diff --git a/wordpress-nginx_rhel7/LICENSE.md b/wordpress-nginx_rhel7/LICENSE.md new file mode 100644 index 0000000..1b1fe9d --- /dev/null +++ b/wordpress-nginx_rhel7/LICENSE.md @@ -0,0 +1,5 @@ +Modified by David Beck (techiscool@gmail.com) 2015 +Copyright (C) 2015 Eugene Varnavsky (varnavruz@gmail.com) + +This work is licensed under the Creative Commons Attribution 3.0 Unported License. +To view a copy of this license, visit http://creativecommons.org/licenses/by/3.0/deed.en_US. diff --git a/wordpress-nginx_rhel7/README.md b/wordpress-nginx_rhel7/README.md new file mode 100644 index 0000000..f4b8ae7 --- /dev/null +++ b/wordpress-nginx_rhel7/README.md @@ -0,0 +1,34 @@ +## WordPress+Nginx+PHP-FPM+MariaDB Deployment + +- Requires Ansible 1.2 or newer +- Expects CentOS/RHEL 7.x host/s + +RHEL7 version reflects changes in Red Hat Enterprise Linux and CentOS 7: +1. Network device naming scheme has changed +2. iptables is replaced with firewalld +3. MySQL is replaced with MariaDB + +These playbooks deploy a simple all-in-one configuration of the popular +WordPress blogging platform and CMS, frontend by the Nginx web server and the +PHP-FPM process manager. To use, copy the `hosts.example` file to `hosts` and +edit the `hosts` inventory file to include the names or URLs of the servers +you want to deploy. + +Then run the playbook, like this: + + ansible-playbook -i hosts site.yml + +The playbooks will configure MariaDB, WordPress, Nginx, and PHP-FPM. When the run +is complete, you can hit access server to begin the WordPress configuration. + +### Ideas for Improvement + +Here are some ideas for ways that these playbooks could be extended: + +- Parameterize the WordPress deployment to handle multi-site configurations. +- Separate the components (PHP-FPM, MySQL, Nginx) onto separate hosts and +handle the configuration appropriately. +- Handle WordPress upgrades automatically. + +We would love to see contributions and improvements, so please fork this +repository on GitHub and send us your changes via pull requests. \ No newline at end of file diff --git a/wordpress-nginx_rhel7/group_vars/all b/wordpress-nginx_rhel7/group_vars/all new file mode 100644 index 0000000..748ce16 --- /dev/null +++ b/wordpress-nginx_rhel7/group_vars/all @@ -0,0 +1,28 @@ +--- +# Variables listed here are applicable to all host groups +wp_version: 4.3 +wp_sha256sum: 3b0db3abe8504f15a33cf64188a493ec0de01eaa8d20e37c3d6a1d9fa0a40fb4 + +# MySQL settings +mysqlservice: mysqld +mysql_port: 3306 + +# These are the WordPress database settings +wp_db_name: wordpress +wp_db_user: wordpress +wp_db_password: secret + +# This is used for the nginx server configuration, but access to the +# WordPress site is not restricted by a named host. +nginx_port: 80 +server_hostname: server.example.com + +# Disable All Updates +# By default automatic updates are enabled, set this value to true to disable all automatic updates +auto_up_disable: false + +#Define Core Update Level +# true = Development, minor, and major updates are all enabled +# false = Development, minor, and major updates are all disabled +# minor = Minor updates are enabled, development, and major updates are disabled +core_update_level: true diff --git a/wordpress-nginx_rhel7/hosts.example b/wordpress-nginx_rhel7/hosts.example new file mode 100644 index 0000000..0dbfb16 --- /dev/null +++ b/wordpress-nginx_rhel7/hosts.example @@ -0,0 +1,2 @@ +[wordpress-server] +webserver2 diff --git a/wordpress-nginx_rhel7/roles/common/files/RPM-GPG-KEY-EPEL-7 b/wordpress-nginx_rhel7/roles/common/files/RPM-GPG-KEY-EPEL-7 new file mode 100644 index 0000000..a1d6f25 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/common/files/RPM-GPG-KEY-EPEL-7 @@ -0,0 +1,29 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (GNU/Linux) + +mQINBFKuaIQBEAC1UphXwMqCAarPUH/ZsOFslabeTVO2pDk5YnO96f+rgZB7xArB +OSeQk7B90iqSJ85/c72OAn4OXYvT63gfCeXpJs5M7emXkPsNQWWSju99lW+AqSNm +jYWhmRlLRGl0OO7gIwj776dIXvcMNFlzSPj00N2xAqjMbjlnV2n2abAE5gq6VpqP +vFXVyfrVa/ualogDVmf6h2t4Rdpifq8qTHsHFU3xpCz+T6/dGWKGQ42ZQfTaLnDM +jToAsmY0AyevkIbX6iZVtzGvanYpPcWW4X0RDPcpqfFNZk643xI4lsZ+Y2Er9Yu5 +S/8x0ly+tmmIokaE0wwbdUu740YTZjCesroYWiRg5zuQ2xfKxJoV5E+Eh+tYwGDJ +n6HfWhRgnudRRwvuJ45ztYVtKulKw8QQpd2STWrcQQDJaRWmnMooX/PATTjCBExB +9dkz38Druvk7IkHMtsIqlkAOQMdsX1d3Tov6BE2XDjIG0zFxLduJGbVwc/6rIc95 +T055j36Ez0HrjxdpTGOOHxRqMK5m9flFbaxxtDnS7w77WqzW7HjFrD0VeTx2vnjj +GqchHEQpfDpFOzb8LTFhgYidyRNUflQY35WLOzLNV+pV3eQ3Jg11UFwelSNLqfQf +uFRGc+zcwkNjHh5yPvm9odR1BIfqJ6sKGPGbtPNXo7ERMRypWyRz0zi0twARAQAB +tChGZWRvcmEgRVBFTCAoNykgPGVwZWxAZmVkb3JhcHJvamVjdC5vcmc+iQI4BBMB +AgAiBQJSrmiEAhsPBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRBqL66iNSxk +5cfGD/4spqpsTjtDM7qpytKLHKruZtvuWiqt5RfvT9ww9GUUFMZ4ZZGX4nUXg49q +ixDLayWR8ddG/s5kyOi3C0uX/6inzaYyRg+Bh70brqKUK14F1BrrPi29eaKfG+Gu +MFtXdBG2a7OtPmw3yuKmq9Epv6B0mP6E5KSdvSRSqJWtGcA6wRS/wDzXJENHp5re +9Ism3CYydpy0GLRA5wo4fPB5uLdUhLEUDvh2KK//fMjja3o0L+SNz8N0aDZyn5Ax +CU9RB3EHcTecFgoy5umRj99BZrebR1NO+4gBrivIfdvD4fJNfNBHXwhSH9ACGCNv +HnXVjHQF9iHWApKkRIeh8Fr2n5dtfJEF7SEX8GbX7FbsWo29kXMrVgNqHNyDnfAB +VoPubgQdtJZJkVZAkaHrMu8AytwT62Q4eNqmJI1aWbZQNI5jWYqc6RKuCK6/F99q +thFT9gJO17+yRuL6Uv2/vgzVR1RGdwVLKwlUjGPAjYflpCQwWMAASxiv9uPyYPHc +ErSrbRG0wjIfAR3vus1OSOx3xZHZpXFfmQTsDP7zVROLzV98R3JwFAxJ4/xqeON4 +vCPFU6OsT3lWQ8w7il5ohY95wmujfr6lk89kEzJdOTzcn7DBbUru33CQMGKZ3Evt +RjsC7FDbL017qxS+ZVA/HGkyfiu4cpgV8VUnbql5eAZ+1Ll6Dw== +=hdPa +-----END PGP PUBLIC KEY BLOCK----- \ No newline at end of file diff --git a/wordpress-nginx_rhel7/roles/common/files/RPM-GPG-KEY-NGINX b/wordpress-nginx_rhel7/roles/common/files/RPM-GPG-KEY-NGINX new file mode 100644 index 0000000..2528b45 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/common/files/RPM-GPG-KEY-NGINX @@ -0,0 +1,28 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v1.4.11 (FreeBSD) + +mQENBE5OMmIBCAD+FPYKGriGGf7NqwKfWC83cBV01gabgVWQmZbMcFzeW+hMsgxH +W6iimD0RsfZ9oEbfJCPG0CRSZ7ppq5pKamYs2+EJ8Q2ysOFHHwpGrA2C8zyNAs4I +QxnZZIbETgcSwFtDun0XiqPwPZgyuXVm9PAbLZRbfBzm8wR/3SWygqZBBLdQk5TE +fDR+Eny/M1RVR4xClECONF9UBB2ejFdI1LD45APbP2hsN/piFByU1t7yK2gpFyRt +97WzGHn9MV5/TL7AmRPM4pcr3JacmtCnxXeCZ8nLqedoSuHFuhwyDnlAbu8I16O5 +XRrfzhrHRJFM1JnIiGmzZi6zBvH0ItfyX6ttABEBAAG0KW5naW54IHNpZ25pbmcg +a2V5IDxzaWduaW5nLWtleUBuZ2lueC5jb20+iQE+BBMBAgAoBQJOTjJiAhsDBQkJ +ZgGABgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCr9b2Ce9m/YpvjB/98uV4t +94d0oEh5XlqEZzVMrcTgPQ3BZt05N5xVuYaglv7OQtdlErMXmRWaFZEqDaMHdniC +sF63jWMd29vC4xpzIfmsLK3ce9oYo4t9o4WWqBUdf0Ff1LMz1dfLG2HDtKPfYg3C +8NESud09zuP5NohaE8Qzj/4p6rWDiRpuZ++4fnL3Dt3N6jXILwr/TM/Ma7jvaXGP +DO3kzm4dNKp5b5bn2nT2QWLPnEKxvOg5Zoej8l9+KFsUnXoWoYCkMQ2QTpZQFNwF +xwJGoAz8K3PwVPUrIL6b1lsiNovDgcgP0eDgzvwLynWKBPkRRjtgmWLoeaS9FAZV +ccXJMmANXJFuCf26iQEcBBABAgAGBQJOTkelAAoJEKZP1bF62zmo79oH/1XDb29S +YtWp+MTJTPFEwlWRiyRuDXy3wBd/BpwBRIWfWzMs1gnCjNjk0EVBVGa2grvy9Jtx +JKMd6l/PWXVucSt+U/+GO8rBkw14SdhqxaS2l14v6gyMeUrSbY3XfToGfwHC4sa/ +Thn8X4jFaQ2XN5dAIzJGU1s5JA0tjEzUwCnmrKmyMlXZaoQVrmORGjCuH0I0aAFk +RS0UtnB9HPpxhGVbs24xXZQnZDNbUQeulFxS4uP3OLDBAeCHl+v4t/uotIad8v6J +SO93vc1evIje6lguE81HHmJn9noxPItvOvSMb2yPsE8mH4cJHRTFNSEhPW6ghmlf +Wa9ZwiVX5igxcvaIRgQQEQIABgUCTk5b0gAKCRDs8OkLLBcgg1G+AKCnacLb/+W6 +cflirUIExgZdUJqoogCeNPVwXiHEIVqithAM1pdY/gcaQZmIRgQQEQIABgUCTk5f +YQAKCRCpN2E5pSTFPnNWAJ9gUozyiS+9jf2rJvqmJSeWuCgVRwCcCUFhXRCpQO2Y +Va3l3WuB+rgKjsQ= +=A015 +-----END PGP PUBLIC KEY BLOCK----- \ No newline at end of file diff --git a/wordpress-nginx_rhel7/roles/common/files/epel.repo b/wordpress-nginx_rhel7/roles/common/files/epel.repo new file mode 100644 index 0000000..0301cc7 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/common/files/epel.repo @@ -0,0 +1,8 @@ +[epel] +name=Extra Packages for Enterprise Linux 7 - $basearch +#baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch +mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch +failovermethod=priority +enabled=1 +gpgcheck=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7 \ No newline at end of file diff --git a/wordpress-nginx_rhel7/roles/common/files/nginx.repo b/wordpress-nginx_rhel7/roles/common/files/nginx.repo new file mode 100644 index 0000000..9060b8d --- /dev/null +++ b/wordpress-nginx_rhel7/roles/common/files/nginx.repo @@ -0,0 +1,7 @@ +[nginx] +name=Nginx repo - $basearch +baseurl=http://nginx.org/packages/centos/7/$basearch +failovermethod=priority +gpgcheck=1 +enabled=1 +gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-NGINX diff --git a/wordpress-nginx_rhel7/roles/common/tasks/main.yml b/wordpress-nginx_rhel7/roles/common/tasks/main.yml new file mode 100644 index 0000000..6c5f9d3 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/common/tasks/main.yml @@ -0,0 +1,12 @@ +--- +- name: Copy the NGINX repository definition + copy: src=nginx.repo dest=/etc/yum.repos.d/ + +- name: Copy the EPEL repository definition + copy: src=epel.repo dest=/etc/yum.repos.d/ + +- name: Create the GPG key for NGINX + copy: src=RPM-GPG-KEY-NGINX dest=/etc/pki/rpm-gpg + +- name: Create the GPG key for EPEL + copy: src=RPM-GPG-KEY-EPEL-7 dest=/etc/pki/rpm-gpg \ No newline at end of file diff --git a/wordpress-nginx_rhel7/roles/mariadb/handlers/main.yml b/wordpress-nginx_rhel7/roles/mariadb/handlers/main.yml new file mode 100644 index 0000000..37c0683 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/mariadb/handlers/main.yml @@ -0,0 +1,5 @@ +--- +# Handler to handle DB tier notifications + +- name: restart mariadb + service: name=mariadb state=restarted diff --git a/wordpress-nginx_rhel7/roles/mariadb/tasks/main.yml b/wordpress-nginx_rhel7/roles/mariadb/tasks/main.yml new file mode 100644 index 0000000..b198b3d --- /dev/null +++ b/wordpress-nginx_rhel7/roles/mariadb/tasks/main.yml @@ -0,0 +1,27 @@ +--- +# This playbook will install MariaDB and create db user and give permissions. + +- name: Install MariaDB package + yum: name={{ item }} state=installed + with_items: + - mariadb-server + - MySQL-python + - libselinux-python + - libsemanage-python + +- name: Configure SELinux to start mysql on any port + seboolean: name=mysql_connect_any state=true persistent=yes + +- name: Create Mysql configuration file + template: src=my.cnf.j2 dest=/etc/my.cnf + notify: + - restart mariadb + +- name: Create MariaDB log file + file: path=/var/log/mysqld.log state=touch owner=mysql group=mysql mode=0775 + +- name: Start MariaDB Service + service: name=mariadb state=started enabled=yes + +- name: insert firewalld rule + firewalld: port={{ mysql_port }}/tcp permanent=true state=enabled immediate=yes \ No newline at end of file diff --git a/wordpress-nginx_rhel7/roles/mariadb/templates/my.cnf.j2 b/wordpress-nginx_rhel7/roles/mariadb/templates/my.cnf.j2 new file mode 100644 index 0000000..0767734 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/mariadb/templates/my.cnf.j2 @@ -0,0 +1,11 @@ +[mysqld] +datadir=/var/lib/mysql +socket=/var/lib/mysql/mysql.sock +user=mysql +# Disabling symbolic-links is recommended to prevent assorted security risks +symbolic-links=0 +port={{ mysql_port }} + +[mysqld_safe] +log-error=/var/log/mysqld.log +pid-file=/var/run/mariadb/mysqld.pid diff --git a/wordpress-nginx_rhel7/roles/nginx/handlers/main.yml b/wordpress-nginx_rhel7/roles/nginx/handlers/main.yml new file mode 100644 index 0000000..16d8192 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/nginx/handlers/main.yml @@ -0,0 +1,3 @@ +--- +- name: restart nginx + service: name=nginx state=restarted enabled=yes diff --git a/wordpress-nginx_rhel7/roles/nginx/tasks/main.yml b/wordpress-nginx_rhel7/roles/nginx/tasks/main.yml new file mode 100644 index 0000000..16baaf7 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/nginx/tasks/main.yml @@ -0,0 +1,13 @@ +--- +- name: Install nginx + yum: name=nginx state=present + +- name: Copy nginx configuration for wordpress + template: src=default.conf dest=/etc/nginx/conf.d/default.conf + notify: restart nginx + +- name: insert firewalld rule for nginx + firewalld: port={{ nginx_port }}/tcp permanent=true state=enabled immediate=yes + +- name: http service state + service: name=nginx state=started enabled=yes diff --git a/wordpress-nginx_rhel7/roles/nginx/templates/default.conf b/wordpress-nginx_rhel7/roles/nginx/templates/default.conf new file mode 100644 index 0000000..bfa7a51 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/nginx/templates/default.conf @@ -0,0 +1,31 @@ +server { + listen {{ nginx_port }} default_server; + server_name {{ server_hostname }}; + root /srv/wordpress/ ; + + client_max_body_size 64M; + + # Deny access to any files with a .php extension in the uploads directory + location ~* /(?:uploads|files)/.*\.php$ { + deny all; + } + + location / { + index index.php index.html index.htm; + try_files $uri $uri/ /index.php?$args; + } + + location ~* \.(gif|jpg|jpeg|png|css|js)$ { + expires max; + } + + location ~ \.php$ { + try_files $uri =404; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_pass unix:/var/run/php-fpm/wordpress.sock; + fastcgi_param SCRIPT_FILENAME + $document_root$fastcgi_script_name; + include fastcgi_params; + } +} diff --git a/wordpress-nginx_rhel7/roles/php-fpm/handlers/main.yml b/wordpress-nginx_rhel7/roles/php-fpm/handlers/main.yml new file mode 100644 index 0000000..6a975ad --- /dev/null +++ b/wordpress-nginx_rhel7/roles/php-fpm/handlers/main.yml @@ -0,0 +1,3 @@ +--- +- name: restart php-fpm + service: name=php-fpm state=restarted diff --git a/wordpress-nginx_rhel7/roles/php-fpm/tasks/main.yml b/wordpress-nginx_rhel7/roles/php-fpm/tasks/main.yml new file mode 100644 index 0000000..e39b4f1 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/php-fpm/tasks/main.yml @@ -0,0 +1,22 @@ +--- +- name: Install php-fpm and deps + yum: name={{ item }} state=present + with_items: + - php + - php-fpm + - php-enchant + - php-IDNA_Convert + - php-mbstring + - php-mysql + - php-PHPMailer + - php-process + - php-simplepie + - php-xml + +- name: Disable default pool + command: mv /etc/php-fpm.d/www.conf /etc/php-fpm.d/www.disabled creates=/etc/php-fpm.d/www.disabled + notify: restart php-fpm + +- name: Copy php-fpm configuration + template: src=wordpress.conf dest=/etc/php-fpm.d/ + notify: restart php-fpm diff --git a/wordpress-nginx_rhel7/roles/php-fpm/templates/wordpress.conf b/wordpress-nginx_rhel7/roles/php-fpm/templates/wordpress.conf new file mode 100644 index 0000000..10434c5 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/php-fpm/templates/wordpress.conf @@ -0,0 +1,15 @@ +[wordpress] +listen = /var/run/php-fpm/wordpress.sock +listen.owner = nginx +listen.group = nginx +listen.mode = 0660 +user = wordpress +group = wordpress +pm = dynamic +pm.max_children = 10 +pm.start_servers = 1 +pm.min_spare_servers = 1 +pm.max_spare_servers = 3 +pm.max_requests = 500 +chdir = /srv/wordpress/ +php_admin_value[open_basedir] = /srv/wordpress/:/tmp diff --git a/wordpress-nginx_rhel7/roles/wordpress/tasks/main.yml b/wordpress-nginx_rhel7/roles/wordpress/tasks/main.yml new file mode 100644 index 0000000..8a577cb --- /dev/null +++ b/wordpress-nginx_rhel7/roles/wordpress/tasks/main.yml @@ -0,0 +1,60 @@ +--- +- name: Download WordPress + get_url: url=http://wordpress.org/wordpress-{{ wp_version }}.tar.gz dest=/srv/wordpress-{{ wp_version }}.tar.gz + sha256sum="{{ wp_sha256sum }}" + +- name: Extract archive + command: chdir=/srv/ /bin/tar xvf wordpress-{{ wp_version }}.tar.gz creates=/srv/wordpress + +- name: Add group "wordpress" + group: name=wordpress + +- name: Add user "wordpress" + user: name=wordpress group=wordpress home=/srv/wordpress/ + +- name: Fetch random salts for WordPress config + local_action: command curl https://api.wordpress.org/secret-key/1.1/salt/ + register: "wp_salt" + sudo: no + +- name: Create WordPress database + mysql_db: name={{ wp_db_name }} state=present + +- name: Create WordPress database user + mysql_user: name={{ wp_db_user }} password={{ wp_db_password }} priv={{ wp_db_name }}.*:ALL host='localhost' state=present + +- name: Copy WordPress config file + template: src=wp-config.php dest=/srv/wordpress/ + +- name: Change ownership of WordPress installation + file: path=/srv/wordpress/ owner=wordpress group=wordpress state=directory recurse=yes + +- name: install SEManage + yum: pkg=policycoreutils-python state=present + +- name: set the SELinux policy for the Wordpress directory + command: semanage fcontext -a -t httpd_sys_content_t "/srv/wordpress(/.*)?" + +- name: set the SELinux policy for wp-config.php + command: semanage fcontext -a -t httpd_sys_script_exec_t "/srv/wordpress/wp-config\.php" + +- name: set the SELinux policy for wp-content directory + command: semanage fcontext -a -t httpd_sys_rw_content_t "/srv/wordpress/wp-content(/.*)?" + +- name: set the SELinux policy for the *.php files + command: semanage fcontext -a -t httpd_sys_script_exec_t "/srv/wordpress/.*\.php" + +- name: set the SELinux policy for the Upgrade directory + command: semanage fcontext -a -t httpd_sys_rw_content_t "/srv/wordpress/wp-content/upgrade(/.*)?" + +- name: set the SELinux policy for the Uploads directory + command: semanage fcontext -a -t httpd_sys_rw_content_t "/srv/wordpress/wp-content/uploads(/.*)?" + +- name: set the SELinux policy for the wp-includes php files + command: semanage fcontext -a -t httpd_sys_script_exec_t "/srv/wordpress/wp-includes/.*\.php" + +- name: set the SELinux on all the Files + command: restorecon -Rv /srv/wordpress + +- name: Start php-fpm Service + service: name=php-fpm state=started enabled=yes diff --git a/wordpress-nginx_rhel7/roles/wordpress/templates/wp-config.php b/wordpress-nginx_rhel7/roles/wordpress/templates/wp-config.php new file mode 100644 index 0000000..5694520 --- /dev/null +++ b/wordpress-nginx_rhel7/roles/wordpress/templates/wp-config.php @@ -0,0 +1,90 @@ +