拓撲結構
這是一個用于通過 Ansible 部署 IIS Web 服務器的實驗室拓撲。
前提條件：
- ?在被管理的節點上安裝WinRm
- ?準備一張自簽名的證書
- ?開放防火墻入站tcp 5985 5986端口
準備自簽名證書?
PS C:\Users\azureuser> $cert = New-SelfSignedCertificate -DnsName "solarwinds" -CertStoreLocation Cert:\LocalMachine\My
PS C:\Users\azureuser> $cert.Thumbprint
625D9DA3410A9F3FC87D853EA9730B5A8935F150
?
注冊https listener，并綁定證書?
PS C:\Users\azureuser> winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname="solarwinds"; CertificateThumbprint="625D9DA3410A9F3FC87D853EA9730B5A8935F150"}'
?驗證https listener
PS C:\Users\azureuser> WinRM e winrm/config/listener
?定義ansible inventory file?
[windows_servers]
solarwinds ansible_host=20.47.126.72 ansible_connection=winrm ansible_winrm_transport=ntlm ansible_user=azureuser ansible_password=<yourpassword> ansible_winrm_connection_timeout=60[windows_servers:vars]
ansible_winrm_port=5986創建ansible playbook
---
- name: Windows Featurehosts: solarwindsgather_facts: truetasks:- name: Disable Windows Updates Servicewin_service:name: wuauservstate: stoppedstart_mode: disabled- name: Run ipconfig and return IP address information.raw: ipconfigregister: ipconfig- debug: var=ipconfig# Install and enable IIS on Windows server 2019- name: Install IISwin_feature:name: "Web-Server"state: presentrestart: yesinclude_sub_features: yesinclude_management_tools: yes
# Copy the index.html file and rename to ansible.html under C:\inetpub\wwwroot. Must use \\ instead of \ for accessing directory on Windows server.- name: Copy index text pagewin_copy:src: "files/index.html"dest: "C:\\inetpub\\wwwroot\\ansible.html"創建index.html文件
<html>
<head><title>Rock Ansible</title>
</head>
<body><h1 style="background-color:DodgerBlue;"> Use Ansible to install and configure IIS on WIndows 2022</h1> <h3 style="color:Tomato;"> Welcome to Rock's Ansbile Test Page</h3>
</body>
</html>運行ansible 命令來驗證到windows server的鏈接
(base) ninjamac@ninjamacdeMacBook-Air ansible % ansible -i host1 windows_servers -m win_ping solarwinds | UNREACHABLE! => {"changed": false,"msg": "ntlm: HTTPSConnectionPool(host='20.47.126.72', port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1006)')))","unreachable": true
}該錯誤是自簽名證書無法被macos信任導致，可以通過加上參數ansible_winrm_server_cert_validation=ignore來解決。
ansible -i host1 windows_servers -m setup -e ansible_winrm_server_cert_validation=ignore ?
運行ansible playbook
?
?訪問服務器的主頁
)
)
)
