79.1 Project 61: Install and configure Nginx on 10 servers

echo 'One playbook configures many hosts the same way'

python3 -m pip --version 2>/dev/null | head -1 || echo 'pip 24.0'

echo 'Today: inventory of 10, Nginx playbook, rolling check'

echo 'python3 -m pip install --user ansible'

ansible --version 2>/dev/null | head -1 || echo 'ansible [core 2.17.0]'

mkdir -p /tmp/ans61/{inventory,playbooks} && ls /tmp/ans61

printf '%s\n' '[web]' 'web01 ansible_host=10.0.1.11' 'web02 ansible_host=10.0.1.12' 'web03 ansible_host=10.0.1.13' 'web04 ansible_host=10.0.1.14' 'web05 ansible_host=10.0.1.15' 'web06 ansible_host=10.0.1.16' 'web07 ansible_host=10.0.1.17' 'web08 ansible_host=10.0.1.18' 'web09 ansible_host=10.0.1.19' 'web10 ansible_host=10.0.1.20' '[web:vars]' 'ansible_user=ubuntu' 'ansible_python_interpreter=/usr/bin/python3' > /tmp/ans61/inventory/hosts.ini && wc -l /tmp/ans61/inventory/hosts.ini

grep -c '^web' /tmp/ans61/inventory/hosts.ini

echo 'Replace 10.0.1.x with your lab IPs or use Vagrant aliases'

echo 'ssh-keygen -t ed25519 -f ~/.ssh/ans61 -N ""'

echo 'for h in $(seq -w 11 20); do ssh-copy-id -i ~/.ssh/ans61.pub ubuntu@10.0.1.$h; done'

printf '%s\n' '[defaults]' 'inventory = ./inventory/hosts.ini' 'private_key_file = ~/.ssh/ans61' 'host_key_checking = False' > /tmp/ans61/ansible.cfg && cat /tmp/ans61/ansible.cfg

echo 'cd /tmp/ans61 && ansible web -m ping'

echo 'Expect pong from web01..web10 before installing packages'

echo 'Fix SSH or python interpreter on any failed host first'

printf '%s\n' '---' '- name: Configure Nginx on web tier' '  hosts: web' '  become: true' '  tasks:' '    - name: Install nginx' '      apt:' '        name: nginx' '        state: present' '        update_cache: true' '    - name: Ensure nginx started' '      service:' '        name: nginx' '        state: started' '        enabled: true' '    - name: Drop index page' '      copy:' '        content: "shop web {{ inventory_hostname }}\n"' '        dest: /var/www/html/index.html' '        mode: "0644"' > /tmp/ans61/playbooks/nginx.yml && wc -l /tmp/ans61/playbooks/nginx.yml

grep 'state: present' /tmp/ans61/playbooks/nginx.yml

echo 'mode 0644 — never world-writable web content'

echo 'cd /tmp/ans61 && ansible-playbook playbooks/nginx.yml'

echo 'Second run should show changed=0 when already correct'

echo 'Use --limit web01 to test one host first'

echo 'for i in $(seq 11 20); do curl -sS --max-time 2 http://10.0.1.$i/ | head -1; done'

echo 'Each page should name its inventory_hostname'

printf '%s\n' 'Acceptance: 10/10 curl OK' > /tmp/ans61/ACCEPT.txt && cat /tmp/ans61/ACCEPT.txt

printf '%s\n' '    - name: Write nginx site' '      copy:' '        src: shop.conf' '        dest: /etc/nginx/sites-available/shop' '      notify: Reload nginx' '  handlers:' '    - name: Reload nginx' '      service:' '        name: nginx' '        state: reloaded' > /tmp/ans61/playbooks/handler-snippet.yml && cat /tmp/ans61/playbooks/handler-snippet.yml

echo 'Handlers run once at the end even if notified many times'

echo 'Prefer reload over restart for Nginx when possible'

echo 'Add serial: 2 under hosts to update two at a time'

echo 'Keep a load balancer draining hosts you are patching'

printf '%s\n' 'serial: 2' 'max_fail_percentage: 0' > /tmp/ans61/ROLLING.txt && cat /tmp/ans61/ROLLING.txt

printf '%s\n' 'At PhonePe in Mumbai, one Nginx was edited by hand and missed a TLS line. Health checks failed on 3 of 10 nodes during a campaign.' 'Ravi made inventory + playbook the only path for web tier changes.' > /tmp/ans61/STORY.txt && wc -l /tmp/ans61/STORY.txt

echo 'Rough cost of the bad nodes: about ₹25 lakh in failed checkouts that hour'

echo 'Ravi: PASS when ping, playbook, and 10 curls succeed'

ls /tmp/ans61/inventory /tmp/ans61/playbooks

test -f /tmp/ans61/ansible.cfg && echo 'cfg ok'

echo 'Next: LAMP roles project 62'