diff options
43 files changed, 1243 insertions, 2 deletions
@@ -1 +1,3 @@ -openstackctl +hosts +delete_instances.sh +*~ @@ -1 +1,124 @@ -# openbook-v3-installer +# Overview + +Welcome to the Talligent ansible playbooks. There is one for spinning +up the bare VMs, one for installing Openbook and all its dependencies +on the VMs, and one for upgrading Openbook when we are given a new WAR +file. + + Spin up new VMs: spin_up_bare_vm.yaml (to be replaced with heat) + Install Openbook on the VMs: install_openbook.yaml + Update the Openbook application: update_openbook.yaml + +# Prerequisites + +There must first be a project named "talligent" in the environment, +and it must have a pre-existing DNS domain created via Horizon. The +showback user must have the following roles on the talligent project: + +ResellerAdmin +lbaas_project_admin +admin +designate_project_admin + +Puppet should take care of assigning these roles. + +# spin_up_bare_vm.yaml playbook: + +This playbook spins up a new VM, sets up networking, security groups +and DNS. It will be reimplemented as a heat template in the near +future. The reason it's a standalone playbook now is to make it easier +to replace. + +Run this playbook first. If you want two Openbook nodes, run it twice +in a row. Use 'openstack server list' or horizon to ensure that you +have the VMs you desire. + +This playbook relies on an environment. Source the appropriate +openrc-* file in the conf/ directory. + +In BFD02 you only need to source one environment and spin up two +VMs. In staging and production you will have to spin up two VMs in a +region, source the other region's openrc file, and spin up two more +VMs. + +It is important to spin up all the VMs before moving on to the +install_openbook.yaml playbook. + +It is also vitally important that your VMs have the IP addresses that +are listed in conf/env.yaml. + +The first time you run this playbook it will create a new VM called +<siteiter>-openbook-001. Subsequent runs will create VMs ending in +002, 003, etc. Normally you will not go past two VMs. Production and +staging have special FIPs that have access to the keystone admin +URL. As mentioned above, your VMs must get the FIPs that are listed in +conf/env.yaml. + +Sample invocation: + + ansible-playbook spin_up_bare_vm.yaml + +See below for a full usage scenario. + +# install_openbook.yaml playbook: + +This playbook installs Openbook and all its dependencies on the +VMs. It acts on all the VMs in the environment. You can look at +conf/env.yaml to see which VMs are expected to pre-exist. + +You do not need to source an openrc file to run this playbook. All the +data is in conf/env.yaml. It doesn't matter if your shell has an +openrc file already sourced. This playbook ignores the environment +entirely. + +Invoke the playbook as follows: + + ansible-playbook -i dynamic_hosts_[env].py install_openbook.yaml + +There is a script called dynamic_hosts.py that reads conf/env.yaml and +transforms the data into JSON. You have to tell it which environment +you want. The way you do that is to use the appropriate symlink that +contains the environment name. There are three possible invocations: + + ansible-playbook -i dynamic_hosts_lab.py install_openbook.yaml + ansible-playbook -i dynamic_hosts_staging.py install_openbook.yaml + ansible-playbook -i dynamic_hosts_prod.py install_openbook.yaml + +You only need to run this playbook once regardless of how many VMs +there are. It will hit every VM in the inventory that is generated by +the python script. + +In staging and production the resulting configuration will include a +cross-region galera cluster. + +# update_openbook.yaml + +This playbook will only update the Openbook application with a new WAR +file that is on blobmaster. (See +bfd01-blobmaster-001:/bfd01/swift/Openbook.war) This is what you will +always use once a cluster is up. + +You do not need to source an openrc file to run this playbook. All the +data is in conf/env.yaml. + +You must feed it the dynamic inventory: + + ansible-playbook -i dynamic_hosts_[env].py update_openbook.yaml + +# Usage + +To build a new cluster: shell onto the build node in the environment +in which you want to spin up an Openbook cluster. + + cd /etc/ansible/oneoff/talligent/ + . conf/openrc-[your-desired-profile] + ansible-playbook spin_ip_bare_vm.yaml + ansible-playbook spin_ip_bare_vm.yaml + . conf/openrc-[your-other-desired-profile] + ansible-playbook spin_ip_bare_vm.yaml + ansible-playbook spin_ip_bare_vm.yaml + ansible-playbook -i dynamic_hosts_[env].py install_openbook.yaml + +To update an existing cluster with a new WAR file: + + ansible-playbook -i dynamic_hosts_[env].py update_openbook.yaml diff --git a/apache-ctl.yaml b/apache-ctl.yaml new file mode 100644 index 0000000..fa9f169 --- /dev/null +++ b/apache-ctl.yaml @@ -0,0 +1,10 @@ +--- +- hosts: target + serial: 1 + tasks: + - name: "Check that -e 'action=[stop|start|restart]' was passed in" + fail: + msg: "The variable 'action' was not passed in with a value of 'stop', 'start' or 'restart' on the command line." + when: action not in ["stop", "start", "restart"] + + - include: playbooks/apache-ctl.yaml diff --git a/conf/.gitignore b/conf/.gitignore new file mode 100644 index 0000000..0e13fa0 --- /dev/null +++ b/conf/.gitignore @@ -0,0 +1,5 @@ +openrc-pippiandcarlos.sh +openrc-vzw-lab.sh +openrc-vzw-prod.yaml +openrc-vzw-staging.yaml +os-venv diff --git a/conf/env.yaml b/conf/env.yaml new file mode 100644 index 0000000..b612dc7 --- /dev/null +++ b/conf/env.yaml @@ -0,0 +1,13 @@ +--- +globals: + ansible_ssh_user: root + ansible_private_key_file: /home/ckonstanski/.ssh/id_rsa + ansible_python_interpreter: /usr/bin/python + fqdn: verizoncloudplatform.com + +environments: + - lab: + - openbook-lab-v3-1.verizoncloudplatform.com: + openbook_gcomm_addresses: 172.16.1.15,172.16.1.17 + - openbook-lab-v3-2.verizoncloudplatform.com: + openbook_gcomm_addresses: 172.16.1.15,172.16.1.17 diff --git a/conf/os-requirements.txt b/conf/os-requirements.txt new file mode 100644 index 0000000..6e6041f --- /dev/null +++ b/conf/os-requirements.txt @@ -0,0 +1,10 @@ +python-cinderclient +python-designateclient +python-glanceclient +python-heatclient +python-keystoneclient +python-neutronclient +python-novaclient +python-openstackclient +python-swiftclient + diff --git a/data/etc/cloud/.gitignore b/data/etc/cloud/.gitignore new file mode 100644 index 0000000..deaa6ae --- /dev/null +++ b/data/etc/cloud/.gitignore @@ -0,0 +1 @@ +cloud.cfg diff --git a/files/cloud.sh b/files/cloud.sh new file mode 100755 index 0000000..a188204 --- /dev/null +++ b/files/cloud.sh @@ -0,0 +1,85 @@ +#!/bin/bash + +keypair_user="${1}" +pubkey_path="${2}" +dns_servers="${3}" + +if [ "${keypair_user}" == "" ]; then + echo "No keypair user was supplied." >&2 + exit 1 +elif [ "${pubkey_path}" == "" ]; then + echo "No pubkey path was supplied." >&2 + exit 1 +elif [ "${dns_servers}" == "" ]; then + echo "No dns servers supplied." >&2 + exit 1 +fi + +nameservers=$(for i in ${dns_servers}; do echo -n "'${i}',"; done) +nameservers="${nameservers::-1}" + +cat > "data/etc/cloud/cloud.cfg" <<EOF +#cloud-config +# vim: syntax=yaml + +users: + - name: default + - name: ${keypair_user} + groups: sudo + shell: /bin/bash + sudo: ['ALL=(ALL) NOPASSWD:ALL'] + ssh-authorized-keys: + - $(cat ${pubkey_path}) + +manage-resolv-conf: True + +resolv_conf: + nameservers: [${nameservers}] + +write_files: + - content: | + 127.0.0.1 localhost + 127.0.2.1 openbook-database + + # The following lines are desirable for IPv6 capable hosts + ::1 localhost ip6-localhost ip6-loopback + ff02::1 ip6-allnodes + ff02::2 ip6-allrouters + path: /etc/hosts + + - path: /root/cloudcfg.sh + permissions: "0755" + content: | + #!/bin/bash + + # Prepare the instance for ansible. This amounts to installing python2. + + python=$(which python || which python3 || which python2 || false) + + case "$(${python} -m platform)" in + *Ubuntu*) + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade + apt-get -y install python python2.7 ntp ntpdate + ;; + *centos*|*redhat*) + # RHEL systems still use python2 by default; nothing to do + ;; + *gentoo*) + if [ ! -d /usr/portage/sys-devel/gcc ]; then + emerge-webrsync + fi + emerge --oneshot --update dev-lang/python:2.7 app-portage/gentoolkit net-misc/ntp + rc-update add ntp-client default + rc-update add ntpd default + ;; + esac + + exit 0 + +runcmd: + - /root/cloudcfg.sh +EOF + +exit 0 diff --git a/files/dns.sh b/files/dns.sh new file mode 100755 index 0000000..8c5b203 --- /dev/null +++ b/files/dns.sh @@ -0,0 +1,48 @@ +#!/bin/bash + +instance_name="${1}" +floating_ip="${2}" + +if [ "${instance_name}" == "" ]; then + echo "No instance name supplied." >&2 + exit 1 +elif [ "${floating_ip}" == "" ]; then + echo "No floating IP supplied." >&2 + exit 1 +fi + +domain_id=$(designate domain-list 2>/dev/null | grep -F "cloud.twc.net" | awk '{print $2;}') +if [ "${domain_id}" == "" ]; then + echo -n "Could not find the domain. It must be created in Horizon " >&2 + echo -n "prior to running this playbook so that the project will " >&2 + echo "get correctly wired up to infoblox." >&2 + exit 1 +else + domain_name=$(designate domain-list 2>/dev/null | grep -F "cloud.twc.net" | awk '{print $4;}') + fqdn="${instance_name}.${domain_name}" +fi + +record_id=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}') +if [ "${record_id}" == "" ]; then + designate record-create ${domain_id} --type A --name "${fqdn}" --data ${floating_ip} >/dev/null 2>&1 + record_id=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}') + if [ "${record_id}" == "" ]; then + echo "No existing A record. Cannot create A record." >&2 + exit 1 + fi +else + target_ip=$(designate record-list ${domain_id} 2>/dev/null | grep -F "${fqdn}" | grep -F ' A ' | awk '{print $8;}') + if [ "${target_ip}" != "${floating_ip}" ]; then + designate record-delete ${domain_id} ${record_id} >/dev/null 2>&1 + designate record-create ${domain_id} --type A --name "${fqdn}" --data ${floating_ip} >/dev/null 2>&1 + record_id=$(designate record-list ${domain_id} 2>/dev/null |grep -F "${fqdn}" | grep -F ' A ' | awk '{print $2;}') + if [ "${record_id}" == "" ]; then + echo "Existing A record had wrong IP. Cannot create A record." >&2 + exit 1 + fi + fi +fi + +echo "${fqdn::-1}" + +exit 0 diff --git a/files/flavor.sh b/files/flavor.sh new file mode 100755 index 0000000..c391b18 --- /dev/null +++ b/files/flavor.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +flavor_name="${1}" + +if [ "${flavor_name}" == "" ]; then + echo "No flavor name supplied." >&2 + exit 1 +fi + +flavor_id=$(nova flavor-list | grep -F "${flavor_name}" | awk '{print $2;}') +if [ "${flavor_id}" == "" ]; then + echo -n "Cannot retrieve a flavor ID corresponding to the name: " >&2 + echo "${flavor_name}" >&2 + exit 1 +fi + +exit 0 diff --git a/files/image.sh b/files/image.sh new file mode 100755 index 0000000..fd694cd --- /dev/null +++ b/files/image.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +image_name="${1}" + +if [ "${image_name}" == "" ]; then + echo "No image name supplied." >&2 + exit 1 +fi + +image_id=$(openstack image list --limit 1000 --public 2>/dev/null | grep -F " ${image_name} " | awk '{print $2;}') +if [ "${image_id}" == "" ]; then + echo -n "Cannot retrieve an image ID corresponding to the name: " >&2 + echo "${image_name}" >&2 + exit 1 +fi + +exit 0 diff --git a/files/instance.sh b/files/instance.sh new file mode 100755 index 0000000..6526ded --- /dev/null +++ b/files/instance.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +flavor_name="${1}" +image_name="${2}" +network_id="${3}" +keypair_name="${4}" +instance_name="${5}" +ext_network_name="${6}" + +if [ "${flavor_name}" == "" ]; then + echo "No flavor name supplied." >&2 + exit 1 +elif [ "${image_name}" == "" ]; then + echo "No image name supplied." >&2 + exit 1 +elif [ "${network_id}" == "" ]; then + echo "No network ID supplied." >&2 + exit 1 +elif [ "${keypair_name}" == "" ]; then + echo "No keypair name supplied." >&2 + exit 1 +elif [ "${instance_name}" == "" ]; then + echo "No instance name supplied." >&2 + exit 1 +elif [ "${ext_network_name}" == "" ]; then + echo "No ext network name supplied." >&2 + exit 1 +fi + +associate_floating_ip () { + for line in $(openstack floating ip list | grep -F 'None' | sed -e 's/ //g'); do + floating_ip_id=$(echo ${line} | awk -F\| '{print $2;}') + floating_ip=$(echo ${line} | awk -F\| '{print $3;}') + floating_ip_port=$(echo ${line} | awk -F\| '{print $5;}') + if [ "${floating_ip_port}" == "None" ]; then + nova floating-ip-associate "${1}" "${floating_ip}" >/dev/null 2>&1 + echo "${floating_ip}" + return 0 + fi + done + return 1 +} + +image_id=$(openstack image list --limit 1000 --public 2>/dev/null | grep -F " ${image_name} " | awk '{print $2;}') +if [ "${image_id}" == "" ]; then + echo "Could not find id for image ${image_name}" >&2 + exit 1 +fi + +instance_number=1 +for num in $(openstack server list --limit 1000 2>/dev/null | grep -F "${instance_name}" | awk '{print $4;}' | awk -F- '{print $4;}' | sort); do + if (( "${num}" == ${instance_number} )); then + instance_number=$(expr ${instance_number} + 1) + fi +done + +# TODO: rewrite with openstack server create +instance_id=$(nova boot \ + --flavor "${flavor_name}" \ + --block-device source=image,id=${image_id},dest=volume,size=20,shutdown=preserve,bootindex=0 \ + --nic net-id="${network_id}" \ + --security-groups "default-grp,dns,galera,vertx,web" \ + --key-name "${keypair_name}" \ + --user-data "data/etc/cloud/cloud.cfg" \ + --poll \ + "${instance_name}-${instance_number}" \ + | grep -F ' id ' | awk '{print $4;}') + +if [ "${instance_id}" == "" ]; then + echo "Instance creation did not return an ID." >&2 + exit 1 +fi + +floating_ip_assigned=$(associate_floating_ip ${instance_id}) +if (( ${?} == 1 )); then + openstack floating ip create ${ext_network_name} >/dev/null 2>&1 + if (( ${?} == 0 )); then + floating_ip_assigned=$(associate_floating_ip ${instance_id}) + if (( ${?} == 1 )); then + echo "Could not associate floating IP." >&2 + exit 1 + fi + fi +fi + +# TODO: rewrite with openstackclient command +for sec in default-grp dns galera vertx web; do + nova add-secgroup ${instance_id} ${sec} >/dev/null 2>&1 +done + +echo "${floating_ip_assigned}" +echo "${instance_name}-${instance_number}" + +exit 0 diff --git a/files/keypair.sh b/files/keypair.sh new file mode 100755 index 0000000..0e8374d --- /dev/null +++ b/files/keypair.sh @@ -0,0 +1,35 @@ +#!/bin/bash + +keypair_name="${1}" +pubkey_path="${2}" + +if [ "${keypair_name}" == "" ]; then + echo "No keypair name was supplied." >&2 + exit 1 +elif [ "${pubkey_path}" == "" ]; then + echo "No pubkey path was supplied." >&2 + exit 1 +fi + +keypair_fingerprint=$(openstack keypair list | grep -F "${keypair_name}" | awk '{print $4;}') +if [ "${keypair_fingerprint}" == "" ]; then + if [ "${pubkey_path}" == "" ]; then + echo -n "Need to create an SSH keypair, but no path to a pubkey " >&2 + echo "was supplied." >&2 + exit 1 + elif [ ! -f "${pubkey_path}" ]; then + echo -n "Need to create an SSH keypair, but the supplied path " >&2 + echo "to the pubkey is invalid:" >&2 + echo "${pubkey_path}" >&2 + exit 1 + fi + + openstack keypair create --public-key "${pubkey_path}" "${keypair_name}" + keypair_fingerprint=$(openstack keypair list | grep -F "${keypair_name}" | awk '{print $4;}') + if [ "${keypair_fingerprint}" == "" ]; then + echo "Could not retrieve keypair after creation." >&2 + exit 1 + fi +fi + +exit 0 diff --git a/files/logrotate_tomcat7 b/files/logrotate_tomcat7 new file mode 100644 index 0000000..6f1c36b --- /dev/null +++ b/files/logrotate_tomcat7 @@ -0,0 +1,8 @@ +/var/log/tomcat7/*.log /var/log/tomcat7/*.txt /var/log/tomcat7/catalina.out { + copytruncate + weekly + rotate 4 + compress + missingok + create 640 tomcat7 adm +} diff --git a/files/network.sh b/files/network.sh new file mode 100755 index 0000000..22b0623 --- /dev/null +++ b/files/network.sh @@ -0,0 +1,69 @@ +#!/bin/bash + +router_name="${1}" +private_network_name="${2}" +private_network_cidr="${3}" +ext_network_name="${4}" +dns_servers="${5}" + +if [ "${router_name}" == "" ]; then + echo "No router name supplied." >&2 + exit 1 +elif [ "${private_network_name}" == "" ]; then + echo "No private network name supplied." >&2 + exit 1 +elif [ "${private_network_cidr}" == "" ]; then + echo "No private network CIDR supplied." >&2 + exit 1 +elif [ "${ext_network_name}" == "" ]; then + echo "No external network name supplied." >&2 + exit 1 +elif [ "${dns_servers}" == "" ]; then + echo "No dns servers supplied." >&2 + exit 1 +fi + +ext_network_id=$(openstack network show -f shell -c id "${ext_network_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g') +if [ "${ext_network_id}" == "" ]; then + echo "No ${ext_network_name} network exists." >&2 + exit 1 +fi + +private_network_id=$(openstack network show -f shell -c id "${private_network_name}" 2>/dev/null | awk -F= '{print $2;}' |sed -e 's/\"//g') +if [ "${private_network_id}" == "" ]; then + openstack network create "${private_network_name}" >/dev/null + openstack subnet create \ + "${private_network_name}" \ + --network "${private_network_name}" \ + --subnet-range "${private_network_cidr}" \ + --dns-nameserver $(echo ${dns_servers} | awk '{print $1;}') \ + --dns-nameserver $(echo ${dns_servers} | awk '{print $2;}') \ + --dns-nameserver $(echo ${dns_servers} | awk '{print $3;}') \ + >/dev/null + private_network_id=$(openstack network show -f shell -c id "${private_network_name}" 2>/dev/null | awk -F= '{print $2;}' |sed -e 's/\"//g') + if [ "${private_network_id}" == "" ]; then + echo "Cannot retrieve private network ID after creation." >&2 + exit 1 + fi +fi + +router_id=$(openstack router show -f shell -c id "${router_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g') +if [ "${router_id}" == "" ]; then + openstack router create "${router_name}" >/dev/null + router_id=$(openstack router show -f shell -c id "${router_name}" 2>/dev/null | awk -F= '{print $2;}' | sed -e 's/\"//g') + if [ "${router_id}" == "" ]; then + echo "Cannot retrieve router ID after creation." >&2 + exit 1 + fi +fi + +gateway_info=$(openstack router show -f shell -c external_gateway_info "${router_name}" 2>/dev/null | grep -F 'external_fixed_ips') +if [ "${gateway_info}" == "" ]; then + openstack router set "${router_id}" --external-gateway "${ext_network_id}" >/dev/null +fi + +openstack router add subnet "${router_id}" "${private_network_name}" >/dev/null 2>&1 || true + +echo -n "${private_network_id}" + +exit 0 diff --git a/files/securitygroup.sh b/files/securitygroup.sh new file mode 100755 index 0000000..a7c2ad1 --- /dev/null +++ b/files/securitygroup.sh @@ -0,0 +1,74 @@ +#!/bin/bash + +private_network_cidr="${1}" +public_network_cidrs="${2}" + +for name in default-grp; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for protocol in tcp udp; do + if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv4'" == "" ]; then + openstack security group rule create --egress --protocol ${protocol} --remote-ip 0.0.0.0/0 --dst-port 1:65535 --ethertype IPv4 ${name} >/dev/null 2>&1 + fi + if [ "openstack security group show default -f shell -c rules | grep -F 'ingress' | grep -F \"port_range_min='1'\" | grep -F \"port_range_max='65535'\" | grep -F \"${protocol}\" | grep -F 'IPv6'" == "" ]; then + openstack security group rule create --egress --protocol ${protocol} --remote-ip ::/0 --dst-port 1:65535 --ethertype IPv6 ${name} >/dev/null 2>&1 + fi + done + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"icmp\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol icmp --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + for port in 22; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in dns; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 53; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol udp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in vertx; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 5701:5710; do + for cidr in ${private_network_cidr}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in web; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 8080:8083; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +for name in galera; do + openstack security group show ${name} || openstack security group create --description "${name} ports" ${name} >/dev/null 2>&1 + for port in 3306 4444 4567 9200; do + for cidr in ${private_network_cidr} ${public_network_cidrs}; do + if [ "$(openstack security group show ${name} -f shell -c rules | grep -F \"port_range_min='${port}'\" | grep -F \"remote_ip_prefix='${cidr}'\")" == "" ]; then + openstack security group rule create --ingress --protocol tcp --dst-port ${port} --remote-ip ${cidr} ${name} >/dev/null 2>&1 + fi + done + done +done + +exit 0 diff --git a/install_openbook.retry b/install_openbook.retry new file mode 100644 index 0000000..0b39bfb --- /dev/null +++ b/install_openbook.retry @@ -0,0 +1 @@ +openbook-lab-v3-2.verizoncloudplatform.com diff --git a/install_openbook.yaml b/install_openbook.yaml new file mode 100644 index 0000000..6f9f2e6 --- /dev/null +++ b/install_openbook.yaml @@ -0,0 +1,37 @@ +--- +- hosts: target + vars: + user_domain_name: "{{ lookup('env', 'OS_USER_DOMAIN_NAME') }}" + project_domain_name: "{{ lookup('env', 'OS_PROJECT_DOMAIN_NAME') }}" + username: "{{ lookup('env', 'OS_USERNAME') }}" + password: "{{ lookup('env', 'OS_PASSWORD') }}" + project_name: "{{ lookup('env', 'OS_PROJECT_NAME') }}" + endpoint: "{{ lookup('env', 'OS_AUTH_URL') }}" + region: "{{ lookup('env', 'OS_REGION_NAME') }}" + interface: "{{ lookup('env', 'OS_INTERFACE') }}" + identity_api_version: "{{ lookup('env', 'OS_IDENTITY_API_VERSION') }}" + image_api_version: "{{ lookup('env', 'OS_IMAGE_API_VERSION') }}" + dns_servers: "{{ lookup('env', 'DNS_SERVERS') }}" + flavor_name: "{{ lookup('env', 'FLAVOR_NAME') }}" + image_name: "{{ lookup('env', 'IMAGE_NAME') }}" + keypair_user: "{{ lookup('env', 'KEYPAIR_USER') }}" + pubkey_path: "{{ lookup('env', 'PUBKEY_PATH') }}" + router_name: "{{ lookup('env', 'ROUTER_NAME') }}" + private_network_name: "{{ lookup('env', 'PRIVATE_NETWORK_NAME') }}" + private_network_cidr: "{{ lookup('env', 'PRIVATE_NETWORK_CIDR') }}" + public_network_cidrs: "{{ lookup('env', 'PUBLIC_NETWORK_CIDRS') }}" + ext_network_name: "{{ lookup('env', 'EXT_NETWORK_NAME') }}" + openbook_db_password: "{{ lookup('env', 'OPENBOOK_DB_PASSWORD') }}" + openbook_api_key: "{{ lookup('env', 'OPENBOOK_API_KEY') }}" + webdav_url: "{{ lookup('env', 'WEBDAV_URL') }}" + webdav_username: "{{ lookup('env', 'WEBDAV_USERNAME') }}" + webdav_password: "{{ lookup('env', 'WEBDAV_PASSWORD') }}" + tasks: + - include: playbooks/openrc.yaml + - include: playbooks/apt.yaml + - include: playbooks/ulimit.yaml + - include: playbooks/ssl.yaml + - include: playbooks/apache.yaml + - include: playbooks/java.yaml + - include: playbooks/logrotate.yaml + - include: playbooks/update_openbook.yaml diff --git a/inventory_json.yaml b/inventory_json.yaml new file mode 100755 index 0000000..b7aec21 --- /dev/null +++ b/inventory_json.yaml @@ -0,0 +1,49 @@ +#!/usr/bin/ruby + +require "json" +require "yaml" + +def doit() + env_yaml_path = "#{File.dirname($0)}/conf/env.yaml" + if ! File.file?(env_yaml_path) + STDERR.puts "Unable to find env.yaml. Exiting." + exit(1) + end + environ = "" + ["prod", "staging", "lab"].each do |env| + if File.basename($0).include?(env) + environ = env + break + end + end + if environ == "" + STDERR.puts "Unable to determine environment. Exiting." + exit(1) + end + globs = {} + hostvars = {} + outobj = {} + hosts_arr = [] + yml = YAML.load_file(env_yaml_path) + yml["globals"].each do |key, value| + globs[key] = value + end + yml["environments"].each do |ee| + ee.each do |e, hosts| + if e == environ + hosts.each do |host_hash| + host_hash.each do |host, attributes| + hosts_arr.push(host) + hostvars[host] = globs.merge(attributes) + end + end + end + end + end + outobj["target"] = {"hosts" => hosts_arr} + outobj["_meta"] = {"hostvars" => hostvars} + puts outobj.to_json +end + +doit() +exit(0) diff --git a/inventory_json_lab.yaml b/inventory_json_lab.yaml new file mode 120000 index 0000000..d4b67b0 --- /dev/null +++ b/inventory_json_lab.yaml @@ -0,0 +1 @@ +inventory_json.yaml
\ No newline at end of file diff --git a/inventory_json_prod.yaml b/inventory_json_prod.yaml new file mode 120000 index 0000000..d4b67b0 --- /dev/null +++ b/inventory_json_prod.yaml @@ -0,0 +1 @@ +inventory_json.yaml
\ No newline at end of file diff --git a/inventory_json_staging.yaml b/inventory_json_staging.yaml new file mode 120000 index 0000000..d4b67b0 --- /dev/null +++ b/inventory_json_staging.yaml @@ -0,0 +1 @@ +inventory_json.yaml
\ No newline at end of file diff --git a/playbooks/apache-ctl.yaml b/playbooks/apache-ctl.yaml new file mode 100644 index 0000000..cada6c7 --- /dev/null +++ b/playbooks/apache-ctl.yaml @@ -0,0 +1,30 @@ +--- +- name: "Stop apache" + service: + name: "{{ item.name }}" + enabled: yes + state: stopped + runlevel: "{{ item.runlevel }}" + with_items: + - { name: apache2, runlevel: default } + when: action == "stop" + +- name: "Start apache" + service: + name: "{{ item.name }}" + enabled: yes + state: started + runlevel: "{{ item.runlevel }}" + with_items: + - { name: apache2, runlevel: default } + when: action == "start" + +- name: "Restart apache" + service: + name: "{{ item.name }}" + enabled: yes + state: restarted + runlevel: "{{ item.runlevel }}" + with_items: + - { name: apache2, runlevel: default } + when: action == "restart" diff --git a/playbooks/apache.yaml b/playbooks/apache.yaml new file mode 100644 index 0000000..f4121d8 --- /dev/null +++ b/playbooks/apache.yaml @@ -0,0 +1,30 @@ +--- +- name: "Configure apache vhost" + template: + src: ../templates/01_openbook.conf + dest: /etc/apache2/sites-available + mode: 0644 + owner: root + group: root + register: vhost_result + +- name: "Configure apache modules" + shell: | + a2enmod headers + a2enmod proxy + a2enmod proxy_http + a2enmod socache_shmcb + a2enmod redirect + a2enmod ssl + a2dissite 000-default.conf + a2dissite default-ssl.conf + rm /etc/apache2/sites-available/000-default.conf + rm /etc/apache2/sites-available/default-ssl.conf + a2ensite 01_openbook.conf + when: vhost_result["changed"] == True + +- include: apache-ctl.yaml action=restart + when: vhost_result["changed"] == True + +- include: apache-ctl.yaml action=start + when: vhost_result["changed"] == False diff --git a/playbooks/apt.yaml b/playbooks/apt.yaml new file mode 100644 index 0000000..3e6a085 --- /dev/null +++ b/playbooks/apt.yaml @@ -0,0 +1,22 @@ +--- +- name: "Apt update/dist-upgrade" + apt: + upgrade: dist + update_cache: yes + dpkg_options: "force-confold,force-confdef" + +- name: "Install extra packages" + apt: + pkg: "{{ item }}" + state: present + with_items: + - language-pack-de + - bc + - tree + - zip + - unzip + - ntp + - openjdk-8-jre-headless + - apache2 + - iotop + - nmap diff --git a/playbooks/install_garbd.yaml b/playbooks/install_garbd.yaml new file mode 100644 index 0000000..a76fa0b --- /dev/null +++ b/playbooks/install_garbd.yaml @@ -0,0 +1,18 @@ +--- +- name: "Configure SSH" + include: ssh.yaml + +- name: "Reboot instances" + include: reboot.yaml + +- name: "Configure DNS on instance" + include: dns.yaml + +- name: "Configure apt" + include: apt_garbd.yaml + +- name: "Reboot instances" + include: reboot.yaml + +- name: "Install openbook" + include: update_garbd.yaml diff --git a/playbooks/install_openbook.yaml b/playbooks/install_openbook.yaml new file mode 100644 index 0000000..59ac065 --- /dev/null +++ b/playbooks/install_openbook.yaml @@ -0,0 +1,27 @@ +--- +- name: "Configure SSH" + include: ssh.yaml + +- name: "Configure DNS on instance" + include: dns.yaml + +- name: "Configure apt" + include: apt.yaml + +- name: "Increase ulimit" + include: ulimit.yaml + +- name: "Configure SSL" + include: ssl.yaml + +- name: "Configure apache" + include: apache.yaml + +- name: "Configure java" + include: java.yaml + +- name: "Configure logrotate" + include: logrotate.yaml + +- name: "Install openbook" + include: update_openbook.yaml diff --git a/playbooks/java.yaml b/playbooks/java.yaml new file mode 100644 index 0000000..435e1a2 --- /dev/null +++ b/playbooks/java.yaml @@ -0,0 +1,14 @@ +--- +- name: "Configure java" + shell: | + update-java-alternatives --set java-1.8.0-openjdk-amd64 + rm -f /usr/lib/jvm/default-java + ln -s /usr/lib/jvm/java-8-openjdk-amd64 /usr/lib/jvm/default-java + sed -i '/^JAVA_OPTS/ s/"$/ -Djsse.enableSNIExtension=false -Djava.security.egd=file:\/dev\/urandom"/g' /etc/default/tomcat7 + update-ca-certificates -f + if [ ! -d /etc/tomcat7 ]; then + DEBIAN_FRONTEND=noninteractive apt-get -y install tomcat7 + JVM_HEAP=$(echo "$(grep -F 'MemTotal' /proc/meminfo | awk '{print $2;}') / 2048" | bc) sed -e "s/Xmx\d*m /Xmx${JVM_HEAP}m /g" -i /etc/default/tomcat7 + fi + args: + executable: /bin/bash diff --git a/playbooks/logrotate.yaml b/playbooks/logrotate.yaml new file mode 100644 index 0000000..e46d8a6 --- /dev/null +++ b/playbooks/logrotate.yaml @@ -0,0 +1,10 @@ +--- +- name: "Install logrotate files" + copy: + src: "../files/{{ item.src }}" + dest: "/etc/logrotate.d/{{ item.dest }}" + mode: 0644 + owner: root + group: root + with_items: + - { src: logrotate_tomcat7, dest: tomcat7 } diff --git a/playbooks/openbook_install_war_file.yaml b/playbooks/openbook_install_war_file.yaml new file mode 100644 index 0000000..fdc8f0a --- /dev/null +++ b/playbooks/openbook_install_war_file.yaml @@ -0,0 +1,18 @@ +--- +- name: "Install Openbook WAR file" + shell: | + pushd /var/lib/tomcat7/webapps/ + rm -rf Openbook.old + mv Openbook Openbook.old + rm -f Openbook.war + wget -q --http-user='{{ webdav_username }}' --http-password='{{ webdav_password }}' {{ webdav_url }}/Openbook.war + unzip -q Openbook.war -d Openbook + sed -e 's|<property name=\"secure\" value=\"true\" \/>|<property name="secure" value="false" />|g' -i Openbook/WEB-INF/classes/applicationContext.xml + for f in $(ls); do + if [ "${f}" != "Openbook" ]; then + rm -rf "${f}" + fi + done + popd + args: + executable: /bin/bash diff --git a/playbooks/openrc.yaml b/playbooks/openrc.yaml new file mode 100644 index 0000000..f491e41 --- /dev/null +++ b/playbooks/openrc.yaml @@ -0,0 +1,8 @@ +--- +- name: "Create openrc script" + template: + src: ../templates/openrc.j2 + dest: /root/openrc + mode: 0644 + owner: root + group: root diff --git a/playbooks/ssh.yaml b/playbooks/ssh.yaml new file mode 100644 index 0000000..167a235 --- /dev/null +++ b/playbooks/ssh.yaml @@ -0,0 +1,11 @@ +--- +- name: "Configure ssh" + shell: | + if [ "$(grep -F 'UseDNS' /etc/ssh/sshd_config)" == "" ]; then + echo "UseDNS no" | tee -a /etc/ssh/sshd_config + else + sed -e 's/^UseDNS.*$/UseDNS no/g' -i /etc/ssh/sshd_config + fi + sed -e 's/^SSHD_OPTS.*$/SSHD_OPTS="-u0"/g' -i /etc/default/ssh + args: + executable: /bin/bash diff --git a/playbooks/ssl.yaml b/playbooks/ssl.yaml new file mode 100644 index 0000000..6b5e53d --- /dev/null +++ b/playbooks/ssl.yaml @@ -0,0 +1,24 @@ +--- +- name: "Create self-signed SSL cert" + shell: + cmd: | + ssl_hostname="{{ ansible_nodename }}.{{ fqdn }}" + if [ ! -f "/etc/ssl/certs/${ssl_hostname}.crt" ] && [ ! -f "/etc/ssl/private/${ssl_hostname}.key" ]; then + openssl req -x509 -nodes -sha256 -days 3650 -newkey rsa:4096 -keyout "/tmp/${ssl_hostname}.key" -out "/tmp/${ssl_hostname}.crt" <<EOF + US + New Jersey + Basking Ridge + Verizon Wireless + Verizon Cloud Platform + ${ssl_hostname} + carlos.konstanski@verizonwireless.com + EOF + cp -f "/tmp/${ssl_hostname}.crt" "/etc/ssl/certs/" + cp -f "/tmp/${ssl_hostname}.key" "/etc/ssl/private/" + chmod 644 "/etc/ssl/certs/${ssl_hostname}.crt" + chown root: "/etc/ssl/certs/${ssl_hostname}.crt" + chmod 640 "/etc/ssl/private/${ssl_hostname}.key" + chown root:ssl-cert "/etc/ssl/private/${ssl_hostname}.key" + fi + args: + executable: /bin/bash diff --git a/playbooks/tomcat-ctl.yaml b/playbooks/tomcat-ctl.yaml new file mode 100644 index 0000000..6f1d0c5 --- /dev/null +++ b/playbooks/tomcat-ctl.yaml @@ -0,0 +1,30 @@ +--- +- name: "Stop tomcat" + service: + name: "{{ item.name }}" + enabled: yes + state: stopped + runlevel: "{{ item.runlevel }}" + with_items: + - { name: tomcat7, runlevel: default } + when: action == "stop" + +- name: "Start tomcat" + service: + name: "{{ item.name }}" + enabled: yes + state: started + runlevel: "{{ item.runlevel }}" + with_items: + - { name: tomcat7, runlevel: default } + when: action == "start" + +- name: "Restart tomcat" + service: + name: "{{ item.name }}" + enabled: yes + state: restarted + runlevel: "{{ item.runlevel }}" + with_items: + - { name: tomcat7, runlevel: default } + when: action == "restart" diff --git a/playbooks/ulimit.yaml b/playbooks/ulimit.yaml new file mode 100644 index 0000000..84cd6e0 --- /dev/null +++ b/playbooks/ulimit.yaml @@ -0,0 +1,12 @@ +--- +- name: "Set nofile limits" + pam_limits: + domain: "{{ item.user }}" + limit_type: "{{ item.type }}" + limit_item: nofile + value: 65535 + with_items: + - { user: "*", type: "soft"} + - { user: "*", type: "hard"} + - { user: "root", type: "soft"} + - { user: "root", type: "hard"} diff --git a/playbooks/update_openbook.yaml b/playbooks/update_openbook.yaml new file mode 100644 index 0000000..713dbf7 --- /dev/null +++ b/playbooks/update_openbook.yaml @@ -0,0 +1,17 @@ +--- +- name: "Stop tomcat" + include: tomcat-ctl.yaml action=stop + +- name: "Copy script and openbook.properties" + include: openbook_install_war_file.yaml + +- name: "Copy openbook.properties" + template: + src: ../templates/openbook.properties + dest: /var/lib/tomcat7/webapps/Openbook/WEB-INF/classes/openbook.properties + mode: 0644 + owner: root + group: root + +- name: "Start tomcat" + include: tomcat-ctl.yaml action=start diff --git a/spin_up_bare_vm.retry b/spin_up_bare_vm.retry new file mode 100644 index 0000000..2fbb50c --- /dev/null +++ b/spin_up_bare_vm.retry @@ -0,0 +1 @@ +localhost diff --git a/spin_up_bare_vm.yaml b/spin_up_bare_vm.yaml new file mode 100755 index 0000000..5ece10d --- /dev/null +++ b/spin_up_bare_vm.yaml @@ -0,0 +1,169 @@ +#!/usr/bin/env ansible-playbook +--- +- name: "Spin up Openbook v3 node" + hosts: localhost + vars: + user_domain_name: "{{ lookup('env', 'OS_USER_DOMAIN_NAME') }}" + project_domain_name: "{{ lookup('env', 'OS_PROJECT_DOMAIN_NAME') }}" + username: "{{ lookup('env', 'OS_USERNAME') }}" + password: "{{ lookup('env', 'OS_PASSWORD') }}" + project_name: "{{ lookup('env', 'OS_PROJECT_NAME') }}" + endpoint: "{{ lookup('env', 'OS_AUTH_URL') }}" + region: "{{ lookup('env', 'OS_REGION_NAME') }}" + interface: "{{ lookup('env', 'OS_INTERFACE') }}" + identity_api_version: "{{ lookup('env', 'OS_IDENTITY_API_VERSION') }}" + image_api_version: "{{ lookup('env', 'OS_IMAGE_API_VERSION') }}" + dns_servers: "{{ lookup('env', 'DNS_SERVERS') }}" + flavor_name: "{{ lookup('env', 'FLAVOR_NAME') }}" + image_name: "{{ lookup('env', 'IMAGE_NAME') }}" + keypair_user: "{{ lookup('env', 'KEYPAIR_USER') }}" + pubkey_path: "{{ lookup('env', 'PUBKEY_PATH') }}" + router_name: "{{ lookup('env', 'ROUTER_NAME') }}" + private_network_name: "{{ lookup('env', 'PRIVATE_NETWORK_NAME') }}" + private_network_cidr: "{{ lookup('env', 'PRIVATE_NETWORK_CIDR') }}" + public_network_cidrs: "{{ lookup('env', 'PUBLIC_NETWORK_CIDRS') }}" + ext_network_name: "{{ lookup('env', 'EXT_NETWORK_NAME') }}" + instance_name: "openbook-{{ lookup('env', 'OPENBOOK_ENVIRONMENT') }}-v3" + tasks: + - name: "Ensure image exists" + shell: | + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + OS_USERNAME='{{ username }}' \ + OS_PASSWORD='{{ password }}' \ + OS_PROJECT_NAME='{{ project_name }}' \ + OS_AUTH_URL='{{ endpoint }}' \ + OS_REGION_NAME='{{ region }}' \ + OS_INTERFACE='{{ interface }}' \ + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + {{ playbook_dir }}/files/image.sh \ + '{{ image_name }}' + + - name: "Ensure flavor exists" + shell: | + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + OS_USERNAME='{{ username }}' \ + OS_PASSWORD='{{ password }}' \ + OS_PROJECT_NAME='{{ project_name }}' \ + OS_AUTH_URL='{{ endpoint }}' \ + OS_REGION_NAME='{{ region }}' \ + OS_INTERFACE='{{ interface }}' \ + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + {{ playbook_dir }}/files/flavor.sh \ + '{{ flavor_name }}' + + - name: "Configure security groups" + shell: | + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + OS_USERNAME='{{ username }}' \ + OS_PASSWORD='{{ password }}' \ + OS_PROJECT_NAME='{{ project_name }}' \ + OS_AUTH_URL='{{ endpoint }}' \ + OS_REGION_NAME='{{ region }}' \ + OS_INTERFACE='{{ interface }}' \ + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + {{ playbook_dir }}/files/securitygroup.sh \ + '{{ private_network_cidr }}' \ + '{{ public_network_cidrs }}' + + - name: "Configure networks" + shell: | + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + OS_USERNAME='{{ username }}' \ + OS_PASSWORD='{{ password }}' \ + OS_PROJECT_NAME='{{ project_name }}' \ + OS_AUTH_URL='{{ endpoint }}' \ + OS_REGION_NAME='{{ region }}' \ + OS_INTERFACE='{{ interface }}' \ + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + {{ playbook_dir }}/files/network.sh \ + '{{ router_name }}' \ + '{{ private_network_name }}' \ + '{{ private_network_cidr }}' \ + '{{ ext_network_name }}' \ + '{{ dns_servers }}' + register: network_id + + - name: "Configure SSH keypair" + shell: | + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + OS_USERNAME='{{ username }}' \ + OS_PASSWORD='{{ password }}' \ + OS_PROJECT_NAME='{{ project_name }}' \ + OS_AUTH_URL='{{ endpoint }}' \ + OS_REGION_NAME='{{ region }}' \ + OS_INTERFACE='{{ interface }}' \ + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + {{ playbook_dir }}/files/keypair.sh \ + '{{ keypair_user }}_keypair' \ + '{{ pubkey_path }}' \ + + - name: "Customize cloud.cfg" + shell: | + OS_REGION_NAME='{{ region }}' \ + DNS_SERVERS='{{ dns_servers }}' \ + {{ playbook_dir }}/files/cloud.sh \ + '{{ keypair_user }}' \ + '{{ pubkey_path }}' \ + '{{ dns_servers }}' + + - name: "Spin up instance" + shell: | + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + OS_USERNAME='{{ username }}' \ + OS_PASSWORD='{{ password }}' \ + OS_PROJECT_NAME='{{ project_name }}' \ + OS_AUTH_URL='{{ endpoint }}' \ + OS_REGION_NAME='{{ region }}' \ + OS_INTERFACE='{{ interface }}' \ + OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + {{ playbook_dir }}/files/instance.sh \ + '{{ flavor_name }}' \ + '{{ image_name }}' \ + '{{ network_id.stdout }}' \ + '{{ keypair_user }}_keypair' \ + '{{ instance_name }}' \ + '{{ ext_network_name }}' + register: ip_name + + # - name: "Configure DNS in OpenStack" + # shell: | + # OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + # OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + # OS_USER_DOMAIN_NAME='{{ user_domain_name }}' \ + # OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' \ + # OS_USERNAME='{{ username }}' \ + # OS_PASSWORD='{{ password }}' \ + # OS_PROJECT_NAME='{{ project_name }}' \ + # OS_AUTH_URL='{{ endpoint }}' \ + # OS_REGION_NAME='{{ region }}' \ + # OS_INTERFACE='{{ interface }}' \ + # OS_IDENTITY_API_VERSION='{{ identity_api_version }}' \ + # OS_IMAGE_API_VERSION='{{ image_api_version }}' \ + # {{ playbook_dir }}/files/dns.sh \ + # '{{ ip_name.stdout_lines[1] }}' \ + # '{{ ip_name.stdout_lines[0] }}' + # register: dns_fqdn diff --git a/templates/01_openbook.conf b/templates/01_openbook.conf new file mode 100644 index 0000000..441f67a --- /dev/null +++ b/templates/01_openbook.conf @@ -0,0 +1,33 @@ +{% set hostname = ansible_nodename + '.' + fqdn %} +{% set ssl_ca = '' %} +{% set ssl_cert_hostname = 'SSLCertificateFile "/etc/ssl/certs/' + hostname + '.crt"' %} +{% set ssl_key_hostname = 'SSLCertificateKeyFile "/etc/ssl/private/' + hostname + '.key"' %} + +<VirtualHost *:80> + Header edit Location ^http://(.*)\$ https://\$1 + ServerName {{ hostname }} + ServerAdmin carlos.konstanski@verizonwireless.com + ProxyPreserveHost On + ProxyPass /Openbook http://127.0.0.1:8080/Openbook + ProxyPassReverse /Openbook http://127.0.0.1:8080/Openbook + RedirectMatch "^/$" "/Openbook" +</VirtualHost> + +<VirtualHost *:443> + Header edit Location ^http://(.*)\$ https://\$1 + ServerName {{ hostname }} + ServerAdmin carlos.konstanski@verizonwireless.com + SSLEngine on + {{ ssl_ca }} + {{ ssl_cert_hostname }} + {{ ssl_key_hostname }} + SSLOptions StrictRequire + SSLProtocol TLSv1 TLSv1.1 TLSv1.2 + SSLCipherSuite AES128+EECDH:AES128+EDH + SSLHonorCipherOrder on + SSLCompression off + ProxyPreserveHost On + ProxyPass /Openbook http://127.0.0.1:8080/Openbook + ProxyPassReverse /Openbook http://127.0.0.1:8080/Openbook + RedirectMatch "^/$" "/Openbook" +</VirtualHost> diff --git a/templates/garbd.j2 b/templates/garbd.j2 new file mode 100644 index 0000000..d8db715 --- /dev/null +++ b/templates/garbd.j2 @@ -0,0 +1,2 @@ +GALERA_NODES="{{ ':4567 '.join(galera_nodes) }}:4567" +GALERA_GROUP="openbook_cluster" diff --git a/templates/openbook.properties b/templates/openbook.properties new file mode 100644 index 0000000..d4c0e44 --- /dev/null +++ b/templates/openbook.properties @@ -0,0 +1,41 @@ +{% set ips = openbook_gcomm_addresses.split(",") %} +{% if ips|length > 1 %} +{% set failover = "failover:" %} +{% else %} +{% set failover = "" %} +{% endif %} + +ROOT_PROVIDER_PUBLIC_URL = https://127.0.0.1:8443 + +DB_USER = openbook +DB_PASSWORD = {{ openbook_db_password }} +DB_ENTITY_URL = jdbc:mariadb:{{ failover }}//{{ openbook_gcomm_addresses }}/openbook +DB_WORKFLOW_URL = jdbc:mariadb:{{ failover }}//{{ openbook_gcomm_addresses }}/openbook_workflow +DB_JOBS_URL = jdbc:mariadb:{{ failover }}//{{ openbook_gcomm_addresses }}/openbook_jobs + +APPLICATION_CONTEXT_ROOT = Openbook +MAIL_LOG_ALL_OUTGOING = false +LICENSE_KEY = {{ openbook_api_key }} + +DEFAULT_CURRENCY = USD +DEFAULT_TAX_RATE = 0 +DEFAULTS_BY_COUNTRY = {"ZA":{"taxRate":"14","currency":"ZAR"}} + +INACTIVE_REGISTRANT_DELETE_AFTER_HOUR = 0 +PASSWORD_CHANGE_TOKEN_VALID_FOR_HOUR = 72 + +OPENSTACK_MEMBER_ROLE_NAME = _member_ +OPENSTACK_PROTECTED_TENANTS = admin, services, demo + +SPLA_REPORT_IMAGE_LIST = \ +[{"serviceType":"OpenStack Instance", "osAttributeName":"image_id", "osAttributeValue":"6b761277-e919-4c95-baa4-32b2175a44a5","osLabel":"cirros"},\ +{"serviceType":"OpenStack Instance", "osAttributeName":"image_id", "osAttributeValue":"61e4f65a-bcfb-4d46-afe6-004c061bc052","osLabel":"fedora"}] + +AAA_MAX_FAILED_LOGIN_ATTEMPTS = 5 +AAA_FAILED_LOGIN_LOCKOUT_SECONDS = 120 +PASSWORD_RULES_HELP_TEXT=Must be at least 8 characters long.<br/>\ +Must contain at least 1 alphabetic character.<br/>\ +Must contain at least 1 numeric character.<br/>\ +Must contain at least 1 special character.<br/>\ +Must not contain whitespace.<br/>\ +Must not be the same as your username.<br/><br/> diff --git a/templates/openrc.j2 b/templates/openrc.j2 new file mode 100644 index 0000000..178c41a --- /dev/null +++ b/templates/openrc.j2 @@ -0,0 +1,13 @@ +export OS_AUTH_URL='{{ endpoint }}' +export OS_USER_DOMAIN_NAME='{{ user_domain_name }}' +export OS_PROJECT_DOMAIN_NAME='{{ project_domain_name }}' +export OS_PROJECT_NAME='{{ project_name }}' +export OS_USERNAME='{{ username }}' +export OS_PASSWORD='{{ password }}' +export OS_REGION_NAME='{{ region }}' +export OS_INTERFACE='{{ interface }}' +export OS_IDENTITY_API_VERSION='{{ identity_api_version }}' +export OS_IMAGE_API_VERSION='{{ image_api_version }}' +export OPENBOOK_DB_USERNAME='root' +export OPENBOOK_DB_PASSWORD='{{ openbook_db_password }}' +export OPENBOOK_CONTAINER='backups-openbook' diff --git a/tomcat-ctl.yaml b/tomcat-ctl.yaml new file mode 100644 index 0000000..25f5159 --- /dev/null +++ b/tomcat-ctl.yaml @@ -0,0 +1,10 @@ +--- +- hosts: target + serial: 1 + tasks: + - name: "Check that -e 'action=[stop|start|restart]' was passed in" + fail: + msg: "The variable 'action' was not passed in with a value of 'stop', 'start' or 'restart' on the command line." + when: action not in ["stop", "start", "restart"] + + - include: playbooks/tomcat-ctl.yaml |