Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Deploying PHP applications with Ansible, Ansibl...

Deploying PHP applications with Ansible, Ansible Vault and Ansistrano

Oliver Davies

April 23, 2021
Tweet

More Decks by Oliver Davies

Other Decks in Technology

Transcript

  1. Things we'll be looking at • Ansible crash course •

    Keeping secrets with Ansible Vault • Deployments with Ansistrano @opdavies
  2. What is Ansible? Ansible is an open-source software provisioning, configuration

    management, and application-deployment tool. https://en.wikipedia.org/wiki/Ansible_(software) @opdavies
  3. What is Ansible? • CLI tool • Configured with YAML

    • Agentless, connects via SSH • Jinja2 for templating • Executes ad-hoc remote commands • Installs software packages • Performs deployment steps • Batteries included @opdavies
  4. Why Ansible? • Familiar syntax (Drupal 8, Symfony, Sculpin) •

    Easily readable • No server dependencies • Easy to add to an existing project • Includes relevant modules (Git, Composer) • Idempotency, resulting in cleaner scripts @opdavies
  5. --- - hosts: webservers vars: git_repo: https://github.com/opdavies/dransible project_root_dir: /app tasks:

    - name: Update the code git: repo: '{{ git_repo }}' dest: '{{ project_root_dir }}' @opdavies
  6. requirements.yml --- - src: geerlingguy.apache - src: geerlingguy.composer - src:

    geerlingguy.mysql - src: geerlingguy.php - src: geerlingguy.php-mysql @opdavies
  7. # playbook.yml --- - hosts: webservers roles: - geerlingguy.apache -

    geerlingguy.mysql - geerlingguy.php - geerlingguy.php-mysql - geerlingguy.composer @opdavies
  8. # playbook.yml --- vars: mysql_databases: - name: main mysql_users: -

    name: user password: secret priv: main.*:ALL @opdavies
  9. PLAY [Provision the webserver machines] ******************************************************************************** TASK [Gathering Facts] *************************************************************************************************

    ok: [webservers] TASK [geerlingguy.apache : Include OS-specific variables.] ************************************************************* ok: [webservers] TASK [geerlingguy.apache : Include variables for Amazon Linux.] skipping: [webservers] TASK [geerlingguy.apache : Define apache_packages.] ******************************************************************** ok: [webservers] TASK [geerlingguy.apache : include_tasks] ****************************************************************************** included: /Users/opdavies/.ansible/roles/geerlingguy.apache/tasks/setup-Debian.yml for webservers TASK [geerlingguy.apache : Update apt cache.] ************************************************************************** changed: [webservers] @opdavies
  10. TASK [geerlingguy.composer : Ensure composer directory exists.] ******************************************************** ok: [webservers]

    TASK [geerlingguy.composer : include_tasks] **************************************************************************** skipping: [webservers] TASK [geerlingguy.composer : include_tasks] **************************************************************************** skipping: [webservers] RUNNING HANDLER [geerlingguy.apache : restart apache] ****************************************************************** changed: [webservers] RUNNING HANDLER [geerlingguy.mysql : restart mysql] ******************************************************************** changed: [webservers] RUNNING HANDLER [geerlingguy.php : restart webserver] ****************************************************************** changed: [webservers] RUNNING HANDLER [geerlingguy.php : restart php-fpm] ******************************************************************** skipping: [webservers] PLAY RECAP ************************************************************************************************************* webservers : ok=111 changed=32 unreachable=0 failed=0 skipped=78 rescued=0 ignored=0 @opdavies
  11. # deploy.yml --- tasks: - name: Creating project directory file:

    path: /app state: directory - name: Uploading application synchronize: src: '{{ playbook_dir }}/../' dest: /app @opdavies
  12. Disadvantages • Sensitive data stored in plain text • Single

    point of failure • No ability to roll back @opdavies
  13. --- vars: mysql_databases: - name: main mysql_users: - name: user

    password: secret priv: main.*:ALL @opdavies
  14. # provision.yml --- vars_files: - vars/provision_vault.yml - vars/provision_vars.yml vars: mysql_databases:

    - '{{ database_name }}' mysql_users: - name: '{{ database_user }}' password: '{{ database_password }}' priv: '{{ database_name }}.*:ALL' @opdavies
  15. Features • Multiple release directories • Shared paths and files

    • Customisable • Multiple deployment strategies • Multi-stage environments • Prune old releases • Rollbacks @opdavies
  16. # deploy.yml --- vars: project_deploy_dir: /app ansistrano_deploy_to: '{{ project_deploy_dir }}'

    ansistrano_deploy_via: git ansistrano_git_branch: master ansistrano_git_repo: '[email protected]:opdavies/dransible' @opdavies
  17. PLAY [webservers] ****************************************************************************************************** TASK [Gathering Facts] ************************************************************************************************* ok: [webservers] TASK

    [ansistrano.deploy : include_tasks] ******************************************************************************* TASK [ansistrano.deploy : include_tasks] ******************************************************************************* included: /Users/opdavies/.ansible/roles/ansistrano.deploy/tasks/setup.yml for webservers TASK [ansistrano.deploy : ANSISTRANO | Ensure deployment base path exists] ********************************************* ok: [webservers] TASK [ansistrano.deploy : ANSISTRANO | Ensure releases folder exists] ************************************************** ok: [webservers] TASK [ansistrano.deploy : ANSISTRANO | Ensure shared elements folder exists] ******************************************* ok: [webservers] TASK [ansistrano.deploy : ANSISTRANO | Ensure shared paths exists] ***************************************************** ok: [webservers] => (item=web/sites/default/files) @opdavies
  18. TASK [ansistrano.deploy : Update file permissions] ********************************************************************* changed: [webservers] TASK

    [ansistrano.deploy : include_tasks] ******************************************************************************* TASK [ansistrano.deploy : include_tasks] ******************************************************************************* included: /Users/opdavies/.ansible/roles/ansistrano.deploy/tasks/cleanup.yml for webservers TASK [ansistrano.deploy : ANSISTRANO | Clean up releases] ************************************************************** changed: [webservers] TASK [ansistrano.deploy : include_tasks] ******************************************************************************* TASK [ansistrano.deploy : include_tasks] ******************************************************************************* included: /Users/opdavies/.ansible/roles/ansistrano.deploy/tasks/anon-stats.yml for webservers TASK [ansistrano.deploy : ANSISTRANO | Send anonymous stats] *********************************************************** skipping: [webservers] PLAY RECAP ************************************************************************************************************* webservers : ok=33 changed=14 unreachable=0 failed=0 skipped=7 rescued=0 ignored=0 @opdavies
  19. vagrant@dransible:/app$ ls -l total 8 lrwxrwxrwx 1 26 Jul 19

    00:15 current -> ./releases/20190719001241Z drwxr-xr-x 5 4096 Jul 22 20:30 releases drwxr-xr-x 4 4096 Jul 19 00:00 shared @opdavies
  20. vagrant@dransible:/app/releases$ ls -l total 20 drwxr-xr-x 5 4096 Jul 22

    20:30 . drwxr-xr-x 4 4096 Jul 19 00:15 .. drwxr-xr-x 10 4096 Jul 19 00:02 20190719000013Z drwxr-xr-x 10 4096 Jul 19 00:14 20190719001241Z drwxr-xr-x 9 4096 Jul 22 20:30 20190722203038Z @opdavies
  21. # rollback.yml --- - hosts: all roles: - ansistrano.rollback vars:

    ansistrano_deploy_to: '{{ project_deploy_dir }}' @opdavies
  22. # deploy.yml --- vars: ansistrano_after_symlink_shared_tasks_file: > '{{ playbook_dir }}/deploy/after-symlink-shared.yml' ansistrano_after_symlink_tasks_file:

    > '{{ playbook_dir }}/deploy/after-symlink.yml' ansistrano_after_update_code_tasks_file: > '{{ playbook_dir }}/deploy/after-update-code.yml' release_web_path: '{{ ansistrano_release_path.stdout }}/web' release_drush_path: '{{ ansistrano_release_path.stdout }}/bin/drush' @opdavies
  23. # deploy/after-update-code.yml --- - name: Install Composer dependencies composer: command:

    install working_dir: '{{ ansistrano_release_path.stdout }}' @opdavies
  24. # deploy/after-symlink-shared.yml --- - name: Run database updates command: >

    {{ release_drush_path }} --root {{ release_web_path }} updatedb @opdavies
  25. # deploy/after-symlink.yml --- - name: Rebuild Drupal cache command: >

    {{ release_drush_path }} --root {{ release_web_path }} cache-rebuild @opdavies
  26. # deploy_vars.yml --- drupal_settings: - drupal_root: /app/web sites: - name:

    default settings: databases: default: default: driver: mysql host: localhost database: '{{ database_name }}' username: '{{ database_user }}' password: '{{ database_password }}' hash_salt: '{{ hash_salt }}' config_directories: sync: ../config/sync @opdavies
  27. {# templates/settings.php.j2 #} {% for key, values in item.1.settings.databases.items() %}

    {% for target, values in values.items() %} $databases['{{ key }}']['{{ target }}'] = array( 'driver' => '{{ values.driver|default('mysql') }}', 'host' => '{{ values.host|default('localhost') }}', 'database' => '{{ values.database }}', 'username' => '{{ values.username }}', 'password' => '{{ values.password }}', ); {% endfor %} {% endfor %} {% if item.1.settings.base_url is defined %} $base_url = '{{ item.1.settings.base_url }}'; {% endif %} @opdavies
  28. # tasks/main.yml --- - name: Ensure directory exists file: state:

    directory path: '{{ item.0.drupal_root }}/sites/{{ item.1.name|default("default") }}' with_subelements: - '{{ drupal_settings }}' - sites no_log: true - name: Create settings files template: src: settings.php.j2 dest: '{{ item.0.drupal_root }}/sites/{{ item.1.name|default("default") }}/{{ item.1.filename|default("settings.php") }}' @opdavies
  29. # vars.yml --- vars: mysql_databases: - name: production - name:

    staging mysql_users: - name: production password: '{{ live_db_password }}' priv: '{{ live_db_name }}.*:ALL' - name: staging password: '{{ staging_db_password }}' priv: staging.*:ALL @opdavies
  30. # hosts.yml --- production: children: hosts: webservers: ansible_ssh_host: 192.168.33.10 ansible_ssh_port:

    22 project_deploy_path: /app git_branch: production drupal_hash_salt: '{{ vault_drupal_hash_salt }}' drupal_install: false drupal_settings: # ... @opdavies
  31. # hosts.yml --- staging: children: hosts: webservers: ansible_ssh_host: 192.168.33.10 ansible_ssh_port:

    22 project_deploy_path: /app-staging git_branch: staging drupal_hash_salt: '{{ vault_drupal_hash_salt }}' drupal_install: true drupal_settings: # ... @opdavies