Ansible Web Tools Installer

You can install easily the basic service for a little startup, that doesn’t need a big infrastructure to work.
Change vars to your needs, the target host, and just execute

./install_cloud.sh

You will have a private cloud, instant messaging, online document editor and an e-mail server.

Additionaly, if you need an CI/CD environment for software development startup, your command is

./install_devtools.sh

This give you Gitlab, Jenkins, Nexus installations automatically.

Or if you need all of them, the magic words are:

./install_all.sh

Features at a Glance

• Private cloud to store all you need via Nextcloud
• Instant messaging and videoconference without 3rd party solutions.
• Online document editor with MS Office (OnlyOffice) and Libreoffice (Collabora) compat.
• E-mail server to manage your domain, with SPAM filter included, via Poste.io
• Ldap server to manage your users, via OpenLDAP
• Gitlab as your main VCS.
• Jenkins as CI/CD manager.
• Nexus as your main artifact repository.
• Sonar as your code quality server.
• Nginx as your main channel to serve all data.
• Auto generation https certs, via Let’s Encrypt
• Use your own https certs instead generated
• Ansible install all your services on unattended way.
• All services, deployed via Docker to simplify the installations and update processes.

Requirements

Hardware

• Cloud tools
  • RAM: 4 GB minimum. 8 GB recommended.
  • CPU cores: 2 cores minimum. 4 recommended
  • Storage free space: 10 GB minimum. Try to get all free space you can: Your storage space on the cloud, and e-mail data, depends on this.
• Development tools
  • RAM: 8 GB minimum. 16 GB recommended.
  • CPU cores: 4 cores minimum. 6 recommended
  • Storage free space: 15 GB minimum. Try to get all free space you can: Your artifact repository data, VCS repositories and compilations, depends on this.
• All web tools
  • RAM: 16 GB minimum.
  • CPU cores: 6 cores minimum.
  • Storage free space: 25 GB minimum. Try to get all free space you can: All your data, depends on this.

    Software

• Supported OS
  • Debian (10 recommended)
  • Ubuntu server (LTS recommended)
• Access
  • SSH server installed
  • Root user or user with sudo permissions

Network

• Access to Internet required from server.
• Access from Internet if the server has to be accessed from outside.
  • If the server, it’s a server with public IP on it’s network interface, that’s all you need.
  • If the server is behind NAT, you need to forward this ports:
    • 80 (HTTP)
    • 443 (HTTPS)
    • 25 (SMTP)
    • 110 (POP3)
    • 143 (IMAP)
    • 465 (SMTP)
    • 587 (SMTP)
    • 993 (IMAP)
    • 995 (POP3)
    • 636 (LDAPS)

DNS

All names for the subdomains could be customize via ansible vars at the installation time.

• Root domain pointing to your public IP with A registry.
• cloud.yourdomain.com as CNAME registry to your root domain (If Nextcloud will be installed)
• mail.yourdomain.com as CNAME registry to your root domain (If E-mail server will be installed)
• ldap.yourdomain.com as CNAME registry to your root domain (If OpenLDAP will be installed)
• collabora.yourdomain.com as CNAME registry to your root domain (If Collabora will be installed)
• onlyoffice.yourdomain.com as CNAME registry to your root domain (If OnlyOffice will be installed)
• gitlab.yourdomain.com as CNAME registry to your root domain (If Gitlab will be installed)
• jenkins.yourdomain.com as CNAME registry to your root domain (If Jenkins will be installed)
• nexus.yourdomain.com as CNAME registry to your root domain (If Nexus will be installed)
• sonar.yourdomain.com as CNAME registry to your root domain (If Sonar will be installed)
• MX register pointing to mail.yourdomain.com with priority 10.

Variables

Vars are distributed among multiple files on the repository.

global_vars.yml

roles/checkdocker/vars/main.yml

roles/openldap/vars/main.yml

roles/collabora/vars/main.yml

roles/onlyoffice/vars/main.yml

roles/nextcloud/vars/main.yml

HTTPS certificates

All services will be deployed over HTTPS, and certificates are needed.

Auto generated

If your server will have access from Internet, you can use the free https certs generator Let’s Encrypt, setting up public_server var to True. This option generate https certs for all services subdomains to install, and you don’t pay attention to renovate it.

Manual certificates

If your server won’t be accessed from Internet, or if it’s public and you have certs for all subdomains, you can put your certs on their directories, and these will be installed.

Your certs have to be named as:

• Certificate: cert.pem
• Private key: privkey.pem
• CA cert: chain.pem

Directories to save your certs:

• roles/proxy/files/root_certs for root certs, to you main domain {{rootdomain}} (Only if you set up install_root var to _True)
• roles/proxycloud/files/cloud_certs for Nextcloud certs, to default subdomain cloud.{{root_domain}}
• roles/proxycloud/files/collabora_certs for Collabora certs, to default subdomain collabora.{{root_domain}}
• roles/proxycloud/files/onlyoffice_certs for Onlyoffice certs, to default subdomain onlyoffice.{{root_domain}}
• roles/proxycloud/files/mail_certs for e-mail certs, to default subdomain mail.{{root_domain}}
• roles/proxycloud/files/ldap_certs for LDAP certs, to default subdomain ldap.{{root_domain}}
• roles/proxydevtools/files/gitlab_certs for Gitlab certs, to default subdomain gitlab.{{root_domain}}
• roles/proxydevtools/files/jenkins_certs for Jenkins certs, to default subdomain jenkins.{{root_domain}}
• roles/proxydevtools/files/nexus_certs for Nexus certs, to default subdomain nexus.{{root_domain}}
• roles/proxydevtools/files/sonar_certs for Sonar certs, to default subdomain sonar.{{root_domain}}

Playbooks and installers

Ansible playbook is a list of independent complex tasks (Named as roles), to execute consecutively to reach you target.

Three playbooks exist:

• install_cloud.yml: Define list of roles to install all cloud services (E-mail, OpenLDAP, Nextcloud, Collabora, Onlyoffice).
• install_devtools.yml: Define list of roles to install all development services (Gitlab, Jenkins, Nexus).
• install_all.yml: Define list of roles to install all cloud and development services.

Related to these playbook, exists three script to launch easily the playbooks:

• install_cloud.sh: Install cloud services via install_cloud.yml playbook.
• install_devtools.sh: Install devtools services via install_cloud.yml playbook.
• install_all.sh: Install all services via install_all.yml playbook.

Roles

List of roles and their description

roles/nextcloud/vars/main.yml

Hosts

To execute installer, you will need modify hosts.cfg to enter your access data.

Example:

10.0.0.12      ansible_ssh_user=myuser  ansible_ssh_pass=mypassword ansible_become_pass=mypassword

If your user, it’s not the root user, you need sudo permissions to execute this installer and ansible_become_pass is required.

Installation

First of all, you need to install Ansible on your machine (Not the server, you own computer) to execute installer. Ansible can be installed on many ways, described on it’s website.

Steps to install:

1. Set up DNS config
2. Forward ports to your server if needed.
3. Set up you target host on hosts.cfg.
4. Set up root_domain var on global-vars.yml
5. Setup for https certs
   1. Auto generated certs: Set up email_certbot var on global-vars.yml and public_server to True
   2. Own certs: Copy all your certs properly named to their directories
6. Set up other vars, as admin passwords.
7. Execute the installer you need:
   1. ./install_cloud.sh to install all cloud services.
   2. ./install_devtools.sh to install all dev tools services.
   3. ./install_all.sh to install all services
8. If you installed Jenkins and Nexus, last role, show you admin passwords.

After the installation process you can access services on this URIs if you didn’t change subdomains

• Nextloud: https://cloud.yourdomain.com
• E-mail: https://mail.yourdomain.com
• LDAP: ldaps://ldap.yourdomain.com:636
• LDAP admin: https://ldap.yourdomain.com. To log in the interface, the default user is “cn=admin,dc=mydomain,dc=com“ and the password on var initial_openldap_admin_password
• Collabora: https://collabora.yourdomain.com doesn’t show you nothing. This URI is for configure collabora on Nextcloud.
• Onlyoffice: https://onlyoffice.yourdomain.com doesn’t show you nothing relevant. This URI is for configure Onlyoffice on Nextcloud.
• Gitlab: https://gitlab.yourdomain.com
• Jenkins: https://jenkins.yourdomain.com
• Nexus: https://nexus.yourdomain.com
• Sonar: https://sonar.yourdomain.com with default user: admin and password: admin

Problems on installation

• If you can’t connect to your server at execute playbooks, first log in to your server manually and accept ssh cert. Ex:ssh root@10.0.0.15

Pull requests are wellcome ;)