spalencsar/ansible-lemp-wordpress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

🚀 Initial release: Complete Ansible LEMP WordPress automation

Browse Source 
✨ Features:
- Complete LEMP stack automation
- WordPress with WP-CLI
- Redis Object Cache (50% performance boost)
- Multi-OS support
- SSL/Let's Encrypt integration
- Security hardening
- Enterprise features
- Docker testing environment
- GitHub Actions CI/CD
- Comprehensive documentation

🧪 Fully tested and production-ready

Copyright (c) 2025 Sebastian Palencsár
This commit is contained in:
Sebastian Palencsár
2025-06-18 18:24:03 +02:00
commit 573224a36b
61 changed files with 6629 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

159
playbooks/install-wordpress-official.yml Normal file
View File

@@ -0,0 +1,159 @@
---
- name: WordPress mit offiziellem WP-CLI installieren
hosts: testservers
become: yes
tasks:
- name: WP-CLI von wp-cli.org herunterladen (offizielle Methode)
shell: |
cd /tmp
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar
mv wp-cli.phar /usr/local/bin/wp
- name: WP-CLI testen
shell: wp --info --allow-root
register: wp_cli_test
environment:
WP_CLI_ALLOW_ROOT: 1
- name: WP-CLI Info
debug:
var: wp_cli_test.stdout_lines
- name: WordPress-Datenbank für WP-CLI vorbereiten
shell: |
mysql -h 127.0.0.1 -P 3306 -u root -psecure_root_pass_123 -e "
DROP DATABASE IF EXISTS wordpress;
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
FLUSH PRIVILEGES;
"
- name: Alte WordPress-Dateien entfernen (außer wp-content)
shell: |
cd /var/www/html
find . -maxdepth 1 -name "*.php" -delete
find . -maxdepth 1 -name "*.html" -delete
find . -maxdepth 1 -name "*.txt" -delete
rm -rf wp-admin wp-includes
ls -la
register: cleanup
- name: Cleanup-Ergebnis
debug:
var: cleanup.stdout_lines
- name: WordPress-Core mit WP-CLI herunterladen
shell: |
cd /var/www/html
wp core download --allow-root --force
register: wp_download
environment:
WP_CLI_ALLOW_ROOT: 1
- name: WordPress-Download Ergebnis
debug:
var: wp_download.stdout_lines
- name: wp-config.php mit WP-CLI erstellen
shell: |
cd /var/www/html
wp config create \
--dbname=wordpress \
--dbuser=wp_user \
--dbpass=wp_secure_pass_123 \
--dbhost=127.0.0.1:3306 \
--dbcharset=utf8mb4 \
--allow-root \
--force
register: wp_config
environment:
WP_CLI_ALLOW_ROOT: 1
- name: wp-config Ergebnis
debug:
var: wp_config.stdout_lines
- name: WordPress mit WP-CLI installieren
shell: |
cd /var/www/html
wp core install \
--url="http://localhost:8080" \
--title="WordPress Test Site" \
--admin_user="admin" \
--admin_password="admin123" \
--admin_email="admin@example.com" \
--allow-root
register: wp_install
environment:
WP_CLI_ALLOW_ROOT: 1
- name: WordPress-Installation Ergebnis
debug:
var: wp_install.stdout_lines
- name: WordPress-Berechtigungen korrekt setzen
shell: |
cd /var/www/html
chown -R www-data:www-data .
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.php
- name: WordPress-Status mit WP-CLI prüfen
shell: |
cd /var/www/html
echo "=== WordPress Version ==="
wp core version --allow-root
echo "=== Site-URLs ==="
wp option get siteurl --allow-root
wp option get home --allow-root
echo "=== Benutzer ==="
wp user list --allow-root
echo "=== Plugins ==="
wp plugin list --allow-root
echo "=== Themes ==="
wp theme list --allow-root
register: wp_status
environment:
WP_CLI_ALLOW_ROOT: 1
- name: WordPress-Status
debug:
var: wp_status.stdout_lines
- name: Services neustarten
shell: |
service php8.3-fpm restart
service nginx restart
- name: WordPress-Homepage testen
uri:
url: http://localhost
method: GET
return_content: yes
register: homepage_test
ignore_errors: yes
- name: Homepage-Inhalt prüfen
debug:
msg: |
Status: {{ homepage_test.status | default('Fehler') }}
Content-Length: {{ homepage_test.content | length if homepage_test.content is defined else 0 }}
Enthält WordPress: {{ 'Ja' if homepage_test.content is defined and 'WordPress' in homepage_test.content else 'Nein' }}
- name: Erfolgreiche Installation
debug:
msg: |
🎉 WordPress erfolgreich installiert!
📱 URLs:
- Homepage: http://localhost:8080
- Admin: http://localhost:8080/wp-admin
🔑 Login-Daten:
- Benutzername: admin
- Passwort: admin123
- E-Mail: admin@example.com
🛠 WP-CLI verfügbar unter: wp --allow-root

345
playbooks/lemp-wordpress-multios.yml Normal file
View File

@@ -0,0 +1,345 @@
---
# Multi-OS LEMP WordPress installation with auto-detection
- name: Install LEMP stack with WordPress (Multi-OS Support)
hosts: all
become: yes
pre_tasks:
- name: Gather OS facts
setup:
gather_subset:
- '!all'
- '!min'
- 'distribution'
- 'distribution_version'
- 'os_family'
- name: Load OS-specific variables
include_vars: "../vars/{{ ansible_os_family | lower }}.yml"
- name: Debug OS information
debug:
msg: |
OS Family: {{ ansible_os_family }}
Distribution: {{ ansible_distribution }}
Version: {{ ansible_distribution_version }}
Using variables from: vars/{{ ansible_os_family | lower }}.yml
vars:
# WordPress Configuration
wordpress_path: "{{ web_root }}"
wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}"
# Database Configuration
mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}"
wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}"
# WordPress Admin
wp_admin_user: "{{ wp_admin_user | default('admin') }}"
wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}"
wp_admin_email: "{{ wp_admin_email | default('admin@localhost') }}"
wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}"
tasks:
# Repository Setup for RedHat family
- name: Enable EPEL repository (RedHat/CentOS)
package:
name: "{{ epel_release }}"
state: present
when: ansible_os_family == "RedHat"
tags: repos
- name: Install Remi repository (RedHat/CentOS)
yum:
name: "{{ remi_release }}"
state: present
when: ansible_os_family == "RedHat"
tags: repos
- name: Enable Remi PHP repository (RedHat/CentOS)
command: "yum-config-manager --enable remi-php{{ php_version | replace('.', '') }}"
when: ansible_os_family == "RedHat"
tags: repos
# Package Installation
- name: Update package cache (Debian/Ubuntu)
apt:
update_cache: yes
cache_valid_time: 3600
when: ansible_os_family == "Debian"
tags: packages
- name: Install Nginx
package:
name: "{{ nginx_package }}"
state: present
tags: nginx
- name: Install MySQL/MariaDB packages
package:
name: "{{ mysql_packages }}"
state: present
tags: mysql
- name: Install PHP packages
package:
name: "{{ php_packages }}"
state: present
tags: php
- name: Install additional tools
package:
name:
- curl
- wget
- unzip
- git
state: present
tags: tools
# Service Management
- name: Start and enable Nginx
service:
name: "{{ nginx_service }}"
state: started
enabled: yes
tags: nginx
- name: Start and enable MySQL/MariaDB
service:
name: "{{ mysql_service }}"
state: started
enabled: yes
tags: mysql
- name: Start and enable PHP-FPM
service:
name: "{{ php_fpm_service }}"
state: started
enabled: yes
tags: php
# SELinux Configuration (RedHat family)
- name: Configure SELinux booleans for web services
seboolean:
name: "{{ item }}"
state: yes
persistent: yes
loop: "{{ selinux_booleans }}"
when: ansible_os_family == "RedHat" and ansible_selinux.status == "enabled"
tags: selinux
# Firewall Configuration
- name: Configure firewall (UFW - Debian/Ubuntu)
ufw:
rule: allow
port: "{{ item }}"
proto: tcp
loop:
- "22"
- "80"
- "443"
when: ansible_os_family == "Debian"
tags: firewall
- name: Configure firewall (firewalld - RedHat/CentOS)
firewalld:
service: "{{ item }}"
permanent: yes
state: enabled
immediate: yes
loop:
- ssh
- http
- https
when: ansible_os_family == "RedHat"
tags: firewall
# MySQL Security
- name: Set MySQL root password
mysql_user:
name: root
password: "{{ mysql_root_password }}"
login_unix_socket: "{{ mysql_socket }}"
state: present
tags: mysql
- name: Create MySQL configuration for root
template:
src: ../templates/my.cnf.j2
dest: /root/.my.cnf
mode: '0600'
tags: mysql
- name: Remove anonymous MySQL users
mysql_user:
name: ""
host_all: yes
state: absent
tags: mysql
- name: Remove MySQL test database
mysql_db:
name: test
state: absent
tags: mysql
# WordPress Database Setup
- name: Create WordPress database
mysql_db:
name: "{{ wordpress_db_name }}"
state: present
tags: mysql
- name: Create WordPress database user
mysql_user:
name: "{{ wordpress_db_user }}"
password: "{{ wordpress_db_password }}"
priv: "{{ wordpress_db_name }}.*:ALL"
host: localhost
state: present
tags: mysql
# WordPress Installation
- name: Create web root directory
file:
path: "{{ wordpress_path }}"
state: directory
owner: "{{ nginx_user }}"
group: "{{ nginx_user }}"
mode: '0755'
tags: wordpress
- name: Download WordPress
get_url:
url: https://wordpress.org/latest.tar.gz
dest: /tmp/wordpress.tar.gz
mode: '0644'
tags: wordpress
- name: Extract WordPress
unarchive:
src: /tmp/wordpress.tar.gz
dest: /tmp/
remote_src: yes
tags: wordpress
- name: Copy WordPress files
command: "cp -r /tmp/wordpress/* {{ wordpress_path }}/"
args:
creates: "{{ wordpress_path }}/wp-config-sample.php"
tags: wordpress
- name: Set WordPress file permissions
file:
path: "{{ wordpress_path }}"
owner: "{{ nginx_user }}"
group: "{{ nginx_user }}"
recurse: yes
tags: wordpress
# Nginx Configuration
- name: Configure Nginx for WordPress (Debian/Ubuntu)
template:
src: ../templates/wordpress.nginx.j2
dest: "{{ nginx_sites_available }}/wordpress"
when: ansible_os_family == "Debian"
notify: restart nginx
tags: nginx
- name: Configure Nginx for WordPress (RedHat/CentOS)
template:
src: ../templates/wordpress-redhat.nginx.j2
dest: "{{ nginx_sites_available }}/wordpress.conf"
when: ansible_os_family == "RedHat"
notify: restart nginx
tags: nginx
- name: Enable WordPress site (Debian/Ubuntu)
file:
src: "{{ nginx_sites_available }}/wordpress"
dest: "{{ nginx_sites_enabled }}/wordpress"
state: link
when: ansible_os_family == "Debian"
notify: restart nginx
tags: nginx
- name: Remove default Nginx site (Debian/Ubuntu)
file:
path: "{{ nginx_sites_enabled }}/default"
state: absent
when: ansible_os_family == "Debian"
notify: restart nginx
tags: nginx
# PHP Configuration
- name: Configure PHP-FPM pool
template:
src: ../templates/www.conf.j2
dest: "{{ php_fpm_pool_dir }}/www.conf"
backup: yes
notify: restart php-fpm
tags: php
- name: Configure PHP settings
lineinfile:
path: "{{ php_ini_path }}"
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
backup: yes
loop:
- { regexp: '^upload_max_filesize', line: 'upload_max_filesize = 64M' }
- { regexp: '^post_max_size', line: 'post_max_size = 64M' }
- { regexp: '^memory_limit', line: 'memory_limit = 256M' }
- { regexp: '^max_execution_time', line: 'max_execution_time = 300' }
notify: restart php-fpm
tags: php
# WordPress Configuration
- name: Configure WordPress
template:
src: ../templates/wp-config.php.j2
dest: "{{ wordpress_path }}/wp-config.php"
owner: "{{ nginx_user }}"
group: "{{ nginx_user }}"
mode: '0600'
tags: wordpress
# WP-CLI Installation
- name: Download WP-CLI
get_url:
url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
dest: /usr/local/bin/wp
mode: '0755'
tags: wp-cli
- name: Verify WP-CLI installation
command: wp --info
become_user: "{{ nginx_user }}"
environment:
HOME: "{{ wordpress_path }}"
register: wp_cli_info
tags: wp-cli
- name: Display WP-CLI info
debug:
var: wp_cli_info.stdout_lines
tags: wp-cli
handlers:
- name: restart nginx
service:
name: "{{ nginx_service }}"
state: restarted
- name: restart php-fpm
service:
name: "{{ php_fpm_service }}"
state: restarted
- name: restart mysql
service:
name: "{{ mysql_service }}"
state: restarted

209
playbooks/lemp-wordpress-ssl.yml Normal file
View File

@@ -0,0 +1,209 @@
---
# SSL-enabled LEMP WordPress installation
- name: Install LEMP stack with WordPress and SSL
hosts: all
become: yes
vars_files:
- "../vars/{{ ansible_os_family | lower }}.yml"
vars:
# SSL Configuration
enable_ssl: "{{ enable_ssl | default(false) }}"
domain_name: "{{ domain_name | default('localhost') }}"
www_redirect: "{{ www_redirect | default(true) }}"
ssl_certificate_path: "{{ ssl_certificate_path | default('/etc/ssl/certs/' + domain_name + '.crt') }}"
ssl_certificate_key_path: "{{ ssl_certificate_key_path | default('/etc/ssl/private/' + domain_name + '.key') }}"
letsencrypt_email: "{{ letsencrypt_email | default('admin@' + domain_name) }}"
# WordPress Configuration
wordpress_path: /var/www/html
wordpress_url: "{{ 'https://' + domain_name if enable_ssl else 'http://' + domain_name }}"
# Database Configuration
mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}"
wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}"
# WordPress Admin
wp_admin_user: "{{ wp_admin_user | default('admin') }}"
wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}"
wp_admin_email: "{{ wp_admin_email | default(letsencrypt_email) }}"
wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}"
tasks:
# Include base LEMP installation
- name: Include base LEMP installation tasks
include_tasks: lemp-base-tasks.yml
# SSL Certificate Management
- name: Install Certbot for Let's Encrypt
apt:
name:
- certbot
- python3-certbot-nginx
state: present
update_cache: yes
when: enable_ssl and ansible_os_family == "Debian"
tags: ssl
- name: Install Certbot for Let's Encrypt (CentOS/RHEL)
yum:
name:
- certbot
- python3-certbot-nginx
state: present
when: enable_ssl and ansible_os_family == "RedHat"
tags: ssl
- name: Check if SSL certificate exists
stat:
path: "{{ ssl_certificate_path }}"
register: ssl_cert_exists
when: enable_ssl
tags: ssl
- name: Create temporary HTTP Nginx config for Let's Encrypt
template:
src: ../templates/wordpress.nginx.j2
dest: /etc/nginx/sites-available/wordpress
when: enable_ssl and not ssl_cert_exists.stat.exists
notify: restart nginx
tags: ssl
- name: Enable temporary site
file:
src: /etc/nginx/sites-available/wordpress
dest: /etc/nginx/sites-enabled/wordpress
state: link
when: enable_ssl and not ssl_cert_exists.stat.exists
notify: restart nginx
tags: ssl
- name: Flush handlers to ensure Nginx is running
meta: flush_handlers
when: enable_ssl and not ssl_cert_exists.stat.exists
- name: Generate Let's Encrypt certificate
command: >
certbot --nginx --non-interactive --agree-tos
--email {{ letsencrypt_email }}
-d {{ domain_name }}
{% if www_redirect %}-d www.{{ domain_name }}{% endif %}
--redirect
when: enable_ssl and not ssl_cert_exists.stat.exists and domain_name != 'localhost'
tags: ssl
- name: Create self-signed certificate for localhost/testing
block:
- name: Create SSL directory
file:
path: /etc/ssl/private
state: directory
mode: '0700'
- name: Generate self-signed certificate
command: >
openssl req -x509 -nodes -days 365 -newkey rsa:2048
-keyout {{ ssl_certificate_key_path }}
-out {{ ssl_certificate_path }}
-subj "/C=US/ST=Test/L=Test/O=Test/CN={{ domain_name }}"
args:
creates: "{{ ssl_certificate_path }}"
when: enable_ssl and not ssl_cert_exists.stat.exists and domain_name == 'localhost'
tags: ssl
# Nginx Configuration
- name: Configure Nginx for WordPress with SSL
template:
src: ../templates/wordpress-ssl.nginx.j2
dest: /etc/nginx/sites-available/wordpress
backup: yes
when: enable_ssl
notify: restart nginx
tags: nginx
- name: Configure Nginx for WordPress without SSL
template:
src: ../templates/wordpress.nginx.j2
dest: /etc/nginx/sites-available/wordpress
backup: yes
when: not enable_ssl
notify: restart nginx
tags: nginx
- name: Enable WordPress site
file:
src: /etc/nginx/sites-available/wordpress
dest: /etc/nginx/sites-enabled/wordpress
state: link
notify: restart nginx
tags: nginx
- name: Remove default Nginx site
file:
path: /etc/nginx/sites-enabled/default
state: absent
notify: restart nginx
tags: nginx
# Rate limiting configuration
- name: Configure Nginx rate limiting
blockinfile:
path: /etc/nginx/nginx.conf
marker: "# {mark} ANSIBLE MANAGED BLOCK - Rate Limiting"
insertafter: "http {"
block: |
# Rate limiting zones
limit_req_zone $binary_remote_addr zone=admin:10m rate=5r/m;
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/m;
notify: restart nginx
tags: nginx
# WordPress Configuration
- name: Configure WordPress with SSL settings
template:
src: ../templates/wp-config.php.j2
dest: "{{ wordpress_path }}/wp-config.php"
owner: www-data
group: www-data
mode: '0600'
tags: wordpress
# SSL Auto-renewal
- name: Set up Let's Encrypt auto-renewal
cron:
name: "Renew Let's Encrypt certificates"
minute: "0"
hour: "12"
job: "/usr/bin/certbot renew --quiet"
when: enable_ssl and domain_name != 'localhost'
tags: ssl
# Firewall Configuration
- name: Configure UFW for HTTP and HTTPS
ufw:
rule: allow
port: "{{ item }}"
proto: tcp
loop:
- "80"
- "443"
when: enable_ssl
tags: firewall
handlers:
- name: restart nginx
service:
name: nginx
state: restarted
- name: restart php-fpm
service:
name: "php{{ php_version }}-fpm"
state: restarted
- name: restart mysql
service:
name: "{{ mysql_service }}"
state: restarted

168
playbooks/lemp-wordpress.yml Normal file
View File

@@ -0,0 +1,168 @@
---
- name: LEMP Stack + WordPress Installation auf Ubuntu
hosts: testservers
become: yes
vars:
mysql_root_password: "secure_root_pass_123"
wordpress_db_name: "wordpress"
wordpress_db_user: "wp_user"
wordpress_db_password: "wp_secure_pass_123"
wordpress_admin_user: "admin"
wordpress_admin_password: "admin_secure_pass_123"
wordpress_admin_email: "admin@example.com"
domain_name: "localhost"
tasks:
- name: System aktualisieren
apt:
update_cache: yes
upgrade: dist
cache_valid_time: 3600
- name: Notwendige Pakete installieren
apt:
name:
- nginx
- mysql-server
- php8.3-fpm
- php8.3-mysql
- php8.3-curl
- php8.3-gd
- php8.3-intl
- php8.3-mbstring
- php8.3-soap
- php8.3-xml
- php8.3-xmlrpc
- php8.3-zip
- curl
- wget
- unzip
- python3-pymysql
state: present
- name: MySQL-Service starten und aktivieren
shell: |
service mysql start
update-rc.d mysql enable
become: yes
- name: MySQL root-Passwort setzen
mysql_user:
name: root
password: "{{ mysql_root_password }}"
login_unix_socket: /var/run/mysqld/mysqld.sock
column_case_sensitive: false
state: present
- name: MySQL-Konfiguration für root
copy:
content: |
[client]
user=root
password={{ mysql_root_password }}
dest: /root/.my.cnf
mode: '0600'
- name: WordPress-Datenbank erstellen
mysql_db:
name: "{{ wordpress_db_name }}"
state: present
login_user: root
login_password: "{{ mysql_root_password }}"
- name: WordPress-Datenbankuser erstellen
mysql_user:
name: "{{ wordpress_db_user }}"
password: "{{ wordpress_db_password }}"
priv: "{{ wordpress_db_name }}.*:ALL"
column_case_sensitive: false
state: present
login_user: root
login_password: "{{ mysql_root_password }}"
- name: WordPress herunterladen
get_url:
url: https://wordpress.org/latest.tar.gz
dest: /tmp/wordpress.tar.gz
- name: WordPress entpacken
unarchive:
src: /tmp/wordpress.tar.gz
dest: /tmp
remote_src: yes
- name: WordPress-Dateien kopieren
copy:
src: /tmp/wordpress/
dest: /var/www/html/
remote_src: yes
owner: www-data
group: www-data
mode: '0755'
- name: wp-config.php erstellen
template:
src: wp-config.php.j2
dest: /var/www/html/wp-config.php
owner: www-data
group: www-data
mode: '0644'
- name: Nginx-Konfiguration für WordPress
template:
src: wordpress.nginx.j2
dest: /etc/nginx/sites-available/wordpress
backup: yes
- name: Standard Nginx-Site deaktivieren
file:
path: /etc/nginx/sites-enabled/default
state: absent
- name: WordPress-Site aktivieren
file:
src: /etc/nginx/sites-available/wordpress
dest: /etc/nginx/sites-enabled/wordpress
state: link
- name: Nginx-Konfiguration testen
command: nginx -t
register: nginx_test
failed_when: nginx_test.rc != 0
- name: PHP-FPM Service starten
shell: service php8.3-fpm start
become: yes
- name: Nginx Service neustarten
shell: service nginx restart
become: yes
- name: WordPress-Verzeichnis-Berechtigungen setzen
file:
path: /var/www/html
owner: www-data
group: www-data
recurse: yes
mode: '0755'
- name: Spezielle WordPress-Verzeichnisse erstellen
file:
path: "{{ item }}"
state: directory
owner: www-data
group: www-data
mode: '0755'
loop:
- /var/www/html/wp-content/uploads
- /var/www/html/wp-content/upgrade
- name: Installation abgeschlossen - Info ausgeben
debug:
msg: |
WordPress-Installation abgeschlossen!
URL: http://{{ domain_name }}:8080
Admin-User: {{ wordpress_admin_user }}
Admin-Passwort: {{ wordpress_admin_password }}
DB-Name: {{ wordpress_db_name }}
DB-User: {{ wordpress_db_user }}

289
playbooks/ultimate-performance-optimization.yml Normal file
View File

@@ -0,0 +1,289 @@
---
# Ultimate WordPress Performance Optimization Playbook
- name: Ultimate WordPress Performance Optimization
hosts: all
become: yes
vars_files:
- "../vars/{{ ansible_os_family | lower }}.yml"
vars:
# Performance Configuration
enable_performance_monitoring: "{{ enable_performance_monitoring | default(true) }}"
enable_system_optimization: "{{ enable_system_optimization | default(true) }}"
enable_nginx_optimization: "{{ enable_nginx_optimization | default(true) }}"
enable_php_optimization: "{{ enable_php_optimization | default(true) }}"
enable_mysql_optimization: "{{ enable_mysql_optimization | default(true) }}"
# Nginx Performance Settings
nginx_worker_processes: "{{ ansible_processor_vcpus }}"
nginx_worker_connections: "{{ (ansible_memtotal_mb / 4) | int }}"
nginx_fastcgi_cache_enabled: true
nginx_fastcgi_cache_size: "{{ (ansible_memtotal_mb / 10) | int }}m"
# PHP Performance Settings
php_memory_limit: "{{ (ansible_memtotal_mb / 4) | int }}M"
php_max_execution_time: 300
php_max_input_vars: 3000
# MySQL Performance Settings
innodb_buffer_pool_size: "{{ (ansible_memtotal_mb / 2) | int }}M"
max_connections: "{{ (ansible_memtotal_mb / 10) | int }}"
tasks:
# System Optimizations
- name: Apply system performance optimizations
template:
src: ../templates/sysctl.conf.j2
dest: /etc/sysctl.d/99-wordpress-performance.conf
backup: yes
when: enable_system_optimization
notify: reload sysctl
tags: system-optimization
- name: Set system limits for web services
blockinfile:
path: /etc/security/limits.conf
marker: "# {mark} ANSIBLE MANAGED BLOCK - WordPress Performance"
block: |
# Limits for web services
www-data soft nofile 65536
www-data hard nofile 65536
mysql soft nofile 65536
mysql hard nofile 65536
redis soft nofile 65536
redis hard nofile 65536
when: enable_system_optimization
tags: system-optimization
# Nginx Performance Optimization
- name: Optimize Nginx main configuration
template:
src: ../templates/nginx.conf.j2
dest: /etc/nginx/nginx.conf
backup: yes
when: enable_nginx_optimization
notify: restart nginx
tags: nginx-optimization
- name: Create FastCGI cache directory
file:
path: /var/cache/nginx
state: directory
owner: www-data
group: www-data
mode: '0755'
when: nginx_fastcgi_cache_enabled
tags: nginx-optimization
- name: Configure Nginx FastCGI cache
copy:
content: |
# FastCGI cache configuration
include /etc/nginx/conf.d/fastcgi-cache.conf;
dest: /etc/nginx/conf.d/fastcgi-cache-include.conf
when: nginx_fastcgi_cache_enabled
notify: restart nginx
tags: nginx-optimization
- name: Create FastCGI cache configuration
template:
src: ../templates/fastcgi-cache.conf.j2
dest: /etc/nginx/conf.d/fastcgi-cache.conf
when: nginx_fastcgi_cache_enabled
notify: restart nginx
tags: nginx-optimization
# PHP Performance Optimization
- name: Optimize PHP configuration
template:
src: ../templates/php.ini.j2
dest: "{{ php_ini_path }}"
backup: yes
when: enable_php_optimization
notify: restart php-fpm
tags: php-optimization
- name: Optimize PHP-FPM pool configuration
template:
src: ../templates/www.conf.j2
dest: "{{ php_fpm_pool_dir }}/www.conf"
backup: yes
when: enable_php_optimization
notify: restart php-fpm
tags: php-optimization
# MySQL Performance Optimization
- name: Optimize MySQL configuration
template:
src: ../templates/my.cnf.j2
dest: "{{ mysql_conf_file }}"
backup: yes
when: enable_mysql_optimization
notify: restart mysql
tags: mysql-optimization
# Redis Performance (if enabled)
- name: Optimize Redis configuration
template:
src: ../templates/redis.conf.j2
dest: /etc/redis/redis.conf
backup: yes
when: enable_redis is defined and enable_redis
notify: restart redis
tags: redis-optimization
# WordPress Cron Optimization
- name: Create optimized WordPress cron script
template:
src: ../templates/wordpress-cron.sh.j2
dest: /usr/local/bin/wordpress-cron.sh
mode: '0755'
tags: wordpress-optimization
- name: Disable default WordPress cron and use system cron
cron:
name: "WordPress Cron"
minute: "*/5"
job: "/usr/local/bin/wordpress-cron.sh"
user: root
tags: wordpress-optimization
- name: Install Redis Object Cache plugin (if Redis enabled)
command: >
wp plugin install redis-cache --activate --allow-root
args:
chdir: "{{ wordpress_path }}"
when: enable_redis is defined and enable_redis
become_user: "{{ nginx_user }}"
tags: wordpress-optimization
- name: Enable Redis Object Cache
command: >
wp redis enable --allow-root
args:
chdir: "{{ wordpress_path }}"
when: enable_redis is defined and enable_redis
become_user: "{{ nginx_user }}"
ignore_errors: yes
tags: wordpress-optimization
# Performance Monitoring
- name: Install performance monitoring script
template:
src: ../templates/performance-monitor.sh.j2
dest: /usr/local/bin/wordpress-performance-monitor.sh
mode: '0755'
when: enable_performance_monitoring
tags: monitoring
- name: Schedule performance monitoring
cron:
name: "WordPress Performance Monitoring"
minute: "*/15"
job: "/usr/local/bin/wordpress-performance-monitor.sh"
user: root
when: enable_performance_monitoring
tags: monitoring
# Log Management
- name: Configure logrotate for WordPress
template:
src: ../templates/logrotate.conf.j2
dest: /etc/logrotate.d/wordpress
tags: log-management
# Cache Warming Script
- name: Create cache warming script
copy:
content: |
#!/bin/bash
# Cache warming script for WordPress
WORDPRESS_URL="{{ wordpress_url }}"
SITEMAP_URL="${WORDPRESS_URL}/sitemap.xml"
# Warm up homepage
curl -s "$WORDPRESS_URL" > /dev/null
# Warm up sitemap URLs (if sitemap exists)
if curl -s "$SITEMAP_URL" | grep -q "xml"; then
curl -s "$SITEMAP_URL" | grep -oP 'https?://[^<]+' | head -20 | while read url; do
curl -s "$url" > /dev/null
sleep 1
done
fi
dest: /usr/local/bin/wordpress-cache-warm.sh
mode: '0755'
when: nginx_fastcgi_cache_enabled
tags: cache-optimization
- name: Schedule cache warming
cron:
name: "WordPress Cache Warming"
minute: "0"
hour: "6"
job: "/usr/local/bin/wordpress-cache-warm.sh"
user: www-data
when: nginx_fastcgi_cache_enabled
tags: cache-optimization
# Database Optimization
- name: Create database optimization script
copy:
content: |
#!/bin/bash
# WordPress Database Optimization Script
cd {{ wordpress_path }}
# Optimize database tables
wp db optimize --allow-root
# Clean up spam comments
wp comment delete $(wp comment list --status=spam --format=ids --allow-root) --allow-root 2>/dev/null || true
# Clean up trash posts
wp post delete $(wp post list --post_status=trash --format=ids --allow-root) --allow-root 2>/dev/null || true
# Clean up expired transients
wp transient delete --expired --allow-root
# Update search index (if search plugin is installed)
wp search-replace 'old-domain.com' '{{ domain_name }}' --dry-run --allow-root || true
dest: /usr/local/bin/wordpress-db-optimize.sh
mode: '0755'
tags: database-optimization
- name: Schedule weekly database optimization
cron:
name: "WordPress Database Optimization"
minute: "0"
hour: "3"
weekday: "0"
job: "/usr/local/bin/wordpress-db-optimize.sh"
user: root
tags: database-optimization
handlers:
- name: restart nginx
service:
name: "{{ nginx_service }}"
state: restarted
- name: restart php-fpm
service:
name: "{{ php_fpm_service }}"
state: restarted
- name: restart mysql
service:
name: "{{ mysql_service }}"
state: restarted
- name: restart redis
service:
name: redis-server
state: restarted
- name: reload sysctl
command: sysctl -p /etc/sysctl.d/99-wordpress-performance.conf

313
playbooks/wordpress-advanced-features.yml Normal file
View File

@@ -0,0 +1,313 @@
---
# Advanced WordPress features and optimizations
- name: WordPress Advanced Features Setup
hosts: all
become: yes
vars_files:
- "../vars/{{ ansible_os_family | lower }}.yml"
vars:
# Backup Configuration
enable_backups: "{{ enable_backups | default(true) }}"
backup_schedule: "{{ backup_schedule | default('0 2 * * *') }}" # Daily at 2 AM
backup_retention_days: "{{ backup_retention_days | default(7) }}"
backup_destination: "{{ backup_destination | default('/var/backups/wordpress') }}"
# Performance Configuration
enable_redis: "{{ enable_redis | default(false) }}"
enable_memcached: "{{ enable_memcached | default(false) }}"
enable_opcache: "{{ enable_opcache | default(true) }}"
# Security Configuration
enable_fail2ban: "{{ enable_fail2ban | default(true) }}"
enable_modsecurity: "{{ enable_modsecurity | default(false) }}"
# Monitoring Configuration
enable_monitoring: "{{ enable_monitoring | default(false) }}"
# WordPress Multisite
enable_multisite: "{{ enable_multisite | default(false) }}"
multisite_type: "{{ multisite_type | default('subdirectory') }}" # subdirectory or subdomain
tasks:
# Backup System
- name: Install backup dependencies
package:
name:
- rsync
- gzip
- tar
state: present
when: enable_backups
tags: backup
- name: Create backup directories
file:
path: "{{ item }}"
state: directory
mode: '0755'
loop:
- "{{ backup_destination }}"
- "{{ backup_destination }}/database"
- "{{ backup_destination }}/files"
when: enable_backups
tags: backup
- name: Create backup script
template:
src: ../templates/wordpress-backup.sh.j2
dest: /usr/local/bin/wordpress-backup.sh
mode: '0755'
when: enable_backups
tags: backup
- name: Schedule WordPress backups
cron:
name: "WordPress Backup"
minute: "{{ backup_schedule.split()[0] }}"
hour: "{{ backup_schedule.split()[1] }}"
day: "{{ backup_schedule.split()[2] }}"
month: "{{ backup_schedule.split()[3] }}"
weekday: "{{ backup_schedule.split()[4] }}"
job: "/usr/local/bin/wordpress-backup.sh"
when: enable_backups
tags: backup
# Redis Cache
- name: Install Redis
package:
name: redis-server
state: present
when: enable_redis
tags: redis
- name: Configure Redis
template:
src: ../templates/redis.conf.j2
dest: /etc/redis/redis.conf
backup: yes
when: enable_redis
notify: restart redis
tags: redis
- name: Start and enable Redis
service:
name: redis-server
state: started
enabled: yes
when: enable_redis
tags: redis
- name: Install Redis PHP extension
package:
name: "php{{ php_version }}-redis"
state: present
when: enable_redis and ansible_os_family == "Debian"
notify: restart php-fpm
tags: redis
# Memcached
- name: Install Memcached
package:
name:
- memcached
- "php{{ php_version }}-memcached"
state: present
when: enable_memcached and ansible_os_family == "Debian"
tags: memcached
- name: Configure Memcached
template:
src: ../templates/memcached.conf.j2
dest: /etc/memcached.conf
backup: yes
when: enable_memcached
notify: restart memcached
tags: memcached
- name: Start and enable Memcached
service:
name: memcached
state: started
enabled: yes
when: enable_memcached
tags: memcached
# PHP OPcache Optimization
- name: Configure PHP OPcache
blockinfile:
path: "{{ php_ini_path }}"
marker: "; {mark} ANSIBLE MANAGED BLOCK - OPcache"
block: |
; OPcache Configuration
opcache.enable=1
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=10000
opcache.revalidate_freq=2
opcache.save_comments=1
opcache.enable_file_override=1
when: enable_opcache
notify: restart php-fpm
tags: opcache
# Fail2Ban Security
- name: Install Fail2Ban
package:
name: fail2ban
state: present
when: enable_fail2ban
tags: fail2ban
- name: Configure Fail2Ban for WordPress
template:
src: ../templates/fail2ban-wordpress.conf.j2
dest: /etc/fail2ban/jail.d/wordpress.conf
when: enable_fail2ban
notify: restart fail2ban
tags: fail2ban
- name: Start and enable Fail2Ban
service:
name: fail2ban
state: started
enabled: yes
when: enable_fail2ban
tags: fail2ban
# WordPress Plugins for Performance
- name: Install WordPress performance plugins
command: >
wp plugin install {{ item }} --activate --allow-root
args:
chdir: "{{ wordpress_path }}"
loop:
- w3-total-cache
- wp-optimize
- wordfence
when: enable_monitoring
become_user: "{{ nginx_user }}"
tags: wordpress-plugins
# WordPress Multisite Setup
- name: Configure WordPress Multisite
blockinfile:
path: "{{ wordpress_path }}/wp-config.php"
marker: "/* {mark} ANSIBLE MANAGED BLOCK - Multisite */"
insertbefore: "/* That's all, stop editing!"
block: |
/* Multisite Configuration */
define('WP_ALLOW_MULTISITE', true);
define('MULTISITE', true);
define('SUBDOMAIN_INSTALL', {{ 'true' if multisite_type == 'subdomain' else 'false' }});
define('DOMAIN_CURRENT_SITE', '{{ domain_name | default(ansible_default_ipv4.address) }}');
define('PATH_CURRENT_SITE', '/');
define('SITE_ID_CURRENT_SITE', 1);
define('BLOG_ID_CURRENT_SITE', 1);
when: enable_multisite
tags: multisite
- name: Configure Nginx for WordPress Multisite
template:
src: ../templates/wordpress-multisite.nginx.j2
dest: "{{ nginx_sites_available }}/wordpress"
backup: yes
when: enable_multisite and ansible_os_family == "Debian"
notify: restart nginx
tags: multisite
# SSL Certificate Auto-renewal with notifications
- name: Create SSL renewal notification script
template:
src: ../templates/ssl-renewal-notify.sh.j2
dest: /usr/local/bin/ssl-renewal-notify.sh
mode: '0755'
when: enable_ssl is defined and enable_ssl
tags: ssl
- name: Schedule SSL renewal with notifications
cron:
name: "Renew SSL certificates with notification"
minute: "0"
hour: "12"
job: "/usr/local/bin/ssl-renewal-notify.sh"
when: enable_ssl is defined and enable_ssl
tags: ssl
# System Monitoring
- name: Install monitoring tools
package:
name:
- htop
- iotop
- nethogs
- glances
state: present
when: enable_monitoring
tags: monitoring
- name: Install Netdata monitoring
shell: |
bash <(curl -Ss https://my-netdata.io/kickstart.sh) --dont-wait --stable-channel
args:
creates: /usr/sbin/netdata
when: enable_monitoring
tags: monitoring
# WordPress CLI improvements
- name: Create WP-CLI config
template:
src: ../templates/wp-cli.yml.j2
dest: "{{ wordpress_path }}/wp-cli.yml"
owner: "{{ nginx_user }}"
group: "{{ nginx_user }}"
tags: wp-cli
# Database optimization
- name: Configure MySQL for WordPress optimization
blockinfile:
path: "{{ mysql_conf_file }}"
marker: "# {mark} ANSIBLE MANAGED BLOCK - WordPress Optimization"
block: |
# WordPress Optimization
innodb_buffer_pool_size = 256M
innodb_log_file_size = 64M
query_cache_type = 1
query_cache_size = 32M
max_connections = 200
thread_cache_size = 8
tmp_table_size = 32M
max_heap_table_size = 32M
notify: restart mysql
tags: mysql-optimization
handlers:
- name: restart nginx
service:
name: "{{ nginx_service }}"
state: restarted
- name: restart php-fpm
service:
name: "{{ php_fpm_service }}"
state: restarted
- name: restart mysql
service:
name: "{{ mysql_service }}"
state: restarted
- name: restart redis
service:
name: redis-server
state: restarted
- name: restart memcached
service:
name: memcached
state: restarted
- name: restart fail2ban
service:
name: fail2ban
state: restarted