服务器自动化运维工具推荐

# 控制端安装（Rocky Linux 9 / Ubuntu 24.04 LTS）
dnf install -y ansible          # Ubuntu: apt install -y ansible
ansible --version               # 截至 2026 年主流为 ansible-core 2.16+ / 2.17+

# 生成 SSH 密钥并分发到被管机器（一次性）
ssh-keygen -t ed25519 -C "ansible-control"
for ip in 10.0.0.11 10.0.0.12 10.0.0.13; do
  ssh-copy-id -o StrictHostKeyChecking=no opsuser@$ip
done

# /etc/ansible/hosts 或项目目录下的 inventory.ini
[web]
web01 ansible_host=10.0.0.11
web02 ansible_host=10.0.0.12

[db]
db01  ansible_host=10.0.0.21

[prod:children]          # 组嵌套
web
db

[web:vars]               # 组变量
ansible_user=opsuser
ansible_port=2222
ansible_python_interpreter=/usr/bin/python3

# 连通性测试
ansible web -m ping -i inventory.ini

# 批量执行命令（查看负载、磁盘）
ansible web -m command -a "uptime" -i inventory.ini
ansible all -m shell -a "df -h | grep -E '/$|/data'" -i inventory.ini

# 批量安装软件包
ansible web -m dnf -a "name=nginx state=present" -i inventory.ini --become

# 批量管理服务
ansible web -m service -a "name=nginx state=restarted enabled=yes" -i inventory.ini --become

# 批量分发文件
ansible web -m copy -a "src=./nginx.conf dest=/etc/nginx/nginx.conf mode=0644" -i inventory.ini --become

# 收集主机信息（facts）
ansible web -m setup -i inventory.ini | head -50
ansible web -m setup -a "filter=ansible_distribution*" -i inventory.ini

# site.yml —— 批量部署 Nginx 并下发配置
---
- name: 部署并配置 Nginx
  hosts: web
  become: yes
  vars:
    nginx_worker_processes: auto
    nginx_keepalive_timeout: 65

  tasks:
    - name: 安装 Nginx
      ansible.builtin.dnf:
        name: nginx
        state: present
      when: ansible_os_family == "RedHat"

    - name: 安装 Nginx（Debian 系）
      ansible.builtin.apt:
        name: nginx
        state: present
      when: ansible_os_family == "Debian"

    - name: 下发主配置文件
      ansible.builtin.template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/nginx.conf
        owner: root
        group: root
        mode: '0644'
        validate: 'nginx -t -c %s'      # 下发前先校验语法，防止配错导致服务起不来
      notify: 重载 Nginx

    - name: 确保 Nginx 运行并开机自启
      ansible.builtin.service:
        name: nginx
        state: started
        enabled: yes

    - name: 放行 HTTP/HTTPS 防火墙
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: yes
        state: enabled
        immediate: yes
      loop:
        - http
        - https
      when: ansible_os_family == "RedHat"

  handlers:
    - name: 重载 Nginx
      ansible.builtin.service:
        name: nginx
        state: reloaded

{# templates/nginx.conf.j2 #}
user nginx;
worker_processes {{ nginx_worker_processes }};
error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

events {
    worker_connections {{ ansible_processor_vcpus * 1024 }};
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    server_tokens off;
    keepalive_timeout {{ nginx_keepalive_timeout }};

    server {
        listen 80;
        server_name {{ inventory_hostname }};
        root /usr/share/nginx/html;
        index index.html;
    }
}

# 语法检查
ansible-playbook site.yml -i inventory.ini --syntax-check

# 演练模式（只显示将要发生的变化，不实际执行）——强烈建议每次先跑
ansible-playbook site.yml -i inventory.ini --check --diff

# 正式执行
ansible-playbook site.yml -i inventory.ini

# 只对一台机器执行（灰度）
ansible-playbook site.yml -i inventory.ini --limit web01

# 分批执行（每次 2 台，避免全量同时变更）
ansible-playbook site.yml -i inventory.ini --forks 2

# 从指定任务开始（排错时有用）
ansible-playbook site.yml -i inventory.ini --start-at-task "下发主配置文件"

# 查看会影响到哪些主机
ansible-playbook site.yml -i inventory.ini --list-hosts

# 标准目录结构（可用 ansible-galaxy init nginx 生成）
ansible-galaxy init roles/nginx

roles/nginx/
├── defaults/main.yml      # 默认变量（优先级最低，易被覆盖）
├── vars/main.yml          # 角色内变量（优先级高）
├── tasks/main.yml         # 主任务列表
├── handlers/main.yml      # 处理器
├── templates/nginx.conf.j2
├── files/index.html       # 静态文件
└── meta/main.yml          # 依赖声明

# roles/nginx/tasks/main.yml
---
- name: 安装 Nginx
  ansible.builtin.package:
    name: nginx
    state: present

- name: 下发配置
  ansible.builtin.template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
    validate: 'nginx -t -c %s'
  notify: reload nginx

# 顶层 playbook 引用 role
---
- hosts: web
  become: yes
  roles:
    - role: nginx
      vars:
        nginx_keepalive_timeout: 30
    - role: mysql

# main.tf —— 声明式描述基础设施
terraform {
  required_providers {
    local = {
      source  = "hashicorp/local"
      version = "~> 2.4"
    }
  }
}

variable "instance_count" {
  description = "创建实例数量"
  type        = number
  default     = 2
}

resource "local_file" "server_inventory" {
  count    = var.instance_count
  filename = "${path.module}/inventory/web-${count.index + 1}.ini"
  content  = <<-EOT
    [web]
    web-${count.index + 1} ansible_host=10.0.0.${11 + count.index}
  EOT
}

output "generated_files" {
  value = local_file.server_inventory[*].filename
}

terraform init        # 初始化 provider
terraform plan        # 预览将要发生的变更（核心安全机制）
terraform apply       # 执行（需确认）
terraform destroy     # 销毁（慎用）
terraform state list  # 查看已管理资源

# 安装（Rocky/RHEL 系）
dnf install -y cockpit cockpit-podman cockpit-navigator
systemctl enable --now cockpit.socket
firewall-cmd --permanent --add-service=cockpit && firewall-cmd --reload
# 访问 https://<服务器IP>:9090 ，用系统账号登录