feat: v2.0.0 production-ready release with Redis, OPcache and Nginx optimizations
This commit is contained in:
Sebastian Palencsár
@@ -1,160 +0,0 @@
|
||||
---
|
||||
- name: WordPress mit offiziellem WP-CLI installieren
|
||||
hosts: testservers
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: WP-CLI von wp-cli.org herunterladen (offizielle Methode)
|
||||
shell: |
|
||||
cd /tmp
|
||||
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
|
||||
chmod +x wp-cli.phar
|
||||
mv wp-cli.phar /usr/local/bin/wp
|
||||
|
||||
- name: WP-CLI testen
|
||||
shell: wp --info --allow-root
|
||||
register: wp_cli_test
|
||||
environment:
|
||||
WP_CLI_ALLOW_ROOT: 1
|
||||
|
||||
- name: WP-CLI Info
|
||||
debug:
|
||||
var: wp_cli_test.stdout_lines
|
||||
|
||||
- name: WordPress-Datenbank für WP-CLI vorbereiten
|
||||
shell: |
|
||||
mysql -h 127.0.0.1 -P 3306 -u root -psecure_root_pass_123 -e "
|
||||
DROP DATABASE IF EXISTS wordpress;
|
||||
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
FLUSH PRIVILEGES;
|
||||
"
|
||||
|
||||
- name: Alte WordPress-Dateien entfernen (außer wp-content)
|
||||
shell: |
|
||||
cd /var/www/html
|
||||
find . -maxdepth 1 -name "*.php" -delete
|
||||
find . -maxdepth 1 -name "*.html" -delete
|
||||
find . -maxdepth 1 -name "*.txt" -delete
|
||||
rm -rf wp-admin wp-includes
|
||||
ls -la
|
||||
register: cleanup
|
||||
|
||||
- name: Cleanup-Ergebnis
|
||||
debug:
|
||||
var: cleanup.stdout_lines
|
||||
|
||||
- name: WordPress-Core mit WP-CLI herunterladen
|
||||
shell: |
|
||||
cd /var/www/html
|
||||
wp core download --allow-root --force
|
||||
register: wp_download
|
||||
environment:
|
||||
WP_CLI_ALLOW_ROOT: 1
|
||||
|
||||
- name: WordPress-Download Ergebnis
|
||||
debug:
|
||||
var: wp_download.stdout_lines
|
||||
|
||||
- name: wp-config.php mit WP-CLI erstellen
|
||||
shell: |
|
||||
cd /var/www/html
|
||||
wp config create \
|
||||
--dbname=wordpress \
|
||||
--dbuser=wp_user \
|
||||
--dbpass=wp_secure_pass_123 \
|
||||
--dbhost=127.0.0.1:3306 \
|
||||
--dbcharset=utf8mb4 \
|
||||
--allow-root \
|
||||
--force
|
||||
register: wp_config
|
||||
environment:
|
||||
WP_CLI_ALLOW_ROOT: 1
|
||||
|
||||
- name: wp-config Ergebnis
|
||||
debug:
|
||||
var: wp_config.stdout_lines
|
||||
|
||||
- name: WordPress mit WP-CLI installieren
|
||||
shell: |
|
||||
cd /var/www/html
|
||||
wp core install \
|
||||
--url="http://localhost:8080" \
|
||||
--title="WordPress Test Site" \
|
||||
--admin_user="admin" \
|
||||
--admin_password="admin123" \
|
||||
--admin_email="admin@example.com" \
|
||||
--allow-root
|
||||
register: wp_install
|
||||
environment:
|
||||
WP_CLI_ALLOW_ROOT: 1
|
||||
|
||||
- name: WordPress-Installation Ergebnis
|
||||
debug:
|
||||
var: wp_install.stdout_lines
|
||||
|
||||
- name: WordPress-Berechtigungen korrekt setzen
|
||||
shell: |
|
||||
cd /var/www/html
|
||||
chown -R www-data:www-data .
|
||||
find . -type d -exec chmod 755 {} \;
|
||||
find . -type f -exec chmod 644 {} \;
|
||||
chmod 600 wp-config.php
|
||||
|
||||
- name: WordPress-Status mit WP-CLI prüfen
|
||||
shell: |
|
||||
cd /var/www/html
|
||||
echo "=== WordPress Version ==="
|
||||
wp core version --allow-root
|
||||
echo "=== Site-URLs ==="
|
||||
wp option get siteurl --allow-root
|
||||
wp option get home --allow-root
|
||||
echo "=== Benutzer ==="
|
||||
wp user list --allow-root
|
||||
echo "=== Plugins ==="
|
||||
wp plugin list --allow-root
|
||||
echo "=== Themes ==="
|
||||
wp theme list --allow-root
|
||||
register: wp_status
|
||||
environment:
|
||||
WP_CLI_ALLOW_ROOT: 1
|
||||
|
||||
- name: WordPress-Status
|
||||
debug:
|
||||
var: wp_status.stdout_lines
|
||||
|
||||
- name: Services neustarten
|
||||
shell: |
|
||||
service php8.3-fpm restart
|
||||
service nginx restart
|
||||
|
||||
- name: WordPress-Homepage testen
|
||||
uri:
|
||||
url: http://localhost
|
||||
method: GET
|
||||
return_content: yes
|
||||
register: homepage_test
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Homepage-Inhalt prüfen
|
||||
debug:
|
||||
msg: |
|
||||
Status: {{ homepage_test.status | default('Fehler') }}
|
||||
Content-Length: {{ homepage_test.content | length if homepage_test.content is defined else 0 }}
|
||||
Enthält WordPress: {{ 'Ja' if homepage_test.content is defined and
|
||||
'WordPress' in homepage_test.content else 'Nein' }}
|
||||
|
||||
- name: Erfolgreiche Installation
|
||||
debug:
|
||||
msg: |
|
||||
🎉 WordPress erfolgreich installiert!
|
||||
|
||||
📱 URLs:
|
||||
- Homepage: http://localhost:8080
|
||||
- Admin: http://localhost:8080/wp-admin
|
||||
|
||||
🔑 Login-Daten:
|
||||
- Benutzername: admin
|
||||
- Passwort: admin123
|
||||
- E-Mail: admin@example.com
|
||||
|
||||
🛠 WP-CLI verfügbar unter: wp --allow-root
|
||||
@@ -1,200 +0,0 @@
|
||||
---
|
||||
# SSL-enabled LEMP WordPress installation
|
||||
- name: Install LEMP stack with WordPress and SSL
|
||||
hosts: all
|
||||
become: yes
|
||||
vars_files:
|
||||
- "../vars/{{ ansible_os_family | lower }}.yml"
|
||||
|
||||
vars:
|
||||
# SSL Configuration
|
||||
enable_ssl: "{{ enable_ssl | default(false) }}"
|
||||
domain_name: "{{ domain_name | default('localhost') }}"
|
||||
www_redirect: "{{ www_redirect | default(true) }}"
|
||||
ssl_certificate_path: "{{ ssl_certificate_path | default('/etc/ssl/certs/' + domain_name + '.crt') }}"
|
||||
ssl_certificate_key_path: "{{ ssl_certificate_key_path | default('/etc/ssl/private/' + domain_name + '.key') }}"
|
||||
letsencrypt_email: "{{ letsencrypt_email | default('admin@' + domain_name) }}"
|
||||
|
||||
# WordPress Configuration
|
||||
wordpress_path: /var/www/html
|
||||
wordpress_url: "{{ 'https://' + domain_name if enable_ssl else 'http://' + domain_name }}"
|
||||
|
||||
# Database Configuration
|
||||
mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}"
|
||||
wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
|
||||
wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
|
||||
wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}"
|
||||
|
||||
# WordPress Admin
|
||||
wp_admin_user: "{{ wp_admin_user | default('admin') }}"
|
||||
wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}"
|
||||
wp_admin_email: "{{ wp_admin_email | default(letsencrypt_email) }}"
|
||||
wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}"
|
||||
|
||||
tasks:
|
||||
# Include base LEMP installation
|
||||
- name: Include base LEMP installation tasks
|
||||
include_tasks: lemp-base-tasks.yml
|
||||
|
||||
# SSL Certificate Management
|
||||
- name: Install Certbot for Let's Encrypt
|
||||
apt:
|
||||
name:
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
update_cache: yes
|
||||
when: enable_ssl
|
||||
tags: ssl
|
||||
|
||||
- name: Check if SSL certificate exists
|
||||
stat:
|
||||
path: "{{ ssl_certificate_path }}"
|
||||
register: ssl_cert_exists
|
||||
when: enable_ssl
|
||||
tags: ssl
|
||||
|
||||
- name: Create temporary HTTP Nginx config for Let's Encrypt
|
||||
template:
|
||||
src: ../templates/wordpress.nginx.j2
|
||||
dest: /etc/nginx/sites-available/wordpress
|
||||
when: enable_ssl and not ssl_cert_exists.stat.exists
|
||||
notify: restart nginx
|
||||
tags: ssl
|
||||
|
||||
- name: Enable temporary site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/wordpress
|
||||
dest: /etc/nginx/sites-enabled/wordpress
|
||||
state: link
|
||||
when: enable_ssl and not ssl_cert_exists.stat.exists
|
||||
notify: restart nginx
|
||||
tags: ssl
|
||||
|
||||
- name: Flush handlers to ensure Nginx is running
|
||||
meta: flush_handlers
|
||||
when: enable_ssl and not ssl_cert_exists.stat.exists
|
||||
|
||||
- name: Generate Let's Encrypt certificate
|
||||
command: >
|
||||
certbot --nginx --non-interactive --agree-tos
|
||||
--email {{ letsencrypt_email }}
|
||||
-d {{ domain_name }}
|
||||
{% if www_redirect %}-d www.{{ domain_name }}{% endif %}
|
||||
--redirect
|
||||
when: enable_ssl and not ssl_cert_exists.stat.exists and domain_name != 'localhost'
|
||||
tags: ssl
|
||||
|
||||
- name: Create self-signed certificate for localhost/testing
|
||||
block:
|
||||
- name: Create SSL directory
|
||||
file:
|
||||
path: /etc/ssl/private
|
||||
state: directory
|
||||
mode: '0700'
|
||||
|
||||
- name: Generate self-signed certificate
|
||||
command: >
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048
|
||||
-keyout {{ ssl_certificate_key_path }}
|
||||
-out {{ ssl_certificate_path }}
|
||||
-subj "/C=US/ST=Test/L=Test/O=Test/CN={{ domain_name }}"
|
||||
args:
|
||||
creates: "{{ ssl_certificate_path }}"
|
||||
when: enable_ssl and not ssl_cert_exists.stat.exists and domain_name == 'localhost'
|
||||
tags: ssl
|
||||
|
||||
# Nginx Configuration
|
||||
- name: Configure Nginx for WordPress with SSL
|
||||
template:
|
||||
src: ../templates/wordpress-ssl.nginx.j2
|
||||
dest: /etc/nginx/sites-available/wordpress
|
||||
backup: yes
|
||||
when: enable_ssl
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Configure Nginx for WordPress without SSL
|
||||
template:
|
||||
src: ../templates/wordpress.nginx.j2
|
||||
dest: /etc/nginx/sites-available/wordpress
|
||||
backup: yes
|
||||
when: not enable_ssl
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Enable WordPress site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/wordpress
|
||||
dest: /etc/nginx/sites-enabled/wordpress
|
||||
state: link
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Remove default Nginx site
|
||||
file:
|
||||
path: /etc/nginx/sites-enabled/default
|
||||
state: absent
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
# Rate limiting configuration
|
||||
- name: Configure Nginx rate limiting
|
||||
blockinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - Rate Limiting"
|
||||
insertafter: "http {"
|
||||
block: |
|
||||
# Rate limiting zones
|
||||
limit_req_zone $binary_remote_addr zone=admin:10m rate=5r/m;
|
||||
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/m;
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
# WordPress Configuration
|
||||
- name: Configure WordPress with SSL settings
|
||||
template:
|
||||
src: ../templates/wp-config.php.j2
|
||||
dest: "{{ wordpress_path }}/wp-config.php"
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0600'
|
||||
tags: wordpress
|
||||
|
||||
# SSL Auto-renewal
|
||||
- name: Set up Let's Encrypt auto-renewal
|
||||
cron:
|
||||
name: "Renew Let's Encrypt certificates"
|
||||
minute: "0"
|
||||
hour: "12"
|
||||
job: "/usr/bin/certbot renew --quiet"
|
||||
when: enable_ssl and domain_name != 'localhost'
|
||||
tags: ssl
|
||||
|
||||
# Firewall Configuration
|
||||
- name: Configure UFW for HTTP and HTTPS
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "80"
|
||||
- "443"
|
||||
when: enable_ssl
|
||||
tags: firewall
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: restarted
|
||||
|
||||
- name: restart php-fpm
|
||||
service:
|
||||
name: "php{{ php_version }}-fpm"
|
||||
state: restarted
|
||||
|
||||
- name: restart mysql
|
||||
service:
|
||||
name: "{{ mysql_service }}"
|
||||
state: restarted
|
||||
579
playbooks/lemp-wordpress-ultimate.yml
Normal file
579
playbooks/lemp-wordpress-ultimate.yml
Normal file
@@ -0,0 +1,579 @@
|
||||
---
|
||||
# Ultimate LEMP WordPress installation with Redis, OPcache and Nginx Optimization
|
||||
- name: Install Ultimate LEMP stack with WordPress, Redis, OPcache and Nginx Performance (Ubuntu/Debian)
|
||||
hosts: all
|
||||
become: yes
|
||||
|
||||
pre_tasks:
|
||||
- name: Gather OS facts
|
||||
setup:
|
||||
gather_subset:
|
||||
- '!all'
|
||||
- '!min'
|
||||
- 'distribution'
|
||||
- 'distribution_version'
|
||||
- 'os_family'
|
||||
|
||||
- name: Load Debian family variables
|
||||
include_vars: "../vars/debian-family.yml"
|
||||
|
||||
- name: Debug OS information
|
||||
debug:
|
||||
msg: |
|
||||
OS Family: {{ ansible_os_family }}
|
||||
Distribution: {{ ansible_distribution }}
|
||||
Version: {{ ansible_distribution_version }}
|
||||
Supported: Ubuntu/Debian family systems
|
||||
|
||||
- name: Verify supported OS
|
||||
fail:
|
||||
msg: "This playbook only supports Ubuntu/Debian systems. Detected: {{ ansible_os_family }}"
|
||||
when: ansible_os_family != "Debian"
|
||||
|
||||
# Environment Detection and Configuration
|
||||
- name: Detect if running in Docker
|
||||
stat:
|
||||
path: /.dockerenv
|
||||
register: docker_env
|
||||
tags: always
|
||||
|
||||
- name: Check for deployment_environment override
|
||||
set_fact:
|
||||
environment_override: "{{ deployment_environment is defined }}"
|
||||
tags: always
|
||||
|
||||
- name: Set deployment environment (auto-detect or override)
|
||||
set_fact:
|
||||
deployment_environment: "{{ deployment_environment | default('docker' if docker_env.stat.exists else 'bare_metal') }}"
|
||||
tags: always
|
||||
|
||||
- name: Set WordPress site URL with smart defaults
|
||||
set_fact:
|
||||
wp_site_url: "{{ wp_site_url | default(_auto_wp_url) }}"
|
||||
vars:
|
||||
_auto_wp_url: "{{ 'http://localhost:8080' if (deployment_environment == 'docker') else 'http://' + (ansible_default_ipv4.address | default('localhost')) }}"
|
||||
tags: always
|
||||
|
||||
- name: Debug deployment configuration
|
||||
debug:
|
||||
msg: |
|
||||
Environment: {{ deployment_environment }} ({{ 'overridden' if environment_override else 'auto-detected' }})
|
||||
WordPress URL: {{ wp_site_url }}
|
||||
Docker detected: {{ docker_env.stat.exists }}
|
||||
tags: always
|
||||
|
||||
vars:
|
||||
# WordPress Configuration
|
||||
wordpress_path: "{{ web_root }}"
|
||||
wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}"
|
||||
|
||||
# Database Configuration (use inventory variables or these defaults)
|
||||
default_mysql_root_password: "{{ mysql_root_password | default('secure_root_password_123') }}"
|
||||
default_wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
|
||||
default_wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
|
||||
default_wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_123') }}"
|
||||
|
||||
# WordPress Admin (use inventory variables directly)
|
||||
# These variables come from inventory/production.yml
|
||||
# wp_admin_user, wp_admin_password, wp_admin_email, wp_site_title
|
||||
|
||||
tasks:
|
||||
# Package Installation
|
||||
- name: Update package cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
tags: packages
|
||||
|
||||
- name: Install all required packages
|
||||
package:
|
||||
name: "{{ packages }}"
|
||||
state: present
|
||||
tags: packages
|
||||
|
||||
# Service Management
|
||||
- name: Start and enable Nginx
|
||||
service:
|
||||
name: "{{ nginx_service }}"
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: nginx
|
||||
|
||||
- name: Start and enable MySQL/MariaDB
|
||||
service:
|
||||
name: "{{ mysql_service }}"
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: mysql
|
||||
|
||||
- name: Start and enable PHP-FPM
|
||||
service:
|
||||
name: "{{ php_fpm_service }}"
|
||||
state: started
|
||||
enabled: yes
|
||||
tags: php
|
||||
|
||||
# Firewall Configuration
|
||||
- name: Configure firewall (UFW)
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "22"
|
||||
- "80"
|
||||
- "443"
|
||||
tags: firewall
|
||||
|
||||
# MySQL Security (Ubuntu 24.04 fix for auth_socket)
|
||||
- name: Set MySQL root password (using auth_socket first)
|
||||
mysql_user:
|
||||
name: root
|
||||
password: "{{ mysql_root_password }}"
|
||||
plugin: mysql_native_password
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
state: present
|
||||
become: true
|
||||
tags: mysql
|
||||
|
||||
- name: Create MySQL configuration for root
|
||||
template:
|
||||
src: ../templates/my.cnf.j2
|
||||
dest: /root/.my.cnf
|
||||
mode: '0600'
|
||||
tags: mysql
|
||||
|
||||
- name: Remove anonymous MySQL users
|
||||
mysql_user:
|
||||
name: ""
|
||||
host_all: yes
|
||||
state: absent
|
||||
tags: mysql
|
||||
|
||||
- name: Remove MySQL test database
|
||||
mysql_db:
|
||||
name: test
|
||||
state: absent
|
||||
tags: mysql
|
||||
|
||||
# WordPress Database Setup
|
||||
- name: Create WordPress database
|
||||
mysql_db:
|
||||
name: "{{ wordpress_db_name }}"
|
||||
state: present
|
||||
tags: mysql
|
||||
|
||||
- name: Create WordPress database user
|
||||
mysql_user:
|
||||
name: "{{ wordpress_db_user }}"
|
||||
password: "{{ wordpress_db_password }}"
|
||||
priv: "{{ wordpress_db_name }}.*:ALL"
|
||||
host: localhost
|
||||
state: present
|
||||
tags: mysql
|
||||
|
||||
# WordPress Installation
|
||||
- name: Create web root directory
|
||||
file:
|
||||
path: "{{ wordpress_path }}"
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0755'
|
||||
tags: wordpress
|
||||
|
||||
- name: Remove default nginx index file
|
||||
file:
|
||||
path: "{{ wordpress_path }}/index.nginx-debian.html"
|
||||
state: absent
|
||||
tags: wordpress
|
||||
|
||||
- name: Download WordPress
|
||||
get_url:
|
||||
url: https://wordpress.org/latest.tar.gz
|
||||
dest: /tmp/wordpress.tar.gz
|
||||
mode: '0644'
|
||||
tags: wordpress
|
||||
|
||||
- name: Extract WordPress
|
||||
unarchive:
|
||||
src: /tmp/wordpress.tar.gz
|
||||
dest: /tmp/
|
||||
remote_src: yes
|
||||
tags: wordpress
|
||||
|
||||
- name: Copy WordPress files
|
||||
command: "cp -r /tmp/wordpress/. {{ wordpress_path }}/"
|
||||
args:
|
||||
creates: "{{ wordpress_path }}/wp-config-sample.php"
|
||||
tags: wordpress
|
||||
|
||||
- name: Set WordPress file permissions
|
||||
file:
|
||||
path: "{{ wordpress_path }}"
|
||||
owner: "{{ nginx_user }}"
|
||||
group: "{{ nginx_user }}"
|
||||
recurse: yes
|
||||
tags: wordpress
|
||||
|
||||
# SSL Configuration (optional)
|
||||
- name: Generate self-signed SSL certificate (if SSL enabled but no cert provided)
|
||||
command: >
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048
|
||||
-keyout {{ ssl_cert_key_path | default('/etc/ssl/private/nginx-selfsigned.key') }}
|
||||
-out {{ ssl_cert_path | default('/etc/ssl/certs/nginx-selfsigned.crt') }}
|
||||
-subj "/C=DE/ST=State/L=City/O=Organization/OU=OrgUnit/CN={{ domain_name }}"
|
||||
when:
|
||||
- ssl_enabled | default(false)
|
||||
- not (ssl_cert_path is defined and ssl_cert_key_path is defined)
|
||||
tags: ssl
|
||||
|
||||
# Nginx Configuration
|
||||
- name: Create Nginx configuration for WordPress
|
||||
template:
|
||||
src: ../templates/{% if ssl_enabled | default(false) %}wordpress-ssl.nginx.j2{% else %}wordpress.nginx.j2{% endif %}
|
||||
dest: "{{ nginx_sites_available }}/wordpress"
|
||||
backup: yes
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Enable WordPress site
|
||||
file:
|
||||
src: "{{ nginx_sites_available }}/wordpress"
|
||||
dest: "{{ nginx_sites_enabled }}/wordpress"
|
||||
state: link
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
- name: Remove default Nginx site
|
||||
file:
|
||||
path: "{{ nginx_sites_enabled }}/default"
|
||||
state: absent
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
|
||||
# PHP Configuration
|
||||
- name: Configure PHP-FPM pool
|
||||
template:
|
||||
src: ../templates/www.conf.j2
|
||||
dest: "{{ php_fpm_pool_path }}/www.conf"
|
||||
backup: yes
|
||||
notify: restart php-fpm
|
||||
tags: php
|
||||
|
||||
- name: Configure PHP settings
|
||||
lineinfile:
|
||||
path: "{{ php_cli_config_path }}/php.ini"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
backup: yes
|
||||
loop:
|
||||
- { regexp: '^upload_max_filesize', line: 'upload_max_filesize = 64M' }
|
||||
- { regexp: '^post_max_size', line: 'post_max_size = 64M' }
|
||||
- { regexp: '^memory_limit', line: 'memory_limit = 256M' }
|
||||
- { regexp: '^max_execution_time', line: 'max_execution_time = 300' }
|
||||
- { regexp: '^disable_functions', line: 'disable_functions = ' }
|
||||
notify: restart php-fpm
|
||||
tags: php
|
||||
|
||||
# WordPress Configuration
|
||||
- name: Configure WordPress
|
||||
template:
|
||||
src: ../templates/wp-config.php.j2
|
||||
dest: "{{ wordpress_path }}/wp-config.php"
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0600'
|
||||
tags: wordpress
|
||||
|
||||
# WP-CLI Installation
|
||||
- name: Download WP-CLI
|
||||
get_url:
|
||||
url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
|
||||
dest: /usr/local/bin/wp
|
||||
mode: '0755'
|
||||
tags: wp-cli
|
||||
|
||||
- name: Verify WP-CLI installation
|
||||
command: wp --info
|
||||
environment:
|
||||
HOME: "{{ wordpress_path }}"
|
||||
register: wp_cli_info
|
||||
tags: wp-cli
|
||||
|
||||
- name: Display WP-CLI info
|
||||
debug:
|
||||
var: wp_cli_info.stdout_lines
|
||||
tags: wp-cli
|
||||
|
||||
# WordPress Core Installation
|
||||
- name: Install WordPress Core
|
||||
command: >
|
||||
wp core install
|
||||
--url="{{ wp_site_url }}"
|
||||
--title="{{ wp_site_title }}"
|
||||
--admin_user="{{ wp_admin_user }}"
|
||||
--admin_password="{{ wp_admin_password }}"
|
||||
--admin_email="{{ wp_admin_email }}"
|
||||
--path="{{ wordpress_path }}"
|
||||
--allow-root
|
||||
environment:
|
||||
HOME: "{{ wordpress_path }}"
|
||||
tags: wp-install
|
||||
|
||||
- name: Set WordPress file ownership after installation
|
||||
file:
|
||||
path: "{{ wordpress_path }}"
|
||||
owner: "{{ nginx_user }}"
|
||||
group: "{{ nginx_user }}"
|
||||
recurse: yes
|
||||
tags: wp-install
|
||||
|
||||
- name: Display WordPress installation success
|
||||
debug:
|
||||
msg: |
|
||||
WordPress installation completed!
|
||||
URL: {{ wp_site_url }}
|
||||
Admin User: {{ wp_admin_user }}
|
||||
Admin Password: {{ wp_admin_password }}
|
||||
Admin Email: {{ wp_admin_email }}
|
||||
tags: wp-install
|
||||
|
||||
# =============================
|
||||
# REDIS CACHE (ULTIMATE FEATURE)
|
||||
# =============================
|
||||
- name: Install Redis server
|
||||
package:
|
||||
name: redis-server
|
||||
state: present
|
||||
when: enable_redis | default(false)
|
||||
tags: redis
|
||||
|
||||
- name: Start and enable Redis
|
||||
service:
|
||||
name: redis-server
|
||||
state: started
|
||||
enabled: yes
|
||||
when: enable_redis | default(false)
|
||||
tags: redis
|
||||
|
||||
- name: Configure Redis for WordPress
|
||||
lineinfile:
|
||||
path: /etc/redis/redis.conf
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
backup: yes
|
||||
loop:
|
||||
- { regexp: '^# maxmemory', line: 'maxmemory 128mb' }
|
||||
- { regexp: '^# maxmemory-policy', line: 'maxmemory-policy allkeys-lru' }
|
||||
- { regexp: '^save 900 1', line: 'save 900 1' }
|
||||
when: enable_redis | default(false)
|
||||
notify: restart redis
|
||||
tags: redis
|
||||
|
||||
- name: Install Redis Object Cache plugin
|
||||
command: >
|
||||
wp plugin install redis-cache --activate
|
||||
--path="{{ wordpress_path }}"
|
||||
--allow-root
|
||||
environment:
|
||||
HOME: "{{ wordpress_path }}"
|
||||
when: enable_redis | default(false)
|
||||
tags: redis
|
||||
|
||||
- name: Enable Redis object cache
|
||||
command: >
|
||||
wp redis enable
|
||||
--path="{{ wordpress_path }}"
|
||||
--allow-root
|
||||
environment:
|
||||
HOME: "{{ wordpress_path }}"
|
||||
when: enable_redis | default(false)
|
||||
ignore_errors: yes
|
||||
tags: redis
|
||||
|
||||
- name: Display Redis status
|
||||
debug:
|
||||
msg: "Redis caching {{ 'ENABLED' if enable_redis | default(false) else 'DISABLED' }}"
|
||||
tags: redis
|
||||
|
||||
# =============================
|
||||
# OPCACHE OPTIMIZATION (ULTIMATE FEATURE)
|
||||
# =============================
|
||||
- name: Configure OPcache for WordPress
|
||||
lineinfile:
|
||||
path: "{{ php_cli_config_path }}/php.ini"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
backup: yes
|
||||
loop:
|
||||
- { regexp: '^;?opcache.enable=', line: 'opcache.enable=1' }
|
||||
- { regexp: '^;?opcache.memory_consumption=', line: 'opcache.memory_consumption=128' }
|
||||
- { regexp: '^;?opcache.interned_strings_buffer=', line: 'opcache.interned_strings_buffer=8' }
|
||||
- { regexp: '^;?opcache.max_accelerated_files=', line: 'opcache.max_accelerated_files=4000' }
|
||||
- { regexp: '^;?opcache.revalidate_freq=', line: 'opcache.revalidate_freq=2' }
|
||||
- { regexp: '^;?opcache.fast_shutdown=', line: 'opcache.fast_shutdown=1' }
|
||||
when: enable_opcache | default(false)
|
||||
notify: restart php-fpm
|
||||
tags: opcache
|
||||
|
||||
- name: Configure OPcache for PHP-FPM
|
||||
lineinfile:
|
||||
path: "/etc/php/{{ php_version }}/fpm/php.ini"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
backup: yes
|
||||
loop:
|
||||
- { regexp: '^;?opcache.enable=', line: 'opcache.enable=1' }
|
||||
- { regexp: '^;?opcache.memory_consumption=', line: 'opcache.memory_consumption=128' }
|
||||
- { regexp: '^;?opcache.interned_strings_buffer=', line: 'opcache.interned_strings_buffer=8' }
|
||||
- { regexp: '^;?opcache.max_accelerated_files=', line: 'opcache.max_accelerated_files=4000' }
|
||||
- { regexp: '^;?opcache.revalidate_freq=', line: 'opcache.revalidate_freq=2' }
|
||||
- { regexp: '^;?opcache.fast_shutdown=', line: 'opcache.fast_shutdown=1' }
|
||||
when: enable_opcache | default(false)
|
||||
notify: restart php-fpm
|
||||
tags: opcache
|
||||
|
||||
- name: Display OPcache status
|
||||
debug:
|
||||
msg: "OPcache optimization {{ 'ENABLED' if enable_opcache | default(false) else 'DISABLED' }}"
|
||||
tags: opcache
|
||||
|
||||
# =============================
|
||||
# NGINX PERFORMANCE OPTIMIZATION (ULTIMATE FEATURE)
|
||||
# =============================
|
||||
- name: Backup original nginx.conf
|
||||
copy:
|
||||
src: /etc/nginx/nginx.conf
|
||||
dest: /etc/nginx/nginx.conf.backup
|
||||
remote_src: yes
|
||||
when: enable_nginx_optimization | default(false)
|
||||
tags: nginx-optimization
|
||||
|
||||
# Clean up any existing ansible-managed blocks first
|
||||
- name: Remove existing ansible-managed blocks from nginx.conf
|
||||
blockinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - Ultimate Performance"
|
||||
state: absent
|
||||
when: enable_nginx_optimization | default(false)
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Remove duplicate worker directives from wrong blocks
|
||||
lineinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
regexp: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- '^\s*worker_processes\s+auto;.*# Added by Ansible'
|
||||
- '^\s*worker_rlimit_nofile\s+65535;.*# Added by Ansible'
|
||||
when: enable_nginx_optimization | default(false)
|
||||
tags: nginx-optimization
|
||||
|
||||
# Configure Worker settings in main block (before events)
|
||||
- name: Configure Nginx worker settings in main block (before events)
|
||||
lineinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
insertbefore: "events {"
|
||||
backup: yes
|
||||
loop:
|
||||
- { regexp: '^worker_processes', line: 'worker_processes auto;' }
|
||||
- { regexp: '^worker_rlimit_nofile', line: 'worker_rlimit_nofile 65535;' }
|
||||
when: enable_nginx_optimization | default(false)
|
||||
notify: restart nginx
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Configure Nginx events block
|
||||
lineinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
regexp: '^(\s*)worker_connections.*'
|
||||
line: '\1worker_connections 2048;'
|
||||
backrefs: yes
|
||||
backup: yes
|
||||
when: enable_nginx_optimization | default(false)
|
||||
notify: restart nginx
|
||||
tags: nginx-optimization
|
||||
|
||||
# Configure HTTP block optimizations (only unique directives)
|
||||
- name: Configure optimized Nginx HTTP configuration
|
||||
blockinfile:
|
||||
path: /etc/nginx/nginx.conf
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - HTTP Performance"
|
||||
insertafter: "http {"
|
||||
block: |
|
||||
# Ultimate Performance optimizations (unique directives only)
|
||||
keepalive_requests 1000;
|
||||
|
||||
# Enhanced Gzip compression
|
||||
gzip_vary on;
|
||||
gzip_min_length 1000;
|
||||
gzip_comp_level 6;
|
||||
gzip_types
|
||||
text/plain
|
||||
text/css
|
||||
text/xml
|
||||
text/javascript
|
||||
application/javascript
|
||||
application/json
|
||||
application/xml+rss
|
||||
application/atom+xml
|
||||
image/svg+xml;
|
||||
|
||||
# Buffer sizes
|
||||
client_body_buffer_size 128k;
|
||||
client_max_body_size 64m;
|
||||
client_header_buffer_size 1k;
|
||||
large_client_header_buffers 4 4k;
|
||||
|
||||
# Timeouts
|
||||
client_body_timeout 12;
|
||||
client_header_timeout 12;
|
||||
send_timeout 10;
|
||||
|
||||
# Cache for file handles
|
||||
open_file_cache max=200000 inactive=20s;
|
||||
open_file_cache_valid 30s;
|
||||
open_file_cache_min_uses 2;
|
||||
open_file_cache_errors on;
|
||||
backup: yes
|
||||
when: enable_nginx_optimization | default(false)
|
||||
notify: restart nginx
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Create Nginx cache directory
|
||||
file:
|
||||
path: /var/cache/nginx/fastcgi
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0755'
|
||||
when: enable_nginx_optimization | default(false)
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Display Nginx optimization status
|
||||
debug:
|
||||
msg: "Nginx performance optimization {{ 'ENABLED' if enable_nginx_optimization | default(false) else 'DISABLED' }}"
|
||||
tags: nginx-optimization
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service:
|
||||
name: "{{ nginx_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart php-fpm
|
||||
service:
|
||||
name: "{{ php_fpm_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart mysql
|
||||
service:
|
||||
name: "{{ mysql_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart redis
|
||||
service:
|
||||
name: redis-server
|
||||
state: restarted
|
||||
@@ -30,22 +30,52 @@
|
||||
msg: "This playbook only supports Ubuntu/Debian systems. Detected: {{ ansible_os_family }}"
|
||||
when: ansible_os_family != "Debian"
|
||||
|
||||
# Environment Detection and Configuration
|
||||
- name: Detect if running in Docker
|
||||
stat:
|
||||
path: /.dockerenv
|
||||
register: docker_env
|
||||
tags: always
|
||||
|
||||
- name: Check for deployment_environment override
|
||||
set_fact:
|
||||
environment_override: "{{ deployment_environment is defined }}"
|
||||
tags: always
|
||||
|
||||
- name: Set deployment environment (auto-detect or override)
|
||||
set_fact:
|
||||
deployment_environment: "{{ deployment_environment | default('docker' if docker_env.stat.exists else 'bare_metal') }}"
|
||||
tags: always
|
||||
|
||||
- name: Set WordPress site URL with smart defaults
|
||||
set_fact:
|
||||
wp_site_url: "{{ wp_site_url | default(_auto_wp_url) }}"
|
||||
vars:
|
||||
_auto_wp_url: "{{ 'http://localhost:8080' if (deployment_environment == 'docker') else 'http://' + (ansible_default_ipv4.address | default('localhost')) }}"
|
||||
tags: always
|
||||
|
||||
- name: Debug deployment configuration
|
||||
debug:
|
||||
msg: |
|
||||
Environment: {{ deployment_environment }} ({{ 'overridden' if environment_override else 'auto-detected' }})
|
||||
WordPress URL: {{ wp_site_url }}
|
||||
Docker detected: {{ docker_env.stat.exists }}
|
||||
tags: always
|
||||
|
||||
vars:
|
||||
# WordPress Configuration
|
||||
wordpress_path: "{{ web_root }}"
|
||||
wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}"
|
||||
|
||||
# Database Configuration
|
||||
mysql_root_password: "{{ mysql_root_password | default('secure_root_password_' + ansible_date_time.epoch) }}"
|
||||
wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
|
||||
wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
|
||||
wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_' + ansible_date_time.epoch) }}"
|
||||
# Database Configuration (use inventory variables or these defaults)
|
||||
default_mysql_root_password: "{{ mysql_root_password | default('secure_root_password_123') }}"
|
||||
default_wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
|
||||
default_wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
|
||||
default_wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_123') }}"
|
||||
|
||||
# WordPress Admin
|
||||
wp_admin_user: "{{ wp_admin_user | default('admin') }}"
|
||||
wp_admin_password: "{{ wp_admin_password | default('secure_admin_password_' + ansible_date_time.epoch) }}"
|
||||
wp_admin_email: "{{ wp_admin_email | default('admin@localhost') }}"
|
||||
wp_site_title: "{{ wp_site_title | default('My WordPress Site') }}"
|
||||
# WordPress Admin (use inventory variables directly)
|
||||
# These variables come from inventory/production.yml
|
||||
# wp_admin_user, wp_admin_password, wp_admin_email, wp_site_title
|
||||
|
||||
tasks:
|
||||
# Package Installation
|
||||
@@ -95,13 +125,15 @@
|
||||
- "443"
|
||||
tags: firewall
|
||||
|
||||
# MySQL Security
|
||||
- name: Set MySQL root password
|
||||
# MySQL Security (Ubuntu 24.04 fix for auth_socket)
|
||||
- name: Set MySQL root password (using auth_socket first)
|
||||
mysql_user:
|
||||
name: root
|
||||
password: "{{ mysql_root_password }}"
|
||||
plugin: mysql_native_password
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
state: present
|
||||
become: true
|
||||
tags: mysql
|
||||
|
||||
- name: Create MySQL configuration for root
|
||||
@@ -150,6 +182,12 @@
|
||||
mode: '0755'
|
||||
tags: wordpress
|
||||
|
||||
- name: Remove default nginx index file
|
||||
file:
|
||||
path: "{{ wordpress_path }}/index.nginx-debian.html"
|
||||
state: absent
|
||||
tags: wordpress
|
||||
|
||||
- name: Download WordPress
|
||||
get_url:
|
||||
url: https://wordpress.org/latest.tar.gz
|
||||
@@ -165,7 +203,7 @@
|
||||
tags: wordpress
|
||||
|
||||
- name: Copy WordPress files
|
||||
command: "cp -r /tmp/wordpress/* {{ wordpress_path }}/"
|
||||
command: "cp -r /tmp/wordpress/. {{ wordpress_path }}/"
|
||||
args:
|
||||
creates: "{{ wordpress_path }}/wp-config-sample.php"
|
||||
tags: wordpress
|
||||
@@ -178,10 +216,22 @@
|
||||
recurse: yes
|
||||
tags: wordpress
|
||||
|
||||
# SSL Configuration (optional)
|
||||
- name: Generate self-signed SSL certificate (if SSL enabled but no cert provided)
|
||||
command: >
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048
|
||||
-keyout {{ ssl_cert_key_path | default('/etc/ssl/private/nginx-selfsigned.key') }}
|
||||
-out {{ ssl_cert_path | default('/etc/ssl/certs/nginx-selfsigned.crt') }}
|
||||
-subj "/C=DE/ST=State/L=City/O=Organization/OU=OrgUnit/CN={{ domain_name }}"
|
||||
when:
|
||||
- ssl_enabled | default(false)
|
||||
- not (ssl_cert_path is defined and ssl_cert_key_path is defined)
|
||||
tags: ssl
|
||||
|
||||
# Nginx Configuration
|
||||
- name: Configure Nginx for WordPress
|
||||
template:
|
||||
src: ../templates/wordpress.nginx.j2
|
||||
src: ../templates/{% if ssl_enabled | default(false) %}wordpress-ssl.nginx.j2{% else %}wordpress.nginx.j2{% endif %}
|
||||
dest: "{{ nginx_sites_available }}/wordpress"
|
||||
notify: restart nginx
|
||||
tags: nginx
|
||||
@@ -244,7 +294,6 @@
|
||||
|
||||
- name: Verify WP-CLI installation
|
||||
command: wp --info
|
||||
become_user: www-data
|
||||
environment:
|
||||
HOME: "{{ wordpress_path }}"
|
||||
register: wp_cli_info
|
||||
@@ -255,6 +304,39 @@
|
||||
var: wp_cli_info.stdout_lines
|
||||
tags: wp-cli
|
||||
|
||||
# WordPress Core Installation
|
||||
- name: Install WordPress Core
|
||||
command: >
|
||||
wp core install
|
||||
--url="{{ wp_site_url }}"
|
||||
--title="{{ wp_site_title }}"
|
||||
--admin_user="{{ wp_admin_user }}"
|
||||
--admin_password="{{ wp_admin_password }}"
|
||||
--admin_email="{{ wp_admin_email }}"
|
||||
--path="{{ wordpress_path }}"
|
||||
--allow-root
|
||||
environment:
|
||||
HOME: "{{ wordpress_path }}"
|
||||
tags: wp-install
|
||||
|
||||
- name: Set WordPress file ownership after installation
|
||||
file:
|
||||
path: "{{ wordpress_path }}"
|
||||
owner: "{{ nginx_user }}"
|
||||
group: "{{ nginx_user }}"
|
||||
recurse: yes
|
||||
tags: wp-install
|
||||
|
||||
- name: Display WordPress installation success
|
||||
debug:
|
||||
msg: |
|
||||
WordPress installation completed!
|
||||
URL: {{ wp_site_url }}
|
||||
Admin User: {{ wp_admin_user }}
|
||||
Admin Password: {{ wp_admin_password }}
|
||||
Admin Email: {{ wp_admin_email }}
|
||||
tags: wp-install
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service:
|
||||
|
||||
@@ -1,289 +0,0 @@
|
||||
---
|
||||
# Ultimate WordPress Performance Optimization Playbook
|
||||
- name: Ultimate WordPress Performance Optimization
|
||||
hosts: all
|
||||
become: yes
|
||||
vars_files:
|
||||
- "../vars/{{ ansible_os_family | lower }}.yml"
|
||||
|
||||
vars:
|
||||
# Performance Configuration
|
||||
enable_performance_monitoring: "{{ enable_performance_monitoring | default(true) }}"
|
||||
enable_system_optimization: "{{ enable_system_optimization | default(true) }}"
|
||||
enable_nginx_optimization: "{{ enable_nginx_optimization | default(true) }}"
|
||||
enable_php_optimization: "{{ enable_php_optimization | default(true) }}"
|
||||
enable_mysql_optimization: "{{ enable_mysql_optimization | default(true) }}"
|
||||
|
||||
# Nginx Performance Settings
|
||||
nginx_worker_processes: "{{ ansible_processor_vcpus }}"
|
||||
nginx_worker_connections: "{{ (ansible_memtotal_mb / 4) | int }}"
|
||||
nginx_fastcgi_cache_enabled: true
|
||||
nginx_fastcgi_cache_size: "{{ (ansible_memtotal_mb / 10) | int }}m"
|
||||
|
||||
# PHP Performance Settings
|
||||
php_memory_limit: "{{ (ansible_memtotal_mb / 4) | int }}M"
|
||||
php_max_execution_time: 300
|
||||
php_max_input_vars: 3000
|
||||
|
||||
# MySQL Performance Settings
|
||||
innodb_buffer_pool_size: "{{ (ansible_memtotal_mb / 2) | int }}M"
|
||||
max_connections: "{{ (ansible_memtotal_mb / 10) | int }}"
|
||||
|
||||
tasks:
|
||||
# System Optimizations
|
||||
- name: Apply system performance optimizations
|
||||
template:
|
||||
src: ../templates/sysctl.conf.j2
|
||||
dest: /etc/sysctl.d/99-wordpress-performance.conf
|
||||
backup: yes
|
||||
when: enable_system_optimization
|
||||
notify: reload sysctl
|
||||
tags: system-optimization
|
||||
|
||||
- name: Set system limits for web services
|
||||
blockinfile:
|
||||
path: /etc/security/limits.conf
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - WordPress Performance"
|
||||
block: |
|
||||
# Limits for web services
|
||||
www-data soft nofile 65536
|
||||
www-data hard nofile 65536
|
||||
mysql soft nofile 65536
|
||||
mysql hard nofile 65536
|
||||
redis soft nofile 65536
|
||||
redis hard nofile 65536
|
||||
when: enable_system_optimization
|
||||
tags: system-optimization
|
||||
|
||||
# Nginx Performance Optimization
|
||||
- name: Optimize Nginx main configuration
|
||||
template:
|
||||
src: ../templates/nginx.conf.j2
|
||||
dest: /etc/nginx/nginx.conf
|
||||
backup: yes
|
||||
when: enable_nginx_optimization
|
||||
notify: restart nginx
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Create FastCGI cache directory
|
||||
file:
|
||||
path: /var/cache/nginx
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: '0755'
|
||||
when: nginx_fastcgi_cache_enabled
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Configure Nginx FastCGI cache
|
||||
copy:
|
||||
content: |
|
||||
# FastCGI cache configuration
|
||||
include /etc/nginx/conf.d/fastcgi-cache.conf;
|
||||
dest: /etc/nginx/conf.d/fastcgi-cache-include.conf
|
||||
when: nginx_fastcgi_cache_enabled
|
||||
notify: restart nginx
|
||||
tags: nginx-optimization
|
||||
|
||||
- name: Create FastCGI cache configuration
|
||||
template:
|
||||
src: ../templates/fastcgi-cache.conf.j2
|
||||
dest: /etc/nginx/conf.d/fastcgi-cache.conf
|
||||
when: nginx_fastcgi_cache_enabled
|
||||
notify: restart nginx
|
||||
tags: nginx-optimization
|
||||
|
||||
# PHP Performance Optimization
|
||||
- name: Optimize PHP configuration
|
||||
template:
|
||||
src: ../templates/php.ini.j2
|
||||
dest: "{{ php_ini_path }}"
|
||||
backup: yes
|
||||
when: enable_php_optimization
|
||||
notify: restart php-fpm
|
||||
tags: php-optimization
|
||||
|
||||
- name: Optimize PHP-FPM pool configuration
|
||||
template:
|
||||
src: ../templates/www.conf.j2
|
||||
dest: "{{ php_fpm_pool_dir }}/www.conf"
|
||||
backup: yes
|
||||
when: enable_php_optimization
|
||||
notify: restart php-fpm
|
||||
tags: php-optimization
|
||||
|
||||
# MySQL Performance Optimization
|
||||
- name: Optimize MySQL configuration
|
||||
template:
|
||||
src: ../templates/my.cnf.j2
|
||||
dest: "{{ mysql_conf_file }}"
|
||||
backup: yes
|
||||
when: enable_mysql_optimization
|
||||
notify: restart mysql
|
||||
tags: mysql-optimization
|
||||
|
||||
# Redis Performance (if enabled)
|
||||
- name: Optimize Redis configuration
|
||||
template:
|
||||
src: ../templates/redis.conf.j2
|
||||
dest: /etc/redis/redis.conf
|
||||
backup: yes
|
||||
when: enable_redis is defined and enable_redis
|
||||
notify: restart redis
|
||||
tags: redis-optimization
|
||||
|
||||
# WordPress Cron Optimization
|
||||
- name: Create optimized WordPress cron script
|
||||
template:
|
||||
src: ../templates/wordpress-cron.sh.j2
|
||||
dest: /usr/local/bin/wordpress-cron.sh
|
||||
mode: '0755'
|
||||
tags: wordpress-optimization
|
||||
|
||||
- name: Disable default WordPress cron and use system cron
|
||||
cron:
|
||||
name: "WordPress Cron"
|
||||
minute: "*/5"
|
||||
job: "/usr/local/bin/wordpress-cron.sh"
|
||||
user: root
|
||||
tags: wordpress-optimization
|
||||
|
||||
- name: Install Redis Object Cache plugin (if Redis enabled)
|
||||
command: >
|
||||
wp plugin install redis-cache --activate --allow-root
|
||||
args:
|
||||
chdir: "{{ wordpress_path }}"
|
||||
when: enable_redis is defined and enable_redis
|
||||
become_user: "{{ nginx_user }}"
|
||||
tags: wordpress-optimization
|
||||
|
||||
- name: Enable Redis Object Cache
|
||||
command: >
|
||||
wp redis enable --allow-root
|
||||
args:
|
||||
chdir: "{{ wordpress_path }}"
|
||||
when: enable_redis is defined and enable_redis
|
||||
become_user: "{{ nginx_user }}"
|
||||
ignore_errors: yes
|
||||
tags: wordpress-optimization
|
||||
|
||||
# Performance Monitoring
|
||||
- name: Install performance monitoring script
|
||||
template:
|
||||
src: ../templates/performance-monitor.sh.j2
|
||||
dest: /usr/local/bin/wordpress-performance-monitor.sh
|
||||
mode: '0755'
|
||||
when: enable_performance_monitoring
|
||||
tags: monitoring
|
||||
|
||||
- name: Schedule performance monitoring
|
||||
cron:
|
||||
name: "WordPress Performance Monitoring"
|
||||
minute: "*/15"
|
||||
job: "/usr/local/bin/wordpress-performance-monitor.sh"
|
||||
user: root
|
||||
when: enable_performance_monitoring
|
||||
tags: monitoring
|
||||
|
||||
# Log Management
|
||||
- name: Configure logrotate for WordPress
|
||||
template:
|
||||
src: ../templates/logrotate.conf.j2
|
||||
dest: /etc/logrotate.d/wordpress
|
||||
tags: log-management
|
||||
|
||||
# Cache Warming Script
|
||||
- name: Create cache warming script
|
||||
copy:
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# Cache warming script for WordPress
|
||||
|
||||
WORDPRESS_URL="{{ wordpress_url }}"
|
||||
SITEMAP_URL="${WORDPRESS_URL}/sitemap.xml"
|
||||
|
||||
# Warm up homepage
|
||||
curl -s "$WORDPRESS_URL" > /dev/null
|
||||
|
||||
# Warm up sitemap URLs (if sitemap exists)
|
||||
if curl -s "$SITEMAP_URL" | grep -q "xml"; then
|
||||
curl -s "$SITEMAP_URL" | grep -oP 'https?://[^<]+' | head -20 | while read url; do
|
||||
curl -s "$url" > /dev/null
|
||||
sleep 1
|
||||
done
|
||||
fi
|
||||
dest: /usr/local/bin/wordpress-cache-warm.sh
|
||||
mode: '0755'
|
||||
when: nginx_fastcgi_cache_enabled
|
||||
tags: cache-optimization
|
||||
|
||||
- name: Schedule cache warming
|
||||
cron:
|
||||
name: "WordPress Cache Warming"
|
||||
minute: "0"
|
||||
hour: "6"
|
||||
job: "/usr/local/bin/wordpress-cache-warm.sh"
|
||||
user: www-data
|
||||
when: nginx_fastcgi_cache_enabled
|
||||
tags: cache-optimization
|
||||
|
||||
# Database Optimization
|
||||
- name: Create database optimization script
|
||||
copy:
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# WordPress Database Optimization Script
|
||||
|
||||
cd {{ wordpress_path }}
|
||||
|
||||
# Optimize database tables
|
||||
wp db optimize --allow-root
|
||||
|
||||
# Clean up spam comments
|
||||
wp comment delete $(wp comment list --status=spam --format=ids --allow-root) --allow-root 2>/dev/null || true
|
||||
|
||||
# Clean up trash posts
|
||||
wp post delete $(wp post list --post_status=trash --format=ids --allow-root) --allow-root 2>/dev/null || true
|
||||
|
||||
# Clean up expired transients
|
||||
wp transient delete --expired --allow-root
|
||||
|
||||
# Update search index (if search plugin is installed)
|
||||
wp search-replace 'old-domain.com' '{{ domain_name }}' --dry-run --allow-root || true
|
||||
dest: /usr/local/bin/wordpress-db-optimize.sh
|
||||
mode: '0755'
|
||||
tags: database-optimization
|
||||
|
||||
- name: Schedule weekly database optimization
|
||||
cron:
|
||||
name: "WordPress Database Optimization"
|
||||
minute: "0"
|
||||
hour: "3"
|
||||
weekday: "0"
|
||||
job: "/usr/local/bin/wordpress-db-optimize.sh"
|
||||
user: root
|
||||
tags: database-optimization
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service:
|
||||
name: "{{ nginx_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart php-fpm
|
||||
service:
|
||||
name: "{{ php_fpm_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart mysql
|
||||
service:
|
||||
name: "{{ mysql_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart redis
|
||||
service:
|
||||
name: redis-server
|
||||
state: restarted
|
||||
|
||||
- name: reload sysctl
|
||||
command: sysctl -p /etc/sysctl.d/99-wordpress-performance.conf
|
||||
@@ -1,313 +0,0 @@
|
||||
---
|
||||
# Advanced WordPress features and optimizations
|
||||
- name: WordPress Advanced Features Setup
|
||||
hosts: all
|
||||
become: yes
|
||||
vars_files:
|
||||
- "../vars/{{ ansible_os_family | lower }}.yml"
|
||||
|
||||
vars:
|
||||
# Backup Configuration
|
||||
enable_backups: "{{ enable_backups | default(true) }}"
|
||||
backup_schedule: "{{ backup_schedule | default('0 2 * * *') }}" # Daily at 2 AM
|
||||
backup_retention_days: "{{ backup_retention_days | default(7) }}"
|
||||
backup_destination: "{{ backup_destination | default('/var/backups/wordpress') }}"
|
||||
|
||||
# Performance Configuration
|
||||
enable_redis: "{{ enable_redis | default(false) }}"
|
||||
enable_memcached: "{{ enable_memcached | default(false) }}"
|
||||
enable_opcache: "{{ enable_opcache | default(true) }}"
|
||||
|
||||
# Security Configuration
|
||||
enable_fail2ban: "{{ enable_fail2ban | default(true) }}"
|
||||
enable_modsecurity: "{{ enable_modsecurity | default(false) }}"
|
||||
|
||||
# Monitoring Configuration
|
||||
enable_monitoring: "{{ enable_monitoring | default(false) }}"
|
||||
|
||||
# WordPress Multisite
|
||||
enable_multisite: "{{ enable_multisite | default(false) }}"
|
||||
multisite_type: "{{ multisite_type | default('subdirectory') }}" # subdirectory or subdomain
|
||||
|
||||
tasks:
|
||||
# Backup System
|
||||
- name: Install backup dependencies
|
||||
package:
|
||||
name:
|
||||
- rsync
|
||||
- gzip
|
||||
- tar
|
||||
state: present
|
||||
when: enable_backups
|
||||
tags: backup
|
||||
|
||||
- name: Create backup directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
loop:
|
||||
- "{{ backup_destination }}"
|
||||
- "{{ backup_destination }}/database"
|
||||
- "{{ backup_destination }}/files"
|
||||
when: enable_backups
|
||||
tags: backup
|
||||
|
||||
- name: Create backup script
|
||||
template:
|
||||
src: ../templates/wordpress-backup.sh.j2
|
||||
dest: /usr/local/bin/wordpress-backup.sh
|
||||
mode: '0755'
|
||||
when: enable_backups
|
||||
tags: backup
|
||||
|
||||
- name: Schedule WordPress backups
|
||||
cron:
|
||||
name: "WordPress Backup"
|
||||
minute: "{{ backup_schedule.split()[0] }}"
|
||||
hour: "{{ backup_schedule.split()[1] }}"
|
||||
day: "{{ backup_schedule.split()[2] }}"
|
||||
month: "{{ backup_schedule.split()[3] }}"
|
||||
weekday: "{{ backup_schedule.split()[4] }}"
|
||||
job: "/usr/local/bin/wordpress-backup.sh"
|
||||
when: enable_backups
|
||||
tags: backup
|
||||
|
||||
# Redis Cache
|
||||
- name: Install Redis
|
||||
package:
|
||||
name: redis-server
|
||||
state: present
|
||||
when: enable_redis
|
||||
tags: redis
|
||||
|
||||
- name: Configure Redis
|
||||
template:
|
||||
src: ../templates/redis.conf.j2
|
||||
dest: /etc/redis/redis.conf
|
||||
backup: yes
|
||||
when: enable_redis
|
||||
notify: restart redis
|
||||
tags: redis
|
||||
|
||||
- name: Start and enable Redis
|
||||
service:
|
||||
name: redis-server
|
||||
state: started
|
||||
enabled: yes
|
||||
when: enable_redis
|
||||
tags: redis
|
||||
|
||||
- name: Install Redis PHP extension
|
||||
package:
|
||||
name: "php{{ php_version }}-redis"
|
||||
state: present
|
||||
when: enable_redis and ansible_os_family == "Debian"
|
||||
notify: restart php-fpm
|
||||
tags: redis
|
||||
|
||||
# Memcached
|
||||
- name: Install Memcached
|
||||
package:
|
||||
name:
|
||||
- memcached
|
||||
- "php{{ php_version }}-memcached"
|
||||
state: present
|
||||
when: enable_memcached and ansible_os_family == "Debian"
|
||||
tags: memcached
|
||||
|
||||
- name: Configure Memcached
|
||||
template:
|
||||
src: ../templates/memcached.conf.j2
|
||||
dest: /etc/memcached.conf
|
||||
backup: yes
|
||||
when: enable_memcached
|
||||
notify: restart memcached
|
||||
tags: memcached
|
||||
|
||||
- name: Start and enable Memcached
|
||||
service:
|
||||
name: memcached
|
||||
state: started
|
||||
enabled: yes
|
||||
when: enable_memcached
|
||||
tags: memcached
|
||||
|
||||
# PHP OPcache Optimization
|
||||
- name: Configure PHP OPcache
|
||||
blockinfile:
|
||||
path: "{{ php_ini_path }}"
|
||||
marker: "; {mark} ANSIBLE MANAGED BLOCK - OPcache"
|
||||
block: |
|
||||
; OPcache Configuration
|
||||
opcache.enable=1
|
||||
opcache.memory_consumption=256
|
||||
opcache.interned_strings_buffer=16
|
||||
opcache.max_accelerated_files=10000
|
||||
opcache.revalidate_freq=2
|
||||
opcache.save_comments=1
|
||||
opcache.enable_file_override=1
|
||||
when: enable_opcache
|
||||
notify: restart php-fpm
|
||||
tags: opcache
|
||||
|
||||
# Fail2Ban Security
|
||||
- name: Install Fail2Ban
|
||||
package:
|
||||
name: fail2ban
|
||||
state: present
|
||||
when: enable_fail2ban
|
||||
tags: fail2ban
|
||||
|
||||
- name: Configure Fail2Ban for WordPress
|
||||
template:
|
||||
src: ../templates/fail2ban-wordpress.conf.j2
|
||||
dest: /etc/fail2ban/jail.d/wordpress.conf
|
||||
when: enable_fail2ban
|
||||
notify: restart fail2ban
|
||||
tags: fail2ban
|
||||
|
||||
- name: Start and enable Fail2Ban
|
||||
service:
|
||||
name: fail2ban
|
||||
state: started
|
||||
enabled: yes
|
||||
when: enable_fail2ban
|
||||
tags: fail2ban
|
||||
|
||||
# WordPress Plugins for Performance
|
||||
- name: Install WordPress performance plugins
|
||||
command: >
|
||||
wp plugin install {{ item }} --activate --allow-root
|
||||
args:
|
||||
chdir: "{{ wordpress_path }}"
|
||||
loop:
|
||||
- w3-total-cache
|
||||
- wp-optimize
|
||||
- wordfence
|
||||
when: enable_monitoring
|
||||
become_user: "{{ nginx_user }}"
|
||||
tags: wordpress-plugins
|
||||
|
||||
# WordPress Multisite Setup
|
||||
- name: Configure WordPress Multisite
|
||||
blockinfile:
|
||||
path: "{{ wordpress_path }}/wp-config.php"
|
||||
marker: "/* {mark} ANSIBLE MANAGED BLOCK - Multisite */"
|
||||
insertbefore: "/* That's all, stop editing!"
|
||||
block: |
|
||||
/* Multisite Configuration */
|
||||
define('WP_ALLOW_MULTISITE', true);
|
||||
define('MULTISITE', true);
|
||||
define('SUBDOMAIN_INSTALL', {{ 'true' if multisite_type == 'subdomain' else 'false' }});
|
||||
define('DOMAIN_CURRENT_SITE', '{{ domain_name | default(ansible_default_ipv4.address) }}');
|
||||
define('PATH_CURRENT_SITE', '/');
|
||||
define('SITE_ID_CURRENT_SITE', 1);
|
||||
define('BLOG_ID_CURRENT_SITE', 1);
|
||||
when: enable_multisite
|
||||
tags: multisite
|
||||
|
||||
- name: Configure Nginx for WordPress Multisite
|
||||
template:
|
||||
src: ../templates/wordpress-multisite.nginx.j2
|
||||
dest: "{{ nginx_sites_available }}/wordpress"
|
||||
backup: yes
|
||||
when: enable_multisite and ansible_os_family == "Debian"
|
||||
notify: restart nginx
|
||||
tags: multisite
|
||||
|
||||
# SSL Certificate Auto-renewal with notifications
|
||||
- name: Create SSL renewal notification script
|
||||
template:
|
||||
src: ../templates/ssl-renewal-notify.sh.j2
|
||||
dest: /usr/local/bin/ssl-renewal-notify.sh
|
||||
mode: '0755'
|
||||
when: enable_ssl is defined and enable_ssl
|
||||
tags: ssl
|
||||
|
||||
- name: Schedule SSL renewal with notifications
|
||||
cron:
|
||||
name: "Renew SSL certificates with notification"
|
||||
minute: "0"
|
||||
hour: "12"
|
||||
job: "/usr/local/bin/ssl-renewal-notify.sh"
|
||||
when: enable_ssl is defined and enable_ssl
|
||||
tags: ssl
|
||||
|
||||
# System Monitoring
|
||||
- name: Install monitoring tools
|
||||
package:
|
||||
name:
|
||||
- htop
|
||||
- iotop
|
||||
- nethogs
|
||||
- glances
|
||||
state: present
|
||||
when: enable_monitoring
|
||||
tags: monitoring
|
||||
|
||||
- name: Install Netdata monitoring
|
||||
shell: |
|
||||
bash <(curl -Ss https://my-netdata.io/kickstart.sh) --dont-wait --stable-channel
|
||||
args:
|
||||
creates: /usr/sbin/netdata
|
||||
when: enable_monitoring
|
||||
tags: monitoring
|
||||
|
||||
# WordPress CLI improvements
|
||||
- name: Create WP-CLI config
|
||||
template:
|
||||
src: ../templates/wp-cli.yml.j2
|
||||
dest: "{{ wordpress_path }}/wp-cli.yml"
|
||||
owner: "{{ nginx_user }}"
|
||||
group: "{{ nginx_user }}"
|
||||
tags: wp-cli
|
||||
|
||||
# Database optimization
|
||||
- name: Configure MySQL for WordPress optimization
|
||||
blockinfile:
|
||||
path: "{{ mysql_conf_file }}"
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - WordPress Optimization"
|
||||
block: |
|
||||
# WordPress Optimization
|
||||
innodb_buffer_pool_size = 256M
|
||||
innodb_log_file_size = 64M
|
||||
query_cache_type = 1
|
||||
query_cache_size = 32M
|
||||
max_connections = 200
|
||||
thread_cache_size = 8
|
||||
tmp_table_size = 32M
|
||||
max_heap_table_size = 32M
|
||||
notify: restart mysql
|
||||
tags: mysql-optimization
|
||||
|
||||
handlers:
|
||||
- name: restart nginx
|
||||
service:
|
||||
name: "{{ nginx_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart php-fpm
|
||||
service:
|
||||
name: "{{ php_fpm_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart mysql
|
||||
service:
|
||||
name: "{{ mysql_service }}"
|
||||
state: restarted
|
||||
|
||||
- name: restart redis
|
||||
service:
|
||||
name: redis-server
|
||||
state: restarted
|
||||
|
||||
- name: restart memcached
|
||||
service:
|
||||
name: memcached
|
||||
state: restarted
|
||||
|
||||
- name: restart fail2ban
|
||||
service:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
Reference in New Issue
Block a user