adding files

14 files changed, 271 insertions, 0 deletions

diff --git a/playbooks/apache-ctl.yaml b/playbooks/apache-ctl.yaml
new file mode 100644
index 0000000..cada6c7
--- /dev/null
+++ b/playbooks/apache-ctl.yaml
@@ -0,0 +1,30 @@
+---
+- name: "Stop apache"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: stopped
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: apache2, runlevel: default }
+  when: action == "stop"
+
+- name: "Start apache"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: started
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: apache2, runlevel: default }
+  when: action == "start"
+
+- name: "Restart apache"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: restarted
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: apache2, runlevel: default }
+  when: action == "restart"
diff --git a/playbooks/apache.yaml b/playbooks/apache.yaml
new file mode 100644
index 0000000..f4121d8
--- /dev/null
+++ b/playbooks/apache.yaml
@@ -0,0 +1,30 @@
+---
+- name: "Configure apache vhost"
+  template:
+    src: ../templates/01_openbook.conf
+    dest: /etc/apache2/sites-available
+    mode: 0644
+    owner: root
+    group: root
+  register: vhost_result
+
+- name: "Configure apache modules"
+  shell: |
+    a2enmod headers
+    a2enmod proxy
+    a2enmod proxy_http
+    a2enmod socache_shmcb
+    a2enmod redirect
+    a2enmod ssl
+    a2dissite 000-default.conf
+    a2dissite default-ssl.conf
+    rm /etc/apache2/sites-available/000-default.conf
+    rm /etc/apache2/sites-available/default-ssl.conf
+    a2ensite 01_openbook.conf
+  when: vhost_result["changed"] == True
+
+- include: apache-ctl.yaml action=restart
+  when: vhost_result["changed"] == True
+
+- include: apache-ctl.yaml action=start
+  when: vhost_result["changed"] == False
diff --git a/playbooks/apt.yaml b/playbooks/apt.yaml
new file mode 100644
index 0000000..3e6a085
--- /dev/null
+++ b/playbooks/apt.yaml
@@ -0,0 +1,22 @@
+---
+- name: "Apt update/dist-upgrade"
+  apt:
+    upgrade: dist
+    update_cache: yes
+    dpkg_options: "force-confold,force-confdef"
+
+- name: "Install extra packages"
+  apt:
+    pkg: "{{ item }}"
+    state: present
+  with_items:
+    - language-pack-de
+    - bc
+    - tree
+    - zip
+    - unzip
+    - ntp
+    - openjdk-8-jre-headless
+    - apache2
+    - iotop
+    - nmap
diff --git a/playbooks/install_garbd.yaml b/playbooks/install_garbd.yaml
new file mode 100644
index 0000000..a76fa0b
--- /dev/null
+++ b/playbooks/install_garbd.yaml
@@ -0,0 +1,18 @@
+---
+- name: "Configure SSH"
+  include: ssh.yaml
+
+- name: "Reboot instances"
+  include: reboot.yaml
+
+- name: "Configure DNS on instance"
+  include: dns.yaml
+
+- name: "Configure apt"
+  include: apt_garbd.yaml
+
+- name: "Reboot instances"
+  include: reboot.yaml
+
+- name: "Install openbook"
+  include: update_garbd.yaml
diff --git a/playbooks/install_openbook.yaml b/playbooks/install_openbook.yaml
new file mode 100644
index 0000000..59ac065
--- /dev/null
+++ b/playbooks/install_openbook.yaml
@@ -0,0 +1,27 @@
+---
+- name: "Configure SSH"
+  include: ssh.yaml
+
+- name: "Configure DNS on instance"
+  include: dns.yaml
+
+- name: "Configure apt"
+  include: apt.yaml
+
+- name: "Increase ulimit"
+  include: ulimit.yaml
+
+- name: "Configure SSL"
+  include: ssl.yaml
+
+- name: "Configure apache"
+  include: apache.yaml
+
+- name: "Configure java"
+  include: java.yaml
+
+- name: "Configure logrotate"
+  include: logrotate.yaml
+
+- name: "Install openbook"
+  include: update_openbook.yaml
diff --git a/playbooks/java.yaml b/playbooks/java.yaml
new file mode 100644
index 0000000..435e1a2
--- /dev/null
+++ b/playbooks/java.yaml
@@ -0,0 +1,14 @@
+---
+- name: "Configure java"
+  shell: |
+    update-java-alternatives --set java-1.8.0-openjdk-amd64
+    rm -f /usr/lib/jvm/default-java
+    ln -s /usr/lib/jvm/java-8-openjdk-amd64 /usr/lib/jvm/default-java
+    sed -i '/^JAVA_OPTS/ s/"$/ -Djsse.enableSNIExtension=false -Djava.security.egd=file:\/dev\/urandom"/g' /etc/default/tomcat7
+    update-ca-certificates -f
+    if [ ! -d /etc/tomcat7 ]; then
+        DEBIAN_FRONTEND=noninteractive apt-get -y install tomcat7
+        JVM_HEAP=$(echo "$(grep -F 'MemTotal' /proc/meminfo | awk '{print $2;}') / 2048" | bc) sed -e "s/Xmx\d*m /Xmx${JVM_HEAP}m /g" -i /etc/default/tomcat7
+    fi
+  args:
+    executable: /bin/bash
diff --git a/playbooks/logrotate.yaml b/playbooks/logrotate.yaml
new file mode 100644
index 0000000..e46d8a6
--- /dev/null
+++ b/playbooks/logrotate.yaml
@@ -0,0 +1,10 @@
+---
+- name: "Install logrotate files"
+  copy:
+    src: "../files/{{ item.src }}"
+    dest: "/etc/logrotate.d/{{ item.dest }}"
+    mode: 0644
+    owner: root
+    group: root
+  with_items:
+    - { src: logrotate_tomcat7, dest: tomcat7 }
diff --git a/playbooks/openbook_install_war_file.yaml b/playbooks/openbook_install_war_file.yaml
new file mode 100644
index 0000000..fdc8f0a
--- /dev/null
+++ b/playbooks/openbook_install_war_file.yaml
@@ -0,0 +1,18 @@
+---
+- name: "Install Openbook WAR file"
+  shell: |
+    pushd /var/lib/tomcat7/webapps/
+    rm -rf Openbook.old
+    mv Openbook Openbook.old
+    rm -f Openbook.war
+    wget -q --http-user='{{ webdav_username }}' --http-password='{{ webdav_password }}' {{ webdav_url }}/Openbook.war
+    unzip -q Openbook.war -d Openbook
+    sed -e 's|<property name=\"secure\" value=\"true\" \/>|<property name="secure" value="false" />|g' -i Openbook/WEB-INF/classes/applicationContext.xml
+    for f in $(ls); do
+        if [ "${f}" != "Openbook" ]; then
+            rm -rf "${f}"
+        fi
+    done
+    popd
+  args:
+    executable: /bin/bash
diff --git a/playbooks/openrc.yaml b/playbooks/openrc.yaml
new file mode 100644
index 0000000..f491e41
--- /dev/null
+++ b/playbooks/openrc.yaml
@@ -0,0 +1,8 @@
+---
+- name: "Create openrc script"
+  template:
+    src: ../templates/openrc.j2
+    dest: /root/openrc
+    mode: 0644
+    owner: root
+    group: root
diff --git a/playbooks/ssh.yaml b/playbooks/ssh.yaml
new file mode 100644
index 0000000..167a235
--- /dev/null
+++ b/playbooks/ssh.yaml
@@ -0,0 +1,11 @@
+---
+- name: "Configure ssh"
+  shell: |
+    if [ "$(grep -F 'UseDNS' /etc/ssh/sshd_config)" == "" ]; then
+        echo "UseDNS no" | tee -a /etc/ssh/sshd_config
+    else
+        sed -e 's/^UseDNS.*$/UseDNS no/g' -i /etc/ssh/sshd_config
+    fi
+    sed -e 's/^SSHD_OPTS.*$/SSHD_OPTS="-u0"/g' -i /etc/default/ssh
+  args:
+    executable: /bin/bash
diff --git a/playbooks/ssl.yaml b/playbooks/ssl.yaml
new file mode 100644
index 0000000..6b5e53d
--- /dev/null
+++ b/playbooks/ssl.yaml
@@ -0,0 +1,24 @@
+---
+- name: "Create self-signed SSL cert"
+  shell:
+    cmd: |
+      ssl_hostname="{{ ansible_nodename }}.{{ fqdn }}"
+      if [ ! -f "/etc/ssl/certs/${ssl_hostname}.crt" ] && [ ! -f "/etc/ssl/private/${ssl_hostname}.key" ]; then
+          openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 -keyout "/tmp/${ssl_hostname}.key" -out "/tmp/${ssl_hostname}.crt" <<EOF
+      US
+      New Jersey
+      Basking Ridge
+      Verizon Wireless
+      Verizon Cloud Platform
+      ${ssl_hostname}
+      carlos.konstanski@verizonwireless.com
+      EOF
+          cp -f "/tmp/${ssl_hostname}.crt" "/etc/ssl/certs/"
+          cp -f "/tmp/${ssl_hostname}.key" "/etc/ssl/private/"
+          chmod 644 "/etc/ssl/certs/${ssl_hostname}.crt"
+          chown root: "/etc/ssl/certs/${ssl_hostname}.crt"
+          chmod 640 "/etc/ssl/private/${ssl_hostname}.key"
+          chown root:ssl-cert "/etc/ssl/private/${ssl_hostname}.key"
+      fi
+  args:
+    executable: /bin/bash
diff --git a/playbooks/tomcat-ctl.yaml b/playbooks/tomcat-ctl.yaml
new file mode 100644
index 0000000..6f1d0c5
--- /dev/null
+++ b/playbooks/tomcat-ctl.yaml
@@ -0,0 +1,30 @@
+---
+- name: "Stop tomcat"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: stopped
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: tomcat7, runlevel: default }
+  when: action == "stop"
+
+- name: "Start tomcat"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: started
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: tomcat7, runlevel: default }
+  when: action == "start"
+
+- name: "Restart tomcat"
+  service:
+    name: "{{ item.name }}"
+    enabled: yes
+    state: restarted
+    runlevel: "{{ item.runlevel }}"
+  with_items:
+    - { name: tomcat7, runlevel: default }
+  when: action == "restart"
diff --git a/playbooks/ulimit.yaml b/playbooks/ulimit.yaml
new file mode 100644
index 0000000..84cd6e0
--- /dev/null
+++ b/playbooks/ulimit.yaml
@@ -0,0 +1,12 @@
+---
+- name: "Set nofile limits"
+  pam_limits:
+    domain: "{{ item.user }}"
+    limit_type: "{{ item.type }}"
+    limit_item: nofile
+    value: 65535
+  with_items:
+    - { user: "*", type: "soft"}
+    - { user: "*", type: "hard"}
+    - { user: "root", type: "soft"}
+    - { user: "root", type: "hard"}
diff --git a/playbooks/update_openbook.yaml b/playbooks/update_openbook.yaml
new file mode 100644
index 0000000..713dbf7
--- /dev/null
+++ b/playbooks/update_openbook.yaml
@@ -0,0 +1,17 @@
+---
+- name: "Stop tomcat"
+  include: tomcat-ctl.yaml action=stop
+
+- name: "Copy script and openbook.properties"
+  include: openbook_install_war_file.yaml
+
+- name: "Copy openbook.properties"
+  template:
+    src: ../templates/openbook.properties
+    dest: /var/lib/tomcat7/webapps/Openbook/WEB-INF/classes/openbook.properties
+    mode: 0644
+    owner: root
+    group: root
+
+- name: "Start tomcat"
+  include: tomcat-ctl.yaml action=start