Ansible and reverse-proxy servers

About half a year ago, I had to develop a reverse proxy site scheme, from many nodes (n> 20) to several (n <= 3) combat servers. Recently faced in a similar request from a colleague. Therefore, I decided to share and collect everything in the article.

The article level is for beginners.
')
As a result, a simple tool was needed to add new nodes and update the list of domains. Profit from such a solution should be, when using caching on the server, and DNS with geolocation.

Finding information on the topic of reverse-proxy, often comes down to articles on setting up “nginx to apache” (on local apache or on a remote upstream server), CDN proxy services (cloudflare, * cdn, cloudfront, etc.). In this case, it did not quite fit.
The peculiarity is the need to provide many different IP (from different geographic locations) for the domains of one or two servers.

To solve the problem, several VPS were purchased in the required different locations (cheap, thanks to lowendbox.com & lowendstock.com, but with the required bendwich). VPS has so far been used on Centos-6-x32, but as soon as epel rolls out packages for Centos-7 32-bit , we will be updated. All other server manipulations are performed remotely, using ansible.

Ansible project structure

In accordance with accepted practice, we have the following file structure:

$ find -type f ./roles/update_os/tasks/main.yml ./roles/update_nginx_configs/tasks/main.yml ./roles/update_nginx_configs/files/proxy.conf ./roles/update_nginx_configs/templates/domain.conf.j2 ./roles/update_nginx_configs/handlers/main.yml ./roles/update_hostname/tasks/main.yml ./ansible.cfg ./hosts ./proxy-nodes.yml 

Go through all the files.
Here the meta group [centos] is displayed and the group [proxy-nodes] is separately listed as a child group to [centos].
Structure with the expectation of expanding roles and tasks.


There is nothing special here either. Setting up the server goes as root, so you can safely turn on pipelining.

hostfile - to clear input parameters when working in the console,
ssh_args - to reduce talkativeness with host reloads, and to set up a persistent connection, among them the most important is ControlPath.


This allows you to work faster than with the "accelerate: true" option. Despite the documentation , Centos 6 has sooooo been working with ControlPersist for a long time , and does not require such a preinstal, as was done before:


Next, the standard playbook, when working with roles, and task update_os:



I believe that these files do not need commenting.

Role update_hostname

It so happened that the nodes are somehow named. As you can see, in the hosts file is specified, speaking for itself, the parameter node_hostname. Unfortunately, ansible still can not change the hostname in accordance with the FQDN, so you have to help:


Now hostname -f does not swear, and it is this check that exists in some control panels.

Role update_nginx_configs

The last role is update_nginx_configs. Here we describe the handler for the nginx release:


The following file creates a caching zone in the http section, and includes future domains for proxying:


Template for domains like this:


There is nothing special here, proxying and cache options are selected for the project. Among the dynamic parameters, we see only three: ansible_default_ipv4.address, item.domain, and item.remoteip. Where the last two come from is evident from the following file:


Here are the final steps: checked that the directory for domains exists, updated the config with the caching zone settings, went through all domain-remoteip pairs in the loop with withitems and re-created the configs.

The final step is the validation of the config, and if successful, the reload nginx handler will start. Unfortunately, this validation cannot be used when generating a template or copying the proxy.conf config.

The validate = “nginx -t -c% s” options or even validate = “nginx -t -c /etc/nginx/nginx.conf -p% s” options are not as good as in the case of generating the httpd.conf config.

Go!

In the case of updating or changing the list of domains in the “re-create domain templates” task, execute:

ansible-playbook proxy-nodes.yml

without any additional options. After adding a new node, you need to run the command:

ansible-playbook proxy-nodes.yml --limit = bbb.bbb.bbb.bbb

where to specify the IP of the new node.

Conclusion

Asking google, I did not get an answer about such services from hosting providers. But the target audience can be very different, from the CEO to various adult web-masters.

Therefore, below the survey.