Package: guacamole-compose
guacamole-composedocker-compose script for running apache guacamole.OverviewThis set of scripts and templates automates the deployment process for guacamole.Generates the docker-compose script.Generates the mysql initialization script, to configure a new mysql database.Generates an nginx configuration.Has parameter options and templates, so you should just have to change a single parameter file for each deployment.Adds user groups to mysql from ldap.Configures connections from ldap.Configures user groups with permissions to connectionsConfigures additional manual connections from the paramters.yaml file.RequirementsTested on Ubuntu 20.04 LTSdockerdocker-composepython3 (3.9)pipsudoaptupdate&&\sudoaptupgrade-y&&\sudoaptinstalldockerpython3.9-y&&\sudosystemctlenabledocker&&\curlhttps://bootstrap.pypa.io/get-pip.py--outputget-pip.py&&\sudopython3.9./get-pip.pyPython Packagesguacamole-composeNote, guacamole-compose will install the following packages:sqlalchemydockerldap3pymysqldnspythonpyyamlcryptographyyamlargcffisudopython3.9-mpipinstallguacamole-composeIf you get the following error:ERROR: Cannot uninstall 'PyYAML'. It is a distutils installed project and thus we cannot accurately determine which files belong to it which would lead to only a partial uninstall.Run this command before installing guacamole-composesudopython3.9-mpipinstall--upgradepyyaml--ignore-installedNote: sudo is needed in the above command only if docker requires sudo privileges to be ran. This is the case by default when running docker.UsageThis requires active directory to be configured with a user group containing child user groups that will be synced to Apache Guacamole.An example structure in active directory.-guacamole:# 'guacamole' is the base user group, configured in parameters.yaml under ldap-user-search-filter and ldap/ldap_group.-user_group1:# This is a child group, a member of the 'guacamole' user group. This group will be created in apache guacamole.-computer1# This is a computer object whos connection will be automatically created. Permission to read/connect/view will be granted to members of user_group1, or user_group2 - since the computer object also exists in user_group2-user1# user1 will not have a user created in guacamole, but will be able to view any connections it's in a group with.-user_group2:-computer1-computer2-user2If a user logs in and is a member of group1, they will have access to the connection created for computer1.All computers that are in child groups will have connections created based off of the configuration settings in parameters.yaml. (auto_connections)Steps:Runguacamole-compose --initEdit the paramters.yaml file for the specific deployment.Edit either the nginx.conf or haproxy.cfg files depending on which rwp you prefer.The default haproxy.cfg and nginx.conf files use http 80 over localhost for testing.If you --deploy with the --haproxy_cfg or --nginx flags, it will overwrite the existing nginx.conf/haproxy.cfg using a template. This is most likely not what you want.Fetch certificates, and place in the corresponding folder.Deploy guacamole withsudo guacamole-compose --deploy --haproxy --ldapIf you want to update your user groups / connections after active directory changes runsudo guacamole-compose --ldapguacamole-compose--init
viparameters.yaml
sudoguacamole-compose--deploy--ldap

%guacamole-compose--help
usage:guacamole-compose[-h][--init][--clean][--deploy][--nginx][--haproxy][--haproxy_cfg][--ldap][--version]optionalarguments:-h,--helpshowthishelpmessageandexit--initInitializethedirectoryandfilesrequired.--cleanCleanthedirectoriesautomaticallycreatedduringdeployment.--deployGenerateconfigurationsanddeployguacamoleusingdocker-compose.--nginxGeneratethenginx.conffilelocatedat./nginx/conf/nginx.conf.--haproxyDeploywithhaproxyinsteadofnginx.--haproxy_cfgGeneratethehaproxy.cfgfileusingvaluesfromparameters.yaml--ldapUsedtocreate/updateconnections,groups,andpermissionsusingldap.--versionOutputsversioninformation.Cleanup of shared directoryThe template parameters.yaml uses a common folder called 'shared' for transferring files in and out of the remote computers. To prevent this folder from growing too large, you can periodically remove files older than ~6 days with a cron job. This example is shown below.crontab-e00***find/home/user/shared/*-mtime+6-typef-deleteUpdating the package and uploading to pypiMake sure the version information is updated before uploading. You cannot upload 2 copies with the same version.sudorm-rdist
python3.9setup.pybdist_wheel--universal
twineuploaddist/*Changelog0.1.7Fixeddocker-compose version (changed to v1)docker-compose requirement in setup.pyOtherAdded notes in the readme on errors caused by distutils version of pyyaml.0.1.6FixedRemoved radius auth extension as it is no longer used.Removed unnecessary ./init folder removal in the clean command.0.1.5FixedAdded clarification to parameters.yaml template to specify an alphanumeric password for the mysql user.AddedVersion information with the --version flag.Color printing for warnings and errors.Output a warning if --init is run as sudo. (Creates the ./shared directory with incorrect permissions.)client.image.prune after deploying to clean up unused images.OtherRemoved duplicate import of shutil.Removed the 'ldap' section in parameters.yaml and instead use the ldap information within the guacamole-properties section.0.1.4FixedinternalProxies in server.xml to be more generic and work no matter the internal rwp address.Added checks forguacamole-compose --initto not overwrite existing files.0.1.3Fixedcreate the ./shared folder with the --init command (without sudo). This fixes a permission issue where users would have tosudo chown user:user ./sharedfor file transfers.Updated README.md to removesudofrom in front ofguacamole-compose --initUpdated the internal proxies from 127.0.0.1 to the default. (as the rwp container will not be 127.0.0.1 to the guacamole container.) This is safe as the guacamole container does not have any exposed ports.0.1.2Addedserver.xml so that the guacamole webpage correctly shows the remote address via X-Forwarded-For.option forwardforin the haproxy templates.code in the init section to create the server.xml file from the template in ./tomcat folder.FixedUpdated nginx init conf with max body size of 10000 (for large file transfers.) Nginx configuration option already had this set.Duplicate documentation section in README.md on updating groups and connections.