140 lines
4.4 KiB
YAML
140 lines
4.4 KiB
YAML
---
|
|
# guacd + FreeRDP als reine Protokoll-Engine fuer RDP (Konzept 3/4.3).
|
|
# Laeuft ausschliesslich lokal gebunden, kein Netzwerkzugriff von aussen.
|
|
#
|
|
# guacd gibt es fuer Debian (Bookworm und aelter) als apt-Paket bislang NICHT
|
|
# (nur Ubuntu paketiert es ueber die "universe"-Komponente). Daher wird guacd
|
|
# hier gemaess der offiziellen Apache-Guacamole-Doku
|
|
# ("Installing Guacamole natively") aus dem Quellcode-Tarball gebaut. Nur das
|
|
# RDP-Plugin wird aktiviert (FreeRDP-Dev-Header vorhanden, kein VNC/Telnet),
|
|
# passend zum reinen RDP-Einsatzzweck dieses Jumphosts.
|
|
|
|
- name: Build-Abhaengigkeiten fuer guacd installieren
|
|
ansible.builtin.apt:
|
|
name:
|
|
- build-essential
|
|
- libcairo2-dev
|
|
- libjpeg62-turbo-dev
|
|
- libpng-dev
|
|
- libtool-bin
|
|
- uuid-dev
|
|
- libpango1.0-dev
|
|
- libssl-dev
|
|
- freerdp2-dev
|
|
- pkg-config
|
|
- wget
|
|
- ca-certificates
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Dedizierten guacd-User anlegen (frueher vom Debian/Ubuntu-Paket erledigt)
|
|
ansible.builtin.user:
|
|
name: guacd
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
create_home: false
|
|
|
|
- name: Vorhandene guacd-Installation (falls Quellcode-Build) pruefen
|
|
ansible.builtin.stat:
|
|
path: /usr/local/sbin/guacd
|
|
register: _guacd_bin
|
|
|
|
- name: Installierte guacd-Version ermitteln
|
|
ansible.builtin.command: /usr/local/sbin/guacd -v
|
|
register: _guacd_version
|
|
changed_when: false
|
|
when: _guacd_bin.stat.exists
|
|
|
|
- name: Feststellen, ob (Neu-)Build noetig ist
|
|
ansible.builtin.set_fact:
|
|
_guacd_build_needed: "{{ (not _guacd_bin.stat.exists) or (guacd_version not in (_guacd_version.stdout | default(''))) }}"
|
|
|
|
- name: guacamole-server Quellcode-Tarball herunterladen
|
|
ansible.builtin.get_url:
|
|
url: "https://archive.apache.org/dist/guacamole/{{ guacd_version }}/source/guacamole-server-{{ guacd_version }}.tar.gz"
|
|
dest: "/usr/local/src/guacamole-server-{{ guacd_version }}.tar.gz"
|
|
checksum: "sha512:https://archive.apache.org/dist/guacamole/{{ guacd_version }}/source/guacamole-server-{{ guacd_version }}.tar.gz.sha512"
|
|
mode: "0644"
|
|
when: _guacd_build_needed
|
|
|
|
- name: guacamole-server Tarball entpacken
|
|
ansible.builtin.unarchive:
|
|
src: "/usr/local/src/guacamole-server-{{ guacd_version }}.tar.gz"
|
|
dest: /usr/local/src
|
|
remote_src: true
|
|
creates: "/usr/local/src/guacamole-server-{{ guacd_version }}/configure"
|
|
when: _guacd_build_needed
|
|
|
|
- name: guacamole-server konfigurieren (nur RDP-Plugin, kein VNC/Telnet/guacenc)
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
./configure --with-systemd-dir=/etc/systemd/system
|
|
--disable-guacenc --disable-guaclog
|
|
chdir: "/usr/local/src/guacamole-server-{{ guacd_version }}"
|
|
creates: "/usr/local/src/guacamole-server-{{ guacd_version }}/Makefile"
|
|
when: _guacd_build_needed
|
|
|
|
- name: guacamole-server kompilieren
|
|
ansible.builtin.command:
|
|
cmd: "make -j{{ ansible_processor_vcpus | default(2) }}"
|
|
chdir: "/usr/local/src/guacamole-server-{{ guacd_version }}"
|
|
when: _guacd_build_needed
|
|
changed_when: true
|
|
|
|
- name: guacamole-server installieren (make install)
|
|
ansible.builtin.command:
|
|
cmd: make install
|
|
chdir: "/usr/local/src/guacamole-server-{{ guacd_version }}"
|
|
when: _guacd_build_needed
|
|
notify:
|
|
- reload systemd
|
|
- restart guacd
|
|
|
|
- name: Shared-Library-Cache aktualisieren (ldconfig)
|
|
ansible.builtin.command: ldconfig
|
|
when: _guacd_build_needed
|
|
changed_when: false
|
|
|
|
- name: guacd nur an localhost binden
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/guacamole/guacd.conf
|
|
regexp: '^bind_host'
|
|
line: "bind_host = 127.0.0.1"
|
|
create: true
|
|
notify: restart guacd
|
|
|
|
- name: guacd-Port setzen
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/guacamole/guacd.conf
|
|
regexp: '^bind_port'
|
|
line: "bind_port = {{ guacd_port }}"
|
|
create: true
|
|
notify: restart guacd
|
|
|
|
- name: RDP-Laufwerksumleitungs-Verzeichnisse anlegen (Filetransfer, Konzept 4.3)
|
|
ansible.builtin.file:
|
|
path: "/var/lib/jumphost/rdp-drives"
|
|
state: directory
|
|
owner: guacd
|
|
group: guacd
|
|
mode: "0750"
|
|
|
|
- name: Override-Verzeichnis fuer guacd-Unit anlegen
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/guacd.service.d
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Gehaertete systemd-Unit fuer guacd ausrollen (Override)
|
|
ansible.builtin.template:
|
|
src: guacd.service.j2
|
|
dest: /etc/systemd/system/guacd.service.d/override.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- reload systemd
|
|
- restart guacd
|