Install Apache Guacamole on RHEL 9 Using Ansible Roles

				
					your-vault-password
				
			

				
					---
# tasks file for installing and configuring guacamole 
- name: Ensure guacamole database exists
  mysql_db:
    name: guacamole_db
    state: present
  register: result_db      

- name: Ensure guacamole user exists
  mysql_user:
    name: guacamole_user
    password: "{{ mysql_password }}"  # Replace this with the desired password
    priv: "guacamole_db.*:ALL"
    host: "localhost"
    state: present
  register: result_user

- name: Install Java OpenJDK
  dnf:
    name: "{{ guacamole_java_package }}"
    state: present

- name: Install Apache Tomcat
  dnf:
    name: tomcat
    state: present

- name: Start and enable Tomcat service
  systemd:
    name: tomcat
    state: started
    enabled: yes

- name: Clone Guacamole server from GitHub
  shell: |
    if [ ! -d /opt/guacamole-server ]; then
      git clone https://github.com/apache/guacamole-server.git /opt/guacamole-server
    fi

- name: Run autoreconf to generate configure script
  shell: autoreconf -fi
  args:
    chdir: /opt/guacamole-server

- name: Build and install Guacamole server
  shell: |
    cd /opt/guacamole-server
    autoreconf -fi
    ./configure --with-init-dir=/etc/init.d --with-ssh --with-vnc --with-freerdp
    make
    sudo make install
  args:
    creates: /usr/local/bin/guacd

- name: Clone FreeRDP Development Package from GitHub
  shell: |
    if [ ! -d /opt/FreeRDP ]; then
      git clone https://github.com/FreeRDP/FreeRDP.git /opt/FreeRDP
    fi

- name: Build and install FreeRDP
  shell: |
    cd /opt/FreeRDP
    git checkout tags/2.10.0
    cmake -DCMAKE_BUILD_TYPE=Release .
    make
    sudo make install

- name: Ensure /etc/guacamole directory exists
  file:
    path: /etc/guacamole
    state: directory
    mode: '0755'

- name: Create guacamole.properties file
  template:
    src: guacamole.properties.j2
    dest: /etc/guacamole/guacamole.properties

- name: Create user-mapping.xml file for user connections
  template:
    src: user-mapping.xml.j2
    dest: /etc/guacamole/user-mapping.xml

- name: Create guacd service file for systemd
  template:
    src: guacd.service.j2
    dest: /etc/systemd/system/guacd.service

- name: Update the system’s cache of installed libraries
  shell: sudo ldconfig

- name: Create the required Guacamole directories
  file:
    path: "/etc/guacamole/{{ item }}"
    state: directory
  loop:
    - extensions
    - lib

- name: Create the config file for guacd
  copy:
    dest: /etc/guacamole/guacd.conf
    content: |
      [daemon]
      pid_file = /var/run/guacd.pid
      #log_level = debug

      [server]
      #bind_host = localhost
      bind_host = 127.0.0.1
      bind_port = 4822

      #[ssl]
      #server_certificate = /etc/ssl/certs/guacd.crt
      #server_key = /etc/ssl/private/guacd.key

- name: Reload systemd to recognize new service
  shell: |
    sudo systemctl daemon-reload

- name: Enable and start guacd service
  systemd:
    name: guacd
    enabled: yes
    state: started

- name: Download Guacamole client WAR file
  get_url:
    url: "https://downloads.apache.org/guacamole/{{ guacamole_version }}/binary/guacamole-{{ guacamole_version }}.war"
    dest: "/tmp/guacamole-{{ guacamole_version }}.war"

- name: Move the Guacamole WAR file to the Tomcat webapps directory
  shell: sudo mv /tmp/guacamole-{{ guacamole_version }}.war /var/lib/tomcat/webapps/guacamole.war

- name: Check if MySQL Connector is installed
  stat:
    path: /etc/guacamole/lib/mysql-connector-j.jar
  register: mysql_connector_stat

- name: Remove existing symbolic link if it exists
  file:
    path: /etc/guacamole/lib/mysql-connector-j.jar
    state: absent
  when: mysql_connector_stat.stat.exists
    
- name: Download MySQL Connector/J for Guacamole
  shell: |
    sudo dnf install -y https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-9.2.0-1.el9.noarch.rpm
    cd /etc/guacamole/lib && sudo ln -s /usr/share/java/mysql-connector-j.jar

- name: Download JDBC auth plugin for Guacamole
  get_url:
    url: "https://downloads.apache.org/guacamole/{{ guacamole_version }}/binary/guacamole-auth-jdbc-{{ guacamole_version }}.tar.gz"
    dest: "/tmp/guacamole-auth-jdbc-{{ guacamole_version }}.tar.gz"

- name: Extract JDBC auth plugin
  unarchive:
    src: "/tmp/guacamole-auth-jdbc-{{ guacamole_version }}.tar.gz"
    dest: "/tmp/"
    remote_src: yes

- name: Move the MySQL JDBC plugin to the extensions directory
  shell: |
    sudo mv /tmp/guacamole-auth-jdbc-{{ guacamole_version }}/mysql/guacamole-auth-jdbc-mysql-{{ guacamole_version }}.jar /etc/guacamole/extensions/
      
- name: Append the MySQL properties to the guacamole.properties file
  lineinfile:
    path: /etc/guacamole/guacamole.properties
    line: "{{ item }}"
  loop:
    - "mysql-hostname: {{ mysql_hostname }}"
    - "mysql-port: {{ mysql_port }}"
    - "mysql-database: {{ mysql_database }}"
    - "mysql-username: {{ mysql_username }}"
    - "mysql-password: {{ mysql_password }}"

- name: Import the database schemas for Guacamole
  shell: |
    cat /tmp/guacamole-auth-jdbc-{{ guacamole_version }}/mysql/schema/*.sql | sudo mysql -u root -p'{{ mysql_password }}' guacamole_db --force
  become: yes
  become_user: root
      
- name: Configure SELinux contexts
  shell: |
    sudo ausearch -c 'Catalina-utilit' --raw | audit2allow -M my-Catalinautilit
    sudo semodule -X 300 -i my-Catalinautilit.pp
    sudo ausearch -c 'java' --raw | audit2allow -M my-java
    sudo semodule -X 300 -i my-java.pp
    sudo setsebool -P domain_can_mmap_files 1
    sudo setsebool -P tomcat_can_network_connect_db 1
    sudo /sbin/restorecon -v /var/lib/tomcat/webapps/guacamole.war

- name: Reload systemd once again
  shell: |
    sudo systemctl daemon-reload

- name: Restart Tomcat and guacd services
  systemd:
    name: "{{ item }}"
    state: restarted
  loop:
    - tomcat
    - guacd

- name: Clean up temporary files
  file:
    path: "/tmp/{{ item }}"
    state: absent
  loop:
    - "guacamole-auth-jdbc-{{ guacamole_version }}.tar.gz"
    - "guacamole-auth-jdbc-{{ guacamole_version }}"