# 配置Prometheus
$ cat > prometheus.yml << 'EOF' global: scrape_interval: 15s scrape_configs: - job_name: 'prometheus' static_configs: - targets: ['fgedudb:9090'] - job_name: 'node_exporter' static_configs: - targets: ['fgedudb:9100'] - job_name: 'nginx' static_configs: - targets: ['fgedudb:9113'] - job_name: 'mysql' static_configs: - targets: ['fgedudb:9104'] EOF # 安装Grafana $ wget https://dl.grafana.com/oss/release/grafana_8.2.0_amd64.deb $ sudo dpkg -i grafana_8.2.0_amd64.deb $ sudo systemctl start grafana-server $ sudo systemctl enable grafana-server

# 验证Grafana
$ curl -I http://fgedudb:3000
HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/html; charset=UTF-8
Date: Thu, 03 Apr 2026 10:00:00 GMT

# 配置Ansible inventory
$ cat > /etc/ansible/hosts << 'EOF' [web_servers] web1 ansible_host=192.168.1.101 web2 ansible_host=192.168.1.102 [db_servers] db1 ansible_host=192.168.1.201 [all:vars] ansible_user=ubuntu ansible_ssh_private_key_file=/home/ubuntu/.ssh/id_rsa EOF # 创建Ansible playbook $ cat > deploy_web.yml << 'EOF' --- - hosts: web_servers become: yes tasks: - name: Update apt cache apt: update_cache: yes - name: Install Nginx apt: name: nginx state: present - name: Start Nginx service service: name: nginx state: started enabled: yes - name: Copy index.html copy: src: files/index.html dest: /var/www/html/index.html EOF # 执行Ansible playbook $ ansible-playbook deploy_web.yml PLAY [web_servers] ***************************************************************** TASK [Gathering Facts] ************************************************************* ok: [web1] ok: [web2] TASK [Update apt cache] ************************************************************* ok: [web1] ok: [web2] TASK [Install Nginx] **************************************************************** ok: [web1] ok: [web2] TASK [Start Nginx service] ********************************************************** ok: [web1] ok: [web2] TASK [Copy index.html] ************************************************************** ok: [web1] ok: [web2] PLAY RECAP ************************************************************************* web1 : ok=5 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 web2 : ok=5 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

# 验证防火墙配置
$ sudo firewall-cmd –list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: ssh dhcpv6-client http https
ports: 22/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

# 安装并配置Fail2ban
$ sudo apt install fail2ban -y
$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
$ sudo systemctl start fail2ban
$ sudo systemctl enable fail2ban

# 验证Fail2ban状态
$ sudo systemctl status fail2ban
● fail2ban.service – Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2026-04-03 11:00:00 UTC; 5min ago
Docs: man:fail2ban(1)
Main PID: 12345 (fail2ban-server)
Tasks: 5
Memory: 10.0M
CGroup: /system.slice/fail2ban.service
└─12345 /usr/bin/python3 /usr/bin/fail2ban-server -xf start