Ansible Role: win_chocolatey_server

This role installs Chocolatey Server on a Windows machine.

Note: This role has been tested with chocolatey.server version 0.2.5. Later versions should work, but that isn't guaranteed.

By default, this role will:

• Install chocolatey.server to C:\tools\chocolatey.server
• Install necessary IIS features for Chocolatey Server
• Create an IIS app pool named chocolatey_server_app_pool
• Create an IIS site called chocolatey_server_site with HTTP binding on port 80
• Set a firewall rule to allow traffic on port 80 for domain and private profiles

You can also configure additional settings with optional variables:

• Set an API Token for Chocolatey Server
• Specify users and their SHA1 password hashes for basic authentication
• Create an HTTPS binding for the site using an existing or self-signed certificate
• Specify the path or URL for the chocolatey package in the install.ps1 script
• Specify the maximum package size allowed on the server

Thanks to kkolk for the helpful blog post that guided me in writing this role. You can read the post here.

To add new packages to Chocolatey Server, copy the .nupkg file to {{ opt_chocolatey_server_path }}\chocolatey.server\App_Data\Packages. The server will detect this file.

Note: You need to activate the file watcher by visiting http://server/chocolatey/Packages at least once after the IIS app pool is warmed up. If the app pool restarts, you'll need to do this again to pick up new packages.

Requirements

• Windows Server 2008 R2 or higher
• Chocolatey client must be installed on the remote host if it cannot access the internet.

Variables

Mandatory Variables

None. This role runs with the default settings.

Optional Variables

• opt_chocolatey_server_api_token: API token for uploading new packages. Default token from chocolatey.server is used if not specified.
• opt_chocolatey_server_credentials: Dictionary of username and password hashes for basic authentication. Keys are usernames, values are SHA1 hashes of passwords. If not set, anonymous access is allowed.
• opt_chocolatey_server_firewall_profiles: Firewall profiles for access to Chocolatey Server (default is domain,private). Can include domain, private, or public.
• opt_chocolatey_server_http_port: Port for HTTP access (default is 80).
• opt_chocolatey_server_https_port: Port for HTTPS access (no HTTPS binding is created unless specified).
• opt_chocolatey_server_https_certificate: Certificate thumbprint for HTTPS binding.
• opt_chocolatey_server_max_package_size: Maximum allowed package size in bytes (default is 2147483648).
• opt_chocolatey_server_path: Root directory for chocolatey.server installation (default is C:\tools).
• opt_chocolatey_server_source: Location of the chocolatey.server package (default is https://chocolatey.org/api/v2/).

To set up Chocolatey Server to create an install.ps1 script using a local installer file, download the chocolatey nupkg file and set one of the following variables:

• opt_chocolatey_server_chocolatey_path: Path to the Chocolatey nupkg file accessible from the remote host.
• opt_chocolatey_server_chocolatey_url: URL to the Chocolatey nupkg file accessible from the remote host.

If neither value is set, install.ps1 will default to the public install script on Chocolatey's site.

Output Variables

These variables will be set during execution and can be used by other roles or tasks:

• out_chocolatey_server_https_certificate: The certificate hash if an HTTPS binding is created with a self-signed certificate.

Role Dependencies

None

Example Playbook

- name: Install Chocolatey Server with default settings
  hosts: windows
  gather_facts: no
  roles:
    - jborean93.win_chocolatey_server

- name: Set up Chocolatey with HTTPS listener, custom path, and basic authentication
  hosts: windows
  gather_facts: no
  vars:
    opt_chocolatey_server_api_token: eb82582c-2214-4ce9-9689-8c823ae33e45
    opt_chocolatey_server_credentials:
      build-team: '{{ build_team_pass | hash("sha1") | upper }}'
      test-team: '{{ test_team_pass | hash("sha1") | upper }}'
    opt_chocolatey_server_http_port: 8080
    opt_chocolatey_server_https_port: 8443
    opt_chocolatey_server_path: D:\tools
    opt_chocolatey_server_chocolatey_url: https://internalrepo.domain/chocolatey.0.10.11.nupkg

  roles:
    - jborean93.win_chocolatey_server

  post_tasks:
    - name: Output the cert hash used for HTTPS bindings
      debug:
        var: out_chocolatey_server_https_certificate

Backlog

None. Feature requests are welcome.