ecs-lnmp.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 该模板用于在指定ECS实例上自动部署LNMP环境（Nginx、MySQL、PHP），配置安全组规则，并提供访问URL。要求输入实例ID和符合规范的MySQL密码。
  en: This template is designed for automatically deploying an LNMP stack (comprising
    Nginx, MySQL, and PHP) on a designated ECS instance, configuring security group
    rules, and furnishing an access URL. It necessitates the input of the instance
    ID and a compliant MySQL password.
Parameters:
  InstanceId:
    Type: String
    Label:
      en: ECS Instance ID
      zh-cn: ECS实例ID
    AssociationProperty: ALIYUN::ECS::Instance::InstanceId
  DbPassword:
    Type: String
    Label:
      en: MySQL Database Password
      zh-cn: MySQL数据库密码
    Description:
      en: |-
        The password must be 8 to 32 characters in length. <br>
        It must contain the following character types: uppercase letters, lowercase letters, digits, and special characters. <br> 
        Special characters include <span style="background:#E7E9EB;"><b>!@#$%^&*()_+-=</b></span>.<br>
        <b>If you repeatedly provision in this tutorial on the same ECS instance, make sure that the MySQL database password is exactly the same as the password set when the template was executed for the first time. Otherwise, the result of provisioning is unavailable.</b>
      zh-cn: |-
        长度为8~32位，需包含大写字母、小写字母、特殊字符和数字，允许的特殊字符包括<span style="background:#E7E9EB;"><b>!@#$%^&*()_+-=</b></span>。<br> 
        <b>如果您在同一台ECS实例上重复执行本教程的一键配置模板，请确保MySQL数据库密码和第一次执行模板时设置的密码完全一致。否则一键配置结果不可用。</b>

    AllowedPattern: ^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])((?=.*[!@#\$%\^&\*\(\)\-\+])|(?=.*[_\.,:;\-\?]))[a-zA-Z0-9!@#\$%\^&\*\(\)\-\+_\.,:;\-\?]{8,32}$
    NoEcho: true
    Confirm: true
Resources:
  DS_Instances:
    Type: DATASOURCE::ECS::Instances
    Properties:
      InstanceIds:
      - Ref: InstanceId
  WaitConditionHandle:
    Type: ALIYUN::ROS::WaitConditionHandle
    Properties: {}
  WaitCondition:
    Type: ALIYUN::ROS::WaitCondition
    Properties:
      Handle:
        Ref: WaitConditionHandle
      Timeout: 3720
      Count: 1
  SecurityGroupIngress_22:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Fn::Jq:
        - First
        - .[0].SecurityGroupIds[0]
        - Fn::GetAtt:
          - DS_Instances
          - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 22/22
  SecurityGroupIngress_80:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Fn::Jq:
        - First
        - .[0].SecurityGroupIds[0]
        - Fn::GetAtt:
          - DS_Instances
          - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 80/80
  SecurityGroupIngress_3306:
    Type: ALIYUN::ECS::SecurityGroupIngress
    Properties:
      SecurityGroupId:
        Fn::Jq:
        - First
        - .[0].SecurityGroupIds[0]
        - Fn::GetAtt:
          - DS_Instances
          - Instances
      SourceCidrIp: 0.0.0.0/0
      IpProtocol: tcp
      NicType: intranet
      PortRange: 3306/3306
  InstallLnmp:
    Type: ALIYUN::ECS::RunCommand
    Properties:
      InstanceIds:
      - Ref: InstanceId
      Type: RunShellScript
      Sync: true
      Timeout: 3600
      CommandContent:
        Fn::Sub: |-
          #!/bin/bash
          if [ ! -f .ros.provision ]; then
            echo "Name: 部署LNMP环境" > .ros.provision
          fi

          name=$(grep "^Name:" .ros.provision | awk -F':' '{print $2}' | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
          if [[ "$name" != "部署LNMP环境" ]]; then
            echo "当前实例已使用过\"$name\"教程的一键配置，不能再使用本教程的一键配置"
            ${WaitConditionHandle.CurlCli} --data-binary "{\"status\": \"FAILURE\", \"reason\": \"The current instance has already applied the configuration of the \\\"$name\\\" tutorial, and the configuration of this tutorial can no longer be applied.\"}"
            exit 0
          fi

          if ! grep -q "^Step1: Install Nginx$" .ros.provision; then
            echo "#########################"
            echo "# Install Nginx"
            echo "#########################"
            yum install -y gcc pcre pcre-devel zlib zlib-devel
            wget http://nginx.org/download/nginx-1.17.10.tar.gz
            tar -zxvf nginx-1.17.10.tar.gz
            cd nginx-1.17.10
            ./configure
            make && make install
            cd /usr/local/nginx/
            sbin/nginx
            cd
            echo "Step1: Install Nginx" >> .ros.provision
          else
            echo "#########################"
            echo "# Nginx has been installed"
            echo "#########################"
          fi

          if ! grep -q "^Step2: Install MySQL$" .ros.provision; then
            echo "#########################"
            echo "# Install MySQL"
            echo "#########################"
            wget http://dev.mysql.com/get/mysql57-community-release-el7-10.noarch.rpm
            yum install -y mysql57-community-release-el7-10.noarch.rpm
            yum install -y mysql-community-server --nogpgcheck
            systemctl start mysqld.service
            systemctl status mysqld.service
            export MYSQL_PWD=`grep "temporary password" /var/log/mysqld.log | awk '{print $NF}'`
            mysqladmin -uroot password '${DbPassword}'
            export MYSQL_PWD='${DbPassword}'
            mysql -uroot -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '${DbPassword}'"
            echo "Step2: Install MySQL" >> .ros.provision
          else
            echo "#########################"
            echo "# MySQL has been installed"
            echo "#########################"
          fi
          
          if ! grep -q "^Step3: Install PHP$" .ros.provision; then
            echo "#########################"
            echo "# Install PHP"
            echo "#########################"
            yum install -y php php-mysql php-fpm
            cat > /usr/local/nginx/conf/nginx.conf << \EOF
          #user  nobody;
          worker_processes  1;

          #error_log  logs/error.log;
          #error_log  logs/error.log  notice;
          #error_log  logs/error.log  info;

          #pid        logs/nginx.pid;


          events {
              worker_connections  1024;
          }


          http {
              include       mime.types;
              default_type  application/octet-stream;

              #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
              #                  '$status $body_bytes_sent "$http_referer" '
              #                  '"$http_user_agent" "$http_x_forwarded_for"';

              #access_log  logs/access.log  main;

              sendfile        on;
              #tcp_nopush     on;

              #keepalive_timeout  0;
              keepalive_timeout  65;

              #gzip  on;

              server {
                  listen       80;
                  server_name  localhost;

                  #charset koi8-r;

                  #access_log  logs/host.access.log  main;

                  location / {
                      root   html;
                      index  index.html index.htm index.php;
                      
                  }
                  if (!-e $request_filename) {
                      rewrite ^/(.*)$ /index.php/$1 last;
                  }

                  location ~ .*\.php(\/.*)*$ {
                      fastcgi_pass   127.0.0.1:9000;
                      include       fastcgi.conf;
                      fastcgi_index  index.php;
                  }

                  #error_page  404              /404.html;

                  # redirect server error pages to the static page /50x.html
                  #
                  error_page   500 502 503 504  /50x.html;
                  location = /50x.html {
                      root   html;
                  }

                  # proxy the PHP scripts to Apache listening on 127.0.0.1:80
                  #
                  #location ~ \.php$ {
                  #    proxy_pass   http://127.0.0.1;
                  #}

                  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
                  #
                  #location ~ \.php$ {
                  #    root           html;
                  #    fastcgi_pass   127.0.0.1:9000;
                  #    fastcgi_index  index.php;
                  #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
                  #    include        fastcgi_params;
                  #}

                  # deny access to .htaccess files, if Apache's document root
                  # concurs with nginx's one
                  #
                  #location ~ /\.ht {
                  #    deny  all;
                  #}
              }


              # another virtual host using mix of IP-, name-, and port-based configuration
              #
              #server {
              #    listen       8000;
              #    listen       somename:8080;
              #    server_name  somename  alias  another.alias;

              #    location / {
              #        root   html;
              #        index  index.html index.htm;
              #    }
              #}


              # HTTPS server
              #
              #server {
              #    listen       443 ssl;
              #    server_name  localhost;

              #    ssl_certificate      cert.pem;
              #    ssl_certificate_key  cert.key;

              #    ssl_session_cache    shared:SSL:1m;
              #    ssl_session_timeout  5m;

              #    ssl_ciphers  HIGH:!aNULL:!MD5;
              #    ssl_prefer_server_ciphers  on;

              #    location / {
              #        root   html;
              #        index  index.html index.htm;
              #    }
              #}

          }
          EOF
            systemctl restart php-fpm
            /usr/local/nginx/sbin/nginx -s reload
            echo "<?php phpinfo(); ?>" > /usr/local/nginx/html/phpinfo.php
            echo "Step3: Install PHP" >> .ros.provision
          else
            echo "#########################"
            echo "# PHP has been installed"
            echo "#########################"
          fi

          ${WaitConditionHandle.CurlCli} --data-binary '{"status": "SUCCESS"}'
    DependsOn:
    - SecurityGroupIngress_22
    - SecurityGroupIngress_80
    - SecurityGroupIngress_3306
Outputs:
  NginxUrl:
    Description:
      en: Nginx Info Page.
      zh-cn: Nginx信息页面。
    Value:
      Fn::Sub:
      - http://${IP}
      - IP:
          Fn::Jq:
          - First
          - if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress
            end
          - Fn::GetAtt:
            - DS_Instances
            - Instances
  PhpUrl:
    Description:
      en: PHP Info Page.
      zh-cn: PHP信息页面。
    Value:
      Fn::Sub:
      - http://${IP}/phpinfo.php
      - IP:
          Fn::Jq:
          - First
          - if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress
            end
          - Fn::GetAtt:
            - DS_Instances
            - Instances
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
    - Parameters:
      - InstanceId
      - DbPassword
    TemplateTags:
    - acs:document:试用教程:部署LNMP环境