playbook.yml

---
# The OME training server(s)
# Set https_letsencrypt_enabled to True in production to ensure certbot
# handles the letsencrypt certificate setup

- hosts: ome-outreach
  pre_tasks:

    - name: Install Make Movie script Prerequisite | MEncoder - Repo
      become: yes
      yum:
        name:  http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm
        state: present

    - name: OMERO.figure server-side prerequisites, script prerequisites + web server for decoupled OMERO.web
      become: yes
      yum:
        name: "{{ item }}"
        state: present
      with_items:
        - mencoder # For the 'make movie' script

    - name: Prerequisites for ldap
      become: yes
      yum:
        name: "{{ item }}"
        state: present
      with_items:
        - openldap-clients
        - python-virtualenv
        - gcc
        - python-ldap

    # Since Nginx isn't installed until later the directories are created in advance
    - name: Create nginx include directories
      become: yes
      file:
        path: "{{ item }}"
        state: directory
        mode: 0755
      with_items:
        - /etc/nginx/conf.d
        - /etc/nginx/conf.d-nested-includes

    - name: NGINX - websocket proxy support
      become: yes
      template:
        src: templates/nginx-confd-websockets-conf.j2
        dest: /etc/nginx/conf.d/websockets.conf
        mode: 0644
      # Don't notify, nginx isn't installed yet

  roles:

    - role: ome.postgresql
      postgresql_databases:
      - name: omero
      postgresql_users:
      - user: omero
        password: omero
        databases: [omero]

    - role: ome.postgresql_backup
      postgresql_backup_compress: true
      postgresql_backup_dir: /OMERO/pgbackup
      postgresql_backup_filename_format: "nightly-omero-%a.pgdump.gz"
      postgresql_backup_minimum_expected_size: 100000000

    - role: ome.versioncontrol_utils

    - role: ome.nfs_mount

    - role: ome.omero_server
      omero_server_python_addons:
        - "omero-cli-duplicate=={{ omero_cli_duplicate_release }}"
        - "omero-cli-render=={{ omero_cli_render_release }}"
        - "omero-metadata=={{ omero_metadata_release }}"
        - "omero-py>={{ omero_py_release }}"
        - "reportlab<3.6"
        - markdown
        - scipy
        # For "simple frap with figure" script
        - matplotlib

    - role: ome.omero_web
      tags: ['web']
      idr_omero_web_public_url_filters_webclient_exclude:
        - action
        - annotate_(file|tags|comment|rating|map)
        - script_ui
        - ome_tiff
        - figure_script
      idr_omero_web_public_url_filters:
        - api/
        - webadmin/myphoto/
        - mapr/
        - figure/
        - iviewer/
        - '$'
        - gallery-api/
        - gallery_settings/
        - cell/
        - tissue/
        - webclient/(?!({{ idr_omero_web_public_url_filters_webclient_exclude | join('|') }}))
        - webgateway/(?!(archived_files|download_as))
      omero_web_python_addons:
        - "omero-py>={{ omero_py_release }}"

      omero_web_config_set:
        omero.web.apps:
           - "omero_iviewer"
           - "omero_figure"
           - "omero_fpbioimage"
           - "omero_webtagging_autotag"
           - "omero_webtagging_tagsearch"
           - "omero_parade"
           - "omero_mapr"
        omero.web.ui.center_plugins:
          - ["Auto Tag", "omero_webtagging_autotag/auto_tag_init.js.html", "auto_tag_panel"]
          - ["Parade", "omero_parade/init.js.html", "omero_parade"]
        omero.web.ui.top_links:
          - ["Data", "webindex", {"title": "Browse Data via Projects, Tags etc"}]
          - ["History", "history", {"title": "History"}]
          - ["Help", "https://help.openmicroscopy.org/", {"title": "Open OMERO user guide in a new tab", "target": "new"}]
          - ["Figure", "figure_index", {"title": "Open Figure in new tab", "target": "_blank"}]
          - ["Tag Search", "tagsearch"]
          - ["Genes", {"query_string": {"experimenter": -1}, "viewname": "maprindex_gene"}, {"title": "Find Gene annotations"}]
          - ["Key-Value", {"viewname": "maprindex_keyvalue"}, {"title": "Search for manually-added Key-Value pairs"}]
        omero.web.open_with:
          - ["Image viewer", "webgateway", {"supported_objects": ["image"], "script_url": "webclient/javascript/ome.openwith_viewer.js"}]
          - ["omero_figure", "new_figure", {"supported_objects":["images"], "target": "_blank", "label": "OMERO.figure"}]
          - ["omero_fpbioimage", "fpbioimage_index", {"supported_objects":["image"], "script_url": "fpbioimage/openwith.js", "label": "FPBioimage"}]
          - - omero_iviewer
            - omero_iviewer_index
            - supported_objects:
                - images
                - dataset
                - well
              script_url: omero_iviewer/openwith.js
              label: OMERO.iviewer

        omero.web.viewer.view: omero_iviewer.views.index
        omero.web.mapr.config:
          - menu: gene
            config:
              default:
                - "Gene Symbol"
              all:
                - "Gene Symbol"
                - "Gene Identifier"
              ns:
                - "openmicroscopy.org/mapr/gene"
              label: "Gene"
          - menu: keyvalue
            config:
              default:
                - "Any Value"
              all: []
              ns:
                - "openmicroscopy.org/omero/client/mapAnnotation"
              label: "KeyValue"
        omero.web.nginx_server_extra_config:
          - 'include /etc/nginx/conf.d-nested-includes/*.conf;'
          # TODO: Move the following into a shared variable
          - >
            location = /omero-ws {
              proxy_pass https://127.0.0.1:4066;
              proxy_http_version 1.1;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection $connection_upgrade;
              proxy_read_timeout 86400;
            }

        omero.web.public.enabled: true
        omero.web.public.password: "{{ omero_web_public_password_override | default('secret') }}"
        omero.web.public.url_filter: "^/({{ idr_omero_web_public_url_filters | join('|') }})"
        omero.web.public.user: "{{ omero_web_public_user_override | default('secret') }}"

    - role: ome.iptables_raw

    - role: ome.docker
      docker_additional_options:
        # Manually configure to avoid conflicts between Docker and system rules
        iptables: false

    - role: ome.cli_utils

  tasks:
    - name: Docker | python client
      become: yes
      yum:
        name: docker-python
        state: present

    - name: Create a figure scripts directory
      become: yes
      file:
        path: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Download the Figure_To_Pdf.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-figure/v{{ omero_figure_release }}/omero_figure/scripts/omero/figure_scripts/Figure_To_Pdf.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts/Figure_To_Pdf.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the Dataset_Images_To_New_Figure.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-guide-figure/f45f733a16852ae8b3c52ec93aef480d26b8e9f9/scripts/Dataset_Images_To_New_Figure.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts/Dataset_Images_To_New_Figure.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the Figure_Images_To_Dataset.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-guide-figure/f45f733a16852ae8b3c52ec93aef480d26b8e9f9/scripts/Figure_Images_To_Dataset.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/figure_scripts/Figure_Images_To_Dataset.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Create a workshop_scripts directory
      become: yes
      file:
        path: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Download the Scipy_Gaussian_Filter.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-guide-python/v{{ ome_training_scripts_release }}/scripts/scipy_gaussian_filter.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/Scipy_Gaussian_Filter.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the simple_frap.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-guide-python/v{{ ome_training_scripts_release }}/scripts/simple_frap.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/simple_frap.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Download the simple_frap_with_figure.py script
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/ome/omero-guide-python/v{{ ome_training_scripts_release }}/scripts/simple_frap_with_figure.py
        dest: /opt/omero/server/OMERO.server/lib/scripts/omero/workshop_scripts/simple_frap_with_figure.py
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: yes

    - name: Create a directory for ldap scripts
      become: yes
      file:
        path: /home/ldap
        state: directory
        mode: 0755
        recurse: yes

    - name: Download the ldap scripts
      become: yes
      get_url:
        url: https://raw.githubusercontent.com/openmicroscopy/apacheds-docker/{{ apache_docker_release }}/bin/ldapmanager
        dest: /home/ldap/ldapmanager
        mode: 0755
        force: yes

    - name: Add DropBox folder for trainer-1
      become: yes
      file:
        path: /home/DropBox/trainer-1
        state: directory
        mode: 0755
        recurse: yes
        owner: "omero-server"
        group: "omero-server"

    - name: Add operating system user "importer1"
      become: true
      user:
       name: "importer1"
       state: present
       groups: "{{ omero_server_system_managedrepo_group }}"
       password: "{{ os_system_users_password | password_hash('sha512', 'ome') }}"

    - name: Allow managed repo group to login
      become: yes
      lineinfile:
        path: /etc/security/access.conf
        regexp: "{{ omero_server_system_managedrepo_group }}"
        insertbefore: BOF
        line: "+:{{ omero_server_system_managedrepo_group }}:ALL"

    - name: Run docker for ldap
      become: yes
      docker_container:
        image: openmicroscopy/apacheds:{{ apache_docker_release }}
        name: ldap
        published_ports:
        - "10389:10389"
        state: started
        restart_policy: always

    - name: Run docker for omero-ms-zarr
      become: yes
      docker_container:
        image: openmicroscopy/omero-ms-zarr:{{ omero_ms_zarr_release }}
        name: omero_ms_zarr
        env:
          CONFIG_omero_db_host: localhost
          CONFIG_omero_db_user: omero
          CONFIG_omero_db_pass: omero
          CONFIG_omero_db_name: omero
          CONFIG_omero_data_dir: /OMERO
        network_mode: host
        restart_policy: always
        state: started
        pull: yes
        volumes:
          - "/OMERO:/OMERO:ro"

    - name: Create minio config directory
      become: yes
      file:
        path: /etc/minio
        state: directory
        mode: 0755

    - name: Check if minio admin credentials exists
      become: yes
      stat:
        path: /etc/minio/docker-minio.env
      register: _minio_docker_env_st

    - name: Create random minio admin credentials file
      become: yes
      copy:
        content: |
          MINIO_ACCESS_KEY={{ lookup('password', '/dev/null length=12') }}
          MINIO_SECRET_KEY={{ lookup('password', '/dev/null length=24') }}
        dest: /etc/minio/docker-minio.env
        mode: 0644
      when: not _minio_docker_env_st.stat.exists

    - name: Run docker for minio
      become: yes
      docker_container:
        image: minio/minio:{{ minio_docker_release }}
        name: minio
        command: server /srv/minio
        env_file: /etc/minio/docker-minio.env
        published_ports:
        - "9000:9000"
        state: started
        restart_policy: always
        volumes:
          - "/srv/minio:/srv/minio"

    - name: Nginx - docker webservices support
      become: yes
      template:
        src: templates/nginx-confdnestedincludes-{{ item }}.j2
        dest: /etc/nginx/conf.d-nested-includes/{{ item }}.conf
        mode: 0644
      with_items:
        - omero-ms-zarr
        - minio-publicscratch
      notify:
        - restart nginx

    # https://fralef.me/docker-and-iptables.html
    # https://blog.daknob.net/debian-firewall-docker/
    # Allow:
    # - all outbound from Docker containers
    # - incoming from host localhost

    - name: Iptables Docker forward rules
      become: yes
      iptables_raw_25:
        name: docker_outreach_rules
        rules: |
          -A FORWARD -i docker0 -o {{ external_nic }} -j ACCEPT
          -A FORWARD -i {{ external_nic }} -o docker0 -j ACCEPT
        state: present

    - name: Iptables Docker nat rules
      become: yes
      iptables_raw_25:
        name: docker_outreach_nat
        table: nat
        rules: |
          -A POSTROUTING -o {{ external_nic }} -j MASQUERADE
          # Allow world to access 10389?
          -A INPUT -p tcp -m tcp --dport 10389 -s 0.0.0.0/0 -j ACCEPT
        state: present

    # TODO: Move to an independent role, currently bundled in
    # https://github.com/manics/ansible-role-minio-s3-gateway/blob/0.1.0/tasks/minio-client.yml
    - name: Download minio client
      become: true
      get_url:
        url:
          https://dl.min.io/client/mc/release/linux-amd64/archive/mc.RELEASE.2020-11-25T23-04-07Z
        checksum:
          sha256:985c43f9bec8fdc4ef2ee44c63c9657e10c4cfeb5cb949179d6d693f7428c314
        dest: /usr/local/bin/mc
        mode: u=rwx,g=rx,o=rx

  # Crypted passwords generated using
  # https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-crypted-passwords-for-the-user-module
  vars:
    #omero_server_datadir_chown: True
    #temporal upgrade force for omero server workaround
    #omero_server_checkupgrade_comparator: '!='
    postgresql_version: "13"
    omero_server_selfsigned_certificates: True
    omero_server_system_managedrepo_group: managed_repo_group
    omero_server_datadir_managedrepo_mode: u=rwX,g=srwX,o=rX,+t
    omero_server_datadir_chown: False
    omero_server_release: "{{ omero_server_release_override | default('5.6.8') }}"
    omero_web_release: "{{ omero_web_release_override | default('5.22.1') }}"
    omero_figure_release: "{{ omero_figure_release_override | default('6.0.1') }}"
    omero_fpbioimage_release: "{{ omero_fpbioimage_release_override | default('0.4.1') }}"
    omero_iviewer_release: "{{ omero_iviewer_release_override | default('0.13.0') }}"
    omero_mapr_release: "{{ omero_mapr_release_override | default('0.5.0') }}"
    omero_parade_release: "{{ omero_parade_release_override | default('0.2.4') }}"
    omero_py_release: "{{ omero_py_release_override | default('5.15.0') }}"

    # The omero_web_apps_* vars are used by the ome.omero_web role under
    # Python 3 otherwise ignored
    omero_web_apps_packages:
      - "omero-figure=={{ omero_figure_release }}"
      - "omero-fpbioimage=={{ omero_fpbioimage_release }}"
      - "omero-iviewer=={{ omero_iviewer_release }}"
      - "omero-mapr=={{ omero_mapr_release }}"
      - "omero-parade=={{ omero_parade_release }}"
      - "omero-webtagging-autotag=={{ omero_webtagging_autotag_release }}"
      - "omero-webtagging-tagsearch=={{ omero_webtagging_tagsearch_release }}"

    ome_training_scripts_release: "{{ ome_training_scripts_release_override | default('0.2.0') }}"
    omero_webtagging_autotag_release: "{{ omero_webtagging_autotag_release_override | default('3.2.0') }}"
    omero_webtagging_tagsearch_release: "{{ omero_webtagging_tagsearch_release_override | default('3.2.0') }}"
    omero_cli_duplicate_release: "{{ omero_cli_duplicate_release_override | default('0.4.0') }}"
    omero_metadata_release: "{{ omero_metadata_release_overrride | default('0.8.0') }}"
    omero_cli_render_release: "{{ omero_cli_render_release_override | default('0.7.0') }}"
    os_system_users_password: "{{ os_system_users_password_override | default('ome') }}"
    apache_docker_release: "{{ apache_docker_release_override | default('0.6.0') }}"
    omero_ms_zarr_release: "{{ omero_ms_zarr_release_override | default('latest') }}"
    minio_docker_release: "{{ minio_docker_release_override | default('RELEASE.2020-11-25T22-36-25Z') }}"
    ldap_password: "{{ ldap_password_override | default ('secret') }}"
    omero_server_config_set:
      #omero.fs.importUsers: "fm1"
      omero.certificates.owner: "/C=UK/ST=Scotland/L=Dundee/O=OME"
      omero.client.icetransports: ssl,wss,tcp
      omero.fs.watchDir: "/home/DropBox"
      omero.fs.importArgs: "-T \"regex:^.*/(?<Container1>.*?)\""
      omero.db.poolsize: 60
      omero.jvmcfg.percent.blitz: 50
      omero.jvmcfg.percent.indexer: 20
      omero.jvmcfg.percent.pixeldata: 20
      omero.glacier2.IceSSL.Ciphers: "ADH:HIGH"
      omero.glacier2.IceSSL.DefaultDir: /opt/omero/server/selfsigned
      omero.glacier2.IceSSL.CAs: server.pem
      omero.glacier2.IceSSL.CertFile: server.p12
      # This password doesn't need to be secret
      omero.glacier2.IceSSL.Password: secret
      omero.fs.repo.path: "%user%_%userId%/%thread%//%year%-%month%/%day%/%time%"
      omero.ldap.config: "true"
      omero.ldap.urls: "ldap://localhost:10389"
      omero.ldap.base: "dc=openmicroscopy,dc=org"
      omero.ldap.group_filter: "(objectClass=groupOfUniqueNames)"
      omero.ldap.group_mapping: "name=cn"
      omero.ldap.new_user_group: "MyData"
      omero.ldap.new_user_group_owner: "(owner=@{dn})"
      omero.ldap.password: "{{ ldap_password }}"
      omero.ldap.sync_on_login: "true"
      omero.ldap.user_filter: "(objectClass=person)"
      omero.ldap.user_mapping: "omeName=uid,firstName=givenName,lastName=sn,email=mail"
      omero.ldap.username: "uid=admin,ou=system"
      omero.server.nodedescriptors: "master:Blitz-0,Indexer-0,Processor-0,Storm,Tables-0"

    external_nic: "{{ ansible_default_ipv4.interface }}"

- name: Import letsencrypt
  import_playbook: letsencrypt.yml

- name: Import idr data
  import_playbook: idr_data.yml