OpenSSL:

• Downloading OpenSSL:

  Run the command below,

  wget http://www.openssl.org/source/openssl-1.0.1g.tar.gz

  Also, download the MD5 hash to verify the integrity of the downloaded file. In the same folder, where you downloaded the OpenSSL file, do the following:

  wget http://www.openssl.org/source/openssl-1.0.1g.tar.gz.md5
  
  md5sum openssl-1.0.1g.tar.gz
  
  cat openssl-1.0.1g.tar.gz.md5
  

  The last two commands (above) generate two strings of alpha-numeric characters. Check to see if both strings are identical or not. If not, repeat the steps above from "Downloading OpenSSL". If yes, your file has been downloaded properly. Please notethat if you are using openssl for a highly secure/critical setup (or for any other reason) then you should also check the PGP signatures (not covered in this tutorial for simplicity).

• Extracting files from the downloaded package:

  tar -xvzf openssl-1.0.1g.tar.gz

  Now, enter the directory where the package is extracted.

  cd openssl-1.0.1g

• Configuring OpenSSL:

  ./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl

  Replace "/usr/local/openssl" above with the directory path where you want to copy the files and folders. Note: check for any error message.

• Compiling OpenSSL:

  make

  Note: check for any error message.

• Installing OpenSSL:

  As root (for privileges on destination directory), run the following.
  With sudo,

  sudo make install

  Without sudo,

  make install

  Note: check for any error messages.

/usr/local/openssl/bin/openssl version
OpenSSL 1.0.1g 7 Apr 2014

Install

sudo apt-add-repository -y ppa:ansible/ansible
sudo apt-get update
sudo apt-get install -y ansible

Managing Servers

sudo mv /etc/ansible/hosts /etc/ansible/hosts.orig

[web]
192.168.22.10
192.168.22.11

[local]
127.0.0.1

Basic: Running Commands

$ ansible all -m ping
127.0.0.1 | success >> {
    "changed": false,
    "ping": "pong"
}

ansible all -m ping -s -k -u vagrant

• all - Use all defined servers from the inventory file
• -m ping - Use the "ping" module, which simply runs the ping command and returns the results
• -s - Use "sudo" to run the commands
• -k - Ask for a password rather than use key-based authentication
• -u vagrant - Log into servers using user vagrant

Modules

ansible all -s -m shell -a 'apt-get install nginx'

ansible all -s -m apt -a 'pkg=nginx state=installed update_cache=true'
127.0.0.1 | success >> {
    "changed": false
}

• all - Run on all defined hosts from the inventory file
• -s - Run using sudo
• -m apt - Use the apt module
• -a 'pkg=nginx state=installed update_cache=true' - Provide the arguments for the apt module, including the package name, our desired end state and whether to update the package repository cache or not

Basic Playbook

Playbooks and Roles in Ansible all use Yaml.

---
- hosts: local
  tasks:
   - name: Install Nginx
     apt: pkg=nginx state=installed update_cache=true

$ ansible-playbook -s nginx.yml

PLAY [local] ******************************************************************

GATHERING FACTS ***************************************************************
ok: [127.0.0.1]

TASK: [Install Nginx] *********************************************************
ok: [127.0.0.1]

PLAY RECAP ********************************************************************
127.0.0.1                  : ok=2    changed=0    unreachable=0    failed=0

I used the command $ ansible-playbook -s -k -u vagrant nginx.yml to run this playbook locally on my Vagrant installation.

Handlers

---
- hosts: local
  tasks:
   - name: Install Nginx
     apt: pkg=nginx state=installed update_cache=true
     notify:
      - Start Nginx

  handlers:
   - name: Start Nginx
     service: name=nginx state=started

Note that Ansible has us define the state you wish the service to be in, rather than defining the change you want. Ansible will decide if a change is needed, we just tell it the desired result.

$ ansible-playbook -s nginx.yml

PLAY [local] ******************************************************************

GATHERING FACTS ***************************************************************
ok: [127.0.0.1]

TASK: [Install Nginx] *********************************************************
ok: [127.0.0.1]

NOTIFIED: [nginx | Start Nginx] ***********************************************
ok: [127.0.0.1]

PLAY RECAP ********************************************************************
127.0.0.1                  : ok=2    changed=0    unreachable=0    failed=0

Notifiers are only run if the Task is run. If I already had Nginx installed, the Install Nginx Task would not be run and the notifier would not be called.

More Tasks

---
- hosts: local
  vars:
   - docroot: /var/www/serversforhackers.com/public
  tasks:
   - name: Add Nginx Repository
     apt_repository: repo='ppa:nginx/stable' state=present
     register: ppastable

   - name: Install Nginx
     apt: pkg=nginx state=installed update_cache=true
     when: ppastable|success
     register: nginxinstalled
     notify:
      - Start Nginx

   - name: Create Web Root
     when: nginxinstalled|success
     file: dest={{ '{{' }} docroot {{ '}}' }} mode=775 state=directory owner=www-data group=www-data
     notify:
      - Reload Nginx

  handlers:
   - name: Start Nginx
     service: name=nginx state=started

    - name: Reload Nginx
      service: name=nginx state=reloaded

• Add Nginx Repository - Add the Nginx stable PPA to get the latest stable version of Nginx, using the apt_repository module.
• Install Nginx - Installs Nginx using the Apt module.
• Create Web Root - Finally, create a web root directory.

ansible-playbook -s nginx.yml

# Or, as I ran on my Vagrant machine:
ansible-playbook -s -k -u vagrant nginx.yml

Roles

rolename
 - files
 - handlers
 - meta
 - templates
 - tasks
 - vars

Files

nginx
 - files
 - - h5bp

Handlers

---
- name: Start Nginx
  service: name=nginx state=started

- name: Reload Nginx
  service: name=nginx state=reloaded

Meta

---
dependencies:
  - { role: ssl }

---
dependencies: []

Template

server {
    # Enforce the use of HTTPS
    listen 80 default_server;
    server_name *.{{ '{{' }} domain {{ '}}'  }};
    return 301 https://{{ '{{' }} domain {{ '}}'  }}$request_uri;
}

server {
    listen 443 default_server ssl;

    root /var/www/{{ '{{' }} domain {{ '}}'  }}/public;
    index index.html index.htm index.php;

    access_log /var/log/nginx/{{ '{{' }} domain {{ '}}'  }}.log;
    error_log  /var/log/nginx/{{ '{{' }} domain {{ '}}'  }}-error.log error;

    server_name {{ '{{' }} domain {{ '}}'  }};

    charset utf-8;

    include h5bp/basic.conf;

    ssl_certificate           {{ '{{' }} ssl_crt {{ '}}' }};
    ssl_certificate_key       {{ '{{' }} ssl_key {{ '}}' }};
    include h5bp/directive-only/ssl.conf;

    location /book {
        return 301 http://book.{{ '{{' }} domain {{ '}}'  }};
    }

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt  { log_not_found off; access_log off; }

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;

        include fastcgi_params; # fastcgi.conf for version 1.6.1+
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO       $fastcgi_path_info;
        fastcgi_param ENV production;
    }

    # Nginx status
    # Nginx Plus only
    #location /status {
    #    status;
    #    status_format json;
    #    allow 127.0.0.1;
    #    deny all;
    #}

    location ~ ^/(fpmstatus|fpmping)$ {
        access_log off;
        allow 127.0.0.1;
        deny all;
        include fastcgi_params; # fastcgi.conf for version 1.6.1+
        fastcgi_pass unix:/var/run/php5-fpm.sock;
    }
}

• domain
• ssl_crt
• ssl_key

Variables

---
domain: serversforhackers.com
ssl_key: /etc/ssl/sfh/sfh.key
ssl_crt: /etc/ssl/sfh/sfh.crt

Tasks

---
- name: Add Nginx Repository
  apt_repository: repo='ppa:nginx/stable' state=present
  register: ppastable

- name: Install Nginx
  apt: pkg=nginx state=installed update_cache=true
  when: ppastable|success
  register: nginxinstalled
  notify:
    - Start Nginx

- name: Add H5BP Config
  when: nginxinstalled|success
  copy: src=h5bp dest=/etc/nginx owner=root group=root

- name: Disable Default Site
  when: nginxinstalled|success
  file: dest=/etc/nginx/sites-enabled/default state=absent

- name: Add SFH Site Config
  when: nginxinstalled|success
  register: sfhconfig
  template: src=serversforhackers.com.j2 dest=/etc/nginx/sites-available/{{ '{{' }} domain {{ '}}'  }}.conf owner=root group=root

- name: Enable SFH Site Config
  when: sfhconfig|success
  file: src=/etc/nginx/sites-available/{{ '{{' }} domain {{ '}}'  }}.conf dest=/etc/nginx/sites-enabled/{{ '{{' }} domain {{ '}}'  }}.conf state=link


- name: Create Web root
  when: nginxinstalled|success
  file: dest=/var/www/{{ '{{' }} domain {{ '}}'  }}/public mode=775 state=directory owner=www-data group=www-data
  notify:
    - Reload Nginx

- name: Web Root Permissions
  when: nginxinstalled|success
  file: dest=/var/www/{{ '{{' }} domain {{ '}}'  }} mode=775 state=directory owner=www-data group=www-data recurse=yes
  notify:
    - Reload Nginx

• Add the nginx/stable repository
• Install & start Nginx, register successful installation to trigger remaining Tasks
• Add H5BP configuration
• Disable the default virtual host by removing the symlink to the default file from the sites-enabled directory
• Copy the serversforhackers.com.conf.j2 virtual host template into the Nginx configuration
• Enable the virtual host configuration by symlinking it to the sites-enabled directory
• Create the web root
• Change permission for the project root directory, which is one level above the web root created previously

Running the Role

roles_path    = /vagrant/ansible/roles

Remove the ssl dependency from meta/main.yml before running this Role if you are following along.

---
- hosts: all
  roles:
    - nginx

In my Vagrant example, I use the host "local" rather than "all".

ansible-playbook -s server.yml

# Or as I do with my Vagrant VM:
ansible-playbook -s -k -u vagrant server.yml

PLAY [all] ********************************************************************

GATHERING FACTS ***************************************************************
ok: [127.0.0.1]

TASK: [nginx | Add Nginx Repository] ******************************************
changed: [127.0.0.1]

TASK: [nginx | Install Nginx] *************************************************
changed: [127.0.0.1]

TASK: [nginx | Add H5BP Config] ***********************************************
changed: [127.0.0.1]

TASK: [nginx | Disable Default Site] ******************************************
changed: [127.0.0.1]

TASK: [nginx | Add SFH Site Config] *******************************************
changed: [127.0.0.1]

TASK: [nginx | Enable SFH Site Config] ****************************************
changed: [127.0.0.1]

TASK: [nginx | Create Web root] ***********************************************
changed: [127.0.0.1]

TASK: [nginx | Web Root Permissions] ******************************************
ok: [127.0.0.1]

NOTIFIED: [nginx | Start Nginx] ***********************************************
ok: [127.0.0.1]

NOTIFIED: [nginx | Reload Nginx] **********************************************
changed: [127.0.0.1]

PLAY RECAP ********************************************************************
127.0.0.1                  : ok=8   changed=7   unreachable=0    failed=0