trainingServer.yml

---
# Deploy training server(s) on Ubuntu 20.04. First task creates and launches an instance.
# Set https_letsencrypt_enabled to True (variable is set in letsencrypt.yml) in production to ensure certbot
# handles the letsencrypt certificate setup

- hosts: omero_training   # this is defined as 206.12.95.221 in the inventory
  gather_facts: False
  vars:
    create_second_volume: false
    https_certificate_domain: "206-12-95-221.cloud.computecanada.ca"
    postgresql_version: "12"
    omero_cli_duplicate_release: "{{ omero_cli_duplicate_release_override | default('0.4.0') }}"
    omero_metadata_release: "{{ omero_metadata_release_overrride | default('0.8.0') }}"
    omero_cli_render_release: "{{ omero_cli_render_release_override | default('0.7.0') }}"
    omero_server_certificate_directory: "/OMERO/certs"
    omero_server_system_managedrepo_group: managed_repo_group
    omero_server_datadir_managedrepo_mode: u=rwX,g=srwX,o=rX,+t
    omero_server_datadir_chown: False
    omero_server_release: "{{ omero_server_release_override | default('5.6.3') }}"
    omero_web_release: "{{ omero_web_release_override | default('5.11.0') }}"
    omero_figure_release: "{{ omero_figure_release_override | default('4.4.1') }}"
    omero_fpbioimage_release: "{{ omero_fpbioimage_release_override | default('0.4.0') }}"
    omero_iviewer_release: "{{ omero_iviewer_release_override | default('0.10.2') }}"
    omero_mapr_release: "{{ omero_mapr_release_override | default('0.4.1') }}"
    omero_parade_release: "{{ omero_parade_release_override | default('0.2.1') }}"
    # The os_system_users_password default is "ome".
    # You may wish to change this variable,
    # or override it by defining the private variable os_system_users_password_override.
    os_system_users_password: "{{ os_system_users_password_override | default('$6$leKi5B1PgSvdA/ec$xbU3CnoSFnYdeZjEjKK5TH8SGATsW746uopssff4edpgyu.cWXGo9A.oK6wH9kIkxLCCNcORGZnnroZPMqGzN/') }}"    
    omero_server_config_set:
      omero.certificates.commonname: "{{ https_certificate_domain | default('localhost') }}"
      omero.client.icetransports: ssl,wss,tcp
      omero.fs.watchDir: "/home/DropBox"
      omero.fs.importArgs: "-T \"regex:^.*/(?<Container1>.*?)\""
      omero.db.poolsize: 60
      omero.jvmcfg.percent.blitz: 50
      omero.jvmcfg.percent.indexer: 20
      omero.jvmcfg.percent.pixeldata: 20
      omero.fs.repo.path: "%user%_%userId%/%thread%//%year%-%month%/%day%/%time%"
      omero.glacier2.IceSSL.CertFile: "server.p12"
      omero.glacier2.IceSSL.Ciphers: "HIGH"
      omero.glacier2.IceSSL.DefaultDir: "{{omero_server_certificate_directory | default('/OMERO/certs') }}"
      omero.glacier2.IceSSL.Password: "secret"
      omero.glacier2.IceSSL.ProtocolVersionMax: "TLS1_2"
      omero.glacier2.IceSSL.ProtocolVersionMin: "TLS1_2"
      omero.glacier2.IceSSL.Protocols: "TLS1_2"

      

    # The omero_web_apps_* vars are used by the ome.omero_web role under
    # Python 3 otherwise ignored
    omero_web_apps_packages:
      - "omero-figure=={{ omero_figure_release }}"
      - "omero-fpbioimage=={{ omero_fpbioimage_release }}"
      - "omero-iviewer=={{ omero_iviewer_release }}"
      - "omero-mapr=={{ omero_mapr_release }}"
      - "omero-parade=={{ omero_parade_release }}"
      - "omero-webtagging-autotag=={{ omero_webtagging_autotag_release }}"
      - "omero-webtagging-tagsearch=={{ omero_webtagging_tagsearch_release }}"

    ome_training_scripts_release: "{{ ome_training_scripts_release_override | default('0.7.3') }}"
    omero_webtagging_autotag_release: "{{ omero_webtagging_autotag_release_override | default('3.1.0') }}"
    omero_webtagging_tagsearch_release: "{{ omero_webtagging_tagsearch_release_override | default('3.1.0') }}"
    
    omero_web_config_set:
      omero.web.nginx_server_extra_config:
        - 'include /etc/nginx/conf.d-nested-includes/*.conf;'
        # TODO: Move the following into a shared variable
        - >
          location = /omero-ws {
            proxy_pass https://127.0.0.1:4066;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 86400;
          }
    omerodir: /opt/omero/server/OMERO.server
    venv_server: /opt/omero/server/venv3
    password: 'omero'
    omero_user: 'root'
    host: 'localhost'
  environment:
    OMERODIR: "{{ omerodir }}"
    PATH: "{{ venv_server }}/bin:{{ ansible_env.PATH }}"

          

  pre_tasks:
  
    - name: Wait for connection to become available, but don't even start checking for 5 seconds
      wait_for_connection:
        delay: 5
        timeout: 120
        
    - name: Gathering Facts after the fact
      setup:      
 
 
# Assume this is a new server, therefore no cert exists at:
# /etc/letsencrypt/live/{{ https_cert_domain }}. But, if I'm reusing this public IP, then
# there may already be a certificate. Normally, I copy the directory /etc/letsencrypt to
# the local path ../files/issued_certs/{{ https_certificiate_domain}}, so I should check
# to see if this exists and register a variable of the result.
    - name: check for local copy of cert
      stat:
        path: "./certs/{{ https_certificate_domain }}"
      delegate_to: 127.0.0.1  
      register: local_p
    - debug:
        msg: "Local Certificates Found! Let's see if we need to copy these to the server "
      when: local_p.stat.isdir is defined and local_p.stat.isdir  
    - debug:
        msg: "No Local Certificates Found! Let's see if there are any on the server."
      when: not (local_p.stat.isdir is defined and local_p.stat.isdir)  
      
    - name: Double check for certs on the server
      become: true
      stat:
        path: "/etc/letsencrypt/live"
      register: remote_p
    - debug:
        msg: "Certificate Directory found on server "
      when: remote_p.stat.isdir is defined and remote_p.stat.isdir  
    - debug:
        msg: "No Certificate directory found on server "
      when: not (remote_p.stat.isdir is defined and remote_p.stat.isdir)
      
    - name: Copy local certificate information to the server if it exists
      become: true
      ansible.posix.synchronize:
        src:  "./certs/{{ https_certificate_domain }}/"
        dest: /etc/letsencrypt/       
      when: # Both conditions below must be true for this task to execute
        - (not (remote_p.stat.isdir is defined and remote_p.stat.isdir))
        - (local_p.stat.isdir is defined and local_p.stat.isdir)
        
    - name: Copy remote certificate information from the server to a local location for future reference
      become: true
      ansible.posix.synchronize:
        mode: pull
        src: /etc/letsencrypt/
        dest: "./certs/{{ https_certificate_domain }}/"
      when:
        - (remote_p.stat.isdir is defined and remote_p.stat.isdir)
        - (not (local_p.stat.isdir is defined and local_p.stat.isdir))               

   
    - name: Update apt-get repo and cache
      become: true
      apt: update_cache=yes force_apt_get=yes cache_valid_time=3600

    - name: Install Prerequisites | unzip wget bc cron, etc. 
      become: true
      apt:
        force_apt_get: true
        name:
          - mencoder  # for the make movie script
          - bzip2
          - screen    # bzip, screen, tmux and zsh installed by ome.cli_utils - but only for centos
          - tmux
          - zsh
          - unzip
          - wget
          - bc
          - cron
          - software-properties-common
          - openssl
        state: present
        
    # Since Nginx isn't installed until later the directories are created in advance
    - name: Create nginx include directories
      become: yes
      file:
        path: "{{ item }}"
        recurse: yes
        state: directory
      with_items:
        - /etc/nginx/conf.d
        - /etc/nginx/conf.d-nested-includes

    - name: NGINX - websocket proxy support
      become: yes
      template:
        src: ./templates/nginx-confd-websockets-conf.j2
        dest: /etc/nginx/conf.d/websockets.conf
      # Don't notify, nginx isn't installed yet

    - name: letsencrypt challenge directory
      become: yes
      file:
        path: /srv/www/letsencrypt/.well-known/
        recurse: yes
        state: directory
        
    - name: create mount on /OMERO if create_second_volume == true
      import_role:  
        name: sco.lvm_partition
      become: true  
      vars:
        lvm_lvname: omero
        lvm_lvmount: /OMERO
        lvm_lvsize: "{{ second_volume_size_gb }}"
        lvm_lvfilesystem: xfs
        lvm_vgname: VolGroup00
        lvm_vgdevice: "/dev/vdb"
        lvm_vgcreate: True
      when: create_second_volume 
      
    - name: create /OMERO directory, if required
      become: yes
      file:
        path: /OMERO
        recurse: yes
        state: directory
      when: not create_second_volume
          
                    
  roles:

            
    - role: ome.postgresql
      postgresql_databases:
      - name: omero
      postgresql_users:
      - user: omero
        password: omero
        databases: [omero]
        
        
#Install the OMERO.server into /opt/omero/server
# Also depends on roles - ome.ice, ome.java, ome.basedeps, ome.python3_virtualenv
    - role: ome.omero_server
      omero_server_virtualenv: yes
      omero_server_python_addons:
        - "omero-cli-duplicate=={{ omero_cli_duplicate_release }}"
        - "omero-cli-render=={{ omero_cli_render_release }}"
        - "omero-metadata=={{ omero_metadata_release }}"
        - reportlab
        - markdown
        - scipy
        # For "simple frap with figure" script
        - matplotlib
        
    - role: ome.omero_web
    
    - role: sco.letsencrypt
      https_letsencrypt_enabled: true
      https_letsencrypt_cert_path: "/etc/letsencrypt/live/{{ https_certificate_domain }}"
      letsencrypt_email: "sogg@ualberta.ca"
      
    - role: sco.nginx_geoip  
    
  tasks:
  
    - name: Create a figure scripts directory
      become: yes
      file:
        path: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Download the Figure_To_Pdf.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-figure/v{{ omero_figure_release }}/omero_figure/scripts/omero/figure_scripts/Figure_To_Pdf.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts/Figure_To_Pdf.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Create a workshop_scripts directory
      become: yes
      file:
        path: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Download the Scipy_Gaussian_Filter.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/training-scripts/v{{ ome_training_scripts_release }}/practical/python/server/scipy_gaussian_filter.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/Scipy_Gaussian_Filter.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the simple_frap.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/training-scripts/v{{ ome_training_scripts_release }}/practical/python/server/simple_frap.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/simple_frap.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the simple_frap_with_figure.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/training-scripts/v{{ ome_training_scripts_release }}/practical/python/server/simple_frap_with_figure.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/simple_frap_with_figure.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Outreach only config for OMERO.web plugins
      become: yes
      template:
        src: files/omero-web-outreach-webapps.omero
        dest: "{{ omero_web_basedir }}/config/omero-web-outreach-webapps.omero"
        owner: "root"
        group: "root"
        mode: "u=rw,go=r"
      notify:
      - restart omero-web

    - name: Add operating system user "importer1"
      become: true
      user:
       name: "importer1"
       state: present
       groups: "{{ omero_server_system_managedrepo_group }}"
       password: "{{ os_system_users_password }}"

    - name: Allow managed repo group to login
      become: yes
      lineinfile:
        path: /etc/security/access.conf
        regexp: "{{ omero_server_system_managedrepo_group }}"
        insertbefore: BOF
        line: "+:{{ omero_server_system_managedrepo_group }}:ALL"

    - name: Create omero-monitoring, a restricted admin who can export prometheus data
      shell: "omero user add -a omero-monitoring omero-monitoring omero-monitoring system  -P omero-monitoring --ignore-existing -s {{ host | quote }} -u {{ omero_user | quote }} --password {{ password | quote }}"
      
    - name: Retrieve omero-monitoring's omero userid
      become: true
      become_user: postgres
      community.general.postgresql_query:
        db: omero
        query: "select id from experimenter where firstname = 'omero-monitoring'"
      register: result
      tags: test
       
    - name: Use omero-monitoring's id to set restrictions to be a read-only light-admin
      shell: "omero obj map-set Experimenter:{{result.query_result[0].id}} config AdminPrivilege:{{item}} false -s {{ host | quote }} -u {{ omero_user | quote }} --password {{ password | quote }}"
      tags: test
      with_items:
        - Sudo
        - WriteOwned
        - WriteFile
        - WriteManagedRepo
        - DeleteOwned
        - DeleteFile
        - DeleteManagedRepo
        - Chgrp
        - Chown
        - ModifyGroup
        - ModifyUser
        - ModifyGroupMembership
        - WriteScriptRepo
        - DeleteScriptRepo

    # (Total cores / 2), leaving some for WSGI
    - name: NGINX - Performance tuning - worker processes
      become: true
      replace:
        dest: "/etc/nginx/nginx.conf"
        regexp: '^worker_processes\s+\d+;'
        replace: "worker_processes {{ ((ansible_processor_count * ansible_processor_cores) / 2) |round|int }};"

    # cf https://www.digitalocean.com/community/tutorials/how-to-optimize-nginx-configuration
    - name: NGINX - Performance tuning - worker connections
      become: true
      replace:
        path: "/etc/nginx/nginx.conf"
        regexp: 'worker_connections\s+\d+;'
        replace: "worker_connections 1024;"
        
# Uncomment this next line if you want to create the 4 groups "Lab1, Lab2, Lab3 and Lab4", the two
# training users that are administrators and 50 regular users numbered user-1 through user-50.
# each of the users passwords are "ome". 
- import_playbook: createUsers.yml