Ansible-pull и GitLab CI/CD: когда лучше тянуть, чем толкать

# vagrant\libvirt\Vagrantfile # Интерфейс для моста BRIDGE_NET = "192.168.2." BRIDGE_NAME = "br0" BRIDGE_DNS = "192.168.2.1"  # Путь к образам виртуальных машин IMAGE_PATH = "/kvm/images"   # Домен который будем использовать для всей площадки DOMAIN = "ch.ap"  # debian 12 BOX_1 = "d12"     # debian 12 BOX_2 = "u1804"   # ubuntu 18.04 BOX_3 = "c7"      # centos 7  # Укажите путь к общей папке на хосте и путь к точке монтирования в ВМ HOST_SHARED_FOLDER = "."   VM_SHARED_FOLDER = "/home/vagrant/shared"  # Имена хостов HOSTNAME_1 = "t-webserver" HOSTNAME_2 = "t-application" HOSTNAME_3 = "t-client-1" HOSTNAME_4 = "t-client-2"  # Массив из хешей, в котором задаются настройки для каждой виртуальной машины. MACHINES = {   HOSTNAME_1.to_sym => {     :box_name     => BOX_1,     :host_name    => HOSTNAME_1,      :ip_brig      => BRIDGE_NET + "211",     :ip_brig_dns  => BRIDGE_DNS,     :disk_size    => "20G",     :int_model_type => "e1000",     :cpu          => 1,     :ram          => 512,     :vnc          => 5971,     :host_role    => "webserver",   },   HOSTNAME_2.to_sym => {     :box_name     => BOX_1,     :host_name    => HOSTNAME_2,      :ip_brig      => BRIDGE_NET + "212",     :ip_brig_dns  => BRIDGE_DNS,     :disk_size    => "20G",     :int_model_type => "e1000",     :cpu          => 1,     :ram          => 1024,     :vnc          => 5972,     :host_role    => "application",   },   HOSTNAME_3.to_sym => {     :box_name     => BOX_2,     :host_name    => HOSTNAME_3,      :ip_brig      => BRIDGE_NET + "213",     :ip_brig_dns  => BRIDGE_DNS,     :disk_size    => "20G",     :int_model_type => "e1000",     :cpu          => 1,     :ram          => 512,     :vnc          => 5973,     :host_role    => "client",   },   HOSTNAME_4.to_sym => {     :box_name     => BOX_3,     :host_name    => HOSTNAME_4,      :ip_brig      => BRIDGE_NET + "214",     :ip_brig_dns  => BRIDGE_DNS,     :disk_size    => "20G",     :int_model_type => "e1000",     :cpu          => 1,     :ram          => 512,     :vnc          => 5974,     :host_role    => "client",   }, }  ## модуль применения настроек Vagrant.configure("2") do |config|   MACHINES.each do |boxname, boxconfig|     config.vm.define boxname do |box|       box.vm.box = boxconfig[:box_name]                      box.vm.hostname = boxconfig[:host_name]              # Указываем публичную сеть с параметрами моста       box.vm.network "public_network",                        bridge: BRIDGE_NAME,                        dev: BRIDGE_NAME,                        type: "bridge",                        ip: boxconfig[:ip_brig]        box.vm.provider "libvirt" do |libvirt|         libvirt.cpus = boxconfig[:cpu]         libvirt.memory = boxconfig[:ram]         libvirt.nic_model_type = boxconfig[:int_model_type]         libvirt.management_network_name = BRIDGE_NAME         libvirt.storage_pool_name = "images"         libvirt.graphics_port = boxconfig[:vnc]         libvirt.graphics_autoport = false       end        # # Настройка синхронизированной папки       box.vm.synced_folder ".", VM_SHARED_FOLDER, type: "nfs", nfs_version: 4, nfs_udp: false       # --- rsa ключи       box.vm.provision "file", source: "#{ENV['HOME']}/.ssh/id_rsa.pub", destination: "/tmp/authorized_keys"       box.vm.provision "shell", inline: <<-SHELL       # Определяем дистрибутив       OS_NAME=$(grep -Eoi 'ubuntu|debian|centos|rhel' /etc/os-release | head -1)        # 📌 Обновление системы       if [[ "$OS_NAME" == "Ubuntu" ]] || [[ "$OS_NAME" == "Debian" ]]; then         sudo apt-get update           # sudo apt-get upgrade -y        elif [[ "$OS_NAME" == "CentOS" ]] || [[ "$OS_NAME" == "rhel" ]]; then         OS_VERSION=$(grep -oP '(?<=VERSION_ID=")[0-9]+' /etc/os-release)          # 🔄 Переключение репозиториев на архивные для CentOS 7 и 8         if [[ "$OS_VERSION" == "7" ]] || [[ "$OS_VERSION" == "8" ]]; then           echo "🔄 Переключаю CentOS $OS_VERSION на архивный репозиторий..."           sudo sed -i 's|^mirrorlist=.*|#mirrorlist removed|' /etc/yum.repos.d/CentOS-Base.repo           sudo sed -i 's|^#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|' /etc/yum.repos.d/CentOS-Base.repo         fi          # ✅ Очистка кэша и обновление пакетов         sudo yum clean all         sudo yum makecache         # sudo yum update -y       fi        # 📌 RSA ключи       if [ -f /tmp/authorized_keys ]; then         cat /tmp/authorized_keys >> /home/vagrant/.ssh/authorized_keys       fi        # 📌 Таймзона       sudo timedatectl set-timezone Europe/Moscow        # 📌 Ansible факт       sudo mkdir -p /etc/ansible/facts.d       echo '{ "host_role": "#{boxconfig[:host_role]}" }' | sudo tee /etc/ansible/facts.d/custom.fact > /dev/null       sudo chmod 0644 /etc/ansible/facts.d/custom.fact        echo "✅ Настройка завершена"       SHELL        if !boxconfig[:prov].nil?         box.vm.provision "shell", path: boxconfig[:prov]       end     end   end end 

# ansible/ansible/infra_ansible_pull.yaml - name: Apply roles dynamically from inventory   hosts: "{{ target_hosts | default('localhost') }}"   gather_facts: true    tasks:     - name: Explicitly gather custom facts       ansible.builtin.setup:         filter: ansible_local      - name: Include web role       ansible.builtin.include_role:         name: web       when: ansible_local.custom.host_role is defined and ansible_local.custom.host_role == "webserver"      - name: Include app role       ansible.builtin.include_role:         name: app       when: ansible_local.custom.host_role is defined and ansible_local.custom.host_role == "application"      - name: Include client role       ansible.builtin.include_role:         name: client       when: ansible_local.custom.host_role is defined and ansible_local.custom.host_role == "client" 

# /etc/ansible/facts.d/custom.fact {   "host_role": "{{ host_role }}" }

ssh-keygen -t rsa -C "id_ansible_pull" -f ~/.ssh/id_ansible_pull cat ~/.ssh/id_ansible_pull.pub

# ansible\node_setting_to_pull\inventory.yml all:   hosts:     webserver:       ansible_host: 192.168.2.221       ansible_user: vagrant       ansible_password: vagrant       ansible_become_pass: vagrant       host_role: webserver      application:       ansible_host: 192.168.2.222       ansible_user: vagrant       ansible_password: vagrant       ansible_become_pass: vagrant       host_role: application      client_1:       ansible_host: 192.168.2.223       ansible_user: vagrant       ansible_password: vagrant       ansible_become_pass: vagrant       host_role: client      client_2:       ansible_host: 192.168.2.224       ansible_user: vagrant       ansible_password: vagrant       ansible_become_pass: vagrant       host_role: client

# ansible\node_setting_to_pull\setup_ansible_pull.yml --- - name: Setup ansible-pull on Debian, Ubuntu, and CentOS   hosts: all   vars:     run_ansible_user: "ansible"     git_playbook_path: "ansible/infra_ansible_pull.yml"       git_branch: "release" # ветка с которой ansible будет подтягивать код, обычно "release"     ssh_key_src: "~/.ssh/id_ansible_pull"      ssh_key_dest: "/home/{{ run_ansible_user }}/.ssh/id_ansible_pull"      git_server: "gitlab.ch.ap"     git_server_ip: "192.168.2.34"     git_repo: "git@gitlab.ch.ap:AndreyChuyan/ansible_pull_cicd.git"   tasks:      ### 🔹 Создание пользователя ansible     - block:         - name: Ensure ansible user exists (Debian-based)           user:             name: "{{ run_ansible_user }}"             shell: /bin/bash             create_home: yes             groups: sudo             append: yes           become: yes           when: ansible_facts['os_family'] == "Debian"          - name: Ensure ansible user exists (RHEL-based)           user:             name: "{{ run_ansible_user }}"             shell: /bin/bash             create_home: yes             groups: wheel             append: yes           become: yes           when: ansible_facts['os_family'] == "RedHat"          - name: Allow ansible user to run ansible-pull without password           copy:             dest: "/etc/sudoers.d/ansible"             content: "{{ run_ansible_user }} ALL=(ALL) NOPASSWD: ALL"             mode: '0440'           become: yes       tags: user_setup      ### 🔹 Установка пакетов (Ansible и Git)     - block:         - name: Install Ansible and Git on Debian/Ubuntu           apt:             name:                - ansible               - git             state: present             update_cache: yes           become: yes           when: ansible_os_family == "Debian"          - name: Install Ansible and Git on CentOS/RedHat           package:             name:                - epel-release               - ansible               - git             state: present           become: yes           when: ansible_os_family == "RedHat"      # 🔹 Устанавливаем коллекцию ansible.posix, если она отсутствует         # - name: Ensure ansible.posix collection is installed         #   ansible.builtin.command:         #     cmd: ansible-galaxy collection install ansible.posix --ignore-errors         #   changed_when: false       tags: ansible_install      ### 🔹 Настройка SSH-ключей для доступа к Git     - block:         - name: Ensure GitLab server IP is in /etc/hosts           lineinfile:             path: /etc/hosts             line: "{{ git_server_ip }} {{ git_server }}"             regexp: ".*\\s+{{ git_server }}$"             state: present           become: yes                  - name: Ensure SSH directory exists for ansible user           file:             path: "/home/{{ run_ansible_user }}/.ssh"             state: directory             mode: '0700'             owner: "{{ run_ansible_user }}"             group: "{{ run_ansible_user }}"           become: yes          - name: Copy private SSH key for ansible user           copy:             src: "{{ ssh_key_src }}"             dest: "{{ ssh_key_dest }}"             owner: "{{ run_ansible_user }}"             group: "{{ run_ansible_user }}"             mode: '0600'           no_log: true           become: yes          - name: Add Git server fingerprint to known_hosts           known_hosts:             path: "/home/{{ run_ansible_user }}/.ssh/known_hosts"             name: "{{ git_server }}"             key: "{{ lookup('pipe', 'ssh-keyscan -H ' + git_server) }}"           become: yes           # become_user: "{{ run_ansible_user }}"       tags: ssh_setup       ### 🔹 Добавление Cron-задачи для ansible-pull     - block:         - name: Calculate random cron minute per host           set_fact:             random_minute_offset: "{{ (inventory_hostname | hash('md5') | int(base=16) % 30) | int }}"          - name: Add ansible-pull cron job           cron:             name: "Run ansible-pull"             minute: "{{ (random_minute_offset | int + 0) % 60 }},{{ (random_minute_offset | int + 30) % 60 }}"             job: >               /usr/bin/ansible-pull -U {{ git_repo }}               -C {{ git_branch }}               --private-key {{ ssh_key_dest }}               {{ git_playbook_path }}               | tee /var/log/ansible-pull.log             user: "{{ run_ansible_user }}"           become: yes          - name: Ensure ansible-pull log file exists           file:             path: /var/log/ansible-pull.log             state: touch             owner: "{{ run_ansible_user }}"             group: "{{ run_ansible_user }}"             mode: '0644'           become: yes       tags: cron_setup      ### 🔹 Установка ролей для хостов     - block:         - name: Create directoryfor custom fact           file:             path: /etc/ansible/facts.d             state: directory             mode: '0755'           become: true          - name: Create JSON-file with fact "host_role"           copy:             dest: /etc/ansible/facts.d/custom.fact             content: |               {                 "host_role": "{{ host_role }}"               }             mode: '0644'           become: true       tags: host_role       ### 🔹 Тестирование     - block:         - name: Check ansible-pull process           shell: "pgrep -fa ansible-pull || true"           register: ansible_pull_status           changed_when: false          - name: Show running ansible-pull status           debug:             msg: "📌 [INFO] - Ansible-pull running: {{ansible_pull_status.stdout_lines }}"           when: ansible_pull_status.stdout | length > 0          # cronjob         - name: Check ansible-pull cron job           shell: "crontab -l -u {{ run_ansible_user }} | grep ansible-pull || true"           register: cron_job_status           changed_when: false           failed_when: false  # Избежать ошибки, если crontab пустой           become: true          - name: Show cron job status           debug:             msg: "📌 [INFO] - Ansible-pull cron job: {{ cron_job_status.stdout_lines }}"           when: cron_job_status.stdout | length > 0          # Принудительное обновление фактов (чтобы загрузился новый файл)         - name: Update ansible_facts           ansible.builtin.setup:             filter: ansible_local          # Проверка наличия кастомного факта "host_role"         - name: Show custom fact           ansible.builtin.debug:             msg: "Роль хоста - host_role: {{ ansible_local.custom.host_role }}"       tags: test 

ansible-playbook -i inventory.yml setup_ansible_pull.yml

# docker-compose_control.yml version: '3.9'  services:   ansible_control:     build:       context: ./docker       dockerfile: Dockerfile.control       args:         DEBIAN_VERSION: ${DEBIAN_VERSION}          HTTP_PROXY: ${HTTP_PROXY}         HTTPS_PROXY: ${HTTP_PROXY}         NO_PROXY: ${NO_PROXY}     environment:       HTTP_PROXY: ${HTTP_PROXY}       HTTPS_PROXY: ${HTTP_PROXY}       NO_PROXY: ${NO_PROXY}     container_name: ansible_control     hostname: ansible_control     networks:       test_network:         ipv4_address: 192.168.100.200     volumes:       - ./ansible:/ansible       - /var/run/docker.sock:/var/run/docker.sock       - /usr/bin/docker:/usr/bin/docker     tty: true     stdin_open: true     restart: unless-stopped  networks:   test_network:     driver: bridge     ipam:       config:         - subnet: 192.168.100.0/24

# docker\Dockerfile.control ARG DEBIAN_VERSION FROM debian:12  # Задаем увеличенный таймаут и число повторных попыток для apt-get RUN echo 'Acquire::http::Timeout "600";' >> /etc/apt/apt.conf.d/99timeout && \     echo 'Acquire::Retries "5";' >> /etc/apt/apt.conf.d/99timeout  # Устанавливаем Ansible, ansible-lint и зависимости RUN apt-get update && apt-get install -y \     ansible \     ansible-lint \     && apt-get clean \     && rm -rf /var/lib/apt/lists/*  # Создаем ansible-пользователя с sudo без пароля RUN useradd -m ansible \     && echo "ansible ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/ansible \     && chmod 0440 /etc/sudoers.d/ansible  # Проверяем установку RUN ansible --version && ansible-lint --version  # Устанавливаем рабочую директорию WORKDIR /ansible  CMD ["/bin/bash"]

# .gitlab-ci.yml variables:   CLIENT_IP: 192.168.2.213   CLIENT_SSH_PASSWORD: vagrant   APP_TEMPLATE: "Это тестовый Flask-сервер"   APP_IP: "192.168.2.212"   WEBSERVER_IP: "192.168.2.211"  stages:   - check   - test   - deploy   # 🔹 Проверяем синтаксис и Ansible-lint перед тестами check-ansible-syntax:   stage: check   tags:     - shell    script:     - echo "🐳 Building Ansible control node..."     # - docker-compose -f docker-compose_control.yml down --remove-orphans     # - docker-compose -f docker-compose_control.yml up -d --build --force-recreate     - docker-compose -f docker-compose_control.yml up -d      - echo "🔁 Waiting for containers to be ready..."     - until docker ps | grep "ansible_control"; do sleep 2; done      - echo "⏳ Waiting for 5 seconds to ensure all services are up..."     - sleep 5      - echo "📌 Checking Ansible playbook syntax..."     - |       docker exec -i ansible_control ansible-playbook infra_ansible_pull.yml --syntax-check       if [ $? -eq 0 ]; then         echo "✅ Синтаксис плейбука infra_ansible_pull.yml корректен!"       else         echo -e "\033[1;31m❌ ERROR: Ошибка в синтаксисе playbook!\033[0m"         exit 1   # Прерываем job, если есть ошибки       fi       - echo "📌 Linting Ansible playbook and roles..."     - |       set -o pipefail # --- вывод ansible-lint ---       # Для отладки можно включить отладочный режим:       # set -x        lint_log="lint_output.txt"        # Выполнение ansible-lint, вывод логируем в файл.       if ! docker exec -i ansible_control ansible-lint infra_ansible_pull.yml | tee "$lint_log"; then         echo -e "\033[1;31m❌ ERROR: ansible-lint выявил критические ошибки! Устараните их согласно рекомендациям выше!\033[0m"         exit 1       fi        echo ""  # Дополнительная пустая строка для корректного сканирования grep        # Проверяем наличие предупреждений в выводе       if grep -q "WARNING" "$lint_log"; then         echo -e "\033[1;33m⚠️  WARNING: Обнаружены предупреждения в ansible-lint!\033[0m"       else         echo -e "\033[1;32m✅ Ansible-lint успешно пройден!\033[0m"       fi   except:     - release  # Исключаем выполнение в ветке release  # 🔹 Развертывание Ansible playbook в тестовом окружении test-deployment:   stage: test   before_script:     - echo "♻️ Обновление окружения..."   tags:     - shell   needs:     - check-ansible-syntax  # ✅ Ждем успешного завершения синтакс-чека    script:     - echo "📌 Running Ansible tests - checking connection..."     - export ANSIBLE_HOST_KEY_CHECKING=False     - ansible all -i ansible/inventory_test.yml -m ping --extra-vars 'ansible_ssh_extra_args="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"'      - echo "📌 Running Ansible playbook execution..."     - ansible-playbook -i ansible/inventory_test.yml ansible/infra_ansible_pull.yml -e "target_hosts=all ansible_ssh_extra_args='-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'" # переопределяем в инвентаре целевые хосты      # 🔹 Тесты     # проверка доступности приложения на узле     - echo "🧪 --- Run tests ---"     # --- Проверка доступности Nginx     - echo "🔍 --- Checking Nginx status"     - |       NGINX_STATUS=$(sshpass -p "$CLIENT_SSH_PASSWORD" ssh -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null "vagrant@$WEBSERVER_IP" "systemctl is-active nginx" 2>/dev/null)       if [[ "$NGINX_STATUS" == "active" ]]; then           echo "✅ Nginx service is running"       else           echo "❌ Nginx service is NOT running"           exit 1       fi      - echo "🔍 --- Checking app content for client"     - |         OUTPUT=$(sshpass -p "$CLIENT_SSH_PASSWORD" ssh -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/dev/null "vagrant@$CLIENT_IP" "echo Узел:; hostname; echo 🌍 HTTP-ответ:; curl -s http://$WEBSERVER_IP")         if echo "$OUTPUT" | grep -q "Узел:" && echo "$OUTPUT" | grep -q "🌍 HTTP-ответ:" && echo "$OUTPUT" | grep -q "$APP_TEMPLATE"; then             echo "✅ Проверка успешна! HTTP-ответ содержит текст: "$APP_TEMPLATE""             exit 0         else             echo "❌ Ошибка! HTTP-ответ не содержит тестовый шаблон! Ответ: "$OUTPUT""             exit 1         fi      - echo "✅ All tests passed successfully!"   except:     - release  # Исключаем выполнение в ветке release   # 🔹 Деплой deploy-ansible-role:   stage: deploy   tags:     - shell   needs:     - check-ansible-syntax  # ✅ Ждем успешного завершения синтакс-чека     - test-deployment     # ✅ Ждем успешного запуска кода на тестовых контейнерах    script:     - echo "🐳 Building and starting test Docker containers..."     # create $RUNNER_TOKEN - roles - developer - read_repository, write_repository. -> Add variable to project     - git config --global user.email "your-email@example.com"     - git config --global user.name "andreychuyan"     - git push --force https://oauth2:$RUNNER_TOKEN@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git  HEAD:refs/heads/release   only:     - main 

.
├── ansible.cfg
├── group_vars
│ └── all.yml
├── infra_ansible_pull.yml
├── inventory_test.yml
├── node_setting_to_pull
│ ├── inventory.yml
│ └── setup_ansible_pull.yml
└── roles
├── app
│ ├── files
│ │ └── app.py
│ ├── handlers
│ │ └── main.yml
│ ├── README.md
│ ├── tasks
│ │ └── main.yml
│ ├── templates
│ │ └── hello-app.service.j2
│ └── vars
│ └── main.yml
├── client
│ ├── files
│ │ ├── id_rsa.pub
│ │ └── ssh_banner
│ ├── README.md
│ ├── tasks
│ │ ├── main.yml
│ │ ├── motd_setup.yml
│ │ └── user_setup.yml
│ └── templates
│ └── motd.j2
└── web
├── handlers
│ └── main.yml
├── README.md
├── tasks
│ └── main.yml
└── templates
└── nginx_application.conf.j2

# ansible/inventory_test.yml all:   vars:     network_prefix: "192.168.2"    hosts:     webserver:       host_role: webserver       ansible_host: "{{ network_prefix }}.211"       ansible_user: vagrant       ansible_password: vagrant       ansible_become: yes       ansible_become_method: sudo      application:       host_role: application       ansible_host: "{{ network_prefix }}.212"       ansible_user: vagrant       ansible_password: vagrant       ansible_become: yes       ansible_become_method: sudo    children:     clients:       hosts:         client_1:           host_role: client           ansible_host: "{{ network_prefix }}.213"           ansible_user: vagrant           ansible_password: vagrant           ansible_become: yes           ansible_become_method: sudo          client_2:           host_role: client           ansible_host: "{{ network_prefix }}.214"           ansible_user: vagrant           ansible_password: vagrant           ansible_become: yes           ansible_become_method: sudo

# ansible/ansible.cfg [defaults] remote_tmp = /tmp/.ansible/tmp roles_path = roles remote_user = ansible become = True become_method = sudo host_key_checking = False forks = 10 timeout = 30 retry_files_enabled = False log_path = ./ansible.log gathering = smart fact_caching = jsonfile fact_caching_connection = /tmp/ansible_facts fact_caching_timeout = 600  [ssh_connection] pipelining = True scp_if_ssh = True

# ansible/group_vars/all.yml app_endpoint: "http://192.168.2.212:8080"

# ansible/ansible/infra_ansible_pull.yaml - name: Apply roles dynamically from inventory   hosts: "{{ target_hosts | default('localhost') }}"   gather_facts: true    tasks:     - name: Explicitly gather custom facts       ansible.builtin.setup:         filter: ansible_local      - name: Include web role       ansible.builtin.include_role:         name: web       when: ansible_local.custom.host_role is defined and ansible_local.custom.host_role == "webserver"      - name: Include app role       ansible.builtin.include_role:         name: app       when: ansible_local.custom.host_role is defined and ansible_local.custom.host_role == "application"      - name: Include client role       ansible.builtin.include_role:         name: client       when: ansible_local.custom.host_role is defined and ansible_local.custom.host_role == "client" 

# ansible/roles/web/handlers/main.yml - name: Reload Nginx   ansible.builtin.service:     name: nginx     state: reloaded   become: true 

# ansible/roles/web/tasks/main.yml # установка nginx - name: Ensure Nginx is installed (Ubuntu/Debian)   ansible.builtin.apt:     name: nginx     state: present     update_cache: true   become: true   when: ansible_os_family == "Debian"  - name: Ensure Nginx is enabled and running   ansible.builtin.service:     name: nginx     state: started     enabled: true   become: true   when: ansible_os_family == "Debian"  - name: Create Nginx configuration file for application   ansible.builtin.template:     src: nginx_application.conf.j2  # Путь к вашему шаблону Jinja2     dest: /etc/nginx/sites-available/application     mode: '0644'   become: true  - name: Enable Nginx site configuration   ansible.builtin.file:     src: /etc/nginx/sites-available/application     dest: /etc/nginx/sites-enabled/application     state: link   become: true   notify: Reload Nginx  # ❌ Удаляем дефолтный конфиг Nginx - name: Remove default Nginx site configuration   ansible.builtin.file:     path: /etc/nginx/sites-enabled/default     state: absent   become: true  - name: Test Nginx configuration   ansible.builtin.command: nginx -t   become: true   changed_when: false  # <- Сообщает Ansible, что это не изменяющее действие  - name: Restart Nginx to apply changes   ansible.builtin.service:     name: nginx     state: restarted     enabled: true   become: true 

# ansible/roles/web/templates/nginx_application.conf.j2 server {     listen 80;     server_name _;      location / {         # Укажите IP-адрес или доменное имя вашего приложения и порт:         proxy_pass {{ app_endpoint }};         proxy_http_version 1.1;         proxy_set_header Host $host;         proxy_set_header X-Real-IP $remote_addr;         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header X-Forwarded-Proto $scheme;     } }

# ansible/roles/app/tasks/main.yml # *Установка Python и Pip на Debian/Ubuntu* - name: Install Python and Pip (Debian)   become: true   ansible.builtin.apt:     name:       - python3-apt       - python3       - python3-pip       - python3-venv     state: present     update_cache: true   when: ansible_os_family == "Debian"  # Создание виртуального окружения - name: Create Python virtual environment   ansible.builtin.command: "python3 -m venv {{ venv_path }}"   args:     creates: "{{ venv_path }}"  # Обновление pip внутри виртуального окружения - name: Upgrade pip inside virtual environment   ansible.builtin.pip:     name: pip     state: present     extra_args: --upgrade     virtualenv: "{{ venv_path }}"  # Установка дополнительных пакетов (Flask и requests) в виртуальное окружение - name: Install required Python packages in virtual environment   ansible.builtin.pip:     name:       - requests       - flask     virtualenv: "{{ venv_path }}"  # *Проверка установки Python* - name: Verify Python installation   ansible.builtin.command: python3 --version   register: python_version   changed_when: false  - name: Debug Python version   ansible.builtin.debug:     msg: "Installed Python version: {{ python_version.stdout }}"  # *Проверка установки Pip (системного)* - name: Verify Pip installation   ansible.builtin.command: pip3 --version   register: pip_version   changed_when: false  - name: Debug Pip version   ansible.builtin.debug:     msg: "Installed Pip version: {{ pip_version.stdout }}"  # *Проверка, что виртуальное окружение успешно создано* - name: Verify virtual environment   ansible.builtin.stat:     path: "{{ venv_path }}/bin/activate"   register: venv_check  - name: Debug virtual environment status   ansible.builtin.debug:     msg: "Virtual environment exists at {{ venv_path }}"   when: venv_check.stat.exists  # ====== Развёртывание Flask-приложения ======  # Создание директории для приложения - name: Create application directory   ansible.builtin.file:     path: "{{ app_dir }}"     state: directory     mode: '0755'  # Развёртывание файла приложения app.py - name: Deploy Flask application (app.py)   ansible.builtin.copy:     src: app.py     dest: "{{ app_dir }}/app.py"     mode: '0755'  # Создание systemd-сервиса для автоматического запуска приложения - name: Create systemd service for Flask app   become: true   ansible.builtin.template:     src: hello-app.service.j2     dest: /etc/systemd/system/hello-app.service     mode: '0644'   notify: Reload systemd  # Включение и запуск Flask приложения через systemd - name: Ensure hello-app service is enabled and started   become: true   ansible.builtin.systemd:     name: hello-app     state: restarted     enabled: true 

#!/usr/bin/env python3 # -*- coding: utf-8 -*- # ansible/roles/app/files  from flask import Flask, render_template_string from datetime import datetime import random  app = Flask(__name__)  QUOTES = [     "Жизнь — это то, что с тобой происходит, пока ты строишь планы. — Джон Леннон",     "Секрет успеха в том, чтобы начать. — Марк Твен",     "Сложные дороги ведут к красивым направлениям. — Неизвестный автор",     "Начни делать — и энергия появится. — Джеймс Клир",     "Будущее принадлежит тем, кто верит в красоту своей мечты. — Элеонор Рузвельт" ]  def get_current_time():     return datetime.now().strftime("%Y-%m-%d %H:%M:%S")  def get_random_quote():     return random.choice(QUOTES)  HTML_TEMPLATE = """ <!DOCTYPE html> <html lang="ru"> <head>     <meta charset="UTF-8">     <meta name="viewport" content="width=device-width, initial-scale=1">     <title>Тестовое приложение</title>     <link          href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css"          rel="stylesheet">     <style>         body { background-color: #f8f9fa; text-align: center; padding: 5rem; }         .container { background: white; padding: 2rem; border-radius: 10px; box-shadow: 0 0 10px rgba(0,0,0,0.1); }         h1 { color: #007bff; }         p { font-size: 1.2rem; }         .quote { font-style: italic; color: #6c757d; }     </style> </head> <body>     <div class="container">         <h1>🚀 Добро пожаловать!</h1>         <p>Это тестовый Flask-сервер.</p>         <p><strong>Текущее время:</strong> {{ time }}</p>         <p class="quote">📜 Цитата дня: "{{ quote }}"</p>         <a href="/time" class="btn btn-primary mt-3">Показать только время</a>     </div> </body> </html> """  @app.route('/') def home():     return render_template_string(HTML_TEMPLATE, time=get_current_time(), quote=get_random_quote())  @app.route('/time') def show_time():     return {"current_time": get_current_time()}  if __name__ == '__main__':     app.run(host='0.0.0.0', port=8080, debug=True)

# ansible/roles/app/handlers/main.yml - name: Reload systemd   become: true   ansible.builtin.systemd:     daemon_reload: true 

# ansible/roles/app/templates/hello-app.service.j2 [Unit] Description=Hello Flask App Service After=network.target  [Service] User={{ ansible_user_id }} WorkingDirectory={{ app_dir }} ExecStart={{ venv_path }}/bin/python app.py Restart=always  [Install] WantedBy=multi-user.target

# ansible/roles/app/vars/main.yml venv_path: "{{ ansible_env.HOME }}/.venv" app_dir: "{{ ansible_env.HOME }}/hello_app" 

# ansible/roles/client/tasks/main.yml --- - name: Создание пользователя и настройка SSH   ansible.builtin.import_tasks: user_setup.yml  - name: Настройка MOTD / SSH баннера   ansible.builtin.import_tasks: motd_setup.yml 

# ansible/roles/client/tasks/motd_setup.yml --- - name: Setup MOTD (message day)   ansible.builtin.template:     src: templates/motd.j2     dest: /etc/motd     owner: root     group: root     mode: '0644'  # Установим безопасные права   become: true  - name: Install SSH banner   ansible.builtin.copy:     src: files/ssh_banner     dest: /etc/issue.net     owner: root     group: root     mode: '0644'   become: true  - name: Enable SSH banner   ansible.builtin.lineinfile:     path: /etc/ssh/sshd_config     regexp: '^#?Banner'     line: 'Banner /etc/issue.net'     state: present   notify: Restart SSH   become: true 

# ansible/roles/client/tasks/user_setup.yml --- - name: Create user ladmin   ansible.builtin.user:     name: ladmin     shell: /bin/bash     groups: "{{ 'sudo' if ansible_os_family == 'Debian' else 'wheel' }}"     append: true     create_home: true     state: present   become: true  - name: Copy SSH-keys for user ladmin   ansible.posix.authorized_key:     user: ladmin     state: present     key: "{{ lookup('file', 'files/id_rsa.pub') }}"  - name: Create sudo no pass user ladmin   ansible.builtin.copy:     dest: /etc/sudoers.d/ladmin     content: "ladmin ALL=(ALL) NOPASSWD:ALL"     mode: "0440"   become: true 

ansible/roles/client/files/ssh_banner

🔒 Внимание! Это частный сервер. Неавторизованный доступ запрещён! 🔒 

# ansible/roles/client/handlers/main.yml - name: Restart SSH   ansible.builtin.service:     name: "{{ 'sshd' if ansible_os_family == 'RedHat' else 'ssh' }}"     state: restarted  - name: Reload environment   ansible.builtin.command: source /etc/environment   changed_when: false 

ansible/roles/client/templates/motd.j2

Добро пожаловать на сервер {{ ansible_hostname }}! Дата и время: {{ ansible_date_time.date }}, {{ ansible_date_time.time }} ОС: {{ ansible_distribution }} {{ ansible_distribution_version }} CPU: {{ ansible_processor_cores }} ядер RAM: {{ ansible_memtotal_mb }} MB

/var/log/ansible-pull.log

ansible@p-application:~$ cat /var/log/ansible-pull.log
[WARNING]: Could not match supplied host pattern, ignoring: p-application
localhost | SUCCESS => {
«after»: «ba7fba1e999fe5e3a4f49d09834601e4c2481e6e»,
«before»: «ba7fba1e999fe5e3a4f49d09834601e4c2481e6e»,
«changed»: false,
«remote_url_changed»: false
}
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that
the implicit localhost does not match ‘all’
[WARNING]: Could not match supplied host pattern, ignoring: p-application

PLAY [Apply roles dynamically from inventory] **********************************

TASK [Gathering Facts] *********************************************************
ok: [localhost]

TASK [Explicitly gather custom facts] ******************************************
ok: [localhost]

TASK [Include web role] ********************************************************
skipping: [localhost]

TASK [Include app role] ********************************************************

TASK [app : Install Python and Pip (Debian)] ***********************************
ok: [localhost]

TASK [app : Create Python virtual environment] *********************************
ok: [localhost]

TASK [app : Upgrade pip inside virtual environment] ****************************
ok: [localhost]

TASK [app : Install required Python packages in virtual environment] ***********
ok: [localhost]

TASK [app : Verify Python installation] ****************************************
ok: [localhost]

TASK [app : Debug Python version] **********************************************
ok: [localhost] => {
«msg»: «Installed Python version: Python 3.11.2»
}

TASK [app : Verify Pip installation] *******************************************
ok: [localhost]

TASK [app : Debug Pip version] *************************************************
ok: [localhost] => {
«msg»: «Installed Pip version: pip 23.0.1 from /usr/lib/python3/dist-packages/pip (python 3.11)»
}

TASK [app : Verify virtual environment] ****************************************
ok: [localhost]

TASK [app : Debug virtual environment status] **********************************
ok: [localhost] => {
«msg»: «Virtual environment exists at /home/ansible/.venv»
}

TASK [app : Create application directory] **************************************
ok: [localhost]

TASK [app : Deploy Flask application (app.py)] *********************************
ok: [localhost]

TASK [app : Create systemd service for Flask app] ******************************
ok: [localhost]

TASK [app : Ensure hello-app service is enabled and started] *******************
changed: [localhost]

TASK [Include client role] *****************************************************
skipping: [localhost]

PLAY RECAP *********************************************************************
localhost : ok=16 changed=1 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0

Starting Ansible Pull at 2025-03-14 23:29:53
/usr/bin/ansible-pull -U git@gitlab.ch.ap:AndreyChuyan/ansible_pull_cicd.git -C release —private-key /home/ansible/.ssh/id_ansible_pull ansible/infra_ansible_pull.yml