nightshade-webclients.yml

# Install OMERO.web with a public user on localhost

# To allow the OMERO.webapps to upgrade, pass `--extra-vars upgrade_webapps=True`
# to ansible-playbook on the command line.

- hosts: ns-webclients

  pre_tasks:

    # Set desired state of webapps (upgrade v.s. install/keep current version)
    - name: OMERO.web plugin upgrade | set default state "installed"
      set_fact:
        webapps_state: present
    - name: OMERO.web plugin upgrade | if --extra-vars upgrade_webapps == True, allow web plugin(s) to upgrade.
      set_fact:
        webapps_state: latest
      when: upgrade_webapps is defined and upgrade_webapps == "True"

  roles:

    # Root LV Size
    - role: openmicroscopy.lvm-partition
      tags: lvm
      lvm_lvname: "{{ provision_root_lvname }}"
      lvm_vgname: "{{ provision_root_vgname }}"
      lvm_lvmount: /
      lvm_lvsize: "{{ provision_rootsize }}"
      lvm_lvfilesystem: "{{ provision_root_filesystem }}"

    # OMERO.web configuration in host_vars in different repository
    - role: openmicroscopy.omero-web
      omero_web_release: 5.4.7

    # Now OME are using RHEL without Spacewalk, the current best-method of
    # checking `is server deployed in Dundee/SLS` is checking for the SLS nameservers.
    - role: openmicroscopy.system-monitor-agent
      when: "'10.1.255.216' in ansible_dns.nameservers"

  post_tasks:

    - name: Omero.web plugins | plugin install via pip & pypi
      become: yes
      pip:
        name:
        - "omero-figure{{ omero_figure_version_req | default('') }}"
        - "omero-webtagging-autotag"
        - "omero-webtagging-tagsearch"
        editable: False
        state: "{{ webapps_state }}"
        # variable comes from role openmicroscopy.omero-web
        virtualenv: "{{ omero_web_basedir }}/venv"
        virtualenv_site_packages: yes
      notify:
        - restart omero-web

    - name: Omero.web plugins | plugin install via pip & pypi
      become: yes
      pip:
        name:
        - "omero-fpbioimage"
        - "omero-iviewer"
        - "omero-parade"
        editable: False
        state: "{{ webapps_state }}"
        # variable comes from role openmicroscopy.omero-web
        virtualenv: "{{ omero_web_basedir }}/venv"
        virtualenv_site_packages: yes
      when: "'ns-web.openmicroscopy.org' in inventory_hostname"
      notify:
        - restart omero-web

    - name: Install open-vm-tools if system is a VMware vm
      become: yes
      yum:
        name: open-vm-tools
        state: present
      when: >
           ((ansible_virtualization_type is defined)
           and (ansible_virtualization_type == "VMware"))

    # (Total cores / 2), leaving some for WSGI
    # post 2.3 'dest' should be renamed 'path'
    - name: NGINX - Performance tuning - worker processes
      become: yes
      replace:
        dest: "/etc/nginx/nginx.conf"
        regexp: '^worker_processes\s+\d+;'
        replace: "worker_processes {{ ((ansible_processor_count * ansible_processor_cores) / 2) |round|int }};"

    # post 2.3 'dest' should be renamed 'path'
    # cf https://www.digitalocean.com/community/tutorials/how-to-optimize-nginx-configuration
    - name: NGINX - Performance tuning - worker connections
      become: yes
      replace:
        dest: "/etc/nginx/nginx.conf"
        regexp: 'worker_connections\s+\d+;'
        replace: "worker_connections 65000;"

    - name: NGINX - SSL File Deployment - prepare directory
      become: yes
      file:
        path: "{{ nginx_ssl_files_path }}"
        state: directory
        owner: root
        group: root
        mode: "u=r,go="

    - name: NGINX - SSL File Deployment
      become: yes
      copy:
        dest="{{ item.key }}"
        content="{{ item.value.content }}"
        owner="{{ item.value.owner }}"
        group="{{ item.value.group }}"
        mode="{{ item.value.mode }}"
      with_dict: "{{ nginx_ssl_cert_files }}"
      no_log: true

    # post 2.3 'destfile' should be renamed 'path'
    # TODO: Move this to /etc/nginx/conf.d-nested-includes/omero-web-ssl.conf
    - name: NGINX - SSL Configuration - Additional listen port
      become: yes
      lineinfile:
        destfile: /etc/nginx/conf.d/omero-web.conf
        insertafter: '    listen 80;'
        line: '    listen 443 ssl;'

    # post 2.3 'destfile' should be renamed 'path'
    # TODO: Move this to /etc/nginx/conf.d-nested-includes/omero-web-ssl.conf
    - name: NGINX - SSL Configuration - Rest of SSL section to omero-web.conf
      become: yes
      blockinfile:
        destfile: /etc/nginx/conf.d/omero-web.conf
        insertbefore: '.*sendfile.*'
        block: |2+

              ssl_certificate {{ nginx_ssl_files_path }}/{{ nginx_ssl_cert_filename }};
              ssl_certificate_key {{ nginx_ssl_files_path }}/{{ nginx_ssl_key_filename }};
              ssl_protocols  {{ nginx_ssl_protocols }}

              if ($ssl_protocol = "") {
                  rewrite ^/(.*) https://$host/$1 permanent;
              }
      notify:
        - restart nginx

    - name: NGINX - create nested includes directory
      become: yes
      file:
        path: /etc/nginx/conf.d-nested-includes
        state: directory

    - name: NGINX - omero-web.conf nested includes
      become: yes
      lineinfile:
        destfile: /etc/nginx/conf.d/omero-web.conf
        insertafter: 'server {'
        line: '    include /etc/nginx/conf.d-nested-includes/*.conf;'
      notify:
        - restart nginx

    # Config for OMERO.web plugins, loaded into OMERO.web by the
    # omero.web systemd restart.
    - name:
      become: yes
      template:
        src: templates/omero-web-config-for-webapps.j2
        dest: "{{ omero_web_basedir }}/config/omero-web-config-for-webapps.omero"
        owner: "root"
        group: "root"
        mode: "u=rw,go=r"
      when: "'ns-web.openmicroscopy.org' in inventory_hostname"
      notify:
        - restart omero-web

    # Config for OMERO.web plugins, loaded into OMERO.web by the
    # omero.web systemd restart.
    - name:
      become: yes
      template:
        src: templates/omero-web-config-for-webapps_ns-web-pub.j2
        dest: "{{ omero_web_basedir }}/config/omero-web-config-for-webapps.omero"
        owner: "root"
        group: "root"
        mode: "u=rw,go=r"
      when: "'ns-web-pub.openmicroscopy.org' in inventory_hostname"
      notify:
        - restart omero-web

    - name: NGINX - SSL Configuration - Custom Paper Redirect
      tags: redirect
      become: yes
      blockinfile:
        marker: "# {mark} ANSIBLE MANAGED BLOCK - Custom Redirects"
        path: /etc/nginx/conf.d/omero-web.conf
        # Before last line in conf file
        insertbefore: '^\}$'
        block: |2+
              location /pub/schleicher-et-al-2017 {
                  return 307 /webclient/?show=project-27936;
              }
      when: "'ns-web-pub.openmicroscopy.org' in inventory_hostname"
      notify:
        - restart nginx

  vars:
    omero_web_config_set: "{{ omero_web_config_set_for_group | combine(omero_web_config_set_for_host) }}"