diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index f58497c..505287a 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -178,101 +178,7 @@ jobs: docker stop test-server || true docker rm test-server || true - test-centos: - name: Test on CentOS Stream - runs-on: ubuntu-latest - needs: lint - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Set up Python - uses: actions/setup-python@v4 - with: - python-version: '3.11' - - - name: Install Ansible - run: | - python -m pip install --upgrade pip - pip install ansible - - - name: Set up Docker - uses: docker/setup-buildx-action@v3 - - - name: Create test inventory - run: | - mkdir -p test-inventory - cat > test-inventory/hosts <> /etc/sudoers - # Configure SSH - RUN mkdir /var/run/sshd - RUN echo 'PermitRootLogin yes' >> /etc/ssh/sshd_config - RUN echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config - RUN echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config - RUN ssh-keygen -A - EXPOSE 22 - # Start SSH service in foreground to keep container running - CMD ["/usr/sbin/sshd", "-D"] - EOF - - - name: Run CentOS test container - run: | - # Generate SSH key (reuse from Ubuntu test) - mkdir -p ~/.ssh - if [ ! -f ~/.ssh/id_rsa ]; then - ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N "" - fi - - # Start container - docker run -d --name test-centos \ - -p 2223:22 \ - test-centos:stream9 - - # Wait for SSH to be ready - sleep 10 - - # Copy SSH key to container - docker exec test-centos mkdir -p /home/testuser/.ssh - docker cp ~/.ssh/id_rsa.pub test-centos:/home/testuser/.ssh/authorized_keys - docker exec test-centos chown -R testuser:testuser /home/testuser/.ssh - docker exec test-centos chmod 700 /home/testuser/.ssh - docker exec test-centos chmod 600 /home/testuser/.ssh/authorized_keys - - # Test if container is running - if ! docker ps | grep -q test-centos; then - echo "CentOS container failed to start, checking logs:" - docker logs test-centos - exit 1 - fi - - - name: Test LEMP installation on CentOS - run: | - # Just test syntax and basic functionality for CentOS - ansible-playbook -i test-inventory/hosts \ - playbooks/lemp-wordpress-multios.yml \ - --extra-vars "mysql_root_password=test123 wordpress_db_password=test123 wp_admin_password=test123" \ - --check \ - -v - continue-on-error: true - - - name: Cleanup CentOS - if: always() - run: | - docker stop test-centos || true - docker rm test-centos || true + security-scan: name: Security Scanning @@ -302,7 +208,7 @@ jobs: release: name: Create Release runs-on: ubuntu-latest - needs: [test-ubuntu, test-centos, security-scan] + needs: [test-ubuntu, security-scan] if: github.ref == 'refs/heads/main' && github.event_name == 'push' permissions: contents: write diff --git a/CHANGELOG.md b/CHANGELOG.md index faecb28..12ed301 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Contributing guidelines - Troubleshooting guide +### Changed +- **BREAKING**: Removed RedHat/CentOS/Rocky Linux support for stability +- Focused on Ubuntu/Debian family systems only +- Simplified CI/CD pipeline (removed CentOS tests) +- Unified variables into single debian-family.yml file +- Streamlined playbooks for better maintainability + +### Fixed +- WP-CLI download from official source +- MySQL user permissions for TCP connections +- PHP-FPM socket permissions +- Service management across different OS families + +### Removed +- RedHat/CentOS/Rocky Linux specific code and variables +- CentOS Docker tests from CI/CD pipeline +- Multi-OS complexity that caused maintenance issues + +## [1.0.0] - 2025-06-19 + +### Added +- SSL/HTTPS support with Let's Encrypt integration +- Ubuntu/Debian support (20.04, 22.04, 24.04, Debian 11, 12) +- GitHub Actions CI/CD pipeline +- Advanced WordPress features (Redis, Memcached, Fail2Ban) +- Automated backup system +- WordPress Multisite support +- Performance optimizations (OPcache, MySQL tuning) +- Security enhancements (Fail2Ban, ModSecurity ready) +- Comprehensive documentation +- Contributing guidelines +- Troubleshooting guide + ### Changed - Restructured project for better maintainability - Improved error handling in playbooks @@ -31,21 +64,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - MySQL user permissions for TCP connections - PHP-FPM socket permissions - Service management across different OS families - -## [1.0.0] - 2025-06-18 - -### Added -- Initial release -- Basic LEMP stack installation (Linux, Nginx, MySQL, PHP) -- WordPress installation and configuration -- WP-CLI integration -- Docker environment for testing -- Basic Ansible playbooks -- Templates for configuration files - -### Features -- Automated Nginx configuration -- MySQL database setup with security -- PHP-FPM optimization -- WordPress installation via WP-CLI -- Basic security configurations diff --git a/PROJECT_OVERVIEW.md b/PROJECT_OVERVIEW.md index 7eb9409..842bb84 100644 --- a/PROJECT_OVERVIEW.md +++ b/PROJECT_OVERVIEW.md @@ -4,7 +4,7 @@ ### πŸ“‹ Project Status: **Production Ready** βœ… -This project provides a complete, production-ready automation solution for deploying LEMP stack (Linux, Nginx, MySQL, PHP) with WordPress using Ansible. It supports multiple operating systems, environments, and includes advanced features for security, performance, and monitoring. +This project provides a complete, production-ready automation solution for deploying LEMP stack (Linux, Nginx, MySQL, PHP) with WordPress using Ansible. It supports Ubuntu/Debian systems and includes advanced features for security, performance, and monitoring. ## πŸ—οΈ Architecture @@ -13,21 +13,18 @@ ansible-lemp-wordpress/ β”œβ”€β”€ playbooks/ # Main automation playbooks β”‚ β”œβ”€β”€ lemp-wordpress.yml # Basic LEMP + WordPress β”‚ β”œβ”€β”€ lemp-wordpress-ssl.yml # LEMP + WordPress + SSL -β”‚ β”œβ”€β”€ lemp-wordpress-multios.yml # Multi-OS support β”‚ β”œβ”€β”€ install-wordpress-official.yml # WordPress installation +β”‚ β”œβ”€β”€ ultimate-performance-optimization.yml # Performance features β”‚ └── wordpress-advanced-features.yml # Advanced features β”œβ”€β”€ templates/ # Configuration templates β”‚ β”œβ”€β”€ wp-config.php.j2 # WordPress configuration -β”‚ β”œβ”€β”€ wordpress.nginx.j2 # Basic Nginx config +β”‚ β”œβ”€β”€ wordpress.nginx.j2 # Nginx configuration β”‚ β”œβ”€β”€ wordpress-ssl.nginx.j2 # SSL Nginx config -β”‚ β”œβ”€β”€ wordpress-redhat.nginx.j2 # RedHat/CentOS Nginx config β”‚ β”œβ”€β”€ wordpress-backup.sh.j2 # Backup script β”‚ β”œβ”€β”€ fail2ban-wordpress.conf.j2 # Fail2Ban config β”‚ └── wp-cli.yml.j2 # WP-CLI configuration -β”œβ”€β”€ vars/ # OS-specific variables -β”‚ β”œβ”€β”€ ubuntu.yml # Ubuntu/Debian variables -β”‚ β”œβ”€β”€ debian.yml # Debian-specific variables -β”‚ └── redhat.yml # CentOS/RHEL/Rocky variables +β”œβ”€β”€ vars/ # System variables +β”‚ └── debian-family.yml # Ubuntu/Debian variables β”œβ”€β”€ inventory/ # Inventory examples β”‚ β”œβ”€β”€ docker.ini # Docker environment β”‚ β”œβ”€β”€ production.example # Production template @@ -42,9 +39,8 @@ ansible-lemp-wordpress/ β”‚ β”œβ”€β”€ troubleshooting.md # Troubleshooting guide β”‚ └── contributing.md # Contributing guidelines β”œβ”€β”€ .github/workflows/ # CI/CD automation -β”‚ β”œβ”€β”€ ci-cd.yml # Main CI/CD pipeline -β”‚ └── docs.yml # Documentation deployment -β”œβ”€β”€ tests/ # Test scripts (future) +β”‚ └── ci-cd.yml # Main CI/CD pipeline +β”œβ”€β”€ tests/ # Test scripts β”œβ”€β”€ CHANGELOG.md # Version history β”œβ”€β”€ LICENSE # MIT License β”œβ”€β”€ README.md # Main documentation @@ -57,9 +53,6 @@ ansible-lemp-wordpress/ ### Operating Systems - βœ… **Ubuntu** 20.04, 22.04, 24.04 LTS - βœ… **Debian** 11, 12 -- βœ… **CentOS Stream** 9 -- βœ… **RHEL** 9 -- βœ… **Rocky Linux** 9 ### Deployment Targets - βœ… **Docker** containers (development/testing) diff --git a/README.md b/README.md index 96fc031..5316707 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,8 @@ πŸš€ **Fully automated LEMP stack (Linux, Nginx, MySQL, PHP) + WordPress deployment using Ansible** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) -[![Ubuntu](https://img.shields.io/badge/Ubuntu-24.04%20LTS-orange)](https://ubuntu.com/) +[![Ubuntu](https://img.shields.io/badge/Ubuntu-20.04%20|%2022.04%20|%2024.04-orange)](https://ubuntu.com/) +[![Debian](https://img.shields.io/badge/Debian-11%20|%2012-red)](https://debian.org/) [![Ansible](https://img.shields.io/badge/Ansible-6.0+-red)](https://www.ansible.com/) [![WordPress](https://img.shields.io/badge/WordPress-6.8+-blue)](https://wordpress.org/) @@ -14,7 +15,7 @@ - Nginx web server with optimized configuration - MySQL 8.0+ with secure setup - PHP 8.3+ with FPM and WordPress extensions -- Multi-OS support (Ubuntu, Debian, CentOS, RHEL, Rocky Linux) +- Ubuntu/Debian family support (20.04, 22.04, 24.04, Debian 11, 12) ### WordPress & Security βœ… **WordPress Automation** @@ -126,7 +127,7 @@ ansible-lemp-wordpress/ ### Server Requirements -- **OS**: Ubuntu 24.04+, Debian 12+, CentOS 8+, Rocky Linux 8+ +- **OS**: Ubuntu 20.04+, Debian 11+ - **RAM**: Minimum 1GB (2GB+ recommended) - **Storage**: Minimum 10GB free space - **Network**: SSH access + web ports (80/443) @@ -236,15 +237,15 @@ ansible-playbook -i inventory/production playbooks/wordpress-advanced-features.y - **Backup automation** with retention policies - **Health checks** and self-healing capabilities -## 🌍 Multi-OS Support +## 🌍 Ubuntu/Debian Support | OS | Version | Status | |---|---|---| | Ubuntu | 24.04 LTS | βœ… Fully Tested | | Ubuntu | 22.04 LTS | βœ… Supported | -| Debian | 12+ | βœ… Supported | -| CentOS | 8+ | πŸ”„ In Progress | -| Rocky Linux | 8+ | πŸ”„ In Progress | +| Ubuntu | 20.04 LTS | βœ… Supported | +| Debian | 12 | βœ… Supported | +| Debian | 11 | βœ… Supported | ## πŸ“š Documentation diff --git a/playbooks/lemp-wordpress-multios.yml b/playbooks/lemp-wordpress-multios.yml deleted file mode 100644 index a2a99f8..0000000 --- a/playbooks/lemp-wordpress-multios.yml +++ /dev/null @@ -1,358 +0,0 @@ ---- -# Multi-OS LEMP WordPress installation with auto-detection -- name: Install LEMP stack with WordPress (Multi-OS Support) - hosts: all - become: yes - - pre_tasks: - - name: Gather OS facts - setup: - gather_subset: - - '!all' - - '!min' - - 'distribution' - - 'distribution_version' - - 'os_family' - - - name: Load OS-specific variables - include_vars: "../vars/{{ ansible_os_family | lower }}.yml" - - - name: Debug OS information - debug: - msg: | - OS Family: {{ ansible_os_family }} - Distribution: {{ ansible_distribution }} - Version: {{ ansible_distribution_version }} - Using variables from: vars/{{ ansible_os_family | lower }}.yml - - vars: - # WordPress Configuration - wordpress_path: "{{ web_root }}" - wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}" - - # Database Configuration - mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}" - wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}" - wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}" - wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}" - - # WordPress Admin - wp_admin_user: "{{ wp_admin_user | default('admin') }}" - wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}" - wp_admin_email: "{{ wp_admin_email | default('admin@localhost') }}" - wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}" - - tasks: - # Repository Setup for RedHat family - - name: Enable EPEL repository (RedHat/CentOS) - package: - name: "{{ epel_release }}" - state: present - when: ansible_os_family == "RedHat" - tags: repos - - - name: Install Remi repository (RedHat/CentOS) - yum: - name: "{{ remi_release }}" - state: present - when: ansible_os_family == "RedHat" - tags: repos - - - name: Enable Remi PHP repository (RedHat/CentOS) - command: "yum-config-manager --enable remi-php{{ php_version | replace('.', '') }}" - when: ansible_os_family == "RedHat" - tags: repos - - # Package Installation - - name: Update package cache (Debian/Ubuntu) - apt: - update_cache: yes - cache_valid_time: 3600 - when: ansible_os_family == "Debian" - tags: packages - - - name: Install Nginx - package: - name: "{{ nginx_package }}" - state: present - tags: nginx - - - name: Install MySQL/MariaDB packages - package: - name: "{{ mysql_packages }}" - state: present - tags: mysql - - - name: Install PHP packages - package: - name: "{{ php_packages }}" - state: present - tags: php - - - name: Install additional tools (Debian/Ubuntu) - package: - name: - - curl - - wget - - unzip - - git - state: present - when: ansible_os_family == "Debian" - tags: tools - - - name: Install additional tools (RedHat/CentOS) - yum: - name: - - curl - - wget - - unzip - - git - state: present - allowerasing: yes - when: ansible_os_family == "RedHat" - tags: tools - - # Service Management - - name: Start and enable Nginx - service: - name: "{{ nginx_service }}" - state: started - enabled: yes - tags: nginx - - - name: Start and enable MySQL/MariaDB - service: - name: "{{ mysql_service }}" - state: started - enabled: yes - tags: mysql - - - name: Start and enable PHP-FPM - service: - name: "{{ php_fpm_service }}" - state: started - enabled: yes - tags: php - - # SELinux Configuration (RedHat family) - - name: Configure SELinux booleans for web services - seboolean: - name: "{{ item }}" - state: yes - persistent: yes - loop: "{{ selinux_booleans }}" - when: ansible_os_family == "RedHat" and ansible_selinux.status == "enabled" - tags: selinux - - # Firewall Configuration - - name: Configure firewall (UFW - Debian/Ubuntu) - ufw: - rule: allow - port: "{{ item }}" - proto: tcp - loop: - - "22" - - "80" - - "443" - when: ansible_os_family == "Debian" - tags: firewall - - - name: Configure firewall (firewalld - RedHat/CentOS) - firewalld: - service: "{{ item }}" - permanent: yes - state: enabled - immediate: yes - loop: - - ssh - - http - - https - when: ansible_os_family == "RedHat" - tags: firewall - - # MySQL Security - - name: Set MySQL root password - mysql_user: - name: root - password: "{{ mysql_root_password }}" - login_unix_socket: "{{ mysql_socket }}" - state: present - tags: mysql - - - name: Create MySQL configuration for root - template: - src: ../templates/my.cnf.j2 - dest: /root/.my.cnf - mode: '0600' - tags: mysql - - - name: Remove anonymous MySQL users - mysql_user: - name: "" - host_all: yes - state: absent - tags: mysql - - - name: Remove MySQL test database - mysql_db: - name: test - state: absent - tags: mysql - - # WordPress Database Setup - - name: Create WordPress database - mysql_db: - name: "{{ wordpress_db_name }}" - state: present - tags: mysql - - - name: Create WordPress database user - mysql_user: - name: "{{ wordpress_db_user }}" - password: "{{ wordpress_db_password }}" - priv: "{{ wordpress_db_name }}.*:ALL" - host: localhost - state: present - tags: mysql - - # WordPress Installation - - name: Create web root directory - file: - path: "{{ wordpress_path }}" - state: directory - owner: "{{ nginx_user }}" - group: "{{ nginx_user }}" - mode: '0755' - tags: wordpress - - - name: Download WordPress - get_url: - url: https://wordpress.org/latest.tar.gz - dest: /tmp/wordpress.tar.gz - mode: '0644' - tags: wordpress - - - name: Extract WordPress - unarchive: - src: /tmp/wordpress.tar.gz - dest: /tmp/ - remote_src: yes - tags: wordpress - - - name: Copy WordPress files - command: "cp -r /tmp/wordpress/* {{ wordpress_path }}/" - args: - creates: "{{ wordpress_path }}/wp-config-sample.php" - tags: wordpress - - - name: Set WordPress file permissions - file: - path: "{{ wordpress_path }}" - owner: "{{ nginx_user }}" - group: "{{ nginx_user }}" - recurse: yes - tags: wordpress - - # Nginx Configuration - - name: Configure Nginx for WordPress (Debian/Ubuntu) - template: - src: ../templates/wordpress.nginx.j2 - dest: "{{ nginx_sites_available }}/wordpress" - when: ansible_os_family == "Debian" - notify: restart nginx - tags: nginx - - - name: Configure Nginx for WordPress (RedHat/CentOS) - template: - src: ../templates/wordpress-redhat.nginx.j2 - dest: "{{ nginx_sites_available }}/wordpress.conf" - when: ansible_os_family == "RedHat" - notify: restart nginx - tags: nginx - - - name: Enable WordPress site (Debian/Ubuntu) - file: - src: "{{ nginx_sites_available }}/wordpress" - dest: "{{ nginx_sites_enabled }}/wordpress" - state: link - when: ansible_os_family == "Debian" - notify: restart nginx - tags: nginx - - - name: Remove default Nginx site (Debian/Ubuntu) - file: - path: "{{ nginx_sites_enabled }}/default" - state: absent - when: ansible_os_family == "Debian" - notify: restart nginx - tags: nginx - - # PHP Configuration - - name: Configure PHP-FPM pool - template: - src: ../templates/www.conf.j2 - dest: "{{ php_fpm_pool_dir }}/www.conf" - backup: yes - notify: restart php-fpm - tags: php - - - name: Configure PHP settings - lineinfile: - path: "{{ php_ini_path }}" - regexp: "{{ item.regexp }}" - line: "{{ item.line }}" - backup: yes - loop: - - { regexp: '^upload_max_filesize', line: 'upload_max_filesize = 64M' } - - { regexp: '^post_max_size', line: 'post_max_size = 64M' } - - { regexp: '^memory_limit', line: 'memory_limit = 256M' } - - { regexp: '^max_execution_time', line: 'max_execution_time = 300' } - notify: restart php-fpm - tags: php - - # WordPress Configuration - - name: Configure WordPress - template: - src: ../templates/wp-config.php.j2 - dest: "{{ wordpress_path }}/wp-config.php" - owner: "{{ nginx_user }}" - group: "{{ nginx_user }}" - mode: '0600' - tags: wordpress - - # WP-CLI Installation - - name: Download WP-CLI - get_url: - url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar - dest: /usr/local/bin/wp - mode: '0755' - tags: wp-cli - - - name: Verify WP-CLI installation - command: wp --info - become_user: "{{ nginx_user }}" - environment: - HOME: "{{ wordpress_path }}" - register: wp_cli_info - tags: wp-cli - - - name: Display WP-CLI info - debug: - var: wp_cli_info.stdout_lines - tags: wp-cli - - handlers: - - name: restart nginx - service: - name: "{{ nginx_service }}" - state: restarted - - - name: restart php-fpm - service: - name: "{{ php_fpm_service }}" - state: restarted - - - name: restart mysql - service: - name: "{{ mysql_service }}" - state: restarted diff --git a/playbooks/lemp-wordpress-ssl.yml b/playbooks/lemp-wordpress-ssl.yml index 21dd40e..b986f67 100644 --- a/playbooks/lemp-wordpress-ssl.yml +++ b/playbooks/lemp-wordpress-ssl.yml @@ -44,16 +44,7 @@ - python3-certbot-nginx state: present update_cache: yes - when: enable_ssl and ansible_os_family == "Debian" - tags: ssl - - - name: Install Certbot for Let's Encrypt (CentOS/RHEL) - yum: - name: - - certbot - - python3-certbot-nginx - state: present - when: enable_ssl and ansible_os_family == "RedHat" + when: enable_ssl tags: ssl - name: Check if SSL certificate exists diff --git a/playbooks/lemp-wordpress.yml b/playbooks/lemp-wordpress.yml index 1da89d7..52b13f4 100644 --- a/playbooks/lemp-wordpress.yml +++ b/playbooks/lemp-wordpress.yml @@ -1,168 +1,272 @@ --- -- name: LEMP Stack + WordPress Installation auf Ubuntu - hosts: testservers +# Ubuntu/Debian LEMP WordPress installation +- name: Install LEMP stack with WordPress (Ubuntu/Debian) + hosts: all become: yes + + pre_tasks: + - name: Gather OS facts + setup: + gather_subset: + - '!all' + - '!min' + - 'distribution' + - 'distribution_version' + - 'os_family' + + - name: Load Debian family variables + include_vars: "../vars/debian-family.yml" + + - name: Debug OS information + debug: + msg: | + OS Family: {{ ansible_os_family }} + Distribution: {{ ansible_distribution }} + Version: {{ ansible_distribution_version }} + Supported: Ubuntu/Debian family systems + + - name: Verify supported OS + fail: + msg: "This playbook only supports Ubuntu/Debian systems. Detected: {{ ansible_os_family }}" + when: ansible_os_family != "Debian" + vars: - mysql_root_password: "secure_root_pass_123" - wordpress_db_name: "wordpress" - wordpress_db_user: "wp_user" - wordpress_db_password: "wp_secure_pass_123" - wordpress_admin_user: "admin" - wordpress_admin_password: "admin_secure_pass_123" - wordpress_admin_email: "admin@example.com" - domain_name: "localhost" + # WordPress Configuration + wordpress_path: "{{ web_root }}" + wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}" + + # Database Configuration + mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}" + wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}" + wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}" + wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}" + + # WordPress Admin + wp_admin_user: "{{ wp_admin_user | default('admin') }}" + wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}" + wp_admin_email: "{{ wp_admin_email | default('admin@localhost') }}" + wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}" tasks: - - name: System aktualisieren + # Package Installation + - name: Update package cache apt: update_cache: yes - upgrade: dist cache_valid_time: 3600 + tags: packages - - name: Notwendige Pakete installieren - apt: - name: - - nginx - - mysql-server - - php8.3-fpm - - php8.3-mysql - - php8.3-curl - - php8.3-gd - - php8.3-intl - - php8.3-mbstring - - php8.3-soap - - php8.3-xml - - php8.3-xmlrpc - - php8.3-zip - - curl - - wget - - unzip - - python3-pymysql + - name: Install all required packages + package: + name: "{{ packages }}" state: present + tags: packages - - name: MySQL-Service starten und aktivieren - shell: | - service mysql start - update-rc.d mysql enable - become: yes + # Service Management + - name: Start and enable Nginx + service: + name: "{{ nginx_service }}" + state: started + enabled: yes + tags: nginx - - name: MySQL root-Passwort setzen + - name: Start and enable MySQL/MariaDB + service: + name: "{{ mysql_service }}" + state: started + enabled: yes + tags: mysql + + - name: Start and enable PHP-FPM + service: + name: "{{ php_fpm_service }}" + state: started + enabled: yes + tags: php + + # Firewall Configuration + - name: Configure firewall (UFW) + ufw: + rule: allow + port: "{{ item }}" + proto: tcp + loop: + - "22" + - "80" + - "443" + tags: firewall + + # MySQL Security + - name: Set MySQL root password mysql_user: name: root password: "{{ mysql_root_password }}" login_unix_socket: /var/run/mysqld/mysqld.sock - column_case_sensitive: false state: present + tags: mysql - - name: MySQL-Konfiguration fΓΌr root - copy: - content: | - [client] - user=root - password={{ mysql_root_password }} + - name: Create MySQL configuration for root + template: + src: ../templates/my.cnf.j2 dest: /root/.my.cnf mode: '0600' + tags: mysql - - name: WordPress-Datenbank erstellen + - name: Remove anonymous MySQL users + mysql_user: + name: "" + host_all: yes + state: absent + tags: mysql + + - name: Remove MySQL test database + mysql_db: + name: test + state: absent + tags: mysql + + # WordPress Database Setup + - name: Create WordPress database mysql_db: name: "{{ wordpress_db_name }}" state: present - login_user: root - login_password: "{{ mysql_root_password }}" + tags: mysql - - name: WordPress-Datenbankuser erstellen + - name: Create WordPress database user mysql_user: name: "{{ wordpress_db_user }}" password: "{{ wordpress_db_password }}" priv: "{{ wordpress_db_name }}.*:ALL" - column_case_sensitive: false + host: localhost state: present - login_user: root - login_password: "{{ mysql_root_password }}" + tags: mysql - - name: WordPress herunterladen - get_url: - url: https://wordpress.org/latest.tar.gz - dest: /tmp/wordpress.tar.gz - - - name: WordPress entpacken - unarchive: - src: /tmp/wordpress.tar.gz - dest: /tmp - remote_src: yes - - - name: WordPress-Dateien kopieren - copy: - src: /tmp/wordpress/ - dest: /var/www/html/ - remote_src: yes - owner: www-data - group: www-data - mode: '0755' - - - name: wp-config.php erstellen - template: - src: wp-config.php.j2 - dest: /var/www/html/wp-config.php - owner: www-data - group: www-data - mode: '0644' - - - name: Nginx-Konfiguration fΓΌr WordPress - template: - src: wordpress.nginx.j2 - dest: /etc/nginx/sites-available/wordpress - backup: yes - - - name: Standard Nginx-Site deaktivieren + # WordPress Installation + - name: Create web root directory file: - path: /etc/nginx/sites-enabled/default - state: absent - - - name: WordPress-Site aktivieren - file: - src: /etc/nginx/sites-available/wordpress - dest: /etc/nginx/sites-enabled/wordpress - state: link - - - name: Nginx-Konfiguration testen - command: nginx -t - register: nginx_test - failed_when: nginx_test.rc != 0 - - - name: PHP-FPM Service starten - shell: service php8.3-fpm start - become: yes - - - name: Nginx Service neustarten - shell: service nginx restart - become: yes - - - name: WordPress-Verzeichnis-Berechtigungen setzen - file: - path: /var/www/html - owner: www-data - group: www-data - recurse: yes - mode: '0755' - - - name: Spezielle WordPress-Verzeichnisse erstellen - file: - path: "{{ item }}" + path: "{{ wordpress_path }}" state: directory owner: www-data group: www-data mode: '0755' - loop: - - /var/www/html/wp-content/uploads - - /var/www/html/wp-content/upgrade + tags: wordpress - - name: Installation abgeschlossen - Info ausgeben + - name: Download WordPress + get_url: + url: https://wordpress.org/latest.tar.gz + dest: /tmp/wordpress.tar.gz + mode: '0644' + tags: wordpress + + - name: Extract WordPress + unarchive: + src: /tmp/wordpress.tar.gz + dest: /tmp/ + remote_src: yes + tags: wordpress + + - name: Copy WordPress files + command: "cp -r /tmp/wordpress/* {{ wordpress_path }}/" + args: + creates: "{{ wordpress_path }}/wp-config-sample.php" + tags: wordpress + + - name: Set WordPress file permissions + file: + path: "{{ wordpress_path }}" + owner: "{{ nginx_user }}" + group: "{{ nginx_user }}" + recurse: yes + tags: wordpress + + # Nginx Configuration + - name: Configure Nginx for WordPress + template: + src: ../templates/wordpress.nginx.j2 + dest: "{{ nginx_sites_available }}/wordpress" + notify: restart nginx + tags: nginx + + - name: Enable WordPress site + file: + src: "{{ nginx_sites_available }}/wordpress" + dest: "{{ nginx_sites_enabled }}/wordpress" + state: link + notify: restart nginx + tags: nginx + + - name: Remove default Nginx site + file: + path: "{{ nginx_sites_enabled }}/default" + state: absent + notify: restart nginx + tags: nginx + + # PHP Configuration + - name: Configure PHP-FPM pool + template: + src: ../templates/www.conf.j2 + dest: "{{ php_fpm_pool_path }}/www.conf" + backup: yes + notify: restart php-fpm + tags: php + + - name: Configure PHP settings + lineinfile: + path: "{{ php_cli_config_path }}/php.ini" + regexp: "{{ item.regexp }}" + line: "{{ item.line }}" + backup: yes + loop: + - { regexp: '^upload_max_filesize', line: 'upload_max_filesize = 64M' } + - { regexp: '^post_max_size', line: 'post_max_size = 64M' } + - { regexp: '^memory_limit', line: 'memory_limit = 256M' } + - { regexp: '^max_execution_time', line: 'max_execution_time = 300' } + notify: restart php-fpm + tags: php + + # WordPress Configuration + - name: Configure WordPress + template: + src: ../templates/wp-config.php.j2 + dest: "{{ wordpress_path }}/wp-config.php" + owner: www-data + group: www-data + mode: '0600' + tags: wordpress + + # WP-CLI Installation + - name: Download WP-CLI + get_url: + url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar + dest: /usr/local/bin/wp + mode: '0755' + tags: wp-cli + + - name: Verify WP-CLI installation + command: wp --info + become_user: www-data + environment: + HOME: "{{ wordpress_path }}" + register: wp_cli_info + tags: wp-cli + + - name: Display WP-CLI info debug: - msg: | - WordPress-Installation abgeschlossen! - URL: http://{{ domain_name }}:8080 - Admin-User: {{ wordpress_admin_user }} - Admin-Passwort: {{ wordpress_admin_password }} - DB-Name: {{ wordpress_db_name }} - DB-User: {{ wordpress_db_user }} + var: wp_cli_info.stdout_lines + tags: wp-cli + + handlers: + - name: restart nginx + service: + name: "{{ nginx_service }}" + state: restarted + + - name: restart php-fpm + service: + name: "{{ php_fpm_service }}" + state: restarted + + - name: restart mysql + service: + name: "{{ mysql_service }}" + state: restarted diff --git a/templates/wordpress-redhat.nginx.j2 b/templates/wordpress-redhat.nginx.j2 deleted file mode 100644 index 9cc0f81..0000000 --- a/templates/wordpress-redhat.nginx.j2 +++ /dev/null @@ -1,75 +0,0 @@ -server { - listen 80; - server_name {{ domain_name | default('_') }}; - - root {{ wordpress_path }}; - index index.php index.html index.htm; - - # Logging - access_log {{ log_dir }}/nginx/wordpress_access.log; - error_log {{ log_dir }}/nginx/wordpress_error.log; - - # WordPress specific rules - location / { - try_files $uri $uri/ /index.php?$args; - } - - location ~ \.php$ { - fastcgi_pass unix:{{ php_fpm_socket }}; - fastcgi_index index.php; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - include fastcgi_params; - - # Security - fastcgi_hide_header X-Powered-By; - } - - # Deny access to hidden files - location ~ /\. { - deny all; - access_log off; - log_not_found off; - } - - # WordPress uploads - location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ { - expires 1y; - add_header Cache-Control "public, immutable"; - access_log off; - } - - # WordPress security - location ~* ^/(wp-config\.php|wp-config-sample\.php|readme\.html|license\.txt)$ { - deny all; - access_log off; - log_not_found off; - } - - # Deny access to any files with a .php extension in the uploads directory - location ~* /(?:uploads|files)/.*\.php$ { - deny all; - access_log off; - log_not_found off; - } - - # WordPress REST API and XMLRPC protection - location = /xmlrpc.php { - deny all; - access_log off; - log_not_found off; - } - - # Block access to wp-includes folders and files - location ~* ^/wp-includes/.*.php$ { - deny all; - access_log off; - log_not_found off; - } - - # Block wp-content/uploads php files - location ~* ^/wp-content/uploads/.*.php$ { - deny all; - access_log off; - log_not_found off; - } -} diff --git a/vars/ubuntu.yml b/vars/debian-family.yml similarity index 81% rename from vars/ubuntu.yml rename to vars/debian-family.yml index aecdff9..0b39425 100644 --- a/vars/ubuntu.yml +++ b/vars/debian-family.yml @@ -1,6 +1,6 @@ -# Ubuntu-specific variables +# Ubuntu/Debian family variables --- -# Package names for Ubuntu +# Package names for Ubuntu/Debian systems packages: - nginx - mysql-server @@ -37,3 +37,9 @@ nginx_sites_enabled: /etc/nginx/sites-enabled # MySQL paths mysql_config_path: /etc/mysql + +# Default PHP version +php_version: "8.3" + +# System paths +web_root: /var/www/html diff --git a/vars/debian.yml b/vars/debian.yml deleted file mode 100644 index c7f6ef5..0000000 --- a/vars/debian.yml +++ /dev/null @@ -1,39 +0,0 @@ -# Debian-specific variables ---- -# Package names for Debian (similar to Ubuntu but may have version differences) -packages: - - nginx - - mariadb-server - - php8.2-fpm - - php8.2-mysql - - php8.2-curl - - php8.2-gd - - php8.2-intl - - php8.2-mbstring - - php8.2-soap - - php8.2-xml - - php8.2-xmlrpc - - php8.2-zip - - python3-pymysql - - unzip - -# Service names -mysql_service: mariadb -nginx_service: nginx -php_fpm_service: php8.2-fpm - -# Package manager -package_manager: apt - -# PHP paths -php_fpm_config_path: /etc/php/8.2/fpm -php_cli_config_path: /etc/php/8.2/cli -php_fpm_pool_path: /etc/php/8.2/fpm/pool.d - -# Nginx paths -nginx_config_path: /etc/nginx -nginx_sites_available: /etc/nginx/sites-available -nginx_sites_enabled: /etc/nginx/sites-enabled - -# MySQL paths -mysql_config_path: /etc/mysql diff --git a/vars/redhat.yml b/vars/redhat.yml deleted file mode 100644 index 855089b..0000000 --- a/vars/redhat.yml +++ /dev/null @@ -1,67 +0,0 @@ ---- -# CentOS/RHEL/Rocky Linux specific variables -ansible_python_interpreter: /usr/bin/python3 - -# Package names -nginx_package: nginx -mysql_packages: - - mariadb-server - - mariadb - - python3-PyMySQL -php_packages: - - php - - php-fpm - - php-mysqlnd # Correct package name for CentOS - - php-gd - - php-xml - - php-mbstring - - php-curl - - php-zip - - php-intl - - php-soap - - php-opcache - -# Service names -nginx_service: nginx -mysql_service: mariadb -php_fpm_service: php-fpm - -# PHP Configuration -php_version: "8.1" # Default PHP version for CentOS 9 -php_fpm_socket: /run/php-fpm/www.sock -php_fpm_pool_dir: /etc/php-fpm.d -php_ini_path: /etc/php.ini -php_fpm_conf: /etc/php-fpm.d/www.conf - -# Nginx Configuration -nginx_conf_dir: /etc/nginx -nginx_sites_available: /etc/nginx/conf.d -nginx_sites_enabled: /etc/nginx/conf.d -nginx_user: nginx - -# MySQL Configuration -mysql_conf_dir: /etc/mysql -mysql_conf_file: /etc/my.cnf.d/mysql-server.cnf -mysql_socket: /var/lib/mysql/mysql.sock -mysql_pid_file: /var/run/mariadb/mariadb.pid -mysql_log_error: /var/log/mariadb/mariadb.log - -# System paths -web_root: /var/www/html -log_dir: /var/log - -# Package manager -package_manager: yum - -# Additional repositories needed -epel_release: epel-release -remi_release: "https://rpms.remirepo.net/enterprise/remi-release-{{ ansible_distribution_major_version }}.rpm" - -# SELinux booleans for web services -selinux_booleans: - - httpd_can_network_connect - - httpd_execmem - - httpd_unified - -# Firewall service -firewall_service: firewalld