yum -y install ansible

yum -y install python-jinja2 PyYAML python-paramiko python-babel python-crypto
tar xf ansible-1.5.4.tar.gz
cd ansible-1.5.4
python setup.py build
python setup.py install
mkdir /etc/ansible
cp -r examples/* /etc/ansible

git clone git://github.com/ansible/ansible.git --recursive
cd ./ansible
source ./hacking/env-setup

# ansible --version
ansible 2.9.18
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.6/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.6.8 (default, Aug 24 2020, 17:57:11) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]

[defaults]
#inventory     = /etc/ansible/hosts # 主机列表配置文件

#library = /usr/share/my_modules/ # 库文件存放目录

#remote_tmp = $HOME/.ansible/tmp # 临时py命令文件存放在远程主机目录

#local_tmp     = $HOME/.ansible/tmp # 本机的临时命令执行目录

#forks         = 5   # 默认并发数

#sudo_user     = root # 默认sudo 用户

#ask_sudo_pass = True # 每次执行ansible命令是否询问ssh密码

#ask_pass     = True   

#remote_port   = 22 # 默认远程链接主机的端口号（还可以在主机清单文件中对某主机单独指定端口）

#module_name = command   # 默认模块，可以修改为shell模块


host_key_checking = False # 检查对应服务器的host_key，建议取消注释，否则每台主机都需要按yes验证，不启用此行的话修改/etc/ssh/ssh_config文件中的StrictHostKeyChecking no也可以，效果一样，建议修改的值（ansible2.9.18已经默认取消注释，所以无需修改）

log_path=/var/log/ansible.log #日志文件，建议启用

# 指定主机名
blue.example.com

# 指定 IP
192.168.100.1

# 指定ssh的端口号（如若目标主机使用了非默认的SSH端口，要在主机名称之后使用冒号加端口号来标明）
192.168.100.2:3333

[webservers]
alpha.example.org
192.168.1.100

# 指定范围
[websrvs]
www[1:100].example.com

# 指定范围，a到f，abcdef
[websrvs]
www[a:f].example.com

# 指定范围，代表10.0.0.1~10.0.0.100
[appsrvs]
10.0.0.[1:100]

/usr/bin/ansible # 主程序，临时命令执行工具

/usr/bin/ansible-doc # 查看配置文档，模块功能查看工具,相当于man 

/usr/bin/ansible-playbook # 定制自动化任务，编排剧本工具,相当于脚本

/usr/bin/ansible-pull # 远程执行命令的工具

/usr/bin/ansible-vault # 文件加密工具

/usr/bin/ansible-console # 基于Console界面与用户交互的执行工具

/usr/bin/ansible-galaxy # 下载/上传优秀代码或Roles模块的官网平台

ansible <host-pattern> [-m module_name] [-a args]

# 所有主机
all

# 指定主机组名称
host_group_name

# 通配符形式表示所有主机
"*"              

# 通配符形式指定主机IP
"192.168.1.*"   

"websrvs:appsrvs"


"192.168.1.10:192.168.1.20"

# 在 websrvs 组，并且在 dbsrvs 组中的主机，即取交集
"websrvs:&dbsrvs"

# 在websrvs组，但不在dbsrvs组中的主机，即表示属于websrvs组中的主机刨去属于dbsrvs组的主机
'websrvs:!dbsrvs'

# office开头的主机组，但排除.206 即ansible自身
'office*:!172.16.66.206'

# 逻辑非范例1：属于webs组中的主机列表中刨去同时属于dbsrvs组的主机
[root@ansible ~]# ansible webs --list
  hosts (2):
    10.0.0.18
    10.0.0.28
[root@ansible ~]# ansible dbs --list
  hosts (4):
    10.0.0.18
    10.0.0.7
    10.0.0.17
    10.0.0.27
[root@ansible ~]# ansible 'webs:!dbs' --list
  hosts (1):
    10.0.0.28

# 组合逻辑
ansible 'websrvs:dbsrvs:&appsrvs:!ftpsrvs' –m ping

# 正则表达式
ansible "websrvs:dbsrvs" –m ping
ansible "~(web|db).*\.magedu\.com" –m ping

--version              # 显示版本
-m module              # 指定模块，默认为command
-a                     # 给模块传递参数
-v                     # 详细过程 –vv -vvv更详细
--list                 # 显示主机列表
-k, --ask-pass         # 提示输入ssh连接密码，默认Key验证 
-C, --check            # 检查，并不执行
-T, --timeout=TIMEOUT  # 执行命令的超时时间，默认10s
-u, --user=REMOTE_USER # 执行远程执行的用户
-b, --become           # 代替旧版的sudo 切换
--become-user=USERNAME # 指定sudo的runas用户，默认为root
-K, --ask-become-pass  # 提示输入sudo时的口令

# 列出所有的主机列表
ansible all --list

# 列出指定分组的主机列表
ansible dbs --list

# 在 dbs 主机组中执行 ping 来测试主机的连通性
ansible dbs -m ping

# 除了自己以外，其他主机都重启（10.0.0.8是本主机）
ansible 'all:!10.0.0.8' -a reboot

# 在kube开头组名和etcd组中除了10.0.0.101主机以外全部重启
ansible 'kube*:etcd:!10.0.0.101' -a reboot



# 以wang用户执行ping存活检测
ansible all -m ping -u wang  -k

# 以wang sudo至root执行ping存活检测
ansible all -m ping -u wang -k -b

# 以wang sudo至mage用户执行ping存活检测
ansible all -m ping -u wang -k -b --become-user=mage

# 以wang sudo至root用户执行ls 
ansible all -m command  -u wang -a 'ls /root' -b --become-user=root -k -K

# 颜色配置文件：
[root@ansible ~]# grep -A13 "\[colors\]" /etc/ansible/ansible.cfg 
[colors]
#highlight = white
#verbose = blue
#warn = bright purple
#error = red
#debug = dark gray
#deprecate = purple
#skip = cyan
#unreachable = red
#ok = green
#changed = yellow
#diff_add = green
#diff_remove = red
#diff_lines = cyan
```
[root@ansible ~]# grep -A13 "\[colors\]" /etc/ansible/ansible.cfg 
[colors]
#highlight = white
#verbose = blue
#warn = bright purple
#error = red
#debug = dark gray
#deprecate = purple
#skip = cyan
#unreachable = red
#ok = green
#changed = yellow
#diff_add = green
#diff_remove = red
#diff_lines = cyan

# 列出所有模块
ansible-doc -l  

# 查看指定模块详细说明
ansible-doc ping  

# 查看指定模块简要说明
ansible-doc -s  ping

ansible-playbook <filename.yml> ... [options]

-C --check   # 只检测可能会发生的改变，但不真正执行操作
--list-hosts # 列出运行任务的主机
--list-tags  # 列出tag
--list-tasks # 列出task
--limit 主机列表 # 只针对主机列表中的特定主机执行
-v -vv -vvv  # 显示过程
--syntax-check # 检查剧本的YAML语法

# cat hello.yaml
---
- hosts: webservers
  remote_user: root # 默认就是以root的身份在远程主机指向
  tasks:
    - name: hello world
      command: /usr/bin/wall hello world # wall命令用于向系统当前所有打开的终端上输出信息。通过wall命令可将信息发送给每位同意接收公众信息的终端机用户


# ansible-playbook hello.yaml
...

ansible-vault [create|decrypt|edit|encrypt|rekey|view] hello.yml

encrypt # 加密
decrypt # 解密
view # 查看
edit  # 编辑加密文件
rekey # 修改口令
create # 创建新文件

# 加密前
# cat hello.yaml
---
- hosts: webservers
  remote_user: root
  tasks:
    - name: hello world
      command: /usr/bin/wall hello world


# 加密
# ansible-vault encrypt hello.yaml
New Vault password: 
Confirm New Vault password: 
Encryption successful


# 加密后
# cat hello.yaml 
$ANSIBLE_VAULT;1.1;AES256
62396235313164353163396433633930373934303432343062333835393130666338363035666231
39643735643766...


# 解密
# ansible-vault decrypt hello.yaml
Vault password: 
Decryption successful
# cat hello.yaml
---
- hosts: webservers
  remote_user: root
  tasks:
    - name: hello world
      command: /usr/bin/wall hello world

[root@ansible ~]#ansible-console
Welcome to the ansible console.
Type help or ? to list commands.

root@all (3)[f:5]$ list
10.0.0.8
10.0.0.7
10.0.0.6

root@all (3)[f:5]$ cd websrvs
root@websrvs (2)[f:5]$ list
10.0.0.7
10.0.0.8

root@websrvs (2)[f:5]$ forks 10

root@websrvs (2)[f:10]$ cd appsrvs

root@appsrvs (2)[f:5]$ yum name=httpd state=present

root@appsrvs (2)[f:5]$ service name=httpd state=started

# 列出所有已安装的galaxy
ansible-galaxy list

# 安装galaxy
ansible-galaxy install geerlingguy.mysql
ansible-galaxy install geerlingguy.redis

# 删除galaxy
ansible-galaxy remove geerlingguy.redis

[root@ansible ~]# ansible dbs -m ping
10.0.0.27 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}
10.0.0.7 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}
10.0.0.17 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

[root@ansible ~]# ansible all -a hostname
10.0.0.27 | CHANGED | rc=0 >>
27
10.0.0.17 | CHANGED | rc=0 >>
17
10.0.0.7 | CHANGED | rc=0 >>
localhost.localdomain

[root@ansible ~]# ansible all -m command -a hostname
10.0.0.27 | CHANGED | rc=0 >>
27
10.0.0.17 | CHANGED | rc=0 >>
17
10.0.0.7 | CHANGED | rc=0 >>
localhost.localdomain

# command删除不了的 shell命令可以删除
[root@ansible ~]# ansible all -m shell -a 'rm -fr  /data/*'

[root@ansible ~]# ansible all -m shell -a 'hostname'
10.0.0.17 | CHANGED | rc=0 >>
17
10.0.0.7 | CHANGED | rc=0 >>
localhost.localdomain
10.0.0.27 | CHANGED | rc=0 >>
27

[root@ansible ~]# cat test.sh 
#!/bin/bash
echo "hello world"


[root@ansible ~]# ansible all -m script -a ~/test.sh 
10.0.0.17 | CHANGED => {
    "changed": true,
    "rc": 0,
    "stderr": "Shared connection to 10.0.0.17 closed.\r\n",
    "stderr_lines": [
        "Shared connection to 10.0.0.17 closed."
    ],
    "stdout": "hello world\r\n",
    "stdout_lines": [
        "hello world"
    ]
}
10.0.0.7 | CHANGED => {
    "changed": true,
    "rc": 0,
    "stderr": "Shared connection to 10.0.0.7 closed.\r\n",
    "stderr_lines": [
        "Shared connection to 10.0.0.7 closed."
    ],
    "stdout": "hello world\r\n",
    "stdout_lines": [
        "hello world"
    ]
}
10.0.0.27 | CHANGED => {
    "changed": true,
    "rc": 0,
    "stderr": "Shared connection to 10.0.0.27 closed.\r\n",
    "stderr_lines": [
        "Shared connection to 10.0.0.27 closed."
    ],
    "stdout": "hello world\r\n",
    "stdout_lines": [
        "hello world"
    ]
}

src  # 指定源，如果目录末尾加了/，则只复制目录内的内容。如果目录末尾未加/，则将目录自身也进行复制。
dest # 指定目标，目标不存在的话会自动创建
backup # 如果目标事先存在，则先对其进行备份后再拷贝
owner # 设置所有者
mode # 设置权限
content # 直接生成文件内容

# 如目标存在，默认覆盖，此处指定先备份
ansible websrvs -m copy -a "src=/root/test1.sh dest=/tmp/test2.sh   owner=wang 
mode=600 backup=yes"

# 指定内容，直接生成目标文件    
ansible websrvs -m copy -a "content='test line1\ntest line2' dest=/tmp/test.txt"

# 包括/etc目录自身一并复制（注意/etc/后面没有/）
ansible websrvs -m copy -a "src=/etc dest=/backup"

# 仅负责复制/etc/目录下的文件，不包括/etc/目录自身（注意/etc/后面有/）
ansible websrvs -m copy -a "src=/etc/ dest=/backup"

src # 远程主机的文件
dest # 本地的目录

[root@ansible ~]# ansible dbs -m fetch -a 'src=/opt/test.txt dest=./'

# 会在本地创建远程主机所对应的目录，以防止数据冲突
[root@ansible ~]# tree 
.
├── 10.0.0.17
│   └── opt
│       └── test.txt
├── 10.0.0.27
│   └── opt
│       └── test.txt
└── 10.0.0.7
    └── opt
        └── test.txt
        
# 拷贝目录会报错
[root@ansible ~]# ansible dbs -m fetch -a 'src=/opt/ dest=./'
10.0.0.7 | FAILED! => {
    "changed": false,
    "file": "/opt/",
    "msg": "remote file is a directory, fetch cannot work on directories"
}
10.0.0.27 | FAILED! => {
    "changed": false,
    "file": "/opt/",
    "msg": "remote file is a directory, fetch cannot work on directories"
}
10.0.0.17 | FAILED! => {
    "changed": false,
    "file": "/opt/",
    "msg": "remote file is a directory, fetch cannot work on directories"
}

path # 
state # 要执行的操作，touch创建文件，directory创建目录，absent删除文件，link创建软链接，
owner # 
group # 
src #
dest # 

#创建文件
ansible dbs -m file -a 'path=/opt/test.txt state=touch'

#删除文件
ansible dbs -m file -a 'path=/opt/test.txt state=absent'

#设置文件的用户为 james 组为 azheng
ansible dbs -m file -a 'path=/opt/test.txt owner=james group=azheng'

#创建目录，并将目录的所有者设为James，权限设为755
ansible dbs -m file -a 'path=/opt/testdir state=directory owner=james mode=755'

#删除目录
ansible dbs -m file -a 'path=/opt/testdir state=absent'

#创建软连接
ansible dbs -m file -a 'src=/etc/passwd dest=/opt/passwd-link state=link'

format # 压缩格式，支持bz2, gz, tar, xz, zip，默认gz

# ansible webs -m archive -a 'path=/var/log dest=/opt/log.tar.gz format=gz owner=nobody mode=000'

# ansible webs -a 'ls -l /opt '
10.0.0.28 | CHANGED | rc=0 >>
total 812
---------- 1 nobody root 830804 Mar 31 18:15 log.tar.gz
10.0.0.18 | CHANGED | rc=0 >>
total 1236
---------- 1 nobody root 1265292 Mar 31 18:15 log.tar.gz

# ansible webs -a 'file /opt/log.tar.gz '
10.0.0.18 | CHANGED | rc=0 >>
/opt/log.tar.gz: gzip compressed data, was "/opt/log.tar", last modified: Fri Mar 31 10:15:47 2023, max compression, original size 15749120
10.0.0.28 | CHANGED | rc=0 >>
/opt/log.tar.gz: gzip compressed data, was "/opt/log.tar", last modified: Fri Mar 31 10:15:47 2023, max compression, original size 11489280

# ansible webs -m archive -a 'path=/var/log/ dest=/data/log.tar.bz2 format=bz2 mode=0600'


# ansible webs -a 'ls -l /data/log.tar.bz2 ; file /data/log.tar.bz2'
10.0.0.18 | CHANGED | rc=0 >>
-rw------- 1 root root 793523 Mar 31 18:19 /data/log.tar.bz2
/data/log.tar.bz2: bzip2 compressed data, block size = 900k
10.0.0.28 | CHANGED | rc=0 >>
-rw------- 1 root root 586244 Mar 31 18:19 /data/log.tar.bz2
/data/log.tar.bz2: bzip2 compressed data, block size = 900k

copy # 默认为yes，当copy=yes，拷贝的文件是从ansible主机复制到远程主机上，如果设置为copy=no，会在远程主机上寻找src源文件

remote_src # 和copy功能恰好相反，因此一般使用copy；和copy功能一样且互斥，yes表示在远程主机，不在ansible主机，no表示文件在ansible主机上

src # 源路径，可以是：ansible主机上的路径（需copy=yes），远程主机上的路径（需copy=no），远程URL的路径（需copy=no）

dest # 远程主机上的目标路径

mode # 设置解压缩后的文件权限

owner # 设置解压后的文件所有者

group # 设置解压后的文件所属组

ansible dbs -m unarchive -a 'src=/opt/etc.gz dest=~/ copy=no mode=400'

[root@ansible opt]# pwd
/opt

[root@ansible opt]# ls
etc.gz

[root@ansible opt]# ansible 10.0.0.27 -m unarchive -a 'src=/opt/etc.gz dest=~/ mode=400'

[root@ansible opt]# ansible 10.0.0.27 -a 'ls -l ~/'
10.0.0.27 | CHANGED | rc=0 >>
total 12
dr-------- 84 root root 8192 Dec 11 21:25 etc

ansible all -m unarchive -a 'src=https://example.com/example.zip dest=/data copy=no'

[root@ansible ~]# ansible dbs -a 'hostname'
10.0.0.17 | CHANGED | rc=0 >>
17
10.0.0.27 | CHANGED | rc=0 >>
27
10.0.0.7 | CHANGED | rc=0 >>
localhost.localdomain

[root@ansible ~]# ansible dbs -m hostname -a 'name=dbserver'
...

[root@ansible ~]# ansible dbs -a 'hostname'
10.0.0.7 | CHANGED | rc=0 >>
dbserver
10.0.0.17 | CHANGED | rc=0 >>
dbserver
10.0.0.27 | CHANGED | rc=0 >>
dbserver

minute # 分钟
hour # 小时
day # 日
month # 月
weekday # 星期

job # 执行的命令

name # 计划任务的名字（体现在计划任务的备注上）

state=absent # 删除

# ansible 10.0.0.18 -m cron -a 'hour=2 minute=30 weekday=1-5 name="backup mysql" job=/root/mysql_backup.sh'
...


# ansible 10.0.0.18 -a 'crontab -l'
10.0.0.18 | CHANGED | rc=0 >>
#Ansible: backup mysql
30 2 * * 1-5 /root/mysql_backup.sh


# ansible 10.0.0.18 -a 'cat /var/spool/cron/root'
10.0.0.18 | CHANGED | rc=0 >>
#Ansible: backup mysql
30 2 * * 1-5 /root/mysql_backup.sh

ansible websrvs -m cron -a "minute=*/5 job='/usr/sbin/ntpdate ntp.aliyun.com &>/dev/null' name=Synctime"

ansible websrvs -m cron -a "minute=*/5 job='/usr/sbin/ntpdate 172.20.0.1 &>/dev/null' name=Synctime disabled=yes"

ansible websrvs -m cron -a "minute=*/5 job='/usr/sbin/ntpdate 172.20.0.1 &>/dev/null' name=Synctime disabled=no"

ansible websrvs -m cron -a "name='backup mysql' state=absent"

ansible websrvs -m cron -a 'state=absent name=Synctime'

ansible websrvs -m yum -a 'name=httpd state=present'

ansible dbs -m yum -a 'name=tcpdump,iotop'

ansible websrvs -m yum -a 'name=httpd state=absent'

ansible all -m service -a 'name=httpd state=started enabled=yes'

ansible all -m service -a 'name=httpd state=stopped'

ansible all -m service -a 'name=httpd state=reloaded'

ansible all -m shell -a "sed -i 's/^Listen 80/Listen 8080/' /etc/httpd/conf/httpd.conf"

ansible all -m service -a 'name=httpd state=restarted'

name=mysql 
shell=/sbin/nologin
system=yes
group=mysql
uid=306
home=/data/mysql
create_home=no  

ansible all -m user -a 'name=user1 comment="test user" uid=2048 home=/app/user1  group=root'

ansible all -m user -a 'name=nginx comment=nginx uid=88 group=nginx  groups="root,daemon" shell=/sbin/nologin system=yes create_home=no home=/data/nginx non_unique=yes'

# remove=yes表示删除用户及家目录等数据,默认remove=no
ansible all -m user -a 'name=nginx state=absent remove=yes'

ansible websrvs -m group  -a 'name=nginx gid=88 system=yes'

ansible websrvs -m group  -a 'name=nginx state=absent'

# ansible 10.0.0.18 -a 'cat /opt/config'
10.0.0.18 | CHANGED | rc=0 >>
SELINUX=disabled


# ansible 10.0.0.18 -m lineinfile -a "path=/opt/config regexp='^SELINUX=' line='SELINUX=enable'"
10.0.0.18 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "backup": "",
    "changed": true,
    "msg": "line replaced"
}


# ansible 10.0.0.18 -a 'cat /opt/config'
10.0.0.18 | CHANGED | rc=0 >>
SELINUX=enable

ansible all -m lineinfile -a "path=/etc/selinux/config regexp='^SELINUX='  line='SELINUX=disabled'"

ansible all -m lineinfile  -a 'dest=/etc/fstab state=absent regexp="^#"'

ansible websrvs -m lineinfile -a "path=/etc/httpd/conf/httpd.conf regexp='^Listen' line='Listen 80'"

path # 远程文件路径
regexp # 匹配的正则表达式
replace # 替代的值

# ansible 10.0.0.18 -a 'cat /opt/config'
10.0.0.18 | CHANGED | rc=0 >>
SELINUX=enable

# ansible 10.0.0.18 -m replace -a "path=/opt/config regexp='^(SELINUX=).*' replace='\1disable'"
...

# ansible 10.0.0.18 -a 'cat /opt/config'
10.0.0.18 | CHANGED | rc=0 >>
SELINUX=disable

# ansible 10.0.0.18 -a 'cat /opt/config'
10.0.0.18 | CHANGED | rc=0 >>
SELINUX=disable

# ansible 10.0.0.18 -m replace -a "path=/opt/config regexp='^(SELINUX=.*)' replace='#\1'"
...

# ansible 10.0.0.18 -a 'cat /opt/config'
10.0.0.18 | CHANGED | rc=0 >>
#SELINUX=disable

ansible all -m replace -a "path=/etc/fstab regexp='^(UUID.*)' replace='#\1'"  

ansible all -m replace -a "path=/etc/fstab regexp='^#(.*)' replace='\1'"

ansible all -m setup

ansible all -m setup -a "filter=ansible_nodename"
ansible all -m setup -a "filter=ansible_hostname"
ansible all -m setup -a "filter=ansible_domain"
ansible all -m setup -a "filter=ansible_memtotal_mb"
ansible all -m setup -a "filter=ansible_memory_mb"
ansible all -m setup -a "filter=ansible_memfree_mb"
ansible all -m setup -a "filter=ansible_os_family"
ansible all -m setup -a "filter=ansible_distribution_major_version"
ansible all -m setup -a "filter=ansible_distribution_version"
ansible all -m setup -a "filter=ansible_processor_vcpus"
ansible all -m setup -a "filter=ansible_all_ipv4_addresses"
ansible all -m setup -a "filter=ansible_architecture"
ansible all -m setup -a "filter=ansible_processor*"

[root@ansible ~]# ansible all -m setup -a 'filter=ansible_python_version'
10.0.0.7 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "2.7.5",
        "discovered_interpreter_python": "/usr/bin/python"
   },
    "changed": false
}
10.0.0.6 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "2.6.6",
        "discovered_interpreter_python": "/usr/bin/python"
   },
    "changed": false
}
10.0.0.8 | SUCCESS => {
    "ansible_facts": {
        "ansible_python_version": "3.6.8",
        "discovered_interpreter_python": "/usr/libexec/platform-python"
   },
    "changed": false
}

# ansible 10.0.0.18 -a 'ip a'
10.0.0.18 | CHANGED | rc=0 >>
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:cc:e7:b6 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.18/24 brd 10.0.0.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:cc:e7:c0 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.214/24 brd 10.0.0.255 scope global dynamic noprefixroute eth1
       valid_lft 720sec preferred_lft 720sec
    inet6 fe80::5d55:6ec0:b164:d5d1/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever


# ansible 10.0.0.18 -m setup -a 'filter=ansible_all_ipv4_addresses'
10.0.0.18 | SUCCESS => {
    "ansible_facts": {
        "ansible_all_ipv4_addresses": [
            "10.0.0.214",
            "10.0.0.18"
        ],
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}

# ansible webs --list
  hosts (2):
    10.0.0.18
    10.0.0.28


# ansible 10.0.0.18 -m setup -a 'filter="ansible_default_ipv4"'
10.0.0.18 | SUCCESS => {
    "ansible_facts": {
        "ansible_default_ipv4": {
            "address": "10.0.0.18",
            "alias": "eth0",
            "broadcast": "10.0.0.255",
            "gateway": "10.0.0.2",
            "interface": "eth0",
            "macaddress": "00:0c:29:cc:e7:b6",
            "mtu": 1500,
            "netmask": "255.255.255.0",
            "network": "10.0.0.0",
            "type": "ether"
        },
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}



# ansible webs -m setup -a 'filter="ansible_default_ipv4"'
10.0.0.28 | SUCCESS => {
    "ansible_facts": {
        "ansible_default_ipv4": {
            "address": "10.0.0.28",
            "alias": "eth0",
            "broadcast": "10.0.255.255",
            "gateway": "10.0.0.2",
            "interface": "eth0",
            "macaddress": "00:0c:29:92:17:a7",
            "mtu": 1500,
            "netmask": "255.255.0.0",
            "network": "10.0.0.0",
            "type": "ether"
        },
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}
10.0.0.18 | SUCCESS => {
    "ansible_facts": {
        "ansible_default_ipv4": {
            "address": "10.0.0.18",
            "alias": "eth0",
            "broadcast": "10.0.0.255",
            "gateway": "10.0.0.2",
            "interface": "eth0",
            "macaddress": "00:0c:29:cc:e7:b6",
            "mtu": 1500,
            "netmask": "255.255.255.0",
            "network": "10.0.0.0",
            "type": "ether"
        },
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}

#!/bin/bash
# 安装Apache
yum install --quiet -y httpd 
# 复制配置文件
cp /tmp/httpd.conf /etc/httpd/conf/httpd.conf
cp/tmp/vhosts.conf /etc/httpd/conf.d/
# 启动Apache，并设置开机启动
systemctl enable --now httpd 

- hosts: websrvs
  remote_user: root
  tasks:
    - name: "安装Apache"
      yum: name=httpd
    - name: "复制配置文件"
      copy: src=/tmp/httpd.conf dest=/etc/httpd/conf/
    - name: "复制配置文件"
      copy: src=/tmp/vhosts.conf dest=/etc/httpd/conf.d/
    - name: "启动Apache，并设置开机启动"
      service: name=httpd state=started enabled=yes

- hosts: websrvs:appsrvs

- hosts: websrvs
  remote_user: root

  tasks:
    - name: test connection
      ping:

- hosts: websrvs
  remote_user: root

  tasks:
    - name: test connection
      ping:
      remote_user: azheng # 在某个 task 中以 azheng 身份执行任务

- hosts: websrvs
  remote_user: root

  tasks:
    - name: test connection
      ping:
      remote_user: james
      sudo: yes # 默认sudo为root
      sudo_user: azheng    # sudo为azheng

# vim test.yml
- hosts: webs
  remote_user: root
  tasks:
    - name: 测试主机连通性
      ping:


# ansible-playbook test.yaml 
...
TASK [Gathering Facts] # 默认会开启 gather_facts 来收集系统信息
ok: [10.0.0.28]
ok: [10.0.0.18]
...

# vim test.yml
- hosts: webs
  remote_user: root
  gather_facts: no
  tasks:
    - name: 测试主机连通性
      ping:

---
- hosts: websrvs
  remote_user: root
  tasks:
    - name: install httpd
      yum: name=httpd 
    - name: start httpd
      service: name=httpd state=started enabled=yes

# vim test.yaml
- hosts: webs
  remote_user: root
  tasks:
    - name: 打印当前所在目录和系统运行时间
      shell: pwd;uptime



# 但结果不会再屏幕上输出
# ansible-playbook test.yaml 

PLAY [webs] ***********************************

TASK [Gathering Facts] ************************
ok: [10.0.0.28]
ok: [10.0.0.18]

TASK [打印当前所在目录和系统运行时间] ***********
changed: [10.0.0.28]
changed: [10.0.0.18]

PLAY RECAP ************************************
10.0.0.18                  : ok=2    changed=1 
10.0.0.28                  : ok=2    changed=1  。。。。。

# vim test.yaml
- hosts: webs
  remote_user: root
  gather_facts: no
  tasks:
    - name: 安装Nginx
      yum: name=nginx state=present
    - name: 拷贝配置文件
      copy: src="files/nginx.conf" dest="/etc/nginx/"
      notify: 重启Nginx # 如果nginx.conf发生修改，则执行重启Nginx的handlers
    - name: 启动Nginx
      service: name=nginx state=started enabled=yes
  handlers:
    - name: 重启Nginx
      service: name=nginx state=restarted


# 列出playbook中执行的主机
# ansible-playbook --list-hosts test.yaml 

playbook: test.yaml

  play #1 (webs): webs	TAGS: []
    pattern: ['webs']
    hosts (2):
      10.0.0.18
      10.0.0.28


# 只针对某个主机执行
# ansible-playbook --limit 10.0.0.18 test.yaml
...


# 测试
# curl 10.0.0.18
...
        <h1>Welcome to <strong>nginx</strong> on Red Hat Enterprise Linux!</h1>
...



# 修改本地的配置文件后，再次执行会调用handlers来重启nginx使配置文件生效
# grep listen files/nginx.conf
        listen       80 default_server;
...
# sed -ri "s/( +listen +)80( default_server;)/\18080\2/" files/nginx.conf
# grep listen files/nginx.conf
        listen       8080 default_server;
...


# 只针对某个主机执行
# ansible-playbook --limit 10.0.0.18 test.yaml
...
RUNNING HANDLER [重启Nginx] ***... # 触发了handlers
changed: [10.0.0.18]


# 再次测试
# curl 10.0.0.18:8080
...
        <h1>Welcome to <strong>nginx</strong> on Red Hat Enterprise Linux!</h1>
...

- hosts: websrvs
  remote_user: root
  gather_facts: no 
  tasks:
    - name: add group nginx
      user: name=nginx state=present
    - name: add user nginx
      user: name=nginx state=present group=nginx
    - name: Install Nginx
      yum: name=nginx state=present
    - name: config 
      copy: src=/root/config.txt dest=/etc/nginx/nginx.conf
      notify:
        - Restart Nginx
        - Check Nginx Process
   handlers:
     - name: Restart Nginx
       service: name=nginx state=restarted enabled=yes
     - name: Check Nginx process
       shell: killall -0 nginx &> /tmp/nginx.log

# vim httpd.yml
- hosts: websrvs
  remote_user: root
  gather_facts: no
  tasks:
    - name: Install httpd
      yum: name=httpd state=present
    - name: Install configure file
      copy: src=files/httpd.conf dest=/etc/httpd/conf/
      tags: conf
    - name: start httpd service
      tags: service
      service: name=httpd state=started enabled=yes


# 只执行conf和service标签中的tasks
# ansible-playbook –t conf,service httpd.yml

vars:
  - var1: value1
  - var2: value2

# vim test.yaml
- hosts: webs
  remote_user: root
  vars: # 定义变量
    collect_info: "/data/test/{{ansible_default_ipv4['address']}}/"
  tasks:
    - name: create IP directory
      file: name="{{collect_info}}" state=directory


# ansible 10.0.0.18 -a 'ls /data/test/ -l'
10.0.0.18 | CHANGED | rc=0 >>
total 0
drwxr-xr-x 2 root root 6 Apr  1 19:03 10.0.0.214

# vim var3.yml 
- hosts: all
  vars:
    - var1: value1
    - var2: value2
  tasks:
    - name: 创建日志文件1
      file: path=/opt/{{ var1 }}.log state=touch mode=000 
    - name: 创建日志文件2
      file: path=/opt/{{ var2 }}.log state=touch mode=000


# ansible-playbook var3.yml 


# ansible webs -a 'ls -l /opt/'
10.0.0.17 | CHANGED | rc=0 >>
total 0
---------- 1 root root 0 Dec 12 18:59 value1.log
---------- 1 root root 0 Dec 12 18:59 value2.log
...

- hosts: all
  vars_files:
    - vars.yml

# 定义变量文件
# vim vars.yml
# variables file
package_name: mariadb-server
service_name: mariadb


# 引用变量文件
# vim var5.yml
# install package and start service
- hosts: dbsrvs
  remote_user: root
  vars_files: # 引用变量文件
    - vars.yml
  tasks:
    - name: install package
      yum: name={{ package_name }}
      tags: install
    - name: start service
      service: name={{ service_name }} state=started enabled=yes

# vim vars2.yml
var1: httpd
var2: nginx


# var6.yml
- hosts: web
  remote_user: root
  vars_files:
    - vars2.yml
  tasks:
    - name: create httpd log
      file: name=/app/{{ var1 }}.log state=touch
    - name: create nginx log
      file: name=/app/{{ var2 }}.log state=touch

# vim vars2.yml
var1: httpd
var2: nginx

---

- hosts: web
  remote_user: root
  vars_files:
    - vars2.yml
  tasks:
    - name: create httpd log
      file: name=/app/{{ var1 }}.log state=touch
    - name: create nginx log
      file: name=/app/{{ var2 }}.log state=touch

# ansible 10.0.0.18 -m setup -a 'filter="ansible_nodename"'
10.0.0.18 | SUCCESS => {
    "ansible_facts": {
        "ansible_nodename": "18",
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}


# vim test.yml
- hosts: webs
  remote_user: root
  gather_facts: yes # 需开启此选项才能从 setup 模块中获取值，此选项默认就是yes
  tasks:
    - name: 创建日志文件
      file: name=/data/{{ ansible_nodename }}.log state=touch owner=nobody mode=600


# ansible-playbook --limit 10.0.0.18 test.yaml
...


# ansible 'webs:!10.0.0.28' -a 'ls -l /data/*.log'
10.0.0.18 | CHANGED | rc=0 >>
-rw------- 1 nobody root 0 Apr  1 18:47 /data/18.log

# ansible 10.0.0.18 -m setup -a 'filter="ansible_default_ipv4"'
10.0.0.18 | SUCCESS => {
    "ansible_facts": {
        "ansible_default_ipv4": {
            "address": "10.0.0.214",
            "alias": "eth1",
            "broadcast": "10.0.0.255",
            "gateway": "10.0.0.2",
            "interface": "eth1",
            "macaddress": "00:0c:29:cc:e7:c0",
            "mtu": 1500,
            "netmask": "255.255.255.0",
            "network": "10.0.0.0",
            "type": "ether"
        },
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false
}


# 不进行过滤的话，会将全部输出结果定向到文件当中
# ansible 'webs:!10.0.0.28' -a 'ls -l /data/'
10.0.0.18 | CHANGED | rc=0 >>
total 784
-rw------- 1 nobody root      0 Apr  1 18:50 {'gateway': '10.0.0.2', 'interface': 'eth1', 'address': '10.0.0.214', 'broadcast': '10.0.0.255', 'netmask': '255.255.255.0', 'network': '10.0.0.0', 'macaddress': '00:0c:29:cc:e7:c0', 'mtu': 1500, 'type': 'ether', 'alias': 'eth1'}.txt


# 使用 [' '] 进行过滤
# vim test.yaml
- hosts: webs
  remote_user: root
  vars:
    collect_info: "/data/test/{{ansible_default_ipv4['address']}}/"
  tasks:
    - name: create IP directory
      file: name="{{collect_info}}" state=directory


# ansible 10.0.0.18 -a 'ls /data/test/ -l'
10.0.0.18 | CHANGED | rc=0 >>
total 0
drwxr-xr-x 2 root root 6 Apr  1 19:03 10.0.0.214

ansible-playbook -e varname=value test.yml

# vim var2.yml
---
- hosts: all
  tasks:
    - name: 创建日志文件
      file: path=/opt/{{ logname }}.log state=touch mode=000


# ansible-playbook -e logname=testlog var2.yml 


# ansible webs -a 'ls -l /opt/'
10.0.0.7 | CHANGED | rc=0 >>
total 0
---------- 1 root root 0 Dec 13 01:18 testlog.log
...

# vim /etc/ansible/hosts
[webs]
10.0.0.18 hname=www1 domain=azheng.io
10.0.0.28 hname=www2

[webs:vars]
mark="-"
domain=azheng.org


# ansible webs -m hostname -a 'name={{ hname }}{{ mark }}{{ domain }}'
...
# ansible webs -a 'hostname'
10.0.0.18 | CHANGED | rc=0 >>
www1-azheng.io
10.0.0.28 | CHANGED | rc=0 >>
www2-azheng.org


# 命令行指定变量最优先
# ansible webs -e domain=azheng.cn -m hostname -a 'name={{ hname }}{{ mark }}{{ domain }}'
# ansible webs -a 'hostname'
10.0.0.28 | CHANGED | rc=0 >>
www2-azheng.cn
10.0.0.18 | CHANGED | rc=0 >>
www1-azheng.cn

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# vim templates/nginx.conf.j2 
server {
  listen  80;
}


# vim test.yaml
- hosts: webs
  remote_user: root
  tasks:
    - name: template config to remote hosts
      template: src=nginx.conf.j2 dest=/data/nginx.conf # dest中的目录不会自动创建，因此需事先创建


# ansible-playbook test.yaml
...


# ansible webs -a 'cat /data/nginx.conf'
10.0.0.28 | CHANGED | rc=0 >>
server {
  listen  80;
}
...

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# vim templates/nginx.conf.j2 
worker_processes {{ ansible_processor_vcpus }}; # 模板文件中调用变量，实现自动生成


# vim test.yaml
- hosts: webs
  remote_user: root
  tasks:
    - name: install nginx
      yum: name=nginx
    - name: template config to remote hosts
      template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf 
    - name: start service
      service: name=nginx state=started enabled=yes

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# vim templates/nginx.conf.j2 
worker_processes {{ ansible_processor_vcpus**3 }}; # 模板文件中调用变量，再利用算术运算
worker_processes {{ ansible_processor_vcpus**2 }};    
worker_processes {{ ansible_processor_vcpus+2 }};


# vim test.yaml
- hosts: websrvs
  remote_user: root
  tasks:
    - name: install nginx
      yum: name=nginx
    - name: template config to remote hosts
      template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
      notify: restart nginx
    - name: start service
      service: name=nginx state=started enabled=yes
  handlers:
    - name: restart nginx
      service: name=nginx state=restarted

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# vim test.yaml
---
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - 81
      - 82
      - 83
  tasks:
   - name: template config
     template: src=nginx.conf.j2 dest=/data/nginx.conf


# 和shell中的for循环非常类似
# vim templates/nginx.conf.j2 
{% for vhost in nginx_vhosts %} # 循环定义
server {
    listen {{ vhost }}
}
{% endfor %} # 循环结束


# 生成的结果
server {
    listen 81   
}
server {
    listen 82   
}
server {
    listen 83   
}

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# vim test.yaml
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - listen: 8080
  tasks:
    - name: config file
      template: src=nginx.conf3.j2 dest=/data/nginx3.conf


# templates/nginx.conf.j2
{% for vhost in nginx_vhosts %}   
server {
 listen {{ vhost.listen }} # 选择变量中某个键的值
}
{% endfor %}


# templates/nginx.conf.j2 其实就相当于
server {
 listen {{ listen }}
}


#生成的结果
server {
 listen 8080
}

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# vim test.yaml
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - listen: 8080
        server_name: "web1.magedu.com"
        root: "/var/www/nginx/web1/"
      - listen: 8081
        server_name: "web2.magedu.com"
        root: "/var/www/nginx/web2/"
      - {listen: 8082, server_name: "web3.magedu.com", root: "/var/www/nginx/web3/"}
  tasks:
    - name: template config
      template: src=nginx.conf4.j2 dest=/data/nginx4.conf


# templates/nginx.conf.j2
{% for vhost in nginx_vhosts %}
server {
   listen {{ vhost.listen }}
   server_name {{ vhost.server_name }}
   root {{ vhost.root }}  
}
{% endfor %}


# 生成的结果
server {
   listen 8080
   server_name web1.magedu.com
   root /var/www/nginx/web1/  
}
server {
   listen 8081
   server_name web2.magedu.com
   root /var/www/nginx/web2/  
}
server {
   listen 8082
   server_name web3.magedu.com
   root /var/www/nginx/web3/  
}

# tree
.
├── templates
│   └── nginx.conf.j2
└── test.yaml


# test.yaml
- hosts: websrvs
  remote_user: root
  vars:
    nginx_vhosts:
      - web1:
        listen: 8080
        root: "/var/www/nginx/web1/"
      - web2:
        listen: 8080
        server_name: "web2.magedu.com"
        root: "/var/www/nginx/web2/"
      - web3:
        listen: 8080
        server_name: "web3.magedu.com"
        root: "/var/www/nginx/web3/"
  tasks:
    - name: template config to 
      template: src=nginx.conf.j2 dest=/data/nginx.conf


# templates/nginx.conf5.j2
{% for vhost in nginx_vhosts %}
server {
   listen {{ vhost.listen }}
   {% if vhost.server_name is defined %} # 如果server_name定义了则生成对应的配置
   server_name {{ vhost.server_name }}
   {% endif %}
   root  {{ vhost.root }}
}
{% endfor %}


# 生成的结果
server {
   listen 8080
   root /var/www/nginx/web1/
}
server {
   listen 8080
   server_name web2.magedu.com
   root /var/www/nginx/web2/
}
server {
   listen 8080
   server_name web3.magedu.com
   root /var/www/nginx/web3/
}

- hosts: websrvs
  remote_user: root
  tasks:
    - name: "shutdown RedHat flavored systems"
      command: /sbin/shutdown -h now
      when: ansible_os_family == "RedHat" # 当操作系统家族为RedHat时

- hosts: websrvs
  remote_user: root  
  tasks:
    - name: add group nginx
      tags: user
      user: name=nginx state=present
    - name: add user nginx
      user: name=nginx state=present group=nginx
    - name: Install Nginx
      yum: name=nginx state=present
    - name: restart Nginx
      service: name=nginx state=restarted
      when: ansible_distribution_major_version == "6" # 当系统版本为6时

- hosts: websrvs
  remote_user: root
  tasks: 
    - name: install conf file to centos7
      template: src=nginx.conf.c7.j2 dest=/etc/nginx/nginx.conf
      when: ansible_distribution_major_version == "7"
    - name: install conf file to centos6
      template: src=nginx.conf.c6.j2 dest=/etc/nginx/nginx.conf
      when: ansible_distribution_major_version == "6"

- hosts: websrvs
  remote_user: root
  tasks:
    - name: add several users
      user: name={{ item }} state=present groups=wheel # 对迭代项的引用，固定变量名为"item"
      with_items: # 要在 task 中使用 with_items 给定要迭代的元素列表
        - testuser1
        - testuser2
        - testuser3


# 上面语句的功能等同于下面的语句
    - name: add several users
      user: name=testuser1 state=present groups=wheel
    - name: add several users
      user: name=testuser2 state=present groups=wheel
    - name: add several users
      user: name=testuser3 state=present groups=wheel

# remove mariadb server
- hosts: appsrvs:!10.0.0.8
  remote_user: root
  tasks:
    - name: stop service
      shell: /etc/init.d/mysqld stop
    - name: delete files and dir
      file: path={{item}} state=absent
      with_items:
        - /usr/local/mysql
        - /usr/local/mariadb-10.2.27-linux-x86_64
        - /etc/init.d/mysqld
        - /etc/profile.d/mysql.sh
        - /etc/my.cnf
        - /data/mysql
    - name: delete user
      user: name=mysql state=absent remove=yes