Move installer roles into roles directory

Signed-off-by: Shane McDonald <me@shanemcd.com>
2026-05-17 06:17:36 -02:30 · 2018-03-22 14:34:03 -04:00
parent ddf000e8e7
commit 84cd933702
32 changed files with 0 additions and 0 deletions
--- a/installer/roles/image_build/files/Dockerfile.sdist
+++ b/installer/roles/image_build/files/Dockerfile.sdist
@@ -0,0 +1,21 @@
+FROM centos:7
+
+RUN yum install -y epel-release
+RUN yum install -y https://centos7.iuscommunity.org/ius-release.rpm
+
+RUN yum install -y bzip2 \
+    gcc-c++ \
+    gettext \
+    git2u-core \
+    make \
+    python \
+    python-pip
+
+RUN curl --silent --location https://rpm.nodesource.com/setup_6.x | bash -
+RUN yum install -y nodejs
+RUN npm set progress=false
+
+WORKDIR "/awx"
+
+ENTRYPOINT ["/bin/bash", "-c"]
+CMD ["make sdist"]
--- a/installer/roles/image_build/files/RPM-GPG-KEY-ansible-release
+++ b/installer/roles/image_build/files/RPM-GPG-KEY-ansible-release
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
+
+mQINBFVfhqABEAC6EEEPv57spTUSQvtgqbVZI7d5ooCTMXEo5KJGVPVSfKtO8+BV
+ZTKPukUazbtplDlIe9csfbP7CBaaBn5CtDgIrbROzazxoWv7mIP6hjUaTQSd5tvv
+ONDQvnCDD5SKcy+XhqkmALSvREsN9tNtKETGXgNOLwJAlzxcpt8JLXnuiCCbefum
+gaDoPQsIkegFa/r6XhY6kLi2lpQOJ3v72IXNDpdau1vtp/xPHclfCI1iQ7gnfEdw
+rRJRGeOx1qikyqAVFgXXiI/NAQrsyIsO0ECGSBLQeDna/bGrqpCGKnrbJhfGAIWA
+aXUTRCQRemiansk0Whu4ATZz8iM9zJPi1R7CeMXgwe7VtD4KOd1y7UBHKwAhIWdu
+4Q4lsOpm2tzYFQUrY6mQ/3BkywDHkdVqmQKTGCuwcNO9PMOBLSE99yCIjxXL04VM
+dPWIqMvh15TLjd6UahNFucowX3312z4JpWFHWA075MdkvVVcqfMxohViOLUCYt/C
+74xFmT+uZUKnSQFYT/JaGqxFLjkYHmnFrb710fBjniDlaB4Ii3Tft/yXsgx8P9xb
+y2cWA/W6yFeRqXM49C3/KA6RhDWU90P55O/MWbYUSGiGu+eYT3rMAV2cI6r4+U7e
+YgQvntpc9GbAzab6co8ceJ3lpTHtSl+QZJUhSoPYg5VbSilf0AqZgUSUUQARAQAB
+tC5BbnNpYmxlLCBJbmMuIChyZWxlYXNlKSA8c2VjdXJpdHlAYW5zaWJsZS5jb20+
+iQI4BBMBAgAiBQJVX4agAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRC4
+TjOcRCZnqfN+D/9LvJVLW/zMPcZ4qK+/KpNiD+MXducBpQiUfj2AoEqkR2LwL4/G
+v5N3GCpBHSrzK1PBp5uW1+6TcdotBO5ePtmvJlSjVMVxHkcTTBfuzqtErcw/zequ
+sNsagllPlCePT1Osi34onGm7zMdillh/uw30bojYRwtDpfXiXJAqPc3vqXrER8EE
+r+ZFj4MJcqDGWdIguWX8hnIFkzYZ7Gyvwo4ETWrdRhRfHoIdwyiAawnxkgpMVHxv
+2+JlqDb+qqY2Wjffd5WC2uaxK88sCsScJF+aE+WlBIVRA4POu4gZneLfuGzzpg2e
+9PSWmtDo5X7ECRnfTIMvAbbpt08x/zSZxwRUwLdQ+F9vN7RZ/ibaXE2rG1xrWOO/
+wel8cfhDl7YgZhKw8R/RURliOB5FFJ336zGWm5HTHyhblbiNn+LcUAy8ipYp6y+C
+ATLnHzF6J5CtIRpG4Bs5Ar3xePNGUnEHXiLv3wYeq3uUkrFcRpmcMUSBrtk6QHbD
+fmJvWpdA4twmoBFBMyvvTJmBb52teNzoqBgeNflXl+SVAMT2eZSezqbvevuHQTOX
+uRw0GXsKCQ/hyR9f1fd0yGRMtPqNTRLwBb4lzpU70/rRmU9gHzY4Yhwg3E9Tv+rM
+a5Lj3YmlJRax5gUVQN02E1zlBDsiNrGqpmDG1Mxo7YPpbxgu0PFPqeqcFbkCDQRV
+X4agARAAwO4MA+7uIRV+oHmyMPLFWqiKp2nFy5McQByJxSQchn93/9qud4JYd1i6
+8pIiKN6XJqtpt16UCTewcZHM5oOJQVNwAS8TP9imfg73TfUaoOoUbp0qfGKub/Q4
+6Ktnwe940qEqYG1/QsPWNE/4G1O3b/O7m6qlozEEmxep8bRviRChz4/Mw75S1W6i
+jlKYI8yZOUco9oiFJcKqyYtaKkgEg18cNuY8uvAlvULezaZyCqVjoVbKGUUAPSVg
+CBixqLQ7UmBMA6xxptVuBvaRJAaF0VvvcyBZo4SzybtrHbUD1VWIzmWKKD/sDS2J
+MQbnQ0FnhRzTjhvQhAp2LVPeAQVbQNFdG7y+ROCHeE9mqutTZLOilut+CQ8HDWuQ
+/eCQU5yV7vh3FL/SVYS0ahZj+FdfTq8rbeIsDT42Z/MjDB54jxB5ajCHLomi4LhC
+09zeb7HgwUc5wzoN7nU1OLmmn0AFwKJVD1R5UgySggv2xJym1H/mjJiR0MDweJDc
+xj3bf4qGRDLVFRkZcO3cmMDLhL9gb1MIU3zBVotOBt2dig/Je+K6CUFHAA237Vcg
+VKUrLIi6OdG3ecAdflGsaNKQ5XPv2mfhbieXu9N/S7HBvjeHIBD2xjWNz9UE1ymu
+QPwR6+zTxD4Nx1xIiink0MN1PaCkGJ03YBSsXnHoyiOhqAfceRcAEQEAAYkCHwQY
+AQIACQUCVV+GoAIbDAAKCRC4TjOcRCZnqSvGD/wP8y6fz2PsrgspHCraNuWTJaVA
+DesQgOxJS6uHskW/jnHkvAMTNzlVhov1hN7g+QjPMISQDCn+913kyqZ0lU3lYmvz
+nByPAbgzZvmAaTqb8v79zY6UH4NzbBuz4dhYN65dxhiMpNrXVvMRQjPFRXG0GG5d
+7ypM1b9eoRTRlJNAwQ/ONoQxZdzVpmpXjcMOaifs75lkGAfNT0bcG/o/Qh/p4MRF
+t/VSmH8tM8jJuHbIPcs8FWP4J8xzum8uhF2ZlKEQsR2C9cBJSBrs5jdOjgMqwFv5
+2qCg0PpEKKNQdu9MabapBprFMwJWIl+dOjUE3fdMrOSJBZZusQq9nwtDNAaaLcD7
+RwStw7AXi6CxYuB/uikKRviLqRCwASdj5Cdjtu6mohS8DdVkpEYbpuPjEdqc7UyW
+fAZQqYMkwIfaxE25/S+FxqISSCFIOCL3QNTk0Q9u2W6Fh+KUACZobtwUL/XytPBz
+7Fn5wXeOCPoAbOXoiT7kPsFGvIsFHpF3K7Fy+cMrqr5dqhywGK5ckIKXRKmCAu8H
+iDeBqVjBn143WJPZ8uiu+7TiaGLuOqDdiDSchM24W4hs5DbD9zdVYy6IFi1OWSot
+HUQyZisiIgD1hSHhkn2LTYrJqIdvJ/q8buMKywB9Avs5fwP/CnsrSP9z+RWJ8HKP
+OwWvTVGXCPUZTxHiYg==
+=msBf
+-----END PGP PUBLIC KEY BLOCK-----
--- a/installer/roles/image_build/files/ansible.repo
+++ b/installer/roles/image_build/files/ansible.repo
@@ -0,0 +1,6 @@
+[ansible]
+name=Ansible for Enterprise Linux 7 - $basearch
+baseurl=https://releases.ansible.com/ansible/rpm/release/epel-7-x86_64/
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ansible-release
--- a/installer/roles/image_build/files/launch_awx.sh
+++ b/installer/roles/image_build/files/launch_awx.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+if [ `id -u` -ge 500 ]; then
+    echo "awx:x:`id -u`:`id -g`:,,,:/var/lib/awx:/bin/bash" >> /tmp/passwd
+    cat /tmp/passwd > /etc/passwd
+    rm /tmp/passwd
+fi
+awx-manage collectstatic --noinput --clear
+supervisord -c /supervisor.conf
--- a/installer/roles/image_build/files/launch_awx_task.sh
+++ b/installer/roles/image_build/files/launch_awx_task.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+if [ `id -u` -ge 500 ]; then
+    echo "awx:x:`id -u`:`id -g`:,,,:/var/lib/awx:/bin/bash" >> /tmp/passwd
+    cat /tmp/passwd > /etc/passwd
+    rm /tmp/passwd
+fi
+
+ANSIBLE_REMOTE_TEMP=/tmp ANSIBLE_LOCAL_TEMP=/tmp ansible -i "127.0.0.1," -c local -v -m wait_for -a "host=$DATABASE_HOST port=$DATABASE_PORT" all
+ANSIBLE_REMOTE_TEMP=/tmp ANSIBLE_LOCAL_TEMP=/tmp ansible -i "127.0.0.1," -c local -v -m wait_for -a "host=$MEMCACHED_HOST port=11211" all
+ANSIBLE_REMOTE_TEMP=/tmp ANSIBLE_LOCAL_TEMP=/tmp ansible -i "127.0.0.1," -c local -v -m wait_for -a "host=$RABBITMQ_HOST port=5672" all
+ANSIBLE_REMOTE_TEMP=/tmp ANSIBLE_LOCAL_TEMP=/tmp ansible -i "127.0.0.1," -c local -v -m postgresql_db --become-user $DATABASE_USER -a "name=$DATABASE_NAME owner=$DATABASE_USER login_user=$DATABASE_USER login_host=$DATABASE_HOST login_password=$DATABASE_PASSWORD port=$DATABASE_PORT" all
+
+awx-manage migrate --noinput --fake-initial
+if [ ! -z "$AWX_ADMIN_USER" ]&&[ ! -z "$AWX_ADMIN_PASSWORD" ]; then
+    echo "from django.contrib.auth.models import User; User.objects.create_superuser('$AWX_ADMIN_USER', 'root@localhost', '$AWX_ADMIN_PASSWORD')" | awx-manage shell
+    awx-manage create_preload_data
+else
+    echo "from django.contrib.auth.models import User; User.objects.create_superuser('admin', 'root@localhost', 'password')" | awx-manage shell
+    awx-manage create_preload_data
+fi
+echo 'from django.conf import settings; x = settings.AWX_TASK_ENV; x["HOME"] = "/var/lib/awx"; settings.AWX_TASK_ENV = x' | awx-manage shell
+awx-manage provision_instance --hostname=$(hostname)
+awx-manage register_queue --queuename=tower --instance_percent=100
+supervisord -c /supervisor_task.conf
--- a/installer/roles/image_build/files/nginx.conf
+++ b/installer/roles/image_build/files/nginx.conf
@@ -0,0 +1,82 @@
+#user awx;
+
+worker_processes  1;
+
+pid        /tmp/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       /etc/nginx/mime.types;
+    default_type  application/octet-stream;
+
+    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                      '$status $body_bytes_sent "$http_referer" '
+                      '"$http_user_agent" "$http_x_forwarded_for"';
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    sendfile        on;
+    #tcp_nopush     on;
+    #gzip  on;
+
+    upstream uwsgi {
+        server 127.0.0.1:8050;
+        }
+
+    upstream daphne {
+        server 127.0.0.1:8051;
+    }
+
+    server {
+        listen 8052 default_server;
+
+        # If you have a domain name, this is where to add it
+        server_name _;
+        keepalive_timeout 65;
+
+        # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
+        add_header Strict-Transport-Security max-age=15768000;
+
+        location /static/ {
+            alias /var/lib/awx/public/static/;
+        }
+
+        location /favicon.ico { alias /var/lib/awx/public/static/favicon.ico; }
+
+        location /websocket {
+            # Pass request to the upstream alias
+            proxy_pass http://daphne;
+            # Require http version 1.1 to allow for upgrade requests
+            proxy_http_version 1.1;
+            # We want proxy_buffering off for proxying to websockets.
+            proxy_buffering off;
+            # http://en.wikipedia.org/wiki/X-Forwarded-For
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            # enable this if you use HTTPS:
+            proxy_set_header X-Forwarded-Proto https;
+            # pass the Host: header from the client for the sake of redirects
+            proxy_set_header Host $http_host;
+            # We've set the Host header, so we don't need Nginx to muddle
+            # about with redirects
+            proxy_redirect off;
+            # Depending on the request value, set the Upgrade and
+            # connection headers
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+        }
+
+        location / {
+            # Add trailing / if missing
+            rewrite ^(.*)$http_host(.*[^/])$ $1$http_host$2/ permanent;
+            uwsgi_read_timeout 120s;
+            uwsgi_pass uwsgi;
+            include /etc/nginx/uwsgi_params;
+        }
+    }
+}
--- a/installer/roles/image_build/files/settings.py
+++ b/installer/roles/image_build/files/settings.py
@@ -0,0 +1,111 @@
+# AWX settings file
+
+import os
+
+
+def get_secret():
+    if os.path.exists("/etc/tower/SECRET_KEY"):
+        return file('/etc/tower/SECRET_KEY', 'rb').read().strip()
+    return os.getenv("SECRET_KEY", "privateawx")
+
+
+ADMINS = ()
+
+STATIC_ROOT = '/var/lib/awx/public/static'
+
+PROJECTS_ROOT = '/var/lib/awx/projects'
+
+JOBOUTPUT_ROOT = '/var/lib/awx/job_status'
+
+SECRET_KEY = get_secret()
+
+ALLOWED_HOSTS = ['*']
+
+INTERNAL_API_URL = 'http://awxweb:8052'
+
+# Container environments don't like chroots
+AWX_PROOT_ENABLED = False
+
+
+CLUSTER_HOST_ID = "awx"
+SYSTEM_UUID = '00000000-0000-0000-0000-000000000000'
+
+CSRF_COOKIE_SECURE = False
+SESSION_COOKIE_SECURE = False
+
+###############################################################################
+# EMAIL SETTINGS
+###############################################################################
+
+SERVER_EMAIL = 'root@localhost'
+DEFAULT_FROM_EMAIL = 'webmaster@localhost'
+EMAIL_SUBJECT_PREFIX = '[AWX] '
+
+EMAIL_HOST = 'localhost'
+EMAIL_PORT = 25
+EMAIL_HOST_USER = ''
+EMAIL_HOST_PASSWORD = ''
+EMAIL_USE_TLS = False
+
+LOGGING['handlers']['console'] = {
+    '()': 'logging.StreamHandler',
+    'level': 'DEBUG',
+    'formatter': 'simple',
+}
+
+LOGGING['loggers']['django.request']['handlers'] = ['console']
+LOGGING['loggers']['rest_framework.request']['handlers'] = ['console']
+LOGGING['loggers']['awx']['handlers'] = ['console']
+LOGGING['loggers']['awx.main.commands.run_callback_receiver']['handlers'] = ['console']
+LOGGING['loggers']['awx.main.commands.inventory_import']['handlers'] = ['console']
+LOGGING['loggers']['awx.main.tasks']['handlers'] = ['console']
+LOGGING['loggers']['awx.main.scheduler']['handlers'] = ['console']
+LOGGING['loggers']['django_auth_ldap']['handlers'] = ['console']
+LOGGING['loggers']['social']['handlers'] = ['console']
+LOGGING['loggers']['system_tracking_migrations']['handlers'] = ['console']
+LOGGING['loggers']['rbac_migrations']['handlers'] = ['console']
+LOGGING['loggers']['awx.isolated.manager.playbooks']['handlers'] = ['console']
+LOGGING['handlers']['callback_receiver'] = {'class': 'logging.NullHandler'}
+LOGGING['handlers']['fact_receiver'] = {'class': 'logging.NullHandler'}
+LOGGING['handlers']['task_system'] = {'class': 'logging.NullHandler'}
+LOGGING['handlers']['tower_warnings'] = {'class': 'logging.NullHandler'}
+LOGGING['handlers']['rbac_migrations'] = {'class': 'logging.NullHandler'}
+LOGGING['handlers']['system_tracking_migrations'] = {'class': 'logging.NullHandler'}
+LOGGING['handlers']['management_playbooks'] = {'class': 'logging.NullHandler'}
+
+DATABASES = {
+    'default': {
+        'ATOMIC_REQUESTS': True,
+        'ENGINE': 'django.db.backends.postgresql',
+        'NAME': os.getenv("DATABASE_NAME", None),
+        'USER': os.getenv("DATABASE_USER", None),
+        'PASSWORD': os.getenv("DATABASE_PASSWORD", None),
+        'HOST': os.getenv("DATABASE_HOST", None),
+        'PORT': os.getenv("DATABASE_PORT", None),
+    }
+}
+
+BROKER_URL = 'amqp://{}:{}@{}:{}/{}'.format(
+    os.getenv("RABBITMQ_USER", None),
+    os.getenv("RABBITMQ_PASSWORD", None),
+    os.getenv("RABBITMQ_HOST", None),
+    os.getenv("RABBITMQ_PORT", "5672"),
+    os.getenv("RABBITMQ_VHOST", "tower"))
+
+CHANNEL_LAYERS = {
+    'default': {'BACKEND': 'asgi_amqp.AMQPChannelLayer',
+                'ROUTING': 'awx.main.routing.channel_routing',
+                'CONFIG': {'url': BROKER_URL}}
+}
+
+
+CACHES = {
+    'default': {
+        'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
+        'LOCATION': '{}:{}'.format(os.getenv("MEMCACHED_HOST", None),
+                                   os.getenv("MEMCACHED_PORT", "11211"))
+    },
+    'ephemeral': {
+        'BACKEND': 'django.core.cache.backends.locmem.LocMemCache',
+    },
+}
--- a/installer/roles/image_build/files/supervisor.conf
+++ b/installer/roles/image_build/files/supervisor.conf
@@ -0,0 +1,60 @@
+[supervisord]
+nodaemon = True
+umask = 022
+
+[program:nginx]
+command = nginx -g "daemon off;"
+autostart = true
+autorestart = true
+stopwaitsecs = 5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:uwsgi]
+command = /var/lib/awx/venv/awx/bin/uwsgi --socket 127.0.0.1:8050 --module=awx.wsgi:application --vacuum --processes=5 --harakiri=120 --no-orphans --master --max-requests=1000 --master-fifo=/var/lib/awx/awxfifo --lazy-apps -b 32768
+directory = /var/lib/awx
+autostart = true
+autorestart = true
+stopwaitsecs = 15
+stopsignal = INT
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:daphne]
+command = /var/lib/awx/venv/awx/bin/daphne -b 127.0.0.1 -p 8051 awx.asgi:channel_layer
+directory = /var/lib/awx
+autostart = true
+autorestart = true
+stopwaitsecs = 5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[group:tower-processes]
+programs=nginx,uwsgi,daphne
+priority=5
+
+# TODO: Exit Handler
+
+[eventlistener:awx-config-watcher]
+command=/usr/bin/config-watcher
+stderr_logfile=/dev/stdout
+stderr_logfile_maxbytes=0
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+events=TICK_60
+priority=0
+
+[unix_http_server]
+file=/tmp/supervisor.sock
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
--- a/installer/roles/image_build/files/supervisor_task.conf
+++ b/installer/roles/image_build/files/supervisor_task.conf
@@ -0,0 +1,62 @@
+[supervisord]
+nodaemon = True
+umask = 022
+
+[program:celery]
+command = /var/lib/awx/venv/awx/bin/celery worker -A awx -B -l debug --autoscale=50,4 -Ofair -s /var/lib/awx/beat.db -n celery@%(ENV_HOSTNAME)s
+directory = /var/lib/awx
+environment = LANGUAGE="en_US.UTF-8",LANG="en_US.UTF-8",LC_ALL="en_US.UTF-8",LC_CTYPE="en_US.UTF-8"
+#user = {{ aw_user }}
+autostart = true
+autorestart = true
+stopwaitsecs = 5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:callback-receiver]
+command = awx-manage run_callback_receiver
+directory = /var/lib/awx
+autostart = true
+autorestart = true
+stopwaitsecs = 5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:channels-worker]
+command = awx-manage runworker --only-channels websocket.*
+directory = /var/lib/awx
+autostart = true
+autorestart = true
+stopwaitsecs = 5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[group:tower-processes]
+programs=celery,callback-receiver,channels-worker
+priority=5
+
+# TODO: Exit Handler
+
+[eventlistener:awx-config-watcher]
+command=/usr/bin/config-watcher
+stderr_logfile=/dev/stdout
+stderr_logfile_maxbytes=0
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+events=TICK_60
+priority=0
+
+[unix_http_server]
+file=/tmp/supervisor.sock
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
--- a/installer/roles/image_build/tasks/main.yml
+++ b/installer/roles/image_build/tasks/main.yml
@@ -0,0 +1,220 @@
+---
+- name: Get Version from checkout if not provided
+  shell: "git describe --long --first-parent | sed 's/\\-g.*//' | sed 's/\\-/\\./'"
+  delegate_to: localhost
+  register: awx_version_command
+  when: awx_version is not defined
+
+- name: Set global version if not provided
+  set_fact:
+    awx_version: "{{ awx_version_command.stdout }}"
+  when: awx_version is not defined
+
+- name: Verify awx-logos directory exists for official install
+  stat:
+    path: "../../awx-logos"
+  delegate_to: localhost
+  register: logosdir
+  failed_when: logosdir.stat.isdir is not defined or not logosdir.stat.isdir
+  when: awx_official|default(false)|bool
+
+- name: Copy logos for inclusion in sdist
+  copy:
+    src: "../../awx-logos/awx/ui/client/assets"
+    dest: "../awx/ui/client/"
+  delegate_to: localhost
+  when: awx_official|default(false)|bool
+
+- name: Set sdist file name
+  set_fact:
+    awx_sdist_file: "awx-{{ awx_version }}.tar.gz"
+
+- name: AWX Distribution
+  debug:
+    msg: "{{ awx_sdist_file }}"
+
+- name: Stat distribution file
+  stat:
+    path: "../dist/{{ awx_sdist_file }}"
+  delegate_to: localhost
+  register: sdist
+
+- name: Clean distribution
+  shell: make clean
+  args:
+    chdir: ..
+  ignore_errors: yes
+  when: not sdist.stat.exists
+  delegate_to: localhost
+
+- name: Build sdist builder image
+  docker_image:
+    buildargs:
+      http_proxy: "{{ http_proxy | default('') }}"
+      https_proxy: "{{ https_proxy | default('') }}"
+      no_proxy: "{{ no_proxy | default('') }}"
+    path: "image_build/files"
+    dockerfile: Dockerfile.sdist
+    name: awx_sdist_builder
+    tag: "{{ awx_version }}"
+    force: true
+  delegate_to: localhost
+  when: use_container_for_build|default(true)|bool
+
+- name: Build AWX distribution using container
+  docker_container:
+    env:
+      http_proxy: "{{ http_proxy | default('') }}"
+      https_proxy: "{{ https_proxy | default('') }}"
+      no_proxy: "{{ no_proxy | default('') }}"
+    image: "awx_sdist_builder:{{ awx_version }}"
+    name: awx_sdist_builder
+    state: started
+    detach: false
+    volumes:
+      - ../:/awx:Z
+  delegate_to: localhost
+  when: use_container_for_build|default(true)|bool
+
+- name: Build AWX distribution locally
+  shell: make sdist
+  args:
+    chdir: ..
+  delegate_to: localhost
+  when: not use_container_for_build|default(true)|bool
+
+- name: Set docker build base path
+  set_fact:
+    docker_base_path: "{{ awx_local_base_config_path|default('/tmp') }}/docker-image"
+
+- name: Set awx_web image name
+  set_fact:
+    awx_web_image: "{{ awx_web_image|default('awx_web') }}"
+
+- name: Set awx_task image name
+  set_fact:
+    awx_task_image: "{{ awx_task_image|default('awx_task') }}"
+
+- name: Ensure directory exists
+  file:
+    path: "{{ docker_base_path }}"
+    state: directory
+  delegate_to: localhost
+
+- name: Stage sdist
+  copy:
+    src: "../dist/{{ awx_sdist_file }}"
+    dest: "{{ docker_base_path }}/{{ awx_sdist_file }}"
+  delegate_to: localhost
+
+- name: Template web Dockerfile
+  template:
+    src: Dockerfile.j2
+    dest: "{{ docker_base_path }}/Dockerfile"
+  delegate_to: localhost
+
+- name: Template task Dockerfile
+  template:
+    src: Dockerfile.task.j2
+    dest: "{{ docker_base_path }}/Dockerfile.task"
+  delegate_to: localhost
+
+- name: Stage launch_awx
+  copy:
+    src: launch_awx.sh
+    dest: "{{ docker_base_path }}/launch_awx.sh"
+    mode: '0700'
+  delegate_to: localhost
+
+- name: Stage launch_awx_task
+  copy:
+    src: launch_awx_task.sh
+    dest: "{{ docker_base_path }}/launch_awx_task.sh"
+    mode: '0700'
+  delegate_to: localhost
+
+- name: Stage nginx.conf
+  copy:
+    src: nginx.conf
+    dest: "{{ docker_base_path }}/nginx.conf"
+  delegate_to: localhost
+
+- name: Stage supervisor.conf
+  copy:
+    src: supervisor.conf
+    dest: "{{ docker_base_path }}/supervisor.conf"
+  delegate_to: localhost
+
+- name: Stage supervisor_task.conf
+  copy:
+    src: supervisor_task.conf
+    dest: "{{ docker_base_path }}/supervisor_task.conf"
+  delegate_to: localhost
+
+- name: Stage settings.py
+  copy:
+    src: settings.py
+    dest: "{{ docker_base_path }}/settings.py"
+  delegate_to: localhost
+
+- name: Stage requirements
+  copy:
+    src: ../requirements/
+    dest: "{{ docker_base_path }}/requirements"
+  delegate_to: localhost
+
+- name: Stage config watcher
+  copy:
+    src: ../tools/scripts/config-watcher
+    dest: "{{ docker_base_path }}/config-watcher"
+  delegate_to: localhost
+
+- name: Stage Makefile
+  copy:
+    src: ../Makefile
+    dest: "{{ docker_base_path }}/Makefile"
+  delegate_to: localhost
+
+- name: Stage ansible repo
+  copy:
+    src: 'ansible.repo'
+    dest: '{{ docker_base_path }}/ansible.repo'
+  delegate_to: localhost
+
+- name: Stage ansible repo key
+  copy:
+    src: 'RPM-GPG-KEY-ansible-release'
+    dest: '{{ docker_base_path }}/RPM-GPG-KEY-ansible-release'
+  delegate_to: localhost
+
+- name: Build base web image
+  docker_image:
+    buildargs:
+      http_proxy: "{{ http_proxy | default('') }}"
+      https_proxy: "{{ https_proxy | default('') }}"
+      no_proxy: "{{ no_proxy | default('') }}"
+    path: "{{ docker_base_path }}"
+    dockerfile: Dockerfile
+    name: "{{ awx_web_image }}"
+    tag: "{{ awx_version }}"
+  delegate_to: localhost
+
+- name: Build base task image
+  docker_image:
+    buildargs:
+      http_proxy: "{{ http_proxy | default('') }}"
+      https_proxy: "{{ https_proxy | default('') }}"
+      no_proxy: "{{ no_proxy | default('') }}"
+    path: "{{ docker_base_path }}"
+    dockerfile: Dockerfile.task
+    name: "{{ awx_task_image }}"
+    tag: "{{ awx_version }}"
+    pull: no
+  delegate_to: localhost
+
+- name: Clean docker base directory
+  file:
+    path: "{{ docker_base_path }}"
+    state: absent
+  when: cleanup_docker_base|default(True)
+  delegate_to: localhost
--- a/installer/roles/image_build/templates/Dockerfile.j2
+++ b/installer/roles/image_build/templates/Dockerfile.j2
@@ -0,0 +1,66 @@
+FROM centos:7
+
+# Do we need this?
+#RUN locale-gen en_US.UTF-8
+#ENV LANG en_US.UTF-8
+#ENV LANGUAGE en_US:en
+#ENV LC_ALL en_US.UTF-8
+
+USER root
+
+# Init System
+ADD https://github.com/krallin/tini/releases/download/v0.14.0/tini /tini
+RUN chmod +x /tini
+
+ADD Makefile /tmp/Makefile
+RUN mkdir /tmp/requirements
+ADD requirements/requirements_ansible.txt \
+    requirements/requirements_ansible_uninstall.txt \
+    requirements/requirements_ansible_git.txt \
+    requirements/requirements.txt \
+    requirements/requirements_tower_uninstall.txt \
+    requirements/requirements_git.txt \
+    /tmp/requirements/
+ADD ansible.repo /etc/yum.repos.d/ansible.repo
+ADD config-watcher /usr/bin/config-watcher
+ADD RPM-GPG-KEY-ansible-release /etc/pki/rpm-gpg/RPM-GPG-KEY-ansible-release
+# OS Dependencies
+WORKDIR /tmp
+RUN mkdir -p /var/lib/awx/public/static
+RUN chgrp -Rf root /var/lib/awx && chmod -Rf g+w /var/lib/awx
+RUN yum -y install epel-release && \
+    yum -y install https://centos7.iuscommunity.org/ius-release.rpm && \
+    yum -y localinstall http://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-centos96-9.6-3.noarch.rpm && \
+    yum -y update && \
+    yum -y install ansible git2u-core mercurial subversion curl python-psycopg2 python-pip python-setuptools libselinux-python setools-libs yum-utils sudo acl make postgresql-devel nginx python-psutil libxml2-devel libxslt-devel libstdc++.so.6 gcc cyrus-sasl-devel cyrus-sasl openldap-devel libffi-devel python-pip xmlsec1-devel swig krb5-devel xmlsec1-openssl xmlsec1 xmlsec1-openssl-devel libtool-ltdl-devel bubblewrap gcc-c++ python-devel krb5-workstation krb5-libs python-crypto libcurl-devel rsync && \
+    pip install virtualenv supervisor && \
+    CFLAGS="-DXMLSEC_NO_SIZE_T" \
+    VENV_BASE=/var/lib/awx/venv make requirements_ansible && \
+    VENV_BASE=/var/lib/awx/venv make requirements_awx && \
+    yum -y remove gcc postgresql-devel libxml2-devel libxslt-devel cyrus-sasl-devel openldap-devel xmlsec1-devel krb5-devel xmlsec1-openssl-devel libtool-ltdl-devel gcc-c++ python-devel && \
+    yum -y clean all && \
+    rm -rf /root/.cache
+
+RUN mkdir -p /var/log/tower
+RUN mkdir -p /etc/tower
+COPY {{ awx_sdist_file }} /tmp/{{ awx_sdist_file }}
+RUN OFFICIAL=yes pip install /tmp/{{ awx_sdist_file }}
+
+RUN echo "{{ awx_version }}" > /var/lib/awx/.tower_version
+ADD nginx.conf /etc/nginx/nginx.conf
+ADD supervisor.conf /supervisor.conf
+ADD supervisor_task.conf /supervisor_task.conf
+ADD launch_awx.sh /usr/bin/launch_awx.sh
+ADD launch_awx_task.sh /usr/bin/launch_awx_task.sh
+RUN chmod +rx /usr/bin/launch_awx.sh && chmod +rx /usr/bin/launch_awx_task.sh && chmod +rx /usr/bin/config-watcher
+ADD settings.py /etc/tower/settings.py
+RUN chmod g+w /etc/passwd
+RUN chmod -R 777 /var/log/nginx && chmod -R 777 /var/lib/nginx
+VOLUME /var/lib/nginx
+RUN ln -sf /dev/stdout /var/log/nginx/access.log \
+    && ln -sf /dev/stderr /var/log/nginx/error.log
+USER 1000
+EXPOSE 8052
+WORKDIR /var/lib/awx
+ENTRYPOINT ["/tini", "--"]
+CMD /usr/bin/launch_awx.sh
--- a/installer/roles/image_build/templates/Dockerfile.task.j2
+++ b/installer/roles/image_build/templates/Dockerfile.task.j2
@@ -0,0 +1,6 @@
+FROM {{ awx_web_image }}:{{ awx_version }}
+USER 0
+RUN sudo yum -y remove nginx
+USER 1000
+EXPOSE 8052
+CMD /usr/bin/launch_awx_task.sh