1. 企业级Web服务集群部署概述在当今互联网服务架构中高可用、可扩展的Web服务集群已成为企业级应用的标配。通过Ansible这一自动化运维工具我们可以实现从单机部署到集群化管理的平滑过渡将Nginx、PHP和MySQL的部署过程标准化、自动化。这种方案特别适合需要快速部署、统一管理多台服务器的场景比如电商大促期间的临时扩容、开发测试环境的快速搭建或是生产环境的标准化部署。我曾在一次金融系统升级项目中用Ansible Playbook在2小时内完成了原本需要2天的手工部署工作。这个Playbook不仅部署了NginxPHPMySQL的基础环境还实现了配置文件的版本化管理、服务状态的自动校验以及部署后的基础性能测试。这种效率提升在紧急故障恢复时尤为宝贵。2. 环境规划与准备工作2.1 基础设施规划在开始编写Playbook前我们需要明确集群架构。一个典型的企业级Web集群包含2台Nginx做负载均衡keepalived实现VIP高可用3台PHP应用服务器根据业务压力可横向扩展1主2从的MySQL集群建议使用Galera Cluster或主从复制1台Ansible控制机也可用开发者本地电脑提示生产环境建议将数据库服务器与Web服务器物理隔离避免资源争用。测试环境可以合并部署。2.2 Ansible基础配置在控制机上安装Ansible后需配置/etc/ansible/hosts文件定义服务器分组。以下是示例[loadbalancer] lb1 ansible_host192.168.1.101 lb2 ansible_host192.168.1.102 [webserver] web1 ansible_host192.168.1.111 web2 ansible_host192.168.1.112 web3 ansible_host192.168.1.113 [database] db1 ansible_host192.168.1.201 db2 ansible_host192.168.1.202 db3 ansible_host192.168.1.203测试连接性ansible all -m ping -u root2.3 系统统一化处理企业环境中服务器可能存在不同的初始状态建议在Playbook开头添加预处理任务- name: 基础系统标准化 hosts: all tasks: - name: 配置统一yum源 copy: src: files/company.repo dest: /etc/yum.repos.d/ - name: 安装基础工具 yum: name: [vim,wget,net-tools,telnet,lsof,tree] state: present - name: 统一时间同步 yum: name: chrony state: present service: name: chronyd state: started enabled: yes3. Nginx集群部署实现3.1 Nginx安装与基础配置创建nginx.ymlPlaybook- name: 部署Nginx集群 hosts: loadbalancer vars: nginx_version: 1.25.3 worker_connections: 4096 tasks: - name: 安装依赖 yum: name: [gcc,pcre-devel,openssl-devel,zlib-devel] state: present - name: 下载Nginx源码包 get_url: url: http://nginx.org/download/nginx-{{nginx_version}}.tar.gz dest: /tmp/nginx-{{nginx_version}}.tar.gz - name: 解压安装 unarchive: src: /tmp/nginx-{{nginx_version}}.tar.gz dest: /tmp/ remote_src: yes register: nginx_src - name: 编译安装 command: | ./configure --prefix/usr/local/nginx \ --with-http_ssl_module \ --with-http_stub_status_module \ --with-threads \ --with-file-aio make make install args: chdir: /tmp/nginx-{{nginx_version}} - name: 创建系统服务文件 copy: content: | [Unit] Descriptionnginx service Afternetwork.target [Service] Typeforking ExecStart/usr/local/nginx/sbin/nginx ExecReload/usr/local/nginx/sbin/nginx -s reload ExecStop/usr/local/nginx/sbin/nginx -s quit PrivateTmptrue [Install] WantedBymulti-user.target dest: /usr/lib/systemd/system/nginx.service - name: 启动并设置开机自启 systemd: name: nginx state: started enabled: yes3.2 负载均衡配置在templates/nginx.conf.j2创建配置模板user nginx; worker_processes {{ansible_processor_vcpus}}; events { worker_connections {{worker_connections}}; } http { upstream backend { {% for host in groups[webserver] %} server {{hostvars[host].ansible_host}}:8000 weight1 max_fails3 fail_timeout30s; {% endfor %} } server { listen 80; server_name {{domain_name}}; location / { proxy_pass http://backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; } } }在Playbook中添加任务- name: 配置负载均衡 template: src: templates/nginx.conf.j2 dest: /usr/local/nginx/conf/nginx.conf notify: reload nginx handlers: - name: reload nginx systemd: name: nginx state: reloaded3.3 Keepalived高可用配置对于生产环境需要为Nginx负载均衡器配置VIP高可用- name: 配置Keepalived hosts: loadbalancer tasks: - name: 安装keepalived yum: name: keepalived state: present - name: 配置MASTER节点 template: src: templates/keepalived-master.conf.j2 dest: /etc/keepalived/keepalived.conf when: inventory_hostname lb1 notify: restart keepalived - name: 配置BACKUP节点 template: src: templates/keepalived-backup.conf.j2 dest: /etc/keepalived/keepalived.conf when: inventory_hostname lb2 notify: restart keepalived handlers: - name: restart keepalived systemd: name: keepalived state: restarted4. PHP应用服务器部署4.1 PHP-FPM环境搭建创建php.ymlPlaybook- name: 部署PHP环境 hosts: webserver vars: php_version: 8.2 tasks: - name: 安装EPEL仓库 yum: name: epel-release state: present - name: 安装Remi仓库 yum: name: https://rpms.remirepo.net/enterprise/remi-release-7.rpm state: present - name: 启用PHP模块 command: yum-config-manager --enable remi-php{{php_version}} - name: 安装PHP及扩展 yum: name: [php,php-fpm,php-mysqlnd,php-opcache,php-gd,php-mbstring,php-xml] state: present - name: 配置PHP-FPM template: src: templates/www.conf.j2 dest: /etc/php-fpm.d/www.conf notify: restart php-fpm - name: 启动PHP-FPM systemd: name: php-fpm state: started enabled: yesPHP-FPM配置模板templates/www.conf.j2关键参数[www] user nginx group nginx listen 0.0.0.0:8000 listen.allowed_clients 127.0.0.1,{{ groups[loadbalancer] | map(extract, hostvars, ansible_host) | join(,) }} pm dynamic pm.max_children 50 pm.start_servers 5 pm.min_spare_servers 5 pm.max_spare_servers 10 pm.max_requests 5004.2 Nginx与PHP联动配置在Web服务器上需要配置Nginx处理PHP请求- name: 配置Web服务器Nginx hosts: webserver tasks: - name: 创建网站目录 file: path: /data/www state: directory owner: nginx group: nginx - name: 部署测试PHP文件 copy: content: ?php phpinfo(); ? dest: /data/www/index.php - name: 配置Nginx template: src: templates/webserver-nginx.conf.j2 dest: /usr/local/nginx/conf/nginx.conf notify: reload nginxWeb服务器Nginx配置模板示例server { listen 8000; server_name localhost; root /data/www; location / { index index.php index.html; } location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } }5. MySQL集群部署5.1 MySQL主从复制配置对于中小规模集群可采用主从复制方案- name: 部署MySQL主库 hosts: db1 tasks: - name: 安装MySQL yum: name: [mysql-community-server,mysql-community-client] state: present - name: 启动MySQL systemd: name: mysqld state: started enabled: yes - name: 设置root密码 mysql_user: name: root password: {{mysql_root_password}} host: localhost priv: *.*:ALL,GRANT - name: 创建复制用户 mysql_user: name: repl password: {{mysql_repl_password}} host: % priv: *.*:REPLICATION SLAVE - name: 配置主库my.cnf template: src: templates/my-master.cnf.j2 dest: /etc/my.cnf notify: restart mysql - name: 部署MySQL从库 hosts: db2,db3 tasks: - name: 安装MySQL yum: name: [mysql-community-server,mysql-community-client] state: present - name: 配置从库my.cnf template: src: templates/my-slave.cnf.j2 dest: /etc/my.cnf notify: restart mysql - name: 设置复制 mysql_replication: mode: changemaster master_host: {{hostvars[db1].ansible_host}} master_user: repl master_password: {{mysql_repl_password}} master_log_file: {{master_status.File}} master_log_pos: {{master_status.Position}} vars: master_status: {{ lookup(mysql, SHOW MASTER STATUS, wantlistTrue)[0] }} notify: start slave handlers: - name: restart mysql systemd: name: mysqld state: restarted - name: start slave mysql_replication: mode: startslave5.2 数据库初始化建议将数据库初始化脚本纳入版本控制- name: 初始化业务数据库 hosts: db1 tasks: - name: 上传SQL脚本 copy: src: files/init_db.sql dest: /tmp/ - name: 执行初始化 mysql_db: name: {{item}} state: import target: /tmp/init_db.sql with_items: - app_db - report_db6. 集群验证与调优6.1 服务连通性测试创建验证Playbookverify.yml- name: 验证集群状态 hosts: localhost connection: local tasks: - name: 测试负载均衡 uri: url: http://{{vip_address}}/index.php return_content: yes register: web_test - name: 检查PHP信息页 assert: that: - PHP Version in web_test.content - name: 测试数据库连接 mysql_query: login_host: {{hostvars[db1].ansible_host}} login_user: root login_password: {{mysql_root_password}} query: SHOW DATABASES register: db_test - name: 验证数据库 assert: that: - app_db in db_test.results[0]6.2 性能调优建议根据实际业务需求调整以下参数Nginx调优worker_processes: CPU核心数worker_connections: 根据内存调整每个连接约占用256KBkeepalive_timeout: 长连接超时时间PHP-FPM调优pm.max_children (总内存 - 系统预留) / 单个PHP进程内存 pm.start_servers CPU核心数 × 2 pm.max_spare_servers CPU核心数 × 4MySQL调优innodb_buffer_pool_size 总内存的50-70% innodb_log_file_size buffer_pool_size的25% max_connections 根据应用需求设置7. 生产环境注意事项安全加固为MySQL root账户设置强密码并限制访问IPNginx关闭server_tokens显示版本信息PHP禁用危险函数exec, system等监控方案Nginx: 通过stub_status模块收集指标PHP-FPM: 启用status页面MySQL: 部署Prometheus exporter备份策略- name: MySQL每日备份 cron: name: MySQL backup minute: 0 hour: 2 job: mysqldump -uroot -p{{mysql_root_password}} --all-databases | gzip /backup/mysql-$(date \%Y\%m\%d).sql.gz灰度发布方案通过Ansible的--limit参数分批发布在负载均衡器上配置健康检查部署前自动创建数据库备份在实际企业部署中我通常会先在一个测试节点完整运行Playbook确认无误后再通过--limit参数分批部署到生产环境。对于配置变更使用--tags功能只执行相关任务减少影响范围。
1. 企业级Web服务集群部署概述在当今互联网服务架构中高可用、可扩展的Web服务集群已成为企业级应用的标配。通过Ansible这一自动化运维工具我们可以实现从单机部署到集群化管理的平滑过渡将Nginx、PHP和MySQL的部署过程标准化、自动化。这种方案特别适合需要快速部署、统一管理多台服务器的场景比如电商大促期间的临时扩容、开发测试环境的快速搭建或是生产环境的标准化部署。我曾在一次金融系统升级项目中用Ansible Playbook在2小时内完成了原本需要2天的手工部署工作。这个Playbook不仅部署了NginxPHPMySQL的基础环境还实现了配置文件的版本化管理、服务状态的自动校验以及部署后的基础性能测试。这种效率提升在紧急故障恢复时尤为宝贵。2. 环境规划与准备工作2.1 基础设施规划在开始编写Playbook前我们需要明确集群架构。一个典型的企业级Web集群包含2台Nginx做负载均衡keepalived实现VIP高可用3台PHP应用服务器根据业务压力可横向扩展1主2从的MySQL集群建议使用Galera Cluster或主从复制1台Ansible控制机也可用开发者本地电脑提示生产环境建议将数据库服务器与Web服务器物理隔离避免资源争用。测试环境可以合并部署。2.2 Ansible基础配置在控制机上安装Ansible后需配置/etc/ansible/hosts文件定义服务器分组。以下是示例[loadbalancer] lb1 ansible_host192.168.1.101 lb2 ansible_host192.168.1.102 [webserver] web1 ansible_host192.168.1.111 web2 ansible_host192.168.1.112 web3 ansible_host192.168.1.113 [database] db1 ansible_host192.168.1.201 db2 ansible_host192.168.1.202 db3 ansible_host192.168.1.203测试连接性ansible all -m ping -u root2.3 系统统一化处理企业环境中服务器可能存在不同的初始状态建议在Playbook开头添加预处理任务- name: 基础系统标准化 hosts: all tasks: - name: 配置统一yum源 copy: src: files/company.repo dest: /etc/yum.repos.d/ - name: 安装基础工具 yum: name: [vim,wget,net-tools,telnet,lsof,tree] state: present - name: 统一时间同步 yum: name: chrony state: present service: name: chronyd state: started enabled: yes3. Nginx集群部署实现3.1 Nginx安装与基础配置创建nginx.ymlPlaybook- name: 部署Nginx集群 hosts: loadbalancer vars: nginx_version: 1.25.3 worker_connections: 4096 tasks: - name: 安装依赖 yum: name: [gcc,pcre-devel,openssl-devel,zlib-devel] state: present - name: 下载Nginx源码包 get_url: url: http://nginx.org/download/nginx-{{nginx_version}}.tar.gz dest: /tmp/nginx-{{nginx_version}}.tar.gz - name: 解压安装 unarchive: src: /tmp/nginx-{{nginx_version}}.tar.gz dest: /tmp/ remote_src: yes register: nginx_src - name: 编译安装 command: | ./configure --prefix/usr/local/nginx \ --with-http_ssl_module \ --with-http_stub_status_module \ --with-threads \ --with-file-aio make make install args: chdir: /tmp/nginx-{{nginx_version}} - name: 创建系统服务文件 copy: content: | [Unit] Descriptionnginx service Afternetwork.target [Service] Typeforking ExecStart/usr/local/nginx/sbin/nginx ExecReload/usr/local/nginx/sbin/nginx -s reload ExecStop/usr/local/nginx/sbin/nginx -s quit PrivateTmptrue [Install] WantedBymulti-user.target dest: /usr/lib/systemd/system/nginx.service - name: 启动并设置开机自启 systemd: name: nginx state: started enabled: yes3.2 负载均衡配置在templates/nginx.conf.j2创建配置模板user nginx; worker_processes {{ansible_processor_vcpus}}; events { worker_connections {{worker_connections}}; } http { upstream backend { {% for host in groups[webserver] %} server {{hostvars[host].ansible_host}}:8000 weight1 max_fails3 fail_timeout30s; {% endfor %} } server { listen 80; server_name {{domain_name}}; location / { proxy_pass http://backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } location /nginx_status { stub_status on; access_log off; allow 127.0.0.1; deny all; } } }在Playbook中添加任务- name: 配置负载均衡 template: src: templates/nginx.conf.j2 dest: /usr/local/nginx/conf/nginx.conf notify: reload nginx handlers: - name: reload nginx systemd: name: nginx state: reloaded3.3 Keepalived高可用配置对于生产环境需要为Nginx负载均衡器配置VIP高可用- name: 配置Keepalived hosts: loadbalancer tasks: - name: 安装keepalived yum: name: keepalived state: present - name: 配置MASTER节点 template: src: templates/keepalived-master.conf.j2 dest: /etc/keepalived/keepalived.conf when: inventory_hostname lb1 notify: restart keepalived - name: 配置BACKUP节点 template: src: templates/keepalived-backup.conf.j2 dest: /etc/keepalived/keepalived.conf when: inventory_hostname lb2 notify: restart keepalived handlers: - name: restart keepalived systemd: name: keepalived state: restarted4. PHP应用服务器部署4.1 PHP-FPM环境搭建创建php.ymlPlaybook- name: 部署PHP环境 hosts: webserver vars: php_version: 8.2 tasks: - name: 安装EPEL仓库 yum: name: epel-release state: present - name: 安装Remi仓库 yum: name: https://rpms.remirepo.net/enterprise/remi-release-7.rpm state: present - name: 启用PHP模块 command: yum-config-manager --enable remi-php{{php_version}} - name: 安装PHP及扩展 yum: name: [php,php-fpm,php-mysqlnd,php-opcache,php-gd,php-mbstring,php-xml] state: present - name: 配置PHP-FPM template: src: templates/www.conf.j2 dest: /etc/php-fpm.d/www.conf notify: restart php-fpm - name: 启动PHP-FPM systemd: name: php-fpm state: started enabled: yesPHP-FPM配置模板templates/www.conf.j2关键参数[www] user nginx group nginx listen 0.0.0.0:8000 listen.allowed_clients 127.0.0.1,{{ groups[loadbalancer] | map(extract, hostvars, ansible_host) | join(,) }} pm dynamic pm.max_children 50 pm.start_servers 5 pm.min_spare_servers 5 pm.max_spare_servers 10 pm.max_requests 5004.2 Nginx与PHP联动配置在Web服务器上需要配置Nginx处理PHP请求- name: 配置Web服务器Nginx hosts: webserver tasks: - name: 创建网站目录 file: path: /data/www state: directory owner: nginx group: nginx - name: 部署测试PHP文件 copy: content: ?php phpinfo(); ? dest: /data/www/index.php - name: 配置Nginx template: src: templates/webserver-nginx.conf.j2 dest: /usr/local/nginx/conf/nginx.conf notify: reload nginxWeb服务器Nginx配置模板示例server { listen 8000; server_name localhost; root /data/www; location / { index index.php index.html; } location ~ \.php$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; } }5. MySQL集群部署5.1 MySQL主从复制配置对于中小规模集群可采用主从复制方案- name: 部署MySQL主库 hosts: db1 tasks: - name: 安装MySQL yum: name: [mysql-community-server,mysql-community-client] state: present - name: 启动MySQL systemd: name: mysqld state: started enabled: yes - name: 设置root密码 mysql_user: name: root password: {{mysql_root_password}} host: localhost priv: *.*:ALL,GRANT - name: 创建复制用户 mysql_user: name: repl password: {{mysql_repl_password}} host: % priv: *.*:REPLICATION SLAVE - name: 配置主库my.cnf template: src: templates/my-master.cnf.j2 dest: /etc/my.cnf notify: restart mysql - name: 部署MySQL从库 hosts: db2,db3 tasks: - name: 安装MySQL yum: name: [mysql-community-server,mysql-community-client] state: present - name: 配置从库my.cnf template: src: templates/my-slave.cnf.j2 dest: /etc/my.cnf notify: restart mysql - name: 设置复制 mysql_replication: mode: changemaster master_host: {{hostvars[db1].ansible_host}} master_user: repl master_password: {{mysql_repl_password}} master_log_file: {{master_status.File}} master_log_pos: {{master_status.Position}} vars: master_status: {{ lookup(mysql, SHOW MASTER STATUS, wantlistTrue)[0] }} notify: start slave handlers: - name: restart mysql systemd: name: mysqld state: restarted - name: start slave mysql_replication: mode: startslave5.2 数据库初始化建议将数据库初始化脚本纳入版本控制- name: 初始化业务数据库 hosts: db1 tasks: - name: 上传SQL脚本 copy: src: files/init_db.sql dest: /tmp/ - name: 执行初始化 mysql_db: name: {{item}} state: import target: /tmp/init_db.sql with_items: - app_db - report_db6. 集群验证与调优6.1 服务连通性测试创建验证Playbookverify.yml- name: 验证集群状态 hosts: localhost connection: local tasks: - name: 测试负载均衡 uri: url: http://{{vip_address}}/index.php return_content: yes register: web_test - name: 检查PHP信息页 assert: that: - PHP Version in web_test.content - name: 测试数据库连接 mysql_query: login_host: {{hostvars[db1].ansible_host}} login_user: root login_password: {{mysql_root_password}} query: SHOW DATABASES register: db_test - name: 验证数据库 assert: that: - app_db in db_test.results[0]6.2 性能调优建议根据实际业务需求调整以下参数Nginx调优worker_processes: CPU核心数worker_connections: 根据内存调整每个连接约占用256KBkeepalive_timeout: 长连接超时时间PHP-FPM调优pm.max_children (总内存 - 系统预留) / 单个PHP进程内存 pm.start_servers CPU核心数 × 2 pm.max_spare_servers CPU核心数 × 4MySQL调优innodb_buffer_pool_size 总内存的50-70% innodb_log_file_size buffer_pool_size的25% max_connections 根据应用需求设置7. 生产环境注意事项安全加固为MySQL root账户设置强密码并限制访问IPNginx关闭server_tokens显示版本信息PHP禁用危险函数exec, system等监控方案Nginx: 通过stub_status模块收集指标PHP-FPM: 启用status页面MySQL: 部署Prometheus exporter备份策略- name: MySQL每日备份 cron: name: MySQL backup minute: 0 hour: 2 job: mysqldump -uroot -p{{mysql_root_password}} --all-databases | gzip /backup/mysql-$(date \%Y\%m\%d).sql.gz灰度发布方案通过Ansible的--limit参数分批发布在负载均衡器上配置健康检查部署前自动创建数据库备份在实际企业部署中我通常会先在一个测试节点完整运行Playbook确认无误后再通过--limit参数分批部署到生产环境。对于配置变更使用--tags功能只执行相关任务减少影响范围。
