Add MinIO cluster (#15)

Co-authored-by: Fedor Batonogov <f.batonogov@yandex.ru>

ansible/roles/nginx_install/files/conf.d/minio.conf

@@ -0,0 +1,73 @@
+upstream minio_s3 {
+    least_conn;
+    server 10.0.75.55:9000;
+    server 10.0.75.56:9000;
+    server 10.0.75.57:9000;
+    server 10.0.75.58:9000;
+}
+
+upstream minio_console {
+    least_conn;
+    server 10.0.75.55:9001;
+    server 10.0.75.56:9001;
+    server 10.0.75.57:9001;
+    server 10.0.75.58:9001;
+}
+
+server {
+    listen        80;
+    listen   [::]:80;
+    listen *:443 ssl;
+    server_name  s3.example.local www.s3.example.local;
+    ssl_certificate /etc/ssl/private/minio.crt;
+    ssl_certificate_key /etc/ssl/private/private.key;
+
+    server_tokens off;
+
+    # Allow special characters in headers
+    ignore_invalid_headers off;
+    # Allow any size file to be uploaded.
+    # Set to a value such as 1000m; to restrict file size to a specific value
+    client_max_body_size 0;
+    # Disable buffering
+    proxy_buffering off;
+    proxy_request_buffering off;
+
+    location / {
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_connect_timeout 300;
+        # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        chunked_transfer_encoding off;
+
+        proxy_pass http://minio_s3; # This uses the upstream directive definition to load balance
+    }
+
+    location /minio/ui/ {
+        rewrite ^/minio/ui/(.*) /$1 break;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-NginX-Proxy true;
+
+        # This is necessary to pass the correct IP to be hashed
+        real_ip_header X-Real-IP;
+
+        proxy_connect_timeout 300;
+
+        # To support websockets in MinIO versions released after January 2023
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        chunked_transfer_encoding off;
+
+        proxy_pass http://minio_console; # This uses the upstream directive definition to load balance
+    }
+}

ansible/roles/nginx_install/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Перезапускаю сервер nginx
+  community.docker.docker_container_exec:
+    container: nginx
+    command: "{{ item }}"
+  loop:
+    - nginx -t
+    - nginx -s reload

ansible/roles/nginx_install/tasks/cert.yml

@@ -0,0 +1,34 @@
+---
+- name: Создаю директорию для ключей
+  ansible.builtin.file:
+    path: /etc/ssl/private
+    state: directory
+    owner: "{{ nginx_user }}"
+    group: "{{ nginx_user }}"
+    mode: "755"
+
+- name: Генерирую приватный ключ
+  community.crypto.openssl_privatekey:
+    path: "/etc/ssl/private/private.key"
+    mode: "0600"
+    owner: "{{ nginx_user }}"
+    group: "{{ nginx_user }}"
+
+- name: Создаю запроса на подписание сертификата (CSR) для самоподписанного сертификата
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: "/etc/ssl/private/private.key"
+    common_name: "minio"
+    organization_name: Example, Inc.
+    subject_alt_name:
+      - "DNS:s3.example.local"
+  register: csr
+
+- name: Создаю самоподписанный сертификат из CSR
+  community.crypto.x509_certificate:
+    path: "/etc/ssl/private/minio.crt"
+    csr_content: "{{ csr.csr }}"
+    privatekey_path: "/etc/ssl/private/private.key"
+    provider: selfsigned
+    mode: "0640"
+    owner: "{{ nginx_user }}"
+    group: "{{ nginx_user }}"

ansible/roles/nginx_install/tasks/config.yml

@@ -0,0 +1,19 @@
+---
+- name: Создаю директорию для nginx conf
+  ansible.builtin.file:
+    path: /etc/nginx/conf.d
+    state: directory
+    owner: "{{ nginx_user }}"
+    group: "{{ nginx_user }}"
+    mode: "755"
+
+- name: Синхронизирую конфигурационные файлы
+  ansible.posix.synchronize:
+    src: "conf.d/"
+    dest: "/etc/nginx/conf.d/"
+    delete: true
+    rsync_opts:
+      - "--chown={{ nginx_user }}:{{ nginx_user }}"
+      - "--chmod=F640"
+  notify:
+    - Перезапускаю сервер nginx

ansible/roles/nginx_install/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Создаю пользователя nginx
+  ansible.builtin.import_tasks: user.yml
+  when: ansible_distribution == 'Ubuntu'
+
+- name: Копирую конфигурацию
+  ansible.builtin.import_tasks: config.yml
+  when: ansible_distribution == 'Ubuntu'
+
+- name: Генерирую самоподписанный сертификат
+  ansible.builtin.import_tasks: cert.yml
+  when: ansible_distribution == 'Ubuntu'
+
+- name: Устанавливаю nginx
+  ansible.builtin.import_tasks: nginx.yml
+  when: ansible_distribution == 'Ubuntu'

ansible/roles/nginx_install/tasks/nginx.yml

@@ -0,0 +1,23 @@
+---
+- name: Наливаю docker-compose файл nginx
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "/home/{{ nginx_user }}/docker-compose.yml"
+    owner: "{{ nginx_user }}"
+    group: "{{ nginx_user }}"
+    mode: "640"
+
+- name: Налаживаю права для директории /etc/letsencrypt/
+  ansible.builtin.file:
+    path: "{{ item }}"
+    owner: "{{ nginx_user }}"
+    group: "{{ nginx_user }}"
+    recurse: true
+  with_items:
+    - "/etc/letsencrypt/"
+
+- name: Поднимаю nginx
+  community.docker.docker_compose_v2:
+    project_src: "/home/{{ nginx_user }}/"
+    remove_orphans: true
+    wait: true

ansible/roles/nginx_install/tasks/user.yml

@@ -0,0 +1,7 @@
+---
+- name: Создаю пользователя {{ nginx_user }}
+  ansible.builtin.user:
+    name: "{{ nginx_user }}"
+    state: present
+    groups: docker
+    shell: /bin/bash

ansible/roles/nginx_install/templates/docker-compose.yml.j2

@@ -0,0 +1,28 @@
+services:
+  nginx:
+    image: nginx:{{ nginx_version }}
+    container_name: nginx
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - TZ=Europe/Moscow
+    volumes:
+      - /etc/nginx/conf.d/:/etc/nginx/conf.d/:ro
+      - /etc/nginx/include.d/:/etc/nginx/include.d/:ro
+      - /etc/ssl/private/:/etc/ssl/private/:ro
+      - /var/lib/letsencrypt/:/var/lib/letsencrypt/:ro
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+    depends_on:
+      - certbot
+
+  certbot:
+    image: certbot/certbot:{{ certbot_version }}
+    container_name: certbot
+    restart: always
+    environment:
+      - TZ=Europe/Moscow
+    volumes:
+      - /etc/letsencrypt:/etc/letsencrypt
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew --webroot -w /etc/letsencrypt/ -n; sleep 12h & wait $${!}; done;'"

ansible/roles/nginx_install/vars/main.yml

@@ -0,0 +1,5 @@
+---
+# vars file for nginx-install
+nginx_version: 1.27.0-alpine
+nginx_user: nginx
+certbot_version: v2.11.0