web-server.yaml

# Install HTTPS certificate, RStudio server, and facette collectd viewer.
#
# We don't want RStudio to be the primary web application, but one of many.
#
# RStudio documentation:
# 1. Reverse proxy setup
#    https://support.rstudio.com/hc/en-us/articles/200552326-Configuring-the-Server
# 2. Getting started
#    https://support.rstudio.com/hc/en-us/articles/200552306-Getting-Started
# 3. Configuration
#    https://support.rstudio.com/hc/en-us/articles/200552316-Configuring-the-Server
---
- name: Setup SSL, Apache and RStudio Server
  hosts: all
  vars:
    domain: corelab2.mcb.uconn.edu
    facette_read_only: true
    facette_base_path: stats_

  tasks:
  - name: Open port 80 to setup SSL with certbot
    become: yes
    ufw:
      rule: allow
      name: Apache Full

  - name: Install certbot for SSL certificate
    become: yes
    apt:
      name:
        - certbot
        - python3-certbot-apache

  - name: Check if SSL certificate created
    become: yes
    stat:
      path: /etc/letsencrypt/live/{{ domain }}
    register:
      cert
      
  - name: Generate SSL certificate
    become: yes
    # The command also installs /etc/cron.d/certbot for auto-renewal.
    command: certbot --apache
    when: not cert.stat.exists

  - name: Install RStudio Server
    become: yes
    apt:
      deb: https://download2.rstudio.org/server/bionic/amd64/rstudio-server-1.2.5033-amd64.deb
    notify:
    - Restart rstudio-server

  - name: Setup rserver.conf
    become: yes
    template:
      src: templates/rserver.conf.j2
      dest: /etc/rstudio/rserver.conf
    notify:
    - Restart rstudio-server

  - name: Create facette user and group for collectd frontend
    become: yes
    user:
      name: facette
      system: yes
      create_home: no
      shell: /usr/sbin/nologin
    tags: facette

  - name: Apply facette directory permissions
    become: yes
    file:
      state: directory
      path: '{{ dir }}'
      owner: facette
      group: facette
      mode: 0755
    loop:
      - /var/cache/facette/
      - /var/log/facette/
      - /var/lib/facette/
    loop_control:
      loop_var: dir
    tags: facette

  - name: Install collectd frontend facette
    become: yes
    apt:
      deb: https://github.com/facette/facette/releases/download/0.5.1/facette_0.5.1_bionic-amd64.deb
    notify:
      - Restart facette
    tags: facette

  - name: Generate facette configuration file
    become: yes
    template:
      src: templates/facette.yaml.j2
      dest: /etc/facette/facette.yaml
    notify:
      - Enable facette
      - Restart facette
    tags: facette

  - name: Enable proxy modules
    become: yes
    apache2_module:
      name: '{{ item }}'
    loop:
      - proxy_http
      - proxy_wstunnel
    notify:
    - Restart apache2

  # Fix warnings from `sudo apachectl -S`
  - name: Fix apache2 ServerName
    become: yes
    lineinfile:
      path: '{{ item.path }}'
      insertafter: '{{ item.insertafter }}'
      regexp: '{{ item.indent }}ServerName '
      line:   '{{ item.indent }}ServerName {{ domain }}'
    loop:
      - path: /etc/apache2/sites-enabled/000-default.conf
        insertafter: '#ServerName'
        indent: '        '
      - path: /etc/apache2/apache2.conf
        insertafter: '^#ServerRoot'
        indent: ''
    notify:
    - Restart apache2

  - name: Setup reverse proxy
    become: yes
    blockinfile:
      path: '/etc/apache2/sites-enabled/{{ item.file }}'
      insertbefore: '{{ item.insertbefore }}'
      block: |
        RewriteEngine on

        {% if facette_read_only %}
        RewriteCond %{HTTP:Upgrade} =websocket
        RewriteRule /{{ facette_base_path }}/(.*)     ws://localhost:12003/{{ facette_base_path }}/$1  [P,L]
        RewriteCond %{HTTP:Upgrade} !=websocket
        RewriteRule /{{ facette_base_path }}/(.*)     http://localhost:12003/{{ facette_base_path }}/$1 [P,L]
        ProxyPass /{{ facette_base_path }}/ http://localhost:12003/{{ facette_base_path }}/
        ProxyPassReverse /{{ facette_base_path }}/ http://localhost:12003/{{ facette_base_path }}/

        {% endif -%}
        RewriteCond %{HTTP:Upgrade} =websocket
        RewriteRule /rstudio/(.*)     ws://localhost:8787/$1  [P,L]
        RewriteCond %{HTTP:Upgrade} !=websocket
        RewriteRule /rstudio/(.*)     http://localhost:8787/$1 [P,L]
        ProxyPass /rstudio/ http://localhost:8787/
        ProxyPassReverse /rstudio/ http://localhost:8787/

        Redirect / /rstudio/

        ProxyRequests Off
    loop:
      - file: 000-default.conf
        insertbefore: '^</VirtualHost>'
      - file: 000-default-le-ssl.conf
        insertbefore: '^SSLCertificateFile'
    notify:
    - Restart apache2
    tags: facette

  handlers:
  - name: Restart rstudio-server
    become: yes
    systemd:
      name: rstudio-server
      state: restarted

  - name: Enable facette
    become: yes
    service:
      name: facette
      enabled: yes

  - name: Restart facette
    become: yes
    service:
      name: facette
      state: restarted

  - name: Restart apache2
    become: yes
    systemd:
      name: apache2
      state: reloaded