因为 ansible 更好用啊（ 你看我的武器库
admin.encrypted-backup
dev.build-tools fs.mfs-server
admin.ssh-keys dev.docker-auth net.clash-proxy
auth.ldap-manager dev.docker-prune sys.config
auth.ldap-server dev.docker-registry sys.docker
cfg.xxxxxx dev.docker-sync sys.packages
cfg.yyyyyy dev.gitlab-ce sys.userdel-ccf
cron.prefect dev.gitlab-runner vpn.ovpn-client
cron.switch-day-jobs dev.push-to-forquant vpn.ovpn-server
db.clickhouse-single dev.pypi-server web.assets-http
db.mongodb-cluster dns.xxxxxx web.certbot-cloudflare
db.mysql-cluster dns.yyyyyy web.doc-server
db.postgres-cluster fs.mfs-common
db.timescaledb-single fs.mfs-mount
这些都是直接拿来就能用的自动部署脚本。然后要部署一个集群的时候，就填入变量然后执行，例如，部署 mysql 双节点集群：
# 双节点 mysql 集群
- hosts: db1
roles:
- role: db.mysql-cluster
tags: mysql
vars:
mysql_server_role: "master"
mysql_server_id: 1
mysql_root_password: "xxxx"
mysql_replication_password: "yyyy"
- hosts: db2
roles:
- role: db.mysql-cluster
tags: mysql
vars:
mysql_server_role: "slave"
mysql_server_id: 2
mysql_root_password: "xxxx"
mysql_replication_password: "yyyy"
mysql_master_ip: 192.168.x.x
再比如，添加一个每天定时更新 Let's Encrypt 证书的任务，然后将证书配置给 Docker Registry 和 Pypi
- hosts: docker-registry
roles:
- role: web.certbot-cloudflare
tags: certbot
vars:
certbot_instance: registry
certbot_email: xxxxxx@xxxxxx.com
certbot_domains:
-
registry.example.com -
pypi.example.com certbot_cloudflare_token: 'xxxxxx'
certbot_deploy_dirs:
- /etc/nginx/certs
certbot_cron_hour: '4'
certbot_cron_minute: '14'
- role: dev.docker-registry
tags: [prod, docker-registry]
vars:
registry_instance: prod
registry_port: 5000
registry_ui_port: 8000
registry_nginx_enable: true
registry_auth_enable: true
registry_nginx_hostname:
registry.example.com registry_nginx_ssl_cert: /etc/nginx/certs/fullchain.pem
registry_nginx_ssl_cert_key: /etc/nginx/certs/privkey.pem
registry_auth_users:
- username: xxxxxx
password: yyyyyy
- role: dev.pypi-server
tags: [prod, pypi]
vars:
pypi_http_port: 8080
pypi_fallback_url:
https://pypi.tuna.tsinghua.edu.cn/simple pypi_nginx_hostname:
pypi.example.com pypi_nginx_ssl_cert: /etc/nginx/certs/fullchain.pem
pypi_nginx_ssl_cert_key: /etc/nginx/certs/privkey.pem