Ansibleで光の速さのWEBサーバーを光の速さで構成してみる。

---
- name: install remi repository
  yum: name=http://rpms.famillecollet.com/enterprise/remi-release-7.rpm state=present 

- name: install epel repository
  yum: name=https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm state=present

- name: install webtatic repository
  yum: name=https://mirror.webtatic.com/yum/el7/webtatic-release.rpm state=present

- name: Install php-fpm and deps 
  yum: name={{ item }} state=present enablerepo=remi,epel,webtatic
  with_items:
  - php70w
  - php70w-fpm
  - php70w-enchant
  - php70w-mbstring
  - php70w-mysql
  - php70w-mcrypt
  - php70w-opcache
  - php70w-xml

- name: Disable default pool
  command: mv /etc/php-fpm.d/www.conf /etc/php-fpm.d/www.disabled creates=/etc/php-fpm.d/www.disabled
  notify: restart php-fpm

- name: Copy php-fpm configuration
  template: src=wordpress.conf dest=/etc/php-fpm.d/
  notify: restart php-fpm

---
- name: Add new user
  user:
    name: "{{ ssh_user }}"
    groups: wheel
    password: "{{ ssh_user_passwd }}"
    generate_ssh_key: yes
    ssh_key_bits: 2048

- name: Create an authorized_keys file
  command: /bin/cp /home/{{ ssh_user }}/.ssh/id_rsa.pub /home/{{ ssh_user }}/.ssh/authorized_keys

- name: Change attributes of an authorized_keys file
  file:
    path: /home/{{ ssh_user }}/.ssh/authorized_keys
    owner: "{{ ssh_user }}"
    group: "{{ ssh_user }}"
    mode: 0600

- name: Allow wheel group to use sudo
  lineinfile:
    dest: /etc/sudoers
    state: present
    insertafter: "^# %wheel\\s+ALL=\\(ALL\\)\\s+NOPASSWD:\\s+ALL"
    line: "%wheel ALL=(ALL) NOPASSWD: ALL"
    validate: "visudo -cf %s"
    backup: yes

- name: Fobid root to access via ssh
  lineinfile:
    dest: /etc/ssh/sshd_config
    state: present
    regexp: "^PermitRootLogin without-password"
    line: "PermitRootLogin no"
    backrefs: yes
    validate: "sshd -T -f %s"
    backup: yes
  notify:
    - restart sshd

- name: Permit only specific user to access via ssh
  lineinfile:
    dest: /etc/ssh/sshd_config
    state: present
    insertafter: "^PasswordAuthentication no"
    regexp: "^AllowUsers"
    line: "AllowUsers {{ ssh_user }}"
    validate: "sshd -T -f %s"
    backup: yes
  notify:
    - restart sshd

- name: Change ssh port number
  lineinfile:
    dest: /etc/ssh/sshd_config
    state: present
    insertafter: "^#Port 22"
    regexp: "^Port"
    line: "Port {{ ssh_port }}"
    validate: "sshd -T -f %s"
    backup: yes
  notify:
    - restart sshd

- name: Change acceptable tcp port for ssh on iptables
  firewalld: port={{ ssh_port }}/tcp permanent=true state=enabled immediate=yes

- name: shutdown ssh port
  firewalld: service=sshd permanent=true state=disabled immediate=yes

- name: Retrieve a private key from remote host
  fetch:
    src: /home/{{ ssh_user }}/.ssh/id_rsa
    dest: fetch/private_key-{{ ansible_hostname }}
    validate_md5: true
    fail_on_missing: true
    flat: true

---
- name: Install libselinux-python
  yum: name=libselinux-python state=present

- name: Check status of selinux
  shell: getenforce

- name: Permissive selinux
  selinux: policy=targeted state=permissive

- name: test connection (before reboot)
  ping:

- name: reboot!
  command: shutdown -r now

[wordpress-server]
xx.xx.xx.xx ansible_ssh_private_key_file=~/.ssh/id_rsa ansible_ssh_user=root