adding files

43 files changed, 1243 insertions, 2 deletions

diff --git a/.gitignore b/.gitignore
index 0d2897c..3063138 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
-openstackctl
+hosts
+delete_instances.sh
+*~
diff --git a/README.md b/README.md
index 118f4a5..365eabd 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,124 @@
-# openbook-v3-installer
+# Overview
+
+Welcome to the Talligent ansible playbooks. There is one for spinning
+up the bare VMs, one for installing Openbook and all its dependencies
+on the VMs, and one for upgrading Openbook when we are given a new WAR
+file.
+
+    Spin up new VMs: spin_up_bare_vm.yaml (to be replaced with heat)
+    Install Openbook on the VMs: install_openbook.yaml
+    Update the Openbook application: update_openbook.yaml
+
+# Prerequisites
+
+There must first be a project named "talligent" in the environment,
+and it must have a pre-existing DNS domain created via Horizon. The
+showback user must have the following roles on the talligent project:
+
+ResellerAdmin
+lbaas_project_admin
+admin
+designate_project_admin
+
+Puppet should take care of assigning these roles.
+
+# spin_up_bare_vm.yaml playbook:
+
+This playbook spins up a new VM, sets up networking, security groups
+and DNS. It will be reimplemented as a heat template in the near
+future. The reason it's a standalone playbook now is to make it easier
+to replace.
+
+Run this playbook first. If you want two Openbook nodes, run it twice
+in a row. Use 'openstack server list' or horizon to ensure that you
+have the VMs you desire.
+
+This playbook relies on an environment. Source the appropriate
+openrc-* file in the conf/ directory.
+
+In BFD02 you only need to source one environment and spin up two
+VMs. In staging and production you will have to spin up two VMs in a
+region, source the other region's openrc file, and spin up two more
+VMs.
+
+It is important to spin up all the VMs before moving on to the
+install_openbook.yaml playbook.
+
+It is also vitally important that your VMs have the IP addresses that
+are listed in conf/env.yaml.
+
+The first time you run this playbook it will create a new VM called
+<siteiter>-openbook-001. Subsequent runs will create VMs ending in
+002, 003, etc. Normally you will not go past two VMs. Production and
+staging have special FIPs that have access to the keystone admin
+URL. As mentioned above, your VMs must get the FIPs that are listed in
+conf/env.yaml.
+
+Sample invocation:
+
+    ansible-playbook spin_up_bare_vm.yaml
+
+See below for a full usage scenario.
+
+# install_openbook.yaml playbook:
+
+This playbook installs Openbook and all its dependencies on the
+VMs. It acts on all the VMs in the environment. You can look at
+conf/env.yaml to see which VMs are expected to pre-exist.
+
+You do not need to source an openrc file to run this playbook. All the
+data is in conf/env.yaml. It doesn't matter if your shell has an
+openrc file already sourced. This playbook ignores the environment
+entirely.
+
+Invoke the playbook as follows:
+
+    ansible-playbook -i dynamic_hosts_[env].py install_openbook.yaml
+
+There is a script called dynamic_hosts.py that reads conf/env.yaml and
+transforms the data into JSON. You have to tell it which environment
+you want. The way you do that is to use the appropriate symlink that
+contains the environment name. There are three possible invocations:
+
+    ansible-playbook -i dynamic_hosts_lab.py install_openbook.yaml
+    ansible-playbook -i dynamic_hosts_staging.py install_openbook.yaml
+    ansible-playbook -i dynamic_hosts_prod.py install_openbook.yaml
+
+You only need to run this playbook once regardless of how many VMs
+there are. It will hit every VM in the inventory that is generated by
+the python script.
+
+In staging and production the resulting configuration will include a
+cross-region galera cluster.
+
+# update_openbook.yaml
+
+This playbook will only update the Openbook application with a new WAR
+file that is on blobmaster. (See
+bfd01-blobmaster-001:/bfd01/swift/Openbook.war) This is what you will
+always use once a cluster is up.
+
+You do not need to source an openrc file to run this playbook. All the
+data is in conf/env.yaml.
+
+You must feed it the dynamic inventory:
+
+    ansible-playbook -i dynamic_hosts_[env].py update_openbook.yaml
+
+# Usage
+
+To build a new cluster: shell onto the build node in the environment
+in which you want to spin up an Openbook cluster.
+
+    cd /etc/ansible/oneoff/talligent/
+    . conf/openrc-[your-desired-profile]
+    ansible-playbook spin_ip_bare_vm.yaml
+    ansible-playbook spin_ip_bare_vm.yaml
+    . conf/openrc-[your-other-desired-profile]
+    ansible-playbook spin_ip_bare_vm.yaml
+    ansible-playbook spin_ip_bare_vm.yaml
+    ansible-playbook -i dynamic_hosts_[env].py install_openbook.yaml
+
+To update an existing cluster with a new WAR file:
+
+    ansible-playbook -i dynamic_hosts_[env].py update_openbook.yaml
diff --git a/apache-ctl.yaml b/apache-ctl.yaml
new file mode 100644
index 0000000..fa9f169
--- /dev/null
+++ b/apache-ctl.yaml
@@ -0,0 +1,10 @@
+---
+- hosts: target
+  serial: 1
+  tasks:
+    - name: "Check that -e 'action=[stop|start|restart]' was passed in"
+      fail:
+        msg: "The variable 'action' was not passed in with a value of 'stop', 'start' or 'restart' on the command line."
+      when: action not in ["stop", "start", "restart"]
+
+    - include: playbooks/apache-ctl.yaml
diff --git a/conf/.gitignore b/conf/.gitignore
new file mode 100644
index 0000000..0e13fa0
--- /dev/null
+++ b/conf/.gitignore
@@ -0,0 +1,5 @@
+openrc-pippiandcarlos.sh
+openrc-vzw-lab.sh
+openrc-vzw-prod.yaml
+openrc-vzw-staging.yaml
+os-venv
diff --git a/conf/env.yaml b/conf/env.yaml
new file mode 100644
index 0000000..b612dc7
--- /dev/null
+++ b/conf/env.yaml
@@ -0,0 +1,13 @@
+---
+globals:
+  ansible_ssh_user: root
+  ansible_private_key_file: /home/ckonstanski/.ssh/id_rsa
+  ansible_python_interpreter: /usr/bin/python
+  fqdn: verizoncloudplatform.com
+
+environments:
+  - lab:
+      - openbook-lab-v3-1.verizoncloudplatform.com:
+          openbook_gcomm_addresses: 172.16.1.15,172.16.1.17
+      - openbook-lab-v3-2.verizoncloudplatform.com:
+          openbook_gcomm_addresses: 172.16.1.15,172.16.1.17
diff --git a/conf/os-requirements.txt b/conf/os-requirements.txt
new file mode 100644
index 0000000..6e6041f
--- /dev/null
+++ b/conf/os-requirements.txt
@@ -0,0 +1,10 @@
+python-cinderclient
+python-designateclient
+python-glanceclient
+python-heatclient
+python-keystoneclient
+python-neutronclient
+python-novaclient
+python-openstackclient
+python-swiftclient
+
diff --git a/data/etc/cloud/.gitignore b/data/etc/cloud/.gitignore
new file mode 100644
index 0000000..deaa6ae
--- /dev/null
+++ b/data/etc/cloud/.gitignore
@@ -0,0 +1 @@
+cloud.cfg
diff --git a/files/cloud.sh b/files/cloud.sh
new file mode 100755
index 0000000..a188204
--- /dev/null
+++ b/files/cloud.sh
@@ -0,0 +1,85 @@
+#!/bin/bash
+
+keypair_user="${1}"
+pubkey_path="${2}"
+dns_servers="${3}"
+
+if [ "${keypair_user}" == "" ]; then
+    echo "No keypair user was supplied." >&2
+    exit 1
+elif [ "${pubkey_path}" == "" ]; then
+    echo "No pubkey path was supplied." >&2
+    exit 1
+elif [ "${dns_servers}" == "" ]; then
+    echo "No dns servers supplied." >&2
+    exit 1
+fi
+
+nameservers=$(for i in ${dns_servers}; do echo -n "'${i}',"; done)
+nameservers="${nameservers::-1}"
+
+cat > "data/etc/cloud/cloud.cfg" <<EOF
+#cloud-config
+# vim: syntax=yaml
+
+users:
+  - name: default
+  - name: ${keypair_user}
+    groups: sudo
+    shell: /bin/bash
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    ssh-authorized-keys:
+      - $(cat ${pubkey_path})
+
+manage-resolv-conf: True
+
+resolv_conf:
+  nameservers: [${nameservers}]
+
+write_files:
+  - content: |
+      127.0.0.1       localhost
+      127.0.2.1       openbook-database
+
+      # The following lines are desirable for IPv6 capable hosts
+      ::1     localhost       ip6-localhost ip6-loopback
+      ff02::1 ip6-allnodes
+      ff02::2 ip6-allrouters
+    path: /etc/hosts
+
+  - path: /root/cloudcfg.sh
+    permissions: "0755"
+    content: |
+      #!/bin/bash
+
+      # Prepare the instance for ansible. This amounts to installing python2.
+
+      python=$(which python || which python3 || which python2 || false)
+
+      case "$(${python} -m platform)" in
+          *Ubuntu*)
+              export DEBIAN_FRONTEND=noninteractive
+              apt-get update
+              apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade
+              apt-get -y install python python2.7 ntp ntpdate
+              ;;
+          *centos*|*redhat*)
+              # RHEL systems still use python2 by default; nothing to do
+              ;;
+          *gentoo*)
+              if [ ! -d /usr/portage/sys-devel/gcc ]; then
+                  emerge-webrsync
+              fi
+              emerge --oneshot --update dev-lang/python:2.7 app-portage/gentoolkit net-misc/ntp
+              rc-update add ntp-client default
+              rc-update add ntpd default
+              ;;
+      esac
+
+      exit 0
+
+runcmd:
+  - /root/cloudcfg.sh
+EOF
+
+exit 0
diff --git a/files/dns.sh b/files/dns.sh
new file mode 100755
index 0000000..8c5b203
--- /dev/null
+++ b/files/dns.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+instance_name="${1}"
+floating_ip="${2}"
+
+if [ "${instance_name}" == "" ]; then
+    echo "No instance name supplied." >&2
+    exit 1
+elif [ "${floating_ip}" == "" ]; then
+    echo "No floating IP supplied." >&2
+    exit 1
+fi
+
+domain_id=$(designate domain-list 2>/dev/null | grep -F "cloud.twc.net" | awk '{print $2;}')
+if [ "${domain_id}" == "" ]; then
+    echo -n "Could not find the domain. It must be created in Horizon " >&2
+    echo -n "prior to running this playbook so that the project will " >&2
+    echo "get correctly wired up to infoblox." >&2
+    exit 1
+else
+    domain_name=$(designate domain-list 2>/dev/null | grep -F "cloud.twc.net" | awk '{print $4;}')
+    fqdn="${instance_name}.${domain_name}"
+fi
+
+record_id=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}')
+if [ "${record_id}" == "" ]; then
+    designate record-create ${domain_id} --type A --name "${fqdn}" --data ${floating_ip} >/dev/null 2>&1
+    record_id=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}')
+    if [ "${record_id}" == "" ]; then
+        echo "No existing A record. Cannot create A record." >&2
+        exit 1
+    fi
+else
+    target_ip=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $8;}')
+    if [ "${target_ip}" != "${floating_ip}" ]; then
+        designate record-delete ${domain_id} ${record_id} >/dev/null 2>&1
+        designate record-create ${domain_id} --type A --name "${fqdn}" --data ${floating_ip} >/dev/null 2>&1
+        record_id=$(designate record-list ${domain_id} 2>/dev/null |grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}')
+        if [ "${record_id}" == "" ]; then
+            echo "Existing A record had wrong IP. Cannot create A record." >&2
+        exit 1
+        fi
+    fi
+fi
+
+echo "${fqdn::-1}"
+
+exit 0
diff --git a/files/flavor.sh b/files/flavor.sh
new file mode 100755
index 0000000..c391b18
--- /dev/null
+++ b/files/flavor.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+flavor_name="${1}"
+
+if [ "${flavor_name}" == "" ]; then
+    echo "No flavor name supplied." >&2
+    exit 1
+fi
+
+flavor_id=$(nova flavor-list | grep -F "${flavor_name}" | awk '{print $2;}')
+if [ "${flavor_id}" == "" ]; then
+    echo -n "Cannot retrieve a flavor ID corresponding to the name: " >&2
+    echo "${flavor_name}" >&2
+    exit 1
+fi
+
+exit 0
diff --git a/files/image.sh b/files/image.sh
new file mode 100755
index 0000000..fd694cd
--- /dev/null
+++ b/files/image.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+image_name="${1}"
+
+if [ "${image_name}" == "" ]; then
+    echo "No image name supplied." >&2
+    exit 1
+fi
+
+image_id=$(openstack image list --limit 1000 --public 2>/dev/null | grep -F " ${image_name} " | awk '{print $2;}')
+if [ "${image_id}" == "" ]; then
+    echo -n "Cannot retrieve an image ID corresponding to the name: " >&2
+    echo "${image_name}" >&2
+    exit 1
+fi
+
+exit 0
diff --git a/files/instance.sh b/files/instance.sh
new file mode 100755
index 0000000..6526ded
--- /dev/null
+++ b/files/instance.sh
@@ -0,0 +1,94 @@
+#!/bin/bash
+
+flavor_name="${1}"
+image_name="${2}"
+network_id="${3}"
+keypair_name="${4}"
+instance_name="${5}"
+ext_network_name="${6}"
+
+if [ "${flavor_name}" == "" ]; then
+    echo "No flavor name supplied." >&2
+    exit 1
+elif [ "${image_name}" == "" ]; then
+    echo "No image name supplied." >&2
+    exit 1
+elif [ "${network_id}" == "" ]; then
+    echo "No network ID supplied." >&2
+    exit 1
+elif [ "${keypair_name}" == "" ]; then
+    echo "No keypair name supplied." >&2
+    exit 1
+elif [ "${instance_name}" == "" ]; then
+    echo "No instance name supplied." >&2
+    exit 1
+elif [ "${ext_network_name}" == "" ]; then
+    echo "No ext network name supplied." >&2
+    exit 1
+fi
+
+associate_floating_ip () {
+    for line in $(openstack floating ip list | grep -F 'None' | sed -e 's/ //g'); do
+        floating_ip_id=$(echo ${line} | awk -F\| '{print $2;}')
+        floating_ip=$(echo ${line} | awk -F\| '{print $3;}')
+        floating_ip_port=$(echo ${line} | awk -F\| '{print $5;}')
+        if [ "${floating_ip_port}" == "None" ]; then
+            nova floating-ip-associate "${1}" "${floating_ip}" >/dev/null 2>&1
+            echo "${floating_ip}"
+            return 0
+        fi
+    done
+    return 1
+}
+
+image_id=$(openstack image list --limit 1000 --public 2>/dev/null | grep -F " ${image_name} " | awk '{print $2;}')
+if [ "${image_id}" == "" ]; then
+    echo "Could not find id for image ${image_name}" >&2
+    exit 1
+fi
+
+instance_number=1
+for num in $(openstack server list --limit 1000 2>/dev/null | grep -F "${instance_name}" | awk '{print $4;}' | awk -F- '{print $4;}' | sort); do
+    if (( "${num}" == ${instance_number} )); then
+        instance_number=$(expr ${instance_number} + 1)
+    fi
+done
+
+# TODO: rewrite with openstack server create
+instance_id=$(nova boot \
+    --flavor "${flavor_name}" \
+    --block-device source=image,id=${image_id},dest=volume,size=20,shutdown=preserve,bootindex=0 \
+    --nic net-id="${network_id}" \
+    --security-groups "default-grp,dns,galera,vertx,web" \
+    --key-name "${keypair_name}" \
+    --user-data "data/etc/cloud/cloud.cfg" \
+    --poll \
+    "${instance_name}-${instance_number}" \
+    | grep -F ' id ' | awk '{print $4;}')
+
+if [ "${instance_id}" == "" ]; then
+    echo "Instance creation did not return an ID." >&2
+    exit 1
+fi
+
+floating_ip_assigned=$(associate_floating_ip ${instance_id})
+if (( ${?} == 1 )); then
+    openstack floating ip create ${ext_network_name} >/dev/null 2>&1
+    if (( ${?} == 0 )); then
+        floating_ip_assigned=$(associate_floating_ip ${instance_id})
+        if (( ${?} == 1 )); then
+            echo "Could not associate floating IP." >&2
+            exit 1
+        fi
+    fi
+fi
+
+# TODO: rewrite with openstackclient command
+for sec in default-grp dns galera vertx web; do
+    nova add-secgroup ${instance_id} ${sec} >/dev/null 2>&1
+done
+
+echo "${floating_ip_assigned}"
+echo "${instance_name}-${instance_number}"
+
+exit 0
diff --git a/files/keypair.sh b/files/keypair.sh
new file mode 100755
index 0000000..0e8374d
--- /dev/null
+++ b/files/keypair.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+keypair_name="${1}"
+pubkey_path="${2}"
+
+if [ "${keypair_name}" == "" ]; then
+    echo "No keypair name was supplied." >&2
+    exit 1
+elif [ "${pubkey_path}" == "" ]; then
+    echo "No pubkey path was supplied." >&2
+    exit 1
+fi
+
+keypair_fingerprint=$(openstack keypair list | grep -F "${keypair_name}" | awk '{print $4;}')
+if [ "${keypair_fingerprint}" == "" ]; then
+    if [ "${pubkey_path}" == "" ]; then
+        echo -n "Need to create an SSH keypair, but no path to a pubkey " >&2
+        echo "was supplied." >&2
+        exit 1
+    elif [ ! -f "${pubkey_path}" ]; then
+        echo -n "Need to create an SSH keypair, but the supplied path " >&2
+        echo "to the pubkey is invalid:" >&2
+        echo "${pubkey_path}" >&2
+        exit 1
+    fi
+
+    openstack keypair create --public-key "${pubkey_path}" "${keypair_name}"
+    keypair_fingerprint=$(openstack keypair list | grep -F "${keypair_name}" | awk '{print $4;}')
+    if [ "${keypair_fingerprint}" == "" ]; then
+        echo "Could not retrieve keypair after creation." >&2
+        exit 1
+    fi
+fi
+
+exit 0
diff --git a/files/logrotate_tomcat7 b/files/logrotate_tomcat7
new file mode 100644
index 0000000..6f1c36b
--- /dev/null
+++ b/files/logrotate_tomcat7
@@ -0,0 +1,8 @@
+/var/log/tomcat7/*.log /var/log/tomcat7/*.txt /var/log/tomcat7/catalina.out {
+  copytruncate
+  weekly
+  rotate 4
+  compress
+  missingok
+  create 640 tomcat7 adm
+}
diff --git a/files/network.sh b/files/network.sh
new file mode 100755
index 0000000..22b0623
--- /dev/null
+++ b/files/network.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+router_name="${1}"
+private_network_name="${2}"
+private_network_cidr="${3}"
+ext_network_name="${4}"
+dns_servers="${5}"
+
+if [ "${router_name}" == "" ]; then
+    echo "No router name supplied." >&2
+    exit 1
+elif [ "${private_network_name}" == "" ]; then
+    echo "No private network name supplied." >&2
+    exit 1
+elif [ "${private_network_cidr}" == "" ]; then
+    echo "No private network CIDR supplied." >&2
+    exit 1
+elif [ "${ext_network_name}" == "" ]; then
+    echo "No external network name supplied." >&2
+    exit 1
+elif [ "${dns_servers}" == "" ]; then
+    echo "No dns servers supplied." >&2
+    exit 1
+fi
+
+ext_network_id=$(openstack network show -f shell -c id "${ext_network_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g')
+if [ "${ext_network_id}" == "" ]; then
+    echo "No ${ext_network_name} network exists." >&2
+    exit 1
+fi
+
+private_network_id=$(openstack network show -f shell -c id "${private_network_name}" 2>/dev/null | awk -F= '{print $2;}' |sed -e 's/\"//g')
+if [ "${private_network_id}" == "" ]; then
+    openstack network create "${private_network_name}" >/dev/null
+    openstack subnet create \
+        "${private_network_name}" \
+        --network "${private_network_name}" \
+        --subnet-range "${private_network_cidr}" \
+        --dns-nameserver $(echo ${dns_servers} | awk '{print $1;}') \
+        --dns-nameserver $(echo ${dns_servers} | awk '{print $2;}') \
+        --dns-nameserver $(echo ${dns_servers} | awk '{print $3;}') \
+        >/dev/null
+    private_network_id=$(openstack network show -f shell -c id "${private_network_name}" 2>/dev/null | awk -F= '{print $2;}' |sed -e 's/\"//g')
+    if [ "${private_network_id}" == "" ]; then
+        echo "Cannot retrieve private network ID after creation." >&2
+        exit 1
+    fi
+fi
+
+router_id=$(openstack router show -f shell -c id "${router_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g')
+if [ "${router_id}" == "" ]; then
+    openstack router create "${router_name}" >/dev/null
+    router_id=$(openstack router show -f shell -c id "${router_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g')
+    if [ "${router_id}" == "" ]; then
+        echo "Cannot retrieve router ID after creation." >&2
+        exit 1
+    fi
+fi
+
+gateway_info=$(openstack router show -f shell -c external_gateway_info "${router_name}" 2>/dev/null | grep -F 'external_fixed_ips')
+if [ "${gateway_info}" == "" ]; then
+    openstack router set "${router_id}" --external-gateway "${ext_network_id}" >/dev/null
+fi
+
+openstack router add subnet "${router_id}" "${private_network_name}" >/dev/null 2>&1 || true
+
+echo -n "${private_network_id}"
+
+exit 0
diff --git a/files/securitygroup.sh b/files/securitygroup.sh
new file mode 100755
index 0000000..a7c2ad1
--- /dev/null
+++ b/files/securitygroup.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+
+private_network_cidr="${1}"
+public_network_cidrs="${2}"
+
+for name in default-grp; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for protocol in tcp udp; do
+        if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv4'" == "" ]; then
+            openstack security group rule create --egress --protocol ${protocol} --remote-ip 0.0.0.0/0 --dst-port 1:65535 --ethertype IPv4 ${name} >/dev/null 2>&1
+        fi
+        if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv6'" == "" ]; then
+            openstack security group rule create --egress --protocol ${protocol} --remote-ip ::/0 --dst-port 1:65535 --ethertype IPv6 ${name} >/dev/null 2>&1
+        fi
+    done
+    for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+        if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"icmp\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+            openstack security group rule create --ingress --protocol icmp --remote-ip ${cidr} ${name} >/dev/null 2>&1
+        fi
+    done
+    for port in 22; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in dns; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 53; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol udp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in vertx; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 5701:5710; do
+        for cidr in ${private_network_cidr}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in web; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 8080:8083; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+for name in galera; do
+    openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1
+    for port in 3306 4444 4567 9200; do
+        for cidr in ${private_network_cidr} ${public_network_cidrs}; do
+            if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then
+                openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1
+            fi
+        done
+    done
+done
+
+exit 0
diff --git a/install_openbook.retry b/install_openbook.retry
new file mode 100644
index 0000000..0b39bfb
--- /dev/null
+++ b/install_openbook.retry
@@ -0,0 +1 @@
+openbook-lab-v3-2.verizoncloudplatform.com
diff --git a/install_openbook.yaml b/install_openbook.yaml
new file mode 100644
index 0000000..6f9f2e6
--- /dev/null
+++ b/install_openbook.yaml
@@ -0,0 +1,37 @@
+---
+- hosts: target
+  vars:
+    user_domain_name: "{{ lookup('env', 'OS_USER_DOMAIN_NAME') }}"
+    project_domain_name: "{{ lookup('env', 'OS_PROJECT_DOMAIN_NAME') }}"
+    username: "{{ lookup('env', 'OS_USERNAME') }}"
+    password: "{{ lookup('env', 'OS_PASSWORD') }}"
+    project_name: "{{ lookup('env', 'OS_PROJECT_NAME') }}"
+    endpoint: "{{ lookup('env', 'OS_AUTH_URL') }}"
+    region: "{{ lookup('env', 'OS_REGION_NAME') }}"
+    interface: "{{ lookup('env', 'OS_INTERFACE') }}"
+    identity_api_version: "{{ lookup('env', 'OS_IDENTITY_API_VERSION') }}"
+    image_api_version: "{{ lookup('env', 'OS_IMAGE_API_VERSION') }}"
+    dns_servers: "{{ lookup('env', 'DNS_SERVERS') }}"
+    flavor_name: "{{ lookup('env', 'FLAVOR_NAME') }}"
+    image_name: "{{ lookup('env', 'IMAGE_NAME') }}"
+    keypair_user: "{{ lookup('env', 'KEYPAIR_USER') }}"
+    pubkey_path: "{{ lookup('env', 'PUBKEY_PATH') }}"
+    router_name: "{{ lookup('env', 'ROUTER_NAME') }}"
+    private_network_name: "{{ lookup('env', 'PRIVATE_NETWORK_NAME') }}"
+    private_network_cidr: "{{ lookup('env', 'PRIVATE_NETWORK_CIDR') }}"
+    public_network_cidrs: "{{ lookup('env', 'PUBLIC_NETWORK_CIDRS') }}"
+    ext_network_name: "{{ lookup('env', 'EXT_NETWORK_NAME') }}"
+    openbook_db_password: "{{ lookup('env', 'OPENBOOK_DB_PASSWORD') }}"
+    openbook_api_key: "{{ lookup('env', 'OPENBOOK_API_KEY') }}"
+    webdav_url: "{{ lookup('env', 'WEBDAV_URL') }}"
+    webdav_username: "{{ lookup('env', 'WEBDAV_USERNAME') }}"
+    webdav_password: "{{ lookup('env', 'WEBDAV_PASSWORD') }}"
+  tasks:
+    - include: playbooks/openrc.yaml
+    - include: playbooks/apt.yaml
+    - include: playbooks/ulimit.yaml
+    - include: playbooks/ssl.yaml
+    - include: playbooks/apache.yaml
+    - include: playbooks/java.yaml
+    - include: playbooks/logrotate.yaml
+    - include: playbooks/update_openbook.yaml
diff --git a/inventory_json.yaml b/inventory_json.yaml
new file mode 100755
index 0000000..b7aec21
--- /dev/null
+++ b/inventory_json.yaml
@@ -0,0 +1,49 @@
+#!/usr/bin/ruby
+
+require "json"
+require "yaml"
+
+def doit()
+    env_yaml_path = "#{File.dirname($0)}/conf/env.yaml"
+    if ! File.file?(env_yaml_path)
+        STDERR.puts "Unable to find env.yaml. Exiting."
+        exit(1)
+    end
+    environ = ""
+    ["prod", "staging", "lab"].each do |env|
+        if File.basename($0).include?(env)
+            environ = env
+            break
+        end
+    end
+    if environ == ""
+        STDERR.puts "Unable to determine environment. Exiting."
+        exit(1)
+    end
+    globs = {}
+    hostvars = {}
+    outobj = {}
+    hosts_arr = []
+    yml = YAML.load_file(env_yaml_path)
+    yml["globals"].each do |key, value|
+        globs[key] = value
+    end
+    yml["environments"].each do |ee|
+        ee.each do |e, hosts|
+            if e == environ
+                hosts.each do |host_hash|
+                    host_hash.each do |host, attributes|
+                        hosts_arr.push(host)
+                        hostvars[host] = globs.merge(attributes)
+                    end
+                end
+            end
+        end
+    end
+    outobj["target"] = {"hosts" => hosts_arr}
+    outobj["_meta"] = {"hostvars" => hostvars}
+    puts outobj.to_json
+end
+
+doit()
+exit(0)
diff --git a/inventory_json_lab.yaml b/inventory_json_lab.yaml
new file mode 120000
index 0000000..d4b67b0
--- /dev/null
+++ b/inventory_json_lab.yaml
@@ -0,0 +1 @@
+inventory_json.yaml
\ No newline at end of file
diff --git a/inventory_json_prod.yaml b/inventory_json_prod.yaml
new file mode 120000
index 0000000..d4b67b0
--- /dev/null
+++ b/inventory_json_prod.yaml
@@ -0,0 +1 @@
+inventory_json.yaml
\ No newline at end of file
diff --git a/inventory_json_staging.yaml b/inventory_json_staging.yaml
new file mode 120000
index 0000000..d4b67b0
--- /dev/null
+++ b/inventory_json_staging.yaml
@@ -0,0 +1 @@
+inventory_json.yaml
\ No newline at end of file
diff --git a/playbooks/apache-ctl.yaml b/playbooks/apache-ctl.yaml
new file mode 100644
index 0000000..cada6c7
--- /dev/null
+++ b/playbooks/apache-ctl.yaml
@@ -0,0 +1,30 @@
+---
+- name: "Stop apache"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: stopped
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: apache2, runlevel: default }
+  when: action == "stop"
+
+- name: "Start apache"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: started
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: apache2, runlevel: default }
+  when: action == "start"
+
+- name: "Restart apache"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: restarted
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: apache2, runlevel: default }
+  when: action == "restart"
diff --git a/playbooks/apache.yaml b/playbooks/apache.yaml
new file mode 100644
index 0000000..f4121d8
--- /dev/null
+++ b/playbooks/apache.yaml
@@ -0,0 +1,30 @@
+---
+- name: "Configure apache vhost"
+  template:
+    src: ../templates/01_openbook.conf
+    dest: /etc/apache2/sites-available
+    mode: 0644
+    owner: root
+    group: root
+  register: vhost_result
+
+- name: "Configure apache modules"
+  shell: |
+    a2enmod headers
+    a2enmod proxy
+    a2enmod proxy_http
+    a2enmod socache_shmcb
+    a2enmod redirect
+    a2enmod ssl
+    a2dissite 000-default.conf
+    a2dissite default-ssl.conf
+    rm /etc/apache2/sites-available/000-default.conf
+    rm /etc/apache2/sites-available/default-ssl.conf
+    a2ensite 01_openbook.conf
+  when: vhost_result["changed"] == True
+
+- include: apache-ctl.yaml action=restart
+  when: vhost_result["changed"] == True
+
+- include: apache-ctl.yaml action=start
+  when: vhost_result["changed"] == False
diff --git a/playbooks/apt.yaml b/playbooks/apt.yaml
new file mode 100644
index 0000000..3e6a085
--- /dev/null
+++ b/playbooks/apt.yaml
@@ -0,0 +1,22 @@
+---
+- name: "Apt update/dist-upgrade"
+  apt:
+    upgrade: dist
+    update_cache: yes
+    dpkg_options: "force-confold,force-confdef"
+
+- name: "Install extra packages"
+  apt:
+    pkg: "{{ item }}"
+    state: present
+  with_items:
+    - language-pack-de
+    - bc
+    - tree
+    - zip
+    - unzip
+    - ntp
+    - openjdk-8-jre-headless
+    - apache2
+    - iotop
+    - nmap
diff --git a/playbooks/install_garbd.yaml b/playbooks/install_garbd.yaml
new file mode 100644
index 0000000..a76fa0b
--- /dev/null
+++ b/playbooks/install_garbd.yaml
@@ -0,0 +1,18 @@
+---
+- name: "Configure SSH"
+  include: ssh.yaml
+
+- name: "Reboot instances"
+  include: reboot.yaml
+
+- name: "Configure DNS on instance"
+  include: dns.yaml
+
+- name: "Configure apt"
+  include: apt_garbd.yaml
+
+- name: "Reboot instances"
+  include: reboot.yaml
+
+- name: "Install openbook"
+  include: update_garbd.yaml
diff --git a/playbooks/install_openbook.yaml b/playbooks/install_openbook.yaml
new file mode 100644
index 0000000..59ac065
--- /dev/null
+++ b/playbooks/install_openbook.yaml
@@ -0,0 +1,27 @@
+---
+- name: "Configure SSH"
+  include: ssh.yaml
+
+- name: "Configure DNS on instance"
+  include: dns.yaml
+
+- name: "Configure apt"
+  include: apt.yaml
+
+- name: "Increase ulimit"
+  include: ulimit.yaml
+
+- name: "Configure SSL"
+  include: ssl.yaml
+
+- name: "Configure apache"
+  include: apache.yaml
+
+- name: "Configure java"
+  include: java.yaml
+
+- name: "Configure logrotate"
+  include: logrotate.yaml
+
+- name: "Install openbook"
+  include: update_openbook.yaml
diff --git a/playbooks/java.yaml b/playbooks/java.yaml
new file mode 100644
index 0000000..435e1a2
--- /dev/null
+++ b/playbooks/java.yaml
@@ -0,0 +1,14 @@
+---
+- name: "Configure java"
+  shell: |
+    update-java-alternatives --set java-1.8.0-openjdk-amd64
+    rm -f /usr/lib/jvm/default-java
+    ln -s /usr/lib/jvm/java-8-openjdk-amd64 /usr/lib/jvm/default-java
+    sed -i '/^JAVA_OPTS/ s/"$/ -Djsse.enableSNIExtension=false -Djava.security.egd=file:\/dev\/urandom"/g' /etc/default/tomcat7
+    update-ca-certificates -f
+    if [ ! -d /etc/tomcat7 ]; then
+        DEBIAN_FRONTEND=noninteractive apt-get -y install tomcat7
+        JVM_HEAP=$(echo "$(grep -F 'MemTotal' /proc/meminfo | awk '{print $2;}') / 2048" | bc) sed -e "s/Xmx\d*m /Xmx${JVM_HEAP}m /g" -i /etc/default/tomcat7
+    fi
+  args:
+    executable: /bin/bash
diff --git a/playbooks/logrotate.yaml b/playbooks/logrotate.yaml
new file mode 100644
index 0000000..e46d8a6
--- /dev/null
+++ b/playbooks/logrotate.yaml
@@ -0,0 +1,10 @@
+---
+- name: "Install logrotate files"
+  copy:
+    src: "../files/{{ item.src }}"
+    dest: "/etc/logrotate.d/{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: root
+  with_items:
+    - { src: logrotate_tomcat7, dest: tomcat7 }
diff --git a/playbooks/openbook_install_war_file.yaml b/playbooks/openbook_install_war_file.yaml
new file mode 100644
index 0000000..fdc8f0a
--- /dev/null
+++ b/playbooks/openbook_install_war_file.yaml
@@ -0,0 +1,18 @@
+---
+- name: "Install Openbook WAR file"
+  shell: |
+    pushd /var/lib/tomcat7/webapps/
+    rm -rf Openbook.old
+    mv Openbook Openbook.old
+    rm -f Openbook.war
+    wget -q --http-user='{{ webdav_username }}' --http-password='{{ webdav_password }}' {{ webdav_url }}/Openbook.war
+    unzip -q Openbook.war -d Openbook
+    sed -e 's|<property name=\"secure\" value=\"true\" \/>|<property name="secure" value="false" />|g' -i Openbook/WEB-INF/classes/applicationContext.xml
+    for f in $(ls); do
+        if [ "${f}" != "Openbook" ]; then
+            rm -rf "${f}"
+        fi
+    done
+    popd
+  args:
+    executable: /bin/bash
diff --git a/playbooks/openrc.yaml b/playbooks/openrc.yaml
new file mode 100644
index 0000000..f491e41
--- /dev/null
+++ b/playbooks/openrc.yaml
@@ -0,0 +1,8 @@
+---
+- name: "Create openrc script"
+  template:
+    src: ../templates/openrc.j2
+    dest: /root/openrc
+    mode: 0644
+    owner: root
+    group: root
diff --git a/playbooks/ssh.yaml b/playbooks/ssh.yaml
new file mode 100644
index 0000000..167a235
--- /dev/null
+++ b/playbooks/ssh.yaml
@@ -0,0 +1,11 @@
+---
+- name: "Configure ssh"
+  shell: |
+    if [ "$(grep -F 'UseDNS' /etc/ssh/sshd_config)" == "" ]; then
+        echo "UseDNS no" | tee -a /etc/ssh/sshd_config
+    else
+        sed -e 's/^UseDNS.*$/UseDNS no/g' -i /etc/ssh/sshd_config
+    fi
+    sed -e 's/^SSHD_OPTS.*$/SSHD_OPTS="-u0"/g' -i /etc/default/ssh
+  args:
+    executable: /bin/bash
diff --git a/playbooks/ssl.yaml b/playbooks/ssl.yaml
new file mode 100644
index 0000000..6b5e53d
--- /dev/null
+++ b/playbooks/ssl.yaml
@@ -0,0 +1,24 @@
+---
+- name: "Create self-signed SSL cert"
+  shell:
+    cmd: |
+      ssl_hostname="{{ ansible_nodename }}.{{ fqdn }}"
+      if [ ! -f "/etc/ssl/certs/${ssl_hostname}.crt" ] && [ ! -f "/etc/ssl/private/${ssl_hostname}.key" ]; then
+          openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 -keyout "/tmp/${ssl_hostname}.key" -out "/tmp/${ssl_hostname}.crt" <<EOF
+      US
+      New Jersey
+      Basking Ridge
+      Verizon Wireless
+      Verizon Cloud Platform
+      ${ssl_hostname}
+      carlos.konstanski@verizonwireless.com
+      EOF
+          cp -f "/tmp/${ssl_hostname}.crt" "/etc/ssl/certs/"
+          cp -f "/tmp/${ssl_hostname}.key" "/etc/ssl/private/"
+          chmod 644 "/etc/ssl/certs/${ssl_hostname}.crt"
+          chown root: "/etc/ssl/certs/${ssl_hostname}.crt"
+          chmod 640 "/etc/ssl/private/${ssl_hostname}.key"
+          chown root:ssl-cert "/etc/ssl/private/${ssl_hostname}.key"
+      fi
+  args:
+    executable: /bin/bash
diff --git a/playbooks/tomcat-ctl.yaml b/playbooks/tomcat-ctl.yaml
new file mode 100644
index 0000000..6f1d0c5
--- /dev/null
+++ b/playbooks/tomcat-ctl.yaml
@@ -0,0 +1,30 @@
+---
+- name: "Stop tomcat"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: stopped
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: tomcat7, runlevel: default }
+  when: action == "stop"
+
+- name: "Start tomcat"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: started
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: tomcat7, runlevel: default }
+  when: action == "start"
+
+- name: "Restart tomcat"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: restarted
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: tomcat7, runlevel: default }
+  when: action == "restart"
diff --git a/playbooks/ulimit.yaml b/playbooks/ulimit.yaml
new file mode 100644
index 0000000..84cd6e0
--- /dev/null
+++ b/playbooks/ulimit.yaml
@@ -0,0 +1,12 @@
+---
+- name: "Set nofile limits"
+  pam_limits:
+    domain: "{{ item.user }}"
+    limit_type: "{{ item.type }}"
+    limit_item: nofile
+    value: 65535
+  with_items:
+    - { user: "*", type: "soft"}
+    - { user: "*", type: "hard"}
+    - { user: "root", type: "soft"}
+    - { user: "root", type: "hard"}
diff --git a/playbooks/update_openbook.yaml b/playbooks/update_openbook.yaml
new file mode 100644
index 0000000..713dbf7
--- /dev/null
+++ b/playbooks/update_openbook.yaml
@@ -0,0 +1,17 @@
+---
+- name: "Stop tomcat"
+  include: tomcat-ctl.yaml action=stop
+
+- name: "Copy script and openbook.properties"
+  include: openbook_install_war_file.yaml
+
+- name: "Copy openbook.properties"
+  template:
+    src: ../templates/openbook.properties
+    dest: /var/lib/tomcat7/webapps/Openbook/WEB-INF/classes/openbook.properties
+    mode: 0644
+    owner: root
+    group: root
+
+- name: "Start tomcat"
+  include: tomcat-ctl.yaml action=start
diff --git a/spin_up_bare_vm.retry b/spin_up_bare_vm.retry
new file mode 100644
index 0000000..2fbb50c
--- /dev/null
+++ b/spin_up_bare_vm.retry
@@ -0,0 +1 @@
+localhost
diff --git a/spin_up_bare_vm.yaml b/spin_up_bare_vm.yaml
new file mode 100755
index 0000000..5ece10d
--- /dev/null
+++ b/spin_up_bare_vm.yaml
@@ -0,0 +1,169 @@
+#!/usr/bin/env ansible-playbook
+---
+- name: "Spin up Openbook v3 node"
+  hosts: localhost
+  vars:
+    user_domain_name: "{{ lookup('env', 'OS_USER_DOMAIN_NAME') }}"
+    project_domain_name: "{{ lookup('env', 'OS_PROJECT_DOMAIN_NAME') }}"
+    username: "{{ lookup('env', 'OS_USERNAME') }}"
+    password: "{{ lookup('env', 'OS_PASSWORD') }}"
+    project_name: "{{ lookup('env', 'OS_PROJECT_NAME') }}"
+    endpoint: "{{ lookup('env', 'OS_AUTH_URL') }}"
+    region: "{{ lookup('env', 'OS_REGION_NAME') }}"
+    interface: "{{ lookup('env', 'OS_INTERFACE') }}"
+    identity_api_version: "{{ lookup('env', 'OS_IDENTITY_API_VERSION') }}"
+    image_api_version: "{{ lookup('env', 'OS_IMAGE_API_VERSION') }}"
+    dns_servers: "{{ lookup('env', 'DNS_SERVERS') }}"
+    flavor_name: "{{ lookup('env', 'FLAVOR_NAME') }}"
+    image_name: "{{ lookup('env', 'IMAGE_NAME') }}"
+    keypair_user: "{{ lookup('env', 'KEYPAIR_USER') }}"
+    pubkey_path: "{{ lookup('env', 'PUBKEY_PATH') }}"
+    router_name: "{{ lookup('env', 'ROUTER_NAME') }}"
+    private_network_name: "{{ lookup('env', 'PRIVATE_NETWORK_NAME') }}"
+    private_network_cidr: "{{ lookup('env', 'PRIVATE_NETWORK_CIDR') }}"
+    public_network_cidrs: "{{ lookup('env', 'PUBLIC_NETWORK_CIDRS') }}"
+    ext_network_name: "{{ lookup('env', 'EXT_NETWORK_NAME') }}"
+    instance_name: "openbook-{{ lookup('env', 'OPENBOOK_ENVIRONMENT') }}-v3"
+  tasks:
+    - name: "Ensure image exists"
+      shell: |
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+        OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+        OS_USERNAME='{{ username }}' \
+        OS_PASSWORD='{{ password }}' \
+        OS_PROJECT_NAME='{{ project_name }}' \
+        OS_AUTH_URL='{{ endpoint }}' \
+        OS_REGION_NAME='{{ region }}' \
+        OS_INTERFACE='{{ interface }}' \
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        {{ playbook_dir }}/files/image.sh \
+        '{{ image_name }}'
+
+    - name: "Ensure flavor exists"
+      shell: |
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+        OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+        OS_USERNAME='{{ username }}' \
+        OS_PASSWORD='{{ password }}' \
+        OS_PROJECT_NAME='{{ project_name }}' \
+        OS_AUTH_URL='{{ endpoint }}' \
+        OS_REGION_NAME='{{ region }}' \
+        OS_INTERFACE='{{ interface }}' \
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        {{ playbook_dir }}/files/flavor.sh \
+        '{{ flavor_name }}'
+
+    - name: "Configure security groups"
+      shell: |
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+        OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+        OS_USERNAME='{{ username }}' \
+        OS_PASSWORD='{{ password }}' \
+        OS_PROJECT_NAME='{{ project_name }}' \
+        OS_AUTH_URL='{{ endpoint }}' \
+        OS_REGION_NAME='{{ region }}' \
+        OS_INTERFACE='{{ interface }}' \
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        {{ playbook_dir }}/files/securitygroup.sh \
+        '{{ private_network_cidr }}' \
+        '{{ public_network_cidrs }}'
+
+    - name: "Configure networks"
+      shell: |
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+        OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+        OS_USERNAME='{{ username }}' \
+        OS_PASSWORD='{{ password }}' \
+        OS_PROJECT_NAME='{{ project_name }}' \
+        OS_AUTH_URL='{{ endpoint }}' \
+        OS_REGION_NAME='{{ region }}' \
+        OS_INTERFACE='{{ interface }}' \
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        {{ playbook_dir }}/files/network.sh \
+        '{{ router_name }}' \
+        '{{ private_network_name }}' \
+        '{{ private_network_cidr }}' \
+        '{{ ext_network_name }}' \
+        '{{ dns_servers }}'
+      register: network_id
+
+    - name: "Configure SSH keypair"
+      shell: |
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+        OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+        OS_USERNAME='{{ username }}' \
+        OS_PASSWORD='{{ password }}' \
+        OS_PROJECT_NAME='{{ project_name }}' \
+        OS_AUTH_URL='{{ endpoint }}' \
+        OS_REGION_NAME='{{ region }}' \
+        OS_INTERFACE='{{ interface }}' \
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        {{ playbook_dir }}/files/keypair.sh \
+        '{{ keypair_user }}_keypair' \
+        '{{ pubkey_path }}' \
+
+    - name: "Customize cloud.cfg"
+      shell: |
+        OS_REGION_NAME='{{ region }}' \
+        DNS_SERVERS='{{ dns_servers }}' \
+        {{ playbook_dir }}/files/cloud.sh \
+        '{{ keypair_user }}' \
+        '{{ pubkey_path }}' \
+        '{{ dns_servers }}'
+
+    - name: "Spin up instance"
+      shell: |
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+        OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+        OS_USERNAME='{{ username }}' \
+        OS_PASSWORD='{{ password }}' \
+        OS_PROJECT_NAME='{{ project_name }}' \
+        OS_AUTH_URL='{{ endpoint }}' \
+        OS_REGION_NAME='{{ region }}' \
+        OS_INTERFACE='{{ interface }}' \
+        OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+        OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+        {{ playbook_dir }}/files/instance.sh \
+        '{{ flavor_name }}' \
+        '{{ image_name }}' \
+        '{{ network_id.stdout }}' \
+        '{{ keypair_user }}_keypair' \
+        '{{ instance_name }}' \
+        '{{ ext_network_name }}'
+      register: ip_name
+
+    # - name: "Configure DNS in OpenStack"
+    #   shell: |
+    #     OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+    #     OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+    #     OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \
+    #     OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \
+    #     OS_USERNAME='{{ username }}' \
+    #     OS_PASSWORD='{{ password }}' \
+    #     OS_PROJECT_NAME='{{ project_name }}' \
+    #     OS_AUTH_URL='{{ endpoint }}' \
+    #     OS_REGION_NAME='{{ region }}' \
+    #     OS_INTERFACE='{{ interface }}' \
+    #     OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \
+    #     OS_IMAGE_API_VERSION='{{ image_api_version }}' \
+    #     {{ playbook_dir }}/files/dns.sh \
+    #     '{{ ip_name.stdout_lines[1] }}' \
+    #     '{{ ip_name.stdout_lines[0] }}'
+    #   register: dns_fqdn
diff --git a/templates/01_openbook.conf b/templates/01_openbook.conf
new file mode 100644
index 0000000..441f67a
--- /dev/null
+++ b/templates/01_openbook.conf
@@ -0,0 +1,33 @@
+{% set hostname = ansible_nodename + '.' + fqdn %}
+{% set ssl_ca = '' %}
+{% set ssl_cert_hostname = 'SSLCertificateFile "/etc/ssl/certs/' + hostname + '.crt"' %}
+{% set ssl_key_hostname = 'SSLCertificateKeyFile "/etc/ssl/private/' + hostname + '.key"' %}
+
+<VirtualHost *:80>
+    Header edit Location ^http://(.*)\$ https://\$1
+    ServerName {{ hostname }}
+    ServerAdmin carlos.konstanski@verizonwireless.com
+    ProxyPreserveHost On
+    ProxyPass /Openbook http://127.0.0.1:8080/Openbook
+    ProxyPassReverse /Openbook http://127.0.0.1:8080/Openbook
+    RedirectMatch "^/$" "/Openbook"
+</VirtualHost>
+
+<VirtualHost *:443>
+    Header edit Location ^http://(.*)\$ https://\$1
+    ServerName {{ hostname }}
+    ServerAdmin carlos.konstanski@verizonwireless.com
+    SSLEngine on
+    {{ ssl_ca }}
+    {{ ssl_cert_hostname }}
+    {{ ssl_key_hostname }}
+    SSLOptions StrictRequire
+    SSLProtocol TLSv1 TLSv1.1 TLSv1.2
+    SSLCipherSuite AES128+EECDH:AES128+EDH
+    SSLHonorCipherOrder on
+    SSLCompression off
+    ProxyPreserveHost On
+    ProxyPass /Openbook http://127.0.0.1:8080/Openbook
+    ProxyPassReverse /Openbook http://127.0.0.1:8080/Openbook
+    RedirectMatch "^/$" "/Openbook"
+</VirtualHost>
diff --git a/templates/garbd.j2 b/templates/garbd.j2
new file mode 100644
index 0000000..d8db715
--- /dev/null
+++ b/templates/garbd.j2
@@ -0,0 +1,2 @@
+GALERA_NODES="{{ ':4567 '.join(galera_nodes) }}:4567"
+GALERA_GROUP="openbook_cluster"
diff --git a/templates/openbook.properties b/templates/openbook.properties
new file mode 100644
index 0000000..d4c0e44
--- /dev/null
+++ b/templates/openbook.properties
@@ -0,0 +1,41 @@
+{% set ips = openbook_gcomm_addresses.split(",") %}
+{% if ips|length > 1 %}
+{% set failover = "failover:" %}
+{% else %}
+{% set failover = "" %}
+{% endif %}
+
+ROOT_PROVIDER_PUBLIC_URL = https://127.0.0.1:8443
+
+DB_USER = openbook
+DB_PASSWORD = {{ openbook_db_password }}
+DB_ENTITY_URL = jdbc:mariadb:{{ failover }}//{{ openbook_gcomm_addresses }}/openbook
+DB_WORKFLOW_URL = jdbc:mariadb:{{ failover }}//{{ openbook_gcomm_addresses }}/openbook_workflow
+DB_JOBS_URL = jdbc:mariadb:{{ failover }}//{{ openbook_gcomm_addresses }}/openbook_jobs
+
+APPLICATION_CONTEXT_ROOT = Openbook
+MAIL_LOG_ALL_OUTGOING = false
+LICENSE_KEY = {{ openbook_api_key }}
+
+DEFAULT_CURRENCY = USD
+DEFAULT_TAX_RATE = 0
+DEFAULTS_BY_COUNTRY = {"ZA":{"taxRate":"14","currency":"ZAR"}}
+
+INACTIVE_REGISTRANT_DELETE_AFTER_HOUR = 0
+PASSWORD_CHANGE_TOKEN_VALID_FOR_HOUR = 72
+
+OPENSTACK_MEMBER_ROLE_NAME = _member_
+OPENSTACK_PROTECTED_TENANTS = admin, services, demo
+
+SPLA_REPORT_IMAGE_LIST = \
+[{"serviceType":"OpenStack Instance", "osAttributeName":"image_id", "osAttributeValue":"6b761277-e919-4c95-baa4-32b2175a44a5","osLabel":"cirros"},\
+{"serviceType":"OpenStack Instance", "osAttributeName":"image_id", "osAttributeValue":"61e4f65a-bcfb-4d46-afe6-004c061bc052","osLabel":"fedora"}]
+
+AAA_MAX_FAILED_LOGIN_ATTEMPTS = 5
+AAA_FAILED_LOGIN_LOCKOUT_SECONDS = 120
+PASSWORD_RULES_HELP_TEXT=Must be at least 8 characters long.<br/>\
+Must contain at least 1 alphabetic character.<br/>\
+Must contain at least 1 numeric character.<br/>\
+Must contain at least 1 special character.<br/>\
+Must not contain whitespace.<br/>\
+Must not be the same as your username.<br/><br/>
diff --git a/templates/openrc.j2 b/templates/openrc.j2
new file mode 100644
index 0000000..178c41a
--- /dev/null
+++ b/templates/openrc.j2
@@ -0,0 +1,13 @@
+export OS_AUTH_URL='{{ endpoint }}'
+export OS_USER_DOMAIN_NAME='{{ user_domain_name }}'
+export OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}'
+export OS_PROJECT_NAME='{{ project_name }}'
+export OS_USERNAME='{{ username }}'
+export OS_PASSWORD='{{ password }}'
+export OS_REGION_NAME='{{ region }}'
+export OS_INTERFACE='{{ interface }}'
+export OS_IDENTITY_API_VERSION='{{ identity_api_version }}'
+export OS_IMAGE_API_VERSION='{{ image_api_version }}'
+export OPENBOOK_DB_USERNAME='root'
+export OPENBOOK_DB_PASSWORD='{{ openbook_db_password }}'
+export OPENBOOK_CONTAINER='backups-openbook'
diff --git a/tomcat-ctl.yaml b/tomcat-ctl.yaml
new file mode 100644
index 0000000..25f5159
--- /dev/null
+++ b/tomcat-ctl.yaml
@@ -0,0 +1,10 @@
+---
+- hosts: target
+  serial: 1
+  tasks:
+    - name: "Check that -e 'action=[stop|start|restart]' was passed in"
+      fail:
+        msg: "The variable 'action' was not passed in with a value of 'stop', 'start' or 'restart' on the command line."
+      when: action not in ["stop", "start", "restart"]
+
+    - include: playbooks/tomcat-ctl.yaml