Rundeck -構築（H/Aなし）-

# イメージ
![cloudcraft - Rundeck_nonH-A.png](https://qiita-image-store.s3.amazonaws.com/0/58788/ea228b6c-87d4-6c4f-b19e-06fd49e36c36.png)



# 環境
* Amazon Linux AMI 2015.09.1
* t2.medium(CPU利用が常時20%を超えて、頻繁にバーストする為、運用するプロジェクト数にもよるがC4.large以上がいいかも。)
* db.t2.micro(デフォルトでは/var/lib/rundeck/data/のH2 Databaseを利用するようになっているが、負荷分散とメンテナンスを考慮しRDSへ変更)
* java-1.8.0-openjdk.x86_64 1:1.8.0.65-2.b17.7.amzn1
* rundeck.noarch 0:2.6.2-1.13.GA

# 構築
ELBでの証明書使用やSES、Route53の設定は省きます。
## インストール
```bash
$ sudo yum install java-1.8.0
$ rpm -Uvh http://repo.rundeck.org/latest.rpm
$ sudo yum install rundeck.repo
```
## 設定
```bash:limits.conf
$ sudo cp /etc/security/limits.conf /etc/security/limits.conf.origin&&sudo vim /etc/security/limits.conf
# ----------------------------------------------------------------
# OS全体で使用できるファイル数の上限を上げる
# root soft nofile 65536
# root hard nofile 65536
# * soft nofile 65536
# * hard nofile 65536
# ----------------------------------------------------------------
# /etc/security/limits.conf
#
#This file sets the resource limits for the users logged in via PAM.
#It does not affect resource limits of the system services.
#
#Also note that configuration files in /etc/security/limits.d directory,
#which are read in alphabetical order, override the settings in this
#file in case the domain is the same or more specific.
#That means for example that setting a limit for wildcard domain here
#can be overriden with a wildcard setting in a config file in the
#subdirectory, but a user specific setting here can be overriden only
#with a user specific setting in the subdirectory.
#
#Each line describes a limit for a user in the form:
#
#<domain>        <type>  <item>  <value>
#
#Where:
#<domain> can be:
#        - a user name
#        - a group name, with @group syntax
#        - the wildcard *, for default entry
#        - the wildcard %, can be also used with %group syntax,
#                 for maxlogin limit
#
#<type> can have the two values:
#        - "soft" for enforcing the soft limits
#        - "hard" for enforcing hard limits
#
#<item> can be one of the following:
#        - core - limits the core file size (KB)
#        - data - max data size (KB)
#        - fsize - maximum filesize (KB)
#        - memlock - max locked-in-memory address space (KB)
#        - nofile - max number of open file descriptors
#        - rss - max resident set size (KB)
#        - stack - max stack size (KB)
#        - cpu - max CPU time (MIN)
#        - nproc - max number of processes
#        - as - address space limit (KB)
#        - maxlogins - max number of logins for this user
#        - maxsyslogins - max number of logins on the system
#        - priority - the priority to run user process with
#        - locks - max number of file locks the user can hold
#        - sigpending - max number of pending signals
#        - msgqueue - max memory used by POSIX message queues (bytes)
#        - nice - max nice priority allowed to raise to values: [-20, 19]
#        - rtprio - max realtime priority
#
#<domain>      <type>  <item>         <value>
#

#*               soft    core            0
#*               hard    rss             10000
#@student        hard    nproc           20
#@faculty        soft    nproc           20
#@faculty        hard    nproc           50
#ftp             hard    nproc           0
#@student        -       maxlogins       4
root soft nofile 65536
root hard nofile 65536
* soft nofile 65536
* hard nofile 65536
# End of file
```

```bash
#設定反映の為、OSを再起動し設定を確認
$ ulimit -n
65536
```


```bash
$ cd /etc/rundeck
$ sudo cp framework.properties framework.properties.origin&&sudo cp rundeck-config.properties rundeck-config.properties.origin&&sudo cp profile profile.origin&&sudo cp jaas-loginmodule.conf jaas-loginmodule.conf.origin
```

```bash:framework.properties
# framework.properties -
#

# ----------------------------------------------------------------
# Rundeck server connection information
# ----------------------------------------------------------------
 
framework.server.name = FQDN
framework.server.hostname = FQDN
framework.server.port = 4440
framework.server.url = http//FQDN:4440
# Username/password used by CLI tools.
framework.server.username = admin
framework.server.password = admin
 
# ----------------------------------------------------------------
# Installation locations
# ログ出力先を変更[/var/lib/rundeck/logs > /var/log/rundeck/log]
# ----------------------------------------------------------------
 
rdeck.base=/var/lib/rundeck
 
framework.projects.dir=/var/rundeck/projects
framework.etc.dir=/etc/rundeck
framework.var.dir=/var/lib/rundeck/var
framework.tmp.dir=/var/lib/rundeck/var/tmp
framework.logs.dir=/var/log/rundeck/logs
framework.libext.dir=/var/lib/rundeck/libext
 
# ----------------------------------------------------------------
# SSH defaults for node executor and file copier
# ----------------------------------------------------------------
 
framework.ssh.keypath = /var/lib/rundeck/.ssh/id_rsa
framework.ssh.user = rundeck

# ssh connection timeout after a specified number of milliseconds.
# "0" value means wait forever.
framework.ssh.timeout = 0
```

```bash:rundeck-config.properties
# ----------------------------------------------------------------
# RDSへの接続情報を記述
# 通知用にmail settingディレクティブを記述
# ----------------------------------------------------------------
#loglevel.default is the default log level for jobs: ERROR,WARN,INFO,VERBOSE,DEBUG
loglevel.default=INFO
rdeck.base=/var/lib/rundeck

#rss.enabled if set to true enables RSS feeds that are public (non-authenticated)
rss.enabled=false
# change hostname here
grails.serverURL=https://FQDN:443
dataSource.dbCreate = update
dataSource.url = jdbc:mysql://RDS-Endpoint/DB-Name?autoReconnect=true
dataSource.username=rundeck
dataSource.password=******

# Enables DB for Project configuration storage
rundeck.projectsStorageType = db

# Encryption for project config storage
rundeck.config.storage.converter.1.type = jasypt-encryption
rundeck.config.storage.converter.1.path = projects
rundeck.config.storage.converter.1.config.password = mysecret

# Enable DB for Key Storage
rundeck.storage.provider.1.type = db
rundeck.storage.provider.1.path = keys

# Encryption for Key Storage
rundeck.storage.converter.1.type = jasypt-encryption
rundeck.storage.converter.1.path = keys
rundeck.storage.converter.1.config.password = mysecret

#mail setting
grails.mail.port=25
grails.mail.default.from=rundeck-server@domain
```

```bash:profile
# ----------------------------------------------------------------
# SSH defaults for node executor and file copier
# SSL Terminated Proxyを有効にするため、$RDECK_JVMにDrundeck.jetty.connector.forwarded=trueを記述
# ----------------------------------------------------------------

RDECK_BASE=/var/lib/rundeck
export RDECK_BASE

JAVA_CMD=java
RUNDECK_TEMPDIR=/tmp/rundeck

RDECK_HTTP_PORT=4440
RDECK_HTTPS_PORT=4443

#
# If JAVA_HOME is set, then add it to home and set JAVA_CMD to use the version specified in that
# path.  JAVA_HOME can be set in the rundeck profile.  Or set in this file.
#JAVA_HOME=<path/to/JDK or JRE/install>

if [ ! -z $JAVA_HOME ]; then
        PATH=$PATH:$JAVA_HOME/bin
        export PATH
        JAVA_CMD=$JAVA_HOME/bin/java
fi



export CLI_CP=$(find /var/lib/rundeck/cli -name \*.jar -printf %p:)
export BOOTSTRAP_CP=$(find /var/lib/rundeck/bootstrap -name \*.jar -printf %p:)
export RDECK_JVM="-Djava.security.auth.login.config=/etc/rundeck/jaas-loginmodule.conf \
        -Dloginmodule.name=RDpropertyfilelogin \
        -Drdeck.config=/etc/rundeck \
        -Drdeck.base=/var/lib/rundeck \
        -Drundeck.server.configDir=/etc/rundeck \
        -Dserver.datastore.path=/var/lib/rundeck/data \
        -Drundeck.server.serverDir=/var/lib/rundeck \
        -Drdeck.projects=/var/rundeck/projects \
        -Drdeck.runlogs=/var/lib/rundeck/logs \
        -Drundeck.config.location=/etc/rundeck/rundeck-config.properties \
        -Djava.io.tmpdir=$RUNDECK_TEMPDIR \
        -Drundeck.jetty.connector.forwarded=true"
#
# Set min/max heap size
#
RDECK_JVM="$RDECK_JVM -Xmx1024m -Xms256m -XX:MaxPermSize=256m -server"
#
# SSL Configuration - Uncomment the following to enable.  Check SSL.properties for details.
#
#export RDECK_JVM="$RDECK_JVM -Drundeck.ssl.config=/etc/rundeck/ssl/ssl.properties -Dserver.https.port=${RDECK_HTTPS_PORT}"

export RDECK_SSL_OPTS="-Djavax.net.ssl.trustStore=/etc/rundeck/ssl/truststore -Djavax.net.ssl.trustStoreType=jks -Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol"

if test -t 0 -a -z "$RUNDECK_CLI_TERSE"
then
  RUNDECK_CLI_TERSE=true
  export RUNDECK_CLI_TERSE
fi

if test -n "$JRE_HOME"
then
   unset JRE_HOME
```

```bash:logrotate.d
$ sudo touch rundeck&&sudo vim rundeck
/var/log/rundeck/*{
daily
rotate 31
create rundeck rundeck
compress
missingok
      sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/rundeckd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
```

```bash
$ mysql -h RDS-Endpoint -u username -p
mysql> grant ALL on rundeck.* to 'rundeck'@'localhost' identified by 'password';

$ sudo service rundeckd start&&sudo chkconfig rundeckd on

$ sudo tail -f /var/log/rundeck/service.log
#下記ログが出力されることを確認する
INFO:oejs.AbstractConnector:Started SelectChannelConnector@0.0.0.0:4440
```

# フロントエンドへ接続
![Screenshot from 2015-12-23 16:03:36.png](https://qiita-image-store.s3.amazonaws.com/0/58788/98d13d5a-5def-71dd-623c-c8933182bb76.png)
![Screenshot from 2015-12-23 16:07:39.png](https://qiita-image-store.s3.amazonaws.com/0/58788/2de3a264-23f5-1657-c68e-9bb0e510e21c.png)