580 lines
18 KiB
YAML
580 lines
18 KiB
YAML
---
|
|
# Ultimate LEMP WordPress installation with Redis, OPcache and Nginx Optimization
|
|
- name: Install Ultimate LEMP stack with WordPress, Redis, OPcache and Nginx Performance (Ubuntu/Debian)
|
|
hosts: all
|
|
become: yes
|
|
|
|
pre_tasks:
|
|
- name: Gather OS facts
|
|
setup:
|
|
gather_subset:
|
|
- '!all'
|
|
- '!min'
|
|
- 'distribution'
|
|
- 'distribution_version'
|
|
- 'os_family'
|
|
|
|
- name: Load Debian family variables
|
|
include_vars: "../vars/debian-family.yml"
|
|
|
|
- name: Debug OS information
|
|
debug:
|
|
msg: |
|
|
OS Family: {{ ansible_os_family }}
|
|
Distribution: {{ ansible_distribution }}
|
|
Version: {{ ansible_distribution_version }}
|
|
Supported: Ubuntu/Debian family systems
|
|
|
|
- name: Verify supported OS
|
|
fail:
|
|
msg: "This playbook only supports Ubuntu/Debian systems. Detected: {{ ansible_os_family }}"
|
|
when: ansible_os_family != "Debian"
|
|
|
|
# Environment Detection and Configuration
|
|
- name: Detect if running in Docker
|
|
stat:
|
|
path: /.dockerenv
|
|
register: docker_env
|
|
tags: always
|
|
|
|
- name: Check for deployment_environment override
|
|
set_fact:
|
|
environment_override: "{{ deployment_environment is defined }}"
|
|
tags: always
|
|
|
|
- name: Set deployment environment (auto-detect or override)
|
|
set_fact:
|
|
deployment_environment: "{{ deployment_environment | default('docker' if docker_env.stat.exists else 'bare_metal') }}"
|
|
tags: always
|
|
|
|
- name: Set WordPress site URL with smart defaults
|
|
set_fact:
|
|
wp_site_url: "{{ wp_site_url | default(_auto_wp_url) }}"
|
|
vars:
|
|
_auto_wp_url: "{{ 'http://localhost:8080' if (deployment_environment == 'docker') else 'http://' + (ansible_default_ipv4.address | default('localhost')) }}"
|
|
tags: always
|
|
|
|
- name: Debug deployment configuration
|
|
debug:
|
|
msg: |
|
|
Environment: {{ deployment_environment }} ({{ 'overridden' if environment_override else 'auto-detected' }})
|
|
WordPress URL: {{ wp_site_url }}
|
|
Docker detected: {{ docker_env.stat.exists }}
|
|
tags: always
|
|
|
|
vars:
|
|
# WordPress Configuration
|
|
wordpress_path: "{{ web_root }}"
|
|
wordpress_url: "http://{{ ansible_default_ipv4.address | default('localhost') }}"
|
|
|
|
# Database Configuration (use inventory variables or these defaults)
|
|
default_mysql_root_password: "{{ mysql_root_password | default('secure_root_password_123') }}"
|
|
default_wordpress_db_name: "{{ wordpress_db_name | default('wordpress_db') }}"
|
|
default_wordpress_db_user: "{{ wordpress_db_user | default('wordpress_user') }}"
|
|
default_wordpress_db_password: "{{ wordpress_db_password | default('secure_wp_password_123') }}"
|
|
|
|
# WordPress Admin (use inventory variables directly)
|
|
# These variables come from inventory/production.yml
|
|
# wp_admin_user, wp_admin_password, wp_admin_email, wp_site_title
|
|
|
|
tasks:
|
|
# Package Installation
|
|
- name: Update package cache
|
|
apt:
|
|
update_cache: yes
|
|
cache_valid_time: 3600
|
|
tags: packages
|
|
|
|
- name: Install all required packages
|
|
package:
|
|
name: "{{ packages }}"
|
|
state: present
|
|
tags: packages
|
|
|
|
# Service Management
|
|
- name: Start and enable Nginx
|
|
service:
|
|
name: "{{ nginx_service }}"
|
|
state: started
|
|
enabled: yes
|
|
tags: nginx
|
|
|
|
- name: Start and enable MySQL/MariaDB
|
|
service:
|
|
name: "{{ mysql_service }}"
|
|
state: started
|
|
enabled: yes
|
|
tags: mysql
|
|
|
|
- name: Start and enable PHP-FPM
|
|
service:
|
|
name: "{{ php_fpm_service }}"
|
|
state: started
|
|
enabled: yes
|
|
tags: php
|
|
|
|
# Firewall Configuration
|
|
- name: Configure firewall (UFW)
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "22"
|
|
- "80"
|
|
- "443"
|
|
tags: firewall
|
|
|
|
# MySQL Security (Ubuntu 24.04 fix for auth_socket)
|
|
- name: Set MySQL root password (using auth_socket first)
|
|
mysql_user:
|
|
name: root
|
|
password: "{{ mysql_root_password }}"
|
|
plugin: mysql_native_password
|
|
login_unix_socket: /var/run/mysqld/mysqld.sock
|
|
state: present
|
|
become: true
|
|
tags: mysql
|
|
|
|
- name: Create MySQL configuration for root
|
|
template:
|
|
src: ../templates/my.cnf.j2
|
|
dest: /root/.my.cnf
|
|
mode: '0600'
|
|
tags: mysql
|
|
|
|
- name: Remove anonymous MySQL users
|
|
mysql_user:
|
|
name: ""
|
|
host_all: yes
|
|
state: absent
|
|
tags: mysql
|
|
|
|
- name: Remove MySQL test database
|
|
mysql_db:
|
|
name: test
|
|
state: absent
|
|
tags: mysql
|
|
|
|
# WordPress Database Setup
|
|
- name: Create WordPress database
|
|
mysql_db:
|
|
name: "{{ wordpress_db_name }}"
|
|
state: present
|
|
tags: mysql
|
|
|
|
- name: Create WordPress database user
|
|
mysql_user:
|
|
name: "{{ wordpress_db_user }}"
|
|
password: "{{ wordpress_db_password }}"
|
|
priv: "{{ wordpress_db_name }}.*:ALL"
|
|
host: localhost
|
|
state: present
|
|
tags: mysql
|
|
|
|
# WordPress Installation
|
|
- name: Create web root directory
|
|
file:
|
|
path: "{{ wordpress_path }}"
|
|
state: directory
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0755'
|
|
tags: wordpress
|
|
|
|
- name: Remove default nginx index file
|
|
file:
|
|
path: "{{ wordpress_path }}/index.nginx-debian.html"
|
|
state: absent
|
|
tags: wordpress
|
|
|
|
- name: Download WordPress
|
|
get_url:
|
|
url: https://wordpress.org/latest.tar.gz
|
|
dest: /tmp/wordpress.tar.gz
|
|
mode: '0644'
|
|
tags: wordpress
|
|
|
|
- name: Extract WordPress
|
|
unarchive:
|
|
src: /tmp/wordpress.tar.gz
|
|
dest: /tmp/
|
|
remote_src: yes
|
|
tags: wordpress
|
|
|
|
- name: Copy WordPress files
|
|
command: "cp -r /tmp/wordpress/. {{ wordpress_path }}/"
|
|
args:
|
|
creates: "{{ wordpress_path }}/wp-config-sample.php"
|
|
tags: wordpress
|
|
|
|
- name: Set WordPress file permissions
|
|
file:
|
|
path: "{{ wordpress_path }}"
|
|
owner: "{{ nginx_user }}"
|
|
group: "{{ nginx_user }}"
|
|
recurse: yes
|
|
tags: wordpress
|
|
|
|
# SSL Configuration (optional)
|
|
- name: Generate self-signed SSL certificate (if SSL enabled but no cert provided)
|
|
command: >
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048
|
|
-keyout {{ ssl_cert_key_path | default('/etc/ssl/private/nginx-selfsigned.key') }}
|
|
-out {{ ssl_cert_path | default('/etc/ssl/certs/nginx-selfsigned.crt') }}
|
|
-subj "/C=DE/ST=State/L=City/O=Organization/OU=OrgUnit/CN={{ domain_name }}"
|
|
when:
|
|
- ssl_enabled | default(false)
|
|
- not (ssl_cert_path is defined and ssl_cert_key_path is defined)
|
|
tags: ssl
|
|
|
|
# Nginx Configuration
|
|
- name: Create Nginx configuration for WordPress
|
|
template:
|
|
src: ../templates/{% if ssl_enabled | default(false) %}wordpress-ssl.nginx.j2{% else %}wordpress.nginx.j2{% endif %}
|
|
dest: "{{ nginx_sites_available }}/wordpress"
|
|
backup: yes
|
|
notify: restart nginx
|
|
tags: nginx
|
|
|
|
- name: Enable WordPress site
|
|
file:
|
|
src: "{{ nginx_sites_available }}/wordpress"
|
|
dest: "{{ nginx_sites_enabled }}/wordpress"
|
|
state: link
|
|
notify: restart nginx
|
|
tags: nginx
|
|
|
|
- name: Remove default Nginx site
|
|
file:
|
|
path: "{{ nginx_sites_enabled }}/default"
|
|
state: absent
|
|
notify: restart nginx
|
|
tags: nginx
|
|
|
|
# PHP Configuration
|
|
- name: Configure PHP-FPM pool
|
|
template:
|
|
src: ../templates/www.conf.j2
|
|
dest: "{{ php_fpm_pool_path }}/www.conf"
|
|
backup: yes
|
|
notify: restart php-fpm
|
|
tags: php
|
|
|
|
- name: Configure PHP settings
|
|
lineinfile:
|
|
path: "{{ php_cli_config_path }}/php.ini"
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
backup: yes
|
|
loop:
|
|
- { regexp: '^upload_max_filesize', line: 'upload_max_filesize = 64M' }
|
|
- { regexp: '^post_max_size', line: 'post_max_size = 64M' }
|
|
- { regexp: '^memory_limit', line: 'memory_limit = 256M' }
|
|
- { regexp: '^max_execution_time', line: 'max_execution_time = 300' }
|
|
- { regexp: '^disable_functions', line: 'disable_functions = ' }
|
|
notify: restart php-fpm
|
|
tags: php
|
|
|
|
# WordPress Configuration
|
|
- name: Configure WordPress
|
|
template:
|
|
src: ../templates/wp-config.php.j2
|
|
dest: "{{ wordpress_path }}/wp-config.php"
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0600'
|
|
tags: wordpress
|
|
|
|
# WP-CLI Installation
|
|
- name: Download WP-CLI
|
|
get_url:
|
|
url: https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
|
|
dest: /usr/local/bin/wp
|
|
mode: '0755'
|
|
tags: wp-cli
|
|
|
|
- name: Verify WP-CLI installation
|
|
command: wp --info
|
|
environment:
|
|
HOME: "{{ wordpress_path }}"
|
|
register: wp_cli_info
|
|
tags: wp-cli
|
|
|
|
- name: Display WP-CLI info
|
|
debug:
|
|
var: wp_cli_info.stdout_lines
|
|
tags: wp-cli
|
|
|
|
# WordPress Core Installation
|
|
- name: Install WordPress Core
|
|
command: >
|
|
wp core install
|
|
--url="{{ wp_site_url }}"
|
|
--title="{{ wp_site_title }}"
|
|
--admin_user="{{ wp_admin_user }}"
|
|
--admin_password="{{ wp_admin_password }}"
|
|
--admin_email="{{ wp_admin_email }}"
|
|
--path="{{ wordpress_path }}"
|
|
--allow-root
|
|
environment:
|
|
HOME: "{{ wordpress_path }}"
|
|
tags: wp-install
|
|
|
|
- name: Set WordPress file ownership after installation
|
|
file:
|
|
path: "{{ wordpress_path }}"
|
|
owner: "{{ nginx_user }}"
|
|
group: "{{ nginx_user }}"
|
|
recurse: yes
|
|
tags: wp-install
|
|
|
|
- name: Display WordPress installation success
|
|
debug:
|
|
msg: |
|
|
WordPress installation completed!
|
|
URL: {{ wp_site_url }}
|
|
Admin User: {{ wp_admin_user }}
|
|
Admin Password: {{ wp_admin_password }}
|
|
Admin Email: {{ wp_admin_email }}
|
|
tags: wp-install
|
|
|
|
# =============================
|
|
# REDIS CACHE (ULTIMATE FEATURE)
|
|
# =============================
|
|
- name: Install Redis server
|
|
package:
|
|
name: redis-server
|
|
state: present
|
|
when: enable_redis | default(false)
|
|
tags: redis
|
|
|
|
- name: Start and enable Redis
|
|
service:
|
|
name: redis-server
|
|
state: started
|
|
enabled: yes
|
|
when: enable_redis | default(false)
|
|
tags: redis
|
|
|
|
- name: Configure Redis for WordPress
|
|
lineinfile:
|
|
path: /etc/redis/redis.conf
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
backup: yes
|
|
loop:
|
|
- { regexp: '^# maxmemory', line: 'maxmemory 128mb' }
|
|
- { regexp: '^# maxmemory-policy', line: 'maxmemory-policy allkeys-lru' }
|
|
- { regexp: '^save 900 1', line: 'save 900 1' }
|
|
when: enable_redis | default(false)
|
|
notify: restart redis
|
|
tags: redis
|
|
|
|
- name: Install Redis Object Cache plugin
|
|
command: >
|
|
wp plugin install redis-cache --activate
|
|
--path="{{ wordpress_path }}"
|
|
--allow-root
|
|
environment:
|
|
HOME: "{{ wordpress_path }}"
|
|
when: enable_redis | default(false)
|
|
tags: redis
|
|
|
|
- name: Enable Redis object cache
|
|
command: >
|
|
wp redis enable
|
|
--path="{{ wordpress_path }}"
|
|
--allow-root
|
|
environment:
|
|
HOME: "{{ wordpress_path }}"
|
|
when: enable_redis | default(false)
|
|
ignore_errors: yes
|
|
tags: redis
|
|
|
|
- name: Display Redis status
|
|
debug:
|
|
msg: "Redis caching {{ 'ENABLED' if enable_redis | default(false) else 'DISABLED' }}"
|
|
tags: redis
|
|
|
|
# =============================
|
|
# OPCACHE OPTIMIZATION (ULTIMATE FEATURE)
|
|
# =============================
|
|
- name: Configure OPcache for WordPress
|
|
lineinfile:
|
|
path: "{{ php_cli_config_path }}/php.ini"
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
backup: yes
|
|
loop:
|
|
- { regexp: '^;?opcache.enable=', line: 'opcache.enable=1' }
|
|
- { regexp: '^;?opcache.memory_consumption=', line: 'opcache.memory_consumption=128' }
|
|
- { regexp: '^;?opcache.interned_strings_buffer=', line: 'opcache.interned_strings_buffer=8' }
|
|
- { regexp: '^;?opcache.max_accelerated_files=', line: 'opcache.max_accelerated_files=4000' }
|
|
- { regexp: '^;?opcache.revalidate_freq=', line: 'opcache.revalidate_freq=2' }
|
|
- { regexp: '^;?opcache.fast_shutdown=', line: 'opcache.fast_shutdown=1' }
|
|
when: enable_opcache | default(false)
|
|
notify: restart php-fpm
|
|
tags: opcache
|
|
|
|
- name: Configure OPcache for PHP-FPM
|
|
lineinfile:
|
|
path: "/etc/php/{{ php_version }}/fpm/php.ini"
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
backup: yes
|
|
loop:
|
|
- { regexp: '^;?opcache.enable=', line: 'opcache.enable=1' }
|
|
- { regexp: '^;?opcache.memory_consumption=', line: 'opcache.memory_consumption=128' }
|
|
- { regexp: '^;?opcache.interned_strings_buffer=', line: 'opcache.interned_strings_buffer=8' }
|
|
- { regexp: '^;?opcache.max_accelerated_files=', line: 'opcache.max_accelerated_files=4000' }
|
|
- { regexp: '^;?opcache.revalidate_freq=', line: 'opcache.revalidate_freq=2' }
|
|
- { regexp: '^;?opcache.fast_shutdown=', line: 'opcache.fast_shutdown=1' }
|
|
when: enable_opcache | default(false)
|
|
notify: restart php-fpm
|
|
tags: opcache
|
|
|
|
- name: Display OPcache status
|
|
debug:
|
|
msg: "OPcache optimization {{ 'ENABLED' if enable_opcache | default(false) else 'DISABLED' }}"
|
|
tags: opcache
|
|
|
|
# =============================
|
|
# NGINX PERFORMANCE OPTIMIZATION (ULTIMATE FEATURE)
|
|
# =============================
|
|
- name: Backup original nginx.conf
|
|
copy:
|
|
src: /etc/nginx/nginx.conf
|
|
dest: /etc/nginx/nginx.conf.backup
|
|
remote_src: yes
|
|
when: enable_nginx_optimization | default(false)
|
|
tags: nginx-optimization
|
|
|
|
# Clean up any existing ansible-managed blocks first
|
|
- name: Remove existing ansible-managed blocks from nginx.conf
|
|
blockinfile:
|
|
path: /etc/nginx/nginx.conf
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK - Ultimate Performance"
|
|
state: absent
|
|
when: enable_nginx_optimization | default(false)
|
|
tags: nginx-optimization
|
|
|
|
- name: Remove duplicate worker directives from wrong blocks
|
|
lineinfile:
|
|
path: /etc/nginx/nginx.conf
|
|
regexp: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- '^\s*worker_processes\s+auto;.*# Added by Ansible'
|
|
- '^\s*worker_rlimit_nofile\s+65535;.*# Added by Ansible'
|
|
when: enable_nginx_optimization | default(false)
|
|
tags: nginx-optimization
|
|
|
|
# Configure Worker settings in main block (before events)
|
|
- name: Configure Nginx worker settings in main block (before events)
|
|
lineinfile:
|
|
path: /etc/nginx/nginx.conf
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
insertbefore: "events {"
|
|
backup: yes
|
|
loop:
|
|
- { regexp: '^worker_processes', line: 'worker_processes auto;' }
|
|
- { regexp: '^worker_rlimit_nofile', line: 'worker_rlimit_nofile 65535;' }
|
|
when: enable_nginx_optimization | default(false)
|
|
notify: restart nginx
|
|
tags: nginx-optimization
|
|
|
|
- name: Configure Nginx events block
|
|
lineinfile:
|
|
path: /etc/nginx/nginx.conf
|
|
regexp: '^(\s*)worker_connections.*'
|
|
line: '\1worker_connections 2048;'
|
|
backrefs: yes
|
|
backup: yes
|
|
when: enable_nginx_optimization | default(false)
|
|
notify: restart nginx
|
|
tags: nginx-optimization
|
|
|
|
# Configure HTTP block optimizations (only unique directives)
|
|
- name: Configure optimized Nginx HTTP configuration
|
|
blockinfile:
|
|
path: /etc/nginx/nginx.conf
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK - HTTP Performance"
|
|
insertafter: "http {"
|
|
block: |
|
|
# Ultimate Performance optimizations (unique directives only)
|
|
keepalive_requests 1000;
|
|
|
|
# Enhanced Gzip compression
|
|
gzip_vary on;
|
|
gzip_min_length 1000;
|
|
gzip_comp_level 6;
|
|
gzip_types
|
|
text/plain
|
|
text/css
|
|
text/xml
|
|
text/javascript
|
|
application/javascript
|
|
application/json
|
|
application/xml+rss
|
|
application/atom+xml
|
|
image/svg+xml;
|
|
|
|
# Buffer sizes
|
|
client_body_buffer_size 128k;
|
|
client_max_body_size 64m;
|
|
client_header_buffer_size 1k;
|
|
large_client_header_buffers 4 4k;
|
|
|
|
# Timeouts
|
|
client_body_timeout 12;
|
|
client_header_timeout 12;
|
|
send_timeout 10;
|
|
|
|
# Cache for file handles
|
|
open_file_cache max=200000 inactive=20s;
|
|
open_file_cache_valid 30s;
|
|
open_file_cache_min_uses 2;
|
|
open_file_cache_errors on;
|
|
backup: yes
|
|
when: enable_nginx_optimization | default(false)
|
|
notify: restart nginx
|
|
tags: nginx-optimization
|
|
|
|
- name: Create Nginx cache directory
|
|
file:
|
|
path: /var/cache/nginx/fastcgi
|
|
state: directory
|
|
owner: www-data
|
|
group: www-data
|
|
mode: '0755'
|
|
when: enable_nginx_optimization | default(false)
|
|
tags: nginx-optimization
|
|
|
|
- name: Display Nginx optimization status
|
|
debug:
|
|
msg: "Nginx performance optimization {{ 'ENABLED' if enable_nginx_optimization | default(false) else 'DISABLED' }}"
|
|
tags: nginx-optimization
|
|
|
|
handlers:
|
|
- name: restart nginx
|
|
service:
|
|
name: "{{ nginx_service }}"
|
|
state: restarted
|
|
|
|
- name: restart php-fpm
|
|
service:
|
|
name: "{{ php_fpm_service }}"
|
|
state: restarted
|
|
|
|
- name: restart mysql
|
|
service:
|
|
name: "{{ mysql_service }}"
|
|
state: restarted
|
|
|
|
- name: restart redis
|
|
service:
|
|
name: redis-server
|
|
state: restarted
|