From e2493de2b805d575ea6ca6461b87e13ffb171d78 Mon Sep 17 00:00:00 2001
From: Andrea Dell'Amico <andrea.dellamico@isti.cnr.it>
Date: Tue, 11 Aug 2020 16:16:52 +0200
Subject: [PATCH] Import the old role.

---
 README.md                      |  42 +--
 defaults/main.yml              |  16 +-
 handlers/main.yml              |   2 -
 meta/main.yml                  |  66 ++--
 tasks/main.yml                 |  68 ++++-
 templates/catalog.xml.j2       |  49 +++
 templates/log4j2.xml.j2        | 219 ++++++++++++++
 templates/threddsConfig.xml.j2 | 274 +++++++++++++++++
 templates/web.xml.j2           | 532 +++++++++++++++++++++++++++++++++
 templates/wmsConfig.xml.j2     | 105 +++++++
 vars/main.yml                  |   9 +-
 11 files changed, 1312 insertions(+), 70 deletions(-)
 delete mode 100644 handlers/main.yml
 create mode 100644 templates/catalog.xml.j2
 create mode 100755 templates/log4j2.xml.j2
 create mode 100644 templates/threddsConfig.xml.j2
 create mode 100644 templates/web.xml.j2
 create mode 100644 templates/wmsConfig.xml.j2

diff --git a/README.md b/README.md
index 3637db8..bde50a3 100644
--- a/README.md
+++ b/README.md
@@ -1,31 +1,37 @@
 Role Name
 =========
 
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+A role that installs the THREDDS Data Server, <https://www.unidata.ucar.edu/software/tds/current/>
 
 Role Variables
 --------------
 
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+The most important variables are listed below:
+
+``` yaml
+thredds_install: True
+thredds_upgrade: False
+thredds_version: 4.6.15
+thredds_data_content_dir: /data/thredds
+thredds_server_name: 'Thredds instance'
+thredds_logo_url: '/thredds/threddsIcon.gif'
+thredds_logo_alt_text: '{{ thredds_server_name }}'
+thredds_organization: 'ORG'
+thredds_email: ''
+thredds_host_institution_name: 'ORG'
+thredds_host_institution_web: ''
+thredds_force_ssl_for_user_data: False
+thredds_abstract: 'Scientific Data'
+thredds_contact_name: 'Support'
+thredds_google_analytics_key: ''
+```
 
 Dependencies
 ------------
 
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
+* openjdk
+* tomcat
+* tomcat-multiple-instances
 
 License
 -------
@@ -35,4 +41,4 @@ EUPL-1.2
 Author Information
 ------------------
 
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+Andrea Dell'Amico, <andrea.dellamico@isti.cnr.it>
diff --git a/defaults/main.yml b/defaults/main.yml
index 95d3c70..27b4abc 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,2 +1,16 @@
 ---
-# defaults file for ansible-role-template
\ No newline at end of file
+thredds_install: True
+thredds_upgrade: False
+thredds_version: 4.6.15
+thredds_data_content_dir: /data/thredds
+thredds_server_name: 'Thredds instance'
+thredds_logo_url: '/thredds/threddsIcon.gif'
+thredds_logo_alt_text: '{{ thredds_server_name }}'
+thredds_organization: 'ORG'
+thredds_email: ''
+thredds_host_institution_name: 'ORG'
+thredds_host_institution_web: ''
+thredds_force_ssl_for_user_data: False
+thredds_abstract: 'Scientific Data'
+thredds_contact_name: 'Support'
+thredds_google_analytics_key: ''
diff --git a/handlers/main.yml b/handlers/main.yml
deleted file mode 100644
index 27474e0..0000000
--- a/handlers/main.yml
+++ /dev/null
@@ -1,2 +0,0 @@
----
-# handlers file for ansible-role-template
\ No newline at end of file
diff --git a/meta/main.yml b/meta/main.yml
index 1126a5e..b0a1493 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -1,61 +1,33 @@
 galaxy_info:
-  author: your name
-  description: your description
+  author: Andrea Dell'Amico
+  description: Systems Architect
   company: ISTI-CNR
 
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
   issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning
 
-  # Some suggested licenses:
-  # - BSD (default)
-  # - MIT
-  # - GPLv2
-  # - GPLv3
-  # - Apache
-  # - CC-BY
-  license: EUPL-1.2
+  license: EUPL 1.2+
 
   min_ansible_version: 2.8
 
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  # Optionally specify the branch Galaxy will use when accessing the GitHub
-  # repo for this role. During role install, if no tags are available,
-  # Galaxy will use this branch. During import Galaxy will access files on
-  # this branch. If Travis integration is configured, only notifications for this
-  # branch will be accepted. Otherwise, in all cases, the repo's default branch
-  # (usually master) will be used.
-  #github_branch:
-
-  #
-  # Provide a list of supported platforms, and for each platform a list of versions.
-  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
   # To view available platforms and versions (or releases), visit:
   # https://galaxy.ansible.com/api/v1/platforms/
   #
-  # platforms:
-  # - name: Fedora
-  #   versions:
-  #   - all
-  #   - 25
-  # - name: SomePlatform
-  #   versions:
-  #   - all
-  #   - 1.0
-  #   - 7
-  #   - 99.99
+  platforms:
+    - name: Ubuntu
+      versions:
+        - bionic
+    - name: EL
+      versions:
+        - 7
+        - 8
 
-  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
+  galaxy_tags:
+    - thredds
+    - datasets
 
-dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.
+dependencies:
+  - src: git+https://gitea-s2i2s.isti.cnr.it/ISTI-ansible-roles/ansible-role-tomcat-multiple-instances.git
+    version: master
+    name: tomcat-multiple-instances
+    state: latest
 
diff --git a/tasks/main.yml b/tasks/main.yml
index 53c6cae..5c24f43 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,2 +1,68 @@
 ---
-# tasks file for ansible-role-template
\ No newline at end of file
+- block:
+    - name: Remove the Thredds webapp directory
+      file: path={{ item.instance_path }}/webapps/{{ thredds_app_name | lower }} state=absent
+      with_items: '{{ tomcat_m_instances }}'
+      notify: tomcat instances restart
+
+  when: not thredds_install or thredds_upgrade
+  tags: [ 'thredds', 'tomcat' ]
+
+- block:
+    - name: Create the Thredds webapp directory
+      file: path={{ item.instance_path }}/webapps/{{ thredds_app_name | lower }} state=directory owner={{ item.user }} group={{ item.user }}
+      with_items: '{{ tomcat_m_instances }}'
+
+    - name: Create the Thredds data directory
+      file: path={{ thredds_data_content_dir }} state=directory owner={{ item.user }} group={{ item.user }}
+      with_items: '{{ tomcat_m_instances }}'
+
+    - name: Check if the configuration files were already initialized with our versions
+      stat: path={{ thredds_data_content_dir }}/thredds/.conf_initialized
+      register: thredds_skip_conf
+      tags: [ 'thredds', 'tomcat', 'thredds_conf' ]
+
+    - name: Install the Thredds data configuration files -only at initialization-
+      template: src={{ item[1] }}.j2 dest={{ thredds_data_content_dir }}/thredds/{{ item[1] }} owner={{ item.0.user }} group={{ item.0.user }} mode=644
+      with_nested: 
+        - '{{ tomcat_m_instances }}'      
+        - ['catalog.xml', 'wmsConfig.xml' ]        
+      notify: tomcat instances restart
+      when: not thredds_skip_conf.stat.exists
+      tags: [ 'thredds', 'tomcat', 'thredds_conf' ]
+
+    - name: Install-update the Thredds data configuration files
+      template: src={{ item[1] }}.j2 dest={{ thredds_data_content_dir }}/thredds/{{ item[1] }} owner={{ item.0.user }} group={{ item.0.user }} mode=644
+      with_nested: 
+        - '{{ tomcat_m_instances }}'      
+        - [ 'threddsConfig.xml']        
+      notify: tomcat instances restart      
+      tags: [ 'thredds', 'tomcat', 'thredds_conf' ]
+
+    - name: Create the file that states that the thredds instance has been configured
+      copy: content="initialized by ansible" dest={{ thredds_data_content_dir }}/thredds/.conf_initialized mode=0400
+      register: thredds_skip_conf
+      tags: [ 'thredds', 'tomcat', 'thredds_conf' ]
+
+    - name: Get the thredds war file
+      maven_artifact: artifact_id={{ thredds_name }} version={{ thredds_version | default(omit) }} group_id={{ thredds_group_id }} extension={{ thredds_extension | default('war') }} repository_url={{ thredds_repository_url }} dest={{ thredds_download_directory }}/{{ thredds_file }}
+
+    - name: Unarchive the thredds war
+      unarchive: copy=no src={{ thredds_download_directory }}/{{ thredds_file }} dest={{ item.instance_path }}/webapps/{{ thredds_app_name | lower }} creates={{ item.instance_path }}/webapps/{{ thredds_app_name | lower }}/WEB-INF/lib owner={{ item.user }} group={{ item.user }}
+      with_items: '{{ tomcat_m_instances }}'
+      notify: tomcat instances restart
+
+    - name: Install the Thredds webapp configuration files
+      template: src=web.xml.j2 dest={{ item.instance_path }}/webapps/{{ thredds_app_name | lower }}/WEB-INF/web.xml owner={{ item.user }} group={{ item.user }} mode=644
+      with_items: '{{ tomcat_m_instances }}'      
+      notify: tomcat instances restart
+      tags: [ 'thredds', 'tomcat', 'thredds_conf', 'thredds_webxml' ]
+
+    - name: Install the Thredds log4j configuration file
+      template: src=log4j2.xml.j2 dest={{ item.instance_path }}/webapps/{{ thredds_app_name | lower }}/WEB-INF/classes/log4j2.xml owner=root group=root mode=0444
+      with_items: '{{ tomcat_m_instances }}'      
+      tags: [ 'thredds', 'tomcat', 'thredds_conf', 'thredds_log4j' ]
+
+  when: thredds_install 
+  tags: [ 'thredds', 'tomcat' ]
+
diff --git a/templates/catalog.xml.j2 b/templates/catalog.xml.j2
new file mode 100644
index 0000000..9f21906
--- /dev/null
+++ b/templates/catalog.xml.j2
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<catalog name="THREDDS Server -gCube Development Infrastructure"
+         xmlns="http://www.unidata.ucar.edu/namespaces/thredds/InvCatalog/v1.0"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://www.unidata.ucar.edu/namespaces/thredds/InvCatalog/v1.0
+           http://www.unidata.ucar.edu/schemas/thredds/InvCatalog.1.0.6.xsd">
+
+  <service name="all" base="" serviceType="compound">
+    <service base="/thredds/dodsC/" name="odap" serviceType="OpenDAP"/>
+    <service base="/thredds/dap4/" name="dap4" serviceType="DAP4"/>
+    <service base="/thredds/fileServer/" name="http" serviceType="HTTPServer"/>
+    <service base="/thredds/ncml/" name="ncml" serviceType="NCML"/>     <!-- Add by JULIEN -->
+    <service base="/thredds/iso/" name="iso" serviceType="ISO"/>     <!-- Add by JULIEN -->
+    <service base="/thredds/wcs/" name="wcs" serviceType="WCS"/>
+    <service base="/thredds/wms/" name="wms" serviceType="WMS"/>
+    <service base="/thredds/sos/" name="sos" serviceType="SOS"/>     <!-- Add by JULIEN / IF POSSIBLE-->
+    <service base="/thredds/ncss/" name="ncss" serviceType="NetcdfSubset"/>
+  </service>
+
+  <service name="dap" base="" serviceType="compound">
+    <service name="odap" serviceType="OpenDAP" base="/thredds/dodsC/" />
+    <service name="dap4" serviceType="DAP4" base="/thredds/dap4/" />
+  </service>
+
+ <datasetScan ID="Root-DatasetScan" location="{{ thredds_public_netcdf_dir }}" name="Thredds Root Catalog" path="public/netcdf">
+    <metadata inherited="true">
+        <serviceName>all</serviceName>
+    </metadata>
+
+    <filter>
+     <include wildcard="*.nc"/>
+     <include wildcard="*.tiff"/>
+     <include wildcard="*.geotiff"/>
+     <include wildcard="*.asc"/> 
+     <include wildcard="*.ncml"/>
+    </filter>
+
+    <sort>
+        <lexigraphicByName increasing="true"/>
+    </sort>
+  </datasetScan>
+
+
+<dataset ID="VRE_Catalogs" name="Catalogs of Virtual Research Environments VRE">  
+ <!-- Contains dedicated catalogs reference -->
+</dataset>
+
+</catalog>
diff --git a/templates/log4j2.xml.j2 b/templates/log4j2.xml.j2
new file mode 100755
index 0000000..aaddff1
--- /dev/null
+++ b/templates/log4j2.xml.j2
@@ -0,0 +1,219 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration monitorInterval="30">
+  <properties>
+    <property name="tds.content.root.path">../content</property>
+    <property name="tds.log.dir">{{ item.instance_path }}/logs/thredds</property>
+  </properties>
+
+  <appenders>
+
+    <File name="serverStartupAppender" fileName="${tds.log.dir}/serverStartup.log" append="false">
+      <PatternLayout pattern="%d{yyyy-MM-dd'T'HH:mm:ss.SSSZ} [%10r][%8X{ID}] %-5p %c: %m%n"/>
+    </File>
+
+    <File name="catalogInit" fileName="${tds.log.dir}/catalogInit.log" append="false">
+      <PatternLayout pattern="%m%n"/>
+    </File>
+
+    <File name="httpout" fileName="${tds.log.dir}/httpout.log" append="false">
+      <PatternLayout pattern="%d %c: %m%n"/>
+    </File>
+
+    <RollingFile name="fcScan" fileName="${tds.log.dir}/featureCollectionScan.log" filePattern="${tds.log.dir}/featureCollectionScan.%i.log">
+      <PatternLayout pattern="[%d{yyyy-MM-dd'T'HH:mm:ss.SSSZ}] %-5p %c: %m%n"/>
+      <Policies>
+        <SizeBasedTriggeringPolicy size="1 MB"/>
+      </Policies>
+      <DefaultRolloverStrategy max="10"/>
+    </RollingFile>
+
+    <RollingFile name="fmrc" fileName="${tds.log.dir}/fmrc.log" filePattern="${tds.log.dir}/fmrc.%i.log">
+      <PatternLayout pattern="[%d{yyyy-MM-dd'T'HH:mm:ss.SSSZ}] %-5p %c: %m%n"/>
+      <Policies>
+        <SizeBasedTriggeringPolicy size="1 MB"/>
+      </Policies>
+      <DefaultRolloverStrategy max="10"/>
+    </RollingFile>
+
+    <!-- RollingFile name="fc" fileName="${tds.log.dir}/fc.$${map:collectionName}.log" filePattern="${tds.log.dir}/fc.$${map:collectionName}.%i.log">
+      <PatternLayout pattern="%d{yyyy-MM-dd'T'HH:mm:ss.SSS Z} %-5p - %m%n"/>
+      <Policies>
+        <SizeBasedTriggeringPolicy size="1 MB"/>
+      </Policies>
+      <DefaultRolloverStrategy max="10"/>
+    </RollingFile -->
+
+    <RollingFile name="threddsServlet" fileName="${tds.log.dir}/threddsServlet.log" filePattern="${tds.log.dir}/threddsServlet.%d{yyyy-MM-dd-HH}.log">
+      <PatternLayout pattern="%d{yyyy-MM-dd'T'HH:mm:ss.SSS Z} [%10r][%8X{ID}] %-5p - %c - %m%n"/>
+      <Policies>
+        <TimeBasedTriggeringPolicy/>
+        <SizeBasedTriggeringPolicy size="100 MB"/>
+      </Policies>
+      <DefaultRolloverStrategy max="10"/>
+    </RollingFile>
+
+    <RollingFile name="cacheLog" fileName="${tds.log.dir}/cache.log" filePattern="${tds.log.dir}/cache.%i.log">
+      <PatternLayout pattern="[%d{yyyy-MM-dd'T'HH:mm:ss.SSSZ}] %m%n"/>
+      <Policies>
+        <SizeBasedTriggeringPolicy size="1 MB"/>
+      </Policies>
+      <DefaultRolloverStrategy max="3"/>
+    </RollingFile>
+
+    <Console name="console" target="SYSTEM_OUT">
+      <PatternLayout pattern="%d{yyyy-MM-dd'T'HH:mm:ss.SSSZ} [%10r][%8X{ID}] %-5p %c: %m%n"/>
+    </Console>
+
+  </appenders>
+
+  <loggers>
+
+    <logger name="serverStartup" level="info" additivity="false">
+      <appender-ref ref="serverStartupAppender"/>
+    </logger>
+
+    <logger name="thredds.servlet.DataRootHandler.catalogInit" level="debug" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="thredds.catalog.parser" level="info" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="thredds.featurecollection.FeatureCollectionConfig" level="info" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="ucar.nc2.thredds.MetadataExtractorAcdd" level="info" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="thredds.catalog.InvDatasetFeatureCollection.catalogInit" level="info" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="thredds.catalog.InvDatasetFeatureCollection.catalogInit" level="info" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="thredds.server.config.TdsContext.catalogInit" level="info" additivity="false">
+      <appender-ref ref="catalogInit"/>
+    </logger>
+
+    <logger name="cacheLogger" level="info" additivity="false">
+      <appender-ref ref="cacheLog"/>
+    </logger>
+
+    <logger name="thredds.filesystem.CacheManager" level="info" additivity="false">
+      <appender-ref ref="cacheLog"/>
+    </logger>
+
+    <!-- fmrc -->
+    <logger name="ucar.nc2.ft.fmrc" level="info" additivity="false">
+      <appender-ref ref="fmrc"/>
+    </logger>
+
+    <logger name="thredds.catalog.InvDatasetFcFmrc" level="info" additivity="false">
+      <appender-ref ref="fmrc"/>
+    </logger>
+
+    <logger name="thredds.servlet.DataRootHandler.fcScan" level="info" additivity="false">
+      <appender-ref ref="fmrc"/>
+    </logger>
+
+    <logger name="thredds.inventory.CollectionManagerAbstract" level="info" additivity="false">
+      <appender-ref ref="fmrc"/>
+    </logger>
+
+    <logger name="thredds.inventory.bdb.MetadataManager" level="warn" additivity="false">
+      <appender-ref ref="fmrc"/>
+    </logger>
+
+    <!-- featureCollection -->
+    <logger name="featureCollectionScan" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="thredds.inventory.MFileCollectionManager" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="thredds.inventory.CollectionUpdater" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="thredds.server.admin.CollectionController" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="ucar.nc2.grib" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="ucar.nc2.grib.grib1.builder.Grib1CollectionBuilder" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="ucar.nc2.grib.grib2.builder.Grib2CollectionBuilder" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="thredds.catalog.InvDatasetFeatureCollection" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="thredds.catalog.InvDatasetFcGrib" level="info" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <logger name="org.quartz" level="warn" additivity="false">
+      <appender-ref ref="fcScan"/>
+    </logger>
+
+    <!-- WMS stuff has routine higher level of messages -->
+    <logger name="uk.ac.rdg.resc.ncwms" level="warn" additivity="false">
+      <appender-ref ref="threddsServlet"/>
+    </logger>
+
+    <logger name="thredds.server.wms.responses" level="warn" additivity="false">
+      <appender-ref ref="threddsServlet"/>
+    </logger>
+
+    <logger name="thredds.server.metadata" level="warn" additivity="false">
+      <appender-ref ref="threddsServlet"/>
+    </logger>
+
+    <logger name="org.springframework.beans.factory" level="info" additivity="false">
+      <appender-ref ref="serverStartupAppender"/>
+    </logger>
+
+    <logger name="org.springframework.http" level="info" additivity="false">
+      <appender-ref ref="threddsServlet"/>
+    </logger>
+
+    <logger name="org.springframework.web" level="info" additivity="false">
+      <appender-ref ref="serverStartupAppender"/>
+    </logger>
+
+    <logger name="org.springframework" level="info" additivity="false">
+      <appender-ref ref="serverStartupAppender"/>
+    </logger>
+
+    <!-- =========================================== -->
+
+    <logger name="thredds.catalog.XMLEntityResolver" level="info" additivity="false">
+       <appender-ref ref="httpout"/>
+     </logger>
+
+    <logger name="org.apache.http.impl.conn" level="info" additivity="false">
+       <appender-ref ref="httpout"/>
+     </logger>
+
+    <!-- All normal logging messages go to threddsServlet.log -->
+    <root level="info" additivity="false">
+      <appender-ref ref="threddsServlet"/>
+    </root>
+
+  </loggers>
+
+</configuration>
diff --git a/templates/threddsConfig.xml.j2 b/templates/threddsConfig.xml.j2
new file mode 100644
index 0000000..79e1474
--- /dev/null
+++ b/templates/threddsConfig.xml.j2
@@ -0,0 +1,274 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<threddsConfig>
+
+  <!-- all options are commented out in standard install - meaning use default values -->
+  <!-- see http://www.unidata.ucar.edu/software/thredds/current/tds/reference/ThreddsConfigXMLFile.html -->
+  <serverInformation>
+    <name>{{ thredds_server_name }}</name>
+    <logoUrl>{{ thredds_logo_url }}</logoUrl>
+    <logoAltText>{{ thredds_logo_alt_text }}</logoAltText>
+
+    <abstract>{{ thredds_abstract }}</abstract>
+    <keywords>meteorology, atmosphere, climate, ocean, earth science</keywords>
+    
+    <contact>
+      <name>{{ thredds_contact_name}}</name>
+      <organization>{{ thredds_organization }}</organization>
+      <email>{{ thredds_email }}</email>
+      <!--phone></phone-->
+    </contact>
+    <hostInstitution>
+      <name>{{ thredds_host_institution_name }}</name>
+      <webSite>{{ thredds_host_institution_web }}</webSite>      
+    </hostInstitution>
+  </serverInformation>
+
+  <!--
+  The <catalogRoot> element:
+  For catalogs you don't want visible from the /thredds/catalog.xml chain
+  of catalogs, you can use catalogRoot elements. Each catalog root config
+  catalog is crawled and used in configuring the TDS.
+
+  <catalogRoot>myExtraCatalog.xml</catalogRoot>
+  <catalogRoot>myOtherExtraCatalog.xml</catalogRoot>
+  -->
+
+  <!--
+   * Setup for generated HTML pages.
+   *
+   * NOTE: URLs may be absolute or relative, relative URLs must be relative
+   * to the webapp URL, i.e., http://server:port/thredds/.
+    -->
+  <htmlSetup>
+    <!--
+     * CSS documents used in generated HTML pages.
+     * The CSS document given in the "catalogCssUrl" element is used for all pages
+     * that are HTML catalog views. The CSS document given in the "standardCssUrl"
+     * element is used in all other generated HTML pages.
+     * -->
+    <standardCssUrl>tds.css</standardCssUrl>
+    <catalogCssUrl>tdsCat.css</catalogCssUrl>
+    <openDapCssUrl>tdsDap.css</openDapCssUrl>
+
+    <!--
+     * The Google Analytics Tracking code you would like to use for the
+     * webpages associated with THREDDS. This will not track WMS or DAP
+     * requests for data, only browsing the catalog.
+    -->
+    <googleTrackingCode>{{ thredds_google_analytics_key }}</googleTrackingCode>
+
+  </htmlSetup>
+  
+  <!-- 
+    The <TdsUpdateConfig> element controls if and how the TDS checks
+    for updates. The default is for the TDS to check for the current
+    stable and development release versions, and to log that information
+    in the TDS serverStartup.log file as INFO entries.
+
+  <TdsUpdateConfig>
+     <logVersionInfo>true</logVersionInfo>
+  </TdsUpdateConfig>
+  -->
+   
+  <!--
+   The <CORS> element controls Cross-Origin Resource Sharing (CORS).
+   CORS is a way to allow a website (such as THREDDS) to open up access
+   to resources to web pages and applications running on a different domain.
+   One example would be allowing a web-application to use fonts from
+   a separate host. For TDS, this can allow a javascript app running on a
+   different site to access data on a THREDDS server.
+   For more information see: https://en.wikipedia.org/wiki/Cross-origin_resource_sharing
+   The elements below represent defaults. Only the <enabled> tag is required
+   to enable CORS. The default allowed origin is '*', which allows sharing
+   to any domain.
+  <CORS>
+    <enabled>false</enabled>
+    <maxAge>1728000</maxAge>
+    <allowedMethods>GET</allowedMethods>
+    <allowedHeaders>Authorization</allowedHeaders>
+    <allowedOrigin>*</allowedOrigin>
+  </CORS>
+  -->
+
+  <!--
+   The <CatalogServices> element:
+   - Services on local TDS served catalogs are always on.
+   - Services on remote catalogs are set with the allowRemote element
+   below. They are off by default (recommended).
+   -->
+  <CatalogServices>
+    <allowRemote>false</allowRemote>
+  </CatalogServices>
+
+  <!--
+  Configuring the CDM (netcdf-java library)
+  see http://www.unidata.ucar.edu/software/netcdf-java/reference/RuntimeLoading.html
+
+  <nj22Config>
+    <ioServiceProvider class="edu.univ.ny.stuff.FooFiles"/>
+    <coordSysBuilder convention="foo" class="test.Foo"/>
+    <coordTransBuilder name="atmos_ln_sigma_coordinates" type="vertical" class="my.stuff.atmosSigmaLog"/>
+    <typedDatasetFactory datatype="Point" class="gov.noaa.obscure.file.Flabulate"/>
+  </nj22Config>
+  -->
+
+  <!--
+  CDM uses the DiskCache directory to store temporary files, like uncompressed files.
+  <DiskCache>
+    <alwaysUse>false</alwaysUse>
+    <scour>1 hour</scour>
+    <maxSize>1 Gb</maxSize>
+  </DiskCache>
+  -->
+
+  <!--
+  Caching open NetcdfFile objects.
+  default is to allow 50 - 100 open files, cleanup every 11 minutes
+  <NetcdfFileCache>
+    <minFiles>50</minFiles>
+    <maxFiles>100</maxFiles>
+    <scour>11 min</scour>
+  </NetcdfFileCache>
+  -->
+
+  <!--
+  The <HTTPFileCache> element:
+  allow 10 - 20 open datasets, cleanup every 17 minutes
+  used by HTTP Range requests.
+  <HTTPFileCache>
+    <minFiles>10</minFiles>
+    <maxFiles>20</maxFiles>
+    <scour>17 min</scour>
+  </HTTPFileCache>
+  -->
+
+  <!--
+  Writing GRIB indexes.
+  <GribIndexing>
+    <setExtendIndex>false</setExtendIndex>
+    <alwaysUseCache>false</alwaysUseCache>
+  </GribIndexing>
+  -->
+
+  <!--
+  Persist joinNew aggregations to named directory. scour every 24 hours, delete stuff older than 90 days
+  <AggregationCache>
+    <scour>24 hours</scour>
+    <maxAge>90 days</maxAge>
+    <cachePathPolicy>NestedDirectory</cachePathPolicy>
+  </AggregationCache>
+  -->
+
+  <!--
+  How to choose the template dataset for an aggregation. latest, random, or penultimate
+  <Aggregation>
+    <typicalDataset>penultimate</typicalDataset>
+  </Aggregation>
+  -->
+
+  <!--
+  The Netcdf Subset Service is off by default.
+  <NetcdfSubsetService>
+    <allow>false</allow>
+    <scour>10 min</scour>
+    <maxAge>-1 min</maxAge>
+  </NetcdfSubsetService>
+  -->
+
+  <!--
+  <Opendap>
+    <ascLimit>50</ascLimit>
+    <binLimit>500</binLimit>
+    <serverVersion>opendap/3.7</serverVersion>
+  </Opendap>
+    -->
+  
+  
+  <!--The WCS Service is off by default.
+  Also, off by default (and encouraged) is operating on a remote dataset. -->
+  <WCS>
+    <allow>true</allow>
+    <allowRemote>false</allowRemote>
+    <scour>15 min</scour>
+    <maxAge>30 min</maxAge>
+  </WCS>
+  
+
+  
+  <WMS>
+    <allow>true</allow>
+    <allowRemote>false</allowRemote>
+    <maxImageWidth>2048</maxImageWidth>
+    <maxImageHeight>2048</maxImageHeight>
+    {% if thredds_palettes_customisation %}
+    <paletteLocationDir>customPalettes</paletteLocationDir>
+    {% endif %}
+  </WMS>
+  
+
+  
+  <NCISO>
+    <ncmlAllow>true</ncmlAllow>
+    <uddcAllow>true</uddcAllow>
+    <isoAllow>true</isoAllow>
+  </NCISO>
+  
+
+  <!-- CatalogGen service is off by default.
+  <CatalogGen>
+    <allow>false</allow>
+  </CatalogGen>
+   -->
+
+  <!-- DLwriter service is off by default.
+       As is support for operating on remote catalogs.
+  <DLwriter>
+    <allow>false</allow>
+    <allowRemote>false</allowRemote>
+  </DLwriter>
+   -->
+
+  <!-- DqcService is off by default.
+  <DqcService>
+    <allow>false</allow>
+  </DqcService>
+   -->
+
+  <!--
+   Link to a Viewer application on the HTML page:
+   <Viewer>my.package.MyViewer</Viewer>
+   -->
+
+   <!--
+   Add a DataSource - essentially an IOSP with access to Servlet request parameters
+   <datasetSource>my.package.DatsetSourceImpl</datasetSource>
+   -->
+
+  <!--
+   set FeatureCollection logging
+  <FeatureCollection>
+     <RollingFileAppender>
+       <MaxFileSize>1 MB</MaxFileSize>
+       <MaxBackups>5</MaxBackups>
+       <Level>INFO</Level>
+     </RollingFileAppender>
+  </FeatureCollection>
+  -->
+
+  <!--
+    Configure how the NetCDF-4 C library is discovered and used.
+    libraryPath: The directory in which the native library is installed.
+    libraryName: The name of the native library. This will be used to locate the proper .DLL, .SO, or .DYLIB file
+      within the libraryPath directory.
+    useForReading: By default, the native library is only used for writing NetCDF-4 files; a pure-Java layer is
+      responsible for reading them. However, if this property is set to true, then it will be used for reading
+      NetCDF-4 (and HDF5) files as well.
+  -->
+  <!--
+  <Netcdf4Clibrary>
+    <libraryPath>/usr/local/lib</libraryPath>
+    <libraryName>netcdf</libraryName>
+    <useForReading>false</useForReading>
+  </Netcdf4Clibrary>
+  -->
+</threddsConfig>
diff --git a/templates/web.xml.j2 b/templates/web.xml.j2
new file mode 100644
index 0000000..b1f386c
--- /dev/null
+++ b/templates/web.xml.j2
@@ -0,0 +1,532 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<web-app xmlns="http://java.sun.com/xml/ns/javaee"
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+      version="3.0">
+  <display-name>THREDDS Data Server</display-name>
+  <description>THREDDS Data Server</description>
+
+  <!-- Provide the context path at init time (otherwise, not available till a request is made). -->
+  <!-- Servlet 2.5 spec provides ServletContext.getContextPath(). But we aren't requiring Servlet 2.5 yet. -->
+  <context-param>
+    <param-name>ContextPath</param-name>
+    <param-value>thredds</param-value>
+  </context-param>
+
+  <!-- Turn on some more targeted debugging. -->
+  <filter>
+    <filter-name>RequestBracketingLogMessageFilter</filter-name>
+    <filter-class>thredds.server.RequestBracketingLogMessageFilter</filter-class>
+  </filter>
+
+  <filter>
+    <filter-name>RequestPathFilter</filter-name>
+    <filter-class>thredds.servlet.filter.RequestPathFilter</filter-class>
+  </filter>
+
+  <filter>
+    <filter-name>RequestQueryFilter</filter-name>
+    <filter-class>thredds.servlet.filter.RequestQueryFilter</filter-class>
+  </filter>
+
+  <filter>
+    <filter-name>RequestQueryFilterAllowAngleBrackets</filter-name>
+    <filter-class>thredds.servlet.filter.RequestQueryFilter</filter-class>
+    <init-param>
+      <param-name>allowAngleBrackets</param-name>
+      <param-value>true</param-value>
+    </init-param>
+  </filter>
+
+  <!-- filter>
+    <filter-name>CatalogServiceFilter</filter-name>
+    <filter-class>thredds.servlet.filter.CatalogServiceFilter</filter-class>
+  </filter -->
+
+  <filter>
+    <filter-name>CookieFilter</filter-name>
+    <filter-class>thredds.servlet.filter.CookieFilter</filter-class>
+  </filter>
+
+  <filter>
+    <filter-name>RequestCORSFilter</filter-name>
+    <!--filter-class>thredds.servlet.filter.RequestCORSFilter</filter-class-->
+    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
+    <init-param>
+	    <param-name>targetBeanName</param-name>
+	    <param-value>corsFilter</param-value>
+    </init-param>
+  </filter>
+
+  <filter-mapping>
+    <filter-name>RequestBracketingLogMessageFilter</filter-name>
+    <!-- servlet-name>metadata</servlet-name-->
+    <url-pattern>/*</url-pattern>
+  </filter-mapping>
+
+  <!--
+  Filter:
+   - the request URL path
+   - on all requests.
+  -->
+  <filter-mapping>
+    <filter-name>RequestPathFilter</filter-name>
+    <url-pattern>/*</url-pattern>
+  </filter-mapping>
+
+  <!--
+  Filter:
+   - the request URL query string
+   - on all requests except OPeNDAP requests.
+  -->
+  <filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>root</servlet-name>
+  </filter-mapping>
+   
+  <!-- filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>catalogService</servlet-name>
+  </filter-mapping -->
+    
+  <!--filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>FileServer</servlet-name>
+  </filter-mapping-->
+  <!-- filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>radarServer</servlet-name>
+  </filter-mapping-->
+  <filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>RestrictedDataset</servlet-name>
+  </filter-mapping>
+  <filter-mapping>
+    <filter-name>RequestCORSFilter</filter-name>
+    <url-pattern>/*</url-pattern>
+  </filter-mapping>
+  <!-- filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>wcs</servlet-name>
+  </filter-mapping -->
+  <filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>wms</servlet-name>
+  </filter-mapping>
+  
+  <!-- filter-mapping>
+    <filter-name>RequestQueryFilter</filter-name>
+    <servlet-name>DLwriter</servlet-name>
+  </filter-mapping -->
+
+  <!--
+  Filter:
+   - the request URL query string
+   - on all OPeNDAP and DAP4 requests.
+  -->
+  <filter-mapping>
+    <filter-name>RequestQueryFilterAllowAngleBrackets</filter-name>
+    <servlet-name>Opendap</servlet-name>
+  </filter-mapping>
+
+  <!--
+  Filter all requests that contain parameters used by CatalogServices
+  -->
+  <!-- filter-mapping>
+    <filter-name>CatalogServiceFilter</filter-name>
+    <servlet-name>catalogService</servlet-name>
+  </filter-mapping -->
+  
+  <!--
+  Filter opendap and dap4 cookies
+  -->
+  <filter-mapping>
+    <filter-name>CookieFilter</filter-name>
+    <servlet-name>Opendap</servlet-name>
+  </filter-mapping>
+
+  <!--
+     Location of the Log4J config file (relative to the webapp root), for initialization.
+
+  <context-param>
+    <param-name>log4jConfigLocation</param-name>
+    <param-value>/WEB-INF/log4j.xml</param-value>
+  </context-param>
+   -->
+  <!--
+     Don't expose the webapp root directory as the "webapp.root" system property.
+     Multiple TDS will clash over this unless we change the name of the system property by defining it with a context-param named "webAppRootKey".
+     It isn't needed because we determine the logging directory ourselves.
+
+  <context-param>
+    <param-name>log4jExposeWebAppRoot</param-name>
+    <param-value>false</param-value>
+  </context-param>
+   -->
+
+  <!--
+     Spring listener to bootstrap Spring WebApplicationContext. Used to
+     handle Spring bean configuration outside of SpringMVC configuration.
+     Paths, by default, are relative to the application root.
+  -->
+  <context-param>
+    <param-name>contextConfigLocation</param-name>
+    <param-value>/WEB-INF/applicationContext-tdsConfig.xml</param-value>
+  </context-param>
+
+  <listener>
+    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
+  </listener>
+
+  <listener>
+    <listener-class>thredds.server.opendap.OpendapSessionAttributeListener</listener-class>
+  </listener>
+
+
+
+  <!-- Some possible ways to deal with error handling. -->
+  <!--
+  <error-page>
+    <exception-type>java.lang.NullPointerException</exception-type>
+    <location>/null.html</location>
+  </error-page>
+  -->
+  <!-- The following goes into affect when 'res.sendError(100)' is called. -->
+  <!--
+  <error-page>
+    <error-code>100</error-code>
+    <location>/myPage.html</location>
+  </error-page>
+  -->
+
+  <!-- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -->
+
+  <!-- root servlet -->
+  <servlet>
+    <servlet-name>root</servlet-name>
+    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
+    <init-param>
+      <param-name>contextConfigLocation</param-name>
+      <param-value>/WEB-INF/servlet-context.xml</param-value>
+    </init-param>
+    <load-on-startup>1</load-on-startup>
+  </servlet>
+
+  <!-- Setup for catalog services. (Catalog subsetting, validation, and translation into HTML.)
+  <servlet>
+    <servlet-name>catalogService</servlet-name>
+    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
+    <load-on-startup>1</load-on-startup>
+  </servlet -->
+
+  <!-- data services -->
+  <!-- NON-SPRING  controllers ands servlets -->
+  <!-- NetCDF/OPeNDAP server -->
+  <servlet>
+    <display-name>OPeNDAP Server</display-name>
+    <servlet-name>Opendap</servlet-name>
+    <servlet-class>thredds.server.opendap.OpendapServlet</servlet-class>
+    <load-on-startup>2</load-on-startup>
+  </servlet>
+
+  <!-- HTTP File server -->
+  <!-- servlet>
+    <servlet-name>FileServer</servlet-name>
+    <servlet-class>thredds.servlet.FileServerServlet</servlet-class>
+    <load-on-startup>3</load-on-startup>
+  </servlet -->
+
+  <!-- Radar Server -->
+  <!-- servlet>
+    <servlet-name>radarServer</servlet-name>
+    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
+    <load-on-startup>1</load-on-startup>
+  </servlet -->
+
+  <!-- OGC Web Coverage server -->
+  <!-- servlet>
+    <servlet-name>wcs</servlet-name>
+    <servlet-class>thredds.server.wcs.WCSServlet</servlet-class>
+    <load-on-startup>1</load-on-startup>
+  </servlet -->
+
+  <servlet>
+    <servlet-name>wms</servlet-name>
+    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
+    <load-on-startup>4</load-on-startup>
+  </servlet>
+
+  <!-- Restricted Access (using container managed security, eg Tomcat, or CAMS) -->
+  <servlet>
+    <servlet-name>RestrictedDataset</servlet-name>
+    <servlet-class>thredds.servlet.restrict.RestrictedDatasetServlet</servlet-class>
+
+    <init-param>
+      <param-name>Authorizer</param-name>
+      <param-value>thredds.servlet.restrict.TomcatAuthorizer</param-value>
+    </init-param>
+
+    <init-param>
+      <param-name>useSSL</param-name>
+      <param-value>false</param-value>
+    </init-param>
+
+    <init-param>
+      <param-name>portSSL</param-name>
+      <param-value>8443</param-value>
+    </init-param>
+
+    <load-on-startup>2</load-on-startup>
+  </servlet>
+
+  <!-- Restricted Access (using CAS)
+  <servlet>
+    <servlet-name>RestrictedDataset</servlet-name>
+    <servlet-class>thredds.servlet.restrict.RestrictedDatasetServlet</servlet-class>
+
+    <init-param>
+      <param-name>Authorizer</param-name>
+      <param-value>thredds.servlet.restrict.CASAuthorizer</param-value>
+    </init-param>
+
+    <init-param>
+      <param-name>RoleDatabase</param-name>
+      <param-value>C:/Program Files (x86)/Apache Software Foundation/apache-tomcat-5.5.20/conf/tomcat-users.xml</param-value>
+    </init-param>
+
+    <init-param>
+      <param-name>edu.yale.its.tp.cas.client.filter.loginUrl</param-name>
+      <param-value>https://localhost:8443/cas/login</param-value>
+    </init-param>
+    <init-param>
+      <param-name>edu.yale.its.tp.cas.client.filter.validateUrl</param-name>
+      <param-value>https://localhost:8443/cas/proxyValidate</param-value>
+    </init-param>
+    <init-param>
+      <param-name>edu.yale.its.tp.cas.client.filter.serverName</param-name>
+      <param-value>localhost:8080</param-value>
+    </init-param>
+
+    <load-on-startup>2</load-on-startup>
+  </servlet>  -->
+
+
+  <!-- catalog services -->
+
+  <!-- Setup for the CatalogAnnotate servlet. (Attach extra info to a catalog.
+  <servlet>
+    <servlet-name>CatalogAnnotate</servlet-name>
+    <servlet-class>thredds.servlet.CatalogAnnotate</servlet-class>
+  </servlet> -->
+
+  <!-- Setup for the CatalogDL servlet. (Make Digital Library records from a catalog.  -->
+  <!-- servlet>
+    <servlet-name>DLwriter</servlet-name>
+    <servlet-class>thredds.servlet.DLwriterServlet</servlet-class>
+    <load-on-startup>10</load-on-startup>
+  </servlet -->
+
+  <!-- ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -->
+
+  <!-- default servlet -->
+  <servlet-mapping>
+    <servlet-name>root</servlet-name>
+    <url-pattern>/</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>
+    <servlet-name>root</servlet-name>
+    <url-pattern>*.css</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>
+    <servlet-name>root</servlet-name>
+    <url-pattern>*.gif</url-pattern>
+  </servlet-mapping>
+
+  <!-- servlet-mapping>
+    <servlet-name>catalogService</servlet-name>
+    <url-pattern>*.xml</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>
+    <servlet-name>catalogService</servlet-name>
+    <url-pattern>*.html</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>
+    <servlet-name>catalogService</servlet-name>
+    <url-pattern>/catalog/*</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>
+    <servlet-name>catalogService</servlet-name>
+    <url-pattern>/remoteCatalogService</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>  For backwards compatibility
+    <servlet-name>catalogService</servlet-name>
+    <url-pattern>/catalogServices</url-pattern>
+  </servlet-mapping>
+  <servlet-mapping>
+    <servlet-name>catalogService</servlet-name>
+    <url-pattern>/remoteCatalogValidation.html</url-pattern>
+  </servlet-mapping -->
+
+  <!-- data services -->
+  <!--servlet-mapping>
+    <servlet-name>radarServer</servlet-name>
+    <url-pattern>/radarServer/*</url-pattern>
+  </servlet-mapping -->
+
+  <servlet-mapping>
+    <servlet-name>Opendap</servlet-name>
+    <url-pattern>/dodsC/*</url-pattern>
+  </servlet-mapping>
+
+  <!-- servlet-mapping>
+    <servlet-name>FileServer</servlet-name>
+    <url-pattern>/fileServer/*</url-pattern>
+  </servlet-mapping -->
+
+  <servlet-mapping>
+    <servlet-name>RestrictedDataset</servlet-name>
+    <url-pattern>/restrictedAccess/*</url-pattern>
+  </servlet-mapping>
+
+  <!-- servlet-mapping>
+    <servlet-name>wcs</servlet-name>
+    <url-pattern>/wcs/*</url-pattern>
+  </servlet-mapping -->
+
+  <servlet-mapping>
+    <servlet-name>wms</servlet-name>
+    <url-pattern>/wms/*</url-pattern>
+  </servlet-mapping>
+
+  <!-- catalog services -->
+  <!--servlet-mapping>
+    <servlet-name>DLwriter</servlet-name>
+    <url-pattern>/DLwriter</url-pattern>
+  </servlet-mapping -->
+
+  <!-- servlet-mapping>
+     <servlet-name>View</servlet-name>
+     <url-pattern>/view/*</url-pattern>
+   </servlet-mapping-->
+
+  <welcome-file-list>
+    <welcome-file>/</welcome-file>
+  </welcome-file-list>
+
+  <error-page>
+    <error-code>404</error-code>
+    <location>/WEB-INF/jsp/errorpages/404.jsp</location>
+  </error-page>
+  <error-page>
+    <error-code>500</error-code>
+    <location>/WEB-INF/jsp/errorpages/500.jsp</location>
+  </error-page>
+
+  <!-- ++++++++++ Setup security restrictions ++++++++++ -->
+  <!-- Do not allow anything but GET  LOOK doesnt work
+  <security-constraint>
+      <display-name>Deny all HTTP methods except GET</display-name>
+      <web-resource-collection>
+          <url-pattern>/</url-pattern>
+          <http-method-omission>GET</http-method-omission>
+      </web-resource-collection>
+      <auth-constraint/>
+  </security-constraint -->
+
+  <!-- tdsConfig with HTTPS needed for /admin access  -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>sensitive read access</web-resource-name>
+      <url-pattern>/admin/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>tdsConfig</role-name>
+    </auth-constraint>
+{% if thredds_force_ssl_for_user_data %}
+     <user-data-constraint>
+      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+    </user-data-constraint>
+{% endif %}
+  </security-constraint>
+
+  <!-- tdsTrigger with HTTPS needed for /admin/trigger  -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>allow feature collection rescan to be triggered externally</web-resource-name>
+      <url-pattern>/admin/collection/trigger</url-pattern>
+      <url-pattern>/admin/trigger</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>tdsTrigger</role-name>
+    </auth-constraint>
+{% if thredds_force_ssl_for_user_data %}
+     <user-data-constraint>
+      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+    </user-data-constraint>
+{% endif %}
+  </security-constraint>
+
+  <!-- This allows "remote monitoring":
+    /thredds/admin/log gives access to logs.
+   -->
+
+  <!-- tdsMonitor with HTTPS needed for access to logs  -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>sensitive read access</web-resource-name>
+      <url-pattern>/admin/log/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>tdsMonitor</role-name>
+    </auth-constraint>
+{% if thredds_force_ssl_for_user_data %}
+     <user-data-constraint>
+      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+    </user-data-constraint>
+{% endif %}
+  </security-constraint>
+
+  <!-- default restricted access dataset uses DIGEST, but not HTTPS -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>restricted access datasets</web-resource-name>
+      <url-pattern>/restrictedAccess/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>restrictedDatasetUser</role-name>
+    </auth-constraint>
+{% if thredds_force_ssl_for_user_data %}
+     <user-data-constraint>
+      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+    </user-data-constraint>
+{% endif %}
+  </security-constraint>
+
+  <!-- can only have one login-config for entire context. -->
+  <login-config>
+    <auth-method>BASIC</auth-method>
+    <realm-name>THREDDS Data Server</realm-name>
+  </login-config>
+
+  <!-- Define security roles. -->
+  <security-role>
+    <description>The configuration role allows users to configure the THREDDS server.</description>
+    <role-name>tdsConfig</role-name>
+  </security-role>
+
+  <security-role>
+    <description>User who can download tds logs for monitoring purposes.</description>
+    <role-name>tdsMonitor</role-name>
+  </security-role>
+
+  <security-role>
+    <description>User is allowed to trigger featureCollection rereads</description>
+    <role-name>tdsTrigger</role-name>
+  </security-role>
+
+  <security-role>
+    <description>User who can access restricted datasets.</description>
+    <role-name>restrictedDatasetUser</role-name>
+  </security-role>
+
+</web-app>
diff --git a/templates/wmsConfig.xml.j2 b/templates/wmsConfig.xml.j2
new file mode 100644
index 0000000..5b94dfb
--- /dev/null
+++ b/templates/wmsConfig.xml.j2
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Detailed configuration of the WMS service.  This config file can be used to
+set default styling parameters for each dataset/variable, and to enable or disable
+the GetFeatureInfo operation.
+
+See http://www.resc.reading.ac.uk/trac/myocean-tools/wiki/WmsDetailedConfiguration
+for more information.
+-->
+<!DOCTYPE wmsConfig [
+
+<!ELEMENT wmsConfig (global, overrides?)>
+
+<!ELEMENT global (defaults, standardNames?)>
+
+<!ELEMENT defaults (allowFeatureInfo, defaultColorScaleRange, defaultPaletteName, defaultNumColorBands, logScaling)>
+
+<!ELEMENT standardNames (standardName*)>
+
+<!ELEMENT standardName (defaultColorScaleRange?, defaultPaletteName?, defaultNumColorBands?, logScaling?)>
+<!ATTLIST standardName name CDATA #REQUIRED>
+<!ATTLIST standardName units CDATA #REQUIRED>
+
+<!ELEMENT overrides (datasetPath*)>
+
+<!ELEMENT datasetPath (pathDefaults?, variables?)>
+<!ATTLIST datasetPath pathSpec CDATA #REQUIRED>
+
+<!ELEMENT pathDefaults (allowFeatureInfo?, defaultColorScaleRange?, defaultPaletteName?, defaultNumColorBands?, logScaling?)>
+
+<!ELEMENT variables (variable*)>
+
+<!ELEMENT variable (defaultColorScaleRange?, defaultPaletteName?, defaultNumColorBands?, logScaling?)>
+<!ATTLIST variable id CDATA #REQUIRED>
+
+<!ELEMENT allowFeatureInfo (#PCDATA)>
+<!ELEMENT defaultColorScaleRange (#PCDATA)>
+<!ELEMENT defaultPaletteName (#PCDATA)>
+<!ELEMENT defaultNumColorBands (#PCDATA)>
+<!ELEMENT logScaling (#PCDATA)>
+]>
+<wmsConfig>
+
+    <global>
+        <!-- These settings apply to all datasets unless overridden below -->
+
+        <defaults>
+            <!-- The global defaults. All elements are mandatory -->
+            <allowFeatureInfo>true</allowFeatureInfo>
+            <defaultColorScaleRange>-50 50</defaultColorScaleRange>
+            <defaultPaletteName>rainbow</defaultPaletteName>
+            <defaultNumColorBands>20</defaultNumColorBands>
+            <logScaling>false</logScaling>
+        </defaults>
+
+        <standardNames>
+            <!-- Use this section to set defaults per standard name -->
+            <!-- Units must come from the UDUNITS vocabulary -->
+            <standardName name="sea_water_potential_temperature" units="K">
+                <defaultColorScaleRange>268 308</defaultColorScaleRange>
+            </standardName>
+            <standardName name="sea_water_temperature" units="K">
+                <defaultColorScaleRange>268 308</defaultColorScaleRange>
+            </standardName>
+            <standardName name="mass_concentration_of_chlorophyll_in_sea_water" units="kg m-3">
+                <logScaling>true</logScaling>
+            </standardName>
+            <!-- TODO: how about allowing "*fraction" to map to 0:1? -->
+            <!-- TODO: how about allowing multiple standard names to map to the same settings,
+                 either through a glob expression or through a list? -->
+        </standardNames>
+    </global>
+
+    <overrides>
+        
+        <datasetPath pathSpec="testAll/*eta_211.nc">
+            <!-- Will apply to all paths that match the path spec above -->
+            <pathDefaults>
+                <!-- These will apply to all variables in this path unless overridden below -->
+                <allowFeatureInfo>false</allowFeatureInfo>
+                <defaultPaletteName>occam</defaultPaletteName>
+            </pathDefaults>
+
+            <variables>
+                <!-- Configure variables individually according to their internal ID.
+                     This is the most specific setting and will override any others -->
+                <variable id="Z_sfc">
+                    <defaultColorScaleRange>10 20</defaultColorScaleRange>
+                </variable>
+            </variables>
+        </datasetPath>
+
+        {% if thredds_palettes_customisation %}
+        <datasetPath pathSpec="public/netcdf/AquaMaps*/*.nc">
+            <pathDefaults>
+                <defaultColorScaleRange>0 1</defaultColorScaleRange>
+                <defaultPaletteName>aquamaps</defaultPaletteName>
+                <defaultNumColorBands>5</defaultNumColorBands>
+            </pathDefaults>
+        </datasetPath>
+        {% endif %}
+        
+    </overrides>
+
+</wmsConfig>
diff --git a/vars/main.yml b/vars/main.yml
index 3808477..fcc4ad1 100644
--- a/vars/main.yml
+++ b/vars/main.yml
@@ -1,2 +1,9 @@
 ---
-# vars file for ansible-role-template
\ No newline at end of file
+thredds_name: tds
+thredds_app_name: Thredds
+thredds_group_id: edu.ucar
+thredds_extension: war
+thredds_file: '{{ thredds_name }}-{{ thredds_version }}.{{ thredds_extension }}'
+thredds_repository_url: 'https://artifacts.unidata.ucar.edu/content/repositories/unidata-releases'
+thredds_download_directory: /srv
+thredds_public_netcdf_dir: '{{ thredds_data_content_dir }}/thredds/public/netcdf/'