wiki:ESGFNodeAnsible

Version 11 (modified by zequi, 4 years ago) (diff)

--

ESGF Node deployment with Ansible

Documentation of using Ansible to automate the installation of a ESGF Node.

Tasks

  1. ESGF Autoinstaller - https://github.com/ESGF/esgf-installer/wiki/ESGF-Installation-Using-Autoinstaller
  2. Creation of users - Create a user with name esgfuser. Is this user supposed to run the esgf services? Is it supposed to be accessible from ssh?
  3. ZFS?
  4. NFS - https://meteo.unican.es/trac/wiki/Equipos/Seal/NFSServer/NfsEsgf
  5. Hour synchronization - ntpdate -u hora.rediris.es
  6. PKI keys? - Which users can ssh?
  7. Firewall
    1. Table filter
      1. Policy - DROP
      2. iptables -A INPUT -p tcp --dport ssh -j ACCEPT -s 192.168.x.x/24

Set up from scratch

  1. Create virtual machine
  2. Set hostname (check with hostname --fqdn)
  3. Install Ansible (https://docs.ansible.com/ansible/intro_installation.html)
  4. Execute ansible playbook
  5. Follow instructions to install ESGF node (https://meteo.unican.es/trac/wiki/ESGFNodeTutorial)

Playbook

- name: Set up machine
  hosts: all
  become: true
  become_method: sudo
  tasks:
    - name: install nfs-utils autofs
      yum:
        name: '{{ item }}'
        state: present
      with_items:
        - nfs-utils
        - autofs

    - name: test for line in /etc/idmapd.conf
      command: grep 'Domain = localadmin' /etc/idmapd.conf
      register: idmapd_check
      ignore_errors: true

    - name: add line in /etc/idmapd.conf
      lineinfile: 
        dest: /etc/idmapd.conf
        line: 'Domain = localadmin'
      when: idmapd_check|failed

    - name: test for line in /etc/auto.master
      command: grep '/- /etc/auto.nfs4' /etc/auto.master
      register: auto_master_check
      ignore_errors: true

    - name: add line in /etc/auto.master
      blockinfile: 
        dest: /etc/auto.master
        content: '/- /etc/auto.nfs4
          +auto.master'
      when: auto_master_check|failed

    - name: check if /etc/auto.nfs4 is ready
      command: grep '^/vols/seal/oceano/gmeteo/DATA/ESGF/UNICAN-NODE' /etc/auto.nfs4
      register: nfs4_check
      ignore_errors: true

    - name: add line in /etc/auto.nfs4
      lineinfile:
        create: yes
        state: present
        dest: /etc/auto.nfs4
        line: '/vols/seal/oceano/gmeteo/DATA/ESGF/UNICAN-NODE      -fstype=nfs4 192.168.x.x:/oceano/gmeteo/DATA/ESGF/UNICAN-NODE'
      when: nfs4_check|failed 

    - name: synchronize time
      shell: 'ntpdate -u hora.rediris.es'

    - name: create user esgfuser
      user:
        name: esgfuser
        shell: /bin/bash

    - name: allow ssh in private network
      iptables:
        table: filter
        chain: INPUT
        source: '192.168.202.0/24'
        protocol: tcp
        in_interface: eth1
        destination_port: ssh
        jump: ACCEPT