README.md

# [Ansible](https://docs.ansible.com/ansible/index.html) repository for LAS/CS NSQ computer
You need to have access to this repository (you need to add your public ssh-key (`ssh-keygen`) to your profile here).
Then you can clone the git repository to work on in locally.
`git clone git@git.scc.kit.edu:las/ansible.git`

Add your computer to the `hosts` file or if you are just testing add it to the local file.
Add your ``hostname`` under each role name (the name in the square brackets) you want to be run on your computer.
Also create a new file which is named
after your [fully-qualified-domain-name](https://de.wikipedia.org/wiki/Domain_(Internet)#Fully_Qualified_Domain_Name_.28FQDN.29}) (FQDN) in the `host_vars` directory including a [yaml](https://docs.ansible.com/ansible/YAMLSyntax.html) list with some host specific configuration variables, e. g. copy another similar host and adjust it.
These files do not have the `.yml` extension and do not start with `---` as most of the other yaml files do.
Then create a file named after your FQDN with the extension ``.yml`` in the main directory of ansible which includes all the roles one want to run. This step needs root privileges and therefore makes only sense for the first installation of a computer.

Install ansible and some dependencies: 

```
dnf install ansible git python2-dnf libselinux-python
```
Run 

``` bash
git clone  clone git@git.scc.kit.edu:las/ansible.git
cd ansible
ansible-playbook --ask-become-pass --limit $(hostname -f) --vault-id @prompt site.yml
```

  * If you only want some parts of the roles to be run, you can use the option `-t TAGNAME` to run only those tasks with the given tag.

### Ask for new software
Open an issue in the GitLab issue tracker and use the template for softwarerequests.

If the software is in the Fedora repositories and you think it makes sense to 
install this software only on your computer, you can also provide a merge/pull 
requst by adding the software name to the list of `extra_software` in the 
`host_vars` file for your computer.

## How to get new software on your computer

## Available roles

* common.yml: basic configuration for all LAS/NSQ computers
* clients.yml: all computers not acting as a server (only) ^1
* desktop.yml: all desktop computers including laptops (having X11/Wayland)
* graphics.yml: fundamental graphics software (Inkscape, Gimp)
* python.yml: basic python_stack for scientific Python usage (including fitting) ^1
* ipynb.yml: IPython/Jupyter notebook ^1
* nfs.yml:
  * nfs-server: export /las-archiv1 to our network
  * lasarchiv: client side mount las126/las-archiv1
* dhcpd.yml: DHCPd primary and secondary server on Fedora
* opera.yml: Cobham's Opera3d (client) ^2 ^3
* admin.yml: tools for administrators
* latex.yml: basic LaTeX installation (Arial not yet) ^1
* kdev.yml: KDevelope (with Python PlugIn) ^1
* jabref.yml: Cross platform BibTeX bibilography software [JabRef](http://www.jabref.org/)
* pycharm.yml: Cross platform Python IDE: [PyCharm](https://www.jetbrains.com/pycharm/) IDE
* chrome.yml: Google Chrome for Fedora (for Adobe Connect usage)
* elegant.yml: elegant (no Pelegant, yet)
* inovesa.yml: [Inovesa](https://github.com/Inovesa/Inovesa)
* undulator_control.yml: Install the software stack that is necessary to develop the control system for the JENA TGU experiment

^1: (also put your FQDN to the \[common\] section in the hosts file as it depends hereon)

^3: (also put your FQDN to the \[lasarchiv\] section in the hosts file as it depends hereon)

### ^2 Opera

After installing Opera via ansible you must confirm the license agreement at first start and go to "Licensing -> Set License Path" and switch to `Other computer(s)` and fill in `@129.13.108.100`.

# Develop new roles, extend or modify existing ones and update roles for new software

## Branches
All roles in the master branch should work and should not brake on any of our systems (desktop, server, simulation, notebooks). The `site.yml` should always be runnable and include all roles that are stable and not explicitly for setup purposes only.

For developement and testing you should use development branches like `dev-latex`.

You can check the syntax of the files by running `ansible-playbook --check-syntax filename.yml` (or by using the pre-commit-hook from the Snipplets.

If you just want to install one or many packages you can use `jabref.yml` as a basis.

Be aware that the development branches here are not save and the owner might force push to them!

# Run as admin 
## Bootstraping
* Add your SSH-key to the host `ssh-copy-id lasXXX.las.kit.edu`
* Install ansible dependencies: `dnf install python2-dnf libselinux-python`
* Run `ansible-playbook -K --vault-id @prompt sites.yml` probably with the option `-l lasXXX.las.kit.edu`

## Edit encrypted files
* You can either use `ansible-vault edit --vault-id @prompt group_vars/all/vault.yml` to edit the file in your editor mentioned in the `$EDITOR` environment variable or
* you can decrypt the file `ansible-vault decrypt --vault-id @prompt group_vars/all/vault.yml`, edit the file and encrypt it again `ansible-vault encrypt --ask-vault-pass group_vars/all/vault.yml`

The first one is of cause the preferred one, because there is no rist to add a unencrypted file to the repo.

## Bootstrap IPA hosts
In this example the client to bootstrap may be `las112` and the installation takes place from the server `las126`.
The prompts `#` show that you are working at root.
* Add your (root's) SSH-key to the host `las126# ssh-copy-id lasXXX.las.kit.edu`
* Install ansible dependencies on the client: `las112# dnf install python2-dnf libselinux-python`
* Get a Kerberos ticket (``las126# kinit -f admin@LAS.KIT.EDU``)
* For the host with the hostname `lasXXX.las.kit.edu` do the following
* edit a file ``host_vars/lasXXX.las.kit.edu``
```
las126# ansible -l lasXXX.las.kit.edu add_ipa_host.yml -k --vault-id @prompt
```
and provide the root password for the new host.

## Decommission/Uninstall a host
* edit the ``add_ipa_host.yml`` and uncomment the uninstall step in it.