From 8e3dd46d3d69ef3e1a811efa2baf1d2132f683ea Mon Sep 17 00:00:00 2001 From: Joshua Hull Date: Sun, 15 Jan 2023 10:49:21 +0100 Subject: [PATCH 1/5] nginx: add common role for nginx esmil: - disable access log and log errors to syslog (journal really) use journalctl -u nginx to see the errors - hoist some configuration values into ansible variables - add tags and use a handler to reload nginx on configuration changes - make nginx do its DNS queries against our local resolved this enables nginx to use DNSSEC and DoT - don't start nginx before the network is up. if it can't do dns lookups ssl_stapling will be ignored --- roles/nginx/defaults/main.yml | 8 ++++ roles/nginx/handlers/main.yml | 7 +++ roles/nginx/tasks/main.yml | 64 +++++++++++++++++++++++++ roles/nginx/templates/nginx.conf.j2 | 73 +++++++++++++++++++++++++++++ roles/sky/files/wait-online.conf | 3 ++ 5 files changed, 155 insertions(+) create mode 100644 roles/nginx/defaults/main.yml create mode 100644 roles/nginx/handlers/main.yml create mode 100644 roles/nginx/tasks/main.yml create mode 100644 roles/nginx/templates/nginx.conf.j2 create mode 100644 roles/sky/files/wait-online.conf diff --git a/roles/nginx/defaults/main.yml b/roles/nginx/defaults/main.yml new file mode 100644 index 0000000..b6283c2 --- /dev/null +++ b/roles/nginx/defaults/main.yml @@ -0,0 +1,8 @@ +--- +nginx_worker_connections: 768 + +nginx_ssl_protocols: 'TLSv1.2 TLSv1.3' +nginx_ssl_ciphers: 'HIGH:!aNULL:!MD5' +#nginx_ssl_ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384' + +# vim: set ts=2 sw=2 et: diff --git a/roles/nginx/handlers/main.yml b/roles/nginx/handlers/main.yml new file mode 100644 index 0000000..f335839 --- /dev/null +++ b/roles/nginx/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: reload nginx + systemd: + name: nginx.service + state: reloaded + +# vim: set ts=2 sw=2 et: diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml new file mode 100644 index 0000000..f73e5e1 --- /dev/null +++ b/roles/nginx/tasks/main.yml @@ -0,0 +1,64 @@ +--- +- name: Configure /etc/nginx/nginx.conf + template: + dest: '/etc/nginx/nginx.conf' + src: nginx.conf.j2 + owner: root + group: root + mode: 0644 + notify: + - reload nginx + tags: + - nginx + +- name: Disable default site + file: + path: '/etc/nginx/sites-enabled/default' + state: absent + notify: + - reload nginx + tags: + - nginx + +- name: Download dhparam + get_url: + dest: '/etc/nginx/dhparam' + url: 'https://ssl-config.mozilla.org/ffdhe2048.txt' + owner: root + group: root + mode: 0440 + notify: + - reload nginx + tags: + - nginx + +- name: Create service drop-in directory + file: + dest: '/etc/systemd/system/nginx.service.d' + state: directory + owner: root + group: root + mode: 0755 + tags: + - nginx + +- name: Start nginx after networks are configured + copy: + dest: '/etc/systemd/system/nginx.service.d/wait-online.conf' + src: wait-online.conf + owner: root + group: root + mode: 0644 + tags: + - nginx + +- name: Enable nginx service + systemd: + name: nginx.service + enabled: yes + masked: no + state: started + tags: + - nginx + +# vim: set ts=2 sw=2 et: diff --git a/roles/nginx/templates/nginx.conf.j2 b/roles/nginx/templates/nginx.conf.j2 new file mode 100644 index 0000000..1188e53 --- /dev/null +++ b/roles/nginx/templates/nginx.conf.j2 @@ -0,0 +1,73 @@ +user www-data; +worker_processes auto; +{% if nginx_worker_rlimit_nofile is defined %} +worker_rlimit_nofile {{ nginx_worker_rlimit_nofile }}; +{% endif %} +pid /run/nginx.pid; +error_log /dev/null debug; +error_log syslog:server=unix:/dev/log,facility=daemon,tag=nginx notice; + +include /etc/nginx/modules-enabled/*.conf; + +events { + worker_connections {{ nginx_worker_connections }}; + # multi_accept on; +} + +http { + ## + # Basic Settings + ## + + sendfile on; + tcp_nopush on; + types_hash_max_size 2048; + # server_tokens off; + + # server_names_hash_bucket_size 64; + # server_name_in_redirect off; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ## + # Resolver + ## + + resolver 127.0.0.53 valid=30s; # systemd-resolved listens here + + ## + # SSL Settings + ## + + ssl_protocols {{ nginx_ssl_protocols }}; + ssl_ciphers {{ nginx_ssl_ciphers }}; + ssl_prefer_server_ciphers off; + ssl_dhparam /etc/nginx/dhparam; + + ## + # Logging Settings + ## + + access_log off; + + ## + # Gzip Settings + ## + + gzip on; + + # gzip_vary on; + # gzip_proxied any; + # gzip_comp_level 6; + # gzip_buffers 16 8k; + # gzip_http_version 1.1; + # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + + ## + # Virtual Host Configs + ## + + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; +} diff --git a/roles/sky/files/wait-online.conf b/roles/sky/files/wait-online.conf new file mode 100644 index 0000000..0a38143 --- /dev/null +++ b/roles/sky/files/wait-online.conf @@ -0,0 +1,3 @@ +[Unit] +Wants=network-online.target +After=network-online.target From 7271b5df2f1f987441b12081b4e6952cb482a2a6 Mon Sep 17 00:00:00 2001 From: Emil Renner Berthing Date: Thu, 19 Jan 2023 21:51:28 +0100 Subject: [PATCH 2/5] sky: add role for new labitat.dk server --- inventory | 1 + roles/sky/files/ens18.network | 17 +++++++++++++ roles/sky/meta/main.yml | 7 ++++++ roles/sky/tasks/main.yml | 12 +++++++++ roles/sky/vars/main.yml | 46 +++++++++++++++++++++++++++++++++++ sky.yml | 11 +++++++++ 6 files changed, 94 insertions(+) create mode 100644 roles/sky/files/ens18.network create mode 100644 roles/sky/meta/main.yml create mode 100644 roles/sky/tasks/main.yml create mode 100644 roles/sky/vars/main.yml create mode 100644 sky.yml diff --git a/inventory b/inventory index 4395cd5..0531274 100644 --- a/inventory +++ b/inventory @@ -1,4 +1,5 @@ space.labitat.dk +sky.labitat.dk ansible_host=85.209.118.135 mail1.labitat.dk [rpis] diff --git a/roles/sky/files/ens18.network b/roles/sky/files/ens18.network new file mode 100644 index 0000000..9496f52 --- /dev/null +++ b/roles/sky/files/ens18.network @@ -0,0 +1,17 @@ +[Match] +Name=ens18 +#Type=ether + +[Network] +DHCP=no +IPv6AcceptRA=no +Address=85.209.118.135/28 +Gateway=85.209.118.129 +Address=2a09:94c4:55d1:7680::87/64 +Gateway=2a09:94c4:55d1:7680::1 +DNS=91.239.100.100#anycast.censurfridns.dk 89.233.43.71#unicast.censurfridns.dk +DNSOverTLS=yes +DNSSEC=yes +LLMNR=no +MulticastDNS=no +LLDP=yes diff --git a/roles/sky/meta/main.yml b/roles/sky/meta/main.yml new file mode 100644 index 0000000..e2e9636 --- /dev/null +++ b/roles/sky/meta/main.yml @@ -0,0 +1,7 @@ +--- +dependencies: +- role: debian +- role: users +- role: nginx + +# vim: set ts=2 sw=2 et: diff --git a/roles/sky/tasks/main.yml b/roles/sky/tasks/main.yml new file mode 100644 index 0000000..0e0e54e --- /dev/null +++ b/roles/sky/tasks/main.yml @@ -0,0 +1,12 @@ +--- +- name: Install network configuration + copy: + dest: '/etc/systemd/network/ens18.network' + src: ens18.network + owner: root + group: root + mode: 0644 + tags: + - networkd + +# vim: set ts=2 sw=2 et: diff --git a/roles/sky/vars/main.yml b/roles/sky/vars/main.yml new file mode 100644 index 0000000..0246270 --- /dev/null +++ b/roles/sky/vars/main.yml @@ -0,0 +1,46 @@ +--- +hostname: 'labitat-sky' + +apt_repos_role: + base: + uri: 'https://deb.debian.org/debian' + suite: '{{ apt_release|default(ansible_distribution_release) }}' + security: + uri: 'https://security.debian.org/debian-security' + suite: '{{ apt_release|default(ansible_distribution_release) }}-security' + updates: + uri: 'https://deb.debian.org/debian' + suite: '{{ apt_release|default(ansible_distribution_release) }}-updates' + backports: + uri: 'https://deb.debian.org/debian' + suite: '{{ apt_release|default(ansible_distribution_release) }}-backports' + +apt_sources_role: + base: + components: + - main + - contrib + - non-free + security: + components: + - main + - contrib + - non-free + updates: + components: + - main + - contrib + - non-free + +apt_packages_role: + 'nginx': present + +journald_conf_role: + 'Journal.Storage': 'persistent' + +users: + 'esmil': sudo + 'ast': sudo + 'joshbuddy': sudo + +# vim: set ts=2 sw=2 et: diff --git a/sky.yml b/sky.yml new file mode 100644 index 0000000..7e24bd3 --- /dev/null +++ b/sky.yml @@ -0,0 +1,11 @@ +--- +- hosts: sky.labitat.dk + pre_tasks: + - name: Detect chroot + set_fact: + chroot: "{{ ansible_connection == 'chroot' or 'container' in ansible_env }}" + tags: always + roles: + - sky + +# vim: set ts=2 sw=2 et: From 4e26de01de237878ded3675edf744edce2058918 Mon Sep 17 00:00:00 2001 From: Joshua Hull Date: Sun, 15 Jan 2023 10:49:21 +0100 Subject: [PATCH 3/5] sky: certbot: configure certbot esmil: - don't install cron job, just use the packaged timer - install deploy hook to reload nginx when certificates are updated --- roles/sky/tasks/certbot.yml | 67 ++++++++++++++++++++++++ roles/sky/tasks/main.yml | 3 ++ roles/sky/templates/certbot-nginx.sh.j2 | 9 ++++ roles/sky/templates/letsencrypt.nginx.j2 | 14 +++++ roles/sky/vars/main.yml | 4 ++ 5 files changed, 97 insertions(+) create mode 100644 roles/sky/tasks/certbot.yml create mode 100755 roles/sky/templates/certbot-nginx.sh.j2 create mode 100644 roles/sky/templates/letsencrypt.nginx.j2 diff --git a/roles/sky/tasks/certbot.yml b/roles/sky/tasks/certbot.yml new file mode 100644 index 0000000..43e0bad --- /dev/null +++ b/roles/sky/tasks/certbot.yml @@ -0,0 +1,67 @@ +--- +- name: Create letsencrypt www directory + file: + name: '/var/www/letsencrypt' + state: directory + owner: root + group: root + mode: 0755 + +- name: Install nginx site for letsencrypt requests + template: + dest: '/etc/nginx/sites-enabled/letsencrypt' + src: letsencrypt.nginx.j2 + owner: root + group: root + mode: 0644 + register: letsencrypt_site + tags: + - nginx + +# We need to have the letsencrypt site loaded in the +# running nginx before creating the certificate below +# so we can't wait for the regular handler to run +- name: Reload nginx + systemd: + name: nginx.service + state: reloaded + when: letsencrypt_site is changed + +- name: 'Create {{ domain_name }} certificate' + command: + argv: + - '/usr/bin/certbot' + - 'certonly' + - '--non-interactive' + - '--agree-tos' + - '--max-log-backups' + - '99' + - '--webroot' + - '--webroot-path' + - '/var/www/letsencrypt' + - '--preferred-challenges' + - 'http' + - '--key-type' + - 'rsa' + - '-m' + - '{{ letsencrypt_email }}' + - '-d' + - '{{ domain_name }}' + creates: '/etc/letsencrypt/renewal/{{ domain_name }}.conf' + +- name: Enable certbot renewal timer + systemd: + name: certbot.timer + enabled: yes + masked: no + state: started + +- name: Add deploy hook to reload nginx + template: + dest: '/etc/letsencrypt/renewal-hooks/deploy/nginx.sh' + src: certbot-nginx.sh.j2 + owner: root + group: root + mode: 0755 + +# vim: set ts=2 sw=2 et: diff --git a/roles/sky/tasks/main.yml b/roles/sky/tasks/main.yml index 0e0e54e..6144e82 100644 --- a/roles/sky/tasks/main.yml +++ b/roles/sky/tasks/main.yml @@ -9,4 +9,7 @@ tags: - networkd +- import_tasks: certbot.yml + tags: certbot + # vim: set ts=2 sw=2 et: diff --git a/roles/sky/templates/certbot-nginx.sh.j2 b/roles/sky/templates/certbot-nginx.sh.j2 new file mode 100755 index 0000000..96ffe6d --- /dev/null +++ b/roles/sky/templates/certbot-nginx.sh.j2 @@ -0,0 +1,9 @@ +#!/bin/sh + +case "$RENEWED_LINEAGE" in +*'/{{ domain_name }}') + exec systemctl reload nginx.service + ;; +esac + +# vim: set ts=2 sw=2 et: diff --git a/roles/sky/templates/letsencrypt.nginx.j2 b/roles/sky/templates/letsencrypt.nginx.j2 new file mode 100644 index 0000000..a6738a4 --- /dev/null +++ b/roles/sky/templates/letsencrypt.nginx.j2 @@ -0,0 +1,14 @@ +server { + listen *:80; + listen [::]:80; + server_name {{ domain_name }}; + + location /.well-known/acme-challenge { + root /var/www/letsencrypt; + try_files $uri $uri/ =404; + } + + location / { + return 301 https://$host$request_uri; + } +} diff --git a/roles/sky/vars/main.yml b/roles/sky/vars/main.yml index 0246270..ce966a8 100644 --- a/roles/sky/vars/main.yml +++ b/roles/sky/vars/main.yml @@ -34,6 +34,7 @@ apt_sources_role: apt_packages_role: 'nginx': present + 'certbot': present journald_conf_role: 'Journal.Storage': 'persistent' @@ -43,4 +44,7 @@ users: 'ast': sudo 'joshbuddy': sudo +domain_name: 'new.labitat.dk' +letsencrypt_email: 'josh@fireflop.com' + # vim: set ts=2 sw=2 et: From e458b4f79f932a99ba33538b82534ea689b8bf74 Mon Sep 17 00:00:00 2001 From: Joshua Hull Date: Sun, 15 Jan 2023 10:49:21 +0100 Subject: [PATCH 4/5] sky: homepage: set up the frontpage of labitat.dk esmil: - use timer to update the homepage - git clone, update and install gems as the homepage user --- roles/sky/files/update-homepage.service | 13 +++++ roles/sky/files/update-homepage.timer | 12 +++++ roles/sky/handlers/main.yml | 8 +++ roles/sky/tasks/homepage.yml | 71 +++++++++++++++++++++++++ roles/sky/tasks/main.yml | 2 + roles/sky/templates/homepage.nginx.j2 | 28 ++++++++++ roles/sky/vars/main.yml | 1 + 7 files changed, 135 insertions(+) create mode 100644 roles/sky/files/update-homepage.service create mode 100644 roles/sky/files/update-homepage.timer create mode 100644 roles/sky/handlers/main.yml create mode 100644 roles/sky/tasks/homepage.yml create mode 100644 roles/sky/templates/homepage.nginx.j2 diff --git a/roles/sky/files/update-homepage.service b/roles/sky/files/update-homepage.service new file mode 100644 index 0000000..d4fc777 --- /dev/null +++ b/roles/sky/files/update-homepage.service @@ -0,0 +1,13 @@ +[Unit] +Description=Update Homepage +Requires=network-online.target +After=network-online.target + +[Service] +Type=oneshot +ExecStart=/home/homepage/homepage/make +WorkingDirectory=/home/homepage/homepage +User=homepage +Group=homepage +ProtectSystem=full +PrivateTmp=yes diff --git a/roles/sky/files/update-homepage.timer b/roles/sky/files/update-homepage.timer new file mode 100644 index 0000000..34a6a57 --- /dev/null +++ b/roles/sky/files/update-homepage.timer @@ -0,0 +1,12 @@ +[Unit] +Description=Update homepage every minute + +[Timer] +Unit=update-homepage.service +OnBootSec=1min +OnUnitActiveSec=1min +AccuracySec=1min +Persistent=no + +[Install] +WantedBy=timers.target diff --git a/roles/sky/handlers/main.yml b/roles/sky/handlers/main.yml new file mode 100644 index 0000000..a73bd25 --- /dev/null +++ b/roles/sky/handlers/main.yml @@ -0,0 +1,8 @@ +--- +- name: restart update-homepage + systemd: + name: update-homepage.timer + state: restarted + daemon_reload: yes + +# vim: set ts=2 sw=2 et: diff --git a/roles/sky/tasks/homepage.yml b/roles/sky/tasks/homepage.yml new file mode 100644 index 0000000..43ebcee --- /dev/null +++ b/roles/sky/tasks/homepage.yml @@ -0,0 +1,71 @@ +--- +- name: Create homepage user + user: + comment: 'user for homepage' + name: homepage + group: homepage + uid: 3000 + shell: '/bin/bash' + +- name: Clone homepage git repo + git: + dest: '~homepage/homepage' + repo: 'https://github.com/labitat/homepage' + version: main + remote: origin + #single_branch: yes + #accept_newhostkey: yes + clone: yes + update: yes + become_user: homepage + +- name: Create build and out directories + file: + path: '~homepage/homepage/{{ item }}' + state: directory + owner: homepage + group: homepage + mode: 0755 + with_items: + - build + - out + +- name: Install dependencies + command: /usr/local/bin/bundle + args: + chdir: '~homepage/homepage' + become_user: homepage + +- name: Create update-homepage service and timer + copy: + dest: '/etc/systemd/system/{{ item }}' + src: '{{ item }}' + owner: root + group: root + mode: 0644 + with_items: + - update-homepage.service + - update-homepage.timer + notify: + - restart update-homepage + +- name: Enable update-homepage timer + systemd: + name: update-homepage.timer + enabled: yes + masked: no + state: started + +- name: Install nginx site for homepage + template: + dest: '/etc/nginx/sites-enabled/homepage' + src: homepage.nginx.j2 + owner: root + group: root + mode: 0644 + notify: + - reload nginx + tags: + - nginx + +# vim: set ts=2 sw=2 et: diff --git a/roles/sky/tasks/main.yml b/roles/sky/tasks/main.yml index 6144e82..9d04b9f 100644 --- a/roles/sky/tasks/main.yml +++ b/roles/sky/tasks/main.yml @@ -11,5 +11,7 @@ - import_tasks: certbot.yml tags: certbot +- import_tasks: homepage.yml + tags: homepage # vim: set ts=2 sw=2 et: diff --git a/roles/sky/templates/homepage.nginx.j2 b/roles/sky/templates/homepage.nginx.j2 new file mode 100644 index 0000000..cf31da9 --- /dev/null +++ b/roles/sky/templates/homepage.nginx.j2 @@ -0,0 +1,28 @@ +# generated 2023-01-14, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration +# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 +server { + listen *:443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ domain_name }}; + + ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem; + + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000" always; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + root /home/homepage/homepage/build; + + location = / { + try_files $uri /out.html; + } +} diff --git a/roles/sky/vars/main.yml b/roles/sky/vars/main.yml index ce966a8..b87f00f 100644 --- a/roles/sky/vars/main.yml +++ b/roles/sky/vars/main.yml @@ -35,6 +35,7 @@ apt_sources_role: apt_packages_role: 'nginx': present 'certbot': present + 'curl': present journald_conf_role: 'Journal.Storage': 'persistent' From 21d88ed69f9dbf14344a4386afbbb7a1ba09c868 Mon Sep 17 00:00:00 2001 From: Joshua Hull Date: Thu, 26 Jan 2023 22:49:10 +0100 Subject: [PATCH 5/5] wip --- .gitignore | 2 + ansible.cfg | 1 + requirements.txt | 10 + roles/geerlingguy.mysql/.ansible-lint | 3 + roles/geerlingguy.mysql/.github/FUNDING.yml | 4 + roles/geerlingguy.mysql/.github/stale.yml | 57 +++++ .../.github/workflows/ci.yml | 79 ++++++ .../.github/workflows/release.yml | 40 +++ roles/geerlingguy.mysql/.gitignore | 4 + roles/geerlingguy.mysql/.yamllint | 10 + roles/geerlingguy.mysql/LICENSE | 20 ++ roles/geerlingguy.mysql/README.md | 239 ++++++++++++++++++ roles/geerlingguy.mysql/defaults/main.yml | 134 ++++++++++ roles/geerlingguy.mysql/handlers/main.yml | 3 + .../meta/.galaxy_install_info | 2 + roles/geerlingguy.mysql/meta/main.yml | 31 +++ .../molecule/default/converge.yml | 16 ++ .../molecule/default/molecule.yml | 19 ++ roles/geerlingguy.mysql/tasks/configure.yml | 85 +++++++ roles/geerlingguy.mysql/tasks/databases.yml | 9 + roles/geerlingguy.mysql/tasks/main.yml | 26 ++ roles/geerlingguy.mysql/tasks/replication.yml | 58 +++++ .../tasks/secure-installation.yml | 86 +++++++ .../tasks/setup-Archlinux.yml | 12 + .../geerlingguy.mysql/tasks/setup-Debian.yml | 34 +++ .../geerlingguy.mysql/tasks/setup-RedHat.yml | 7 + roles/geerlingguy.mysql/tasks/users.yml | 12 + roles/geerlingguy.mysql/tasks/variables.yml | 59 +++++ roles/geerlingguy.mysql/templates/my.cnf.j2 | 130 ++++++++++ .../templates/root-my.cnf.j2 | 5 + .../templates/user-my.cnf.j2 | 5 + roles/geerlingguy.mysql/vars/Archlinux.yml | 12 + roles/geerlingguy.mysql/vars/Debian-10.yml | 13 + roles/geerlingguy.mysql/vars/Debian-11.yml | 13 + roles/geerlingguy.mysql/vars/Debian.yml | 14 + roles/geerlingguy.mysql/vars/RedHat-7.yml | 16 ++ roles/geerlingguy.mysql/vars/RedHat-8.yml | 18 ++ roles/geerlingguy.mysql/vars/RedHat-9.yml | 18 ++ roles/sky/meta/main.yml | 1 + roles/sky/tasks/main.yml | 2 + roles/sky/tasks/wiki.yml | 6 + roles/sky/vars/main.yml | 7 + 42 files changed, 1322 insertions(+) create mode 100644 requirements.txt create mode 100644 roles/geerlingguy.mysql/.ansible-lint create mode 100644 roles/geerlingguy.mysql/.github/FUNDING.yml create mode 100644 roles/geerlingguy.mysql/.github/stale.yml create mode 100644 roles/geerlingguy.mysql/.github/workflows/ci.yml create mode 100644 roles/geerlingguy.mysql/.github/workflows/release.yml create mode 100644 roles/geerlingguy.mysql/.gitignore create mode 100644 roles/geerlingguy.mysql/.yamllint create mode 100644 roles/geerlingguy.mysql/LICENSE create mode 100644 roles/geerlingguy.mysql/README.md create mode 100644 roles/geerlingguy.mysql/defaults/main.yml create mode 100644 roles/geerlingguy.mysql/handlers/main.yml create mode 100644 roles/geerlingguy.mysql/meta/.galaxy_install_info create mode 100644 roles/geerlingguy.mysql/meta/main.yml create mode 100644 roles/geerlingguy.mysql/molecule/default/converge.yml create mode 100644 roles/geerlingguy.mysql/molecule/default/molecule.yml create mode 100644 roles/geerlingguy.mysql/tasks/configure.yml create mode 100644 roles/geerlingguy.mysql/tasks/databases.yml create mode 100644 roles/geerlingguy.mysql/tasks/main.yml create mode 100644 roles/geerlingguy.mysql/tasks/replication.yml create mode 100644 roles/geerlingguy.mysql/tasks/secure-installation.yml create mode 100644 roles/geerlingguy.mysql/tasks/setup-Archlinux.yml create mode 100644 roles/geerlingguy.mysql/tasks/setup-Debian.yml create mode 100644 roles/geerlingguy.mysql/tasks/setup-RedHat.yml create mode 100644 roles/geerlingguy.mysql/tasks/users.yml create mode 100644 roles/geerlingguy.mysql/tasks/variables.yml create mode 100644 roles/geerlingguy.mysql/templates/my.cnf.j2 create mode 100644 roles/geerlingguy.mysql/templates/root-my.cnf.j2 create mode 100644 roles/geerlingguy.mysql/templates/user-my.cnf.j2 create mode 100644 roles/geerlingguy.mysql/vars/Archlinux.yml create mode 100644 roles/geerlingguy.mysql/vars/Debian-10.yml create mode 100644 roles/geerlingguy.mysql/vars/Debian-11.yml create mode 100644 roles/geerlingguy.mysql/vars/Debian.yml create mode 100644 roles/geerlingguy.mysql/vars/RedHat-7.yml create mode 100644 roles/geerlingguy.mysql/vars/RedHat-8.yml create mode 100644 roles/geerlingguy.mysql/vars/RedHat-9.yml create mode 100644 roles/sky/tasks/wiki.yml diff --git a/.gitignore b/.gitignore index bee9651..19308ee 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,6 @@ *.retry /secrets.yml +/passwd *~ .*.swp +/env diff --git a/ansible.cfg b/ansible.cfg index d205e0c..0d9b7fb 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -2,6 +2,7 @@ inventory = inventory error_on_missing_handler = True interpreter_python = auto +vault_password_file = passwd [ssh_connection] pipelining = True diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..0d48dfc --- /dev/null +++ b/requirements.txt @@ -0,0 +1,10 @@ +ansible==7.1.0 +ansible-core==2.14.1 +cffi==1.15.1 +cryptography==39.0.0 +Jinja2==3.1.2 +MarkupSafe==2.1.1 +packaging==23.0 +pycparser==2.21 +PyYAML==6.0 +resolvelib==0.8.1 diff --git a/roles/geerlingguy.mysql/.ansible-lint b/roles/geerlingguy.mysql/.ansible-lint new file mode 100644 index 0000000..acc8255 --- /dev/null +++ b/roles/geerlingguy.mysql/.ansible-lint @@ -0,0 +1,3 @@ +skip_list: + - 'yaml' + - 'role-name' diff --git a/roles/geerlingguy.mysql/.github/FUNDING.yml b/roles/geerlingguy.mysql/.github/FUNDING.yml new file mode 100644 index 0000000..96b4938 --- /dev/null +++ b/roles/geerlingguy.mysql/.github/FUNDING.yml @@ -0,0 +1,4 @@ +# These are supported funding model platforms +--- +github: geerlingguy +patreon: geerlingguy diff --git a/roles/geerlingguy.mysql/.github/stale.yml b/roles/geerlingguy.mysql/.github/stale.yml new file mode 100644 index 0000000..3cc6ec3 --- /dev/null +++ b/roles/geerlingguy.mysql/.github/stale.yml @@ -0,0 +1,57 @@ +# Configuration for probot-stale - https://github.com/probot/stale + +# Number of days of inactivity before an Issue or Pull Request becomes stale +daysUntilStale: 90 + +# Number of days of inactivity before an Issue or Pull Request with the stale label is closed. +# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale. +daysUntilClose: 30 + +# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled) +onlyLabels: [] + +# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable +exemptLabels: + - bug + - pinned + - security + - planned + +# Set to true to ignore issues in a project (defaults to false) +exemptProjects: false + +# Set to true to ignore issues in a milestone (defaults to false) +exemptMilestones: false + +# Set to true to ignore issues with an assignee (defaults to false) +exemptAssignees: false + +# Label to use when marking as stale +staleLabel: stale + +# Limit the number of actions per hour, from 1-30. Default is 30 +limitPerRun: 30 + +pulls: + markComment: |- + This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution! + + Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark pull requests as stale. + + unmarkComment: >- + This pull request is no longer marked for closure. + + closeComment: >- + This pull request has been closed due to inactivity. If you feel this is in error, please reopen the pull request or file a new PR with the relevant details. + +issues: + markComment: |- + This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution! + + Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale. + + unmarkComment: >- + This issue is no longer marked for closure. + + closeComment: >- + This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details. diff --git a/roles/geerlingguy.mysql/.github/workflows/ci.yml b/roles/geerlingguy.mysql/.github/workflows/ci.yml new file mode 100644 index 0000000..4551488 --- /dev/null +++ b/roles/geerlingguy.mysql/.github/workflows/ci.yml @@ -0,0 +1,79 @@ +--- +name: CI +'on': + pull_request: + push: + branches: + - master + schedule: + - cron: "0 1 * * 3" + +defaults: + run: + working-directory: 'geerlingguy.mysql' + +jobs: + + lint: + name: Lint + runs-on: ubuntu-latest + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + with: + path: 'geerlingguy.mysql' + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install test dependencies. + run: pip3 install yamllint + + - name: Lint code. + run: | + yamllint . + + molecule: + name: Molecule + runs-on: ubuntu-latest + strategy: + matrix: + distro: + - rockylinux8 + - rockylinux9 + - ubuntu2204 + - ubuntu2004 + - debian11 + - debian10 + + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + with: + path: 'geerlingguy.mysql' + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install test dependencies. + run: pip3 install ansible molecule[docker] docker + + # See: https://github.com/geerlingguy/ansible-role-mysql/issues/422 + - name: Disable AppArmor on Debian. + run: | + set -x + sudo apt-get install apparmor-profiles + sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/ + sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld + if: ${{ startsWith(matrix.distro, 'debian') }} + + - name: Run Molecule tests. + run: molecule test + env: + PY_COLORS: '1' + ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: ${{ matrix.distro }} diff --git a/roles/geerlingguy.mysql/.github/workflows/release.yml b/roles/geerlingguy.mysql/.github/workflows/release.yml new file mode 100644 index 0000000..d4d41ca --- /dev/null +++ b/roles/geerlingguy.mysql/.github/workflows/release.yml @@ -0,0 +1,40 @@ +--- +# This workflow requires a GALAXY_API_KEY secret present in the GitHub +# repository or organization. +# +# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy +# See: https://github.com/ansible/galaxy/issues/46 + +name: Release +'on': + push: + tags: + - '*' + +defaults: + run: + working-directory: 'geerlingguy.mysql' + +jobs: + + release: + name: Release + runs-on: ubuntu-latest + steps: + - name: Check out the codebase. + uses: actions/checkout@v2 + with: + path: 'geerlingguy.mysql' + + - name: Set up Python 3. + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: Install Ansible. + run: pip3 install ansible-core + + - name: Trigger a new import on Galaxy. + run: >- + ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }} + $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2) diff --git a/roles/geerlingguy.mysql/.gitignore b/roles/geerlingguy.mysql/.gitignore new file mode 100644 index 0000000..554cc54 --- /dev/null +++ b/roles/geerlingguy.mysql/.gitignore @@ -0,0 +1,4 @@ +*.retry +*/__pycache__ +*.pyc +.cache diff --git a/roles/geerlingguy.mysql/.yamllint b/roles/geerlingguy.mysql/.yamllint new file mode 100644 index 0000000..2a66c05 --- /dev/null +++ b/roles/geerlingguy.mysql/.yamllint @@ -0,0 +1,10 @@ +--- +extends: default + +rules: + line-length: + max: 160 + level: warning + +ignore: | + .github/stale.yml diff --git a/roles/geerlingguy.mysql/LICENSE b/roles/geerlingguy.mysql/LICENSE new file mode 100644 index 0000000..4275cf3 --- /dev/null +++ b/roles/geerlingguy.mysql/LICENSE @@ -0,0 +1,20 @@ +The MIT License (MIT) + +Copyright (c) 2017 Jeff Geerling + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/roles/geerlingguy.mysql/README.md b/roles/geerlingguy.mysql/README.md new file mode 100644 index 0000000..9f78057 --- /dev/null +++ b/roles/geerlingguy.mysql/README.md @@ -0,0 +1,239 @@ +# Ansible Role: MySQL + +[![CI](https://github.com/geerlingguy/ansible-role-mysql/workflows/CI/badge.svg?event=push)](https://github.com/geerlingguy/ansible-role-mysql/actions?query=workflow%3ACI) + +Installs and configures MySQL or MariaDB server on RHEL/CentOS or Debian/Ubuntu servers. + +## Requirements + +No special requirements; note that this role requires root access, so either run it in a playbook with a global `become: yes`, or invoke the role in your playbook like: + +```yaml +- hosts: database + roles: + - role: geerlingguy.mysql + become: yes +``` + +## Role Variables + +Available variables are listed below, along with default values (see `defaults/main.yml`): + +```yaml +mysql_user_home: /root +mysql_user_name: root +mysql_user_password: root +``` + +The home directory inside which Python MySQL settings will be stored, which Ansible will use when connecting to MySQL. This should be the home directory of the user which runs this Ansible role. The `mysql_user_name` and `mysql_user_password` can be set if you are running this role under a non-root user account and want to set a non-root user. + +```yaml +mysql_root_home: /root +mysql_root_username: root +mysql_root_password: root +``` + +The MySQL root user account details. + +```yaml +mysql_root_password_update: false +``` + +Whether to force update the MySQL root user's password. By default, this role will only change the root user's password when MySQL is first configured. You can force an update by setting this to `yes`. + +> Note: If you get an error like `ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)` after a failed or interrupted playbook run, this usually means the root password wasn't originally updated to begin with. Try either removing the `.my.cnf` file inside the configured `mysql_user_home` or updating it and setting `password=''` (the insecure default password). Run the playbook again, with `mysql_root_password_update` set to `yes`, and the setup should complete. + +> Note: If you get an error like `ERROR 1698 (28000): Access denied for user 'root'@'localhost' (using password: YES)` when trying to log in from the CLI you might need to run as root or sudoer. + +```yaml +mysql_enabled_on_startup: true +``` + +Whether MySQL should be enabled on startup. + +```yaml +mysql_config_file: *default value depends on OS* +mysql_config_include_dir: *default value depends on OS* +``` + +The main my.cnf configuration file and include directory. + +```yaml +overwrite_global_mycnf: true +``` + +Whether the global my.cnf should be overwritten each time this role is run. Setting this to `no` tells Ansible to only create the `my.cnf` file if it doesn't exist. This should be left at its default value (`yes`) if you'd like to use this role's variables to configure MySQL. + +```yaml +mysql_config_include_files: [] +``` + +A list of files that should override the default global my.cnf. Each item in the array requires a "src" parameter which is a path to a file. An optional "force" parameter can force the file to be updated each time ansible runs. + +```yaml +mysql_databases: [] +``` + +The MySQL databases to create. A database has the values `name`, `encoding` (defaults to `utf8`), `collation` (defaults to `utf8_general_ci`) and `replicate` (defaults to `1`, only used if replication is configured). The formats of these are the same as in the `mysql_db` module. + +You can also delete a database (or ensure it's not on the server) by setting `state` to `absent` (defaults to `present`). + +```yaml +mysql_users: [] +``` + +The MySQL users and their privileges. A user has the values: + + - `name` + - `host` (defaults to `localhost`) + - `password` (can be plaintext or encrypted—if encrypted, set `encrypted: yes`) + - `encrypted` (defaults to `no`) + - `priv` (defaults to `*.*:USAGE`) + - `append_privs` (defaults to `no`) + - `state` (defaults to `present`) + +The formats of these are the same as in the `mysql_user` module. + +```yaml +mysql_packages: + - mysql + - mysql-server +``` + +(OS-specific, RedHat/CentOS defaults listed here) Packages to be installed. In some situations, you may need to add additional packages, like `mysql-devel`. + +```yaml +mysql_enablerepo: "" +``` + +(RedHat/CentOS only) If you have enabled any additional repositories (might I suggest geerlingguy.repo-epel or geerlingguy.repo-remi), those repositories can be listed under this variable (e.g. `remi,epel`). This can be handy, as an example, if you want to install later versions of MySQL. + +```yaml +mysql_python_package_debian: python3-mysqldb +``` + +(Ubuntu/Debian only) If you need to explicitly override the MySQL Python package, you can set it here. Set this to `python-mysqldb` if using older distributions running Python 2. + +```yaml +mysql_port: "3306" +mysql_bind_address: '0.0.0.0' +mysql_datadir: /var/lib/mysql +mysql_socket: *default value depends on OS* +mysql_pid_file: *default value depends on OS* +``` + +Default MySQL connection configuration. + +```yaml +mysql_log_file_group: mysql *adm on Debian* +mysql_log: "" +mysql_log_error: *default value depends on OS* +mysql_syslog_tag: *default value depends on OS* +```yaml + +MySQL logging configuration. Setting `mysql_log` (the general query log) or `mysql_log_error` to `syslog` will make MySQL log to syslog using the `mysql_syslog_tag`. + +```yaml +mysql_slow_query_log_enabled: false +mysql_slow_query_log_file: *default value depends on OS* +mysql_slow_query_time: 2 +``` + +Slow query log settings. Note that the log file will be created by this role, but if you're running on a server with SELinux or AppArmor, you may need to add this path to the allowed paths for MySQL, or disable the mysql profile. For example, on Debian/Ubuntu, you can run `sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/usr.sbin.mysqld && sudo service apparmor restart`. + +```yaml +mysql_key_buffer_size: "256M" +mysql_max_allowed_packet: "64M" +mysql_table_open_cache: "256" +... +``` + +The rest of the settings in `defaults/main.yml` control MySQL's memory usage and some other common settings. The default values are tuned for a server where MySQL can consume 512 MB RAM, so you should consider adjusting them to suit your particular server better. + +```yaml +mysql_server_id: "1" +mysql_max_binlog_size: "100M" +mysql_binlog_format: "ROW" +mysql_expire_logs_days: "10" +mysql_replication_role: '' +mysql_replication_master: '' +mysql_replication_user: {} +``` + +Replication settings. Set `mysql_server_id` and `mysql_replication_role` by server (e.g. the master would be ID `1`, with the `mysql_replication_role` of `master`, and the slave would be ID `2`, with the `mysql_replication_role` of `slave`). The `mysql_replication_user` uses the same keys as individual list items in `mysql_users`, and is created on master servers, and used to replicate on all the slaves. + +`mysql_replication_master` needs to resolve to an IP or a hostname which is accessable to the Slaves (this could be a `/etc/hosts` injection or some other means), otherwise the slaves cannot communicate to the master. + +If the replication master has different IP addresses where you are running ansible and where the mysql replica is running, you can *optionally* specify a `mysql_replication_master_inventory_host` to access the machine (e.g. you run ansible on your local machine, but the mysql master and replica need to communicate on a different network) + +### Later versions of MySQL on CentOS 7 + +If you want to install MySQL from the official repository instead of installing the system default MariaDB equivalents, you can add the following `pre_tasks` task in your playbook: + +```yaml + pre_tasks: + - name: Install the MySQL repo. + yum: + name: http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm + state: present + when: ansible_os_family == "RedHat" + + - name: Override variables for MySQL (RedHat). + set_fact: + mysql_daemon: mysqld + mysql_packages: ['mysql-server'] + mysql_log_error: /var/log/mysqld.err + mysql_syslog_tag: mysqld + mysql_pid_file: /var/run/mysqld/mysqld.pid + mysql_socket: /var/lib/mysql/mysql.sock + when: ansible_os_family == "RedHat" +``` + +### MariaDB usage + +This role works with either MySQL or a compatible version of MariaDB. On RHEL/CentOS 7+, the mariadb database engine was substituted as the default MySQL replacement package. No modifications are necessary though all of the variables still reference 'mysql' instead of mariadb. + +#### Ubuntu 14.04 and 16.04 MariaDB configuration + +On Ubuntu, the package names are named differently, so the `mysql_package` variable needs to be altered. Set the following variables (at a minimum): + + mysql_packages: + - mariadb-client + - mariadb-server + - python-mysqldb + +## Dependencies + +If you have `ansible` installed (e.g. `pip3 install ansible`), none. + +If you have only installed `ansible-core`, be sure to require `community.mysql` in your `collections/requirements.yml` or install it manually with `ansible-galaxy collection install community.mysql`. + +## Example Playbook + + - hosts: db-servers + become: yes + vars_files: + - vars/main.yml + roles: + - { role: geerlingguy.mysql } + +*Inside `vars/main.yml`*: + + mysql_root_password: super-secure-password + mysql_databases: + - name: example_db + encoding: latin1 + collation: latin1_general_ci + mysql_users: + - name: example_user + host: "%" + password: similarly-secure-password + priv: "example_db.*:ALL" + +## License + +MIT / BSD + +## Author Information + +This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/). diff --git a/roles/geerlingguy.mysql/defaults/main.yml b/roles/geerlingguy.mysql/defaults/main.yml new file mode 100644 index 0000000..49110da --- /dev/null +++ b/roles/geerlingguy.mysql/defaults/main.yml @@ -0,0 +1,134 @@ +--- +# Set this to the user ansible is logging in as - should have root +# or sudo access +mysql_user_home: /root +mysql_user_name: root +mysql_user_password: root + +# The default root user installed by mysql - almost always root +mysql_root_home: /root +mysql_root_username: root +mysql_root_password: root + +# Set this to `true` to forcibly update the root password. +mysql_root_password_update: false +mysql_user_password_update: false + +mysql_enabled_on_startup: true + +# Whether my.cnf should be updated on every run. +overwrite_global_mycnf: true + +# The following variables have a default value depending on operating system. +# mysql_config_file: /etc/my.cnf +# mysql_config_include_dir: /etc/my.cnf.d + +# Pass in a comma-separated list of repos to use (e.g. "remi,epel"). Used only +# for RedHat systems (and derivatives). +mysql_enablerepo: "" + +# Define a custom list of packages to install; if none provided, the default +# package list from vars/[OS-family].yml will be used. +# mysql_packages: +# - mysql +# - mysql-server +# - MySQL-python + +mysql_python_package_debian: python3-mysqldb + +# MySQL connection settings. +mysql_port: "3306" +mysql_bind_address: '0.0.0.0' +mysql_skip_name_resolve: false +mysql_datadir: /var/lib/mysql +mysql_sql_mode: ~ +# The following variables have a default value depending on operating system. +# mysql_pid_file: /var/run/mysqld/mysqld.pid +# mysql_socket: /var/lib/mysql/mysql.sock + +# Log file settings. +mysql_log_file_group: mysql + +# Slow query log settings. +mysql_slow_query_log_enabled: false +mysql_slow_query_time: "2" +# The following variable has a default value depending on operating system. +# mysql_slow_query_log_file: /var/log/mysql-slow.log + +# Memory settings (default values optimized ~512MB RAM). +mysql_key_buffer_size: "256M" +mysql_max_allowed_packet: "64M" +mysql_table_open_cache: "256" +mysql_sort_buffer_size: "1M" +mysql_read_buffer_size: "1M" +mysql_read_rnd_buffer_size: "4M" +mysql_myisam_sort_buffer_size: "64M" +mysql_thread_cache_size: "8" +mysql_query_cache_type: "0" +mysql_query_cache_size: "16M" +mysql_query_cache_limit: "1M" +mysql_max_connections: "151" +mysql_tmp_table_size: "16M" +mysql_max_heap_table_size: "16M" +mysql_group_concat_max_len: "1024" +mysql_join_buffer_size: "262144" + +# Other settings. +mysql_lower_case_table_names: "0" +mysql_wait_timeout: "28800" +mysql_event_scheduler_state: "OFF" + +# InnoDB settings. +mysql_innodb_file_per_table: "1" +# Set .._buffer_pool_size up to 80% of RAM but beware of setting too high. +mysql_innodb_buffer_pool_size: "256M" +# Set .._log_file_size to 25% of buffer pool size. +mysql_innodb_log_file_size: "64M" +mysql_innodb_log_buffer_size: "8M" +mysql_innodb_flush_log_at_trx_commit: "1" +mysql_innodb_lock_wait_timeout: "50" + +# These settings require MySQL > 5.5. +mysql_innodb_large_prefix: "1" +mysql_innodb_file_format: "barracuda" + +# mysqldump settings. +mysql_mysqldump_max_allowed_packet: "64M" + +# Logging settings. +mysql_log: "" +# The following variables have a default value depending on operating system. +# mysql_log_error: /var/log/mysql/mysql.err +# mysql_syslog_tag: mysql + +mysql_config_include_files: [] +# - src: path/relative/to/playbook/file.cnf +# - { src: path/relative/to/playbook/anotherfile.cnf, force: yes } + +# Databases. +mysql_databases: [] +# - name: example +# collation: utf8_general_ci +# encoding: utf8 +# replicate: 1 + +# Users. +mysql_users: [] +# - name: example +# host: 127.0.0.1 +# password: secret +# priv: *.*:USAGE + +mysql_disable_log_bin: false + +# Replication settings (replication is only enabled if master/user have values). +mysql_server_id: "1" +mysql_max_binlog_size: "100M" +mysql_binlog_format: "ROW" +mysql_expire_logs_days: "10" +mysql_replication_role: '' +mysql_replication_master: '' +mysql_replication_master_inventory_host: "{{ mysql_replication_master }}" + +# Same keys as `mysql_users` above. +mysql_replication_user: [] diff --git a/roles/geerlingguy.mysql/handlers/main.yml b/roles/geerlingguy.mysql/handlers/main.yml new file mode 100644 index 0000000..429abe3 --- /dev/null +++ b/roles/geerlingguy.mysql/handlers/main.yml @@ -0,0 +1,3 @@ +--- +- name: restart mysql + service: "name={{ mysql_daemon }} state=restarted sleep=5" diff --git a/roles/geerlingguy.mysql/meta/.galaxy_install_info b/roles/geerlingguy.mysql/meta/.galaxy_install_info new file mode 100644 index 0000000..3dccb94 --- /dev/null +++ b/roles/geerlingguy.mysql/meta/.galaxy_install_info @@ -0,0 +1,2 @@ +install_date: Thu Jan 26 19:23:08 2023 +version: 4.3.0 diff --git a/roles/geerlingguy.mysql/meta/main.yml b/roles/geerlingguy.mysql/meta/main.yml new file mode 100644 index 0000000..57f5d4f --- /dev/null +++ b/roles/geerlingguy.mysql/meta/main.yml @@ -0,0 +1,31 @@ +--- +dependencies: [] + +galaxy_info: + role_name: mysql + author: geerlingguy + description: MySQL server for RHEL/CentOS and Debian/Ubuntu. + company: "Midwestern Mac, LLC" + license: "license (BSD, MIT)" + min_ansible_version: 2.4 + platforms: + - name: EL + versions: + - 7 + - 8 + - 9 + - name: Ubuntu + versions: + - all + - name: Debian + versions: + - all + - name: Archlinux + versions: + - all + galaxy_tags: + - database + - mysql + - mariadb + - db + - sql diff --git a/roles/geerlingguy.mysql/molecule/default/converge.yml b/roles/geerlingguy.mysql/molecule/default/converge.yml new file mode 100644 index 0000000..c83b102 --- /dev/null +++ b/roles/geerlingguy.mysql/molecule/default/converge.yml @@ -0,0 +1,16 @@ +--- +- name: Converge + hosts: all + become: true + + roles: + - role: geerlingguy.mysql + + post_tasks: + - name: Make sure we can connect to MySQL via Unix socket. + command: "mysql -u root -proot -e 'show databases;'" + changed_when: false + + - name: Make sure we can connect to MySQL via TCP. + command: "mysql -u root -proot -h 127.0.0.1 -e 'show databases;'" + changed_when: false diff --git a/roles/geerlingguy.mysql/molecule/default/molecule.yml b/roles/geerlingguy.mysql/molecule/default/molecule.yml new file mode 100644 index 0000000..d291e5b --- /dev/null +++ b/roles/geerlingguy.mysql/molecule/default/molecule.yml @@ -0,0 +1,19 @@ +--- +role_name_check: 1 +dependency: + name: galaxy +driver: + name: docker +platforms: + - name: instance + image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest" + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + pre_build_image: true +provisioner: + name: ansible + playbooks: + converge: ${MOLECULE_PLAYBOOK:-converge.yml} diff --git a/roles/geerlingguy.mysql/tasks/configure.yml b/roles/geerlingguy.mysql/tasks/configure.yml new file mode 100644 index 0000000..cca777c --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/configure.yml @@ -0,0 +1,85 @@ +--- +- name: Get MySQL version. + command: 'mysql --version' + register: mysql_cli_version + changed_when: false + check_mode: false + +- name: Copy my.cnf global MySQL configuration. + template: + src: my.cnf.j2 + dest: "{{ mysql_config_file }}" + owner: root + group: root + mode: 0644 + force: "{{ overwrite_global_mycnf }}" + notify: restart mysql + +- name: Verify mysql include directory exists. + file: + path: "{{ mysql_config_include_dir }}" + state: directory + owner: root + group: root + mode: 0755 + when: mysql_config_include_files | length + +- name: Copy my.cnf override files into include directory. + template: + src: "{{ item.src }}" + dest: "{{ mysql_config_include_dir }}/{{ item.src | basename }}" + owner: root + group: root + mode: 0644 + force: "{{ item.force | default(False) }}" + with_items: "{{ mysql_config_include_files }}" + notify: restart mysql + +- name: Create slow query log file (if configured). + command: "touch {{ mysql_slow_query_log_file }}" + args: + creates: "{{ mysql_slow_query_log_file }}" + when: mysql_slow_query_log_enabled + +- name: Create datadir if it does not exist + file: + path: "{{ mysql_datadir }}" + state: directory + owner: mysql + group: mysql + mode: 0755 + setype: mysqld_db_t + +- name: Set ownership on slow query log file (if configured). + file: + path: "{{ mysql_slow_query_log_file }}" + state: file + owner: mysql + group: "{{ mysql_log_file_group }}" + mode: 0640 + when: mysql_slow_query_log_enabled + +- name: Create error log file (if configured). + command: "touch {{ mysql_log_error }}" + args: + creates: "{{ mysql_log_error }}" + when: + - mysql_log | default(true) + - mysql_log_error | default(false) + tags: ['skip_ansible_galaxy'] + +- name: Set ownership on error log file (if configured). + file: + path: "{{ mysql_log_error }}" + state: file + owner: mysql + group: "{{ mysql_log_file_group }}" + mode: 0640 + when: + - mysql_log | default(true) + - mysql_log_error | default(false) + tags: ['skip_ansible_galaxy'] + +- name: Ensure MySQL is started and enabled on boot. + service: "name={{ mysql_daemon }} state=started enabled={{ mysql_enabled_on_startup }}" + register: mysql_service_configuration diff --git a/roles/geerlingguy.mysql/tasks/databases.yml b/roles/geerlingguy.mysql/tasks/databases.yml new file mode 100644 index 0000000..6e6a546 --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/databases.yml @@ -0,0 +1,9 @@ +--- +- name: Ensure MySQL databases are present. + mysql_db: + name: "{{ item.name }}" + collation: "{{ item.collation | default('utf8_general_ci') }}" + encoding: "{{ item.encoding | default('utf8') }}" + state: "{{ item.state | default('present') }}" + target: "{{ item.target | default(omit) }}" + with_items: "{{ mysql_databases }}" diff --git a/roles/geerlingguy.mysql/tasks/main.yml b/roles/geerlingguy.mysql/tasks/main.yml new file mode 100644 index 0000000..47cefcd --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/main.yml @@ -0,0 +1,26 @@ +--- +# Variable configuration. +- include_tasks: variables.yml + +# Setup/install tasks. +- include_tasks: setup-RedHat.yml + when: ansible_os_family == 'RedHat' + +- include_tasks: setup-Debian.yml + when: ansible_os_family == 'Debian' + +- include_tasks: setup-Archlinux.yml + when: ansible_os_family == 'Archlinux' + +- name: Check if MySQL packages were installed. + set_fact: + mysql_install_packages: "{{ (rh_mysql_install_packages is defined and rh_mysql_install_packages.changed) + or (deb_mysql_install_packages is defined and deb_mysql_install_packages.changed) + or (arch_mysql_install_packages is defined and arch_mysql_install_packages.changed) }}" + +# Configure MySQL. +- include_tasks: configure.yml +- include_tasks: secure-installation.yml +- include_tasks: databases.yml +- include_tasks: users.yml +- include_tasks: replication.yml diff --git a/roles/geerlingguy.mysql/tasks/replication.yml b/roles/geerlingguy.mysql/tasks/replication.yml new file mode 100644 index 0000000..ec5a22a --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/replication.yml @@ -0,0 +1,58 @@ +--- +- name: Ensure replication user exists on master. + mysql_user: + name: "{{ mysql_replication_user.name }}" + host: "{{ mysql_replication_user.host | default('%') }}" + password: "{{ mysql_replication_user.password }}" + priv: "{{ mysql_replication_user.priv | default('*.*:REPLICATION SLAVE,REPLICATION CLIENT') }}" + state: present + when: + - mysql_replication_role == 'master' + - mysql_replication_user.name is defined + - (mysql_replication_master | length) > 0 + tags: ['skip_ansible_galaxy'] + +- name: Check slave replication status. + mysql_replication: + mode: getreplica + login_user: "{{ mysql_root_username }}" + login_password: "{{ mysql_root_password }}" + ignore_errors: true + register: slave + when: + - mysql_replication_role == 'slave' + - (mysql_replication_master | length) > 0 + tags: ['skip_ansible_galaxy'] + +- name: Check master replication status. + mysql_replication: mode=getprimary + delegate_to: "{{ mysql_replication_master_inventory_host }}" + register: master + when: + - (slave.Is_Slave is defined and not slave.Is_Slave) or (slave.Is_Replica is defined and not slave.Is_Replica) or (slave.Is_Slave is not defined and slave.Is_Replica is not defined and slave is failed) + - mysql_replication_role == 'slave' + - (mysql_replication_master | length) > 0 + tags: ['skip_ansible_galaxy'] + +- name: Configure replication on the slave. + mysql_replication: + mode: changeprimary + master_host: "{{ mysql_replication_master }}" + master_user: "{{ mysql_replication_user.name }}" + master_password: "{{ mysql_replication_user.password }}" + master_log_file: "{{ master.File }}" + master_log_pos: "{{ master.Position }}" + ignore_errors: true + when: + - (slave.Is_Slave is defined and not slave.Is_Slave) or (slave.Is_Replica is defined and not slave.Is_Replica) or (slave.Is_Slave is not defined and slave.Is_Replica is not defined and slave is failed) + - mysql_replication_role == 'slave' + - mysql_replication_user.name is defined + - (mysql_replication_master | length) > 0 + +- name: Start replication. + mysql_replication: mode=startreplica + when: + - (slave.Is_Slave is defined and slave.Is_Slave) or (slave.Is_Replica is defined and slave.Is_Replica) or (slave.Is_Slave is not defined and slave.Is_Replica is not defined and slave is failed) + - mysql_replication_role == 'slave' + - (mysql_replication_master | length) > 0 + tags: ['skip_ansible_galaxy'] diff --git a/roles/geerlingguy.mysql/tasks/secure-installation.yml b/roles/geerlingguy.mysql/tasks/secure-installation.yml new file mode 100644 index 0000000..b7de266 --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/secure-installation.yml @@ -0,0 +1,86 @@ +--- +- name: Ensure default user is present. + mysql_user: + name: "{{ mysql_user_name }}" + host: 'localhost' + password: "{{ mysql_user_password }}" + priv: '*.*:ALL,GRANT' + state: present + when: mysql_user_name != mysql_root_username + +# Has to be after the password assignment, for idempotency. +- name: Copy user-my.cnf file with password credentials. + template: + src: "user-my.cnf.j2" + dest: "{{ mysql_user_home }}/.my.cnf" + owner: "{{ mysql_user_name }}" + mode: 0600 + when: > + mysql_user_name != mysql_root_username + and (mysql_install_packages | bool or mysql_user_password_update) + +- name: Disallow root login remotely + command: 'mysql -NBe "{{ item }}"' + with_items: + - DELETE FROM mysql.user WHERE User='{{ mysql_root_username }}' AND Host NOT IN ('localhost', '127.0.0.1', '::1') + changed_when: false + +- name: Get list of hosts for the root user. + command: mysql -NBe + "SELECT Host + FROM mysql.user + WHERE User = '{{ mysql_root_username }}' + ORDER BY (Host='localhost') ASC" + register: mysql_root_hosts + changed_when: false + check_mode: false + when: mysql_install_packages | bool or mysql_root_password_update + +# Note: We do not use mysql_user for this operation, as it doesn't always update +# the root password correctly. See: https://goo.gl/MSOejW +# Set root password for MySQL >= 5.7.x. +- name: Update MySQL root password for localhost root account (5.7.x). + shell: > + mysql -u root -NBe + "ALTER USER '{{ mysql_root_username }}'@'{{ item }}' + IDENTIFIED WITH mysql_native_password BY '{{ mysql_root_password }}'; FLUSH PRIVILEGES;" + with_items: "{{ mysql_root_hosts.stdout_lines|default([]) }}" + when: > + ((mysql_install_packages | bool) or mysql_root_password_update) + and ('5.7.' in mysql_cli_version.stdout or '8.0.' in mysql_cli_version.stdout) + +# Set root password for MySQL < 5.7.x. +- name: Update MySQL root password for localhost root account (< 5.7.x). + shell: > + mysql -NBe + 'SET PASSWORD FOR "{{ mysql_root_username }}"@"{{ item }}" = PASSWORD("{{ mysql_root_password }}"); FLUSH PRIVILEGES;' + with_items: "{{ mysql_root_hosts.stdout_lines|default([]) }}" + when: > + ((mysql_install_packages | bool) or mysql_root_password_update) + and ('5.7.' not in mysql_cli_version.stdout and '8.0.' not in mysql_cli_version.stdout) + +# Has to be after the root password assignment, for idempotency. +- name: Copy .my.cnf file with root password credentials. + template: + src: "root-my.cnf.j2" + dest: "{{ mysql_root_home }}/.my.cnf" + owner: root + group: root + mode: 0600 + when: mysql_install_packages | bool or mysql_root_password_update + +- name: Get list of hosts for the anonymous user. + command: mysql -NBe "SELECT Host FROM mysql.user WHERE User = ''" + register: mysql_anonymous_hosts + changed_when: false + check_mode: false + +- name: Remove anonymous MySQL users. + mysql_user: + name: "" + host: "{{ item }}" + state: absent + with_items: "{{ mysql_anonymous_hosts.stdout_lines|default([]) }}" + +- name: Remove MySQL test database. + mysql_db: "name='test' state=absent" diff --git a/roles/geerlingguy.mysql/tasks/setup-Archlinux.yml b/roles/geerlingguy.mysql/tasks/setup-Archlinux.yml new file mode 100644 index 0000000..e785290 --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/setup-Archlinux.yml @@ -0,0 +1,12 @@ +--- +- name: Ensure MySQL Python libraries are installed. + pacman: "name=mysql-python state=present" + +- name: Ensure MySQL packages are installed. + pacman: "name={{ mysql_packages }} state=present" + register: arch_mysql_install_packages + +- name: Run mysql_install_db if MySQL packages were changed. + command: mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql + when: arch_mysql_install_packages.changed + tags: ['skip_ansible_lint'] diff --git a/roles/geerlingguy.mysql/tasks/setup-Debian.yml b/roles/geerlingguy.mysql/tasks/setup-Debian.yml new file mode 100644 index 0000000..feb18c6 --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/setup-Debian.yml @@ -0,0 +1,34 @@ +--- +- name: Check if MySQL is already installed. + stat: path={{ mysql_config_file }} + register: mysql_installed + +- name: Update apt cache if MySQL is not yet installed. + apt: update_cache=yes + changed_when: False + when: not mysql_installed.stat.exists + +- name: Ensure MySQL Python libraries are installed. + apt: + name: "{{ mysql_python_package_debian }}" + state: present + +- name: Ensure MySQL packages are installed. + apt: + name: "{{ mysql_packages }}" + state: present + policy_rc_d: 101 + register: deb_mysql_install_packages + +# Because Ubuntu starts MySQL as part of the install process, we need to stop +# mysql and remove the logfiles in case the user set a custom log file size. +- name: Ensure MySQL is stopped after initial install. + service: "name={{ mysql_daemon }} state=stopped" + when: not mysql_installed.stat.exists + +- name: Delete innodb log files created by apt package after initial install. + file: path={{ mysql_datadir }}/{{ item }} state=absent + with_items: + - ib_logfile0 + - ib_logfile1 + when: not mysql_installed.stat.exists diff --git a/roles/geerlingguy.mysql/tasks/setup-RedHat.yml b/roles/geerlingguy.mysql/tasks/setup-RedHat.yml new file mode 100644 index 0000000..6835c0d --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/setup-RedHat.yml @@ -0,0 +1,7 @@ +--- +- name: Ensure MySQL packages are installed. + yum: + name: "{{ mysql_packages }}" + state: present + enablerepo: "{{ mysql_enablerepo | default(omit, true) }}" + register: rh_mysql_install_packages diff --git a/roles/geerlingguy.mysql/tasks/users.yml b/roles/geerlingguy.mysql/tasks/users.yml new file mode 100644 index 0000000..75265ea --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/users.yml @@ -0,0 +1,12 @@ +--- +- name: Ensure MySQL users are present. + mysql_user: + name: "{{ item.name }}" + host: "{{ item.host | default('localhost') }}" + password: "{{ item.password }}" + priv: "{{ item.priv | default('*.*:USAGE') }}" + state: "{{ item.state | default('present') }}" + append_privs: "{{ item.append_privs | default('no') }}" + encrypted: "{{ item.encrypted | default('no') }}" + with_items: "{{ mysql_users }}" + no_log: true diff --git a/roles/geerlingguy.mysql/tasks/variables.yml b/roles/geerlingguy.mysql/tasks/variables.yml new file mode 100644 index 0000000..6e38106 --- /dev/null +++ b/roles/geerlingguy.mysql/tasks/variables.yml @@ -0,0 +1,59 @@ +--- +# Variable configuration. +- name: Include OS-specific variables. + include_vars: "{{ item }}" + with_first_found: + - files: + - "vars/{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml" + - "vars/{{ ansible_os_family }}.yml" + skip: true + +- name: Define mysql_packages. + set_fact: + mysql_packages: "{{ __mysql_packages | list }}" + when: mysql_packages is not defined + +- name: Define mysql_daemon. + set_fact: + mysql_daemon: "{{ __mysql_daemon }}" + when: mysql_daemon is not defined + +- name: Define mysql_slow_query_log_file. + set_fact: + mysql_slow_query_log_file: "{{ __mysql_slow_query_log_file }}" + when: mysql_slow_query_log_file is not defined + +- name: Define mysql_log_error. + set_fact: + mysql_log_error: "{{ __mysql_log_error }}" + when: mysql_log_error is not defined + +- name: Define mysql_syslog_tag. + set_fact: + mysql_syslog_tag: "{{ __mysql_syslog_tag }}" + when: mysql_syslog_tag is not defined + +- name: Define mysql_pid_file. + set_fact: + mysql_pid_file: "{{ __mysql_pid_file }}" + when: mysql_pid_file is not defined + +- name: Define mysql_config_file. + set_fact: + mysql_config_file: "{{ __mysql_config_file }}" + when: mysql_config_file is not defined + +- name: Define mysql_config_include_dir. + set_fact: + mysql_config_include_dir: "{{ __mysql_config_include_dir }}" + when: mysql_config_include_dir is not defined + +- name: Define mysql_socket. + set_fact: + mysql_socket: "{{ __mysql_socket }}" + when: mysql_socket is not defined + +- name: Define mysql_supports_innodb_large_prefix. + set_fact: + mysql_supports_innodb_large_prefix: "{{ __mysql_supports_innodb_large_prefix }}" + when: mysql_supports_innodb_large_prefix is not defined diff --git a/roles/geerlingguy.mysql/templates/my.cnf.j2 b/roles/geerlingguy.mysql/templates/my.cnf.j2 new file mode 100644 index 0000000..ec6fd8e --- /dev/null +++ b/roles/geerlingguy.mysql/templates/my.cnf.j2 @@ -0,0 +1,130 @@ +{{ ansible_managed | comment }} + +[client] +#password = your_password +port = {{ mysql_port }} +socket = {{ mysql_socket }} + +[mysqld] +port = {{ mysql_port }} +bind-address = {{ mysql_bind_address }} +datadir = {{ mysql_datadir }} +socket = {{ mysql_socket }} +pid-file = {{ mysql_pid_file }} +{% if mysql_skip_name_resolve %} +skip-name-resolve +{% endif %} +{% if mysql_sql_mode is not none %} +sql_mode = {{ mysql_sql_mode }} +{% endif %} + +# Logging configuration. +{% if mysql_log_error == 'syslog' or mysql_log == 'syslog' %} +syslog +syslog-tag = {{ mysql_syslog_tag }} +{% else %} +{% if mysql_log %} +log = {{ mysql_log }} +{% endif %} +log-error = {{ mysql_log_error }} +{% endif %} + +{% if mysql_slow_query_log_enabled %} +# Slow query log configuration. +slow_query_log = 1 +slow_query_log_file = {{ mysql_slow_query_log_file }} +long_query_time = {{ mysql_slow_query_time }} +{% endif %} + + +{% if mysql_disable_log_bin and not mysql_replication_master %} +# Disable binlog to save disk space +disable-log-bin +{% endif %} + +{% if mysql_replication_master %} +# Replication +server-id = {{ mysql_server_id }} + +{% if mysql_replication_role == 'master' %} +log_bin = mysql-bin +log-bin-index = mysql-bin.index +expire_logs_days = {{ mysql_expire_logs_days }} +max_binlog_size = {{ mysql_max_binlog_size }} +binlog_format = {{mysql_binlog_format}} + +{% for db in mysql_databases %} +{% if db.replicate|default(1) %} +binlog_do_db = {{ db.name }} +{% else %} +binlog_ignore_db = {{ db.name }} +{% endif %} +{% endfor %} +{% endif %} + +{% if mysql_replication_role == 'slave' %} +read_only +relay-log = relay-bin +relay-log-index = relay-bin.index +{% endif %} +{% endif %} + +# Disabling symbolic-links is recommended to prevent assorted security risks +symbolic-links = 0 + +# User is ignored when systemd is used (fedora >= 15). +user = mysql + +# http://dev.mysql.com/doc/refman/5.5/en/performance-schema.html +;performance_schema + +# Memory settings. +key_buffer_size = {{ mysql_key_buffer_size }} +max_allowed_packet = {{ mysql_max_allowed_packet }} +table_open_cache = {{ mysql_table_open_cache }} +sort_buffer_size = {{ mysql_sort_buffer_size }} +read_buffer_size = {{ mysql_read_buffer_size }} +read_rnd_buffer_size = {{ mysql_read_rnd_buffer_size }} +myisam_sort_buffer_size = {{ mysql_myisam_sort_buffer_size }} +thread_cache_size = {{ mysql_thread_cache_size }} +{% if '8.0.' not in mysql_cli_version.stdout %} +query_cache_type = {{ mysql_query_cache_type }} +query_cache_size = {{ mysql_query_cache_size }} +query_cache_limit = {{ mysql_query_cache_limit }} +{% endif %} +max_connections = {{ mysql_max_connections }} +tmp_table_size = {{ mysql_tmp_table_size }} +max_heap_table_size = {{ mysql_max_heap_table_size }} +group_concat_max_len = {{ mysql_group_concat_max_len }} +join_buffer_size = {{ mysql_join_buffer_size }} + +# Other settings. +wait_timeout = {{ mysql_wait_timeout }} +lower_case_table_names = {{ mysql_lower_case_table_names }} +event_scheduler = {{ mysql_event_scheduler_state }} + +# InnoDB settings. +{% if mysql_supports_innodb_large_prefix and '8.0.' not in mysql_cli_version.stdout %} +innodb_large_prefix = {{ mysql_innodb_large_prefix }} +innodb_file_format = {{ mysql_innodb_file_format }} +{% endif %} +innodb_file_per_table = {{ mysql_innodb_file_per_table }} +innodb_buffer_pool_size = {{ mysql_innodb_buffer_pool_size }} +innodb_log_file_size = {{ mysql_innodb_log_file_size }} +innodb_log_buffer_size = {{ mysql_innodb_log_buffer_size }} +innodb_flush_log_at_trx_commit = {{ mysql_innodb_flush_log_at_trx_commit }} +innodb_lock_wait_timeout = {{ mysql_innodb_lock_wait_timeout }} + +[mysqldump] +quick +max_allowed_packet = {{ mysql_mysqldump_max_allowed_packet }} + +[mysqld_safe] +pid-file = {{ mysql_pid_file }} + +{% if mysql_config_include_files | length %} +# * IMPORTANT: Additional settings that can override those from this file! +# The files must end with '.cnf', otherwise they'll be ignored. +# +!includedir {{ mysql_config_include_dir }} +{% endif %} diff --git a/roles/geerlingguy.mysql/templates/root-my.cnf.j2 b/roles/geerlingguy.mysql/templates/root-my.cnf.j2 new file mode 100644 index 0000000..af13e81 --- /dev/null +++ b/roles/geerlingguy.mysql/templates/root-my.cnf.j2 @@ -0,0 +1,5 @@ +{{ ansible_managed | comment }} + +[client] +user="{{ mysql_root_username }}" +password="{{ mysql_root_password }}" diff --git a/roles/geerlingguy.mysql/templates/user-my.cnf.j2 b/roles/geerlingguy.mysql/templates/user-my.cnf.j2 new file mode 100644 index 0000000..62e3692 --- /dev/null +++ b/roles/geerlingguy.mysql/templates/user-my.cnf.j2 @@ -0,0 +1,5 @@ +{{ ansible_managed | comment }} + +[client] +user="{{ mysql_user_name }}" +password="{{ mysql_user_password }}" diff --git a/roles/geerlingguy.mysql/vars/Archlinux.yml b/roles/geerlingguy.mysql/vars/Archlinux.yml new file mode 100644 index 0000000..2dd3c47 --- /dev/null +++ b/roles/geerlingguy.mysql/vars/Archlinux.yml @@ -0,0 +1,12 @@ +--- +__mysql_daemon: mariadb +__mysql_packages: + - mariadb +__mysql_slow_query_log_file: /var/log/mysql/mysql-slow.log +__mysql_log_error: /var/log/mysql.err +__mysql_syslog_tag: mysql +__mysql_pid_file: /run/mysqld/mysqld.pid +__mysql_config_file: /etc/mysql/my.cnf +__mysql_config_include_dir: /etc/mysql/conf.d +__mysql_socket: /run/mysqld/mysqld.sock +__mysql_supports_innodb_large_prefix: true diff --git a/roles/geerlingguy.mysql/vars/Debian-10.yml b/roles/geerlingguy.mysql/vars/Debian-10.yml new file mode 100644 index 0000000..cb4935a --- /dev/null +++ b/roles/geerlingguy.mysql/vars/Debian-10.yml @@ -0,0 +1,13 @@ +--- +__mysql_daemon: mariadb +__mysql_packages: + - default-mysql-server +mysql_log_file_group: adm +__mysql_slow_query_log_file: /var/log/mysql/mysql-slow.log +__mysql_log_error: /var/log/mysql/mysql.log +__mysql_syslog_tag: mariadb +__mysql_pid_file: /run/mysqld/mysqld.pid +__mysql_config_file: /etc/mysql/my.cnf +__mysql_config_include_dir: /etc/mysql/conf.d +__mysql_socket: /run/mysqld/mysqld.sock +__mysql_supports_innodb_large_prefix: true diff --git a/roles/geerlingguy.mysql/vars/Debian-11.yml b/roles/geerlingguy.mysql/vars/Debian-11.yml new file mode 100644 index 0000000..7052adb --- /dev/null +++ b/roles/geerlingguy.mysql/vars/Debian-11.yml @@ -0,0 +1,13 @@ +--- +__mysql_daemon: mariadb +__mysql_packages: + - default-mysql-server +mysql_log_file_group: adm +__mysql_slow_query_log_file: /var/log/mysql/mariadb-slow.log +__mysql_log_error: /var/log/mysql/mysql.log +__mysql_syslog_tag: mysqld +__mysql_pid_file: /run/mysqld/mysqld.pid +__mysql_config_file: /etc/mysql/my.cnf +__mysql_config_include_dir: /etc/mysql/conf.d +__mysql_socket: /run/mysqld/mysqld.sock +__mysql_supports_innodb_large_prefix: true diff --git a/roles/geerlingguy.mysql/vars/Debian.yml b/roles/geerlingguy.mysql/vars/Debian.yml new file mode 100644 index 0000000..a96a025 --- /dev/null +++ b/roles/geerlingguy.mysql/vars/Debian.yml @@ -0,0 +1,14 @@ +--- +__mysql_daemon: mysql +__mysql_packages: + - mysql-common + - mysql-server +mysql_log_file_group: adm +__mysql_slow_query_log_file: /var/log/mysql/mysql-slow.log +__mysql_log_error: /var/log/mysql/mysql.err +__mysql_syslog_tag: mysql +__mysql_pid_file: /var/run/mysqld/mysqld.pid +__mysql_config_file: /etc/mysql/my.cnf +__mysql_config_include_dir: /etc/mysql/conf.d +__mysql_socket: /var/run/mysqld/mysqld.sock +__mysql_supports_innodb_large_prefix: true diff --git a/roles/geerlingguy.mysql/vars/RedHat-7.yml b/roles/geerlingguy.mysql/vars/RedHat-7.yml new file mode 100644 index 0000000..6f989b3 --- /dev/null +++ b/roles/geerlingguy.mysql/vars/RedHat-7.yml @@ -0,0 +1,16 @@ +--- +__mysql_daemon: mariadb +__mysql_packages: + - mariadb + - mariadb-server + - mariadb-libs + - MySQL-python + - perl-DBD-MySQL +__mysql_slow_query_log_file: /var/log/mysql-slow.log +__mysql_log_error: /var/log/mariadb/mariadb.log +__mysql_syslog_tag: mariadb +__mysql_pid_file: /var/run/mariadb/mariadb.pid +__mysql_config_file: /etc/my.cnf +__mysql_config_include_dir: /etc/my.cnf.d +__mysql_socket: /var/lib/mysql/mysql.sock +__mysql_supports_innodb_large_prefix: true diff --git a/roles/geerlingguy.mysql/vars/RedHat-8.yml b/roles/geerlingguy.mysql/vars/RedHat-8.yml new file mode 100644 index 0000000..12484af --- /dev/null +++ b/roles/geerlingguy.mysql/vars/RedHat-8.yml @@ -0,0 +1,18 @@ +--- +__mysql_daemon: mariadb +__mysql_packages: + - mariadb + - mariadb-server + - mariadb-connector-c + - python3-PyMySQL + - perl-DBD-MySQL +__mysql_slow_query_log_file: /var/log/mysql-slow.log +__mysql_log_error: /var/log/mariadb/mariadb.log +__mysql_syslog_tag: mariadb +__mysql_pid_file: /var/run/mariadb/mariadb.pid +__mysql_config_file: /etc/my.cnf +__mysql_config_include_dir: /etc/my.cnf.d +__mysql_socket: /var/lib/mysql/mysql.sock +# The entries controlled by this value should not be used with MariaDB >= 10.2.2 +# See https://github.com/frappe/bench/issues/681#issuecomment-398984706 +__mysql_supports_innodb_large_prefix: false diff --git a/roles/geerlingguy.mysql/vars/RedHat-9.yml b/roles/geerlingguy.mysql/vars/RedHat-9.yml new file mode 100644 index 0000000..12484af --- /dev/null +++ b/roles/geerlingguy.mysql/vars/RedHat-9.yml @@ -0,0 +1,18 @@ +--- +__mysql_daemon: mariadb +__mysql_packages: + - mariadb + - mariadb-server + - mariadb-connector-c + - python3-PyMySQL + - perl-DBD-MySQL +__mysql_slow_query_log_file: /var/log/mysql-slow.log +__mysql_log_error: /var/log/mariadb/mariadb.log +__mysql_syslog_tag: mariadb +__mysql_pid_file: /var/run/mariadb/mariadb.pid +__mysql_config_file: /etc/my.cnf +__mysql_config_include_dir: /etc/my.cnf.d +__mysql_socket: /var/lib/mysql/mysql.sock +# The entries controlled by this value should not be used with MariaDB >= 10.2.2 +# See https://github.com/frappe/bench/issues/681#issuecomment-398984706 +__mysql_supports_innodb_large_prefix: false diff --git a/roles/sky/meta/main.yml b/roles/sky/meta/main.yml index e2e9636..fe6a824 100644 --- a/roles/sky/meta/main.yml +++ b/roles/sky/meta/main.yml @@ -3,5 +3,6 @@ dependencies: - role: debian - role: users - role: nginx +- role: geerlingguy.mysql # vim: set ts=2 sw=2 et: diff --git a/roles/sky/tasks/main.yml b/roles/sky/tasks/main.yml index 9d04b9f..0066af8 100644 --- a/roles/sky/tasks/main.yml +++ b/roles/sky/tasks/main.yml @@ -13,5 +13,7 @@ tags: certbot - import_tasks: homepage.yml tags: homepage +- import_tasks: wiki.yml + tags: wiki # vim: set ts=2 sw=2 et: diff --git a/roles/sky/tasks/wiki.yml b/roles/sky/tasks/wiki.yml new file mode 100644 index 0000000..a78fc65 --- /dev/null +++ b/roles/sky/tasks/wiki.yml @@ -0,0 +1,6 @@ +--- +- name: Install php packages + apt: + pkg: + - php + - php-fpm diff --git a/roles/sky/vars/main.yml b/roles/sky/vars/main.yml index b87f00f..a424b6a 100644 --- a/roles/sky/vars/main.yml +++ b/roles/sky/vars/main.yml @@ -47,5 +47,12 @@ users: domain_name: 'new.labitat.dk' letsencrypt_email: 'josh@fireflop.com' +mysql_root_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 36633632613063373366623339366564663532363663616462303563613638383761353331303738 + 3130363231363763363133346430636333316266353933380a343935313062333931656432383730 + 63333562653364303761383137636436623564303732623136663630333734646163303265316239 + 3064636536303833330a373537316361303730323038656434616161616133656537626337303964 + 30366264636266353038656235313233316237636561643833336165306530353132 # vim: set ts=2 sw=2 et: