleware/nginx nginx_conf=/data/iuap/middleware/nginx/nginx.conf test_config=1 apply_cmd=2 nginx_path=/usr/sbin/nginx messages= EOF run_once: true delegate_to: "{{item}}" loop: "{{ groups['nginx'] }}" - name: "add new user for manage nginx, set default user/passwd: nginx/nginx123" lineinfile: dest: /etc/webmin/miniserv.users line: "nginx:$1$73896119$gkZO9mp5z2J4iGcLNn0a50::::::::::::" run_once: true delegate_to: "{{item}}" loop: "{{ groups['nginx'] }}" - name: "add nginx user acl" lineinfile: dest: /etc/webmin/webmin.acl line: "nginx: nginx" run_once: true delegate_to: "{{item}}" loop: "{{ groups['nginx'] }}" - name: "set language to zh_CN for user nginx" lineinfile: dest: /etc/webmin/config line: "lang_nginx=zh_CN.UTF-8" run_once: true delegate_to: "{{item}}" loop: "{{ groups['nginx'] }}" # ---- end install nginx module |
roles/webmin/tasks/bind.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 |
# ---- start configure for manage DNS --- - name: "create server id" shell: perl -e 'print (time()+int(rand(20)))' register: server_id with_items: - "{{ groups['bind-dns'] }}" when: inventory_hostname in groups['bind-dns'] - set_fact: server_id: "{{ server_id['results'][0]['stdout']}}" when: inventory_hostname in groups['bind-dns'] - name: define paramiters for dns servers set_fact: server_id: "{{ server_id }}" prins: "ns1.{{ ns_domain }}" secns: "{{ secns|default([]) + ['ns' + (ansible_loop.index+1)|string + '.' + ns_domain] }}" old_defip: "{{ inventory_hostname }}" with_items: - "{{ groups['bind-dns'] }}" loop_control: extended: yes when: inventory_hostname in groups['bind-dns'] - name: "add hosts into /etc/hosts for bind servers" lineinfile: dest: /etc/hosts regexp: '.*{{ item }}.*$' line: "{{ hostvars[item].inventory_hostname }} {{ hostvars[item].ansible_fqdn }} ns{{ ansible_loop.index }}.{{ ns_domain }}" state: present with_items: - "{{ groups['bind-dns'] }}" loop_control: extended: yes when: inventory_hostname in groups['bind-dns'] - name: "login webmin to create a cookie" uri: url: http://127.0.0.1:20000/session_login.cgi method: POST body_format: form-urlencoded status_code: [301,302] body: user: admin pass: admin123 enter: Sign in return_content: yes headers: Cookie: "testing=1" register: login run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" - name: config virtual-server template: src: virtual-server-config.j2 dest: /etc/webmin/virtual-server/config mode: '0711' run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" - name: check and reload Virtualmin uri: url: http://127.0.0.1:20000/virtual-server/check.cgi? validate_certs: no method: GET #return_content: yes headers: Cookie: "{{ login.set_cookie }}" status_code: [200] run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" # create server index - name: "add servers to webmin cluster" shell: cmd: | cat > /etc/webmin/servers/{{ hostvars[item].server_id }}.serv << EOF pass=admin123 ssl=0 checkssl= port=20000 host={{ item }} group= desc= user=admin id={{ hostvars[item].server_id }} type=centos fast=1 EOF run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" with_items: - "{{ groups['bind-dns'][1:] }}" - name: add dns slave servers to dns master server uri: url: http://127.0.0.1:20000/bind8/slave_add.cgi validate_certs: no method: POST #return_content: yes headers: Cookie: "{{ login.set_cookie }}" status_code: [200,301,302] body_format: form-urlencoded body: server: '{{ hostvars[item].server_id }}' view_def: 1 view: '' sec: 1 sync: 1 name_def: 0 name: "{{ secns[ansible_loop.index0] }}" run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" with_items: - "{{ groups['bind-dns'][1:] }}" loop_control: extended: yes - name: "Setting the Master IP Address" lineinfile: dest: /etc/webmin/bind8/config regexp: '^this_ip.*$' line: "this_ip={{ groups['bind-dns'][0] }}" state: present run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" - name: Basic Setup of DNS server uri: url: http://127.0.0.1:20000/bind8/save_zonedef.cgi validate_certs: no method: POST #return_content: yes headers: Cookie: "{{ login.set_cookie }}" status_code: [200,301,302] body_format: form-urlencoded body: refresh: 10800 refunit: '' retry: 3600 retunit: '' expiry: 604800 expunit: minimum: 38400 minunit: name_0: type_0: A value_0_def: 1 name_1: type_1: A value_1_def: 1 include_def: 1 email: 'iuap_admin@yonyou.com' prins_def: 0 prins: '{{ prins }}' dnssec: 0 alg: RSASHA1 size_def: 1 size: single: 0 allow-transfer_def: 0 allow-transfer: acl1 allow-query_def: 0 allow-query: any also-notify_def: 1 also-notify: master: ignore slave: response: notify: run_once: true delegate_to: "{{ groups['bind-dns'][0] }}" - name: "add new user bind for manage dns" lineinfile: dest: /etc/webmin/miniserv.users line: "bind:$1$73641827$.K742ybaJY33hg1vQQlQL/::::::::0::::" run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" - name: "add user bind acl for manage dns" lineinfile: dest: /etc/webmin/webmin.acl line: "bind: bind8" run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" - name: "create bind.acl file" file: path: "/etc/webmin/bind.acl" state: touch mode: '0611' run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" - name: "add bind acl for user" shell: cmd: | cat > /etc/webmin/bind.acl << 'EOF' rpc=2 nodot=0 webminsearch=1 uedit_mode=0 gedit_mode=0 feedback=2 otherdirs= readonly=0 fileunix=root uedit= negative=0 root=/ uedit2= gedit= gedit2= EOF run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" - name: "set language to zh_CN for user bind" lineinfile: dest: /etc/webmin/config line: 'lang_bind=zh_CN.UTF-8' run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" # add cron job for backup configure file - name: define parameter for backup.pl set_fact: script_dir: "backup-config" script: "backup.pl" - name: create backup script template: src: run_perl.j2 dest: /etc/webmin/{{ script_dir }}/{{ script }} mode: '0755' run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" - name: "create cron jobs" shell: cmd: | cron_job_id=$(perl -e 'print time().$$') job_dir=/etc/webmin/{{ script_dir }}/backups backup_dir=/data/backup/bind mkdir -p $job_dir $backup_dir cat > $job_dir/${cron_job_id}.backup << EOF configfile= dest=/data/backup/bind/bind_config others= post=conf="$backup_dir/bind_config"; conf_time=\${conf}_\$(date +%F-%H-%M); [[ -f "\$conf" ]] && echo "move \$conf to \$conf_time" && mv \$conf \$conf_time pre= email= mins=0 mods=bind8 sched=1 id=$cron_job_id hours=0 days=* nofiles= emode=0 weekdays=* months=* EOF grep -q "${cron_job_id}" /var/spool/cron/root || echo "0 0 * * * /etc/webmin/backup-config/backup.pl ${cron_job_id}" >> /var/spool/cron/root run_once: true delegate_to: "{{item}}" loop: "{{ groups['bind-dns'] }}" # ---- end configure for manage DNS |
roles/webmin/tasks/rsyslog.yml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
# ---- start config rsyslog server # rsyslog - name: "add new user for rsyslog" lineinfile: dest: /etc/webmin/miniserv.users line: "log:$1$75549770$Nvwg.lVayH5fxorPOOIw5/::::::::::::" run_once: true delegate_to: "{{item}}" loop: "{{ groups['log-collector'] }}" - name: "set language to zh_CN for user log" lineinfile: dest: /etc/webmin/config line: "lang_log=zh_CN.UTF-8" run_once: true delegate_to: "{{item}}" loop: "{{ groups['log-collector'] }}" - name: "add log user acl" lineinfile: dest: /etc/webmin/webmin.acl line: "log: logrotate syslog" run_once: true delegate_to: "{{item}}" loop: "{{ groups['log-collector'] }}" - name: "creat acl for log user, give log user only permission of dir /data/logs" shell: cmd: | cat > /etc/webmin/log.acl << 'EOF' rpc=2 nodot=0 webminsearch=1 uedit_mode=0 gedit_mode=0 feedback=2 otherdirs= readonly=0 fileunix=root uedit= negative=0 root=/data/logs uedit2= gedit= gedit2= EOF run_once: true delegate_to: "{{item}}" loop: "{{ groups['log-collector'] }}" # ---- end for config rsyslog server |