saltstack之nginx、php的配置

saltstack为nginx提供状态配置

1、创建nginx配置需要的目录

mkdir /srv/salt/prod/nginx
mkdir /srv/salt/prod/nginx/files

 2、将需要用到的nginx的源码包、启动脚本以及配置文件提供到files文件中

[root@node1 nginx]# ll files/
total 824
-rw-r--r-- 1 root root 833473 Oct 11 15:51 nginx-1.8.1.tar.gz
-rw-r--r-- 1 root root   1012 Oct 11 15:52 nginx.conf
-rwxr-xr-x 1 root root   2687 Oct 11 14:53 nginx.init

 3、编写nginx安装的配置文件，并将nginx启动脚本添加到系统服务

[root@node1 nginx]# cat install.sls 
include:
  - pkg.pkg-init

nginx-install:
  file.managed:
    - name: /usr/local/src/nginx-1.8.1.tar.gz
    - source: salt://nginx/files/nginx-1.8.1.tar.gz
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name: useradd -M -s /sbin/nologin nginx && cd /usr/local/src && tar xf nginx-1.8.1.tar.gz && cd nginx-1.8.1 && yum install libxslt-devel -y gd gd-devel GeoIP GeoIP-devel pcre pcre-devel && ./configure --user=nginx --group=nginx --prefix=/usr/local/nginx --with-file-aio --with-ipv6 --with-http_ssl_module  --with-http_spdy_module --with-http_realip_module    --with-http_addition_module    --with-http_xslt_module   --with-http_image_filter_module    --with-http_geoip_module  --with-http_sub_module  --with-http_dav_module --with-http_flv_module    --with-http_mp4_module --with-http_gunzip_module  --with-http_gzip_static_module  --with-http_auth_request_module  --with-http_random_index_module   --with-http_secure_link_module   --with-http_degradation_module   --with-http_stub_status_module && make && make install && chown -R nginx:nginx /usr/local/nginx/
    - unless: test -d /usr/local/nginx
    - require:
      - pkg: pkg-init
      - file: /usr/local/src/nginx-1.8.1.tar.gz

nginx-init:
  file.managed:
    - name: /etc/init.d/nginx
    - source: salt://nginx/files/nginx.init
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name: chkconfig --add nginx
    - unless: chkconfig --list|grep nginx
    - require:
      - file: /etc/init.d/nginx

 执行nginx安装配置文件：

salt 'node1' state.sls nginx.install saltenv=prod

 当然可以将上述的install.sls中的几个部分分割开：

1、nginx服务的用户，可以自定义nginx-user.sls

nginx-user-group:
  group.present:
    - name: nginx
    - gid: 1000

  user.present:
    - name: nginx
    - fullname: nginx
    - shell: /sbin/nologin
    - uid: 1000
    - gid: 1000

 2、编译nginx安装时需要依赖的包

nginx-require:
  pkg.installed:
    - names:
      - libxslt-devel
      - gd
      - gd-devel
      - GeoIP
      - GeoIP-devel
      - pcre
      - pcre-devel

 4、nginx安装完成后，需要给nginx提供配置文件，并将nginx服务开启

[root@node1 nginx]# cat service.sls 
include:
  - nginx.install

/usr/local/nginx/conf/nginx.conf:
  file.managed:
    - source: salt://nginx/files/nginx.conf
    - user: nginx
    - group: nginx
    - mode: 644

nginx-service:
  file.directory:
    - name: /usr/local/nginx/conf/vhost
    - require:
      - file: nginx-install
  service.running:
    - name: nginx
    - enable: True
    - reload: True
    - require: 
      - file: /etc/init.d/nginx
      - cmd: nginx-init
    - watch:
      - file: /usr/local/nginx/conf/nginx.conf

 执行整个nginx项目配置文件

salt 'node1' state.sls nginx.service saltenv=prod

 nginx框架图：

[root@node1 nginx]# tree
.
├── files
│   ├── nginx-1.8.1.tar.gz
│   ├── nginx.conf
│   └── nginx.init
├── install.sls
└── service.sls

 将nginx项目整合到base环境的top.sls文件中：

[root@node1 base]# cat top.sls 
base:
  '*':
    - init.env_init

prod:
  '*':
    - cluster.haproxy-outside
    - cluster.haproxy-outside-keepalived
    - nginx.service

 nginx的配置文件如下：

[root@node1 nginx]# cat files/nginx.conf 
user  nginx;
worker_processes  1;
error_log  logs/error.log  error;
pid        logs/nginx.pid;
worker_rlimit_nofile 30000;


events {
    worker_connections  1024;
    use epoll;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  logs/access.log  main;
    sendfile        on;
    tcp_nopush     on;
    underscores_in_headers on;
    keepalive_timeout  10;
    send_timeout 60;
    gzip  on;
include /usr/local/nginx/conf/vhost/*.conf;
    server {
        listen       8080;
        server_name  localhost;
        location /nginx_status {
            stub_status on;
            access_log off;
            allow 192.168.44.0/24;
            deny all;
        }
    }
}

 nginx启动脚本如下：

[root@node1 nginx]# cat files/nginx.init 
#!/bin/sh
#
# nginx - this script starts and stops the nginx daemon
#
# chkconfig:   - 85 15
# description:  NGINX is an HTTP(S) server, HTTP(S) reverse 
#               proxy and IMAP/POP3 proxy server
# processname: nginx
# config:      /etc/nginx/nginx.conf
# config:      /etc/sysconfig/nginx
# pidfile:     /var/run/nginx.pid

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ "$NETWORKING" = "no" ] && exit 0

nginx="/usr/local/nginx/sbin/nginx"
prog=$(basename $nginx)

NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf"

[ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx

lockfile=/var/lock/subsys/nginx

make_dirs() {
   # make required directories
   user=`$nginx -V 2>&1 | grep "configure arguments:.*--user=" | sed 's/[^*]*--user=([^ ]*).*/1/g' -`
   if [ -n "$user" ]; then
      if [ -z "`grep $user /etc/passwd`" ]; then
         useradd -M -s /bin/nologin $user
      fi
      options=`$nginx -V 2>&1 | grep 'configure arguments:'`
      for opt in $options; do
          if [ `echo $opt | grep '.*-temp-path'` ]; then
              value=`echo $opt | cut -d "=" -f 2`
              if [ ! -d "$value" ]; then
                  # echo "creating" $value
                  mkdir -p $value && chown -R $user $value
              fi
          fi
       done
    fi
}

start() {
    [ -x $nginx ] || exit 5
    [ -f $NGINX_CONF_FILE ] || exit 6
    make_dirs
    echo -n $"Starting $prog: "
    daemon $nginx -c $NGINX_CONF_FILE
    retval=$?
    echo
    [ $retval -eq 0 ] && touch $lockfile
    return $retval
}

stop() {
    echo -n $"Stopping $prog: "
    killproc $prog -QUIT
    retval=$?
    echo
    [ $retval -eq 0 ] && rm -f $lockfile
    return $retval
}

restart() {
    configtest || return $?
    stop
    sleep 1
    start
}

reload() {
    configtest || return $?
    echo -n $"Reloading $prog: "
    killproc $nginx -HUP
    RETVAL=$?
    echo
}

force_reload() {
    restart
}

configtest() {
  $nginx -t -c $NGINX_CONF_FILE
}

rh_status() {
    status $prog
}

rh_status_q() {
    rh_status >/dev/null 2>&1
}

case "$1" in
    start)
        rh_status_q && exit 0
        $1
        ;;
    stop)
        rh_status_q || exit 0
        $1
        ;;
    restart|configtest)
        $1
        ;;
    reload)
        rh_status_q || exit 7
        $1
        ;;
    force-reload)
        force_reload
        ;;
    status)
        rh_status
        ;;
    condrestart|try-restart)
        rh_status_q || exit 0
            ;;
    *)
        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload|configtest}"
        exit 2
esac

 saltstack为php提供状态配置

1、安装php的依赖包

2、编译安装php

3、安装PHP插件：pdo_mysql

4、提供php配置文件php-ini

5、提供php-fpm配置文件

6、给php-fpm提供启动脚本、将服务添加到启动项、开启php-fpm服务

1、创建php项目需要的目录

mkdir /srv/salt/prod/php
mkdir /srv/salt/prod/php/files

 2、编译安装php需要用到的文件脚本和源码包

[root@node1 files]# ll
total 14760
-rw-r--r-- 1 root root     2354 Oct 11 20:03 init.d.php-fpm
-rw-r--r-- 1 root root 15011816 Oct 11 19:23 php-5.6.30.tar.bz2
-rw-r--r-- 1 root root    22794 Oct 11 20:05 php-fpm.conf.default
-rw-r--r-- 1 root root    73685 Oct 11 20:01 php.ini-production

 3、编写状态配置文件

3.1编写libmcrypt状态配置

mkdir /srv/salt/prod/libmcrypt
mkdir /srv/salt/prod/libmcrypt/files
[root@node1 files]# ll
total 512
-rw-r--r-- 1 root root 523321 Oct 11 20:13 libmcrypt-2.5.7.tar.gz
[root@node1 files]# pwd
/srv/salt/prod/libmcrypt/files
[root@node1 libmcrypt]# pwd
/srv/salt/prod/libmcrypt
[root@node1 libmcrypt]# tree
.
├── files
│   └── libmcrypt-2.5.7.tar.gz
└── install.sls
[root@node1 libmcrypt]# cat install.sls 
libmcrypt-install:
  file.managed:
    - name: /usr/local/src/libmcrypt-2.5.7.tar.gz
    - source: salt://libmcrypt/files/libmcrypt-2.5.7.tar.gz
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name: cd /usr/local/src/ && tar xf libmcrypt-2.5.7.tar.gz && cd libmcrypt-2.5.7 && ./configure && make && make install
    - unless: test -d /usr/local/src/libmcrypt-2.5.7
    - require:
      - file: /usr/local/src/libmcrypt-2.5.7.tar.gz
5.2编译安装php
[root@node1 php]# cat install.sls 
pkg-php:                                 编写依赖包状态配置
  pkg.installed:
    - names:
      - libxml2
      - libxml2-devel
      - bzip2
      - bzip2-devel
      - libjpeg-turbo
      - libjpeg-turbo-devel
      - libpng
      - libpng-devel
      - freetype
      - freetype-devel
      - zlib
      - zlib-devel
      - libcurl
      - libcurl-devel

php-install:                        php编译安装状态配置
  file.managed:
    - name: /usr/local/src/php-5.6.30.tar.bz2
    - source: salt://php/files/php-5.6.30.tar.bz2
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name: cd /usr/local/src/ && tar xf php-5.6.30.tar.bz2 && cd php-5.6.30 && ./configure --prefix=/usr/local/php --with-pdo-mysql=mysqlnd --with-mysqli=mysqlnd --with-mysql=mysqlnd --with-openssl --enable-mbstring --with-freetype-dir --with-jpeg-dir --with-png-dir --with-mcrypt --with-zlib --with-libxml-dir=/usr --enable-xml  --enable-sockets --enable-fpm --with-config-file-path=/usr/local/php/etc --with-bz2 --with-gd && make && make install
    - unless: test -d /usr/local/php
    - require:
      - pkg: pkg-php                   由于上面安装的依赖于是基于pkg模式
      - file: /usr/local/src/php-5.6.30.tar.bz2

pdo-plugin:                          php插件pdo_mysql状态配置
  cmd.run:
    - name: cd /usr/local/src/php-5.6.30/ext/pdo_mysql && /usr/local/php/bin/phpize && ./configure --with-php-config=/usr/local/php/bin/php-config && make&& make install 
    - unless: test -f /usr/local/php/lib/php/extensions/*/pdo_mysql.so
    - require:
      - file: php-install

php-ini:                                  提供php的php-ini配置文件
  file.managed:
    - name: /usr/local/php/etc/php.ini
    - source: salt://php/files/php.ini-production
    - user: root
    - group: root
    - mode: 644

php-fpm:                                 提供php-fpm的配置文件
  file.managed:
    - name: /usr/local/php/etc/php-fpm.conf
    - source: salt://php/files/php-fpm.conf.default
    - user: root
    - group: root
    - mode: 644

php-service:                           将php-fpm服务添加到系统服务中
  file.managed:
    - name: /etc/init.d/php-fpm
    - source: salt://php/files/init.d.php-fpm
    - user: root
    - group: root
    - mode: 755
  cmd.run:
    - name: chkconfig --add php-fpm
    - unless: chkconfig --list|grep php-fpm
    - require:
      - file: /etc/init.d/php-fpm
  service.running:
    - name: php-fpm
    - enable: True
    - require: 
      - cmd: php-service
    - watch:
      - file: php-ini
      - file: php-fpm

 执行[root@node1 php]# salt 'node1' state.sls php.install saltenv=prod

查看php-fpm：

[root@node1 php]# netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 0.0.0.0:8080                0.0.0.0:*                   LISTEN      122333/nginx        
tcp        0      0 192.168.44.10:80            0.0.0.0:*                   LISTEN      107737/haproxy      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1265/sshd           
tcp        0      0 0.0.0.0:4505                0.0.0.0:*                   LISTEN      42708/python2.7     
tcp        0      0 0.0.0.0:8090                0.0.0.0:*                   LISTEN      107737/haproxy      
tcp        0      0 0.0.0.0:4506                0.0.0.0:*                   LISTEN      42714/python2.7     
tcp        0      0 127.0.0.1:9000              0.0.0.0:*                   LISTEN      117298/php-fpm      
tcp        0      0 :::22                       :::*                        LISTEN      1265/sshd           
udp        0      0 0.0.0.0:68                  0.0.0.0:*                               1092/dhclient

 php项目构建图：

[root@node1 php]# tree
.
├── files
│   ├── init.d.php-fpm
│   ├── php-5.6.30.tar.bz2
│   ├── php-fpm.conf.default
│   └── php.ini-production
└── install.sls

 将nginx和php-fpm结合起来，提供配置文件

mkdir /srv/salt/prod/html
mkdir /srv/salt/prod/html/files
[root@node1 files]# ll
total 8
-rw-r--r-- 1 root root 1034 Oct 11 21:24 fastcgi_params
-rw-r--r-- 1 root root  278 Oct 11 21:10 www.conf
[root@node1 files]# pwd
/srv/salt/prod/html/files
[root@node1 html]# tree
.
├── files
│   ├── fastcgi_params            将nginx和php进行结合
│   └── www.conf                     添加应用配置文件
└── www.sls
[root@node1 html]# cat www.sls 
include:                                 包含了nginx和php的安装
  - php.install
  - nginx.service

nginx-php-conf:
  file.managed:
    - name: /usr/local/nginx/conf/fastcgi_params
    - source: salt://html/files/fastcgi_params
    - user: nginx
    - group: nginx
    - mode: 755

html-www:
  file.managed:
    - name: /usr/local/nginx/conf/vhost/www.conf
    - source: salt://html/files/www.conf
    - user: root
    - group: root
    - mode: 644
    - require: 
      - service: php-service
    - watch_in:
      - service: nginx-service

 提供的fastcgi_params配置文件

[root@node1 html]# cat files/fastcgi_params 

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

 提供的index.php测试文件：

[root@node1 conf]# cat ../html/index.php 
<?php
  phpinfo();
?>

 测试效果：

构建树info如下：

[root@node1 prod]# tree libmcrypt/
libmcrypt/
├── files
│   └── libmcrypt-2.5.7.tar.gz
└── install.sls

[root@node1 prod]# tree nginx/
nginx/
├── files
│   ├── nginx-1.8.1.tar.gz
│   ├── nginx.conf
│   └── nginx.init
├── install.sls
└── service.sls

[root@node1 prod]# tree php/
php/
├── files
│   ├── init.d.php-fpm
│   ├── php-5.6.30.tar.bz2
│   ├── php-fpm.conf.default
│   └── php.ini-production
└── install.sls

[root@node1 prod]# tree html/
html/
├── files
│   ├── fastcgi_params
│   └── www.conf
└── www.sls

 将项目nginx和php和html结合到top.sls文件中：

[root@node1 base]# cat top.sls 
base:
  '*':
    - init.env_init

prod:
  '*':
    - cluster.haproxy-outside
    - cluster.haproxy-outside-keepalived
    - html.www                     该项目包含了nginx和php的安装