基于腾讯云CVM + Ansible的自动化运维与监控体系搭建实战

# terraform/main.tf
terraform {
  required_providers {
    tencentcloud = {
      source = "tencentcloudstack/tencentcloud"
      version = "~> 1.81"
    }
  }
}

provider "tencentcloud" {
  secret_id  = var.secret_id
  secret_key = var.secret_key
  region     = "ap-shanghai"
}

# 创建VPC及子网（若已存在可忽略）
resource "tencentcloud_vpc" "main" {
  name         = "devops-vpc"
  cidr_block   = "10.0.0.0/16"
}

resource "tencentcloud_subnet" "subnet" {
  vpc_id            = tencentcloud_vpc.main.id
  name              = "devops-subnet"
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-shanghai-2"
}

# 创建Web节点（使用课程推荐CentOS 7.9镜像）
resource "tencentcloud_instance" "web" {
  count             = 2
  instance_name     = "web-node-${count.index}"
  availability_zone = "ap-shanghai-2"
  image_id          = "img-eb30mz89"  # CentOS 7.9 64位
  instance_type     = "S5.MEDIUM4"
  system_disk_type  = "CLOUD_PREMIUM"
  system_disk_size  = 50
  vpc_id            = tencentcloud_vpc.main.id
  subnet_id         = tencentcloud_subnet.subnet.id
  security_groups   = [tencentcloud_security_group.sg.id]
  password          = var.instance_password
  internet_max_bandwidth_out = 5
  count              = 2
}

ansible/
├── production
│   └── hosts             # 主机清单（按组分）
├── group_vars/
│   ├── web.yml
│   ├── db.yml
│   └── monitor.yml
└── roles/
    ├── common/           # 基础优化（关闭SELinux、配置yum源、安装常用工具）
    ├── nginx/            # Nginx编译安装 + 配置
    ├── php/              # PHP-FPM 8.2 安装与扩展
    ├── mysql/            # MySQL 8.0 安装 + 主从复制配置
    ├── prometheus/       # Prometheus + node_exporter 部署
    └── filebeat/         # 日志采集至COS（或ELK）

# roles/common/tasks/main.yml
- name: 关闭防火墙和SELinux（课程惯例）
  systemd: name=firewalld state=stopped enabled=no
  ignore_errors: yes

- name: 禁用SELinux
  selinux: state=disabled

- name: 配置腾讯云内网yum源（加速）
  get_url:
    url: http://mirrors.tencentyun.com/repo/centos7_base.repo
    dest: /etc/yum.repos.d/CentOS-Base.repo

- name: 安装必备工具
  yum:
    name:
      - vim
      - net-tools
      - wget
      - curl
      - git
      - unzip
    state: present

# roles/nginx/tasks/main.yml
- name: 添加Nginx官方yum源
  yum_repository:
    name: nginx
    description: Nginx repo
    baseurl: http://nginx.org/packages/centos/7/$basearch/
    gpgcheck: no

- name: 安装Nginx
  yum:
    name: nginx
    state: present

- name: 生成Nginx配置文件（支持CLB健康检查）
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: restart nginx

- name: 创建网站根目录
  file:
    path: /data/www
    state: directory
    owner: nginx
    group: nginx
    mode: '0755'

- name: 部署测试页面（动态从git拉取，此处为示例）
  copy:
    content: "<?php phpinfo(); ?>"
    dest: /data/www/index.php
    owner: nginx
    group: nginx
    mode: '0644'

# roles/php/tasks/main.yml
- name: 安装PHP 8.2及相关扩展（使用remi源）
  yum:
    name:
      - php82
      - php82-php-fpm
      - php82-php-mysqlnd
      - php82-php-gd
      - php82-php-mbstring
      - php82-php-xml
      - php82-php-opcache
    enablerepo: remi-php82
    state: present

- name: 修改php-fpm池配置（动态调整进程数）
  template:
    src: www.conf.j2
    dest: /etc/opt/remi/php82/php-fpm.d/www.conf
  notify: restart php-fpm

# roles/mysql/tasks/main.yml
- name: 安装MySQL 8.0（使用腾讯云镜像）
  yum:
    name:
      - mysql-community-server
      - mysql-community-client
    enablerepo: mysql80-community
    state: present

- name: 启动MySQL并设置开机自启
  systemd:
    name: mysqld
    state: started
    enabled: yes

- name: 获取临时密码
  shell: grep 'temporary password' /var/log/mysqld.log | awk '{print $NF}'
  register: temp_password
  changed_when: false

- name: 修改root密码（安全加固）
  shell: |
    mysqladmin -u root -p"{{ temp_password.stdout }}" password "{{ mysql_root_password }}"
  ignore_errors: yes

# 主从配置（根据inventory中的组变量判断）
- name: 配置主库复制账号
  mysql_user:
    name: repl
    password: "{{ replication_password }}"
    priv: "*.*:REPLICATION SLAVE,REPLICATION CLIENT"
    state: present
    login_user: root
    login_password: "{{ mysql_root_password }}"
  when: "'db-master' in group_names"

- name: 配置从库同步（获取主库状态）
  mysql_replication:
    mode: changemaster
    master_host: "{{ hostvars[groups['db-master'][0]]['ansible_default_ipv4']['address'] }}"
    master_user: repl
    master_password: "{{ replication_password }}"
    master_log_file: "{{ master_log_file }}"
    master_log_pos: "{{ master_log_pos }}"
    login_user: root
    login_password: "{{ mysql_root_password }}"
  when: "'db-slave' in group_names"

# roles/prometheus/tasks/main.yml
- name: 下载Prometheus二进制包（2.53.0）
  get_url:
    url: https://github.com/prometheus/prometheus/releases/download/v2.53.0/prometheus-2.53.0.linux-amd64.tar.gz
    dest: /tmp/prometheus.tar.gz

- name: 解压并安装
  unarchive:
    src: /tmp/prometheus.tar.gz
    dest: /usr/local/
    remote_src: yes
    creates: /usr/local/prometheus-2.53.0.linux-amd64

- name: 创建软链接
  file:
    src: /usr/local/prometheus-2.53.0.linux-amd64
    dest: /usr/local/prometheus
    state: link

- name: 配置prometheus.yml（抓取node_exporter和自定义业务指标）
  template:
    src: prometheus.yml.j2
    dest: /usr/local/prometheus/prometheus.yml

- name: 创建systemd service
  template:
    src: prometheus.service.j2
    dest: /etc/systemd/system/prometheus.service
  notify: restart prometheus

- name: 安装node_exporter
  hosts: all
  tasks:
    - name: 下载node_exporter
      get_url:
        url: https://github.com/prometheus/node_exporter/releases/download/v1.8.0/node_exporter-1.8.0.linux-amd64.tar.gz
        dest: /tmp/node_exporter.tar.gz
    - name: 解压并安装
      unarchive:
        src: /tmp/node_exporter.tar.gz
        dest: /usr/local/
        remote_src: yes
    - name: 启动服务
      systemd:
        name: node_exporter
        state: started
        enabled: yes
        daemon_reload: yes
        unit: |
          [Unit]
          Description=Node Exporter
          After=network.target
          [Service]
          ExecStart=/usr/local/node_exporter-1.8.0.linux-amd64/node_exporter
          Restart=always
          [Install]
          WantedBy=multi-user.target

# scripts/setup_cloud_alarm.py
from tencentcloud.common import credential
from tencentcloud.monitor.v20180724 import monitor_client, models

cred = credential.Credential(os.getenv("TENCENTCLOUD_SECRET_ID"), os.getenv("TENCENTCLOUD_SECRET_KEY"))
client = monitor_client.MonitorClient(cred, "ap-shanghai")

req = models.CreateAlarmPolicyRequest()
req.PolicyName = "CPU使用率过高"
req.Condition = models.AlarmPolicyCondition()
req.Condition.MetricName = "CpuUsage"
req.Condition.Period = 60
req.Condition.Operator = "gt"
req.Condition.Threshold = 80
req.NoticeIds = ["notice-xxxx"]  # 预创建的通知模板
req.Enable = 1
resp = client.CreateAlarmPolicy(req)
print(resp)

# scripts/bind_clb.py
from tencentcloud.clb.v20180317 import clb_client, models
...
def bind_backend(clb_id, instance_ids, listener_id):
    req = models.RegisterTargetsRequest()
    req.LoadBalancerId = clb_id
    req.ListenerId = listener_id
    targets = [{"InstanceId": ins, "Port": 80, "Weight": 10} for ins in instance_ids]
    req.Targets = targets
    client.RegisterTargets(req)

# roles/filebeat/files/filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  fields:
    log_type: nginx_access
  fields_under_root: true

output.console:  # 调试用，实际使用cos插件
  pretty: true

# 生产使用腾讯云COS output（官方未直接支持，可选用S3兼容API）
# 此处为了简化，用logstash中转或定期用coscli上传

# 每日凌晨压缩前日日志并上传
0 2 * * * /usr/local/bin/coscli cp /var/log/nginx/access.log cos://my-log-bucket/nginx-$(date -d "yesterday" +%Y%m%d).log

- hosts: all
  roles:
    - common
  tags: always

- hosts: web
  roles:
    - nginx
    - php
  tags: web

- hosts: db-master
  roles:
    - mysql
  tags: db

- hosts: db-slave
  roles:
    - mysql
  tags: db

- hosts: monitor
  roles:
    - prometheus
    - filebeat
  tags: monitor

ansible-playbook -i production/hosts site.yml --extra-vars "mysql_root_password=xxx replication_password=xxx"