Feature/test servers fix

ansible/provision/server_initial_setup.yml

@@ -51,9 +51,13 @@
       debug:
         var: ansible_facts
 
+    - name: Install opensearch
+      include_tasks: tasks/install_opensearch_test_server.yml
+      when: install_index | bool and deploy_env == "test"
+
     - name: Install opensearch
       include_tasks: tasks/install_opensearch.yml
-      when: install_index | bool
+      when: install_index | bool and deploy_env != "test"
 
     - name: Summarise actions
       debug:

ansible/provision/tasks/install_opensearch_test_server.yml

@@ -0,0 +1,62 @@
+- name: Check if OpenSearch is installed
+  shell: "dpkg -l | grep opensearch"
+  register: os_check
+  ignore_errors: yes
+
+- name: Import the OpenSearch GPG key
+  become: yes
+  ansible.builtin.shell:
+    # Check signing key URL when upgrading OpenSearch major version https://docs.opensearch.org/1.3/install-and-configure/install-opensearch/debian/
+    cmd: "curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring"
+    creates: /usr/share/keyrings/opensearch-keyring
+  when: os_check.rc != 0
+
+- name: Add the OpenSearch repository
+  become: yes
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/1.x/apt stable main"
+    filename: opensearch-1.x
+    state: present
+  when: os_check.rc != 0
+
+- name: Update the apt cache
+  become: yes
+  ansible.builtin.apt:
+    update_cache: yes
+  when: os_check.rc != 0
+
+- name: Install OpenSearch 1.3.20
+  become: yes
+  ansible.builtin.apt:
+    name: opensearch=1.3.20
+    state: present
+    allow_downgrade: yes
+  when: os_check.rc != 0
+
+- name: Replace OpenSearch configuration file
+  become: yes
+  ansible.builtin.template:
+    src: opensearch1.3_test_server.yml
+    dest: /etc/opensearch/opensearch.yml
+    owner: opensearch
+    group: opensearch
+    mode: '0640'
+  when: os_check.rc != 0
+
+- name: Replace OpenSearch JVM options file
+  become: yes
+  ansible.builtin.template:
+    src: os1.3_test_server.jvm.options
+    dest: /etc/opensearch/jvm.options
+    owner: opensearch
+    group: opensearch
+    mode: '0640'
+  when: os_check.rc != 0
+
+- name: Restart Opensearch and configure to start on boot
+  become: yes
+  ansible.builtin.systemd:
+    name: opensearch
+    enabled: yes
+    state: restarted
+  when: os_check.rc != 0

ansible/provision/templates/opensearch1.3_test_server.yml

@@ -0,0 +1,117 @@
+# ======================== OpenSearch Configuration =========================
+#
+# NOTE: OpenSearch comes with reasonable defaults for most settings.
+#       Before you set out to tweak and tune the configuration, make sure you
+#       understand what are you trying to accomplish and the consequences.
+#
+# The primary way of configuring a node is via this file. This template lists
+# the most important settings you may want to configure for a production cluster.
+#
+# Please consult the documentation for further information on configuration options:
+# https://www.opensearch.org
+#
+# ---------------------------------- Cluster -----------------------------------
+#
+# Use a descriptive name for your cluster:
+#
+cluster.name: doaj-${HOSTNAME}
+#
+#
+# ------------------------------------ Node ------------------------------------
+#
+# Use a descriptive name for the node:
+#
+node.name: ${HOSTNAME}
+#
+#
+# Add custom attributes to the node:
+#
+#node.attr.rack: r1
+#
+# ----------------------------------- Paths ------------------------------------
+#
+# Path to directory where to store the data (separate multiple locations by comma):
+#
+path.data: /var/lib/opensearch
+#
+# Path to log files:
+#
+path.logs: /var/log/opensearch
+#
+# ----------------------------------- Memory -----------------------------------
+#
+# Lock the memory on startup:
+#
+bootstrap.memory_lock: true
+#
+# Make sure that the heap size is set to about half the memory available
+# on the system and that the owner of the process is allowed to use this
+# limit.
+#
+# OpenSearch performs poorly when the system is swapping the memory.
+#
+# ---------------------------------- Network -----------------------------------
+#
+# Set the bind address to a specific IP (IPv4 or IPv6):
+#
+#network.host: 192.168.0.1
+#
+# Set a custom port for HTTP:
+#
+#http.port: 9200
+#
+# For more information, consult the network module documentation.
+#
+# --------------------------------- Discovery ----------------------------------
+#
+# Pass an initial list of hosts to perform discovery when this node is started:
+# The default list of hosts is ["127.0.0.1", "[::1]"]
+#
+#discovery.seed_hosts: ["host1", "host2"]
+#
+# Bootstrap the cluster using an initial set of master-eligible nodes:
+#
+#cluster.initial_master_nodes: ["node-1", "node-2"]
+#
+# For more information, consult the discovery and cluster formation module documentation.
+#
+# ---------------------------------- Gateway -----------------------------------
+#
+# Block initial recovery after a full cluster restart until N nodes are started:
+#
+#gateway.recover_after_nodes: 3
+#
+# For more information, consult the gateway module documentation.
+#
+# ---------------------------------- Various -----------------------------------
+#
+# Require explicit names when deleting indices:
+#
+#action.destructive_requires_name: true
+
+# To keep equivalence with ES OSS as deployed
+plugins.security.disabled: true
+
+######## Start OpenSearch Security Demo Configuration ########
+# WARNING: revise all the lines below before you go into production
+# plugins.security.ssl.transport.pemcert_filepath: esnode.pem
+# plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
+# plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
+# plugins.security.ssl.transport.enforce_hostname_verification: false
+# plugins.security.ssl.http.enabled: true
+# plugins.security.ssl.http.pemcert_filepath: esnode.pem
+# plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
+# plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
+# plugins.security.allow_unsafe_democertificates: true
+# plugins.security.allow_default_init_securityindex: true
+# plugins.security.authcz.admin_dn:
+#   - CN=kirk,OU=client,O=client,L=test, C=de
+
+# plugins.security.audit.type: internal_opensearch
+# plugins.security.enable_snapshot_restore_privilege: true
+# plugins.security.check_snapshot_restore_write_privileges: true
+# plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
+# plugins.security.system_indices.enabled: true
+# plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
+# node.max_local_storage_nodes: 3
+######## End OpenSearch Security Demo Configuration ########

ansible/provision/templates/os1.3_test_server.jvm.options

@@ -0,0 +1,86 @@
+## JVM configuration
+
+################################################################
+## IMPORTANT: JVM heap size
+################################################################
+##
+## You should always set the min and max JVM heap
+## size to the same value. For example, to set
+## the heap to 4 GB, set:
+##
+## -Xms4g
+## -Xmx4g
+##
+## See https://opensearch.org/docs/opensearch/install/important-settings/
+## for more information
+##
+################################################################
+
+# Xms represents the initial size of total heap space
+# Xmx represents the maximum size of total heap space
+
+-Xms4g
+-Xmx4g
+
+################################################################
+## Expert settings
+################################################################
+##
+## All settings below this section are considered
+## expert settings. Don't tamper with them unless
+## you understand what you are doing
+##
+################################################################
+
+## GC configuration
+8-10:-XX:+UseConcMarkSweepGC
+8-10:-XX:CMSInitiatingOccupancyFraction=75
+8-10:-XX:+UseCMSInitiatingOccupancyOnly
+
+## G1GC Configuration
+# NOTE: G1 GC is only supported on JDK version 10 or later
+# to use G1GC, uncomment the next two lines and update the version on the
+# following three lines to your version of the JDK
+# 10:-XX:-UseConcMarkSweepGC
+# 10:-XX:-UseCMSInitiatingOccupancyOnly
+11-:-XX:+UseG1GC
+11-:-XX:G1ReservePercent=25
+11-:-XX:InitiatingHeapOccupancyPercent=30
+
+## JVM temporary directory
+-Djava.io.tmpdir=${OPENSEARCH_TMPDIR}
+
+## heap dumps
+
+# generate a heap dump when an allocation from the Java heap fails
+# heap dumps are created in the working directory of the JVM
+-XX:+HeapDumpOnOutOfMemoryError
+
+# specify an alternative path for heap dumps; ensure the directory exists and
+# has sufficient space
+-XX:HeapDumpPath=/var/lib/opensearch
+
+# specify an alternative path for JVM fatal error logs
+-XX:ErrorFile=/var/log/opensearch/hs_err_pid%p.log
+
+## JDK 8 GC logging
+8:-XX:+PrintGCDetails
+8:-XX:+PrintGCDateStamps
+8:-XX:+PrintTenuringDistribution
+8:-XX:+PrintGCApplicationStoppedTime
+8:-Xloggc:/var/log/opensearch/gc.log
+8:-XX:+UseGCLogFileRotation
+8:-XX:NumberOfGCLogFiles=32
+8:-XX:GCLogFileSize=64m
+
+# JDK 9+ GC logging
+9-:-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/opensearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m
+
+# Explicitly allow security manager (https://bugs.openjdk.java.net/browse/JDK-8270380)
+18-:-Djava.security.manager=allow
+
+## OpenSearch Performance Analyzer
+-Dclk.tck=100
+-Djdk.attach.allowAttachSelf=true
+-Djava.security.policy=file:///etc/opensearch/opensearch-performance-analyzer/opensearch_security.policy
+--add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED