Skip to content

Commit ce29c94

Browse files
cbarriacbarria
committed
(role/tma) add tma profile and test
1 parent b354dc4 commit ce29c94

File tree

6 files changed

+515
-0
lines changed

6 files changed

+515
-0
lines changed

‎hieradata/role/tma.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
classes:
3+
- "profile::core::common"
4+
- "profile::core::debugutils"
5+
- "profile::core::docker"
6+
- "profile::ts::tma"
7+
8+
packages:
9+
- "@base-x"
10+
- "@xfce-desktop"
11+
- "git"
12+
- "git-lfs"
13+
- "perl-File-Copy"
14+
- "sddm"
15+
- "tigervnc-server"
16+
- "unzip"
17+
18+
profile::ts::tma::tma_db_repo: "[email protected]:lsst-ts/ts_tma_mariadb-docker.git"
19+
profile::ts::tma::tma_db_path: "/opt/tma/mariadb-docker"
20+
profile::ts::tma::opman_path: "/opt/tma/operation-manager"
21+
profile::ts::tma::pxi_0_ip: "10.0.0.10"
22+
profile::ts::tma::pxi_1_ip: "10.0.0.11"
23+
24+
profile::ts::tma::labview_rpm_url: "https://repo-nexus.lsst.org/nexus/repository/ts_yum/releases/ni-labview-2024-pro-24.3.2.49152-0%2Bf0-rhel9.noarch.rpm"
25+
profile::ts::tma::vipm_zip: "/opt/installers/vipm-22.1.2354-linux.zip"
26+
profile::ts::tma::vipm_root: "/usr/local/JKI/VIPM"
27+
profile::ts::tma::vipc_path: "/usr/local/JKI/VIPM/LSST_tma_dependencies.vipc"
28+
profile::ts::tma::vipc_url: "https://github.com/lsst-ts/ts_tma_vipm_dependency/raw/develop/LSST_tma_dependencies.vipc"
29+
30+
profile::ts::tma::enable_graphical: true
31+
profile::ts::tma::enable_vnc_auto_setup: true
32+
profile::ts::tma::vnc_geometry: "1920x1080"

‎site/profile/manifests/ts/tma.pp‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
# @summary
2+
# TMA multi-user workstation: XFCE, Docker services, LabVIEW, VIPM, per-user VNC
3+
#
4+
# @param tma_db_repo TMA MariaDB repository
5+
# @param tma_db_path Path for TMA DB (shared service)
6+
# @param pxi_0_ip PXI 0 IP address
7+
# @param pxi_1_ip PXI 1 IP address
8+
# @param opman_path Operation Manager path (shared service)
9+
# @param labview_rpm_url Full URL to NI LabVIEW RPM
10+
# @param compose_cmd Docker compose command (docker-compose or docker compose)
11+
# @param ghcr_username GitHub Container Registry username
12+
# @param ghcr_token GitHub Container Registry token (Sensitive)
13+
# @param vipm_zip VIPM ZIP path (optional, for offline install)
14+
# @param vipc_url VIPC dependencies URL
15+
# @param vipc_username VIPC credentials username (optional)
16+
# @param vipc_password VIPC credentials password (Sensitive, optional)
17+
# @param vipm_root VIPM root installation path
18+
# @param vipc_path VIPC file destination path
19+
# @param enable_graphical Enable graphical mode (XFCE + LightDM)
20+
# @param enable_vnc_auto_setup Enable automatic VNC setup for LDAP users
21+
# @param vnc_geometry Default VNC geometry for all users
22+
# @param tma_group LDAP group name for TMA users (must exist in FreeIPA)
23+
class profile::ts::tma (
24+
String[1] $tma_db_repo,
25+
Stdlib::Absolutepath $tma_db_path,
26+
String[1] $pxi_0_ip,
27+
String[1] $pxi_1_ip,
28+
Stdlib::Absolutepath $opman_path = '/opt/tma/operation-manager',
29+
String[1] $labview_rpm_url = 'https://repo-nexus.lsst.org/nexus/repository/ts_yum/releases/ni-labview-2024-pro-24.3.2.49152-0%2Bf0-rhel9.noarch.rpm',
30+
String[1] $compose_cmd = 'docker-compose',
31+
Optional[String[1]] $ghcr_username = undef,
32+
Optional[Sensitive[String[1]]] $ghcr_token = undef,
33+
Optional[Stdlib::Absolutepath] $vipm_zip = undef,
34+
String[1] $vipc_url = 'https://github.com/lsst-ts/ts_tma_vipm_dependency/raw/develop/LSST_tma_dependencies.vipc',
35+
Optional[String[1]] $vipc_username = undef,
36+
Optional[Sensitive[String[1]]] $vipc_password = undef,
37+
Stdlib::Absolutepath $vipm_root = '/usr/local/JKI/VIPM',
38+
Stdlib::Absolutepath $vipc_path = '/usr/local/JKI/VIPM/LSST_tma_dependencies.vipc',
39+
Boolean $enable_graphical = true,
40+
Boolean $enable_vnc_auto_setup = true,
41+
String[1] $vnc_geometry = '1920x1080',
42+
String[1] $tma_group = 'tma',
43+
) {
44+
if $enable_graphical {
45+
exec { 'set-graphical-target':
46+
command => '/bin/systemctl set-default graphical.target',
47+
unless => '/bin/systemctl get-default | grep -q graphical.target',
48+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
49+
}
50+
51+
exec { 'switch-to-sddm':
52+
command => '/bin/bash -c "systemctl disable gdm lightdm; systemctl enable --force sddm; systemctl stop gdm lightdm; systemctl start sddm"',
53+
unless => '/bin/systemctl is-enabled sddm 2>/dev/null',
54+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
55+
require => Exec['set-graphical-target'],
56+
}
57+
}
58+
59+
if $enable_vnc_auto_setup {
60+
file { '/usr/local/bin/tma-vnc-setup':
61+
ensure => file,
62+
owner => 'root',
63+
group => 'root',
64+
mode => '0755',
65+
content => epp('profile/ts/tma/vnc-setup.sh.epp', {
66+
vnc_geometry => $vnc_geometry,
67+
}),
68+
}
69+
70+
file { '/etc/profile.d/tma-user-setup.sh':
71+
ensure => file,
72+
owner => 'root',
73+
group => 'root',
74+
mode => '0644',
75+
content => epp('profile/ts/tma/user-setup.sh.epp'),
76+
}
77+
}
78+
79+
if $ghcr_username != undef and $ghcr_token != undef {
80+
exec { 'docker-login-ghcr':
81+
command => "bash -lc 'printf %s ${ghcr_token.unwrap} | docker login ghcr.io -u ${ghcr_username} --password-stdin'",
82+
unless => "bash -lc 'docker info 2>/dev/null | grep -q ghcr.io'",
83+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
84+
}
85+
}
86+
87+
file { '/opt/tma':
88+
ensure => directory,
89+
owner => 'root',
90+
group => $tma_group,
91+
mode => '0775',
92+
}
93+
94+
file { $tma_db_path:
95+
ensure => directory,
96+
owner => 'root',
97+
group => $tma_group,
98+
mode => '2775',
99+
require => File['/opt/tma'],
100+
}
101+
102+
vcsrepo { $tma_db_path:
103+
ensure => present,
104+
provider => git,
105+
source => $tma_db_repo,
106+
require => File[$tma_db_path],
107+
}
108+
109+
file { "${tma_db_path}/backup":
110+
ensure => directory,
111+
owner => 'root',
112+
group => $tma_group,
113+
mode => '2775',
114+
}
115+
116+
exec { 'tma-db-up':
117+
command => "${compose_cmd} up -d",
118+
cwd => $tma_db_path,
119+
refreshonly => true,
120+
subscribe => Vcsrepo[$tma_db_path],
121+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin', '/usr/local/bin'],
122+
}
123+
124+
cron { 'tma-db-createbackup':
125+
ensure => present,
126+
command => "${tma_db_path}/createbackup.pl",
127+
minute => '5',
128+
hour => '12',
129+
user => 'root',
130+
}
131+
132+
cron { 'tma-db-python-backup':
133+
ensure => present,
134+
command => "docker run --rm -v ${tma_db_path}/python:/script -v ${tma_db_path}/backup:/backup python:3.7 python /script/main.py",
135+
minute => '5',
136+
hour => '13',
137+
user => 'root',
138+
}
139+
140+
file { $opman_path:
141+
ensure => directory,
142+
owner => 'root',
143+
group => $tma_group,
144+
mode => '2775',
145+
require => File['/opt/tma'],
146+
}
147+
148+
$compose_content = @("COMPOSE")
149+
version: '3'
150+
services:
151+
mt-mount-manager:
152+
image: ghcr.io/lsst-ts/ts_tma_operation-manager_mt-mount-operation-manager:latest
153+
container_name: mt-mount-manager
154+
ports:
155+
- "60005:60005"
156+
- "40005:40005"
157+
- "30005:30005"
158+
volumes:
159+
- /var/log/mtmount_operation_manager/:/var/log/mtmount_operation_manager
160+
environment:
161+
- PXI_0_IP=${pxi_0_ip}
162+
- PXI_1_IP=${pxi_1_ip}
163+
restart: unless-stopped
164+
| COMPOSE
165+
166+
file { "${opman_path}/docker-compose.yml":
167+
ensure => file,
168+
owner => 'root',
169+
group => $tma_group,
170+
mode => '0664',
171+
content => $compose_content,
172+
notify => Exec['opman-up'],
173+
}
174+
175+
exec { 'opman-up':
176+
command => "${compose_cmd} up -d",
177+
cwd => $opman_path,
178+
refreshonly => true,
179+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin', '/usr/local/bin'],
180+
}
181+
182+
package { 'ni-labview-2024-el9-pro':
183+
ensure => installed,
184+
provider => 'rpm',
185+
source => $labview_rpm_url,
186+
}
187+
188+
file { '/usr/local/JKI':
189+
ensure => directory,
190+
owner => 0,
191+
group => 0,
192+
mode => '0755',
193+
}
194+
195+
file { '/etc/JKI':
196+
ensure => directory,
197+
owner => 0,
198+
group => 0,
199+
mode => '0755',
200+
}
201+
202+
file { $vipm_root:
203+
ensure => directory,
204+
owner => 0,
205+
group => 0,
206+
mode => '0755',
207+
require => File['/usr/local/JKI'],
208+
}
209+
210+
if $vipm_zip != undef {
211+
exec { 'vipm-unzip':
212+
command => "unzip -o ${vipm_zip} -d ${vipm_root}",
213+
unless => "test -x ${vipm_root}/vipm",
214+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
215+
require => File[$vipm_root],
216+
}
217+
}
218+
219+
if $vipc_username != undef and $vipc_password != undef {
220+
exec { 'vipc-fetch':
221+
command => "bash -lc 'curl -fsSL -u ${vipc_username}:${vipc_password.unwrap} -o ${vipc_path} ${vipc_url}'",
222+
creates => $vipc_path,
223+
path => ['/bin', '/usr/bin', '/sbin', '/usr/sbin'],
224+
require => File[$vipm_root],
225+
}
226+
} else {
227+
notify { 'vipc-skip':
228+
message => 'VIPC skip: no creds',
229+
}
230+
}
231+
}

‎site/profile/templates/ts/tma/user-setup.sh.epp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
if groups | grep -q '\btma\b' && [ ! -d "$HOME/.vnc" ]; then
3+
/usr/local/bin/tma-vnc-setup
4+
fi
5+

‎site/profile/templates/ts/tma/vnc-setup.sh.epp‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<%- |
2+
String[1] $vnc_geometry,
3+
| -%>
4+
#!/bin/bash
5+
set -euo pipefail
6+
7+
if ! groups | grep -q '\btma\b'; then
8+
exit 0
9+
fi
10+
11+
USER_UID=$(id -u)
12+
VNC_DISPLAY=$((USER_UID % 100))
13+
14+
if [ ! -d "$HOME/.vnc" ]; then
15+
mkdir -p "$HOME/.vnc"
16+
chmod 700 "$HOME/.vnc"
17+
fi
18+
19+
cat > "$HOME/.vnc/config" <<EOF
20+
session=xfce
21+
securitytypes=vncauth,tlsvnc
22+
geometry=<%= $vnc_geometry %>
23+
localhost
24+
alwaysshared
25+
EOF
26+
27+
echo ""
28+
echo "================================================================================"
29+
echo " TMA VNC Setup - User: $(whoami)"
30+
echo "================================================================================"
31+
echo ""
32+
echo " VNC Display: :${VNC_DISPLAY}"
33+
echo " VNC Port: $((5900 + VNC_DISPLAY))"
34+
echo ""
35+
echo " To set your VNC password, run:"
36+
echo " vncpasswd"
37+
echo ""
38+
echo " To start your VNC server:"
39+
echo " vncserver :${VNC_DISPLAY}"
40+
echo ""
41+
echo " To stop your VNC server:"
42+
echo " vncserver -kill :${VNC_DISPLAY}"
43+
echo ""
44+
echo " To connect remotely:"
45+
echo " vncviewer <hostname>:${VNC_DISPLAY}"
46+
echo ""
47+
echo "================================================================================"
48+
echo ""
49+
50+
if [ ! -f "$HOME/.vnc/passwd" ]; then
51+
echo "IMPORTANT: Set your VNC password by running 'vncpasswd'"
52+
fi
53+
54+
exit 0
55+

0 commit comments

Comments
 (0)