package seed import ( "strings" "ezops/model" "ezops/pkg/toolinstaller" "go.uber.org/zap" "golang.org/x/crypto/bcrypt" "gorm.io/gorm" ) // seedData 初始化种子数据（admin用户 + LDAP配置 + 审批模板 + 权限角色） func SeedData(db *gorm.DB) { // 1. 创建默认 admin 用户（仅首次） var userCount int64 db.Model(&model.User{}).Count(&userCount) if userCount == 0 { hashedPassword, _ := bcrypt.GenerateFromPassword([]byte("123456"), bcrypt.DefaultCost) admin := model.User{ Username: "admin", Password: string(hashedPassword), Email: "admin@ezops.local", RealName: "管理员", Status: 1, IsAdmin: true, AuthSource: "local", } if err := db.Create(&admin).Error; err != nil { zap.L().Warn("failed to seed admin user", zap.Error(err)) } else { zap.L().Info("seeded default admin user (admin/123456)") } } // 2. 创建默认 LDAP 配置 var ldapCount int64 db.Model(&model.LDAPConfig{}).Count(&ldapCount) if ldapCount == 0 { port := 389 useLDAPS := false searchFilter := "(objectClass=inetOrgPerson)" userMapping := `{"username":"uid","email":"mail","display_name":"cn"}` ldapCfg := model.LDAPConfig{ LDAPHost: "8.217.205.92", LDAPPort: &port, UseLDAPS: &useLDAPS, AdminDN: "cn=admin,dc=opsx,dc=vip", AdminPassword: "LQl2GX7EEg2N", BaseDN: "dc=opsx,dc=vip", SearchFilter: &searchFilter, UserMapping: &userMapping, } if err := db.Create(&ldapCfg).Error; err != nil { zap.L().Warn("failed to seed LDAP config", zap.Error(err)) } else { zap.L().Info("seeded default LDAP config (8.217.205.92:389)") } } // 3. 创建默认审批模板（资源申请） var tplCount int64 db.Model(&model.ApprovalTemplate{}).Count(&tplCount) if tplCount == 0 { templates := []model.ApprovalTemplate{ { Name: "云服务器申请", Code: "server_apply", Description: "申请云服务器资源（ECS/EC2），包含规格、数量、用途等信息", Type: "server_apply", Category: "resource", FormSchema: `{ "fields": [ {"key": "provider", "label": "云厂商", "type": "select", "options": ["阿里云","腾讯云","华为云","AWS"], "required": true}, {"key": "region", "label": "地域", "type": "text", "placeholder": "如 cn-hangzhou", "required": true}, {"key": "spec", "label": "规格", "type": "select", "options": ["2C4G","4C8G","8C16G","16C32G","32C64G"], "required": true}, {"key": "disk", "label": "系统盘(GB)", "type": "number", "default": 40, "required": true}, {"key": "count", "label": "数量(台)", "type": "number", "default": 1, "required": true}, {"key": "duration", "label": "时长", "type": "select", "options": ["1个月","3个月","6个月","1年"], "required": true}, {"key": "purpose", "label": "用途说明", "type": "textarea", "required": true} ] }`, FlowConfig: `[{"name":"直接主管","approver_role":"team_lead","step_type":"audit"},{"name":"运维负责人","approver_role":"ops_manager","step_type":"audit"},{"name":"运维执行","approver_role":"ops_manager","step_type":"execute"}]`, Enabled: true, }, { Name: "应用部署申请", Code: "app_deploy", Description: "申请新应用部署，包含 Git 地址、端口、Nacos 等配置信息", Type: "app_deploy", Category: "app", FormSchema: `{ "fields": [ {"key": "app_name", "label": "应用名称", "type": "text", "placeholder": "如 user-service", "required": true}, {"key": "git_url", "label": "Git 地址", "type": "text", "placeholder": "如 https://github.com/org/repo.git", "required": true}, {"key": "branch", "label": "分支", "type": "text", "default": "main", "required": true}, {"key": "language", "label": "开发语言", "type": "select", "options": ["Java","Go","Python","Node.js","C++"], "required": true}, {"key": "http_port", "label": "HTTP 端口", "type": "number", "placeholder": "如 8080", "required": false}, {"key": "grpc_port", "label": "gRPC 端口", "type": "number", "placeholder": "如 9090", "required": false}, {"key": "nacos_addr", "label": "Nacos 地址", "type": "text", "placeholder": "如 nacos.opsx.vip:8848", "required": true}, {"key": "nacos_namespace", "label": "Nacos 命名空间", "type": "text", "placeholder": "如 production", "required": false}, {"key": "env", "label": "部署环境", "type": "select", "options": ["dev","staging","prod"], "required": true}, {"key": "replicas", "label": "副本数", "type": "number", "default": 2, "required": true}, {"key": "remark", "label": "备注", "type": "textarea", "required": false} ] }`, FlowConfig: `[{"name":"技术负责人","approver_role":"tech_lead","step_type":"audit"},{"name":"运维负责人","approver_role":"ops_manager","step_type":"audit"},{"name":"部署执行","approver_role":"ops_manager","step_type":"execute"}]`, Enabled: true, }, { Name: "权限申请", Code: "permission_request", Description: "申请堡垒机、生产VPN、日志查询、数据查询等运维权限", Type: "permission_request", Category: "permission", FormSchema: `{ "fields": [ {"key": "perm_type", "label": "权限类型", "type": "select", "options": ["堡垒机权限","生产VPN权限","日志查询权限","数据库查询权限","服务器SSH权限","K8s集群权限"], "required": true}, {"key": "target", "label": "目标资源", "type": "text", "placeholder": "如 生产环境服务器 10.10.10.x / k8s-prod 集群", "required": true}, {"key": "account", "label": "申请账号", "type": "text", "placeholder": "如 logan.li", "required": true}, {"key": "reason", "label": "申请理由", "type": "textarea", "placeholder": "说明为什么需要该权限", "required": true}, {"key": "duration", "label": "权限时长", "type": "select", "options": ["临时(24小时)","短期(7天)","中期(30天)","长期(90天)","永久"], "required": true}, {"key": "dept", "label": "所属部门", "type": "text", "placeholder": "如 基础架构部", "required": true} ] }`, FlowConfig: `[{"name":"直接主管","approver_role":"team_lead","step_type":"audit"},{"name":"安全负责人","approver_role":"security_lead","step_type":"audit"},{"name":"权限开通","approver_role":"ops_manager","step_type":"execute"}]`, Enabled: true, }, } if err := db.Create(&templates).Error; err != nil { zap.L().Warn("failed to seed approval templates", zap.Error(err)) } else { zap.L().Info("seeded default approval templates (server_apply + app_deploy + permission_request)") } } // 4. 创建默认权限和角色权限映射 var permCount int64 db.Model(&model.Permission{}).Count(&permCount) if permCount == 0 { perms := []model.Permission{ // 资产管理 {Name: "服务器管理", Code: "server:view", Type: "menu", Sort: 1, Status: 1}, {Name: "服务器创建", Code: "server:create", Type: "button", Sort: 2, Status: 1}, {Name: "服务器编辑", Code: "server:update", Type: "button", Sort: 3, Status: 1}, {Name: "服务器删除", Code: "server:delete", Type: "button", Sort: 4, Status: 1}, {Name: "WebShell终端", Code: "server:webshell", Type: "button", Sort: 5, Status: 1}, // 云资源 {Name: "云账号管理", Code: "cloud:account", Type: "menu", Sort: 10, Status: 1}, {Name: "域名管理", Code: "cloud:domain", Type: "menu", Sort: 11, Status: 1}, {Name: "云账单", Code: "cloud:billing", Type: "menu", Sort: 12, Status: 1}, // Kubernetes {Name: "集群管理", Code: "k8s:cluster", Type: "menu", Sort: 20, Status: 1}, {Name: "节点管理", Code: "k8s:nodes", Type: "menu", Sort: 21, Status: 1}, {Name: "工作负载", Code: "k8s:workloads", Type: "menu", Sort: 22, Status: 1}, {Name: "架构拓扑", Code: "k8s:topology", Type: "menu", Sort: 23, Status: 1}, // 应用发布 {Name: "流水线", Code: "deploy:pipeline", Type: "menu", Sort: 30, Status: 1}, {Name: "应用发布", Code: "deploy:release", Type: "menu", Sort: 31, Status: 1}, // 监控告警 {Name: "告警中心", Code: "monitor:alert", Type: "menu", Sort: 40, Status: 1}, {Name: "告警规则", Code: "monitor:rule", Type: "button", Sort: 41, Status: 1}, {Name: "Agent监控", Code: "agent:monitor", Type: "menu", Sort: 42, Status: 1}, {Name: "Agent告警", Code: "agent:alert", Type: "menu", Sort: 43, Status: 1}, // 自动化运维 {Name: "定时任务", Code: "auto:cron", Type: "menu", Sort: 50, Status: 1}, {Name: "脚本管理", Code: "auto:script", Type: "menu", Sort: 51, Status: 1}, {Name: "远程执行", Code: "auto:ansible", Type: "menu", Sort: 52, Status: 1}, // AIOps {Name: "智能助手", Code: "aiops:assistant", Type: "menu", Sort: 60, Status: 1}, {Name: "告警分析", Code: "aiops:analysis", Type: "menu", Sort: 61, Status: 1}, {Name: "容量预测", Code: "aiops:forecast", Type: "menu", Sort: 62, Status: 1}, {Name: "Agent CLI", Code: "aiops:agent-cli", Type: "menu", Sort: 63, Status: 1}, {Name: "大模型设置", Code: "aiops:llm-config", Type: "menu", Sort: 64, Status: 1}, // 资源申请 {Name: "资源申请", Code: "approval:apply", Type: "menu", Sort: 70, Status: 1}, {Name: "审批管理", Code: "approval:manage", Type: "button", Sort: 71, Status: 1}, // 系统管理 {Name: "用户管理", Code: "system:user", Type: "menu", Sort: 80, Status: 1}, {Name: "角色权限", Code: "system:role", Type: "menu", Sort: 81, Status: 1}, {Name: "操作审计", Code: "system:audit", Type: "menu", Sort: 82, Status: 1}, {Name: "LDAP配置", Code: "system:ldap", Type: "menu", Sort: 83, Status: 1}, // 仪表盘 {Name: "仪表盘", Code: "dashboard:view", Type: "menu", Sort: 90, Status: 1}, // 安全审计 {Name: "终端审计", Code: "audit:terminal", Type: "menu", Sort: 91, Status: 1}, {Name: "操作审计", Code: "audit:operations", Type: "menu", Sort: 92, Status: 1}, {Name: "登录日志", Code: "audit:login-logs", Type: "menu", Sort: 93, Status: 1}, {Name: "会话阻断", Code: "audit:kill-session", Type: "button", Sort: 94, Status: 1}, } db.Create(&perms) zap.L().Info("seeded default permissions") } // 5. 创建默认角色（如果不存在） var roleCount int64 db.Model(&model.Role{}).Count(&roleCount) if roleCount == 0 { roles := []model.Role{ {Name: "超级管理员", Code: "super_admin", Description: "系统最高权限，管理所有资源和配置", Status: 1, IsSystem: true}, {Name: "Kubernetes管理员", Code: "k8s_admin", Description: "管理K8s集群、节点、工作负载和存储", Status: 1, IsSystem: true}, {Name: "资源管理员", Code: "resource_admin", Description: "管理服务器、云账号、域名和云资源", Status: 1, IsSystem: true}, {Name: "监控管理员", Code: "monitor_admin", Description: "管理告警、监控指标和采集Agent", Status: 1, IsSystem: true}, {Name: "安全审计员", Code: "security_auditor", Description: "审计终端会话、操作日志和登录记录", Status: 1, IsSystem: true}, {Name: "发布管理员", Code: "release_admin", Description: "管理流水线、应用发布和审批流程", Status: 1, IsSystem: true}, {Name: "只读用户", Code: "viewer", Description: "仅查看仪表盘和资源概览，无操作权限", Status: 1, IsSystem: true}, } db.Create(&roles) zap.L().Info("seeded 7 system default roles") // 为各角色分配权限 var allPerms []model.Permission db.Find(&allPerms) for _, role := range roles { var permIds []uint switch role.Code { case "super_admin": for _, p := range allPerms { permIds = append(permIds, p.ID) } case "k8s_admin": k8sPrefixes := []string{"k8s:", "server:webshell", "dashboard:view", "deploy:"} for _, p := range allPerms { for _, pre := range k8sPrefixes { if strings.HasPrefix(p.Code, pre) { permIds = append(permIds, p.ID) break } } } case "resource_admin": resPrefixes := []string{"server:", "cloud:", "dashboard:view", "k8s:topology"} for _, p := range allPerms { for _, pre := range resPrefixes { if strings.HasPrefix(p.Code, pre) { permIds = append(permIds, p.ID) break } } } case "monitor_admin": monPrefixes := []string{"monitor:", "agent:", "dashboard:view", "server:view"} for _, p := range allPerms { for _, pre := range monPrefixes { if strings.HasPrefix(p.Code, pre) { permIds = append(permIds, p.ID) break } } } case "security_auditor": auditPrefixes := []string{"audit:", "dashboard:view", "server:view", "system:audit"} for _, p := range allPerms { for _, pre := range auditPrefixes { if strings.HasPrefix(p.Code, pre) { permIds = append(permIds, p.ID) break } } } case "release_admin": relPrefixes := []string{"deploy:", "approval:", "dashboard:view", "server:view", "k8s:cluster", "k8s:workloads"} for _, p := range allPerms { for _, pre := range relPrefixes { if strings.HasPrefix(p.Code, pre) { permIds = append(permIds, p.ID) break } } } case "viewer": for _, p := range allPerms { if p.Code == "dashboard:view" || p.Code == "server:view" || p.Code == "monitor:alert" || p.Code == "k8s:cluster" || p.Code == "k8s:topology" || p.Code == "cloud:billing" || p.Code == "deploy:pipeline" { permIds = append(permIds, p.ID) } } } if len(permIds) > 0 { permIds = dedupeUint(permIds) var rolePerms []model.Permission db.Where("id IN ?", permIds).Find(&rolePerms) db.Model(&role).Association("Permissions").Append(rolePerms) } } } // 6. 创建默认 Ansible Playbook 模板（15 个高频运维场景）// Logan.Li var pbCount int64 db.Model(&model.AnsiblePlaybook{}).Count(&pbCount) if pbCount == 0 { playbooks := []model.AnsiblePlaybook{ {Name: "系统信息收集", Description: "收集主机基本信息：OS、内核、CPU、内存、磁盘、网络接口", Category: "maintenance", Tags: `["系统信息","诊断","基础"]`, Content: `--- - name: 系统信息收集 hosts: all gather_facts: yes tasks: - name: 系统基本信息 debug: msg: - "主机: {{ ansible_hostname }}" - "OS: {{ ansible_distribution }} {{ ansible_distribution_version }}" - "内核: {{ ansible_kernel }} ({{ ansible_architecture }})" - "CPU: {{ ansible_processor_vcpus }} 核" - "内存: {{ (ansible_memtotal_mb / 1024) | round(1) }} GB" - name: 磁盘使用率 shell: df -h / | tail -1 | awk '{print $5}' register: disk_pct - name: 系统负载 shell: uptime register: load - name: 运行摘要 debug: msg: "磁盘: {{ disk_pct.stdout }} | 负载: {{ load.stdout.split('load average:')[1].strip() if 'load average:' in load.stdout else 'N/A' }}"`, CreatedBy: "system"}, {Name: "系统安全更新", Description: "安装系统安全补丁（自动识别 apt/yum/dnf）", Category: "security", Tags: `["安全","更新","补丁"]`, Content: `--- - name: 系统安全更新 hosts: all become: yes tasks: - name: 检测包管理器 shell: which apt yum dnf 2>/dev/null | head -1 | xargs basename register: pkg_mgr - name: 更新软件包 (APT) apt: update_cache=yes upgrade=safe when: pkg_mgr.stdout == "apt" - name: 更新软件包 (YUM/DNF) shell: "{{ pkg_mgr.stdout }} update -y --security" when: pkg_mgr.stdout in ["yum", "dnf"] - name: 检查重启需求 shell: test -f /var/run/reboot-required && echo "需要重启" || echo "无需重启" register: reboot - name: 更新完成 debug: msg="更新完成，{{ reboot.stdout }}"`, CreatedBy: "system"}, {Name: "磁盘空间清理", Description: "清理日志、临时文件、Docker 缓存、包管理器缓存", Category: "maintenance", Tags: `["磁盘","清理","维护"]`, Content: `--- - name: 磁盘空间清理 hosts: all become: yes tasks: - name: 清理前磁盘使用 shell: df -h / | awk 'NR==2{print "使用率:",$5,"可用:",$4}' register: before - name: 清理30天前日志 shell: find /var/log -type f \( -name "*.log" -o -name "*.gz" \) -mtime +30 -delete 2>/dev/null; echo "done" - name: 清理临时文件 shell: find /tmp /var/tmp -type f -mtime +7 -delete 2>/dev/null; echo "done" - name: 清理 journald (保留3天) shell: journalctl --vacuum-time=3d 2>/dev/null || true - name: 清理包管理器缓存 shell: (apt-get clean 2>/dev/null || yum clean all 2>/dev/null || dnf clean all 2>/dev/null); echo "done" - name: 清理 Docker (如有) shell: docker system prune -af 2>/dev/null || true - name: 清理后磁盘使用 shell: df -h / | awk 'NR==2{print "使用率:",$5,"可用:",$4}' register: after - name: 清理摘要 debug: msg="清理前 - {{ before.stdout }} | 清理后 - {{ after.stdout }}"`, CreatedBy: "system"}, {Name: "服务状态巡检", Description: "检查关键服务状态，自动启动已停止的服务", Category: "maintenance", Tags: `["服务","巡检","重启"]`, Content: `--- - name: 服务状态巡检 hosts: all become: yes vars: services: [nginx, docker, sshd, cron, rsyslog] tasks: - name: 收集服务状态 service_facts: - name: 检查并启动服务 service: name: "{{ item }}" state: started loop: "{{ services }}" when: item in ansible_facts.services - name: 显示服务状态 debug: msg: "{{ item }}: {{ ansible_facts.services[item].state if item in ansible_facts.services else '未安装' }}" loop: "{{ services }}" - name: 检查关键端口 shell: ss -tlnp | awk '{print $4}' | grep -E ':22$|:80$|:443$' register: ports - name: 端口监听 debug: msg="监听端口: {{ ports.stdout_lines }}"`, CreatedBy: "system"}, {Name: "用户与SSH管理", Description: "创建运维用户、配置SSH密钥、禁用root密码登录", Category: "security", Tags: `["用户","SSH","安全"]`, Content: `--- - name: 用户与SSH管理 hosts: all become: yes vars: ops_user: devops ops_ssh_key: "" tasks: - name: 创建运维用户 user: name={{ ops_user }} shell=/bin/bash groups=sudo append=yes state=present - name: 配置SSH密钥 authorized_key: user={{ ops_user }} key="{{ ops_ssh_key }}" state=present when: ops_ssh_key != "" - name: sudo免密 copy: content="{{ ops_user }} ALL=(ALL) NOPASSWD:ALL" dest=/etc/sudoers.d/{{ ops_user }} validate="visudo -cf %s" - name: 禁用root密码登录 lineinfile: path=/etc/ssh/sshd_config regexp="^PermitRootLogin" line="PermitRootLogin prohibit-password" notify: reload sshd - name: 可登录用户列表 shell: awk -F: '$$7 !~ /(false|nologin)/ {print $$1}' /etc/passwd register: users - name: 用户摘要 debug: msg="可登录用户: {{ users.stdout_lines }}" handlers: - name: reload sshd service: name=sshd state=reloaded`, CreatedBy: "system"}, {Name: "Nginx配置检查", Description: "检查Nginx语法、显示虚拟主机、执行重载", Category: "configuration", Tags: `["Nginx","配置","Web"]`, Content: `--- - name: Nginx配置管理 hosts: all become: yes tasks: - name: Nginx状态 shell: nginx -v 2>&1 || echo "未安装" register: nginx_ver - name: 配置语法检查 shell: nginx -t 2>&1 register: nginx_test when: "'nginx' in nginx_ver.stdout" - name: 列出站点 shell: ls /etc/nginx/sites-enabled/ 2>/dev/null || ls /etc/nginx/conf.d/ 2>/dev/null register: sites - name: 重载Nginx service: name=nginx state=reloaded when: nginx_test.stdout is defined and 'successful' in nginx_test.stdout - name: 检查监听端口 shell: ss -tlnp | grep nginx register: nginx_ports - name: 配置摘要 debug: msg: - "版本: {{ nginx_ver.stdout }}" - "站点: {{ sites.stdout_lines }}" - "端口: {{ nginx_ports.stdout }}"`, CreatedBy: "system"}, {Name: "SSL证书检查", Description: "检查本地证书和HTTPS证书到期时间", Category: "security", Tags: `["SSL","证书","HTTPS"]`, Content: `--- - name: SSL证书到期检查 hosts: all vars: domains: [] tasks: - name: 本地证书检查 shell: | for f in /etc/nginx/ssl/*.crt /etc/letsencrypt/live/*/fullchain.pem 2>/dev/null; do [ -f "$$f" ] && echo "$$f: $$(openssl x509 -enddate -noout -in "$$f" | cut -d= -f2)" done register: local_certs - name: 远程HTTPS检查 shell: | for d in {% for d in target_hosts.split(',') %}{{ d }} {% endfor %}; do expiry=$$(echo | openssl s_client -servername "$$d" -connect "$$d:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2) [ -n "$$expiry" ] && echo "$$d: $$expiry" done register: remote_certs when: target_hosts is defined - name: 证书到期列表 debug: msg: - "本地: {{ local_certs.stdout_lines }}" - "远程: {{ remote_certs.stdout_lines | default([]) }}"`, CreatedBy: "system"}, {Name: "配置文件备份", Description: "备份关键配置到压缩包", Category: "backup", Tags: `["备份","配置"]`, Content: `--- - name: 配置备份 hosts: all become: yes vars: backup_dir: "/tmp/config-backup-{{ ansible_date_time.date }}" tasks: - name: 创建备份目录 file: path={{ backup_dir }} state=directory mode=0700 - name: 备份关键配置 archive: path: "{{ item }}" dest: "{{ backup_dir }}/{{ item | basename | replace('/', '_') }}.tar.gz" loop: [/etc/nginx, /etc/ssh/sshd_config, /etc/fstab, /etc/hosts] ignore_errors: yes - name: 备份crontab shell: crontab -l > {{ backup_dir }}/crontab.txt 2>/dev/null || true - name: 备份汇总 shell: du -sh {{ backup_dir }} register: size - name: 备份完成 debug: msg="备份: {{ backup_dir }} ({{ size.stdout.split()[0] }})"`, CreatedBy: "system"}, {Name: "进程健康诊断", Description: "CPU/内存TOP10、僵尸进程、进程总数", Category: "monitoring", Tags: `["进程","性能","诊断"]`, Content: `--- - name: 进程健康诊断 hosts: all tasks: - name: CPU TOP10 shell: ps aux --sort=-%cpu | head -11 register: cpu - name: 内存 TOP10 shell: ps aux --sort=-%mem | head -11 register: mem - name: 僵尸进程 shell: ps aux | awk '$$8=="Z"' || echo "无僵尸进程" register: zombies - name: 进程总数 shell: ps aux | wc -l register: total - name: 诊断摘要 debug: msg: - "总进程: {{ total.stdout }} | 僵尸: {{ zombies.stdout_lines | length }}" - "=== CPU TOP10 ===" - "{{ cpu.stdout }}" - "=== 内存 TOP10 ===" - "{{ mem.stdout }}"`, CreatedBy: "system"}, {Name: "Docker环境清理", Description: "清理未使用容器、镜像、构建缓存和网络", Category: "maintenance", Tags: `["Docker","清理","容器"]`, Content: `--- - name: Docker环境清理 hosts: all become: yes tasks: - name: 检查Docker shell: docker --version 2>/dev/null || echo "NONE" register: dk - name: Docker资源概览 shell: | echo "容器:" && docker ps -a --format "table {{.Names}} {{.Status}}" 2>/dev/null echo "镜像:" && docker images --format "table {{.Repository}} {{.Size}}" 2>/dev/null register: status when: dk.stdout != "NONE" - name: 清理停止容器 shell: docker container prune -f when: dk.stdout != "NONE" - name: 清理未用镜像 shell: docker image prune -a -f when: dk.stdout != "NONE" - name: 清理构建缓存 shell: docker builder prune -f when: dk.stdout != "NONE" - name: 清理未用网络/卷 shell: docker system prune -f --volumes when: dk.stdout != "NONE" - name: 清理完成 debug: msg="Docker清理完成"`, CreatedBy: "system"}, {Name: "防火墙规则管理", Description: "查看/配置防火墙规则（ufw/firewalld/iptables）", Category: "security", Tags: `["防火墙","安全","网络"]`, Content: `--- - name: 防火墙规则管理 hosts: all become: yes vars: open_ports: [22, 80, 443] tasks: - name: 防火墙类型 shell: | ufw status 2>/dev/null | grep -q "active" && echo ufw && exit firewall-cmd --state 2>/dev/null | grep -q "running" && echo firewalld && exit echo iptables register: fw - name: 当前规则 shell: | case {{ fw.stdout }} in ufw) ufw status verbose ;; firewalld) firewall-cmd --list-all ;; *) iptables -L -n ;; esac register: rules - name: 开放端口(UFW) ufw: rule=allow port={{ item }} proto=tcp loop: "{{ open_ports }}" when: fw.stdout == "ufw" - name: 开放端口(firewalld) firewalld: port={{ item }}/tcp permanent=yes state=enabled immediate=yes loop: "{{ open_ports }}" when: fw.stdout == "firewalld" - name: 防火墙规则 debug: msg="{{ rules.stdout }}"`, CreatedBy: "system"}, {Name: "时间同步检查", Description: "检查NTP/Chrony同步状态和时间一致性", Category: "configuration", Tags: `["时间","NTP","同步"]`, Content: `--- - name: 时间同步检查 hosts: all become: yes tasks: - name: 当前时间 shell: date '+%Y-%m-%d %H:%M:%S %Z' register: now - name: 同步服务 shell: | systemctl is-active chronyd 2>/dev/null && echo "chronyd" || systemctl is-active ntpd 2>/dev/null && echo "ntpd" || systemctl is-active systemd-timesyncd 2>/dev/null && echo "timesyncd" || echo "未配置" register: svc - name: 同步状态 shell: | case {{ svc.stdout }} in chronyd) chronyc tracking 2>/dev/null | grep -E "Stratum|System time" ;; ntpd) ntpq -p 2>/dev/null | tail -5 ;; timesyncd) timedatectl show-timesync 2>/dev/null ;; *) echo "未同步" ;; esac register: sync - name: 时间摘要 debug: msg: "时间: {{ now.stdout }} | 服务: {{ svc.stdout }} | {{ sync.stdout }}"`, CreatedBy: "system"}, {Name: "日志轮转配置", Description: "安装logrotate并配置应用日志轮转策略", Category: "configuration", Tags: `["日志","轮转","logrotate"]`, Content: `--- - name: 日志轮转配置 hosts: all become: yes vars: log_path: /var/log/app keep_days: 30 tasks: - name: 安装logrotate package: name=logrotate state=present - name: 应用日志轮转 copy: dest: /etc/logrotate.d/app-logs content: | {{ log_path }}/*.log { daily rotate {{ keep_days }} missingok notifempty compress delaycompress sharedscripts postrotate systemctl reload app 2>/dev/null || true endscript } - name: 测试配置 shell: logrotate -d /etc/logrotate.conf 2>&1 | head -10 register: test - name: 配置完成 debug: msg="Logrotate已配置 | {{ test.stdout }}"`, CreatedBy: "system"}, {Name: "内核参数调优", Description: "优化网络/内存/文件句柄等内核参数", Category: "configuration", Tags: `["内核","优化","性能"]`, Content: `--- - name: 内核参数调优 hosts: all become: yes tasks: - name: 网络参数优化 sysctl: name: "{{ item.name }}" value: "{{ item.value }}" state: present reload: yes loop: - { name: net.core.somaxconn, value: '65535' } - { name: net.ipv4.tcp_tw_reuse, value: '1' } - { name: net.ipv4.tcp_fin_timeout, value: '30' } - name: 内存参数 sysctl: name=vm.swappiness value=10 state=present reload=yes - name: 文件句柄 sysctl: name=fs.file-max value=655350 state=present reload=yes - name: limits.conf pam_limits: domain: '*' limit_type: "{{ item.t }}" limit_item: "{{ item.i }}" value: "{{ item.v }}" loop: - { t: soft, i: nofile, v: '65535' } - { t: hard, i: nofile, v: '65535' } - name: 调优完成 debug: msg="内核参数已优化"`, CreatedBy: "system"}, {Name: "网络连通性诊断", Description: "DNS解析、Ping延迟、端口检测、路由追踪", Category: "monitoring", Tags: `["网络","诊断","连通性"]`, Content: `--- - name: 网络诊断 hosts: all vars: targets: [8.8.8.8, 1.1.1.1] domains: [baidu.com] tasks: - name: DNS解析 shell: | for d in {% for d in domains %}{{ d }} {% endfor %}; do echo "$$d: $$(nslookup $$d 2>/dev/null | awk '/^Address/{print $$2}' | tail -1 || echo 'FAIL')" done register: dns - name: Ping延迟 shell: ping -c 2 -W 2 {{ item }} 2>&1 | tail -1 loop: "{{ targets }}" register: ping - name: 端口检测 shell: timeout 2 bash -c "echo >/dev/tcp/{{ item }}/53" 2>/dev/null && echo "{{ item }}:53 OK" || echo "{{ item }}:53 FAIL" loop: "{{ targets }}" register: port - name: 诊断结果 debug: msg: - "=== DNS ===" - "{{ dns.stdout_lines }}" - "=== Ping ===" - "{{ ping.results | map(attribute='stdout') }}" - "=== 端口 ===" - "{{ port.results | map(attribute='stdout') }}"`, CreatedBy: "system"}, } if err := db.Create(&playbooks).Error; err != nil { zap.L().Warn("failed to seed playbook templates", zap.Error(err)) } else { zap.L().Info("seeded 15 Ansible playbook templates (deprecated — replaced by remote exec)") } } // 7. 种子工具配置（kubectl/maven/node/ansible/git/docker）// Logan.Li ti := toolinstaller.New(db) ti.SeedTools() } // dedupeUint 去重 uint 切片 func dedupeUint(slice []uint) []uint { seen := make(map[uint]bool) result := make([]uint, 0, len(slice)) for _, v := range slice { if !seen[v] { seen[v] = true result = append(result, v) } } return result }