playbook.yml

---        
- name: Build Tableau Linux Server        
  hosts: all
  become: true

  tasks:    
  - name: Set timezone to Europe/London
    timezone:
      name: Europe/London

  - name: enable rc.local service
    shell:
       systemctl enable rc-local.service && systemctl start rc-local.service

  - name: perform repo sed replace
    shell:
       sed -i 's/REGION/eu-west-2/' /etc/yum.repos.d/redhat-rhui*.repo


  - name: DNF Install Dependencies
    dnf: name={{ item }}
    with_items:
      - zip
      - unzip
      - git
      - postgresql
      - python39
    become: true

  - name: Get AWS-CLI
    shell: |
      curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
      unzip awscliv2.zip
      ./aws/install
    become: true
    become_user: root
    
  - name: Create python link
    file:
      src: /usr/bin/python3.9
      dest: /usr/bin/python
      state: link
      force: true
      
  - name: PIP install botocore and boto3
    pip:
      name:
          - botocore
          - boto3
      executable: pip3.9
    become: true
    become_user: root  
    
  - name: Pull variable file from S3
    shell: |
       /usr/local/bin/aws s3 cp s3://dq-config-bucket/dqusers.yml /tmp/dqusers.yml
    become: true
    become_user: root      

  - name: Use fetch module for this task  
    fetch:
          src: "/tmp/dqusers.yml"
          dest: ./var/dqusers.yml
          flat: yes      

  - name: Read dqusers yaml
    include_vars:
      file: ./var/dqusers.yml
        
  - name: Create users for dqsupport members
    user:
        name: "{{ item.name }}"
        shell: /bin/bash
        createhome: yes                    
    with_items: "{{ dqusers }}"      

  - name: setup ssh pub key for abv defined users  
    authorized_key:
        user: '{{ item.name }}'
        key: "{{ item.pubkey | join('\n')  }}"
        state: "present" 
    with_items: "{{ dqusers }}"

  - name: deploy sudoers file
    template:
        src: dqsupport-sudoers.j2
        dest: /etc/sudoers.d/{{ item.userno }}-{{ item.name }}-user
    with_items: "{{ dqusers }}" 
    become: true
    become_user: root

  - name: Get Tableau files from DQ-config-bucket
    shell: |
      /usr/local/bin/aws s3 cp s3://dq-config-bucket/dq-tableau-linux/gold-master /tmp/install --recursive

  - name: Create tableau_srv user
    user:
      name: tableau_srv

  - name: Create .ssh directory for tableau_srv user
    file:
      path: /home/tableau_srv/.ssh
      state: directory
      mode: 0700
      owner: tableau_srv

  - name: Create scripts directory for tableau_srv user c/w all files
    copy:
      src: tableau-scripts/
      dest: /home/tableau_srv/scripts
      owner: tableau_srv
      group: tableau_srv
      mode: 0555

  - name: Ensure Tableau backup to S3 log file for tableau_srv user exists
    copy:
      content: ""
      dest: /var/log/tableau-backup-to-s3.log
      force: no
      owner: tableau_srv
      group: tableau_srv
      mode: 0644

  - name: Create directory for old Tableau backup files for tableau_srv user
    file:
      path: /var/log/tableau-backup-logs
      state: directory
      mode: 0755
      owner: tableau_srv

  - name: Create cronjob to run script to backup Tableau to S3 every day at 9am
    cron:
      name: Tableau to S3 backup
      user: tableau_srv
      minute: 0
      hour: 9
      job: . $HOME/.bashrc; /home/tableau_srv/scripts/tableau-backup.sh

  - name: Create cronjob to run script to export contents of Tableau Repository
    cron:
      name: Run Tableau Repo export
      user: tableau_srv
      minute: 20
      hour: 11
      job: source $HOME/.bashrc; /home/tableau_srv/scripts/extract_timings_export.sh > /home/tableau_srv/scripts/export.log 2> /home/tableau_srv/scripts/export.err

  - name: Create cronjob to run script to import contents of Tableau Repository to RDS
    cron:
      name: Run Tableau Repo import
      user: tableau_srv
      minute: 25
      hour: 11
      job: source $HOME/.bashrc; /home/tableau_srv/scripts/extract_timings_import.sh > /home/tableau_srv/scripts/import.log 2> /home/tableau_srv/scripts/import.err

  - name: DNF Install Tableau - Tableau Server
    dnf:
      name:
        - /tmp/install/tableau-server-gold-master.x86_64.rpm
      disable_gpg_check: true

  - name: Install the Postgresql & Athena JDBC Driver
    shell: |
      mkdir -p /opt/tableau/tableau_driver/jdbc
      cp /tmp/install/AthenaJDBC42.jar /opt/tableau/tableau_driver/jdbc/AthenaJDBC42.jar
      cp /tmp/install/postgresql-42.jar /opt/tableau/tableau_driver/jdbc/postgresql-42.jar
      chmod 755 /opt/tableau/tableau_driver/jdbc/AthenaJDBC42.jar
      chmod 755 /opt/tableau/tableau_driver/jdbc/postgresql-42.jar
    become: true

  - name: GET CloudWatch logs config from DQ-config-bucket
    shell: |
       /usr/local/bin/aws s3 cp s3://dq-config-bucket/dq-tableau-linux/cwlogs.conf /tmp
       /usr/local/bin/aws s3 cp s3://dq-config-bucket/dq-tableau-linux/awslogs-agent-setup.py /tmp
       chmod u+x /tmp/awslogs-agent-setup.py

  - name: Install CloudWatch log agent
    environment:
      LC_ALL: C
    shell: /tmp/awslogs-agent-setup.py --region eu-west-2 --non-interactive -c /tmp/cwlogs.conf
    args:
      creates: /var/awslogs/etc/aws.conf

  - name: Copy CloudWatch logs starter
    copy:
      src: scripts/startcloudwatchlogs.sh
      dest: /usr/bin/startcloudwatchlogs.sh
      owner: root
      group: root
      mode: 0755

  - name: Make Cron Job to start awslogs with right region
    cron:
      name: Start awslogs
      special_time: reboot
      job: /usr/bin/startcloudwatchlogs.sh

  - name: Download CloudWatch agent (for ec2 alarms)
    get_url:
      url: https://s3.amazonaws.com/amazoncloudwatch-agent/redhat/amd64/latest/amazon-cloudwatch-agent.rpm
      dest: /tmp/amazon-cloudwatch-agent.rpm
      mode: "+x"

  - name: Install CloudWatch agent (for ec2 alarms)
    dnf:
      name: /tmp/amazon-cloudwatch-agent.rpm
      state: present
      disable_gpg_check: true

  - name: CloudWatch Agent config
    copy:
      dest: /opt/aws/amazon-cloudwatch-agent/bin/config.json
      content: |
                {
                "agent": {
                        "metrics_collection_interval": 60,
                        "run_as_user": "ec2-user"
                },
                "metrics": {
                        "namespace": "CWAgent",
                        "append_dimensions": {
                                "InstanceId": "${aws:InstanceId}"
                        },
                        "metrics_collected": {
                                "disk": {
                                        "measurement": [
                                                "used_percent"
                                        ],
                                        "metrics_collection_interval": 60,
                                        "resources": [
                                                "*"
                                        ],
                                        "ignore_file_system_types": [
                                                "devtmpfs",
                                                "tmpfs"
                                        ],
                                        "drop_device": true
                                },
                                "diskio": {
                                        "measurement": [
                                                "io_time"
                                        ],
                                        "metrics_collection_interval": 60,
                                        "resources": [
                                                "*"
                                        ]
                                },
                                "mem": {
                                        "measurement": [
                                                "mem_used_percent",
                                                "mem_available_percent",
                                                "mem_used",
                                                "mem_cached",
                                                "mem_total"
                                        ],
                                        "metrics_collection_interval": 60
                                },
                                "swap": {
                                  "measurement": [
                                          "swap_used_percent"
                                  ],
                                  "metrics_collection_interval": 60
                                        }
                                }
                        }
                }

  - name: CloudWatch logs config
    copy:
      dest: /tmp/cwlogs.conf
      content: |
        [general]
        state_file = /var/awslogs/state/agent-state
        [/var/log/messages]
        file = /var/log/messages
        log_group_name = /TABLEAU/messages
        log_stream_name = {instance_id}
        datetime_format = %b %d %H:%M:%S
        [/TABLEAU/cloud-init]
        file = /var/log/cloud-init.log
        log_group_name = /TABLEAU/cloud-init
        log_stream_name = {instance_id}
        datetime_format = %Y-%m-%d %H:%M:%S,%f
        [/TABLEAU/cloud-init/output]
        file = /var/log/cloud-init-output.log
        log_group_name = /TABLEAU/cloud-init/output
        log_stream_name = {instance_id}
        datetime_format = %Y-%m-%d %H:%M:%S,%f
        [/TABLEAU/cron]
        file = /var/log/cron
        log_group_name = /TABLEAU/cron
        log_stream_name = {instance_id}
        datetime_format = %Y-%m-%d %H:%M:%S,%f
        [/TABLEAU/secure]
        file = /var/log/secure
        log_group_name = /TABLEAU/secure
        log_stream_name = {instance_id}
        datetime_format = %Y-%m-%d %H:%M:%S,%f
        [/TABLEAU/yum]
        file = /var/log/dnf.rpm.log
        log_group_name = /TABLEAU/yum
        log_stream_name = {instance_id}
        datetime_format = %Y-%m-%d %H:%M:%S,%f
        [/TABLEAU/syslog]
        file = /var/log/syslog
        log_group_name = /TABLEAU/syslog
        log_stream_name = {instance_id}
        datetime_format = %Y-%m-%d %H:%M:%S,%f

  - name: Set DNS Resolver Options
    blockinfile:
      path: /etc/sysconfig/network
      block: |
        RES_OPTIONS="rotate timeout:1 attempts:1"

  - name: Configure permissions for tableau_srv user
    shell: |
       touch /var/log/user-data.log && chown tableau_srv:tableau_srv /var/log/user-data.log
       chown -R tableau_srv:tableau_srv /opt/tableau

  - name: install selinux bindings
    pip:
      name: selinux

  - name: Secure sshd_config
    lineinfile: dest=/etc/ssh/sshd_config
                regexp="^PermitRootLogin"
                line="PermitRootLogin no"
                state=present
  - lineinfile: dest=/etc/ssh/sshd_config
                regexp="^PasswordAuthentication"
                line="PasswordAuthentication no"
                state=present
  - lineinfile: dest=/etc/ssh/sshd_config
                regexp="^X11Forwarding"
                line="X11Forwarding no"
                state=present
  - lineinfile: dest=/etc/ssh/sshd_config
                regexp="^(.*)AllowTcpForwarding"
                line="AllowTcpForwarding no"
                state=present