play_install_omero.yml

---
- hosts: all
  become: yes

  vars_files:
    - vars/vault.yml  # Encrypt/decrypt with ansible-vault
    - vars/omero-server_config.yml
    - vars/omero-web_config.yml

  vars:
    firewall_ports:
      - { port: 22, proto: "tcp" }
      - { port: 80, proto: "tcp" }
      - { port: 443, proto: "tcp" }
      - { port: 4063, proto: "tcp" }
      - { port: 4064, proto: "tcp" }

  roles:
    - role: ome.postgresql
      postgresql_databases:
        - name: "{{ omero_db_name }}"
          owner: "{{ omero_db_user }}"
      postgresql_users:
        - user: "{{ omero_db_user }}"
          password: "{{ omero_db_pwd }}"
          databases: 
            - "{{ omero_db_name }}"

    - role: ome.omero_server
      omero_server_selfsigned_certificates: true
      omero_server_rootpassword: "{{ omero_root_pwd }}"
      omero_server_dbuser: "{{ omero_db_user }}"
      omero_server_dbname: "{{ omero_db_name }}"
      omero_server_dbpassword: "{{ omero_db_pwd }}"

    - role: ome.redis  # Used by Django to cache responses

    - role: ome.omero_web

  post_tasks:
  
    - name: Check if the system is Rocky Linux or Ubuntu
      ansible.builtin.package_facts:

    - name: Install firewalld on Rocky Linux
      ansible.builtin.yum:
        name: firewalld
        state: present
      when: ansible_facts.os_family == "RedHat"

    - name: Install ufw on Ubuntu
      ansible.builtin.apt:
        name: ufw
        state: present
        update_cache: yes
      when: ansible_facts.os_family == "Debian"

    - name: Ensure firewalld is running on Rocky Linux
      ansible.builtin.service:
        name: firewalld
        state: started
        enabled: yes
      when: ansible_facts.os_family == "RedHat"

    - name: Ensure ufw is enabled on Ubuntu
      ansible.builtin.ufw:
        state: enabled
      when: ansible_facts.os_family == "Debian"

    - name: Open firewall ports on Rocky Linux (firewalld)
      ansible.builtin.firewalld:
        port: "{{ item.port }}/{{ item.proto }}"
        permanent: yes
        state: enabled
      loop: "{{ firewall_ports }}"
      when: ansible_facts.os_family == "RedHat"
      notify: reload_firewalld

    - name: Open firewall ports on Ubuntu (ufw)
      ansible.builtin.ufw:
        rule: allow
        port: "{{ item.port }}"
        proto: "{{ item.proto }}"
      loop: "{{ firewall_ports }}"
      when: ansible_facts.os_family == "Debian"

    - name: Create the omero.sh profile using a template in /etc/profile.d
      ansible.builtin.template:
        src: templates/omero.sh.j2
        dest: /etc/profile.d/omero.sh
        owner: root
        group: root
        mode: '0644'

    - name: NGINX - create nested includes directory
      become: true
      ansible.builtin.file:
        path: /etc/nginx/conf.d-nested-includes
        state: directory
        mode: 0755
        
    - name: NGINX - OMERO websockets
      become: true
      template:
        src: templates/nginx-confdnestedincludes-omerows-conf.j2
        dest: /etc/nginx/conf.d-nested-includes/omerows.conf
        mode: 0644
      notify:
        - restart nginx

    - name: NGINX - websocket proxy support
      become: true
      template:
        src: templates/nginx-confd-websockets-conf.j2
        dest: /etc/nginx/conf.d/websockets.conf
        mode: 0644
      notify:
        - restart nginx

    - name: system packages | set selinux variable
      set_fact:
        selinux_enabled: "{{ ansible_facts.selinux.status == 'enabled' }}"

    - name: SELinux | Add port 4066 to http_port_t type using shell command
      command: semanage port -a -t http_port_t -p tcp 4066
      when: selinux_enabled | default(false)
      become: true
      ignore_errors: true  # Avoid failure if the port is already added

    - name: Create a figure scripts directory
      become: true
      ansible.builtin.file:
        path: "{{ omero_server_basedir }}/OMERO.server/lib/\
          scripts/omero/figure_scripts"
        state: directory
        mode: 0755
        recurse: true
        owner: root

    - name: Download the Figure_To_Pdf.py script
      become: true
      ansible.builtin.get_url:
        url: "https://raw.githubusercontent.com/ome/omero-figure/\
          refs/tags/v{{ omero_figure_script_release }}/omero_figure/scripts/omero/\
          figure_scripts/Figure_To_Pdf.py"
        dest: "{{ omero_server_basedir }}/OMERO.server/lib/\
          scripts/omero/figure_scripts/Figure_To_Pdf.py"
        mode: 0755
        owner: "omero-server"
        group: "omero-server"
        force: true

    - name: Download import memory leak fix
      become: true
      ansible.builtin.get_url:
        url: "https://github.com/glencoesoftware/omero-pc-steward/\
          releases/download/v0.1.0/omero-pc-steward-0.1.0.jar"
        dest: "{{ omero_server_basedir }}/OMERO.server/lib/\
          server/omero-pc-steward-0.1.0.jar"
        mode: 0644
        owner: "omero-server"
        group: "omero-server"
        force: true
      notify: 
        - omero-server restart omero-server

    - name: Add logger line for memory leak fix
      ansible.builtin.lineinfile:
        path: "{{ omero_server_basedir }}/OMERO.server/etc/logback.xml"
        insertafter: '<!-- All below are ROOT loggers -->'
        line: '  <logger name="com.glencoesoftware" level="INFO"/>'
      become: yes

  handlers:
    - name: reload_firewalld
      ansible.builtin.service:
        name: firewalld
        state: reloaded
      when: ansible_facts.os_family == "RedHat"