Skip to content

Commit d53b9ce

Browse files
drybjeddrybjed
committed
Added 'mysql' role
This role sets up mysql service. Several variables in defaults/main.yml allow for customization of mysqld options, there's also support for random root passwords using lookup function if "$secret" variable is defined in playbook or inventory.
1 parent 1b2401a commit d53b9ce

12 files changed

Lines changed: 317 additions & 0 deletions

File tree

‎playbooks/mysql.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
3+
- name: MySQL support
4+
hosts: aiua_mysql
5+
sudo: yes
6+
tags: mysql
7+
8+
roles:
9+
- { role: mysql }
10+

‎playbooks/roles/mysql/defaults/main.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
3+
mysql_utf8: True
4+
5+
# If 'secret' variable is undefined, this variable will be used to set password
6+
mysql_root_password: 'password'
7+
8+
mysql_backup_mailaddr: 'root'
9+
mysql_backup_doweekly: 6
10+
mysql_backup_latest: 'no'
11+
12+
mysql_mysqld_bind_address: '127.0.0.1'
13+
mysql_mysqld_port: 3306
14+
mysql_mysqld_max_connections: 100
15+
16+
# Use this variable to set additional mysqld options
17+
#mysql_mysqld_options:
18+
# key_buffer: '16M'
19+
# skip-name-resolve:
20+
21+
# This is a list of networks allowed to connect to mysqld from remote hosts
22+
# It will be applied in firewall (ferm) and /etc/hosts.allow (tcpwrappers)
23+
# Also you need to set mysql_mysqld_bind_address to 0.0.0.0
24+
#mysql_network_allow_list:
25+
# - '10.0.0.0/8'
26+
# - '172.16.0.0/12'
27+
# - '192.168.0.0/16'
28+
29+

‎playbooks/roles/mysql/handlers/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
3+
- name: Restart mysql
4+
service: name=mysql state=restarted
5+
6+
- name: Reload mysql
7+
service: name=mysql state=reloaded
8+

‎playbooks/roles/mysql/meta/main.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
3+
dependencies:
4+
- { role: ferm }
5+
- { role: tcpwrappers }
6+

‎playbooks/roles/mysql/tasks/main.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
3+
- name: MYSQL | Install MySQL-related packages
4+
apt: pkg={{ item }} state=latest install_recommends=no
5+
with_items:
6+
- python-mysqldb
7+
- mysql-server
8+
- automysqlbackup
9+
tags:
10+
- mysql
11+
- packages
12+
13+
- name: MYSQL | Apply mysqld configuration
14+
template: src=etc/mysql/conf.d/mysqld.cnf.j2 dest=/etc/mysql/conf.d/mysqld.cnf owner=root group=root mode=0644
15+
notify:
16+
- Reload mysql
17+
tags:
18+
- mysql
19+
20+
- name: MYSQL | Apply client configuration
21+
template: src=etc/mysql/conf.d/client.cnf.j2 dest=/etc/mysql/conf.d/client.cnf owner=root group=root mode=0644
22+
notify:
23+
- Reload mysql
24+
tags:
25+
- mysql
26+
27+
- name: MYSQL | Start the MySQL service
28+
service: name=mysql state=started
29+
tags:
30+
- mysql
31+
32+
- name: MYSQL | Lookup mysql root password if $secret is defined
33+
set_fact:
34+
mysql_root_password: "{{ lookup('password', secret + '/credentials/' + ansible_fqdn + '/mysql/root/password length=15') }}"
35+
when: secret is defined
36+
tags:
37+
- mysql
38+
- secret
39+
40+
- name: MYSQL | Update mysql root password for all root accounts
41+
mysql_user: name=root host={{ item }} password={{ mysql_root_password }}
42+
with_items:
43+
- '{{ ansible_hostname }}'
44+
- 127.0.0.1
45+
- ::1
46+
- localhost
47+
tags:
48+
- mysql
49+
- secret
50+
51+
- name: MYSQL | Copy .my.cnf file with root password credentials
52+
template: src=root/my.cnf.j2 dest=/root/.my.cnf owner=root group=root mode=0600
53+
tags:
54+
- mysql
55+
- secret
56+
57+
- name: MYSQL | Delete anonymous users
58+
mysql_user: user="" host={{ item }} state=absent
59+
with_items:
60+
- '{{ ansible_hostname }}'
61+
- 'localhost'
62+
tags:
63+
- mysql
64+
65+
- name: MYSQL | Remove the test database
66+
mysql_db: db=test state=absent
67+
tags:
68+
- mysql
69+
70+
- name: MYSQL | Setup automysqlbackup configuration
71+
template: src=etc/default/automysqlbackup.j2 dest=/etc/default/automysqlbackup owner=root group=root mode=0644
72+
tags:
73+
- mysql
74+
75+
- name: MYSQL | Enable network access in firewall
76+
template: src=etc/ferm/ferm.d/mysql.conf.j2 dest=/etc/ferm/ferm.d/mysql.conf owner=root group=root mode=0644
77+
when: mysql_network_allow_list is defined and mysql_network_allow_list is not none
78+
notify:
79+
- Restart ferm
80+
tags:
81+
- mysql
82+
- firewall
83+
84+
- name: MYSQL | Disable network access in firewall
85+
file: path=/etc/ferm/ferm.d/mysql.conf state=absent
86+
when: mysql_network_allow_list is not defined
87+
notify:
88+
- Restart ferm
89+
tags:
90+
- mysql
91+
- firewall
92+
93+
- name: MYSQL | Enable network access in tcpwrappers
94+
template: src=etc/hosts.allow.d/50_mysql.j2 dest=/etc/hosts.allow.d/50_mysql owner=root group=root mode=0644
95+
when: mysql_network_allow_list is defined and mysql_network_allow_list is not none
96+
notify:
97+
- Assemble hosts.allow.d
98+
tags:
99+
- mysql
100+
- tcpwrappers
101+
102+
- name: MYSQL | Disable network access in tcpwrappers
103+
file: path=/etc/hosts.allow.d/50_mysql state=absent
104+
when: mysql_network_allow_list is not defined
105+
notify:
106+
- Assemble hosts.allow.d
107+
tags:
108+
- mysql
109+
- tcpwrappers
110+
111+

‎playbooks/roles/mysql/templates/etc/default/automysqlbackup.j2‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# {{ ansible_managed }}
2+
3+
# By default, the Debian version of automysqlbackup will use:
4+
# mysqldump --defaults-file=/etc/mysql/debian.cnf
5+
# but you might want to overwrite with a specific user & pass.
6+
# To do this, simply edit bellow.
7+
8+
# Username to access the MySQL server e.g. dbuser
9+
#USERNAME=`grep user /etc/mysql/debian.cnf | tail -n 1 | cut -d"=" -f2 | awk '{print $1}'`
10+
11+
# Username to access the MySQL server e.g. password
12+
#PASSWORD=`grep password /etc/mysql/debian.cnf | tail -n 1 | cut -d"=" -f2 | awk '{print $1}'`
13+
14+
# Host name (or IP address) of MySQL server e.g localhost
15+
DBHOST=localhost
16+
17+
# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3"
18+
# Note that it's absolutely normal that the db named "mysql" is not in this
19+
# list, as it's added later by the script. See the MDBNAMES directives below
20+
# in this file (advanced options).
21+
# This is ONLY a convenient default, if you don't like it, don't complain
22+
# and write your own.
23+
# The following is a quick hack that will find the names of the databases by
24+
# reading the mysql folder content. Feel free to replace by something else.
25+
# DBNAMES=`find /var/lib/mysql -mindepth 1 -maxdepth 1 -type d | cut -d'/' -f5 | grep -v ^mysql\$ | tr \\\r\\\n ,\ `
26+
# This one does a list of dbs using a MySQL statement.
27+
DBNAMES=`mysql --defaults-file=/etc/mysql/debian.cnf --execute="SHOW DATABASES" | awk '{print $1}' | grep -v ^Database$ | grep -v ^mysql$ | grep -v ^performance_schema$ | grep -v ^information_schema$ | tr \\\r\\\n ,\ `
28+
29+
# Backup directory location e.g /backups
30+
# Folders inside this one will be created (daily, weekly, etc.), and the
31+
# subfolders will be database names. Note that backups will be owned by
32+
# root, with Unix rights 0600.
33+
BACKUPDIR="/var/lib/automysqlbackup"
34+
35+
# Mail setup
36+
# What would you like to be mailed to you?
37+
# - log : send only log file
38+
# - files : send log file and sql files as attachments (see docs)
39+
# - stdout : will simply output the log to the screen if run manually.
40+
# - quiet : Only send logs if an error occurs to the MAILADDR.
41+
MAILCONTENT="quiet"
42+
43+
# Set the maximum allowed email size in k. (4000 = approx 5MB email [see
44+
# docs])
45+
MAXATTSIZE="4000"
46+
47+
# Email Address to send mail to? (user@domain.com)
48+
MAILADDR="{{ mysql_backup_mailaddr }}"
49+
50+
# ============================================================
51+
# === ADVANCED OPTIONS ( Read the doc's below for details )===
52+
#=============================================================
53+
54+
# List of DBBNAMES for Monthly Backups.
55+
MDBNAMES="mysql $DBNAMES"
56+
57+
# List of DBNAMES to EXLUCDE if DBNAMES are set to all (must be in " quotes)
58+
DBEXCLUDE=""
59+
60+
# Include CREATE DATABASE in backup?
61+
CREATE_DATABASE=yes
62+
63+
# Separate backup directory and file for each DB? (yes or no)
64+
SEPDIR=yes
65+
66+
# Which day do you want weekly backups? (1 to 7 where 1 is Monday)
67+
DOWEEKLY={{ mysql_backup_doweekly }}
68+
69+
# Choose Compression type. (gzip or bzip2)
70+
COMP=gzip
71+
72+
# Compress communications between backup server and MySQL server?
73+
COMMCOMP=no
74+
75+
# Additionally keep a copy of the most recent backup in a seperate
76+
# directory.
77+
LATEST={{ mysql_backup_latest }}
78+
79+
# The maximum size of the buffer for client/server communication. e.g. 16MB
80+
# (maximum is 1GB)
81+
MAX_ALLOWED_PACKET=
82+
83+
# For connections to localhost. Sometimes the Unix socket file must be
84+
# specified.
85+
SOCKET=
86+
87+
# Command to run before backups (uncomment to use)
88+
#PREBACKUP="/etc/mysql-backup-pre"
89+
90+
# Command run after backups (uncomment to use)
91+
#POSTBACKUP="/etc/mysql-backup-post"
92+
93+
# Backup of stored procedures and routines (comment to remove)
94+
ROUTINES=yes
95+
96+

‎playbooks/roles/mysql/templates/etc/ferm/ferm.d/mysql.conf.j2‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# iptables ferm firewall - mysql access
2+
# {{ ansible_managed }}
3+
4+
table filter {
5+
chain INPUT {
6+
protocol tcp dport {{ mysql_mysqld_port }} {
7+
{% for network in mysql_network_allow_list %}
8+
saddr {{ network }} ACCEPT;
9+
{% endfor %}
10+
}
11+
}
12+
}
13+
14+

‎playbooks/roles/mysql/templates/etc/hosts.allow.d/50_mysql.j2‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Allow mysqld connections
2+
{% for network in mysql_network_allow_list %}
3+
mysqld: {{ network }}
4+
{% endfor %}
5+
6+

‎playbooks/roles/mysql/templates/etc/mysql/conf.d/client.cnf.j2‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# {{ ansible_managed }}
2+
3+
[client]
4+
5+
{% if mysql_utf8 is defined and mysql_utf8 == True %}
6+
default-character-set = utf8
7+
{% endif %}
8+
9+

‎playbooks/roles/mysql/templates/etc/mysql/conf.d/mysqld.cnf.j2‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# {{ ansible_managed }}
2+
3+
[mysqld]
4+
bind-address = {{ mysql_mysqld_bind_address }}
5+
port = {{ mysql_mysqld_port }}
6+
max-connections = {{ mysql_mysqld_max_connections }}
7+
8+
{% if mysql_utf8 is defined and mysql_utf8 == True %}
9+
character-set-server = utf8
10+
collation-server = utf8_general_ci
11+
init-connect = 'SET NAMES utf8'
12+
13+
{% endif %}
14+
{% if mysql_mysqld_options is defined and mysql_mysqld_options is not none %}
15+
{% for key, value in mysql_mysqld_options.iteritems() %}
16+
{{ key }}{% if value is not none %} = {{ value }}{% endif %}
17+
18+
{% endfor %}
19+
20+
{% endif %}

0 commit comments

Comments
 (0)