feat: Выполнил практическое задание по DevOps

2026-08-17 03:06:32 +03:00
commit d1ca831865
16 changed files with 689 additions and 0 deletions
@@ -0,0 +1,10 @@
+backup.sh
+docker-compose.yaml
+ssl/
+*.key
+*.pem
+*.crt
+backups/
+*.tar
+*.tar.gz
+*.tgz
@@ -0,0 +1,12 @@
+# FROM nginxinc/nginx-unprivileged:1.29.8-alpine3.23-slim@sha256:59678856b05324b7f6371f26eb1520be7fcd8bdc8ab380fc4913db8503e5a842
+FROM nginx:1.29.6-alpine3.23-slim@sha256:c8eb3bb3009bb98c04480e11405f5b4d38adbd0bf6df5f5e6ff552b236576331
+
+COPY --chown=nginx:nginx nginx.conf /etc/nginx/nginx.conf
+COPY --chown=nginx:nginx index.html /usr/share/nginx/html/index.html
+
+EXPOSE 80 443
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD wget -q --spider http://127.0.0.1:8080 || exit 1
+
+USER nginx
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+BACKUP_DIR="/opt/nginx/backups"
+CONTAINER="nginx"
+DATE=$(date -u +"%Y-%m-%d_%H-%M-%S")
+
+mkdir -p "$BACKUP_DIR"
+
+TMP_DIR=$(mktemp -d)
+
+docker cp "${CONTAINER}:/etc/nginx" "$TMP_DIR/nginx"
+
+tar -czf "${BACKUP_DIR}/nginx_${DATE}.tar.gz" \
+    -C "$TMP_DIR" nginx
+
+rm -rf "$TMP_DIR"
@@ -0,0 +1,13 @@
+services:
+  nginx:
+    image: simbir-nginx:1.29.6
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "80:8080"
+      - "443:8443"
+    restart: "unless-stopped"
+    container_name: nginx
+    volumes:
+      - /opt/nginx/ssl:/etc/nginx/ssl:ro
@@ -0,0 +1,20 @@
+<html>
+    <head>
+        <title>
+Hello DevOps world!
+        </title>
+    </head>
+    <body>
+        <h2>Hello DevOps world!</h2><br>
+        <h3 id="time"></h3>
+        <script>
+            setInterval(() => {
+                document.getElementById("time").textContent =
+                    new Date().toLocaleTimeString("ru-RU", {
+                        hour: "2-digit",
+                        minute: "2-digit",
+                        second: "2-digit"
+                    });
+            }, 1000);
+        </script>
+</body></html>
@@ -0,0 +1,24 @@
+pid /tmp/nginx.pid;
+user nginx;
+events {}
+
+http {
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path       /tmp/proxy_temp;
+    fastcgi_temp_path     /tmp/fastcgi_temp;
+    uwsgi_temp_path       /tmp/uwsgi_temp;
+    scgi_temp_path        /tmp/scgi_temp;
+
+    server {
+        listen 8080;
+        root /usr/share/nginx/html;
+    }
+
+    server {
+        listen 8443 ssl;
+        root /usr/share/nginx/html;
+
+        ssl_certificate     /etc/nginx/ssl/cert.pem;
+        ssl_certificate_key /etc/nginx/ssl/key.pem;
+    }
+}
@@ -0,0 +1,103 @@
+- name: Подготовка директории
+  become: true
+  ansible.builtin.file:
+    state: directory
+    path: /opt/nginx
+    mode: "0755"
+
+- name: Проверка наличия сертификата
+  ansible.builtin.stat:
+    path: /opt/nginx/ssl/cert.pem
+  register: cert_file
+
+- name: Проверка наличия приватного ключа
+  ansible.builtin.stat:
+    path: /opt/nginx/ssl/key.pem
+  register: key_file
+
+- name: Создание директории для сертификатов
+  become: true
+  ansible.builtin.file:
+    path: /opt/nginx/ssl
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when: not cert_file.stat.exists or not key_file.stat.exists
+
+- name: Генерация приватного ключа
+  become: true
+  community.crypto.openssl_privatekey:
+    path: /opt/nginx/ssl/key.pem
+    size: 2048
+    owner: root
+    group: 101
+    mode: '0640'
+  when: not cert_file.stat.exists or not key_file.stat.exists
+
+- name: Генерация CSR
+  become: true
+  community.crypto.openssl_csr:
+    path: /opt/nginx/ssl/nginx.csr
+    privatekey_path: /opt/nginx/ssl/key.pem
+    common_name: nginx.local
+    subject_alt_name:
+      - "DNS:nginx.local"
+      - "DNS:localhost"
+      - "IP:{{ansible_facts['default_ipv4']['address']}}"
+  when: not cert_file.stat.exists or not key_file.stat.exists
+
+- name: Генерация самоподписанного сертификата
+  become: true
+  community.crypto.x509_certificate:
+    path: /opt/nginx/ssl/cert.pem
+    privatekey_path: /opt/nginx/ssl/key.pem
+    csr_path: /opt/nginx/ssl/nginx.csr
+    provider: selfsigned
+    selfsigned_not_after: "+3650d"
+  when: not cert_file.stat.exists or not key_file.stat.exists
+
+- name: Изменение прав на сертификат
+  become: true
+  ansible.builtin.file:
+    path: /opt/nginx/ssl/cert.pem
+    owner: root
+    group: "101"
+    mode: "0644"
+
+- name: Копирование файлов конфигурации
+  become: true
+  ansible.builtin.copy:
+    src: "{{item}}"
+    dest: "/opt/nginx/{{item}}"
+    mode: "0755"
+  loop:
+    - nginx.conf
+    - Dockerfile
+    - index.html
+    - docker-compose.yaml
+    - backup.sh
+
+- name: Подготовка директории бекапов
+  become: true
+  ansible.builtin.file:
+    state: directory
+    path: /opt/nginx/backups
+    mode: "0755"
+
+- name: Настройка еженедельного резервного копирования Nginx
+  become: true
+  ansible.builtin.cron:
+    name: "nginx configuration backup"
+    minute: "0"
+    hour: "1"
+    weekday: "1"
+    job: "/opt/nginx/backup.sh"
+    env: false
+
+- name: Сборка и запуск Docker Compose
+  community.docker.docker_compose_v2:
+    project_src: /opt/nginx
+    state: present
+    build: always
+  become: true
@@ -0,0 +1,30 @@
+- name: Проверка наличия докера
+  ansible.builtin.command:
+    cmd: docker --version
+  register: docker_version
+  changed_when: false
+  failed_when: false
+
+- name: Скачивание скрипта установки докера
+  become: true
+  ansible.builtin.get_url:
+    url: https://get.docker.com
+    dest: /tmp/get-docker.sh
+    owner: root
+    group: root
+    mode: "0755"
+  when: docker_version.rc != 0
+
+- name: Установка докера
+  become: true
+  ansible.builtin.command:
+    cmd: sh /tmp/get-docker.sh
+    creates: /usr/bin/docker
+  when: docker_version.rc != 0
+
+- name: Активация докер сервиса
+  become: true
+  ansible.builtin.service:
+    name: docker
+    enabled: true
+    state: started
@@ -0,0 +1,5 @@
+- name: Генерация SSH ключа
+  ansible.builtin.command:
+    cmd: "ssh-keygen -t ed25519 -f {{playbook_dir}}/id_ed25519_simbirkey -N '' -C ''"
+    creates: "{{playbook_dir}}/id_ed25519_simbirkey"
+  delegate_to: localhost
@@ -0,0 +1,64 @@
+- name: Добавление SSH ключа
+  ansible.posix.authorized_key:
+    user: "{{ansible_user}}"
+    key: "{{ lookup('file', playbook_dir + '/id_ed25519_simbirkey.pub') }}"
+    state: present
+
+- name: Установка необходимых пакетов
+  ansible.builtin.apt:
+    name:
+      - ufw
+      - openssl
+      - openssh-server
+      - tar
+      - cron
+    state: present
+    update_cache: true
+  become: true
+
+- name: Разрешить SSH
+  community.general.ufw:
+    rule: allow
+    name: openssh
+  become: true
+
+- name: Разрешить HTTP и HTTPS
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  become: true
+  loop:
+    - "80"
+    - "443"
+
+- name: Включение и запуск файрволла
+  community.general.ufw:
+    state: enabled
+    default: deny
+  become: true
+
+- name: Перезагрузка файрволла
+  ansible.builtin.command: ufw reload
+  become: true
+
+- name: Включение и запуск SSH
+  ansible.builtin.systemd_service:
+    name: ssh
+    enabled: true
+    state: started
+  become: true
+
+- name: Включение и запуск cron
+  ansible.builtin.systemd_service:
+    name: cron
+    state: started
+    enabled: true
+  become: true
+
+- name: Установка UTC для cron
+  ansible.builtin.cron:
+    name: CRON_TZ
+    env: true
+    job: UTC
+  become: true