operating-system-migration.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 在CentOS 7 ECS实例上自动部署WordPress，包括配置Nginx、MySQL、PHP及安全设置，提供公网访问URL。
  en: Automatically deploy WordPress on a CentOS 7 ECS instance, encompassing the
    configuration of Nginx, MySQL, PHP, and implementing security settings, with provision
    for public internet access via a URL.
Conditions:
  CreateInstance:
    'Fn::Equals':
      - Ref: SelectInstance
      - false
Parameters:
  SelectInstance:
    Type: Boolean
    Label:
      en: Whether to select an existing instance
      zh-cn: 是否选择已有实例
    Description:
      en: >-
        Whether to select an existing Centos7 system instance. The Centos7
        system instance must be connected to a public network.
      zh-cn: 是否选择已有Centos7系统实例，实例需要开通公网。
    Default: true
  InstanceId:
    Type: String
    Label:
      en: Existing ECS Instance
      zh-cn: 已创建ECS实例
    Description:
      en: Select an ECS instance with the CentOS 7.9 64-bit operating system.
      zh-cn: 选择已存在操作系统为CentOS 7.9 64位的ECS实例。
    AssociationProperty: 'ALIYUN::ECS::Instance::InstanceId'
    AssociationPropertyMetadata:
      Visible:
        Condition:
          'Fn::Equals':
            - '${SelectInstance}'
            - true
    Default: null
  ZoneId:
    Type: String
    Label:
      en: VSwitch Availability Zone
      zh-cn: 可用区ID
    Description:
      en: >-
        Availability Zone ID,<br><b>note： <font color='blue'>Before selecting,
        please confirm that the Availability Zone supports the specification of
        creating ECS resources.</font></b>
      zh-cn: >-
        可用区ID。<br><b>注： <font
        color='blue'>选择可用区前请确认该可用区是否支持创建ECS资源的规格。</font></b>
    AssociationProperty: 'ALIYUN::ECS::Instance:ZoneId'
    AssociationPropertyMetadata:
      ZoneId: ZoneId
      Visible:
        Condition:
          'Fn::Equals':
            - '${SelectInstance}'
            - false
    Default: null
  InstanceType:
    Type: String
    Label:
      en: Instance Type
      zh-cn: 实例类型
    Description:
      en: >-
        Fill in the specifications that can be used under the VSwitch
        availability zone;</b></font><br>general specifications：<font
        color='red'><b>ecs.c5.large</b></font><br>note: a few zones do not
        support general specifications<br>see detail: <a
        href='https://www.alibabacloud.com/help/en/doc-detail/25378.html'
        target='_blank'><b><font color='blue'>Instance Specification
        Family</font></a></b>
      zh-cn: >-
        填写VSwitch可用区下可使用的规格；<br>通用规格：<font
        color='red'><b>ecs.c5.large</b></font><br>注：可用区可能不支持通用规格<br>规格详见：<a
        href='https://help.aliyun.com/document_detail/25378.html'
        target='_blank'><b><font color='blue'>实例规格族</font></a></b>
    AssociationProperty: 'ALIYUN::ECS::Instance::InstanceType'
    AssociationPropertyMetadata:
      ZoneId: ZoneId
      Visible:
        Condition:
          'Fn::Equals':
            - '${SelectInstance}'
            - false
    Default: ecs.c5.large
  SystemDiskCategory:
    Type: String
    Label:
      en: System Disk Type
      zh-cn: 系统盘类型
    Description:
      en: >-
        <font color='blue'><b>Optional values:</b></font><br>[cloud_efficiency:
        <font color='green'>Efficient Cloud Disk</font>]<br>[cloud_ssd: <font
        color='green'>SSD Cloud Disk</font>]<br>[cloud_essd: <font
        color='green'>ESSD Cloud Disk</font>]<br>[cloud: <font
        color='green'>Cloud Disk</font>]<br>[ephemeral_ssd: <font
        color='green'>Local SSD Cloud Disk</font>]
      zh-cn: >-
        <font color='blue'><b>可选值：</b></font><br>[cloud_efficiency: <font
        color='green'>高效云盘</font>]<br>[cloud_ssd: <font
        color='green'>SSD云盘</font>]<br>[cloud_essd: <font
        color='green'>ESSD云盘</font>]<br>[cloud: <font
        color='green'>普通云盘</font>]<br>[ephemeral_ssd: <font
        color='green'>本地SSD盘</font>]
    AssociationProperty: 'ALIYUN::ECS::Disk::SystemDiskCategory'
    AssociationPropertyMetadata:
      LocaleKey: DiskCategory
      InstanceType: '${InstanceType}'
      ZoneId: ZoneId
      Visible:
        Condition:
          'Fn::Equals':
            - '${SelectInstance}'
            - false
    Default: cloud_efficiency
  InstancePassword:
    Type: String
    Label:
      en: Instance Password
      zh-cn: 实例密码
    Description:
      en: >-
        Server login password, Length 8-30, must contain three(Capital letters,
        lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special
        symbol in).
      zh-cn: >-
        服务器登录密码,长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
        中的特殊符号）。
    ConstraintDescription:
      en: >-
        Length 8-30, must contain three(Capital letters, lowercase letters,
        numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in).
      zh-cn: '长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;''<>,.?/ 中的特殊符号）。'
    AllowedPattern: '[0-9A-Za-z\_\-\&:;''<>,=%`~!@#\(\)\$\^\*\+\|\{\}\[\]\.\?\/]+$'
    AssociationProperty: ALIYUN::ECS::Instance::Password
    AssociationPropertyMetadata:
      Visible:
        Condition:
          'Fn::Equals':
            - '${SelectInstance}'
            - false
    MinLength: 8
    MaxLength: 30
    NoEcho: true
    Default: null
  DbPassword:
    Type: String
    Label:
      en: DB User Password
      zh-cn: 数据库用户密码
    Description:
      en: >-
        The MySQL user password, consisting of letters, numbers, and
        underline(_), 8 to 32 characters in length.
      zh-cn: MySQL用户密码，数据库访问大小写字母、数字和下划线（_），8-32个字符。
    ConstraintDescription:
      en: >-
        Consisting of letters, numbers, and underline(_), 8 to 32 characters in
        length.
      zh-cn: 由字母、数字和下划线(_)组成，长度为8到32个字符。
    MinLength: 8
    MaxLength: 32
    NoEcho: true
    AssociationProperty: ALIYUN::ECS::Instance::Password
Resources:
  Vpc:
    Type: 'ALIYUN::ECS::VPC'
    Condition: CreateInstance
    Properties:
      CidrBlock: 192.168.0.0/16
  VSwitch:
    Type: 'ALIYUN::ECS::VSwitch'
    Condition: CreateInstance
    Properties:
      ZoneId:
        Ref: ZoneId
      VpcId:
        Ref: Vpc
      CidrBlock: 192.168.0.0/24
  SecurityGroup:
    Type: 'ALIYUN::ECS::SecurityGroup'
    Condition: CreateInstance
    Properties:
      VpcId:
        Ref: Vpc
  SecurityGroupIngress_22:
    Type: 'ALIYUN::ECS::SecurityGroupIngress'
    Properties:
      SecurityGroupId:
        'Fn::Jq':
          - First
          - '.[0].SecurityGroupIds[0]'
          - 'Fn::GetAtt':
              - DS_Instances
              - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 22/22
  SecurityGroupIngress_80:
    Type: 'ALIYUN::ECS::SecurityGroupIngress'
    Properties:
      SecurityGroupId:
        'Fn::Jq':
          - First
          - '.[0].SecurityGroupIds[0]'
          - 'Fn::GetAtt':
              - DS_Instances
              - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 80/80
  SecurityGroupIngress_443:
    Type: 'ALIYUN::ECS::SecurityGroupIngress'
    Properties:
      SecurityGroupId:
        'Fn::Jq':
          - First
          - '.[0].SecurityGroupIds[0]'
          - 'Fn::GetAtt':
              - DS_Instances
              - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 443/443
  WaitConditionHandle:
    Type: 'ALIYUN::ROS::WaitConditionHandle'
    Properties: {}
  RosWaitCondition:
    Type: 'ALIYUN::ROS::WaitCondition'
    Properties:
      Count: 1
      Handle:
        Ref: WaitConditionHandle
      Timeout: 7200
  DS_Instances:
    Type: 'DATASOURCE::ECS::Instances'
    Properties:
      InstanceIds:
        'Fn::If':
          - CreateInstance
          - 'Fn::GetAtt':
              - InstanceGroup
              - InstanceIds
          - - Ref: InstanceId
  InstanceGroup:
    Type: 'ALIYUN::ECS::InstanceGroup'
    Condition: CreateInstance
    Properties:
      VpcId:
        Ref: Vpc
      VSwitchId:
        Ref: VSwitch
      SecurityGroupId:
        Ref: SecurityGroup
      ImageId: centos_7_8
      InstanceType:
        Ref: InstanceType
      SystemDiskCategory:
        Ref: SystemDiskCategory
      Password:
        Ref: InstancePassword
      IoOptimized: optimized
      MaxAmount: 1
  InstallWordpress:
    Type: 'ALIYUN::ECS::RunCommand'
    Properties:
      InstanceIds:
        'Fn::If':
          - CreateInstance
          - 'Fn::GetAtt':
              - InstanceGroup
              - InstanceIds
          - - Ref: InstanceId
      Type: RunShellScript
      Sync: true
      Timeout: 7200
      CommandContent:
        'Fn::Sub':
          - >-
            #!/bin/bash

            if [ ! -f .ros.provision ]; then
              echo "Name: 手动搭建WordPress（CentOS 7）" > .ros.provision
            fi


            name=$(grep "^Name:" .ros.provision | awk -F':' '{print $2}' | sed
            -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')

            if [[ "$name" != "手动搭建WordPress（CentOS 7）" ]]; then
              echo "当前实例已使用过\"$name\"教程的一键配置，不能再使用本教程的一键配置"
              ${WaitConditionHandle.CurlCli} --data-binary "{\"status\": \"FAILURE\", \"reason\": \"The current instance has already applied the configuration of the \\\"$name\\\" tutorial, and the configuration of this tutorial can no longer be applied.\"}"
              exit 0
            fi


            echo "#########################"

            echo "# Check Network"

            echo "#########################"

            ping -c 2 -W 2 aliyun.com > /dev/null

            if [[ $? -ne 0 ]]; then
              echo "当前实例无法访问公网"
              ${WaitConditionHandle.CurlCli} --data-binary "{\"status\": \"FAILURE\", \"reason\": \"The current instance cannot access the public network.\"}"
              exit 0
            fi


            if ! grep -q "^Step1: Prepare Environment$" .ros.provision; then
              echo "#########################"
              echo "# Prepare Environment"
              echo "#########################"
              systemctl status firewalld
              systemctl stop firewalld
              echo "Step1: Prepare Environment" >> .ros.provision
            else
              echo "#########################"
              echo "# Environment has been ready"
              echo "#########################"
            fi


            if ! grep -q "^Step2: Install Nginx$" .ros.provision; then
              echo "#########################"
              echo "# Install Nginx"
              echo "#########################"
              yum -y install nginx
              nginx -v
              echo "Step2: Install Nginx" >> .ros.provision
            else
              echo "#########################"
              echo "# Nginx has been installed"
              echo "#########################"
            fi


            if ! grep -q "^Step3: Install MySQL$" .ros.provision; then
              echo "#########################"
              echo "# Install MySQL"
              echo "#########################"
              rpm -Uvh  https://dev.mysql.com/get/mysql57-community-release-el7-9.noarch.rpm
              yum -y install mysql-community-server --nogpgcheck
              mysql -V
              systemctl start mysqld
              systemctl enable mysqld
              systemctl daemon-reload
              echo "Step3: Install MySQL" >> .ros.provision
            else
              echo "#########################"
              echo "# MySQL has been installed"
              echo "#########################"
            fi


            if ! grep -q "^Step4: Install PHP$" .ros.provision; then
              echo "#########################"
              echo "# Install PHP"
              echo "#########################"
              yum install -y \
                https://mirrors.aliyun.com/ius/ius-release-el7.rpm \
                https://mirrors.aliyun.com/epel/epel-release-latest-7.noarch.rpm
              rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
              yum -y install php70w-devel php70w.x86_64 php70w-cli.x86_64 php70w-common.x86_64 php70w-gd.x86_64 php70w-ldap.x86_64 php70w-mbstring.x86_64 php70w-mcrypt.x86_64  php70w-pdo.x86_64   php70w-mysqlnd  php70w-fpm php70w-opcache php70w-pecl-redis php70w-pecl-mongodb
              php -v
              echo "Step4: Install PHP" >> .ros.provision
            else
              echo "#########################"
              echo "# PHP has been installed"
              echo "#########################"
            fi


            if ! grep -q "^Step4: Config Nginx$" .ros.provision; then
              echo "#########################"
              echo "# Config Nginx"
              echo "#########################"
              cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
              cat > /etc/nginx/nginx.conf << \EOF
            # For more information on configuration, see:

            #   * Official English Documentation: http://nginx.org/en/docs/

            #   * Official Russian Documentation: http://nginx.org/ru/docs/


            user nginx;

            worker_processes auto;

            error_log /var/log/nginx/error.log;

            pid /run/nginx.pid;


            # Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.

            include /usr/share/nginx/modules/*.conf;


            events {
                worker_connections 1024;
            }


            http {
                log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                                  '$status $body_bytes_sent "$http_referer" '
                                  '"$http_user_agent" "$http_x_forwarded_for"';

                access_log  /var/log/nginx/access.log  main;

                sendfile            on;
                tcp_nopush          on;
                tcp_nodelay         on;
                keepalive_timeout   65;
                types_hash_max_size 4096;

                include             /etc/nginx/mime.types;
                default_type        application/octet-stream;

                # Load modular configuration files from the /etc/nginx/conf.d directory.
                # See http://nginx.org/en/docs/ngx_core_module.html#include
                # for more information.
                include /etc/nginx/conf.d/*.conf;

                server {
                    listen       80;
                    listen       [::]:80;
                    server_name  _;
                    root         /usr/share/nginx/html/wordpress;

                    # Load configuration files for the default server block.
                    include /etc/nginx/default.d/*.conf;

                    location / {
                        index index.php index.html index.htm;
                    }

                    location ~ .php$ {
                        root /usr/share/nginx/html/wordpress;    # 将/usr/share/nginx/html替换为您的网站根目录，本文使用/usr/share/nginx/html作为网站根目录。
                        fastcgi_pass 127.0.0.1:9000;   # Nginx通过本机的9000端口将PHP请求转发给PHP-FPM进行处理。
                        fastcgi_index index.php;
                        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
                        include fastcgi_params;   # Nginx调用fastcgi接口处理PHP请求。
                    }

                    error_page 404 /404.html;
                    location = /404.html {
                    }

                    error_page 500 502 503 504 /50x.html;
                    location = /50x.html {
                    }
                }

            # Settings for a TLS enabled server.

            #

            #    server {

            #        listen       443 ssl http2;

            #        listen       [::]:443 ssl http2;

            #        server_name  _;

            #        root         /usr/share/nginx/html;

            #

            #        ssl_certificate "/etc/pki/nginx/server.crt";

            #        ssl_certificate_key "/etc/pki/nginx/private/server.key";

            #        ssl_session_cache shared:SSL:1m;

            #        ssl_session_timeout  10m;

            #        ssl_ciphers HIGH:!aNULL:!MD5;

            #        ssl_prefer_server_ciphers on;

            #

            #        # Load configuration files for the default server block.

            #        include /etc/nginx/default.d/*.conf;

            #

            #        error_page 404 /404.html;

            #            location = /40x.html {

            #        }

            #

            #        error_page 500 502 503 504 /50x.html;

            #            location = /50x.html {

            #        }

            #    }


            }

            EOF
              systemctl start nginx
              systemctl enable nginx
              echo "Step4: Config Nginx" >> .ros.provision
            else
              echo "#########################"
              echo "# Nginx has been configured"
              echo "#########################"
            fi


            if ! grep -q "^Step6: Config MySQL$" .ros.provision; then
              echo "#########################"
              echo "# Config MySQL"
              echo "#########################"
              export MYSQL_PWD=`grep "temporary password" /var/log/mysqld.log | awk '{print $NF}'`
              mysqladmin -uroot password '${DbPassword}'
              export MYSQL_PWD='${DbPassword}'
              mysql -uroot -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DbPassword}'"
              echo CREATE DATABASE wordpress\; >> /tmp/setup.mysql
              echo CREATE user "user"@"localhost" identified by \"${DbPassword}\"\; >> /tmp/setup.mysql
              echo GRANT ALL privileges ON wordpress.* TO "user"@"localhost" IDENTIFIED BY \"${DbPassword}\"\; >> /tmp/setup.mysql
              echo FLUSH privileges\;>> /tmp/setup.mysql
              chmod 400 /tmp/setup.mysql
              mysql -u root --password='${DbPassword}' < /tmp/setup.mysql
              echo "Step6: Config MySQL" >> .ros.provision
            else
              echo "#########################"
              echo "# MySQL has been configured"
              echo "#########################"
            fi


            if ! grep -q "^Step7: Config PHP$" .ros.provision; then
              echo "#########################"
              echo "# Config PHP"
              echo "#########################"
              echo "<?php phpinfo(); ?>" > /usr/share/nginx/html/phpinfo.php
              systemctl start php-fpm
              systemctl enable php-fpm
              echo "Step7: Config PHP" >> .ros.provision
            else
              echo "#########################"
              echo "# PHP has been configured"
              echo "#########################"
            fi


            if ! grep -q "^Step8: Install wordpress$" .ros.provision; then
              echo "#########################"
              echo "# Install wordpress"
              echo "#########################"
              yum -y install wordpress
              echo "Step8: Install wordpress" >> .ros.provision
            else
              echo "#########################"
              echo "# wordpress has been installed"
              echo "#########################"
            fi


            if ! grep -q "^Step9: Config wordpress$" .ros.provision; then
              echo "#########################"
              echo "# Config wordpress"
              echo "#########################"
              mv /usr/share/wordpress /usr/share/nginx/html/wordpress
              cd /usr/share/nginx/html/wordpress
              ln -snf /etc/wordpress/wp-config.php wp-config.php
              sed -i "s/database_name_here/wordpress/" wp-config.php
              sed -i "s/username_here/user/" wp-config.php
              sed -i "s/password_here/${DbPassword}/" wp-config.php
              echo "Step8: Config wordpress" >> .ros.provision
            else
              echo "#########################"
              echo "# wordpress has been configured"
              echo "#########################"
            fi


            systemctl restart nginx

            ${WaitConditionHandle.CurlCli} --data-binary '{"status": "SUCCESS"}'
          - IP:
              'Fn::Jq':
                - First
                - >-
                  if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0]
                  else .[0].EipAddress.IpAddress end
                - 'Fn::GetAtt':
                    - DS_Instances
                    - Instances
    DependsOn:
      - SecurityGroupIngress_22
      - SecurityGroupIngress_443
      - SecurityGroupIngress_80
Outputs:
  WordPressUrl:
    Description: Wordpress default address.
    Value:
      'Fn::Sub':
        - 'http://${IP}'
        - IP:
            'Fn::Jq':
              - First
              - >-
                if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else
                .[0].EipAddress.IpAddress end
              - 'Fn::GetAtt':
                  - DS_Instances
                  - Instances
Metadata:
  'ALIYUN::ROS::Interface':
    ParameterGroups:
      - Parameters:
          - SelectExistECS
          - ECSInstanceId
          - ZoneId
          - InstanceType
          - SystemDiskCategory
          - InstancePassword
          - DbPassword
        Label:
          default: ECS
    TemplateTags:
      - 'acs:technical-solution:cloud-migration:CentOS到Alinux操作系统迁移-tech_solu_80'