Remote Desktop Flavour

This Ansible Playbook configures virtual machines within the European Weather Cloud (EWC) to operate as a remote desktops, courtesy of X2Go.

X2Go enables secure, graphical access to a desktop environment over low or high bandwidth connections, providing a seamless user experience for remote work. This template equips your VM with utility software you would expect to see in a typical and stable Linux distribution, ideal efficient and intuitive desktop operation.

Special for tenant users needing remote graphical access in their EWC environment, this template simplifies the setup of basic cloud development solution. Follow the instructions below to get started.

Functionality

The template is designed to:

• Configure a pre-existing Rocky Linux virtual machine (minimum 4GB RAM recommended) with the MATE desktop environment.
• Install and set up X2Go for secure remote desktop access over varying network conditions.
• Enable end-users to interact with the VM through a graphical interface using the X2Go client application.

Prerequisites

💡 This Item is supported by the EWCCLI, and can be deployed, together with a compatible VM, via it. Checkout the EWC User Stories: I want to use the ewccli documentation pages to learn how.

• Install git (version 2.0 or higher )

• Install python (version 3.9 or higher)

• Install ansible (version 2.15 or higher)

• Verify the ssh-https OpenStack Security Group exists in your EWC tenancy

  💡 You may create Security Groups via this EWC Community Hub Item if pre-required ones are missing.

• If you plan to configure an existing VM, ensure it meets the minium requirements before moving on to the Usage section below:

  • VM Image: RockyLinux 8 or 9
  • VM Plan: 4 CPU cores, 4GB RAM, 30GB Disk
  • Network: Private
  • Security Groups: ssh-https
  • Floating IP: Optional (not recommended from a security standpoint)

  Otherwise, provision a new VM with above specifications before continuing (see EWC Getting Started: Provision a VM for details).

Usage

1. Clone the repository

git clone https://github.com/ewcloud/ewc-ansible-playbook-flavours-and-provisioning.git

1.1. Change to the specific Item's subdirectory

cd ewc-ansible-playbook-flavours-and-provisioning/playbooks/remote-desktop-flavour

1.2. Checkout an specific Item's version

⚠️ Make sure to replace x.y.z in the command below, with your version of preference.

git checkout x.y.z

2. Download Ansible dependencies

💡 By default, Ansible Roles are installed under the ~/.ansible/roles directory within your working environment.

Download the correct version of the Ansible dependencies, if you haven't done so already:

ansible-galaxy role install --force -r requirements.yml

3. Specify the target host and SSH credentials

Create an inventory file, to specify address/credentials that your local working environment should use to connect to the target VM.

Copy into the file one of the two snippets below, and replace the placeholders (i.e. values enclosed in < > characters):

• Connecting form within the EWC tenancy's network

  # inventory.yml
  ---
  ewcloud:
    hosts:
      target:
        ansible_python_interpreter: auto
        ansible_host: <add the IP address of the target host>
        ansible_ssh_private_key_file: <add the path to local SSH private key file>
        ansible_user: cloud-user
        ansible_ssh_common_args: -o StrictHostKeyChecking=no
  

OR

• Connecting from outside the EWC tenancy's network

  ⚠️ This requires an SSH Bastion to be already provisioned within your EWC tenancy.

  # inventory.yml
  ---
  ewcloud:
    hosts:
      target:
        ansible_host: <add the IP address of the target host>
        ansible_ssh_user: cloud-user
        ansible_ssh_private_key_file: <add the path to local SSH private key file>
        ansible_python_interpreter: auto
  
  all:
    vars:
      ansible_ssh_common_args: >-
        -o StrictHostKeyChecking=no
        -o UserKnownHostsFile=/dev/null
        -o ProxyCommand="ssh
                        -o StrictHostKeyChecking=no
                        -o UserKnownHostsFile=/dev/null
                        -o BatchMode=yes
                        -W %h:%p
                        -i <add the path to local SSH private key file>
                        cloud-user@<add the IP address of the ssh bastion>"
  
  

4. Configure and apply the template

• Interactive Mode

  By running the following command, you can trigger an interactive session that prompts you for the necessary user inputs, and then applies changes to your target EWC environment:

  ansible-playbook -i inventory.yml remote-desktop-flavour.yml
  

• Non-Interactive Mode

  💡 To learn more about defining variables at runtime, checkout the official Ansible documentation.

  You can also run in non-interactive mode by passing the --extra-vars or -e flag, followed by a map of key-value pairs; one for each and every available input (see inputs section below). For example:

  ansible-playbook \
    -i inventory.yml \
    -e '{
        "fail2ban_whitelisted_ip_ranges": ""
      }' \
    remote-desktop-flavour.yml
  

5. Install the local client and connect to your remote desktop

⚠️ When configuring a connection, be sure to select "MATE" (instead of "KDE" or any other options) in the Session Type drop-down list, towards the bottom of the Session tab. This is required for the local client to correctly communicate with your remote desktop.

Install the remote desktop client on Microsoft Window, Mac OS or Linux by following the links on the official X2Go installation page. Then follow the official X2Go client usage page if you do not know how to configure a new session.

For a session creation example, representative of a typical EWC environment, checkout the Remote Desktop section of [this official EWC documentation page]https://confluence.ecmwf.int/x/bVA7E).

Inputs

Dependencies

💡 Upon execution, a SBOM (SPDX format) is auto-generated and stored in the VM's file system root directory (see /sbom.json).