Установка NGINX и NGINX Plus с помощью Chef

Загрузка и настройка поваренной книги NGINX

Теперь мы устанавливаем и настраиваем кулинарную книгу NGINX на нашем сервере Chef.

1. Измените каталог на каталог детской площадки внутри репозитория, который мы клонировали как ~ / chef-zero в предыдущем разделе. Это позволяет knifeкомандам найти конфигурационный файл knife.rb , который находится в подкаталоге ~ / chef-zero / plays / /chef .

   ~$ cd chef-zero/playground/

2. Загрузите поваренную книгу и ее требования к вашей локальной системе. (Термин installв командной строке вводит в заблуждение, потому что команда фактически не устанавливает NGINX или что-либо еще; вместо этого она просто загружает файлы.)

   ~/chef-zero/playground$ knife cookbook site install nginx
   Installing nginx to /home/username/chef-zero/playground/cookbooks
   Checking out the master branch.
   Creating pristine copy branch chef-vendor-nginx
   Downloading nginx from the cookbooks site at version 2.7.6 to /home/username/chef-zero/playground/cookbooks/nginx.tar.gz
   ...
   Cookbook yum version 3.8.1 successfully installed

3. По какой-то причине knife cookbookкоманда, которую мы выполняли на предыдущем шаге, загружает версии поваренной книги, для которых несовместимы rsyslog. Если мы не исправим это, несовместимость вызовет следующую ошибку позже, когда мы загрузим поваренные книги на шаге 4:

        # DO NOT RUN NOW: example to show error
        ~/chef-zero/playground/cookbooks$ knife cookbook upload *
        Uploading apache2      [1.0.0]
        Uploading apt          [2.9.2]
        Uploading bluepill     [2.4.1]
        ERROR: Cookbook bluepill depends on cookbooks which are not currently
        ERROR: being uploaded and cannot be found on the server.
        ERROR: The missing cookbook(s) are: 'rsyslog' version '~> 2.0'

   Чтобы избежать ошибки, выполните эту команду, чтобы получить более раннюю версию rsyslogповаренной книги:

   ~/chef-zero/playground$ cd cookbooks
   ~/chef-zero/playground/cookbooks$ knife cookbook site install rsyslog 2.0.0
   Installing rsyslog to /home/username/chef-zero/playground/cookbooks
   Checking out the master branch.
   Pristine copy branch (chef-vendor-rsyslog) exists, switching to it.
   ...
   Cookbook rsyslog version 2.0.0 successfully installed

4. Создайте новый файл рецепта для установки NGINX Plus на основе существующего рецепта в кулинарной книге NGINX для установки программного обеспечения NGINX с открытым исходным кодом из готового двоичного файла package.rb . После того, как мы внесем несколько изменений в кулинарную книгу NGINX, мы загрузим ее на сервер Chef. Новый рецепт, plus_package.rb , создает все необходимые сертификаты и aptрепозитории, необходимые для доступа к пакету NGINX Plus. Создайте файл plus_package.rb в каталоге ~ / chef-zero / playground / cookbooks / nginx / recipes с этим содержимым :

   #
   # Cookbook Name:: nginx
   # Recipe:: plus_package
   # Author:: Damian Curry <[email protected]>
   #
   # Copyright 2008-2013, Chef Software, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #     http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #

   include_recipe ‘nginx::ohai_plugin’

   directory ‘/etc/ssl/nginx’ do
   owner ‘root’
   group ‘root’
   mode ‘0755’
   action :create
   end

   file ‘/etc/ssl/nginx/nginx-repo.key’ do
   owner ‘root’
   group ‘root’
   mode ‘0644’
   content node.attribute[‘nginx’][‘nginx_repo_key’]
   end

   file ‘/etc/ssl/nginx/nginx-repo.crt’ do
   owner ‘root’
   group ‘root’
   mode ‘0644’
   content node.attribute[‘nginx’][‘nginx_repo_crt’]
   end

   remote_file ‘/etc/ssl/nginx/CA.crt’ do
   source ‘https://cs.nginx.com/static/files/CA.crt’
   owner ‘root’
   group ‘root’
   mode ‘0644’
   end

   remote_file ‘/etc/apt/apt.conf.d/90nginx’ do
   source ‘https://cs.nginx.com/static/files/90nginx’
   owner ‘root’
   group ‘root’
   mode ‘0644’
   end

   #this is currently set up only for ubuntu; rhel to follow
   if platform_family?(‘debian’)
   include_recipe ‘apt::default’

   apt_repository ‘nginx_plus’ do
   uri ‘https://plus-pkgs.nginx.com/ubuntu’
   distribution node[‘lsb’][‘codename’]
   components %w(nginx-plus)
   deb_src false
   key ‘http://nginx.org/keys/nginx_signing.key’
   end
   end

   package node[‘nginx’][‘package_name’] do
   notifies :reload, ‘ohai[reload_nginx]’, :immediately
   not_if ‘which nginx’
   end

   directory node[‘nginx’][‘dir’] do
   owner ‘root’
   group node[‘root_group’]
   mode ‘0755’
   recursive true
   end

   directory node[‘nginx’][‘log_dir’] do
   mode node[‘nginx’][‘log_dir_perm’]
   owner node[‘nginx’][‘user’]
   action :create
   recursive true
   end

   directory File.dirname(node[‘nginx’][‘pid’]) do
   owner ‘root’
   group node[‘root_group’]
   mode ‘0755’
   recursive true
   end

   directory «#{node[‘nginx’][‘dir’]}/conf.d» do
   owner ‘root’
   group node[‘root_group’]
   mode ‘0755’
   end

   service ‘nginx’ do
   supports :status => true, :restart => true, :reload => true
   action :enable
   end

   include_recipe ‘nginx::commons_script’

   template ‘nginx.conf’ do
   path «#{node[‘nginx’][‘dir’]}/nginx.conf»
   source node[‘nginx’][‘conf_template’]
   cookbook node[‘nginx’][‘conf_cookbook’]
   owner ‘root’
   group node[‘root_group’]
   mode ‘0644’
   notifies :reload, ‘service[nginx]’, :delayed
   end

   if node[‘nginx’][‘default_site_enabled’] == ‘true’
   template «#{node[‘nginx’][‘dir’]}/conf.d/default.conf» do
   source ‘default-site.erb’
   owner ‘root’
   group node[‘root_group’]
   mode ‘0644’
   notifies :reload, ‘service[nginx]’, :delayed
   end
   else
   file «#{node[‘nginx’][‘dir’]}/conf.d/default.conf» do
   action :delete
   end
   end

   if node[‘nginx’][‘plus_status_enable’] == ‘true’
   template ‘nginx_plus_status’ do
   path «#{node[‘nginx’][‘dir’]}/conf.d/nginx_plus_status.conf»
   source ‘nginx_plus_status.erb’
   owner ‘root’
   group node[‘root_group’]
   mode ‘0644’
   notifies :reload, ‘service[nginx]’, :delayed
   end
   end

5. Создайте файл шаблона nginx_plus_status.erb , на который ссылается последний раздел рецепта plus_package.rb . Поместите его в каталог ~ / chef-zero / Playground / Cookbooks / nginx / templates / default с таким содержимым:

   upstream example {
       zone example 64k;
       server [::1]:8080;
   }
   server {
       listen <%= node['nginx']['plus_status_port'] -%>;
       status_zone status-page;
       access_log  <%= node['nginx']['log_dir'] %>/status.access.log;
       location = /status.html {
           root /usr/share/nginx/html;
       }
       location = / {
           return 301 /status.html;
       }
       location /status {
           status;
           status_format json;
           access_log off;
       }
       location /upstream_conf {
           upstream_conf;
       }
   }

6. Создайте роль для использования при установке NGINX Plus. Роли в Chef состоят из четырех основных списков:
   
   • attributes to one or both of the default_attributes and override_attributes lists on each individual node.

     Create the nginx_plus.rb role definition file with these contents and place it in the ~/chef-zero/playground/roles directory:

     name "nginx_plus"
     description "An example role to install NGINX Plus"
     run_list "recipe[nginx]"
     default_attributes "nginx" => { "install_method" => "plus_package",
                                     "package_name" => "nginx-plus",
                                     "init_style" => "init",
                                     "default_site_enabled" => "true",
                                     "nginx_repo_key" => "‑‑‑‑‑BEGIN PRIVATE KEY‑‑‑‑‑\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCbYwum24BwEY8Y\nnqc0  ...  +BCnoMSzbvLWhZbpSrdmD9nOj1KkPcW\n4ArSv6prlYItUwWbNtFLw/E=\n‑‑‑‑‑END PRIVATE KEY‑‑‑‑‑",
                                     "nginx_repo_crt" => "‑‑‑‑‑BEGIN CERTIFICATE‑‑‑‑‑\nMIIDrDCCApSgAwIBAgICBs8wDQYJKoZIhvcNAQEFBQAwXjELMAkGA1UEBhGTg  ...  X2X\nbovinLlYPfdi7BhlXTI9u78+tqbo0YVsSBiDV49hcIA=\n‑‑‑‑‑END CERTIFICATE‑‑‑‑‑" }

     You will notice that I have added the contents of the nginx-repo.key and nginx-repo.crt files as the values of the nginx_repo_key and nginx_repo_crt attributes. If you use the example as the basis for your nginx_plus.rb file, replace the values in the example with the key and certificate for your NGINX Plus subscription or trial. I prefer recording the key and certificate in attributes this way instead of recording them in files inside of the cookbook, because it makes things more portable, but you can use either method.

     It is also possible to define the run_list and default_attributes for an individual host or an environment, inside either the node or environment definition, but I prefer to define them in a role. Then you can apply the role to any node where you want to install NGINX Plus, followed by another recipe that configures NGINX Plus for the specific function the node is to perform.

     Notes:

     • You must define the init_style attribute as init, because its default value of runit does not work with NGINX Plus.
     • When you copy in the key and certificate from your Subscriptions page at the NGINX Plus customer portal, each one is a block of about 20 lines of text with a hard linebreak at the end of each line. For Chef to parse the key and certificate properly, you must convert each one to a single line by replacing every hard linebreak with the linebreak character, \n (backslash-n). For brevity, the example shows the converted form of only the first and last couple lines from the original blocks.

user www-data;
worker_processes  1;

name "nginx_plus"
description "An example role to install NGINX Plus"
run_list "recipe[nginx]"
default_attributes "nginx" => { "install_method" => "plus_package",
                                "package_name" => "nginx-plus",
                                "init_style" => "init",
                                "default_site_enabled" => "false",
                                "worker_processes" => "auto",
                                "user" => "nginx",
                                "gzip" => "off",
                                "plus_status_enable" => "true",
                                "plus_status_port" => "8080",
                                "nginx_repo_key" => "‑‑‑‑‑BEGIN PRIVATE KEY‑‑‑‑‑\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCbYwum24BwEY8Y\nnqc0  ...  +BCnoMSzbvLWhZbpSrdmD9nOj1KkPcW\n4ArSv6prlYItUwWbNtFLw/E=\n‑‑‑‑‑END PRIVATE KEY‑‑‑‑‑",
                                "nginx_repo_crt" => "‑‑‑‑‑BEGIN CERTIFICATE‑‑‑‑‑\nMIIDrDCCApSgAwIBAgICBs8wDQYJKoZIhvcNAQEFBQAwXjELMAkGA1UEBhGTg  ...  X2X\nbovinLlYPfdi7BhlXTI9u78+tqbo0YVsSBiDV49hcIA=\n‑‑‑‑‑END CERTIFICATE‑‑‑‑‑" }

~/chef-zero/playground$ knife role from file roles/nginx_plus.rb
Updated Role nginx_plus!

10.100.10.1 - - [11/Dec/2015:17:31:22 -0800] "GET / HTTP/1.1" 301 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.80 Safari/537.36"
200 NONE/[email protected] GET / HTTP/1.1 / 1711 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /vendor.css HTTP/1.1 / 127994 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /dockerui.css HTTP/1.1 / 1352 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /angular.js HTTP/1.1 / 209191 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /dockerui.js HTTP/1.1 / 96665 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /vendor.js HTTP/1.1 / 652438 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /dockerapi/version HTTP/1.1 / 345 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /dockerapi/containers/json?all=1 HTTP/1.1 / 564 bytes  ->10.100.100.23:8970
200 NONE/[email protected] GET /dockerapi/images/json?all=0 HTTP/1.1 / 431 bytes  ->10.100.100.23:8970

log_format main "$status $ssl_client_verify/$remote_user@$remote_addr $request / $bytes_sent bytes  ->$upstream_addr";