Ansible Role: Oracle HTTP Server (OHS)
Relevant source files
The following files were used as context for generating this wiki page:
The ohs Ansible role is designed to automate the installation, patching, and configuration of the Oracle HTTP Server (OHS), which serves as the Web server component for Oracle Fusion Middleware. This role is a critical part of the spm-middleware collection, facilitating the infrastructure setup required for Cúram Social Program Management (SPM).
The role manages the entire lifecycle of an OHS instance, from installing base binaries and applying necessary security patches via OPatch to configuring WebLogic server plugins and SSL certificates. While it can be used independently, it is primarily intended to work in environments where WebLogic is already present, as it includes tasks for trusting WebLogic CA certificates and configuring domain links.
Sources: roles/ohs/README.md:3-8, roles/ohs/README.md:27-29, README.md:3-5
Deployment Workflow
The OHS deployment follows a structured sequence of tasks to ensure all prerequisites are met before binaries are installed and configured. The main entry point orchestrates these phases based on the version specified and the current state of the target system.
The execution flow ensures idempotency by checking inventory/registry.xml for existing versions before attempting installation or upgrades.
Sources: roles/ohs/tasks/main.yml:2-55
Installation and Infrastructure Setup
The base_install.yml task file handles the OS-level preparation and the initial binary installation. This includes creating the oracle user and oinstall group, setting up the Oracle Inventory, and executing the OHS installer in silent mode.
System Requirements and Users
The role installs a variety of system packages including binutils, gcc-c++, libaio-devel, and unzip. For RHEL/CentOS 7 systems, additional compatibility libraries like compat-libcap1 are included.
Sources: roles/ohs/tasks/base_install.yml:2-27
| Component | Default Value | Description |
|---|---|---|
ohs_user | oracle | OS user for OHS ownership (UID 54321) |
ohs_group | oinstall | Primary group for Oracle software (GID 54321) |
ohs_inventory | /opt/Oracle/oraInventory | Location of the Oracle Inventory |
ohs_home | /home/oracle/Oracle/Middleware/HTTP_Oracle_Home | The ORACLE_HOME directory for OHS |
Sources: roles/ohs/defaults/main.yml:4-10, roles/ohs/tasks/base_install.yml:33-46
Silent Installation
The role uses a Jinja2 template ohs_install.rsp.j2 to generate a response file for the silent installer. The installation command ignores system prerequisites to facilitate automated deployment across various environment flavors.
Sources: roles/ohs/tasks/base_install.yml:95-104
Patching with OPatch
Patching is handled via patch.yml, which manages the version of the OPatch tool itself and applies specific middleware patches defined in the version variables.
Patching Logic
- Java Setup: OHS patching requires a JDK; the role extracts a Java repo to the specified
jdk_folder. - OPatch Tool Update: If
opatch_versionis defined, the role checks the current version inversion.txtand updates the tool if a mismatch is found. - Application of Patches: The role iterates through a list of patches, extracts them to
/tmp/, and runsopatch apply -silentfrom the patch directory.
Sources: roles/ohs/tasks/patch.yml:2-87
Domain and SSL Configuration
The configuration phase (config.yml) establishes the OHS domain, configures performance modules, and sets up SSL wallets for both frontend (Public Endpoint) and backend (WebLogic Plugin) communication.
Wallet and Certificate Management
The role automates the creation of Oracle Wallets using the orapki utility. It generates self-signed certificates for the frontend and imports WebLogic's CA (CertGenCA.der) into a plugin wallet to secure the connection between OHS and the WebLogic managed servers.
Sources: roles/ohs/tasks/config.yml:118-255
Key Configuration Files
| File Path | Description |
|---|---|
custom_ohs_perf.conf | Performance tuning parameters for OHS modules |
mod_wl_ohs.conf | Configuration for the WebLogic Server Proxy Plug-in |
ssl.conf | Updated to use publicEndPoint instead of default wallet |
/etc/cap.ora | Configured with oinstall: bind to allow port binding |
Sources: roles/ohs/tasks/config.yml:42-50, roles/ohs/tasks/config.yml:92-105, roles/ohs/tasks/config.yml:251-255
Service Management
The role configures a systemd service for the Node Manager (ohsNM.service) to ensure the OHS administration components persist across reboots. Once the Node Manager is active, the role uses startComponent.sh to initialize the OHS instance (ohs1) and store user configuration for future headless operations.
Sources: roles/ohs/tasks/config.yml:272-302
Summary
The ohs role provides a comprehensive automation suite for Oracle HTTP Server within the SPM middleware stack. By handling prerequisite libraries, silent installations, OPatch updates, and complex Oracle Wallet configurations, it ensures a consistent and secure Web server environment. Its reliance on orapki and OpenSSL integration allows it to manage the end-to-end trust chain between external clients and backend WebLogic application servers.
Sources: roles/ohs/README.md, roles/ohs/tasks/main.yml, roles/ohs/tasks/config.yml