productionServer.yml

---
# Deploy server(s) on Ubuntu 20.04.
# Set https_letsencrypt_enabled to True (variable is set in letsencrypt.yml) in production to ensure certbot
# handles the letsencrypt certificate setup
- hosts: uofa_omero
  vars:
    fqdn: "omerocloud.med.ualberta.ca"
    https_certificate_domain: "{{ fqdn | default('localhost') }}"
    postgresql_version: "12"
    omero_cli_duplicate_release: "{{ omero_cli_duplicate_release_override | default('0.4.0') }}"
    omero_metadata_release: "{{ omero_metadata_release_overrride | default('0.8.0') }}"
    omero_cli_render_release: "{{ omero_cli_render_release_override | default('0.7.0') }}"
    omero_server_certificate_directory: "/OMERO/certs"
    omero_server_system_managedrepo_group: managed_repo_group
    omero_server_datadir_chown: False
    omero_server_release: "{{ omero_server_release_override | default('5.6.3') }}"
    omero_web_release: "{{ omero_web_release_override | default('5.11.0') }}"
    omero_figure_release: "{{ omero_figure_release_override | default('4.4.1') }}"
    omero_fpbioimage_release: "{{ omero_fpbioimage_release_override | default('0.4.0') }}"
    omero_iviewer_release: "{{ omero_iviewer_release_override | default('0.10.2') }}"
    omero_mapr_release: "{{ omero_mapr_release_override | default('0.4.1') }}"
    omero_parade_release: "{{ omero_parade_release_override | default('0.2.1') }}"
    # The os_system_users_password default is "ome".
    # You may wish to change this variable,
    # or override it by defining the private variable os_system_users_password_override.
    os_system_users_password: "{{ os_system_users_password_override | default('$6$leKi5B1PgSvdA/ec$xbU3CnoSFnYdeZjEjKK5TH8SGATsW746uopssff4edpgyu.cWXGo9A.oK6wH9kIkxLCCNcORGZnnroZPMqGzN/') }}"    
    omero_server_config_set:
      omero.certificates.commonname: "{{ https_certificate_domain | default('localhost') }}"
      omero.client.icetransports: ssl,wss,tcp
#      omero.fs.watchDir: "/home/DropBox"
#      omero.fs.importArgs: "-T \"regex:^.*/(?<Container1>.*?)\""
      omero.pixeldata.max_projection_bytes: 536870912    #double the default size
      omero.db.poolsize: 60
      omero.jvmcfg.percent.blitz: 50
      omero.jvmcfg.percent.indexer: 20
      omero.jvmcfg.percent.pixeldata: 20
#      omero.fs.repo.path: "%user%_%userId%/%thread%//%year%-%month%/%day%/%time%"
      omero.glacier2.IceSSL.CertFile: "server.p12"
      omero.glacier2.IceSSL.Ciphers: "HIGH"
      omero.glacier2.IceSSL.DefaultDir: "{{omero_server_certificate_directory | default('/OMERO/certs') }}"
      omero.glacier2.IceSSL.Password: "secret"
      omero.glacier2.IceSSL.ProtocolVersionMax: "TLS1_2"
      omero.glacier2.IceSSL.ProtocolVersionMin: "TLS1_2"
      omero.glacier2.IceSSL.Protocols: "TLS1_2"
      omero.mail.config: true
      omero.mail.from: omero.notifications@gmail.com
      omero.mail.host: smtp.googlemail.com
      omero.mail.port: 587
      omero.mail.smtp.auth: true
      omero.mail.username: omero.notifications@gmail.com
      omero.mail.password: EdmontonMontrealOmero
      omero.mail.smtp.starttls.enable: true

    # Workaround lack of restriction on temp file sizes
    # https://github.com/ome/omero-web/issues/118
    # The downside is that it won't be automatically cleared out
    omero_server_systemd_environment:
      OMERO_TMPDIR: /opt/omero/server/tmp

 
    omero_web_apps_names:
      - omero_figure
      - omero_fpbioimage
      - omero_iviewer
      - omero_mapr
      - omero_parade
      - omero_webtagging_autotag
      - omero_webtagging_tagsearch
     

    # The omero_web_apps_* vars are used by the ome.omero_web role under
    # Python 3 otherwise ignored
    omero_web_apps_packages:
      - "omero-figure=={{ omero_figure_release }}"
      - "omero-fpbioimage=={{ omero_fpbioimage_release }}"
      - "omero-iviewer=={{ omero_iviewer_release }}"
      - "omero-mapr=={{ omero_mapr_release }}"
      - "omero-parade=={{ omero_parade_release }}"
      - "omero-webtagging-autotag=={{ omero_webtagging_autotag_release }}"
      - "omero-webtagging-tagsearch=={{ omero_webtagging_tagsearch_release }}"
 
    omero_web_apps_top_links:
      - label: Figure
        link: figure_index
        attrs:
          title: Open Figure in new tab
          target: _blank
      - label: Tag Search
        link: tagsearch
      - label: Key-Value
        link:
          viewname: maprindex_keyvalue
        attrs:
         title: Search for manually-added Key-Value pairs

    omero_web_apps_config_append:
      #omero.web.template_dirs: /opt/omero/web/OMERO.web/var/templates # location of custom_login_template
      omero.web.open_with:
        - - omero_figure
          - new_figure
          - supported_objects:
              - images
            target: _blank
            label: OMERO.figure
        - - omero_fpbioimage
          - fpbioimage_index
          - supported_objects:
              - image
            script_url: fpbioimage/openwith.js
            label: FPBioimage
        - - omero_iviewer
          - omero_iviewer_index
          - supported_objects:
              - images
              - dataset
              - well
            script_url: omero_iviewer/openwith.js
            label: OMERO.iviewer
            
      omero.web.mapr.config:
        - menu: keyvalue
          config:
            default:
            - Any Value
            all: []
            ns:
            - openmicroscopy.org/omero/client/mapAnnotation
            label: KeyValue
      
      omero.web.ui.center_plugins:
        - - Auto Tag
          - omero_webtagging_autotag/auto_tag_init.js.html
          - auto_tag_panel
        - - Parade
          - omero_parade/init.js.html
          - omero_parade

    omero_web_apps_config_set:
      omero.web.viewer.view: omero_iviewer.views.index
     

    ome_training_scripts_release: "{{ ome_training_scripts_release_override | default('0.7.3') }}"
    omero_webtagging_autotag_release: "{{ omero_webtagging_autotag_release_override | default('3.1.0') }}"
    omero_webtagging_tagsearch_release: "{{ omero_webtagging_tagsearch_release_override | default('3.1.0') }}"
    
    omero_web_config_set:
      omero.web.session_cookie_secure: true
      omero.web.csrf_cookie_secure: true
        # These logo locations/links are for the UofA.
      #omero.web.login_logo: "https://lh3.googleusercontent.com/iBRpWkVfDcpDaf8_43t8wX9m8uX8rPSGzWFO91wTCL3XEUpeuufDGlGDKc7KxvSeT6zDIprjxkcRAeArg5lGgH_joq1GwmTGWWYm7Wp7GKJ19e8aeBV_s1kT3CtPWTJzb9nzkM-w1-c=w2400"
      omero.web.top_logo: "https://lh3.googleusercontent.com/ZacQhsgB1SPMOKJqZLk1PaU0-nnSB0DqsjibD_g-3Qtv5jSBRQpoA6cCz22gHSfDJf-z70zCJDRM-ehpF5IUjdytrB7G67b9zrb27O1LMomhNVEEhcwiidDBlnf2yN4qi-EOk6s0G14=w2400"
      omero.web.top_logo_link: "https://www.ualberta.ca/index.html"
      
      #omero.web.index_template: "custom_login.html"
      #omero.web.login_view: "webindex_custom"
      
      omero.web.nginx_server_extra_config:
        - 'include /etc/nginx/conf.d-nested-includes/*.conf;'
        # TODO: Move the following into a shared variable
        - >
          location = /omero-ws {
            proxy_pass https://127.0.0.1:4066;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 86400;
          }
          
# The following variables are used for omero-py when creating importer-1 and omero-monitoring          
    omerodir: /opt/omero/server/OMERO.server
    venv_server: /opt/omero/server/venv3
    password: 'omero'
    omero_user: 'root'
    host: 'localhost'
  environment:
    OMERODIR: "{{ omerodir }}"
    PATH: "{{ venv_server }}/bin:{{ ansible_env.PATH }}"

          

  pre_tasks:
  
# Assume this is a new server, therefore no cert exists at:
# /etc/letsencrypt/live/{{ https_cert_domain }}. But, if I'm reusing this public IP, then
# there may already be a certificate. Normally, I copy the directory /etc/letsencrypt to
# the local path ./certs/{{ https_certificiate_domain}}, so I should check
# to see if this exists and register a variable of the result. Then,copy the certs to the 
# server so I don't use letsencrypt to generate another certificate for the same IP address.

    - name: check for local copy of cert
      stat:
        path: "./certs/{{ https_certificate_domain }}"
      delegate_to: 127.0.0.1  
      register: local_p
    - debug:
        msg: "Local Certificates Found! Let's see if we need to copy these to the server "
      when: local_p.stat.isdir is defined and local_p.stat.isdir  
    - debug:
        msg: "No Local Certificates Found! Let's see if there are any on the server."
      when: not (local_p.stat.isdir is defined and local_p.stat.isdir)  
      
    - name: Double check for certs on the server
      become: true
      stat:
        path: "/etc/letsencrypt/live"
      register: remote_p
    - debug:
        msg: "Certificate Directory found on server "
      when: remote_p.stat.isdir is defined and remote_p.stat.isdir  
    - debug:
        msg: "No Certificate directory found on server "
      when: not (remote_p.stat.isdir is defined and remote_p.stat.isdir)
      
    - name: Copy local certificate information to the server if it exists
      become: true
      ansible.posix.synchronize:
        src:  "./certs/{{ https_certificate_domain }}/"
        dest: /etc/letsencrypt/       
      when: # Both conditions below must be true for this task to execute
        - (not (remote_p.stat.isdir is defined and remote_p.stat.isdir))
        - (local_p.stat.isdir is defined and local_p.stat.isdir)
        
    - name: Copy remote certificate information from the server to a local location for future reference
      become: true
      ansible.posix.synchronize:
        mode: pull
        src: /etc/letsencrypt/
        dest: "./certs/{{ https_certificate_domain }}/"
      when:
        - (remote_p.stat.isdir is defined and remote_p.stat.isdir)
        - (not (local_p.stat.isdir is defined and local_p.stat.isdir))               

    - name: Update packages
      become: true
      import_tasks: updateAllPackages.yml
      
    - name: Install Prerequisites | unzip wget bc cron etc. 
      become: true
      apt:
        force_apt_get: true
        name:
          - mencoder  # for the make movie script
          - bzip2
          - screen    # bzip, screen, tmux and zsh installed by ome.cli_utils - but only for centos
          - tmux
          - zsh
          - unzip
          - wget
          - bc
          - cron
          - rdiff-backup # used to backup the /OMERO binary repository
          - openssl
        state: present
        
    # Since Nginx isn't installed until later the directories are created in advance
    - name: Create nginx include directories
      become: true
      file:
        path: "{{ item }}"
        recurse: yes
        state: directory
      with_items:
        - /etc/nginx/conf.d
        - /etc/nginx/conf.d-nested-includes

    - name: NGINX - websocket proxy support
      become: true
      template:
        src: ./templates/nginx-confd-websockets-conf.j2
        dest: /etc/nginx/conf.d/websockets.conf
      # Don't notify, nginx isn't installed yet
      
    - name: create letsencrypt challenge directory for later use
      become: true
      file:
        path: /srv/www/letsencrypt/.well-known/
        recurse: yes
        state: directory
      
                    
  roles:
    - role: sco.lvm_partition
      become: true
      lvm_lvname: omero
      lvm_lvmount: /OMERO
      lvm_lvsize: "{{ second_volume_size_gb }}"
      lvm_lvfilesystem: xfs
      lvm_vgname: VolGroup00
      lvm_vgdevice: "/dev/vdb"

            
    - role: ome.postgresql
      postgresql_databases:
      - name: omero
      postgresql_users:
      - user: omero
        password: omero
        databases: [omero]
        
        
# Explicitly install ome.ice to create the symlinks
    - role: ome.ice
      ice_binaries_symlink_dest: "/usr/local/bin"
      
#Install the OMERO.server into /opt/omero/server
# Also depends on roles - ome.ice, ome.java, ome.basedeps, ome.python3_virtualenv      
    - role: ome.omero_server
      omero_server_python_addons:
        - "omero-cli-duplicate=={{ omero_cli_duplicate_release }}"
        - "omero-cli-render=={{ omero_cli_render_release }}"
        - "omero-metadata=={{ omero_metadata_release }}"
        - reportlab
        - markdown
        - scipy
        # For "simple frap with figure" script
        - matplotlib
        
        
    - role: ome.postgresql_backup
      postgresql_backup_compress: true
      postgresql_backup_dir: "/OMERO/backups/database"
      postgresql_backup_filename_format: "nightly-omero-%Y%m%d-%H%M%S.pgdump.gz"
      postgresql_backup_minimum_expected_size: 100000      
        
        
#Install the OMERO.web into /opt/omero/web  
    - role: ome.omero_web
      omero_web_systemd_limit_nofile: 16384
    
    - role: sco.letsencrypt
      vars:
        https_letsencrypt_enabled: true
        https_certificate_domain: "{{ fqdn }}"
        letsencrypt_email: "sogg@ualberta.ca"
        https_letsencrypt_cert_path: "/etc/letsencrypt/live/{{ fqdn | default('localhost') }}"

    - role: sco.nginx_geoip
        
  tasks:
   #TODO move this to omero_config_set: variables for the ome.omero_web role
    - name: copy config file to server for custom login page configuration
      become: true
      copy:
        content: >
          # {{ ansible_managed }}
          config set omero.web.index_template "custom_login.html"
          config append omero.web.template_dirs '"/opt/omero/web/OMERO.web/var/templates"'
          config set omero.web.login_view "webindex_custom"
        dest: /opt/omero/web/config/web-custom-login.omero
        
    - name: Copy custom_login.html to /opt/omero/web/OMERO.web/var/templates
      become: true
      copy:
        src: ./files/custom_login.html
        dest: /opt/omero/web/OMERO.web/var/templates/custom_login.html
        owner: "omero-web"
        group: "omero-web"
        mode: 0664
         
      
    - name: Create a figure scripts directory
      become: true
      file:
        path: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Download the Figure_To_Pdf.py script
      become: true
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-figure/v{{ omero_figure_release }}/omero_figure/scripts/omero/figure_scripts/Figure_To_Pdf.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts/Figure_To_Pdf.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Create a workshop_scripts directory
      become: true
      file:
        path: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Download the Scipy_Gaussian_Filter.py script
      become: true
      get_url:
        url: https://raw.githubusercontent.com/ome/training-scripts/v{{ ome_training_scripts_release }}/practical/python/server/scipy_gaussian_filter.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/Scipy_Gaussian_Filter.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the simple_frap.py script
      become: true
      get_url:
        url: https://raw.githubusercontent.com/ome/training-scripts/v{{ ome_training_scripts_release }}/practical/python/server/simple_frap.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/simple_frap.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the simple_frap_with_figure.py script
      become: true
      get_url:
        url: https://raw.githubusercontent.com/ome/training-scripts/v{{ ome_training_scripts_release }}/practical/python/server/simple_frap_with_figure.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/simple_frap_with_figure.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes


    - name: Allow managed repo group to login
      become: true
      lineinfile:
        path: /etc/security/access.conf
        regexp: "{{ omero_server_system_managedrepo_group }}"
        insertbefore: BOF
        line: "+:{{ omero_server_system_managedrepo_group }}:ALL"
        
    - name: Create Importer-1, a restricted admin who can import others' data
      shell: "omero user add -a importer-1 importer-1 importer-1 system  -P ome --ignore-existing -s {{ host | quote }} -u {{ omero_user | quote }} --password {{ password | quote }}"
      
    - name: Retrieve importer-1's omero userid
      become: true
      become_user: postgres
      community.general.postgresql_query:
        db: omero
        query: "select id from experimenter where firstname = 'importer-1'"
      register: result
      tags: test
       
    - name: Use importer-1's id to set restrictions to only sudo so they can import data for others
      shell: "omero obj map-set Experimenter:{{result.query_result[0].id}} config AdminPrivilege:{{item}} false -s {{ host | quote }} -u {{ omero_user | quote }} --password {{ password | quote }}"
      tags: test
      with_items:
        - WriteOwned
        - WriteFile
        - WriteManagedRepo
        - DeleteOwned
        - DeleteFile
        - DeleteManagedRepo
        - Chgrp
        - Chown
        - ModifyGroup
        - ModifyUser
        - ModifyGroupMembership
        - WriteScriptRepo
    
    - name: Create omero-monitoring, a restricted admin who can export prometheus data
      shell: "omero user add -a omero-monitoring omero-monitoring omero-monitoring system  -P omero-monitoring --ignore-existing -s {{ host | quote }} -u {{ omero_user | quote }} --password {{ password | quote }}"
      
    - name: Retrieve omero-monitoring's omero userid
      become: true
      become_user: postgres
      community.general.postgresql_query:
        db: omero
        query: "select id from experimenter where firstname = 'omero-monitoring'"
      register: result
      tags: test
       
    - name: Use omero-monitoring's id to set restrictions to be a read-only light-admin
      shell: "omero obj map-set Experimenter:{{result.query_result[0].id}} config AdminPrivilege:{{item}} false -s {{ host | quote }} -u {{ omero_user | quote }} --password {{ password | quote }}"
      tags: test
      with_items:
        - Sudo
        - WriteOwned
        - WriteFile
        - WriteManagedRepo
        - DeleteOwned
        - DeleteFile
        - DeleteManagedRepo
        - Chgrp
        - Chown
        - ModifyGroup
        - ModifyUser
        - ModifyGroupMembership
        - WriteScriptRepo
        - DeleteScriptRepo

    # (Total cores / 2), leaving some for WSGI
    - name: NGINX - Performance tuning - worker processes
      become: true
      replace:
        dest: "/etc/nginx/nginx.conf"
        regexp: '^worker_processes\s+\d+;'
        replace: "worker_processes {{ ((ansible_processor_count * ansible_processor_cores) / 2) |round|int }};"

    # cf https://www.digitalocean.com/community/tutorials/how-to-optimize-nginx-configuration
    - name: NGINX - Performance tuning - worker connections
      become: true
      replace:
        path: "/etc/nginx/nginx.conf"
        regexp: 'worker_connections\s+\d+;'
        replace: "worker_connections 1024;"
        
    # Workaround lack of restriction on temp file sizes
    # https://github.com/ome/omero-web/issues/118
    # The downside is that it won't be automatically cleared out 
    - name: Create another temporary directory since OMERO doesn't limit sizes and fills up /tmp
      become: true
      file:
        path: "{{ omero_server_systemd_environment.OMERO_TMPDIR }}"
        state: directory
        mode: 0700
        owner: "{{ omero_server_system_user }}"