Citrix Tech Zone Document History

The Citrix Automation Handbook 2601 - Part 6

Wed, 21 Jan 2026 09:14:10 +0000

The Citrix Automation Handbook - Part 6In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we discuss common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4 In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure In this part, we cover some final topics. Part 6 Let´s look at some final thoughts about using Automation and Infrastructure-as-Code in the Citrix Universe ConclusionDeploying Citrix infrastructure without Infrastructure-as-Code and automation is like navigating a storm without a compass. By embracing IaC, your organization gains predictability, speed, and governance—turning your infrastructure from a liability into a strategic asset. It’s not just about technology; it’s about enabling the business to deliver secure, high-performance apps and desktops at scale, with confidence. Instead of manual clicks and scripts scattered across teams, every component in your Citrix estate is defined, validated, and governed through code. This code is version-controlled, peer-reviewed, and automatically tested before deployment. With a single command, the entire Citrix stack spins up consistently—whether in the cloud, on-premises, or hybrid. But the evolution doesn’t stop at automation. For the last decade, automation was the bridge—the gap separating modern operations from legacy systems. Today, policy-driven infrastructure and AI-assisted intelligence are extending that bridge even further. Once your Citrix environment is expressed as code and governed by declarative policy, you unlock the next stage of operational maturity: infrastructure defined by intent, not manual effort Automated policy enforcement for security, cost, and performance baselines AI-driven recommendations, remediation, and continuous optimization Self-healing, self-scaling, and context-aware decision making across the Citrix control plane In other words: automation gets you consistency; policy + AI gets you intelligence. An organization that never crossed the automation bridge is already behind. But those who embrace IaC, policy-as-code, and AI-driven operations position themselves for compound acceleration, enabling their Citrix infrastructure to operate with predictability, resilience, and adaptability that legacy environments cannot match. This handbook is intended to: Provide an overview of the possibilities Citrix currently offers in Infrastructure-as-Code and Automation Show examples from real-world projects Provide insights and samples touching the three main IaC frameworks Explain CI/CD strategies for deploying and updating Citrix infrastructure Illustrate how policy-as-code and AI-driven intelligence become the natural next evolution once IaC is in place Important The Citrix Automation Handbook is a living document. We will add, edit, remove, and alter parts if necessary. AcknowledgementsThank you to all my colleagues who helped me create this handbook. They provided invaluable insights, experience, knowledge, and ideas: Avijit Gahtori Zhuolun Lin Sourav Samanta Sameer Sharma Special thanks for providing invaluable information and granting me access to their repositories to: Alan Goldman Konstantinos Kaltsas Rody Kossen Jason Samuel LinksAutomation Landing Zone Citrix GitHub repository for Terraform Citrix GitHub repository for Ansible Citrix GitHub repository for Packer Citrix NetScaler GitHub repository That completes Part 6 of the Citrix Automation Handbook. In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we discuss common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4 In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure In this part, we covered some final topics. DisclaimerMost important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Packer, Terraform, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. Using all the provided code snippets is at your own risk – please read the disclaimer below for further information. EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action.

The Citrix Automation Handbook 2601 - Part 5

Wed, 21 Jan 2026 09:13:42 +0000

The Citrix Automation Handbook - Part 5In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we discuss common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4 In this part, we focus on: Creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. Part 5 Creating a Citrix DaaS Deployment on AzureIn this example, we cover the usage of three distinct Infrastructure-as-Code (IaC) frameworks to deploy a Citrix DaaS-based deployment on Azure. Components and Frameworks usedLet´s have a short overview of all the components and frameworks used. Hashicorp TerraformTerraform is one of the most widely adopted Infrastructure-as-Code (IaC) platforms for provisioning and managing cloud and on-prem infrastructure at scale. Its declarative configuration model, strong ecosystem support, and provider-agnostic architecture make it a foundational tool for organizations seeking consistency, compliance, and operational maturity in their infrastructure lifecycle. Terraform relies on declarative code to define infrastructure in a predictable, reproducible manner. By representing compute, networking, storage, IAM, and platform services as version-controlled code artifacts, Terraform: Hashicorp PackerHashiCorp Packer is a foundational tool for organizations seeking to standardize, automate, and scale the creation of master images across multi-cloud and hybrid environments. As organizations increasingly adopt Infrastructure-as-Code (IaC) approaches, Packer provides a consistent, version-controlled, and repeatable way to build golden images aligned with modern DevOps and platform engineering practices. RedHat AnsibleMany organizations that have matured their Infrastructure-as-Code (IaC) practices increasingly require tooling that not only provisions infrastructure but also configures systems, applications, and operating environments in a controlled, repeatable manner. Ansible is a leading configuration management and automation platform that aligns naturally with IaC principles and complements provisioning tools such as Terraform, or cloud-native IaC engines. Its agentless architecture, declarative playbook model, and extensive ecosystem make it a strategic choice for enterprises seeking predictable, scalable, and compliant post-provision configuration. Ansible provides a declarative, idempotent configuration model that ensures systems converge to a desired state regardless of their current configuration. This makes it ideally suited for environments provisioned using IaC tools. Note You can find more information about the three frameworks and their importance in the first part of the Citrix Automation Handbook. Better togetherTerraform and Ansible serve complementary roles in modern Infrastructure-as-Code (IaC) architectures. Terraform excels at provisioning infrastructure resources—compute, networks, storage, identity, and cloud services—while Ansible specializes in configuring and managing the software, applications, and operating system state on those resources once they are created. When combined, they form a robust, scalable, and fully automated delivery pipeline that allows organizations to provision secure, consistent environments and configure them in a modular, policy-driven manner. Terraform is primarily designed for infrastructure lifecycle management, while Ansible is engineered for post-provisioning configuration. This clean separation ensures: Terraform builds and destroys infrastructure predictably Ansible configures servers, middleware, application stacks, and OS settings Changes to infrastructure and configuration are maintained in distinct codebases, improving clarity and reducing risk IT can version, audit, and test both layers independently This division of responsibilities aligns with architectural patterns used in platform engineering and regulated environments, where infrastructure and system configuration often have separate compliance requirements. All needed Automation components were installed on an Ubuntu-based VM cluster. If all IaC frameworks reside on the same machine/cluster, communication between them is less error-prone. Communication Flow between Packer, Terraform, Ansible, and the Target MachinesAll communication between Terraform, Packer, and Ansible on the IaC-VM and the target VMs on the XenServer cluster uses SSH and WinRM. WinRM (Windows Remote Management) is a Microsoft protocol that enables remote management of Windows systems by allowing access to remote computers to perform management tasks. It is Microsoft's implementation of the WS-Management (Web Services Management Protocol) standard. It often uses SOAP (Simple Object Access Protocol) for communication over HTTP or HTTPS, using ports 5985 (HTTP) and 5986 (HTTPS) by default. WinRM provides the basis for remote management with PowerShell and is used for tasks such as running remote scripts, automating, configuring, and performing system inventory. Therefore, WinRM and SSH must be configured correctly. Important We emphasize ensuring the communication flow works as intended from the outset of the pre-domain-joined stage; otherwise, Terraform and Ansible will fail to configure the VMs. During the pre-domain-join stage, you can configure these settings using the local Group Policy Editor on the VM or in the autounattend.xml file as we do in our Packer scripts. After a successful domain join, you can set all relevant settings using GPOs. To provide maximum flexibility and a fallback mechanism, you can use both listeners - HTTP and HTTPS - but we recommend using the secure transport whenever and wherever possible. Note You can find more information about the communication flow, its configuration, and its importance in the first part of the Citrix Automation Handbook. Creation of the Citrix DaaS Environment using IaCAs already stated, the workflow is divided into blocks that must be started in a specific, predetermined order: Create all prerequisites on Azure Using Packer to create the Master Images Creating the needed Cloud Connector VMs Putting the 2 Cloud Connector VMs Into the Active Directory Domain Installing and Configuring the Cloud Connector Software Creating the Hypervisor Connection and Hypervisor Resource Pool Creating a Machine Catalog on Azure Creating a Delivery Group Creating Policy Sets, Scopes, and Roles Removing Citrix DaaS entities using Terraform Note All Ansible playbooks are directly called from Terraform. Terraform stops the workflow if an error occurs by checking Ansible's return code. Important All shown Terraform codes, Ansible Playbooks, and PowerShell scripts are tailored exclusively for the specific environment used for this guide. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. Using all the provided code snippets is at your own risk – please read the disclaimer at the end of the document for further information. Tip This IaC-based deployment is built on single, stand-alone modules. This is because our GitHub workflows enable the reuse of each module for Day 2-like administrative steps. Each module might need variables from earlier modules to function properly - for example, the Resource Group name, the Citrix Zone ID, etc., are values that are needed in most modules. You need to ensure the values are available across all modules. Part 1: Create all needed prerequisitesDetermining available base images on AzureThe first step is to determine which base image you want to use – Azure offers many options. As we create master images for MCS, we focus on Windows images. Packer needs to know which base image it should use: # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion Let´s find out which images we can use. The easiest way is to use PowerShell: Get the Image Publisher: PS C:\TMM> $LocName="austriaeast" PS C:\TMM> $Publisher=Get-AzVMImagePublisher -Location $LocName | Where-Object { $_.PublisherName -eq "MicrosoftWindowsDesktop" } PS C:\TMM> $Publisher PublisherName Location Id ------------- -------- -- MicrosoftWindowsDesktop austriaeast /Subscriptions//Providers/Microsoft.Compute/Locations/austriaeast/Publishers/MicrosoftWindowsDesktop PS C:\TMM>Get the Image Offer: PS C:\TMM> $Offer = Get-AzVMImageOffer -Location $LocName -PublisherName $Publisher.PublisherName | Where-Object { $_.Offer -eq "windows-11" } PS C:\TMM> $Offer Offer PublisherName Location Id ----- ------------- -------- -- windows-11 MicrosoftWindowsDesktop austriaeast /Subscriptions//Providers/Microsoft.Compute/Locations/austriaeast/Publishers/MicrosoftWindowsDesktop/ArtifactTypes/VMImage… PS C:\TMM>Get the Image SKU – here all SKUs are shown for informational purposes: PS C:\TMM> $Skus = Get-AZVMImageSku -Location $LocName -PublisherName $Publisher.PublisherName -Offer $Offer.Offer | Select Skus PS C:\TMM> $SKus Skus ---- win11-21h2-avd win11-21h2-ent win11-21h2-pro-zh-cn win11-22h2-avd win11-22h2-ent win11-22h2-entn win11-23h2-avd win11-23h2-ent win11-23h2-entn win11-23h2-pro win11-23h2-pro-zh-cn win11-23h2-pron win11-24h2-avd win11-24h2-ent win11-24h2-entn win11-24h2-pro win11-24h2-pro-zh-cn win11-24h2-pron win11-25h2-avd win11-25h2-ent win11-25h2-entn win11-25h2-pro win11-25h2-pro-zh-cn win11-25h2-pron PS C:\TMM>Get the Image: PS C:\TMM> Get-AzVMImage -Location $LocName -PublisherName $Publisher.PublisherName -Offer $Offer.Offer -Sku "win11-25h2-pro" | Select Version Version ------- 26200.6584.250915 26200.6899.251011 26200.7171.251109 26200.7462.251207 PS C:\TMM>We now have all the parameters we need to tell Packer which base image should be used: ... azure_imgpublisher = "MicrosoftWindowsDesktop" azure_imgoffer = "windows-11" azure_imgsku = "win11-25h2-pro" azure_imgversion = "26200.7462.251207" ... Creating a Service Principal Name (SPN) with a Client Secret for Azure AuthenticationA Service Principal is an application within Azure Active Directory whose authentication tokens can be used as the client_id, client_secret, and tenant_id fields needed by the Azure Terraform provider. The subscription_id field can be found in your Azure Account details. Terraform uses the SPN to connect to Azure and create everything needed. If you do not have an SPN configured, you can use e.g. Azure CLI on PowerShell to create one: PS C:\TMM\TestWinRM> az login Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136 Retrieving tenants and subscriptions for the selection... [Tenant and subscription selection] No Subscription name Subscription ID Tenant ----- ------------------- ------------------------------------ ---------------- [1] * WWCO-XxXxXxX dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13 Citrix (TM-WWCO) The default is marked with an *; the default tenant is 'Citrix (TM-WWCO)' and subscription is 'WWCO-XxXxXxX' (dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13). Select a subscription and tenant (Type a number or Enter for no changes): 1 Tenant: Citrix (TM-WWCO) Subscription: WWCO-XxXxXxX (dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13) PS C:\TMM> az ad sp create-for-rbac The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli { "appId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", "displayName": "azure-cli-2025-12-03-18-12-57", "password": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "tenant": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" } PS C:\TMM>Please record the corresponding values for future use. (Optional) Create a dedicated Resource Group in your Azure SubscriptionYou can decide if you want Terraform to create a new Resource Group on Azure to deploy all further components by setting the corresponding variable: ... "CreateRG": true, "RG-Name": "TMM-TEAM-RG-AEAST" ...The new Resource Group will be created if you set this variable to true. # Create a Citrix Cloud Resource Location and DaaS Deployment on Microsoft Azure ## Create Pre-requisites ### Create a Resource Group on Azure #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group resource "azurerm_resource_group" "TACG-AZ-RG" { count = var.CreateRG ? 1 : 0 location = var.RG-DeployLocation name = var.RG-Name tags = { Environment = var.TAG-Environment, Environment-Entity = var.TAG-Environment-Entity, Environment-Usage = var.TAG-Environment-Usage, } } Determining existing Azure Entities - Virtual Network, Subnet, and Network Security GroupWe assume that these entities are already configured on Azure. Terraform relies on them and retrieves Important configuration details during the deployment. You can use PowerShell to retrieve all the needed entity values. Write down the required entity information for later use in the corresponding .auto.tfvars.json files so the Terraform provider can use this Information. Get the Virtual Network to use: PS C:\_TMM> Get-AzVirtualNetwork -ResourceGroupName 'TMM-TEAM-RG-AEAST' | FT Name, Location Name Location ---- -------- AEAST-vnet austriaeast PS C:\_TMM>Get the Subnet(s) to use: PS C:\_TMM> $vn = Get-AzVirtualNetwork -Name 'AEAST-vnet' PS C:\_TMM> Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vn | FT Name, AddressPrefix Name AddressPrefix ---- ------------- AEAST-1-sn {10.53.16.0/24} AEAST-2-sn {10.53.17.0/25} GatewaySubnet {10.53.17.128/26} PS C:\_TMM>Get the Network Security Group to use: PS C:\_TMM> Get-AzNetworkSecurityGroup -ResourceGroupName 'TMM-TEAM-RG-AEAST' | FT Name, Location Name Location ---- -------- AZ-AEAST-GK-nsg austriaeast AZ-AEAST-test-nsg austriaeast PS C:\_TMM> You can, of course, use a Terraform code snippet to determine these entities directly in Terraform for further usage: variable "azure_resource_group_name" { description = "Name of the Azure RG" type = string } # Resolve the RG data "azurerm_resource_group" "rg" { name = var.resource_group_name } data "azurerm_resources" "vnets" { resource_group_name = data.azurerm_resource_group.rg.name type = "Microsoft.Network/virtualNetworks" } locals { vnet_index = { for r in data.azurerm_resources.vnets.resources : r.name => r } } data "azurerm_virtual_network" "vnet" { for_each = local.vnet_index name = each.value.name resource_group_name = data.azurerm_resource_group.rg.name } locals { vnet_subnet_ids = flatten([ for v in data.azurerm_virtual_network.vnet : v.subnets ]) subnets_map = { for sid in local.vnet_subnet_ids : sid => { id = sid name = element(split("/", sid), length(split("/", sid)) - 1) vnet = element(split("/", sid), index(split("/", sid), "virtualNetworks") + 1) } } } data "azurerm_subnet" "subnet" { for_each = local.subnets_map name = each.value.name virtual_network_name = each.value.vnet resource_group_name = data.azurerm_resource_group.rg.name } data "azurerm_resources" "nsgs_in_rg" { resource_group_name = data.azurerm_resource_group.rg.name type = "Microsoft.Network/networkSecurityGroups" } locals { nsgs_in_rg_index = { for r in data.azurerm_resources.nsgs_in_rg.resources : r.name => r } } data "azurerm_network_security_group" "nsg_in_rg" { for_each = local.nsgs_in_rg_index name = each.value.name resource_group_name = data.azurerm_resource_group.rg.name } locals { associated_nsg_ids = distinct( compact([ for s in values(data.azurerm_subnet.subnet) : s.network_security_group_id ]) ) associated_nsg_map = { for id in local.associated_nsg_ids : id => { id = id # Parse NSG name and RG from the ARM ID name = element(split("/", id), length(split("/", id)) - 1) rg = element(split("/", id), index(split("/", id), "resourceGroups") + 1) } } } data "azurerm_network_security_group" "associated" { for_each = local.associated_nsg_map name = each.value.name resource_group_name = each.value.rg } (Optional) Check the available VM sizes and quotas in your Azure SubscriptionCaution It is best practice to check whether your subscription has enough VMs of the chosen size available, as not all Machine Sizes are available in all Azure locations. Be sure that your subscription has no quota limitation on the chosen VM type and that you have enough resources on Azure to create all the Virtual Machines planned to put into the Machine Catalog by checking quotas. Otherwise, the creation of the Machine Catalog will fail if there are not enough compute resources available! Use PowerShell to list the available Machine Sizes for Windows Server-based VMs. In this example, we plan to deploy "D2-based" VMs - change the parameters according to your needs: PS C:\_TMM> $location="austriaeast" PS C:\_TMM> Get-AzVMSize -Location $location | Where Name -like 'Standard_D2*' | Select Name,NumberOfCores,MemoryInMB,OSDiskSizeInMB,ResourceDiskSizeInMB | Format-Table Name NumberOfCores MemoryInMB OSDiskSizeInMB ResourceDiskSizeInMB ---- ------------- ---------- -------------- -------------------- Standard_D2a_v4 2 8192 1047552 51200 Standard_D2as_v4 2 8192 1047552 16384 Standard_D2as_v5 2 8192 1047552 0 Standard_D2ads_v5 2 8192 1047552 76800 Standard_D2_v2 2 7168 1047552 102400 Standard_D2_v2_Promo 2 7168 1047552 102400 Standard_D2_v3 2 8192 1047552 51200 Standard_D2s_v3 2 8192 1047552 16384 Standard_D2ds_v4 2 8192 1047552 76800 Standard_D2ds_v5 2 8192 1047552 76800 Standard_D2d_v4 2 8192 1047552 76800 Standard_D2d_v5 2 8192 1047552 76800 Standard_D2s_v4 2 8192 1047552 0 Standard_D2s_v5 2 8192 1047552 0 Standard_D2_v4 2 8192 1047552 0 Standard_D2_v5 2 8192 1047552 0 Standard_D2ls_v5 2 4096 1047552 0 Standard_D2lds_v5 2 4096 1047552 76800 Standard_D2 2 7168 1047552 102400 Standard_D2plds_v5 2 4096 1047552 76800 Standard_D2pls_v5 2 4096 1047552 0 Standard_D2pds_v5 2 8192 1047552 76800 Standard_D2ps_v5 2 8192 1047552 0 Standard_D2pls_v6 2 4096 1047552 0 Standard_D2plds_v6 2 4096 1047552 0 Standard_D2ps_v6 2 8192 1047552 0 Standard_D2pds_v6 2 8192 1047552 0 Standard_D2ls_v6 2 4096 1047552 0 Standard_D2lds_v6 2 4096 1047552 0 Standard_D2s_v6 2 8192 1047552 0 Standard_D2ds_v6 2 8192 1047552 0 Standard_D2as_v6 2 8192 1047552 0 Standard_D2ads_v6 2 8192 1047552 0 Standard_D2als_v6 2 4096 1047552 0 Standard_D2alds_v6 2 4096 1047552 0 PS C:\_TMM>Use PowerShell to list the available Machine Sizes for Windows Server-based VMs. In this example, we check the vCPU quotas for a "D2S_V5"-based VM - change the parameters according to your needs: PS C:\_TMM> $Location = 'austriaeast' PS C:\_TMM> $VMSize = 'Standard_D2s_v5' PS C:\_TMM> $SKU = Get-AzComputeResourceSku -Location $Location | where ResourceType -eq "virtualMachines" | select Name,Family PS C:\_TMM> $VMFamily = ($SKU | where Name -eq $VMSize | select -Property Family).Family PS C:\_TMM> Get-AzVMUsage -Location $Location | Where-Object { $_.Name.Value -eq $VMFamily } Name Current Value Limit Unit ---- ------------- ----- ---- Standard DSv5 Family vCPUs 18 350 Count PS C:\_TMM>This example shows that we can create enough D2S_v5 VMs before exceeding the limit. The Azure Console or PowerShell can increase the vCPU or any other quota. More information about increasing vCPU quotas can be found here: https://learn.microsoft.com/en-us/azure/quotas/per-vm-quota-requests. Creating a Shared Image Gallery on AzureThe next step is to create a Shared Image Gallery on Azure, where Packer will later upload the images. Based on that image, an image definition and an image version will be created in Azure for further use. # Create a Citrix Cloud Resource Location and DaaS Deployment ## Create Pre-requisites ### Create a Shared Image Gallery #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/shared_image_gallery data "azurerm_resource_group" "TMM-RG" { name = var.RG-Name } resource "azurerm_shared_image_gallery" "TACG-AZ-V2-SIG" { name = var.SIG-Name description = var.SIG-Description resource_group_name = data.azurerm_resource_group.TMM-RG.name location = data.azurerm_resource_group.TMM-RG.location tags = { Environment = var.TAG-Environment, Environment-Entity = var.TAG-Environment-Entity, Environment-Usage = var.TAG-Environment-Usage, } } Creating a Service Principal in Citrix Cloud for AuthenticationA Service Principal in Citrix Cloud acts as an API client to Citrix Cloud APIs: Service principals have their own roles and permissions. These roles and permissions are distinct from the creator’s roles and permissions. Service principals are scoped to a single Citrix Cloud customer. To access more than one customer, you must create a distinct service principal within each customer. Service principals’ secrets expire on an expiration date of your choice. Service principals currently only support custom access. Full access will be available soon once all resource provider services support service principals. Select the Identity and Access Management option from the menu to create a Service Principal. If this option does not appear, you do not have adequate permissions to create an API client. Contact your administrator to get the required permissions. Open Identity and Access Management in WebStudio: Click API Access, Service principals: Click Create service principal Enter a Name and click Next: Choose the correct Access settings and click Next: Choose the Expiration and click Next: Review the settings and click Complete: After the Service Principal is created, copy and write down the shown ID and Secret: The Secret is only visible during creation - after closing the window, you cannot get it anymore. The client-id and client-secret fields are needed by the Citrix Terraform provider. The customer ID field can also be found in your Citrix Cloud details. Put the values in the corresponding .auto.tvars.json file: ... "CC_APIKey-ClientID":"f4xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx5", "CC_APIKey-ClientSecret":"VxxxxxxxA==", "CC_CustomerID": "uxxxxxxxxj" ...Now that the prerequisites are complete, we can jump into creation. Part 2: Using Packer to create the Master ImagesConfiguring Packer to create the Master ImagePacker uses the HashiCorp Configuration Language (HCL) to define build templates for creating machine images. HCL is a human-readable, declarative language designed by HashiCorp for defining infrastructure and automation workflows. It is used across HashiCorp tools like Terraform, Packer, and Vault because it balances readability for humans with machine-parsability. Key Features of HCL: Declarative syntax: You describe what you want, not how to do it Blocks and attributes: Resources are defined in blocks with key-value pairs Supports variables, interpolation, and conditionals Let´s look at a valid example of an HCL to create a Windows 11-based master image on Azure. In this example, we use Chocolatey to deploy software packages, and upload the final image to an Azure Image Gallery – from there, you can, for example, create an image definition and image version in Citrix DaaS to deploy a Machine catalog. Note You can find more information on using Packer, Chocolatey, and Ansible together to deploy software packages, Windows components, and Windows settings in the third part of the Citrix Automation Handbook. win11-azure.packer.hcl: # Defining all used variables variable "azure_clientid" { type = string description = "azure Service Principal App ID" sensitive = true } variable "azure_clientsecret" { type = string description = "azure Service Principal Secret" sensitive = true } variable "azure_subscriptionid" { type = string description = "azure Subscription ID" sensitive = true } variable "azure_tenantid" { type = string description = "azure Tenant ID" sensitive = true } ... variable "vda_location" { type = string } variable "script_installvda" { type = string default = "install-vda.ps1" } variable "script_optimizer" { type = string default = "run-optimizer.ps1" } variable "script_cleanup" { type = string default = "run-cleanup.ps1" } variable "location_setup" { type = string default = "c:\\setup" } # Defining the used Packer Plugin(s) packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = ">= 2.5.0" } } } # Defining the source(s) block(s) source "azure-arm" "W11MIWithSWPackagesWithVDA" { # Tagging the Azure VM azure_tags = { environment = var.azure_tag_environment, environment-entity = var.azure_tag_environment_entity, usage = var.azure_tag_usage } # WinRM Communicator communicator = "winrm" winrm_use_ssl = true winrm_insecure = false winrm_timeout = "5m" winrm_username = "packer" # Service Principal Authentication client_id = var.azure_clientid client_secret = var.azure_clientsecret subscription_id = var.azure_subscriptionid tenant_id = var.azure_tenantid # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion # Destination Image - we want to upload the artifact directly into the Azure Image Gallery, so no creation of a stand-alone image is needed # managed_image_resource_group_name = var.azure_RG # managed_image_name = var.azure_ManagedImgName # Store created Image in Shared Image Gallery shared_image_gallery_destination { resource_group = var.azure_rg gallery_name = var.azure_sig_name image_name = var.azure_sig_imgname image_version = var.azure_sig_imgversion replication_regions = ["austriaeast"] storage_account_type = "Standard_LRS" } # Packer Computing Resources build_resource_group_name = var.azure_temprg vm_size = var.azure_vmsize } # Defining the building blocks build { source "azure-arm.W11MIWithSWPackagesWithVDA" {} # Install Chocolatey: https://chocolatey.org/install#individual provisioner "powershell" { inline = ["Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"] } # Install Chocolatey packages provisioner "file" { source = "./scripts/SWPackagesToInstall.config" destination = "${var.location_setup}/scripts/SWPackagesToInstall.config" } provisioner "powershell" { inline = ["choco install --ignore-hash --ignore-checksums --confirm ${var.location_setup}/scripts/SWPackagesToInstall.config"] # See https://docs.chocolatey.org/en-us/choco/commands/install#exit-codes valid_exit_codes = [0, 3, 1641, 3010] } provisioner "windows-restart" {} provisioner "powershell" { inline = ["New-Item -Path ${var.location_setup} -Force -ItemType \"directory\" | Out-Null"] } provisioner "file" { destination = "${var.location_setup}/${var.script_installvda}" source = "./scripts/${var.script_installvda}" } provisioner "file" { destination = "${var.location_setup}/${var.script_optimizer}" source = "./scripts/${var.script_optimizer}" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Host 'Script: computer restarted.'}\"" restart_timeout = "30m" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "powershell" { inline = ["$assemblyPath = \"C:\\Program Files (x86)\\Citrix\\ICA Client\\wfica32.exe\"", "$ngen64 = \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\"", "$ngen32 = \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\"", "Write-Host \"Running 64-bit Ngen...\"", "& $ngen64 executequeueditems", "Write-Host \"Running 32-bit Ngen...\"", "& $ngen32 executequeueditems"] } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_optimizer} -OptimizerDownloadUri ${var.optimizer_location} -Template ${var.optimizer_template}"] } # Generalize image using Sysprep # See https://www.packer.io/docs/builders/azure/arm#windows # See https://docs.microsoft.com/en-us/azure/virtual-machines/windows/build-image-with-packer#define-packer-template provisioner "powershell" { inline = [ "while ((Get-Service RdAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "while ((Get-Service WindowsazureGuestAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /quiet /quit /mode:vm", "while ($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }" ] } }The variables are defined in a key-value format - example: win11-azure.auto.pkrvars.hcl: azure_clientid = azure_clientsecret = azure_subscriptionid = azure_tenantid = azure_rg = "" azure_temprg = "Temp-" azure_imgpublisher = "MicrosoftWindowsDesktop" azure_imgoffer = "windows-11" azure_imgsku = "win11-25h2-pro" azure_imgversion = "26200.7462.251207" ... vda_location = "https://.blob.core.windows.net/ctxsw/VDAWorkstationSetup_2507.exe" script_installvda = "install-vda.ps1" script_optimizer = "run-optimizer.ps1" script_cleanup = "run-cleanup.ps1" location_setup = "c:\\ttemp" optimizer_location = "https://.blob.core.windows.net/ctxsw/CitrixOptimizerTool.zip" optimizer_template = "Citrix_Windows_11_2009.xml" Most Important The Image definition on the Azure Image Gallery MUST exist before running Packer, otherwise the deployment will fail. If you want to start the creation process manually, you can use the well-known Packer command: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ packer build -on-error=cleanup -force -var-file="win11-azure.auto.pkrvars.hcl" win11-azure.pkr.hclPacker writes out all relevant information during the building process: ==> azure-arm.W11MIWithSWPackagesWithVDA: Running builder ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Azure Resource Manager (ARM) client ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ARM Client successfully created ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting source image id for the deployment ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> SourceImageName: '/subscriptions//providers/Microsoft.Compute/locations/austriaeast/publishers/MicrosoftWindowsDesktop/ArtifactTypes/vmimage/offers/windows-11/skus/win11-25h2-pro/versions/26200.7462.251207' ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting the VM's IP address ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> ResourceGroupName : '' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> PublicIPAddressName : 'pkripgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> NicName : 'pkrnigf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> Network Connection : 'PublicEndpoint' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> IP Address : '4.210.182.179' ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for WinRM to become available... ==> azure-arm.W11MIWithSWPackagesWithVDA: WinRM connected. ==> azure-arm.W11MIWithSWPackagesWithVDA: Connected to WinRM! ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Forcing web requests to allow TLS v1.2 (Required for requests to Chocolatey.org) ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting latest version of the Chocolatey package for download. ==> azure-arm.W11MIWithSWPackagesWithVDA: Not using proxy. ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting Chocolatey from https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0. ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0 to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip ==> azure-arm.W11MIWithSWPackagesWithVDA: Not using proxy. ==> azure-arm.W11MIWithSWPackagesWithVDA: Extracting C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing Chocolatey on the local machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating ChocolateyInstall as an environment variable (targeting 'Machine') ==> azure-arm.W11MIWithSWPackagesWithVDA: Setting ChocolateyInstall to 'C:\ProgramData\chocolatey' ... ==> azure-arm.W11MIWithSWPackagesWithVDA: c:\ttemp/scripts/SWPackagesToInstall.config ==> azure-arm.W11MIWithSWPackagesWithVDA: By installing, you accept licenses for the packages. ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing the following packages: ==> azure-arm.W11MIWithSWPackagesWithVDA: adobereader ==> azure-arm.W11MIWithSWPackagesWithVDA: googlechrome ==> azure-arm.W11MIWithSWPackagesWithVDA: git.install ==> azure-arm.W11MIWithSWPackagesWithVDA: sysinternals ==> azure-arm.W11MIWithSWPackagesWithVDA: winscp.install ==> azure-arm.W11MIWithSWPackagesWithVDA: teamviewer ==> azure-arm.W11MIWithSWPackagesWithVDA: dropbox ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWithSWPackagesWithVDA: Progress: Downloading chocolatey-compatibility.extension 1.0.0... 100% ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWithSWPackagesWithVDA: Progress: Downloading GoogleChrome 143.0.7499.41... 100% ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome v143.0.7499.41[Approved] ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome package files install completed. Performing other installation steps. ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading googlechrome 64 bit ==> azure-arm.W11MIWithSWPackagesWithVDA: from 'https://dl.google.com/dl/chrome/install/googlechromestandaloneenterprise64.msi' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Download of googlechromestandaloneenterprise64.msi (-1 B) completed. ==> azure-arm.W11MIWithSWPackagesWithVDA: WARNING: Ignoring checksums due to feature checksumFiles turned off or option --ignore-checksums set. ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing googlechrome... ==> azure-arm.W11MIWithSWPackagesWithVDA: googlechrome has been installed. ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome may be able to be automatically uninstalled. ==> azure-arm.W11MIWithSWPackagesWithVDA: The install of GoogleChrome was successful. ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Chocolatey installed 13/13 packages. ==> azure-arm.W11MIWithSWPackagesWithVDA: See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log). ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Installed: ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-compatibility.extension v1.0.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-core.extension v1.4.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-dotnetfx.extension v1.0.1 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-visualstudio.extension v1.13.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-windowsupdate.extension v1.0.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - adobereader v2025-1-20577 ==> azure-arm.W11MIWithSWPackagesWithVDA: - filezilla v3.69.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - GoogleChrome v143.0.7499.41 ==> azure-arm.W11MIWithSWPackagesWithVDA: - git.install v2.52.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - sysinternals v2025.11.17 ==> azure-arm.W11MIWithSWPackagesWithVDA: - winscp.install v6.5.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - teamviewer v15.72.6 ==> azure-arm.W11MIWithSWPackagesWithVDA: - dropbox v238.4.6075 ==> azure-arm.W11MIWithSWPackagesWithVDA: Restarting Machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for machine to restart... ==> azure-arm.W11MIWithSWPackagesWithVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWithSWPackagesWithVDA: pkrvmgf6zyyvkul restarted. ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Uploading ./scripts/install-vda.ps1 => c:\ttemp/install-vda.ps1 ==> azure-arm.W11MIWithSWPackagesWithVDA: Uploading ./scripts/run-optimizer.ps1 => c:\ttemp/run-optimizer.ps1 ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with powershell script: C:\Users\packer\AppData\Local\Temp\powershell-provisioner3550365223 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:50 - Initiating Ctrix VDA installation. ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:50 - Adding firewall allow rules for ports 80, 443, 1494, 2598, 8008 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:53 - Finished adding firewall allow rules for ports 80, 443, 1494, 2598, 8008 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:53 - Downloading VDASetup file from blob storage ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:05 - Executing: C:\Users\packer\AppData\Local\Temp\VDASetup.exe, Components: VDA ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:05 - Parameters: /quiet /noreboot /masterimage /enable_real_time_transport /enable_hdx_ports /components vda /includeadditional "Citrix MCS IODriver","Citrix VDA Upgrade Agent" ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:40 - XenDesktopVDA installation started ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:40 - Waiting few seconds to make sure the process extracts and starts ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:58:40 - Checking if XenDesktopVdaSetup process is running ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:58:40 - Installation process still running ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - Installation process completed ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - GctRegistration already enabled ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - BrokerAgent found and it is running. ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - Installation of XenDesktopVDA completed with success ==> azure-arm.W11MIWithSWPackagesWithVDA: Restarting Machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for machine to restart... ==> azure-arm.W11MIWithSWPackagesWithVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: computer restarted. ==> azure-arm.W11MIWithSWPackagesWithVDA: pkrvmgf6zyyvkul restarted. ==> azure-arm.W11MIWithSWPackagesWithVDA: Machine successfully restarted, moving on ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with powershell script: C:\Users\packer\AppData\Local\Temp\powershell-provisioner2019159959 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:20:55 - Downloading Citrix Optimizer from blob storage ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:20:55 - Executing: C:\Users\packer\AppData\Local\Temp\CitrixOptimizer\CtxOptimizerEngine.ps1, Template: Citrix_Windows_11_2009.xml ==> azure-arm.W11MIWithSWPackagesWithVDA: ------------------------------ ==> azure-arm.W11MIWithSWPackagesWithVDA: | Citrix Optimization Engine | ==> azure-arm.W11MIWithSWPackagesWithVDA: | Version 2.9 | ==> azure-arm.W11MIWithSWPackagesWithVDA: ------------------------------ ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Running in execute mode ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Logs folder 2025-12-12_14-20-55 ==> azure-arm.W11MIWithSWPackagesWithVDA: Starting session log ==> azure-arm.W11MIWithSWPackagesWithVDA: Checking permissions ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Processing definition file C:\Users\packer\AppData\Local\Temp\CitrixOptimizer\Templates\Citrix_Windows_11_2009.xml ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:24:38 - Optimization script completed ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: IMAGE_STATE_COMPLETE ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Querying the machine's properties ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Powering off machine ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Publishing to Shared Image Gallery ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> Shared Gallery Image Version ID : '/subscriptions//resourceGroups/TMM-/providers/Microsoft.Compute/galleries//images//versions/1.0.0' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleting Virtual Machine deployment and its attached resources... ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Compute/virtualMachines : 'pkrvmgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/networkInterfaces : 'pkrnigf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/virtualNetworks : 'pkrvngf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/publicIPAddresses : 'pkripgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/networkSecurityGroups : 'pkrsggf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Compute/disks : '/subscriptions//resourceGroups/TMM-sensitive/providers/Microsoft.Compute/disks/pkrosgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Removing the created Deployment object: 'pkrdpgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleting KeyVault created during build ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.KeyVault/vaults : 'pkrkvgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Removing the created Deployment object: 'kvpkrdpgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: The resource group was not created by Packer, not deleting ... Build 'azure-arm.W11MIWithSWPackagesWithVDA' finished after 54 minutes 36 seconds. ==> Wait completed after 54 minutes 36 seconds ==> Builds finished. The artifacts of successful builds are: --> azure-arm.W11MIWithSWPackagesWithVDA: Azure.ResourceManagement.VMImage: OSType: Windows ManagedImageSharedImageGalleryId: /subscriptions//resourceGroups/TMM-/providers/Microsoft.Compute/galleries//images//versions/1.0.0 SharedImageGalleryResourceGroup: TMM- SharedImageGalleryName: SharedImageGalleryImageName: SharedImageGalleryImageVersion: 1.0.0 SharedImageGalleryReplicatedRegions: austriaeastThe creation was completed successfully. Important Please make sure you know the return code for each software package's successful installation, as it varies by package. Usually, ‘0’ indicates a successful installation, but, for example, the return code for a successful VDA deployment is ‘3’ if a reboot is required. You need to enter the correct return codes for all packages in the corresponding configuration step: valid_exit_codes = [0, 3, 1641, 3010] If Packer encounters another code, it will raise an error, and the deployment will fail. Note If some errors occur during the creation process, you might enable Packer to write verbose logs by using: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ export PACKER_LOG=1 azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ export PACKER_LOG_PATH="./packer.log" or start the building process with verbose logging: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ packer build -on-error=cleanup -debug -force -var-file="win11-azure.auto.pkrvars.hcl" win11-azure.pkr.hcl Depending on the underlying load on Azure, the deployment process lasts some time - in our example, it took around 55 minutes. The respective Azure Gallery reflects the newly created image and image version: Part 3: Creating the Cloud Connector VMsTerraform creates 2 Cloud Connector VMs. Therefore, it creates various Azure entities, including a Network Interface with its IP configuration, associations with a Network Security Group, and VMs. # Create a Citrix Cloud Resource Location and DaaS Deployment ## Create Pre-requisites ### We are using existing entitites like the Resource Group, NSGs, Firewall Rules, etc #### Get existing entity data data "azurerm_virtual_network" "TACG-TMM-VNet" { name = var.TACG-TMM-VNet-Name resource_group_name = var.TACG-TMM-ResourceGroup-Name } data "azurerm_subnet" "TACG-TMM-Subnet" { name = var.TACG-TMM-Subnet-Name virtual_network_name = data.azurerm_virtual_network.TACG-TMM-VNet.name resource_group_name = var.TACG-TMM-ResourceGroup-Name } data "azurerm_network_security_group" "TACG-TMM-NSG" { name = var.TACG-TMM-NSG-Name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Create a new inbound rule in NSG to allow WinRM Communication resource "azurerm_network_security_rule" "EnableWinRMInNSG" { depends_on = [ data.azurerm_network_security_group.TACG-TMM-NSG ] count = var.TACG-TMM-NSGRule-CreateRule ? 1 : 0 name = var.TACG-TMM-NSGRule-Name priority = var.TACG-TMM-NSGRule-Priority direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = var.TACG-TMM-NSGRule-InboundPorts source_address_prefix = "VirtualNetwork" destination_address_prefix = "VirtualNetwork" resource_group_name = var.TACG-TMM-ResourceGroup-Name network_security_group_name = data.azurerm_network_security_group.TACG-TMM-NSG.name } #### Create a dedicated Network Interface and IP configuration for the CC1-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface" "TACG-TMM-TF-CC1-NIC" { depends_on = [ data.azurerm_subnet.TACG-TMM-Subnet ] name = "${var.TACG-TMM-CC1-NIC-Name}" location = "${var.TACG-TMM-ResourceGroup-Location}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" accelerated_networking_enabled = true dns_servers = data.azurerm_virtual_network.TACG-TMM-VNet.dns_servers tags = { Environment = var.TAG-Environment, Environment-Entity = var.TAG-Environment-Entity, Environment-Usage = var.TAG-Environment-Usage, } ip_configuration { name = var.TACG-TMM-CC1-IPC-Name subnet_id = data.azurerm_subnet.TACG-TMM-Subnet.id private_ip_address_allocation = var.TACG-TMM-CC1-IPC-Private_IP_Address_Allocation private_ip_address = var.TACG-TMM-CC1-IPC-Private_IP_Address } } #### Create a dedicated Network Interface and IP configuration for the CC2-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface" "TACG-TMM-TF-CC2-NIC" { depends_on = [ data.azurerm_subnet.TACG-TMM-Subnet ] name = var.TACG-TMM-CC2-NIC-Name location = var.TACG-TMM-ResourceGroup-Location resource_group_name = var.TACG-TMM-ResourceGroup-Name accelerated_networking_enabled = true dns_servers = data.azurerm_virtual_network.TACG-TMM-VNet.dns_servers tags = { Environment = var.TAG-Environment, Environment-Entity = var.TAG-Environment-Entity, Environment-Usage = var.TAG-Environment-Usage, } ip_configuration { name = var.TACG-TMM-CC2-IPC-Name subnet_id = data.azurerm_subnet.TACG-TMM-Subnet.id private_ip_address_allocation = var.TACG-TMM-CC2-IPC-Private_IP_Address_Allocation private_ip_address = var.TACG-TMM-CC2-IPC-Private_IP_Address } } #### Associate the CC1-Network Interface with an existing NSG #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface_security_group_association" "TACG-TMM-TF-CC1-NICNSG" { depends_on = [ azurerm_network_interface.TACG-TMM-TF-CC1-NIC, data.azurerm_network_security_group.TACG-TMM-NSG ] network_interface_id = azurerm_network_interface.TACG-TMM-TF-CC1-NIC.id network_security_group_id = data.azurerm_network_security_group.TACG-TMM-NSG.id } #### Associate the CC2-Network Interface with an existing NSG #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface_security_group_association" "TACG-TMM-TF-CC2-NICNSG" { depends_on = [ azurerm_network_interface.TACG-TMM-TF-CC2-NIC, data.azurerm_network_security_group.TACG-TMM-NSG ] network_interface_id = azurerm_network_interface.TACG-TMM-TF-CC2-NIC.id network_security_group_id = data.azurerm_network_security_group.TACG-TMM-NSG.id } resource "azurerm_windows_virtual_machine" "TACG-TMM-CC1" { depends_on = [ azurerm_network_interface_security_group_association.TACG-TMM-TF-CC1-NICNSG ] name = var.TACG-TMM-CC1-VM-Name location = var.TACG-TMM-ResourceGroup-Location resource_group_name = var.TACG-TMM-ResourceGroup-Name network_interface_ids = [azurerm_network_interface.TACG-TMM-TF-CC1-NIC.id] size = var.TACG-TMM-CCX-VM-Size admin_username = var.TACG-TMM-CCX-VM-Loc-UN admin_password = var.TACG-TMM-CCX-VM-Loc-PW provision_vm_agent = true timezone = "W. Europe Standard Time" patch_mode = "AutomaticByOS" enable_automatic_updates = true # Reboot setting is set to Never, because of Cloud COntrollers should not go down simultaneously due to a pending reboot! reboot_setting = "Never" hotpatching_enabled = false secure_boot_enabled = false os_disk { name = "${var.TACG-TMM-CC1-VM-OSDrive-Name}" caching = "${var.TACG-TMM-CCX-VM-OSDrive-Cache}" storage_account_type = "${var.TACG-TMM-CCX-VM-OSDrive-StorageType}" } tags = { Environment = var.TAG-Environment, Environment-Entity = var.TAG-Environment-Entity, Environment-Usage = var.TAG-Environment-Usage, } #### Create the CC2-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_windows_virtual_machine" "TACG-TMM-CC2" { depends_on = [ azurerm_network_interface_security_group_association.TACG-TMM-TF-CC2-NICNSG ] name = var.TACG-TMM-CC2-VM-Name location = var.TACG-TMM-ResourceGroup-Location resource_group_name = var.TACG-TMM-ResourceGroup-Name network_interface_ids = [azurerm_network_interface.TACG-TMM-TF-CC2-NIC.id] size = var.TACG-TMM-CCX-VM-Size admin_username = var.TACG-TMM-CCX-VM-Loc-UN admin_password = var.TACG-TMM-CCX-VM-Loc-PW provision_vm_agent = true timezone = "W. Europe Standard Time" patch_mode = "AutomaticByOS" enable_automatic_updates = true # Reboot setting is set to Never, because of Cloud Controllers should not go down simultaneously due to a pending reboot! reboot_setting = "Never" hotpatching_enabled = false secure_boot_enabled = false os_disk { name = var.TACG-TMM-CC2-VM-OSDrive-Name caching = var.TACG-TMM-CCX-VM-OSDrive-Cache storage_account_type = var.TACG-TMM-CCX-VM-OSDrive-StorageType } tags = { Environment = var.TAG-Environment, Environment-Entity = var.TAG-Environment-Entity, Environment-Usage = var.TAG-Environment-Usage, } }Running the snippet creates the VMs as intended: PS C:\TMM\CreateVMs> terraform apply ... Plan: 6 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes azurerm_network_interface.TACG-TMM-TF-CC1-NIC: Creating... azurerm_network_interface.TACG-TMM-TF-CC2-NIC: Creating... azurerm_network_interface.TACG-TMM-TF-CC1-NIC: Still creating... [10s elapsed] azurerm_network_interface.TACG-TMM-TF-CC2-NIC: Still creating... [10s elapsed] azurerm_network_interface.TACG-TMM-TF-CC2-NIC: Creation complete after 12s [id=/subscriptions/.../Microsoft.Network/networkInterfaces/TFT-az-aeast-CC2-NIC] azurerm_network_interface_security_group_association.TACG-TMM-TF-CC2-NICNSG: Creating... azurerm_network_interface.TACG-TMM-TF-CC1-NIC: Still creating... [20s elapsed] azurerm_network_interface_security_group_association.TACG-TMM-TF-CC2-NICNSG: Still creating... [10s elapsed] azurerm_network_interface.TACG-TMM-TF-CC1-NIC: Creation complete after 23s [id=/subscriptions/.../Microsoft.Network/networkInterfaces/TFT-az-aeast-CC1-NIC] azurerm_network_interface_security_group_association.TACG-TMM-TF-CC1-NICNSG: Creating... azurerm_network_interface_security_group_association.TACG-TMM-TF-CC2-NICNSG: Creation complete after 11s [id=/subscriptions/.../Microsoft.Network/networkInterfaces/TFT-az-aeast-CC2-NIC|/subscriptions/...Microsoft.Network/networkSecurityGroups/AZ-aeast-GK-nsg] azurerm_windows_virtual_machine.TACG-TMM-CC2: Creating... azurerm_network_interface_security_group_association.TACG-TMM-TF-CC1-NICNSG: Still creating... [10s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC2: Still creating... [10s elapsed] azurerm_network_interface_security_group_association.TACG-TMM-TF-CC1-NICNSG: Creation complete after 11s [id=/subscriptions/.../Microsoft.Network/networkInterfaces/TFT-az-aeast-CC1-NIC|/subscriptions/.../Microsoft.Network/networkSecurityGroups/AZ-aeast-GK-nsg] azurerm_windows_virtual_machine.TACG-TMM-CC1: Creating... azurerm_windows_virtual_machine.TACG-TMM-CC2: Still creating... [20s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC1: Still creating... [10s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC2: Still creating... [30s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC1: Still creating... [20s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC2: Still creating... [40s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC1: Still creating... [30s elapsed] ... azurerm_windows_virtual_machine.TACG-TMM-CC1: Still creating... [1m40s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC2: Still creating... [2m0s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC1: Still creating... [1m50s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC2: Creation complete after 2m5s [id=/subscriptions/.../Microsoft.Compute/virtualMachines/TFT-az-aeast-CC2] azurerm_windows_virtual_machine.TACG-TMM-CC1: Still creating... [2m0s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC1: Creation complete after 2m3s [id=/subscriptions/.../Microsoft.Compute/virtualMachines/TFT-az-aeast-CC1] Apply complete! Resources: 6 added, 0 changed, 0 destroyed. PS C:\TMM\CreateVMs>Terraform successfully created the two Cloud Connector Virtual Machines. Now, the next step can be started. Part 4: Putting the 2 Cloud Connector VMs Into the Active Directory DomainTerraform now puts the just-created 2 Cloud Connector VMs into the Active Directory Domain. Not all Terraform Providers have this ability, so we decided to show a Terraform Provider-agnostic way—we use an Ansible Playbook for this step. Schematic overview: Terraform calls Ansible and the corresponding Ansible Playbook directly from its code snippet. Important Ensure flawless communication between Terraform and the Ansible Control Server. You can find more information about the communication flow, its configuration, and its importance in the first part of the Citrix Automation Handbook. The Ansible Playbook is written in YAML and contains all the necessary Information for joining the VMs into the Active Directory Domain - for example: --- - name: join cc1 host to domain with automatic reboot hosts: cloudconnector1-ip tasks: - name: join cc1 host to domain with automatic reboot microsoft.ad.membership: dns_domain_name: wwco.net hostname: az-weur-tf-cc1 domain_admin_user: XXXX@XXXX.XXX domain_admin_password: "XxXxXxXxXxXxXxXxX” domain_ou_path: "OU=Infra,OU=WestEUR,OU=Azure,OU=Cloud,OU=Compute,DC=wwco,DC=net" state: domain reboot: falseThe configuration can be started by following the standard Terraform workflow: # Create a Citrix Cloud Resource Location and DaaS Deployment ## Create Pre-requisites ### We are using existing entitites like the Resource Group, NSGs, Firewall Rules, etc #### Call Ansible to Join VM to Domain ##### Copy Ansible Playbooks to Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyPlaybookForCC1ToAnsibleServer" { connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP1 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "file" { source = var.TACG-TMM-Ansible-Playbook-CC1-Source destination = var.TACG-TMM-Ansible-Playbook-CC1-Destination } } resource "null_resource" "CopyPlaybookForCC2ToAnsibleServer" { connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP2 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "file" { source = var.TACG-TMM-Ansible-Playbook-CC2-Source destination = var.TACG-TMM-Ansible-Playbook-CC2-Destination } } ##### Connect to Ansible Interpreter and Add CC1 To Domain resource "null_resource" "AddCC1ToDomain" { depends_on = [ null_resource.CopyPlaybookForCC1ToAnsibleServer ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP1 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "remote-exec" { inline = var.TACG-TMM-Ansible-CMDForCC1 } } ##### Connect to Ansible Interpreter and Add CC2 To Domain resource "null_resource" "AddCC2ToDomain" { depends_on = [ null_resource.CopyPlaybookForCC2ToAnsibleServer ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP2 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "remote-exec" { inline = var.TACG-TMM-Ansible-CMDForCC2 } }Running the Terraform snippet puts the VMs into the domain: PS C:\TMM\UseAnsibleToJoinDomain> terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # null_resource.AddCC1ToDomain will be created + resource "null_resource" "AddCC1ToDomain" { + id = (known after apply) } # null_resource.AddCC2ToDomain will be created + resource "null_resource" "AddCC2ToDomain" { + id = (known after apply) } # null_resource.CopyPlaybookForCC1ToAnsibleServer will be created + resource "null_resource" "CopyPlaybookForCC1ToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPlaybookForCC2ToAnsibleServer will be created + resource "null_resource" "CopyPlaybookForCC2ToAnsibleServer" { + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPlaybookForCC1ToAnsibleServer: Creating... null_resource.CopyPlaybookForCC2ToAnsibleServer: Creating... null_resource.CopyPlaybookForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybookForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybookForCC2ToAnsibleServer: Creation complete after 1s [id=1021300872990083837] null_resource.AddCC2ToDomain: Creating... null_resource.AddCC2ToDomain: Provisioning with 'remote-exec'... null_resource.AddCC2ToDomain (remote-exec): Connecting to remote host via SSH... null_resource.AddCC2ToDomain (remote-exec): Host: 10.53.16.10 null_resource.AddCC2ToDomain (remote-exec): Port: 5986 null_resource.AddCC2ToDomain (remote-exec): User: svc_ansible null_resource.AddCC2ToDomain (remote-exec): Password: true null_resource.AddCC2ToDomain (remote-exec): HTTPS: true null_resource.AddCC2ToDomain (remote-exec): Insecure: false null_resource.AddCC2ToDomain (remote-exec): NTLM: false null_resource.AddCC2ToDomain (remote-exec): CACert: false null_resource.AddCC2ToDomain (remote-exec): SSH Agent: false null_resource.AddCC2ToDomain (remote-exec): Checking Host Key: false null_resource.AddCC2ToDomain (remote-exec): Target Platform: unix null_resource.AddCC2ToDomain (remote-exec): Connected! null_resource.CopyPlaybookForCC1ToAnsibleServer: Creation complete after 1s [id=4834864719047546946] null_resource.AddCC1ToDomain: Creating... null_resource.AddCC1ToDomain: Provisioning with 'remote-exec'... null_resource.AddCC1ToDomain (remote-exec): Connecting to remote host via SSH... null_resource.AddCC1ToDomain (remote-exec): Host: 10.53.16.10 null_resource.AddCC1ToDomain (remote-exec): Port: 5986 null_resource.AddCC1ToDomain (remote-exec): User: svc_ansible null_resource.AddCC1ToDomain (remote-exec): Password: true null_resource.AddCC1ToDomain (remote-exec): HTTPS: true null_resource.AddCC1ToDomain (remote-exec): Insecure: false null_resource.AddCC1ToDomain (remote-exec): NTLM: false null_resource.AddCC1ToDomain (remote-exec): CACert: false null_resource.AddCC1ToDomain (remote-exec): SSH Agent: false null_resource.AddCC2ToDomain (remote-exec): Checking Host Key: false null_resource.AddCC1ToDomain (remote-exec): Target Platform: unix null_resource.AddCC1ToDomain (remote-exec): Connected! null_resource.AddCC2ToDomain (remote-exec): Using /etc/ansible/ansible.cfg as config file null_resource.AddCC1ToDomain (remote-exec): Using /etc/ansible/ansible.cfg as config file null_resource.AddCC2ToDomain (remote-exec): PLAY [join host to domain with automatic reboot] ******************************* null_resource.AddCC2ToDomain (remote-exec): TASK [Gathering Facts] ********************************************************* null_resource.AddCC1ToDomain (remote-exec): PLAY [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain (remote-exec): TASK [Gathering Facts] ********************************************************* null_resource.AddCC2ToDomain (remote-exec): ok: [10.53.16.102] null_resource.AddCC2ToDomain (remote-exec): TASK [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain (remote-exec): ok: [10.53.16.101] null_resource.AddCC1ToDomain (remote-exec): TASK [join host to domain with automatic reboot] ******************************* null_resource.AddCC2ToDomain: Still creating... [10s elapsed] null_resource.AddCC1ToDomain: Still creating... [10s elapsed] null_resource.AddCC2ToDomain (remote-exec): changed: [10.53.16.102] => {"changed": true, "reboot_required": true} null_resource.AddCC2ToDomain (remote-exec): PLAY RECAP ********************************************************************* null_resource.AddCC2ToDomain (remote-exec): 10.53.16.102 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.AddCC2ToDomain: Creation complete after 15s [id=4528100002845834178] null_resource.AddCC1ToDomain (remote-exec): changed: [10.53.16.101] => {"changed": true, "reboot_required": true} null_resource.AddCC1ToDomain (remote-exec): PLAY RECAP ********************************************************************* null_resource.AddCC1ToDomain (remote-exec): 10.53.16.101 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.AddCC1ToDomain: Creation complete after 18s [id=2667672656305371565] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. PS C:\TMM\UseAnsibleToJoinDomain>Terraform successfully put the two Cloud Connector Virtual Machines into the domain. Now, the next step can be started. Part 5: Installing and Configuring the Cloud Connector SoftwareThis part installs and configures the Cloud Connector software and all required entities. It is split into the following configuration parts: Creating a new Resource Location and the adjacent Zone in Citrix Cloud Uploading the Cloud Connector software installer to the Cloud Connector VMs Dynamically creating the configuration file cwc.json based on the Resource Location- and Zone-Information, and uploading it to the Cloud Connector VMs Installing and configuring the Cloud Connector software using an Ansible Playbook Adding the Cloud Connectors to the newly created Resource Location Schematic overview: The Ansible Playbook is written in YAML and contains all the necessary information for deploying the Cloud Connector software - for example: --- - name: install citrix cloud connector hosts: cloudconnector1-ip tasks: - name: install citrix cloud connector ansible.windows.win_package: path: C:\temp\cwcconnector.exe product_id: CWCConnector.exe arguments: - /q - /ParametersFilePath:C:\temp\cwc.json state: present become: true become_method: runas become_user: SYSTEM Important In previous versions, the Terraform script would pause for some time after creating the Resource Location. This is due to time constraints on the back-end. The creation of the Zone related to the Resource Location takes some time—we have seen delays of up to 8 minutes before the Zone is created. The actual Terraform provider should handle that and wait until the creation is complete. The previous Wait commands are therefore commented out in the Terraform snippets. If you want them to be used, just remove the comments. Example: Terraform snippet for configuring the Cloud Connector VMs # Create a Citrix Cloud Resource Location and DaaS Deployment on Microsoft Azure V2 ## Create the Resource Location and install the Cloud Connectors create the Resource Location ### Set local variables and scripts #### Create a Resource Location in Citrix Cloud #### https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources ##### Set the values in the corresponding .auto.tfvars.json file resource "citrix_cloud_resource_location" "CreateCCRLInCC" { name = "${var.TACG-TMM-CC-RL-Name}" } #### Create a Zone in the just created Resource Location in Citrix Cloud resource "citrix_zone" "CreateZoneInCC" { depends_on = [ citrix_cloud_resource_location.CreateCCRLInCC ] resource_location_id = citrix_cloud_resource_location.CreateCCRLInCC.id } #### Wait 10mins until Background Processes have completed /* resource "time_sleep" "Wait10Minutes" { depends_on = [ citrix_zone.CreateZoneInCC ] create_duration = "600s" } */ resource "local_file" "WriteRLDataToFile" { # depends_on = [ time_sleep.Wait10Minutes ] content = citrix_cloud_resource_location.CreateCCRLInCC.id filename = "${path.module}/assets/RLData.txt" } resource "local_file" "WriteZoneDataToFile" { # depends_on = [ time_sleep.Wait10Minutes ] content = citrix_zone.CreateZoneInCC.id filename = "${path.module}/assets/ZoneData.txt" } #### Create JSON-file for Cloud Connector Installer resource "local_file" "CWC-Configuration" { # depends_on = [ time_sleep.Wait10Minutes ] content = jsonencode( { "customerName" = var.cc-customerid}", "clientId" = var.cc-apikey-clientId, "clientSecret" = var.cc-apikey-clientSecret, "resourceLocationId" = citrix_cloud_resource_location.CreateCCRLInCC.id "acceptTermsOfService" = true } ) filename = "${path.module}/assets/cwc.json" } #### Upload Cloud Connector Installer and Configuration file to CC1 ##### Set the Provisioner-Connection resource "null_resource" "UploadCCAndCWCToCC1" { depends_on = [ local_file.CWC-Configuration ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP1 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } ###### Upload Cloud Connector Configuration to CC1 provisioner "file" { source = "${path.module}/assets/cwc.json" destination = "C:/temp/cwc.json" } ###### Upload Cloud Connector Installer to CC1 provisioner "file" { source = "${path.module}/assets/cwcconnector.exe" destination = "C:/temp/cwcconnector.exe" } } #### Upload Cloud Connector Installer and Configuration file to CC2 ##### Set the Provisioner-Connection resource "null_resource" "UploadCCAndCWCToCC2" { depends_on = [ local_file.CWC-Configuration ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP2 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } ###### Upload Cloud Connector Configuration to CC2 provisioner "file" { source = "${path.module}/assets/cwc.json" destination = "C:/temp/cwc.json" } ###### Upload Cloud Connector Installer to CC2 provisioner "file" { source = "${path.module}/assets/cwcconnector.exe" destination = "C:/temp/cwcconnector.exe" } } ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyPlaybookForCC1ToAnsibleServer" { depends_on = [ null_resource.UploadCCAndCWCToCC1 ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP1 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "file" { source = var.TACG-TMM-Ansible-Playbook-CC1-Source destination = var.TACG-TMM-Ansible-Playbook-CC1-Destination } } resource "null_resource" "CopyPlaybookForCC2ToAnsibleServer" { depends_on = [ null_resource.UploadCCAndCWCToCC2 ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP2 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "file" { source = var.TACG-TMM-Ansible-Playbook-CC2-Source destination = var.TACG-TMM-Ansible-Playbook-CC2-Destination } } ##### Connect to Ansible Interpreter and Install CC on CC1 resource "null_resource" "InstallCCOnCC1" { depends_on = [ null_resource.CopyPlaybookForCC1ToAnsibleServer ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP1 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "remote-exec" { inline = var.TACG-TMM-Ansible-CMDForCC1 } } ##### Connect to Ansible Interpreter and and Install CC on CC2 resource "null_resource" "InstallCCOnCC2" { depends_on = [ null_resource.CopyPlaybookForCC2ToAnsibleServer ] connection { type = var.TACG-TMM-Ansible_Connection-Type user = var.TACG-TMM-Ansible_SecureAdmin-Username password = var.TACG-TMM-Ansible_SecureAdmin-Password host = var.TACG-TMM-Ansible_IP2 port = var.TACG-TMM-Ansible_Port https = var.TACG-TMM-Ansible_HTTPS timeout = var.TACG-TMM-Ansible_Timeout } provisioner "remote-exec" { inline = var.TACG-TMM-Ansible-CMDForCC2 } }Running this snippet creates the necessary entities in Citrix Cloud and configures the Cloud Connector VMs. Due to the length of the output during the process, it will be partially omitted below: XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployCCs$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_cloud_resource_location.CreateCCRLInCC will be created + resource "citrix_cloud_resource_location" "CreateCCRLInCC" { + id = (known after apply) + internal_only = false + name = "TF-Azure-WEUR" + time_zone = "GMT Standard Time" } # citrix_zone.CreateZoneInCC will be created + resource "citrix_zone" "CreateZoneInCC" { + description = (known after apply) + id = (known after apply) + name = (known after apply) + resource_location_id = (known after apply) } # local_file.CWC-Configuration will be created + resource "local_file" "CWC-Configuration" { + content = (sensitive value) + content_base64sha256 = (known after apply) + content_base64sha512 = (known after apply) + content_md5 = (known after apply) + content_sha1 = (known after apply) + content_sha256 = (known after apply) + content_sha512 = (known after apply) + directory_permission = "0777" + file_permission = "0777" + filename = "./assets/cwc.json" + id = (known after apply) } # local_file.WriteRLDataToFile will be created + resource "local_file" "WriteRLDataToFile" { + content = (known after apply) + content_base64sha256 = (known after apply) + content_base64sha512 = (known after apply) + content_md5 = (known after apply) + content_sha1 = (known after apply) + content_sha256 = (known after apply) + content_sha512 = (known after apply) + directory_permission = "0777" + file_permission = "0777" + filename = "./assets/RLData.txt" + id = (known after apply) } # local_file.WriteZoneDataToFile will be created + resource "local_file" "WriteZoneDataToFile" { + content = (known after apply) + content_base64sha256 = (known after apply) + content_base64sha512 = (known after apply) + content_md5 = (known after apply) + content_sha1 = (known after apply) + content_sha256 = (known after apply) + content_sha512 = (known after apply) + directory_permission = "0777" + file_permission = "0777" + filename = "./assets/ZoneData.txt" + id = (known after apply) } # null_resource.CopyPlaybookForCC1ToAnsibleServer will be created + resource "null_resource" "CopyPlaybookForCC1ToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPlaybookForCC2ToAnsibleServer will be created + resource "null_resource" "CopyPlaybookForCC2ToAnsibleServer" { + id = (known after apply) } # null_resource.InstallCCOnCC1 will be created + resource "null_resource" "InstallCCOnCC1" { + id = (known after apply) } # null_resource.InstallCCOnCC2 will be created + resource "null_resource" "InstallCCOnCC2" { + id = (known after apply) } # null_resource.UploadCCAndCWCToCC1 will be created + resource "null_resource" "UploadCCAndCWCToCC1" { + id = (known after apply) } # null_resource.UploadCCAndCWCToCC2 will be created + resource "null_resource" "UploadCCAndCWCToCC2" { + id = (known after apply) } # time_sleep.Wait10Minutes will be created + resource "time_sleep" "Wait10Minutes" { + create_duration = "600s" + id = (known after apply) } Plan: 12 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_cloud_resource_location.CreateCCRLInCC: Creating... citrix_cloud_resource_location.CreateCCRLInCC: Creation complete after 3s [id=ba22XXXX-XXXX-XXXX-XXXX-XXXXXXXXa7c6] citrix_zone.CreateZoneInCC: Creating... citrix_zone.CreateZoneInCC: Still creating... [00m10s elapsed] citrix_zone.CreateZoneInCC: Still creating... [00m20s elapsed] ... citrix_zone.CreateZoneInCC: Still creating... [01m50s elapsed] citrix_zone.CreateZoneInCC: Still creating... [02m00s elapsed] citrix_zone.CreateZoneInCC: Creation complete after 2m3s [id=4b16XXXX-XXXX-XXXX-XXXX-XXXXXXXX2623] time_sleep.Wait10Minutes: Creating... time_sleep.Wait10Minutes: Still creating... [00m10s elapsed] time_sleep.Wait10Minutes: Still creating... [00m20s elapsed] ... time_sleep.Wait10Minutes: Still creating... [09m50s elapsed] time_sleep.Wait10Minutes: Still creating... [10m00s elapsed] time_sleep.Wait10Minutes: Creation complete after 10m0s [id=2025-10-14T12:07:31Z] local_file.WriteZoneDataToFile: Creating... local_file.WriteRLDataToFile: Creating... local_file.WriteZoneDataToFile: Creation complete after 0s [id=843500af8ed08f26e10bfd8cecb070de73223227] local_file.CWC-Configuration: Creating... local_file.WriteRLDataToFile: Creation complete after 1s [id=f4b71055fe71f40a2c3c177871fd686bc6e276c2] local_file.CWC-Configuration: Creation complete after 1s [id=3b27a001ebb3f6e16b9762acbde333fdf4521a6b] null_resource.UploadCCAndCWCToCC1: Creating... null_resource.UploadCCAndCWCToCC2: Creating... null_resource.UploadCCAndCWCToCC1: Provisioning with 'file'... null_resource.UploadCCAndCWCToCC2: Provisioning with 'file'... #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 null_resource.UploadCCAndCWCToCC1: Provisioning with 'file'... #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 null_resource.UploadCCAndCWCToCC2: Provisioning with 'file'... null_resource.UploadCCAndCWCToCC2: Still creating... [00m10s elapsed] null_resource.UploadCCAndCWCToCC1: Still creating... [00m10s elapsed] ... null_resource.UploadCCAndCWCToCC1: Still creating... [20m20s elapsed] null_resource.UploadCCAndCWCToCC2: Still creating... [20m20s elapsed] #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 null_resource.UploadCCAndCWCToCC2: Creation complete after 20m25s [id=6362997336651914450] null_resource.CopyPlaybookForCC2ToAnsibleServer: Creating... null_resource.CopyPlaybookForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybookForCC2ToAnsibleServer: Creation complete after 1s [id=7075206156614440554] null_resource.InstallCCOnCC2: Creating... null_resource.InstallCCOnCC2: Provisioning with 'remote-exec'... null_resource.InstallCCOnCC2 (remote-exec): Connecting to remote host via SSH... null_resource.InstallCCOnCC2 (remote-exec): Host: 10.53.16.10 ... null_resource.InstallCCOnCC2 (remote-exec): Connected! ... null_resource.InstallCCOnCC2 (remote-exec): PLAY [install Citrix Cloud Connector™] ****************************************** null_resource.InstallCCOnCC2 (remote-exec): TASK [Gathering Facts] ********************************************************* null_resource.UploadCCAndCWCToCC1: Still creating... [20m30s elapsed] null_resource.InstallCCOnCC2 (remote-exec): ok: [10.53.16.102] null_resource.InstallCCOnCC2 (remote-exec): TASK [install citrix cloud connector] ****************************************** null_resource.InstallCCOnCC2: Still creating... [00m10s elapsed] null_resource.UploadCCAndCWCToCC1: Still creating... [20m40s elapsed] null_resource.InstallCCOnCC2: Still creating... [00m20s elapsed] null_resource.UploadCCAndCWCToCC1: Still creating... [20m50s elapsed] null_resource.InstallCCOnCC2: Still creating... [00m30s elapsed] null_resource.UploadCCAndCWCToCC1: Still creating... [21m00s elapsed] null_resource.InstallCCOnCC2: Still creating... [00m40s elapsed] null_resource.UploadCCAndCWCToCC1: Still creating... [21m10s elapsed] null_resource.InstallCCOnCC2: Still creating... [00m50s elapsed] null_resource.UploadCCAndCWCToCC1: Still creating... [21m20s elapsed] null_resource.InstallCCOnCC2: Still creating... [01m00s elapsed] null_resource.InstallCCOnCC2 (remote-exec): changed: [10.53.16.102] => {"changed": true, "checksum": "28D0D0F2A545E18A4271850FA21B62A51DA6C62A", "rc": 0, "reboot_required": false} null_resource.InstallCCOnCC2 (remote-exec): PLAY RECAP ********************************************************************* null_resource.InstallCCOnCC2 (remote-exec): 10.53.16.102 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.InstallCCOnCC2: Creation complete after 1m1s [id=8928953023351995099] #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 #< CLIXML System.Management.Automation.PSCustomObjectSystem.Object1Preparing modules for first use.0-1-1Completed-1 null_resource.UploadCCAndCWCToCC1: Creation complete after 21m28s [id=4106024715508474007] null_resource.CopyPlaybookForCC1ToAnsibleServer: Creating... null_resource.CopyPlaybookForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybookForCC1ToAnsibleServer: Creation complete after 1s [id=1082050735244950664] null_resource.InstallCCOnCC1: Creating... null_resource.InstallCCOnCC1: Provisioning with 'remote-exec'... null_resource.InstallCCOnCC1 (remote-exec): Connecting to remote host via SSH... null_resource.InstallCCOnCC1 (remote-exec): Host: 10.53.16.10 ... null_resource.InstallCCOnCC1 (remote-exec): Connected! null_resource.InstallCCOnCC1 (remote-exec): PLAY [install citrix cloud connector] ****************************************** null_resource.InstallCCOnCC1 (remote-exec): TASK [Gathering Facts] ********************************************************* null_resource.InstallCCOnCC1 (remote-exec): ok: [10.53.16.101] null_resource.InstallCCOnCC1 (remote-exec): TASK [install citrix cloud connector] ****************************************** null_resource.InstallCCOnCC1: Still creating... [00m10s elapsed] null_resource.InstallCCOnCC1: Still creating... [00m20s elapsed] null_resource.InstallCCOnCC1: Still creating... [00m30s elapsed] null_resource.InstallCCOnCC1: Still creating... [00m40s elapsed] null_resource.InstallCCOnCC1: Still creating... [00m50s elapsed] null_resource.InstallCCOnCC1 (remote-exec): changed: [10.53.16.101] => {"changed": true, "checksum": "28D0D0F2A545E18A4271850FA21B62A51DA6C62A", "rc": 0, "reboot_required": false} null_resource.InstallCCOnCC1 (remote-exec): PLAY RECAP ********************************************************************* null_resource.InstallCCOnCC1 (remote-exec): 10.53.16.101 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.InstallCCOnCC1: Creation complete after 57s [id=96612861702981347] Apply complete! Resources: 12 added, 0 changed, 0 destroyed. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployCCs$Terraform has successfully created the Resource Location, the Zone, and deployed and configured the 2 Cloud Connectors: Now, the next step can begin: creating the first Citrix DaaS entity, the Hypervisor Connection and Resource Pool. Part 6: Creating the Hypervisor Connection and Hypervisor Resource PoolThe next step is to configure the Hypervisor Connection and the corresponding Hypervisor Resource Pool. Important There are many ways to create the Hypervisor Connection and the Hypervisor Resource Pool using Terraform, as Citrix Cloud supports multiple connections to different Hypervisors and Hyperscalers. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for other examples. The example below is the most requested by customers: creating entities in Azure. Example: Terraform snippet to create a Hypervisor connection to Azure and to create the adjacent Resource Pool # Create a Citrix Cloud Resource Location and DaaS Deployment on Microsoft Azure ## Create all relevant Citrix Cloud Entities ### Set local variables and scripts locals {} ### Get existing entity data #### Retrieving the ZoneID data "citrix_zone" "GetTFAzureZoneID" { name = var.CC-Azure-ZoneID } #### Creating the Hypervisor Connection #### https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources ##### Set the values in the corresponding .auto.tfvars.json file resource "citrix_azure_hypervisor" "CreateAzureHostingConnection" { depends_on = [ data.citrix_zone.GetTFAzureZoneID ] name = var.CC-Azure-HypConn-Name zone = data.citrix_zone.GetTFAzureZoneID.id active_directory_id = var.azurerm-tenantid subscription_id = var.azurerm-subscriptionid application_secret = var.azurerm-clientsecret application_id = var.azurerm-clientid #scopes = var.CC-GetScopeToBeUsed-Names } #### Sleep 30s to let Background processes settle resource "time_sleep" "wait_30_seconds" { depends_on = [ citrix_azure_hypervisor.CreateAzureHostingConnection ] create_duration = "30s" } #### Creating the Hypervisor Resource Pool #### https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources ##### Set the values in the corresponding .auto.tfvars.json file resource "citrix_azure_hypervisor_resource_pool" "CreateAzureHostingConnectionPool" { depends_on = [ time_sleep.wait_30_seconds] name = var.CC-Azure-HypConn-Name hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id region = var.TACG-TMM-ResourceGroup-Location virtual_network_resource_group = var.TACG-TMM-ResourceGroup-Name virtual_network = var.CC-Azure-VNet-Name subnets = var.CC-Azure-Subnets } #### Sleep 30s to let Background processes settle resource "time_sleep" "wait_30_seconds1" { depends_on = [ citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool ] create_duration = "30s" } Running the snippet creates the wanted entities. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployCItrixCloudEntitites$ terraform apply data.citrix_zone.GetTFAzureZoneID: Reading... data.citrix_zone.GetTFAzureZoneID: Read complete after 0s [id=4b16XXXX-XXXX-XXXX-XXXX-XXXXXXXX2623] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_azure_hypervisor.CreateAzureHostingConnection will be created + resource "citrix_azure_hypervisor" "CreateAzureHostingConnection" { + active_directory_id = (sensitive value) + application_id = (sensitive value) + application_secret = (sensitive value) + authentication_mode = "AppClientSecret" + enable_azure_ad_device_management = false + id = (known after apply) + name = "TF-HC-TMM-Azure-WEUR-HypConn" + proxy_hypervisor_traffic_through_connector = false + scopes = [] + subscription_id = (sensitive value) + tenants = (known after apply) + zone = "4b16XXXX-XXXX-XXXX-XXXX-XXXXXXXX2623" } # citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool will be created + resource "citrix_azure_hypervisor_resource_pool" "CreateAzureHostingConnectionPool" { + hypervisor = (known after apply) + id = (known after apply) + name = "TF-HC-TMM-Azure-WEUR-HypConn" + region = "westeurope" + subnets = [ + "West-EUR-1-sn", ] + virtual_network = "West-EUR-vnet" + virtual_network_resource_group = "TMM-TF-WEUR" + vm_tagging = true } # time_sleep.wait_30_seconds will be created + resource "time_sleep" "wait_30_seconds" { + create_duration = "30s" + id = (known after apply) } # time_sleep.wait_30_seconds1 will be created + resource "time_sleep" "wait_30_seconds1" { + create_duration = "30s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Changes to Outputs: + hypconnname = (known after apply) + hypname = (known after apply) Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_azure_hypervisor.CreateAzureHostingConnection: Creating... citrix_azure_hypervisor.CreateAzureHostingConnection: Still creating... [00m10s elapsed] ... citrix_azure_hypervisor.CreateAzureHostingConnection: Still creating... [01m10s elapsed] citrix_azure_hypervisor.CreateAzureHostingConnection: Creation complete after 1m12s [id=f183XXXX-XXXX-XXXX-XXXX-XXXXXXXX4de9] time_sleep.wait_30_seconds: Creating... time_sleep.wait_30_seconds: Still creating... [00m10s elapsed] time_sleep.wait_30_seconds: Still creating... [00m20s elapsed] time_sleep.wait_30_seconds: Still creating... [00m30s elapsed] time_sleep.wait_30_seconds: Creation complete after 30s [id=2025-10-14T15:22:18Z] citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool: Creating... citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool: Still creating... [00m10s elapsed] ... citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool: Still creating... [01m30s elapsed] citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool: Creation complete after 1m36s [id=828bXXXX-XXXX-XXXX-XXXX-XXXXXXXX860d] time_sleep.wait_30_seconds1: Creating... time_sleep.wait_30_seconds1: Still creating... [00m10s elapsed] time_sleep.wait_30_seconds1: Still creating... [00m20s elapsed] time_sleep.wait_30_seconds1: Still creating... [00m30s elapsed] time_sleep.wait_30_seconds1: Creation complete after 30s [id=2025-10-14T15:24:23Z] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployCItrixCloudEntitites$The Hypervisor Connection and the Hypervisor Resource Pool were successfully created. Tip We recommend running health checks during the first few runs to ensure the snippets and their adjacent entities are working as intended before proceeding to the next modules. We can now proceed to the next step. Part 7: Creating a Machine Catalog on AzureThe next step is to create a Machine Catalog in Azure based on the image version we created earlier. If you follow this approach, it is easy to update the Machine Catalog with a new version of the image - you only need to change the appropriate variable in the Terraform snippet. Important There are many ways to create the Machine Catalog using Terraform. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/blob/main/docs/resources/machine_catalog.md for other examples. The example below is the most requested by customers: creating entities in Azure. Example: Terraform snippet to create a Machine Catalog in Azure based on the Packer-generated Master Image stored in the Azure Shared Image Gallery # Create a Citrix Cloud Resource Location and DaaS Deployment on Microsoft Azure ## Create all relevant Citrix Cloud Entities ### Set local variables and scripts locals {} ### Get existing entity data #### Retrieving the ZoneID data "citrix_zone" "GetTFAzureZoneID" { name = var.CC-Azure-ZoneID } #### Retrieving the Shared Image Gallery data "azurerm_shared_image_gallery" "GetAzureSIG" { name = var.CC-Azure-SIG-Name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Retrieving the Shared Image Definition data "azurerm_shared_image" "GetAzureSIGDefinition" { name = var.CC-Azure-SIGDefinition-Name gallery_name = data.azurerm_shared_image_gallery.GetAzureSIG.name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Retrieving the Shared Image Definition Version data "azurerm_shared_image_version" "GetAzureSIGDefinitionVersion" { name = var.CC-Azure-SIGDefinitionVersion image_name = data.azurerm_shared_image.GetAzureSIGDefinition.name gallery_name = data.azurerm_shared_image_gallery.GetAzureSIG.name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Retrieving the Hypervisor Connection data "citrix_hypervisor" "CreateAzureHostingConnection" { name = var.CC-Azure-HypConn-Name } #### Retrieving the Hypervisor Resource Pool data "citrix_hypervisor_resource_pool" "CreateAzureHostingConnectionPool" { name = var.CC-Azure-HypConnPool-Name hypervisor_name = data.citrix_hypervisor.CreateAzureHostingConnection.name } #### Sleep 30s to let Background processes settle resource "time_sleep" "wait_30_seconds1" { create_duration = "30s" } #### Creating the Machine Catalog resource "citrix_machine_catalog" "CreateAzureMCSCatalog" { depends_on = [ time_sleep.wait_30_seconds1 ] name = var.CC-Azure-MC-Name description = var.CC-Azure-MC-Description allocation_type = var.CC-Azure-MC-AllocationType session_support = var.CC-Azure-MC-SessionType provisioning_type = "MCS" zone = data.citrix_zone.GetTFAzureZoneID.id provisioning_scheme = { hypervisor = data.citrix_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = data.citrix_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id identity_type = var.CC-Azure-MC-IDPType machine_domain_identity = { domain = var.CC-Azure-MC-Domain domain_ou = var.CC-Azure-MC-DomainOU service_account = var.CC-Azure-MC-DomainAdmin-Username-UPN service_account_password = var.CC-Azure-MC-DomainAdmin-Password } azure_machine_config = { storage_type = "Standard_LRS" use_managed_disks = true service_offering = var.CC-Azure-MC-VMSize azure_master_image = { resource_group = var.TACG-TMM-ResourceGroup-Name gallery_image = { gallery = data.azurerm_shared_image_gallery.GetAzureSIG.name definition = data.azurerm_shared_image.GetAzureSIGDefinition.name version = data.azurerm_shared_image_version.GetAzureSIGDefinitionVersion.name } } } number_of_total_machines = var.CC-Azure-MC-VMNumbers machine_account_creation_rules = { naming_scheme = var.CC-Azure-MC-NamingScheme-Name naming_scheme_type = var.CC-Azure-MC-NamingScheme-Type } } }Running the Terraform snippet creates the Machine Catalog: XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployMCS$ terraform apply data.citrix_zone.GetTFAzureZoneID: Reading... data.citrix_hypervisor.CreateAzureHostingConnection: Reading... data.citrix_hypervisor.CreateAzureHostingConnection: Read complete after 0s [id=f183XXXX-XXXX-XXXX-XXXXXXXX4de9] data.citrix_hypervisor_resource_pool.CreateAzureHostingConnectionPool: Reading... data.citrix_hypervisor_resource_pool.CreateAzureHostingConnectionPool: Read complete after 0s [id=828bXXXX-XXXX-XXXX-XXXX-XXXXXXXX860d] data.citrix_zone.GetTFAzureZoneID: Read complete after 0s [id=4b16XXXX-XXXX-XXXX-XXXX-XXXXXXXX860d2623] data.azurerm_shared_image_gallery.GetAzureSIG: Reading... ... Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: ... Plan: 2 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes time_sleep.wait_30_seconds1: Creating... time_sleep.wait_30_seconds1: Still creating... [00m10s elapsed] time_sleep.wait_30_seconds1: Still creating... [00m20s elapsed] time_sleep.wait_30_seconds1: Still creating... [00m30s elapsed] time_sleep.wait_30_seconds1: Creation complete after 30s [id=2025-10-23T11:22:35Z] citrix_machine_catalog.CreateAzureMCSCatalog: Creating... citrix_machine_catalog.CreateAzureMCSCatalog: Still creating... [00m10s elapsed] ... citrix_machine_catalog.CreateAzureMCSCatalog: Still creating... [10m40s elapsed] citrix_machine_catalog.CreateAzureMCSCatalog: Creation complete after 10m42s [id=a283XXXX-XXXX-XXXX-XXXX-XXXXXXXX860d424e] Apply complete! Resources: 2 added, 0 changed, 0 destroyed. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployMCs$The Machine Catalog based on an Azure Shared Image was successfully created. Important To change the base image of the Machine Catalog, update the variable that sets the image version – assuming that the image definition is the same: var.CC-Azure-SIGDefinitionVersion To change the number of machines in the Machine Catalog, update the variable that sets the number: number_of_total_machines = var.CC-Azure-MC-VMNumbers You can find more information about daily administrative tasks such as changes of the master image in the third part of the Citrix Automation Handbook. Tip We recommend running health checks during the first few runs to ensure the snippets and their adjacent entities are working as intended before proceeding to the next modules. We can now proceed to the next step. Part 8: Creating a Delivery GroupThe next step is to create a Delivery Group based on the just-created Machine Catalog. Important There are many ways to create the Delivery Group using Terraform. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/blob/main/docs/resources/delivery_group.md for other examples. The example below is the most requested by customers: creating entities in Azure. Example: Terraform snippet to create a Delivery Group based on the Machine Catalog created earlier: # Create a Citrix Cloud Resource Location and DaaS Deployment on Microsoft Azure2 ## Create all relevant Citrix Cloud Entities ### Set local variables and scripts locals {} ### Get existing entity data #### Retrieving the Machine Catalog data "citrix_machine_catalog" "MCS" { name = var.CC-Azure-MC-Name } #### Create the Delivery Group based on the Machine Catalog resource "citrix_delivery_group" "TACG-TMM-DG" { depends_on = [citrix_machine_catalog.MCS] name = var.TACG-TMM-DG-Name description = var.TACG-TMM-DG-Description minimum_functional_level = var.TACG-TMM-DG-FunctionalLevel associated_machine_catalogs = [ { machine_catalog = data.citrix_machine_catalog.MCS.id machine_count = var.TACG-TMM-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-DG-Desktops-Name description = var.TACG-TMM-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-DG-Desktops-AllowList } enabled = var.TACG-TMM-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC # enable_session_roaming = var.TACG-TMM-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM--DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-DG-AS-Days display_name = var.TACG-TMM-DG-AS-Name peak_time_ranges = var.TACG-TMM-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-DG-RS-Enabled frequency = var.TACG-TMM-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-DG-RS-RebootDays start_time = var.TACG-TMM-DG-RS-RebootStartTime start_date = var.TACG-TMM-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-DG-RS-Notification-MessageRepeat #} } ] }Running this snippet creates the Delivery Group based on the Machine Catalog. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployDG$ terraform apply data.citrix_machine_catalog.MCS: Reading... data.citrix_machine_catalog.MCS: Read complete after 1s [id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX] ... Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_delivery_group.CreateDG will be created + resource "citrix_delivery_group" "TACG-TMM-DG" { + associated_machine_catalogs = [ + { + machine_catalog = "a283XXXX-XXXX-XXXX-XXXX-XXXXXXXX424e" + machine_count = 10 }, ] + autoscale_settings = { ... Plan: 1 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_delivery_group.TACG-TMM-DG: Creating... citrix_delivery_group.TACG-TMM-DG: Still creating... [00m10s elapsed] citrix_delivery_group.TACG-TMM-DG: Still creating... [00m20s elapsed] citrix_delivery_group.TACG-TMM-DG: Still creating... [00m30s elapsed] citrix_delivery_group.TACG-TMM-DG: Creation complete after 39s [id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX] Apply complete! Resources: 1 added, 0 changed, 0 destroyed. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployDG$The Delivery Group was successfully created. Important To change the number of machines in the Delivery Group, update the variable that sets the number: machine_count = var.TACG-TMM-MC-VM-NumberOfVMs You can find more information about daily administrative tasks such as changes of the master image in the third part of the Citrix Automation Handbook. Tip We recommend running health checks during the first few runs to ensure the snippets and their adjacent entities are working as intended before proceeding to the next modules. We can now proceed to the next step. Part 9: Creating Policy Sets, Scopes, and RolesThe next step is to create a policy set, scopes, and roles to allow more granular configuration of your DaaS environment. Important Please consult the product documentation at https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference.html or the Terraform provider documentation at https://github.com/citrix/terraform-provider-citrix/blob/main/internal/daas/policies/policy_set_resource.md#available-policy-settings for more information about the various policy settings. For more information about policy filters, consult the Terraform provider documentation at https://github.com/citrix/terraform-provider-citrix/blob/main/internal/daas/policies/policy_set_resource.md#available-policy-filters. Caution Please ensure your environment supports Policy Sets before creating them with Terraform. Example: Terraform snippet to create scopes, roles, and a policy set: # Create a Citrix Cloud Resource Location and DaaS Deployment # Terraform deployment of Scopes, Roles, and Policies ## Creating all Citrix Cloud-related entities ### Retrieve default Monitor Scope id for later use data "citrix_admin_scope" "GetDefaultMonitorScope" { name = "All" } ### Retrieve Delivery Group ID for later use data "citrix_delivery_group" "TACG-TMM-DG" { name = var.CC-Azure-DG-Name } ### Creating Monitor examples #### Create an Monitor Scope example resource "citrix_admin_scope" "CreateMonitorScopeExample" { name = var.CreateMonitorScopeExample-Name description = var.CreateMonitorScopeExample-Description } #### Create an Monitor Role example resource "citrix_admin_role" "CreateMonitorRoleExample" { name = var.CreateMonitorRoleExample-Name description = var.CreateMonitorRoleExample-Description can_launch_manage = false can_launch_monitor = true permissions = [ "Applications_Read", "Catalog_Read", "DesktopGroup_Read", "Director_Alerts_Read", "Director_ClientDetails_Read", "Director_ClientHelpDesk_Read", "Director_Dashboard_Read", "Director_HelpDesk_Read", "Director_MachineDetails_Read", "Director_Trends_Read", "Director_UserDetails_Read", "Hosts_Read", "Logging_Read", "Policies_Read", "Setting_Read", "Zone_Read" ] } #### Create a default Policy Set resource "citrix_policy_set_v2" "TACG-TMM-DefaultPolicySet" { depends_on = [data.citrix_delivery_group.TACG-TMM-DG] name = var.TACG-TMM-PS-Name description = var.TACG-TMM-PS-Description delivery_groups = [data.citrix_delivery_group.TACG-TMM-DG.id] } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-DefaultPolicySet-Printing" { depends_on = [citrix_policy_set_v2.TACG-TMM-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-DefaultPolicySet.id name = "Printing" description = "Example of Printer-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-DefaultPolicySet-HDX" { depends_on = [citrix_policy_set_v2.TACG-TMM-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-DefaultPolicySet.id name = "HDX Graphics" description = "Example of HDX Graphics-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-DefaultPolicySet-ClientDrives" { depends_on = [citrix_policy_set_v2.TACG-TMM-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-DefaultPolicySet.id name = "Client Drives" description = "Example of Client Drive-related policy in default Policy Set" enabled = true } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-Printing1" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id name = "ClientPrinterAutoCreation" value = "DefaultPrinterOnly" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-Printing2" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id name = "UniversalPrintDriverUsage" value = "FallbackToSpecific" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-HDX1" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id name = "AllowVisuallyLosslessCompression" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-HDX2" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id name = "UseVideoCodecForCompression" value = "UseVideoCodecIfPreferred" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-HDX3" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id name = "UseHardwareEncodingForVideoCodec" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD1" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "AutoConnectDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD2" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientDriveRedirection" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD3" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientFixedDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD4" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientFloppyDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD5" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientOpticalDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD6" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientNetworkDrives" enabled = false use_default = false } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-DefaultPolicySet-DGFilter-1" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id enabled = true allowed = true delivery_group_id = data.citrix_delivery_group.TACG-TMM-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-DefaultPolicySet-DGFilter-2" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id enabled = true allowed = true delivery_group_id = data.citrix_delivery_group.TACG-TMM-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-DefaultPolicySet-DGFilter-3" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id enabled = true allowed = true delivery_group_id = data.citrix_delivery_group.TACG-TMM-DG.id } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-DefaultPolicySet-SIDFilter-1" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id enabled = true allowed = true sid = var.TACG-TMM-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-DefaultPolicySet-SIDFilter-2" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id enabled = true allowed = true sid = var.TACG-TMM-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-DefaultPolicySet-SIDFilter-3" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id enabled = true allowed = true sid = var.TACG-TMM-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-DefaultPolicySet-ClientIPFilter-1" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id enabled = true allowed = true ip_address = var.TACG-TMM-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-DefaultPolicySet-ClientIPFilter-2" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id enabled = true allowed = true ip_address = var.TACG-TMM-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-DefaultPolicySet-ClientIPFilter-3" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id enabled = true allowed = true ip_address = var.TACG-TMM-PS-IPRange } resource "null_resource" "WriteProgress5" { depends_on = [citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD1, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD2, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD3, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD4, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD5, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD6, citrix_policy_setting.TACG-TMM-DefaultPolicySet-HDX1, citrix_policy_setting.TACG-TMM-DefaultPolicySet-HDX2, citrix_policy_setting.TACG-TMM-DefaultPolicySet-HDX3, citrix_policy_setting.TACG-TMM-DefaultPolicySet-Printing1, citrix_policy_setting.TACG-TMM-DefaultPolicySet-Printing2] provisioner "local-exec" { command = "echo The default Policy Set and its policies and filters were successfully created..." } }Running the Terraform snippet creates all entities and assigns the Policy Set to the Delivery Group. The output is omitted due to its length. Part 10: Removing Citrix DaaS entities using TerraformWe have discussed mainly aspects of the CREATION of entities using Terraform. Finally, it is also most important to have an instrument to REMOVE entities created by Terraform. In Infrastructure‑as‑Code (IaC) environments, terraform destroy plays a critical role in ensuring clean deprovisioning, operational discipline, and compliance with governance. By design, Terraform manages infrastructure declaratively—meaning everything it creates is recorded in its state. Using terraform destroy ensures that all Terraform‑managed resources are removed consistently, predictably, and traceably, eliminating the risk of leaving unmanaged or “orphaned” cloud assets behind, and supports security hygiene by ensuring no unused compute, networking, or identity components remain. It also reduces cost leakage. Terraform logs, state history, and pipeline execution metadata provide a verifiable chain of custody for resource lifecycle events. Using terraform destroy creates explicit evidence showing: What was removed, When it was removed, and Who initiated the removal This is essential for audit frameworks such as ISO 27001, SOC 2, and internal IT controls. Example: Removing a Delivery Group You can simply remove the Delivery Group by uncommenting the respective code in your snippet - place the uncomment markers /* <------ place the marker here #### Create the Delivery Group based on the Machine Catalog resource "citrix_delivery_group" "TACG-TMM-DG" { depends_on = [citrix_machine_catalog.MCS] name = var.TACG-TMM-DG-Name description = var.TACG-TMM-DG-Description minimum_functional_level = var.TACG-TMM-DG-FunctionalLevel associated_machine_catalogs = [ { machine_catalog = data.citrix_machine_catalog.MCS.id machine_count = var.TACG-TMM-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-DG-Desktops-Name description = var.TACG-TMM-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-DG-Desktops-AllowList } enabled = var.TACG-TMM-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC # enable_session_roaming = var.TACG-TMM-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM--DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-DG-AS-Days display_name = var.TACG-TMM-DG-AS-Name peak_time_ranges = var.TACG-TMM-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-DG-RS-Enabled frequency = var.TACG-TMM-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-DG-RS-RebootDays start_time = var.TACG-TMM-DG-RS-RebootStartTime start_date = var.TACG-TMM-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-DG-RS-Notification-MessageRepeat #} } ] } */ <------ place the marker hereRunning the snippet would remove the Delivery Group: XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployDG$ terraform apply data.citrix_machine_catalog.MCS: Reading... data.citrix_machine_catalog.MCS: Read complete after 1s [id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX] ... Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: - destroy Terraform will perform the following actions: # citrix_delivery_group.CreateDG will be destroyed - resource "citrix_delivery_group" "TACG-TMM-DG" { - associated_machine_catalogs = [ - { - machine_catalog = "a283XXXX-XXXX-XXXX-XXXX-XXXXXXXX424e" -> null - machine_count = 10 -> null }, ] + autoscale_settings = { ... Plan: 0 to add, 0 to change, 1 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_delivery_group.TACG-TMM-DG: Destroying... citrix_delivery_group.TACG-TMM-DG: Destruction complete after 39s [id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX] Apply complete! Resources: 0 added, 0 changed, 1 destroyed. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployDG$Terraform has decommissioned the Delivery Group and its adjacent entities. That completes our example of using Infrastructure-as-Code for creating a Citrix DaaS Deployment on Azure. SummaryUsing Terraform can significantly streamline your workflow and improve efficiency: Automation: IaC automates repetitive tasks, such as provisioning and managing infrastructure. This reduces the need for manual intervention and minimizes the risk of human error. Consistency: Defining IaC ensures that your environments are consistent and reproducible. This is particularly useful for maintaining multiple environments, such as development, staging, and production. Scalability: IaC makes it easy to scale your infrastructure up or down based on demand. You can define your desired state, and Terraform will handle the necessary changes to achieve that state. Collaboration: IaC configurations can be stored in version control systems like Git, enabling team collaboration. Team members can review, comment on, and approve changes before they are applied. Visibility: IaC provides a clear and auditable record of changes to your infrastructure. This makes it easier to track changes, troubleshoot issues, and ensure compliance with organizational policies. Integration: IaCintegrates with various tools and services, such as CI/CD pipelines, monitoring systems, and configuration management tools. This allows you to create a seamless, automated workflow for managing your infrastructure. Cost Management: By automating resource provisioning and de-provisioning, Terraform helps you optimize resource usage and control costs. You can easily identify and eliminate unused or underutilized resources. That completes Part 5 of the Citrix Automation Handbook. In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we discuss common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4 In this part, we focus on: Creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. DisclaimerMost important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Packer, Terraform, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. Using all the provided code snippets is at your own risk – please read the disclaimer below for further information. EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action.

The Citrix Automation Handbook 2601 - Part 4

Wed, 21 Jan 2026 09:13:09 +0000

The Citrix Automation Handbook - Part 4In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we discuss common and special use cases, as well as complete deployment examples from the field. In this part, we focus on: Creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. Part 4 Creating a Citrix Virtual Apps and Desktops 2507 LTSR Deployment on XenServer 8.4In this example, we cover the usage of three distinct Infrastructure-as-Code (IaC) frameworks to deploy a Citrix Virtual Desktops™ 2507 LTSR-based deployment on a XenServer® 8.4 cluster. The instructions are divided into blocks that must be started in a specific, predetermined order. However, it is not necessary to start all blocks in one go—the dependencies on previous blocks are recorded at runtime, so essential time intervals or even execution pauses between the individual blocks are not a problem. All these blocks can, of course, be implemented in a CI/CD deployment – we will cover that aspect in a distinct example later in this handbook. Components and Frameworks usedLet´s have a short overview of all the components and frameworks used. XenServer 8.4For customers who want to virtualize Citrix workloads, XenServer delivers an affordable, straightforward hypervisor optimized for Citrix Virtual Apps™ and Desktops™ deployments. XenServer 8.4 is the most optimized hypervisor for running Citrix workloads, with features only available with Citrix and XenServer – relevant for this deployment guide are: IntelliCache™ MCS Read Cache You can find more information about XenServer 8 in its respective product documentation. Hashicorp TerraformTerraform is one of the most widely adopted Infrastructure-as-Code (IaC) platforms for provisioning and managing cloud and on-prem infrastructure at scale. Its declarative configuration model, strong ecosystem support, and provider-agnostic architecture make it a foundational tool for organizations seeking consistency, compliance, and operational maturity in their infrastructure lifecycle. Terraform relies on declarative code to define infrastructure in a predictable, reproducible manner. By representing compute, networking, storage, IAM, and platform services as version-controlled code artifacts, Terraform: Hashicorp PackerHashiCorp Packer is a foundational tool for organizations seeking to standardize, automate, and scale the creation of master images across multi-cloud and hybrid environments. As organizations increasingly adopt Infrastructure-as-Code (IaC) approaches, Packer provides a consistent, version-controlled, and repeatable way to build golden images aligned with modern DevOps and platform engineering practices. RedHat AnsibleMany organizations that have matured their Infrastructure-as-Code (IaC) practices increasingly require tooling that not only provisions infrastructure but also configures systems, applications, and operating environments in a controlled, repeatable manner. Ansible is a leading configuration management and automation platform that aligns naturally with IaC principles and complements provisioning tools such as Terraform, or cloud-native IaC engines. Its agentless architecture, declarative playbook model, and extensive ecosystem make it a strategic choice for enterprises seeking predictable, scalable, and compliant post-provision configuration. Ansible provides a declarative, idempotent configuration model that ensures systems converge to a desired state regardless of their current configuration. This makes it ideally suited for environments provisioned using IaC tools, Note You can find more information about the three frameworks and their importance in the first part of the Citrix Automation Handbook. You can find more information about XenServer 8 and its importance in an IaC deployment in the third part of the Citrix Automation Handbook. Better togetherTerraform and Ansible serve complementary roles in modern Infrastructure-as-Code (IaC) architectures. Terraform excels at provisioning infrastructure resources—compute, networks, storage, identity, and cloud services—while Ansible specializes in configuring and managing the software, applications, and operating system state on those resources once they are created. When combined, they form a robust, scalable, and fully automated delivery pipeline that allows organizations to provision secure, consistent environments and configure them in a modular, policy-driven manner. Terraform is primarily designed for infrastructure lifecycle management, while Ansible is engineered for post-provisioning configuration. This clean separation ensures: Terraform builds and destroys infrastructure predictably Ansible configures servers, middleware, application stacks, and OS settings Changes to infrastructure and configuration are maintained in distinct codebases, improving clarity and reducing risk IT can version, audit, and test both layers independently This division of responsibilities aligns with architectural patterns used in platform engineering and regulated environments, where infrastructure and system configuration often have separate compliance requirements. All needed Automation components were installed on an Ubuntu-based VM cluster. If all IaC frameworks reside on the same machine/cluster, communication between them is less error-prone. Caution Due to current limitations in Citrix StoreFront´s automation capabilities, you must run the automated deployment and configuration of Citrix StoreFront™ from a domain-joined Windows machine with Terraform installed. Communication Flow between Packer, Terraform, Ansible, and the Target MachinesAll communication between Terraform, Packer, and Ansible on the IaC-VM and the target VMs on the XenServer cluster uses SSH and WinRM. WinRM (Windows Remote Management) is a Microsoft protocol that enables remote management of Windows systems by allowing access to remote computers to perform management tasks. It is Microsoft's implementation of the WS-Management (Web Services Management Protocol) standard. It often uses SOAP (Simple Object Access Protocol) for communication over HTTP or HTTPS, using ports 5985 (HTTP) and 5986 (HTTPS) by default. WinRM provides the basis for remote management with PowerShell and is used for tasks such as running remote scripts, automating, configuring, and performing system inventory. Therefore, WinRM and SSH must be configured correctly. Important We emphasize ensuring the communication flow works as intended from the outset of the pre-domain-joined stage; otherwise, Terraform and Ansible will fail to configure the VMs. During the pre-domain-join stage, you can configure these settings using the local Group Policy Editor on the VM or in the autounattend.xml file as we do in our Packer scripts. After a successful domain join, you can set all relevant settings using GPOs. To provide maximum flexibility and a fallback mechanism, you can use both listeners - HTTP and HTTPS - but we recommend using the secure transport whenever and wherever possible. Note You can find more information about the communication flow, its configuration, and its importance in the first part of the Citrix Automation Handbook. Creation of the CVAD Environment using IaCAs already stated, the workflow is divided into blocks that must be started in a specific, predetermined order: Caution As already mentioned above, Module 9 - Using Terraform to create the StoreFront deployment and all its necessities, must be run on a Windows-based, domain-joined VM to be supported. This is due to limitations in StoreFront´s automation capabilities. Using Packer to create the Master Images In this IaC block, we use Packer to create the Master Images for the VDI machines and the Windows Servers. Using Terraform to create the needed VMs based on the Master Images Terraform will create these VMs: a. Two Windows Server 2025-based VMs for the Delivery Controllers b. One Windows Server 2025-based VM for the StoreFront™ server c. One Windows Server 2025-based VM for the WebStudio™ server d. One Windows 11-based VM as a VDI Worker Using Terraform and Ansible to configure the VMs Terraform and Ansible take further configuration steps: a. Change the IP addresses to known IPs b. Change the Ansible configuration file to reflect the IP changes c. Put the VMs into the AD domain Using Terraform and Ansible to deploy the Delivery Controllers Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the DDCs c. Install all required server roles and features before installing the DDCs d. Change some necessary registry settings Using Terraform and Ansible to deploy the StoreFront server Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the StoreFront server c. Install all required server roles and features before installing the StoreFront d. Change some necessary registry settings Using Terraform and Ansible to deploy the WebStudio server Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the WebStudio server c. Install all required server roles and features before installing the WebStudio server d. Change some necessary registry settings e. Configure WebStudio server as proxy for the DDCs Using Terraform and Ansible to change the SSL Bindings Terraform and Ansible take further configuration steps: a. Change the SSL bindings on all servers and listeners to achieve complete HTTPS communication Using Terraform and Ansible to create the CVAD site and all its necessities Terraform and Ansible take further configuration steps: a. Create all databases b. Create the site c. Add the second DDC to the site d. Configure additional site configurations e. Configure a dedicated Administrators group f. Configure the licensing Using Terraform to create the StoreFront deployment and all its necessities Terraform takes further configuration steps: a. Create the StoreFront deployment b. Create a StoreFront Authentication service c. Create a StoreFront Store service d. Create a StoreFront WebReceiver service Using Terraform to create all CVAD entities and all their necessities Terraform takes further configuration steps: a. Create a StoreFront Server object b. Create a Hypervisor connection c. Create a Hypervisor connection resource pool d. Create a Machine Catalog e. Create a Delivery Group f. Create a Policy Set and its policies Using Terraform to remove CVAD entities Note All Ansible playbooks are directly called from Terraform. Terraform stops the workflow if an error occurs by checking Ansible's return code. Important All shown Terraform codes, Ansible Playbooks, and PowerShell scripts are tailored exclusively for the specific environment used for this guide. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. Using all the provided code snippets is at your own risk – please read the disclaimer at the end of the document for further information. Terraform verifies the successful execution of each Ansible playbook. If an error occurs, Terraform will halt the deployment and write out the failed Playbook Example snippet: ##### Create Databases Start ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCDB" { depends_on = [null_resource.RunCreateDatabasePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { depends_on = [data.external.CheckAnsibleReturnCodeCDB] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCDB.result.found}\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } In this example, Terraform runs the Ansible playbook to create the CVAD databases. If an error occurs, Terraform writes an error message indicating that deploying the CVAD databases failed. You would find more information in the LogFile directory on the corresponding server. Terraform then stops the further execution of the snippets. Part 1: Using Packer to create the Master ImagesHashicorp Packer is our standard framework for creating, maintaining, and deploying Master Images using IaC. Caution XenServer currently lacks an official Packer plugin. We use an open-source Tech Preview plugin maintained by my Citrite colleagues Rody Kossen and Marshall Wu to showcase the feasibility of end-to-end IaC. You can find more about this TP on GitHub: https://github.com/xenserver/packer-plugin-xenserver/tree/feature-rodyk-revamp Use the plugin at your own risk – please read the disclaimer at the end of the document for further information. There is NO warranty that it will work as intended – we cannot provide any support. You can find a more thorough example of using a supported Packer deployment in our TechZone guide "Using Infrastructure-as-Code for deploying Citrix® Virtual Apps and Desktops™ 2507 LTSR on vSphere™ 8" or in the third part of the Citrix Automation Handbook. Example Packer HCL file for deploying a Windows Server 2025-VM on XenServer 8: packer { required_plugins { xenserver= { version = ">= v0.1.0" source = "github.com/xenserver/xenserver" } } } source "xenserver-iso" "XSTEST" { iso_checksum_type = "none" iso_name = var.os_iso_path sr_iso_name = var.sr_iso_name sr_name = var.sr_name tools_iso_name = var.tools_iso_name remote_host = var.remote_host remote_password = var.remote_password remote_username = var.remote_username vm_name = var.vm_name vm_description = var.vm_description vm_memory = var.memory disk_size = var.disksize vcpus = var.cpu cores_per_socket = var.cpu network_names = ["${var.virtual_network_name}"] firmware = var.firmware secure_boot = var.secure_boot vTPM = var.vtpm vgpu_profile = var.vgpu_profile clone_template = var.clone_template cd_files = ["W2K25AutoUnattendInclWinRM.xml"] ssh_username = var.ssh_username ssh_password = var.ssh_password ssh_wait_timeout = "60000s" boot_command = [ "" ] boot_wait = "1s" #Export Options format = "xva" keep_vm = "on_success" communicator = "winrm" winrm_insecure = true winrm_password = var.winrm_password winrm_timeout = "5m" winrm_use_ssl = false winrm_username = var.winrm_username } build { sources = ["xenserver-iso.windows"] provisioner "powershell" { inline = ["Write-Host 'Installing updates and XenServer Tools...'", "Start-Process msiexec.exe -ArgumentList '/i D:\\xensetup\\managementagentx64.msi /qn' -Wait”] } } In this example, we use a modified autounattend.xml file to configure the Windows VM during creation: 0 true 1 Primary 100 2 Primary true 1 1 true System NTFS 2 2 Windows NTFS C OnError /IMAGE/INDEX 1 0 2 Never true Packer Builder ExampleCorp WIN2025BASE UTC 1 cmd /c winrm quickconfig -quiet Enable WinRM 2 cmd /c winrm set winrm/config/service/auth @{Basic="true"} Enable Basic Auth 3 cmd /c winrm set winrm/config/service @{AllowUnencrypted="true"} Allow Unencrypted 4 cmd /c netsh advfirewall set allprofiles state off Disable Firewall 5 cmd /c winrm set winrm/config/client @{TrustedHosts="*"} Disable Firewall de-AT en-US en-US de-AT true Work 3 !XxXxXxXxXxXxXxXxX! true</PlainText> </AdministratorPassword> </UserAccounts> <AutoLogon> <Username>Administrator</Username> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> <Enabled>true</Enabled> <LogonCount>1</LogonCount> </AutoLogon> <FirstLogonCommands> </FirstLogonCommands> </component> </settings> <cpi:offlineImage cpi:source="wim://wimfile/install.wim#Windows Server 2025 SERVERSTANDARD" xmlns:cpi="urn:schemas-microsoft-com:cpi" /> </unattend>Running the Packer IaC snippet should create a XenServer XVA that can then be used as a Master Image. azadmin@tacg-cicd:~$ packer build packer-tmpl-w2k25-xs.pkr.hcl xenserver-iso.XSTEST: output will be in this color. ==> xenserver-iso.XSTEST: XAPI client session established ==> xenserver-iso.XSTEST: Retrieving ISO ==> xenserver-iso.XSTEST: Trying http://10.10.100.1/iso/windows_server_2025.iso ==> xenserver-iso.XSTEST: Trying http://10.10.100.1/iso/windows_server_2025.iso ==> xenserver-iso.XSTEST: http://10.10.100.1/iso/windows_server_2025.iso => C:\__PPMM\_PACKER\_XENSERVER\packer_cache\4282f11098333441b4a8c39028041a36490797cb ==> xenserver-iso.XSTEST: Creating CD disk... xenserver-iso.XSTEST: OSCDIMG 2.56 CD-ROM and DVD-ROM Premastering Utility xenserver-iso.XSTEST: Copyright (C) Microsoft, 1993-2012. All rights reserved. xenserver-iso.XSTEST: Licensed only for producing Microsoft authorized content. xenserver-iso.XSTEST: Scanning source tree xenserver-iso.XSTEST: Scanning source tree complete (1 files in 1 directories) xenserver-iso.XSTEST: Computing directory information complete xenserver-iso.XSTEST: Image file is 57344 bytes (before optimization) xenserver-iso.XSTEST: Writing 1 files in 1 directories to tmp/packer1625305315.iso xenserver-iso.XSTEST: Storage optimization saved 0 files, 0 bytes (0% of image) xenserver-iso.XSTEST: After optimization, image file is 57344 bytes xenserver-iso.XSTEST: Done. xenserver-iso.XSTEST: 100% complete xenserver-iso.XSTEST: Done copying paths from CD_dirs ==> xenserver-iso.XSTEST: Step: Upload VDI 'Packer-CD' ==> xenserver-iso.XSTEST: Step: Found SR for upload 'OpaqueRef:ed24af24-cd3e-4ed0-2303-d885e72a691a' ==> xenserver-iso.XSTEST: PUT 'https://10.10.119.1/import_raw_vdi?session_id=OpaqueRef%3A93b232ae-a9bf-8b83-bb54-9aaf7412b6ba&task_id=OpaqueRef%3A99d66110-5044-37b2-7b21-baa23c54d2e1&vdi=OpaqueRef%3A65a7da41-3aba-e5b1-d1f1-0e5f006286f4' ==> xenserver-iso.XSTEST: Attemping to find VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Step: Upload VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Step: Found SR for upload 'OpaqueRef:ed24af24-cd3e-4ed0-2303-d885e72a691a' ==> xenserver-iso.XSTEST: PUT 'https://10.10.119.1/import_raw_vdi?session_id=OpaqueRef%3A93b232ae-a9bf-8b83-bb54-9aaf7412b6ba&task_id=OpaqueRef%3Ac8d26e51-2289-49b5-5363-220848bb4b6c&vdi=OpaqueRef%3A4893a784-2514-12b3-20bf-9880fc5bf3be' ==> xenserver-iso.XSTEST: Step: Create Instance ==> xenserver-iso.XSTEST: Using the following SR for the VM: OpaqueRef:67690a5f-2856-f785-7cac-fb59728d7ef2 ==> xenserver-iso.XSTEST: Created instance '2d4f4efc-5a3d-d915-380c-f86b0108eabe' ==> xenserver-iso.XSTEST: Step: Start VM Paused ==> xenserver-iso.XSTEST: Step: Set SSH address to VM host IP ==> xenserver-iso.XSTEST: Set host SSH address to '10.10.119.1'. ==> xenserver-iso.XSTEST: Set host SSH port to 22. ==> xenserver-iso.XSTEST: Unpausing VM 2d4f4efc-5a3d-d915-380c-f86b0108eabe ==> xenserver-iso.XSTEST: Waiting 10s for boot... ==> xenserver-iso.XSTEST: Connecting to VNC over XAPI... xenserver-iso.XSTEST: Making HTTP request to initiate VNC connection: CONNECT /console?uuid=6e861319-fb00-a8c8-d607-615b6c4561fe HTTP/1.0 xenserver-iso.XSTEST: Host: 10.10.119.1 xenserver-iso.XSTEST: Cookie: session_id=OpaqueRef:93b232ae-a9bf-8b83-bb54-9aaf7412b6ba xenserver-iso.XSTEST: xenserver-iso.XSTEST: xenserver-iso.XSTEST: Received response: HTTP/1.1 200 OK xenserver-iso.XSTEST: Connection: keep-alive xenserver-iso.XSTEST: Cache-Control: no-cache, no-store xenserver-iso.XSTEST: xenserver-iso.XSTEST: xenserver-iso.XSTEST: Found local IP: 10.10.11.99 ==> xenserver-iso.XSTEST: Typing boot commands over VNC... ==> xenserver-iso.XSTEST: Step: Wait for VMs IP to become known to us. ==> xenserver-iso.XSTEST: Successfully installed ==> xenserver-iso.XSTEST: Destroying VDI ==> xenserver-iso.XSTEST: Destroyed VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Destroyed VDI 'Packer-CD' ==> xenserver-iso.XSTEST: Deleting output directory... ==> xenserver-iso.XSTEST: Closing sessions .... Build 'xenserver-iso.XSTEST' finished after 43 minutes 52 seconds. ==> Wait completed after 43 minutes 52 seconds ==> Builds finished. The artifacts of successful builds are: --> ==> xenserver-iso.XSTEST: W2K25.2511 azadmin@tacg-cicd:~$ After a successful run, XenServer should reflect the created VM, and after conversion, the corresponding template: The exact same process is done to create the Windows 11 Master Image and Template. Since the Master Images have been created, we can proceed to the next step. Part 2: Using Terraform to create the needed VMs based on the Master ImagesTerraform now creates all the required Infrastructure VMs for deploying CVAD: Two Windows Server 2025-based VMs for the Delivery Controllers One Windows Server 2025-based VM for the StoreFront server One Windows Server 2025-based VM for the WebStudio server. All needed settings are defined in a dedicated JSON file, where all variables and their values are stored. This allows maximum code flexibility and reusability, as it does not need to be changed when other VM configurations arise. Note Those are the key principles of IaC – repeatability, reusability, and flexibility. Example of the VM settings in Terraform: { "TACG-TMM-XS-CL-VMSR":"local storage", "TACG-TMM-XS-CL-ISOSR":"ENTERPRISE ISO", "TACG-TMM-XS-CL-NW":"Network 0", "TACG-TMM-XS-CL-W2K25-MI":"W2K25.2511", "TACG-TMM-XS-CL-VM-DDC1-Name":"VM-TF-TACG-DDC1", "TACG-TMM-XS-CL-VM-DDC2-Name":"VM-TF-TACG-DDC2", "TACG-TMM-XS-CL-VM-StoreFront-Name":"VM-TF-TACG-SF", "TACG-TMM-XS-CL-VM-WebStudio-Name":"VM-TF-TACG-WS", "TACG-TMM-XS-CL-VM-DDC1-DiskName":"vdi-tacg-ddc1", "TACG-TMM-XS-CL-VM-DDC2-DiskName":"vdi-tacg-ddc2", "TACG-TMM-XS-CL-VM-StoreFront-DiskName":"vdi-tacg-sf", "TACG-TMM-XS-CL-VM-WebStudio-DiskName":"vdi-tacg-ws", "TACG-TMM-XS-CL-VM-DDC1-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-DDC2-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-StoreFront-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-WebStudio-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-DDC1-MemSize":8589934592, "TACG-TMM-XS-CL-VM-DDC2-MemSize":8589934592, "TACG-TMM-XS-CL-VM-StoreFront-MemSize":8589934592, "TACG-TMM-XS-CL-VM-WebStudio-MemSize":8589934592, "TACG-TMM-XS-CL-VM-DDC1-CPUs":2, "TACG-TMM-XS-CL-VM-DDC2-CPUs":2, "TACG-TMM-XS-CL-VM-StoreFront-CPUs":2, "TACG-TMM-XS-CL-VM-DDC1-Cores":2, "TACG-TMM-XS-CL-VM-DDC2-Cores":2, "TACG-TMM-XS-CL-VM-StoreFront-Cores":2 }For example, if you want to change the main disk size, you only need to change the corresponding value: From to would double the disk size to 128GB. Important As the current Terraform provider for XenServer does not support joining a newly created VM to an AD domain, this step will be performed in the next block using an Ansible playbook. Caution The current version of the Terraform provider (1.0.30) at the time of writing this guide has a bug: The storage name is processed internally only in lowercase; however, if it contains an uppercase letter, an error message is returned. That is why the code snippets always refer to “local storage” rather than its original name, “Local storage”. Please rename the storage name you want to use in XenCenter™ to lowercase characters. Example Terraform snippet for VM creation: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs ## Definition of all required local variables ### Get XenServer-related Data #### Get the VM SR object data "xenserver_sr" "vmsr" { name_label = var.TACG-TMM-XS-CL-VMSR } #### Get the ISO SR object data "xenserver_sr" "isosr" { name_label = var.TACG-TMM-XS-CL-ISOSR } #### Get the Network object data "xenserver_network" "network" { } # Create a Windows Server 2025 VM for DDC1 from the custom template resource "xenserver_vm" "VM-DDC1" { name_label = var.TACG-TMM-XS-CL-VM-DDC1-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-DDC1-MemSize vcpus = var.TACG-TMM-XS-CL-VM-DDC1-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-DDC1-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] } # Create a Windows Server 2025 VM for DDC2 from the custom template resource "xenserver_vm" "VM-DDC2" { name_label = var.TACG-TMM-XS-CL-VM-DDC2-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-DDC2-MemSize vcpus = var.TACG-TMM-XS-CL-VM-DDC2-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-DDC2-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] } # Create a Windows Server 2025 VM for SF from the custom template resource "xenserver_vm" "VM-StoreFront" { name_label = var.TACG-TMM-XS-CL-VM-StoreFront-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-StoreFront-MemSize vcpus = var.TACG-TMM-XS-CL-VM-StoreFront-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-StoreFront-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] } # Create a Windows Server 2025 VM for WebStudio from the custom template resource "xenserver_vm" "VM-WebStudio" { name_label = var.TACG-TMM-XS-CL-VM-WebStudio-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-WebStudio-MemSize vcpus = var.TACG-TMM-XS-CL-VM-StoreFront-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-StoreFront-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] }Running this snippet should create all four VMs on XenServer: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_Creation$ terraform apply data.xenserver_sr.vmsr: Reading... data.xenserver_sr.isosr: Reading... data.xenserver_network.network: Reading... data.xenserver_sr.vmsr: Read complete after 0s data.xenserver_network.network: Read complete after 0s data.xenserver_sr.isosr: Read complete after 0s Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # xenserver_vm.VM-DDC1 will be created + resource "xenserver_vm" "VM-DDC1" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-DDC1" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } # xenserver_vm.VM-DDC2 will be created + resource "xenserver_vm" "VM-DDC2" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-DDC2" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } # xenserver_vm.VM-StoreFront will be created + resource "xenserver_vm" "VM-StoreFront" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-SF" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } # xenserver_vm.VM-WebStudio will be created + resource "xenserver_vm" "VM-WebStudio" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-WS" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes xenserver_vm.VM-DDC2: Creating... xenserver_vm.VM-DDC1: Creating... xenserver_vm.VM-StoreFront: Creating... xenserver_vm.VM-WebStudio: Creating... xenserver_vm.VM-DDC2: Still creating... [00m10s elapsed] xenserver_vm.VM-StoreFront: Still creating... [00m10s elapsed] xenserver_vm.VM-DDC1: Still creating... [00m10s elapsed] xenserver_vm.VM-WebStudio: Still creating... [00m10s elapsed] ... xenserver_vm.VM-DDC2: Still creating... [01m50s elapsed] xenserver_vm.VM-StoreFront: Still creating... [01m50s elapsed] xenserver_vm.VM-DDC1: Still creating... [01m50s elapsed] xenserver_vm.VM-WebStudio: Still creating... [01m50s elapsed] xenserver_vm.VM-DDC2: Creation complete after 1m59s [id=5e08ba70-f038-f926-9650-99148985018e] xenserver_vm.VM-DDC1: Creation complete after 1m59s [id=16330ad2-4c9a-e2db-cdc5-9c9b765fa879] xenserver_vm.VM-StoreFront: Creation complete after 1m59s [id=db28575f-34f1-7624-184a-9f9c69bebc0b] xenserver_vm.VM-WebStudio: Creation complete after 1m59s [id=88e132dd-45ed-1121-9eab-1e7fda2361aa] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_Creation$Since the VMs have been created, we can proceed to the next step. Part 3: Using Terraform and Ansible to configure the VMsThis configuration block now uses the combination of Terraform and Ansible for all needed configuration steps. As mentioned, Terraform excels at creating components; Ansible excels at configuring them. Together, we have everything we need for a successful deployment. Note: In all our guides, we try to be as Hypervisor- and Hyperscaler-agnostic as possible. For example, the vSphere provider could add a VM to an AD domain, but not all providers support this, and each provider uses a different syntax. Using the same Ansible playbook across all Hypervisors/Hyperscalers, regardless of built-in capabilities, also improves code reuse, as no specific code needs to be changed for different Hypervisor-/Hyperscaler deployments. This block also shows the main flow: Terraform decides which steps are necessary and starts the corresponding Ansible playbooks to achieve the needed outcome. The following configuration steps are sequentially done: Change the IP addresses to known IPs. Change the Ansible configuration file to reflect the IP changes. Put the VMs into the AD domain. As the VMs are created, they will get an IP address from a DHCP server. This is expected behavior, but it will break any communication flow between Ansible and the VMs, as Ansible needs to know how to contact the VM. It can also lead to interruptions if the VMs are still configured to use DHCP when the Delivery Controllers and StoreFront are installed, so it is imperative to update the Ansible hosts file to reflect the assigned, static IP addresses after IP assignment. In our example, the VMs will get DHCP-based IP addresses in the 10.10.11.x/24 range. This is reflected in Ansible´s etc/ansible/HOSTS file: ... [ddc1_ipaddr] 10.10.11.178 [ddc2_ipaddr] 10.10.11.179 [sf_ipaddr] 10.10.11.180 [ws_ipaddr] 10.10.11.181 ...After the VMs are created, Ansible can contact them using the originally assigned DHCP-based IPs. Terraform now takes the three steps mentioned above to correct that. Therefore, it changes the IPs to fixed IPs defined in the Ansible playbook's corresponding variables. The etc/ansible/HOSTS file is updated with the correct IPs, and the VMs are added to the domain. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs ## Definition of all required local variables ### Get Needed Data #### Call Ansible to Join VM to Domain ##### Copy Ansible Playbooks to Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyPlaybooksForCC1ToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC1-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC1-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC1-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC1-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC1-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC1-Destination } } resource "null_resource" "CopyPlaybooksForCC2ToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC2-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC2-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC2-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC2-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC2-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC2-Destination } } resource "null_resource" "CopyPlaybooksForSFToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-SF-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-SF-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-SF-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-SF-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-SF-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-SF-Destination } } resource "null_resource" "CopyPlaybooksForWebStudioToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-WS-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-WS-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-WS-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-WS-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-WS-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-WS-Destination } } #### Wait 10s Minute for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyPlaybooksForCC1ToAnsibleServer, null_resource.CopyPlaybooksForCC2ToAnsibleServer, null_resource.CopyPlaybooksForSFToAnsibleServer, null_resource.CopyPlaybooksForWebStudioToAnsibleServer] create_duration = "10s" } #### Use Ansible to change all relevant settings on DDC1 ##### Connect to Ansible Interpreter and change IP of DDC1 resource "null_resource" "ChangeIPOfDDC1" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-IPChangeCMDForCC1 } } ##### Connect to Ansible Interpreter and change IP of DDC1 in Ansible´s HOSTS file resource "null_resource" "ChangeHostIPOfDDC1" { depends_on = [null_resource.ChangeIPOfDDC1] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-HostChangeCMDForCC1 } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode1" { depends_on = [null_resource.ChangeHostIPOfDDC1] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt1" { depends_on = [data.external.CheckAnsibleReturnCode1] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode1.result.found}\" = \"1\" ] && echo \"Changing IP/HOSTS: Everything OK\" || { echo \"Changing the IP of DDC1 and/or changing the Ansible HOSTS file failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } resource "time_sleep" "wait_10_seconds_1" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt1] create_duration = "10s" } ##### Connect to Ansible Interpreter and Add DDC1 To Domain resource "null_resource" "AddCC1ToDomain" { depends_on = [time_sleep.wait_10_seconds_1] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-DomainJoinCMDForCC1 } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeD1" { depends_on = [null_resource.AddCC1ToDomain] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltD1" { depends_on = [data.external.CheckAnsibleReturnCodeD1] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeD1.result.found}\" = \"1\" ] && echo \"Adding DDC1 to Domain: Everything OK\" || { echo \"Adding DDC1 to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### End of necessary changes on DDC1 #### Wait 10s Minute for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_afterddc1" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltD1] create_duration = "10s" } ... The same steps are needed for all the other servers ... ##### All necessary changes on the VMs are completeExample Ansible Playbook for changing the IP Address: ... - name: Change DDC1 IP address hosts: ddc1_ipaddr gather_facts: yes vars: ip: "10.10.119.11" sn: "16" gw: "10.10.0.1" dns: "10.10.100.1" tasks: - name: Set up static IP address ansible.windows.win_shell: | $interface = Get-NetAdapter | ? {$_.Status -eq "up"} $IpAddre = "{{ ip }}" $Prefx = "{{ sn }}" $GW = "{{ gw }}" $DNSAddre = "{{ dns }}" $interface | New-NetIPAddress -IPAddress $IpAddre -PrefixLength $Prefx -DefaultGateway $GW $interface | Set-DnsClientServerAddress -ServerAddresses $DNSAddre Start-Sleep -Seconds 10 async: 100 poll: 0 register: ip_resultExample Ansible Playbook for changing the etc/ansible/HOSTS file: ... - name: Replace old IP with new IP in /etc/ansible/hosts hosts: localhost connection: local become: true vars: ip: "10.10.119.11" oldip: "10.10.11.163" tasks: - name: Replace old IP with new IP in /etc/ansible/hosts lineinfile: path: /etc/ansible/hosts search_string: '{{ oldip }}' line: '{{ ip }}' state: presentExample Ansible Playbook for adding the VM to the AD domain: ... - name: join host to domain with automatic reboot hosts: ddc1_ipaddr tasks: - name: join host to domain with automatic reboot microsoft.ad.membership: dns_domain_name: the-austrian-citrix-guy.at hostname: tf-cvad-ddc1 domain_admin_user: XxXxXxXxX@the-austrian-citrix-guy.at domain_admin_password: "!XxXxXxXxXxXxXxXxX!" domain_ou_path: "OU=_COMPUTER,OU=TACG-CVAD,DC=the-austrian-citrix-guy,DC=at" state: domain reboot: trueRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_UseAnsibleToJoinDomain$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode1 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode1" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCode2 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode2" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } ... # time_sleep.wait_10_seconds_afterddc2 will be created + resource "time_sleep" "wait_10_seconds_afterddc2" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_seconds_aftersf will be created + resource "time_sleep" "wait_10_seconds_aftersf" { + create_duration = "10s" + id = (known after apply) } Plan: 32 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Creating... null_resource.CopyPlaybooksForSFToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Creation complete after 0s [id=9099395716454281124] null_resource.CopyPlaybooksForCC2ToAnsibleServer: Creation complete after 1s [id=2239027084142302025] null_resource.CopyPlaybooksForCC1ToAnsibleServer: Creation complete after 1s [id=8241870746583503880] null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Creation complete after 1s [id=85414301571074153] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-03T12:50:18Z] null_resource.ChangeIPOfDDC1: Creating... null_resource.ChangeIPOfDDC1: Provisioning with 'local-exec'... null_resource.ChangeIPOfDDC1 (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeIPAddress-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.ChangeIPOfDDC1 (local-exec): PLAY [Change DDC1 IP address] ************************************************** null_resource.ChangeIPOfDDC1 (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.ChangeIPOfDDC1 (local-exec): ok: [10.10.11.163] null_resource.ChangeIPOfDDC1 (local-exec): TASK [Set up static IP address] ************************************************ null_resource.ChangeIPOfDDC1 (local-exec): ok: [10.10.11.163] => {"ansible_async_watchdog_pid": 2392, "ansible_job_id": "j399189549114.3256", "changed": false, "finished": false, "results_file": "C:\\Users\\Administrator\\.ansible_async\\j399189549114.3256", "started": true} null_resource.ChangeIPOfDDC1 (local-exec): PLAY RECAP ********************************************************************* null_resource.ChangeIPOfDDC1 (local-exec): 10.10.11.163 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.ChangeIPOfDDC1: Creation complete after 5s [id=679400677203292951] null_resource.ChangeHostIPOfDDC1: Creating... null_resource.ChangeHostIPOfDDC1: Provisioning with 'local-exec'... null_resource.ChangeHostIPOfDDC1 (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeHostFile-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.ChangeHostIPOfDDC1 (local-exec): PLAY [Replace old IP with new IP in /etc/ansible/hosts] ************************ null_resource.ChangeHostIPOfDDC1 (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.ChangeHostIPOfDDC1 (local-exec): ok: [localhost] null_resource.ChangeHostIPOfDDC1 (local-exec): TASK [Replace old IP with new IP in /etc/ansible/hosts] ************************ null_resource.ChangeHostIPOfDDC1 (local-exec): changed: [localhost] => {"backup": "", "changed": true, "msg": "line replaced"} null_resource.ChangeHostIPOfDDC1 (local-exec): PLAY RECAP ********************************************************************* null_resource.ChangeHostIPOfDDC1 (local-exec): localhost : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.ChangeHostIPOfDDC1: Creation complete after 1s [id=4435900660469540446] data.external.CheckAnsibleReturnCode1: Reading... data.external.CheckAnsibleReturnCode1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt1: Creating... null_resource.IfExitCodeIsNotZeroThenHalt1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Changing IP/HOSTS: Everything OK\" || { echo \"Changing the IP of DDC1 and/or changing the Ansible HOSTS file failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt1 (local-exec): Changing IP/HOSTS: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt1: Creation complete after 0s [id=8720650856500940604] time_sleep.wait_10_seconds_1: Creating... time_sleep.wait_10_seconds_1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_1: Creation complete after 10s [id=2025-11-03T12:50:35Z] null_resource.AddCC1ToDomain: Creating... null_resource.AddCC1ToDomain: Provisioning with 'local-exec'... null_resource.AddCC1ToDomain (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/Join-VMToDomain-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.AddCC1ToDomain (local-exec): PLAY [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.AddCC1ToDomain (local-exec): ok: [10.10.119.11] null_resource.AddCC1ToDomain (local-exec): TASK [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain: Still creating... [00m10s elapsed] null_resource.AddCC1ToDomain: Still creating... [00m20s elapsed] null_resource.AddCC1ToDomain (local-exec): changed: [10.10.119.11] => {"changed": true, "reboot_required": false} null_resource.AddCC1ToDomain (local-exec): PLAY RECAP ********************************************************************* null_resource.AddCC1ToDomain (local-exec): 10.10.119.11 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.AddCC1ToDomain: Creation complete after 28s [id=6625761552218837946] data.external.CheckAnsibleReturnCodeD1: Reading... data.external.CheckAnsibleReturnCodeD1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltD1: Creating... null_resource.IfExitCodeIsNotZeroThenHaltD1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltD1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Adding DDC1 to Domain: Everything OK\" || { echo \"Adding DDC1 to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltD1 (local-exec): Adding DDC1 to Domain: Everything OK null_resource.IfExitCodeIsNotZeroThenHaltD1: Creation complete after 0s [id=7818126381059512591] time_sleep.wait_10_seconds_afterddc1: Creating... time_sleep.wait_10_seconds_afterddc1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_afterddc1: Creation complete after 10s [id=2025-11-03T12:51:13Z] ... All these steps are the same for the other three servers. Output omitted due to length ... data.external.CheckAnsibleReturnCodeDWS: Reading... data.external.CheckAnsibleReturnCodeDWS: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltDWS: Creating... null_resource.IfExitCodeIsNotZeroThenHaltDWS: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltDWS (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Adding WebStudio to Domain: Everything OK\" || { echo \"Adding WebStudio to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltDWS (local-exec): Adding WebStudio to Domain: Everything OK null_resource.IfExitCodeIsNotZeroThenHaltDWS: Creation complete after 0s [id=975638781208917805] Apply complete! Resources: 32 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_UseAnsibleToJoinDomain$The etc/ansible/HOSTS file is updated with the correct IPs: ... [ddc1_ipaddr] 10.10.119.11 [ddc2_ipaddr] 10.10.119.12 [sf_ipaddr] 10.10.119.13 [ws_ipaddr] 10.10.119.14 ..Ansible´s further used inventory.ini file also reflects all these changes: [cvad:children] cvad-ddcs cvad-sfs cvad-ws [cvad-ddcs] tf-cvad-ddc1.the-austrian-citrix-guy.at tf-cvad-ddc2.the-austrian-citrix-guy.at [cvad-ddc1] tf-cvad-ddc1.the-austrian-citrix-guy.at [cvad-ddc2] tf-cvad-ddc2.the-austrian-citrix-guy.at [cvad-ddc1-nb] TF-CVAD-DDC1 [cvad-ddc2-nb] TF-CVAD-DDC2 [cvad-sfs] tf-cvad-sf.the-austrian-citrix-guy.at [cvad-ws] tf-cvad-ws.the-austrian-citrix-guy.at [all:vars] ansible_user="svc_ansible" ansible_domainuser="XxXxXxXxX@the-austrian-citrix-guy.at" ansible_password="!XxXxXxXxXxXxXxXxXx!” ansible_connection=winrm ansible_winrm_scheme=https ansible_winrm_transport=certificate ansible_winrm_port=5986 ansible_winrm_server_cert_validation=ignore ansible_winrm_cert_pem=/etc/ssl/certs/svc_ansible.pem ansible_winrm_cert_key_pem=/etc/ssl/certs/svc_ansible.pem ansible_winrm_server_cert_validation=ignoreSince the VMs and their dependencies were successfully reconfigured, we can proceed to the next step. Part 4: Using Terraform and Ansible to deploy the Delivery ControllersThe VMs dedicated to holding the Delivery Controller™ roles are now ready for the deployment of the Delivery Controller components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the DDCs Install all required server roles and features before installing the DDCs Change some necessary registry settings Therefore, we again use the well-proven combination of Terraform and Ansible. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleDDCAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } # Copy vars-ddcs.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Vars-Source destination = var.TACG-TMM-XS-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Inventory-Source destination = var.TACG-TMM-XS-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForDDCs-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForDDCs-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleDDCAssetsToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on DDCs resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-InitialCMDForDDCs } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying CVAD: Everything OK\" || { echo \"Deploying the CVAD software and its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } Example Ansible Playbook for deploying and configuring the DDCs and all needed further configurations: --- # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the Delivery Controllers - name: Configure the DDCs initially hosts: cvad-ddcs vars_files: - ./vars-ddcs.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ ddc_req_roles }}" state: present register: requirements - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 3010] creates_path: C:\Program Files\Citrix\Desktop Studio register: ddc_install - name: Reboot after DDC ansible.windows.win_reboot: when: ddc_install.changed - name: Remove DDC RunOnce Key ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce name: "!XenDesktopSetup" state: absent register: ddc_resume - name: Resume DDC Install ansible.windows.win_package: path: C:\ProgramData\Citrix\XenDesktopSetup\XenDesktopServerSetup.exe state: present expected_return_code: [0, 3, 3010] creates_path: C:\Program Files\Citrix\Desktop Studio when: ddc_resume.changed - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Restart a service ansible.windows.win_service: name: CitrixHostService state: startedRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallCVAD$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleDDCAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleDDCAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Creation complete after 0s [id=3392935108841645613] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-12T07:13:29Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForDDCs.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the DDCs initially] ******************************************** null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc1.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc2.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [00m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [12m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [12m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Group Policy Management", "id": 69, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Remote Server Administration Tools", "id": 67, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS and AD LDS Tools", "id": 329, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Tools", "id": 257, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Snap-Ins and Command-Line Tools", "id": 299, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Role Administration Tools", "id": 256, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Group Policy Management", "id": 69, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Remote Server Administration Tools", "id": 67, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS and AD LDS Tools", "id": 329, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Tools", "id": 257, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Snap-Ins and Command-Line Tools", "id": 299, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Role Administration Tools", "id": 256, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook: Still creating... [15m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [15m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [15m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [25m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after DDC] ******************************************************** null_resource.RunInitialPlaybook: Still creating... [25m30s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m40s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m50s elapsed] null_resource.RunInitialPlaybook: Still creating... [26m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 34, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 43, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): TASK [Remove DDC RunOnce Key] ************************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "data_changed": false, "data_type_changed": false} null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "data_changed": false, "data_type_changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Resume DDC Install] ****************************************************** null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "ddc_resume.changed", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "ddc_resume.changed", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook: Still creating... [26m10s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=12 changed=9 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 null_resource.RunInitialPlaybook (local-exec): tf-cvad-ddc2.the-austrian-citrix-guy.at : ok=12 changed=9 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 26m11s [id=3927491137125445482] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying CVAD: Everything OK\" || { echo \"Deploying the CVAD software and its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying CVAD: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=8978265277076340502] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallCVAD$ After successful deployment, the CVAD software is installed and can be configured later. Caution We have noticed that in some environments, the Citrix Host Service does not start after the initial reboot, even though it is set to Automatic start. Therefore, we added a new task to the Ansible Playbook to ensure that the Citrix Host Service starts after the initial reboot and before the following configuration steps. Since the CVAD software and its dependencies were successfully deployed, we can proceed to the next step. Part 5: Using Terraform and Ansible to deploy the StoreFront serverThe VM dedicated to holding the StoreFront™ role is now ready for the deployment of the StoreFront components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the DDCs Install all required server roles and features before installing the DDCs Change some necessary registry settings Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VMs. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets for installing StoreFront to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSFAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } # Copy vars-sf.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Vars-Source destination = var.TACG-TMM-XS-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Inventory-Source destination = var.TACG-TMM-XS-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForSF-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForSF-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSFAssetsToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on SF resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-InitialCMDForSF } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying StoreFront - Everything OK\" || { echo \"Deploying the StoreFront software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } }Example Ansible Playbook for deploying and configuring Storefront and all needed further configurations: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the StoreFront Server - name: Configure the StoreFront Server initially hosts: cvad-sf vars_files: - ./vars-sf.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ sf_req_roles }}" state: present register: requirements become: true become_method: runas become_user: SYSTEM - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Create database server record ansible.windows.win_dns_record: computer_name: "{{ sf_dns_ip }}" name: "{{ sf_dns_name }}" type: "A" value: "{{ sf_dns_value }}" zone: "{{ sf_dns_zone }}" state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 4, 3010] creates_path: C:\ProgramData\Citrix\Storefront Install register: sf_install become: true become_method: runas become_user: "{{ ansible_domainuser }}" - name: Reboot after sf ansible.windows.win_reboot: when: sf_install.changed Running the snippet should fulfill all required steps: At first, all missing Windows features are installed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallStoreFront$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSFAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSFAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleSFAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Creation complete after 0s [id=3119681656948818723] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-04T16:59:29Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForStoreFront.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the StoreFront Server initially] ******************************* null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-sf.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [00m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [09m50s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook: Still creating... [10m00s elapsed] null_resource.RunInitialPlaybook: Still creating... [10m10s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [19m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Message Queuing", "id": 49, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Server", "id": 191, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Services", "id": 190, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 (includes .NET 2.0 and 3.0)", "id": 220, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 Features", "id": 475, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Activation", "id": 421, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing (MSMQ) Activation", "id": 422, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Named Pipe Activation", "id": 423, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "TCP Activation", "id": 424, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Telnet Client", "id": 44, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Process Activation Service", "id": 41, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Configuration APIs", "id": 217, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Process Model", "id": 219, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Initialization", "id": 445, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP", "id": 150, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Basic Authentication", "id": 163, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "CGI", "id": 151, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Dynamic Content Compression", "id": 173, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Redirection", "id": 146, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Tracing", "id": 159, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Server Side Includes", "id": 154, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Logging Tools", "id": 157, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Metabase Compatibility", "id": 179, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Management Compatibility", "id": 178, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Scripts and Tools", "id": 176, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 WMI Compatibility", "id": 180, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [19m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m20s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m30s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "22A6C5D5BB516ABD6DF5DC6E6CA0C0CEFBB19082", "rc": 3010, "reboot_required": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after sf] ********************************************************* null_resource.RunInitialPlaybook: Still creating... [19m40s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m50s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m00s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 42, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-sf.the-austrian-citrix-guy.at : ok=11 changed=10 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 20m24s [id=7847329303251523226] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying StoreFront - Everything OK\" || { echo \"Deploying the StoreFront software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying StoreFront - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=6843415180162545622] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallStoreFront$ After successful deployment, the StoreFront software is installed and can be configured later. Since the StoreFront software and its dependencies were successfully deployed, we can proceed to the next step. Part 6: Using Terraform and Ansible to deploy the Web Studio ServerThe VM dedicated to holding the Web Studio role is now ready for the deployment of the Web Studio components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the Web Studio server Install all required server roles and features before installing the Web Studio server Change some necessary registry settings Configure the Web Studio server as a proxy for the DDCs Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VM again. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets for installing WebStudio to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleWSAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP } # Copy vars-ws.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Vars-Source destination = var.TACG-TMM-XS-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Inventory-Source destination = var.TACG-TMM-XS-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForWS-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForWS-Destination } # Copy SetProxy Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-SetProxyPlaybookWS-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForWS-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleWSAssetsToAnsibleServer] create_duration = "10s" } #### Run initial configuration ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on WS resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-InitialCMDForWS } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying WebStudio: Everything OK\" || { echo \"Deploying the WebStudio software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_IC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt] create_duration = "10s" } ##### End of intitial configuration #### Run SetProxy configuration ##### Connect to Ansible Interpreter and run SetProxy Playbook on WS resource "null_resource" "RunSetProxyConfigurationPlaybook" { depends_on = [time_sleep.wait_10_seconds_IC] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-SetProxyPlaybookWS } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodePC" { depends_on = [null_resource.RunSetProxyConfigurationPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltPC" { depends_on = [data.external.CheckAnsibleReturnCodePC] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodePC.result.found}\" = \"1\" ] && echo \"Configuring WebStudio as Proxy: Everything OK\" || { echo \"Configuring WebStudio as Proxy failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_IC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt] create_duration = "10s" } ##### End of intitial configuration Example Ansible Playbook for deploying and configuring WebStudio and all needed further configurations: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the WebStudio Server - name: Configure the WebStudio Server initially hosts: cvad-ws vars_files: - ./vars-ws.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ ws_req_roles }}" state: present register: requirements become: true become_method: runas become_user: SYSTEM - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 4, 3010] creates_path: C:\ProgramData\Citrix\Storefront Install register: ws_install become: true become_method: runas become_user: "{{ ansible_domainuser }}" - name: Reboot after ws ansible.windows.win_reboot: when: ws_install.changedExample Ansible Playbook for configuring Web Studio as Proxy: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Configure WS as Proxy - name: Configure WebStudio as Proxy hosts: cvad-ws gather_facts: no tasks: - name: Run PS to enable Proxy Mode ansible.windows.win_powershell: script: | & "c:\Program Files\Citrix\Web Studio\Tool\StudioConfig.exe" --enableproxy --proxyserver "tf-cvad-ws.the-austrian-citrix-guy.at" register: runps - name: Print results ansible.builtin.debug: var: runps Running the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallWebStudio$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleWSAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleWSAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleWSAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Creation complete after 1s [id=8218302926752497323] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-12T07:52:23Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForWS.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the WebStudio Server initially] ******************************** null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ws.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [09m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook: Still creating... [09m30s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [18m40s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Message Queuing", "id": 49, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Server", "id": 191, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Services", "id": 190, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 (includes .NET 2.0 and 3.0)", "id": 220, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 Features", "id": 475, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Activation", "id": 421, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing (MSMQ) Activation", "id": 422, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Named Pipe Activation", "id": 423, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "TCP Activation", "id": 424, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Telnet Client", "id": 44, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Process Activation Service", "id": 41, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Configuration APIs", "id": 217, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Process Model", "id": 219, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Initialization", "id": 445, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP", "id": 150, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Basic Authentication", "id": 163, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "CGI", "id": 151, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Dynamic Content Compression", "id": 173, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Redirection", "id": 146, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Tracing", "id": 159, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Server Side Includes", "id": 154, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Logging Tools", "id": 157, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Metabase Compatibility", "id": 179, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Management Compatibility", "id": 178, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Scripts and Tools", "id": 176, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 WMI Compatibility", "id": 180, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [18m50s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [22m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after sf] ********************************************************* null_resource.RunInitialPlaybook: Still creating... [22m30s elapsed] null_resource.RunInitialPlaybook: Still creating... [22m40s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 23, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-ws.the-austrian-citrix-guy.at : ok=11 changed=9 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 22m45s [id=7191293509250199804] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying WebStudio: Everything OK\" || { echo \"Deploying the WebStudio software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying WebStudio: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=416418525198442619] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallWebStudio$ After successful deployment, the WebStudio server is now installed and ready. We can continue with the next step. Part 7: Using Terraform and Ansible to Change the SSL BindingsWe want to configure all transport in our environment as securely as possible. Therefore, Terraform and Ansible take additional steps to configure all SSL bindings across all servers and listeners to enable complete HTTPS communication. Where applicable, the SSL certificate is changed to a publicly signed certificate to avoid certificate trust errors. The change is applied by a PowerShell script, which Ansible runs on each applicable host. To obtain all required elevated privileges, we use PsExec64.exe as the host to run the PowerShell scripts. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-Ansible port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Playbook-Destination } } #### Copy the required PowerShell Scripts to the DDC1 resource "null_resource" "CopyPowerShellScriptsToDDC1" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-DDC1 port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the DDC1 provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the DDC1 provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the DDC2 resource "null_resource" "CopyPowerShellScriptsToDDC2" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-DDC2 port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the DDC2 provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the DDC2 provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the SF resource "null_resource" "CopyPowerShellScriptsToSF" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-SF port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the SF provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the SF provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the WS resource "null_resource" "CopyPowerShellScriptsToWS" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-WS port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the WS provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the WS provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSiteAssetsToAnsibleServer, null_resource.CopyPowerShellScriptsToDDC1] create_duration = "10s" } ##### Change the SSL Bindings Start ##### Connect to Ansible Interpreter and run ChangeSSLOnServers-Playbook resource "null_resource" "RunChangeSSLPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunChangeSSLPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Change SSL Bindings - Everything OK\" || { echo \"Changing the SSL bindings failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### Change the SSL Bindings EndExample Ansible Playbook for changing the SSL bindings on the DDCs: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Change SSL Certificate bindings to the previously uploaded public SSL Certificate by running a PowerShell script on all CVAD servers - name: Change SSL Certificate bindings hosts: cvad-ddcs gather_facts: no collections: - community.windows vars: domain_user: "TACG\\XxXxXxXxX" domain_pass: "!XxXxXxXxXxXxXxXxX!" psexec_path: "C:\\InstallCVAD\\PsExec64.exe" remote_script: "C:\\InstallCVAD\\ChangeSSLOnServers.ps1" ansible_user: "svc_ansible" ansible_password: "!XxXxXxXxXxXxXxXxX!" ansible_connection: winrm ansible_winrm_transport: certificate tasks: - name: Run the ChangeSSLOnDDCs-PowerShell script as Domain Administrator community.windows.win_psexec: command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{{ remote_script }}" executable: "{{ psexec_path }}" username: "{{ domain_user }}" password: "{{ domain_pass }}" elevated: true noprofile: true interactive: true wait: true Example PowerShell script to change the SSL bindings: Try { $friendlyName = "*.the-austrian-citrix-guy.at" $Thumbprint = (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.FriendlyName -eq $friendlyName}).Thumbprint -join ';' $ThumbprintC = ($ThumbPrint.Replace(" ","")) netsh http delete sslcert ipport=0.0.0.0:443 $NGuid = [guid]::NewGuid().ToString("B") netsh http add sslcert ipport=0.0.0.0:443 certhash=$ThumbprintC appid=$NGuid disablelegacytls=enable netsh http show sslcert } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ChangeSSLCertificateBindings: Error: $errorMessage" Write-Output "An error occurred trying to change the SSL-Certificate bindings (error: $($Error[0]))" Exit 1 }Running the snippet should fulfill all needed steps – example for running it on the DDCs: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ChangeSSLOnServers$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSiteAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC1 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC1" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC2 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC2" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToSF will be created + resource "null_resource" "CopyPowerShellScriptsToSF" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToWS will be created + resource "null_resource" "CopyPowerShellScriptsToWS" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunChangeSSLPlaybook will be created + resource "null_resource" "RunChangeSSLPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 8 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creating... null_resource.CopyPowerShellScriptsToWS: Creating... null_resource.CopyPowerShellScriptsToDDC1: Creating... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToWS: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToSF: Creating... null_resource.CopyPowerShellScriptsToDDC2: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC2: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToSF: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creation complete after 0s [id=8882922836300404953] #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> ... null_resource.CopyPowerShellScriptsToDDC1: Creation complete after 10s [id=4814951330333809760] null_resource.CopyPowerShellScriptsToSF: Creation complete after 10s [id=6247443398511140586] null_resource.CopyPowerShellScriptsToDDC2: Creation complete after 10s [id=4396737003381006003] ... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-13T12:24:08Z] null_resource.RunChangeSSLPlaybook: Creating... null_resource.RunChangeSSLPlaybook: Provisioning with 'local-exec'... null_resource.RunChangeSSLPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeSSLOnServers.ansible.yml -i /etc/ansible/assets/inventory.ini -vvv -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunChangeSSLPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunChangeSSLPlaybook (local-exec): PLAYBOOK: ChangeSSLOnServers.ansible.yml *************************************** null_resource.RunChangeSSLPlaybook (local-exec): 1 plays in /etc/ansible/assets/ChangeSSLOnServers.ansible.yml null_resource.RunChangeSSLPlaybook (local-exec): PLAY [Change SSL Certificate bindings] ***************************************** null_resource.RunChangeSSLPlaybook (local-exec): TASK [Run the ChangeSSLOnDDCs-PowerShell script as Domain Administrator] ******* null_resource.RunChangeSSLPlaybook (local-exec): task path: /etc/ansible/assets/ChangeSSLOnServers.ansible.yml:26 null_resource.RunChangeSSLPlaybook (local-exec): Using module file /usr/lib/python3/dist-packages/ansible_collections/community/windows/plugins/modules/win_psexec.ps1 null_resource.RunChangeSSLPlaybook (local-exec): Pipelining is enabled. null_resource.RunChangeSSLPlaybook (local-exec): <tf-cvad-ddc1.the-austrian-citrix-guy.at> ESTABLISH WINRM CONNECTION FOR USER: svc_ansible on PORT 5986 TO tf-cvad-ddc1.the-austrian-citrix-guy.at null_resource.RunChangeSSLPlaybook (local-exec): EXEC (via pipeline wrapper) null_resource.RunChangeSSLPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => { null_resource.RunChangeSSLPlaybook (local-exec): "changed": true, null_resource.RunChangeSSLPlaybook (local-exec): "delta": "0:00:01.130213", null_resource.RunChangeSSLPlaybook (local-exec): "end": "2025-11-13 12:24:09.735282", null_resource.RunChangeSSLPlaybook (local-exec): "invocation": { null_resource.RunChangeSSLPlaybook (local-exec): "module_args": { null_resource.RunChangeSSLPlaybook (local-exec): "chdir": null, null_resource.RunChangeSSLPlaybook (local-exec): "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\ChangeSSLOnServers.ps1\"", null_resource.RunChangeSSLPlaybook (local-exec): "elevated": true, null_resource.RunChangeSSLPlaybook (local-exec): "executable": "C:\\InstallCVAD\\PsExec64.exe", null_resource.RunChangeSSLPlaybook (local-exec): "hostnames": null, null_resource.RunChangeSSLPlaybook (local-exec): "interactive": true, null_resource.RunChangeSSLPlaybook (local-exec): "limited": false, null_resource.RunChangeSSLPlaybook (local-exec): "nobanner": false, null_resource.RunChangeSSLPlaybook (local-exec): "noprofile": true, null_resource.RunChangeSSLPlaybook (local-exec): "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", null_resource.RunChangeSSLPlaybook (local-exec): "priority": null, null_resource.RunChangeSSLPlaybook (local-exec): "session": null, null_resource.RunChangeSSLPlaybook (local-exec): "system": false, null_resource.RunChangeSSLPlaybook (local-exec): "timeout": null, null_resource.RunChangeSSLPlaybook (local-exec): "username": "TACG\\administrator", null_resource.RunChangeSSLPlaybook (local-exec): "wait": true null_resource.RunChangeSSLPlaybook (local-exec): } null_resource.RunChangeSSLPlaybook (local-exec): }, null_resource.RunChangeSSLPlaybook (local-exec): "psexec_command": "C:\\InstallCVAD\\PsExec64.exe -u TACG\\administrator -p *PASSWORD_REPLACED* -e -h -i -accepteula powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\ChangeSSLOnServers.ps1\"", null_resource.RunChangeSSLPlaybook (local-exec): "rc": 0, null_resource.RunChangeSSLPlaybook (local-exec): "start": "2025-11-13 12:24:08.605068", null_resource.RunChangeSSLPlaybook (local-exec): "stderr": "Connecting to local system...\r\r\rStarting PSEXESVC service on local system...\r\r\rCopying authentication key to TF-CVAD-DDC1...\r\r\rConnecting with PsExec service on TF-CVAD-DDC1...\r\r\rStarting powershell.exe on TF-CVAD-DDC1...\r\r\r\r\npowershell.exe exited on TF-CVAD-DDC1 with error code 0.\r\n", null_resource.RunChangeSSLPlaybook (local-exec): "stderr_lines": [ null_resource.RunChangeSSLPlaybook (local-exec): "Connecting to local system...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Starting PSEXESVC service on local system...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Copying authentication key to TF-CVAD-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Connecting with PsExec service on TF-CVAD-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Starting powershell.exe on TF-CVAD-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "powershell.exe exited on TF-CVAD-DDC1 with error code 0." null_resource.RunChangeSSLPlaybook (local-exec): ], null_resource.RunChangeSSLPlaybook (local-exec): "stdout": "\r\nPsExec v2.43 - Execute processes remotely\r\nCopyright (C) 2001-2023 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\n", null_resource.RunChangeSSLPlaybook (local-exec): "stdout_lines": [ null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "PsExec v2.43 - Execute processes remotely", null_resource.RunChangeSSLPlaybook (local-exec): "Copyright (C) 2001-2023 Mark Russinovich", null_resource.RunChangeSSLPlaybook (local-exec): "Sysinternals - www.sysinternals.com", null_resource.RunChangeSSLPlaybook (local-exec): "" null_resource.RunChangeSSLPlaybook (local-exec): ] null_resource.RunChangeSSLPlaybook (local-exec): } null_resource.RunChangeSSLPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunChangeSSLPlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunChangeSSLPlaybook (local-exec): tf-cvad-ddc2.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunChangeSSLPlaybook: Creation complete after 3s [id=6734265951530601448] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Change SSL Bindings - Everything OK\" || { echo \"Changing the SSL bindings failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Change SSL Bindings - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=5221894585109127965] Apply complete! Resources: 8 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ChangeSSLOnServers$As all server operations are complete, we can now start with creating the CVAD site, the StoreFront site, and all the CVAD entities. Part 8: Using Terraform and Ansible to create the CVAD site and all its necessitiesCreating the CVAD site, including its requirements and dependencies, is a complex task that involves many steps. Terraform and Ansible together fulfill the following tasks: Create all databases Create the site Add the second DDC to the site Configure additional site configurations Configure a dedicated Administrators group Configure the licensing Before running these tasks, we see that no related databases exist on SQL Server, and no site is configured on the primary Delivery Controller. Important All Terraform configurations and Ansible Playbooks, as well as the corresponding PowerShell scripts, must be run in the Site Administrator´s context – it must be a Domain user account. To obtain all required elevated privileges, we use PsExec64.exe as the host to run the PowerShell scripts. If we do not use the correct user account and privileges, the deployment will fail. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-HostIP port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-AdditionalSiteConfiguration-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-AdditionalSiteConfiguration-Playbook-Destination } # Copy AddSecondDDCToSite Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-AddSecondDDCToSite-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-AddSecondDDCToSite-Playbook-Destination } # Copy ConfigureAdminGroup Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ConfigureAdminGroup-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-ConfigureAdminGroup-Playbook-Destination } # Copy CreateDatabase Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-Playbook-Destination } # Copy CreateSite Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-CreateSite-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-CreateSite-Playbook-Destination } # Copy SetLicensing Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-SetLicensing-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-SetLicensing-Playbook-Destination } } #### Copy the required PowerShell Scripts to the DDC resource "null_resource" "CopyPowerShellScriptsToDDC1" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-HostIP port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-AdditionalSiteConfiguration-Source destination = var.TACG-TMM-XS-CL-DDC-AdditionalSiteConfiguration-Destination } # Copy AddSecondDDCToSite.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-AddSecondDDCToSite-Source destination = var.TACG-TMM-XS-CL-DDC-AddSecondDDCToSite-Destination } # Copy ConfigureAdminGroup.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-ConfigureAdminGroup-Source destination = var.TACG-TMM-XS-CL-DDC-ConfigureAdminGroup-Destination } # Copy CreateDatabase.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-CreateDatabase-Source destination = var.TACG-TMM-XS-CL-DDC-CreateDatabase-Destination } # Copy CreateSite.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-CreateSite-Source destination = var.TACG-TMM-XS-CL-DDC-CreateSite-Destination } # Copy SetLicensing.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-SetLicensing-Source destination = var.TACG-TMM-XS-CL-DDC-SetLicensing-Destination } # Copy PsExec.exe file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-PsExec-Source destination = var.TACG-TMM-XS-CL-DDC-PsExec-Destination } } resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSiteAssetsToAnsibleServer, null_resource.CopyPowerShellScriptsToDDC1] create_duration = "10s" } ##### Create Databases Start ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCDB" { depends_on = [null_resource.RunCreateDatabasePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { depends_on = [data.external.CheckAnsibleReturnCodeCDB] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCDB.result.found}\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_300_secondsCDB" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltCDB] create_duration = "300s" } ##### Create Databases End ##### Create Site Start ##### Connect to Ansible Interpreter and run CreateSite-Playbook on DDCs resource "null_resource" "RunCreateSitePlaybook" { depends_on = [time_sleep.wait_300_secondsCDB] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateSite-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCS" { depends_on = [null_resource.RunCreateSitePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCS" { depends_on = [data.external.CheckAnsibleReturnCodeCS] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCS.result.found}\" = \"1\" ] && echo \"Create Site - Everything OK\" || { echo \"Deploying the CVAD Site failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_60_secondsCS" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltCS] create_duration = "60s" } ##### Create Site End ##### Create SiteAddSecondDDC Start ##### Connect to Ansible Interpreter and run AddSecondDDC-Playbook on DDCs resource "null_resource" "RunAddSecondDDCPlaybook" { depends_on = [time_sleep.wait_60_secondsCS] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-AddSecondDDCToSite-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeSecondDDC" { depends_on = [null_resource.RunAddSecondDDCPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltSecondDDC" { depends_on = [data.external.CheckAnsibleReturnCodeSecondDDC] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeSecondDDC.result.found}\" = \"1\" ] && echo \"Add Second DDC - Everything OK\" || { echo \"Adding second DDC to the CVAD Site failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsSecondDDC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltSecondDDC] create_duration = "10s" } ##### Create SiteAddSecondDDC End ##### Create AdditionalSiteConfiguration Start ##### Connect to Ansible Interpreter and run AdditionalSiteConfiguration-Playbook on DDCs resource "null_resource" "RunAdditionalSiteConfigurationPlaybook" { depends_on = [time_sleep.wait_10_secondsSecondDDC] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-AdditionalSiteConfiguration-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeAdditionalSiteConfiguration" { depends_on = [null_resource.RunAdditionalSiteConfigurationPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration" { depends_on = [data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration.result.found}\" = \"1\" ] && echo \"Additional Site Configuration - Everything OK\" || { echo \"Running the additional Site Configurations failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsAdditionalSiteConfiguration" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration] create_duration = "10s" } ##### Create AdditionalSiteConfiguration End ##### Create ConfigureAdminGroup Start ##### Connect to Ansible Interpreter and run ConfigureAdminGroup-Playbook on DDCs resource "null_resource" "RunConfigureAdminGroupPlaybook" { depends_on = [time_sleep.wait_10_secondsAdditionalSiteConfiguration] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-ConfigureAdminGroup-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeConfigureAdminGroup" { depends_on = [null_resource.RunConfigureAdminGroupPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltConfigureAdminGroup" { depends_on = [data.external.CheckAnsibleReturnCodeConfigureAdminGroup] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeConfigureAdminGroup.result.found}\" = \"1\" ] && echo \"Admin Group Configuration - Everything OK\" || { echo \"Running the Configuration of the AdminGroup failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsConfigureAdminGroup" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltConfigureAdminGroup] create_duration = "10s" } ##### Create ConfigureAdminGroup End ##### Create SetLicensing Start ##### Connect to Ansible Interpreter and run SetLicensing-Playbook on DDCs resource "null_resource" "RunConfigureSetLicensingPlaybook" { depends_on = [time_sleep.wait_10_secondsConfigureAdminGroup] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-SetLicensing-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeSetLicensing" { depends_on = [null_resource.RunConfigureSetLicensingPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltSetLicensing" { depends_on = [data.external.CheckAnsibleReturnCodeSetLicensing] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeSetLicensing.result.found}\" = \"1\" ] && echo \"Licensing Configuration - Everything OK\" || { echo \"Configuration of Licensing failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### Create SetLicensing End Example Ansible Playbook calling the corresponding PowerShell script in PsExec64.exe for creating the required databases: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Create CVAD Databases by running a PowerShell script on DDC1 - name: Create CVAD Databases hosts: cvad-ddc1 gather_facts: no collections: - community.windows vars: domain_user: "TACG\\XxXxXxXxXxXxX" domain_pass: "!XxXxXxXxXxXxXxXxX!" psexec_path: "C:\\InstallCVAD\\PsExec64.exe" target_host: "tf-cvad-ddc1.the-austrian-citrix-guy.at" remote_script: "C:\\InstallCVAD\\CreateDatabases.ps1" ansible_user: "svc_ansible" ansible_password: "!XxXxXxXxXxXxXxXxX!" ansible_connection: winrm ansible_winrm_transport: certificate tasks: - name: Run the Create Database-PowerShell script as Domain Administrator community.windows.win_psexec: command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{{ remote_script }}" executable: "{{ psexec_path }}" username: "{{ domain_user }}" password: "{{ domain_pass }}" elevated: true noprofile: true interactive: true wait: trueExample PowerShell script for creating the required databases: Import-Module Citrix.XenDesktop®.Admin asnp citrix.* $SiteName = "TF-TACG-CVAD2507" $DatabaseServer = "tacg-sql.the-austrian-citrix-guy.at" $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $DatabasePrefix = "DB-" try { New-XDDatabase -AdminAddress $DDCName -SiteName $SiteName -AllDefaultDatabases -DatabaseServer $DatabaseServer -DatabaseNamePrefix $DatabasePrefix -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - CreateDB: Error: $errorMessage" Write-Output "An error occurred trying to create the databases (error: $($Error[0]))" Exit 1 } Note: The corresponding Ansible Playbooks for all the needed steps mentioned above are mostly the same – they differ only in running the feasible PowerShell script. Example PowerShell script for creating the CVAD site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $SiteName = "TF-TACG-CVAD2507" $DatabaseServer = "tacg-sql.the-austrian-citrix-guy.at" $DatabaseName_Site = "DB-CitrixTF-TACG-CVAD2507Site" $DatabaseName_Logging = "DB-CitrixTF-TACG-CVAD2507Logging" $DatabaseName_Monitoring = "DB-CitrixTF-TACG-CVAD2507Monitoring" $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" try { New-XDSite -DatabaseServer $DatabaseServer -LoggingDatabaseName $DatabaseName_Logging -MonitorDatabaseName $DatabaseName_Monitoring -SiteDatabaseName $DatabaseName_Site -SiteName $SiteName -AdminAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - CreateSite: Error: $errorMessage" Write-Output "An error occurred trying to create the CVAD site (error: $($Error[0]))" Exit 1 } Example PowerShell script for adding the second DDC to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $NewDDCName = "tf-cvad-ddc2.the-austrian-citrix-guy.at" try { Add-XDController -AdminAddress $NewDDCName -SiteControllerAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - Add2ndDDC: Error: $errorMessage" Write-Output "An error occurred trying to add the 2nd DDC (error: $($Error[0]))" Exit 1 } Example PowerShell script for adding the second DDC to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $NewDDCName = "tf-cvad-ddc2.the-austrian-citrix-guy.at" try { Add-XDController -AdminAddress $NewDDCName -SiteControllerAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - Add2ndDDC: Error: $errorMessage" Write-Output "An error occurred trying to add the 2nd DDC (error: $($Error[0]))" Exit 1 }Example PowerShell script for running additional site configurations: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $GroomingDays = 90 try { Set-MonitorConfiguration -GroomApplicationInstanceRetentionDays $GroomingDays -GroomDeletedRetentionDays $GroomingDays -GroomFailuresRetentionDays $GroomingDays -GroomLoadIndexesRetentionDays $GroomingDays -GroomMachineHotfixLogRetentionDays $GroomingDays -GroomNotificationLogRetentionDays $GroomingDays -GroomResourceUsageDayDataRetentionDays $GroomingDays -GroomSessionsRetentionDays $GroomingDays -GroomSummariesRetentionDays $GroomingDays Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true Set-BrokerSite -ConnectionLeasingEnabled $false Set-BrokerSite -LocalHostCacheEnabled $true Set-AnalyticsSite -Enabled $false } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - AdditionalSiteConfiguration: Error: $errorMessage" Write-Output "An error occurred trying to run the additional Site configuration (error: $($Error[0]))" Exit 1 }Example PowerShell script for adding a dedicated Administrators group to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $AdminGroup = "TACG-CTX-Admins" try { New-AdminAdministrator -AdminAddress $DDCName -Name $AdminGroup Add-AdminRight -AdminAddress $DDCName -Administrator $AdminGroup -Role 'Full Administrator' -Scope "All" } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ConfigureCTXAdminGroup: Error: $errorMessage" Write-Output "An error occurred trying to run the CTXAdminGroup script (error: $($Error[0]))" Exit 1 }Example PowerShell script for configuring the Licensing: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $LicenseServer = "tacg-dc.the-austrian-citrix-guy.at" $LicenseServerPort = 27000 $LicensingModel = "UserDevice" $ProductCode = "XDT" $ProductEdition = "PLT" try { Set-XDLicensing -AdminAddress $DDCName -LicenseServerAddress $LicenseServer -LicenseServerPort $LicenseServerPort -Force Set-ConfigSite -AdminAddress $DDCName -LicensingModel $LicensingModel -ProductCode $ProductCode -ProductEdition $ProductEdition -UseLicenseActivationService $true Set-ConfigSiteMetadata -AdminAddress $DDCName -Name 'CertificateHash' -Value $(Get-LicCertificate -AdminAddress "https://$($LicenseServer):8083").CertHash } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ConfigureLicensing: Error: $errorMessage" Write-Output "An error occurred trying to run the ConfigureLicensing script (error: $($Error[0]))" Exit 1 }Running the snippet should fulfill all the steps mentioned above and create the CVAD site: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ConfigureSite$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeAdditionalSiteConfiguration" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeCDB will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeCDB" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeCS will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeCS" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeConfigureAdminGroup will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeConfigureAdminGroup" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeSecondDDC will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeSecondDDC" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeSetLicensing will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeSetLicensing" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSiteAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC1 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC1" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltCDB will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltCS will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltCS" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltConfigureAdminGroup will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltConfigureAdminGroup" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltSecondDDC will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltSecondDDC" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltSetLicensing" { + id = (known after apply) } # null_resource.RunAddSecondDDCPlaybook will be created + resource "null_resource" "RunAddSecondDDCPlaybook" { + id = (known after apply) } # null_resource.RunAdditionalSiteConfigurationPlaybook will be created + resource "null_resource" "RunAdditionalSiteConfigurationPlaybook" { + id = (known after apply) } # null_resource.RunConfigureAdminGroupPlaybook will be created + resource "null_resource" "RunConfigureAdminGroupPlaybook" { + id = (known after apply) } # null_resource.RunConfigureSetLicensingPlaybook will be created + resource "null_resource" "RunConfigureSetLicensingPlaybook" { + id = (known after apply) } # null_resource.RunCreateDatabasePlaybook will be created + resource "null_resource" "RunCreateDatabasePlaybook" { + id = (known after apply) } # null_resource.RunCreateSitePlaybook will be created + resource "null_resource" "RunCreateSitePlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsAdditionalSiteConfiguration will be created + resource "time_sleep" "wait_10_secondsAdditionalSiteConfiguration" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsConfigureAdminGroup will be created + resource "time_sleep" "wait_10_secondsConfigureAdminGroup" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsSecondDDC will be created + resource "time_sleep" "wait_10_secondsSecondDDC" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_300_secondsCDB will be created + resource "time_sleep" "wait_300_secondsCDB" { + create_duration = "300s" + id = (known after apply) } # time_sleep.wait_60_secondsCS will be created + resource "time_sleep" "wait_60_secondsCS" { + create_duration = "60s" + id = (known after apply) } Plan: 20 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPowerShellScriptsToDDC1: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creation complete after 1s [id=3364084582988389224] time_sleep.wait_10_seconds: Creating... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> ... null_resource.CopyPowerShellScriptsToDDC1: Creation complete after 10s [id=6861429796874371568] time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-12T16:58:47Z] null_resource.RunCreateDatabasePlaybook: Creating... null_resource.RunCreateDatabasePlaybook: Provisioning with 'local-exec'... null_resource.RunCreateDatabasePlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/CreateDatabases.ansible.yml -i /etc/ansible/assets/inventory.ini -vvv -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunCreateDatabasePlaybook (local-exec): PLAYBOOK: CreateDatabases.ansible.yml ****************************************** null_resource.RunCreateDatabasePlaybook (local-exec): 1 plays in /etc/ansible/assets/CreateDatabases.ansible.yml null_resource.RunCreateDatabasePlaybook (local-exec): PLAY [Run PowerShell script on Windows Server as Domain Admin] ***************** null_resource.RunCreateDatabasePlaybook (local-exec): TASK [Run the StoreFront installer PowerShell script as domain user] *********** null_resource.RunCreateDatabasePlaybook (local-exec): task path: /etc/ansible/assets/CreateDatabases.ansible.yml:20 null_resource.RunCreateDatabasePlaybook (local-exec): Using module file /usr/lib/python3/dist-packages/ansible_collections/community/windows/plugins/modules/win_psexec.ps1 null_resource.RunCreateDatabasePlaybook (local-exec): Pipelining is enabled. null_resource.RunCreateDatabasePlaybook (local-exec): <tf-cvad-ddc1.the-austrian-citrix-guy.at> ESTABLISH WINRM CONNECTION FOR USER: svc_ansible on PORT 5986 TO tf-cvad-ddc1.the-austrian-citrix-guy.at null_resource.RunCreateDatabasePlaybook (local-exec): EXEC (via pipeline wrapper) null_resource.RunCreateDatabasePlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => { null_resource.RunCreateDatabasePlaybook (local-exec): "changed": true, null_resource.RunCreateDatabasePlaybook (local-exec): "delta": "0:00:32.533635", null_resource.RunCreateDatabasePlaybook (local-exec): "end": "2025-11-12 04:59:20.201075", null_resource.RunCreateDatabasePlaybook (local-exec): "invocation": { null_resource.RunCreateDatabasePlaybook (local-exec): "module_args": { null_resource.RunCreateDatabasePlaybook (local-exec): "chdir": null, null_resource.RunCreateDatabasePlaybook (local-exec): "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\CreateDatabases.ps1\"", null_resource.RunCreateDatabasePlaybook (local-exec): "elevated": true, null_resource.RunCreateDatabasePlaybook (local-exec): "executable": "C:\\InstallCVAD\\PsExec64.exe", null_resource.RunCreateDatabasePlaybook (local-exec): "hostnames": null, null_resource.RunCreateDatabasePlaybook (local-exec): "interactive": true, null_resource.RunCreateDatabasePlaybook (local-exec): "limited": false, null_resource.RunCreateDatabasePlaybook (local-exec): "nobanner": false, null_resource.RunCreateDatabasePlaybook (local-exec): "noprofile": true, null_resource.RunCreateDatabasePlaybook (local-exec): "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", null_resource.RunCreateDatabasePlaybook (local-exec): "priority": null, null_resource.RunCreateDatabasePlaybook (local-exec): "session": null, null_resource.RunCreateDatabasePlaybook (local-exec): "system": false, null_resource.RunCreateDatabasePlaybook (local-exec): "timeout": null, null_resource.RunCreateDatabasePlaybook (local-exec): "username": "TACG\\administrator", null_resource.RunCreateDatabasePlaybook (local-exec): "wait": true null_resource.RunCreateDatabasePlaybook (local-exec): } null_resource.RunCreateDatabasePlaybook (local-exec): }, null_resource.RunCreateDatabasePlaybook (local-exec): "psexec_command": "C:\\InstallCVAD\\PsExec64.exe -u TACG\\administrator -p *PASSWORD_REPLACED* -e -h -i -accepteula powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\CreateDatabases.ps1\"", null_resource.RunCreateDatabasePlaybook (local-exec): "rc": 0, null_resource.RunCreateDatabasePlaybook (local-exec): "start": "2025-11-12 04:58:47.667440", null_resource.RunCreateDatabasePlaybook (local-exec): "stderr": "Connecting to local system...\r\r\rStarting PSEXESVC service on local system...\r\r\rCopying authentication key to TF-CVAD-DDC1...\r\r\rConnecting with PsExec service on TF-CVAD-DDC1...\r\r\rStarting powershell.exe on TF-CVAD-DDC1...\r\r\r\r\npowershell.exe exited on TF-CVAD-DDC1 with error code 0.\r\n", null_resource.RunCreateDatabasePlaybook (local-exec): "stderr_lines": [ null_resource.RunCreateDatabasePlaybook (local-exec): "Connecting to local system...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Starting PSEXESVC service on local system...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Copying authentication key to TF-CVAD-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Connecting with PsExec service on TF-CVAD-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Starting powershell.exe on TF-CVAD-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "powershell.exe exited on TF-CVAD-DDC1 with error code 0." null_resource.RunCreateDatabasePlaybook (local-exec): ], null_resource.RunCreateDatabasePlaybook (local-exec): "stdout": "\r\nPsExec v2.43 - Execute processes remotely\r\nCopyright (C) 2001-2023 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\n", null_resource.RunCreateDatabasePlaybook (local-exec): "stdout_lines": [ null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "PsExec v2.43 - Execute processes remotely", null_resource.RunCreateDatabasePlaybook (local-exec): "Copyright (C) 2001-2023 Mark Russinovich", null_resource.RunCreateDatabasePlaybook (local-exec): "Sysinternals - www.sysinternals.com", null_resource.RunCreateDatabasePlaybook (local-exec): "" null_resource.RunCreateDatabasePlaybook (local-exec): ] null_resource.RunCreateDatabasePlaybook (local-exec): } null_resource.RunCreateDatabasePlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunCreateDatabasePlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunCreateDatabasePlaybook: Creation complete after 35s [id=5576848404034541586] data.external.CheckAnsibleReturnCodeCDB: Reading... data.external.CheckAnsibleReturnCodeCDB: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltCDB: Creating... null_resource.IfExitCodeIsNotZeroThenHaltCDB: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltCDB (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltCDB (local-exec): Create Databases - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltCDB: Creation complete after 0s [id=449387280135483830] ... Running all Playbooks looks similar, omitted due to the length of the output. ... null_resource.RunConfigureSetLicensingPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunConfigureSetLicensingPlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunConfigureSetLicensingPlaybook: Creation complete after 13s [id=5106544801416722566] data.external.CheckAnsibleReturnCodeSetLicensing: Reading... data.external.CheckAnsibleReturnCodeSetLicensing: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Creating... null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Licensing Configuration - Everything OK\" || { echo \"Configuration of Licensing failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing (local-exec): Licensing Configuration - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Creation complete after 0s [id=1454545395290283154] Apply complete! Resources: 26 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ConfigureSite$The Terraform snippet has successfully created the site and all needed configurations. The CVAD site was successfully created: All site tests are successful: With the CVAD site ready, we can proceed to the next step. Part 9: Using Terraform to create the StoreFront deployment and all its necessitiesCreating a StoreFront deployment is a simple, straightforward task. Terraform can create the Storefront site on its own – no Ansible interaction is needed. Extreme Caution As already mentioned, this module, Module 9, must be run on a Windows-based, domain-joined VM due to limitations in StoreFront´s automation capabilities. Terraform will sequentially run the following tasks: Create the StoreFront deployment Create a StoreFront Authentication service Create a StoreFront Store service Create a StoreFront WebReceiver service Warning The current Automation snippets of StoreFront will only run on Windows Powershell <=5.1. They will not run on Powershell >=6. Be sure to start the Terraform code on the correct PowerShell version. You may encounter this error after starting the Terraform snippet: Error: Error fetching StoreFront version │ │ with citrix_stf_webreceiver_service.CreateSFWebReceiverService, │ on CVADOnXS-ConfigureStoreFront.tf line 48, in resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService": │ 48: resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { │ │ Error message: error executing command: Get-STFVersion │ Error Message: │ ConvertTo-SecureString : "ConvertTo-SecureString" was found in module "Microsoft.PowerShell.Security", │ we were unable to load the module. Run "Import-Module │ Microsoft.PowerShell.Security". │ In row:1 column:205 │ + ... n@the-austrian-citrix-guy.at',(ConvertTo-SecureString -Force ... │ + ~~~~~~~~~~~~~~~~~~~~~~ │ + CategoryInfo : ObjectNotFound: (ConvertTo-SecureString:String) [], CommandNotFoundException │ + FullyQualifiedErrorId : CouldNotAutoloadMatchingModuleThat error means you have not loaded the module Microsoft.PowerShell.Security in Windows PowerShell. Be sure to load the module in Windows PowerShell, not PowerShell: PS C:\__PPMM\ConfigureStoreFront> Import-Module Microsoft.PowerShell.Security After loading the module in Windows PowerShell, the error should be gone and the Terraform snippet run through. Before running the snippet, the StoreFront server has no StoreFront site configured. Example Terraform snippet to create a StoreFront site: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Configuring StoreFront ##### Reference https://github.com/citrix/terraform-provider-citrix/blob/main/StoreFront.md ###### Create an initial StoreFront Deployment resource "citrix_stf_deployment" "CreateInitialSFDeployment" { site_id = var.TACG-TMM-SF-SiteID host_base_url = var.TACG-TMM-SF-SiteURL roaming_gateway = [ { name = var.TACG-TMM-SF-Gateway-Name logon_type = var.TACG-TMM-SF-Gateway-LogonType gateway_url = var.TACG-TMM-SF-Gateway-URL callback_url = var.TACG-TMM-SF-Gateway-CallbackURL subnet_ip_address = var.TACG-TMM-SF-Gateway-SNIP secure_ticket_authority_urls = var.TACG-TMM-SF-Gateway-STAs } ] roaming_beacon = { internal_address = var.TACG-TMM-SF-Beacon-Internal external_addresses = var.TACG-TMM-SF-Beacon-External } } ##### Create an Authentication service resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-AuthService-Name virtual_path = var.TACG-TMM-SF-AuthService-Path } ##### Create a Store service resource "citrix_stf_store_service" "CreateSFStoreService" { depends_on = [citrix_stf_authentication_service.CreateSFAuthenticationService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id virtual_path = var.TACG-TMM-SF-StoreService-Path friendly_name = var.TACG-TMM-SF-StoreService-Name authentication_service_virtual_path = citrix_stf_authentication_service.CreateSFAuthenticationService.virtual_path pna = { enable = false } farms = var.TACG-TMM-SF-StoreService-Farms } ##### Create a WebReceiver service resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment, citrix_stf_store_service.CreateSFStoreService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-WebService-Name virtual_path = var.TACG-TMM-SF-WebService-Path store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path authentication_methods = [ "ExplicitForms", "CitrixAGBasic" ] plugin_assistant = { enabled = var.TACG-TMM-SF-WebService-PA-Enabled html5_single_tab_launch = var.TACG-TMM-SF-WebService-PA-HTML5SingleTab upgrade_at_login = var.TACG-TMM-SF-WebService-PA-UpgradeAtLogin html5_enabled = var.TACG-TMM-SF-WebService-PA-HTML5Enabled } application_shortcuts = { prompt_for_untrusted_shortcuts = var.TACG-TMM-SF-WebService-AppSC-Prompt trusted_urls = var.TACG-TMM-SF-WebService-AppSC-TrustedURLs } user_interface = { auto_launch_desktop = var.TACG-TMM-SF-WebService-UI-AutoLaunchDesktop multi_click_timeout = var.TACG-TMM-SF-WebService-UI-Timeout enable_apps_folder_view = var.TACG-TMM-SF-WebService-UI-AppFolderView workspace_control = { enabled = var.TACG-TMM-SF-WebService-UI-WC-Enabled auto_reconnect_at_logon = var.TACG-TMM-SF-WebService-UI-WC-AutoReconnect logoff_action = var.TACG-TMM-SF-WebService-UI-LogoffAction show_reconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowReconnect show_disconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowDisconnect } receiver_configuration = { enabled = var.TACG-TMM-SF-WebService-RC-Enabled } app_shortcuts = { enabled = var.TACG-TMM-SF-WebService-ASC-Enabled show_desktop_shortcut = var.TACG-TMM-SF-WebService-ASC-ShowDesktopShortcut } ui_views = { show_apps_view = var.TACG-TMM-SF-WebService-UIViews-Apps show_desktops_view = var.TACG-TMM-SF-WebService-UIViews-Desktops default_view = var.TACG-TMM-SF-WebService-UIViews-Default } category_view_collapsed = var.TACG-TMM-SF-WebService-CategoryView move_app_to_uncategorized = var.TACG-TMM-SF-WebService-Uncategorized progressive_web_app = { enabled = var.TACG-TMM-SF-WebService-PWA-Enabled show_install_prompt = var.TACG-TMM-SF-WebService-PWA-Install } show_activity_manager = var.TACG-TMM-SF-WebService-ActivityManager show_first_time_use = var.TACG-TMM-SF-WebService-FirstTimeUse prevent_ica_downloads = var.TACG-TMM-SF-WebService-PreventICADownloads } resources_service = { ica_file_cache_expiry = var.TACG-TMM-SF-WebService-RS-IcaFileExpiry persistent_icon_cache_enabled = var.TACG-TMM-SF-WebService-RS-IconCacheEnabled } } ##### A PNA site is not installed due to no effective needs #resource "citrix_stf_xenapp_default_store" "CreateSFXenAppPath" { # depends_on = [citrix_stf_store_service.CreateSFStoreService] # store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path # store_site_id = citrix_stf_store_service.CreateSFStoreService.site_id #} Running the snippet should complete all required steps – during the run, the StoreFront server installs any missing roles and features. PS C:\_ppmm\__TF\CVADOnXS-2511\_ConfigureStoreFront> terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_stf_authentication_service.CreateSFAuthenticationService will be created + resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { + claims_factory_name = "standardClaimsFactory" + friendly_name = "TACG-SF-AuthService" + site_id = "1" + virtual_path = "/Citrix/Authentication" } # citrix_stf_deployment.CreateInitialSFDeployment will be created + resource "citrix_stf_deployment" "CreateInitialSFDeployment" { + host_base_url = "https://storefront.the-austrian-citrix-guy.at" + roaming_beacon = { + external_addresses = [ + "https://www.orf.at/", + "https://www.microsoft.com/", ] + internal_address = "http://10.10.100.1/" } + roaming_gateway = [ + { + callback_url = "https://access.the-austrian-citrix-guy.at/CitrixAuthService/AuthService.asmx" + gateway_url = "https://access.the-austrian-citrix-guy.at/" + is_cloud_gateway = false + logon_type = "Domain" + name = "TACG-NS" + request_ticket_from_two_stas = false + secure_ticket_authority_urls = [ + { + sta_url = "http://tf-cvad-ddc1.the-austrian-citrix-guy.at/scripts/ctxsta.dll" + sta_validation_enabled = false }, + { + sta_url = "http://tf-cvad-ddc2.the-austrian-citrix-guy.at/scripts/ctxsta.dll" + sta_validation_enabled = false }, ] + session_reliability = false + smart_card_fallback_logon_type = "None" + stas_bypass_duration = "0.1:0:0" + stas_use_load_balancing = false + subnet_ip_address = "10.10.119.112" + version = "Version10_0_69_4" }, ] + site_id = "1" } # citrix_stf_store_service.CreateSFStoreService will be created + resource "citrix_stf_store_service" "CreateSFStoreService" { + authentication_service_virtual_path = "/Citrix/Authentication" + farms = [ + { + all_failed_bypass_duration = 0 + bypass_duration = 60 + farm_name = "TACG80" + farm_type = "XenDesktop" + load_balance = true + max_failed_servers_per_request = 0 + port = 80 + rade_ticket_time_to_live = 100 + server_urls = [] + servers = [ + "tf-cvad-sf.the-austrian-citrix-guy.at", ] + ssl_relay_port = 443 + ticket_time_to_live = 200 + transport_type = "HTTPS" + xml_validation_enabled = false + zones = [] # (4 unchanged attributes hidden) }, + { + all_failed_bypass_duration = 0 + bypass_duration = 60 + farm_name = "TACG443" + farm_type = "XenDesktop" + load_balance = true + max_failed_servers_per_request = 0 + port = 443 + rade_ticket_time_to_live = 100 + server_urls = [] + servers = [ + "tf-cvad-sf.the-austrian-citrix-guy.at", ] + ssl_relay_port = 443 + ticket_time_to_live = 200 + transport_type = "HTTPS" + xml_validation_enabled = false + zones = [] # (4 unchanged attributes hidden) }, ] + friendly_name = "TACG-SF-StoreService" + pna = { + enable = false } + site_id = "1" + virtual_path = "/Citrix/Store" } # citrix_stf_webreceiver_service.CreateSFWebReceiverService will be created + resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { + application_shortcuts = { + gateway_urls = [] + prompt_for_untrusted_shortcuts = true + trusted_urls = [ + "https://storefront.the-austrian-citrix-guy.at/", ] } + authentication_methods = [ + "CitrixAGBasic", + "ExplicitForms", ] + friendly_name = "TACG-SF-WebReceiverService" + plugin_assistant = { + enabled = true + html5_enabled = "Fallback" + html5_single_tab_launch = true + show_after_login = false + upgrade_at_login = true } + resources_service = { + ica_file_cache_expiry = 80 + icon_size = 128 + persistent_icon_cache_enabled = true + show_desktop_viewer = true } + site_id = "1" + store_virtual_path = "/Citrix/Store" + user_interface = { + app_shortcuts = { + allow_session_reconnect = false } + auto_launch_desktop = true + category_view_collapsed = false + enable_apps_folder_view = true + move_app_to_uncategorized = true + multi_click_timeout = 3 + prevent_ica_downloads = false + progressive_web_app = { + enabled = false + show_install_prompt = false } + receiver_configuration = { + download_url = (known after apply) + enabled = true } + show_activity_manager = true + show_first_time_use = true + ui_views = { + default_view = "Auto" + show_apps_view = true + show_desktops_view = true } + workspace_control = { + auto_reconnect_at_logon = true + enabled = true + logoff_action = "Disconnect" + show_disconnect_button = false + show_reconnect_button = false } } + virtual_path = "/Citrix/StoreWeb" } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_stf_deployment.CreateInitialSFDeployment: Creating... citrix_stf_deployment.CreateInitialSFDeployment: Still creating... [00m10s elapsed] citrix_stf_deployment.CreateInitialSFDeployment: Still creating... [00m20s elapsed] citrix_stf_deployment.CreateInitialSFDeployment: Creation complete after 25s citrix_stf_authentication_service.CreateSFAuthenticationService: Creating... citrix_stf_authentication_service.CreateSFAuthenticationService: Creation complete after 6s citrix_stf_store_service.CreateSFStoreService: Creating... citrix_stf_store_service.CreateSFStoreService: Still creating... [00m10s elapsed] citrix_stf_store_service.CreateSFStoreService: Creation complete after 16s citrix_stf_webreceiver_service.CreateSFWebReceiverService: Creating... citrix_stf_webreceiver_service.CreateSFWebReceiverService: Still creating... [00m10s elapsed] citrix_stf_webreceiver_service.CreateSFWebReceiverService: Creation complete after 15s Apply complete! Resources: 4 added, 0 changed, 0 destroyed. PS C:\_ppmm\__TF\CVADOnXS-2511\_ConfigureStoreFront>The StoreFront server now has a valid StoreFront site deployed: With the StoreFront site ready, we can proceed to the final step: deploying all CVAD-related entities. Important You can now switch back to the Ubuntu IaC machine or stay on the Windows machine to run the last Terraform snippet. Part 10: Using Terraform to create all CVAD entities and all their necessitiesCreating the final steps is a simple, straightforward task. Terraform can create the CVAD entities site on its own – no Ansible interaction is needed. Create a StoreFront Server object Create a Hypervisor connection Create a Hypervisor connection resource pool Create a Machine Catalog Create a Delivery Group Create a Policy Set and its policies Before running the snippet, no CVAD-related entity is configured: No Hypervisor Connection and Hypervisor Connection pool exist, no Machine Catalog exists, no Delivery Group exists, and no dedicated Policy Set exists: Example Terraform snippet to create all needed CVAD entities as mentioned above: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenCVADServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/citrix/citrix/latest/docs #### Definition of all required local variables or data ##### Get XenServer-related Data ###### Get the VM SR object data "xenserver_sr" "vmsr" { name_label = var.TACG-TMM-XS-CL-VMSR } /* output "name" { value = data.xenserver_sr.vmsr.data_items[0].name_label } */ ###### Get the Network object data "xenserver_network" "network" { } ##### Get CVAD-related Data ###### Get the Zone in CVAD data "citrix_zone" "TACG-TMM-CVAD-Zone" { name = var.TACG-TMM-CVAD-Zone-Name } #### Create a StoreFront Server object - we assume a load-balanced server resource "citrix_storefront_server" "CreateSFServer" { name = var.TACG-TMM-SF-Server-Name description = var.TACG-TMM-SF-Server-Description url = var.TACG-TMM-SF-Server-URL enabled = true } #### Create a Hypervisor Connection resource "citrix_xenserver_hypervisor" "TACG-TMM-CVAD-HypConn" { depends_on = [data.citrix_zone.TACG-TMM-CVAD-Zone] name = var.TACG-TMM-CVAD-HypConn-Name zone = data.citrix_zone.TACG-TMM-CVAD-Zone.id username = var.XS-CL-UN password = var.XS-CL-PW password_format = "PlainText" addresses = var.XS-CL-IPs ssl_thumbprints = var.XS-CL-SSLTP } resource "null_resource" "WriteProgress1" { depends_on = [citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn] provisioner "local-exec" { command = "echo The Hypervisor Connection was successfully created..." } } #### Create a Hypervisor Connection Resource Pool resource "citrix_xenserver_hypervisor_resource_pool" "TACG-TMM-CVAD-HypConnPool" { depends_on = [citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn] name = var.TACG-TMM-CVAD-HypConnPool-Name hypervisor = citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn.id networks = [data.xenserver_network.network.data_items[0].name_label] storage = [ { storage_name = data.xenserver_sr.vmsr.data_items[0].name_label } ] temporary_storage = [ { storage_name = data.xenserver_sr.vmsr.data_items[0].name_label } ] use_local_storage_caching = false } resource "null_resource" "WriteProgress2" { depends_on = [citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool] provisioner "local-exec" { command = "echo The Hypervisor Connection Pool was successfully created..." } } #### Create the Machine Catalog ##### Important: Using CVAD Image Definitions and Image Versions is currently not supported on a XenServer-based deployment. ##### Important: You need to use standard Master Image VMs/Snapshots for creation of a Machine Catalog! resource "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { depends_on = [citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool] name = var.TACG-TMM-CVAD-MC-Name description = var.TACG-TMM-CVAD-MC-Description provisioning_type = var.TACG-TMM-CVAD-MC-ProvisioningType allocation_type = var.TACG-TMM-CVAD-MC-AllocationType session_support = var.TACG-TMM-CVAD-MC-SessionType zone = data.citrix_zone.TACG-TMM-CVAD-Zone.id provisioning_scheme = { hypervisor = citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn.id hypervisor_resource_pool = citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool.id identity_type = var.TACG-TMM-CVAD-MC-IdentityType machine_domain_identity = { domain = var.TACG-TMM-CVAD-MC-VM-DomainFQDN domain_ou = var.TACG-TMM-CVAD-MC-VM-DomainOU service_account = var.TACG-TMM-CVAD-MC-VM-ServiceUserName service_account_password = var.TACG-TMM-CVAD-MC-VM-ServiceUserPassword } xenserver_machine_config = { master_image_vm = var.TACG-TMM-CVAD-MC-MasterImageVMName cpu_count = var.TACG-TMM-CVAD-MC-VM-CPUCount memory_mb = var.TACG-TMM-CVAD-MC-VM-MemorySize image_snapshot = var.TACG-TMM-CVAD-MC-MasterImageVMName-SnapshotName use_full_disk_clone_provisioning = var.TACG-TMM-CVAD-MC-MasterImageVMName-UseFullDiskClone } number_of_total_machines = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs machine_account_creation_rules = { naming_scheme = var.TACG-TMM-CVAD-MC-VM-NamingScheme naming_scheme_type = var.TACG-TMM-CVAD-MC-VM-NamingSchemeType } } } resource "null_resource" "WriteProgress3" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-MC] provisioner "local-exec" { command = "echo The Machine Catalog was successfully created..." } } /* data "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { name = var.TACG-TMM-CVAD-MC-Name } */ #### Create the Delivery Group resource "citrix_delivery_group" "TACG-TMM-CVAD-DG" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-MC, citrix_storefront_server.CreateSFServer] #depends_on = [data.citrix_machine_catalog.TACG-TMM-CVAD-MC] name = var.TACG-TMM-CVAD-DG-Name description = var.TACG-TMM-CVAD-DG-Description minimum_functional_level = var.TACG-TMM-CVAD-DG-FunctionalLevel storefront_servers = [citrix_storefront_server.CreateSFServer.id] associated_machine_catalogs = [ { machine_catalog = citrix_machine_catalog.TACG-TMM-CVAD-MC.id #machine_catalog = data.citrix_machine_catalog.TACG-TMM-CVAD-MC.id machine_count = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-CVAD-DG-Desktops-Name description = var.TACG-TMM-CVAD-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } enabled = var.TACG-TMM-CVAD-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC # enable_session_roaming = var.TACG-TMM-CVAD-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-CVAD-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-CVAD-DG-AS-Days display_name = var.TACG-TMM-CVAD-DG-AS-Name peak_time_ranges = var.TACG-TMM-CVAD-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-CVAD-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-CVAD-DG-RS-Enabled frequency = var.TACG-TMM-CVAD-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-CVAD-DG-RS-RebootDays start_time = var.TACG-TMM-CVAD-DG-RS-RebootStartTime start_date = var.TACG-TMM-CVAD-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-CVAD-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-CVAD-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-CVAD-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-CVAD-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-MessageRepeat #} } ] } resource "null_resource" "WriteProgress4" { depends_on = [citrix_delivery_group.TACG-TMM-CVAD-DG] provisioner "local-exec" { command = "echo The Delivery Group was successfully created..." } } #### Create a default Policy Set resource "citrix_policy_set_v2" "TACG-TMM-CVAD-DefaultPolicySet" { depends_on = [citrix_delivery_group.TACG-TMM-CVAD-DG] name = var.TACG-TMM-CVAD-PS-Name description = var.TACG-TMM-CVAD-PS-Description delivery_groups = [citrix_delivery_group.TACG-TMM-CVAD-DG.id] } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-Printing" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "Printing" description = "Example of Printer-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-HDX" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "HDX™ Graphics" description = "Example of HDX Graphics-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-ClientDrives" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "Client Drives" description = "Example of Client Drive-related policy in default Policy Set" enabled = true } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id name = "ClientPrinterAutoCreation" value = "DefaultPrinterOnly" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id name = "UniversalPrintDriverUsage" value = "FallbackToSpecific" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "AllowVisuallyLosslessCompression" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "UseVideoCodecForCompression" value = "UseVideoCodecIfPreferred" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX3" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "UseHardwareEncodingForVideoCodec" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "AutoConnectDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientDriveRedirection" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD3" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientFixedDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD4" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientFloppyDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD5" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientOpticalDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD6" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientNetworkDrives" enabled = false use_default = false } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } resource "null_resource" "WriteProgress5" { depends_on = [citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2] provisioner "local-exec" { command = "echo The default Policy Set and its policies and filters were successfully created..." } }Running the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_CreateCitrixEntities$ terraform apply data.xenserver_network.network: Reading... data.xenserver_sr.vmsr: Reading... data.xenserver_network.network: Read complete after 0s data.xenserver_sr.vmsr: Read complete after 0s data.citrix_zone.TACG-TMM-CVAD-Zone: Reading... data.citrix_zone.TACG-TMM-CVAD-Zone: Read complete after 0s [id=47010f19-5c99-4414-ab73-01a31aacff9a] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_machine_catalog.TACG-TMM-CVAD-MC will be created + resource "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { + allocation_type = "Static" + built_in_scopes = (known after apply) + delete_machine_accounts = "None" + description = "Terraform-created Machine Catalog for TACG running on XS8-Cluster" + id = (known after apply) + inherited_scopes = (known after apply) + minimum_functional_level = "L7_20" + name = "TACG-TMM-CVAD-XS8-MC" + persist_user_changes = (known after apply) + provisioning_scheme = { + hypervisor = (known after apply) + hypervisor_resource_pool = (known after apply) + identity_type = "ActiveDirectory" + machine_account_creation_rules = { + naming_scheme = "tf-mcs-w11-#" + naming_scheme_type = "Numeric" } + machine_domain_identity = { + domain = "the-austrian-citrix-guy.at" + domain_ou = "OU=_COMPUTER,OU=TACG-CVAD,DC=the-austrian-citrix-guy,DC=at" + service_account = (sensitive value) + service_account_password = (sensitive value) } + number_of_total_machines = 2 + xenserver_machine_config = { + cpu_count = 2 + image_snapshot = "" + master_image_note = "" + master_image_vm = "W1125H2" + memory_mb = 4096 + use_full_disk_clone_provisioning = false } } + provisioning_type = "MCS" + scopes = [] + session_support = "SingleSession" + tenants = (known after apply) + zone = "47010f19-5c99-4414-ab73-01a31aacff9a" } # citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn will be created + resource "citrix_xenserver_hypervisor" "TACG-TMM-CVAD-HypConn" { + addresses = [ + "http://10.10.119.1", ] + id = (known after apply) + max_absolute_active_actions = 40 + max_absolute_new_actions_per_minute = 10 + max_power_actions_percentage_of_machines = 20 + name = "TACG-TMM-CVAD-XS8-Cluster" + password = (sensitive value) + password_format = "PlainText" + scopes = [] + ssl_thumbprints = (sensitive value) + tenants = (known after apply) + username = (sensitive value) + zone = "47010f19-5c99-4414-ab73-01a31aacff9a" } # citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool will be created + resource "citrix_xenserver_hypervisor_resource_pool" "TACG-TMM-CVAD-HypConnPool" { + hypervisor = (known after apply) + id = (known after apply) + name = "TACG-TMM-CVAD-XS8-Cluster" + networks = [ + "Network0", ] + storage = [ + { + storage_name = "local storage" + superseded = false }, ] + temporary_storage = [ + { + storage_name = "local storage" + superseded = false }, ] + use_local_storage_caching = false + vm_tagging = true } # null_resource.WriteProgress1 will be created + resource "null_resource" "WriteProgress1" { + id = (known after apply) } # null_resource.WriteProgress2 will be created + resource "null_resource" "WriteProgress2" { + id = (known after apply) } # null_resource.WriteProgress3 will be created + resource "null_resource" "WriteProgress3" { + id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_delivery_group.TACG-TMM-CVAD-DG will be created + resource "citrix_delivery_group" "TACG-TMM-CVAD-DG" { + associated_machine_catalogs = [ + { + machine_catalog = "c052bbc4-d5a7-407a-baa3-d0faf901a0b1" + machine_count = 2 }, ] + autoscale_settings = { + autoscale_enabled = true + disconnect_off_peak_idle_session_after_seconds = 0 + disconnect_peak_idle_session_after_seconds = 0 + log_off_off_peak_disconnected_session_after_seconds = 0 + log_off_peak_disconnected_session_after_seconds = 0 + log_off_reminder_enabled = false + log_off_reminder_message = "" + log_off_reminder_title = "" + log_off_warning_message = "" + log_off_warning_title = "" + off_peak_buffer_size_percent = 0 + off_peak_disconnect_action = "Suspend" + off_peak_disconnect_timeout_minutes = 5 + off_peak_extended_disconnect_action = "Nothing" + off_peak_extended_disconnect_timeout_minutes = 0 + off_peak_limit_seconds_to_force_log_off_user = 0 + off_peak_log_off_action = "Suspend" + off_peak_log_off_reminder_interval = 0 + off_peak_log_off_timeout_minutes = 5 + peak_autoscale_assigned_power_on_idle_action = "Nothing" + peak_autoscale_assigned_power_on_idle_timeout_minutes = 0 + peak_buffer_size_percent = 0 + peak_disconnect_action = "Suspend" + peak_disconnect_timeout_minutes = 5 + peak_extended_disconnect_action = "Nothing" + peak_extended_disconnect_timeout_minutes = 0 + peak_limit_seconds_to_force_log_off_user = 0 + peak_log_off_action = "Suspend" + peak_log_off_reminder_interval = 0 + peak_log_off_timeout_minutes = 5 + power_off_delay_minutes = 30 + power_time_schemes = [ + { + days_of_week = [ + "Friday", + "Monday", + "Thursday", + "Tuesday", + "Wednesday", ] + display_name = "TACG-TMM-CVAD-XS8-AS" + peak_time_ranges = [ + "09:00-17:00", ] + pool_using_percentage = false }, ] + timezone = "UTC" } + built_in_scopes = (known after apply) + color_depth = "TwentyFourBit" + default_desktop_icon = "1" + description = "Terraform-created Delivery Group for TACG running on XS8-Cluster" + desktops = [ + { + description = "Terraform-created W11 Desktops running on XS8-Cluster" + enabled = true + id = (known after apply) + published_name = "TACG-XS8-W11" + restricted_access_users = { + allow_list = [ + "TACG\\vdaallowed", ] + block_list = [] } }, ] + enabled = true + force_delete = false + id = (known after apply) + in_maintenance_mode = false + inherited_scopes = (known after apply) + load_balancing_type = "None" + minimum_functional_level = "L7_20" + name = "TACG-TMM-CVAD-XS8-DG" + reboot_schedules = [ + { + days_in_week = [ + "Sunday", ] + frequency = "Weekly" + frequency_factor = 1 + ignore_maintenance_mode = true + name = "TACG-TMM-CVAD-XS8-RS" + natural_reboot_schedule = false + reboot_duration_minutes = 0 + reboot_schedule_enabled = true + start_date = "2025-01-01" + start_time = "02:00" # (1 unchanged attribute hidden) }, ] + restricted_access_users = { + allow_list = [ + "TACG\\vdaallowed", ] + block_list = [] } + scopes = [] + secure_ica_required = false + tenants = (known after apply) + total_machines = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-ClientDrives" { + description = "Example of Client Drive-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "Client Drives" + policy_set_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-HDX" { + description = "Example of HDX Graphics-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "HDX Graphics" + policy_set_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-Printing" { + description = "Example of Printer-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "Printing" + policy_set_id = (known after apply) } # citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet will be created + resource "citrix_policy_set_v2" "TACG-TMM-CVAD-DefaultPolicySet" { + assigned = (known after apply) + delivery_groups = [ + (known after apply), ] + description = "Terraform-created default Policy Set for TACG running on XS8-Cluster" + id = (known after apply) + name = "TACG-TMM-CVAD-XS8-PS-Default" + scopes = [] } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD1" { + enabled = true + id = (known after apply) + name = "AutoConnectDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD2" { + enabled = true + id = (known after apply) + name = "ClientDriveRedirection" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD3" { + enabled = true + id = (known after apply) + name = "ClientFixedDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD4" { + enabled = false + id = (known after apply) + name = "ClientFloppyDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD5" { + enabled = false + id = (known after apply) + name = "ClientOpticalDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD6" { + enabled = false + id = (known after apply) + name = "ClientNetworkDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX1" { + enabled = true + id = (known after apply) + name = "AllowVisuallyLosslessCompression" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX2" { + id = (known after apply) + name = "UseVideoCodecForCompression" + policy_id = (known after apply) + use_default = false + value = "UseVideoCodecIfPreferred" } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX3" { + enabled = true + id = (known after apply) + name = "UseHardwareEncodingForVideoCodec" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing1" { + id = (known after apply) + name = "ClientPrinterAutoCreation" + policy_id = (known after apply) + use_default = false + value = "DefaultPrinterOnly" } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing2" { + id = (known after apply) + name = "UniversalPrintDriverUsage" + policy_id = (known after apply) + use_default = false + value = "FallbackToSpecific" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # null_resource.WriteProgress4 will be created + resource "null_resource" "WriteProgress4" { + id = (known after apply) } # null_resource.WriteProgress5 will be created + resource "null_resource" "WriteProgress5" { + id = (known after apply) } Plan: 33 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Creating... citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m10s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m20s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m30s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m40s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Creation complete after 41s [id=f6f129aa-c9c6-4b9f-84c3-cb0834342fa6] null_resource.WriteProgress1: Creating... null_resource.WriteProgress1: Provisioning with 'local-exec'... null_resource.WriteProgress1 (local-exec): Executing: ["/bin/sh" "-c" "echo The Hypervisor Connection was successfully created..."] null_resource.WriteProgress1 (local-exec): The Hypervisor Connection was successfully created... null_resource.WriteProgress1: Creation complete after 0s [id=7102860708396185821] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Creating... citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m10s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m20s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m30s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m40s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Creation complete after 40s [id=6d2214be-5d23-44bb-8f90-90acc6151e97] null_resource.WriteProgress2: Creating... null_resource.WriteProgress2: Provisioning with 'local-exec'... null_resource.WriteProgress2 (local-exec): Executing: ["/bin/sh" "-c" "echo The Hypervisor Connection Pool was successfully created..."] null_resource.WriteProgress2 (local-exec): The Hypervisor Connection Pool was successfully created... null_resource.WriteProgress2: Creation complete after 0s [id=4353748660640660049] citrix_machine_catalog.TACG-TMM-CVAD-MC: Creating... citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m10s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m30s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m40s elapsed] ... citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [09m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Creation complete after 41s [id=47df73ea-fde2-3431-33f13-ae8909328dd1] ... citrix_delivery_group.TACG-TMM-CVAD-DG: Creating... citrix_delivery_group.TACG-TMM-CVAD-DG: Still creating... [00m10s elapsed] citrix_delivery_group.TACG-TMM-CVAD-DG: Still creating... [00m20s elapsed] citrix_delivery_group.TACG-TMM-CVAD-DG: Creation complete after 21s [id=e57c8f65-c8a2-4788-bdda-dac19816192b] null_resource.WriteProgress4: Creating... citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Creating... null_resource.WriteProgress4: Provisioning with 'local-exec'... null_resource.WriteProgress4 (local-exec): Executing: ["/bin/sh" "-c" "echo The Delivery Group was successfully created..."] null_resource.WriteProgress4 (local-exec): The Delivery Group was successfully created... null_resource.WriteProgress4: Creation complete after 0s [id=1603009483001819548] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m10s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m20s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m30s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Creation complete after 30s [id=f06d0abd-bfba-4da2-853a-22f1d0f29c94] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX: Creation complete after 1s [id=7d2605d3-8e15-4358-81c0-3e6fecefe31c] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing: Creation complete after 1s [id=ccc01f86-0120-4293-85e6-92ca430553c6] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives: Creation complete after 1s [id=51ee45df-68c8-4221-a9f4-b65fa37c0299] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2: Creating... citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1: Creating... citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2: Creation complete after 1s [id=f4e7a4ba-b9af-4808-86bf-451f2747729d] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2: Creation complete after 1s [id=30c858f9-437c-42af-b917-2938284aae76] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3: Creating... citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2: Creation complete after 1s [id=cc621016-8e1e-48e8-bdcd-244d6bcdaf6e] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1: Creation complete after 1s [id=1b24d545-130a-429e-8c7e-a8340d38d18c] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1: Creation complete after 1s [id=b6a0b752-fcc1-4bcc-87a1-34bc132bddb1] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1: Creation complete after 0s [id=64f9bffa-bd49-44f8-953a-ae15f7137838] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3: Creation complete after 0s [id=0c1174c4-cc2c-45cb-9183-aca6857b46f1] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3: Creation complete after 0s [id=dc53bebb-9ddf-409c-9df3-a29abf995bd0] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2: Creation complete after 1s [id=99327137-cee4-4ad9-81c8-cdc489bf9bf5] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3: Creation complete after 3s [id=d80f6146-6a4f-4950-8f0f-1bf157f64824] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1: Creation complete after 3s [id=41fe293e-0f1a-48a9-bc13-83b44f7d1fb9] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1: Creation complete after 3s [id=89866698-9c9e-4c9a-946b-a0e6cca6b856] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2: Creation complete after 3s [id=e40d7c92-2b67-4d85-94c6-9d648cc4cd16] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5: Creation complete after 1s [id=32b89ef9-d542-4a09-8863-391a7132c80d] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6: Creation complete after 2s [id=0d7e6233-946a-442b-96ab-004a62e72088] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4: Creation complete after 1s [id=45d0697b-b39f-4e70-9c8d-bfb50aef7db2] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3: Creation complete after 2s [id=09d39467-ba5a-4057-ad3c-427789900339] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2: Creation complete after 3s [id=2297952e-611f-4d08-b9c2-a9587d119838] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3: Creation complete after 0s [id=a9332544-c5d4-495b-b800-12f976d4cdef] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1: Creation complete after 0s [id=dde0f25c-7a9e-4429-b1c7-7d5b978a180e] null_resource.WriteProgress5: Creating... null_resource.WriteProgress5: Provisioning with 'local-exec'... null_resource.WriteProgress5 (local-exec): Executing: ["/bin/sh" "-c" "echo The default Policy Set and its policies and filters were successfully created..."] null_resource.WriteProgress5 (local-exec): The default Policy Set and its policies and filters were successfully created... null_resource.WriteProgress5: Creation complete after 0s [id=3134505013310827667] Apply complete! Resources: 33 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_CreateCitrixEntities$Terraform has successfully installed all required Citrix entities: a Hypervisor Connection and a Hypervisor Connection Pool were created, a Machine Catalog was created, a Delivery Group was created, and a dedicated Policy Set and its policies were created. WebStudio shows a complete, error-free deployment of Citrix Virtual Apps and Desktops 2507 LTSR: As the deployment is complete, we can now log on to StoreFront and start our assigned desktop. Part 10: Using Terraform to create all CVAD entities and all their necessitiesRemoving Citrix DaaS entities using TerraformWe have discussed mainly aspects of the CREATION of entities using Terraform. Finally, it is also most important to have an instrument to REMOVE entities created by Terraform. In Infrastructure‑as‑Code (IaC) environments, terraform destroy plays a critical role in ensuring clean deprovisioning, operational discipline, and compliance with governance. By design, Terraform manages infrastructure declaratively—meaning everything it creates is recorded in its state. Using terraform destroy ensures that all Terraform‑managed resources are removed consistently, predictably, and traceably, eliminating the risk of leaving unmanaged or “orphaned” cloud assets behind, and supports security hygiene by ensuring no unused compute, networking, or identity components remain. It also reduces cost leakage. Terraform logs, state history, and pipeline execution metadata provide a verifiable chain of custody for resource lifecycle events. Using terraform destroy creates explicit evidence showing: What was removed, When it was removed, and Who initiated the removal This is essential for audit frameworks such as ISO 27001, SOC 2, and internal IT controls. Example: Removing a Delivery Group You can simply remove the Delivery Group by uncommenting the respective code in your snippet - place the uncomment markers /* <------ place the marker here #### Create the Delivery Group resource "citrix_delivery_group" "TACG-TMM-CVAD-DG" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-MC, citrix_storefront_server.CreateSFServer] #depends_on = [data.citrix_machine_catalog.TACG-TMM-CVAD-MC] name = var.TACG-TMM-CVAD-DG-Name description = var.TACG-TMM-CVAD-DG-Description minimum_functional_level = var.TACG-TMM-CVAD-DG-FunctionalLevel storefront_servers = [citrix_storefront_server.CreateSFServer.id] associated_machine_catalogs = [ { machine_catalog = citrix_machine_catalog.TACG-TMM-CVAD-MC.id #machine_catalog = data.citrix_machine_catalog.TACG-TMM-CVAD-MC.id machine_count = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-CVAD-DG-Desktops-Name description = var.TACG-TMM-CVAD-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } enabled = var.TACG-TMM-CVAD-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC # enable_session_roaming = var.TACG-TMM-CVAD-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-CVAD-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-CVAD-DG-AS-Days display_name = var.TACG-TMM-CVAD-DG-AS-Name peak_time_ranges = var.TACG-TMM-CVAD-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-CVAD-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-CVAD-DG-RS-Enabled frequency = var.TACG-TMM-CVAD-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-CVAD-DG-RS-RebootDays start_time = var.TACG-TMM-CVAD-DG-RS-RebootStartTime start_date = var.TACG-TMM-CVAD-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-CVAD-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-CVAD-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-CVAD-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-CVAD-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-MessageRepeat #} } ] } */ <------ place the marker hereRunning the snippet would remove the Delivery Group: XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployDG$ terraform apply ... Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: - destroy Terraform will perform the following actions: # citrix_delivery_group.CreateDG will be destroyed - resource "citrix_delivery_group" "TACG-TMM-CVAD-DG" { - associated_machine_catalogs = [ - { - machine_catalog = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" -> null - machine_count = 1 -> null }, ] + autoscale_settings = { ... Plan: 0 to add, 0 to change, 1 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_delivery_group.TACG-TMM-CVAD-DG: Destroying... citrix_delivery_group.TACG-TMM-CVAD-DG: Destruction complete after 24s [id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX] Apply complete! Resources: 0 added, 0 changed, 1 destroyed. XxXxXxXxX@devops-automation:/etc/terraform-tmm/DeployDG$Terraform has decommissioned the Delivery Group and its adjacent entities. That completes our example of using Infrastructure-as-Code for creating a Citrix DaaS Deployment on Azure. Using the DeploymentAs all prerequisites are met, we can now log on to our CVAD site and start our assigned VDI desktop. Logging on through Citrix Workspace App or Storefront is possible: SummaryUsing Terraform can significantly streamline your workflow and improve efficiency: Automation: IaC automates repetitive tasks, such as provisioning and managing infrastructure. This reduces the need for manual intervention and minimizes the risk of human error. Consistency: Defining IaC ensures that your environments are consistent and reproducible. This is particularly useful for maintaining multiple environments, such as development, staging, and production. Scalability: IaC makes it easy to scale your infrastructure up or down based on demand. You can define your desired state, and Terraform will handle the necessary changes to achieve that state. Collaboration: IaC configurations can be stored in version control systems like Git, enabling team collaboration. Team members can review, comment on, and approve changes before they are applied. Visibility: IaC provides a clear and auditable record of changes to your infrastructure. This makes it easier to track changes, troubleshoot issues, and ensure compliance with organizational policies. Integration: IaCintegrates with various tools and services, such as CI/CD pipelines, monitoring systems, and configuration management tools. This allows you to create a seamless, automated workflow for managing your infrastructure. Cost Management: By automating resource provisioning and de-provisioning, Terraform helps you optimize resource usage and control costs. You can easily identify and eliminate unused or underutilized resources. That completes Part 4 of the Citrix Automation Handbook. In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we discuss common and special use cases, as well as complete deployment examples from the field. In this part, we focused on: Creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. DisclaimerMost important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Packer, Terraform, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. Using all the provided code snippets is at your own risk – please read the disclaimer below for further information. EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>The Citrix Automation Handbook 2601 - Part 3</h1> <p>Wed, 21 Jan 2026 09:12:37 +0000</p> The Citrix Automation Handbook - Part 3In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In this part, we focus on: Common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. Part 3 Common Use Cases, Special Use Cases, and Examples from the FieldIn this section of the Handbook, we would like to showcase use cases we saw in the field. At first, we discuss the usage of the triad in real-world scenarios based on Customer projects. Common Use Cases of the TriadThese use cases are examples from Customer Projects. Theory: Deploying and Configuring Master Images with Hashicorp Packer and RedHat AnsibleOverviewHashiCorp Packer automates the creation of machine images—across clouds and virtualization platforms—from a single, declarative template, enabling a consistent, repeatable, and fast way to deliver 'golden images' that underpin immutable infrastructure. By combining core Packer capabilities (builders, provisioners, post‑processors) with the HCP Packer registry (channels, metadata, and revocation) and Terraform consumption, platform teams can standardize base images, reduce drift, and accelerate delivery while maintaining compliance. Modern delivery teams operate across multiple platforms (AWS, Azure, GCP, VMware, Docker), and the cost of scripting per platform is high. Packer solves this by building identical images for multiple targets from a single configuration, thereby reducing variability and build time. Let´s look at two ways to automate the creation of Master Images using Packer: Creating a Master Image on vSphere Creating a Master Image on Azure The HCL-based Packer templates are primarily built using variables for maximum flexibility and reusability. There are different ways of modifying the Master Image during the creation process – in this guide, we look at the following steps: Packer initially creates the base images and sets the initial Software configurations on the Master Image using PowerShell scripts embedded in the autounattend.xml file and using different provisioners. After creating the Master Image, we use Ansible and/or Chocolatey to automate additional software installations and configurations. Using this approach, you can maximize flexibility when creating your Master Images automatically. Modifying the Master Image using Autounattend.xmlThe autounattend.xml file is an unattended answer file used during Windows setup. It contains configuration settings and instructions that Windows Setup uses to perform an automated installation without requiring user interaction. Important The autounattend.xml file is only needed for Hypervisor-based Images. It is not required for all Hyperscaler- or Cloud-based deployments. Of course, you could convert an upload Hypervisor-based Image to the Hyperscaler… Some benefits of using autounattend.xml files for modifying the Windows Master Image are: Fully Automated Installation: It eliminates the need for manual input during installation (e.g., language selection, disk partitioning, product key entry) Consistency Across Deployments: Ensures every machine is set up precisely the same way — ideal for enterprise environments or mass deployments Time-Saving: Speeds up deployment, especially when installing Windows on many machines Customization: You can predefine: Computer name User accounts Network settings Domain-join settings Application installations Post-install scripts Hands-Free Setup: Useful for remote or unattended installations where no technician is present Note You can decide when to use the autounattend.xml method for initial configuration and when to use Ansible afterward. For demonstration purposes, we use both ways sequentially in this guide. Example of an autounattend.xml file : ... <settings pass="oobeSystem"> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <AutoLogon> <Enabled>true</Enabled> <Username>administrator</Username> <Password> <Value>XxXxXxXxXxXxXxX</Value> <PlainText>true</PlainText> </Password> <LogonCount>5</LogonCount> </AutoLogon> <FirstLogonCommands> <SynchronousCommand wcm:action="add"> <Order>1</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\install-vmwtools.ps1</CommandLine> <Description>VMware Tools Installation</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>2</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\enable-ssh.ps1</CommandLine> <Description>Enable SSH service</Description> <RequiresUserInput>true</RequiresUserInput> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>3</Order> <CommandLine>cmd.exe /c a:\enable-rdp.cmd</CommandLine> <Description>Enable RDP</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>4</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\configure-firewall.ps1</CommandLine> <Description>Configure Windows Firewall</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>5</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\enable-winrm.ps1</CommandLine> <Description>Enable WinRM service</Description> <RequiresUserInput>true</RequiresUserInput> </SynchronousCommand> </FirstLogonCommands> <OOBE> <HideEULAPage>true</HideEULAPage> <HideLocalAccountScreen>true</HideLocalAccountScreen> <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen> <HideOnlineAccountScreens>true</HideOnlineAccountScreens> <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> <NetworkLocation>Home</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> </OOBE> <UserAccounts> <AdministratorPassword> <Value>XxXxXxXxXxXxXValue> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> </component> </settings> Note The autounattend.xml file can trigger further scripts. In this example, five scripts are started in sequence for further configuration. Caution The syntax and structure of the autounattend.xml file are complex and differ between operating systems. Please ensure the correct structure and syntax, as an erroneous autounattend.xml file can prevent the Windows Master Image from deploying. Therefore, we created a web-based application and framework with a graphical interface to configure and structure a corresponding autounattend.xml file. It simplifies creating a valid autounattend.xml file. A valid and well-structured autounattend.xml file lays the foundation for successfully deploying a Windows-based Master Image. Modifying the Master Image using AnsibleAnsible is an open-source automation tool used primarily for: Configuration management Application deployment Task automation IT orchestration Ansible describes automation jobs using YAML (in the form of Ansible Playbooks), a simple, human-readable language. It connects to your nodes (Servers, Devices, etc.) over SSH (or WinRM for Windows) and doesn’t require Agent software installed on the target machines. Some benefits of using Ansible Playbooks for modifying the Windows Master Image, especially when you're aiming for consistency, scalability, and automation in your infrastructure, are: Consistency and Repeatability: Ansible Playbooks ensure that every Master Image is built the same way, every time. Reduces human error and configuration drift Modular and Reusable: Ansible roles and tasks can be reused across different images or environments. Makes it easy to maintain and update configurations Testable and Version-Controlled: Ansible Playbooks can be stored in Git, enabling version control, collaboration, and code reviews. You can test changes in a staging environment before applying them to production images Agentless and Cross-Platform: No need to install agents on the Image. Works across Linux, Windows, and Cloud platforms (AWS, Azure, GCP, etc.) Using Ansible to modify your Windows Master Images is a powerful way to ensure consistency and repeatability in your infrastructure. Caution The Ansible Playbooks depend entirely on the correct syntax and structure of the corresponding YAML file. Please be aware that writing YAML using the correct structure and syntax is crucial, as an erroneous Playbook can break the deployment of the Windows Master Image. Therefore, we also created a web-based application and framework with a graphical interface to configure and structure the corresponding Ansible Playbooks. Example of an Ansible Playbook – shortened due to the original length of the code/decision logic: --- # Install WWCO Golden Master # Version 100625v2GK # Windows 11 23H2 - name: Install WWCO Master Image 100625v2GK hosts: all gather_facts: true vars: vm_join_domain: true vm_enable_rdp: true vm_install_windows_updates: false vm_join_domain_config: "wwco.net.json" vm_optimize_image: true vm_install_vda: true vm_install_vda_mcsio: false vm_install_vda_firewall: false vm_install_vda_rtt: false vm_install_vda_pm: false vm_install_vda_pm_wmi: true vm_install_vda_upgr: true vm_install_wem: false vm_install_pvs: false vm_install_uber: false vm_install_wapp: false vm_install_o365: true vm_install_python: false vm_install_ps7: false vm_install_crm: false vm_install_chrome: true vm_install_firefox: true vm_install_slack: false roles: - role: join_domain when: vm_join_domain == true - role: enable_rdp when: vm_enable_rdp == true - role: install_vda_std when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_mcsio when: vm_install_vda == true and vm_install_vda_mcsio == true and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_fw when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == true and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_rtt when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == true and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_pm when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == true and vm_install_vda_upgr == false - role: install_vda_std_pm_wmi when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm_wmi == true and vm_install_vda_upgr == false - role: install_vda_std_upgr when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == true and vm_install_vda_upgr == true ... - role: install_wem when: vm_install_wem == true - role: install_pvs when: vm_install_pvs == true - role: install_uber when: vm_install_uber == true - role: install_wapp when: vm_install_wapp == true - role: install_o365 when: vm_install_o365 == true - role: install_python when: vm_install_python == true - role: install_ps7 when: vm_install_ps7 == true - role: install_crm when: vm_install_crm == true - role: install_chrome when: vm_install_chrome == true - role: install_firefox when: vm_install_firefox == true - role: install_slack when: vm_install_slack == true - role: install_windows_updates when: vm_install_windows_updates == true - role: optimize_image when: vm_optimize_image == true ... By setting a variable in the vars: section to true, Ansible will install the corresponding Software package. The Ansible roles contain all the needed Tasks for deploying the corresponding functionality – for example, these are the Tasks for the Ansible role “Join-Domain”: --- # Ansible Role Join-Domain ## Generic Tasks file for Join-Domain Role - name: Create the DNS Server List ansible.builtin.set_fact: dns_servers_list: "{{ dns_servers | split(',') }}" when: dns_servers is search(",") - name: Set DNS to DCs ansible.windows.win_dns_client: adapter_names: "*" dns_servers: "{{ dns_servers_list }}" when: dns_servers and dns_servers is search(",") - name: Change Computer Name ansible.windows.win_hostname: name: "{{ vm_hostname }}" register: hostname_state - name: Reboot after Computer Name was changed ansible.windows.win_reboot: post_reboot_delay: 30 when: hostname_state.reboot_required - name: Join to Domain - Variables are set by PACKERGEN-Tool according to chosen Domain-Join configuration microsoft.ad.membership: dns_domain_name: "{{ dns_domain_name }}" domain_admin_user: "{{ domain_join_user }}" domain_admin_password: "{{ domain_join_pw }}" domain_ou_path: "{{ domain_join_ou_path }}" hostname: "{{ vm_hostname }}" state: domain ignore_unreachable: true register: domain_state - name: Reboot after Domain Join ansible.windows.win_reboot: ...Most Ansible Tasks are built on Variables that the Web application modifies and reads. The Domain configuration is stored in a JSON file in an Azure Vault and loaded by the Web application. It is then written in the corresponding Ansible YAML file: --- # Variable files for Domain-Join Role ## DNS dns_servers: "10.53.XXX.XXX,10.53.XXX.XXX" dns_domain_name: "WWCO.NET" # Domain domain_join_user: "XxXxXxX@wwco.net" domain_join_pw: "SWFtU29ycnlCdXRUaGF0SXNPZkNvdXJzZU5vdFRoZVJpZ2h0UGFzc3dvcmQ=" domain_join_ou_path: "OU=VDA,OU=XxXxXxXxX,OU=XxXxXxXxX,OU=XxXxXxXxX,OU=XxXxXxXxX,DC=wwco,DC=net" vm_hostname: "GENMI100625V2"Due to the complexity of the syntax in autounattend.xml and the YAML playbooks, we created a web application that lets you configure all settings via a GUI. You might follow this approach to ease Master Image creation. If you want to further ease software package deployment, we will present a way using Chocolatey as a package manager later in this guide - Installing Software Packages using Packer, Ansible, and Chocolatey Example Workflow for Packer creating a Master Image on AzureThe workflow below demonstrates how to automate the creation of a Windows Server 2025-based Master Image using all the steps outlined in this guide. For a more detailed guide and deeper information, please consult our Packer deployment guides on Citrix TechZone. The Terraform code for creation of the prerequisites is out of scope in this guide, you can find it on Citrix TechZone. We defined the Software packages and needed configurations in Ansible using the Web application. Packer will create the Master Image on Azure from a custom Base Image, and then use Ansible for further configuration and Software deployment. Example Packer HCL code: # Packer File for Creation of a Windows Server 2025-based Master Image based on an existing custom Base Image using Packer and Ansible ## Version 06.2025 ### Modified by PACKERGEN packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = ">= 2.3.3" } ansible = { source = "github.com/hashicorp/ansible" version = ">= 1.1.3" } } } ... source "azure-arm" "windows" { async_resourcegroup_delete = true client_id = var.client_id client_secret = var.client_secret communicator = "winrm" location = var.location build_resource_group_name = var.build_resource_group_name # Security settings security_type = var.security_type vtpm_enabled = var.vtpm secure_boot_enabled = var.secure_boot # Temp Image Storage Type managed_image_storage_account_type = var.managed_image_storage_account_type os_type = var.os_type shared_image_gallery { subscription = var.subscription_id resource_group = var.resource_group_name gallery_name = var.shared_gallery_name image_name = var.image_name image_version = var.image_version } shared_image_gallery_destination { gallery_name = var.shared_gallery_name image_name = var.dest_image_name image_version = var.dest_image_version replication_regions = ["${var.image_replication_regions}"] resource_group = var.resource_group_name storage_account_type = var.sig_storage_type } azure_tags = { build_number = var.build_number build_id = var.build_id } private_virtual_network_with_public_ip = "false" subscription_id = var.subscription_id tenant_id = var.tenant_id vm_size = var.vm_size virtual_network_name = var.virtual_network_name virtual_network_resource_group_name = var.virtual_network_resource_group_name virtual_network_subnet_name = var.virtual_network_subnet_name winrm_insecure = "true" winrm_timeout = var.winrm_timeout winrm_use_ssl = "true" winrm_username = var.winrm_username } build { name = "WWCOW2K25MIFromARMTemplate" sources = ["source.azure-arm.windows"] # Enable WinRM provisioner "powershell" { script = "/scripts/enable-winrm.ps1" } # Provisioning of Configuration and Packages using Ansible ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_generic}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_CTX}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } provisioner "powershell" { script = "/scripts/sysprep.ps1" } post-processor "manifest" { output = "manifest.json" strip_path = true custom_data = { source_image_name = "${build.SourceImageName}" tenant_id = "${build.TenantID}" subscription_id = "${build.SubscriptionID}" temp_deployment_name = "${build.TempDeploymentName}" temp_compute_name = "${build.TempComputeName}" temp_nic_name = "${build.TempNicName}" temp_os_disk_name = "${build.TempOSDiskName}" temp_data_disk_name = "${build.TempDataDiskName}" temp_resource_group_name = "${build.TempResourceGroupName}" temp_nsg_name = "${build.TempNsgName}" temp_key_vault_name = "${build.TempKeyVaultName}" temp_subnet_name = "${build.TempSubnetName}" temp_virtual_network_name = "${build.TempVirtualNetworkName}" temp_public_ip_address_name = "${build.TempPublicIPAddressName}" } } } ... Important Please do not forget to follow the correct sequence of the packer commands – e.g.: packer init -upgrade XxXxXxXxX.pkr.hcl packer validate -var-file W2K25ARMWithAnsible.variables.pkr.hcl W2K25ARMWithAnsible.pkr.hcl packer build -on-error=abort -force -var-file=W2K25ARMWithAnsible.variables.pkr.hcl W2K25ARMWithAnsible.pkr.hcl Example Workflow for Packer creating a Master Image on vSpherePacker will create the Master Image on vSphere from an official Windows Server 2025 ISO file, and then use Ansible for further configuration and Software deployment. We defined the Software packages and required configurations in Ansible using our Web application, including installing the Citrix Virtual Delivery Agent (VDA) on the Master Image. Example Packer HCL code: packer { required_version = ">= 1.9.0" required_plugins { vsphere = { version = ">= v1.4.2" source = "github.com/hashicorp/vsphere" } } required_plugins { windows-update = { version = ">= 0.16.8" source = "github.com/rgl/windows-update" } } } ... source "vsphere-iso" "windows" { vcenter_server = var.vcenter_server username = var.vcenter_username password = var.vcenter_password insecure_connection = true cluster = var.vsphere_cluster host = var.vsphere_host datacenter = var.vsphere_datacenter datastore = var.vsphere_datastore folder = var.vsphere_folder vm_name = var.vm_name notes = "Created by Packer and PACKERGEN." guest_os_type = "windows9Server64Guest" firmware = var.firmware vTPM = var.vtpm CPUs = var.cpu cpu_cores = var.cpu RAM = var.memory RAM_reserve_all = true remove_cdrom = true cdrom_type = "sata" vm_version = var.vm_version iso_paths = [ "${var.os_iso_path}" ] cd_files = [ "/autounattend/Autounattend.xml", "/scripts/enable-winrm.ps1", "/scripts/install-vmwaretools.ps1", "/drivers/" ] disk_controller_type = ["pvscsi"] storage { disk_size = var.disksize disk_thin_provisioned = true } network_adapters { network = var.vsphere_network network_card = "vmxnet3" } boot_order = "disk,cdrom" boot_command = [ "<spacebar><wait2><spacebar>" ] boot_wait = "1s" communicator = "winrm" winrm_insecure = true winrm_password = var.connection_password winrm_timeout = "20m" winrm_use_ssl = true winrm_username = var.connection_username } build { name = "WWCOW2K25MIFromISOvSphere" source "vsphere-iso.windows" { convert_to_template = false create_snapshot = var.create_snapshot snapshot_name = "Created by Packer and PACKERGEN" } # Provisioning of Configuration and Packages using Ansible ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_generic}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_CTX}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } post-processor "manifest" { output = "manifest.json" strip_path = true custom_data = { source_image_name = "${build.SourceImageName}" tenant_id = "${build.TenantID}" subscription_id = "${build.SubscriptionID}" temp_deployment_name = "${build.TempDeploymentName}" temp_compute_name = "${build.TempComputeName}" temp_nic_name = "${build.TempNicName}" temp_os_disk_name = "${build.TempOSDiskName}" temp_data_disk_name = "${build.TempDataDiskName}" temp_resource_group_name = "${build.TempResourceGroupName}" temp_nsg_name = "${build.TempNsgName}" temp_key_vault_name = "${build.TempKeyVaultName}" temp_subnet_name = "${build.TempSubnetName}" temp_virtual_network_name = "${build.TempVirtualNetworkName}" temp_public_ip_address_name = "${build.TempPublicIPAddressName}" } } } Example: Packer Image Management Module for Citrix® Virtual Apps and DesktopsAs mentioned above, there are different ways to deploy the Citrix® Virtual Delivery Agent (VDA) on the Master Image: using the autounattend.xml file, a Packer Provisioner, or Ansible. The VDA is a crucial component for a successful Citrix infrastructure. The Packer Image Management Module for Citrix® Virtual Apps and Desktops aims to streamline image management by creating a custom Golden Image with the VDA. It runs the Citrix® Optimizer to improve image efficiency by removing unnecessary bloatware, resulting in optimized performance and resource utilization. A single command can deploy an Image by creating it using Packer. Note Please note that this module is still in Tech Preview. You can find the actual version here: https://github.com/citrix/citrix-packer-tools Example HCL code for creating a Windows 11-based Image: packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = "~> 1" } } } variable "client_id" { type = string default = "ff1bXXXX-XXXX-XXXX-XXXX-XXXXXXXX53b6" } variable "client_object_id" { type = string default = "69bdXXXX-XXXX-XXXX-XXXX-XXXXXXXX4244" } variable "client_secret" { type = string default = "XxXxXxXxXxXxXxXxX" } variable "client_subscription_id" { type = string default = "de13XXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13" } variable "client_tenant_id" { type = string default = "1974XXXX-XXXX-XXXX-XXXX-XXXXXXXX474b" } variable "image_name" { type = string default = "win_office_11_22h2" } variable "image_resource_group" { type = string default = "TMM-XxXxXxXxX-WEUR" } variable "install_browser_chrome_flag" { type = string default = "true" } variable "install_browser_firefox_flag" { type = string default = "true" } variable "location_setup" { type = string default = "c:\\setup" } variable "optimizer_location" { type = string default = "https://XxXxXxX.blob.core.windows.net/packer/VDAWorkstationSetup_2503.exe" } variable "optimizer_template" { type = string default = "Citrix_Windows_11_2009.xml" } variable "script_cleanup" { type = string default = "run-cleanup.ps1" } variable "script_installchrome" { type = string default = "install-browser-chrome.ps1" } variable "script_installfirefox" { type = string default = "install-browser-firefox.ps1" } variable "script_installvda" { type = string default = "install-vda.ps1" } variable "script_optimizer" { type = string default = "run-optimizer.ps1" } variable "username" { type = string default = "XxXxXxXxXxXxXxXxX" } variable "userpass" { type = string default = "XxXxXxXxXxXxXxXxX" } variable "vda_location" { type = string default = "https://XxXxXxX.blob.core.windows.net/packer/CitrixOptimizerTool.zip" } variable "winrm_insecure" { type = string default = "true" } # The "legacy_isotime" function has been provided for backwards compatability, but we recommend switching to the timestamp and formatdate functions. source "azure-arm" "autogenerated_1" { azure_tags = { Image = "Packer Generated" } client_id = "${var.client_id}" client_secret = "${var.client_secret}" communicator = "winrm" image_offer = "office-365" image_publisher = "MicrosoftWindowsDesktop" image_sku = "WIN11-22H2-AVD-M365" image_version = "latest" location = "East US" managed_image_name = "${var.image_name}_${legacy_isotime("200601020304")}" managed_image_os_disk_snapshot_name = "${var.image_name}_${legacy_isotime("200601020304")}" managed_image_resource_group_name = "${var.image_resource_group}" object_id = "${var.client_object_id}" os_type = "Windows" subscription_id = "${var.client_subscription_id}" tenant_id = "${var.client_tenant_id}" vm_size = "Standard_D2s_v3" winrm_insecure = "${var.winrm_insecure}" winrm_password = "${var.userpass}" winrm_timeout = "20m" winrm_use_ssl = false winrm_username = "${var.username}" } build { sources = ["source.azure-arm.autogenerated_1"] ... provisioner "powershell" { inline = ["New-Item -Path ${var.location_setup} -ItemType \"directory\" | Out-Null"] } provisioner "file" { destination = "${var.location_setup}\\${var.script_installvda}" source = ".\\scripts\\${var.script_installvda}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_optimizer}" source = ".\\scripts\\${var.script_optimizer}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_installchrome}" source = ".\\scripts\\${var.script_installchrome}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_installfirefox}" source = ".\\scripts\\${var.script_installfirefox}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_cleanup}" source = ".\\scripts\\${var.script_cleanup}" } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Host 'Script: computer restarted.'}\"" restart_timeout = "30m" } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_optimizer} -OptimizerDownloadUri ${var.optimizer_location} -Template ${var.optimizer_template}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installchrome} -InstallSoftware ${var.install_browser_chrome_flag}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installfirefox} -InstallSoftware ${var.install_browser_firefox_flag}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_cleanup} -Username ${var.username} -LocationPath ${var.location_setup}"] } ... } Examples from the Field - Creating Master Images with PackerLet´s have a look at real-world examples from the field - we cover using Packer to create Master Images on XenServer, vSphere, and Azure. All these examples have more detailed guides available in our Automation Landing Zone on Citrix TechZone at https://community.citrix.com/tech-zone/automation Please be aware that each Hypervisor and Hyperscaler has different support in Packer – for example, some Packer plugins can automatically add Windows VMs to an AD domain, while others do not. That is why we try to keep as Hypervisor-/Hyperscaler-agnostic as possible – all further configurations, such as changing IP addresses, DNS names, or adding the VM to the AD domain, are handled by Ansible. Ansible does not care about the underlying infrastructure; it talks directly to the target machine to run the desired configuration steps. Important It is imperative to configure the Master Image for WinRM before proceeding with all further steps. In these examples, we use Packer and/or the autounattend.xml method to configure WinRM. More sophisticated WinRM configurations, such as securing the WinRM transport, are applied after the AD domain join via GPOs. Creating Master Images using Packer on XenServer 8.4Caution XenServer currently lacks an official Packer plugin. In this guide, we use a forked plugin from my Citrite colleague Rody Kossen to showcase the feasibility of end-to-end IaC. https://github.com/xenserver/packer-plugin-xenserver/tree/feature-rodyk-revamp Use the plugin at your own risk – please read the disclaimer at the end of the document for further information. There is NO warranty that it will work as intended – we cannot provide any support. You need to compile the plugin before you can use it. Compiling the Packer plugin for XenServerHere´s a guide for compiling it – we use our Ubuntu IaC machine for compilation: Before compilation, we need to ensure that these prerequisites are installed: Packer – is installed. Golang 1.24.1 – is not installed, need to install Step 1: Install Golang 1.24.1 azadmin@tacg-cicd:~$ wget https://go.dev/dl/go1.24.1.linux-amd64.tar.gz --2025-11-21 09:32:35-- https://go.dev/dl/go1.24.1.linux-amd64.tar.gz Resolving go.dev (go.dev)... 216.239.36.21, 216.239.32.21, 216.239.34.21, ... Connecting to go.dev (go.dev)|216.239.36.21|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://dl.google.com/go/go1.24.1.linux-amd64.tar.gz [following] --2025-11-21 09:32:36-- https://dl.google.com/go/go1.24.1.linux-amd64.tar.gz Resolving dl.google.com (dl.google.com)... 142.251.39.78, 2a00:1450:400d:80e::200e Connecting to dl.google.com (dl.google.com)|142.251.39.78|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 78503123 (75M) [application/x-gzip] Saving to: ‘go1.24.1.linux-amd64.tar.gz’ go1.24.1.linux-amd64.tar.gz 100%[=================================================>] 74.87M 29.5MB/s in 2.5s 2025-11-21 09:32:38 (29.5 MB/s) - ‘go1.24.1.linux-amd64.tar.gz’ saved [78503123/78503123] azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ sudo tar -C /usr/local -xzf go1.24.1.linux-amd64.tar.gz azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ ls -l /usr/local/go* total 76 drwxr-xr-x 2 root root 4096 Feb 27 2025 api drwxr-xr-x 2 root root 4096 Feb 27 2025 bin -rw-r--r-- 1 root root 52 Feb 27 2025 codereview.cfg -rw-r--r-- 1 root root 1337 Feb 27 2025 CONTRIBUTING.md drwxr-xr-x 3 root root 4096 Feb 27 2025 doc -rw-r--r-- 1 root root 505 Feb 27 2025 go.env drwxr-xr-x 5 root root 4096 Feb 27 2025 lib -rw-r--r-- 1 root root 1453 Feb 27 2025 LICENSE drwxr-xr-x 8 root root 4096 Feb 27 2025 misc -rw-r--r-- 1 root root 1303 Feb 27 2025 PATENTS drwxr-xr-x 4 root root 4096 Feb 27 2025 pkg -rw-r--r-- 1 root root 1454 Feb 27 2025 README.md -rw-r--r-- 1 root root 426 Feb 27 2025 SECURITY.md drwxr-xr-x 56 root root 4096 Feb 27 2025 src drwxr-xr-x 28 root root 16384 Feb 27 2025 test -rw-r--r-- 1 root root 35 Feb 27 2025 VERSION azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ sudo nano ~/.profile azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ source ~/.profile azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ go version go version go1.24.1 linux/amd64 azadmin@tacg-cicd:~$Go is successfully installed. Step 2: Download the plugin source from GitHub and place it into a feasible directory We downloaded the source and put it into “packer-plugin-xenserver-feature-rodyk-revamp” azadmin@tacg-cicd:~$ ls cert_key.pem Documents Music packer-templates snap cert.pem Downloads packer-examples-for-vsphere Pictures Templates Desktop go1.24.1.linux-amd64.tar.gz packer-plugin-xenserver-feature-rodyk-revamp Public Videos azadmin@tacg-cicd:~$Step 3: Compile the plugin azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ make builder/xenserver/common/client.go:9:2: xenapi@v0.0.0-00010101000000-000000000000: replacement directory ./goSDK does not exist make: *** [GNUmakefile:11: build] Error 1 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ This error indicates that the XenServer SDK-GO files are missing. We need to download them into a subdirectory to make them accessible for compilation: azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ wget -P /home/azadmin/Downloads https://downloads.xenserver.com/sdk/25.30.0/XenServer-SDK-25.30.0.zip --2025-11-21 10:39:31-- https://downloads.xenserver.com/sdk/25.30.0/XenServer-SDK-25.30.0.zip Resolving downloads.xenserver.com (downloads.xenserver.com)... 13.107.226.44, 13.107.253.44, 2620:1ec:48:1::44, ... Connecting to downloads.xenserver.com (downloads.xenserver.com)|13.107.226.44|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 19568538 (19M) [application/zip] Saving to: ‘/home/azadmin/Downloads/XenServer-SDK-25.30.0.zip’ XenServer-SDK-25.30.0.zip 100%[================================================================================================================>] 18.66M 21.7MB/s in 0.9s 2025-11-21 10:39:32 (21.7 MB/s) - ‘/home/azadmin/Downloads/XenServer-SDK-25.30.0.zip’ saved [19568538/19568538] azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ mkdir goSDK azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp/goSDK$ unzip /home/azadmin/Downloads/XenServer-SDK-25.30.0.zip -d /home/azadmin/Downloads/XenServer-SDK-25.30.0 ... azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ cp -r /home/azadmin/Downloads/XenServer-SDK-25.30.0/XenServer-SDK/XenServerGo/src/. /home/azadmin/packer-plugin-xenserver-feature-rodyk-re vamp/goSDK azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ cd goSDK azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp/goSDK$ ls api_errors.go cluster_host.go enums.go host_driver.go network_sriov.go pool_patch.go repository.go subject.go vdi_nbd_server_info.go vm_group.go api_messages.go console.go event.go host.go observer.go pool_update.go role.go task.go vgpu.go vm_guest_metrics.go api_versions.go convert.go export_test.go host_metrics.go pbd.go probe_result.go sdn_controller.go tunnel.go vgpu_type.go vm_metrics.go auth.go convert_test.go feature.go host_patch.go pci.go pusb.go secret.go usb_group.go vif.go vmpp.go blob.go crashdump.go go.mod jsonrpc_client.go pgpu.go pvs_cache_storage.go session.go user.go vif_metrics.go vmss.go bond.go data_source.go gpu_group.go lvhd.go pif.go pvs_proxy.go sm.go vbd.go vlan.go vtpm.go certificate.go driver_variant.go host_cpu.go message.go pif_metrics.go pvs_server.go sr.go vbd_metrics.go vm_appliance.go vusb.go cluster.go dr_task.go host_crashdump.go network.go pool.go pvs_site.go sr_stat.go vdi.go vm.go azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp/goSDK$As the required SDK files are now in place, we can start the compilation again: azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ make go: downloading github.com/hashicorp/packer-plugin-sdk v0.6.2 go: downloading github.com/hashicorp/hcl/v2 v2.24.0 go: downloading github.com/hashicorp/hcl v1.0.0 ... go: downloading github.com/golang/protobuf v1.5.3 go: downloading github.com/mattn/go-colorable v0.1.13 go: downloading github.com/hashicorp/go-immutable-radix v1.3.1 go: downloading golang.org/x/sync v0.14.0 go: downloading github.com/hashicorp/golang-lru v0.5.4 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ ls builder docs examples GNUmakefile go.mod goSDK go.sum LICENSE main.go packer-plugin-xenserver README.md version azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$The compilation was successful, now we need to install the plugin in Packer. Step 4: Install the plugin azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ sudo packer plugins install --path packer-plugin-xenserver github.com/xenserver/xenserver Successfully installed plugin github.com/xenserver/xenserver from /home/azadmin/packer-plugin-xenserver-feature-rodyk-revamp/packer-plugin-xenserver to /root/.config/packer/plugins/github.com/xenserver/xenserver/packer-plugin-xenserver_v0.9.1_x5.0_linux_amd64 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ sudo packer plugins installed /root/.config/packer/plugins/github.com/xenserver/xenserver/packer-plugin-xenserver_v0.9.1_x5.0_linux_amd64 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$Installation is complete, let´s create some VMs now. For a detailed overview of the builder, please look at the plugin´s documentation. Example Packer HCL file for deploying a Windows Server 2025-VM on XenServer 8: packer { required_plugins { xenserver= { version = ">= v0.1.0" source = "github.com/xenserver/xenserver" } } } source "xenserver-iso" "XSTEST" { iso_checksum_type = "none" iso_name = var.os_iso_path sr_iso_name = var.sr_iso_name sr_name = var.sr_name tools_iso_name = var.tools_iso_name remote_host = var.remote_host remote_password = var.remote_password remote_username = var.remote_username vm_name = var.vm_name vm_description = var.vm_description vm_memory = var.memory disk_size = var.disksize vcpus = var.cpu cores_per_socket = var.cpu network_names = ["${var.virtual_network_name}"] firmware = var.firmware secure_boot = var.secure_boot vTPM = var.vtpm vgpu_profile = var.vgpu_profile clone_template = var.clone_template cd_files = ["W2K25AutoUnattendInclWinRM.xml"] ssh_username = var.ssh_username ssh_password = var.ssh_password ssh_wait_timeout = "60000s" boot_command = [ "<spacebar><wait2><spacebar>" ] boot_wait = "1s" #Export Options format = "xva" keep_vm = "on_success" communicator = "winrm" winrm_insecure = true winrm_password = var.winrm_password winrm_timeout = "5m" winrm_use_ssl = false winrm_username = var.winrm_username } build { sources = ["xenserver-iso.windows"] provisioner "powershell" { inline = ["Write-Host 'Installing updates and XenServer Tools...'", "Start-Process msiexec.exe -ArgumentList '/i D:\\xensetup\\managementagentx64.msi /qn' -Wait”] } }In this example, we use a modified autounattend.xml file to configure the Windows VM during creation: <?xml version="1.0" encoding="utf-8"?> <unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="windowsPE"> <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <DiskConfiguration> <Disk wcm:action="add"> <DiskID>0</DiskID> <WillWipeDisk>true</WillWipeDisk> <CreatePartitions> <CreatePartition wcm:action="add"> <Order>1</Order> <Type>Primary</Type> <Size>100</Size> </CreatePartition> <CreatePartition wcm:action="add"> <Order>2</Order> <Type>Primary</Type> <Extend>true</Extend> </CreatePartition> </CreatePartitions> <ModifyPartitions> <ModifyPartition wcm:action="add"> <Order>1</Order> <PartitionID>1</PartitionID> <Active>true</Active> <Label>System</Label> <Format>NTFS</Format> </ModifyPartition> <ModifyPartition wcm:action="add"> <Order>2</Order> <PartitionID>2</PartitionID> <Label>Windows</Label> <Format>NTFS</Format> <Letter>C</Letter> </ModifyPartition> </ModifyPartitions> </Disk> <WillShowUI>OnError</WillShowUI> </DiskConfiguration> <ImageInstall> <OSImage> <InstallFrom> <MetaData wcm:action="add"> <Key>/IMAGE/INDEX</Key> <Value>1</Value> </MetaData> </InstallFrom> <InstallTo> <DiskID>0</DiskID> <PartitionID>2</PartitionID> </InstallTo> </OSImage> </ImageInstall> <UserData> <ProductKey> <Key></Key> <WillShowUI>Never</WillShowUI> </ProductKey> <AcceptEula>true</AcceptEula> <FullName>Packer Builder</FullName> <Organization>ExampleCorp</Organization> </UserData> </component> </settings> <settings pass="specialize"> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <ComputerName>WIN2025BASE</ComputerName> <TimeZone>UTC</TimeZone> </component> <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <RunSynchronous> <RunSynchronousCommand> <Order>1</Order> <Path>cmd /c winrm quickconfig -quiet</Path> <Description>Enable WinRM</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>2</Order> <Path>cmd /c winrm set winrm/config/service/auth @{Basic="true"}</Path> <Description>Enable Basic Auth</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>3</Order> <Path>cmd /c winrm set winrm/config/service @{AllowUnencrypted="true"}</Path> <Description>Allow Unencrypted</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>4</Order> <Path>cmd /c netsh advfirewall set allprofiles state off</Path> <Description>Disable Firewall</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>5</Order> <Path>cmd /c winrm set winrm/config/client @{TrustedHosts="*"}</Path> <Description>Disable Firewall</Description> </RunSynchronousCommand> </RunSynchronous> </component> </settings> <settings pass="oobeSystem"> <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <InputLocale>de-AT</InputLocale> <SystemLocale>en-US</SystemLocale> <UILanguage>en-US</UILanguage> <UserLocale>de-AT</UserLocale> </component> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>3</ProtectYourPC> </OOBE> <UserAccounts> <AdministratorPassword> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> <AutoLogon> <Username>Administrator</Username> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> <Enabled>true</Enabled> <LogonCount>1</LogonCount> </AutoLogon> <FirstLogonCommands> </FirstLogonCommands> </component> </settings> <cpi:offlineImage cpi:source="wim://wimfile/install.wim#Windows Server 2025 SERVERSTANDARD" xmlns:cpi="urn:schemas-microsoft-com:cpi" /> </unattend>Running the Packer IaC snippet should create a XenServer XVA that can then be used as a Master Image: azadmin@tacg-cicd:~$ packer build packer-tmpl-w2k25-xs.pkr.hcl xenserver-iso.XSTEST: output will be in this color. ==> xenserver-iso.XSTEST: XAPI client session established ==> xenserver-iso.XSTEST: Retrieving ISO ==> xenserver-iso.XSTEST: Trying http://10.10.100.1/iso/windows_server_2025.iso ==> xenserver-iso.XSTEST: Trying http://10.10.100.1/iso/windows_server_2025.iso ==> xenserver-iso.XSTEST: http://10.10.100.1/iso/windows_server_2025.iso => C:\__PPMM\_PACKER\_XENSERVER\packer_cache\4282f11098333441b4a8c39028041a36490797cb ==> xenserver-iso.XSTEST: Creating CD disk... xenserver-iso.XSTEST: OSCDIMG 2.56 CD-ROM and DVD-ROM Premastering Utility xenserver-iso.XSTEST: Copyright (C) Microsoft, 1993-2012. All rights reserved. xenserver-iso.XSTEST: Licensed only for producing Microsoft authorized content. xenserver-iso.XSTEST: Scanning source tree xenserver-iso.XSTEST: Scanning source tree complete (1 files in 1 directories) xenserver-iso.XSTEST: Computing directory information complete xenserver-iso.XSTEST: Image file is 57344 bytes (before optimization) xenserver-iso.XSTEST: Writing 1 files in 1 directories to tmp/packer1625305315.iso xenserver-iso.XSTEST: Storage optimization saved 0 files, 0 bytes (0% of image) xenserver-iso.XSTEST: After optimization, image file is 57344 bytes xenserver-iso.XSTEST: Done. xenserver-iso.XSTEST: 100% complete xenserver-iso.XSTEST: Done copying paths from CD_dirs ==> xenserver-iso.XSTEST: Step: Upload VDI 'Packer-CD' ==> xenserver-iso.XSTEST: Step: Found SR for upload 'OpaqueRef:ed24af24-cd3e-4ed0-2303-d885e72a691a' ==> xenserver-iso.XSTEST: PUT 'https://10.10.119.1/import_raw_vdi?session_id=OpaqueRef%3A93b232ae-a9bf-8b83-bb54-9aaf7412b6ba&task_id=OpaqueRef%3A99d66110-5044-37b2-7b21-baa23c54d2e1&vdi=OpaqueRef%3A65a7da41-3aba-e5b1-d1f1-0e5f006286f4' ==> xenserver-iso.XSTEST: Attemping to find VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Step: Upload VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Step: Found SR for upload 'OpaqueRef:ed24af24-cd3e-4ed0-2303-d885e72a691a' ==> xenserver-iso.XSTEST: PUT 'https://10.10.119.1/import_raw_vdi?session_id=OpaqueRef%3A93b232ae-a9bf-8b83-bb54-9aaf7412b6ba&task_id=OpaqueRef%3Ac8d26e51-2289-49b5-5363-220848bb4b6c&vdi=OpaqueRef%3A4893a784-2514-12b3-20bf-9880fc5bf3be' ==> xenserver-iso.XSTEST: Step: Create Instance ==> xenserver-iso.XSTEST: Using the following SR for the VM: OpaqueRef:67690a5f-2856-f785-7cac-fb59728d7ef2 ==> xenserver-iso.XSTEST: Created instance '2d4f4efc-5a3d-d915-380c-f86b0108eabe' ==> xenserver-iso.XSTEST: Step: Start VM Paused ==> xenserver-iso.XSTEST: Step: Set SSH address to VM host IP ==> xenserver-iso.XSTEST: Set host SSH address to '10.10.119.1'. ==> xenserver-iso.XSTEST: Set host SSH port to 22. ==> xenserver-iso.XSTEST: Unpausing VM 2d4f4efc-5a3d-d915-380c-f86b0108eabe ==> xenserver-iso.XSTEST: Waiting 10s for boot... ==> xenserver-iso.XSTEST: Connecting to VNC over XAPI... xenserver-iso.XSTEST: Making HTTP request to initiate VNC connection: CONNECT /console?uuid=6e861319-fb00-a8c8-d607-615b6c4561fe HTTP/1.0 xenserver-iso.XSTEST: Host: 10.10.119.1 xenserver-iso.XSTEST: Cookie: session_id=OpaqueRef:93b232ae-a9bf-8b83-bb54-9aaf7412b6ba xenserver-iso.XSTEST: xenserver-iso.XSTEST: xenserver-iso.XSTEST: Received response: HTTP/1.1 200 OK xenserver-iso.XSTEST: Connection: keep-alive xenserver-iso.XSTEST: Cache-Control: no-cache, no-store xenserver-iso.XSTEST: xenserver-iso.XSTEST: xenserver-iso.XSTEST: Found local IP: 10.10.11.99 ==> xenserver-iso.XSTEST: Typing boot commands over VNC... ==> xenserver-iso.XSTEST: Step: Wait for VMs IP to become known to us. ==> xenserver-iso.XSTEST: Successfully installed ==> xenserver-iso.XSTEST: Destroying VDI ==> xenserver-iso.XSTEST: Destroyed VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Destroyed VDI 'Packer-CD' ==> xenserver-iso.XSTEST: Deleting output directory... ==> xenserver-iso.XSTEST: Closing sessions .... Build 'xenserver-iso.XSTEST' finished after 43 minutes 52 seconds. ==> Wait completed after 43 minutes 52 seconds ==> Builds finished. The artifacts of successful builds are: --> ==> xenserver-iso.XSTEST: W2K25.2511 azadmin@tacg-cicd:~$After a successful run, XenServer should reflect the created VM, and after conversion, the corresponding template. Creating Master Images using Packer on vSphere 8This example demonstrates creating a Windows 11-based Master Image on vSphere 8. After the VM is successfully created, it is converted by a post-processor into a vSphere template for further use. For a detailed overview of the builder, please look at the plugin´s documentation. Example Packer HCL file for deploying a Windows 11-VM on vSphere 8: locals { WinRMUser = "administrator" WinRMPass = "!XxXxXxXxXxXxXxXxX!" vcenter_admin = "administrator@vsphere.local" vcenter_password = "!XxXxXxXxXxXxXxXxX!" timestamp = regex_replace(timestamp(), "[- TZ:01]", "") buildtime = formatdate("DD-MM-YYYY hh:mm ZZZ", timestamp()) manifest_date = formatdate("DD-MM-YYYY hh:mm:ss", timestamp()) } packer { required_version = ">= 1.9.0" required_plugins { vsphere = { version = ">= v1.4.2" source = "github.com/vmware/vsphere" } } required_plugins { windows-update = { version = ">= 0.16.8" source = "github.com/rgl/windows-update" } } } variable "host" { type = string description = "VMware ESXi host" } variable "name" { type = string description = "Golden Image name" } variable "operating_system_vm" { type = string description = "OS Guest OS" } variable "vcenter_cluster" { type = string description = "vCenter cluster name" } variable "vcenter_datastore" { type = string description = "vSphere datastore" } variable "vcenter_host" { type = string description = "vCenter Server" } variable "vcenter_network" { type = string description = "Portgroup name" } variable "vm_cores" { type = string description = "Amount of cores" } variable "vm_cpus" { type = string description = "amount of vCPUs" } variable "vm_disk_controller_type" { type = list(string) description = "Controller type" } variable "vm_disk_size" { type = string description = "Harddisk size" } variable "vm_disk_thin" { type = string description = "Enable/Disable thin provisioning" } variable "vm_hardwareversion" { type = string description = "VM hardware version" } variable "vm_firmware" { type = string description = "The virtual machine firmware. (e.g. 'efi-secure'. 'efi', or 'bios')" default = "efi-secure" } variable "vm_cdrom_type" { type = string description = "The virtual machine CD-ROM type. (e.g. 'sata', or 'ide')" default = "sata" } variable "common_remove_cdrom" { type = bool description = "Remove the virtual CD-ROM(s)." default = true } variable "vm_hotplug" { type = string description = "Enable/Disable hotplug?" } variable "vm_logging" { type = string description = "Enable/Disable VM Logging" } variable "vm_memory" { type = string description = "VM Memory" } variable "vm_memory_reserve_all" { type = string description = "Reserve all memory?" } variable "vm_network_card" { type = string description = "Networkcard type" } variable "winsrv_iso" { type = string description = "Windows Server ISO location" } variable "vm_vgpu" { type = string description = "VM vGPU size" } variable "vm_boot_order" { type = string description = "The boot order for virtual machines devices. (e.g. 'disk,cdrom')" default = "disk,cdrom" } variable "vm_boot_wait" { type = string description = "The time to wait before boot." } variable "vm_boot_command" { type = list(string) description = "The virtual machine boot command." default = [] } variable "vm_shutdown_command" { type = string description = "Command(s) for guest operating system shutdown." } variable "vm_tpm" { type = string default = "true" } variable "create_snapshot" { type = string } variable "remove_cdrom" { type = string } variable "vbs_enabled" { type = string } variable "vvtd_enabled" { type = string } source "vsphere-iso" "win11_iso" { CPUs = var.vm_cpus notes = "Built by HashiCorp Packer on ${local.buildtime}." RAM = var.vm_memory firmware = var.vm_firmware NestedHV = true RAM_reserve_all = var.vm_memory_reserve_all cluster = var.vcenter_cluster configuration_parameters = { "devices.hotplug" = var.vm_hotplug "logging" = var.vm_logging "svga.autodetect" = "FALSE" "svga.numDisplays" = "2" } create_snapshot = var.create_snapshot remove_cdrom = var.remove_cdrom cpu_cores = var.vm_cores datastore = var.vcenter_datastore disk_controller_type = var.vm_disk_controller_type floppy_files = ["${path.root}/setup/"] guest_os_type = var.operating_system_vm host = var.host iso_paths = [var.winsrv_iso] network_adapters { network = var.vcenter_network network_card = var.vm_network_card } storage { disk_size = var.vm_disk_size disk_thin_provisioned = var.vm_disk_thin } username = local.vcenter_admin password = local.vcenter_password vcenter_server = var.vcenter_host vm_name = var.name vm_version = var.vm_hardwareversion vTPM = var.vm_tpm vbs_enabled = var.vbs_enabled vvtd_enabled = var.vvtd_enabled insecure_connection = "true" communicator = "winrm" winrm_port = "5985" winrm_username = local.WinRMUser winrm_password = local.WinRMPass winrm_timeout = "12h" boot_order = var.vm_boot_order boot_wait = var.vm_boot_wait boot_command = var.vm_boot_command shutdown_command = var.vm_shutdown_command } build { sources = ["source.vsphere-iso.win11_iso"] provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Output 'restarted.'}\"" restart_timeout = "20m" } provisioner "powershell" { elevated_user = local.WinRMUser elevated_password = local.WinRMPass valid_exit_codes = [0] scripts = [ "./setup/install-vda.ps1", ] } provisioner "powershell" { elevated_user = local.WinRMUser elevated_password = local.WinRMPass valid_exit_codes = [0, 267014] scripts = [ "./setup/windows-init.ps1", ] } post-processors { post-processor "vsphere-template"{ host = var.vcenter_host insecure = true username = local.vcenter_admin password = local.vcenter_password datacenter = var.vcenter_datacenter folder = "/vmfs/volumes/XxXxXxXxXxXxXxX" } } }In this example, we use a modified autounattend.xml file to configure the Windows VM during creation: <?xml version="1.0" encoding="utf-8"?> <unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="windowsPE"> <component name="Microsoft-Windows-PnpCustomizationsWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <DriverPaths> <PathAndCredentials wcm:action="add" wcm:keyValue="1"> <Path>E:\</Path> </PathAndCredentials> </DriverPaths> </component> <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <DiskConfiguration> <Disk wcm:action="add"> <CreatePartitions> <CreatePartition wcm:action="add"> <Order>1</Order> <Type>EFI</Type> <Size>100</Size> </CreatePartition> <CreatePartition wcm:action="add"> <Order>2</Order> <Type>MSR</Type> <Size>16</Size> </CreatePartition> <CreatePartition wcm:action="add"> <Order>3</Order> <Type>Primary</Type> <Extend>true</Extend> </CreatePartition> </CreatePartitions> <ModifyPartitions> <ModifyPartition wcm:action="add"> <Order>1</Order> <Format>FAT32</Format> <Label>System</Label> <PartitionID>1</PartitionID> </ModifyPartition> <ModifyPartition wcm:action="add"> <Order>2</Order> <PartitionID>2</PartitionID> </ModifyPartition> <ModifyPartition wcm:action="add"> <Order>3</Order> <Format>NTFS</Format> <Label>Windows</Label> <Letter>C</Letter> <PartitionID>3</PartitionID> </ModifyPartition> </ModifyPartitions> <DiskID>0</DiskID> <WillWipeDisk>true</WillWipeDisk> </Disk> </DiskConfiguration> <ImageInstall> <OSImage> <InstallTo> <DiskID>0</DiskID> <PartitionID>3</PartitionID> </InstallTo> <InstallFrom> <MetaData wcm:action="add"> <Key>/IMAGE/INDEX</Key> <Value>1</Value> </MetaData> </InstallFrom> </OSImage> </ImageInstall> <UserData> <ProductKey> <Key>VK7JG-NPHTM-C97JM-9MPGT-3V66T</Key> <WillShowUI>OnError</WillShowUI> </ProductKey> <AcceptEula>true</AcceptEula> <FullName>TACG</FullName> <Organization>TACG</Organization> </UserData> <RunSynchronous> <RunSynchronousCommand wcm:action="add"> <Order>1</Order> <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1</Path> </RunSynchronousCommand> <RunSynchronousCommand wcm:action="add"> <Order>2</Order> <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1</Path> </RunSynchronousCommand> <RunSynchronousCommand wcm:action="add"> <Order>3</Order> <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1</Path> </RunSynchronousCommand> </RunSynchronous> </component> <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <SetupUILanguage> <UILanguage>en-US</UILanguage> </SetupUILanguage> <InputLocale>en-US</InputLocale> <SystemLocale>en-US</SystemLocale> <UILanguage>en-US</UILanguage> <UILanguageFallback>en-US</UILanguageFallback> <UserLocale>en-US</UserLocale> </component> </settings> <settings pass="oobeSystem"> <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <InputLocale>en-US</InputLocale> <SystemLocale>en-US</SystemLocale> <UILanguage>en-US</UILanguage> <UILanguageFallback>en-US</UILanguageFallback> <UserLocale>en-US</UserLocale> </component> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <OOBE> <HideEULAPage>true</HideEULAPage> <HideLocalAccountScreen>true</HideLocalAccountScreen> <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen> <HideOnlineAccountScreens>true</HideOnlineAccountScreens> <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> <ProtectYourPC>1</ProtectYourPC> </OOBE> <TimeZone>UTC</TimeZone> <UserAccounts> <AdministratorPassword> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </AdministratorPassword> <LocalAccounts> <LocalAccount wcm:action="add"> <Name>azadmin</Name> <DisplayName></DisplayName> <Group>Administrators</Group> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> </LocalAccount> <LocalAccount wcm:action="add"> <Name>User</Name> <DisplayName></DisplayName> <Group>Users</Group> <Password> <Value></Value> <PlainText>true</PlainText> </Password> </LocalAccount> </LocalAccounts> </UserAccounts> <AutoLogon> <Username>Administrator</Username> <Enabled>true</Enabled> <LogonCount>1</LogonCount> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> </AutoLogon> <FirstLogonCommands> <SynchronousCommand wcm:action="add"> <Order>1</Order> <CommandLine>PowerShell "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine> <Description>Change the default PowerShell Execution Policy from Restricted to RemoteSigned</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>2</Order> <CommandLine>C:\Windows\SysWOW64\cmd /c PowerShell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine> <Description>Change the default PowerShell (32-bit) Execution Policy from Restricted to RemoteSigned</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>3</Order> <CommandLine>PowerShell -WindowStyle Maximized -Command "Get-PSDrive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root provision-autounattend.ps1; if (Test-Path $p) {&$p}}"</CommandLine> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\install-vmwtools.ps1</CommandLine> <Order>4</Order> <Description>Install VMware Tools</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -File a:\windows-init.ps1</CommandLine> <Order>5</Order> <Description>Initial Configuration</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Description>Sysprep Generalize</Description> <CommandLine>cmd /c C:\Windows\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown</CommandLine> <Order>5</Order> </SynchronousCommand> </FirstLogonCommands> </component> </settings> <settings pass="offlineServicing"> <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <EnableLUA>false</EnableLUA> </component> </settings> </unattend>Running the Windows 11-related Packer IaC snippet should create a vSphere VM that is converted to a template: azadmin@tacg-cicd:~$ packer build -force -var-file=".\win11-std.auto.pkrvars.hcl" win11-std-config.pkr.hcl vsphere-iso.win11_iso: output will be in this color. ==> vsphere-iso.win11_iso: Creating virtual machine... ==> vsphere-iso.win11_iso: Customizing hardware... ==> vsphere-iso.win11_iso: Adding virtual machine flags... ==> vsphere-iso.win11_iso: Mounting ISO images... ==> vsphere-iso.win11_iso: Adding configuration parameters... ==> vsphere-iso.win11_iso: Creating floppy disk... ==> vsphere-iso.win11_iso: Copying files flatly from floppy_files ==> vsphere-iso.win11_iso: Copying directory: ./setup/ ==> vsphere-iso.win11_iso: Adding file: setup\add-domain.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\autounattend.xml ==> vsphere-iso.win11_iso: Adding file: setup\autounattend.xml-orig ==> vsphere-iso.win11_iso: Adding file: setup\disable-autolog.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\disable-network-discovery.cmd ==> vsphere-iso.win11_iso: Adding file: setup\disable-ssh.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\enable-rdp.cmd ==> vsphere-iso.win11_iso: Adding file: setup\enable-ssh.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\enable-winrm.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\install-vmwtools.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\install_windowsfeatures.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\windows-init.ps1 ==> vsphere-iso.win11_iso: Done copying files from floppy_files ==> vsphere-iso.win11_iso: Collecting paths from floppy_dirs ==> vsphere-iso.win11_iso: Resulting paths from floppy_dirs : [] ==> vsphere-iso.win11_iso: Done copying paths from floppy_dirs ==> vsphere-iso.win11_iso: Copying files from floppy_content ==> vsphere-iso.win11_iso: Done copying files from floppy_content ==> vsphere-iso.win11_iso: Uploading floppy image... ==> vsphere-iso.win11_iso: Adding generated floppy image... ==> vsphere-iso.win11_iso: Setting boot order... ==> vsphere-iso.win11_iso: Powering on virtual machine... ==> vsphere-iso.win11_iso: Waiting 3s for boot... ==> vsphere-iso.win11_iso: Typing boot command... ==> vsphere-iso.win11_iso: Waiting for IP... ==> vsphere-iso.win11_iso: IP address: 10.10.11.186 ==> vsphere-iso.win11_iso: Using WinRM communicator to connect: 10.10.11.186 ==> vsphere-iso.win11_iso: Waiting for WinRM to become available... ==> vsphere-iso.win11_iso: WinRM connected. ==> vsphere-iso.win11_iso: Connected to WinRM! ==> vsphere-iso.win11_iso: Restarting Machine ==> vsphere-iso.win11_iso: Waiting for machine to restart... ==> vsphere-iso.win11_iso: A system shutdown is in progress.(1115) ==> vsphere-iso.win11_iso: A system shutdown is in progress.(1115) ==> vsphere-iso.win11_iso: restarted. ==> vsphere-iso.win11_iso: TACGTAC-8KAGCAS restarted. ==> vsphere-iso.win11_iso: Machine successfully restarted, moving on ==> vsphere-iso.win11_iso: Provisioning with Powershell... ==> vsphere-iso.win11_iso: Provisioning with powershell script: ./setup/windows-init.ps1 ==> vsphere-iso.win11_iso: Configuring important Windows Features... ==> vsphere-iso.win11_iso: Setting the network connection profiles to Private... ==> vsphere-iso.win11_iso: Setting the Windows Remote Management configuration... ==> vsphere-iso.win11_iso: WinRM service is already running on this machine. ==> vsphere-iso.win11_iso: WinRM is already set up for remote management on this computer. ==> vsphere-iso.win11_iso: Service ==> vsphere-iso.win11_iso: RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD) ==> vsphere-iso.win11_iso: MaxConcurrentOperations = 4294967295 ==> vsphere-iso.win11_iso: MaxConcurrentOperationsPerUser = 1500 ==> vsphere-iso.win11_iso: EnumerationTimeoutms = 240000 ==> vsphere-iso.win11_iso: MaxConnections = 300 ==> vsphere-iso.win11_iso: MaxPacketRetrievalTimeSeconds = 120 ==> vsphere-iso.win11_iso: AllowUnencrypted = true ==> vsphere-iso.win11_iso: Auth ==> vsphere-iso.win11_iso: Basic = true ==> vsphere-iso.win11_iso: Kerberos = true ==> vsphere-iso.win11_iso: Negotiate = true ==> vsphere-iso.win11_iso: Certificate = false ==> vsphere-iso.win11_iso: CredSSP = false ==> vsphere-iso.win11_iso: CbtHardeningLevel = Relaxed ==> vsphere-iso.win11_iso: DefaultPorts ==> vsphere-iso.win11_iso: HTTP = 5985 ==> vsphere-iso.win11_iso: HTTPS = 5986 ==> vsphere-iso.win11_iso: IPv4Filter = * ==> vsphere-iso.win11_iso: IPv6Filter = * ==> vsphere-iso.win11_iso: EnableCompatibilityHttpListener = false ==> vsphere-iso.win11_iso: EnableCompatibilityHttpsListener = false ==> vsphere-iso.win11_iso: CertificateThumbprint ==> vsphere-iso.win11_iso: AllowRemoteAccess = true ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Auth ==> vsphere-iso.win11_iso: Basic = true ==> vsphere-iso.win11_iso: Kerberos = true ==> vsphere-iso.win11_iso: Negotiate = true ==> vsphere-iso.win11_iso: Certificate = false ==> vsphere-iso.win11_iso: CredSSP = false ==> vsphere-iso.win11_iso: CbtHardeningLevel = Relaxed ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Allowing Windows Remote Management in the Windows Firewall... ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: No rules match the specified criteria. ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Updated 2 rule(s). ==> vsphere-iso.win11_iso: Ok. ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Running shutdown command... ==> vsphere-iso.win11_iso: Deleting floppy drives... ==> vsphere-iso.win11_iso: Deleting floppy image... ==> vsphere-iso.win11_iso: Ejecting CD-ROM media... ==> vsphere-iso.win11_iso: Removing CD-ROM devices... ==> vsphere-iso.win11_iso: Closing sessions... Build 'vsphere-iso.win11_iso' finished after 20 minutes 40 seconds. ... ==> Wait completed after 20 minutes 40 seconds ==> Builds finished. The artifacts of successful builds are: --> vsphere-iso.win11_iso: win11-p01 azadmin@tacg-cicd:~$ Creating Master Images using Packer on Azure with Packer, Ansible, and ChocolateyUsing Packer with a modern package manager like Chocolatey makes it easier to create master images that include all necessary software components. With Packer, you define the basic settings of the master image based on your requirements for the underlying operating system. Next, with Chocolatey, you can then install all the necessary software components after configuring the operating system. Chocolatey´s repository currently lists over 10,000 software packages. Finally, Ansible enables installing software components that are not available in Chocolatey or that are not supported for deployment via Chocolatey. Since we are referring to DaaS and CVAD, Packer can also perform the appropriate configuration and installation of the Virtual Delivery Agent (VDA) and other Citrix components, resulting in a fully configured master image ready for further use. Note You can find the full guide on Citrix TechZone: https://community.citrix.com/tech-zone/automation/masterimage-iac-packer-ansible-chocolatey-github This example demonstrates creating a much more sophisticated Windows 11-based Master Image with Packer, Ansible, and Chocolatey on Azure. For a detailed overview of the builder, please look at the plugin´s documentation. PrerequisitesBefore starting Packer, we need to determine some Azure-related information, like the SKUs to be used: # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion ### Get available Windows Desktop Publishers PS C:\Users\packer> Get-AzVMImagePublisher -Location "austriaeast" | Where-Object { $_.PublisherName -eq "MicrosoftWindowsDesktop" } | Select PublisherName PublisherName ------------- MicrosoftWindowsDesktop PS C:\Users\packer> ### Get available Win11-Image Offers PS C:\Users\packer> Get-AzVMImageOffer -Location "austriaeast" -PublisherName "MicrosoftWindowsDesktop" | Select Offer Offer ----- office-365 Windows-10 windows-11 windows-7 windows-ent-cpc windows10preview windows11preview windows11preview-arm64 PS C:\Users\packer> ### Get Windows 11 Image SKU with Office 365 installed PS C:\Users\packer> Get-AzVMImageSku -Location "austriaeast" -PublisherName "MicrosoftWindowsDesktop" -Offer "office-365" | Select Skus Skus ---- rs5-evd-o365pp-g2 win10-22h2-avd-m365 win10-22h2-avd-m365-g2 win11-22h2-avd-m365 win11-23h2-avd-m365 win11-24h2-avd-m365 win11-25h2-avd-m365 PS C:\Users\packer> ### Get final Image version ID PS C:\Users\packer> Get-AzVMImage -Location "austriaeast" -PublisherName "MicrosoftWindowsDesktop" -Offer "office-365" -Sku "win11-25h2-avd-m365" | Select Version Version ------- 26200.6584.250915 26200.6899.251014 26200.7171.251111 PS C:\Users\packer>Determining the software packages to be installed using ChocolateyThe next step is to determine which software packages you want to use – Chocolatey currently offers more than 10,000 packages. Note You can find an actual list at https://community.chocolatey.org/packages. Important Please check whether a package is supported in your environment before deploying it. Each package has a lot of information tied to – the most important is if tests have failed. You can then look for a valid, error-free package in the package history. Example package data – Google Chrome: In our environment, we, of course, only use problem-free packages. You can most easily check the last available problem-free versions using a PowerShell script to determine these packages: choco search --exact googlechrome -a --approved-only --not-broken --limit-outputPS C:\TMM> choco search --exact googlechrome -a --approved-only --not-broken --limit-output GoogleChrome|143.0.7499.41 GoogleChrome|142.0.7444.176 GoogleChrome|142.0.7444.163 GoogleChrome|142.0.7444.135 GoogleChrome|142.0.7444.60 GoogleChrome|142.0.7444.52 GoogleChrome|141.0.7390.77 GoogleChrome|141.0.7390.66 GoogleChrome|141.0.7390.55 GoogleChrome|141.0.7390.37 ...Choosing the software packages to be installed using ChocolateyChocolatey needs a packages.config file to know which packages should be installed during the creation of the master image. Example of a packages.config file: <?xml version="1.0" encoding="utf-8"?> <packages> <package id="adobereader" version="2025.1.20577" /> <package id="googlechrome" version="143.0.7499.41" /> <package id="git.install" version="2.52.0" /> <package id="sysinternals" version="2025.11.17" /> <package id="winscp.install" version="6.5.5" /> <package id="teamviewer" version="15.72.6" /> <package id="dropbox" version="238.4.6075" /> </packages>Based on the package list seen earlier, you can manually create a suitable package.config file, or you can use any other mechanism. For demonstration purposes, we created a self-service web application that lets you choose packages via a web frontend. The table with the packages and their versions is dynamically created out of the JSON file mentioned above: Configuring Packer to create the master image and deploy the packagesLet´s look at a valid example of an HCL to create a Windows 11-based master image on Azure, deploy the software packages using Chocolatey, and upload the final image to an Azure Image Gallery – from there, you can, for example, create an image definition and image version in Citrix Daas to deploy a Machine catalog. win11-azure.packer.hcl: # Defining all used variables variable "azure_clientid" { type = string description = "azure Service Principal App ID" sensitive = true } variable "azure_clientsecret" { type = string description = "azure Service Principal Secret" sensitive = true } variable "azure_subscriptionid" { type = string description = "azure Subscription ID" sensitive = true } variable "azure_tenantid" { type = string description = "azure Tenant ID" sensitive = true } ... variable "vda_location" { type = string } variable "script_installvda" { type = string default = "install-vda.ps1" } variable "script_optimizer" { type = string default = "run-optimizer.ps1" } variable "script_cleanup" { type = string default = "run-cleanup.ps1" } variable "location_setup" { type = string default = "c:\\setup" } # Defining the used Packer Plugin(s) packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = ">= 2.5.0" } } } # Defining the source(s) block(s) source "azure-arm" "W11MIWithSWPackagesWithVDA" { # Tagging the Azure VM azure_tags = { environment = var.azure_tag_environment, environment-entity = var.azure_tag_environment_entity, usage = var.azure_tag_usage } # WinRM Communicator communicator = "winrm" winrm_use_ssl = true winrm_insecure = false winrm_timeout = "5m" winrm_username = "packer" # Service Principal Authentication client_id = var.azure_clientid client_secret = var.azure_clientsecret subscription_id = var.azure_subscriptionid tenant_id = var.azure_tenantid # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion # Destination Image - we want to upload the artifact directly into the Azure Image Gallery, so no creation of a stand-alone image is needed # managed_image_resource_group_name = var.azure_RG # managed_image_name = var.azure_ManagedImgName # Store created Image in Shared Image Gallery shared_image_gallery_destination { resource_group = var.azure_rg gallery_name = var.azure_sig_name image_name = var.azure_sig_imgname image_version = var.azure_sig_imgversion replication_regions = ["austriaeast"] storage_account_type = "Standard_LRS" } # Packer Computing Resources build_resource_group_name = var.azure_temprg vm_size = var.azure_vmsize } # Defining the building blocks build { source "azure-arm.W11MIWithSWPackagesWithVDA" {} # Install Chocolatey: https://chocolatey.org/install#individual provisioner "powershell" { inline = ["Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"] } # Install Chocolatey packages provisioner "file" { source = "./scripts/SWPackagesToInstall.config" destination = "${var.location_setup}/scripts/SWPackagesToInstall.config" } provisioner "powershell" { inline = ["choco install --ignore-hash --ignore-checksums --confirm ${var.location_setup}/scripts/SWPackagesToInstall.config"] # See https://docs.chocolatey.org/en-us/choco/commands/install#exit-codes valid_exit_codes = [0, 3, 1641, 3010] } provisioner "windows-restart" {} provisioner "powershell" { inline = ["New-Item -Path ${var.location_setup} -Force -ItemType \"directory\" | Out-Null"] } provisioner "file" { destination = "${var.location_setup}/${var.script_installvda}" source = "./scripts/${var.script_installvda}" } provisioner "file" { destination = "${var.location_setup}/${var.script_optimizer}" source = "./scripts/${var.script_optimizer}" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Host 'Script: computer restarted.'}\"" restart_timeout = "30m" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "powershell" { inline = ["$assemblyPath = \"C:\\Program Files (x86)\\Citrix\\ICA Client\\wfica32.exe\"", "$ngen64 = \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\"", "$ngen32 = \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\"", "Write-Host \"Running 64-bit Ngen...\"", "& $ngen64 executequeueditems", "Write-Host \"Running 32-bit Ngen...\"", "& $ngen32 executequeueditems"] } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_optimizer} -OptimizerDownloadUri ${var.optimizer_location} -Template ${var.optimizer_template}"] } # Generalize image using Sysprep # See https://www.packer.io/docs/builders/azure/arm#windows # See https://docs.microsoft.com/en-us/azure/virtual-machines/windows/build-image-with-packer#define-packer-template provisioner "powershell" { inline = [ "while ((Get-Service RdAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "while ((Get-Service WindowsazureGuestAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /quiet /quit /mode:vm", "while ($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }" ] } }The variables are defined in a key-value format - example: win11-azure.auto.pkrvars.hcl: azure_clientid = <sensitive> azure_clientsecret = <sensitive> azure_subscriptionid = <sensitive> azure_tenantid = <sensitive> azure_rg = "TMM-<sensitive>" azure_temprg = "TMM-<sensitive>" azure_imgpublisher = "MicrosoftWindowsDesktop" azure_imgoffer = "windows-11" azure_imgsku = "win11-25h2-pro" azure_imgversion = "26200.7462.251207" ... vda_location = "https://<sensitive>.blob.core.windows.net/ctxsw/VDAWorkstationSetup_2507.exe" script_installvda = "install-vda.ps1" script_optimizer = "run-optimizer.ps1" script_cleanup = "run-cleanup.ps1" location_setup = "c:\\ttemp" optimizer_location = "https://<sensitive>.blob.core.windows.net/ctxsw/CitrixOptimizerTool.zip" optimizer_template = "Citrix_Windows_11_2009.xml"To start the creation process manually, you can use the well-known Packer command: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ packer build -on-error=cleanup -force -var-file="win11-azure.auto.pkrvars.hcl" win11-azure.pkr.hclPacker writes out all relevant information during the building process. ==> azure-arm.W11MIWithSWPackagesWithVDA: Running builder ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Azure Resource Manager (ARM) client ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ARM Client successfully created ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting source image id for the deployment ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> SourceImageName: '/subscriptions/<sensitive>/providers/Microsoft.Compute/locations/austriaeast/publishers/MicrosoftWindowsDesktop/ArtifactTypes/vmimage/offers/windows-11/skus/win11-25h2-pro/versions/26200.7462.251207' ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting the VM's IP address ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> ResourceGroupName : 'TMM-<sensitive>' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> PublicIPAddressName : 'pkripgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> NicName : 'pkrnigf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> Network Connection : 'PublicEndpoint' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> IP Address : '4.210.182.179' ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for WinRM to become available... ==> azure-arm.W11MIWithSWPackagesWithVDA: WinRM connected. ==> azure-arm.W11MIWithSWPackagesWithVDA: Connected to WinRM! ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Forcing web requests to allow TLS v1.2 (Required for requests to Chocolatey.org) ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting latest version of the Chocolatey package for download. ==> azure-arm.W11MIWithSWPackagesWithVDA: Not using proxy. ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting Chocolatey from https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0. ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0 to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip ==> azure-arm.W11MIWithSWPackagesWithVDA: Not using proxy. ==> azure-arm.W11MIWithSWPackagesWithVDA: Extracting C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing Chocolatey on the local machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating ChocolateyInstall as an environment variable (targeting 'Machine') ==> azure-arm.W11MIWithSWPackagesWithVDA: Setting ChocolateyInstall to 'C:\ProgramData\chocolatey' ... ==> azure-arm.W11MIWithSWPackagesWithVDA: c:\ttemp/scripts/SWPackagesToInstall.config ==> azure-arm.W11MIWithSWPackagesWithVDA: By installing, you accept licenses for the packages. ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing the following packages: ==> azure-arm.W11MIWithSWPackagesWithVDA: adobereader ==> azure-arm.W11MIWithSWPackagesWithVDA: googlechrome ==> azure-arm.W11MIWithSWPackagesWithVDA: git.install ==> azure-arm.W11MIWithSWPackagesWithVDA: sysinternals ==> azure-arm.W11MIWithSWPackagesWithVDA: winscp.install ==> azure-arm.W11MIWithSWPackagesWithVDA: teamviewer ==> azure-arm.W11MIWithSWPackagesWithVDA: dropbox ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWithSWPackagesWithVDA: Progress: Downloading chocolatey-compatibility.extension 1.0.0... 100% ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWithSWPackagesWithVDA: Progress: Downloading GoogleChrome 143.0.7499.41... 100% ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome v143.0.7499.41[Approved] ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome package files install completed. Performing other installation steps. ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading googlechrome 64 bit ==> azure-arm.W11MIWithSWPackagesWithVDA: from 'https://dl.google.com/dl/chrome/install/googlechromestandaloneenterprise64.msi' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Download of googlechromestandaloneenterprise64.msi (-1 B) completed. ==> azure-arm.W11MIWithSWPackagesWithVDA: WARNING: Ignoring checksums due to feature checksumFiles turned off or option --ignore-checksums set. ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing googlechrome... ==> azure-arm.W11MIWithSWPackagesWithVDA: googlechrome has been installed. ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome may be able to be automatically uninstalled. ==> azure-arm.W11MIWithSWPackagesWithVDA: The install of GoogleChrome was successful. ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Chocolatey installed 13/13 packages. ==> azure-arm.W11MIWithSWPackagesWithVDA: See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log). ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Installed: ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-compatibility.extension v1.0.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-core.extension v1.4.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-dotnetfx.extension v1.0.1 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-visualstudio.extension v1.13.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-windowsupdate.extension v1.0.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - adobereader v2025-1-20577 ==> azure-arm.W11MIWithSWPackagesWithVDA: - filezilla v3.69.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - GoogleChrome v143.0.7499.41 ==> azure-arm.W11MIWithSWPackagesWithVDA: - git.install v2.52.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - sysinternals v2025.11.17 ==> azure-arm.W11MIWithSWPackagesWithVDA: - winscp.install v6.5.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - teamviewer v15.72.6 ==> azure-arm.W11MIWithSWPackagesWithVDA: - dropbox v238.4.6075 ==> azure-arm.W11MIWithSWPackagesWithVDA: Restarting Machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for machine to restart... ==> azure-arm.W11MIWithSWPackagesWithVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWithSWPackagesWithVDA: pkrvmgf6zyyvkul restarted. ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Uploading ./scripts/install-vda.ps1 => c:\ttemp/install-vda.ps1 ==> azure-arm.W11MIWithSWPackagesWithVDA: Uploading ./scripts/run-optimizer.ps1 => c:\ttemp/run-optimizer.ps1 ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with powershell script: C:\Users\Gerhard\AppData\Local\Temp\powershell-provisioner3550365223 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:50 - Initiating Ctrix VDA installation. ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:50 - Adding firewall allow rules for ports 80, 443, 1494, 2598, 8008 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:53 - Finished adding firewall allow rules for ports 80, 443, 1494, 2598, 8008 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:53 - Downloading VDASetup file from blob storage ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:05 - Executing: C:\Users\packer\AppData\Local\Temp\VDASetup.exe, Components: VDA ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:05 - Parameters: /quiet /noreboot /masterimage /enable_real_time_transport /enable_hdx_ports /components vda /includeadditional "Citrix MCS IODriver","Citrix VDA Upgrade Agent" ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:40 - XenDesktopVDA installation started ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:40 - Waiting few seconds to make sure the process extracts and starts ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:58:40 - Checking if XenDesktopVdaSetup process is running ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:58:40 - Installation process still running ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - Installation process completed ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - GctRegistration already enabled ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - BrokerAgent found and it is running. ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - Installation of XenDesktopVDA completed with success ==> azure-arm.W11MIWithSWPackagesWithVDA: Restarting Machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for machine to restart... ==> azure-arm.W11MIWithSWPackagesWithVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: computer restarted. ==> azure-arm.W11MIWithSWPackagesWithVDA: pkrvmgf6zyyvkul restarted. ==> azure-arm.W11MIWithSWPackagesWithVDA: Machine successfully restarted, moving on ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with powershell script: C:\Users\Gerhard\AppData\Local\Temp\powershell-provisioner2019159959 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:20:55 - Downloading Citrix Optimizer from blob storage ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:20:55 - Executing: C:\Users\packer\AppData\Local\Temp\CitrixOptimizer\CtxOptimizerEngine.ps1, Template: Citrix_Windows_11_2009.xml ==> azure-arm.W11MIWithSWPackagesWithVDA: ------------------------------ ==> azure-arm.W11MIWithSWPackagesWithVDA: | Citrix Optimization Engine | ==> azure-arm.W11MIWithSWPackagesWithVDA: | Version 2.9 | ==> azure-arm.W11MIWithSWPackagesWithVDA: ------------------------------ ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Running in execute mode ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Logs folder 2025-12-12_14-20-55 ==> azure-arm.W11MIWithSWPackagesWithVDA: Starting session log ==> azure-arm.W11MIWithSWPackagesWithVDA: Checking permissions ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Processing definition file C:\Users\packer\AppData\Local\Temp\CitrixOptimizer\Templates\Citrix_Windows_11_2009.xml ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:24:38 - Optimization script completed ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: IMAGE_STATE_COMPLETE ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Querying the machine's properties ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Powering off machine ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Publishing to Shared Image Gallery ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> Shared Gallery Image Version ID : '/subscriptions/<sensitive>/resourceGroups/TMM-<sensitive>/providers/Microsoft.Compute/galleries/<sensitive>/images/<sensitive>/versions/1.0.0' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleting Virtual Machine deployment and its attached resources... ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Compute/virtualMachines : 'pkrvmgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/networkInterfaces : 'pkrnigf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/virtualNetworks : 'pkrvngf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/publicIPAddresses : 'pkripgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/networkSecurityGroups : 'pkrsggf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Compute/disks : '/subscriptions/<sensitive>/resourceGroups/TMM-sensitive/providers/Microsoft.Compute/disks/pkrosgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Removing the created Deployment object: 'pkrdpgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleting KeyVault created during build ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.KeyVault/vaults : 'pkrkvgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Removing the created Deployment object: 'kvpkrdpgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: The resource group was not created by Packer, not deleting ... Build 'azure-arm.W11MIWithSWPackagesWithVDA' finished after 54 minutes 36 seconds. ==> Wait completed after 54 minutes 36 seconds ==> Builds finished. The artifacts of successful builds are: --> azure-arm.W11MIWithSWPackagesWithVDA: Azure.ResourceManagement.VMImage: OSType: Windows ManagedImageSharedImageGalleryId: /subscriptions/<sensitive>/resourceGroups/TMM-<sensitive>/providers/Microsoft.Compute/galleries/<sensitive>/images/<sensitive>/versions/1.0.0 SharedImageGalleryResourceGroup: TMM-<sensitive> SharedImageGalleryName: <sensitive> SharedImageGalleryImageName: <sensitive> SharedImageGalleryImageVersion: 1.0.0 SharedImageGalleryReplicatedRegions: austriaeastThe creation was completed successfully. We can now use this image version, for example, to generate the corresponding image on Citrix DaaS to create a Machine Catalog. #### Creating the Image Definition based on the Azure shared gallery image definition resource "citrix_image_definition" "CreateAzureImageDefinition" { name = var.CC-Azure-ImgDef-Name description = var.CC-Azure-ImgDef-Description os_type = "Windows" session_support = "SingleSession" hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id azure_image_definition = { resource_group = var.TACG-TMM-ResourceGroup-Name use_image_gallery = true image_gallery_name = var.CC-Azure-SIG-Name } } #### Creating the Image version based on the Azure shared gallery image version resource "citrix_image_version" "CreateAzureImageVersion" { depends_on = [citrix_image_definition.CreateAzureImageDefinition] image_definition = citrix_image_definition.CreateAzureImageDefinition.id hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id description = var.CC-Azure-ImgVer-Description azure_image_specs = { service_offering = var.CC-Azure-Img-ServiceOffering storage_type = var.CC-Azure-Img-StorageType resource_group = var.TACG-TMM-ResourceGroup-Name gallery_image = { gallery = var.CC-Azure-SIG-Name definition = var.CC-Azure-SIGDefinition-Name version = var.CC-Azure-SIGDefinition-Version } machine_profile = { machine_profile_resource_group = var.CC-Azure-ImgVer-MachineProfile-RG machine_profile_vm_name = var.CC-Azure-ImgVer-MachineProfile-VMName } } } resource "null_resource" "WriteProgress2" { depends_on = [citrix_image_version.CreateAzureImageVersion] provisioner "local-exec" { command = "echo The Image definition and Image version were successfully created..." } } #### Creating the Machine Catalog based on the Image version just created resource "citrix_machine_catalog" "CreateAzureMCSCatalog" { depends_on = [citrix_image_version.CreateAzureImageVersion] name = var.CC-Azure-MC-Name description = var.CC-Azure-MC-Description allocation_type = var.CC-Azure-MC-AllocationType session_support = var.CC-Azure-MC-SessionType provisioning_type = "MCS" #zone = data.local_file.LoadZoneID.content zone = data.citrix_zone.GetTFAzureZoneID.id #scopes = "${var.CC-GetScopeToBeUsed-Names}" provisioning_scheme = { hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id identity_type = "${var.CC-Azure-MC-IDPType}" machine_domain_identity = { domain = "${var.CC-Azure-MC-Domain}" domain_ou = "${var.CC-Azure-MC-DomainOU}" service_account = "${var.CC-Azure-MC-DomainAdmin-Username-UPN}" service_account_password = "${var.CC-Azure-MC-DomainAdmin-Password}" } azure_machine_config = { storage_type = "Premium_LRS" use_managed_disks = true service_offering = "${var.CC-Azure-MC-VMSize}" machine_profile = { machine_profile_resource_group = var.CC-Azure-ImgVer-MachineProfile-RG machine_profile_vm_name = var.CC-Azure-ImgVer-MachineProfile-VMName } prepared_image = { image_definition = citrix_image_definition.CreateAzureImageDefinition.id image_version = citrix_image_version.CreateAzureImageVersion.id } } number_of_total_machines = var.CC-Azure-MC-Machine_Count machine_account_creation_rules = { naming_scheme = "${var.CC-Azure-MC-NamingScheme-Name}" naming_scheme_type = "${var.CC-Azure-MC-NamingScheme-Type}" } } }Adding AnsibleIf Chocolatey is not suitable/capable of fulfilling all software deployment needs, we can use Ansible to fill in the gaps. As Ansible is another important IaC tool, we follow our strict IaC strategy. Using Ansible, you can also install Windows features during the creation process – let´s look at some examples: ######################################## # Ansible connection variables (WinRM) ######################################## variable "ansible_user" { type = string default = "Administrator" } variable "ansible_password" { type = string sensitive = true } variable "ansible_connection" { type = string default = "winrm" } variable "ansible_transport" { type = string default = "basic" } // or ntlm/credssp if needed ######################################## # Hosting Bundle variables (ASP.NET Core) ######################################## variable "hosting_bundle_url" { type = string description = "Direct download URL for the .NET Hosting Bundle installer (ASP.NET Core on IIS)." } variable "hosting_bundle_args" { type = string description = "Silent install args for Hosting Bundle." // Install quietly, no restart; optionally skip x86 if you host only x64 apps default = "/quiet /norestart OPT_NO_X86=1" } // Run Ansible from the build machine against the Azure VM provisioner "ansible" { playbook_file = "ansible/windows-iis-dotnet.yml" // Group the host for group_vars if you want groups = ["azure", "windows", "iis"] // Provisioner user is the Ansible connection user user = var.ansible_user // Pass connection vars to Ansible extra_arguments = [ "-e", "ansible_connection=${var.ansible_connection}", "-e", "ansible_user=${var.ansible_user}", "-e", "ansible_password=${var.ansible_password}", "-e", "ansible_winrm_transport=${var.ansible_transport}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "hosting_bundle_url=${var.hosting_bundle_url}", "-e", "hosting_bundle_args=${var.hosting_bundle_args}" ] // For WinRM, letting the provisioner skip localhost proxy is recommended use_proxy = false } }windows-iis-dotnet.yml --- - name: Prepare Windows for IIS + .NET hosts: all gather_facts: no vars: # Passed from Packer via extra_arguments hosting_bundle_url: "{{ hosting_bundle_url | default('') }}" hosting_bundle_args: "{{ hosting_bundle_args | default('/quiet /norestart OPT_NO_X86=1') }}" site_name: "Default Web Site" site_path: "C:\\inetpub\\wwwroot" tasks: # 1) Install IIS base + ASP.NET 4.x features - name: Install IIS Web-Server with common subfeatures ansible.windows.win_feature: name: - Web-Server - Web-Static-Content - Web-Default-Doc - Web-Dir-Browsing - Web-Http-Errors - Web-Http-Logging - Web-Stat-Compression - Web-Filtering - Web-Basic-Auth - Web-Windows-Auth - Web-ISAPI-Ext - Web-ISAPI-Filter - Web-Asp-Net45 # ASP.NET 4.x integration with IIS - Web-Net-Ext45 # .NET Extensibility 4.x - Web-Mgmt-Console state: present include_management_tools: true register: iis_features # Ansible feature names & usage: # https://docs.ansible.com/.../win_feature_module.html # (See citations in the prose above) - name: Reboot if IIS feature installation requires it ansible.windows.win_reboot: when: iis_features.reboot_required | default(false) # 2) (Optional) Ensure .NET Framework 4.8/4.8.1 is present if your apps need it # Use win_feature or a dedicated role/installer if you target specific KBs # Supported versions reference is here: # https://learn.microsoft.com/.../framework/install/on-windows-and-server # (See citations in the prose above) # 3) Install the .NET Hosting Bundle (ASP.NET Core runtime + IIS integration) - name: Fail fast if Hosting Bundle URL not provided ansible.builtin.fail: msg: "Please pass hosting_bundle_url via Packer variable." when: hosting_bundle_url | length == 0 - name: Download .NET Hosting Bundle installer ansible.windows.win_get_url: url: "{{ hosting_bundle_url }}" dest: "C:\\Windows\\Temp\\dotnet-hosting-bundle.exe" - name: Install .NET Hosting Bundle silently ansible.windows.win_package: path: "C:\\Windows\\Temp\\dotnet-hosting-bundle.exe" arguments: "{{ hosting_bundle_args }}" state: present - name: Reboot after Hosting Bundle (pick up PATH & module changes) ansible.windows.win_reboot: # 4) Configure IIS website (requires microsoft.iis collection) - name: Ensure IIS Default Web Site is present and started microsoft.iis.website: name: "{{ site_name }}" state: started physical_path: "{{ site_path }}" port: 80 ip: "*" hostname: "" # Module docs: https://docs.ansible.com/.../microsoft/iis/website_module.htmlUse Ansible to deploy Chocolatey packagesYou might also use Ansible to deploy the Chocolatey packages -some benefits are: Ansible idempotency: Rerun the deployment process to make sure, all needed packages are deployed Update/Uninstall/Add packages depending on conditions Example for deploying Software packages initially: --- - name: Install SW Packages using Chocolatey hosts: packer_masterimages_w11 vars: # Add all packages which should be installed by Chocolatey choco_packages: - 7zip - git - putty - notepadplusplus - adobereader - firefox - sql-server-management-studio - newpackagename tasks: - name: Install packages win_chocolatey: name: "{{ item }}" state: present loop: "{{ choco_packages }}" register: get_choco_installation_results failed_when: false - name: Determine if any choco install returned reboot-required (3010) set_fact: reboot_required: >- {{ ( get_choco_installation_results.results | selectattr('rc','defined') | selectattr('rc','equalto',3010) | list | length > 0 ) or ( get_choco_installation_results.results | selectattr('return_code','defined') | selectattr('return_code','equalto',3010) | list | length > 0 ) or ( get_choco_installation_results.results | selectattr('chocolatey_exit_code','defined') | selectattr('chocolatey_exit_code','equalto',3010) | list | length > 0 ) }} - name: Show whether a host reboot is required debug: msg: "Chocolatey requests a host reboot: {{ reboot_required }}" - name: Reboot the host if Chocolatey signaled that a host reboot is required ansible.windows.win_reboot: reboot_timeout: 600 pre_reboot_delay: 5 post_reboot_delay: 30 when: reboot_required | boolIn this snippet, Ansible reads a list of packages to install and installs them sequentially. It then looks through each installation´s return code and, if a reboot is necessary, automatically reboots the machine. If you add package names here, even after the initial run, Ansible and its Idempotency would only install the additional package. This is also used in our self-written website and framework, where we can visually select all required packages for deployment. The framework adds or removes the package names and triggers the playbook run. choco_packages: - 7zip - git - putty - notepadplusplus - adobereader - firefox - sql-server-management-studio - newpackagenameAs mentioned, you can also use the same snippet for uninstalling the packages – you only need to change the state from present to absent: tasks: - name: Install packages win_chocolatey: name: "{{ item }}" state: present # ---------------------------------- loop: "{{ choco_packages }}"to tasks: - name: Remove packages win_chocolatey: name: "{{ item }}" state: absent # ---------------------------------- loop: "{{ choco_packages }}"A Terraform code snippet starts the Ansible Playbook, as Terraform is the backend of all our IaC workflows. # Terraform Deployment to install Software Packages on Target machines using Ansible and Chocolatey ## Reference https://docs.ansible.com/projects/ansible/latest/collections/chocolatey/chocolatey/win_chocolatey_module.html ### Reference https://community.chocolatey.org/packages #### Ansible-related Variables ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyPlaybooksForTargetToAnsibleServer" { connection { type = var.TACG-TMM-Ansible-Connection-Type user = var.TACG-TMM-Ansible-Connection-User password = var.TACG-TMM-Ansible-Connection-Password host = var.TACG-TMM-Ansible-Connection-HostIP } provisioner "file" { source = var.TACG-TMM-Ansible-GetSWPackagesInstalledByChocolatey-Playbook-Source destination = var.TACG-TMM-Ansible-GetSWPackagesInstalledByChocolatey-Playbook-Destination } provisioner "file" { source = var.TACG-TMM-Ansible-InstallSWPackagesUsingChocolatey-Playbook-Source destination = var.TACG-TMM-Ansible-InstallSWPackagesUsingChocolatey-Playbook-Destination } provisioner "file" { source = var.TACG-TMM-Ansible-RemoveSWPackagesUsingChocolatey-Playbook-Source destination = var.TACG-TMM-Ansible-RemoveSWPackagesUsingChocolatey-Playbook-Destination } provisioner "file" { source = var.TACG-TMM-Ansible-CheckAnsibleReturnCodeShellScript-Source destination = var.TACG-TMM-Ansible-CheckAnsibleReturnCodeShellScript-Destination } provisioner "file" { source = var.TACG-TMM-Ansible-Inventory-Source destination = var.TACG-TMM-Ansible-Inventory-Destination } } #### Wait 10s Minute for Backgroud Processes to settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyPlaybooksForTargetToAnsibleServer] create_duration = "10s" } #### Use Ansible to install Software Packages using Chocolatey on Target Machine resource "null_resource" "DeploySW" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-Ansible-InstallSWPackagesUsingChocolatey-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.DeploySW] program = ["bash", "/etc/ansible/packer/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/packer/assets/ansible_exit_code.txt", "0|3010"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Software Packages were successfully deployed - Everything OK\" || { echo \"Deploying Software Packages failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } resource "time_sleep" "wait_10_seconds_1" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt] create_duration = "10s" } #### Use Ansible to list all Software Packages using Chocolatey on Target Machine resource "null_resource" "GetSWPackages" { depends_on = [time_sleep.wait_10_seconds_1] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-Ansible-GetSWPackagesInstalledByChocolate-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode_1" { depends_on = [null_resource.GetSWPackages] program = ["bash", "/etc/ansible/packer/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/packer/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt_1" { depends_on = [data.external.CheckAnsibleReturnCode_1] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode_1.result.found}\" = \"1\" ] && echo \"Software Packages were successfully listed - Everything OK\" || { echo \"Listing Software Packages failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### All necessary playbooks on the VMs are completeTerraform uploads all necessary scripts and configuration items to the Ansible cluster, then runs the Software deployment playbook, and, after installation, the Software inventory playbook to list all packages installed by Ansible. Let´s have a look at the output: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE/ImgWithSoftwareFromAnsibleAndChocolatey$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/packer/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/packer/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCode_1 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode_1" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/packer/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/packer/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyPlaybooksForTargetToAnsibleServer will be created + resource "null_resource" "CopyPlaybooksForTargetToAnsibleServer" { + id = (known after apply) } # null_resource.DeploySW will be created + resource "null_resource" "DeploySW" { + id = (known after apply) } # null_resource.GetSWPackages will be created + resource "null_resource" "GetSWPackages" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt_1 will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt_1" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_seconds_1 will be created + resource "time_sleep" "wait_10_seconds_1" { + create_duration = "10s" + id = (known after apply) } Plan: 7 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPlaybooksForTargetToAnsibleServer: Creating... null_resource.CopyPlaybooksForTargetToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForTargetToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForTargetToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForTargetToAnsibleServer: Creation complete after 1s [id=7884248548548556180] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-12-01T13:41:41Z] null_resource.DeploySW: Creating... null_resource.DeploySW: Provisioning with 'local-exec'... null_resource.DeploySW (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook -i /etc/ansible/packer/assets/inventory.ini /etc/ansible/packer/assets/InstallSWPackagesUsingChocolatey.ansible.yml -v -c winrm; echo $? > /etc/ansible/packer/assets/ansible_exit_code.txt"] null_resource.DeploySW (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.DeploySW (local-exec): PLAY [Install SW Packages using Chocolatey] ************************************ null_resource.DeploySW (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.DeploySW: Still creating... [00m10s elapsed] null_resource.DeploySW (local-exec): ok: [10.53.16.16] null_resource.DeploySW (local-exec): TASK [Install packages] ******************************************************** null_resource.DeploySW: Still creating... [00m20s elapsed] null_resource.DeploySW: Still creating... [00m30s elapsed] ... null_resource.DeploySW: Still creating... [14m10s elapsed] null_resource.DeploySW: Still creating... [14m20s elapsed] null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=7zip) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "7zip", "rc": 0} null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=git) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "git", "rc": 0} null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=putty) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "putty", "rc": 0} null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=notepadplusplus) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "notepadplusplus", "rc": 0} null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=adobereader) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "adobereader", "rc": 0} null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=firefox) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "firefox", "rc": 0} null_resource.DeploySW (local-exec): changed: [10.53.16.16] => (item=sql-server-management-studio) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "sql-server-management-studio", "rc": 3010} null_resource.DeploySW (local-exec): TASK [Determine if any choco install returned reboot-required (3010)] ********** null_resource.DeploySW (local-exec): ok: [10.53.16.16] => {"ansible_facts": {"reboot_required": true}, "changed": false} null_resource.DeploySW (local-exec): TASK [Show whether a host reboot is required] ********************************** null_resource.DeploySW (local-exec): ok: [10.53.16.16] => { null_resource.DeploySW (local-exec): "msg": "Chocolatey requests a host reboot: True" null_resource.DeploySW (local-exec): } null_resource.DeploySW (local-exec): TASK [Reboot the host if Chocolatey signaled that a host reboot is required] *** null_resource.DeploySW: Still creating... [14m30s elapsed] null_resource.DeploySW: Still creating... [14m40s elapsed] ... null_resource.DeploySW: Still creating... [17m10s elapsed] null_resource.DeploySW: Still creating... [17m20s elapsed] null_resource.DeploySW (local-exec): changed: [10.53.16.16] => {"changed": true, "elapsed": 180, "rebooted": true, "unreachable": false} null_resource.DeploySW (local-exec): PLAY RECAP ********************************************************************* null_resource.DeploySW (local-exec): 10.53.16.16 : ok=5 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.DeploySW: Creation complete after 17m30s [id=1780552660517598418] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Software Packages were successfully deployed - Everything OK\" || { echo \"Deploying Software Packages failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Software Packages were successfully deployed - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=5539246426978853570] time_sleep.wait_10_seconds_1: Creating... time_sleep.wait_10_seconds_1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_1: Creation complete after 10s [id=2025-12-01T13:59:20Z] null_resource.GetSWPackages: Creating... null_resource.GetSWPackages: Provisioning with 'local-exec'... null_resource.GetSWPackages (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook -i /etc/ansible/packer/assets/inventory.ini /etc/ansible/packer/assets/GetSWPackagesInstalledByChocolatey.ansible.yml -v -c winrm; echo $? > /etc/ansible/packer/assets/ansible_exit_code.txt"] null_resource.GetSWPackages (local-exec): [WARNING]: Ansible is being run in a world writable directory (/etc/ansible), ignoring it as an ansible.cfg source. For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir null_resource.GetSWPackages (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.GetSWPackages (local-exec): PLAY [Print out all software packages installed by Chocolatey] ***************** null_resource.GetSWPackages (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.GetSWPackages (local-exec): ok: [10.53.16.16] null_resource.GetSWPackages (local-exec): TASK [Get all by Chocolatey installed packages] ******************************** null_resource.GetSWPackages: Still creating... [00m10s elapsed] null_resource.GetSWPackages (local-exec): ok: [10.53.16.16] => {"ansible_facts": {"ansible_chocolatey": {"config": {"cacheLocation": "", "commandExecutionTimeoutSeconds": 2700, "containsLegacyPackageInstalls": true, "defaultPushSource": "", "defaultTemplateName": "", "proxy": "", "proxyBypassList": "", "proxyBypassOnLocal": true, "proxyPassword": "", "proxyUser": "", "upgradeAllExceptions": "", "webRequestTimeoutSeconds": 30}, "feature": {"allowEmptyChecksums": false, "allowEmptyChecksumsSecure": true, "allowGlobalConfirmation": false, "alwaysIncludeHeaders": false, "autoUninstaller": true, "checksumFiles": true, "disableCompatibilityChecks": false, "exitOnRebootDetected": false, "failOnAutoUninstaller": false, "failOnInvalidOrMissingLicense": false, "failOnStandardError": false, "ignoreInvalidOptionsSwitches": true, "ignoreUnfoundPackagesOnUpgradeOutdated": false, "logEnvironmentValues": false, "logValidationResultsOnWarnings": true, "logWithoutColor": false, "powershellHost": true, "removePackageInformationOnUninstall": false, "showDownloadProgress": true, "showNonElevatedWarnings": true, "skipPackageUpgradesWhenNotInstalled": false, "stopOnFirstPackageFailure": false, "useEnhancedExitCodes": false, "useFipsCompliantChecksums": false, "useHttpCache": true, "usePackageExitCodes": true, "usePackageHashValidation": false, "usePackageRepositoryOptimizations": true, "useRememberedArgumentsForUpgrades": false, "virusCheck": false}, "filter": ["all"], "outdated": [], "packages": [{"package": "7zip", "version": "25.1.0"}, {"package": "7zip.install", "version": "25.1.0"}, {"package": "adobereader", "version": "2025.1.20844"}, {"package": "chocolatey", "version": "2.5.1"}, {"package": "chocolatey-compatibility.extension", "version": "1.0.0"}, {"package": "chocolatey-core.extension", "version": "1.4.0"}, {"package": "chocolatey-dotnetfx.extension", "version": "1.0.1"}, {"package": "chocolatey-visualstudio.extension", "version": "1.13.0"}, {"package": "dotnetfx", "version": "4.8.0.20220524"}, {"package": "Firefox", "version": "145.0.2"}, {"package": "git", "version": "2.52.0"}, {"package": "git.install", "version": "2.52.0"}, {"package": "KB2919355", "version": "1.0.20160915"}, {"package": "KB2919442", "version": "1.0.20160915"}, {"package": "notepadplusplus", "version": "8.8.8"}, {"package": "notepadplusplus.install", "version": "8.8.8"}, {"package": "putty", "version": "0.83.0"}, {"package": "putty.portable", "version": "0.83.0"}, {"package": "sql-server-management-studio", "version": "22.0.0"}], "sources": [{"admin_only": false, "allow_self_service": false, "bypass_proxy": false, "certificate": null, "disabled": false, "name": "chocolatey", "priority": 0, "source": "https://community.chocolatey.org/api/v2/", "source_username": null}]}}, "changed": false} null_resource.GetSWPackages (local-exec): TASK [Print out facts] ********************************************************* null_resource.GetSWPackages (local-exec): ok: [10.53.16.16] => { null_resource.GetSWPackages (local-exec): "list_choco_packages.ansible_facts.ansible_chocolatey.packages": [ null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "7zip", null_resource.GetSWPackages (local-exec): "version": "25.1.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "7zip.install", null_resource.GetSWPackages (local-exec): "version": "25.1.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "adobereader", null_resource.GetSWPackages (local-exec): "version": "2025.1.20844" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "chocolatey", null_resource.GetSWPackages (local-exec): "version": "2.5.1" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "chocolatey-compatibility.extension", null_resource.GetSWPackages (local-exec): "version": "1.0.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "chocolatey-core.extension", null_resource.GetSWPackages (local-exec): "version": "1.4.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "chocolatey-dotnetfx.extension", null_resource.GetSWPackages (local-exec): "version": "1.0.1" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "chocolatey-visualstudio.extension", null_resource.GetSWPackages (local-exec): "version": "1.13.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "dotnetfx", null_resource.GetSWPackages (local-exec): "version": "4.8.0.20220524" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "Firefox", null_resource.GetSWPackages (local-exec): "version": "145.0.2" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "git", null_resource.GetSWPackages (local-exec): "version": "2.52.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "git.install", null_resource.GetSWPackages (local-exec): "version": "2.52.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "KB2919355", null_resource.GetSWPackages (local-exec): "version": "1.0.20160915" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "KB2919442", null_resource.GetSWPackages (local-exec): "version": "1.0.20160915" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "notepadplusplus", null_resource.GetSWPackages (local-exec): "version": "8.8.8" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "notepadplusplus.install", null_resource.GetSWPackages (local-exec): "version": "8.8.8" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "putty", null_resource.GetSWPackages (local-exec): "version": "0.83.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "putty.portable", null_resource.GetSWPackages (local-exec): "version": "0.83.0" null_resource.GetSWPackages (local-exec): }, null_resource.GetSWPackages (local-exec): { null_resource.GetSWPackages (local-exec): "package": "sql-server-management-studio", null_resource.GetSWPackages (local-exec): "version": "22.0.0" null_resource.GetSWPackages (local-exec): } null_resource.GetSWPackages (local-exec): ] null_resource.GetSWPackages (local-exec): } null_resource.GetSWPackages (local-exec): PLAY RECAP ********************************************************************* null_resource.GetSWPackages (local-exec): 10.53.16.16 : ok=3 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.GetSWPackages: Creation complete after 14s [id=2076355028329137182] data.external.CheckAnsibleReturnCode_1: Reading... data.external.CheckAnsibleReturnCode_1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt_1: Creating... null_resource.IfExitCodeIsNotZeroThenHalt_1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt_1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Software Packages were successfully listed - Everything OK\" || { echo \"Listing Software Packages failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt_1 (local-exec): Software Packages were successfully listed - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt_1: Creation complete after 0s [id=4904832862807509256] Apply complete! Resources: 7 added, 0 changed, 0 destroyed. azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE/ImgWithSoftwareFromAnsibleAndChocolatey$ Rerunning Software Deployment PlaybookIf you rerun the Software deployment playbook, Ansible uses its idempotency to ensure all playbooks are still installed: Example for rerunning the Terraform code to ensure all packages are installed: ... null_resource.DeploySW (local-exec): TASK [Install packages] ******************************************************** null_resource.DeploySW: Still creating... [00m10s elapsed] null_resource.DeploySW: Still creating... [00m20s elapsed] null_resource.DeploySW: Still creating... [00m30s elapsed] null_resource.DeploySW: Still creating... [00m40s elapsed] null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=7zip) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "7zip", "rc": 0} null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=git) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "git", "rc": 0} null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=putty) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "putty", "rc": 0} null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=notepadplusplus) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "notepadplusplus", "rc": 0} null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=adobereader) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "adobereader", "rc": 0} null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=firefox) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "firefox", "rc": 0} null_resource.DeploySW (local-exec): ok: [10.53.16.16] => (item=sql-server-management-studio) => {"ansible_loop_var": "item", "changed": false, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "sql-server-management-studio", "rc": 0} null_resource.DeploySW (local-exec): TASK [Determine if any choco install returned reboot-required (3010)] ********** null_resource.DeploySW (local-exec): ok: [10.53.16.16] => {"ansible_facts": {"reboot_required": false}, "changed": false} null_resource.DeploySW (local-exec): TASK [Show whether a host reboot is required] ********************************** null_resource.DeploySW (local-exec): ok: [10.53.16.16] => { null_resource.DeploySW (local-exec): "msg": "Chocolatey requests a host reboot: False" null_resource.DeploySW (local-exec): } ...No packages need to be changed; everything is fine. Uninstalling Software PackagesAs mentioned above, you can use Terraform and Ansible to remove previously installed Software packages. You only need to set the state to absent and tell Ansible which packages should be removed. To make sure all dependencies are also removed, you can use the corresponding setting: --- - name: Remove SW Packages using Chocolatey hosts: packer_masterimages_w11 vars: # Add all packages which should be removed by Chocolatey choco_packages: - notepadplusplus tasks: - name: Remove packages win_chocolatey: name: "{{ item }}" remove_dependencies: true state: absent loop: "{{ choco_packages }}" register: get_choco_installation_results failed_when: false - name: Determine if any choco install returned reboot-required (3010) set_fact: reboot_required: >- {{ ( get_choco_installation_results.results | selectattr('rc','defined') | selectattr('rc','equalto',3010) | list | length > 0 ) or ( get_choco_installation_results.results | selectattr('return_code','defined') | selectattr('return_code','equalto',3010) | list | length > 0 ) or ( get_choco_installation_results.results | selectattr('chocolatey_exit_code','defined') | selectattr('chocolatey_exit_code','equalto',3010) | list | length > 0 ) }} - name: Show whether a host reboot is required debug: msg: "Chocolatey requests a host reboot: {{ reboot_required }}" - name: Reboot the host if Chocolatey signaled that a host reboot is required ansible.windows.win_reboot: reboot_timeout: 600 pre_reboot_delay: 5 post_reboot_delay: 30 when: reboot_required | bool Example for running the Terraform code to remove specific packages: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE/ImgWithSoftwareFromAnsibleAndChocolatey$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCodeRemove will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeRemove" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/packer/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/packer/assets/ansible_exit_code.txt", + "0|3010", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeRemove_1 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeRemove_1" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/packer/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/packer/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.GetSWPackagesRemove will be created + resource "null_resource" "GetSWPackagesRemove" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltRemove will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltRemove" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltRemove_1 will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltRemove_1" { + id = (known after apply) } # null_resource.RemoveSW will be created + resource "null_resource" "RemoveSW" { + id = (known after apply) } # time_sleep.wait_10_seconds_remove_1 will be created + resource "time_sleep" "wait_10_seconds_remove_1" { + create_duration = "10s" + id = (known after apply) } Plan: 5 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.RemoveSW: Creating... null_resource.RemoveSW: Provisioning with 'local-exec'... null_resource.RemoveSW (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook -i /etc/ansible/packer/assets/inventory.ini /etc/ansible/packer/assets/RemoveSWPackagesUsingChocolatey.ansible.yml -v -c winrm; echo $? > /etc/ansible/packer/assets/ansible_exit_code.txt"] null_resource.RemoveSW (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RemoveSW (local-exec): PLAY [Remove SW Packages using Chocolatey] ************************************* null_resource.RemoveSW (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RemoveSW (local-exec): ok: [10.53.16.16] null_resource.RemoveSW (local-exec): TASK [Remove packages] ******************************************************** null_resource.RemoveSW: Still creating... [00m10s elapsed] null_resource.RemoveSW (local-exec): changed: [10.53.16.16] => (item=notepadplusplus) => {"ansible_loop_var": "item", "changed": true, "choco_cli_version": "2.5.1", "failed_when_result": false, "item": "notepadplusplus", "rc": 0} null_resource.RemoveSW (local-exec): TASK [Determine if any choco install returned reboot-required (3010)] ********** null_resource.RemoveSW (local-exec): ok: [10.53.16.16] => {"ansible_facts": {"reboot_required": false}, "changed": false} null_resource.RemoveSW (local-exec): TASK [Show whether a host reboot is required] ********************************** null_resource.RemoveSW (local-exec): ok: [10.53.16.16] => { null_resource.RemoveSW (local-exec): "msg": "Chocolatey requests a host reboot: False" null_resource.RemoveSW (local-exec): } null_resource.RemoveSW (local-exec): TASK [Reboot the host if Chocolatey signaled that a host reboot is required] *** null_resource.RemoveSW (local-exec): skipping: [10.53.16.16] => {"changed": false, "false_condition": "reboot_required | bool", "skip_reason": "Conditional result was False"} null_resource.RemoveSW (local-exec): PLAY RECAP ********************************************************************* null_resource.RemoveSW (local-exec): 10.53.16.16 : ok=4 changed=1 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RemoveSW: Creation complete after 16s [id=4885597512309489198] data.external.CheckAnsibleReturnCodeRemove: Reading... data.external.CheckAnsibleReturnCodeRemove: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltRemove: Creating... null_resource.IfExitCodeIsNotZeroThenHaltRemove: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltRemove (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Software Packages were successfully removed - Everything OK\" || { echo \"Removing Software Packages failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltRemove (local-exec): Software Packages were successfully removed - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltRemove: Creation complete after 0s [id=7865390904371031353] time_sleep.wait_10_seconds_remove_1: Creating... time_sleep.wait_10_seconds_remove_1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_remove_1: Creation complete after 10s [id=2025-12-01T15:11:06Z] null_resource.GetSWPackagesRemove: Creating... null_resource.GetSWPackagesRemove: Provisioning with 'local-exec'... null_resource.GetSWPackagesRemove (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook -i /etc/ansible/packer/assets/inventory.ini /etc/ansible/packer/assets/GetSWPackagesInstalledByChocolatey.ansible.yml -v -c winrm; echo $? > /etc/ansible/packer/assets/ansible_exit_code.txt"] null_resource.GetSWPackagesRemove (local-exec): [WARNING]: Ansible is being run in a world writable directory (/etc/ansible), ignoring it as an ansible.cfg source. For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir null_resource.GetSWPackagesRemove (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.GetSWPackagesRemove (local-exec): PLAY [Print out all software packages installed by Chocolatey] ***************** null_resource.GetSWPackagesRemove (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.GetSWPackagesRemove (local-exec): ok: [10.53.16.16] null_resource.GetSWPackagesRemove (local-exec): TASK [Get all by Chocolatey installed packages] ******************************** null_resource.GetSWPackagesRemove: Still creating... [00m10s elapsed] null_resource.GetSWPackagesRemove (local-exec): ok: [10.53.16.16] => {"ansible_facts": {"ansible_chocolatey": {"config": {"cacheLocation": "", "commandExecutionTimeoutSeconds": 2700, "containsLegacyPackageInstalls": true, "defaultPushSource": "", "defaultTemplateName": "", "proxy": "", "proxyBypassList": "", "proxyBypassOnLocal": true, "proxyPassword": "", "proxyUser": "", "upgradeAllExceptions": "", "webRequestTimeoutSeconds": 30}, "feature": {"allowEmptyChecksums": false, "allowEmptyChecksumsSecure": true, "allowGlobalConfirmation": false, "alwaysIncludeHeaders": false, "autoUninstaller": true, "checksumFiles": true, "disableCompatibilityChecks": false, "exitOnRebootDetected": false, "failOnAutoUninstaller": false, "failOnInvalidOrMissingLicense": false, "failOnStandardError": false, "ignoreInvalidOptionsSwitches": true, "ignoreUnfoundPackagesOnUpgradeOutdated": false, "logEnvironmentValues": false, "logValidationResultsOnWarnings": true, "logWithoutColor": false, "powershellHost": true, "removePackageInformationOnUninstall": false, "showDownloadProgress": true, "showNonElevatedWarnings": true, "skipPackageUpgradesWhenNotInstalled": false, "stopOnFirstPackageFailure": false, "useEnhancedExitCodes": false, "useFipsCompliantChecksums": false, "useHttpCache": true, "usePackageExitCodes": true, "usePackageHashValidation": false, "usePackageRepositoryOptimizations": true, "useRememberedArgumentsForUpgrades": false, "virusCheck": false}, "filter": ["all"], "outdated": [], "packages": [{"package": "7zip", "version": "25.1.0"}, {"package": "7zip.install", "version": "25.1.0"}, {"package": "adobereader", "version": "2025.1.20844"}, {"package": "chocolatey", "version": "2.5.1"}, {"package": "chocolatey-compatibility.extension", "version": "1.0.0"}, {"package": "chocolatey-core.extension", "version": "1.4.0"}, {"package": "chocolatey-dotnetfx.extension", "version": "1.0.1"}, {"package": "chocolatey-visualstudio.extension", "version": "1.13.0"}, {"package": "dotnetfx", "version": "4.8.0.20220524"}, {"package": "Firefox", "version": "145.0.2"}, {"package": "git", "version": "2.52.0"}, {"package": "git.install", "version": "2.52.0"}, {"package": "KB2919355", "version": "1.0.20160915"}, {"package": "KB2919442", "version": "1.0.20160915"}, {"package": "putty", "version": "0.83.0"}, {"package": "putty.portable", "version": "0.83.0"}, {"package": "sql-server-management-studio", "version": "22.0.0"}], "sources": [{"admin_only": false, "allow_self_service": false, "bypass_proxy": false, "certificate": null, "disabled": false, "name": "chocolatey", "priority": 0, "source": "https://community.chocolatey.org/api/v2/", "source_username": null}]}}, "changed": false} null_resource.GetSWPackagesRemove (local-exec): TASK [Print out facts] ********************************************************* null_resource.GetSWPackagesRemove (local-exec): ok: [10.53.16.16] => { null_resource.GetSWPackagesRemove (local-exec): "list_choco_packages.ansible_facts.ansible_chocolatey.packages": [ null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "7zip", null_resource.GetSWPackagesRemove (local-exec): "version": "25.1.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "7zip.install", null_resource.GetSWPackagesRemove (local-exec): "version": "25.1.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "adobereader", null_resource.GetSWPackagesRemove (local-exec): "version": "2025.1.20844" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "chocolatey", null_resource.GetSWPackagesRemove (local-exec): "version": "2.5.1" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "chocolatey-compatibility.extension", null_resource.GetSWPackagesRemove (local-exec): "version": "1.0.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "chocolatey-core.extension", null_resource.GetSWPackagesRemove (local-exec): "version": "1.4.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "chocolatey-dotnetfx.extension", null_resource.GetSWPackagesRemove (local-exec): "version": "1.0.1" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "chocolatey-visualstudio.extension", null_resource.GetSWPackagesRemove (local-exec): "version": "1.13.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "dotnetfx", null_resource.GetSWPackagesRemove (local-exec): "version": "4.8.0.20220524" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "Firefox", null_resource.GetSWPackagesRemove (local-exec): "version": "145.0.2" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "git", null_resource.GetSWPackagesRemove (local-exec): "version": "2.52.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "git.install", null_resource.GetSWPackagesRemove (local-exec): "version": "2.52.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "KB2919355", null_resource.GetSWPackagesRemove (local-exec): "version": "1.0.20160915" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "KB2919442", null_resource.GetSWPackagesRemove (local-exec): "version": "1.0.20160915" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "putty", null_resource.GetSWPackagesRemove (local-exec): "version": "0.83.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "putty.portable", null_resource.GetSWPackagesRemove (local-exec): "version": "0.83.0" null_resource.GetSWPackagesRemove (local-exec): }, null_resource.GetSWPackagesRemove (local-exec): { null_resource.GetSWPackagesRemove (local-exec): "package": "sql-server-management-studio", null_resource.GetSWPackagesRemove (local-exec): "version": "22.0.0" null_resource.GetSWPackagesRemove (local-exec): } null_resource.GetSWPackagesRemove (local-exec): ] null_resource.GetSWPackagesRemove (local-exec): } null_resource.GetSWPackagesRemove (local-exec): PLAY RECAP ********************************************************************* null_resource.GetSWPackagesRemove (local-exec): 10.53.16.16 : ok=3 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.GetSWPackagesRemove: Creation complete after 12s [id=1019312554423816987] data.external.CheckAnsibleReturnCodeRemove_1: Reading... data.external.CheckAnsibleReturnCodeRemove_1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltRemove_1: Creating... null_resource.IfExitCodeIsNotZeroThenHaltRemove_1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltRemove_1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Software Packages were successfully listed - Everything OK\" || { echo \"Listing Software Packages failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltRemove_1 (local-exec): Software Packages were successfully listed - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltRemove_1: Creation complete after 0s [id=613552392272345868] Apply complete! Resources: 5 added, 0 changed, 0 destroyed. azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE/ImgWithSoftwareFromAnsibleAndChocolatey$Ansible successfully removed the Notepad++ package, the inventory does not list it anymore… Upgrading installed Software PackagesAs mentioned above, you can use Terraform and Ansible to upgrade all or specific installed Software packages. You only need to set the state to latest and tell Ansible which packages should be upgraded. tasks: - name: Upgrade packages win_chocolatey: name: "{{ item }}" state: latest loop: "{{ choco_packages }}" register: get_choco_installation_results failed_when: false Installing Software Packages using Ansible StandaloneThere might be circumstances where using Chocolatey would not be suitable to fulfill all Software deployment needs, e.g. no Chocolatey package is available. Terraform and Ansible serve complementary roles in modern Infrastructure-as-Code (IaC) architectures. Terraform excels at provisioning infrastructure resources—compute, networks, storage, identity, and cloud services—while Ansible specializes in configuring and managing the software, applications, and operating system state on those resources once they are created. When combined, they form a robust, scalable, and fully automated delivery pipeline that allows organizations to provision secure, consistent environments and configure them in a modular, policy-driven manner. Ansible has various built-in or available interaction points with Windows-based machines. You can virtually configure anything using Ansible. Ansible modules for Windows—such as win_package, win_service, and win_regedit—perform the heavy lifting: win_package installs MSI or EXE packages silently win_service ensures services are running as expected win_regedit tweaks registry keys for custom configurations Because of Ansible´s idempotency, it skips the configuration if the target machine already has the correct configuration. It offers more flexibility than Chocolatey, but is also more error-prone due to its complex syntax. Let´s look at some examples: inventory.yml all: vars: ansible_user: ""{{ vault_ansible_user }}"" ansible_password: "{{ vault_ansible_password }}" ansible_connection: winrm ansible_winrm_transport: kerberos # or "credssp" / "basic" over HTTPS ansible_port: 5986 ansible_winrm_scheme: https ansible_winrm_server_cert_validation: ignore # use 'validate' with proper certs in prod children: windows: hosts: win-app-01.domain.local: win-app-02.domain.local: win-util-01.domain.local: appservers: hosts: win-app-01.domain.local: win-app-02.domain.local: utility: hosts: win-util-01.domain.local:windows_vars.yml: # Global Windows settings for all hosts reboot_if_needed: true firewall_enable: true # Chocolatey packages to install/ensure choco_packages: - name: googlechrome state: present - name: 7zip state: latest - name: notepadplusplus state: present # MSI/EXE package installs via win_package msi_packages: - name: "ContosoApp" path: "https://download.contoso.com/ContosoApp-5.2.1.msi" product_id: "{A1B2C3D4-E5F6-1234-ABCD-000000000001}" arguments: "/qn /norestart" state: present # Registry keys to enforce registry_items: - path: 'HKLM:\Software\Contoso\App' name: 'TelemetryEnabled' type: dword value: 0 - path: 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell' name: 'EnableScripts' type: dword value: 1 # Services to manage services: - name: "ContosoService" state: started start_mode: auto # Firewall rules firewall_rules: - name: "Allow_ContosoService_TCP_8443" localport: 8443 protocol: tcp direction: in action: allow enabled: yes profiles: ["Domain"] # Scheduled tasks scheduled_tasks: - name: "ContosoLogCleanup" description: "Rotate logs weekly" actions: - path: "PowerShell.exe" arguments: "-File C:\\ProgramData\\Contoso\\scripts\\cleanup.ps1" triggers: - type: weekly start_boundary: "2025-01-01T03:00:00" days_of_week: ["Sunday"] username: "SYSTEM" run_level: highestapp_deploy_and_configure.yml: --- - name: Prepare Windows hosts (base tools & system policy) hosts: windows gather_facts: yes vars: chocolatey_state: present tasks: - name: Ensure Chocolatey is installed win_chocolatey: state: "{{ chocolatey_state }}" tags: [choco, base] - name: Install/Update Chocolatey packages win_chocolatey: name: "{{ item.name }}" state: "{{ item.state | default('present') }}" loop: "{{ choco_packages }}" tags: [choco, apps] - name: Configure registry settings win_regedit: path: "{{ item.path }}" name: "{{ item.name }}" type: "{{ item.type }}" data: "{{ item.value }}" loop: "{{ registry_items }}" tags: [registry, compliance] - name: Set PowerShell execution policy (machine-wide) win_shell: "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine -Force" args: executable: PowerShell changed_when: false # report-only unless you need to enforce idempotence via win_regedit tags: [policy] - name: Create directories for app config win_file: path: "{{ app_config_dir | default('C:\\ProgramData\\Contoso\\config') }}" state: directory tags: [files, config] - name: Copy static app settings win_copy: src: "{{ playbook_dir }}/../files/configs/appsettings.json" dest: "{{ app_config_dir | default('C:\\ProgramData\\Contoso\\config') }}\\appsettings.json" tags: [files, config] - name: Deploy templated logging config win_template: src: "{{ playbook_dir }}/../templates/{{ log_config_template | default('log4net.config.j2') }}" dest: "{{ app_config_dir | default('C:\\ProgramData\\Contoso\\config') }}\\log4net.config" vars: log_level: "{{ log_level | default('INFO') }}" notify: Restart ContosoService tags: [templates, config] - name: Place service config XML win_copy: src: "{{ playbook_dir }}/../files/configs/service.config.xml" dest: "{{ app_config_dir | default('C:\\ProgramData\\Contoso\\config') }}\\service.config.xml" notify: Restart ContosoService tags: [files, config] - name: Install MSI/EXE packages win_package: path: "{{ item.path }}" product_id: "{{ item.product_id | default(omit) }}" arguments: "{{ item.arguments | default(omit) }}" state: "{{ item.state | default('present') }}" creates_path: "{{ item.creates_path | default(omit) }}" loop: "{{ msi_packages }}" register: msi_results tags: [msi, apps] - name: Ensure Windows services are running win_service: name: "{{ item.name }}" state: "{{ item.state }}" start_mode: "{{ item.start_mode | default('auto') }}" loop: "{{ services }}" tags: [services] - name: Configure firewall rules when: firewall_enable | default(true) win_firewall_rule: name: "{{ item.name }}" localport: "{{ item.localport }}" protocol: "{{ item.protocol }}" direction: "{{ item.direction }}" action: "{{ item.action }}" enabled: "{{ item.enabled }}" profiles: "{{ item.profiles }}" loop: "{{ firewall_rules }}" tags: [firewall, security] - name: Deploy maintenance script win_copy: content: | param([string]$LogPath = "C:\\ProgramData\\Contoso\\logs") Get-ChildItem $LogPath -Filter *.log -Recurse | Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-14) } | Remove-Item -Force dest: "C:\\ProgramData\\Contoso\\scripts\\cleanup.ps1" tags: [scripts, maintenance] - name: Create scheduled tasks win_scheduled_task: name: "{{ item.name }}" description: "{{ item.description | default('') }}" actions: "{{ item.actions }}" triggers: "{{ item.triggers }}" username: "{{ item.username | default(omit) }}" run_level: "{{ item.run_level | default('highest') }}" state: present enabled: yes loop: "{{ scheduled_tasks }}" tags: [schedule, maintenance] - name: Reboot if the system requires it when: reboot_if_needed | default(true) win_reboot: reboot_timeout: 1200 msg: "Rebooting after package installations/config changes." tags: [reboot] handlers: - name: Restart ContosoService win_service: name: "ContosoService" state: restarted # Optional: appserver-specific play - name: Appserver feature flags & validation hosts: appservers gather_facts: no tasks: - name: Write feature flags JSON win_copy: content: "{{ app_feature_flags | to_nice_json }}" dest: "{{ app_config_dir }}\\features.json" notify: Restart ContosoService tags: [config] - name: Validate service responsive on port 8443 win_shell: | Test-NetConnection -ComputerName $env:COMPUTERNAME -Port 8443 -InformationLevel Detailed args: executable: PowerShell register: port_check changed_when: false tags: [validate] - name: Show connectivity result debug: var: port_check tags: [validate] handlers: - name: Restart ContosoService win_service: name: "ContosoService" state: restartedExample for a baseline configuration of a Windows machine: --- - name: Configure Windows OS baseline hosts: windows gather_facts: yes pre_tasks: - name: Show target info debug: msg: "Configuring {{ inventory_hostname }} (OS: {{ ansible_distribution }} {{ ansible_os_name }})" tags: [always] tasks: # Time zone & NTP (time zone via module; NTP can be enforced via registry/commands) - name: Set system time zone win_timezone: timezone: "{{ desired_timezone }}" tags: [timezone] # PowerShell execution policy - name: Ensure PowerShell execution policy (Machine) win_regedit: path: 'HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell' name: 'ExecutionPolicy' type: string data: "{{ powershell_execution_policy }}" tags: [policy, powershell] # Enable/Disable RDP - name: Configure RDP (Terminal Services) win_regedit: path: 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' name: 'fDenyTSConnections' type: dword data: "{{ 0 if rdp_enabled else 1 }}" notify: Restart TermService tags: [rdp] # Windows Firewall baseline - name: Configure firewall rules win_firewall_rule: name: "{{ item.name }}" localport: "{{ item.localport }}" protocol: "{{ item.protocol }}" direction: "{{ item.direction }}" action: "{{ item.action }}" enabled: "{{ item.enabled }}" profiles: "{{ item.profiles }}" loop: "{{ firewall_rules }}" tags: [firewall] # Local groups - name: Ensure local groups exist win_group: name: "{{ item.name }}" description: "{{ item.description | default(omit) }}" state: "{{ item.state | default('present') }}" loop: "{{ local_groups }}" tags: [accounts, groups] - name: Ensure group membership win_group_membership: name: "{{ item.name }}" members: "{{ item.members | default([]) }}" state: present loop: "{{ local_groups | selectattr('members','defined') | list }}" tags: [accounts, groups] # Local user accounts - name: Ensure local users exist win_user: name: "{{ item.name }}" password: "{{ item.password | default(omit) }}" state: "{{ item.state | default('present') }}" groups: "{{ item.groups | default(omit) }}" password_never_expires: "{{ item.password_never_expires | default(false) }}" user_cannot_change_password: "{{ item.user_cannot_change_password | default(false) }}" loop: "{{ local_users }}" tags: [accounts, users] # Windows features - name: Ensure Windows features state win_feature: name: "{{ item.name }}" state: "{{ item.state }}" loop: "{{ windows_features }}" register: feature_changes tags: [features] # Registry hardening - name: Apply registry hardening win_regedit: path: "{{ item.path }}" name: "{{ item.name }}" type: "{{ item.type }}" data: "{{ item.value }}" loop: "{{ registry_hardening }}" register: reg_changes tags: [registry, security] # Power settings (example: disable sleep on AC) - name: Disable sleep when plugged in (AC) win_shell: | powercfg /change standby-timeout-ac 0 args: executable: PowerShell changed_when: false tags: [power] # Services baseline (example: ensure Remote Registry disabled) - name: Disable Remote Registry service win_service: name: "RemoteRegistry" state: stopped start_mode: disabled tags: [services, security] # Scheduled tasks - name: Place cleanup script win_copy: content: | # Remove files older than 14 days from temp Get-ChildItem 'C:\Windows\Temp' -Recurse -Force | Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-14) } | Remove-Item -Force -ErrorAction SilentlyContinue dest: "C:\\Windows\\Temp\\cleanup.ps1" tags: [tasks] - name: Create scheduled tasks win_scheduled_task: name: "{{ item.name }}" description: "{{ item.description | default('') }}" actions: "{{ item.actions }}" triggers: "{{ item.triggers }}" username: "{{ item.username | default(omit) }}" run_level: "{{ item.run_level | default('highest') }}" state: present enabled: yes loop: "{{ scheduled_tasks }}" tags: [tasks] # Windows Update (configuration run; not app installs) - name: Install Windows updates (critical/security) win_updates: category_names: "{{ windows_update.category_names }}" state: "{{ windows_update.state }}" reboot: "{{ windows_update.reboot }}" register: update_result tags: [updates] # Validation checks - name: Validate RDP listening (if enabled) when: rdp_enabled win_shell: | Test-NetConnection -ComputerName $env:COMPUTERNAME -Port 3389 -InformationLevel Detailed args: executable: PowerShell register: rdp_port changed_when: false tags: [validate] - name: Show validation outputs debug: msg: - "Features changed: {{ feature_changes.results | selectattr('changed') | list | length }} host operations" - "Registry changes applied: {{ reg_changes.results | selectattr('changed') | list | length }}" - "Updates installed: {{ update_result.installed_update_count | default('n/a') }}" - "RDP port check (if enabled): {{ rdp_port.TcpTestSucceeded | default('n/a') }}" tags: [validate] # Reboot only if needed (modules signal this) - name: Reboot if required when: reboot_if_needed | default(true) win_reboot: reboot_timeout: 1800 msg: "Baseline configuration applied. Rebooting if required." tags: [reboot] handlers: - name: Restart TermService win_service: name: "TermService" state: restartedThese snippets cover only a tiny part of Ansible's power. Because of this power, every IaC deployment strategy must include Ansible to be successful. Theory: Deploying a Citrix Virtual Apps and Desktops or Citrix DaaS Environment using TerraformOverviewUsing the Triad allows for a start-to-end IaC strategy. Combining the benefits of all three toolkits in the right order brings you to success when deploying a Citrix CVAD or Citrix DaaS environment. We use Hashicorp Packer as the framework for generating the Master Images and templates for deploying all needed Windows-based virtual machines on XenServer 8.4, Hashicorp Terraform as the backbone and “coordinating” framework for creating all needed Infrastructure components, and Ansible as the configuration framework for all configuration needs of the components that Terraform cannot do during the initial creation of the respective element. All needed Automation components were installed on an Ubuntu-based VM cluster. If all IaC frameworks reside on the same machine/cluster, communication between them is less error-prone. Example flow for deploying a Citrix CVAD infrastructure: Important There are many ways to create a Citrix CVAD or Citrix DaaS environment across different Hypervisors using Terraform. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for other examples. In the following examples, we will: Focus on XenServer 8.4 for deploying a Citrix CVAD environment and all relevant entities, as it is the most requested deployment option for customers Focus onAzure for deploying a Citrix DaaS environment and all relevant entities, as it is the most requested deployment option for customers Examples from the Field - Creating a Citrix Virtual Apps and Desktops 2507 LTSR Deployment on XenServer 8.4Let´s have a look at another real-world example from the field - we cover the creation of a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. All these examples have more detailed guides available in our Automation Landing Zone on Citrix TechZone at https://community.citrix.com/tech-zone/automation. Due to the size of the corresponding deployment guide, we created a dedicated page; you can find this example in the Citrix Automation Handbook 2601, Part 4. Examples from the Field - Creating a Citrix DaaS Deployment on AzureLet´s have a look at another real-world example from the field - we cover the creation of a Citrix DaaS deployment on Azure. All these examples have more detailed guides available in our Automation Landing Zone on Citrix TechZone at https://community.citrix.com/tech-zone/automation Due to the size of the corresponding deployment guide, we created a dedicated page; you can find this example in the Citrix Automation Handbook 2601, Part 5. Special Use Cases of the TriadUsing CI/CDUsing CI/CD is the enterprise-ready approach to creating, configuring, and administering your environment. In our demo environment, we have various CI/CD workflows configured - we already touched on some configuration examples earlier. Let´s see an example of using a GitHub workflow in action: Code snippet of a GitHub workflow for deploying a Master Image on Azure using Packer name: Packer building a Master Image on Azure on: push: branches: [ "main" ] workflow_dispatch: jobs: packer-build: runs-on: ubuntu-latest env: PKR_VAR_Azure_ClientID: ${{ secrets.AZURE_CLIENTID }} PKR_VAR_Azure_ClientSecret: ${{ secrets.AZURE_CLIENTSECRET }} PKR_VAR_Azure_SubscriptionID: ${{ secrets.AZURE_SUBSCRIPTIONID }} PKR_VAR_Azure_TenantID: ${{ secrets.AZURE_TENANTID }} PKR_VAR_Azure_RG: ${{ secrets.AZURE_RG }} PKR_VAR_Azure_TempRG: ${{ secrets.AZURE_TempRG }} PACKER_LOG: "1" PACKER_LOG_PATH: "packer.log" steps: - name: Checkout repo uses: actions/checkout@v4 - name: Packer init run: packer init ./packer - name: Packer validate run: packer validate -var-file "./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hcl - name: Packer build run: packer build -on-error=abort -force -var-file="./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hclThe workflow can be triggered in various ways: manually, via a PR, or via a REST API call. In this case, we use a REST API call to trigger the run using the Postman app: The return code 204 No Content indicates that GitHub has accepted the REST API call and triggered the workflow run. GitHub reflects the triggering with information about the run: Current runner version: '2.329.0' Runner Image Provisioner Hosted Compute Agent Version: 20251124.448 Commit: fda5086b43ec66ade217e5fcd18146c879571177 Build Date: 2025-11-24T21:16:26Z Operating System Ubuntu 24.04.3 LTS Runner Image Image: ubuntu-24.04 Version: 20251126.144.1 Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20251126.144/images/ubuntu/Ubuntu2404-Readme.md Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20251126.144 GITHUB_TOKEN Permissions Contents: read Metadata: read Packages: read Secret source: Actions Prepare workflow directory Prepare all required actions Getting action download info Download action repository 'actions/checkout@v4' (SHA:34e114876b0b11c390a56381ad16ebd13914f8d5) Complete job name: packer-build 0s Run actions/checkout@v4 Syncing repository: *** Getting Git version info Temporarily overriding HOME='/home/runner/work/_temp/72de3656-802c-4fea-b70f-fec21f79ffaa' before making global git config changes Adding repository directory to the temporary git global config as a safe directory /usr/bin/git config --global --add safe.directory /home/runner/work/tacg-packer-github/tacg-packer-github Deleting the contents of '/home/runner/work/tacg-packer-github/tacg-packer-github' Initializing the repository Disabling automatic garbage collection Setting up auth Fetching the repository Determining the checkout info /usr/bin/git sparse-checkout disable /usr/bin/git config --local --unset-all extensions.worktreeConfig Checking out the ref /usr/bin/git log -1 --format=%H 2688fe1583b4385319cd928b763697e1ef8b4e06 4s Run packer init ./packer Installed plugin github.com/hashicorp/azure v2.5.0 in "/home/runner/.config/packer/plugins/github.com/hashicorp/azure/packer-plugin-azure_v2.5.0_x5.0_linux_amd64" 1s Run packer validate -var-file "./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hcl The configuration is valid. 25m 59s Run packer build -on-error=abort -force -var-file="./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hcl azure-arm.W11MIWitSWPackagesWithoutVDA: output will be in this color. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Running builder ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Creating Azure Resource Manager (ARM) client ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ARM Client successfully created ==> azure-arm.W11MIWitSWPackagesWithoutVDA: the managed image named TMM_TF_SIG_PACKR_W11_MI already exists, but deleting it due to -force flag ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Getting source image id for the deployment ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> SourceImageName: '/subscriptions/<sensitive>/providers/Microsoft.Compute/locations/westeurope/publishers/MicrosoftWindowsDesktop/ArtifactTypes/vmimage/offers/office-365/skus/win11-25h2-avd-m365/versions/26200.7171.251111' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Using existing resource group ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Location : 'westeurope' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Validating deployment template ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> DeploymentName : 'kvpkrdp635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deploying deployment template ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> DeploymentName : 'kvpkrdp635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Getting the certificate's URL ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Key Vault Name : 'pkrkv635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Key Vault Secret Name : 'packerKeyVaultSecret' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Certificate URL : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Setting the certificate's URL ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Validating deployment template ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> DeploymentName : 'pkrdp635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deploying deployment template ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> DeploymentName : 'pkrdp635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Getting the VM's IP address ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> PublicIPAddressName : 'pkrip635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> NicName : 'pkrni635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Network Connection : 'PublicEndpoint' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> IP Address : '20.61.110.209' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Waiting for WinRM to become available... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WinRM connected. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Connected to WinRM! ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Provisioning with Powershell... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Provisioning with powershell script: /tmp/powershell-provisioner512226397 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Forcing web requests to allow TLS v1.2 (Required for requests to Chocolatey.org) ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Getting latest version of the Chocolatey package for download. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Not using proxy. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Getting Chocolatey from https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0 to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Not using proxy. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Extracting C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing Chocolatey on the local machine ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Creating ChocolateyInstall as an environment variable (targeting 'Machine') ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Setting ChocolateyInstall to 'C:\ProgramData\chocolatey' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WARNING: It's very likely you will need to close and reopen your shell ==> azure-arm.W11MIWitSWPackagesWithoutVDA: before you can use choco. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Restricting write permissions to Administrators ==> azure-arm.W11MIWitSWPackagesWithoutVDA: We are setting up the Chocolatey package repository. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The packages themselves go to 'C:\ProgramData\chocolatey\lib' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: (i.e. C:\ProgramData\chocolatey\lib\yourPackageName). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: A shim file for the command line goes to 'C:\ProgramData\chocolatey\bin' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: and points to an executable in 'C:\ProgramData\chocolatey\lib\yourPackageName'. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Creating Chocolatey CLI folders if they do not already exist. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey.nupkg file not installed in lib. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Attempting to locate it from bootstrapper. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: PATH environment variable does not have C:\ProgramData\chocolatey\bin in it. Adding... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WARNING: Not setting tab completion: Profile file does not exist at ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 'C:\Users\packer\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1'. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Chocolatey CLI (choco.exe) is now ready. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: You can call choco from anywhere, command line or PowerShell by typing choco. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Run choco /? for a list of functions. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: You may need to shut down and restart PowerShell and/or consoles ==> azure-arm.W11MIWitSWPackagesWithoutVDA: first prior to using choco. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Ensuring Chocolatey commands are on the path ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Ensuring chocolatey.nupkg is in the lib folder ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Uploading ./packer/SWPackagesToInstall.config => D:/SWPackagesToInstall.config ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Provisioning with Powershell... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Provisioning with powershell script: /tmp/powershell-provisioner249548071 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Chocolatey v2.6.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing from config file: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: D:/SWPackagesToInstall.config ==> azure-arm.W11MIWitSWPackagesWithoutVDA: By installing, you accept licenses for the packages. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing the following packages: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: powershell-core ==> azure-arm.W11MIWitSWPackagesWithoutVDA: openssh ==> azure-arm.W11MIWitSWPackagesWithoutVDA: firefox ==> azure-arm.W11MIWitSWPackagesWithoutVDA: googlechrome ==> azure-arm.W11MIWitSWPackagesWithoutVDA: rsat ==> azure-arm.W11MIWitSWPackagesWithoutVDA: filezilla ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git ==> azure-arm.W11MIWitSWPackagesWithoutVDA: sql-server-management-studio ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip ==> azure-arm.W11MIWitSWPackagesWithoutVDA: adobereader ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading chocolatey-compatibility.extension 1.0.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-compatibility.extension v1.0.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-compatibility.extension package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installed/updated chocolatey-compatibility extensions. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of chocolatey-compatibility.extension was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\extensions\chocolatey-compatibility' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading chocolatey-core.extension 1.4.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-core.extension v1.4.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-core.extension package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installed/updated chocolatey-core extensions. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of chocolatey-core.extension was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\extensions\chocolatey-core' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading chocolatey-windowsupdate.extension 1.0.5... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-windowsupdate.extension v1.0.5 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-windowsupdate.extension package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installed/updated chocolatey-windowsupdate extensions. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of chocolatey-windowsupdate.extension was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\extensions\chocolatey-windowsupdate' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading KB2919442 1.0.20160915... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: KB2919442 v1.0.20160915 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: KB2919442 package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Skipping installation because this hotfix only applies to Windows 8.1 and Windows Server 2012 R2. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of KB2919442 was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software install location not explicitly set, it could be in package or ==> azure-arm.W11MIWitSWPackagesWithoutVDA: default install location of installer. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading KB2919355 1.0.20160915... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: KB2919355 v1.0.20160915 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: KB2919355 package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Skipping installation because this hotfix only applies to Windows 8.1 and Windows Server 2012 R2. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of KB2919355 was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software install location not explicitly set, it could be in package or ==> azure-arm.W11MIWitSWPackagesWithoutVDA: default install location of installer. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading KB3118401 1.0.5... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: KB3118401 v1.0.5 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: KB3118401 package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Skipping installation because update KB3118401 does not apply to this operating system (Microsoft Windows 11 Enterprise multi-session). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of KB3118401 was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software install location not explicitly set, it could be in package or ==> azure-arm.W11MIWitSWPackagesWithoutVDA: default install location of installer. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading powershell-core 7.5.4... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: powershell-core v7.5.4 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: powershell-core package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7.5.4 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WARNING: If you started this package under PowerShell core, replacing an in-use version may be unpredictable, require multiple attempts or produce errors. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading powershell-core 64 bit ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://github.com/PowerShell/PowerShell/releases/download/v7.5.4/PowerShell-7.5.4-win-x64.msi' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - Completed download of C:\Users\packer\AppData\Local\Temp\chocolatey\powershell-core\7.5.4\PowerShell-7.5.4-win-x64.msi (107.9 MB). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of PowerShell-7.5.4-win-x64.msi (107.9 MB) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Hashes match. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing powershell-core... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: powershell-core has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************ ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * INSTRUCTIONS: Your system default WINDOWS PowerShell version has not been changed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * PowerShell CORE 7.5.4, was installed to: "C:\Program Files\PowerShell\7" ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * To start PowerShell Core 7.5.4, at a prompt or the start menu execute: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * "pwsh.exe" ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * Or start it from the desktop or start menu shortcut installed by this package. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * This is your new default version of PowerShell CORE (pwsh.exe). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************ ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************** ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * As of OpenSSH 0.0.22.0 Universal Installer, a script is distributed that allows * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * setting the default shell for openssh. You could call it with code like this: * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * If (Test-Path "C:\Program Files\openssh-win64\Set-SSHDefaultShell.ps1") * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * {& "C:\Program Files\openssh-win64\Set-SSHDefaultShell.ps1" [PARAMETERS]} * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * Learn more with this: * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * Get-Help "C:\Program Files\openssh-win64\Set-SSHDefaultShell.ps1" * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * Or here: * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: * https://github.com/DarwinJS/ChocoPackages/blob/main/openssh/readme.md * ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************** ==> azure-arm.W11MIWitSWPackagesWithoutVDA: powershell-core may be able to be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Environment Vars (like PATH) have changed. Close/reopen your shell to ==> azure-arm.W11MIWitSWPackagesWithoutVDA: see the changes (or in powershell/cmd.exe just type `refreshenv`). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of powershell-core was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software installed as 'msi', install location is likely default. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading openssh 8.0.0.1... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: openssh v8.0.0.1 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: openssh package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Running on: Windows 10 Enterprise multi-session, (ServerRdsh) ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Windows Version: 10.0.26200 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************ ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************ ==> azure-arm.W11MIWitSWPackagesWithoutVDA: This package is a Universal Installer and can ALSO install Win32-OpenSSH on ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Nano, Server Core, Docker Containers and more WITHOUT using Chocolatey. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: See the following for more details: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: https://github.com/DarwinJS/ChocoPackages/blob/master/openssh/readme.md ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************ ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ************************************************************************************ ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Extracting C:\ProgramData\chocolatey\lib\openssh\tools\OpenSSH-Win64.zip to C:\Users\packer\AppData\Local\Temp\chocolatey\OpenSSHTemp... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Users\packer\AppData\Local\Temp\chocolatey\OpenSSHTemp ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Hashes for internal source match ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\FixHostFilePermissions.ps1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\FixUserFilePermissions.ps1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\install-sshd.ps1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\libcrypto.dll ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\openssh-events.man ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\OpenSSHUtils.psd1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\OpenSSHUtils.psm1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\scp.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\sftp-server.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\sftp.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\ssh-add.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\ssh-agent.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\ssh-keygen.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\ssh-keyscan.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\ssh-shellhost.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\ssh.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\sshd.exe ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\sshd_config_default ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\uninstall-sshd.ps1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: C:\Program Files\OpenSSH-Win64\Set-SSHDefaultShell.ps1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: PATH environment variable does not have C:\Program Files\OpenSSH-Win64 in it. Adding... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Updating machine environment variable TERM from "" to "" ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: NEW VERSIONS OF SSH EXES: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WARNING: You must start a new prompt, or use the command 'refreshenv' (provided by your chocolatey install) to re-read the environment for the tools to be available in this shell session. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Environment Vars (like PATH) have changed. Close/reopen your shell to ==> azure-arm.W11MIWitSWPackagesWithoutVDA: see the changes (or in powershell/cmd.exe just type `refreshenv`). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of openssh was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\Users\packer\AppData\Local\Temp\chocolatey\OpenSSHTemp' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading Firefox 145.0.2... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Firefox v145.0.2 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Firefox package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Using locale 'en-US'... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading Firefox 64 bit ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://download.mozilla.org/?product=firefox-145.0.2-ssl&os=win64&lang=en-US' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - Completed download of C:\Users\packer\AppData\Local\Temp\chocolatey\Firefox\145.0.2\Firefox Setup 145.0.2.exe (81.93 MB). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of Firefox Setup 145.0.2.exe (81.93 MB) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Hashes match. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing Firefox... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Firefox has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WARNING: No registry key found based on 'Mozilla Firefox' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Firefox may be able to be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of Firefox was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\Program Files\Mozilla Firefox' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading GoogleChrome 143.0.7499.41... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: GoogleChrome v143.0.7499.41 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: GoogleChrome package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading googlechrome 64 bit ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://dl.google.com/dl/chrome/install/googlechromestandaloneenterprise64.msi' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of googlechromestandaloneenterprise64.msi (-1 B) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Hashes match. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing googlechrome... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: googlechrome has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: GoogleChrome may be able to be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of GoogleChrome was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software installed as 'MSI', install location is likely default. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading RSAT 2.1809.1.20241223... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: rsat v2.1809.1.20241223 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: rsat package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Detected: Microsoft Windows 11 Enterprise multi-session ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Adding Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 to Windows ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - RunningWARNING: Access is denied. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of rsat was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software install location not explicitly set, it could be in package or ==> azure-arm.W11MIWitSWPackagesWithoutVDA: default install location of installer. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading filezilla 3.69.1... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: filezilla v3.69.1 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: filezilla package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing 64-bit filezilla... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: filezilla has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: filezilla may be able to be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of filezilla was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\Program Files\FileZilla FTP Client' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading git.install 2.52.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git.install v2.52.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git.install package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Using Git LFS ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing 64-bit git.install... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git.install has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git.install installed to 'C:\Program Files\Git' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git.install can be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Environment Vars (like PATH) have changed. Close/reopen your shell to ==> azure-arm.W11MIWitSWPackagesWithoutVDA: see the changes (or in powershell/cmd.exe just type `refreshenv`). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of git.install was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\Program Files\Git\' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading git 2.52.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git v2.52.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: git package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of git was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\lib\git' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading chocolatey-dotnetfx.extension 1.0.1... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-dotnetfx.extension v1.0.1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-dotnetfx.extension package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installed/updated chocolatey-dotnetfx extensions. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of chocolatey-dotnetfx.extension was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\extensions\chocolatey-dotnetfx' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading chocolatey-visualstudio.extension 1.13.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-visualstudio.extension v1.13.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: chocolatey-visualstudio.extension package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installed/updated chocolatey-visualstudio extensions. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of chocolatey-visualstudio.extension was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\extensions\chocolatey-visualstudio' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading dotnetfx 4.8.0.20220524... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: dotnetfx v4.8.0.20220524 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: dotnetfx package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Microsoft .NET Framework 4.8 or later is already installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of dotnetfx was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Software install location not explicitly set, it could be in package or ==> azure-arm.W11MIWitSWPackagesWithoutVDA: default install location of installer. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading sql-server-management-studio 22.0.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: sql-server-management-studio v22.0.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: sql-server-management-studio package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading channel manifest ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://aka.ms/ssms/22/release/channel' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - Completed download of C:\Users\packer\AppData\Local\Temp\chocolatey\chocolatey-visualstudio.extension\ChannelManifest_-2000454548.man (44.57 KB). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of ChannelManifest_-2000454548.man (44.57 KB) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading catalog manifest ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://download.visualstudio.microsoft.com/download/pr/d3b4e0f6-4bc0-4ec0-ba9c-20b355d61cc4/ecaa0d29877aed722c085ea92a7dc206515b627f8f653512024cc6c58d80e6d3/SSMS.vsman' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - Completed download of C:\Users\packer\AppData\Local\Temp\chocolatey\chocolatey-visualstudio.extension\Catalog_1806514720.man (9.45 MB). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of Catalog_1806514720.man (9.45 MB) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading sql-server-management-studio ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://download.visualstudio.microsoft.com/download/pr/d3b4e0f6-4bc0-4ec0-ba9c-20b355d61cc4/41b0ec8225d7d6a773abc363b0fb90a9443072e49fa4619271220e244b11f832/vs_SSMS.exe' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - Completed download of C:\Users\packer\AppData\Local\Temp\chocolatey\sql-server-management-studio\22.0.0\vs_SSMS.exe (4.21 MB). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of vs_SSMS.exe (4.21 MB) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Hashes match. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing sql-server-management-studio... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\2052\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1028\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1029\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1033\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1046\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1055\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1042\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1040\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\3082\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1031\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1036\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1041\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1049\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\HelpFile\1045\help.html... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\vs_setup_bootstrapper.exe... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.Identity.Client.Broker.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.Identity.Client.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.Identity.Client.Extensions.Msal.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.Identity.Client.NativeInterop.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.IdentityModel.Abstractions.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\runtimes\win-x64\native\msalruntime.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\runtimes\win-arm64\native\msalruntime_arm64.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\runtimes\win-x86\native\msalruntime_x86.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\Newtonsoft.Json.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\System.Memory.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\VSInstallerElevationService.Contracts.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\zh-Hant\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\ko\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\ja\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\pt-BR\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\tr\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\cs\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\de\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\fr\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\es\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\it\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\pl\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\ru\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\zh-Hans\vs_setup_bootstrapper.resources.dll... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\vs_setup_bootstrapper.config... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\detection.json... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Preparing: C:\Users\packer\AppData\Local\Temp\chocolatey\8c41d392761dead58726e9a5b8\vs_bootstrapper_d15\vs_setup_bootstrapper.json... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: sql-server-management-studio has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: sql-server-management-studio may be able to be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of sql-server-management-studio was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to '"C:\Program Files (x86)\Microsoft Visual Studio\Installer"' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading 7zip.install 25.1.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip.install v25.1.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip.install package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing 64 bit version ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing 7zip.install... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip.install has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip installed to 'C:\Program Files\7-Zip' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Added C:\ProgramData\chocolatey\bin\7z.exe shim pointed to 'c:\program files\7-zip\7z.exe'. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip.install can be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of 7zip.install was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\Program Files\7-Zip\' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading 7zip 25.1.0... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip v25.1.0 [Approved] ==> azure-arm.W11MIWitSWPackagesWithoutVDA: 7zip package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of 7zip was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\ProgramData\chocolatey\lib\7zip' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: Downloading adobereader 2025.1.20937... 100% ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: adobereader v2025.1.20937 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: adobereader package files install completed. Performing other installation steps. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: WARNING: No registry key found based on 'Adobe Acrobat*' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Configuring manual update checks and installs. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Downloading adobereader 64 bit ==> azure-arm.W11MIWitSWPackagesWithoutVDA: from 'https://ardownload3.adobe.com/pub/adobe/acrobat/win/AcrobatDC/2500120937/AcroRdrDCx642500120937_MUI.exe' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - Completed download of C:\Users\packer\AppData\Local\Temp\chocolatey\AcroRdrDCx642500120937_MUI.exe (805.13 MB). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Download of AcroRdrDCx642500120937_MUI.exe (805.13 MB) completed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Hashes match. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installing adobereader (installer)... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: adobereader (installer) has been installed. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Progress: 100% - 2/2 completed adobereader may be able to be automatically uninstalled. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The install of adobereader was successful. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deployed to 'C:\Program Files\Adobe\Acrobat DC\' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Chocolatey installed 21/21 packages. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log). ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Installed: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - 7zip v25.1.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - 7zip.install v25.1.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - adobereader v2025.1.20937 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - chocolatey-compatibility.extension v1.0.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - chocolatey-core.extension v1.4.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - chocolatey-dotnetfx.extension v1.0.1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - chocolatey-visualstudio.extension v1.13.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - chocolatey-windowsupdate.extension v1.0.5 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - dotnetfx v4.8.0.20220524 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - filezilla v3.69.1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - Firefox v145.0.2 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - git v2.52.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - git.install v2.52.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - GoogleChrome v143.0.7499.41 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - KB2919355 v1.0.20160915 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - KB2919442 v1.0.20160915 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - KB3118401 v1.0.5 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - openssh v8.0.0.1 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - powershell-core v7.5.4 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - rsat v2.1809.1.20241223 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: - sql-server-management-studio v22.0.0 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Restarting Machine ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Waiting for machine to restart... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWitSWPackagesWithoutVDA: pkrvm635shf1s4d restarted. ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Machine successfully restarted, moving on ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Provisioning with Powershell... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Provisioning with powershell script: /tmp/powershell-provisioner2853369393 ==> azure-arm.W11MIWitSWPackagesWithoutVDA: IMAGE_STATE_COMPLETE ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Querying the machine's properties ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ComputeName : 'pkrvm635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Managed OS Disk : '/subscriptions/<sensitive>/resourceGroups/***/providers/Microsoft.Compute/disks/pkros635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Querying the machine's additional disks properties ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ComputeName : 'pkrvm635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Powering off machine ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> ComputeName : 'pkrvm635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Compute ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Compute Name : 'pkrvm635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Compute Location : 'westeurope' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Generalizing machine ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Capturing image ... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Image ResourceGroupName : '***' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Image Name : 'TMM_TF_SIG_PACKR_W11_MI' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: -> Image Location : 'westeurope' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleting Virtual Machine deployment and its attached resources... ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.Compute/virtualMachines : 'pkrvm635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.Network/networkInterfaces : 'pkrni635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.Network/virtualNetworks : 'pkrvn635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.Network/publicIPAddresses : 'pkrip635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.Network/networkSecurityGroups : 'pkrsg635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.Compute/disks : '/subscriptions/<sensitive>/resourceGroups/***/providers/Microsoft.Compute/disks/pkros635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Removing the created Deployment object: 'pkrdp635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleting KeyVault created during build ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Deleted -> Microsoft.KeyVault/vaults : 'pkrkv635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: Removing the created Deployment object: 'kvpkrdp635shf1s4d' ==> azure-arm.W11MIWitSWPackagesWithoutVDA: ==> azure-arm.W11MIWitSWPackagesWithoutVDA: The resource group was not created by Packer, not deleting ... Build 'azure-arm.W11MIWitSWPackagesWithoutVDA' finished after 25 minutes 58 seconds. ==> Wait completed after 25 minutes 58 seconds ==> Builds finished. The artifacts of successful builds are: --> azure-arm.W11MIWitSWPackagesWithoutVDA: Azure.ResourceManagement.VMImage: OSType: Windows ManagedImageResourceGroupName: *** ManagedImageName: TMM_TF_SIG_PACKR_W11_MI ManagedImageId: /subscriptions/<sensitive>/resourceGroups/***/providers/Microsoft.Compute/images/TMM_TF_SIG_PACKR_W11_MI ManagedImageLocation: westeurope 0s Post job cleanup. /usr/bin/git version git version 2.52.0 Temporarily overriding HOME='/home/runner/work/_temp/2a3532df-c470-48e6-9814-538e48ab6811' before making global git config changes Adding repository directory to the temporary git global config as a safe directory /usr/bin/git config --global --add safe.directory /home/runner/work/tacg-packer-github/tacg-packer-github /usr/bin/git config --local --name-only --get-regexp core\.sshCommand /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :" /usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader http.https://github.com/.extraheader /usr/bin/git config --local --unset-all http.https://github.com/.extraheader /usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :" /usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir: /usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url 0s Cleaning up orphan processesGitHub has successfully created a Master Image with installed software on Azure. The same flow also applies to all other configured REST-API calls. The same kind of workflows can, of course, be used to trigger all other examples mentioned in the handbook, such as the deployment of entire infrastructures or only discrete entities like Machine Catalogs, Delivery Groups, etc. Tip Using the REST API and GitHub workflows, you can trigger the workflows from any application, as we do in our self-service portal. Example Application to showcase using an IaC framework built on the TriadTo summarize and demonstrate all the benefits of IaC and automation outlined in this handbook, we created a Web-based service portal applicationthat lets you use Terraform, Ansible, and Packer together to perform various tasks. The application is built into our leading demo company, WorldWide Co. WWCo has its backend infrastructure entirely on Azure, so our application executes all instructions and operations in Azure. GitHub actions support all these functionalities. The application currently has these functionalities implemented – they are constantly being expanded: Using Packer for Master Image creation Creation of Master Images based on different Operating systems Automatic installation of Software packages using Chocolatey Different types of master images can be created: VHD Managed image Image version stored in an Azure Compute Gallery Using Ansible to deploy Software packages on existing images/machines Using Ansible to configure baseline OS settings on existing images/machines Using Terraform to deploy infrastructure components or whole infrastructures All Citrix CVAD entities All Citrix DaaS entities A complete Azure-based Citrix CVAD infrastructure A complete Citrix Azure-based DaaS infrastructure Using Terraform to alter infrastructure components Using Terraform to demonstrate Day 2 administrative operations: Checking for changes in the desired configuration alerting Alerting Self-healing Changing the settings of VDI worker machines Changing the settings of machine catalogs Increasing the machine count in the machine catalog Changing the image version of the machine catalog Changing the settings of delivery groups Assigning new machines to the delivery group Adding new users to the delivery group Changing Autoscale™ settings The application was developed to provide inspiration for integrating IaC into your own environments and to facilitate entry into the world of automation and Infrastructure-as-code. Be inspired by the sheer endless possibilities and implement parts of it in your infrastructure. Simplification of Administrative Efforts/“Day Two” OperationsThe Triad can be leveraged to simplify administrative efforts. We have already touched on some of these points, but let's summarize them again here together Importing an existing infrastructure into IaCWe have discussed that topic already in Part 1 of the Citrix Automation Handbook - Integrate an existing Citrix Environment into your Automation Strategy Check for configuration drifts and get notificationsUsing Terraform´s or Ansible´s idempotency, you can create a task to run the respective snippet and check for changes. Implement drift detection (e.g., terraform plan in scheduled tasks or cron jobs) Using scheduled tasks or cron jobs, along with an advanced notification mechanism, lets you detect infrastructure changes and respond promptly. Example: The output of the Config Drift Notification script shows the changes: PS C:\_TERRAFORM\> .\config-drift.ps1 Terraform Config Drift Detected: --------------------------------------------------------------------------------------------------- # citrix_delivery_group.CreateDG has changed ~ resource "citrix_delivery_group" "CreateDG" { ~ autoscale_settings = { ~ autoscale_enabled = true -> false # (22 unchanged attributes hidden) } id = "3dee598d-3a66-4a43-b3ce-1d989e75a3c4" name = "DG-TMM-GK-TF-Azure" # (12 unchanged attributes hidden) }You can hook onto the output and take further steps. Example for combining the check for changes and the CVAD/DaaS feature Configuration Logging: You must install the Citrix Remote PowerShell SDK to retrieve the Configuration Logging events. Add-PSSnapin Citrix.* $Date = Get-Date -Format "yyyy-MM-dd" $OutDirFull = "C:\_TEMP\ConfigDrift\" + $Date $StartRange = $Date + " 00:00" $EndRange = $Date + " 23:59" Set-XDCredentials -StoreAs TACG -ProfileType CloudApi -CustomerId xXxXxXxXxXxXx -APIKey yYyYyYyYyYyYyYy -SecretKey zZzZzZzZzZzZzZz Get-XDAuthentication -ProfileName TACG New-Item -Path $OutDirFull -ItemType "directory" -Force Export-LogReportHtml -OutputDirectory $OutDirFull -StartDateRange $StartRange -EndDateRange $EndRangeIt enables you to get an overview of who did what when, making it easier to track. We created a simple script to get a notification out via email and on a specific Teams channel: Altering Infrastructure components like VM sizesYou can easily adjust your infrastructure components, e.g., if you need more compute power for your VMs, if you followed your advice to use variables and do not hard-code values in your Terraform snippets by changing the corresponding value: Example: Changing the VM size of your Cloud Connector-VMs on Azure Changing from ... "TACG-TMM-CCX-VM-Size":"Standard_D2s_v5", ...to ... "TACG-TMM-CCX-VM-Size":"Standard_D4s_v5", ...allows you to simply adjust the value by running the same script as you would for an initial deployment. Terraform detects the wanted change and acts accordingly: PS C:\_TERRAFORM\ChangeVMSize>terraform apply ... Terraform will perform the following actions: # azurerm_windows_virtual_machine.TACG-TMM-CC1 will be updated in-place ~ resource "azurerm_windows_virtual_machine" "TACG-TMM-CC1" { id = "/subscriptions/.../Microsoft.Compute/virtualMachines/TACG-TMM-TF-CC1" name = "TACG-TMM-TF-CC1" ~ size = "Standard_D2s_v5" -> "Standard_D4s_v5" tags = { "Environment" = "TMM-Gerhard" } # (41 unchanged attributes hidden) # (2 unchanged blocks hidden) } # azurerm_windows_virtual_machine.TACG-TMM-CC2 will be updated in-place ~ resource "azurerm_windows_virtual_machine" "TACG-TMM-CC2" { id = "/subscriptions/.../Microsoft.Compute/virtualMachines/TACG-TMM-TF-CC2" name = "TACG-TMM-TF-CC2" ~ size = "Standard_D2s_v5" -> "Standard_D4s_v5" tags = { "Environment" = "TMM-Gerhard" } # (41 unchanged attributes hidden) # (2 unchanged blocks hidden) } Plan: 0 to add, 2 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes azurerm_windows_virtual_machine.TACG-TMM-CC2: Modifying... [id=/subscriptions/.../Microsoft.Compute/virtualMachines/TACG-TMM-TF-CC2] azurerm_windows_virtual_machine.TACG-TMM-CC1: Modifying... [id=/subscriptions.../Microsoft.Compute/virtualMachines/TACG-TMM-TF-CC1] azurerm_windows_virtual_machine.TACG-TMM-CC1: Still modifying... [id=/subscriptions/....ompute/virtualMachines/TACG-TMM-TF-CC1, 10s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC2: Still modifying... [id=/subscriptions/....ompute/virtualMachines/TACG-TMM-TF-CC2, 10s elapsed] azurerm_windows_virtual_machine.TACG-TMM-CC1: Modifications complete after 12s [id=/subscriptions/.../Microsoft.Compute/virtualMachines/TACG-TMM-TF-CC1] azurerm_windows_virtual_machine.TACG-TMM-CC2: Modifications complete after 12s [id=/subscriptions/.../Microsoft.Compute/virtualMachines/TACG-TMM-TF-CC2] Apply complete! Resources: 0 added, 2 changed, 0 destroyed. PS C:\_TERRAFORM\ChangeVMSize>You can see that 41 attributes were not touched; only the VM sizes of each VM were updated. Altering Citrix entities: Updating the Machine Catalog with a new Image versionIn this example, we will update a Machine Catalog and deploy a new version of the Master Image. The master image version of the machine catalog is stored in a variable: ... azure_master_image = { resource_group = var.CC-Azure-MCImgDef-MasterImage-RG master_image = var.CC-Azure-MCImgDef-MasterImage } ...Changing from ... "CC-Azure-MCImgDef-MasterImage":"W11-BaseImageDefinition-1-baseDisk-3w0te", ...to ... "CC-Azure-MCImgDef-MasterImage":"W11-BaseImageDefinition-3-baseDisk-my3dm", ...allows you to simply adjust the value by running the same script as you would for an initial deployment. Terraform detects the wanted change and acts accordingly: PS C:\_TERRAFORM\ChangeMCImage> terraform apply ... Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # citrix_machine_catalog.CreateAzureImgDefMCSCatalog will be updated in-place ~ resource "citrix_machine_catalog" "CreateAzureImgDefMCSCatalog" { id = "c7364b7a-c045-41cc-af81-7a3da2c5d84f" ~ inherited_scopes = [] -> (known after apply) name = "MC-TMM-GK-TF-Azure-ImgDef-Win11" ~ provisioning_scheme = { ~ azure_machine_config = { ~ azure_master_image = { ~ master_image = "W11-BaseImageDefinition-1-baseDisk-3w0te" -> "W11-BaseImageDefinition-3-baseDisk-my3dm" # (1 unchanged attribute hidden) } # (5 unchanged attributes hidden) } # (6 unchanged attributes hidden) } + tenants = (known after apply) # (8 unchanged attributes hidden) } Plan: 0 to add, 1 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f] citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Still modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f, 10s elapsed] citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Still modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f, 20s elapsed] citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Still modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f, 30s elapsed] ... citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Still modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f, 7m30s elapsed] citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Still modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f, 7m40s elapsed] citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Still modifying... [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f, 7m50s elapsed] citrix_machine_catalog.CreateAzureImgDefMCSCatalog: Modifications complete after 7m53s [id=c7364b7a-c045-41cc-af81-7a3da2c5d84f] Apply complete! Resources: 0 added, 1 changed, 0 destroyed. PS C:\_TERRAFORM\ChangeMCImage>Terraform has successfully updated the Machine Catalog. Altering Citrix Entities: Creating additional machines in the Machine Catalog and the adjacent Delivery GroupIn this example, we will add additional machines to the Machine Catalog and the Delivery Group. The number of machines in the Machine Catalog and the number of machines in the Delivery Group are stored in a variable: ... # Machine Catalog setting number_of_total_machines = var.CC-Azure-MCImgDef-NumberOfVMs # Delivery Group Setting ... associated_machine_catalogs = [ { machine_catalog = citrix_machine_catalog.CreateAzureImgDefMCSCatalog.id machine_count = var.CC-Azure-MCImgDef-NumberOfVMs } ] ...Changing the value from ... "CC-Azure-MCImgDef-NumberOfVMs":50, ...to ... "CC-Azure-MCImgDef-NumberOfVMs":100, ...allows you to simply alter the entities running the same script as you would for an initial deployment. Terraform detects the wanted change and acts accordingly, as shown above - the output of this snippet is omitted due to resource scarcity. Altering Citrix Entities: Adding users to a Delivery GroupIn this example, we will add additional AD users/AD user groups to the Delivery Group. The allowed users in the Delivery Group are stored in a variable: ... desktops = [ { published_name = var.TACG-TMM-CVAD-DG-Desktops-Name description = var.TACG-TMM-CVAD-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } enabled = var.TACG-TMM-CVAD-DG-Desktops-Enabled ... } ... ] ...Changing the value from ... TACG-TMM-CVAD-DG-Desktops-AllowList = ["TACG\\vdaallowed"] ...to ... TACG-TMM-CVAD-DG-Desktops-AllowList = ["TACG\\vdaallowed","TACG\\temporaryallowedmanda"] ...allows you to simply add users to the adjacent Delivery Group. Since all configuration files in the IaC universe are text-based, you can edit them as needed. Our self-service portal application simply updates the required configuration files and, e.g., uploads them to the appropriate deployment locations. Explore the endless possibilities of using IaC and the triad to ease administrative operations in your infrastructure. That completes Part 3 of the Citrix Automation Handbook. In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In this part, we focused on: Common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. DisclaimerMost important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Packer, Terraform, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. Using all the provided code snippets is at your own risk – please read the disclaimer below for further information. EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>The Citrix Automation Handbook 2601 - Part 2</h1> <p>Wed, 21 Jan 2026 09:12:09 +0000</p> The Citrix Automation Handbook - Part 2In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In this part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we focus on common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. Part 2 As mentioned in the Automation Matrix at the beginning of the first part of the handbook, there are many different ways to automate Citrix components. Let´s have a look at possible automations. Important Please review the main concepts: Declarative (Functional) Approach (e.g., Terraform, Ansible): Focuses on the target configuration that should be achieved. Defines the desired state, and the system executes the steps needed to achieve it. Imperative (Procedural): Focuses on how the infrastructure is to be changed to meet this. Defines specific commands that must be executed in the appropriate order to reach the desired conclusion. Idempotency (Terraform and Ansible): You can run the same Terraform or Ansible snippet as often as you want/need – it will only change the infrastructure if the snippet or the infrastructure changes. Terraform and Ansible compare the code with the actual infrastructure. You receive the same result regardless of the execution count. Scripting (PowerShell, REST API): Each time you run a PowerShell script or invoke a REST API call, the engine tries to create the entities coded in the script. This can lead to unwanted resources or even crashes of the script. The engine itself does NOT compare the code with the actual infrastructure. Most Important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Terraform codes, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the specific environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. For some code snippets, we also show the console output during code execution to visualize backend processes for information purposes. Using all the provided code snippets is at your own risk – please read the disclaimer at the end of the document for further information. Automation of Hypervisors/HyperscalersIf you want to automate the deployment or configuration of your Hypervisors/Hyperscalers, you can leverage the corresponding providers. Here´s a short matrix of supported toolkits: Important There are many ways to automate and use IaC across different Hypervisors and Hyperscalers using Terraform and Ansible. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for other examples. Example: Prepare Microsoft Azure for deploying a Citrix DaaS environment using Terraform### Create a Resource Group on Azure #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group resource "azurerm_resource_group" "TACG-AZ-V2-RG" { count = var.CreateRG ? 1 : 0 location = "${var.RG-DeployLocation}" name = "${var.RG-Name}" tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } } ### Create a Shared Image Gallery #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/shared_image_gallery data "azurerm_resource_group" "TMM-RG" { name = "${var.RG-Name}" } resource "azurerm_shared_image_gallery" "TACG-AZ-V2-SIG" { name = "${var.SIG-Name}" description = "${var.SIG-Description}" resource_group_name = data.azurerm_resource_group.TMM-RG.name location = data.azurerm_resource_group.TMM-RG.location tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } } ### Create an Image Definition for the Master Image #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/shared_image resource "azurerm_shared_image" "TACG-AZ-V2-SIG-IDW2K25M" { depends_on = [ azurerm_shared_image_gallery.TACG-AZ-V2-SIG ] name = "${var.SIG-IDW2K25M-Name}" gallery_name = azurerm_shared_image_gallery.TACG-AZ-V2-SIG.name resource_group_name = data.azurerm_resource_group.TMM-RG.name location = data.azurerm_resource_group.TMM-RG.location os_type = "${var.SIG-IDW2K25M-OsType}" hyper_v_generation = "V2" hibernation_enabled = true accelerated_network_support_enabled = true trusted_launch_enabled = false identifier { publisher = "${var.SIG-IDW2K25M-Publisher}" offer = "${var.SIG-IDW2K25M-Offer}" sku = "${var.SIG-IDW2K25M-SKU}" } tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } } resource "azurerm_shared_image_version" "TACG-AZ-V2-SIG-IDW2K25M-ImgVersion" { depends_on = [ azurerm_shared_image.TACG-AZ-V2-SIG-IDW2K25M ] name = "${var.SIG-IDW2K25M-Version}" gallery_name = azurerm_shared_image_gallery.TACG-AZ-V2-SIG.name image_name = "${var.SIG-IDW2K25M-Name}" resource_group_name = data.azurerm_resource_group.TMM-RG.name location = data.azurerm_resource_group.TMM-RG.location managed_image_id = "${var.SIG-IDW2K25M-ID}" target_region { name = data.azurerm_resource_group.TMM-RG.location regional_replica_count = 1 storage_account_type = "Standard_LRS" } tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } } ### We are using existing entitites like the Resource Group, NSGs, Firewall Rules, etc #### Get existing entity data data "azurerm_virtual_network" "TACG-TMM-VNet" { name = "${var.TACG-TMM-VNet-Name}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" } data "azurerm_subnet" "TACG-TMM-Subnet" { name = "${var.TACG-TMM-Subnet-Name}" virtual_network_name = data.azurerm_virtual_network.TACG-TMM-VNet.name resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" } data "azurerm_network_security_group" "TACG-TMM-NSG" { name = "${var.TACG-TMM-NSG-Name}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" } output "VNet_ID" { value = data.azurerm_virtual_network.TACG-TMM-VNet.id } output "Subnet_id" { value = data.azurerm_subnet.TACG-TMM-Subnet.name } output "NSG_id" { value = data.azurerm_network_security_group.TACG-TMM-NSG.name } #### Create a new inbound rule in NSG to allow WinRM Communication resource "azurerm_network_security_rule" "EnableWinRMInNSG" { depends_on = [ data.azurerm_network_security_group.TACG-TMM-NSG ] count = var.TACG-TMM-NSGRule-CreateRule ? 1 : 0 name = "${var.TACG-TMM-NSGRule-Name}" priority = "${var.TACG-TMM-NSGRule-Priority}" direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "${var.TACG-TMM-NSGRule-InboundPorts}" source_address_prefix = "VirtualNetwork" destination_address_prefix = "VirtualNetwork" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" network_security_group_name = data.azurerm_network_security_group.TACG-TMM-NSG.name } #### Create a dedicated Network Interface and IP configuration for the CC1-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface" "TACG-TMM-TF-CC1-NIC" { depends_on = [ azurerm_network_security_rule.EnableWinRMInNSG ] name = "${var.TACG-TMM-CC1-NIC-Name}" location = "${var.TACG-TMM-ResourceGroup-Location}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" accelerated_networking_enabled = true # dns_servers = [ "10.53.8.29" ] dns_servers = data.azurerm_virtual_network.TACG-TMM-VNet.dns_servers tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } ip_configuration { name = "${var.TACG-TMM-CC1-IPC-Name}" subnet_id = data.azurerm_subnet.TACG-TMM-Subnet.id private_ip_address_allocation = "${var.TACG-TMM-CC1-IPC-Private_IP_Address_Allocation}" private_ip_address = "${var.TACG-TMM-CC1-IPC-Private_IP_Address}" } } #### Create a dedicated Network Interface and IP configuration for the CC2-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface" "TACG-TMM-TF-CC2-NIC" { depends_on = [ data.azurerm_subnet.TACG-TMM-Subnet ] name = "${var.TACG-TMM-CC2-NIC-Name}" location = "${var.TACG-TMM-ResourceGroup-Location}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" accelerated_networking_enabled = true #dns_servers = [ "10.53.8.29" ] dns_servers = data.azurerm_virtual_network.TACG-TMM-VNet.dns_servers tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } ip_configuration { name = "${var.TACG-TMM-CC2-IPC-Name}" subnet_id = data.azurerm_subnet.TACG-TMM-Subnet.id private_ip_address_allocation = "${var.TACG-TMM-CC2-IPC-Private_IP_Address_Allocation}" private_ip_address = "${var.TACG-TMM-CC2-IPC-Private_IP_Address}" } } #### Associate the CC1-Network Interface with an existing NSG #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface_security_group_association" "TACG-TMM-TF-CC1-NICNSG" { depends_on = [ azurerm_network_interface.TACG-TMM-TF-CC1-NIC, data.azurerm_network_security_group.TACG-TMM-NSG ] network_interface_id = azurerm_network_interface.TACG-TMM-TF-CC1-NIC.id network_security_group_id = data.azurerm_network_security_group.TACG-TMM-NSG.id } #### Associate the CC2-Network Interface with an existing NSG #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_network_interface_security_group_association" "TACG-TMM-TF-CC2-NICNSG" { depends_on = [ azurerm_network_interface.TACG-TMM-TF-CC2-NIC, data.azurerm_network_security_group.TACG-TMM-NSG ] network_interface_id = azurerm_network_interface.TACG-TMM-TF-CC2-NIC.id network_security_group_id = data.azurerm_network_security_group.TACG-TMM-NSG.id } #### Create the CC1-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_windows_virtual_machine" "TACG-TMM-CC1" { depends_on = [ azurerm_network_interface_security_group_association.TACG-TMM-TF-CC1-NICNSG ] name = "${var.TACG-TMM-CC1-VM-Name}" location = "${var.TACG-TMM-ResourceGroup-Location}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" network_interface_ids = [azurerm_network_interface.TACG-TMM-TF-CC1-NIC.id] size = "${var.TACG-TMM-CCX-VM-Size}" admin_username = "${var.TACG-TMM-CCX-VM-Loc-UN}" admin_password = "${var.TACG-TMM-CCX-VM-Loc-PW}" provision_vm_agent = true timezone = "W. Europe Standard Time" patch_mode = "AutomaticByOS" enable_automatic_updates = true reboot_setting = "Never" hotpatching_enabled = false secure_boot_enabled = false source_image_id = "${var.TACG-TMM-SharedImage-ID}" os_disk { name = "${var.TACG-TMM-CC1-VM-OSDrive-Name}" caching = "${var.TACG-TMM-CCX-VM-OSDrive-Cache}" storage_account_type = "${var.TACG-TMM-CCX-VM-OSDrive-StorageType}" } tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } } #### Create the CC2-VM #### https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine ##### Set the values in the corresponding .auto.tfvars.json file resource "azurerm_windows_virtual_machine" "TACG-TMM-CC2" { depends_on = [ azurerm_network_interface_security_group_association.TACG-TMM-TF-CC2-NICNSG ] name = "${var.TACG-TMM-CC2-VM-Name}" location = "${var.TACG-TMM-ResourceGroup-Location}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" network_interface_ids = [azurerm_network_interface.TACG-TMM-TF-CC2-NIC.id] size = "${var.TACG-TMM-CCX-VM-Size}" admin_username = "${var.TACG-TMM-CCX-VM-Loc-UN}" admin_password = "${var.TACG-TMM-CCX-VM-Loc-PW}" provision_vm_agent = true timezone = "W. Europe Standard Time" patch_mode = "AutomaticByOS" enable_automatic_updates = true reboot_setting = "Never" hotpatching_enabled = false secure_boot_enabled = false source_image_id = "${var.TACG-TMM-SharedImage-ID}" os_disk { name = "${var.TACG-TMM-CC2-VM-OSDrive-Name}" caching = "${var.TACG-TMM-CCX-VM-OSDrive-Cache}" storage_account_type = "${var.TACG-TMM-CCX-VM-OSDrive-StorageType}" } tags = { Environment = "${var.TAG-Environment}", Environment-Entity = "${var.TAG-Environment-Entity}", Environment-Usage = "${var.TAG-Environment-Usage}", } } Note Please keep in mind that leveraging Terraform´s idempotency and declarative approach is the most flexible way of deploying infrastructure components. Example: Using Ansible to put a Virtual Machine into an AD DomainIn this example, we use the combination of Terraform and Ansible to join a newly created Virtual machine into an Active Directory domain. After deploying the VM using the Terraform snippet above, Terraform runs an Ansible Playbook to join the VM to the AD domain. Terraform snippet: ###### Call Ansible to Join VM to Domain resource "ansible_host" "TF-W2K25-CC-1" { name = "10.53.16.101" groups = ["cloudconnector1-ip"] variables = { ansible_user = "XxXxXxXxX", ansible_ssh_private_key_file = "~/.ssh/id_ed25519", ansible_python_interpreter = "/usr/bin/python3" } } resource "ansible_host" "TF-W2K25-CC-2" { name = "10.53.16.102" groups = ["cloudconnector2-ip"] variables = { ansible_user = "XxXxXxXxX", ansible_ssh_private_key_file = "~/.ssh/id_ed25519", ansible_python_interpreter = "/usr/bin/python3" } } resource "terraform_data" "ansible_inventory" { provisioner "local-exec" { command = "ansible-inventory -i inventory.yml --graph --vars" } } resource "terraform_data" "ansible_playbook" { provisioner "local-exec" { command = "ansible-playbook -v --check /etc/ansible/Join-VMToDomain-CC1.microsoft.ad.ansible.yml -c winrm" #command = "ansible-playbook -i inventory.yml /etc/ansible/Join-VMToDomain.microsoft.ad.ansible.yml --check -v" } depends_on = [terraform_data.ansible_inventory] } Ansible Playbook: --- - name: join host to domain with automatic reboot hosts: cloudconnector1-ip:cloudconnector1-ip tasks: - name: join host cc1 to domain with automatic reboot microsoft.ad.membership: dns_domain_name: XxXxX.XxX hostname: az-weur-tf-cc1 domain_admin_user: XxXxXxXxXxXxXxXxX domain_admin_password: "XxXxXxXxXxXxXxXxX" domain_ou_path: "OU=Infra,OU=West EUR,OU=Azure,OU=Cloud,OU=Compute,DC=XxXxX,DC=XxXxX" state: domain reboot: false - name: join host cc2 to domain with automatic reboot microsoft.ad.membership: dns_domain_name: XxXxX.XxX hostname: az-weur-tf-cc2 domain_admin_user: XxXxXxXxXxXxXxXxX domain_admin_password: "XxXxXxXxXxXxXxXxX" domain_ou_path: "OU=Infra,OU=West EUR,OU=Azure,OU=Cloud,OU=Compute,DC=XxXxX,DC=XxXxX" state: domain reboot: falseAnsible Configuration - insecure communication: XxXxXxXxX@devops-automation:/etc/ansible$ sudo nano hosts [cloudconnector1-ip] 10.53.16.101 [cloudconnector2-ip] 10.53.16.102 [cloudconnector1-ip:vars] ansible_user="XxXxXxXxX" ansible_password="XxXxXxXxXxXxXxXxXxXxXxXxX" ansible_connection=winrm ansible_winrm_transport=basic ansible_winrm_port=5985 ansible_winrm_server_cert_validation=ignore [cloudconnector2-ip:vars] ansible_user="XxXxXxXxX" ansible_password="XxXxXxXxXxXxXxXxXxX" ansible_connection=winrm ansible_winrm_transport=basic ansible_winrm_port=5985 ansible_winrm_server_cert_validation=ignoreTesting the Playbook: XxXxXxXxX@devops-automation:/etc/ansible$ ansible-playbook /etc/ansible/Join-VMToDomain.microsoft.ad.ansible.yml --check -c winrm ... PLAY [join host to domain with automatic reboot] *********************************************************************** TASK [Gathering Facts] ************************************************************************************************* ok: [10.53.16.101] ok: [10.53.16.102] TASK [join host cc1 to domain with automatic reboot] *********************************************************************** ok: [10.53.16.101] TASK [join host cc2 to domain with automatic reboot] *********************************************************************** ok: [10.53.16.102] PLAY RECAP ************************************************************************************************************* 10.53.16.101 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 10.53.16.102 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 XxXxXxXxX@devops-automation:/etc/ansible$ Example: Create all needed prerequisites and two VMs for Cloud ConnectorsIn this example, we use Terraform to set up the prerequisites for installing two Cloud Connector VMs on vSphere. Terraform snippet: # Terraform Deployment of Citrix Cloud Connectors on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs data "vsphere_datacenter" "datacenter" { name = var.vsphere_datacenter } data "vsphere_datastore" "datastore" { name = var.vsphere_datastore datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_network" "network" { name = var.vsphere_network datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_host" "host" { name = var.vsphere_host datacenter_id = data.vsphere_datacenter.datacenter.id } ### If a cluster is available, uncomment this block data "vsphere_compute_cluster" "cluster" { name = "TACG" datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_virtual_machine" "W2K22_Template" { name = var.vsphere_W2K25_template_name datacenter_id = data.vsphere_datacenter.datacenter.id } ### Create CC1-VM resource "vsphere_virtual_machine" "cc1-vm" { name = var.vsphere_ccc1_vmname resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id datastore_id = data.vsphere_datastore.datastore.id num_cpus = var.vsphere_cc1_cpus memory = var.vsphere_cc1_ram guest_id = data.vsphere_virtual_machine.W2K22_Template.guest_id scsi_type = data.vsphere_virtual_machine.W2K22_Template.scsi_type firmware = "efi" network_interface { network_id = data.vsphere_network.network.id adapter_type = data.vsphere_virtual_machine.W2K22_Template.network_interface_types[0] } disk { label = var.vsphere_cc1_disk_name ### If you want to use the same disk size and type as the template, uncomment this block size = data.vsphere_virtual_machine.W2K22_Template.disks.0.size thin_provisioned = data.vsphere_virtual_machine.W2K22_Template.disks.0.thin_provisioned ### If you want to override the disk size and disk provisioning type, uncomment this block and set the corresponding variables #size = var.vsphere_cc1_disk_size #thin_provisioned = var.vsphere_cc1_disk_provtype } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = var.vsphere_iso_destination_path } clone { template_uuid = data.vsphere_virtual_machine.W2K22_Template.id customize { network_interface { ipv4_address = var.vsphere_cc1_ipv4 ipv4_netmask = var.vsphere_cc_ipv4netmask dns_server_list = [var.vsphere_cc_dns[0]] } windows_options { computer_name = var.vsphere_computernames[0] } ipv4_gateway = var.vsphere_cc_ipv4_gateway } } } ### Create CC2-VM resource "vsphere_virtual_machine" "cc2-vm" { name = var.vsphere_cc2_vmname resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id datastore_id = data.vsphere_datastore.datastore.id num_cpus = var.vsphere_cc2_cpus memory = var.vsphere_cc2_ram guest_id = data.vsphere_virtual_machine.W2K22_Template.guest_id scsi_type = data.vsphere_virtual_machine.W2K22_Template.scsi_type firmware = "efi" network_interface { network_id = data.vsphere_network.network.id adapter_type = data.vsphere_virtual_machine.W2K22_Template.network_interface_types[0] } disk { label = var.vsphere_cc2_disk_name ### If you want to use the same disk size and type as the template, uncomment this block size = data.vsphere_virtual_machine.W2K22_Template.disks.0.size thin_provisioned = data.vsphere_virtual_machine.W2K22_Template.disks.0.thin_provisioned ### If you want to override the disk size and disk provisioning type, uncomment this block and set the corresponding variables #size = var.vsphere_cc2_disk_size #thin_provisioned = var.vsphere_cc2_disk_provtype } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = var.vsphere_iso_destination_path } clone { template_uuid = data.vsphere_virtual_machine.W2K22_Template.id customize { network_interface { ipv4_address = var.vsphere_cc2_ipv4 ipv4_netmask = var.vsphere_cc_ipv4netmask dns_server_list = [var.vsphere_cc_dns[0]] } windows_options { computer_name = var.vsphere_computernames[0] } ipv4_gateway = var.vsphere_cc_ipv4_gateway } } }Please consult further examples of using automation and IaC for Hypervisors/Hyperscalers on our Automation landing page on Citrix TechZone. Automation of DaaS ComponentsIf you want to automate the deployment or configuration of your Hypervisors/Hyperscalers, you can leverage the corresponding providers. Here´s a short matrix of supported toolkits: Important There are many ways to automate DaaS components and use IaC, especially across different Hypervisors and Hyperscalers using Terraform and Ansible. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for additional examples, or visit our Automation landing page on Citrix TechZone. First, we want to show the syntax differences for creating the same Hypervisor Connection and Hypervisor Connection Pool on AWS, Azure, and GCP. The examples are snippets from real-world deployments we did with customers: Example: Create a Hypervisor Connection and Connection Pool on AWS### Creating a Hypervisor Resource Pool #### Retrieving the Zone ID data "citrix_zone" "GetTFAWSZoneID" { name = "${var.AWSEC2_ZoneID}" } #### Retrieving the VPC name based on the VPC ID data "aws_vpc" "AWSVPC" { id = "${var.AWSEC2_VPC-ID}" } #### Retrieving the Availability Zone data "aws_vpc" "AWSAZ" { id = "${var.AWSEC2_VPC-ID}" } #### Retrieving the Subnet Mask based on the Subnet ID data "aws_subnet" "AWSSubnet" { id = "${var.AWSEC2_Subnet-ID}" } #### Creating the Hypervisor Connection resource "citrix_aws_hypervisor" "CreateHypervisorConnection" { depends_on = [ data.local_file.LoadZoneID ] name = "${var.CC_AWSEC2-HypConn-Name}" zone = data.citrix_zone.GetTFAWSZoneID api_key = "${var.AWSEC2_AccessKey}" secret_key = "${var.AWSEC2_AccessKeySecret}" region = "${var.AWSEC2_Region}" } #### Create the Hypervisor Resource Pool resource "citrix_aws_hypervisor_resource_pool" "CreateHypervisorPool" { depends_on = [ citrix_aws_hypervisor.CreateHypervisorConnection ] name = "${var.CC_AWSEC2-HypConnPool-Name}" hypervisor = citrix_aws_hypervisor.CreateHypervisorConnection.id subnets = [ "${data.aws_subnet.AWSSubnet.cidr_block}", ] vpc = "${var.AWSEC2_VPC-Name}" availability_zone = data.aws_subnet.AWSSubnet.availability_zone } Example: Create a Hypervisor Connection and Connection Pool on Azure#### Retrieving the ZoneID data "citrix_zone" "GetTFAzureZoneID" { name = "${var.CC-Azure-ZoneID}" } ### Creating the Hypervisor Connection resource "citrix_azure_hypervisor" "CreateAzureHostingConnection" { depends_on = [ data.citrix_zone.GetTFAzureZoneID ] name = "${var.CC-Azure-HypConn-Name}" zone = data.citrix_zone.GetTFAzureZoneID.id active_directory_id = "${var.azurerm-tenantid}" subscription_id = "${var.azurerm-subscriptionid}" application_secret = "${var.azurerm-clientsecret}" application_id = "${var.azurerm-clientid}" } #### Creating the Hypervisor Resource Pool resource "citrix_azure_hypervisor_resource_pool" "CreateAzureHostingConnectionPool" { depends_on = [ citrix_azure_hypervisor.CreateAzureHostingConnection] name = "${var.CC-Azure-HypConn-Name}" hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id region = "${var.TACG-TMM-ResourceGroup-Location}" virtual_network_resource_group = "${var.TACG-TMM-ResourceGroup-Name}" virtual_network = "${var.CC-Azure-VNet-Name}" subnets = var.CC-Azure-Subnets } Example: Create a Hypervisor Connection and Connection Pool on GCP#### Retrieving the ZoneID data "citrix_zone" "GetGCPZoneID" { name = "${var.GCP-ZoneID}" } resource "citrix_gcp_hypervisor" "CreateHypervisorConnection" { depends_on = [ data.citrix_zone.GetGCPZoneID ] name = "${var.CC_GCP-HypConn-Name}" zone = data.citrix_zone.GetGCPZoneID.id service_account_id = "${var.CC_GCP-ServiceAccountID}" service_account_credentials = data.local_file.GCPCredentials.content service_account_id = "${var.tv_client_email}" service_account_credentials = "${var.tv_private_key}" } #### Creating the Hypervisor Resource Pool resource "citrix_gcp_hypervisor_resource_pool" "CreateHypervisorPool" { depends_on = [ citrix_gcp_hypervisor.CreateHypervisorConnection ] name = "${var.CC_GCP-HypConnPool-Name}" hypervisor = citrix_gcp_hypervisor.CreateHypervisorConnection.id project_name = "${var.CCOnGCP-CCStuff-Provider-GCPProjectName}" region = "${var.CCOnGCP-CCStuff-Provider-GCPRegion}" vpc = "${var.CC_GCP-HypConnPool-VPC}" subnets = [ "${var.CC_GCP-HypConnPool-Subnet}", ] } Note These three examples showcase that there are slight but distinct differences in the syntax depending on the underlying Hypervisor or HyperScaler. Heavier differences occur when creating Machine Catalogs. Example: Creation of a Machine Catalog on vSphere based on a snapshot of an Imageresource "citrix_machine_catalog" "TACG-TMM-CVAD-V-MC" { depends_on = [citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool] name = var.TACG-TMM-CVAD-MC-Name description = var.TACG-TMM-CVAD-MC-Description provisioning_type = var.TACG-TMM-CVAD-MC-ProvisioningType allocation_type = var.TACG-TMM-CVAD-MC-AllocationType session_support = var.TACG-TMM-CVAD-MC-SessionType zone = data.citrix_zone.TACG-TMM-CVAD-V-Zone.id provisioning_scheme = { hypervisor = citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn.id hypervisor_resource_pool = citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool.id identity_type = var.TACG-TMM-CVAD-MC-IdentityType machine_domain_identity = { domain = var.TACG-TMM-CVAD-MC-VM-DomainFQDN domain_ou = var.TACG-TMM-CVAD-MC-VM-DomainOU service_account = var.TACG-TMM-CVAD-MC-VM-ServiceUserName service_account_password = var.TACG-TMM-CVAD-MC-VM-ServiceUserPassword } vsphere_machine_config = { master_image_vm = var.TACG-TMM-CVAD-MC-MasterImageVMName cpu_count = var.TACG-TMM-CVAD-MC-VM-CPUCount memory_mb = var.TACG-TMM-CVAD-MC-VM-MemorySize image_snapshot = var.TACG-TMM-CVAD-MC-MasterImageVMName-SnapshotName } number_of_total_machines = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs machine_account_creation_rules = { naming_scheme = var.TACG-TMM-CVAD-MC-VM-NamingScheme naming_scheme_type = var.TACG-TMM-CVAD-MC-VM-NamingSchemeType } } } Example: Creation of a Machine Catalog on Azure based on an Image Gallery-based Image### Retrieving the Shared Image Gallery data "azurerm_shared_image_gallery" "GetAzureSIG" { name = "${var.CC-Azure-SIG-Name}" resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" } #### Retrieving the Shared Image Definition data "azurerm_shared_image" "GetAzureSIGDefinition" { name = "${var.CC-Azure-SIGDefinition-Name}" gallery_name = data.azurerm_shared_image_gallery.GetAzureSIG.name resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" } #### Retrieving the Shared Image Definition Version data "azurerm_shared_image_version" "GetAzureSIGDefinitionVersion" { name = "${var.CC-Azure-SIGDefinitionVersion}" image_name = data.azurerm_shared_image.GetAzureSIGDefinition.name gallery_name = data.azurerm_shared_image_gallery.GetAzureSIG.name resource_group_name = "${var.TACG-TMM-ResourceGroup-Name}" } #### Creating the Machine Catalog resource "citrix_machine_catalog" "CreateAzureMCSCatalog" { depends_on = [ time_sleep.wait_30_seconds1 ] name = "${var.CC-Azure-MC-Name}" description = "${var.CC-Azure-MC-Description}" allocation_type = "${var.CC-Azure-MC-AllocationType}" session_support = "${var.CC-Azure-MC-SessionType}" provisioning_type = "MCS" zone = data.citrix_zone.GetTFAzureZoneID.id scopes = "${var.CC-GetScopeToBeUsed-Names}" provisioning_scheme = { hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id identity_type = "${var.CC-Azure-MC-IDPType}" machine_domain_identity = { domain = "${var.CC-Azure-MC-Domain}" domain_ou = "${var.CC-Azure-MC-DomainOU}" service_account = "${var.CC-Azure-MC-DomainAdmin-Username-UPN}" service_account_password = "${var.CC-Azure-MC-DomainAdmin-Password}" } azure_machine_config = { storage_type = "Standard_LRS" use_managed_disks = true service_offering = "${var.CC-Azure-MC-VMSize}" azure_master_image = { resource_group = var.azure_resource_group gallery_image = { gallery = data.azurerm_shared_image_gallery.GetAzureSIG.name definition = data.azurerm_shared_image.GetAzureSIGGetAzureSIGDefinition.name version = data.azurerm_shared_image_version.GetAzureSIGDefinitionVersion.name } } machine_profile = { machine_profile_resource_group = "${var.TACG-TMM-ResourceGroup-Name}" machine_profile_vm_name = "${var.CC-Azure-MC-VMProfileName}" } } number_of_total_machines = "${var.CC-Azure-MC-MachineCount}" machine_account_creation_rules = { naming_scheme = "${var.CC-Azure-MC-NamingScheme-Name}" naming_scheme_type = "${var.CC-Azure-MC-NamingScheme-Type}" } } } Creation of a Machine Catalog on AWS based on an Image AMI#### Creating the Machine Catalog resource "citrix_machine_catalog" "resource "citrix_machine_catalog" "CreateAWSMCSCatalog" { name = "${var.AWS-MC-Name}" description = "${var.AWS-MC-Description}" allocation_type = "${var.AWS-MC-AllocationType}" session_support = "${var.AWS-MC-SessionType}" zone = data.citrix_zone.GetAWSZoneID.id provisioning_type = "MCS" provisioning_scheme = { hypervisor = data.citrix_aws_hypervisor.AWSHypConn.id hypervisor_resource_pool = data.citrix_aws_hypervisor_resource_pool.AWSHypConnPool.id identity_type = "${var.AWS-MC-IDPType}" machine_domain_identity = { domain = "${var.AWS-MC-Domain}" domain_ou = "${var.AWS-MC-DomainOU}" service_account = "${var.AWS-MC-DomainAdmin-Username-UPN}" service_account_password = "${var.AWS-MC-DomainAdmin-Password}" } aws_machine_config = { image_ami = "${var.AWS-MC-ImageAMI}" master_image = "${var.AWS-MC-MImageAMIName}" service_offering = "${var.AWS-MC-MachineSize}" security_groups = [ "${var.AWS-MC-SecGroup}" ] tenancy_type = "${var.AWS-MC-Tenancy}" secondary_vm_sizes = [ { vm_size = "${var.AWS-MC-SecondaryMachineSize}" use_spot_pricing_if_available = false } ] } number_of_total_machines = "${var.AWS-MC-MachineCount}" machine_account_creation_rules = { naming_scheme = "${var.AWS-MC-NamingScheme-Name}" naming_scheme_type = "${var.AWS-MC-NamingScheme-Type}" } } } Note These examples show that there are greater differences in syntax depending on the underlying Hypervisor or HyperScaler and the Master Image type used. No differences occur when creating a Delivery Group. Example: Creation of a Delivery Group#### Create the Delivery Group resource "citrix_delivery_group" "TACG-TMM-DG" { depends_on = [citrix_machine_catalog.TACG-TMM-MC] name = var.TACG-TMM-DG-Name description = var.TACG-TMM-DG-Description minimum_functional_level = var.TACG-TMM-DG-FunctionalLevel associated_machine_catalogs = [ { machine_catalog = citrix_machine_catalog.TACG-TMM-MC.id machine_count = var.TACG-TMM-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-DG-Desktops-Name description = var.TACG-TMM-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } enabled = var.TACG-TMM-CVAD-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC, change if a Random assignment type-MC is used # enable_session_roaming = var.TACG-TMM-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM-DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC, change if a Random assignment type-MC is used #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-DG-AS-Days display_name = var.TACG-TMM-DG-AS-Name peak_time_ranges = var.TACG-TMM-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-DG-RS-Enabled frequency = var.TACG-TMM-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-DG-RS-RebootDays start_time = var.TACG-TMM-DG-RS-RebootStartTime start_date = var.TACG-TMM-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC, change if a Random assignment type-MC is used #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-DG-RS-Notification-MessageRepeat #} } ] } Note A syntactically simple entity is the Policy set, but be aware that it has a very complex structure. Example: Creation of a Policy set with some policies### Make sure that the site settings allow the usage of Policy Sets resource "citrix_site_settings" "TACG-TMM-SiteSettings" { web_ui_policy_set_enabled = true dns_resolution_enabled = true multiple_remote_pc_assignments = true trust_requests_sent_to_the_xml_service_port_enabled = true } #### Create a default Policy Set resource "citrix_policy_set_v2" "TACG-TMM-DefaultPolicySet" { depends_on = [citrix_delivery_group.TACG-TMM-V-DG, citrix_site_settings.TACG-TMM-SiteSettings ] name = var.TACG-TMM-PS-Name description = var.TACG-TMM-PS-Description delivery_groups = [citrix_delivery_group.TACG-TMM-V-DG.id] } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-DefaultPolicySet-Printing" { depends_on = [citrix_policy_set_v2.TACG-TMM-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-DefaultPolicySet.id name = "Printing" description = "Example of Printer-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-DefaultPolicySet-HDX" { depends_on = [citrix_policy_set_v2.TACG-TMM-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-DefaultPolicySet.id name = "HDX™ Graphics" description = "Example of HDX Graphics-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-DefaultPolicySet-ClientDrives" { depends_on = [citrix_policy_set_v2.TACG-TMM-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-DefaultPolicySet.id name = "Client Drives" description = "Example of Client Drive-related policy in default Policy Set" enabled = true } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-Printing1" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id name = "ClientPrinterAutoCreation" value = "DefaultPrinterOnly" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-Printing2" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id name = "UniversalPrintDriverUsage" value = "FallbackToSpecific" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-HDX1" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id name = "AllowVisuallyLosslessCompression" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-HDX2" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id name = "UseVideoCodecForCompression" value = "UseVideoCodecIfPreferred" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-HDX3" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id name = "UseHardwareEncodingForVideoCodec" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD1" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "AutoConnectDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD2" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientDriveRedirection" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD3" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientFixedDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD4" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientFloppyDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD5" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientOpticalDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-DefaultPolicySet-CD6" { policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id name = "ClientNetworkDrives" enabled = false use_default = false } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-DefaultPolicySet-DGFilter-1" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-V-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-DefaultPolicySet-DGFilter-2" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-V-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-DefaultPolicySet-DGFilter-3" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-V-DG.id } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-DefaultPolicySet-SIDFilter-1" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id enabled = true allowed = true sid = var.TACG-TMM-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-DefaultPolicySet-SIDFilter-2" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id enabled = true allowed = true sid = var.TACG-TMM-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-DefaultPolicySet-SIDFilter-3" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id enabled = true allowed = true sid = var.TACG-TMM-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-DefaultPolicySet-ClientIPFilter-1" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-Printing.id enabled = true allowed = true ip_address = var.TACG-TMM-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-DefaultPolicySet-ClientIPFilter-2" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-HDX.id enabled = true allowed = true ip_address = var.TACG-TMM-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-DefaultPolicySet-ClientIPFilter-3" { depends_on = [citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-DefaultPolicySet-ClientDrives.id enabled = true allowed = true ip_address = var.TACG-TMM-PS-IPRange } resource "null_resource" "WriteProgress5" { depends_on = [citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD1, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD2, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD3, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD4, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD5, citrix_policy_setting.TACG-TMM-DefaultPolicySet-CD6, citrix_policy_setting.TACG-TMM-DefaultPolicySet-HDX1, citrix_policy_setting.TACG-TMM-DefaultPolicySet-HDX2, citrix_policy_setting.TACG-TMM-DefaultPolicySet-HDX3, citrix_policy_setting.TACG-TMM-DefaultPolicySet-Printing1, citrix_policy_setting.TACG-TMM-DefaultPolicySet-Printing2] provisioner "local-exec" { command = "echo The default Policy Set and its policies and filters were successfully created..." } }Important Finally, we want to emphasize again: There are many ways to automate DaaS Components and use IaC, especially across different Hypervisors and Hyperscalers using Terraform and Ansible. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for additional examples, or visit our Automation landing page on Citrix TechZone. Automation of CVAD ComponentsIf you want to automate the deployment or configuration of your Hypervisors/Hyperscalers, you can leverage the corresponding providers. Here´s a short matrix of supported toolkits: Important There are many ways to automate CVAD components and use IaC, especially across different Hypervisors and Hyperscalers using Terraform and Ansible. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for additional examples, or visit our Automation landing page on Citrix TechZone. As there is almost no difference between using Automation and IaC for the Citrix DaaS-based entities and the Citrix CVAD-based entities, we want to show only one example: Example: Creation of a StoreFront deploymentCaution Due to limitations in StoreFront´s automation capabilities, this module/snippet must be run on a Windows-based, domain-joined VM. You cannot run it from, e.g., the Ubuntu VM mentioned throughout the handbook. WARNING The current Automation snippets for StoreFront will only run on Windows PowerShell <= 5.1. They will not run on PowerShell >=6. Be sure to start the Terraform code on the correct PowerShell version. You may encounter this error after starting the Terraform snippet: Error: Error fetching StoreFront version │ │ with citrix_stf_webreceiver_service.CreateSFWebReceiverService, │ on CVADOnXS-ConfigureStoreFront.tf line 48, in resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService": │ 48: resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { │ │ Error message: error executing command: Get-STFVersion │ Error Message: │ ConvertTo-SecureString : "ConvertTo-SecureString" was found in module "Microsoft.PowerShell.Security", │ we were unable to load the module. Run "Import-Module │ Microsoft.PowerShell.Security". │ In row:1 column:205 │ + ... nistrator@the-austrian-citrix-guy.at',(ConvertTo-SecureString -Force ... │ + ~~~~~~~~~~~~~~~~~~~~~~ │ + CategoryInfo : ObjectNotFound: (ConvertTo-SecureString:String) [], CommandNotFoundException │ + FullyQualifiedErrorId : CouldNotAutoloadMatchingModule │╵That error means you have not loaded the module Microsoft.PowerShell.Security in Windows PowerShell. Be sure to load the module in Windows PowerShell, not PowerShell: PS C:\__PPMM\__TF\_ConfigureStoreFront> Import-Module Microsoft.PowerShell.Security Terraform snippet for creating a StoreFront deployment: #### Configuring StoreFront ##### Reference https://github.com/citrix/terraform-provider-citrix/blob/main/StoreFront.md ###### Create an initial StoreFront Deployment resource "citrix_stf_deployment" "CreateInitialSFDeployment" { site_id = var.TACG-TMM-SF-SiteID host_base_url = var.TACG-TMM-SF-SiteURL roaming_gateway = [ { name = var.TACG-TMM-SF-Gateway-Name logon_type = var.TACG-TMM-SF-Gateway-LogonType gateway_url = var.TACG-TMM-SF-Gateway-URL callback_url = var.TACG-TMM-SF-Gateway-CallbackURL subnet_ip_address = var.TACG-TMM-SF-Gateway-SNIP secure_ticket_authority_urls = var.TACG-TMM-SF-Gateway-STAs } ] roaming_beacon = { internal_address = var.TACG-TMM-SF-Beacon-Internal external_addresses = var.TACG-TMM-SF-Beacon-External } } ##### Create an Authentication service resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-AuthService-Name virtual_path = var.TACG-TMM-SF-AuthService-Path } ##### Create a Store service resource "citrix_stf_store_service" "CreateSFStoreService" { depends_on = [citrix_stf_authentication_service.CreateSFAuthenticationService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id virtual_path = var.TACG-TMM-SF-StoreService-Path friendly_name = var.TACG-TMM-SF-StoreService-Name authentication_service_virtual_path = citrix_stf_authentication_service.CreateSFAuthenticationService.virtual_path pna = { enable = false } farms = var.TACG-TMM-SF-StoreService-Farms } ##### Create a WebReceiver service resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment, citrix_stf_store_service.CreateSFStoreService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-WebService-Name virtual_path = var.TACG-TMM-SF-WebService-Path store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path authentication_methods = [ "ExplicitForms", "CitrixAGBasic" ] plugin_assistant = { enabled = var.TACG-TMM-SF-WebService-PA-Enabled html5_single_tab_launch = var.TACG-TMM-SF-WebService-PA-HTML5SingleTab upgrade_at_login = var.TACG-TMM-SF-WebService-PA-UpgradeAtLogin html5_enabled = var.TACG-TMM-SF-WebService-PA-HTML5Enabled } application_shortcuts = { prompt_for_untrusted_shortcuts = var.TACG-TMM-SF-WebService-AppSC-Prompt trusted_urls = var.TACG-TMM-SF-WebService-AppSC-TrustedURLs } user_interface = { auto_launch_desktop = var.TACG-TMM-SF-WebService-UI-AutoLaunchDesktop multi_click_timeout = var.TACG-TMM-SF-WebService-UI-Timeout enable_apps_folder_view = var.TACG-TMM-SF-WebService-UI-AppFolderView workspace_control = { enabled = var.TACG-TMM-SF-WebService-UI-WC-Enabled auto_reconnect_at_logon = var.TACG-TMM-SF-WebService-UI-WC-AutoReconnect logoff_action = var.TACG-TMM-SF-WebService-UI-LogoffAction show_reconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowReconnect show_disconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowDisconnect } receiver_configuration = { enabled = var.TACG-TMM-SF-WebService-RC-Enabled } app_shortcuts = { enabled = var.TACG-TMM-SF-WebService-ASC-Enabled show_desktop_shortcut = var.TACG-TMM-SF-WebService-ASC-ShowDesktopShortcut } ui_views = { show_apps_view = var.TACG-TMM-SF-WebService-UIViews-Apps show_desktops_view = var.TACG-TMM-SF-WebService-UIViews-Desktops default_view = var.TACG-TMM-SF-WebService-UIViews-Default } category_view_collapsed = var.TACG-TMM-SF-WebService-CategoryView move_app_to_uncategorized = var.TACG-TMM-SF-WebService-Uncategorized progressive_web_app = { enabled = var.TACG-TMM-SF-WebService-PWA-Enabled show_install_prompt = var.TACG-TMM-SF-WebService-PWA-Install } show_activity_manager = var.TACG-TMM-SF-WebService-ActivityManager show_first_time_use = var.TACG-TMM-SF-WebService-FirstTimeUse prevent_ica_downloads = var.TACG-TMM-SF-WebService-PreventICADownloads } resources_service = { ica_file_cache_expiry = var.TACG-TMM-SF-WebService-RS-IcaFileExpiry persistent_icon_cache_enabled = var.TACG-TMM-SF-WebService-RS-IconCacheEnabled } } ##### A PNA site is not installed due to no effective needs #resource "citrix_stf_xenapp_default_store" "CreateSFXenAppPath" { # depends_on = [citrix_stf_store_service.CreateSFStoreService] # store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path # store_site_id = citrix_stf_store_service.CreateSFStoreService.site_id # } Important Finally, we want to emphasize again: There are many ways to automate CVAD Components and use IaC, especially across different Hypervisors and Hyperscalers using Terraform and Ansible. Listing all possibilities, snippets, and runtime outputs is out of scope. Please consult the documentation at https://github.com/citrix/terraform-provider-citrix/tree/main/docs/resources for additional examples, or visit our Automation landing page on Citrix TechZone. Automation of Endpoint ComponentsOne of the most requested Automation tasks from the Endpoint perspective is the automated configuration of the Workspace App. You can configure the Citrix Workspace app using the Global App Configuration service (GACS). It helps you manage the app settings for end users on both managed and unmanaged devices. Settings can be configured for both cloud (Citrix Workspace) and on-premises (Citrix StoreFront™) environments. The Global App Configuration service lets you perform the following functions from a centralized interface: Configure settings for both managed and unmanaged devices (Bring Your Own Devices) Configure settings for multiple stores Update and manage client app agents (for example, Endpoint Analysis, ZTNA) and third-party agents (for example, Zoom, Webex) Automatically update and manage the Citrix Workspace app version for end users Test the configuration before rolling it out to your end-users Of course, GACS can be configured using Terraform. Important Listing all possible settings is out of scope. To determine which settings are supported on each platform, please consult the GACS documentation at https://developer-docs.citrix.com/en-us/server-integration/global-app-configuration-service/getting-started#/supported-settings-and-their-values-per-platform. Example screenshot: Let´s have a look at the Terraform snippet: # Configuring Citrix Cloud Global App Configuration Service ## Create Settings resource "citrix_gac_settings" "TMM-TF-GACS-Settings" { service_url = "${var.GACS-ServiceURL}" name = "${var.GACS-Settings-Name}" description = "${var.GACS-Settings-Description}" test_channel = true app_settings = { windows = [ { user_override = false, category = "root", settings = [ { name = "Hide advanced preferences", value_string = "true" }, { name = "Hide connection center", value_string = "true" } ] }, { user_override = false, category = "browser", settings = [ { name = "Incognito Mode Availability", value_string = "Incognito mode available" }, { name = "saving browser history disabled", value_string = "true" } ] }, { user_override = false, category = "dazzle", settings = [ { name = "Put shortcuts on desktop", value_string = "true" } ] }, { user_override = false, category = "ICA® client", settings = [ { name = "Allow Client Clipboard Redirection", value_string = "true" } ] } ], html5 = [ { category = "virtual channel", user_override = false, settings = [ { name = "Clipboard Operations Between VDA And Local Device", value_string = "true" } ] }, { category = "toolbar", user_override = false, settings = [ { name = "Clipboard Option in Toolbar", value_string = "true" }, { name = "USB Devices Option in Toolbar", value_string = "true" } ] } ], ios = [ { category = "advanced", user_override = false, settings = [ { name = "Touch Enable", value_string = "true" }, { name = "Fullscreen Window", value_string = "true" } ] } ], android = [ { category = "advanced", user_override = false, settings = [ { name = "Enable clipboard", value_string = "true" } ] } ], macos = [ { category = "browser", user_override = false, settings = [ { name = "Enable Password Save", value_string = "true" }, { name = "Enable Citrix Enterprise Browser™ shortcut", value_string = "true" } ] } ], linux = [ { category = "browser", user_override = false, settings = [ { name = "Incognito Mode Availability", value_string = "Incognito mode available" }, { name = "Enable Password Save", value_string = "true" } ] } ] } } Overview of Automating NetScaler and its ComponentsWith NetScaler infrastructure as code (IaC), you can automate the deployment and management of your NetScaler ADC infrastructure and scale it easily. IaC is the process of managing infrastructure declaratively using code. IaC ensures infrastructure consistency by defining configuration in code. This reduces the risk of misconfigurations that can lead to security vulnerabilities or downtime. NetScaler IaC also lets you version-control your infrastructure, enabling you to track changes and roll back to a previous version if necessary. And it allows teams to collaborate on the same infrastructure using code repositories and version control systems. NetScaler provides multiple tools to automate your ADC deployments and configurations. This document provides a brief summary of various automation tools and references to resources you can use to manage ADC configurations. Terraform Provider for Citrix ADCCitrix has developed a custom Terraform provider for automating Citrix ADC deployments and configurations. Using Terraform, you can custom-configure your ADCs for different use cases, such as Load Balancing, SSL, Content Switching, GSLB, and WAF. You can find many examples of using Terraform to configure basic ADC operations or ADC use cases in the GitHub repository: https://github.com/citrix/terraform-provider-citrixadc. Example: Deploying a Citrix ADC HA pair on vSphereConfiguration is based on ADC's preboot config functionality. Additionally, we need to create ISO images to attach to the ADC VMs as they boot. To do this, we rely on the mkisofs utility available on Linux platforms. Make sure that Terraform runs on a Linux host that has this utility installed. Also, note that we need to host the OVF and VMDK files on a host with high-speed connectivity to the target vSphere server. This is to reduce the time it takes to transfer these files. Important During the HA pair's bootstrap process, there is a race condition over which node will be Primary and which Secondary. To remove this race condition, we advise running the Terraform apply command with a single thread. Use terraform apply -parallelism=1 variables.tf variable "nsip" { description = "NSIP address" type = list(string) } variable "gw_ip" { description = "Gateway IP address" type = string } variable "subnetmask" { description = "Subnet Mask" type = string } variable "vsphere_ip" { description = "IP Address of vsphere" type = string } variable "vsphere_username" { description = "User name for vsphere" type = string } variable "vsphere_password" { description = "vSphere password" sensitive = true type = string } variable "datacenter_name" { description = "Data Center name" type = string } variable "datastore_name" { description = "Data Store Name" type = string } variable "resource_pool_name" { description = "Resource Pool Name" type = string } variable "resource_host" { description = "ESXi host ip" type = string } variable "nic_01_network_name" { description = "Network name for 1/1 NIC" type = string } variable "virtual_machine_name" { description = "Virtual machine names in list(string)" type = string } variable "remote_vpx_ovf_path" { description = "OVF path" type = string } variable "memory" { description = "VPX memory in MB" type = number } variable "num_cpus" { description = "VPX cpu count" type = number } variable "iso_output_dir" { description = "Directory which will be used to construct userdata iso file" type = string default = "iso_preboot_config" } variable "iso_destination_folder" { description = "Target directory in datastore to upload iso file" type = string }provider.tf provider "vsphere" { user = "administrator@vsphere.local" password = "XxXxXxXxXxXxXxXxX" vsphere_server = "10.217.100.101" # If you have a self-signed cert allow_unverified_ssl = true } terraform { required_providers { null = { source = "hashicorp/null" version = "3.1.1" } } }resources.tf data "vsphere_datacenter" "dc" { name = var.datacenter_name } data "vsphere_datastore" "datastore" { name = var.datastore_name datacenter_id = data.vsphere_datacenter.dc.id } # https://github.com/hashicorp/terraform-provider-vsphere/issues/262#issuecomment-348644869 # Every cluster will have a default `Resources` resource_pool data "vsphere_resource_pool" "pool" { name = var.resource_pool_name datacenter_id = data.vsphere_datacenter.dc.id } data "vsphere_host" "host" { name = var.resource_host datacenter_id = data.vsphere_datacenter.dc.id } data "vsphere_network" "nic_01" { name = var.nic_01_network_name datacenter_id = data.vsphere_datacenter.dc.id } # Create iso file resource "null_resource" "makeiso" { provisioner "local-exec" { command = format("./process_userdata.py --nsip %s --other-node-nsip %s --netmask %s --gateway %s --output-dir %s-%s", var.nsip[count.index], var.nsip[count.index == 0 ? 1:0], var.subnetmask, var.gw_ip, var.iso_output_dir, count.index + 1) } count = 2 } # Upload iso file to datastore resource "vsphere_file" "upload_iso" { datacenter = var.datacenter_name datastore = var.datastore_name source_file = format("%s-%s.iso", var.iso_output_dir, count.index + 1) destination_file = format("%s/%s-%s.iso", var.iso_destination_folder, var.iso_output_dir, count.index + 1) create_directories = true count = 2 depends_on = [null_resource.makeiso] } # https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs/resources/virtual_machine resource "vsphere_virtual_machine" "citrixVPX" { name = format("%s-%s", var.virtual_machine_name, count.index + 1) resource_pool_id = data.vsphere_resource_pool.pool.id datastore_id = data.vsphere_datastore.datastore.id # folder - (Optional) The path to the folder to put this virtual machine in, relative to the datacenter that the resource pool is in. # folder = "test-vapp" host_system_id = data.vsphere_host.host.id wait_for_guest_net_timeout = 0 wait_for_guest_ip_timeout = 0 datacenter_id = data.vsphere_datacenter.dc.id network_interface { network_id = data.vsphere_network.nic_01.id } # Add more network_interface blocks here scsi_type = "lsilogic" num_cpus = var.num_cpus memory = var.memory # in MBs # https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs/resources/virtual_machine#creating-vm-from-deploying-a-ovfova-template ovf_deploy { remote_ovf_url = var.remote_vpx_ovf_path enable_hidden_properties = true allow_unverified_ssl_cert = true } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = format("%s/%s-%s.iso", var.iso_destination_folder, var.iso_output_dir, count.index + 1) } count = 2 depends_on = [vsphere_file.upload_iso] }process_userdata.py #!/usr/bin/env python3 import argparse import shutil import os import subprocess nspreboot_str = '''\ <NS-PRE-BOOT-CONFIG> <NS-CONFIG> add route 0.0.0.0 0.0.0.0 %s add ha node 1 %s </NS-CONFIG> <NS-BOOTSTRAP> <SKIP-DEFAULT-BOOTSTRAP>YES</SKIP-DEFAULT-BOOTSTRAP> <NEW-BOOTSTRAP-SEQUENCE>YES</NEW-BOOTSTRAP-SEQUENCE> <MGMT-INTERFACE-CONFIG> <INTERFACE-NUM>eth0</INTERFACE-NUM> <IP>%s</IP> <SUBNET-MASK>%s</SUBNET-MASK> </MGMT-INTERFACE-CONFIG> </NS-BOOTSTRAP> </NS-PRE-BOOT-CONFIG> ''' def main(): parser = argparse.ArgumentParser() parser.add_argument('--nsip', required=True) parser.add_argument('--other-node-nsip', required=True) parser.add_argument('--netmask', default="255.255.255.0") parser.add_argument('--gateway', required=True) parser.add_argument('--output-dir', default="iso_preboot_config") args = parser.parse_args() output_str = nspreboot_str % (args.gateway, args.other_node_nsip, args.nsip, args.netmask) # Check if output directory exists if os.path.exists(args.output_dir): print('Deleting existing output dir %s', args.output_dir) shutil.rmtree(args.output_dir) os.makedirs(args.output_dir) output_file = os.path.join(args.output_dir, 'userdata') with open(output_file, 'w') as fh: fh.write(output_str) # Create iso file iso_output_file = '.'.join([args.output_dir,'iso']) cp = subprocess.run(['mkisofs', '-o', iso_output_file, args.output_dir]) cp.check_returncode() if __name__ == '__main__': main() Example: Deploying a Citrix ADC HA pair with an Azure Availability SetThis example shows a standardized deployment of Citrix ADCs in a High Availability set. It can serve as the baseline for all subsequent configurations and use cases. You can find the whole script and variables in the GitHub repository. The following components will be configured: A Virtual Network with 3 subnets and associated security groups and routing tables Two Citrix ADC instances configured in a High Availability setup main.tf describes the actual config objects to be created. The attributes of these resources are either hard-coded or looked up from input variables in examples.tfvars. Configuration DetailsThe Citrix ADC instances are deployed with 3 separate NICs each, in separate subnets. The ADC bootstrap code will assign IP addresses to each interface according to the IP addresses assigned by Azure. The management network interface is where the NSIP address is assigned. There are no additional security rules attached to the interface. This means that access is restricted only by the subnet-attached security group, which allows SSH, HTTP, and HTTPS from the controlling subnet. This interface has a public IP address, making it reachable from outside the Virtual Network. For enhanced security, one could remove the public IP. In such a case, the management interface will only be accessible from within the Virtual Network. This means that all SSH connections and NITRO API calls must go through the bastion host. The client network interface is where the VIP address is assigned. This private VIP address is not used for incoming traffic since we are in an HA setup. Instead, the IP address used for traffic is the public IP address of the Azure Load Balancer. This address must be assigned to a Vserver (LB/CS) with functioning backend services. From that point on, the ALB public IP address will start load-balancing the instances. You can find a sample LB configuration in this folder In the event of a failover, the ALB will detect via the probe that one node is going down and the secondary is taking over, at which point it will start sending traffic to the new primary node. Traffic may be impacted for a few seconds while the ALB probe determines the functional state of the HA pair. There are no additional security rules attached to the interface. This means access is restricted only by the subnet-attached security group, which allows HTTP and HTTPS traffic from anywhere. The server network interface is where the SNIP address is assigned. No public ip address is associated with this interface. There are no additional security rules attached to the interface. This means access is restricted only by the subnet's attached security group, which allows traffic only from the subnet itself. An SSH key is required when creating the ADC host. # Azure Resource Group resource "azurerm_resource_group" "terraform-resource-group" { name = var.resource_group_name location = var.location } resource "azurerm_availability_set" "terraform-availability-set" { name = "terraform-availability-set" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name platform_update_domain_count = 2 platform_fault_domain_count = 2 } resource "azurerm_virtual_network" "terraform-virtual-network" { name = "terraform-virtual-network" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name address_space = [var.virtual_network_address_space] } resource "azurerm_subnet" "terraform-management-subnet" { name = "terraform-management-subnet" resource_group_name = azurerm_resource_group.terraform-resource-group.name virtual_network_name = azurerm_virtual_network.terraform-virtual-network.name address_prefixes = [var.management_subnet_address_prefix] } resource "azurerm_subnet" "terraform-server-subnet" { name = "terraform-server-subnet" resource_group_name = azurerm_resource_group.terraform-resource-group.name virtual_network_name = azurerm_virtual_network.terraform-virtual-network.name address_prefixes = [var.server_subnet_address_prefix] } resource "azurerm_subnet" "terraform-client-subnet" { name = "terraform-client-subnet" resource_group_name = azurerm_resource_group.terraform-resource-group.name virtual_network_name = azurerm_virtual_network.terraform-virtual-network.name address_prefixes = [var.client_subnet_address_prefix] } resource "azurerm_subnet_network_security_group_association" "management-subnet-association" { subnet_id = azurerm_subnet.terraform-management-subnet.id network_security_group_id = azurerm_network_security_group.terraform-management-subnet-security-group.id } resource "azurerm_network_security_group" "terraform-management-subnet-security-group" { name = "terraform-management-subnet-security-group" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name } // Allow ssh, http and https from controlling subnet resource "azurerm_network_security_rule" "terraform-allow-all-from-controlling-subnet" { name = "terraform-allow-all-from-controlling-subnet" priority = 1000 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_ranges = ["22", "80", "443"] source_address_prefix = var.controlling_subnet destination_address_prefix = "*" resource_group_name = azurerm_resource_group.terraform-resource-group.name network_security_group_name = azurerm_network_security_group.terraform-management-subnet-security-group.name } resource "azurerm_subnet_network_security_group_association" "client-subnet-association" { subnet_id = azurerm_subnet.terraform-client-subnet.id network_security_group_id = azurerm_network_security_group.terraform-client-subnet-security-group.id } resource "azurerm_network_security_group" "terraform-client-subnet-security-group" { name = "terraform-client-subnet-security-group" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name } // Allow http and https from everywhere resource "azurerm_network_security_rule" "terraform-allow-client-http-from-internet" { name = "terraform-allow-client-http-from-internet" priority = 1000 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_ranges = ["80", "443"] source_address_prefix = "*" destination_address_prefix = "*" resource_group_name = azurerm_resource_group.terraform-resource-group.name network_security_group_name = azurerm_network_security_group.terraform-client-subnet-security-group.name } resource "azurerm_subnet_network_security_group_association" "server-subnet-association" { subnet_id = azurerm_subnet.terraform-server-subnet.id network_security_group_id = azurerm_network_security_group.terraform-server-subnet-security-group.id } resource "azurerm_network_security_group" "terraform-server-subnet-security-group" { name = "terraform-server-subnet-security-group" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name } // Next two rules: Allow server subnet to reply only inside its own subnet resource "azurerm_network_security_rule" "terraform-server-allow-outbound" { name = "terraform-server-allow-subnet-outbound" priority = 1000 direction = "Outbound" access = "Allow" protocol = "*" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefixes = [ azurerm_subnet.terraform-server-subnet.address_prefixes[0], ] resource_group_name = azurerm_resource_group.terraform-resource-group.name network_security_group_name = azurerm_network_security_group.terraform-server-subnet-security-group.name } resource "azurerm_network_security_rule" "terraform-server-deny-all-outbound" { name = "terraform-server-deny-all-outbound" priority = 1010 direction = "Outbound" access = "Deny" protocol = "*" source_port_range = "*" destination_port_range = "*" source_address_prefix = "*" destination_address_prefix = "*" resource_group_name = azurerm_resource_group.terraform-resource-group.name network_security_group_name = azurerm_network_security_group.terraform-server-subnet-security-group.name } resource "azurerm_public_ip" "terraform-ubuntu-public-ip" { name = "terraform-ubuntu-public-ip" resource_group_name = azurerm_resource_group.terraform-resource-group.name location = var.location allocation_method = "Static" } resource "azurerm_network_interface" "terraform-ubuntu-management-interface" { name = "terraform-ubuntu-management-interface" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name ip_configuration { name = "management" subnet_id = azurerm_subnet.terraform-management-subnet.id private_ip_address_allocation = "Dynamic" public_ip_address_id = azurerm_public_ip.terraform-ubuntu-public-ip.id } depends_on = [azurerm_subnet_network_security_group_association.management-subnet-association] } # ubuntu bastion host deployment resource "azurerm_linux_virtual_machine" "terraform-ubuntu-machine" { name = "terraform-ubuntu-bastion-machine" resource_group_name = azurerm_resource_group.terraform-resource-group.name location = var.location size = var.ubuntu_vm_size admin_username = var.ubuntu_admin_user network_interface_ids = [ azurerm_network_interface.terraform-ubuntu-management-interface.id ] admin_ssh_key { username = var.ubuntu_admin_user public_key = file(var.ssh_public_key_file) } os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "18.04-LTS" version = "latest" } } resource "azurerm_public_ip" "terraform-adc-management-public-ip" { name = format("terraform-adc-management-public-ip-node-%v", count.index) resource_group_name = azurerm_resource_group.terraform-resource-group.name location = var.location allocation_method = "Static" count = 2 } resource "azurerm_network_interface" "terraform-adc-management-interface" { name = format("terraform-adc-management-interface-node-%v", count.index) location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name ip_configuration { name = "management" subnet_id = azurerm_subnet.terraform-management-subnet.id private_ip_address_allocation = "Dynamic" public_ip_address_id = element(azurerm_public_ip.terraform-adc-management-public-ip.*.id, count.index) } depends_on = [azurerm_subnet_network_security_group_association.management-subnet-association] count = 2 } resource "azurerm_network_interface" "terraform-adc-client-interface" { name = format("terraform-adc-client-interface-node-%v", count.index) location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name ip_configuration { name = "client" subnet_id = azurerm_subnet.terraform-client-subnet.id private_ip_address_allocation = "Dynamic" } depends_on = [azurerm_subnet_network_security_group_association.client-subnet-association] count = 2 } resource "azurerm_network_interface" "terraform-adc-server-interface" { name = format("terraform-adc-server-interface-node-%v", count.index) location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name ip_configuration { name = "server" subnet_id = azurerm_subnet.terraform-server-subnet.id private_ip_address_allocation = "Dynamic" } depends_on = [azurerm_subnet_network_security_group_association.server-subnet-association] count = 2 } # Primary Citrix ADC instance deployment resource "azurerm_virtual_machine" "terraform-primary-adc-machine" { name = "terraform-adc-machine-node-0" resource_group_name = azurerm_resource_group.terraform-resource-group.name location = var.location vm_size = var.adc_vm_size network_interface_ids = [ azurerm_network_interface.terraform-adc-management-interface[0].id, azurerm_network_interface.terraform-adc-client-interface[0].id, azurerm_network_interface.terraform-adc-server-interface[0].id, ] primary_network_interface_id = azurerm_network_interface.terraform-adc-management-interface[0].id os_profile { computer_name = "Citrix-ADC-VPX-node-0" admin_username = var.adc_admin_username admin_password = var.adc_admin_password custom_data = base64encode(<<-EOF <NS-PRE-BOOT-CONFIG> <NS-CONFIG> set systemparameter -promptString "%u@%s" add ns ip ${azurerm_network_interface.terraform-adc-client-interface[0].private_ip_address} ${cidrnetmask(var.client_subnet_address_prefix)} -type SNIP add ns ip ${azurerm_network_interface.terraform-adc-server-interface[0].private_ip_address} ${cidrnetmask(var.server_subnet_address_prefix)} -type SNIP add ha node 1 ${azurerm_network_interface.terraform-adc-management-interface[1].private_ip_address} -inc ENABLED set ns rpcNode ${azurerm_network_interface.terraform-adc-management-interface[0].private_ip_address} -password ${var.citrixadc_rpc_node_password} -secure YES set ns rpcNode ${azurerm_network_interface.terraform-adc-management-interface[1].private_ip_address} -password ${var.citrixadc_rpc_node_password} -secure YES </NS-CONFIG> </NS-PRE-BOOT-CONFIG> EOF ) } availability_set_id = azurerm_availability_set.terraform-availability-set.id os_profile_linux_config { disable_password_authentication = false ssh_keys { key_data = file(var.ssh_public_key_file) path = format("/home/%v/.ssh/authorized_keys", var.adc_admin_username) } } delete_os_disk_on_termination = true storage_os_disk { name = "terraform-citrixadc-os-disk-node-0" caching = "ReadWrite" managed_disk_type = "Standard_LRS" create_option = "FromImage" } storage_image_reference { publisher = "citrix" offer = "netscalervpx-130" sku = "netscalerbyol" version = "latest" } plan { name = "netscalerbyol" publisher = "citrix" product = "netscalervpx-130" } depends_on = [ azurerm_subnet_network_security_group_association.server-subnet-association, azurerm_subnet_network_security_group_association.client-subnet-association, azurerm_subnet_network_security_group_association.management-subnet-association, azurerm_network_interface_backend_address_pool_association.tf_assoc, azurerm_lb_rule.allow_http, ] } # Secondary Citrix ADC instance deployment resource "azurerm_virtual_machine" "terraform-secondary-adc-machine" { name = "terraform-adc-machine-node-1" resource_group_name = azurerm_resource_group.terraform-resource-group.name location = var.location vm_size = var.adc_vm_size network_interface_ids = [ azurerm_network_interface.terraform-adc-management-interface[1].id, azurerm_network_interface.terraform-adc-client-interface[1].id, azurerm_network_interface.terraform-adc-server-interface[1].id, ] primary_network_interface_id = azurerm_network_interface.terraform-adc-management-interface[1].id os_profile { computer_name = "Citrix-ADC-VPX-node-1" admin_username = var.adc_admin_username admin_password = var.adc_admin_password custom_data = base64encode(<<-EOF <NS-PRE-BOOT-CONFIG> <NS-CONFIG> set systemparameter -promptString "%u@%s" add ns ip ${azurerm_network_interface.terraform-adc-client-interface[1].private_ip_address} ${cidrnetmask(var.client_subnet_address_prefix)} -type SNIP add ns ip ${azurerm_network_interface.terraform-adc-server-interface[1].private_ip_address} ${cidrnetmask(var.server_subnet_address_prefix)} -type SNIP add ha node 1 ${azurerm_network_interface.terraform-adc-management-interface[0].private_ip_address} -inc ENABLED set ns rpcNode ${azurerm_network_interface.terraform-adc-management-interface[0].private_ip_address} -password ${var.citrixadc_rpc_node_password} -secure YES set ns rpcNode ${azurerm_network_interface.terraform-adc-management-interface[1].private_ip_address} -password ${var.citrixadc_rpc_node_password} -secure YES </NS-CONFIG> </NS-PRE-BOOT-CONFIG> EOF ) } availability_set_id = azurerm_availability_set.terraform-availability-set.id os_profile_linux_config { disable_password_authentication = false ssh_keys { key_data = file(var.ssh_public_key_file) path = format("/home/%v/.ssh/authorized_keys", var.adc_admin_username) } } delete_os_disk_on_termination = true storage_os_disk { name = "terraform-citrixadc-os-disk-node-1" caching = "ReadWrite" managed_disk_type = "Standard_LRS" create_option = "FromImage" } storage_image_reference { publisher = "citrix" offer = "netscalervpx-130" sku = "netscalerbyol" version = "latest" } plan { name = "netscalerbyol" publisher = "citrix" product = "netscalervpx-130" } depends_on = [ azurerm_subnet_network_security_group_association.server-subnet-association, azurerm_subnet_network_security_group_association.client-subnet-association, azurerm_subnet_network_security_group_association.management-subnet-association, azurerm_network_interface_backend_address_pool_association.tf_assoc, azurerm_lb_rule.allow_http, azurerm_virtual_machine.terraform-primary-adc-machine, ] } # Azure Load-balancer resource "azurerm_public_ip" "terraform-load-balancer-public-ip" { name = "tf_lb_pubip" resource_group_name = azurerm_resource_group.terraform-resource-group.name location = var.location allocation_method = "Static" } resource "azurerm_network_interface_backend_address_pool_association" "tf_assoc" { network_interface_id = element(azurerm_network_interface.terraform-adc-client-interface.*.id, count.index) ip_configuration_name = "client" backend_address_pool_id = azurerm_lb_backend_address_pool.tf_backend_pool.id count = 2 } resource "azurerm_lb_rule" "allow_http" { loadbalancer_id = azurerm_lb.tf_lb.id name = "LBRule" protocol = "Tcp" frontend_port = 80 backend_port = 80 frontend_ip_configuration_name = "PublicIPAddress" enable_floating_ip = true idle_timeout_in_minutes = 4 load_distribution = "Default" probe_id = azurerm_lb_probe.tf_probe.id backend_address_pool_ids = [azurerm_lb_backend_address_pool.tf_backend_pool.id] } resource "azurerm_lb_backend_address_pool" "tf_backend_pool" { loadbalancer_id = azurerm_lb.tf_lb.id name = "BackEndAddressPool" } resource "azurerm_lb_probe" "tf_probe" { loadbalancer_id = azurerm_lb.tf_lb.id name = "http-probe" port = 9000 protocol = "Tcp" interval_in_seconds = 5 number_of_probes = 2 } resource "azurerm_lb" "tf_lb" { name = "tf_lb" location = var.location resource_group_name = azurerm_resource_group.terraform-resource-group.name sku = "Basic" frontend_ip_configuration { name = "PublicIPAddress" public_ip_address_id = azurerm_public_ip.terraform-load-balancer-public-ip.id } } Example: Deploying a Citrix ADC HA pair as a NetScaler Gateway with LDAP and RADIUS authenticationThis example shows a standardized deployment of a Citrix ADC HA pair as a NetScaler Gateway with LDAP and RADIUS authentication. Needed prerequisites: Two NetScaler ADCs are already provisioned in the same subnet All the necessary certificates for gateway configuration should be present in step2_gateway_ldap_radius folder Example code snippets: # Create a HA pair # add ha node 1 <netscaler2_nsip> resource "citrixadc_hanode" "netscaler1" { hanode_id = 1 ipaddress = var.netscaler2_nsip } # add ha node 1 <netscaler1_nsip> resource "citrixadc_hanode" "netscaler2" { provider = citrixadc.netscaler2 hanode_id = 1 ipaddress = var.netscaler1_nsip depends_on = [citrixadc_hanode.netscaler1] } resource "citrixadc_systemparameter" "netscaler1_ns_prompt" { promptstring = "%u@%s" } resource "citrixadc_systemparameter" "netscaler2_ns_prompt" { provider = citrixadc.netscaler2 promptstring = "%u@%s" } # It is best practice to change the RPC node password # set rpcnode <netscaler1_nsip> -password secretpassword -secure ON resource "citrixadc_nsrpcnode" "netscaler1to1_rpc_node" { ipaddress = var.netscaler1_nsip password = var.rpc_node_password secure = "ON" depends_on = [citrixadc_hanode.netscaler1] } # It is best practice to change the RPC node password resource "citrixadc_nsrpcnode" "netscaler1to2_rpc_node" { ipaddress = var.netscaler2_nsip password = var.rpc_node_password secure = "ON" depends_on = [citrixadc_hanode.netscaler1] } # It is best practice to change the RPC node password resource "citrixadc_nsrpcnode" "netscaler2to1_rpc_node" { provider = citrixadc.netscaler2 ipaddress = var.netscaler1_nsip password = var.rpc_node_password secure = "ON" depends_on = [citrixadc_hanode.netscaler2] } # It is best practice to change the RPC node password resource "citrixadc_nsrpcnode" "netscaler2to2_rpc_node" { provider = citrixadc.netscaler2 ipaddress = var.netscaler2_nsip password = var.rpc_node_password secure = "ON" depends_on = [citrixadc_hanode.netscaler2] }HA pair creation is finished; proceed to the next step. This code snippet is quite long – we want to show a complex example of an IaC-based deployment. # Create the NS Gateway based on the HA pair created earlier resource "citrixadc_nsvpxparam" "tf_nsvpxparam" { cpuyield = "YES" } # set HA node -failSafe ON -maxFlips 3 -maxFlipTime 1200 resource "citrixadc_hanode" "local_node" { hanode_id = 0 //the id of local_node is always 0 failsafe = "ON" maxflips = 3 maxfliptime = 1200 } ############################ # Upload SSL certificates ############################# resource "citrixadc_systemfile" "ns_server_cert" { filename = var.servercertfile_name filelocation = "/nsconfig/ssl/" filecontent = file("${path.module}/${var.servercertfile_name}") } resource "citrixadc_systemfile" "ns_server_key" { filename = var.servekeyfile_name filelocation = "/nsconfig/ssl/" filecontent = file("${path.module}/${var.servekeyfile_name}") } #Intermediate certificates # scp remote_mycoolcompany_com.ca-bundle nsroot@10.0.10.10:/nsconfig/ssl/ # scp remote_mycoolcompany_com.ca-bundle_ic1 nsroot@10.0.10.10:/nsconfig/ssl/ resource "citrixadc_systemfile" "remote_mycoolcompany_com_ca-bundle" { filename = var.intermediate_certificate1_name filelocation = "/nsconfig/ssl/" filecontent = file("${path.module}/${var.intermediate_certificate1_name}") } resource "citrixadc_systemfile" "remote_mycoolcompany_com_ca-bundle_ic1" { filename = var.intermediate_certificate2_name filelocation = "/nsconfig/ssl/" filecontent = file("${path.module}/${var.intermediate_certificate2_name}") } #Gateway certificate and key # scp remote_mycoolcompany_com.crt nsroot@10.0.10.10:/nsconfig/ssl/ # scp "remote.mycoolcompany.com_key3.txt" nsroot@10.0.10.10:/nsconfig/ssl/ resource "citrixadc_systemfile" "remote_mycoolcompany_com_crt" { filename = var.gateway_certfile_name filelocation = "/nsconfig/ssl/" filecontent = file("${path.module}/${var.gateway_certfile_name}") } resource "citrixadc_systemfile" "remote_mycoolcompany_com_key" { filename = var.gateway_keyfile_name filelocation = "/nsconfig/ssl/" filecontent = file("${path.module}/${var.gateway_keyfile_name}") } ############################# # Base configuration ############################# #This command is only for the Primary node # set ns ip 10.0.10.10 -vServer DISABLED -gui SECUREONLY -mgmtAccess ENABLED -restrictAccess ENABLED #This command is only for the Secondary node # set ns ip 10.0.10.11 -vServer DISABLED -gui SECUREONLY -mgmtAccess ENABLED -restrictAccess ENABLED resource "citrixadc_nsip" "nsip_qenzcpieio" { ipaddress = var.snip_ip_address netmask = var.snip_netmask vserver = "DISABLED" gui = "SECUREONLY" mgmtaccess = "ENABLED" restrictaccess = "ENABLED" } # No need as there will be default route associated # resource "citrixadc_route" "route_zluebtokju" { # count = length(var.route) # network = var.route[count.index]["network"] # netmask = var.route[count.index]["netmask"] # gateway = var.route[count.index]["gateway"] # depends_on = [ # citrixadc_nsip.nsip_qenzcpieio # ] # } # #Add SSL certificates # add ssl certKey Intermediate_SSL_certificate -cert remote_mycoolcompany_com.ca-bundle # add ssl certKey Intermediate_SSL_certificate_ic1 -cert remote_mycoolcompany_com.ca-bundle_ic1 # add ssl certKey remote.mycoolcompany.com -cert remote_mycoolcompany_com.crt -key "remote.mycoolcompany.com_key 3.txt" # #Link SSL certificates to intermediate certificates # link ssl certKey Intermediate_SSL_certificate Intermediate_SSL_certificate_ic1 # link ssl certKey remote.mycoolcompany.com Intermediate_SSL_certificate # Above configuration is implemeted in below terraform resource block # Need to check on link ssl certKey Intermediate_SSL_certificate Intermediate_SSL_certificate_ic1 resource "citrixadc_sslcertkey" "sslcertkey_yactrltynp" { #Issuer certificate mismatch certkey = "Intermediate_SSL_certificate" cert = "remote_mycoolcompany_com.ca-bundle" linkcertkeyname = citrixadc_sslcertkey.sslcertkey_todfwaybti.certkey depends_on = [ citrixadc_systemfile.remote_mycoolcompany_com_ca-bundle ] } resource "citrixadc_sslcertkey" "sslcertkey_todfwaybti" { certkey = "Intermediate_SSL_certificate_ic1" cert = "remote_mycoolcompany_com.ca-bundle_ic1" depends_on = [ citrixadc_systemfile.remote_mycoolcompany_com_ca-bundle_ic1 ] } # link ssl certKey remote.mycoolcompany.com Intermediate_SSL_certificate resource "citrixadc_sslcertkey" "tf_sslcertkey" { certkey = "remote.mycoolcompany.com" cert = "remote_mycoolcompany_com.crt" key = "remote.mycoolcompany.com_key3.txt" linkcertkeyname = citrixadc_sslcertkey.sslcertkey_yactrltynp.certkey depends_on = [ citrixadc_systemfile.remote_mycoolcompany_com_crt, citrixadc_systemfile.remote_mycoolcompany_com_key ] } resource "citrixadc_nsfeature" "tf_nsfeature" { cs = true lb = true ssl = true cmp = true sslvpn = true aaa = true rewrite = true responder = true wl = false } resource "citrixadc_nsmode" "tf_nsmode" { l3 = false edge = false } resource "citrixadc_nshttpparam" "tf_nshttpparam" { dropinvalreqs = "ON" markhttp09inval = "ON" } resource "citrixadc_nsparam" "tf_nsparam" { cookieversion = 1 } resource "citrixadc_systemparameter" "tf_systemparameter" { promptstring = var.promptstring maxclient = 40 } resource "citrixadc_systemuser" "tf_systemuser" { username = "ADM-Service-Account" password = "securepassword" externalauth = "DISABLED" } # set system user nsroot -externalAuth DISABLED resource "citrixadc_systemgroup" "tf_systemgroup1" { groupname = var.systemgroup1_name cmdpolicybinding { policyname = "read-only" priority = 100 } } resource "citrixadc_systemgroup" "tf_systemgroup2" { groupname = var.systemgroup2_name cmdpolicybinding { policyname = "operator" priority = 100 } } resource "citrixadc_systemgroup" "tf_systemgroup3" { groupname = var.systemgroup3_name cmdpolicybinding { policyname = "network" priority = 100 } } resource "citrixadc_systemgroup" "tf_systemgroup4" { groupname = var.systemgroup4_name cmdpolicybinding { policyname = "sysadmin" priority = 100 } } resource "citrixadc_systemgroup" "tf_systemgroup5" { groupname = var.systemgroup5_name cmdpolicybinding { policyname = "superuser" priority = 100 } } resource "citrixadc_authenticationldapaction" "tf_authenticationldapaction_Management_LDAP_Server" { name = var.management_authenticationldapaction_name servername = var.management_authenticationldapaction_servername serverport = 636 ldapbase = var.management_authenticationldapaction_ldapbase ldapbinddn = var.management_authenticationldapaction_ldapbinddn ldapbinddnpassword = var.management_authenticationldapaction_ldapbinddnpassword ldaploginname = "sAMAccountName" searchfilter = var.management_authenticationldapaction_searchfilter groupattrname = "memberOf" subattributename = "cn" sectype = "SSL" passwdchange = "ENABLED" } resource "citrixadc_authenticationpolicy" "tf_Management_LDAP_Policy" { name = "Management_LDAP_Policy" rule = "true" action = citrixadc_authenticationldapaction.tf_authenticationldapaction_Management_LDAP_Server.name } resource "citrixadc_systemglobal_authenticationpolicy_binding" "systemglobal__binding_gwtebwywgn" { policyname = citrixadc_authenticationpolicy.tf_Management_LDAP_Policy.name priority = 100 gotopriorityexpression = "NEXT" } resource "citrixadc_nshostname" "tf_nshostname" { hostname = "HA-NetScaler-Pair" } resource "citrixadc_sslparameter" "sslparameter_zhfnbtqegq" { defaultprofile = "ENABLED" } resource "citrixadc_sslcipher" "sslcipher_eogidyupcx" { ciphergroupname = "SSL_Labs_Cipher_Group_Q4_2021" ciphersuitebinding { ciphername = "TLS1.3-AES256-GCM-SHA384" cipherpriority = 1 } ciphersuitebinding { ciphername = "TLS1.3-AES128-GCM-SHA256" cipherpriority = 2 } ciphersuitebinding { ciphername = "TLS1.3-CHACHA20-POLY1305-SHA256" cipherpriority = 3 } ciphersuitebinding { ciphername = "TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384" cipherpriority = 4 } ciphersuitebinding { ciphername = "TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256" cipherpriority = 5 } ciphersuitebinding { ciphername = "TLS1.2-ECDHE-ECDSA-AES256-SHA384" cipherpriority = 6 } ciphersuitebinding { ciphername = "TLS1.2-ECDHE-RSA-AES256-GCM-SHA384" cipherpriority = 7 } } resource "citrixadc_sslprofile" "sslprofile_nezvhaeqqj" { name = "SSL_Labs_Profile_Q4_2021" tls1 = "DISABLED" tls11 = "DISABLED" tls12 = "ENABLED" tls13 = "ENABLED" denysslreneg = "NONSECURE" hsts = "ENABLED" maxage = 157680000 ecccurvebindings = ["P_256", "P_384", "P_224", "P_521"] depends_on = [citrixadc_sslparameter.sslparameter_zhfnbtqegq] } # Replace the ciphers in the SSL profile # unbind ssl profile SSL_Labs_Profile_Q4_2021 -cipherName DEFAULT #not supported # bind ssl profile SSL_Labs_Profile_Q4_2021 -cipherName SSL_Labs_Cipher_Group_Q4_2021 resource "citrixadc_sslprofile_sslcipher_binding" "sslprofile__binding_bydrzyttal" { name = citrixadc_sslprofile.sslprofile_nezvhaeqqj.name #"SSL_Labs_Profile_Q4_2021" ciphername = citrixadc_sslcipher.sslcipher_eogidyupcx.ciphergroupname cipherpriority = 1 } resource "citrixadc_snmpcommunity" "snmpcommunity_nasflquehd" { communityname = var.snmpcommunity_name permissions = "ALL" } resource "citrixadc_snmpmanager" "snmpmanager_kbyotszmda" { ipaddress = var.snmpmanager1_ipaddress netmask = "255.255.255.255" } resource "citrixadc_snmpmanager" "snmpmanager_znnvjqhxnl" { ipaddress = var.snmpmanager2_ipaddress netmask = "255.255.255.255" } resource "citrixadc_snmpalarm" "snmpalarm_dhellhzjiq" { trapname = "CPU-USAGE" thresholdvalue = 80 normalvalue = 35 severity = "Informational" } resource "citrixadc_snmpalarm" "snmpalarm_qiydzhgjub" { trapname = "HA-STATE-CHANGE" severity = "Critical" } resource "citrixadc_snmpalarm" "snmpalarm_jojguqjrzr" { trapname = "MEMORY" thresholdvalue = 80 normalvalue = 35 severity = "Critical" } resource "citrixadc_snmpview" "snmpview_jwytycajii" { name = "all_group_view" subtree = 1 type = "included" } resource "citrixadc_snmpgroup" "snmpgroup_poscxdyegh" { name = "all_group" securitylevel = "authPriv" readviewname = "all_group_view" } resource "citrixadc_snmpuser" "snmpuser_moivcqwmvb" { name = var.snmpuser_name group = "all_group" authtype = "SHA" authpasswd = var.snmpuser_authpasswd privtype = "AES" privpasswd = var.snmpuser_privpasswd } resource "citrixadc_snmptrap" "snmptrap_bpldwoskfn" { trapclass = "generic" trapdestination = var.snmptrap1_trapdestination version = "V3" } resource "citrixadc_snmptrap" "snmptrap_mquunqimgl" { trapclass = "generic" trapdestination = var.snmptrap2_trapdestination version = "V3" } resource "citrixadc_snmptrap_snmpuser_binding" "snmptrap__binding_rkcthyuxwg" { trapclass = citrixadc_snmptrap.snmptrap_bpldwoskfn.trapclass trapdestination = citrixadc_snmptrap.snmptrap_bpldwoskfn.trapdestination username = citrixadc_snmpuser.snmpuser_moivcqwmvb.name securitylevel = "authPriv" } resource "citrixadc_snmptrap_snmpuser_binding" "snmptrap__binding_cwvuxvrjvn" { trapclass = citrixadc_snmptrap.snmptrap_mquunqimgl.trapclass trapdestination = citrixadc_snmptrap.snmptrap_mquunqimgl.trapdestination username = citrixadc_snmpuser.snmpuser_moivcqwmvb.name securitylevel = "authPriv" } resource "citrixadc_auditsyslogaction" "auditsyslogaction_mgiickzjzf" { name = var.auditsyslogaction_name serverip = var.auditsyslogaction_serverip loglevel = ["EMERGENCY", "ALERT", "CRITICAL", "ERROR", "WARNING"] acl = "ENABLED" timezone = "LOCAL_TIME" userdefinedauditlog = "YES" } resource "citrixadc_auditsyslogpolicy" "auditsyslogpolicy_itefscdolv" { name = "Syslog-Policy-1" #Syslog Policy 1 rule = "true" action = citrixadc_auditsyslogaction.auditsyslogaction_mgiickzjzf.name } # #Globally bind the Syslog Policy resource "citrixadc_auditsyslogglobal_auditsyslogpolicy_binding" "auditsyslogglobal__binding_kqxnpyfgzd" { policyname = citrixadc_auditsyslogpolicy.auditsyslogpolicy_itefscdolv.name priority = 100 } ############################# # Create Load Balancers and configure DNS ############################# resource "citrixadc_server" "server_sqztnaumda" { name = var.dns_server1_ipaddress ipaddress = var.dns_server1_ipaddress } resource "citrixadc_server" "server_wsadkcqflz" { name = var.dns_server2_ipaddress ipaddress = var.dns_server2_ipaddress } resource "citrixadc_server" "server_pfutrwnpwf" { name = var.server3_ipaddress ipaddress = var.server3_ipaddress } resource "citrixadc_server" "server_pxjminslbl" { name = var.storefront_server1_ipaddress ipaddress = var.storefront_server1_ipaddress } resource "citrixadc_server" "server_zbsxvzdore" { name = var.storefront_server2_ipaddress ipaddress = var.storefront_server2_ipaddress } resource "citrixadc_server" "server_jynqmiwzru" { name = var.ldap_server1_ipaddress ipaddress = var.ldap_server1_ipaddress } resource "citrixadc_server" "server_airvursjkh" { name = var.ldap_server2_ipaddress ipaddress = var.ldap_server2_ipaddress } resource "citrixadc_server" "server_hjbevwqkdv" { name = var.radius_server_ipaddress ipaddress = var.radius_server_ipaddress } resource "citrixadc_servicegroup" "servicegroup_eumxhmjuac" { servicegroupname = "DNS_TCP_SVG" servicetype = "DNS_TCP" maxclient = "0" maxreq = "0" cip = "DISABLED" usip = "NO" useproxyport = "YES" clttimeout = 180 svrtimeout = 360 cka = "NO" tcpb = "NO" cmp = "NO" } resource "citrixadc_servicegroup" "servicegroup_chxikudgsk" { servicegroupname = "DNS_UDP_SVG" servicetype = "DNS" maxclient = "0" maxreq = "0" cip = "DISABLED" usip = "NO" useproxyport = "NO" clttimeout = 120 svrtimeout = 120 cka = "NO" tcpb = "NO" cmp = "NO" } resource "citrixadc_servicegroup" "servicegroup_ahpzkekxep" { servicegroupname = "StoreFront_SVG" servicetype = "SSL" maxclient = "0" maxreq = "0" cip = "DISABLED" usip = "NO" useproxyport = "YES" clttimeout = 180 svrtimeout = 360 cka = "NO" tcpb = "NO" cmp = "YES" } resource "citrixadc_servicegroup" "servicegroup_vvvkkztink" { servicegroupname = "LDAP_SVG" servicetype = "TCP" maxclient = "0" maxreq = "0" cip = "DISABLED" usip = "NO" useproxyport = "YES" clttimeout = 9000 svrtimeout = 9000 cka = "NO" tcpb = "NO" cmp = "NO" } resource "citrixadc_servicegroup" "servicegroup_ndsbbzqxlp" { servicegroupname = "LDAP_TLS_Offload_SVG" servicetype = "SSL_TCP" maxclient = "0" maxreq = "0" cip = "DISABLED" usip = "NO" useproxyport = "YES" clttimeout = 9000 svrtimeout = 9000 cka = "NO" tcpb = "NO" cmp = "NO" } resource "citrixadc_servicegroup" "servicegroup_pkmvqajaxw" { servicegroupname = "RADIUS_SVG" servicetype = "RADIUS" maxclient = "0" maxreq = "0" cip = "DISABLED" usip = "NO" useproxyport = "NO" clttimeout = 120 svrtimeout = 120 cka = "NO" tcpb = "NO" cmp = "NO" } resource "citrixadc_lbvserver" "dns_tcp_lbvserver" { name = var.dns_tcp_lbvserver_name servicetype = var.dns_tcp_lbvserver_servicetype ipv46 = var.dns_tcp_lbvserver_ipv46 persistencetype = "NONE" clttimeout = 180 } resource "citrixadc_lbvserver" "dns_udp_lbvserver" { name = var.dns_udp_lbvserver_name servicetype = var.dns_udp_lbvserver_servicetype ipv46 = var.dns_udp_lbvserver_ipv46 persistencetype = "NONE" clttimeout = 120 } resource "citrixadc_lbvserver" "lbvserver_ymgredddqh" { name = var.storefront_lbvserver_name servicetype = var.storefront_lbvserver_servicetype ipv46 = var.storefront_lbvserver_ipv46 port = 443 persistencetype = "COOKIEINSERT" clttimeout = 180 } resource "citrixadc_lbvserver" "lbvserver_pfxwimkyah" { name = var.ldap_lbvserver_name servicetype = var.ldap_lbvserver_servicetype ipv46 = var.ldap_lbvserver_ipv46 port = 636 persistencetype = "SOURCEIP" clttimeout = 9000 } resource "citrixadc_lbvserver" "lbvserver_aretuuhedg" { name = var.ldap_tls_offload_lbvserver_name servicetype = var.ldap_tls_offload_lbvserver_servicetype ipv46 = var.ldap_tls_offload_lbvserver_ipv46 port = 637 persistencetype = "SOURCEIP" clttimeout = 9000 } resource "citrixadc_lbvserver" "lbvserver_ewlwbfnjnk" { name = var.radius_lbvserver_name servicetype = var.radius_lbvserver_servicetype ipv46 = var.radius_lbvserver_ipv46 port = 1812 persistencetype = "RULE" lbmethod = "TOKEN" rule = "CLIENT.UDP.RADIUS.USERNAME" clttimeout = 120 } resource "citrixadc_lbvserver_servicegroup_binding" "lbvserver__binding_wegcwdmyfm" { name = citrixadc_lbvserver.dns_tcp_lbvserver.name # "DNS_TCP_LB" servicegroupname = citrixadc_servicegroup.servicegroup_eumxhmjuac.servicegroupname #"DNS_TCP_SVG" } resource "citrixadc_lbvserver_servicegroup_binding" "lbvserver__binding_knazcgzimi" { name = citrixadc_lbvserver.dns_udp_lbvserver.name #"DNS_UDP_LB" servicegroupname = citrixadc_servicegroup.servicegroup_chxikudgsk.servicegroupname #"DNS_UDP_SVG" } resource "citrixadc_lbvserver_servicegroup_binding" "lbvserver__binding_nlsolummnp" { name = citrixadc_lbvserver.lbvserver_ymgredddqh.name #"StoreFront_LB" servicegroupname = citrixadc_servicegroup.servicegroup_ahpzkekxep.servicegroupname #"StoreFront_SVG" } resource "citrixadc_lbvserver_servicegroup_binding" "lbvserver__binding_kiccugrtpf" { name = citrixadc_lbvserver.lbvserver_pfxwimkyah.name #"LDAP_LB" servicegroupname = citrixadc_servicegroup.servicegroup_vvvkkztink.servicegroupname #"LDAP_SVG" } resource "citrixadc_lbvserver_servicegroup_binding" "lbvserver__binding_pzxtoylktl" { name = citrixadc_lbvserver.lbvserver_aretuuhedg.name #"LDAP_TLS_Offload_LB" servicegroupname = citrixadc_servicegroup.servicegroup_ndsbbzqxlp.servicegroupname #"LDAP_TLS_Offload_SVG" } resource "citrixadc_lbvserver_servicegroup_binding" "lbvserver__binding_lkhrkfmmmm" { name = citrixadc_lbvserver.lbvserver_ewlwbfnjnk.name #"RADIUS_LB" servicegroupname = citrixadc_servicegroup.servicegroup_pkmvqajaxw.servicegroupname #"RADIUS_SVG" } resource "citrixadc_lbmonitor" "lbmonitor_hcfaaeslbw" { monitorname = var.dns_tcp_lbmonitor_name type = var.dns_tcp_lbmonitor_type query = var.dns_tcp_lbmonitor_query querytype = "Address" lrtm = "DISABLED" interval = 6 resptimeout = 3 downtime = 20 destport = 53 } resource "citrixadc_lbmonitor" "lbmonitor_chovwassas" { monitorname = var.dns_udp_lbmonitor_name type = var.dns_udp_lbmonitor_type query = var.dns_udp_lbmonitor_query querytype = "Address" lrtm = "DISABLED" interval = 6 resptimeout = 3 downtime = 20 destport = 53 } resource "citrixadc_lbmonitor" "lbmonitor_trnqrgntrg" { monitorname = var.storefront_lbmonitor_name type = var.storefront_lbmonitor_type scriptname = "nssf.pl" dispatcherip = var.storefront_lbmonitor_dispatcherip dispatcherport = 3013 lrtm = "DISABLED" interval = 30 resptimeout = 5 downtime = 20 secure = "YES" storename = var.storefront_lbmonitor_storename } resource "citrixadc_lbmonitor" "lbmonitor_uizgmebaiu" { monitorname = var.ldap_lbmonitor_name type = var.ldap_lbmonitor_type scriptname = "nsldap.pl" dispatcherip = var.ldap_lbmonitor_dispatcherip dispatcherport = 3013 password = var.ldap_lbmonitor_password secure = "YES" basedn = var.ldap_lbmonitor_basedn binddn = var.ldap_lbmonitor_binddn filter = var.ldap_lbmonitor_filter } resource "citrixadc_lbmonitor" "lbmonitor_swzbkbrwrr" { monitorname = var.radius_lbmonitor_name type = var.radius_lbmonitor_type respcode = ["3"] username = var.radius_lbmonitor_username password = var.radius_lbmonitor_password radkey = var.radius_lbmonitor_radkey lrtm = "DISABLED" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_hxwtyofwtm" { servicegroupname = citrixadc_servicegroup.servicegroup_eumxhmjuac.servicegroupname #"DNS_TCP_SVG" ip = citrixadc_server.server_sqztnaumda.ipaddress #"8.8.8.8" port = 53 weight = "10" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_pzsbmgfxsq" { servicegroupname = citrixadc_servicegroup.servicegroup_eumxhmjuac.servicegroupname #"DNS_TCP_SVG" ip = citrixadc_server.server_wsadkcqflz.ipaddress #"1.1.1.1" port = 53 weight = "10" } resource "citrixadc_servicegroup_lbmonitor_binding" "servicegroup__binding_encckgfcuq" { servicegroupname = citrixadc_servicegroup.servicegroup_eumxhmjuac.servicegroupname #"DNS_TCP_SVG" monitorname = citrixadc_lbmonitor.lbmonitor_hcfaaeslbw.monitorname #"DNS_TCP_monitor" weight = "80" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_dunulodvsu" { servicegroupname = citrixadc_servicegroup.servicegroup_chxikudgsk.servicegroupname #"DNS_UDP_SVG" ip = citrixadc_server.server_sqztnaumda.ipaddress #"8.8.8.8" port = 53 weight = "10" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_ddikktifmu" { servicegroupname = citrixadc_servicegroup.servicegroup_chxikudgsk.servicegroupname #"DNS_UDP_SVG" ip = citrixadc_server.server_wsadkcqflz.ipaddress #"1.1.1.1" port = 53 weight = "10" } resource "citrixadc_servicegroup_lbmonitor_binding" "servicegroup__binding_dbwtlpttjz" { servicegroupname = citrixadc_servicegroup.servicegroup_chxikudgsk.servicegroupname #"DNS_UDP_SVG" monitorname = citrixadc_lbmonitor.lbmonitor_chovwassas.monitorname #"DNS_UDP_monitor" weight = "80" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_jfgnghruur" { servicegroupname = citrixadc_servicegroup.servicegroup_ahpzkekxep.servicegroupname #"StoreFront_SVG" ip = citrixadc_server.server_zbsxvzdore.ipaddress #"192.168.3.31" port = 443 } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_oejyktuylb" { servicegroupname = citrixadc_servicegroup.servicegroup_ahpzkekxep.servicegroupname #"StoreFront_SVG" ip = citrixadc_server.server_pxjminslbl.ipaddress #"192.168.3.30" port = 443 } resource "citrixadc_servicegroup_lbmonitor_binding" "servicegroup__binding_oaemujffdq" { servicegroupname = citrixadc_servicegroup.servicegroup_ahpzkekxep.servicegroupname #"StoreFront_SVG" monitorname = citrixadc_lbmonitor.lbmonitor_trnqrgntrg.monitorname #"StoreFront_monitor" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_uqjotkmwph" { servicegroupname = citrixadc_servicegroup.servicegroup_vvvkkztink.servicegroupname #"LDAP_SVG" ip = citrixadc_server.server_airvursjkh.ipaddress #"192.168.3.11" port = 636 } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_ebmkappfpg" { servicegroupname = citrixadc_servicegroup.servicegroup_vvvkkztink.servicegroupname #"LDAP_SVG" ip = citrixadc_server.server_jynqmiwzru.ipaddress #"192.168.3.10" port = 636 } resource "citrixadc_servicegroup_lbmonitor_binding" "servicegroup__binding_apzkavrvpq" { servicegroupname = citrixadc_servicegroup.servicegroup_vvvkkztink.servicegroupname #"LDAP_SVG" monitorname = citrixadc_lbmonitor.lbmonitor_uizgmebaiu.monitorname #"LDAP_MON" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_sdfgertyui" { servicegroupname = citrixadc_servicegroup.servicegroup_ndsbbzqxlp.servicegroupname #"LDAP_TLS_Offload_SVG" ip = citrixadc_server.server_airvursjkh.ipaddress #"192.168.3.11" port = 636 } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_sertfergwt" { servicegroupname = citrixadc_servicegroup.servicegroup_ndsbbzqxlp.servicegroupname #"LDAP_TLS_Offload_SVG" ip = citrixadc_server.server_jynqmiwzru.ipaddress #"192.168.3.10" port = 636 } resource "citrixadc_servicegroup_lbmonitor_binding" "servicegroup__binding_qlcdvznpfp" { servicegroupname = citrixadc_servicegroup.servicegroup_ndsbbzqxlp.servicegroupname #"LDAP_TLS_Offload_SVG" monitorname = citrixadc_lbmonitor.lbmonitor_uizgmebaiu.monitorname #"LDAP_MON" } resource "citrixadc_servicegroup_servicegroupmember_binding" "servicegroup__binding_xiwzfksboa" { servicegroupname = citrixadc_servicegroup.servicegroup_pkmvqajaxw.servicegroupname #"RADIUS_SVG" ip = citrixadc_server.server_hjbevwqkdv.ipaddress #"192.168.3.20" port = 1812 } resource "citrixadc_servicegroup_lbmonitor_binding" "servicegroup__binding_kyofxsqqgl" { servicegroupname = citrixadc_servicegroup.servicegroup_pkmvqajaxw.servicegroupname #"RADIUS_SVG" monitorname = citrixadc_lbmonitor.lbmonitor_swzbkbrwrr.monitorname #"RADIUS_MON" } resource "citrixadc_sslvserver_sslcertkey_binding" "sslvserver__binding_cavebdpwll" { vservername = citrixadc_lbvserver.lbvserver_ymgredddqh.name #"StoreFront_LB" certkeyname = citrixadc_sslcertkey.tf_sslcertkey.certkey #"remote.mycoolcompany.com" } resource "citrixadc_dnsnameserver" "dnsnameserver_qxduquwhhh" { dnsvservername = citrixadc_lbvserver.dns_udp_lbvserver.name #"DNS_UDP_LB" } resource "citrixadc_dnsnameserver" "dnsnameserver_ufzjtabuhu" { dnsvservername = citrixadc_lbvserver.dns_tcp_lbvserver.name #"DNS_TCP_LB" type = "TCP" } ############################# # Create the AAA and Gateway vServers ############################# resource "citrixadc_ntpserver" "tf_ntpserver0" { servername = "0.pool.ntp.org" } resource "citrixadc_ntpserver" "tf_ntpserver1" { servername = "1.pool.ntp.org" } resource "citrixadc_ntpsync" "tf_ntpsync" { state = "ENABLED" } resource "citrixadc_authenticationauthnprofile" "authenticationauthnprofile_ktfhymohui" { name = "Gateway_Auth_vServer_Profile" authnvsname = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" } resource "citrixadc_authenticationvserver" "authenticationvserver_ztlrjkpdpv" { name = "Gateway_Auth_vServer" servicetype = "SSL" ipv46 = "0.0.0.0" } resource "citrixadc_sslvserver_sslcertkey_binding" "sslvserver__binding_rzcbmamxes" { vservername = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" certkeyname = citrixadc_sslcertkey.tf_sslcertkey.certkey #"remote.mycoolcompany.com" } #Apply default AAA vServer policies # These are the default bindings that are already present in NetScaler, So we can't implement it # resource "citrixadc_authenticationvserver_cachepolicy_binding" "authenticationvserver__binding_rvxuncxaaq" { # name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" # policy = "_cacheTCVPNStaticObjects" # priority = "10" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_authenticationvserver_cachepolicy_binding" "authenticationvserver__binding_linqrlpevp" { # name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" # policy = "_cacheOCVPNStaticObjects" # priority = "20" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_authenticationvserver_cachepolicy_binding" "authenticationvserver__binding_wgwcqnznie" { # name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" # policy = "_cacheVPNStaticObjects" # priority = "30" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_authenticationvserver_cachepolicy_binding" "authenticationvserver__binding_pakbnjojvp" { # name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" # policy = "_cacheWFStaticObjects" # priority = "10" # gotopriorityexpression = "END" # bindpoint = "RESPONSE" # } # resource "citrixadc_authenticationvserver_cachepolicy_binding" "authenticationvserver__binding_asdfghjwer" { # name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" # policy = "_mayNoCacheReq" # priority = "40" # gotopriorityexpression = "END" # bindpoint = "RESPONSE" # } # resource "citrixadc_authenticationvserver_cachepolicy_binding" "authenticationvserver__binding_rtyughjvbn" { # name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" # policy = "_noCacheRest" # priority = "20" # gotopriorityexpression = "END" # bindpoint = "RESPONSE" # } resource "citrixadc_authenticationldapaction" "authenticationldapaction_opktkswlqh" { name = var.gateway_authenticationldapaction_name servername = var.gateway_authenticationldapaction_servername serverport = 637 ldapbase = var.gateway_authenticationldapaction_ldapbase ldapbinddn = var.gateway_authenticationldapaction_ldapbinddn ldapbinddnpassword = var.gateway_authenticationldapaction_ldapbinddnpassword ldaploginname = "sAMAccountName" groupattrname = "memberOf" subattributename = "cn" ssonameattribute = "UserPrincipalName" passwdchange = "ENABLED" } resource "citrixadc_authenticationradiusaction" "authenticationradiusaction_cqxcxdvlum" { name = var.authenticationradiusaction_name serverip = var.authenticationradiusaction_serverip serverport = 1812 radkey = var.authenticationradiusaction_radkey } resource "citrixadc_authenticationpolicy" "authenticationpolicy_bttsismyrq" { name = "Gateway_RADIUS_Policy" rule = "true" action = citrixadc_authenticationradiusaction.authenticationradiusaction_cqxcxdvlum.name #"Gateway_RADIUS_Server" } resource "citrixadc_authenticationpolicy" "authenticationpolicy_kzfdrxegbm" { name = "Gateway_LDAP_Policy" rule = "true" action = citrixadc_authenticationldapaction.authenticationldapaction_opktkswlqh.name #"Gateway_LDAP_Server" } resource "citrixadc_authenticationpolicylabel" "authenticationpolicylabel_dedfgsgtiy" { labelname = "Gateway_LDAP_Policy_Label" loginschema = citrixadc_authenticationloginschema.authenticationloginschema_uzyekmkszy.name #LSCHEMA_INT_new # created new login schema } resource "citrixadc_authenticationvserver_authenticationloginschemapolicy_binding" "authenticationvserver__binding_czgdiinyld" { name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" policy = citrixadc_authenticationloginschemapolicy.lschema_dual_factor_builtin_new_policy.name #"lschema_dual_factor_builtin_new" # created new login schema priority = "100" gotopriorityexpression = "END" } resource "citrixadc_authenticationpolicylabel_authenticationpolicy_binding" "authenticationpolicylabel__binding_ikyceqhvtp" { labelname = citrixadc_authenticationpolicylabel.authenticationpolicylabel_dedfgsgtiy.labelname #"Gateway_LDAP_Policy_Label" policyname = citrixadc_authenticationpolicy.authenticationpolicy_kzfdrxegbm.name #"Gateway_LDAP_Policy" priority = "100" gotopriorityexpression = "NEXT" } resource "citrixadc_authenticationvserver_authenticationpolicy_binding" "citrixadc_authenticationvserver__binding_fgghhnbvcc" { name = citrixadc_authenticationvserver.authenticationvserver_ztlrjkpdpv.name #"Gateway_Auth_vServer" policy = citrixadc_authenticationpolicy.authenticationpolicy_bttsismyrq.name #"Gateway_RADIUS_Policy" priority = "100" gotopriorityexpression = "NEXT" nextfactor = citrixadc_authenticationpolicylabel.authenticationpolicylabel_dedfgsgtiy.labelname #Gateway_LDAP_Policy_Label } # set authentication loginSchema LSCHEMA_INT -authenticationSchema noschema -passwdExpression AAA.LOGIN.PASSWORD resource "citrixadc_authenticationloginschema" "authenticationloginschema_uzyekmkszy" { name = "LSCHEMA_INT_new" authenticationschema = "noschema" passwdexpression = "AAA.LOGIN.PASSWORD" } # set authentication loginSchema lschema_dual_factor_builtin -authenticationSchema "LoginSchema/DualAuth.xml" -passwdExpression AAA.LOGIN.PASSWORD2 resource "citrixadc_authenticationloginschema" "authenticationloginschema_pdnomdjvyw" { name = "lschema_dual_factor_builtin_new" authenticationschema = "LoginSchema/DualAuth.xml" passwdexpression = "AAA.LOGIN.PASSWORD2" } resource "citrixadc_authenticationloginschemapolicy" "lschema_dual_factor_builtin_new_policy" { name = "lschema_dual_factor_builtin_new" rule = "true" action = citrixadc_authenticationloginschema.authenticationloginschema_pdnomdjvyw.name } resource "citrixadc_vpnvserver" "vpnvserver_rwcwpgwfgn" { name = var.gateway_vpnvserver_name servicetype = var.gateway_vpnvserver_servicetype ipv46 = var.gateway_vpnvserver_ipv46 port = 443 dtls = "OFF" downstateflush = "DISABLED" listenpolicy = "NONE" authnprofile = citrixadc_authenticationauthnprofile.authenticationauthnprofile_ktfhymohui.name #"Gateway_Auth_vServer_Profile" depends_on = [ citrixadc_sslprofile.sslprofile_nezvhaeqqj ] } # set ssl vserver Gateway_vServer -sslProfile SSL_Labs_Profile_Q4_2021 resource "citrixadc_sslvserver" "sslvserver_izprawjoeg" { vservername = citrixadc_vpnvserver.vpnvserver_rwcwpgwfgn.name #"Gateway_vServer" sslprofile = citrixadc_sslprofile.sslprofile_nezvhaeqqj.name #"SSL_Labs_Profile_Q4_2021" } resource "citrixadc_sslvserver_sslcertkey_binding" "sslvserver__binding_gyfoaqaitg" { vservername = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" certkeyname = citrixadc_sslcertkey.tf_sslcertkey.certkey #"remote.mycoolcompany.com" } resource "citrixadc_vpnsessionaction" "vpnsessionaction_vjgcvhrdrz" { name = var.vpnsessionaction1_name defaultauthorizationaction = "ALLOW" sso = "ON" ssocredential = "PRIMARY" icaproxy = "ON" wihome = var.vpnsessionaction1_wihome storefronturl = var.vpnsessionaction1_storefronturl } resource "citrixadc_vpnsessionaction" "vpnsessionaction_pwvhwkswnw" { name = var.vpnsessionaction2_name defaultauthorizationaction = "ALLOW" sso = "ON" ssocredential = "PRIMARY" icaproxy = "ON" wihome = var.vpnsessionaction2_wihome } resource "citrixadc_vpnsessionpolicy" "vpnsessionpolicy_scsugkktws" { name = var.vpnsessionpolicy1_name rule = var.vpnsessionpolicy1_rule action = citrixadc_vpnsessionaction.vpnsessionaction_vjgcvhrdrz.name #"Native_Profile" } resource "citrixadc_vpnsessionpolicy" "vpnsessionpolicy_kssyvgzcxs" { name = var.vpnsessionpolicy2_name rule = var.vpnsessionpolicy2_rule action = citrixadc_vpnsessionaction.vpnsessionaction_pwvhwkswnw.name #"Web_Profile" } resource "citrixadc_vpnvserver_staserver_binding" "vpnvserver__binding_uxhsocvixy" { count = length(var.vpnvserver_staserver) name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" staserver = var.vpnvserver_staserver[count.index] } # These are the default bindings that are already present in NetScaler, So we can't implement it # resource "citrixadc_vpnvserver_cachepolicy_binding" "vpnvserver__binding_bwkemtdbxa" { # name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" # policy = "_cacheTCVPNStaticObjects" # priority = "10" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_vpnvserver_cachepolicy_binding" "vpnvserver__binding_ybeqyvijdg" { # name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" # policy = "_cacheOCVPNStaticObjects" # priority = "20" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_vpnvserver_cachepolicy_binding" "vpnvserver__binding_xolgcloktl" { # name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" # policy = "_cacheVPNStaticObjects" # priority = "30" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_vpnvserver_cachepolicy_binding" "vpnvserver__binding_qvwjfdjbsf" { # name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" # policy = "_mayNoCacheReq" # priority = "40" # gotopriorityexpression = "END" # bindpoint = "REQUEST" # } # resource "citrixadc_vpnvserver_cachepolicy_binding" "vpnvserver__binding_cudcutilur" { # name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" # policy = "_cacheWFStaticObjects" # priority = "10" # gotopriorityexpression = "END" # bindpoint = "RESPONSE" # } # resource "citrixadc_vpnvserver_cachepolicy_binding" "vpnvserver__binding_uanbnbckso" { # name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" # policy = "_noCacheRest" # priority = "20" # gotopriorityexpression = "END" # bindpoint = "RESPONSE" # } resource "citrixadc_vpnvserver_vpnsessionpolicy_binding" "vpnvserver__binding_koafozsiot" { name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" policy = citrixadc_vpnsessionpolicy.vpnsessionpolicy_scsugkktws.name #"Native_Policy" priority = "10" gotopriorityexpression = "NEXT" bindpoint = "REQUEST" } resource "citrixadc_vpnvserver_vpnsessionpolicy_binding" "vpnvserver__binding_pqoxtwuojy" { name = citrixadc_sslvserver.sslvserver_izprawjoeg.vservername #"Gateway_vServer" policy = citrixadc_vpnsessionpolicy.vpnsessionpolicy_kssyvgzcxs.name #"Web_Policy" priority = "20" gotopriorityexpression = "NEXT" bindpoint = "REQUEST" } resource "citrixadc_vpnvserver" "vpnvserver_toqdaseefd" { name = var.gateway_dtls_vpnvserver_name servicetype = var.gateway_dtls_vpnvserver_servicetype ipv46 = var.gateway_dtls_vpnvserver_ipv46 port = 443 downstateflush = "DISABLED" } resource "citrixadc_sslvserver_sslcertkey_binding" "sslvserver__binding_ekimchexvk" { vservername = citrixadc_vpnvserver.vpnvserver_toqdaseefd.name #"Gateway_DTLS_vServer" certkeyname = citrixadc_sslcertkey.tf_sslcertkey.certkey #"remote.mycoolcompany.com" } Citrix ADC & Citrix ADM Ansible ModulesThe collection provides Ansible modules for configuring and managing NetScaler ADC appliances. The modules are written using the NITRO API. The modules are idempotent and can be used to declaratively configure NetScaler ADC appliances. All Citrix ADC form factors are supported. Note You can find lots of examples of using Ansible for configuring basic ADC operations or ADC use cases in the GitHub repository https://github.com/netscaler/ansible-collection-netscaleradc/tree/citrix.adc. Important The Ansible modules are intended for configuring existing ADC instances, not for deploying them. The ADC deployment can be achieved using Terraform. List of all the resources and whether they are supported or not: Total number of resources: 947 Total number of supported resources: 947 Total number of unsupported resources: 0 Percentage of supported resources: 100.0% Playbook DetailsThis is how a typical playbook in the netscaler.adc collection looks like: - name: Name of the playbook hosts: demo_netscalers gather_facts: false # Since the module runs on localhost, we don't need to gather facts module_defaults: # If we are using `module_defaults`, then these common arguments (`nsip`, `nitro_user`, etc) can be skipped from the tasks below. group/netscaler.adc.default_args: nsip: 10.10.10.10 nitro_user: nsroot nitro_pass: verysecretpassword nitro_protocol: http validate_certs: false save_config: false netscaler_console_as_proxy_server: true managed_netscaler_instance_name: my_instance managed_netscaler_instance_id: 1234 managed_netscaler_instance_ip: 1.1.1.1 managed_netscaler_instance_username: my_user managed_netscaler_instance_password: my_password tasks: - name: Name of the task delegate_to: localhost # Since the module runs on localhost, we need to delegate the task to localhost netscaler.adc.service: # Name of the module. We recommend to use the fully qualified name of the module # The following are the NITRO authentication parameters. Refer to the module documentation for the list of supported parameters. nsip: 10.0.0.1 # This can also be given via NETSCALER_NSIP environment variable nitro_user: nitrouser # This can also be given via NETSCALER_NITRO_USER environment variable nitro_pass: verysecretpassword # This can also be given via NETSCALER_NITRO_PASS environment variable nitro_protocol: https # This can also be given via NETSCALER_NITRO_PROTOCOL environment variable validate_certs: false # This can also be given via NETSCALER_VALIDATE_CERTS environment variable # NetScaler Console as an API Proxy Server. This is optional. Default is false. # Refer: https://docs.netscaler.com/en-us/netscaler-application-delivery-management-software/current-release/adm-as-api-proxy-server.html netscaler_console_as_proxy_server: true # This can also be given via NETSCALER_CONSOLE_AS_PROXY_SERVER environment variable # When you want NetScaler Console to forward a request to a managed netscaler instance, add ANY ONE of the below parameters. managed_netscaler_instance_name: my_instance # This can also be given via NETSCALER_MANAGED_NETSCALER_INSTANCE_NAME environment variable managed_netscaler_instance_id: 1234 # This can also be given via NETSCALER_MANAGED_NETSCALER_INSTANCE_ID environment variable managed_netscaler_instance_ip: 1.1.1.1 # This can also be given via NETSCALER_MANAGED_NETSCALER_INSTANCE_IP environment variable # In Settings > Administration > System Configurations > Basic Settings, if you select Prompt Credentials for Instance Login, ensure to configure user name and password of a managed instance. Alternatively, you can also specify the instance session ID. managed_netscaler_instance_username: my_user # This can also be given via NETSCALER_MANAGED_NETSCALER_INSTANCE_USERNAME environment variable managed_netscaler_instance_password: my_password # This can also be given via NETSCALER_MANAGED_NETSCALER_INSTANCE_PASSWORD environment variable # Should the module save the config after making the changes. This is optional. Default is false. save_config: false # This can also be given via NETSCALER_SAVE_CONFIG environment variable state: present # This is the desired state of the resource. The module will make sure that the resource is in this state. Valid values are `present`, `absent`, `enabled`, `disabled`, `imported`, `unset`, `created`, `flushed`, `switched`. However, not all modules support all the states. Refer to the module documentation for the supported states. # The following are the module parameters. Refer to the module documentation for the list of supported parameters. name: s1 ipaddress: 10.10.10.10 servicetype: HTTP port: 80All NetScaler resources can be managed by the Netscaler Ansible collection. Let´s have a look at some day-to-day-used resources: Example: Configuring an LB vserverThis example shows all the needed Ansible modules for configuring a new LB vserver. It can serve as the baseline for all subsequent configurations and use cases. You can find the whole script and variables in the GitHub repository. lbserver.yaml --- - name: Sample lbvserver playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure lbvserver delegate_to: localhost netscaler.adc.lbvserver: state: present name: lb_dns_01 servicetype: DNS ipv46: 169.254.100.2 port: 53 persistencetype: NONE clttimeout: 120lbserverservicebinding.yaml --- - name: Sample lbvserver_service_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure lbvserver_service_binding delegate_to: localhost netscaler.adc.lbvserver_service_binding: state: present name: lb_dns_01 servicename: dns_svc_03lbserverservicegroupbinding.yaml --- - name: Sample lbvserver_servicegroup_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure lbvserver_servicegroup_binding delegate_to: localhost netscaler.adc.lbvserver_servicegroup_binding: state: present name: CR_cachev21 servicename: CR_SVGlbserver_responderpolicy_binding.yaml --- - name: Sample lbvserver_responderpolicy_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure lbvserver_responderpolicy_binding delegate_to: localhost netscaler.adc.lbvserver_responderpolicy_binding: state: present name: v666 policyname: P1 priority: '5' bindpoint: REQUESTlbserverrewritepolicybinding.yaml --- - name: Sample lbvserver_rewritepolicy_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure lbvserver_rewritepolicy_binding delegate_to: localhost netscaler.adc.lbvserver_rewritepolicy_binding: state: present name: LB_DIA_vs2 policyname: rw_diam_pol priority: '10' gotopriorityexpression: END bindpoint: REQUESTlbservertmtrafficpolicybinding.yaml --- - name: Sample lbvserver_tmtrafficpolicy_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure lbvserver_tmtrafficpolicy_binding delegate_to: localhost netscaler.adc.lbvserver_tmtrafficpolicy_binding: state: present name: lbvs policyname: ia_tmtrafpol1 priority: '1' Example: Configuring an Authentication vserver with LDAP and RADIUS policiesThis example shows all the needed Ansible modules for configuring a new AUTH vserver. You can find the whole script and variables in the GitHub repository. authenticationvserver.yml --- - name: Sample authenticationvserver playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationvserver delegate_to: localhost netscaler.adc.authenticationvserver: state: present name: Citrix_AAA_vServer servicetype: SSL ipv46: 0.0.0.0authenticationpolicy.yaml --- - name: Sample authenticationpolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationpolicy delegate_to: localhost netscaler.adc.authenticationpolicy: state: present name: OKta_SAML_Internal_ZS_SubnetsMisc rule: Sub_58220950_24 || Sub_941881310_25 || Sub_1242481410_24 || Sub_1281771250_24 || Sub_137831540_24 || Sub_154113230_24 || Sub_197982010_24 || Sub_211144190_24 || Sub_213521020_24 action: prod_oktaauthenticationldappolicy.yaml --- - name: Sample authenticationldappolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationldappolicy delegate_to: localhost netscaler.adc.authenticationldappolicy: state: present name: LDAP_Basic_Policy rule: ns_true reqaction: ldap_mgmt_actauthenticationldappolicy.yaml --- - name: Sample authenticationldappolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationldappolicy delegate_to: localhost netscaler.adc.authenticationldappolicy: state: present name: LDAP_Basic_Policy rule: ns_true reqaction: ldap_mgmt_actauthenticationldapaction.yaml --- - name: Sample authenticationldapaction playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationldapaction delegate_to: localhost netscaler.adc.authenticationldapaction: state: present name: ldap_userextraction_External_noauth servername: awsdcs-amer.blackstone.com serverport: 636 ldapbase: OU=New AD Structure,DC=Blackstone,DC=com ldapbinddn: CN=GD-CITRIXADC-P-APP,OU=Service Accounts,OU=Elevated,OU=New AD Structure,DC=Blackstone,DC=com ldapbinddnpassword: REQ_PASSWORD ldaploginname: sAMAccountName groupattrname: memberOf subattributename: cn sectype: SSL authentication: DISABLED passwdchange: ENABLED nestedgroupextraction: 'ON' groupnameidentifier: sAMAccountName groupsearchattribute: sAMAccountName defaultauthenticationgroup: Externalauthenticationradiuspolicy.yaml --- - name: Sample authenticationradiuspolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationradiuspolicy delegate_to: localhost netscaler.adc.authenticationradiuspolicy: state: present name: test_radius rule: ns_true reqaction: test_radius_actauthenticationradiusaction.yaml --- - name: Sample authenticationradiusaction playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure authenticationradiusaction delegate_to: localhost netscaler.adc.authenticationradiusaction: state: present name: RADIUS_10.102.222.187 serverip: 10.102.222.187 serverport: 1812 authtimeout: '3' radkey: freebsd radnasip: DISABLED passencoding: pap ipvendorid: '0' accounting: 'ON' callingstationid: DISABLED Example: Configuring a REWRITE policy and actionThis example shows all the needed Ansible modules for configuring a new rewrite policy and action. You can find the whole script and variables in the GitHub repository. rewritepolicy.yaml --- - name: Sample rewritepolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure rewritepolicy delegate_to: localhost netscaler.adc.rewritepolicy: state: present name: rw_diam_pol rule: diameter.req.avp(264).value.eq("host.xyz.net") action: rw_act_insert_after_diameter_avprewriteaction.yaml --- - name: Sample rewriteaction playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure rewriteaction delegate_to: localhost netscaler.adc.rewriteaction: state: present name: rw_act_insert_after_diameter_avp type: insert_after target: diameter.req.avp(345678) stringbuilderexpr: diameter.new_avp(3110, "This is now inserted…") Example: Configuring an NS Gateway server (vpnvserver)This example shows Ansible modules for configuring a new NetScaler Gateway server. You can find the whole script and variables in the GitHub repository. vpnvserver.yaml --- - name: Sample vpnvserver playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnvserver delegate_to: localhost netscaler.adc.vpnvserver: state: present name: CitrixAccessCallback servicetype: SSL ipv46: 10.189.130.19 port: 443 downstateflush: DISABLED listenpolicy: NONEvpnsessionpolicy.yaml --- - name: Sample vpnsessionpolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnsessionpolicy delegate_to: localhost netscaler.adc.vpnsessionpolicy: state: present name: External_receiver_session_pol rule: HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver") action: External_receiver_session_profvpnsessionaction.yaml --- - name: Sample vpnsessionaction playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnsessionaction delegate_to: localhost netscaler.adc.vpnsessionaction: state: present name: External_receiver_session_prof sesstimeout: 20 transparentinterception: 'OFF' defaultauthorizationaction: ALLOW clientidletimeout: 20 sso: 'ON' ssocredential: SECONDARY icaproxy: 'ON' wihome: https://ac.the-austrian-citrix-guy.at/Citrix/StoreExternal clientlessvpnmode: 'ON'vpnstaserver.yaml --- - name: Sample vpnglobal_staserver_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnglobal_staserver_binding delegate_to: localhost netscaler.adc.vpnglobal_staserver_binding: state: present staserver: https://ddc1.the-austrian-citrix-guy.atvpndomain.yaml --- - name: Sample vpnglobal_domain_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnglobal_domain_binding delegate_to: localhost netscaler.adc.vpnglobal_domain_binding: state: present intranetdomain: '*.the-austrian-citrix-guy.at'vpnclientlessaccesspolicy.yaml --- - name: Sample vpnclientlessaccesspolicy playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnclientlessaccesspolicy delegate_to: localhost netscaler.adc.vpnclientlessaccesspolicy: state: present name: ia_cltlsacspol1 rule: 'true' profilename: ia_cltlsacsprof1vpnclientlessaccessprofile.yaml --- - name: Sample vpnclientlessaccessprofile playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnclientlessaccessprofile delegate_to: localhost netscaler.adc.vpnclientlessaccessprofile: state: present profilename: ia_cltlsacsprof1vpnldappolicy.yaml --- - name: Sample vpnvserver_authenticationldappolicy_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnvserver_authenticationldappolicy_binding delegate_to: localhost netscaler.adc.vpnvserver_authenticationldappolicy_binding: state: present name: ns.pcoip.net policy: ldap24 priority: '100'vpnradiuspolicy.yaml --- - name: Sample vpnvserver_authenticationradiuspolicy_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnvserver_authenticationradiuspolicy_binding delegate_to: localhost netscaler.adc.vpnvserver_authenticationradiuspolicy_binding: state: present name: nsgw_voila_direct2dll_com policy: auth_pol_radius_azure_mfa2_nonmobile priority: '120' secondary: truevpnicapolicy.yaml --- - name: Sample vpnvserver_icapolicy_binding playbook hosts: demo_netscalers gather_facts: false tasks: - name: Configure vpnvserver_icapolicy_binding delegate_to: localhost netscaler.adc.vpnvserver_icapolicy_binding: state: present name: wionnsvs policy: icapol1 priority: '3'… and many more… Designing an Environment for Automation Architectural OverviewThe architecture of an IaC deployment is straightforward – you need a machine with all the IaC frameworks installed. This machine or machine cluster then contacts all your targets using remoting protocols like WinRM or SSH. You can find a thorough installation description for an Ubuntu-based machine earlier in this guide. Core PrinciplesThe core principles of a best-practise-based architecture for using Infrastructure-as-code are essential to remember: Idempotency: Applying the same code multiple times should not change the system state Declarative Approach: Define what the infrastructure should look like, not how to create it Modularity: Break down resources into reusable modules Version Control: All IaC code is stored in Git or a similar VCS Security & Compliance: Integrate secrets management, policy enforcement, and scanning High-Level ArchitectureIt is best to think about the architecture in different stages: Source Control Layer: Git repositories for: Modules (reducible building blocks) Environment Configurations (dev, staging, prod) Pipeline Definitions Branching strategy: main for production, dev, test, feature branches for changes CI/CD Pipeline Layer: Continuous Integration: Linting (e.g., terraform fmt ) Static analysis (e.g., tfsec) Unit tests for modules Continuous Deployment: Plan → Approve → Apply Automated rollback on failure Tools: GitHub Actions, Azure Pipelines, GitLab CI, or Jenkins State Management Layer: Remote State Backend Terraform: S3, DynamoDB, Azure Storage, GCS, … Locking is enabled to prevent race conditions State Encryption: Enable encryption at rest and in transit Secrets Management Layer: Use Vault, AWS Secrets Manager, or Azure Key Vault Never hardcode secrets in IaC Policy Enforcement Layer: OPA (Open Policy Agent) or Terraform Sentinel for compliance Enforce tagging, resource limits, and security baselines Execution Layer: IaC tools: Terraform, Ansible, Packer Immutable Infrastructure principle: Replace rather than mutate resources where possible Security Best PracticesEnable least privilege for IaC execution roles Scan IaC code for vulnerabilities before deployment Implement drift detection (e.g., terraform plan in scheduled tasks or cron jobs) Using scheduled tasks or cron jobs, along with an advanced notification mechanism, lets you detect infrastructure changes and respond promptly. Example for combining the check for changes and the CVAD/DaaS feature Configuration Logging. It enables you to get an overview of who did what when, making it easier to track. We created a simple script to get a notification out via email and on a specific Teams channel: Observability & AuditingLog all IaC actions (plan, apply) in a centralized system Integrate with monitoring tools (Prometheus, Grafana, Splunk, …) Audit trails for compliance You can also use Terraform to keep a record of your infrastructure for audits, as IaC creates every entity, and the Terraform state file represents your current infrastructure state. You will learn more about the importance of the state file later in this handbook. Component InteractionIn a full-blown IaC architecture, many components must interact with one another to enable successful IaC and CI/CD. Here are some examples for distinct roles: Packer Purpose: Build immutable machine images (VM templates, AMIs, managed images) with base OS and common dependencies Outputs: Versioned images referenced later by Terraform Auth/Secrets: Pulls credentials (cloud API keys, provisioner passwords) from Vault at build time Terraform Purpose: Provision infrastructure resources (compute, network, storage, IAM) and publish state to Azure Storage (remote backend) Outputs: Resource attributes and connection info for Ansible (e.g., IPs, hostnames) Ansible Purpose: Post‑provision configuration management on the provisioned hosts (packages, services, app deploys) Connectivity: Uses SSH (22) for Unix/Linux; WinRM HTTP (5985) or WinRM HTTPS (5986) for Windows Auth/Secrets: Retrieves credentials (SSH keys, WinRM user/pass, certificates) from Vault just‑in‑time Vault (Secrets Management) Stores: Cloud provider creds, SSH private keys, WinRM users/passwords, TLS certificates Access: IaC machine and CI agents authenticate (OIDC/JWT, AppRole, or Azure auth methods) and request short‑lived tokens Azure Storage (Terraform State) Backend: Terraform remote state with state locking (via storage leases) and encryption at rest Usage: The IaC machine (or CI agents) reads/writes state to avoid local state conflicts CI Triggers (GitHub Actions, Jenkins, Azure Pipelines) Function: Kick off Packer → Terraform → Ansible workflows on code changes or scheduled runs. Security: Pipelines fetch ephemeral secrets from Vault; never store secrets in repo. Typical End-to-End FlowLet´s look at a typical flow – starting from scratch until the desired end state of our infrastructure. CI Trigger & Preparation: Designer commits changes (Packer templates, Terraform modules, Ansible playbooks) to the repository GitHub Actions / Jenkins / Azure Pipelines start the workflow on push/PR or schedule Pipeline agent (or the dedicated IaC machine) authenticates to Vault, obtains short‑lived tokens, and required secrets Image Build (Packer) Packer runs: Authenticates to cloud (e.g., Azure, AWS) using creds from Vault Optionally runs provisioning steps (shell/Ansible) inside the image Produces versioned image artifacts (e.g., Azure Managed Image ID) The Image IDs are exported as pipeline artifacts or Terraform variables for further usage Infrastructure Provision (Terraform) terraform init uses Azure Storage as the backend: Saves remote state; acquires lock terraform plan computes changes; policy checks run (if you use OPA/Sentinel) terraform apply provisions: Compute: VM/Scale Sets using the Packer-created Image. Network: VNet/Subnets, NSGs, firewalls (open only required ports 22, 5985/5986 from the IaC network) Outputs: Host inventories (IP/hostname), and connection details required by Ansible State updated in Azure Storage; lock released Configuration & App Deploy (Ansible) Ansible inventory is assembled from Terraform outputs (dynamic inventory or generated files) Ansible connects to targets: Linux: SSH over TCP port 22 Windows: WinRM over: HTTP (TCP port 5985) for initial setup prior to domain-join and GPO download HTTPS (TCP port 5986) for production/hardened environments High-level overview of the flow: Design Decisions Terraform State File LocationTerraform stores information about your infrastructure and configuration in its State. It primarily maps deployed resources to the infrastructure and maintains the required metadata. The State is stored by default in a local file named"terraform.tfstate". Terraform uses the State to determine which changes must be made to your infrastructure. Terraform automatically refreshes the state with the existing infrastructure before any alterations are initiated. Important Be very careful with a locally saved .tfstate file—it is recommended that you store it in a safe, encrypted manner with limited access and use a versioning control system. Caution Terraform´s .tfstate file can contain sensitive data such as database passwords, user passwords, or private keys. If you use locally stored State files (=Local State), they are stored on your machine as plain-text JSON files. If you use remote state files (= Remote State), the State is transferred from the remote backend to memory only when Terraform uses it. Be aware that the transport can be unencrypted. The .tfstate file can grow quite large—for example, in our demo environment, it exceeds 5MB. Example of a representation of a Machine Catalog in a locally stored .tfstate file: ..., { "mode": "managed", "type": "citrix_machine_catalog", "name": "machine_catalog_0", "provider": "provider[\"registry.terraform.io/citrix/citrix\"]", "instances": [ { "schema_version": 0, "attributes": { "allocation_type": "Random", "built_in_scopes": [ "00000000-0000-0000-0000-000000000000" ], "description": "Machine Catalog on Azure based on Windows 11 Single-Session for TMM-Gerhard", "id": "95d6xxxx-xxxx-xxxx-xxxx-xxxxxxxxdc35", "inherited_scopes": [], "is_power_managed": null, "is_remote_pc": null, "machine_accounts": null, "machine_catalog_folder_path": null, "metadata": null, "minimum_functional_level": "L7_34", "name": "MC-TMM-GK-AZURE-W11-SS", "provisioning_scheme": { "availability_zones": [ "1" ], "aws_machine_config": null, "azure_machine_config": { "azure_master_image": { "container": null, "gallery_image": null, "master_image": "TMM-GK-W11-SS-M_OsDisk_1_7d8xxxxxxxx", "resource_group": "tmm_gerhard_westeurope", "shared_subscription": null, "storage_account": null }, "azure_pvs_config": null, "disk_encryption_set": null, "enroll_in_intune": null, "image_update_reboot_options": null, "license_type": "Windows_Client", "machine_profile": { "machine_profile_resource_group": "tmm_gerhard_westeurope", "machine_profile_template_spec_name": null, "machine_profile_template_spec_version": null, "machine_profile_vm_name": "TMM-GK-W11-SS-M" }, "master_image_note": "", "service_offering": "Standard_D2s_v5", "storage_type": "Premium_LRS", "use_azure_compute_gallery": null, "use_managed_disks": true, "vda_resource_group": "tmm_gerhard_westeurope", "writeback_cache": null }, "custom_properties": null, "gcp_machine_config": null, "hypervisor": "bec2xxxx-xxxx-xxxx-xxxx-xxxxxxxxf8f0", "hypervisor_resource_pool": "2c70xxxx-xxxx-xxxx-xxxx-xxxxxxxx87cb", "identity_type": "ActiveDirectory", "machine_account_creation_rules": { "naming_scheme": "TMM-GK-W11-SS-#", "naming_scheme_type": "Numeric" }, "machine_domain_identity": { "domain": "democloud.corp", "domain_ou": "OU=_AZURE,OU=_WORKER,OU=_CITRIX,OU=TACG,OU=EBC-TMM,DC=xxxxxxxxxxxxxxxxxxxxxxxx,DC=xxxxxxxxxxxxxxxxxxxxxxxx", "service_account": "xxxxxxxxxxxxxxxxxxxxxxxx", "service_account_password": "xxxxxxxxxxxxxxxxxxxxxxxx" }, "metadata": null, "network_mapping": null, "number_of_total_machines": 1, "nutanix_machine_config": null, "scvmm_machine_config": null, "vsphere_machine_config": null, "xenserver_machine_config": null }, "provisioning_type": "MCS", "remote_pc_ous": null, "scopes": [], "session_support": "SingleSession", "tags": null, "tenants": null, "vda_upgrade_type": null, "zone": "4050xxxx-xxxx-xxxx-xxxx-xxxxxxxxc507" }, "sensitive_attributes": [ [ { "type": "get_attr", "value": "provisioning_scheme" }, { "type": "get_attr", "value": "machine_domain_identity" }, { "type": "get_attr", "value": "service_account_password" } ] ] } ] },Keeping the State safeThe recommended way to keep the State secure is not to use Local State but Remote State. The State is written to a remote data store. Terraform supports HCP Terraform, HashiCorp Consul, Amazon S3, Azure Blob Storage, Google Cloud Storage, and more. As mentioned, Terraform will not persist the State anywhere on the local disk. It will write the State locally only in the case of a non-recoverable error, when writing to the backend fails. This is to prevent data loss. We use an Azure Storage Account to store the State in this example. You can use Terraform to create the needed Storage Account: data "azurerm_resource_group" "GetAzureRG" { name = "TMM-Gerhard-WestEurope" } resource "azurerm_storage_account" "AzureStorageAccountForTerraform" { name = "${var.TF-StorageAccount-Name}" resource_group_name = data.azurerm_resource_group.GetAzureRG.name location = data.azurerm_resource_group.GetAzureRG.location account_tier = "Standard" account_replication_type = "LRS" allow_nested_items_to_be_public = false tags = { environment = "TMM-Gerhard" } } resource "azurerm_storage_container" "AzureStorageAccountContainerForTerraform" { depends_on = [ azurerm_storage_account.AzureStorageAccountForTerraform ] name = "${var.TF-StorageAccountContainer-Name}" storage_account_name = azurerm_storage_account.AzureStorageAccountForTerraform.name container_access_type = "private" }Or you can use PowerShell to create the needed Storage Account: # Get Azure Resource Group $ResourceGroup = Get-AzResourceGroup -Name $RESOURCE_GROUP_NAME # Create Azure Storage Account $StorageAccount = New-AzStorageAccount -ResourceGroupName $ResourceGroup.Name -Name $TF_StorageAccount_Name -SkuName Standard_LRS -Location $ResourceGroup.Location -AllowBlobPublicAccess $false # Create Azure Blob Container New-AzStorageContainer -Name $TF_StorageAccountContainer_Name -Context $StorageAccount.context # Retrieve Storage Container Access Key $SC_Access_Key=(Get-AzStorageAccountKey -ResourceGroupName $ResourceGroup.Name -Name $StorageAccount.Name)[0].valueNow you can configure Terraform to use Remote State using a backend configuration: terraform { required_providers { azurerm = { source = "hashicorp/azurerm" version = "=>4.9" } } backend "azurerm" { resource_group_name = "XxXxXxXxXxX" storage_account_name = "XxXxXxXxXxX" container_name = "terraform" key = "terraform.tfstate" use_oidc = true client_id = "a99fxXxX-xXxX-xXxX-xXxX-xXxXxXxXxd2de" client_secret = "xXxX-xXxX-xXxX-xXxX-xXxXxXxXx" subscription_id = "893axXxX-xXxX-xXxX-xXxX-xXxXxXxXx2de793" tenant_id = "db32xXxX-xXxX-xXxX-xXxX-xXxXxXxXx2de49f" } } provider "azurerm" { features {} } Caution You cannot use variables in the backend configuration part. You need to define the settings in clear text, including all sensitive settings. Important Azure Storage blobs are automatically locked before any operation writes to the state. This prevents concurrent state operations. All Data stored in an Azure blob is encrypted. Terraform retrieves the State from the backend and stores it in local memory. Transport is usually encrypted, as accessing the Azure Storage Container requires a TLS-capable connection. Terraform initializes successfully using Remote State: PS C:\_TERRAFORM\_BACKEND> terraform init Initializing the backend... Successfully configured the backend "azurerm"! Terraform will automatically use this backend unless the backend configuration changes. Initializing provider plugins... - Finding hashicorp/azurerm versions matching ">= 4.6.0"... - Finding citrix/citrix versions matching ">= 1.0.5"... - Installing hashicorp/azurerm v4.10.0... - Installed hashicorp/azurerm v4.10.0 (signed by HashiCorp) - Installing citrix/citrix v1.0.7... - Installed citrix/citrix v1.0.7 (self-signed, key ID BD4BD0E690CB7D88) Partner and community providers are signed by their developers. If you'd like to know more about provider signing, you can read about it here: https://www.terraform.io/docs/cli/plugins/signing.html Terraform has created a lock file .terraform.lock.hcl to record the provider selections it made above. Include this file in your version control repository so that Terraform can guarantee to make the same selections by default when you run "terraform init" in the future. Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary.You can see the .tfstate file in the Azure Storage Container: Storing SecretsAs we have seen, secrets should not be stored in a ready-to-use format or even hardcoded into the code. Use Vault or Azure Key Vault for secrets Fetch secrets dynamically during runtime (CI/CD pipeline or IaC execution) Use short-lived tokens and role-based access control Enable audit logging for secret access Never store secrets in terraform .tfvars or Ansible inventory files in plain text Examples of data that are considered sensible: Cloud Provider Credentials API keys, access tokens, client secrets for AWS, Azure, GCP Example: ARM_CLIENT_SECRET for Azure or AWS_SECRET_ACCESS_KEY SSH Keys Private keys used for connecting to Linux servers Public keys can be stored in code, but private keys must be secured WinRM Credentials Username and password for WinRM Certificates for WinRM over HTTPS (port 5986) Database Credentials Connection strings, usernames, and passwords for SQL/NoSQL databases TLS/SSL Certificates Private keys and certificate files for HTTPS endpoints API Tokens Tokens for third-party services (monitoring, logging, CI/CD integrations) Sensitive Configuration Values Encryption keys, JWT signing secrets, OAuth client secrets Terraform Backend Credentials Storage account keys or SAS tokens for remote state (e.g., Azure Storage) Ansible Vault Password If using Ansible Vault for encrypted variables Packer Builder Credentials Cloud Image builder credentials (Azure Managed Image, AWS AMI) For example, you can define variables as sensitive in Terraform, so that Terraform does not show the content during its run: variable "vsphere_admin_username" { type = string sensitive = true description = "REQUIRED: vSphere-Admin-Username" } variable "vsphere_admin_pw" { type = string sensitive = true description = "REQUIRED: vSphere-Admin-Password" }If you run the code, Terraform does not list the content: # citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn will be created + resource "citrix_vsphere_hypervisor" "TACG-TMM-CVAD-V-HypConn" { + addresses = [ + (sensitive value), ] + id = (known after apply) + max_absolute_active_actions = 20 + max_absolute_new_actions_per_minute = 10 + max_power_actions_percentage_of_machines = 20 + name = "TACG-TMM-CVAD-VSP-Cluster" + password = (sensitive value) + password_format = "PlainText" + scopes = [] + tenants = (known after apply) + username = (sensitive value)Terraform helps to keep the sensitive values “secret”. Another way to keep sensitive values secret is to use HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager. Example Terraform code that retrieves secrets dynamically without hardcoding them and avoids storing them in the .tfstate file: # Configure Vault provider provider "vault" { address = "https://vault.example.com" token = var.vault_token # Use short-lived token from CI/CD pipeline } # Retrieve secret from Vault data "vault_generic_secret" "db" { path = "secret/data/db" } # Use the secret in a resource without storing it in state resource "null_resource" "configure" { provisioner "local-exec" { command = <<EOT ansible-playbook -i inventory site.yml \ --extra-vars "db_password=${data.vault_generic_secret.db.data["password"]}" EOT } # Prevent storing secret in state lifecycle { ignore_changes = [provisioner] } } # Sensitive output (hidden in CLI) output "db_password" { value = data.vault_generic_secret.db.data["password"] sensitive = true }Another example of securing sensitive data is storing it in GitHub´s vault: HIGHEST CAUTION Remember to make sure that forking your public GitHub repository does not reveal sensitive data. Storing and Reusing Components/Scripts on Central RepositoriesIn every organization, every team might build infrastructures its own way. One team keeps Terraform scripts on a local laptop, another uses Ansible playbooks stored in a shared drive, and someone else has Packer templates buried in an email attachment. A developer updates a security group in staging, but production doesn’t match. Someone accidentally deletes a resource because they didn’t know about a recent change. Compliance audits become nightmares because there’s no clear history of who changed what. Secrets leak because they were hardcoded in scripts. The result is drift, downtime, and risk. Adopting centralized Infrastructure as Code repositories solves these problems. All Terraform modules, Ansible roles, and Packer templates live in a single source of truth—version-controlled, secure, and accessible. Every change is tracked, reviewed, and approved through pull requests. CI/CD pipelines automatically test and deploy infrastructure changes. Secrets are injected securely from Vault or Azure Key Vault, never hardcoded. Teams reuse modules instead of reinventing the wheel, ensuring consistency across environments. When an auditor asks, “Who changed the firewall rules last month?”—you can answer in seconds. When a new team joins, they clone the repo and follow documented workflows. Disaster recovery? Just redeploy from the repo. Security? Git hooks and scanning tools catch exposed secrets before they hit production. Possible Repository OptionsGitHub Widely used, integrates with GitHub Actions for CI/CD GitLab Built-in CI/CD and strong DevSecOps features Azure Repos (Azure DevOps) Ideal for organizations using Azure services Bitbucket Integrates with Atlassian tools like Jira AWS CodeCommit Native AWS solution for Git repositories Self-hosted Git (e.g., Gitea, Gerrit) For organizations requiring on-premises control Example: Using an Azure Storage VaultAzure Storage provides Blob Containers that can act as a secure, scalable repository for storing: Terraform modules and IaC snippets (e.g., reusable VPC, VM, or security group templates). Ansible playbooks and roles for configuration management. Packer templates for image building. These files are uploaded to a central container, organized by environment and purpose. Access is controlled via Azure RBAC and Managed Identities, ensuring only authorized users and CI/CD pipelines can read or write. We recommend enabling soft-delete, blob-versioning, and change feed as further necessary settings. Example structure of our in-use Azure Storage Vault: Directories in container 'iac-repo': ansible dev playbooks tasks roles prod playbooks tasks roles test playbooks tasks roles terraform dev modules compute hyperscaler aws azure gcp hypervisor nutanix vsphere xenserver other prod modules compute hyperscaler aws azure gcp hypervisor nutanix vsphere xenserver other test modules compute hyperscaler aws azure gcp hypervisor nutanix vsphere xenserver other packer dev hyperscaler aws azure gcp hypervisor nutanix vsphere xenserver prod hyperscaler aws azure gcp hypervisor nutanix vsphere xenserver test hyperscaler aws azure gcp hypervisor nutanix vsphere xenserverThis file structure enables structured, shared access to all relevant snippets, organized by target entities. The division into dev, test, and prod also makes it easy to implement CI/CD standards. Example: Using GitHubWe also use GitHub Actions as our CI/CD framework, along with webhooks and REST API calls to trigger deployments. We created a similar structure on our private GitHub repository to allow collaboration. All Terraform modules, Ansible playbooks, and Packer templates are stored in a secure, version-controlled GitHub repository. Every change is tracked, reviewed, and approved through pull requests. Security GitHub integrates with enterprise authentication (SSO, MFA) and secret scanning tools to prevent leaks Scalability Repositories can host hundreds of modules and playbooks, organized by environment and purpose Collaboration Designers, operations managers, and security teams work together through branches and pull requests As always, it is up to you which central repository you want to use – but it is recommended to use one, for sure. Deployment TipsStart Small, Grow SlowlyImplementing Infrastructure as Code (IaC) is a transformative step for IT organizations, enabling automation, consistency, and scalability. However, for teams new to IaC, starting small and growing gradually is not just a best practice—it’s a strategic imperative. Reduce Risk and Complexity IaC introduces new paradigms in infrastructure management, including version control, declarative configurations, and automated deployments. Jumping into full-scale implementation without experience can lead to misconfigurations, outages, and security gaps. Starting with a limited scope—such as automating a single environment or a non-critical workload—allows teams to learn without jeopardizing business continuity Build Skills and Confidence IaC requires proficiency in tools (Terraform, Ansible, Packer, Jenkins, GitHub, Azure Pipelines, etc.), coding practices, and DevOps principles. A phased approach gives teams time to: Understand syntax and workflows Develop troubleshooting skills Establish coding standards and governance This incremental learning curve fosters confidence and competence before scaling to mission-critical systems Establish Governance Early Starting small enables organizations to define policies, compliance checks, and approval workflows before complexity grows. This prevents “IaC sprawl” and ensures security and operational standards are baked in from the beginning. Deployment of ComponentsThe following proposal outlines a phased approach for implementing Infrastructure as Code (IaC) using Terraform and Ansible to deploy a Citrix Virtual Apps and Desktops workspace environment. A crawl -> walk -> run -> evolve model reduces risk, improves predictability, and creates reusable automation assets. By starting small and scaling systematically, the organization ensures repeatable, secure, and resilient Citrix deployments. Phase 1 — Foundations (“Crawl”) Duration: 4–8 weeks Goal: Establish a stable IaC foundation before automating Citrix-specific components 1. Governance & Architecture Setup Define IaC standards: naming, tagging, directory structure Establish Git workflows and PR-based change control Design CI/CD pipeline architecture for Terraform and Ansible Deliverables IaC governance playbook Repository structure for modules & roles Pipeline architecture Success Metric A simple Terraform deployment runs through the pipeline successfully and adheres to standards 2. Terraform Baseline Infrastructure Build, for example, compute and network foundations based on the used Hypervisor/Hyperscaler Create foundational modules for reuse across Citrix tiers Deliverables Production-ready infrastructure modules Automated creation of network and compute components Success Metric Foundation-level components deploy 100% automatically 3. Ansible Baseline Configuration Automate simple OS configurations Automate OS hardening and security baselines Automate domain-join and install common agents (monitoring, logging) Prepare configuration roles for future Citrix nodes Deliverables Configured and hardened VM via Ansible Configured domain-joined servers Success Metric VMs deployed via Terraform are fully configured by Ansible with no manual steps 4. Pipeline & Secrets Integration and Configuration Implement secure pipelines for plan/apply actions Integrate with Vault, Key Vault, or KMS Success Metric All credentials managed via secrets vault; no manual deployment needed Phase 2 — Core Services Automation (“Walk”) Duration: 8–12 weeks Goal: Automate core services required for Citrix, but not yet the Citrix entities 1. Platform Infrastructure for Citrix Deploy SQL/RDS, license servers, file servers, and AD components Standardize these components as modules Deliverables Highly available platform services via Terraform and Ansible Infrastructure is ready for Citrix installation Success Metric Core dependencies deploy in less than one hour 2. Citrix - Network & ADC foundations (optional) Automate NetScaler/ADC provisioning (VPX, HA pairs) Configure SNIPs, VIPs, VLANs, and basic load-balancing Deliverables Terraform and Ansible modules for ADC Automated network constructs required for Citrix Gateway and StoreFront Success Metric ADC HA pair deploys cleanly through the pipeline 3. Image & VDA Preparation Build golden images via Packer Deploy Ansible roles for OS tuning, configuration of prerequisites, installation of mainstream software packages, and Citrix VDA installation Deliverables End-to-end automated base image Reusable Software package installation and configuration role Reusable VDA configuration role Success Metric New VDA templates are generated automatically and consistently 4. Testing & Quality Add testing and quality assurance validation actions Integrate security scans and linting Success Metric IaC quality and security checks run automatically on every PR Phase 3 — Full Citrix Automation (“Run”) Duration: 10–16 weeks Goal: Fully automate Citrix control plane, access layer, and worker node deployment 1. Delivery Controller Automation Deploy Delivery Controllers via Terraform Configure all needed features with Ansible Success Metric Controllers deploy production-ready without human intervention 2. StoreFront & Gateway Automation Automate StoreFront installation and store creation Integrate with Citrix Gateway Automate Gateway authentication, ICA proxy, and session policies Success Metric Functional Citrix access layer validated via test connections 3. Machine Catalogs, Delivery Groups & Policies Automate MCS/PVS catalog creation Deploy Delivery Groups and publish apps/desktops Apply centralized GPOs or Studio-based Citrix Policies automatically Success Metric Full Citrix site deploys in less than four hours 4. Enterprise Scaling & Governance Implement auto-remediation and drift detection Build multi-region or multi-environment topologies Create runbooks and handoff documentation Success Metric IaC-managed Citrix platform moves into steady-state operation Phase 4 — Optimization & Self-Service (“Evolve”) Duration: Ongoing Goal: Increase automation maturity and operational efficiency 1. Self-Service Provisioning Integrate with ServiceNow, Azure DevOps, or portals Enable RBAC-driven automated provisioning of new workloads 2. Automated Scaling & Cost Optimization Deploy auto-scale logic for VDA worker nodes Implement shutdown/start schedules and cost dashboards 3. Continuous Improvements Update Terraform/Ansible modules as Citrix releases evolve Enhance observability, logging, and failure reporting Maintain automated testing and security posture Timeline OverviewPhase Duration Core Deliverables 1 – Foundations 4–8 weeks IaC standards, Production-ready Terraform and Ansible modules, VM deployment without manual interaction 2 – Core Services 8–12 weeks Core services like SQL, licensing, and basic ADC functions deploy automatically, and worker templates create and deploy automatically 3 – Full Citrix Stack 10–16 weeks All Citrix entities deploy automatically, and a fully functional environment is deployed using IaC 4 – Optimization Ongoing Continuous improvement and optimization of IaC-based deployment This phased approach ensures that the organization adopts Terraform and Ansible in a structured, low-risk manner while creating a fully automated, scalable Citrix environment. By starting with foundational IaC components, your team builds reusable modules that accelerate later phases and reduce long-term operational overhead. Using CI/CD MethodologiesThe following proposal outlines a phased, low-risk approach to implementing CI/CD automation using GitHub Actions, Azure Pipelines, or Jenkins. The strategy follows a crawl -> walk -> run -> evolve maturity model designed to minimize disruption, build confidence, and establish a scalable automation foundation. Implementation begins with version control governance and simple pipelines, then gradually expands into reusable templates, environment automation, and enterprise-level continuous delivery. Phase 1 — Foundations (“Crawl”) Duration: 4–8 weeks Goal: Establish core CI/CD governance, version control structure, and basic automation workflows. This phase intentionally avoids production-impacting automation so teams can learn tooling safely. 1. Repository & Branching Standards Objectives Standardize Git repository layout and naming conventions Define branching model (e.g., Feature Branch) Enable mandatory PR reviews and protections Deliverables Repository templates Branching and tagging standards PR and approval policies Success Metric Teams consistently follow the repository standard; PR workflows run smoothly 2. Initial CI Pipeline Objectives Build simple, non-invasive pipelines to validate tooling and workflows Provide predictable feedback loops without touching deployment systems Deliverables A basic pipeline for: Linting code Running basic tests Artifact packaging (optional) Platform examples GitHub Actions: Basic workflow YAML (lint → test → build) Azure Pipelines: YAML pipeline or classic build pipeline Jenkins: Freestyle job or scripted Jenkinsfile pipeline Success Metric Receive automated feedback on commits 3. Secrets & Credential Management Objectives Ensure pipelines never expose credentials Set up secure integration with identity systems Deliverables Secure secrets stored in: GitHub Secrets Azure Key Vault + Library variables in Azure Pipelines Jenkins Credentials Store Documented policies for secret rotation Success Metric All pipelines consume secrets securely without hardcoded credentials 4. Build Agent Strategy Objectives Decide between hosted agents or self-hosted runners Establish patching and security requirements for agents Integrate with Vault, Key Vault, or KMS Deliverables Documented agent strategy Configured runners or agents with access controls Success Metric CI jobs run reliably and safely on approved agents Phase 2 — Expanded CI/CD Capabilities (“Walk”) Duration: 8–12 weeks Goal: Mature CI/CD by introducing reusable templates, test automation, artifact management, and controlled deployments 1. Reusable Pipeline Templates Objectives Reduce duplication and increase consistency across teams Deliverables Shared workflow templates for GitHub Reusable YAML templates for Azure Pipelines Shared Jenkins pipeline libraries Success Metric ≥50% of repositories adopt centralized templates 2. Environment Deployment and Promotion Objectives Introduce a deployment automation in a controlled, low-risk manner Deliverables Dev → Test → Prod pipelines Manual approvals, checks Structured release process Success Metric Deployments become predictable, repeatable, and logged automatically 3. Pipeline Observability & Reporting Objectives Add transparency, logging, and quality metrics Deliverables Notifications to Teams/Slack/e-mail Success Metric Teams can monitor pipeline performance and spot failures quickly Phase 3 — Full CI/CD (“Run”) Duration: 10–16 weeks Goal: Automate complete delivery cycles, from commit to production, with governance and compliance controls 1. Automated Deployments to Production Objectives Expand CI/CD to orchestrate full deployments Deliverables Deployment pipelines for cloud, on-prem, or hybrid Success Metric Production deployments executed reliably through pipelines 2. Finalization of Infrastructure-Oriented Pipelines Objectives Finalize the integration of CI/CD with IaC workflows Deliverables Pipelines that orchestrate terraform plan/apply in production Ansible execution jobs for configuration changes Change approvals integrated into platform workflows Success Metric Infrastructure deployments and changes in production become stable and repeatable 3. Enterprise-Wide Template Adoption Objectives Standardize pipeline patterns across teams for efficiency and operational consistency Deliverables Notifications to Teams/Slack/eEnterprise pipeline library Shared GitHub/DevOps/Jenkins templates Security-validated build blocks Success Metric 80%+ of pipelines adopt standardized building blocks Phase 4 — Optimization & Self-Service (“Evolve”) Duration: Ongoing Goal: Move CI/CD from an engineering tool to a scalable platform service used across the organization 1. Self-Service Pipelines Portals or templates to use ready-made pipelines Automated onboarding for new workloads 2. Advanced Deployment Strategies Canary releases Progressive delivery frameworks 3. Continuous Improvements Update pipelines as Citrix releases and infrastructure environments evolve Automated cleanup of old artifacts Timeline OverviewPhase Duration Core Deliverables 1 – Foundations 4–8 weeks Repos, branching standards, simple CI, secrets management 2 – Expanded CI/CD Capabilities 8–12 weeks Increased template adoption, Deployments become predictable and repeatable 3 – Full CI/CD Capabilities 10–16 weeks Full automated deployments, governance & IaC integration 4 – Optimization Ongoing Self-service CI/CD, canary releases, continuous improvement This phased roadmap ensures safe, predictable, and scalable adoption of CI/CD platforms—whether GitHub Actions, Azure Pipelines, or Jenkins. By starting with governance and simple pipelines, the organization builds the knowledge and infrastructure needed to support enterprise-grade automation, reduce deployment risk, and accelerate delivery cycles. Reproducibility in the case of ErrorsReproducible errors are the fastest path to root cause. For IaC tools, this hinges on: Deterministic inputs (version pinning, immutable artifacts) Controlled environments (containers, isolated accounts/workspaces) Captured context (state, vars, logs, tool/provider versions) Consistent execution (CI pipelines, seed data, parallelism) Disciplined debugging (isolate, instrument, iterate) Let's look deeper at how to set up reproducibility, configure high-value logging, and use systematic debugging strategies for Terraform, Ansible, and Packer. Deterministic inputsPin tool versions: Terraform: Use only a strictly defined version by setting a required_version Terraform providers/modules: use required_providers terraform { required_version = "= 1.8.4" required_providers { vsphere = { source = "hashicorp/vsphere" version = "= 2.7.0" } citrix = { source = "citrix/citrix" version = "=1.0.30" } } } Ansible: pin role/collection versions in requirements.yml --- roles: # Install a role from Ansible Galaxy. - name: rolenametobeused version: "1.9.6" collections: # Install a collection from Ansible Galaxy. - name: community.general version: "=7.0.0" source: https://galaxy.ansible.com Packer: pin specific version in required_plugins packer { required_version = "= 1.9.0" required_plugins { vsphere = { version = "= v1.4.2" source = "github.com/hashicorp/vsphere" } } required_plugins { windows-update = { version = "= 0.16.8" source = "github.com/rgl/windows-update" } } }Immutable artifacts: Reference specific AMI IDs/Azure Image version; avoid “latest” Snapshot base images and tag them Controlled environmentsThe recommended way is to use a controlled, reproducible environment. Only then can you be sure that your debugging environment is always built on the same foundation. Run in containers with pinned OS + toolchain Isolate accounts/projects for non-prod testing (e.g., separate cloud account, Terraform workspaces) Use remote state with Terraform with locking (e.g., Consul), one state per environment Use fixed regions + network (avoid region drift, ensure reproducible network routes) Capture Full Run ContextFor reproducibility, it is essential to capture all settings, versions, variables, etc. Try to save: Tool versions (terraform/packer/ansible and provider/plugin versions) Input variables (*.tfvars, group/host vars for Ansible), inventory snapshot State snapshot (Terraform state, Packer builder outputs, Ansible task results) Environment variables and flags used for the run Commit SHA / build number linking code to artifacts Consistent Execution PathsTry always to use consistent execution paths: CI pipelines to run on a standard machine image Parallelism controls: lower parallelism to expose ordering issues Seeding / test data: fixed seeds for randomized elements, mock inputs where possible Let´s look at some tool-specific best-practice settings for debugging: Terraform — Logging & DebuggingSet the log level accordingly (from most to least level): # Deep logging export TF_LOG=TRACE # TRACE|DEBUG|INFO|WARN|ERROR export TF_LOG_PATH=./terraform.log # Mark that Terraform is running under automation (less interactive) export TF_IN_AUTOMATION=1Use validation & plan capture: terraform fmt -check terraform validate terraform init -upgrade=false # Avoid unpredictable upgrades terraform plan -out=tfplan terraform show -json tfplan > tfplan.json # Machine-readable diff for reviewUse workspace isolation and targeted runs: terraform workspace new repro-test # Use dedicated workspace terraform plan -target=module.name # Isolate a suspect module (use sparingly) terraform apply -parallelism=1 # Reduce concurrency to expose ordering issues terraform plan -refresh-only # Focus on drift without applying changesUse deeper, interactive inspection possibilities: terraform state list terraform console # Inspect variables/expressions interactively Ansible — Logging & DebuggingSet the verbosity level accordingly: ansible-playbook site.yml -v # Least level of verbosity ansible-playbook site.yml -vv ansible-playbook site.yml -vvv ansible-playbook site.yml -vvvv # Highest level of verbosity ansible-playbook site.yml -v --check # Running in Check mode: execute a playbook without applying any alterations to your systems. Use check mode to test playbooks before running them in a production environment. ansible-playbook site.yml -v --diff --check # Running in Diff mode, the changes made are reported or if used with --check, the changes that would have been made. Structured logging via callback plugins by configuring ansible.cfg: [defaults] inventory = inventories/dev stdout_callback = yaml # Enable useful callbacks for profiling & logging callbacks_enabled = profile_tasks, timer, log_plays host_key_checking = True forks = 10 # Consider lowering to reproduce ordering issuesIn-playbook instrumentation: - name: Debug variables and task context ansible.builtin.debug: msg: - "host={{ inventory_hostname }}" - "var1={{ var1 }}" - "ansible_facts.os={{ ansible_facts.os_family }}Isolation & Determinism: Inventory snapshots: Export the inventory used (ansible-inventory --list > inventory.json) ansible-galaxy install -r requirements.yml --force Serialize execution to reproduce ordering-sensitive issues - hosts: windows serial: 1 strategy: linear tasks: ...Artifacts & Re-runs: Use ansible-runner to generate structured event logs (if available) Capture stdout/stderr to files per run Packer — Logging & DebuggingDeep logging + Debug Mode: export PACKER_LOG=1 export PACKER_LOG_PATH=./packer.log packer validate template.pkr.hcl packer inspect template.pkr.hcl packer build -debug template.pkr.hcl # Interactively step through builders/provisioners Deep logging + Debug Mode: packer { required_plugins { amazon = { source = "github.com/hashicorp/amazon" version = ">= 1.2.5, < 1.3.0" } } } build { name = "app-image" on_error = "abort" # or "cleanup" / "continue" sources = ["source.amazon-ebs.app"] }Determinism: Use fixed base AMI IDs, Image IDs, and fixed regions Tag images with e.g., git_sha, build_number, and environment Archive the provisioner scripts used in the image build Other proven strategiesInstrument & Observe: Add debug outputs near suspected failure points Turn on TRACE/DEBUG logs for the specific tool Capture timestamps and host/resource identifiers to correlate events across tools Separate “drift” from “bug”: Terraform: -refresh-only to see drift without applying changes If drift exists, reconcile and re-test. If not, focus on config logic Create Minimal Repro Cases: Smaller templates/playbooks that reproduce the issue quickly are gold for root cause analysis Create a per-run folder, e.g., artifacts/2025-12-05T09-00-00-<commit_SHA>/ containing: versions.txt — terraform/ansible/packer versions, provider/plugin versions env.txt — all relevant environment variables and flags inputs/ — .tfvars, Ansible var files, inventories, Packer HCL state/ — Terraform state snapshot (read-only copy), Packer outputs, Ansible run events logs/ — terraform.log, ansible.log (callback output), packer.log plan/ — terraform plan + plan.json notes.md — brief description of failure, steps taken, following hypotheses Use CI to standardize environments and capture artifacts – GitHub example workflow: name: IaC Repro Run on: workflow_dispatch: inputs: env: description: "Environment to test (dev/stage)" required: true default: "dev" jobs: repro: runs-on: ubuntu-latest env: TF_IN_AUTOMATION: "1" TF_LOG: "TRACE" PACKER_LOG: "1" steps: - uses: actions/checkout@v4 - name: Set up Terraform (pinned) uses: hashicorp/setup-terraform@v3 with: terraform_version: 1.6.6 - name: Show tool versions run: | terraform -version | tee versions.txt ansible --version | tee -a versions.txt packer -version | tee -a versions.txt - name: Terraform init + plan run: | terraform init -upgrade=false terraform plan -out=tfplan -var-file="vars/${{ github.event.inputs.env }}.tfvars" terraform show -json tfplan > plan/tfplan.json - name: Ansible run (structured output) run: | ansible-playbook site.yml -vvv --inventory inventories/${{ github.event.inputs.env }} --check --diff | tee logs/ansible.log - name: Packer validate + build (debug) run: | packer validate template.pkr.hcl PACKER_LOG_PATH=logs/packer.log packer build -debug template.pkr.hcl - name: Upload artifacts uses: actions/upload-artifact@v4 with: name: iac-repro-${{ github.sha }} path: | versions.txt plan/tfplan.json logs/ vars/ inventories/Reference configurations – Terraform: capture plans for reproducibility: terraform init -upgrade=false terraform plan -out=tfplan -var-file="vars/dev.tfvars" terraform show -json tfplan > plan/tfplan.json Reference configurations – Ansible: ansible.cfg: [defaults] inventory = inventories/dev stdout_callback = yaml callbacks_enabled = profile_tasks, timer, log_plays host_key_checking = True forks = 10 retry_files_enabled = False Reference configurations – Use proven Packer template snippets: variable "Azure_ClientID" { type = string description = "Azure Service Principal App ID" sensitive = true } variable "Azure_ClientSecret" { type = string description = "Azure Service Principal Secret" sensitive = true } variable "Azure_SubscriptionID" { type = string description = "Azure Subscription ID" sensitive = true } variable "Azure_TenantID" { type = string description = "Azure Tenant ID" sensitive = true } variable "Azure_RG" { type = string description = "Packer Artifacts Resource Group" } variable "Azure_TempRG" { type = string description = "Packer Build Resource Group" } variable "Azure_ImgPublisher" { type = string description = "Windows Image Publisher" } variable "Azure_ImgOffer" { type = string description = "Windows Image Offer" } variable "Azure_ImgSKU" { type = string description = "Windows Image SKU" } variable "Azure_ImgVersion" { type = string description = "Windows Image Version" } variable "Azure_ManagedImgName" { type = string description = "FInalized Windows Image Name" } variable "Azure_SIG-ImgVersion" { type = string description = "FInalized Windows Image Name" } variable "Azure_SIG-Name" { type = string description = "FInalized Windows Image Name" } variable "Azure_SIG-ImgName" { type = string description = "FInalized Windows Image Name" } variable "Azure_VMSize" { type = string description = "FInalized Windows Image Name" } packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = "~> 2" } } } source "azure-arm" "W11MIWitSWPackagesWithoutVDA" { # Tagging azure_tags = { environment = "TMM", environment-entity ="GK-TF", usage ="Prod" } # WinRM Communicator communicator = "winrm" winrm_use_ssl = true winrm_insecure = true winrm_timeout = "5m" winrm_username = "packer" # Service Principal Authentication client_id = var.Azure_ClientID client_secret = var.Azure_ClientSecret subscription_id = var.Azure_SubscriptionID tenant_id = var.Azure_TenantID # Source Image os_type = "Windows" image_publisher = var.Azure_ImgPublisher image_offer = var.Azure_ImgOffer image_sku = var.Azure_ImgSKU image_version = var.Azure_ImgVersion # Destination Image managed_image_resource_group_name = var.Azure_RG managed_image_name = var.Azure_ManagedImgName # Packer Computing Resources build_resource_group_name = var.Azure_TempRG vm_size = var.Azure_VMSize } build { source "azure-arm.W11MIWithSWPackagesWithoutVDA" {} # Install Chocolatey: https://chocolatey.org/install#individual provisioner "powershell" { inline = ["Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"] } # Install Chocolatey packages provisioner "file" { source = "./SWPackagesToInstall.config" destination = "D:/SWPackagesToInstall.config" } provisioner "powershell" { inline = ["choco install --confirm D:/SWPackagesToInstall.config"] # See https://docs.chocolatey.org/en-us/choco/commands/install#exit-codes valid_exit_codes = [0, 3010] } provisioner "windows-restart" {} # Generalize image using Sysprep # See https://www.packer.io/docs/builders/azure/arm#windows # See https://docs.microsoft.com/en-us/azure/virtual-machines/windows/build-image-with-packer#define-packer-template provisioner "powershell" { inline = [ "while ((Get-Service RdAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "while ((Get-Service WindowsAzureGuestAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /quiet /quit /mode:vm", "while ($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }" ] } } ChecklistsImportant Implement proven checklists and stick to them to minimize bugs or problems. Reproducible Run Checklist Tool versions pinned (Terraform, Ansible, Packer, providers/plugins) Deterministic inputs captured (tfvars, inventories, HCL templates) Isolated environment/workspace/account used Remote state with locking enabled Logs and plans captured (tfplan.json, terraform.log, packer.log, Ansible callback output) Artifact folder archived under unique run ID (commit SHA / timestamp) Concurrency controlled (serial/forks/parallelism) Drift assessed (refresh-only / inventory validation) Minimal repro case available (if needed) Debugging Strategy Checklist Reproduce in container/CI Reduce scope (module/tag/builder) Instrument with debug outputs Review logs at TRACE/DEBUG with timestamps Separate drift vs config bug Apply binary search on the configuration Capture state/image/inventory snapshots Add regression test post-fix Triad VersioningCaution Major problems may arise if you change the versions of each triad member tool without testing. Version pinning and lock files are not optional—they are the foundation for reproducibility, security, and stability in IaC workflows. Let´s look at some caveats if the mentioned best practices are ignored: Non-Reproducible Builds Different environments resolve different versions → infrastructure drift Example: Terraform provider defaults change → resource attributes differ between runs Breaking Changes on Upgrade Unpinned versions allow automatic major upgrades → syntax changes or deprecated arguments break pipelines Security Risks Pulling the latest versions without review may introduce vulnerabilities or untested features Example: A provider update enabling insecure defaults CI/CD Failures Pipeline uses an older version than local → plan/apply fails due to syntax differences Example: Terraform 1.6 vs 1.4 handling of moved blocks Hidden Behavioral Changes Providers often change defaults silently (e.g., Azure storage replication defaults) Without version pinning, behavior changes without code changes → hard-to-debug issues Drift Between Environments Dev uses updated Ansible collection, prod uses older → tasks behave differently Leads to inconsistent infrastructure and unpredictable deployments Increased Debugging Complexity When errors occur, reproducing them is nearly impossible if versions differ Logs and state files may not match the code semantics of the current version Repetitive TasksRepetitive tasks are not just a convenience—they are the gold standard because they enable automation, reliability, and governance. They transform infrastructure from a manual, error-prone process into a predictable, scalable system. Important Infrastructure as Code (IaC) is about predictability, consistency, and automation. Repetitive tasks—those that can be executed identically across environments—are the foundation of these principles Let´s look deeper: Predictable Outcomes: Repetition ensures that the same code produces the same infrastructure every time. This predictability reduces risk and accelerates troubleshooting because the behavior is deterministic Consistency Across Environments: By automating repetitive tasks (e.g., provisioning VMs and configuring networks), IaC ensures that dev, test, and production environments are aligned. This eliminates configuration drift and deployment surprises Scalability and Efficiency: Repetitive tasks are easy to parameterize and scale. Instead of manually configuring 100 servers, you define one template and apply it repeatedly—saving time and reducing human error Auditability and Compliance: When repetitive tasks are codified, they become traceable and version-controlled. This makes compliance checks straightforward and ensures that every change is documented Foundation for Continuous Delivery: IaC pipelines rely on repeatable steps to integrate seamlessly with CI/CD. Without repeatability, automation breaks down, and deployments become unreliable. Tip Try to follow all your familiar and standardized workflows. Especially in complex environments, a familiar workflow ensures a fast, reliable implementation. That completes Part 2 of the Citrix Automation Handbook. In the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In this part of the Citrix Automation Handbook, we focused on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we focus on common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. DisclaimerMost important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Packer, Terraform, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. Using all the provided code snippets is at your own risk – please read the disclaimer below for further information. EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>The Citrix Automation Handbook 2601</h1> <p>Wed, 21 Jan 2026 09:11:00 +0000</p> The Citrix Automation Handbook - The Story and StrategyCitrix platforms (e.g., Citrix Desktops as a Service, Citrix Virtual Apps and Desktops, Citrix Cloud, NetScaler span hybrid infrastructures, multiple operating systems, and a diverse set of configuration surfaces—from golden images and machine catalogs (MCS/PVS) to StoreFront, profiles, policies, and ADC traffic management. Without a shared, codified approach, teams face configuration drift, slow and inconsistent deployments, brittle change processes, and avoidable downtime. The Citrix Automation Handbook should be seen as a concise, practical technical handbook discussing the common language, patterns, and guardrails needed to scale Citrix reliably through automation and Infrastructure as Code (IaC). Goals of the handbookDefine standards for IaC across Citrix: Naming conventions, repository structure, module boundaries, and branching strategies Provide reference architectures (on‑prem, cloud, and hybrid) covering CVAD resource locations, image pipelines (PVS/MCS), StoreFront, WEM, and ADC/Global Server Load Balancing Document tooling choices and integration patterns: Terraform for underlying cloud/on‑prem infrastructure (networks, load balancers, compute) PowerShell/DSC, Ansible, and Citrix SDK/APIs for Citrix components and Windows configuration CI/CD (GitHub Actions/Azure DevOps) for build, test, validate, and deploy Establish operational workflows: Environment promotion, change review, testing (unit/integration), drift detection, rollback, and incident playbooks Codify security practices: Secrets management, least‑privilege service principals, artifact signing, and policy-as-code Enable onboarding & knowledge transfer: Checklists, runbooks, templates, and examples that accelerate new projects and new team members. Who should use itPlatform engineers, Citrix admins, network/security teams, and operations staff who build, run, and secure Citrix services—plus application owners who depend on predictable delivery. How it will be usedAs the single source of truth for designing, implementing, and operating automated Citrix environments—referenced in daily work, embedded in pipelines, and updated through peer review as the platform evolves. StructureIn the first part of the Citrix Automation Handbook, we discuss the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we focus on common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. Part 1 Why is Automation essential for Citrix?Citrix’s goal is to help customers automate their environments with minimal friction. We support multiple automation interfaces, REST APIs, PowerShell SDKs, and Terraform providers, so customers can choose the tools that fit their workflows. Internally, we use the same automation interfaces that customers do. This helps us validate our APIs, catch bugs early, and understand how customers are using our products in real-world scenarios. It also means that when a customer reports an issue, we’re often able to reproduce and fix it quickly. Automation also enhances Citrix’s ability to deliver repeatable, scalable, and secure deployments across hybrid and multi-cloud environments. It supports Citrix’s broader goals of reducing time-to-value, improving customer satisfaction, and deeply integrating into customer ecosystems. Why is Automation essential for Customers?Automation shifts the customer experience from manual, error-prone configuration to a model that’s repeatable, testable, and centrally managed. Once infrastructure is defined as code, customers can version-control their environments, audit changes, and prevent drift. This is especially important in regulated industries or large-scale deployments where consistency and traceability are critical. There are already regulations in place that are becoming mandatory to meet compliance and audit requirements for customer verticals: Vertical Key Regulations / Standards IaC Compliance Benefits Financial Services (Banking, Insurance, FinTech) PCI DSS (Payment Card Industry Data Security Standard) SOX (Sarbanes-Oxley Act) EBA Guidelines (EU) FFIEC (US) Automated, auditable infrastructure changes Enforces encryption, access controls Reduces human error in sensitive systems Healthcare & Life Sciences HIPAA (US) HITECH (US) GDPR (EU) ISO 27799 (Health informatics) Consistent HIPAA-compliant environments Version-controlled infrastructure for audits Data protection by design Government & Public Sector FedRAMP (US) FISMA (US) NIST 800-53 ENS (Spain) Standardized, secure deployments Automated compliance baselines Rapid patching and updates Energy & Utilities NERC CIP (North America) ISO 27019 IEC 62443 Reproducible, validated infrastructure Automated enforcement of security controls Reduced risk of misconfiguration Telecommunications ETSI Standards (EU) FCC Regulations (US) ISO 27001 Automated provisioning across regions Built-in security and monitoring Compliance baked into templates Retail & eCommerce PCI DSS GDPR (EU) CCPA (California) Enforces PCI compliance for payment systems Consistent data protection policies Audit-ready infrastructure Pharmaceuticals & Biotech GxP (Good Practice guidelines) 21 CFR Part 11 (US FDA) ICH Guidelines Validated, reproducible environments Automated audit trails Supports clinical trial compliance Technology & SaaS Providers SOC 2 / SOC 3 ISO 27001 CSA STAR Secure multi-tenant environments Automated evidence collection for audits Faster compliance reporting With automation in place, customers can build pipelines around their infrastructure to facilitate compliance checks, disaster recovery workflows, or image update cycles. For example, monthly patching becomes a predictable, low-effort process when Terraform, Packer, and Ansible are chained together. The most advanced customers are building custom workflows that fully automate onboarding, image updates, and policy enforcement. These pipelines reduce manual toil and improve reliability across the board. Automation also improves security posture. By storing configuration in source control and enforcing policy-as-code, customers can ensure that only approved changes are deployed. This makes it easier to pass audits and respond to incidents. Finally, automation scales. Whether a customer manages a few hundred VDAs or tens of thousands across hybrid environments, automation ensures operational overhead doesn’t grow linearly with the environment. Which Automation possibilities does Citrix offer?Citrix offers many ways to automate your Citrix environment. You can use any Automation strategy you are familiar with, or that best suits your overall strategy. Of course, not all functionalities are achievable with all Automation toolkits. Each toolkit has its own strengths and weaknesses. You need to decide for yourself what to use for which deployment. PowerShell SDKs: Automate granular management tasks for Citrix Virtual Apps™ and Desktops™, NetScaler®, and Cloud Citrix DaaS™ REST API: API-driven operations for resource management, data retrieval, and configuration changes Citrix Hypervisor™ CLI: Automate VM lifecycle and network management in Citrix Hypervisor environments Ansible: Orchestrate and manage complex Citrix environments with agentless automation Terraform: Deploy and manage Citrix infrastructure with infrastructure-as-code (IaC) principles Packer: Create, manage, and deploy Master Images for Citrix infrastructures based on infrastructure-as-code (IaC) principles Suitable Use Cases for Automation (examples): Infrastructure Provisioning: Automate the setup of servers, networks, and storage using tools like Terraform or Ansible Deployment Pipelines: CI/CD pipelines that automate the build, test, and deployment process Monitoring and Alerts: Automatically check your infrastructure for unwanted changes and trigger alerts when changes are detected - you can even remediate them automatically using the right toolkit Security Compliance: Automate security checks and compliance validations Limitations of Automation (examples): Complex Decision-Making: Tasks requiring human judgment, especially in ambiguous situations Creative and Innovative Processes: Automation cannot replace creativity, brainstorming, or strategy development Highly Variable Processes: Tasks with too much variability or a lack of standard procedures are challenging to automate Which Components can be automated?Here is a matrix showcasing which components can be automated. Note This matrix will be constantly reviewed and edited as products evolve. Overview: Green means Automation using this toolkit/framework is possible, Yellow means partially possible, Red means not possible. DaaS-specific: Green means Automation using this toolkit/framework is possible, Yellow means partially possible, Red means not possible. Software Package-specific: Green means Automation using this toolkit/framework is possible, Yellow means partially possible, Red means not possible. Administration-specific: Green means Automation using this toolkit/framework is possible, Yellow means partially possible, Red means not possible. Why should you use Automation with the Triad over REST API, PowerShell, or GUI?In all our guides and documentation, we use 3 distinct toolkits for all our core Automation tasks. Let´s call these the “Triad”. Hashicorp Packer for Master Image Creation and Image Handling Hashicorp Terraform for the deployment of the Infrastructure components and as the backbone of the Automation task RedHat Ansible for System configurations and the deployment, installation, and configuration of Applications A detailed description of all three toolkits is available later in this document. Let´s have a look at the main differences between the toolkits for Infrastructure-as-Code: Comparison of PowerShell vs Rest API vs Terraform PowerShell REST API Terraform Use Case Automating tasks in Citrix Cloud, Citrix Virtual Apps and Desktops, and NetScaler environments via cmdlets Direct programmatic access to Citrix Cloud, Citrix Virtual Apps and Desktops, and NetScaler, enabling custom integrations Infrastructure as Code (IaC) for Citrix Cloud, Citrix Virtual Apps and Desktops, and NetScaler Automation Scope Task-level automation (e.g., managing user sessions, configuring virtual servers, resource provisioning) API-driven operations for resource management, data retrieval, and configuration changes Full infrastructure lifecycle management (e.g., provisioning, updating, scaling infrastructure) Ease of Use High for Citrix admins with PowerShell knowledge. Easy scripting with cmdlets Low learning curve: Administrators should have some experience with Windows/PowerShell Moderate: Requires knowledge of API endpoints and coding (e.g., Python, JavaScript) Moderate learning curve: Requires learning the Citrix API and handling RESTful interactions Moderate: Requires knowledge of HCL (HashiCorp Configuration Language) for defining infrastructure Moderate learning curve: Requires learning Terraform language and understanding IaC principles Configuration Type Script-based: Commands specify exactly how to perform tasks Programmatic: Directly interacting with APIs to perform tasks Declarative: Define the desired end-state of infrastructure, and Terraform figures out the steps to achieve it Setup Complexity Low: No additional setup required apart from installing Citrix PowerShell SDKs Moderate: Requires understanding of Citrix API documentation and authentication (OAuth tokens, API keys) Moderate: Requires provider configuration (Citrix Cloud, Citrix Virtual Apps and Desktops) and Terraform installation Scalability Suitable for small to medium-scale automation tasks (one-time or scheduled scripts) High: Can be used in custom applications for large-scale integration, but requires handling concurrency, rate limits High: Scalable and reusable infrastructure configurations. Excellent for large, complex environments State Management No state management; scripts must be run manually or via automation tools (e.g., Scheduled Tasks) No inherent state management; the developer needs to handle state in applications Managed via state files, allowing tracking of infrastructure over time and ensuring consistent environments Version Control Possible to store scripts in version control, but no native versioning for tasks or infrastructure Version control through the code used to interact with the API, but no inherent versioning of infrastructure Native version control through configuration files, with tracking of infrastructure changes over time Integration with other Tools Integrates well with Windows-based automation tools and systems (e.g., Windows Task Scheduler, Jenkins) Can be integrated into custom software or DevOps pipelines (e.g., via CI/CD tools like Jenkins) Natively integrates with CI/CD tools (e.g., GitLab CI, Jenkins, Azure DevOps) for continuous delivery of infrastructure Best Usage Scenarios Managing Citrix sessions and desktops Configuring NetScaler traffic policies One-time tasks and small-scale automation Custom applications for managing Citrix resources Real-time data queries API-driven automation Automating Citrix infrastructure provisioning and scaling Managing complex, multi-cloud or multi-environment Citrix deployments Some thoughts about choosing the right toolkit: PowerShell: Best for administrators needing detailed control of Citrix components REST API: Best for developing custom applications for managing Citrix resources Terraform: Ideal for teams practicing infrastructure-as-code with a focus on scalability Ansible: Useful for automating post-install configurations, network, and application delivery configurations in a declarative manner Look at a comparison of creating the same Machine Catalog using Terraform, REST-API, and PowerShell: Terraform – Declarative Approach: resource "citrix_daas_machine_catalog" "TF-CC-MC" { depends_on = [ citrix_daas_hypervisor_resource_pool.TF-CC-HYPV-POOL ] name = "${var.cc-mc-name}" description = "${var.cc-mc-description}" zone = citrix_daas_hypervisor.TF-CC-HYPV.zone service_account = "${var.azurerm-vm-domainAdminUsernameWithoutDomain}" service_account_password = "${var.azurerm-vm-domainAdminPassword}" allocation_type = "${var.cc-mc-allocationtype}" # "Random" session_support = "${var.cc-mc-sessiontype}" # "SingleSession" provisioning_scheme = { machine_config = { hypervisor = citrix_daas_hypervisor.TF-CC-HYPV.id hypervisor_resource_pool = citrix_daas_hypervisor_resource_pool.TF-CC-HYPV-POOL.id service_offering = "${var.cc-mc-service_offering}" resource_group = "${var.azurerm-resource_group_name}" master_image = "${var.azurerm-masterimage-name}" } network_mapping = { network_device = "0" network = "${var.azurerm-subnet-name}" } number_of_total_machines = "${var.cc-mc-machine_count}" machine_account_creation_rules = { naming_scheme = "${var.cc-mc-naming_scheme_name}" naming_scheme_type = "${var.cc-mc-naming_scheme_type}" domain = "${var.azurerm-vm-domainname}" } os_type = "${var.cc-mc-os_type}" storage_type = "${var.cc-mc-storage_type}" use_managed_disks = "${var.cc-mc-use_managed_disks}" } } REST-API – Declarative Approach, more complicated syntax due to strict formatting rules: POST https://api-eu.cloud.com/cvad/manage/MachineCatalogs?async=true Authorization: Bearer Citrix-CustomerId: Citrix-InstanceID: X-AdminCredential: Basic MjFceDIx… Body: { "Name": "MC-AZ-HIB-NAME", "AllocationType":"Static", "MinimumFunctionalLevel":"LMAX", "PersistUserChanges":"OnLocal", "ProvisioningType":"MCS", "IsPowerManaged": true, "SessionSupport":"SingleSession", "Scopes":["00000000-0000-0000-0000-000000000000"], "Tenants":[], "Zone":"The Austrian Citrix Guy - AzHib", "VdaUpgradeType":"NotSet", "ProvisioningScheme":{ "MasterImagePath":"XDHyp:\\HostingUnits\\NW-TACG-XXXXX\\image.folder\\CTX-Hibtest2.resourcegroup\\CTX-HibTest-M_OsDisk.manageddisk", "CpuCount":null, "MemoryMB":null, "UseWriteBackCache":false, "NumTotalMachines":1, "NetworkMapping":[ {"DeviceNameOrId":"default","NetworkDeviceNameOrId":"0", "NetworkPath":"XDHyp:\\HostingUnits\\NW-TACG-XXXXX\\virtualprivatecloud.folder\\East US.region\\virtualprivatecloud.folder\\CTX-Hibtest2.resourcegroup\\TACG-HibTest-DCCC-vnet.virtualprivatecloud\\default.network" }], "Metadata": [ { "Name": "SupportsHibernation", "Value": "True" } ], "IdentityType":"ActiveDirectory", "MachineAccountCreationRules":{ "NamingScheme":"MCS-REST-W11-#","NamingSchemeType":"Numeric","Domain":"hib.the-austrian-citrix-guy.at","OU":"CN=Computers,DC=hib,DC=the-austrian-citrix-guy,DC=at"}, "MachineProfilePath":"XDHyp:\\HostingUnits\\NW-TACG-XXXXX\\machineprofile.folder\\CTX-Hibtest2.resourcegroup\\CTX-HibTest-M.vm", "PrepareImage":true, "DedicatedTenancy":false, "SecurityGroups":null, "UseFullDiskCloneProvisioning":false,"CustomProperties":[{"Name":"UseManagedDisks","Value":"true"},{"Name":"OsType","Value":"Windows"},{"Name":"StorageType","Value":"Premium_LRS"},{"Name":"LicenseType","Value":"Windows_Server"},{"Name":"Zones","Value":"1"}], "ServiceOfferingPath":"XDHyp:\\HostingUnits\\NW-TACG-XXXXX\\serviceoffering.folder\\Standard_D2s_v5.serviceoffering"}, "AdminFolder":"0" } PowerShell – Imperative Approach, the most complicated, but most flexible way: [CmdletBinding()] param ( [Parameter(Mandatory=$true)] [string] $hostingUnitPath, [Parameter(Mandatory=$true)] [string] $catalogName, [string] $catalogDescription, [Parameter(Mandatory=$true)] [int] $numVmsToCreate, [string] $adminAddress, [Parameter(Mandatory=$true)] [string] $namingScheme, [string] $OU, [Parameter(Mandatory=$true)] [string] $domain, [Parameter(Mandatory=$true)] [string] $masterImagePath ) Set-HypAdminConnection -AdminAddress $adminAddress $hostingUnit = get-item $hostingUnitPath $hostConnection = $hostingUnit.hypervisorConnection $brokerHypConnection = Get-BrokerHypervisorConnection -HypHypervisorConnectionUid $hostConnection.HypervisorConnectionUid $catalog = New-BrokerCatalog -AllocationType 'Permanent' -Description $catalogDescription -IsRemotePC $False ` -MinimumFunctionalLevel 'L7' -Name $catalogName -PersistUserChanges 'OnPvd' -ProvisioningType 'MCS' ` -Scope @() -SessionSupport 'SingleSession' -LoggingId $loggingId -AdminAddress $adminAddress $adPool = New-AcctIdentityPool -IdentityPoolName $catalogName -NamingScheme $namingScheme ` -NamingSchemeType 'Numeric' -OU $OU -Domain $domain -AllowUnicode ` -LoggingId $loggingId -AdminAddress $adminAddress Set-BrokerCatalogMetadata -CatalogId $catalog.Uid -Name 'Citrix_DesktopStudio_IdentityPoolUid' ` -Value $adPool.IdentityPoolUid -LoggingId $loggingId -AdminAddress $adminAddress $provSchemeTaskID = New-ProvScheme -ProvisioningSchemeName $catalogName -HostingUnitUID $hostingUnit.HostingUnitUID ` -IdentityPoolUID $adpool.IdentityPoolUid -CleanOnBoot -MasterImageVM $masterImagePath -UsePersonalVDiskStorage ` -RunAsynchronously -LoggingId $loggingId -AdminAddress $adminAddress $ProvTask = get-provTask -TaskID $provSchemeTaskID -AdminAddress $adminAddress $taskProgress = 0 write-host "Creating New ProvScheme" while ($provTask.Active -eq $true) try {$totalPercent = if ($provTask.TaskProgress){$provTask.TaskProgress} else {0}} catch {} sleep 30 $ProvTask = get-provTask -TaskID $provSchemeTaskID -AdminAddress $adminAddress } $provScheme = get-provScheme -ProvisioningSchemeUID $provTask.ProvisioningSchemeUid $controllers = Get-BrokerController | select DNSName Add-ProvSchemeControllerAddress -ProvisioningSchemeUID $provScheme.ProvisioningSchemeUID -ControllerAddress $controllers ` -LoggingId $loggingId -AdminAddress $adminAddress Set-BrokerCatalog -InputObject $catalog -ProvisioningSchemeId $provTask.ProvisioningSchemeUid -LoggingId $loggingId -AdminAddress $adminAddressDecide for yourself which option is most convenient for you. Automating the Citrix PlatformAutomated deployments and configurations, along with Infrastructure-as-Code (IaC), are essential components of modern IT infrastructure management. These practices streamline operations, reduce human error, and enhance consistency across environments. In regulated industries such as finance, healthcare, and government, adopting IaC is not just beneficial but often mandatory due to compliance and audit requirements. What is Infrastructure-as-Code (IaC)Infrastructure as Code (IaC) represents a contemporary methodology for overseeing and provisioning computing resources through the use of machine-readable definition files, rather than relying on physical hardware setups or interactive configuration tools. Traditionally, setting up infrastructure involves manual processes, such as connecting servers, installing operating systems, and configuring networks. However, with the advent of cloud computing, there has been an increasing necessity for scalable, repeatable, and automated infrastructure solutions. IaC was developed to fulfill this requirement. Early tools like Puppet and Chef laid the groundwork for declarative configuration management, while subsequent advancements such as Terraform and AWS CloudFormation revolutionized IaC by enabling entire infrastructure environments to be defined and deployed through code. Key PrinciplesDeclarative Configuration: Define the desired state of infrastructure, and the tool ensures it matches Version Control: Infrastructure definitions are stored in version control systems like Git Automation: Infrastructure is provisioned automatically without manual intervention Idempotency: Applying the same configuration multiple times results in the same infrastructure state Core PrerequisitesOne of the most important prerequisites is a functioning communication channel between the machines hosting the usual frameworks (e.g. Terraform, Packer, Ansible, PowerShell) and the Windows/Linux machines to be edited. Important There are two main ways of running commands remotely - WinRM and SSH. SSH is primarily used in the Linux world, while WinRM is used in the Windows world. Be sure to enable at least one communication path. After enabling, ensure the communication works as intended – you can use the short Terraform snippet mentioned later. Communication Flow between Terraform, Ansible, Packer, and the Target MachinesAll communication between Terraform, Packer, and Ansible on the IaC-VM and the target VMs on the Hypervisors or HyperScalers uses SSH and/or WinRM. WinRM (Windows Remote Management) is a Microsoft protocol that enables remote management of Windows systems by allowing access to remote computers to perform management tasks. It is Microsoft's implementation of the WS-Management (Web Services Management Protocol) standard. It often uses SOAP (Simple Object Access Protocol) for communication over HTTP or HTTPS, using ports 5985 (HTTP) and 5986 (HTTPS) by default. WinRM provides the basis for remote management with PowerShell and is used for tasks such as running remote scripts, automating, configuring, and performing system inventory. Therefore, WinRM and SSH must be configured correctly. Important We emphasize ensuring the communication flow works as intended from the outset of the pre-domain-joined stage; otherwise, Terraform, Ansible, and Packer will fail to configure the VMs and create the images. During the pre-domain-join stage, you can configure these settings using the local Group Policy Editor on the VM or in the autounattend.xml file if you use Packer to create the Master Image. After a successful domain join, you can set all relevant settings using GPOs. To provide maximum flexibility and a fallback mechanism, you can use both listeners—HTTP and HTTPS. You can check all available listeners using PowerShell: PS > winrm e winrm/config/listener Listener [Source="GPO"] Address = * Transport = HTTP Port = 5985 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 10.10.119.13, 127.0.0.1, ::1, fe80::287c:216e:9bd9:18e5%7 Listener Address = * Transport = HTTPS Port = 5986 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint = e3bf89dd77c95dd6c0f1b94480ea63782df4279e ListeningOn = 10.10.119.13, 127.0.0.1, ::1, fe80::287c:216e:9bd9:18e5%7WinRM Secure Enablement ChecklistEnabling WinRM must be carefully planned, as it exposes potential attack vectors on Windows machines. Caution Be sure to enable WinRM in the most secure, least-privileged way possible. Look at an example checklist for enabling WinRM: Control Area Action / Best Practice Domain-Joined Workgroup Compliance Mapping Preparation Confirm OS support, patch systems, plan firewall rules (5985/5986), decide authentication model ✅ ✅ CIS 18.9.84, NIST SI‑2, ISO A.12.6.1 Enablement Enable WinRM (via GPO in domain, winrm quickconfig in workgroup) ✅ (GPO) ✅ (Manual) CIS 18.9.84, NIST CM‑7, ISO A.9.2.3 Authentication Use Kerberos (preferred), avoid NTLM; configure HTTPS with certs ✅ ⚠️ NTLM fallback NIST IA‑2, ISO A.9.4.2, CIS 18.9.84 TrustedHosts Configure only specific hosts; avoid * N/A ✅ NIST AC‑3, ISO A.9.1.2 Certificates Deploy enterprise PKI certs (auto-enrollment) or self-signed/internal CA in workgroup ✅ ✅ NIST SC‑12, ISO A.10.1.2 Firewall Open 5985/5986; enforce via GPO or manual rules ✅ ✅ CIS 9.1, NIST SC‑7, ISO A.13.1.1 Access Control Restrict WinRM to admin/security groups; audit via Event Logs ✅ ✅ NIST AC‑6, ISO A.9.2.3, CIS 18.9.84 HTTPS Binding Bind cert to listener (winrm create winrm/config/Listener…) ✅ ✅ NIST SC‑12, ISO A.10.1.2 Disable HTTP Remove HTTP listener if HTTPS is enforced ✅ ✅ CIS 18.9.84, NIST SC‑8, ISO A.13.2.3 Session Tuning Adjust MaxMemoryPerShellMB, MaxShellsPerUser, IdleTimeout for automation scale ✅ ✅ NIST CM‑6, ISO A.12.1.3 Least Privilege Implement JEA (Just Enough Administration) endpoints ✅ ✅ NIST AC‑6, ISO A.9.1.2 Monitoring & Logging Enable detailed WinRM logging; forward to SIEM ✅ ✅ NIST AU‑6, ISO A.12.4.1, CIS 6.2 Maintenance Patch regularly, rotate certificates, review TrustedHosts, audit access ✅ ✅ NIST SI‑2, ISO A.12.6.1, CIS 3.4 Example Flow for Enabling Secure WinRM CommunicationThis is an example of enabling Secure WinRM communication using PowerShell - please adapt to your regulations and needs: Enable WinRM Service: Enable-PSRemoting -Force Set-Service -Name WinRM -StartupType Automatic Create a Self‑Signed Certificate: $CertCN = $env:COMPUTERNAME $cert = New-SelfSignedCertificate -DnsName $CertCN -CertStoreLocation Cert:\LocalMachine\My $thumbprint = $cert.Thumbprint Configure HTTPS Listener: winrm delete winrm/config/Listener?Address=*+Transport=HTTPS 2>$null winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"$CertCN`"; CertificateThumbprint=`"$thumbprint`"}" Configure TrustedHosts: $TrustedHosts = "192.168.0.100,192.168.0.101" # Replace with your management servers Set-Item WSMan:\localhost\Client\TrustedHosts -Value $TrustedHosts -Force Configure Firewall: If (-Not (Get-NetFirewallRule -DisplayName "WINRM HTTPS" -ErrorAction SilentlyContinue)) { New-NetFirewallRule -Name "WINRM_HTTPS" -DisplayName "WINRM HTTPS" -Protocol TCP -LocalPort 5986 -Action Allow } Testing WinRM Communication FlowAfter enabling WinRM communication, test the flow. Therefore, use the following Terraform snippet: Unsecure Communication - connecting to the HTTP listener – TestWinRM-Unsecure.tf resource "null_resource" "UploadTestFileToVMToTest" { connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_ToTest-IP timeout = var.Provisioner_Timeout } ###### Upload Test script to VMToTest provisioner "file" { source = "${path.module}/data/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallOnVMToTest" { depends_on = [null_resource.UploadTestFileToVMToTest] connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_ToTest-IP timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } } Secure Communication - connecting to the HTTPS listener – TestWinRM-Secure.tf resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_ToTest-IP port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_ToTest-IP port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } }TestWinRM-auto.tfvars.json { "Provisioner_Type":"winrm", "Provisioner_Admin-Username":"XxXxXxX", "Provisioner_Admin-Password":"XxXxXxXxX", "Provisioner_SecureAdmin-Username":"XxXxXxX", "Provisioner_SecureAdmin-Password":"XxXxXxXxX", "Provisioner_ToTest-IP":"10.53.16.101", "Provisioner_Port":443, "Provisioner_HTTPS":true, "Provisioner_Timeout":"20s" }These snippets try to upload a script from the Terraform host to a Virtual Machine and to execute the script. If you can see “Connected” in the following output, you can be sure that the communication between the Terraform (or Packer or Ansible) host works as intended: Unsecure connection established: XxXxXxXxX@devops-automation:/etc/terraform$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # null_resource.InstallOnVMToTest will be created + resource "null_resource" "InstallOnVMToTest" { + id = (known after apply) } # null_resource.UploadTestFileToVMToTest will be created + resource "null_resource" "UploadTestFileToVMToTest" { + id = (known after apply) } Plan: 2 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.UploadTestFileToVMToTest: Creating... null_resource.UploadTestFileToVMToTest: Provisioning with 'file'... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.UploadTestFileToVMToTest: Creation complete after 2s [id=XxXxX] null_resource.InstallOnVMToTest: Creating... null_resource.InstallOnVMToTest: Provisioning with 'remote-exec'... null_resource.InstallOnVMToTest (remote-exec): Connecting to remote host via WinRM... null_resource.InstallOnVMToTest (remote-exec): Host: 10.53.16.101 null_resource.InstallOnVMToTest (remote-exec): Port: 5985 null_resource.InstallOnVMToTest (remote-exec): User: XxXxXxX null_resource.InstallOnVMToTest (remote-exec): Password: true null_resource.InstallOnVMToTest (remote-exec): HTTPS: false null_resource.InstallOnVMToTest (remote-exec): Insecure: true null_resource.InstallOnVMToTest (remote-exec): NTLM: false null_resource.InstallOnVMToTest (remote-exec): CACert: false null_resource.InstallOnVMToTest (remote-exec): Connected! #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.InstallOnVMToTest (remote-exec): C:\Users\azadmin>powershell -File c:/temp/Test-Script.ps1 #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj><Obj S="progress" RefId="1"><TNRef RefId="0" /><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.InstallOnVMToTest: Creation complete after 3s [id=XxXxX] Apply complete! Resources: 2 added, 0 changed, 0 destroyed. XxXxXxXxX@devops-automation:/etc/terraform$Secure connection established: XxXxXxXxX@devops-automation:/etc/terraform$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # null_resource.InstallOnVMToTest will be created + resource "null_resource" "InstallOnVMToTest" { + id = (known after apply) } # null_resource.UploadTestFileToVMToTest will be created + resource "null_resource" "UploadTestFileToVMToTest" { + id = (known after apply) } Plan: 2 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.UploadTestFileToVMToTest: Creating... null_resource.UploadTestFileToVMToTest: Provisioning with 'file'... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.UploadTestFileToVMToTest: Creation complete after 2s [id=XxXxX] null_resource.InstallOnVMToTest: Creating... null_resource.InstallOnVMToTest: Provisioning with 'remote-exec'... null_resource.InstallOnVMToTest (remote-exec): Connecting to remote host via WinRM... null_resource.InstallOnVMToTest (remote-exec): Host: 10.53.16.101 null_resource.InstallOnVMToTest (remote-exec): Port: 5986 null_resource.InstallOnVMToTest (remote-exec): User: XxXxXxX null_resource.InstallOnVMToTest (remote-exec): Password: true null_resource.InstallOnVMToTest (remote-exec): HTTPS: true null_resource.InstallOnVMToTest (remote-exec): Insecure: false null_resource.InstallOnVMToTest (remote-exec): NTLM: false null_resource.InstallOnVMToTest (remote-exec): CACert: true null_resource.InstallOnVMToTest (remote-exec): Connected! #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.InstallOnVMToTest (remote-exec): C:\Users\azadmin>powershell -File c:/temp/Test-Script.ps1 #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj><Obj S="progress" RefId="1"><TNRef RefId="0" /><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.InstallOnVMToTest: Creation complete after 3s [id=XxXxX] Apply complete! Resources: 2 added, 0 changed, 0 destroyed. XxXxXxXxX@devops-automation:/etc/terraform$ Communication Flow using SSHSSH, known as Secure Shell, is a protocol designed for secure remote system login. It is primarily used for accessing remote Linux servers. An SSH server establishes a secure and encrypted connection that facilitates remote management, file transfers, and tunneling. Its significance lies in its ability to supersede older, less secure protocols such as Telnet, support automation and DevOps practices, and provide secure remote access across various platforms including Linux, Windows, and network devices. Important Windows Server 2025 already includes an OpenSSH-based SSH server. SSH Secure Enablement ChecklistAs for WinRM, enabling SSH must be carefully planned, as it exposes potential attack vectors on the target machines. Caution Be sure to enable SSH in the most secure, least-privileged way possible. Look at an example checklist for enabling SSH on a Linux machine: SSH Server Hardening Checklist with Compliance Mapping Control Area Action / Best Practice Compliance Mapping (examples) Preparation Keep OpenSSH and OS patched; back up sshd_config; define access scope CIS 5.1, NIST SI‑2, ISO A.12.6.1 Authentication Disable root login (PermitRootLogin no); disable password auth; enforce key‑based auth; use strong keys (RSA 3072+, Ed25519); rotate keys; enable MFA CIS 5.2.8, NIST IA‑2, ISO A.9.4.2 Access Control Restrict users/groups (AllowUsers, AllowGroups); limit source IPs; use bastion hosts; disable empty passwords CIS 5.2.9, NIST AC‑3, ISO A.9.1.2 Cryptography Force SSH‑2 only; allow modern ciphers (chacha20, AES‑GCM); strong MACs (SHA‑2); secure KEX (curve25519) CIS 5.2.11, NIST SC‑12, ISO A.10.1.2 Session Management Idle timeout (ClientAliveInterval 300, ClientAliveCountMax 2); limit concurrent sessions; reduce MaxAuthTries; configure legal banner CIS 5.2.12, NIST AC‑11, ISO A.9.4.3 Logging & Monitoring Set LogLevel VERBOSE; centralize logs; monitor failed logins (fail2ban/sshguard); audit authorized keys CIS 4.1, NIST AU‑6, ISO A.12.4.1 Network & Firewall Restrict SSH to trusted networks; optionally change default port; enable TCP wrappers; apply rate limiting CIS 9.1, NIST SC‑7, ISO A.13.1.1 Advanced Hardening Use chroot/restricted shells for untrusted accounts; disable port/X11/agent forwarding unless required; consider SSH certificates for scalable key management CIS 5.2.14, NIST AC‑6, ISO A.9.2.3 Maintenance Patch OpenSSH regularly; rotate keys; review access quarterly; validate against CIS/NIST/ISO benchmarks CIS 3.4, NIST SI‑2, ISO A.12.6.1 Example Flow for Enabling SSH Communication on UbuntuThis is an example of enabling SSH communication on Ubuntu: Install SSH: sudo apt update sudo apt install openssh-server Check SSH Service Status and start it, if necessary: sudo systemctl status ssh sudo systemctl start ssh sudo systemctl enable ssh Configure Firewall: sudo ufw allow ssh sudo ufw enable Harden SSH Configuration by editing /etc/ssh/sshd_config: sudo nano /etc/ssh/sshd_config Port 22 # Or change to a non-standard port Protocol 2 # Enforce SSH-2 only PermitRootLogin no # Disable direct root login PasswordAuthentication no # Enforce key-based authentication PermitEmptyPasswords no # Disallow empty passwords MaxAuthTries 3 # Limit login attempts AllowUsers adminuser # Restrict access to specific users ClientAliveInterval 300 # Disconnect idle sessions after 5 minutes ClientAliveCountMax 2 LogLevel VERBOSE # Enable detailed logging Restart SSH: sudo systemctl restart ssh Set up Key-Based Authentication (if wanted): ssh-keygen -t ed25519 -C "admin@yourdomain" ssh-copy-id adminuser@yourserver Ensure the storage location of the authorized keys is properly secured - ~/.ssh/authorized_keys Example Flow for Enabling SSH Communication on Windows before Windows Server 2025This is an example of enabling SSH communication on Windows Server/Windows 11 Check if OpenSSH is available: PS> Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*' Name : OpenSSH.Client~~~~0.0.1.0 State : Installed Name : OpenSSH.Server~~~~0.0.1.0 State : NotPresent PS> Install the OpenSSH server components needed: PS> Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 Path : Online : True RestartNeeded : False PS> Configure OpenSSH Server: PS> Set-Service -Name sshd -StartupType 'Automatic' PS> PS> if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) { >> Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..." >> New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 >> } else { >> Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists." >> } Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists. PS> PS> Start-Service sshd PS> Example Flow for Enabling SSH Communication on Windows Server 2025Beginning with Windows Server 2025, OpenSSH is installed by default. You only need to follow Step 3 above to configure it. Installing OpenSSH using PackerLater in this guide, we will show an example of how to use Packer to automatically install and configure SSH on a Windows-based master image. Testing SSH Communication FlowAfter enabling SSH, test the communication flow. Therefore, use the Terraform snippet mentioned above and change it accordingly to use SSH. Benefits of Infrastructure-as-CodeLet´s have a look at some important benefits when using Infrastructure-as-Code: Speed and Efficiency:What it really means: IaC turns infrastructure provisioning from a manual, ticket-driven process into deterministic code execution. This shortens lead time for changes and slashes toil across Day 0/1/2 operations (create, update, and maintain). Why it matters: Lead time: From request to ready environment drops from days/weeks to minutes/hours. MTTR (mean time to recovery): Improves because you can recreate, not repair. Self-service: Becomes viable (devs or platform consumers request pre-approved stacks via PR or portal). Example: A dev team spins up a production-like environment with Terraform modules + GitHub Actions in ~15 minutes, instead of opening IT tickets and waiting a week. Feature branches get on-demand preview environments, improving test fidelity and cycle time. KPIs to track: Lead time for infra changes Time to provision the new environment MTTR for infra incidents % change automation (vs. manual) Practices that enable it: Standard modules/blueprints (e.g., Terraform Registry modules, Azure Bicep modules) CI/CD for infra (GitHub Actions/Azure DevOps) with plan → review → apply Ephemeral/preview environments for feature branches Pre-approved patterns/guardrails (policy-as-code) to avoid human bottlenecks Consistency and Standardization:What it really means: You codify “the right way” to build and configure infrastructure, so every environment is created from reusable modules with opinionated defaults. Why it matters: Fewer drift and misconfigurations (the top cause of outages/security gaps) Compliance by construction: encryption, logging, network boundaries baked into templates Predictability across dev/test/stage/prod increases confidence and reduces surprises Example: A “base Virtual Machine” module enforces: The same settings for all VMs are created based on the module All regulations and needs are met Centralized logging/metrics Tagging for cost and ownership Every service team consumes the same module versions via a module registry. KPIs to track: Drift rate (resources not matching code) Policy violations per deployment % of infra created via approved modules/templates Change failure rate Practices that enable it: Golden modules/blueprints with versioning and semantic versioning Policy-as-code (e.g., Azure Policy, Citrix Policy) in CI Guardrails in the pipeline (failing builds on violations) Module registries/internal catalogs for discoverability and re-use Scalability:What it really means: IaC lets you scale breadth (many teams/environments) and depth (complex, multi-cloud, multi-account/tenant topologies) without linear increases in human effort. Why it matters: Add new environments/regions/accounts with minimal friction Safely manage complex estates (e.g., hub/spoke networks, shared services) Support rapid org growth and M&A without fragile manual processes Example: A platform team uses composition: org > account/subscription > environment > workload. Each layer references vetted modules Workspaces (or stacks) handle per-environment state and variables Global rollouts move from “snowflake” deployments to controlled, batched changes KPIs to track: Ratio of platform engineers to product teams supported Time to bring a new team/service online % automated vs. manual tasks Practices that enable it: Layered architecture (foundation → platform → product) Remote state with locking (e.g., Terraform backends) and clear state separation Workspaces/stacks and environment-specific variables Pipelines that fan out (matrix builds) for multi-environment changes Version Control and Auditability:What it really means: Every infrastructure change is a code change—reviewed, versioned, traceable, and reversible. Why it matters: Auditable history: Who changed what, when, and why (PRs tie changes to tickets) Safe rollbacks: Revert git commits and re-apply Separation of duties: Reviewers/approvers defined in the repo, not ad hoc Example: A PR updating a database parameter includes a Terraform plan, cost estimate, and security policy checks. Approvers see the exact delta and impact before merging and applying. Six months later, auditors can reconstruct the decision trail. KPIs to track: % infra changes via PR (vs. console) Average reviewers per infra PR Time in review; % auto-approvals vs. manual Incidents tied to unreviewed changes Practices that enable it: Enforce “no-clickops” (block cloud console changes to production or detect & revert drift) Mandatory code owners and review policies Signed commits, protected branches, and required checks (plan, policy, tests) Secrets management (no secrets in code; use KV/managed identities/OIDC) Cost Management:What it really means: Cost control becomes proactive: you estimate before provisioning, enforce budgets and right-sizing through code, and automatically tear down idle resources. Why it matters: Prevents “surprise bills” from ad hoc provisioning Enables FinOps guardrails (budgets, quotas, instance families, tagging) Facilitates chargeback/showback with reliable tagging and ownership data Example: Pipelines run a cost-estimation step on the plan and fail the PR if it breaches a budget threshold. Modules enforce mandatory tags (owner, cost center, environment). Non-production resources default to auto-suspend or TTL policies. KPIs to track: % changes with pre-merge cost estimate Cost per environment/team vs. budget variance Idle/underutilized spend reclaimed Resource tagging coverage Practices that enable it: Tagging standards enforced in CI (and policy-as-code) Budget and quota policies at the org/subscription level Default sizes and autoscaling parameters in modules Scheduled shutdowns/TTL for non-prod and previews Collaboration:What it really means: Infrastructure becomes a shared, reviewable artifact—just like application code—enabling platform, security, SRE, and app teams to work from a single source of truth. Why it matters: Requirements are codified rather than buried in tickets Reusable patterns reduce rework and cognitive load across teams Example: A platform repo hosts modules (networking, data stores, observability). App teams reference these modules in their own repos, while central teams maintain the standards. Security authors policies-as-code that run in every pipeline. Master image creators offer validated, proven master images for deployment. KPIs to track: Reuse ratio (modules used across teams) Time from request to approved pattern availability % of issues closed with community PRs Practices that enable it: Clear ownership: platform maintains modules; product teams consume Contribution guidelines and examples (scaffolding/templates) Documentation as code (README/diagrams in the repo) GitOps practices (PR-based changes, environments reconciled from git) Cross-Cutting Enablers - all 6 benefits together:Testing for IaC: Unit tests for modules (e.g., Terratest), static analysis (tflint, checkov), integration tests in ephemeral envs Policy-as-Code: OPA/Conftest, Azure Policy/Bicep rules, Security Hub/Config for AWS—fail fast in CI Environment Strategy: Strict separation of dev/test/stage/prod, promotion via artifacted module versions (not copy/paste) State & Secrets Hygiene: Remote state with locking, least-privilege service principals, short-lived tokens via OIDC, no shared credentials Drift Detection: Scheduled plans or reconciler tools to detect and correct out-of-band changes Change Management: PR templates tying changes to tickets, risk classification, and approval routing The Core Idea: Compliance by Construction + Continuous EnforcementIaC turns infrastructure requirements into executable standards. Instead of relying on docs and manual approvals, you codify controls so that: Compliant configurations are the only way to deploy (prevention), and Non‑compliant drift is detected and corrected continuously (detection + remediation). This directly supports control objectives in frameworks like ISO 27001 (e.g., A.12 change management), SOC 2 (Change Management & Logical Access), NIST 800‑53 (CM, AU, SC), PCI DSS (network segmentation, logging, encryption), and HIPAA (access control, audit, transmission security). Controls by Construction (Standardized, Reusable Modules):What happens: You encapsulate required controls into golden modules/blueprints (e.g., Terraform modules, Bicep modules) with opinionated defaults. Teams consume these modules rather than crafting bespoke resources. Compliance impact: Encryption: Default to encryption at rest/in transit; enforce KMS/Key Vault usage Networking: Private subnets, controlled egress, mandatory security groups/NSGs Logging/Monitoring: Centralized log sinks, metrics, and SIEM forwarding configured automatically Tagging & Ownership: Mandatory tags (owner, data classification, cost center) for audit and chargeback Backups & DR: Standard backup policies baked in (RPO/RTO targets) Example: module "secure_storage" { source = "org/secure-storage/azurerm" version = "1.4.2" # Enforced controls enable_encryption = true encryption_key_id = var.managed_key_id private_endpoint = true logging_enabled = true mandatory_tags = { owner = var.owner environment = var.env data_class = var.data_classification # e.g., PII, Confidential } } Policy‑as‑Code Guardrails (Preventive & Detective)What happens: You encode organizational policies into machine‑readable rules that run in CI/CD and/or are enforced in the cloud control plane. Compliance impact: Preventive controls: Pipelines fail early when a change violates policy (e.g., public S3 bucket, open firewall) Detective controls: Runtime monitoring flags drift or misconfigurations post‑deploy Consistent enforcement: No subjective interpretation—policies are deterministic Tools & patterns: CI checks: tflint, Regula against IaC code Cloud enforcement: Azure Policy, AWS Config + SCPs, GCP Organization Policy Cost guardrails: Infracost in PR to prevent budget violations Auditability & Evidence (Change History, Approvals, Plans)What happens: Every infrastructure change is a code change: it lives in Git, goes through PR review, and produces a plan that shows the exact delta before applying. Compliance impact: Full audit trail: Who changed what, when, and why—linked to tickets/issues Evidence artifacts: Stored Terraform plans, policy check outputs, pipeline logs, and approvals Rollback capability: Revert to known‑good states; demonstrate controlled, reversible changes Operational practices: Protected branches, code owners, and required reviewers (segregation of duties) Signed commits; PR templates capturing risk and control references Retain pipeline logs and plan artifacts for the audit period Continuous Compliance & Drift ManagementWhat happens: IaC pipelines (or GitOps reconcilers) regularly compare the desired state to the actual runtime state; cloud‑native services scan for violations. Compliance impact: Drift detection: Catch “clickops” or unapproved changes that break compliance Automated remediation: Reapply code or trigger playbooks to restore a compliant baseline Real‑time posture: Dashboards show compliance coverage and open findings Common tooling: Scheduled terraform plan with alerts on unexpected changes AWS Config, Azure Policy, GCP Security Command Center for runtime checks SIEM hooks to surface violations into central incident workflows Access Control & Segregation of Duties (SoD)What happens: You implement role‑based access to repos, pipelines, and cloud identities, and limit blast radius with scoped service principals. Compliance impact: Least privilege: Pipelines use narrowly scoped identities (e.g., workload identity/OIDC) per environment SoD: Different roles for authors, reviewers, and deployers; approvals enforced by policy Controlled production: No direct console changes; production is applied by approvals and automated checks Data Residency, Classification & LifecycleWhat happens: Data location rules and retention policies are enforced via code and guardrails Compliance impact: Residency: Regions/subscriptions/projects constrained to approved geos Classification: Required tags drive handling rules (backup, encryption, access review cadence) Lifecycle: TTLs for non‑prod, automatic deletion of ephemeral resources to reduce surface area Reporting & Attestation (Proving Compliance)What happens: Pipelines produce machine‑readable reports, and posture tools consolidate findings for stakeholders. Compliance impact: Evidence on demand: Exportable lists of compliant/non‑compliant resources, with timestamps and remediation notes Control mapping: Reports align checks to control IDs (e.g., ISO/NIST/PCI clauses) for audit narratives Trend visibility: Track improvement over time across teams and environments Implementation Blueprint (Practical Steps)Define control objectives: Map regulatory requirements to technical checks (encryption, logging, network boundaries, SoD) Codify standards into modules Publish a curated catalog with opinionated defaults and semver Integrate policy‑as‑code in CI/CD Fail PRs on violations; include cost checks if relevant Enforce runtime guardrails Azure Policy/AWS Config/GCP Org Policy; block non‑compliant resources Lock down production Protected branches, mandatory reviews, no console changes (“no‑clickops”) Establish drift detection Scheduled plan + alerts; reconcile deviations automatically Generate evidence Archive plans, check outputs, and approval logs; align with control catalogs Measure & iterate Publish KPIs to stakeholders; use trends to prioritize control improvements Infrastructure-as-Code in Regulated IndustriesInfrastructure-as-Code (IaC) in regulated industries helps ensure compliance by making infrastructure management auditable, consistent, and automated. By using IaC, organizations can use version control, automated testing, and integrated governance to meet requirements in sectors like healthcare, finance, and government. This approach reduces human error and provides a verifiable history of every change, which is crucial for audits and risk mitigation. IaC supports these requirements by: Auditability and Traceability Every infrastructure change is stored in version control systems (e.g., Git), creating a complete audit trail Regulators demand evidence of who changed what, when, and why. IaC provides this automatically through commit histories and pull requests This aligns with frameworks such as GAMP® 5 and NIST guidance, which emphasize lifecycle management and the verification of IT systems Consistency and Repeatability Manual provisioning introduces human error and configuration drift. IaC eliminates this by ensuring environments (dev, test, prod) are identical and reproducible This is crucial in industries like pharma, finance, and government, where even small deviations can invalidate compliance certifications Policy-as-Code for Compliance Policy-as-Code for Compliance IaC integrates with policy-as-code frameworks (e.g., HashiCorp Sentinel) to enforce compliance rules automatically This ensures that security baselines, encryption standards, and access controls are applied consistently across multi-cloud and hybrid environments Risk Reduction IaC enforces immutable infrastructure—instead of patching live systems, new compliant environments are provisioned from code This reduces the risk of untracked changes and strengthens cyber resilience, which regulators increasingly scrutinize Faster Compliance Validation IaC templates can be pre-validated against regulatory frameworks (e.g., HIPAA, SOX, GDPR) Automated testing and compliance scans shorten audit cycles and reduce the cost of demonstrating conformity Facilitating disaster recovery through reproducible infrastructure setups Using IaC allows a faster disaster recovery due to proven processes, well-tested scripts Implementation and best practicesTreat IaC like application code: IaC should be developed and managed using risk-based software development practices, including verification and validation before deployment Integrate with CI/CD: Integrate IaC changes into CI/CD pipelines to trigger automated deployments, tests, and validations Conduct regular validation: Implement a validation and verification schedule that includes automated testing, peer code reviews, and security assessments Embed security and compliance: Incorporate security checks and compliance guardrails at every step of the IaC pipeline Choose a declarative approach: When possible, use a declarative IaC approach, which defines the desired final state rather than a series of steps. The system then determines the best way to achieve that state, simplifying management and increasing consistency What is Continuous Integration and Continuous Deployment (CI/CD)Continuous Integration and Continuous Deployment (CI/CD) are practices that complement Automation and IaC. CI/CD stands for Continuous Integration and Continuous Delivery/Deployment. It is a set of practices that enable development teams to deliver code changes more frequently and reliably. Continuous Integration (CI): CI involves automatically integrating code changes from multiple contributors into a shared repository. For example, Jenkins triggers builds and tests on each commit, ensuring that new changes do not break existing functionality Continuous Delivery (CD): CD ensures that code is always deployable. For example, Jenkins automates application deployment to staging environments, allowing manual approval before release to production Continuous Deployment: Continuous Deployment extends CD by automatically deploying every change that passes tests to production without manual intervention CI/CD for Infrastructure DeploymentInfrastructure as Code (IaC) allows teams to manage infrastructure using code. For example, Jenkins integrates with tools such as Terraform and Ansible to automate infrastructure provisioning and configuration. A typical CI/CD pipeline for infrastructure might look like this: Validate IaC templates Generate execution plans (e.g., terraform plan) Apply changes (e.g., terraform apply) Run compliance and security checks Destroy resources if needed (for ephemeral environments) CI/CD for Master Image DeploymentMaster images are pre-configured virtual machine templates that include operating systems, patches, and software. Jenkins can automate the creation and deployment of these images using Packer, Terraform, and Ansible. A typical CI/CD pipeline for master image deployment: Trigger Packer to build the image Run Ansible during the build to install software Publish the image to a cloud image gallery (e.g., Azure Shared Image Gallery) Create test VMs from the image Run post-deployment validation using Ansible or other tools CI/CD Using GitHub Actions, Azure Pipelines, and JenkinsThere are various ways to implement Continuous Integration and Continuous Deployment (CI/CD) using GitHub Actions, Azure Pipelines, and Jenkins. GitHub Actions: GitHub Actions is GitHub’s built‑in automation and CI/CD platform. You define workflows as YAML files in your repo that run on specific events (like push, pull_request, schedules, or manual triggers) and execute on runners (GitHub‑hosted Linux/Windows/macOS VMs, or your own self‑hosted machines). It’s used to build, test, deploy, and automate repository tasks Azure Pipelines: Offers seamless integration with Azure services, supports YAML-based pipeline definitions, and provides robust security and compliance features Jenkins: An open-source automation server that supports a wide range of plugins for building, deploying, and automating software projects All tools enable automated testing, deployment, and rollback, ensuring high-quality releases and reducing downtime. Example we have implemented using Jenkins: What is DevOpsDevOps encompasses a collection of practices that integrates software development (Dev) with IT operations (Ops). Its primary objective is to reduce the development lifecycle and facilitate continuous delivery while maintaining high standards of software quality. More than merely a methodology, DevOps represents a cultural transformation that promotes collaboration among teams that have traditionally operated in isolation. The emergence of the DevOps concept was a response to the difficulties organizations encountered in rapidly and reliably delivering software. Prior to the advent of DevOps, development and operations teams functioned independently, which often resulted in delays, poor communication, and failures during deployment. Organizations recognized the necessity for enhanced collaboration and automation within the software delivery process. DevOps has its roots in Agile methodologies and has integrated principles from Lean practices as well as Continuous Delivery strategies. DevOps MethodologiesAssess the Citrix Infrastructure and ProcessesGoal: Build a current‑state map of services, automation entry points, and operational constraints to inform IaC scope and sequencing. What to inventory: Citrix DaaS / CVAD control‑plane & resource locations: Note whether to use the Citrix Terraform provider (recommended), the Citrix DaaS Remote PowerShell SDK, or the DaaS REST APIs for orchestration These are primary automation surfaces NetScaler (Citrix ADC) & ADM: Confirm versions and whether configuration is done via NITRO API, Terraform provider, or Ansible collection; ADM may act as a proxy and automation hub StoreFront, WEM, Provisioning (PVS), MCS: Identify if you rely on PowerShell SDKs (CVAD/StoreFront/WEM) for scripted operations, or if you could use Terraform Monitoring paths: Capture telemetry sources (Citrix Monitor Service OData API) and NetScaler Prometheus/Observability pipelines for metrics/logs/traces; these will feed CI/CD quality gates and SRE dashboards Outcome: A capability matrix—what can be automated via REST/SDK today, which gaps require upgrades or tooling, and which processes (provisioning, config, change, incident) are candidates for codification first. (Use Citrix Cloud API clients/service principals as the auth model for control‑plane automation.) Identify Existing Usage of Automation‑ and Integration‑ToolsObjective: Catalog all existing items to avoid duplication and guide standardization Select Tools Aligned with Existing StandardsRecommended stack (aligned to Citrix & cloud ecosystem): Provisioning IaC: Terraform for cloud infrastructure and resource locations, and NetScaler/SDX configurations Configuration Mgmt: Ansible for Windows configuration and NetScaler run‑time objects (lbvserver, bindings, policies), use Terraform for Daas/CVAD entity configuration PowerShell SDKs can be used out of Terraform and Ansible, where no Terraform or Ansible modules exist CI/CD: GitHub Actions with OIDC federation to Azure or Vault for plan/test/apply workflows and policy validation in pipelines Governance: Azure Policy as Code with EPAC to manage and audit policy definitions/assignments as code (GitOps) Observability: NetScaler Prometheus integration and Citrix Monitor Service OData API for CVAD; wire into Grafana/Splunk as needed Define Source Control and Versioning StrategyPatterns to adopt: Mono‑repo vs. multi‑repo: Keep platform modules (Terraform providers/modules, Ansible roles) in a platform repo, and workload‑specific stacks in application repos. Use reusable workflows for consistency across repos Branching & environments: Git‐based promotion (dev -> test -> prod) with environment‑scoped workflows and workload identity (OIDC) for per‑env credentials; store Terraform state, e.g., in Azure Blob with RBAC Code Owners & approvals: Enforce PR reviews and protected branches; tie changes to tickets for auditability Secrets model: Prefer OIDC over long‑lived secrets; where secrets are unavoidable (e.g., on‑prem SQL, legacy scripts), isolate via environment secrets and ADM proxies Automate Infrastructure ProvisioningTargets & examples: NetScaler/SDX: Declaratively provision VPX instances, HA pairs, GSLB, SSL offload via Terraform provider (NITRO under the hood); ADM proxying is supported in provider config Citrix DaaS/CVAD: Automate Azure/Vsphere/AHV/EC2 components (VNets/VPCs, subnets, VMs), then call the respective Terraform/Ansible snippets to create and configure all needed entities like Machine Catalogs and Delivery Groups Reference guides: Citrix Tech Zone shows end‑to‑end IaC deployments (Terraform + Ansible + Packer) for DaaS resource locations on various Hypervisors and Hyperscalers, and DaaS/CVAD sites Automate Configuration ManagementApproach by domain: NetScaler ADC: Use the netscaler.adc Ansible collection. Works against ADC directly or via ADM proxy CVAD / StoreFront / WEM: Automate with Terraform and PowerShell SDKs called byTerraform/Ansible Citrix DaaS: Automate completely using Terraform and Ansible Implement / Define CI/CD Methodologies for Deployments and UpdatesTriggers: Run plan on pull_request, apply on merge to main; use matrices for multi‑env fan‑out; store plan/apply artifacts OIDC to Azure/AWS/GCP/etc.: Authenticate pipelines without secrets; provision state backend (Blob) and federated identities per environment Quality gates: Static checks (terraform fmt/validate, tflint), policy validation (Azure Policy as Code), optional cost estimates MonitoringTwo pillars for Citrix estates: NetScaler Observability: Export metrics directly to Prometheus (pull/push), visualize in Grafana, and/or use the Observability Exporter to stream logs/traces to Splunk/Zipkin/Kafka CVAD/DaaS Telemetry: Consume service health, sessions, and machine stats via Monitor Service OData API for trend analysis, troubleshooting, and CI/CD post‑deploy verification Governance (policy‑as‑code):Manage Azure Policy definitions/initiatives/assignments via EPAC; keep policies in Git, test in “non‑enforcing” mode, then promote; export non‑compliance reports. Security (pipeline & runtime): Use OIDC federation for GitHub → Azure auth (short‑lived tokens; no long‑lived secrets in repos) Scope identities per environment; enforce PR approvals and required checks in Actions before production applies For NetScaler API access, follow NITRO authentication patterns (session/login and multi‑factor flows when applicable) Rollback & drift: GitOps rollback: Revert the offending commit/PR and re‑apply Terraform/Ansible; Terraform state + plans provide deterministic change sets Drift detection: Schedule terraform plan and compare against the desired state; use ADM configuration audit for ADC fleet to catch out‑of‑band changes Integrate an existing Citrix Environment into your Automation StrategySince Terraform is the backend for our Automation Strategy across all our guides, we need to import existing infrastructure into an IaC-based representation. It would be impossible to recreate an existing infrastructure from scratch only to end up with an IaC-based representation. Citrix provides a script that lets you import your existing infrastructure into Terraform. You can find the script and explanations here: https://github.com/citrix/terraform-provider-citrix/tree/main/scripts/onboarding-helper This automation script is designed to onboard an existing site to Terraform. It collects the list of resources from DDC, imports them into Terraform, and generates the Terraform skeletons for the site resources. Onboarding ProcessThe onboarding process is easy – here are the main steps: Create a new folder for your Terraform project. Copy the terraform-onboarding.ps1 script and terraform.tf to the Terraform project directory created in step 1. Open a PowerShell session with Administrator privileges. Navigate to the directory where the terraform-onboarding.ps1 script is located. Set the Execution policy to Bypass in the PowerShell session. Run the script according to your needed structure. Please consult the documentation. Wait for the script to complete. The execution time will depend on the complexity of the onboarding process and the resources being imported. Once the script has finished running, check the .tf files for the output. The Terraform state file should also be updated with the site resources. Please note that the onboarding script masks all sensitive attributes in the generated Terraform files. Please update these placeholders with the appropriate values. At this point, if you run terraform plan, you should only see the sensitive attributes from step 9 being updated. Run terraform apply. This will synchronize the state file with the updated values of the sensitive attributes from step 9. If you run terraform plan again, you should see the following message: No changes. Your infrastructure matches the configuration.. This indicates that all the Citrix resources have been successfully onboarded. The script creates a representation of each resource type, for example: citrix_admin_folder, citrix_admin_role, citrix_admin_scope, citrix_admin_user, citrix_application, citrix_application_group, citrix_application_icon, citrix_aws_hypervisor, citrix_azure_hypervisor, citrix_delivery_group, citrix_gcp_hypervisor, citrix_image_definition, citrix_machine_catalog, citrix_nutanix_hypervisor, citrix_openshift_hypervisor, citrix_policy_set, citrix_scvmm_hypervisor, citrix_service_account, citrix_storefront_server, citrix_tag, citrix_vsphere_hypervisor, citrix_xenserver_hypervisor, citrix_zone Look at the script in action: Overview of the TriadIn all our guides and documentation, we use three distinct tools for all our core Automation tasks. Let´s call these the “Triad”. The Triad consists of these tools: Hashicorp Packer for Master Image Creation Hashicorp Terraform for the deployment of the Infrastructure components and as the backbone of the Automation task RedHat Ansible for System configurations and the deployment, installation, and configuration of Applications HashiCorp PackerHashiCorp Packer is a foundational tool for organizations seeking to standardize, automate, and scale the creation of master images across multi-cloud and hybrid environments. As organizations increasingly adopt Infrastructure-as-Code (IaC) approaches, Packer provides a consistent, version-controlled, and repeatable way to build golden images aligned with modern DevOps and platform engineering practices. Standardization and Consistency Across Environments: Packer enables the creation of identically configured images for AWS, Azure, GCP, VMware, and other platforms from a single source template. This eliminates configuration drift and ensures that compute instances, virtual desktops, containers, or on-prem VMs are consistently built from the same baseline. For enterprises managing multiple environments, Packer’s multi-builder architecture ensures that every deployment starts from a deterministic, verified image. Full Infrastructure-as-Code Alignment: Packer templates are declarative and integrate seamlessly into IaC workflows using tools such as Terraform, Ansible, and even cloud-native configuration tools. This yields several architectural advantages: Versioned images: Each new image build is immutable and tied to a version-controlled configuration. Reproducibility: Builds can be recreated deterministically at any time, supporting compliance and audit requirements. Automation-ready: Image creation fits naturally into CI/CD pipelines, enabling continuous delivery of operating system and middleware baselines. Efficient, Scalable Deployments: Master images generated by Packer accelerate workload provisioning by drastically reducing runtime bootstrap configuration. This leads to: Faster autoscaling responsiveness Reduced risk of configuration failures during provisioning Decreased cloud compute costs due to shorter initialization times Better operational consistency across development, staging, and production These benefits scale exceptionally well for enterprise cloud deployments, VDI environments, and large-scale microservice platforms. Multi-Cloud Flexibility and Future-Proofing: Packer’s provider-agnostic architecture helps organizations avoid lock-in and stay adaptable. A single template can create AMIs, Azure Managed Images, GCP images, Docker images, and VMware templates. This uniformity supports long-term cloud strategy, modernization efforts, and disaster recovery architectures that depend on identical images across regions and providers. Integration with Modern Platform Engineering Practices: Packer integrates tightly with modern platform engineering toolchains: Terraform for downstream deployment Vault for secure secrets handling GitHub Actions, GitLab CI, Azure DevOps for automated pipelines This positions Packer as a first-class component in automated golden image pipelines, enabling platform teams to provide self-service, pre-validated, compliant images to developers and operations teams. Packer is a mature, efficient, and cloud-agnostic solution that brings the rigor of Infrastructure-as-Code to master image creation. It ensures repeatability, security, compliance, and operational speed while integrating seamlessly into modern CI/CD and platform engineering ecosystems. For organizations pursuing scalable, automated, and consistent image-based deployments, Packer is not only valid but strategically advantageous. Packer is an open-source tool that automates the creation of machine images for multiple platforms from a single source configuration. It enables developers and DevOps teams to define image-creation workflows in code, resulting in consistent, repeatable, and version-controlled image builds. Packer supports a wide range of platforms, including: AWS AMIs (Amazon Machine Images) Azure Managed Images Azure Compute Galleries Google Cloud Images Docker containers vSphere, XenServer, VirtualBox, and other Hypervisors Core ConceptsImportant Packer does not replace configuration management like Chef, Puppet, or Ansible. Packer can use tools to install software onto the image. In this handbook, we will focus on Packer using Ansible for configuration management and software installation, as well as Chocolatey for software installation. Immutable InfrastructurePacker promotes the concept of immutable infrastructure, where Images are not modified after deployment. Instead, new Images are built and deployed. This approach ensures zero Configuration drift as the Image contains all configurations. The reproducibility is also 100% - all Image builds are the same. Common Use CasesGolden Image Creation: Create pre-configured, secure, and tested base images for cloud or on-prem environments CI/CD Integration: Integrate with CI/CD pipelines to automatically build and test images during deployment Multi-Cloud/Hybrid-Cloud Deployments: Build identical images for multiple cloud providers or even hybrid cloud deployments to ensure consistency across environments Container Image Creation: Use Packer to build Docker images with consistent provisioning steps Disaster Recovery: Maintain up-to-date images that can be quickly deployed in case of failure Benefits of using PackerBenefit Description Consistency Ensures all environments use the same base image, reducing "it works on my machine" issues Automation Fully automates image creation, reducing manual errors and saving time Speed Speeds up instance provisioning by using pre-baked images Version Control Templates can be stored, for example, in Git, enabling change tracking and collaboration Multi-Platform Support Build images for multiple platforms from a single template Security Embed security patches and configurations into images before deployment This establishes Packer as a top-tier element within automated golden image workflows, allowing platform teams to deliver self-service, pre-validated, and compliant images for developers and operational teams. Packer is a well-established, effective, and cloud-agnostic tool that applies Infrastructure-as-Code principles to the process of creating master images. It guarantees consistency, security, compliance, and enhanced operational efficiency while fitting smoothly into contemporary CI/CD and platform engineering frameworks. For organizations aiming for scalable, automated, and uniform image-based deployments, Packer is not only relevant but also strategically beneficial. As an open-source solution, Packer streamlines the creation of machine images across various platforms using a single source configuration. This functionality allows developers and DevOps teams to articulate image creation procedures in code, ensuring that image builds are consistent, repeatable, and subject to version control. Installing PackerThe installation of Packer is straightforward. There are many ways to install Packer – you can find more information about Installation on the Packer homepage. Note In our case, we use a dedicated Ubuntu-based VM that hosts all automation-related frameworks. You can find more information about creating and installing such a dedicated machine in this guide. Example of installing Packer on Ubuntu: XxXxXxXxX@tacg-cicd:~$curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add - OK XxXxXxXxX@tacg-cicd:~$echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(grep -oP '(?<=UBUNTU_CODENAME=).*' /etc/os-release || lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list deb [arch=amd64 signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com noble main XxXxXxXxX@tacg-cicd:~$ sudo apt-get update && sudo apt-get install packer Hit:1 http://at.archive.ubuntu.com/ubuntu noble InRelease Get:2 http://at.archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB] Get:3 https://apt.releases.hashicorp.com noble InRelease [12.9 kB] Ign:4 https://pkg.jenkins.io/debian binary/ InRelease Get:5 http://at.archive.ubuntu.com/ubuntu noble-backports InRelease [126 kB] Hit:6 https://pkg.jenkins.io/debian binary/ Release Get:7 http://at.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1,110 kB] Hit:9 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble InRelease Get:10 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB] Get:11 http://at.archive.ubuntu.com/ubuntu noble-updates/main amd64 Components [161 kB] Get:12 http://at.archive.ubuntu.com/ubuntu noble-updates/restricted amd64 Components [212 B] Get:13 http://at.archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages [1,068 kB] Get:14 http://at.archive.ubuntu.com/ubuntu noble-updates/universe amd64 Components [376 kB] Get:15 http://security.ubuntu.com/ubuntu noble-security/main amd64 Components [21.6 kB] Get:16 http://at.archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Components [940 B] Get:17 http://at.archive.ubuntu.com/ubuntu noble-backports/main amd64 Components [7,072 B] Get:18 http://at.archive.ubuntu.com/ubuntu noble-backports/restricted amd64 Components [216 B] Get:19 http://at.archive.ubuntu.com/ubuntu noble-backports/universe amd64 Components [16.4 kB] Get:20 http://at.archive.ubuntu.com/ubuntu noble-backports/multiverse amd64 Components [212 B] Get:21 http://security.ubuntu.com/ubuntu noble-security/restricted amd64 Components [212 B] Get:22 http://security.ubuntu.com/ubuntu noble-security/universe amd64 Components [52.2 kB] Get:23 http://security.ubuntu.com/ubuntu noble-security/multiverse amd64 Components [212 B] Fetched 3,206 kB in 1s (3,247 kB/s) Reading package lists... Done Reading package lists... Done Building dependency tree... Done Reading state information... Done The following NEW packages will be installed: packer 0 upgraded, 1 newly installed, 0 to remove and 20 not upgraded. Need to get 14.4 MB of archives. After this operation, 42.0 MB of additional disk space will be used. Get:1 https://apt.releases.hashicorp.com noble/main amd64 packer amd64 1.13.0-1 [14.4 MB] Fetched 14.4 MB in 0s (32.6 MB/s) Selecting previously unselected package packer. (Reading database ... 223616 files and directories currently installed.) Preparing to unpack .../packer_1.13.0-1_amd64.deb ... Unpacking packer (1.13.0-1) ... Setting up packer (1.13.0-1) ... XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ packer --version Packer v1.13.0 XxXxXxXxX@tacg-cicd:~$ Packer CommandsPacker is controlled using its command-line interface (CLI). Calling packer without any subcommand shows all currently implemented commands: XxXxXxXxX@tacg-cicd:~$ packer Usage: packer [--version] [--help] <command> [<args>] Available commands are: build build image(s) from template console creates a console for testing variable interpolation fix fixes templates from old versions of packer fmt Rewrites HCL2 config files to canonical format hcl2_upgrade transform a JSON template into an HCL2 configuration init Install missing plugins or upgrade plugins inspect see components of a template plugins Interact with Packer plugins and catalog validate check that a template is valid version Prints the Packer version XxXxXxXxX@tacg-cicd:~$ Note You can find a detailed description of the commands on the Packer homepage. For this guide, we will use only 3 commands – these make up the core workflow: packer init -upgrade path_to_template.hcl This command downloads and installs all needed plugins according to the template file. XxXxXxXxX@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer init -upgrade win2025-std-config.pkr.hcl Installed plugin github.com/hashicorp/vsphere v1.4.2 in "/home/XxXxXxXxX/.config/packer/plugins/github.com/hashicorp/vsphere/packer-plugin-vsphere_v1.4.2_x5.0_linux_amd64" Installed plugin github.com/rgl/windows-update v0.16.10 in "/home/XxXxXxXxX/.config/packer/plugins/github.com/rgl/windows-update/packer-plugin-windows-update_v0.16.10_x5.0_linux_amd64" XxXxXxXxX@tacg-cicd:~/packer-templates/winsrv2025-ssh$packer validate -var-file=path_to_varfile.hcl path_to_template.hcl This command validates the syntax and configuration of a template file. It returns a specific exit status depending on success or failure. An error message will be displayed if a template cannot be successfully validated. XxXxXxXxX@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer validate -var-file win2025-std.auto.pkrvars.hcl win2025-std- config.pkr.hcl The configuration is valid. XxXxXxXxX@tacg-cicd:~/packer-templates/winsrv2025-ssh$packer build -var-file=path_to_varfile.hcl -force -on-error=abort path_to_template.hcl This command builds an image from the template file and the variables defined for it. The -force parameter instructs Packer to overwrite existing artifacts. If a previous build has created an artifact (such as an AMI or Vagrant box) with the same name or ID, Packer will delete or overwrite it without prompting. It also instructs Packer to skip confirmation prompts, thereby bypassing any interactive confirmation that might otherwise halt the build. In case of an error during the building process, the -on-error=abort parameter instructs Packer to exit without removing any created stuff, which is helpful during debugging. Example of the output of a successful image build: XxXxXxXxX@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer build -var-file win2025-std.auto.pkrvars.hcl -force -on-error=abort win2025-std-config.pkr.hcl The configuration is valid. vsphere-iso.winsrv2025: output will be in this color. ==> vsphere-iso.winsrv2025: Creating virtual machine... ==> vsphere-iso.winsrv2025: Customizing hardware... ==> vsphere-iso.winsrv2025: Adding virtual machine flags... ==> vsphere-iso.winsrv2025: Mounting ISO images... ==> vsphere-iso.winsrv2025: Adding configuration parameters... ==> vsphere-iso.winsrv2025: Creating floppy disk... vsphere-iso.winsrv2025: Copying files flatly from floppy_files ... vsphere-iso.winsrv2025: Successfully installed vsphere-iso.winsrv2025: ==> vsphere-iso.winsrv2025: Provisioning with Powershell... ==> vsphere-iso.winsrv2025: Provisioning with powershell script: ./setup/post-setup.ps1 vsphere-iso.winsrv2025: Disable SSH ==> vsphere-iso.winsrv2025: Provisioning with powershell script: ./setup/disable-ssh.ps1 ==> vsphere-iso.winsrv2025: Running shutdown command... ==> vsphere-iso.winsrv2025: Deleting floppy drives... ==> vsphere-iso.winsrv2025: Deleting floppy image... ==> vsphere-iso.winsrv2025: Ejecting CD-ROM media... ==> vsphere-iso.winsrv2025: Removing CD-ROM devices... vsphere-iso.winsrv2025: Closing sessions .... Build 'vsphere-iso.winsrv2025' finished after 57 minutes 36 seconds. ==> Wait completed after 57 minutes 36 seconds ==> Builds finished. The artifacts of successful builds are: --> vsphere-iso.winsrv2025: winsrv2025-01 XxXxXxXxX@tacg-cicd:~/packer-templates/winsrv2025-ssh$Packer TerminologyA short overview of terms related to Packer: Artifacts Each Builder creates a single Artifact during the building process. For example, the vSphere Builder creates a directory containing all the files of the created VM. Builds A Build is a task that produces an Artifact according to the instructions in the Template. Builder A Builder is specific to each platform and is the process that creates the Virtual Machine. Each Builder has different capabilities and needs depending on the underlying platform. For example, the azure-arm builder allows you to build VHDs and Managed Images in ARM. The vsphere-ISO uses an OS ISO file and builds a VM Image on vSphere. Provisioner A Provisioner allows Packer to install Software before the Build finishes. Provisioners are the main component that adds all the desired elements to the underlying OS. Provisioners can also call other IaC Frameworks, such as Ansible, or run scripts like Shell Scripts or PowerShell snippets, or upload files. It is imperative that communication between the Packer Machine and the Windows Machine via WinRM and/or SSH can be established without error. Post-Processor A Post-Processor takes a successful build and can be used, e.g., to upload an Artifact or package the files. For example, the vsphere Post-Processor uploads a successfully created Artifact to vSphere. Template A JSON- or HCL-based human-readable file that defines the build process. It holds the configuration and tells the Builder what to do. Data Source A Data Source fetches Data from the outer World and makes it accessible to Packer. Important It is imperative that communication between the Packer Machine and the Windows Machine using WinRM and/or SSH can be established without error. Note You can ensure that WinRM is configured correctly by adding the configuration script to the unattend.xml or autounattend.xml file, which Packer will use. Packer StructurePacker uses HCL templates as the recipe for creating an Image. You must follow a simple structure in the Templates (see example of a Windows Server 2025 Template below): # Windows Server 2025 deployment using Hashicorp Packer locals { SSHUser = "XxXxXxXxXxXxX" SSHPass = "XxXxXxXxXxXxX" WinRMUser = "administrator" WinRMPass = "XxXxXxXxXxXxX" vcenter_admin = "admin@vspXxX.tmmXxXxX" vcenter_password = "XxXxXxXxXxXxX" timestamp = regex_replace(timestamp(), "[- TZ:01]", "") buildtime = formatdate("DD-MM-YYYY hh:mm ZZZ", timestamp()) manifest_date = formatdate("DD-MM-YYYY hh:mm:ss", timestamp()) } packer { required_version = ">= 1.12.0" required_plugins { vsphere = { version = ">= v1.4.2" source = "github.com/hashicorp/vsphere" } } required_plugins { windows-update = { version = ">= 0.16.8" source = "github.com/rgl/windows-update" } } } variable "host" { type = string description = "Name of the Host to use" } variable "name" { type = string description = "Name of the Image" } ... variable "vvtd_enabled" { type = string } source "vsphere-iso" "winsrv2025" { CPUs = var.vm_cpus notes = "TMM - Built by HashiCorp Packer on ${local.buildtime}." RAM = var.vm_memory firmware = var.vm_firmware ... network_adapters { network = var.vcenter_network network_card = var.vm_network_card } ... storage { disk_size = var.vm_disk_size disk_thin_provisioned = var.vm_disk_thin } ... boot_order = var.vm_boot_order boot_wait = var.vm_boot_wait boot_command = var.vm_boot_command shutdown_command = var.vm_shutdown_command } build { sources = ["source.vsphere-iso.winsrv2025"] provisioner "windows-update" { pause_before = "30s" search_criteria = "IsInstalled=0" filters = [ "exclude:$_.Title -like '*Preview*'", "exclude:$_.InstallationBehavior.CanRequestUserInput", "include:$true" ] restart_timeout = "120m" } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Output 'restarted.'}\"" restart_timeout = "20m" } provisioner "powershell" { elevated_user = local.SSHUser elevated_password = local.SSHPass scripts = [ "./setup/disable-autolog.ps1", "./setup/disable-ssh.ps1" ] } }The locals {} block defines variables used locally in this particular Template. The packer {} block is the root block of this Template and contains all settings. It specifies a required version – in this case, at least Packer version 1.12 or higher. The required_plugins {} block defines all plugins needed for a successful build. The variable {} blocks define all the variable names, the types, and, if needed, default values. Packer looks for the values in the variable file mentioned in the CLI command you used to start the build (remember packer build -var-file=path_to_varfile.hcl -force -on-error=abort path_to_template.hcl). The source {} block configures a plugin for building an Image on a specific platform and defines all needed settings. Important This block differs based on the underlying platform and its needs. It can be reused whenever you need to build an Image on the same platform. The build {} block defines all the steps Packer should execute sequentially after the complete source {} block. Now, as all needed blocks are defined, you can build your image. If you are not sure whether your template is valid, you can run packer validate -var-file=path_to_varfile.hcl path_to_template.hcl to check for errors. HashiCorp TerraformTerraform is one of the most widely adopted Infrastructure-as-Code (IaC) platforms for provisioning and managing cloud and on-prem infrastructure at scale. Its declarative configuration model, strong ecosystem support, and provider-agnostic architecture make it a foundational tool for organizations seeking consistency, compliance, and operational maturity in their infrastructure lifecycle. Terraform relies on declarative code to define infrastructure in a predictable, reproducible manner. By representing compute, networking, storage, IAM, and platform services as version-controlled code artifacts, Terraform: Eliminates configuration drift Ensures consistent provisioning across development, staging, and production Produces deployments that can be rebuilt deterministically This consistency is particularly valuable in regulated environments where documentation, repeatability, and environmental fidelity are required for audits and certification processes. For highly regulated verticals—such as finance, healthcare, government, and critical infrastructure—Terraform provides the governance, repeatability, and auditability required to meet stringent compliance obligations. These regulated verticals often operate under strict frameworks, such as: Finance: PCI-DSS, FFIEC, SOX Healthcare: HIPAA, HITECH Government/Public Sector: FedRAMP, NIST 800-53, DoD SRG Energy/Critical Infrastructure: NERC CIP Global Privacy Requirements: GDPR, regional data sovereignty mandates Terraform helps organizations meet these obligations by providing: Complete Traceability and Auditability: All infrastructure changes can be captured in version control systems. This enables traceable change histories, approvals, and rollbacks—supporting SOX, NIST, and ISO 27001 requirements around change management and configuration governance. Standardized, Repeatable Environments: Terraform modules enable organizations to define compliant “building blocks” that development teams cannot inadvertently modify, ensuring every environment meets baseline controls for security, networking, identity, and data protection. Operational Efficiency and Reduced Risk: Terraform’s execution plan and state management capabilities allow organizations to preview changes before applying them, reducing misconfigurations—a key risk driver in regulated environments. Additional operational benefits include: Automated provisioning at scale Predictable change outcomes through planning and applying workflows Reduced human error, a significant source of compliance violations Consistent rollback and recovery patterns Integration With Secure DevOps and Platform Engineering Practices: Terraform fits seamlessly into CI/CD, GitOps, and automated compliance frameworks, enabling regulated organizations to adopt modern DevOps practices without compromising governance. It perfectly integrates with frameworks such as: Terraform Cloud/Enterprise for controlled workflows Vault for secure secrets injection Packer for master image pipelines GitHub Actions, GitLab, Azure DevOps for automated deployment Core FeaturesMulti-Cloud Provisioning: Terraform supports all major cloud providers (AWS, Azure, GCP, OCI) and many others via providers Declarative Configuration: You define what infrastructure you want (not how to create it), and Terraform figures out the steps Execution Plan (Preview Changes): Terraform generates an execution plan before making changes, showing you exactly what it will do State Management: Terraform keeps track of resources it manages in a state file, enabling drift detection and dependency resolution Modularization & Reuse: You can build modules to encapsulate complex infrastructure patterns and reuse them Easily and widely extendable: Terraform can be extended with custom Providers, Provisioners, and Data Sources Core ConceptsImmutable InfrastructureTerraform promotes the concept of immutable infrastructure, where Resources are not modified after deployment. Instead, the Resources are recreated and replaced. This approach ensures zero Configuration drift as the Resources always have the same configurations. Reproducibility is also 100% - all Resources deployed across different Infrastructures use the same configuration. Security and Compliance as CodeSecurity policies and compliance requirements can be codified into Terraform to ensure consistent enforcement. Environment Management (Dev, Staging, Prod)Terraform allows managing separate Infrastructure environments through Workspaces or Folder-based patterns. State Management & Drift DetectionTerraform maintains a state file that represents the Infrastructure’s current state. This state can be used to detect configuration drift or unauthorized changes. Automated Scaling and Auto-Healing InfrastructureTerraform works in tandem with cloud-native tools for dynamic scaling and fault recovery. That leads to improved reliability and reduced manual maintenance. Common Use CasesCreation of Infrastructures based on Infrastructure-as-Code Create your Infrastructure in the Cloud or on-premises CI/CD Integration Integrate with CI/CD pipelines to automatically build and test your Infrastructure during deployment Multi-Cloud/Hybrid-Cloud Deployments Build identical Infrastructure for multiple Cloud providers or even hybrid Cloud deployments to ensure consistency across environments Detect Configuration Drifts Use Terraform to ensure your Infrastructure is in the desired state. You can even automatically remediate any changes Disaster Recovery Using Terraform ensures that your Infrastructure or Components can be quickly deployed in case of failure Benefits of using TerraformBenefit Description Consistency Ensures all environments use the same IaC Codebase, reducing Configuration sprawl Automation Fully automates Infrastructure creation, reducing manual errors and saving time Speed Speeds up Infrastructure provisioning by using IaC Version Control Templates can be stored, for example, in Git, enabling change tracking and collaboration Multi-Platform Support Build deployments for multiple platforms from the same codebase with minor modifications if needed Security Ensure all entities match all security needs and regulations, as these settings are part of the modules Installing TerraformThe installation of Terraform is straightforward. There are many ways to install Terraform – you can find more information about Installation on the Terraform homepage. Note In our case, we use a dedicated Ubuntu-based VM that hosts all automation-related frameworks. You can find more information about creating and installing such a dedicated machine in this guide. Example of installing Terraform on Ubuntu: XxXxXxXxX@tacg-cicd:~$ sudo apt install gnupg software-properties-common -y Reading package lists... Done Building dependency tree... Done Reading state information... Done gnupg is already the newest version (2.4.4-2ubuntu17). gnupg set to manually installed. software-properties-common is already the newest version (0.99.49.1). software-properties-common set to manually installed. 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg --2024-12-13 15:21:43-- https://apt.releases.hashicorp.com/gpg Resolving apt.releases.hashicorp.com (apt.releases.hashicorp.com)... 13.225.47.104, 13.225.47.21, 13.225.47.116, ... Connecting to apt.releases.hashicorp.com (apt.releases.hashicorp.com)|13.225.47.104|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 3980 (3.9K) [binary/octet-stream] Saving to: ‘STDOUT’ - 100%[=================================================>] 3.89K --.-KB/s in 0s 2024-12-13 15:21:43 (488 MB/s) - written to stdout [3980/3980] XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com noble main XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ sudo apt update Hit:1 https://packages.microsoft.com/repos/code stable InRelease Hit:2 https://esm.ubuntu.com/apps/ubuntu noble-apps-security InRelease Hit:3 https://esm.ubuntu.com/apps/ubuntu noble-apps-updates InRelease Hit:4 https://esm.ubuntu.com/infra/ubuntu noble-infra-security InRelease Hit:5 https://esm.ubuntu.com/infra/ubuntu noble-infra-updates InRelease Hit:6 http://azure.archive.ubuntu.com/ubuntu noble InRelease Get:7 https://apt.releases.hashicorp.com noble InRelease [12.9 kB] Hit:8 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease Hit:9 http://azure.archive.ubuntu.com/ubuntu noble-backports InRelease Get:10 https://apt.releases.hashicorp.com noble/main amd64 Packages [161 kB] Hit:11 http://azure.archive.ubuntu.com/ubuntu noble-security InRelease Fetched 174 kB in 1s (146 kB/s) Reading package lists... Done Building dependency tree... Done Reading state information... Done All packages are up to date. XxXxXxXxX@tacg-cicd:~$ sudo apt install terraform -y Reading package lists... Done Building dependency tree... Done Reading state information... Done The following NEW packages will be installed: terraform 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. Need to get 27.4 MB of archives. After this operation, 90.2 MB of additional disk space will be used. Get:1 https://apt.releases.hashicorp.com noble/main amd64 terraform amd64 1.10.2-1 [27.4 MB] Fetched 27.4 MB in 2s (13.1 MB/s) Selecting previously unselected package terraform. (Reading database ... 179937 files and directories currently installed.) Preparing to unpack .../terraform_1.10.2-1_amd64.deb ... Unpacking terraform (1.10.2-1) ... Setting up terraform (1.10.2-1) ... Scanning processes... Scanning linux images... Running kernel seems to be up-to-date. No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ terraform --version Terraform v1.10.2 on linux_arm64 XxXxXxXxX@tacg-cicd:~$Terraform CommandsTerraform is controlled using its command-line interface (CLI). Calling terraform without any subcommand shows all currently implemented commands: XxXxXxXxX@tacg-cicd:~$ terraform Usage: terraform [global options] <subcommand> [args] The available commands for execution are listed below. The primary workflow commands are given first, followed by less common or more advanced commands. Main commands: init Prepare your working directory for other commands validate Check whether the configuration is valid plan Show changes required by the current configuration apply Create or update infrastructure destroy Destroy previously-created infrastructure All other commands: console Try Terraform expressions at an interactive command prompt fmt Reformat your configuration in the standard style force-unlock Release a stuck lock on the current workspace get Install or upgrade remote Terraform modules graph Generate a Graphviz graph of the steps in an operation import Associate existing infrastructure with a Terraform resource login Obtain and save credentials for a remote host logout Remove locally-stored credentials for a remote host metadata Metadata related commands modules Show all declared modules in a working directory output Show output values from your root module providers Show the providers required for this configuration refresh Update the state to match remote systems show Show the current state or a saved plan stacks Manage HCP Terraform stack operations state Advanced state management taint Mark a resource instance as not fully functional test Execute integration tests for Terraform modules untaint Remove the 'tainted' state from a resource instance version Show the current Terraform version workspace Workspace management Global options (use these before the subcommand, if any): -chdir=DIR Switch to a different working directory before executing the given subcommand. -help Show this help output or the help for a specified subcommand. -version An alias for the "version" subcommand. XxXxXxXxX@tacg-cicd:~$ Note You can find a detailed description of the commands on the Terraform homepage. Normally, we will use these commands – these make up the core workflow: terraform fmt This command formats all .tf files in the current directory according to the standard, making them much easier to read. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform fmt WinRM-provider-variables.tf WinRM-provider.tf WinRM-test-Secure.tf WinRM-variables.tf XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform init This command initializes a working directory containing Terraform configuration files. This is the first command you should run after writing a new Terraform configuration or cloning an existing configuration from version control. It is safe to run this command multiple times. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform init Initializing the backend... Initializing provider plugins... - Finding latest version of hashicorp/null... - Installing hashicorp/null v3.2.4... - Installed hashicorp/null v3.2.4 (signed by HashiCorp) Terraform has created a lock file .terraform.lock.hcl to record the provider selections it made above. Include this file in your version control repository so that Terraform can guarantee to make the same selections by default when you run "terraform init" in the future. Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform validate This command validates the configuration files in a directory. It does not validate remote services, such as remote state or provider APIs. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform validate Success! The configuration is valid. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform plan This command generates an execution plan that lets you preview the changes Terraform plans to make to your infrastructure. The plan command alone does not actually carry out the proposed changes - use this command to check whether the proposed changes match what you expected before you apply the changes or share your changes with your team for broader review. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform plan Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # null_resource.InstallonIP1 will be created + resource "null_resource" "InstallonIP1" { + id = (known after apply) } # null_resource.InstallonIP2 will be created + resource "null_resource" "InstallonIP2" { + id = (known after apply) } # null_resource.UploadTestFileToIP1 will be created + resource "null_resource" "UploadTestFileToIP1" { + id = (known after apply) } # null_resource.UploadTestFileToIP2 will be created + resource "null_resource" "UploadTestFileToIP2" { + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$In this example, Terraform lists all entities that would be created/changed/destroyed: Plan: 4 to add, 0 to change, 0 to destroy. Important If Terraform detects that no changes are needed to the underlying infrastructure, it will report that no actions are required. This functionality can be used for regular checks to ensure the infrastructure continues to meet your requirements. You will see a detailed description of this use case later. terraform apply This command executes the operations proposed in a Terraform plan. When you run terraform apply without passing a saved plan file, Terraform automatically creates a new execution plan as if you had run terraform plan, prompts you to approve that plan, and performs the indicated operations. You can also use auto-approve to start the execution without asking for confirmation. Extreme Caution If you use -auto-approve, make sure that no one changed your infrastructure or Terraform snippets without consent to minimize the risk of unpredictable changes. XxXxXxXxX@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # null_resource.InstallonIP1 will be created + resource "null_resource" "InstallonIP1" { + id = (known after apply) } # null_resource.InstallonIP2 will be created + resource "null_resource" "InstallonIP2" { + id = (known after apply) } # null_resource.UploadTestFileToIP1 will be created + resource "null_resource" "UploadTestFileToIP1" { + id = (known after apply) } # null_resource.UploadTestFileToIP2 will be created + resource "null_resource" "UploadTestFileToIP2" { + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.UploadTestFileToIP1: Creating... null_resource.UploadTestFileToIP1: Provisioning with 'file'... null_resource.UploadTestFileToIP2: Creating... null_resource.UploadTestFileToIP2: Provisioning with 'file'... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.UploadTestFileToIP1: Creation complete after 1s [id=38299301982712762563] #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.UploadTestFileToIP2: Creation complete after 1s [id=2420916592744961178] null_resource.InstallonIP2: Creating... null_resource.InstallonIP2: Provisioning with 'remote-exec'... null_resource.InstallonIP2 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP2 (remote-exec): Host: 10.10.119.32 null_resource.InstallonIP2 (remote-exec): Port: 5985 null_resource.InstallonIP2 (remote-exec): User: XxXxXxXxX null_resource.InstallonIP2 (remote-exec): Password: true null_resource.InstallonIP2 (remote-exec): HTTPS: false null_resource.InstallonIP2 (remote-exec): Insecure: false null_resource.InstallonIP2 (remote-exec): NTLM: false null_resource.InstallonIP2 (remote-exec): CACert: false null_resource.InstallonIP2 (remote-exec): Connected! #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.InstallonIP2 (remote-exec): C:\Users\Administrator>powershell -File c:/temp/Test-Script.ps1 #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj><Obj S="progress" RefId="1"><TNRef RefId="0" /><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.InstallonIP2: Creation complete after 3s [id=98225693556377100230] null_resource.InstallonIP2: Creating... null_resource.InstallonIP2: Provisioning with 'remote-exec'... null_resource.InstallonIP2 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP2 (remote-exec): Host: 10.10.119.31 null_resource.InstallonIP2 (remote-exec): Port: 5985 null_resource.InstallonIP2 (remote-exec): User: XxXxXxXxX null_resource.InstallonIP2 (remote-exec): Password: true null_resource.InstallonIP2 (remote-exec): HTTPS: false null_resource.InstallonIP2 (remote-exec): Insecure: false null_resource.InstallonIP2 (remote-exec): NTLM: false null_resource.InstallonIP2 (remote-exec): CACert: false null_resource.InstallonIP2 (remote-exec): Connected! #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.InstallonIP2 (remote-exec): C:\Users\Administrator>powershell -File c:/temp/Test-Script.ps1 #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj><Obj S="progress" RefId="1"><TNRef RefId="0" /><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>null_resource.InstallonIP1: Creation complete after 3s [id=63698556510210360780] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform destroy This command deprovisions all objects managed by a Terraform configuration. You can use terraform destroy to conveniently clean up all objects or a specific object created by Terraform. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ terraform destroy null_resource.UploadTestFileToIP1: Refreshing state... [id=38299301982712762563] null_resource.InstallonIP1: Refreshing state... [id=63698556510210360780] null_resource.UploadTestFileToIP2: Refreshing state... [id=2420916592744961178] null_resource.InstallonIP2: Refreshing state... [id=98225693556377100230] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: - destroy Terraform will perform the following actions: # null_resource.InstallonIP1 will be destroyed - resource "null_resource" "InstallonIP1" { - id = "63698556510210360780" -> null } # null_resource.UploadTestFileToIP1 will be destroyed - resource "null_resource" "UploadTestFileToIP1" { - id = "38299301982712762563" -> null } # null_resource.InstallonIP2 will be destroyed - resource "null_resource" "InstallonIP2" { - id = "98225693556377100230" -> null } # null_resource.UploadTestFileToIP2 will be destroyed - resource "null_resource" "UploadTestFileToIP2" { - id = "2420916592744961178" -> null } Plan: 0 to add, 0 to change, 2 to destroy. Do you really want to destroy all resources? Terraform will destroy all your managed infrastructure, as shown above. There is no undo. Only 'yes' will be accepted to confirm. Enter a value: yes null_resource.InstallonIP1: Destroying... [id=63698556510210360780] null_resource.InstallonIP1: Destruction complete after 0s null_resource.UploadTestFileToIP1: Destroying... [id=38299301982712762563] null_resource.UploadTestFileToIP1: Destruction complete after 0s null_resource.InstallonIP2: Destroying... [id=98225693556377100230] null_resource.InstallonIP2: Destruction complete after 0s null_resource.UploadTestFileToIP2: Destroying... [id=2420916592744961178] null_resource.UploadTestFileToIP2: Destruction complete after 0s Destroy complete! Resources: 4 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/TestWinRM$ Terraform TerminologyA short overview of terms related to Packer: Configuration The set of .tf files (written in HCL) that declare desired infrastructure. These files are the primary interface for all workflows. Provider A plugin that maps Terraform’s model to a real service’s API (AWS, Azure, vSphere, SaaS) Resource A managed object that Terraform creates, updates, or destroys (e.g., citrix_machine_catalog) Data Source Read‑only lookup that fetches external data (from the provider or other backends) to use in your configuration. Nothing is altered. Module A reusable collection of Terraform code/snippets Input Variables (variable) Parameters that make modules configurable Local Variables (locals) Named expressions for reuse inside a module Outputs (output) Prints out a value used by a module State A record of the objects Terraform manages, used to plan changes safely. Holds the representation of the underlying infrastructure. Provisioners Imperative post‑apply steps (run scripts, upload files) Important It is imperative that communication between the Terraform machine and the Windows Machine using WinRM and/or SSH can be established without error. Note You can ensure that WinRM is configured correctly by adding the configuration via local or domain-based group policies. It is best practice to configure WinRM when creating the virtual machine (e.g., with Packer). Terraform StructureTerraform uses HCL as its "programming language". Example with explanations - environment and provider definition: terraform { ## Defining Terraform version to be at least 1.9.7 required_version = ">= 1.9.7" ## Defining all needed providers and the respective minimal versions required_providers { azurerm = { source = "hashicorp/azurerm" version = ">=4.6.0" } citrix = { source = "citrix/citrix" version = ">=1.0.30" } azuread = { source = "hashicorp/azuread" version = ">=3.0.2" } } ## Backend Configuration for Terraform Remote State on Azure ### In the Backend configuration block, no variables can be used, the settings must be hardcoded backend "azurerm" { resource_group_name = XxXxXxXxX storage_account_name = XxXxXxXxX container_name = XxXxXxXxX key = XxXxXxXxX use_oidc = true client_id = XxXxXxXxX client_secret = XxXxXxXxX subscription_id = XxXxXxXxX tenant_id = XxXxXxXxX snapshot = true } } ## Configure all Providers provider "azurerm" { features {} client_id = var.azurerm-clientid client_secret = var.azurerm-clientsecret tenant_id = var.azurerm-tenantid subscription_id = var.azurerm-subscriptionid } provider "citrix" { cvad_config = { customer_id = var.cc-customerid client_id = var.cc-apikey-clientId client_secret = var.cc-apikey-clientSecret } } provider "azuread" { tenant_id = var.azurerm-tenantid } Example with explanations - creation of some DaaS entities: ### Set local variables and scripts - in this module no local variables are needed locals {} ### Get existing entity datan #### Retrieving the ZoneID data "citrix_zone" "GetTFAzureZoneID" { name = var.CC-Azure-ZoneID } #### Retrieving the Image Definition ID data "citrix_image_definition" "GetImageDefinition" { name = var.CC-ImageDefinition-Name #name = "Example Image Definition" } #### Retrieving the Image Version ID data "citrix_image_version" "GetImageDefinitionVersion" { version_number = var.CC-ImageDefinition-Version image_definition = data.citrix_image_definition.GetImageDefinition.id } ##### Write out some information for debugging/validation output "name" { value = data.citrix_image_definition.GetImageDefinition.id } output "version" { value = data.citrix_image_version.GetImageDefinitionVersion.id } #### Retrieving the Shared Image Gallery data "azurerm_shared_image_gallery" "GetAzureSIG" { name = var.CC-Azure-SIG-Name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Retrieving the Shared Image Definition data "azurerm_shared_image" "GetAzureSIGDefinition" { name = var.CC-Azure-SIGDefinition-Name gallery_name = data.azurerm_shared_image_gallery.GetAzureSIG.name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Retrieving the Shared Image Definition Version data "azurerm_shared_image_version" "GetAzureSIGDefinitionVersion" { name = var.CC-Azure-SIGDefinitionVersion image_name = data.azurerm_shared_image.GetAzureSIGDefinition.name gallery_name = data.azurerm_shared_image_gallery.GetAzureSIG.name resource_group_name = var.TACG-TMM-ResourceGroup-Name } #### Creating the Hypervisor Connection resource "citrix_azure_hypervisor" "CreateAzureHostingConnection" { depends_on = [data.citrix_zone.GetTFAzureZoneID] name = var.CC-Azure-HypConn-Name zone = data.citrix_zone.GetTFAzureZoneID.id active_directory_id = var.azurerm-tenantid subscription_id = var.azurerm-subscriptionid application_secret = var.azurerm-clientsecret application_id = var.azurerm-clientid } #### Sleep 30s to let Background processes settle resource "time_sleep" "wait_30_seconds" { depends_on = [citrix_azure_hypervisor.CreateAzureHostingConnection] create_duration = "30s" } #### Creating the Hypervisor Resource Pool resource "citrix_azure_hypervisor_resource_pool" "CreateAzureHostingConnectionPool" { depends_on = [time_sleep.wait_30_seconds] name = var.CC-Azure-HypConn-Name hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id region = var.TACG-TMM-ResourceGroup-Location virtual_network_resource_group = var.TACG-TMM-ResourceGroup-Name virtual_network = var.CC-Azure-VNet-Name subnets = var.CC-Azure-Subnets } ##### Write out some information for debugging/validation output "hypname" { value = citrix_azure_hypervisor.CreateAzureHostingConnection.id } output "hypconnname" { value = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id }Terraform normally knows the order in which entities will be created. To ensure the order manually, you can use the [depends_on] statement. It forces Terraform to create the respective resource only if the depending resource is created. Example with explanations - definition of variables: ## Definition of Azure Terraform Provider variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs #### The sensitive keyword means that Terraform dies not print out the value variable "azurerm-clientid" { type = string sensitive = true description = "REQUIRED: Client-ID of the Azure SPN" } variable "azurerm-clientsecret" { type = string sensitive = true description = "REQUIRED: Client-Secret of the Azure SPN" } variable "azurerm-tenantid" { type = string sensitive = true description = "REQUIRED: Tenant-ID of the Azure SPN" } variable "azurerm-subscriptionid" { type = string sensitive = true description = "REQUIRED: Subscription-ID of the Azure subscription used" } Example with explanations - assignment of values to variables in JSON format: { ... "cc-customerid": "XxXxXxX", "cc-apikey-clientId": "XxXxXxX", "cc-apikey-clientSecret": "XxXxXxX", "azurerm-subscriptionid":"XxXxXxX", "azurerm-tenantid":"XxXxXxX", "azurerm-clientid":"XxXxXxX", "azurerm-clientsecret":"XxXxXxX", "TAG-Environment":"XxXxXxX", "TAG-Environment-Entity":"XxXxXxX", "TAG-Environment-Usage":"XxXxXxX", ... }All in all, Terraform's syntax is relatively straightforward. Red Hat Ansible Automation PlatformMany organizations that have matured their Infrastructure-as-Code (IaC) practices increasingly require tooling that not only provisions infrastructure but also configures systems, applications, and operating environments in a controlled, repeatable manner. Ansible is a leading configuration management and automation platform that aligns naturally with IaC principles and complements provisioning tools such as Terraform, or cloud-native IaC engines. Its agentless architecture, declarative playbook model, and extensive ecosystem make it a strategic choice for enterprises seeking predictable, scalable, and compliant post-provision configuration. Ansible provides a declarative, idempotent configuration model that ensures systems converge to a desired state regardless of their current configuration. This makes it ideally suited for environments provisioned using IaC tools, allowing organizations to: Configure compute resources, operating systems, middleware, and applications immediately after provisioning Apply consistent baseline templates across development, staging, and production Avoid configuration drift and reduce manual intervention Enforce standardization across diverse platforms and environments Because Ansible uses standard protocols (SSH, WinRM, API calls) and does not require agents, it can manage virtually any resource created by IaC tooling with minimal setup. Ansible excels by enabling: OS configuration (packages, services, permissions, patching) Deployment and maintenance of middleware or applications Secure configuration of agents (monitoring, logging, EDR, secrets managers) Post-provision checks and compliance enforcement Continuous updates and lifecycle operations long after initial provisioning Ansible delivers operational benefits such as: Idempotent reruns that safely correct drift Automated configuration updates Consistent rollout of application versions or patches Reduced human error and faster recovery Centralized configuration logic rather than ad-hoc scripts These capabilities support long-term environment stability, which is often a weak point in IaC deployments if configuration is not managed separately. Core ConceptsInventoryThe list of managed hosts (static INI/YAML or dynamic inventory from clouds like AWS, Azure, GCP). You can group hosts (e.g., ddc, cc, prod, test). PlaybooksYAML files describing desired states. A play targets host groups and runs a sequence of tasks using modules. ModulesThe building blocks like “package”, “service”, “user”, “copy”, “template”, “win_feature”, cloud/network modules, etc. RolesReusable content bundles (tasks, handlers, templates, defaults, vars, files) with a predictable structure for maintainability. CollectionsNamespaced distributions of roles, modules, plugins. (e.g., “amazon.aws”, “ansible.windows”, “kubernetes.core”). Variables & FactsInput data and discovered system facts (“gather_facts”). Variable precedence is essential for predictability. TemplatesJinja2 templates to render config files dynamically. HandlersTriggered by tasks to perform actions like service restarts, only when changes occur Key FeaturesAgentless, Human‑Readable Automation: Ansible connects over SSH/WinRM/HTTPS—no agents on managed nodes—reducing operational overhead and security footprint. Automation is expressed in YAML playbooks that describe the desired state and support idempotency, so re‑runs are safe and predictable Enterprise Control with Automation Controller: A centralized UI/API provides RBAC, credential management, job templates, scheduling, workflows, and auditing—standardizing how automation is deployed, delegated, and measured across teams and environments Scale-Out Execution with Automation Mesh: An overlay network distributes automation to execution/hop nodes across WANs and multiple sites, supports control–execution plane separation, and offers resilient, bi‑directional, multi‑hop routing (FIPS‑compliant) to meet large‑scale and edge needs Repeatable Runtimes via Execution Environments: Containerized execution environments (EEs) package the Ansible engine, collections, and dependencies—ensuring that what you test is exactly what runs in production. This improves reliability and portability, and shortens development cycles Curated Content with Automation Hub: Automation Hub provides certified content collections (modules, roles, plugins, docs) from Red Hat and partners; Private Automation Hub lets you curate, sign, and govern internal content and mirror external sources for disconnected sites Event‑Driven Ansible (EDA): EDA introduces rulebooks (if/then logic) to subscribe to event sources (e.g., monitoring tools, webhooks, Kafka) and trigger playbooks or actions—enabling near real‑time remediation, compliance enforcement, and closed‑loop operations Analytics, Insights, and Governance: Automation analytics quantify business impact (e.g., ROI calculators, job success/failure patterns), while Red Hat Insights monitors the platform estate, identifies drift/vulnerabilities, and can feed EDA for proactive remediation. Data collection deliberately excludes secrets and detailed task output Security & Hardening Guidance: Red Hat provides a hardening guide for AAP on RHEL, including firewall, topology, and DISA STIG considerations; community and official roles exist to automate CIS/STIG baselines on hosts (e.g., RHEL) Example Use CasesHybrid Cloud Provisioning & Lifecycle: Automate Cloud resource creation, configuration, tagging, security controls, and teardown across AWS, Azure, GCP, and VMware, Nutanix, XenServer, Azure Local using certified/maintained collections. Use workflows to orchestrate approvals, compliance checks, and change records. Application Deployment & Day‑2 Operations: Express application delivery as code—playbooks and workflows—to ensure deterministic rollouts across dev/test/prod with idempotent tasks (config files, services, DB migrations), then schedule patching and post‑deployment validation. Security & Compliance at Scale: Codify baseline hardening and continuous compliance (e.g., DISA STIG/CIS) and use Insights to detect drift or vulnerabilities. Trigger EDA rulebooks to remediate misconfigurations on detection. Network Automation (Multi‑Vendor): Standardize configuration and state validation across routers, switches, firewalls, and load balancers with Ansible’s network collections and platform‑specific modules; orchestrate backups, firmware, and policy enforcement, and leverage EDA for signal‑based responses. Installing AnsibleThe installation of Ansible is straightforward. There are many ways to install Ansible– you can find more information about Installation on the Ansible homepage. Note In our case, we use a dedicated Ubuntu-based VM that hosts all automation-related frameworks. You can find more information about creating and installing such a dedicated machine in this guide. Example of installing Ansible on Ubuntu: XxXxXxXxX@tacg-cicd:~$ echo "sysops ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/sysops sysops ALL=(ALL) NOPASSWD:ALL XxXxXxXxX@tacg-cicd:~$ sudo apt update Hit:1 https://packages.microsoft.com/repos/code stable InRelease Hit:2 https://esm.ubuntu.com/apps/ubuntu noble-apps-security InRelease Hit:3 https://esm.ubuntu.com/apps/ubuntu noble-apps-updates InRelease Hit:4 https://esm.ubuntu.com/infra/ubuntu noble-infra-security InRelease Hit:5 https://esm.ubuntu.com/infra/ubuntu noble-infra-updates InRelease Hit:6 http://azure.archive.ubuntu.com/ubuntu noble InRelease Hit:7 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease Hit:8 https://apt.releases.hashicorp.com noble InRelease Hit:9 http://azure.archive.ubuntu.com/ubuntu noble-backports InRelease Hit:10 http://azure.archive.ubuntu.com/ubuntu noble-security InRelease Reading package lists... Done Building dependency tree... Done Reading state information... Done All packages are up to date. XxXxXxXxX@tacg-cicd:~$ sudo apt upgrade -y Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done # # Patches available for the local privilege escalation issue in needrestart # tracked by CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, and CVE-2024-10224 # For more see: https://ubuntu.com/blog/needrestart-local-privilege-escalation # 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. XxXxXxXxX@tacg-cicd:~$ sudo apt install -y software-properties-common Reading package lists... Done Building dependency tree... Done Reading state information... Done software-properties-common is already the newest version (0.99.49.1). 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. XxXxXxXxX@tacg-cicd:~$ sudo add-apt-repository --yes --update ppa:ansible/ansible Repository: 'Types: deb URIs: https://ppa.launchpadcontent.net/ansible/ansible/ubuntu/ Suites: noble Components: main ' Description: Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy. Avoid writing scripts or custom code to deploy and update your applications— automate in a language that approaches plain English, using SSH, with no agents to install on remote systems. http://ansible.com/ If you face any issues while installing Ansible PPA, file an issue here: https://github.com/ansible-community/ppa/issues More info: https://launchpad.net/~ansible/+archive/ubuntu/ansible Adding repository. Hit:1 https://packages.microsoft.com/repos/code stable InRelease Hit:2 https://esm.ubuntu.com/apps/ubuntu noble-apps-security InRelease Hit:3 https://esm.ubuntu.com/apps/ubuntu noble-apps-updates InRelease Get:4 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble InRelease [17.8 kB] Hit:5 https://esm.ubuntu.com/infra/ubuntu noble-infra-security InRelease Hit:6 https://esm.ubuntu.com/infra/ubuntu noble-infra-updates InRelease Hit:7 http://azure.archive.ubuntu.com/ubuntu noble InRelease Get:8 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble/main amd64 Packages [772 B] Get:9 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble/main Translation-en [472 B] Hit:10 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease Hit:11 https://apt.releases.hashicorp.com noble InRelease Hit:12 http://azure.archive.ubuntu.com/ubuntu noble-backports InRelease Hit:13 http://azure.archive.ubuntu.com/ubuntu noble-security InRelease Fetched 19.0 kB in 1s (18.7 kB/s) Reading package lists... Done XxXxXxXxX@tacg-cicd:~$ sudo apt update Hit:1 https://esm.ubuntu.com/apps/ubuntu noble-apps-security InRelease Hit:2 https://esm.ubuntu.com/apps/ubuntu noble-apps-updates InRelease Hit:3 https://esm.ubuntu.com/infra/ubuntu noble-infra-security InRelease Hit:4 https://esm.ubuntu.com/infra/ubuntu noble-infra-updates InRelease Hit:5 https://packages.microsoft.com/repos/code stable InRelease Hit:6 http://azure.archive.ubuntu.com/ubuntu noble InRelease Hit:7 http://azure.archive.ubuntu.com/ubuntu noble-updates InRelease Hit:8 https://apt.releases.hashicorp.com noble InRelease Hit:9 http://azure.archive.ubuntu.com/ubuntu noble-backports InRelease Hit:10 http://azure.archive.ubuntu.com/ubuntu noble-security InRelease Hit:11 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble InRelease Reading package lists... Done Building dependency tree... Done Reading state information... Done All packages are up to date. XxXxXxXxX@tacg-cicd:~$ sudo apt install -y ansible Reading package lists... Done Building dependency tree... Done Reading state information... Done The following additional packages will be installed: ansible-core python3-kerberos python3-ntlm-auth python3-requests-ntlm python3-resolvelib python3-winrm python3-xmltodict sshpass The following NEW packages will be installed: ansible ansible-core python3-kerberos python3-ntlm-auth python3-requests-ntlm python3-resolvelib python3-winrm python3-xmltodict sshpass 0 upgraded, 9 newly installed, 0 to remove and 0 not upgraded. Need to get 19.0 MB of archives. After this operation, 212 MB of additional disk space will be used. Get:1 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble/main amd64 ansible-core all 2.17.7-1ppa~noble [1015 kB] Get:2 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 python3-resolvelib all 1.0.1-1 [25.7 kB] Get:3 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble/main amd64 ansible all 10.7.0-1ppa~noble [17.8 MB] Get:4 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 python3-kerberos amd64 1.1.14-3.1build9 [21.2 kB] Get:5 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 python3-ntlm-auth all 1.5.0-1 [21.3 kB] Get:6 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 python3-requests-ntlm all 1.1.0-3 [6308 B] Get:7 http://azure.archive.ubuntu.com/ubuntu noble/main amd64 python3-xmltodict all 0.13.0-1 [13.4 kB] Get:8 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 python3-winrm all 0.4.3-2 [31.9 kB] Get:9 http://azure.archive.ubuntu.com/ubuntu noble/universe amd64 sshpass amd64 1.09-1 [11.7 kB] Fetched 19.0 MB in 3s (6995 kB/s) Selecting previously unselected package python3-resolvelib. (Reading database ... 179940 files and directories currently installed.) Preparing to unpack .../0-python3-resolvelib_1.0.1-1_all.deb ... Unpacking python3-resolvelib (1.0.1-1) ... Selecting previously unselected package ansible-core. Preparing to unpack .../1-ansible-core_2.17.7-1ppa~noble_all.deb ... Unpacking ansible-core (2.17.7-1ppa~noble) ... Selecting previously unselected package ansible. Preparing to unpack .../2-ansible_10.7.0-1ppa~noble_all.deb ... Unpacking ansible (10.7.0-1ppa~noble) ... Selecting previously unselected package python3-kerberos. Preparing to unpack .../3-python3-kerberos_1.1.14-3.1build9_amd64.deb ... Unpacking python3-kerberos (1.1.14-3.1build9) ... Selecting previously unselected package python3-ntlm-auth. Preparing to unpack .../4-python3-ntlm-auth_1.5.0-1_all.deb ... Unpacking python3-ntlm-auth (1.5.0-1) ... Selecting previously unselected package python3-requests-ntlm. Preparing to unpack .../5-python3-requests-ntlm_1.1.0-3_all.deb ... Unpacking python3-requests-ntlm (1.1.0-3) ... Selecting previously unselected package python3-xmltodict. Preparing to unpack .../6-python3-xmltodict_0.13.0-1_all.deb ... Unpacking python3-xmltodict (0.13.0-1) ... Selecting previously unselected package python3-winrm. Preparing to unpack .../7-python3-winrm_0.4.3-2_all.deb ... Unpacking python3-winrm (0.4.3-2) ... Selecting previously unselected package sshpass. Preparing to unpack .../8-sshpass_1.09-1_amd64.deb ... Unpacking sshpass (1.09-1) ... Setting up python3-ntlm-auth (1.5.0-1) ... Setting up python3-resolvelib (1.0.1-1) ... Setting up python3-kerberos (1.1.14-3.1build9) ... Setting up ansible-core (2.17.7-1ppa~noble) ... Setting up sshpass (1.09-1) ... Setting up python3-xmltodict (0.13.0-1) ... Setting up ansible (10.7.0-1ppa~noble) ... Setting up python3-requests-ntlm (1.1.0-3) ... Setting up python3-winrm (0.4.3-2) ... Processing triggers for man-db (2.12.0-4build2) ... Scanning processes... Scanning linux images... Running kernel seems to be up-to-date. No services need to be restarted. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host. XxXxXxXxX@tacg-cicd:~$ ansible --version ansible [core 2.17.7] config file = /etc/ansible/ansible.cfg configured module search path = ['/home/tmm-XxXxXxXxX/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3/dist-packages/ansible ansible collection location = /home/tmm-XxXxXxXxX/.ansible/collections:/usr/share/ansible/collections executable location = /usr/bin/ansible python version = 3.12.3 (main, Nov 6 2024, 18:32:19) [GCC 13.2.0] (/usr/bin/python3) jinja version = 3.1.2 libyaml = True XxXxXxXxX@tacg-cicd:~$Ansible was successfully installed, and the correct version is reported. We recommend installing important Ansible libraries based on your needs – for example ####Run on all hosts: XxXxXxXxX@tacg-cicd:~$ ansible-galaxy collection install azure.azcollection --force Starting galaxy collection install process Process install dependency map Starting collection install process Downloading https://galaxy.ansible.com/api/v3/plugin/ansible/content/published/collections/artifacts/azure-azcollection-3.3.1.tar.gz to /home/XxXxXxXxX/.ansible/tmp/ansible-local-4576vflvb_gi/tmpu0orj7n3/azure-azcollection-3.3.1-wid_5_qj Installing 'azure.azcollection:3.3.1' to '/home/XxXxXxXxX/.ansible/collections/ansible_collections/azure/azcollection' azure.azcollection:3.3.1 was installed successfully XxXxXxXxX@tacg-cicd:~$ Ansible CommandsAnsible is controlled using its command-line interface (CLI). Calling Ansible without any subcommand shows all currently implemented commands: XxXxXxXxX@tacg-cicd:~$ ansible usage: ansible [-h] [--version] [-v] [-b] [--become-method BECOME_METHOD] [--become-user BECOME_USER] [-K | --become-password-file BECOME_PASSWORD_FILE] [-i INVENTORY] [--list-hosts] [-l SUBSET] [-P POLL_INTERVAL] [-B SECONDS] [-o] [-t TREE] [--private-key PRIVATE_KEY_FILE] [-u REMOTE_USER] [-c CONNECTION] [-T TIMEOUT] [--ssh-common-args SSH_COMMON_ARGS] [--sftp-extra-args SFTP_EXTRA_ARGS] [--scp-extra-args SCP_EXTRA_ARGS] [--ssh-extra-args SSH_EXTRA_ARGS] [-k | --connection-password-file CONNECTION_PASSWORD_FILE] [-C] [-D] [-e EXTRA_VARS] [--vault-id VAULT_IDS] [-J | --vault-password-file VAULT_PASSWORD_FILES] [-f FORKS] [-M MODULE_PATH] [--playbook-dir BASEDIR] [--task-timeout TASK_TIMEOUT] [-a MODULE_ARGS] [-m MODULE_NAME] pattern Define and run a single task 'playbook' against a set of hosts positional arguments: pattern host pattern options: --become-password-file BECOME_PASSWORD_FILE, --become-pass-file BECOME_PASSWORD_FILE Become password file --connection-password-file CONNECTION_PASSWORD_FILE, --conn-pass-file CONNECTION_PASSWORD_FILE Connection password file --list-hosts outputs a list of matching hosts; does not execute anything else --playbook-dir BASEDIR Since this tool does not use playbooks, use this as a substitute playbook directory. This sets the relative path for many features including roles/ group_vars/ etc. --task-timeout TASK_TIMEOUT set task timeout limit in seconds, must be positive integer. --vault-id VAULT_IDS the vault identity to use. This argument may be specified multiple times. --vault-password-file VAULT_PASSWORD_FILES, --vault-pass-file VAULT_PASSWORD_FILES vault password file --version show program's version number, config file location, configured module search path, module location, executable location and exit -B SECONDS, --background SECONDS run asynchronously, failing after X seconds (default=N/A) -C, --check don't make any changes; instead, try to predict some of the changes that may occur -D, --diff when changing (small) files and templates, show the differences in those files; works great with --check -J, --ask-vault-password, --ask-vault-pass ask for vault password -K, --ask-become-pass ask for privilege escalation password -M MODULE_PATH, --module-path MODULE_PATH prepend colon-separated path(s) to module library (default={{ ANSIBLE_HOME ~ "/plugins/modules:/usr/share/ansible/plugins/modules" }}). This argument may be specified multiple times. -P POLL_INTERVAL, --poll POLL_INTERVAL set the poll interval if using -B (default=15) -a MODULE_ARGS, --args MODULE_ARGS The action's options in space separated k=v format: -a 'opt1=val1 opt2=val2' or a json string: -a '{"opt1": "val1", "opt2": "val2"}' -e EXTRA_VARS, --extra-vars EXTRA_VARS set additional variables as key=value or YAML/JSON, if filename prepend with @. This argument may be specified multiple times. -f FORKS, --forks FORKS specify number of parallel processes to use (default=5) -h, --help show this help message and exit -i INVENTORY, --inventory INVENTORY, --inventory-file INVENTORY specify inventory host path or comma separated host list. --inventory-file is deprecated. This argument may be specified multiple times. -k, --ask-pass ask for connection password -l SUBSET, --limit SUBSET further limit selected hosts to an additional pattern -m MODULE_NAME, --module-name MODULE_NAME Name of the action to execute (default=command) -o, --one-line condense output -t TREE, --tree TREE log output to this directory -v, --verbose Causes Ansible to print more debug messages. Adding multiple -v will increase the verbosity, the builtin plugins currently evaluate up to -vvvvvv. A reasonable level to start is -vvv, connection debugging might require -vvvv. This argument may be specified multiple times. A detailed description of all available commands can be found on Ansible´s homepage. Better togetherTerraform, Packer, and Ansible serve complementary roles in modern Infrastructure-as-Code (IaC) architectures. Using Terraform, Ansible, and Packer together creates a powerful, cohesive, and maintainable workflow for provisioning, configuring, and managing modern infrastructure. Each tool has a specific purpose, and together they form a clean pipeline from image creation to infrastructure deployment to configuration management. Terraform excels at provisioning infrastructure resources—compute, networks, storage, identity, and cloud services—while Ansible specializes in configuring and managing the software, applications, and operating system state on those resources once they are created. When combined, they form a robust, scalable, and fully automated delivery pipeline that allows organizations to provision secure, consistent environments and configure them in a modular, policy-driven manner. Terraform is primarily designed for infrastructure lifecycle management, while Ansible is engineered for post-provisioning configuration. This clean separation ensures: Terraform builds and destroys infrastructure predictably Ansible configures servers, middleware, application stacks, and OS settings Changes to infrastructure and configuration are maintained in distinct codebases, improving clarity and reducing risk IT can version, audit, and test both layers independently This division of responsibilities aligns with architectural patterns used in platform engineering and regulated environments, where infrastructure and system configuration often have separate compliance requirements. Example schematic workflow: Terraform builds your infrastructure, Packer builds your images, and Ansible configures your systems—together they give you a clean, scalable, and reliable IaC pipeline that reduces drift, speeds deployments, and ensures consistent environments. Overview of CI/CD MethodologiesInstallation and Usage of JenkinsJenkins is one of the most popular free open-source automation servers used to automate parts of the software development process, especially building, testing, and deploying code. It’s widely used for Continuous Integration (CI) and Continuous Delivery/Deployment (CD). Key FeaturesExtensible: Over 1,800 plugins for integration with tools like Git, Docker, Kubernetes, etc. Distributed Builds: Supports master-agent architecture for scaling builds across multiple machines Pipeline as Code: Jenkins Pipelines (written in Groovy) allow build workflows to be defined in code Web Interface: Easy-to-use UI for managing jobs, builds, and configurations Community Support: Large and active community with frequent updates Importance of Jenkins in CI/CDJenkins plays a critical role in CI/CD pipelines by automating the entire software delivery lifecycle. It enables teams to: Automatically build Master Images Deploy environments to staging or production environments Run automated tests to ensure quality Monitor pipeline status and receive notifications Integrate infrastructure provisioning and configuration Core ConceptsAutomation of Repetitive Tasks: Automates testing, packaging, and deployment. Reduces manual errors and speeds up deployment cycles Scalability: Can be distributed across multiple nodes to handle large-scale builds Flexibility: Supports multiple languages and platforms. Easily integrates with version control systems (Git), and deployment platforms Pipeline as Code: Enables version-controlled, reproducible build and deployment processes Installing JenkinsThe installation of Ansible is straightforward. There are many ways to install Jenkins– you can find more information about Installation on the Jenkins homepage. Note In our case, we use a dedicated Ubuntu-based VM that hosts all automation-related frameworks. You can find more information about creating and installing such a dedicated machine in this guide. Example of installing Jenkins on Ubuntu: XxXxXxXxX@tacg-cicd:~$ sudo apt update Get:1 https://apt.releases.hashicorp.com noble InRelease [12.9 kB] ... Get:25 http://at.archive.ubuntu.com/ubuntu noble-backports/multiverse amd64 Components [212 B] Fetched 3,961 kB in 1s (2,937 kB/s) Reading package lists... Done Building dependency tree... Done Reading state information... Done 158 packages can be upgraded. Run 'apt list --upgradable' to see them. XxXxXxXxX@tacg-cicd:~$ sudo apt upgrade Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done ... Fetched 164 MB in 26s (6,412 kB/s) Extracting templates from packages: 100% Preconfiguring packages ... ... XxXxXxXxX@tacg-cicd:~$ sudo apt install openjdk-17-jdk [sudo] password for XxXxXxXxX: Reading package lists... Done Building dependency tree... Done Reading state information... Done The following package was automatically installed and is no longer required: net-tools Use 'sudo apt autoremove' to remove it. The following additional packages will be installed: libice-dev libpthread-stubs0-dev libsm-dev libx11-dev libxau-dev libxcb1-dev libxdmcp-dev libxt-dev openjdk-17-jdk-headless openjdk-17-jre openjdk-17-jre-headless x11proto-dev xorg-sgml-doctools xtrans-dev Suggested packages: libice-doc libsm-doc libx11-doc libxcb-doc libxt-doc openjdk-17-demo openjdk-17-source visualvm fonts-ipafont-gothic fonts-ipafont-mincho fonts-wqy-microhei | fonts-wqy-zenhei fonts-indic The following NEW packages will be installed: libice-dev libpthread-stubs0-dev libsm-dev libx11-dev libxau-dev libxcb1-dev libxdmcp-dev libxt-dev openjdk-17-jdk openjdk-17-jdk-headless openjdk-17-jre openjdk-17-jre-headless x11proto-dev xorg-sgml-doctools xtrans-dev 0 upgraded, 15 newly installed, 0 to remove and 8 not upgraded. Need to get 123 MB of archives. After this operation, 281 MB of additional disk space will be used. Do you want to continue? [Y/n] Y ... Setting up openjdk-17-jdk:amd64 (17.0.16+8~us1-0ubuntu1~24.04.1) ... update-alternatives: using /usr/lib/jvm/java-17-openjdk-amd64/bin/jconsole to provide /usr/bin/jconsole (jconsole) in auto mode XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ java --version openjdk 21.0.8 2025-07-15 OpenJDK Runtime Environment (build 21.0.8+9-Ubuntu-0ubuntu124.04.1) OpenJDK 64-Bit Server VM (build 21.0.8+9-Ubuntu-0ubuntu124.04.1, mixed mode, sharing) XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ sudo wget -O /usr/share/keyrings/jenkins-keyring.asc https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key --2025-09-04 13:17:23-- https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key Resolving pkg.jenkins.io (pkg.jenkins.io)... 199.232.18.133, 2a04:4e42:41::645 Connecting to pkg.jenkins.io (pkg.jenkins.io)|199.232.18.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 3175 (3.1K) [application/pgp-keys] Saving to: ‘/usr/share/keyrings/jenkins-keyring.asc’ /usr/share/keyrings/jenkins-k 100%[=================================================>] 3.10K --.-KB/s in 0s 2025-09-04 13:17:24 (56.7 MB/s) - ‘/usr/share/keyrings/jenkins-keyring.asc’ saved [3175/3175] XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ sudo sh -c 'echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] https://pkg.jenkins.io/debian binary/ > /etc/apt/sources.list.d/jenkins.list' XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ sudo apt update Hit:1 http://at.archive.ubuntu.com/ubuntu noble InRelease Hit:2 http://at.archive.ubuntu.com/ubuntu noble-updates InRelease Hit:3 http://at.archive.ubuntu.com/ubuntu noble-backports InRelease Hit:4 http://security.ubuntu.com/ubuntu noble-security InRelease Ign:5 https://pkg.jenkins.io/debian binary/ InRelease Hit:6 https://pkg.jenkins.io/debian binary/ Release Hit:7 https://apt.releases.hashicorp.com noble InRelease Hit:9 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble InRelease Reading package lists... Done Building dependency tree... Done Reading state information... Done 8 packages can be upgraded. Run 'apt list --upgradable' to see them. XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ sudo apt install jenkins Reading package lists... Done Building dependency tree... Done Reading state information... Done The following NEW packages will be installed: jenkins 0 upgraded, 1 newly installed, 0 to remove and 8 not upgraded. Need to get 95.0 MB of archives. After this operation, 95.5 MB of additional disk space will be used. Get:1 https://pkg.jenkins.io/debian binary/ jenkins 2.526 [95.0 MB] Fetched 95.0 MB in 26s (3,584 kB/s) Selecting previously unselected package jenkins. (Reading database ... 225680 files and directories currently installed.) Preparing to unpack .../archives/jenkins_2.526_all.deb ... Unpacking jenkins (2.526) ... Setting up jenkins (2.526) ... Created symlink /etc/systemd/system/multi-user.target.wants/jenkins.service → /usr/lib/systemd/system/jenkins.service. XxXxXxXxX@tacg-cicd:~$ XxXxXxXxX@tacg-cicd:~$ sudo systemctl start jenkins XxXxXxXxX@tacg-cicd:~$ sudo systemctl enable jenkins Synchronizing state of jenkins.service with SysV service script with /usr/lib/systemd/systemd-sysv-install. Executing: /usr/lib/systemd/systemd-sysv-install enable jenkins XxXxXxXxX@tacg-cicd:~$ sudo systemctl status jenkins ● jenkins.service - Jenkins Continuous Integration Server Loaded: loaded (/usr/lib/systemd/system/jenkins.service; enabled; preset: enabled) Active: active (running) since Thu 2025-09-04 13:19:19 CEST; 45s ago Main PID: 1189395 (java) Tasks: 48 (limit: 9403) Memory: 706.7M (peak: 721.0M) CPU: 11.417s CGroup: /system.slice/jenkins.service └─1189395 /usr/bin/java -Djava.awt.headless=true -jar /usr/share/java/jenkins.war --webroot=/var/cache/jen> Sep 04 13:19:16 tacg-cicd jenkins[1189395]: f8a1bf5689a142ef90fbe1fc2ba17856 Sep 04 13:19:16 tacg-cicd jenkins[1189395]: This may also be found at: /var/lib/jenkins/secrets/initialAdminPassword Sep 04 13:19:16 tacg-cicd jenkins[1189395]: ************************************************************* Sep 04 13:19:16 tacg-cicd jenkins[1189395]: ************************************************************* Sep 04 13:19:16 tacg-cicd jenkins[1189395]: ************************************************************* Sep 04 13:19:19 tacg-cicd jenkins[1189395]: 2025-09-04 11:19:19.375+0000 [id=40] INFO jenkins.InitReactor> Sep 04 13:19:19 tacg-cicd jenkins[1189395]: 2025-09-04 11:19:19.382+0000 [id=30] INFO hudson.lifecycle.Li> Sep 04 13:19:19 tacg-cicd systemd[1]: Started jenkins.service - Jenkins Continuous Integration Server. Sep 04 13:19:20 tacg-cicd jenkins[1189395]: 2025-09-04 11:19:20.200+0000 [id=56] INFO h.m.DownloadService> Sep 04 13:19:20 tacg-cicd jenkins[1189395]: 2025-09-04 11:19:20.200+0000 [id=56] INFO hudson.util.Retrier> lines 1-20/20 (END) XxXxXxXxX@tacg-cicd:~$ Usage of JenkinsIn our environments, we use Jenkins not for software building, testing, and deployment. Jenkins can orchestrate a full infrastructure and application deployment pipeline using Packer, Terraform, and Ansible. This setup is ideal for teams practicing Infrastructure as Code (IaC) and DevOps automation. The pipeline consists of three major stages, each triggered by Jenkins: Image Creation with Packer Infrastructure Provisioning with Terraform Configuration Management with Ansible Each stage is defined in a Jenkins Pipeline (Groovy syntax), allowing full automation and visibility. Stage 1: Build Golden Images with PackerPurpose: Create immutable machine images (e.g., AWS AMIs, Azure VM images) with pre-installed base software. Jenkins Integration: Jenkins triggers a Packer build using a shell step or plugin. Packer reads a JSON or HCL template to build the image. Output: Image ID (e.g., AMI ID) stored for use in Terraform. Example Jenkinsfile Snippet: stage('Build Image with Packer') { steps { sh 'packer build -var "build_version=${BUILD_NUMBER}" packer/template.json' } } Stage 2: Provision Infrastructure with TerraformPurpose: Deploy infrastructure (VMs, networks, load balancers, etc.) using the image created by Packer. Jenkins Integration: Jenkins uses the Terraform CLI or plugin. Terraform reads .tf files and uses the image ID from Packer. Jenkins stores Terraform state securely (e.g., in remote backend). Example Jenkinsfile Snippet: stage('Deploy Infrastructure with Terraform') { steps { sh ''' cd terraform/ terraform init terraform apply -auto-approve -var "image_id=${packer_image_id}" ''' } } Stage 3: Configure Software with AnsiblePurpose: Install and configure applications, services, and settings on provisioned infrastructure. Jenkins Integration: Jenkins runs Ansible playbooks via shell or plugin. Uses dynamic inventory (e.g., Terraform output). Ensures idempotent configuration. Example Jenkinsfile Snippet: stage('Configure with Ansible') { steps { sh 'ansible-playbook -i inventory/hosts.ini ansible/site.yml' } } Full Pipeline FlowCommit -> triggers Jenkins Jenkins runs Packer ->builds an image Jenkins runs Terraform -> provisions infra using builtimage Jenkins runs Ansible -> configures infra Notifications -> Slack/Teams/email on success/failure Benefits of This Approach Immutable Infrastructure: Ensures consistency across environments Full Automation: Reduces manual effort and risk Scalability: Easily extendable to multi-cloud or hybrid setups Auditability: Every step is logged and version-controlled Complete Jenkinsfile Snippet: pipeline { agent any environment { PACKER_TEMPLATE = 'packer/template.json' TERRAFORM_DIR = 'terraform' ANSIBLE_PLAYBOOK = 'ansible/site.yml' IMAGE_ID_FILE = 'packer_image_id.txt' NOTIFY_EMAIL = 'devops-team@example.com' } stages { stage('Build Image with Packer') { steps { script { echo "Starting Packer build..." sh """ packer build -var 'build_version=${BUILD_NUMBER}' ${PACKER_TEMPLATE} | tee output.log grep 'AMI:' output.log | awk '{print \$2}' > ${IMAGE_ID_FILE} """ } } } stage('Deploy Infrastructure with Terraform') { steps { script { def imageId = readFile(IMAGE_ID_FILE).trim() echo "Using Image ID: ${imageId}" dir("${TERRAFORM_DIR}") { sh """ terraform init terraform apply -auto-approve -var 'image_id=${imageId}' """ } } } } stage('Configure with Ansible') { steps { script { echo "Running Ansible playbook..." sh "ansible-playbook -i inventory/hosts.ini ${ANSIBLE_PLAYBOOK}" } } } } post { success { echo 'Pipeline completed successfully.' mail to: "${NOTIFY_EMAIL}", subject: "Jenkins Pipeline Success - Build #${BUILD_NUMBER}", body: "The CI/CD pipeline completed successfully." } failure { echo 'Pipeline failed.' mail to: "${NOTIFY_EMAIL}", subject: "Jenkins Pipeline Failure - Build #${BUILD_NUMBER}", body: "The CI/CD pipeline failed. Please check the Jenkins logs." } } } Installation and Usage of GitHub ActionsGitHub Actions is a CI/CD (Continuous Integration and Continuous Deployment) platform built into GitHub. It allows you to automate workflows for building, testing, and deploying code directly from your GitHub repository. The Actions are defined in YAML files, allowing them to be triggered by GitHub events such as Pull Requests. Key FeaturesWorkflow Automation: A workflow is a set of automated steps defined in a YAML file inside .github/workflows/. It enables you to automate repetitive tasks, such as running tests, building artifacts, or deploying applications, whenever code changes occur Event-Driven Execution: Based on the Trigger types, you can tailor workflows to run only when needed, saving time and resources push_request , pull_request → e.g., detect which stacks changed, then run the plan only for those stacks schedule → Cron-like scheduled runs, for e.g., nightly drift detection workflow_dispatch → e.g, manual trigger apply/destroy flows Core ConceptsWorkflow: A YAML file defining automation steps Job: A set of steps that run on the same runner Step: A single task, e.g., running a script, uses an action Runner: A server that executes the workflow jobs Action: A reusable unit of code (e.g., actions/checkout) Trigger: An event that starts the workflow (e.g., push, schedule) Installing GitHub ActionsGitHub Actions is natively integrated into GitHub, so there’s no installation required. Example: Create a workflow file in your repository: Location: .github/workflows/ Format: YAML (.yml or .yaml) name: Build master image (Packer/Azure) and provision with Terraform on: workflow_dispatch: inputs: location: description: 'Azure location (e.g., westeurope)' required: true default: 'westeurope' apply: description: 'Apply Terraform? (false = plan only)' type: boolean required: true default: false push: branches: [ "main" ] paths: - 'packer/**' - 'terraform/**' - '.github/workflows/packer-terraform-azure.yml' concurrency: group: packer-terraform-azure-${{ github.ref }} cancel-in-progress: true permissions: id-token: write # required for OIDC to Azure contents: read env: AZURE_LOCATION: ${{ github.event.inputs.location || 'westeurope' }} TF_IN_AUTOMATION: true TF_INPUT: false jobs: packer: name: Build master image with Packer (Azure) runs-on: ubuntu-latest outputs: image_id: ${{ steps.capture.outputs.image_id }} steps: - name: Checkout uses: actions/checkout@v4 # --- AZURE AUTH VIA OIDC --- - name: Azure login (OIDC) uses: azure/login@v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Export Azure creds for Hashi tools (OIDC) run: | echo "ARM_USE_OIDC=true" >> $GITHUB_ENV echo "ARM_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV echo "ARM_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV echo "ARM_SUBSCRIPTION_ID=${{ secrets.AZURE_SUBSCRIPTION_ID }}" >> $GITHUB_ENV echo "AZURE_LOCATION=${{ env.AZURE_LOCATION }}" >> $GITHUB_ENV - name: Set up Packer uses: hashicorp/setup-packer@v3 - name: Packer init run: packer init ./packer - name: Packer validate run: packer validate ./packer - name: Packer build (machine-readable) run: | mkdir -p artifacts # Adjust the path if your primary template is e.g., packer/azure.pkr.hcl packer build -color=false -machine-readable ./packer | tee artifacts/packer-build.log - name: Capture image ID from build output (Azure) id: capture shell: bash run: | set -euo pipefail LOG="artifacts/packer-build.log" IMAGE_ID="" # Prefer Azure Compute Gallery (SIG) version ID if grep -qE '/subscriptions/.*/resourceGroups/.*/providers/Microsoft\.Compute/galleries/.*/images/.*/versions/[0-9.]+' "$LOG"; then IMAGE_ID=$(grep -oE '/subscriptions/.*/resourceGroups/.*/providers/Microsoft\.Compute/galleries/.*/images/.*/versions/[0-9.]+' "$LOG" | head -n1) elif grep -qE '/subscriptions/.*/resourceGroups/.*/providers/Microsoft\.Compute/images/[^ ]+' "$LOG"; then # Managed Image ID IMAGE_ID=$(grep -oE '/subscriptions/.*/resourceGroups/.*/providers/Microsoft\.Compute/images/[^ ]+' "$LOG" | head -n1) fi # Fallback to manifest.json if you configured the Packer manifest post-processor if [ -z "${IMAGE_ID}" ] && [ -f "packer/manifest.json" ]; then sudo apt-get update -y && sudo apt-get install -y jq # .builds[-1].artifact_id may look like "azure-arm:/subscriptions/.../images/..." or SIG version id IMAGE_ID=$(jq -r '.builds[-1].artifact_id // empty' packer/manifest.json | sed -E 's#.*:##') fi if [ -z "${IMAGE_ID}" ]; then echo "Could not detect image ID in Packer output." >&2 exit 1 fi echo "Detected image: ${IMAGE_ID}" echo "image_id=${IMAGE_ID}" >> "$GITHUB_OUTPUT" - name: Upload Packer artifacts uses: actions/upload-artifact@v4 with: name: packer-artifacts path: | artifacts/packer-build.log packer/manifest.json if-no-files-found: ignore terraform: name: Terraform plan/apply (Azure) needs: packer runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v4 # --- AZURE AUTH VIA OIDC --- - name: Azure login (OIDC) uses: azure/login@v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Export Azure creds for Terraform (OIDC) run: | echo "ARM_USE_OIDC=true" >> $GITHUB_ENV echo "ARM_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV echo "ARM_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV echo "ARM_SUBSCRIPTION_ID=${{ secrets.AZURE_SUBSCRIPTION_ID }}" >> $GITHUB_ENV - name: Set up Terraform uses: hashicorp/setup-terraform@v3 with: terraform_wrapper: false - name: Terraform fmt working-directory: ./terraform run: terraform fmt -check -recursive - name: Terraform init working-directory: ./terraform run: terraform init -input=false - name: Terraform validate working-directory: ./terraform run: terraform validate - name: Terraform plan id: plan working-directory: ./terraform env: TF_VAR_image_id: ${{ needs.packer.outputs.image_id }} TF_VAR_location: ${{ env.AZURE_LOCATION }} run: terraform plan -input=false -out=tfplan - name: Upload Terraform plan if: ${{ always() }} uses: actions/upload-artifact@v4 with: name: terraform-plan path: ./terraform/tfplan - name: Terraform apply if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.apply == 'true' }} working-directory: ./terraform env: TF_VAR_image_id: ${{ needs.packer.outputs.image_id }} TF_VAR_location: ${{ env.AZURE_LOCATION }} run: terraform apply -auto-approve tfplanUsage of GitHub ActionsAs with Jenkins, you can use GitHub Actions for a variety of different scenarios, like: Triggering CI/CD pipelines Automation of GitHub tasks Setting up or running scheduled tasks like checks for configuration drifts or security checks Deploying and/or Altering your Infrastructure by using Infrastructure as Code Example for running a Terraform workflow: name: Terraform CI/CD on: pull_request: paths: - "infra/**" - ".github/workflows/terraform.yml" push: branches: [ "main" ] paths: - "infra/**" - ".github/workflows/terraform.yml" workflow_dispatch: {} permissions: contents: read # Map GitHub Repository Variables/Secrets -> TF_VAR_* so Terraform sees them as input vars env: TF_INPUT: "false" TF_VAR_project: ${{ vars.PROJECT }} TF_VAR_environment: ${{ vars.ENVIRONMENT }} TF_VAR_greeting: ${{ vars.GREETING }} TF_VAR_db_password: ${{ secrets.DB_PASSWORD }} jobs: plan: name: Terraform Init/Validate/Plan runs-on: ubuntu-latest defaults: run: shell: bash working-directory: infra steps: - name: Checkout uses: actions/checkout@v4 # Install Terraform (update version as desired) - name: Setup Terraform uses: hashicorp/setup-terraform@v2 with: terraform_version: 1.9.5 - name: Terraform Init run: terraform init -input=false - name: Terraform Format (check) run: terraform fmt -check -diff - name: Terraform Validate run: terraform validate - name: Terraform Plan run: terraform plan -no-color -out=tfplan.bin - name: Upload Plan Artifact uses: actions/upload-artifact@v4 with: name: tfplan path: infra/tfplan.bin if-no-files-found: error apply: name: Terraform Apply needs: plan runs-on: ubuntu-latest environment: name: production if: github.event_name == 'push' && github.ref == 'refs/heads/main' defaults: run: shell: bash working-directory: infra steps: - name: Checkout uses: actions/checkout@v4 - name: Setup Terraform uses: hashicorp/setup-terraform@v2 with: terraform_version: 1.9.5 - name: Terraform Init run: terraform init -input=false - name: Download Plan Artifact uses: actions/download-artifact@v4 with: name: tfplan path: infra - name: Terraform Apply run: terraform apply -input=false -auto-approve tfplan.bin Installation and Usage of Azure PipelinesAzure Pipelines is a cloud-based offering from Microsoft Azure designed for continuous integration (CI) and continuous delivery (CD). It accommodates various programming languages and project types, and it seamlessly integrates with GitHub, Azure Repos, and other version control platforms. This service is essential for infrastructure automation as it facilitates Infrastructure as Code (IaC) methodologies. Similar to Jenkins and GitHub Actions, Azure Pipelines empowers teams to automate the provisioning and management of infrastructure through tools like Terraform, Ansible, and Packer. Key FeaturesMulti-platform Support: Build and deploy on Windows, Linux, and macOS Language Support: Works with .NET, Java, Node.js, Python, PHP, Ruby, and more Integration: Seamlessly integrates with GitHub, Bitbucket, Azure Repos, and Docker Parallel Jobs: Run multiple jobs in parallel to speed up the CI/CD process Custom Agents: Use Microsoft-hosted or self-hosted agents for builds YAML Pipelines: Define pipelines as code using YAML syntax Environment Management: Manage approvals and checks for deployments Core ConceptsTrigger: A manual, scheduled, or automated trigger causes a pipeline to start Pipeline: The workflow that contains one or more stages and is deployed to one or more environments Stages: Used to organize pipelines by logically grouping jobs; each stage contains one or more Jobs: A collection of steps that run on the same agent. Each job contains one or more steps Step: An individual task (e.g., running a script, installing a package) Task: A prepackaged script that performs an action, such as invoking a Packer or Terraform script A pipeline run produces artifacts such as files or packages. Installing Azure PipelinesSign in to Azure DevOps Create a new project in Azure DevOps Navigate to Pipelines -> New Pipeline Connect your repository (GitHub, Azure Repos, etc.) Choose a template or start with an empty YAML file Define your pipeline steps and save the YAML file in your repo Run the pipeline to start the CI/CD process Usage of Azure PipelinesAs with Jenkins and GitHub Actions, you can use Azure Pipelines for a variety of different scenarios, like: Triggering CI/CD pipelines Setting up or running scheduled tasks like checks for configuration drifts or security checks Deploying and/or Altering your Infrastructure by using Infrastructure as Code Example for running an Azure Pipelines workflow: azure-pipelines.yml trigger: branches: include: - main pr: branches: include: - '*' variables: vmImage: 'ubuntu-latest' terraformVersion: '1.8.7' # set the TF version you want workingDirectory: 'infra' # folder with your Terraform code azureServiceConnection: 'sc-az-devops' prodEnvironmentName: 'production' # Azure DevOps Environment (set approvals/checks in UI) stages: # -------------------------------------- # Stage: Validate & Plan # -------------------------------------- - stage: Validate_and_Plan displayName: 'Terraform Validate & Plan' jobs: # PRs -> Dev plan - job: plan_dev displayName: 'Dev plan (PRs)' condition: ne(variables['Build.SourceBranch'], 'refs/heads/main') pool: vmImage: $(vmImage) steps: - checkout: self clean: true - script: | set -euo pipefail curl -sLo terraform.zip https://releases.hashicorp.com/terraform/$(terraformVersion)/terraform_$(terraformVersion)_linux_amd64.zip sudo unzip -o terraform.zip -d /usr/local/bin terraform -version displayName: 'Install Terraform $(terraformVersion)' - task: Cache@2 displayName: 'Cache Terraform plugins' inputs: key: 'terraform | $(Agent.OS) | $(Build.SourcesDirectory)/$(workingDirectory)/.terraform.lock.hcl' path: '$(Build.SourcesDirectory)/$(workingDirectory)/.terraform' restoreKeys: | terraform | $(Agent.OS) - task: AzureCLI@2 displayName: 'terraform fmt/validate/plan (dev)' inputs: azureSubscription: $(azureServiceConnection) scriptType: bash scriptLocation: inlineScript workingDirectory: $(workingDirectory) inlineScript: | set -euo pipefail terraform fmt -check terraform init -upgrade -input=false terraform validate terraform workspace select dev || terraform workspace new dev terraform plan -input=false -var-file=env/dev.tfvars # main -> Prod plan (artifact published for apply) - job: plan_prod displayName: 'Prod plan (main)' condition: eq(variables['Build.SourceBranch'], 'refs/heads/main') pool: vmImage: $(vmImage) steps: - checkout: self clean: true - script: | set -euo pipefail curl -sLo terraform.zip https://releases.hashicorp.com/terraform/$(terraformVersion)/terraform_$(terraformVersion)_linux_amd64.zip sudo unzip -o terraform.zip -d /usr/local/bin terraform -version displayName: 'Install Terraform $(terraformVersion)' - task: Cache@2 displayName: 'Cache Terraform plugins' inputs: key: 'terraform | $(Agent.OS) | $(Build.SourcesDirectory)/$(workingDirectory)/.terraform.lock.hcl' path: '$(Build.SourcesDirectory)/$(workingDirectory)/.terraform' restoreKeys: | terraform | $(Agent.OS) - task: AzureCLI@2 displayName: 'terraform init/validate/plan (prod)' inputs: azureSubscription: $(azureServiceConnection) scriptType: bash scriptLocation: inlineScript workingDirectory: $(workingDirectory) inlineScript: | set -euo pipefail terraform fmt -check terraform init -upgrade -input=false terraform validate terraform workspace select prod || terraform workspace new prod # Write the plan into the repo working dir so paths remain valid on apply terraform plan -input=false -var-file=env/prod.tfvars -out=tfplan - publish: $(workingDirectory)/tfplan artifact: tfplan displayName: 'Publish Terraform plan artifact (prod)' # -------------------------------------- # Stage: Apply (main only; protected Environment) # -------------------------------------- - stage: Apply displayName: 'Terraform Apply (main)' dependsOn: Validate_and_Plan condition: eq(variables['Build.SourceBranch'], 'refs/heads/main') jobs: - deployment: apply_to_production displayName: 'Apply to production' environment: $(prodEnvironmentName) # configure approvals/checks in Azure DevOps UI strategy: runOnce: deploy: steps: - checkout: self clean: true - download: current artifact: tfplan displayName: 'Download plan artifact' - script: | set -euo pipefail curl -sLo terraform.zip https://releases.hashicorp.com/terraform/$(terraformVersion)/terraform_$(terraformVersion)_linux_amd64.zip sudo unzip -o terraform.zip -d /usr/local/bin terraform -version displayName: 'Install Terraform $(terraformVersion)' - task: Cache@2 displayName: 'Cache Terraform plugins' inputs: key: 'terraform | $(Agent.OS) | $(Build.SourcesDirectory)/$(workingDirectory)/.terraform.lock.hcl' path: '$(Build.SourcesDirectory)/$(workingDirectory)/.terraform' restoreKeys: | terraform | $(Agent.OS) # Copy the downloaded plan back into the same working directory used for planning - script: | set -euo pipefail cp "$(Pipeline.Workspace)/tfplan/tfplan" "$(Build.SourcesDirectory)/$(workingDirectory)/tfplan" displayName: 'Place plan file in working directory' - task: AzureCLI@2 displayName: 'terraform init/apply (prod)' inputs: azureSubscription: $(azureServiceConnection) scriptType: bash scriptLocation: inlineScript workingDirectory: $(workingDirectory) inlineScript: | set -euo pipefail terraform init -input=false terraform workspace select prod || terraform workspace new prod terraform apply -input=false -auto-approve tfplan Comparison of Azure Pipelines, GitHub Actions, and JenkinsAll three mentioned CI/CD Frameworks have their strengths and weaknesses – use the one that best suits your needs. OverviewFeature Azure Pipelines GitHub Actions Jenkins Type Cloud & self-hosted CI/CD service (part of Azure DevOps) Cloud-native CI/CD integrated with GitHub Open-source automation server Best For Enterprise environments, Azure-heavy ecosystems GitHub-native teams, open source, small to mid-size teams Highly customized workflows, legacy systems Hosting Microsoft-hosted or self-hosted agents GitHub-hosted or self-hosted runners Self-hosted (on-prem or cloud) Config Style YAML pipelines YAML workflows in .github/workflows Jenkinsfile (Groovy) or UI jobs Pricing Paid (with free tier), included in Azure DevOps Free for public repos, paid for private Free (open source), but infra costs apply Ease of Setup/Learning CurveAzure Pipelines: Quick for Azure users, but requires service connections and RBAC setup. Steeper learning curve for newcomers GitHub Actions: Easiest to get started if the code is on GitHub. Zero installation, YAML-based, huge marketplace of pre-built actions Jenkins: Most complex to set up. Requires server installation, plugin management, and pipeline scripting. That completes Part 1 of the Citrix Automation Handbook. In the first part of the Citrix Automation Handbook, we discussed the Citrix Automation story and the basics of Infrastructure-as-Code, of Continuous Integration/Continuous Deployment (CI/CD) strategies, and our main IaC tools: Packer, Terraform, and Ansible. In the second part of the Citrix Automation Handbook, we focus on: Applying automation and infrastructure-as-code in the Citrix universe. We discuss all relevant components and provide code examples from real environments Best practises for designing an environment for automation and IaC use, and discuss deployment tips In the third part of the Citrix Automation Handbook, we focus on common and special use cases, as well as complete deployment examples from the field. In the fourth part of the Citrix Automation Handbook, we cover creating a Citrix Virtual Apps and Desktops 2507 LTSR deployment on XenServer 8.4. In the fifth part of the Citrix Automation Handbook, we cover creating a Citrix DaaS deployment on Azure. In the sixth part of the Citrix Automation Handbook, we cover some final topics. DisclaimerMost important All code snippets mentioned in this handbook were thoroughly tested and run in a sandbox environment. All shown Packer snippets, Terraform snippets, Ansible Playbooks, and PowerShell scripts were tailored exclusively for the specific environment used for this handbook. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. We tried to show different ways, even if they were not always in line with best-practice guidelines, such as unencrypted WinRM communication for demonstration purposes. Using all the provided code snippets is at your own risk – please read the disclaimer below for further information. EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>Licensing Guide</h1> <p>Thu, 15 Jan 2026 13:10:00 +0000</p> Citrix Unicon Licensing Guide IntroductionThe Citrix Unicon OS (eLux® Operating System) is a secure, lightweight, hardened operating system designed for Citrix DaaS environments. Combined with Citrix Unicon OS Management (Scout Management Suite), it provides a centralized solution for easily managing all endpoints in your enterprise. Currently, Scout can still be installed and operated using multiple licensing models. This guide explains the specifics and technical dependencies of those licensing models. Furthermore, it provides step-by-step instructions for using the available licensing models in Scout. This information allows customers to choose the listening model that best meets their individual requirements, ensuring an efficient setup. This guide is structured as follows: Brief technical background Overview of licensing models for Scout Compatibility of licensing models for Scout with Scout versions Process for obtaining Citrix Unicon entitlements through Citrix How to use the available licensing models for Scout Summary Brief technical background The Scout Management Suite must be licensed to ensure full functionality. The licensing model (installation type/operating mode) can be selected during initial installation. Furthermore, it can be switched after the initial installation, depending on the current Scout version (see the following paragraphs for more details). All available licensing models require Unicon entitlements obtained from Citrix or Citrix partners. Overview of licensing models for ScoutLicensing Model Validity Limitation Citrix License Server No limitation License Activation Service (LAS) and Citrix legacy licensing only, not available for file-based licensing Enterprise Subscriptions End-of-Life (EOL) on 2026-04-15 Perpetual (keys for licenses and Software Maintenance) End-of-Life (EOL), no further extensions Compatibility of licensing models for Scout with Scout versionsLicensing model Compatibility Scout 2507 and earlier Scout 2508 and later Citrix License Server Upon installation No Yes After updating from an earlier version No Yes Switch to another licensing model No No Enterprise Subscriptions Upon installation Yes Yes After updating from an earlier version Yes Yes Switch to another licensing model No To Citrix License Server Perpetual (keys for licenses and Software Maintenance) Upon installation Yes No After updating from an earlier version Yes Still functioning, but no further extensions are possible Switch to another licensing model Scout 2412 or Scout 2409 LTSR CU2 and later: to Enterprise Subscriptions To Citrix License Server (Scout 2508 and later) and Enterprise Subscriptions (Scout 2508.1 and later) If the Scout was installed using the “Standard” installation type in Scout 2507 or earlier, it is using the perpetual licensing model. In this case, the license information dialog in Scout Board shows “Software Maintenance for eLux & Scout”: It is recommended to switch from the perpetual licensing model to another licensing model. Process for obtaining Citrix Unicon entitlements through CitrixThe process for obtaining Citrix Unicon entitlements depends on the customer type and the current Citrix licenses. Similarly, there are different processes to obtain trials for Unicon solutions. Generally, all Scout licensing models are compatible with all Citrix licenses that include Unicon entitlements. However, the limitations listed in the overview of licensing models for Scout apply. For customers with CPL licenses, Unicon entitlements are already included in the Citrix license. For customers with UHMC licenses and some other licenses, Unicon entitlements are partially already included in the Citrix license. To verify this, check whether “Citrix Unicon” is listed as a sub-component of the license (https://www.citrix.com/account/) or reach out to your Citrix representative (e.g. Citrix ATS / Citrix Partner). One case in which Unicon entitlements are included in the Citrix license is a UHMC license renewed or initially purchased after 2025-06-08. If Unicon entitlements are included in the Citrix license, customers do not require trials and can use their actual Unicon entitlements instead. Otherwise, customers can reach out to their Citrix representative (e.g., Citrix ATS / Citrix Partner) to obtain Unicon entitlements or to request trials. How to use the available licensing models for ScoutHow to use the licensing model Citrix License Server in ScoutSince this licensing model remains valid after 2026-04-15, when the Enterprise Subscription reaches End-of-Life (EOL), it is the recommended option. Moreover, it is the most user-friendly licensing model because once a License Server is set up and License Activation Service (LAS) is activated, existing Unicon entitlements are automatically available. Furthermore, LAS provides an offline activation option for airgapped environments. Contact your Citrix representative for this option. Technical requirements and detailed instructions on how to set up a Scout with this licensing model can be found in the eLux and Scout POC Guide and in the product documentation. To switch from another licensing model to this licensing model, use the corresponding button (Switch to Citrix License Server) in the license information dialog in Scout Board. How to use the licensing model Enterprise Subscriptions in ScoutSince this licensing model reaches its end-of-life on 2026-04-15, it is recommended to use the Citrix License Server licensing model instead. To use Enterprise Subscriptions, the Scout must connect to the Citrix backend at least once over the internet. Afterwards, offline reporting is possible. Contact your Citrix representative for this option. This licensing model is therefore not suitable for permanently airgapped environments. Furthermore, a Technical Scout User is required. Follow the subsequent steps to create or activate a Technical Scout User and to use Enterprise Subscriptions for Scout. If a Technical Scout User was already activated before the last renewal, follow step 1 again to re-activate the Technical Scout User once the renewal is processed. This will update the Technical Scout user with the most recent expiration date and seat limit. Activate a Technical Scout User: Locate and click the Unicon button in Citrix MyAccount. Manage licenses > Activate Unicon Customer If the button is not visible, consider that it may take some time for orders to be processed, and the button will appear. Submit the user's information: Click “Activate Unicon Customer”. Enter the “First Name”, “Last Name” and “Email” address of the Technical Scout user which will be used for the Enterprise Subscriptions. One Technical Scout User can be used to install multiple Scouts Click “Submit”. A success notification is shown, and the activated user is listed on the right under “Active Users”. In the backend, a new myelux user is created as a Technical Scout User or an existing myelux user with the submitted email address updated accordingly with the number of seats and expiration date. A confirmation email is sent to the submitted email address, describing the next steps. Complete the User setup in myelux: Follow the instructions in the confirmation email: If the myelux user did not exist before, set the initial password. If the password cannot be set, your user was most likely not correctly created/updated. If you have a myelux user and are able to log in but don’t see the page Licensing > Scout MSP License Report, your myelux user was not correctly updated. Scout installation or licensing model switch: Scout installation: Technical requirements and detailed instructions for setting up a Scout with this licensing model can be found in the eLux and Scout POC Guide and the product documentation. During installation, do not change the default MSP reporting portal / URL unless instructed to do so. Licensing model switch to Enterprise Subscriptions: To switch from another licensing model to this licensing model, use the corresponding button (Switch to Citrix License Server) in the license information dialog in Scout Board. During the switch, do not change the default MSP reporting portal / URL unless you are instructed to do so. In case you are encountering a “Mode switch error” (see screenshot below) during the switch of the Scout operating mode, do the following: If you are using a proxy: Leave the proxy field of the SBD empty. Set the proxy in Edge for the user account instead. If this does not resolve the error, contact the technical support. You will most likely need to submit your Scout's diagnostic data, which you can already retrieve. For technical issues related to the licensing model, contact your Citrix ATS, Citrix Partner, or Citrix Support. How CSPs can use licensing models for ScoutNormally, a CSP would install a Scout as described in the previous sections, using its own Citrix License Server or its own Technical Scout User for Enterprise Subscriptions. After installation, the CSP can grant admin rights to the Scout for customers. SummaryThis guide provides a detailed explanation of licensing models currently available for Unicon Scout. It described the specifics and technical dependencies of those licensing models. Furthermore, it provides step-by-step instructions for using the available licensing models in Scout. Following this guide enabled customers to choose the listening model that best meets their individual requirements. This leads to time savings and guarantees an efficient setup of Unicon Scout. For further guidance, reach out to your Citrix representative, check out the eLux and Scout POC Guide, or consult the official documentation at https://docs.citrix.com/en-us/unicon-elux-scout. </article> <article> <h1>Avoid Common Misconfigurations that Can Negatively Impact DaaS Resiliency</h1> <p>Fri, 09 Jan 2026 14:35:00 +0000</p> Overview Local Host Cache and Service Continuity should be at the forefront of conversations when building a resilient Citrix environment. Local Host Cache and Service Continuity are Citrix technologies that can maintain end-user access to business-critical workloads during potential service disruptions.  While they function differently, both features serve the same purpose: to keep users launching their apps and desktops regardless of service health. Let's start by differentiating the 2 features: Local Host Cache (LHC): LHC leverages a locally cached copy of the Site database hosted on Cloud Connectors. The local copy of the Site database is used to broker sessions if connectivity between the Cloud Connectors and Citrix Cloud is lost. LHC is enabled by default for DaaS environments, but some configurations must be considered to ensure LHC works properly during a service disruption.  Service Continuity: Service Continuity is a DaaS-only feature that uses Connection Lease files downloaded to a user’s endpoint when they log in to Citrix Workspace from either the Workspace app or a browser (the Citrix Workspace web extension is required for Service Continuity to work in a browser). Service Continuity uses the Connection Lease files when a normal end-user launch path cannot be established. It’s important to note that Service Continuity can leverage the LHC database on the Cloud Connectors, so many of the LHC misconfigurations below can also impact customers using Service Continuity for resiliency. Service Continuity is only supported for DaaS connections through the Workspace service. Service Continuity cannot be used with an on-premises StoreFront server.  Note The deprecated Citrix feature called “connection leasing” resembles Workspace connection leases in that it improves connection resiliency during outages. Otherwise, that deprecated feature is unrelated to service continuity. Understanding the resiliency features is a critical first step in configuring your environment correctly in the case of a service disruption. This article assumes a working knowledge of LHC and Service Continuity. There are a few crucial configurations to check for to ensure that users can continue to access their resources when LHC or Service Continuity activates. The table below lists common misconfigurations that may impact the availability of DaaS resources in the event of a service disruption. Review this list and update any potential misconfigurations in your environment before it’s too late! Impacts All Access Methods In the table below, you’ll see that some misconfigurations impact StoreFront only, some impact Workspace only, and some can impact both. That’s because, with Service Continuity, the Cloud Connectors still attempt to retrieve the VDA addresses from the Citrix Cloud-hosted session broker (using the information supplied from the cached connection leases on the endpoint). If the session broker is unreachable, the VDA addresses are determined using the LHC database. You can see the entire process here in more detail. Misconfiguration Description Impact Detection Mitigation MachinesUnusableDuringHA Pooled single-session OS VDAs that are power managed are unavailable during LHC Because power management services reside on Citrix Cloud infrastructure rather than Cloud Connectors, power management becomes unavailable during an LHC event. This results in an inability to reboot power-managed pooled single-session OS VDAs and reset their differencing/write cache disks while LHC is active. For security reasons, these VDAs are unavailable by default during LHC to avoid changes and data from previous user sessions being available on subsequent sessions. During an LHC event, the machines in this delivery group will not be available for new launches. Review the Delivery Groups node in Studio. Any pooled single-session delivery group that is power-managed and is not configured for access during LHC will show a warning icon. Edit the Local Host Cache settings within the delivery group. Note: Changing the default can result in changes and data from previous user sessions being present in subsequent sessions. ExceedsRecommendedVdas Too many VDAs in a Resource Location The LHC broker on Cloud Connectors caps VDA registrations at 10,000 per resource location if the resource location goes into LHC mode. A subset of VDAs will be unavailable during LHC. Review the Zones node in Studio. 1. Reconfigure Resource Locations to contain no more than 10,000 VDAs. 3 Consecutive failed config syncs Cloud Connectors periodically sync configurations from Citrix Cloud to the local database to ensure up-to-date configurations if LHC activates. Failed configuration syncs can result in stale or corrupted configurations used in case of an LHC event. Monitor Cloud Connectors for 505 events from the Config Synchronizer Service. Email alerts for failed config syncs are on the roadmap for Citrix Monitor! Review firewall configurations to ensure your firewall accepts XML and SOAP traffic. Review CTX238909. Open a support ticket to determine why config sync failures occur in your environment.  MultipleElectedLhcBrokers Multiple elected brokers One Cloud Connector per resource location should be elected for LHC events. Cloud Connectors must be able to communicate with each other to determine the elected broker and understand the health of other peer Cloud Connectors to make a go/no-go decision about entering LHC mode. “Split brain” scenario where multiple Connectors in the same Resource Location remain active during an LHC event. VDAs may register with any elected connectors in the Resource Location, and launches may fail intermittently while LHC is active. Review the Zones node in Studio. Otherwise, monitor Cloud Connectors for 3504 events from the High Availability Service to see if more than one Cloud Connector per Resource Location is being elected. Ensure Cloud Connectors can communicate with each other at http://<FQDN_OF_PEER_CONNECTOR>:80/Citrix/CdsController/ISecondaryBrokerElection. If using a proxy, bypassing the proxy for traffic between Cloud Connectors is recommended.  Lack of Regular Testing It’s debatable whether a lack of testing can be considered a misconfiguration, but what’s not up for debate is the impact testing can have on ensuring this tech works in your environment! Testing can ensure infrastructure is scaled properly and works as expected before a disruption occurs. Testing should be done at regular intervals. For testing LHC, see Force an Outage. Forcing LHC is relevant to both on-prem StoreFront customers and customers leveraging Service Continuity. DaaS resources are potentially inaccessible during a service disruption. If you don’t have a testing plan for LHC or Service Continuity in your environment, consider this misconfiguration detected. Verify that Local Host Cache is working. Create a testing plan to test Service Continuity and Local Host Cache regularly. Low vCPU cores per socket configuration LHC operates using a Microsoft SQL Server Express LocalDB on the Cloud Connector. Microsoft has a limitation on SQL Express in which the Connector is limited to the lesser of 1 socket or 4 vCPU cores when using the LHC DB. If we configure Cloud Connectors to use one core per socket (e.g., 4 sockets, 4 cores), we limit LHC operating on a single core during an LHC event. Because all VDA registration and brokering operations go through a single connector during LHC, this can negatively impact performance and cause issues with VDA registration during the service disruption. More info regarding LHC core and socket configurations can be found in the Recommended compute configuration for Local Host Cache. Negative impact on the stability of VDA re-registration during an LHC event and the performance of LHC brokering operations. Check Task Manager to view core and socket configurations. Divide the number of virtual processors by the number of sockets to get your core-per-socket ratio. Reconfigure your VM to use at least 4 cores per socket. A new instance type may have to be used for public cloud workloads. Rebooting your connector may be required to reconfigure the core and socket configuration.  Undersized Cloud Connectors During an event in which the LHC is activated, a single Cloud Connector per resource location begins to broker sessions. The elected LHC broker handles all VDA registrations and session launch requests (see Resource locations with multiple Cloud Connectors for more information on the election process). Sizing connectors to handle this added load during an LHC event is important for ensuring consistent performance.  Negative impact on stability and performance during LHC VDA registration and LHC steady state. Check out the Zones node within Citrix DaaS Full Configuration! If your environment has undersized connectors, see our documentation for troubleshooting steps. The sizing of connectors can also be checked on each connector machine at the hypervisor or VM level.  Reconfigure connectors to have at least 4 vCPU and 6 GB of RAM. Review the Recommended compute configuration for local host cache for recommended sizing guidelines based on the number of VDAs in the Resource Location.   MultipleDomainsInResourceLocation Multiple Active Directory (AD) domains in a single resource location As per Citrix DaaS limits e-docs, only one Active Directory domain is supported per resource location. Multiple AD domains in a single Resource Location can cause issues with VDA registration during LHC events. VDAs may have to try multiple Connectors before finding one they can register with. This can impact VDA registration times and add additional load on Connectors when VDAs must register, especially in VDA registration storms like Local Host Cache re-registration or Autoscale events. Review the Zones node in Studio. If your environment has multiple AD domains in a resource location, a warning icon will show on the resource location. Reconfigure resource locations to only contain Cloud Connectors in a single AD domain per resource location.  VdaRegisteringInMultipleZones Auto-update of DDC list disabled By default, auto-update of ListOfDDCs is enabled in the policy. If it has been deliberately disabled, it is important that VDAs are provided with a ListOfDDCs from the same resource location that the VDAs are configured for. During an LHC event, VDAs that are registered in the wrong resource location will not be available for launch. Check if the policy is disabled in Studio. 1. Enable the policy for auto update of DDC list. Impacts Workspace The following misconfigurations only apply when Workspace is used as the access tier.  Misconfiguration Description Impact Detection Mitigation Service Continuity not enabled Things can’t work if they’re not turned on! Service Continuity is a core resiliency feature for customers leveraging the Citrix Workspace service as their access tier. You can manage Service Continuity on the Citrix Cloud Workspace configuration page.  Without Service Continuity enabled, Connection Lease files won’t be downloaded, and users won’t be able to access their apps and desktops during a service disruption.  View the Service Continuity tab in the Citrix Cloud Workspace configuration page to see if the feature is enabled. Enable Service Continuity. See Configure Service Continuity for more information. Access clients are unsupported for Service Continuity To download Service Continuity Connection Lease files, users must access their Workspace from a client that supports Service Continuity. See User device requirements to learn which client versions and access scenarios are supported. Users accessing from clients that do not support Service Continuity will be unable to launch DaaS resources during a service disruption. Review session launches in Monitor for Workspace app versions. Update Citrix Workspace app clients to versions that support Service Continuity. Encourage users using the web browser to install the Citrix Workspace web extension. Impacts StoreFrontThe following misconfigurations only apply when StoreFront is used as the access tier. Misconfiguration Description Impact Detection Mitigation SfAdvanceHealthCheck StoreFront ‘Advanced Health Check’ setting not configured StoreFront’s Advanced Health Check feature gives StoreFront additional information about the Resource Location where a published app or desktop can be launched.  Without an Advanced Health Check, StoreFront may send launch requests to a resource location that does not deliver that particular resource, resulting in launch failures during an LHC event. On StoreFront, run “Get-STFStoreFarmConfiguration” via PowerShell. Enable the StoreFront Advanced Health Check feature. For StoreFront 2308 forward, StoreFront Advanced Health Check is enabled by default. If you upgrade your StoreFront, Advanced Health Check will be enabled automatically. Out of Support StoreFront (1912) StoreFront 1912 LTSR reached end of life in December 2024. No support, bugfixes, security patches, etc. Newer versions of StoreFront also have several additional resiliency enhancements. Check the version on all StoreFront servers. Upgrade StoreFront servers. Incorrect load balancing monitor Some customers opt to use a load-balancing vServer to balance XML traffic between StoreFront and Connectors for optimized manageability and traffic management. When connectors in a resource location go into LHC, only the primary broker can service launch requests. The remaining Connectors send health checks to try to reconnect. If an incorrect monitor is used on the load balancing server, StoreFront may continue to send launch requests to all connectors in the resource location rather than just the elected broker. Potential intermittent launch failures during an LHC event.  Check your load balancer to ensure the monitor bound to the load balancer is monitoring for brokering capabilities, not just TCP responses. NetScaler has this functionality out of the box with the CITRIX-XD-DDC monitor. Note: The CITRIX-XML-SERVICE monitor is for previous versions of Citrix Virtual Apps and Desktops and does not perform the same checks as the CITRIX-XD-DDC monitor.  Configure your load balancing vServer to monitor Connectors based on brokering capabilities (e.g., use the CITRIX-XD-DDC monitor for connector load balancing). Connectors not listed as a single set of resource feed in StoreFront With the addition of StoreFront’s Advanced Health Check feature, Citrix recommends that all Cloud Connectors within a single Cloud tenant be included as a single set of Delivery Controllers in StoreFront. Check out this Citrix TIPs blog for more information regarding recommended configurations. Duplicate icons for end users or more complex multi-site aggregation configurations are required in StoreFront. View your resource feed configuration in the “Manage Delivery Controllers” tab in StoreFront. Configure all Connectors (or all Connector load balancing vServers) are listed as a single Site within StoreFront. Review Add resource feeds for Desktops as a Service for more information. Tags used to restrict launches to a subset of Resource Locations in a Delivery Group With Advanced Health Check, StoreFront knows what resource locations a published app or desktop can launch from. StoreFront does this using Delivery Group to Machine Catalog mappings. However, StoreFront is not aware of tags. Consider a scenario in which a Delivery Group contains Machine Catalogs from Resource Location “A” and Resource Location “B”. If we use tags to restrict app/desktop launches to only Resource Location “A”, StoreFront will continue to send launch requests to both Resource Location “A” and “B” during an LHC event because it does not have tag information. Potential intermittent launch failures during LHC events. Review tags used in your environment. Automated detection of Resource Location-based tag restrictions is on our roadmap for Web Studio! Configure tags so that at least one (preferably multiple!) VDA in each Resource Location delivered from a Delivery Group contains each tag. MissingCtxStaTraffic Not all connectors are receiving Secure Ticket Authority (STA) requests  A subset of Cloud Connectors in a resource location is not receiving STA traffic. This can be because either they are not listed in StoreFront or NetScaler Gateway, or there is another problem with communication, such as an expired certificate on the Cloud Connector. Note: The list of cloud connectors used in StoreFront for NFuse and STA is separate. Check the mitigation column for the correct configuration. During a Local Host Cache event, a single Cloud Connector acts as the STA server for the resource location. If that Cloud Connector is not receiving STA traffic, all launches through a NetScaler could fail during an LHC event. If however, Standalone STA feature is enabled, then all Cloud Connectors can act as the STA servers for the resource location irrespective of LHC event. We need all the Cloud Connectors listed in Storefront should also match those in NetScaler gateway. Review the Zones node in Studio. Otherwise, review resource feeds in StoreFront to ensure that all Cloud Connectors are listed. If so, test that StoreFront can communicate with all listed Cloud Connectors over the port configured in the resource feed. View NetScaler Gateway configurations in StoreFront and ensure all Cloud Connectors are listed as STA servers. Review NetScaler appliances and ensure all STAs listed in StoreFront are in the same format in the NetScaler Gateway vServers. STA service health can also be monitored in the Gateway vServer. MissingCtxStaTrafficWhenVdaExists Resource location has VDA registrations, but does not have STA traffic The Cloud Connectors in a resource location are not receiving STA traffic, but have VDA registrations. This can be because either they are not listed in NetScaler Gateway or Storefront, or there is another problem with communication, such as an expired certificate on the Cloud Connector. During a Local Host Cache event, a single Cloud Connector acts as the STA server for the resource location. If the elected broker is not receiving STA traffic, all launches through a NetScaler could fail during an LHC event. If, however, Standalone STA feature is enabled, then all Cloud Connectors can act as the STA servers for the resource location irrespective of an LHC event. Check that all Cloud Connectors are listed as STAs in StoreFront and NetScaler Gateway. View NetScaler Gateway configurations in StoreFront and ensure all Cloud Connectors are listed as STA servers. Review NetScaler appliances and ensure all STAs listed in StoreFront are in the same format in the NetScaler Gateway vServers. STA service health can also be monitored in the Gateway vServer. MissingNFuseTraffic StoreFront not communicating with all Cloud Connectors StoreFront can only contact a subset of Cloud Connectors in a resource location. This can be because either they are not listed in StoreFront or there is another problem with communication, such as an expired certificate on the Cloud Connector. Note: The list of cloud connectors used in Storefront for Nfuse and Sta is separate. Check the mitigation column for the correct configuration. StoreFront not communicating with a subset of Cloud Connectors can negatively impact the scalability and performance of an environment during both steady-state and LHC operations. If the elected LHC broker is not receiving StoreFront traffic, all LHC launch attempts may fail. Review the Zones node in Studio. Otherwise, review resource feeds in StoreFront to ensure that all Cloud Connectors are listed. If so, test that StoreFront can communicate with all listed Cloud Connectors over the port configured in the resource feed. Add all Cloud Connectors to the resource feed in StoreFront and fix any communication issues between StoreFront and the Cloud Connectors. One of the most common communication issues between StoreFront and Cloud Connectors is an expired certificate on the Cloud Connector when XML traffic is over port 443. Note: For customers with many Cloud Connectors, it may be beneficial to configure load-balancing vServers for each resource location to reduce the management overhead and simplify troubleshooting. Review Citrix TIPs: Integrating Citrix Virtual Apps and Desktops service and StoreFront for more information. Review Citrix TIPs: Integrating Citrix Virtual Apps and Desktops service and StoreFront for more information. MissingNFuseTrafficWhenVdaExists Resource location has VDA registrations, but does not have NFuse traffic The Cloud Connectors in a resource location are not receiving NFuse requests from StoreFront, but have VDA registrations in the resource location. This can be because either they are not listed in StoreFront or there is a problem with communication, such as an expired certificate on the Cloud Connector. StoreFront not communicating with Cloud Connectors can negatively impact the scalability and performance of an environment during both steady-state and LHC operations. If the elected broker is not receiving StoreFront traffic, LHC launch attempts may fail.   Review the resource feeds in StoreFront to ensure that all Cloud Connectors are listed. If so, test that StoreFront can communicate with all listed Cloud Connectors over the port configured in the resource feed. Add all Cloud Connectors to the resource feed in StoreFront and fix any communication issues between StoreFront and the Cloud Connectors. One of the most common communication issues between StoreFront and Cloud Connectors is an expired certificate on the Cloud Connectors when XML traffic is over port 443. Note: For customers with many Cloud Connectors, it may be beneficial to configure load-balancing vServers for each resource location to reduce the management overhead and simplify troubleshooting. Review Citrix TIPs: Integrating Citrix Virtual Apps and Desktops service and StoreFront for more information. Summary Correctly configuring your Citrix environment significantly impacts its availability and performance. Review your environments for these potential misconfigurations to keep your business running, no matter what! </article> <article> <h1>Deployment Guide: The Modern Way of creating Master Images using IaC with Packer, Ansible, Chocolatey, and GitHub Actions</h1> <p>Thu, 08 Jan 2026 11:40:33 +0000</p> Deployment Guide: The Modern Way of creating Master Images using IaC with Packer, Ansible, Chocolatey, and GitHub ActionsIntroductionImagine an enterprise IT team tasked with rolling out a new software stack across hundreds of machines. Without Infrastructure as Code (IaC) tools like Packer, Terraform, and Ansible, and without package managers like Chocolatey, this process quickly becomes a fragile, manual exercise. Each master image for DaaS and/or CVAD is built by hand, each configuration is applied individually, and every update requires human intervention. Over time, inconsistencies creep in—one server has a slightly different patch level, another is missing a dependency. These discrepancies aren’t just inconvenient; they introduce real risk. Security vulnerabilities hide in outdated components, compliance audits become nightmares, and troubleshooting turns into detective work because no two environments are truly identical. This process often leads to: Inconsistency across environments due to human error High operational overhead for updates and patching Limited scalability, making it difficult to replicate or roll back changes quickly Now imagine the same scenario with IaC and automated package management in place. Packer creates golden images that are version-controlled and reproducible, ensuring every deployment starts from a trusted baseline. Terraform provisions infrastructure declaratively, so environments can be spun up or torn down with confidence, knowing they’ll match the desired state exactly. Ansible handles configuration at scale, applying changes consistently across thousands of nodes without manual touchpoints. Chocolatey and Ansible take care of software installation and updates, eliminating the chaos of ad-hoc downloads and ensuring every machine runs the correct version of every application. The benefits compound quickly: Risk drops because environments are predictable and auditable Compliance becomes easier because configurations are codified and traceable Security improves because updates can be rolled out systematically, closing vulnerabilities before they become exploits And perhaps most importantly, the burden on IT staff shrinks dramatically. Instead of spending hours—or days—building images and troubleshooting inconsistencies, they manage code, not servers These tools automate repetitive tasks, freeing time for strategic work that drives business value. What was once a painstaking, error-prone process becomes a streamlined, reliable pipeline, turning infrastructure from a liability into an asset This approach not only streamlines image management but also aligns with modern DevOps practices, enabling agility and reliability at scale. OverviewCitrix has always focused on relieving administrators of administrative burden – the automation of Citrix DaaS and CVAD deployments is a big part of this strategy. Using Packer with a modern package manager like Chocolatey makes it easier to create master images that include all necessary software components. With Packer, you define the basic settings of the master image based on your requirements for the underlying operating system. Next, with Chocolatey, you can then install all the necessary software components after configuring the operating system. Chocolatey´s repository currently lists over 10,000 software packages. Finally, Ansible enables installing software components that are not available in Chocolatey or that are not supported for deployment via Chocolatey. Since we are referring to DaaS and CVAD, Packer can also perform the appropriate configuration and installation of the Virtual Delivery Agent (VDA) and other Citrix components, resulting in a fully configured master image ready for further use. Let´s look at an example flow: PrerequisitesWe assume you have a dedicated machine or a cluster running all Automation components. If all IaC frameworks reside on the same machine/cluster, communication between them is less error-prone. We recommend an Ubuntu-based machine/cluster for various reasons: An Ubuntu VM is one of the most reliable, flexible, and well-supported environments for running IaC tools like Terraform, Ansible, Jenkins, and Packer, because it offers stability, compatibility, and strong community support. Most IaC tools (Terraform, Ansible, Packer) are developed and tested primarily on Linux. Note You can find a guide to create such an all-in-one deployment machine on Citrix TechZone. All communication between Terraform, Packer, and Ansible on the IaC-VM and the target Master Image VM uses SSH and/or WinRM. WinRM (Windows Remote Management) is a Microsoft protocol that enables remote management of Windows systems by allowing access to remote computers to perform management tasks. It is Microsoft's implementation of the WS-Management (Web Services Management Protocol) standard. It often uses SOAP (Simple Object Access Protocol) for communication over HTTP or HTTPS, using ports 5985 (HTTP) and 5986 (HTTPS) by default. WinRM provides the basis for remote management with PowerShell and is used for tasks such as running remote scripts, automating, configuring, and performing system inventory. Therefore, WinRM and SSH must be configured correctly. Important We emphasize ensuring the communication flow works as intended from the outset of the pre-domain-joined stage; otherwise, Terraform and Ansible will fail to configure the VMs. During the pre-domain-join stage, you can configure these settings using the local Group Policy Editor on the VM, in the autounattend.xml file, or using Packer settings. We will use Packer settings in this guide. After a successful domain join, you can set all relevant settings using GPOs. To provide maximum flexibility and a fallback mechanism, you can use both listeners—HTTP and HTTPS. You can check all available listeners using PowerShell: PS > winrm e winrm/config/listener Listener [Source="GPO"] Address = * Transport = HTTP Port = 5985 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 10.10.137.10, 127.0.0.1, ::1 Listener Address = * Transport = HTTPS Port = 5986 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint = 24ed3…3ef21 ListeningOn = 10.10.137.10, 127.0.0.1, ::1To check the communication, you can use a simple Terraform snippet: Unsecure Communication - connecting to the HTTP listener: resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_IP1 timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_IP1 timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } }Output: ... null_resource.InstallonIP1: Creating... null_resource.InstallonIP1: Provisioning with 'remote-exec'... null_resource.InstallonIP1 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP1 (remote-exec): Host: tf-w11-mi null_resource.InstallonIP1 (remote-exec): Port: 5985 null_resource.InstallonIP1 (remote-exec): User: administrator null_resource.InstallonIP1 (remote-exec): Password: true null_resource.InstallonIP1 (remote-exec): HTTPS: false null_resource.InstallonIP1 (remote-exec): Insecure: true null_resource.InstallonIP1 (remote-exec): NTLM: false null_resource.InstallonIP1 (remote-exec): CACert: false null_resource.InstallonIP1 (remote-exec): Connected! ... Secure Communication - connecting to the HTTPS listener: resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } } Output: ... null_resource.InstallonIP1: Creating... null_resource.InstallonIP1: Provisioning with 'remote-exec'... null_resource.InstallonIP1 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP1 (remote-exec): Host: tf-w11-mi null_resource.InstallonIP1 (remote-exec): Port: 5986 null_resource.InstallonIP1 (remote-exec): User: svc_ansible null_resource.InstallonIP1 (remote-exec): Password: true null_resource.InstallonIP1 (remote-exec): HTTPS: true null_resource.InstallonIP1 (remote-exec): Insecure: false null_resource.InstallonIP1 (remote-exec): NTLM: false null_resource.InstallonIP1 (remote-exec): CACert: false null_resource.InstallonIP1 (remote-exec): Connected! ... Important Configuring secure communication is a complex task that involves certificates and user mappings – you can find many comprehensive configuration guides online. Note In this guide, we will primarily focus on using Azure as the Hyperscaler for deploying our master images. The available images offered in Azure have a basic WinRM configuration in place. Therefore, we do not need to run any WinRM configuration scripts in Packer. Deploying Master Images with Software ComponentsAs soon as you are sure you have prepared all necessary scripts to configure WinRM consistently, you can start the deployment. Step 1: Determining available base images on AzureThe first step is to determine which base image you want to use – Azure offers many options. As we create master images for MCS, we focus on Windows images. Packer needs to know which base image it should use: # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion Let´s find out which images we can use. The easiest way is to use PowerShell: Get the Image Publisher: PS C:\TMM> $LocName="austriaeast" PS C:\TMM> $Publisher=Get-AzVMImagePublisher -Location $LocName | Where-Object { $_.PublisherName -eq "MicrosoftWindowsDesktop" } PS C:\TMM> $Publisher PublisherName Location Id ------------- -------- -- MicrosoftWindowsDesktop westeurope /Subscriptions/<sensitive>/Providers/Microsoft.Compute/Locations/austriaeast/Publishers/MicrosoftWindowsDesktop PS C:\TMM>Get the Image Offer: PS C:\TMM> $Offer = Get-AzVMImageOffer -Location $LocName -PublisherName $Publisher.PublisherName | Where-Object { $_.Offer -eq "windows-11" } PS C:\TMM> $Offer Offer PublisherName Location Id ----- ------------- -------- -- windows-11 MicrosoftWindowsDesktop austriaeast /Subscriptions/<sensitive>/Providers/Microsoft.Compute/Locations/austriaeast/Publishers/MicrosoftWindowsDesktop/ArtifactTypes/VMImage… PS C:\TMM>Get the Image SKU – here all SKUs are shown for informational purposes: PS C:\TMM> $Skus = Get-AZVMImageSku -Location $LocName -PublisherName $Publisher.PublisherName -Offer $Offer.Offer | Select Skus PS C:\TMM> $SKus Skus ---- win11-21h2-avd win11-21h2-ent win11-21h2-pro-zh-cn win11-22h2-avd win11-22h2-ent win11-22h2-entn win11-23h2-avd win11-23h2-ent win11-23h2-entn win11-23h2-pro win11-23h2-pro-zh-cn win11-23h2-pron win11-24h2-avd win11-24h2-ent win11-24h2-entn win11-24h2-pro win11-24h2-pro-zh-cn win11-24h2-pron win11-25h2-avd win11-25h2-ent win11-25h2-entn win11-25h2-pro win11-25h2-pro-zh-cn win11-25h2-pron PS C:\TMM>Get the Image: PS C:\TMM> Get-AzVMImage -Location $LocName -PublisherName $Publisher.PublisherName -Offer $Offer.Offer -Sku "win11-25h2-pro" | Select Version Version ------- 26200.6584.250915 26200.6899.251011 26200.7171.251109 26200.7462.251207 PS C:\TMM>We now have all the parameters we need to tell Packer which base image should be used: ... azure_imgpublisher = "MicrosoftWindowsDesktop" azure_imgoffer = "windows-11" azure_imgsku = "win11-25h2-pro" azure_imgversion = "26200.7462.251207" ... Step 2: Determining the software packages to be installed using ChocolateyThe next step is to determine which software packages you want to use – Chocolatey currently offers more than 10,000 packages. Note You can find an actual list at https://community.chocolatey.org/packages. Important Please check whether a package is supported in your environment before deploying it. Each package has a lot of information tied to – the most important is if tests have failed. You can then look for a valid, error-free package in the package history. Example package data – Google Chrome: In our environment, we, of course, only use problem-free packages. You can most easily check the last available problem-free versions using a PowerShell script to determine these packages: PS C:\TMM> choco search --exact googlechrome -a --approved-only --not-broken --limit-output GoogleChrome|143.0.7499.41 GoogleChrome|142.0.7444.176 GoogleChrome|142.0.7444.163 GoogleChrome|142.0.7444.135 GoogleChrome|142.0.7444.60 GoogleChrome|142.0.7444.52 GoogleChrome|141.0.7390.77 GoogleChrome|141.0.7390.66 GoogleChrome|141.0.7390.55 GoogleChrome|141.0.7390.37 ...For easier use, we created a short Windows application that is called immediately before determining which software packages should be deployed: We declare all packages we offer for deployment in a JSON file to allow easy maintenance of the list: [ { "Name": "Adobe Acrobat Reader DC", "Install": "adobereader" }, { "Name": "Google Chrome", "Install": "googlechrome" }, { "Name": "Mozilla Firefox", "Install": "firefox" }, ... , { "Name": "WinRAR", "Install": "winrar" }, { "Name": "Dropbox", "Install": "dropbox" }, { "Name": "KeePass", "Install": "keepass" } ]The application reads this list and retrieves the last three versions of each package and stores them also in a JSON file: [ { "Install": "adobereader", "Version": "2025.1.20577" }, { "Install": "adobereader", "Version": "2024.2.20857" }, { "Install": "adobereader", "Version": "2023.8.20555" } , { "Install": "GoogleChrome", "Version": "143.0.7499.41" }, { "Install": "GoogleChrome", "Version": "142.0.7444.176" }, { "Install": "GoogleChrome", "Version": "142.0.7444.163" } , { "Install": "Firefox", "Version": "146.0.0" }, { "Install": "Firefox", "Version": "145.0.2" }, { "Install": "Firefox", "Version": "145.0.1" } , ... , { "Install": "dropbox", "Version": "238.4.6075" }, { "Install": "dropbox", "Version": "237.4.5655" }, { "Install": "dropbox", "Version": "236.4.5918" } , { "Install": "keepass", "Version": "2.60.0" }, { "Install": "keepass", "Version": "2.58.0" }, { "Install": "keepass", "Version": "2.57.1" } ]This list serves as the foundation for all our subsequent Chocolatey-based deployments. Code snippet: Private Sub but_start_Click(sender As Object, e As EventArgs) Handles but_start.Click Dim jsonPath As String = "C:\__PPMM\SS_IIS\ChocolateyPackages.json" Dim outputPath As String = "C:\__PPMM\SS_IIS\ChocolateyPackagesVersions.json" Dim apps As List(Of ChocolateyPackageList) = LoadApplications(jsonPath) Dim i_Apps As Integer = apps.Count ProgressBar1.Minimum = 0 ProgressBar1.Maximum = i_Apps + 1 Dim InstallCommand As String = String.Empty Dim PackageName As String = String.Empty If File.Exists(outputPath) Then File.Delete(outputPath) End If Dim i_ProgCount As Integer = 0 For Each app As ChocolateyPackageList In apps InstallCommand = app.Install PackageName = app.Name Dim chocoOutput As List(Of ChocolateyPackage) = GetChocolateyResults(InstallCommand) ' Take first 3 results Dim firstThree = chocoOutput.Take(3).ToList() ' Serialize to JSON Dim jsonOptions As New JsonSerializerOptions With { .WriteIndented = True } Dim jsonString As String = JsonSerializer.Serialize(firstThree, jsonOptions) File.AppendAllText(outputPath, jsonString) i_ProgCount = i_ProgCount + 1 ProgressBar1.Value = i_ProgCount Next Try ' 1) Read the entire file content Dim content As String = File.ReadAllText(outputPath) Dim contentrep As String contentrep = content.Replace("][", ",") ' 3) Write the updated content back to the file File.WriteAllText(outputPath, contentrep) i_ProgCount = i_ProgCount + 1 ProgressBar1.Value = i_ProgCount Console.WriteLine("Replacement completed successfully.") Catch ex As Exception Console.WriteLine("Error: " & ex.Message) End Try lbl_success.Visible = True End Sub Private Function GetChocolateyResults(ByVal InstallCommand As String) As List(Of ChocolateyPackage) Dim packages As New List(Of ChocolateyPackage) Dim psi As New ProcessStartInfo With { .FileName = "choco", .Arguments = "search --exact " & InstallCommand & " -a --approved-only --not-broken --limit-output", .RedirectStandardOutput = True, .UseShellExecute = False, .CreateNoWindow = True } Using proc As Process = Process.Start(psi) Using reader As StreamReader = proc.StandardOutput While Not reader.EndOfStream Dim line As String = reader.ReadLine() If line.Contains("|") Then Dim parts = line.Split("|"c) packages.Add(New ChocolateyPackage With { .Install = parts(0), .Version = parts(1) }) End If End While End Using End Using Return packages End Function Step 3: Choosing the software packages to be installed using ChocolateyChocolatey needs a packages.config file to know which packages should be installed during the creation of the master image. Example of a packages.config file: <?xml version="1.0" encoding="utf-8"?> <packages> <package id="adobereader" version="2025.1.20577" /> <package id="googlechrome" version="143.0.7499.41" /> <package id="git.install" version="2.52.0" /> <package id="sysinternals" version="2025.11.17" /> <package id="winscp.install" version="6.5.5" /> <package id="teamviewer" version="15.72.6" /> <package id="dropbox" version="238.4.6075" /> </packages>Based on the package list seen earlier, you can manually create your suitable package.config file, or you can use any other mechanism. For demonstration purposes, we created a self-service web application that lets you choose packages via a web frontend. The table with the packages and their versions is dynamically created out of the JSON file mentioned above: Important You can host your packages in an internal repository if the machines do not have access to the Chocolatey repository on the Internet. Therefore, you can install a local Chocolatey server in your LAN. You can find the detailed configuration guide on the Chocolatey homepage. Example to add a CIFS share of a locally installed Chocolatey server as a valid source: PS C:\TMM> choco source add -n="corporate-smb" -s="\\fileserver\chocorepo" --user="EXxXxXxX\XxXxXxXxXxXxXxXxX" --password="XxXxXxXxXxXxXxXxX" --priority="10" --allow-self-service="true" Chocolatey v2.4.3 Added corporate-smb - \\fileserver\chocorepo (Priority 10) PS C:\TMM>Pressing the Modify Chocolatey configuration file button creates the package.config file seen above. Step 4: Configuring Packer to create the master image and deploy the packagesWe have now defined everything we need – the base image Packer should use to create the master image VM, and the Chocolatey packages to be deployed. Let´s look at the workflow – the GitHub action part and the Ansible part will be discussed later in this guide: Packer uses the HashiCorp Configuration Language (HCL) to define build templates for creating machine images. HCL is a human-readable, declarative language designed by HashiCorp for defining infrastructure and automation workflows. It is used across HashiCorp tools like Terraform, Packer, and Vault because it balances readability for humans with machine-parsability. Key Features of HCL: Declarative syntax: You describe what you want, not how to do it Blocks and attributes: Resources are defined in blocks with key-value pairs Supports variables, interpolation, and conditionals Let´s look at a valid example of an HCL to create a Windows 11-based master image on Azure, deploy the software packages using Chocolatey, and upload the final image to an Azure Image Gallery – from there, you can, for example, create an image definition and image version in Citrix DaaS to deploy a Machine catalog. win11-azure.packer.hcl: # Defining all used variables variable "azure_clientid" { type = string description = "azure Service Principal App ID" sensitive = true } variable "azure_clientsecret" { type = string description = "azure Service Principal Secret" sensitive = true } variable "azure_subscriptionid" { type = string description = "azure Subscription ID" sensitive = true } variable "azure_tenantid" { type = string description = "azure Tenant ID" sensitive = true } ... variable "vda_location" { type = string } variable "script_installvda" { type = string default = "install-vda.ps1" } variable "script_optimizer" { type = string default = "run-optimizer.ps1" } variable "script_cleanup" { type = string default = "run-cleanup.ps1" } variable "location_setup" { type = string default = "c:\\setup" } # Defining the used Packer Plugin(s) packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = ">= 2.5.0" } } } # Defining the source(s) block(s) source "azure-arm" "W11MIWithSWPackagesWithVDA" { # Tagging the Azure VM azure_tags = { environment = var.azure_tag_environment, environment-entity = var.azure_tag_environment_entity, usage = var.azure_tag_usage } # WinRM Communicator communicator = "winrm" winrm_use_ssl = true winrm_insecure = false winrm_timeout = "5m" winrm_username = "packer" # Service Principal Authentication client_id = var.azure_clientid client_secret = var.azure_clientsecret subscription_id = var.azure_subscriptionid tenant_id = var.azure_tenantid # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion # Destination Image - we want to upload the artifact directly into the Azure Image Gallery, so no creation of a stand-alone image is needed # managed_image_resource_group_name = var.azure_RG # managed_image_name = var.azure_ManagedImgName # Store created Image in Shared Image Gallery shared_image_gallery_destination { resource_group = var.azure_rg gallery_name = var.azure_sig_name image_name = var.azure_sig_imgname image_version = var.azure_sig_imgversion replication_regions = ["austriaeast"] storage_account_type = "Standard_LRS" } # Packer Computing Resources build_resource_group_name = var.azure_temprg vm_size = var.azure_vmsize } # Defining the building blocks build { source "azure-arm.W11MIWithSWPackagesWithVDA" {} # Install Chocolatey: https://chocolatey.org/install#individual provisioner "powershell" { inline = ["Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"] } # Install Chocolatey packages provisioner "file" { source = "./scripts/SWPackagesToInstall.config" destination = "${var.location_setup}/scripts/SWPackagesToInstall.config" } provisioner "powershell" { inline = ["choco install --ignore-hash --ignore-checksums --confirm ${var.location_setup}/scripts/SWPackagesToInstall.config"] # See https://docs.chocolatey.org/en-us/choco/commands/install#exit-codes valid_exit_codes = [0, 3, 1641, 3010] } provisioner "windows-restart" {} provisioner "powershell" { inline = ["New-Item -Path ${var.location_setup} -Force -ItemType \"directory\" | Out-Null"] } provisioner "file" { destination = "${var.location_setup}/${var.script_installvda}" source = "./scripts/${var.script_installvda}" } provisioner "file" { destination = "${var.location_setup}/${var.script_optimizer}" source = "./scripts/${var.script_optimizer}" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Host 'Script: computer restarted.'}\"" restart_timeout = "30m" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "powershell" { inline = ["$assemblyPath = \"C:\\Program Files (x86)\\Citrix\\ICA Client\\wfica32.exe\"", "$ngen64 = \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\"", "$ngen32 = \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\"", "Write-Host \"Running 64-bit Ngen...\"", "& $ngen64 executequeueditems", "Write-Host \"Running 32-bit Ngen...\"", "& $ngen32 executequeueditems"] } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_optimizer} -OptimizerDownloadUri ${var.optimizer_location} -Template ${var.optimizer_template}"] } # Generalize image using Sysprep # See https://www.packer.io/docs/builders/azure/arm#windows # See https://docs.microsoft.com/en-us/azure/virtual-machines/windows/build-image-with-packer#define-packer-template provisioner "powershell" { inline = [ "while ((Get-Service RdAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "while ((Get-Service WindowsazureGuestAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /quiet /quit /mode:vm", "while ($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }" ] } }The variables are defined in a key-value format - example: win11-azure.auto.pkrvars.hcl: azure_clientid = <sensitive> azure_clientsecret = <sensitive> azure_subscriptionid = <sensitive> azure_tenantid = <sensitive> azure_rg = "TMM-<sensitive>" azure_temprg = "TMM-<sensitive>" azure_imgpublisher = "MicrosoftWindowsDesktop" azure_imgoffer = "windows-11" azure_imgsku = "win11-25h2-pro" azure_imgversion = "26200.7462.251207" ... vda_location = "https://<sensitive>.blob.core.windows.net/ctxsw/VDAWorkstationSetup_2507.exe" script_installvda = "install-vda.ps1" script_optimizer = "run-optimizer.ps1" script_cleanup = "run-cleanup.ps1" location_setup = "c:\\ttemp" optimizer_location = "https://<sensitive>.blob.core.windows.net/ctxsw/CitrixOptimizerTool.zip" optimizer_template = "Citrix_Windows_11_2009.xml"Most Important The Image definition on the Azure Image Gallery MUST exist before running Packer, otherwise the deployment will fail. Command-line-based deploymentIf you want to start the creation process manually, you can use the well-known Packer command: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ packer build -on-error=cleanup -force -var-file="win11-azure.auto.pkrvars.hcl" win11-azure.pkr.hclPacker writes out all relevant information during the building process: ==> azure-arm.W11MIWithSWPackagesWithVDA: Running builder ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Azure Resource Manager (ARM) client ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ARM Client successfully created ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting source image id for the deployment ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> SourceImageName: '/subscriptions/<sensitive>/providers/Microsoft.Compute/locations/austriaeast/publishers/MicrosoftWindowsDesktop/ArtifactTypes/vmimage/offers/windows-11/skus/win11-25h2-pro/versions/26200.7462.251207' ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting the VM's IP address ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> ResourceGroupName : 'TMM-<sensitive>' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> PublicIPAddressName : 'pkripgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> NicName : 'pkrnigf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> Network Connection : 'PublicEndpoint' ==> azure-arm.W11MIWithSWPackagesWithVDA: -> IP Address : '4.210.182.179' ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for WinRM to become available... ==> azure-arm.W11MIWithSWPackagesWithVDA: WinRM connected. ==> azure-arm.W11MIWithSWPackagesWithVDA: Connected to WinRM! ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Forcing web requests to allow TLS v1.2 (Required for requests to Chocolatey.org) ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting latest version of the Chocolatey package for download. ==> azure-arm.W11MIWithSWPackagesWithVDA: Not using proxy. ==> azure-arm.W11MIWithSWPackagesWithVDA: Getting Chocolatey from https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0. ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading https://community.chocolatey.org/api/v2/package/chocolatey/2.6.0 to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip ==> azure-arm.W11MIWithSWPackagesWithVDA: Not using proxy. ==> azure-arm.W11MIWithSWPackagesWithVDA: Extracting C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip to C:\Users\packer\AppData\Local\Temp\chocolatey\chocoInstall ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing Chocolatey on the local machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating ChocolateyInstall as an environment variable (targeting 'Machine') ==> azure-arm.W11MIWithSWPackagesWithVDA: Setting ChocolateyInstall to 'C:\ProgramData\chocolatey' ... ==> azure-arm.W11MIWithSWPackagesWithVDA: c:\ttemp/scripts/SWPackagesToInstall.config ==> azure-arm.W11MIWithSWPackagesWithVDA: By installing, you accept licenses for the packages. ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing the following packages: ==> azure-arm.W11MIWithSWPackagesWithVDA: adobereader ==> azure-arm.W11MIWithSWPackagesWithVDA: googlechrome ==> azure-arm.W11MIWithSWPackagesWithVDA: git.install ==> azure-arm.W11MIWithSWPackagesWithVDA: sysinternals ==> azure-arm.W11MIWithSWPackagesWithVDA: winscp.install ==> azure-arm.W11MIWithSWPackagesWithVDA: teamviewer ==> azure-arm.W11MIWithSWPackagesWithVDA: dropbox ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWithSWPackagesWithVDA: Progress: Downloading chocolatey-compatibility.extension 1.0.0... 100% ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading package from source 'https://community.chocolatey.org/api/v2/' ==> azure-arm.W11MIWithSWPackagesWithVDA: Progress: Downloading GoogleChrome 143.0.7499.41... 100% ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome v143.0.7499.41[Approved] ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome package files install completed. Performing other installation steps. ==> azure-arm.W11MIWithSWPackagesWithVDA: Downloading googlechrome 64 bit ==> azure-arm.W11MIWithSWPackagesWithVDA: from 'https://dl.google.com/dl/chrome/install/googlechromestandaloneenterprise64.msi' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Download of googlechromestandaloneenterprise64.msi (-1 B) completed. ==> azure-arm.W11MIWithSWPackagesWithVDA: WARNING: Ignoring checksums due to feature checksumFiles turned off or option --ignore-checksums set. ==> azure-arm.W11MIWithSWPackagesWithVDA: Installing googlechrome... ==> azure-arm.W11MIWithSWPackagesWithVDA: googlechrome has been installed. ==> azure-arm.W11MIWithSWPackagesWithVDA: GoogleChrome may be able to be automatically uninstalled. ==> azure-arm.W11MIWithSWPackagesWithVDA: The install of GoogleChrome was successful. ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Chocolatey installed 13/13 packages. ==> azure-arm.W11MIWithSWPackagesWithVDA: See the log for details (C:\ProgramData\chocolatey\logs\chocolatey.log). ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Installed: ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-compatibility.extension v1.0.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-core.extension v1.4.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-dotnetfx.extension v1.0.1 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-visualstudio.extension v1.13.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - chocolatey-windowsupdate.extension v1.0.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - adobereader v2025-1-20577 ==> azure-arm.W11MIWithSWPackagesWithVDA: - filezilla v3.69.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - GoogleChrome v143.0.7499.41 ==> azure-arm.W11MIWithSWPackagesWithVDA: - git.install v2.52.0 ==> azure-arm.W11MIWithSWPackagesWithVDA: - sysinternals v2025.11.17 ==> azure-arm.W11MIWithSWPackagesWithVDA: - winscp.install v6.5.5 ==> azure-arm.W11MIWithSWPackagesWithVDA: - teamviewer v15.72.6 ==> azure-arm.W11MIWithSWPackagesWithVDA: - dropbox v238.4.6075 ==> azure-arm.W11MIWithSWPackagesWithVDA: Restarting Machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for machine to restart... ==> azure-arm.W11MIWithSWPackagesWithVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWithSWPackagesWithVDA: pkrvmgf6zyyvkul restarted. ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Uploading ./scripts/install-vda.ps1 => c:\ttemp/install-vda.ps1 ==> azure-arm.W11MIWithSWPackagesWithVDA: Uploading ./scripts/run-optimizer.ps1 => c:\ttemp/run-optimizer.ps1 ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with powershell script: C:\Users\packer\AppData\Local\Temp\powershell-provisioner3550365223 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:50 - Initiating Ctrix VDA installation. ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:50 - Adding firewall allow rules for ports 80, 443, 1494, 2598, 8008 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:53 - Finished adding firewall allow rules for ports 80, 443, 1494, 2598, 8008 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:55:53 - Downloading VDASetup file from blob storage ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:05 - Executing: C:\Users\packer\AppData\Local\Temp\VDASetup.exe, Components: VDA ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:05 - Parameters: /quiet /noreboot /masterimage /enable_real_time_transport /enable_hdx_ports /components vda /includeadditional "Citrix MCS IODriver","Citrix VDA Upgrade Agent" ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:40 - XenDesktopVDA installation started ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:56:40 - Waiting few seconds to make sure the process extracts and starts ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:58:40 - Checking if XenDesktopVdaSetup process is running ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 01:58:40 - Installation process still running ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - Installation process completed ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - GctRegistration already enabled ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - BrokerAgent found and it is running. ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:00:40 - Installation of XenDesktopVDA completed with success ==> azure-arm.W11MIWithSWPackagesWithVDA: Restarting Machine ==> azure-arm.W11MIWithSWPackagesWithVDA: Waiting for machine to restart... ==> azure-arm.W11MIWithSWPackagesWithVDA: A system shutdown is in progress.(1115) ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: computer restarted. ==> azure-arm.W11MIWithSWPackagesWithVDA: pkrvmgf6zyyvkul restarted. ==> azure-arm.W11MIWithSWPackagesWithVDA: Machine successfully restarted, moving on ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with powershell script: C:\Users\packer\AppData\Local\Temp\powershell-provisioner2019159959 ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:20:55 - Downloading Citrix Optimizer from blob storage ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:20:55 - Executing: C:\Users\packer\AppData\Local\Temp\CitrixOptimizer\CtxOptimizerEngine.ps1, Template: Citrix_Windows_11_2009.xml ==> azure-arm.W11MIWithSWPackagesWithVDA: ------------------------------ ==> azure-arm.W11MIWithSWPackagesWithVDA: | Citrix Optimization Engine | ==> azure-arm.W11MIWithSWPackagesWithVDA: | Version 2.9 | ==> azure-arm.W11MIWithSWPackagesWithVDA: ------------------------------ ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Running in execute mode ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Logs folder 2025-12-12_14-20-55 ==> azure-arm.W11MIWithSWPackagesWithVDA: Starting session log ==> azure-arm.W11MIWithSWPackagesWithVDA: Checking permissions ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Processing definition file C:\Users\packer\AppData\Local\Temp\CitrixOptimizer\Templates\Citrix_Windows_11_2009.xml ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Script: 12-12-25 02:24:38 - Optimization script completed ==> azure-arm.W11MIWithSWPackagesWithVDA: Provisioning with Powershell... ==> azure-arm.W11MIWithSWPackagesWithVDA: IMAGE_STATE_COMPLETE ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Querying the machine's properties ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Powering off machine ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Publishing to Shared Image Gallery ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: -> Shared Gallery Image Version ID : '/subscriptions/<sensitive>/resourceGroups/TMM-<sensitive>/providers/Microsoft.Compute/galleries/<sensitive>/images/<sensitive>/versions/1.0.0' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleting Virtual Machine deployment and its attached resources... ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Compute/virtualMachines : 'pkrvmgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/networkInterfaces : 'pkrnigf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/virtualNetworks : 'pkrvngf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/publicIPAddresses : 'pkripgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Network/networkSecurityGroups : 'pkrsggf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.Compute/disks : '/subscriptions/<sensitive>/resourceGroups/TMM-sensitive/providers/Microsoft.Compute/disks/pkrosgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Removing the created Deployment object: 'pkrdpgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleting KeyVault created during build ==> azure-arm.W11MIWithSWPackagesWithVDA: Deleted -> Microsoft.KeyVault/vaults : 'pkrkvgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: Removing the created Deployment object: 'kvpkrdpgf6zyyvkul' ==> azure-arm.W11MIWithSWPackagesWithVDA: ==> azure-arm.W11MIWithSWPackagesWithVDA: The resource group was not created by Packer, not deleting ... Build 'azure-arm.W11MIWithSWPackagesWithVDA' finished after 54 minutes 36 seconds. ==> Wait completed after 54 minutes 36 seconds ==> Builds finished. The artifacts of successful builds are: --> azure-arm.W11MIWithSWPackagesWithVDA: Azure.ResourceManagement.VMImage: OSType: Windows ManagedImageSharedImageGalleryId: /subscriptions/<sensitive>/resourceGroups/TMM-<sensitive>/providers/Microsoft.Compute/galleries/<sensitive>/images/<sensitive>/versions/1.0.0 SharedImageGalleryResourceGroup: TMM-<sensitive> SharedImageGalleryName: <sensitive> SharedImageGalleryImageName: <sensitive> SharedImageGalleryImageVersion: 1.0.0 SharedImageGalleryReplicatedRegions: austriaeastThe creation was completed successfully. Important Please make sure you know the return code for each software package's successful installation, as it varies by package. Usually, ‘0’ indicates a successful installation, but, for example, the return code for a successful VDA deployment is ‘3’ if a reboot is required. You need to enter the correct return codes for all packages in the corresponding configuration step: valid_exit_codes = [0, 3, 1641, 3010] If Packer encounters another code, it will raise an error, and the deployment will fail. Note If some errors occur during the creation process, you might enable Packer to write verbose logs by using: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ export PACKER_LOG=1 azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ export PACKER_LOG_PATH="./packer.log" or start the building process with verbose logging: azadmin@az-weur-devops-automation:/etc/terraform-tmm/PACKER/_AZURE$ packer build -on-error=cleanup -debug -force -var-file="win11-azure.auto.pkrvars.hcl" win11-azure.pkr.hcl Depending on the underlying load on Azure, the deployment process lasts some time - in our example, it took around 55 minutes. The respective Azure Gallery reflects the newly created image and image version: We can now use this image version, for example, to generate the corresponding image on Citrix DaaS to create a Machine Catalog. Therefore, we use Terraform: #### Creating the Image Definition based on the Azure shared gallery image definition resource "citrix_image_definition" "CreateAzureImageDefinition" { name = var.CC-Azure-ImgDef-Name description = var.CC-Azure-ImgDef-Description os_type = "Windows" session_support = "SingleSession" hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id azure_image_definition = { resource_group = var.TACG-TMM-ResourceGroup-Name use_image_gallery = true image_gallery_name = var.CC-Azure-SIG-Name } } #### Creating the Image version based on the Azure shared gallery image version resource "citrix_image_version" "CreateAzureImageVersion" { depends_on = [citrix_image_definition.CreateAzureImageDefinition] image_definition = citrix_image_definition.CreateAzureImageDefinition.id hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id description = var.CC-Azure-ImgVer-Description azure_image_specs = { service_offering = var.CC-Azure-Img-ServiceOffering storage_type = var.CC-Azure-Img-StorageType resource_group = var.TACG-TMM-ResourceGroup-Name gallery_image = { gallery = var.CC-Azure-SIG-Name definition = var.CC-Azure-SIGDefinition-Name version = var.CC-Azure-SIGDefinition-Version } machine_profile = { machine_profile_resource_group = var.CC-Azure-ImgVer-MachineProfile-RG machine_profile_vm_name = var.CC-Azure-ImgVer-MachineProfile-VMName } } } resource "null_resource" "WriteProgress2" { depends_on = [citrix_image_version.CreateAzureImageVersion] provisioner "local-exec" { command = "echo The Image definition and Image version were successfully created..." } } #### Creating the Machine Catalog based on the Image version just created resource "citrix_machine_catalog" "CreateAzureMCSCatalog" { depends_on = [citrix_image_version.CreateAzureImageVersion] name = var.CC-Azure-MC-Name description = var.CC-Azure-MC-Description allocation_type = var.CC-Azure-MC-AllocationType session_support = var.CC-Azure-MC-SessionType provisioning_type = "MCS" #zone = data.local_file.LoadZoneID.content zone = data.citrix_zone.GetTFAzureZoneID.id #scopes = "${var.CC-GetScopeToBeUsed-Names}" provisioning_scheme = { hypervisor = citrix_azure_hypervisor.CreateAzureHostingConnection.id hypervisor_resource_pool = citrix_azure_hypervisor_resource_pool.CreateAzureHostingConnectionPool.id identity_type = "${var.CC-Azure-MC-IDPType}" machine_domain_identity = { domain = "${var.CC-Azure-MC-Domain}" domain_ou = "${var.CC-Azure-MC-DomainOU}" service_account = "${var.CC-Azure-MC-DomainAdmin-Username-UPN}" service_account_password = "${var.CC-Azure-MC-DomainAdmin-Password}" } azure_machine_config = { storage_type = "Premium_LRS" use_managed_disks = true service_offering = "${var.CC-Azure-MC-VMSize}" machine_profile = { machine_profile_resource_group = var.CC-Azure-ImgVer-MachineProfile-RG machine_profile_vm_name = var.CC-Azure-ImgVer-MachineProfile-VMName } prepared_image = { image_definition = citrix_image_definition.CreateAzureImageDefinition.id image_version = citrix_image_version.CreateAzureImageVersion.id } } number_of_total_machines = var.CC-Azure-MC-Machine_Count machine_account_creation_rules = { naming_scheme = "${var.CC-Azure-MC-NamingScheme-Name}" naming_scheme_type = "${var.CC-Azure-MC-NamingScheme-Type}" } } }The DaaS console reflects the newly created image: Application-based deploymentYou can integrate the workflow into any application or IaC tool – in our example, we have configured GitHub Actions to start the corresponding flows via REST API calls to GitHub. As REST APIs are an industry standard, it should not be a problem to use them wherever you need. This demo application uses this functionality—each offered integration executes the appropriate REST API call, thereby starting the corresponding action on GitHub. Snippets from a screenshot of the demo application: ... How does a REST API call look? The syntax and functionality can easily be checked using Postman. Example of a GitHub workflow: packer-build.yml name: Packer building a Master Image on Azure on: push: branches: [ "main" ] workflow_dispatch: jobs: packer-build: runs-on: ubuntu-latest env: PKR_VAR_Azure_ClientID: ${{ secrets.AZURE_CLIENTID }} PKR_VAR_Azure_ClientSecret: ${{ secrets.AZURE_CLIENTSECRET }} PKR_VAR_Azure_SubscriptionID: ${{ secrets.AZURE_SUBSCRIPTIONID }} PKR_VAR_Azure_TenantID: ${{ secrets.AZURE_TENANTID }} PKR_VAR_Azure_RG: ${{ secrets.AZURE_RG }} PKR_VAR_Azure_TempRG: ${{ secrets.AZURE_TempRG }} PACKER_LOG: "1" PACKER_LOG_PATH: "packer.log" steps: - name: Checkout repo uses: actions/checkout@v4 - name: Packer init run: packer init ./packer - name: Packer validate run: packer validate -var-file "./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hcl - name: Packer build run: packer build -on-error=abort -force -var-file="./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hclImportant Do not store sensitive information hard-coded in the GitHub files. Store them securely in GitHub´s vault and reference them in your .yml files. Sample screenshot: GitHub records each workflow run and all its steps, so you can easily check whether your flow is working: The log output is the same as in PowerShell we saw earlier: Run packer build -on-error=abort -force -var-file="./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hcl packer build -on-error=abort -force -var-file="./packer/win11-azure.auto.pkrvars.hcl" ./packer/win11-azure.pkr.hcl shell: /usr/bin/bash -e {0} env: PKR_VAR_Azure_ClientID: *** PKR_VAR_Azure_ClientSecret: *** PKR_VAR_Azure_SubscriptionID: *** PKR_VAR_Azure_TenantID: *** PKR_VAR_Azure_RG: *** PKR_VAR_Azure_TempRG: *** PACKER_LOG: 1 PACKER_LOG_PATH: packer.log azure-arm.W11MIWithSWPackagesWithVDA: output will be in this color. ==> azure-arm.W11MIWithSWPackagesWithVDA: Running builder ... ==> azure-arm.W11MIWithSWPackagesWithVDA: Creating Azure Resource Manager (ARM) client ... ==> azure-arm.W11MIWithSWPackagesWithVDA: ARM Client successfully created ... ... ==> azure-arm.W11MIWithSWPackagesWithVDA: The resource group was not created by Packer, not deleting ... Build 'azure-arm.W11MIWithSWPackagesWithVDA' finished after 56 minutes 11 seconds. ==> Wait completed after 56 minutes 11 seconds ==> Builds finished. The artifacts of successful builds are: --> azure-arm.W11MIWithSWPackagesWithVDA: Azure.ResourceManagement.VMImage: OSType: Windows ManagedImageResourceGroupName: *** ManagedImageName: *** ManagedImageId: /subscriptions/<sensitive>/resourceGroups/***/providers/Microsoft.Compute/images/*** ManagedImageLocation: austriaeast Step 5: Adding AnsibleIf Chocolatey is not suitable/capable of fulfilling all software deployment needs, we can use Ansible to fill in the gaps. As Ansible is another important IaC tool, we follow our strict IaC strategy. Using Ansible, you can also install Windows features during the creation process – let´s look at some examples: It is very easy to add Ansible to Packer - just configure Packer to use the Ansible plugin and use the Ansible provisioner block in your HCL code: ... required_plugins { ansible = { version = "~> 1" source = "github.com/hashicorp/ansible" } } ... provisioner "ansible" { playbook_file = "ansible/windows.yml" extra_arguments = [ "-e", "ansible_user=Administrator", "-e", "ansible_password={{user `winrm_password`}}", "-e", "ansible_connection=winrm", "-e", "ansible_winrm_transport=basic", "-e", "ansible_winrm_server_cert_validation=ignore" ] } Adding the necessary changes to our Packer HCL snippet used above would result in this: # Defining all used variables variable "azure_clientid" { type = string description = "azure Service Principal App ID" sensitive = true } variable "azure_clientsecret" { type = string description = "azure Service Principal Secret" sensitive = true } variable "azure_subscriptionid" { type = string description = "azure Subscription ID" sensitive = true } variable "azure_tenantid" { type = string description = "azure Tenant ID" sensitive = true } ... variable "ansible_user" { type = string description = "Ansible User" sensitive = true } variable "ansible_password" { type = string description = "Ansible Users Password" sensitive = true } variable "ansible_connection" { type = string description = "How to connect to Ansible - winrm" } variable "ansible_transport" { type = string description = "How to connect to Ansible - SecureOrBasic" } ... variable "vda_location" { type = string } variable "script_installvda" { type = string default = "install-vda.ps1" } variable "script_optimizer" { type = string default = "run-optimizer.ps1" } variable "script_cleanup" { type = string default = "run-cleanup.ps1" } variable "location_setup" { type = string default = "c:\\setup" } # Variables defining package URLs for Ansible variable "msi_url_7zip" { type = string default = "https://www.7-zip.org/a/7z2402-x64.msi" description = "Example MSI package URL" } variable "exe_url_vcredist" { type = string default = "https://download.visualstudio.microsoft.com/download/pr/e9.../vcredist_x64.exe" description = "Example EXE package URL (silent flags required)" # Defining the used Packer Plugin(s) packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = ">= 2.5.0" } ansible = { source = "github.com/hashicorp/ansible" version = "~> 1" } } } # Defining the source(s) block(s) source "azure-arm" "W11MIWithSWPackagesWithVDA" { # Tagging the Azure VM azure_tags = { environment = var.azure_tag_environment, environment-entity = var.azure_tag_environment_entity, usage = var.azure_tag_usage } # WinRM Communicator communicator = "winrm" winrm_use_ssl = true winrm_insecure = false winrm_timeout = "5m" winrm_username = "packer" # Service Principal Authentication client_id = var.azure_clientid client_secret = var.azure_clientsecret subscription_id = var.azure_subscriptionid tenant_id = var.azure_tenantid # Source Image os_type = "Windows" image_publisher = var.azure_imgpublisher image_offer = var.azure_imgoffer image_sku = var.azure_imgsku image_version = var.azure_imgversion # Destination Image - we want to upload the artifact directly into the Azure Image Gallery, so no creation of a stand-alone image is needed # managed_image_resource_group_name = var.azure_RG # managed_image_name = var.azure_ManagedImgName # Store created Image in Shared Image Gallery shared_image_gallery_destination { resource_group = var.azure_rg gallery_name = var.azure_sig_name image_name = var.azure_sig_imgname image_version = var.azure_sig_imgversion replication_regions = ["austriaeast"] storage_account_type = "Standard_LRS" } # Packer Computing Resources build_resource_group_name = var.azure_temprg vm_size = var.azure_vmsize } # Defining the building blocks build { source "azure-arm.W11MIWithSWPackagesWithVDA" {} # Install Chocolatey: https://chocolatey.org/install#individual provisioner "powershell" { inline = ["Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"] } # Install Chocolatey packages provisioner "file" { source = "./scripts/SWPackagesToInstall.config" destination = "${var.location_setup}/scripts/SWPackagesToInstall.config" } provisioner "powershell" { inline = ["choco install --ignore-hash --ignore-checksums --confirm ${var.location_setup}/scripts/SWPackagesToInstall.config"] # See https://docs.chocolatey.org/en-us/choco/commands/install#exit-codes valid_exit_codes = [0, 3, 1641, 3010] } provisioner "windows-restart" {} provisioner "ansible" { playbook_file = "./scripts/ConfigW11.yml" groups = ["azure"] user = var.ansible_user extra_arguments = [ "-e", "ansible_connection=${var.ansible_connection}", "-e", "ansible_user=${var.ansible_user}", "-e", "ansible_password=${var.ansible_password}", "-e", "ansible_winrm_transport=${var.ansible_transport}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "msi_url_7zip=${var.msi_url_7zip}", "-e", "exe_url_vcredist=${var.exe_url_vcredist}" ] use_proxy = false } provisioner "powershell" { inline = ["New-Item -Path ${var.location_setup} -Force -ItemType \"directory\" | Out-Null"] } provisioner "file" { destination = "${var.location_setup}/${var.script_installvda}" source = "./scripts/${var.script_installvda}" } provisioner "file" { destination = "${var.location_setup}/${var.script_optimizer}" source = "./scripts/${var.script_optimizer}" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Host 'Script: computer restarted.'}\"" restart_timeout = "30m" } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "powershell" { inline = ["$assemblyPath = \"C:\\Program Files (x86)\\Citrix\\ICA Client\\wfica32.exe\"", "$ngen64 = \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\"", "$ngen32 = \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\"", "Write-Host \"Running 64-bit Ngen...\"", "& $ngen64 executequeueditems", "Write-Host \"Running 32-bit Ngen...\"", "& $ngen32 executequeueditems"] } provisioner "powershell" { inline = ["${var.location_setup}/${var.script_optimizer} -OptimizerDownloadUri ${var.optimizer_location} -Template ${var.optimizer_template}"] } # Generalize image using Sysprep # See https://www.packer.io/docs/builders/azure/arm#windows # See https://docs.microsoft.com/en-us/azure/virtual-machines/windows/build-image-with-packer#define-packer-template provisioner "powershell" { inline = [ "while ((Get-Service RdAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "while ((Get-Service WindowsazureGuestAgent).Status -ne 'Running') { Start-Sleep -s 5 }", "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /quiet /quit /mode:vm", "while ($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }" ] } }Note The Ansible playbook listed below is intended solely to demonstrate Ansible's capabilities for installing various software packages and configuring Windows components and settings: It downloads and installs 2 Software packages as examples - an EXE and a MSI. It sets some registry keys. It enables the Windows Firewall and sets a firewall rule. It configures further Windows settings and installs the Windows IIS feature. Please see it as an example and tailor it according to your needs. ConfigW11.yml: --- - name: Install packages, configure settings, and enable features hosts: all gather_facts: no vars: msi_url_7zip: "{{ msi_url_7zip }}" exe_url_vcredist: "{{ exe_url_vcredist }}" msi_dest: "C:\\Windows\\Temp\\7zip.msi" exe_dest: "C:\\Windows\\Temp\\vcredist_x64.exe" tasks: - name: Download MSI (7-Zip) ansible.windows.win_get_url: url: "{{ msi_url_7zip }}" dest: "{{ msi_dest }}" - name: Install MSI (7-Zip) silently ansible.windows.win_package: path: "{{ msi_dest }}" state: present - name: Download EXE (VC++ Redistributable) ansible.windows.win_get_url: url: "{{ exe_url_vcredist }}" dest: "{{ exe_dest }}" - name: Install EXE silently ansible.windows.win_package: path: "{{ exe_dest }}" arguments: "/quiet /norestart" state: present - name: Enable long Win32 paths (Registry) ansible.windows.win_regedit: path: HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem name: LongPathsEnabled data: 1 type: dword state: present - name: Ensure firewall profiles are enabled ansible.windows.win_firewall: state: enabled profiles: - Domain - Private - Public - name: Allow inbound RDP on TCP 3389 (rule) community.windows.win_firewall_rule: name: "Allow RDP Inbound" localport: 3389 protocol: tcp direction: in action: allow state: present enabled: true - name: Ensure Windows Update service is running ansible.windows.win_service: name: wuauserv start_mode: auto state: started - name: Grant 'Log on as a service' to local account ansible.windows.win_user_right: name: SeServiceLogonRight users: - ".\\Administrator" action: add - name: Install IIS Web-Server + management console ansible.windows.win_feature: name: - Web-Server - Web-Mgmt-Console state: present include_management_tools: true - name: Reboot if feature install requires it ansible.windows.win_reboot: when: ansible_windows_feature_result is defined and ansible_windows_feature_result.reboot_required | default(false)Packer would now sequentially run the following tasks while creating the Windows-based Master image: Create all necessary temporary resources needed on Azure - these will be automatically deleted after completion if the on-abort parameter is set according to your needs. Create the VM based on your configuration needs. Install the chosen Windows OS. Install all Chocolatey-based software packages. Install and configure all software packages, Windows components, and Windows settings using Ansible. Install the Citrix VDA. Run the Citrix Optimizer script. Running sysprep to generalize the image. Upload the image to your Azure Image Gallery for further use. SummaryUsing some or all of the provided steps should help create a modern image factory and therefore ease image creation: Packer’s superpower is simple: one template, many platforms. It turns a single-source configuration into identical machine images across clouds and hypervisors—your classic golden-image pipeline. That unlocks faster autoscaling (instances boot already configured), reduces runtime bootstrapping, and enforces consistency you can track in version control. In short, Packer standardizes and automates image creation, so your “master” isn’t a snowflake—it’s a known artifact. Windows lacks a native, universal package workflow across third‑party apps. Chocolatey fills that gap: it wraps installers into versioned packages, automates deployments, and integrates with enterprise tooling, so your image build and fleet updates don’t rely on ad‑hoc downloads and silent‑switch folklore. Using Chocolatey inside your Ansible/Packer pipeline brings Linux‑like package discipline to Windows—uniform installs, consistent updates, and auditable sources. With Ansible, you prevent configuration drift across fleets and reruns. Ansible’s Windows story is mature: it manages packages (MSI/EXE), services, the registry, the firewall, and IIS with supported modules—agentless over WinRM or SSH—so you can enforce consistent settings at image build time and again at runtime when needed. Treating images and configurations as code means they live in Git, go through pull requests, can be tested, diffed, and rolled back. IaC turns point‑and‑click “ClickOps” into repeatable pipelines with audit trails, security baselines, and policy checks. It also fixes the economics: cloud infrastructure is elastic and API‑driven, so the only scalable, safe way to manage it is declarative, versioned automation. IaC also gives you the best of both worlds: immutable (pre‑baked) images for speed and reliability, plus config management for last‑mile adjustments. Packer builds the artifact; Ansible and Chocolatey ensure what’s inside is correct and stays that way. The result is faster provisioning, fewer surprises, and environments that match across dev, staging, and prod. DisclaimerDisclaimer EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>Deployment Guide: Using Infrastructure-as-Code for deploying Citrix® Virtual Apps and Desktops™ 2507 LTSR on vSphere 8</h1> <p>Wed, 19 Nov 2025 15:54:00 +0000</p> Using Infrastructure-as-Code for deploying Citrix® Virtual Apps and Desktops™ 2507 LTSR on vSphere 8 Citrix’s goal is to help customers automate their environments with minimal friction. We support multiple automation interfaces, REST APIs, PowerShell SDKs, Terraform providers, Ansible playbooks, and all current CI/CD frameworks, so customers can choose the tools that fit their workflow. Automation enhances Citrix’s ability to deliver repeatable, scalable, and secure deployments across hybrid and multi-cloud environments. It supports Citrix’s broader goals of reducing time-to-value, improving customer satisfaction, and deeply integrating into customer ecosystems. IntroductionIn this guide, we cover the usage of three distinct Infrastructure-as-Code (IaC) frameworks to deploy a Citrix Virtual Desktops 2507 LTSR-based deployment on a vSphere 8 cluster. The instructions are divided into blocks that must be started in a specific, predetermined order. However, it is not necessary to start all blocks in one go—the dependencies on previous blocks are recorded during runtime, so that essential time intervals or even execution stops between the individual blocks are not a problem. Components and frameworks used in this guideLet´s have a short overview of all the components and frameworks used in this guide. We use Hashicorp Packer as the framework for generating the Master Images and templates for deploying all needed Windows-based virtual machines on XenServer 8.4, Hashicorp Terraform as the backbone and “coordinating” framework for creating all needed Infrastructure components, and Ansible as the configuration framework for all configuration needs of the components that Terraform cannot do during the initial creation of the respective element. vSphere 8VMware vSphere 8 is a powerful hypervisor that provides a stable, scalable platform for Citrix Virtual Apps and Desktops. It combines modern virtualization features with optimized performance, high security, and broad Citrix support, providing businesses with a future-proof foundation for their virtual desktop infrastructure (VDI). With VMware vSphere 8 as the hypervisor for Citrix Virtual Apps and Desktops, organizations gain a future-proof, scalable, and secure platform for their VDI strategy. The combination enables high performance, flexible scaling, and easy management while improving the end-user experience and meeting compliance requirements. Hashicorp TerraformTerraform is one of the most widely adopted Infrastructure-as-Code (IaC) platforms for provisioning and managing cloud and on-prem infrastructure at scale. Its declarative configuration model, strong ecosystem support, and provider-agnostic architecture make it a foundational tool for organizations seeking consistency, compliance, and operational maturity in their infrastructure lifecycle. Terraform relies on declarative code to define infrastructure in a predictable, reproducible manner. By representing compute, networking, storage, IAM, and platform services as version-controlled code artifacts, Terraform: Eliminates configuration drift Ensures consistent provisioning across development, staging, and production Produces deployments that can be rebuilt deterministically This consistency is particularly valuable in regulated environments where documentation, repeatability, and environmental fidelity are required for audits and certification processes. For highly regulated verticals—such as finance, healthcare, government, and critical infrastructure—Terraform provides the governance, repeatability, and auditability required to meet stringent compliance obligations. These regulated verticals often operate under strict frameworks, such as: Finance: PCI-DSS, FFIEC, SOX Healthcare: HIPAA, HITECH Government/Public Sector: FedRAMP, NIST 800-53, DoD SRG Energy/Critical Infrastructure: NERC CIP Global Privacy Requirements: GDPR, regional data sovereignty mandates Terraform helps organizations meet these obligations by providing: Complete Traceability and Auditability: All infrastructure changes can be captured in version control systems. This enables traceable change histories, approvals, and rollbacks—supporting SOX, NIST, and ISO 27001 requirements around change management and configuration governance. Standardized, Repeatable Environments: Terraform modules enable organizations to define compliant “building blocks” that development teams cannot inadvertently modify, ensuring every environment meets baseline controls for security, networking, identity, and data protection. Operational Efficiency and Reduced Risk: Terraform’s execution plan and state management capabilities allow organizations to preview changes before applying them, reducing misconfigurations—a key risk driver in regulated environments. Additional operational benefits include: Automated provisioning at scale Predictable change outcomes through planning and applying workflows Reduced human error, a significant source of compliance violations Consistent rollback and recovery patterns Integration With Secure DevOps and Platform Engineering Practices Terraform fits seamlessly into CI/CD, GitOps, and automated compliance frameworks, enabling regulated organizations to adopt modern DevOps practices without compromising governance. It perfectly integrates with frameworks such as: Terraform Cloud/Enterprise for controlled workflows Vault for secure secrets injection Packer for master image pipelines GitHub Actions, GitLab, Azure DevOps for automated deployment Hashicorp PackerHashiCorp Packer is a foundational tool for organizations seeking to standardize, automate, and scale the creation of master images across multi-cloud and hybrid environments. As organizations increasingly adopt Infrastructure-as-Code (IaC) approaches, Packer provides a consistent, version-controlled, and repeatable way to build golden images aligned with modern DevOps and platform engineering practices. Standardization and Consistency Across Environments: Packer enables the creation of identically configured images for AWS, Azure, GCP, VMware, and other platforms from a single source template. This eliminates configuration drift and ensures that compute instances, virtual desktops, containers, or on-prem VMs are consistently built from the same baseline. For enterprises managing multiple environments, Packer’s multi-builder architecture ensures that every deployment starts from a deterministic, verified image. Full Infrastructure-as-Code Alignment: Packer templates are declarative and integrate seamlessly into IaC workflows using tools such as Terraform, Ansible, and even cloud-native configuration tools. This yields several architectural advantages: Versioned images: Each new image build is immutable and tied to a version-controlled configuration. Reproducibility: Builds can be recreated deterministically at any time, supporting compliance and audit requirements. Automation-ready: Image creation fits naturally into CI/CD pipelines, enabling continuous delivery of operating system and middleware baselines. Efficient, Scalable Deployments: Master images generated by Packer accelerate workload provisioning by drastically reducing runtime bootstrap configuration. This leads to: Faster autoscaling responsiveness Reduced risk of configuration failures during provisioning Decreased cloud compute costs due to shorter initialization times Better operational consistency across development, staging, and production These benefits scale exceptionally well for enterprise cloud deployments, VDI environments, and large-scale microservice platforms. Multi-Cloud Flexibility and Future-Proofing Packer’s provider-agnostic architecture helps organizations avoid lock-in and stay adaptable. A single template can create AMIs, Azure Managed Images, GCP images, Docker images, and VMware templates. This uniformity supports long-term cloud strategy, modernization efforts, and disaster recovery architectures that depend on identical images across regions and providers. Integration with Modern Platform Engineering Practices Packer integrates tightly with modern platform engineering toolchains: Terraform for downstream deployment Vault for secure secrets handling GitHub Actions, GitLab CI, Azure DevOps for automated pipelines This positions Packer as a first-class component in automated golden image pipelines, enabling platform teams to provide self-service, pre-validated, compliant images to developers and operations teams. Packer is a mature, efficient, and cloud-agnostic solution that brings the rigor of Infrastructure-as-Code to master image creation. It ensures repeatability, security, compliance, and operational speed while integrating seamlessly into modern CI/CD and platform engineering ecosystems. For organizations pursuing scalable, automated, and consistent image-based deployments, Packer is not only valid but strategically advantageous. Packer is an open-source tool that automates the creation of machine images for multiple platforms from a single source configuration. It enables developers and DevOps teams to define image-creation workflows in code, resulting in consistent, repeatable, and version-controlled image builds. RedHat AnsibleMany organizations that have matured their Infrastructure-as-Code (IaC) practices increasingly require tooling that not only provisions infrastructure but also configures systems, applications, and operating environments in a controlled, repeatable manner. Ansible is a leading configuration management and automation platform that aligns naturally with IaC principles and complements provisioning tools such as Terraform, or cloud-native IaC engines. Its agentless architecture, declarative playbook model, and extensive ecosystem make it a strategic choice for enterprises seeking predictable, scalable, and compliant post-provision configuration. Ansible provides a declarative, idempotent configuration model that ensures systems converge to a desired state regardless of their current configuration. This makes it ideally suited for environments provisioned using IaC tools, allowing organizations to: Configure compute resources, operating systems, middleware, and applications immediately after provisioning Apply consistent baseline templates across development, staging, and production Avoid configuration drift and reduce manual intervention Enforce standardization across diverse platforms and environments Because Ansible uses standard protocols (SSH, WinRM, API calls) and does not require agents, it can manage virtually any resource created by IaC tooling with minimal setup. Ansible excels by enabling: OS configuration (packages, services, permissions, patching) Deployment and maintenance of middleware or applications Secure configuration of agents (monitoring, logging, EDR, secrets managers) Post-provision checks and compliance enforcement Continuous updates and lifecycle operations long after initial provisioning Ansible delivers operational benefits such as: Idempotent reruns that safely correct drift Automated configuration updates Consistent rollout of application versions or patches Reduced human error and faster recovery Centralized configuration logic rather than ad-hoc scripts These capabilities support long-term environment stability, which is often a weak point in IaC deployments if configuration is not managed separately. Better togetherTerraform and Ansible serve complementary roles in modern Infrastructure-as-Code (IaC) architectures. Terraform excels at provisioning infrastructure resources—compute, networks, storage, identity, and cloud services—while Ansible specializes in configuring and managing the software, applications, and operating system state on those resources once they are created. When combined, they form a robust, scalable, and fully automated delivery pipeline that allows organizations to provision secure, consistent environments and configure them in a modular, policy-driven manner. Terraform is primarily designed for infrastructure lifecycle management, while Ansible is engineered for post-provisioning configuration. This clean separation ensures: Terraform builds and destroys infrastructure predictably Ansible configures servers, middleware, application stacks, and OS settings Changes to infrastructure and configuration are maintained in distinct codebases, improving clarity and reducing risk IT can version, audit, and test both layers independently This division of responsibilities aligns with architectural patterns used in platform engineering and regulated environments, where infrastructure and system configuration often have separate compliance requirements. Schematic workflow in this guide: PrerequisitesLet´s have a short overview of all the prerequisites needed: IaC Deployment MachineWe assume you have a dedicated machine or a cluster running all Automation components. If all IaC frameworks reside on the same machine/cluster, communication between them is less error-prone. We recommend an Ubuntu-based machine for various reasons: An Ubuntu VM is one of the most reliable, flexible, and well-supported environments for running IaC tools like Terraform, Ansible, Jenkins, and Packer, thanks to its stability, compatibility, and strong community support. Most IaC tools (Terraform, Ansible, Packer) are developed and tested primarily on Linux. Note: You can find a guide to create such an all-in-one deployment machine on Citrix TechZone. If you use the Ubuntu-based IaC machine, all Terraform, Packer, and Ansible snippets are running on Ubuntu. All local-exec provisioners also run on the Ubuntu machine: Example of a local-exec provisioner: ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } Caution: Due to current limitations in Citrix StoreFront´s automation capabilities, you must run the automated deployment and configuration of Citrix StoreFront™ from a domain-joined Windows machine with Terraform installed. Important: Suppose you decide to switch to running all Terraform snippets on a Windows machine. In that case, you need to change the provisioner types and the code from local-exec provisioners to remote-exec provisioners, as Ansible cannot run on a Windows machine! Example of the local-exec provisioner mentioned above - converted to a remote-exec provisioner: ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD ] } }You can find instructions for setting up the necessary WinRM/SSH configuration later in this guide. vSphere 8We assume that you already have a vSphere 8 cluster in place, which will serve as the Hypervisor host for all required virtual machines. Important: There is no need to have template VMs or template snapshots configured if you want to follow our IaC-based approach to create and configure all needed Master images using Packer. If you do not want to use Packer but have already configured Master images, you can use them and reference them in the corresponding Terraform variables later. Communication Flow between Terraform, Ansible, and the Target MachinesAll communication between Terraform, Packer, and Ansible on the IaC-VM and the target VMs on the XenServer cluster uses SSH and WinRM. WinRM (Windows Remote Management) is a Microsoft protocol that enables remote management of Windows systems by allowing access to remote computers to perform management tasks. It is Microsoft's implementation of the WS-Management (Web Services Management Protocol) standard. It often uses SOAP (Simple Object Access Protocol) for communication over HTTP or HTTPS, using ports 5985 (HTTP) and 5986 (HTTPS) by default. WinRM provides the basis for remote management with PowerShell and is used for tasks such as running remote scripts, automating, configuring, and performing system inventory. Therefore, WinRM and SSH must be configured correctly. Important: We emphasize ensuring the communication flow works as intended from the outset of the pre-domain-joined stage; otherwise, Terraform and Ansible will fail to configure the VMs. During the pre-domain-join stage, you can configure these settings using the local Group Policy Editor on the VM or in the autounattend.xml file as we do in our Packer scripts. After a successful domain join, you can set all relevant settings using GPOs. To provide maximum flexibility and a fallback mechanism, you can use both listeners - HTTP and HTTPS - but we recommend using the secure transport whenever and wherever possible. You can check all available listeners using PowerShell: PS > winrm e winrm/config/listener Listener [Source="GPO"] Address = * Transport = HTTP Port = 5985 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 10.10.119.31, 127.0.0.1, ::1, fe80::287c:216e:9bd9:18e5%7 Listener [Source="GPO"] Address = * Transport = HTTPS Port = 5986 Hostname = tf-cvad-v-ddc1.the-austrian-citrix-guy.at Enabled = true URLPrefix = wsman CertificateThumbprint = e3bf89dd77c95dd6c0f1b94480ea63782df4279e ListeningOn = 10.10.119.31, 127.0.0.1, ::1, fe80::287c:216e:9bd9:18e5%7To check the communication, you can use a Terraform snippet: Unsecure Communication - connecting to the HTTP listener: resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_IP1 timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_IP1 timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } }Output: ... null_resource.InstallonIP1: Creating... null_resource.InstallonIP1: Provisioning with 'remote-exec'... null_resource.InstallonIP1 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP1 (remote-exec): Host: tf-cvad-v-ddc1 null_resource.InstallonIP1 (remote-exec): Port: 5985 null_resource.InstallonIP1 (remote-exec): User: administrator null_resource.InstallonIP1 (remote-exec): Password: true null_resource.InstallonIP1 (remote-exec): HTTPS: false null_resource.InstallonIP1 (remote-exec): Insecure: false null_resource.InstallonIP1 (remote-exec): NTLM: false null_resource.InstallonIP1 (remote-exec): CACert: false null_resource.InstallonIP1 (remote-exec): Connected! ... Secure Communication - connecting to the HTTPS listener: resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } }Output: ... null_resource.InstallonIP1: Creating... null_resource.InstallonIP1: Provisioning with 'remote-exec'... null_resource.InstallonIP1 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP1 (remote-exec): Host: tf-cvad-v-ddc1 null_resource.InstallonIP1 (remote-exec): Port: 5986 null_resource.InstallonIP1 (remote-exec): User: svc_ansible null_resource.InstallonIP1 (remote-exec): Password: true null_resource.InstallonIP1 (remote-exec): HTTPS: true null_resource.InstallonIP1 (remote-exec): Insecure: false null_resource.InstallonIP1 (remote-exec): NTLM: false null_resource.InstallonIP1 (remote-exec): CACert: false null_resource.InstallonIP1 (remote-exec): Connected! ...Important: Configuring secure communication, especially for Ansible on the Ubuntu machine, is a complex task that involves certificates and user mappings – you can find many comprehensive configuration guides online. A good start can be found in Ansible´s own documentation. Active Directory DomainAn existing AD domain is imperative for a successful CVAD deployment. We assume you have a domain with all the needed configurations in place. Creation of the CVAD Environment using IaCAs all prerequisites are met, we can now start with the workflow to create our Citrix Virtual Apps and Desktops deployment. As already stated, the workflow is divided into blocks that must be started in a specific, predetermined order: Caution: As already mentioned above, Module 9 - Using Terraform to create the StoreFront deployment and all its necessities, must be run on a Windows-based, domain-joined VM to be supported. This is due to limitations in StoreFront´s automation capabilities. Using Packer to create the Master Images In this IaC block, we use Packer to create the Master Images for the VDI machines and the Windows Servers. Using Terraform to create the needed VMs based on the Master Images Terraform will create these VMs: a. Two Windows Server 2025-based VMs for the Delivery Controllers b. One Windows Server 2025-based VM for the StoreFront™ server c. One Windows Server 2025-based VM for the WebStudio™ server d. One Windows 11-based VM as a VDI Worker Using Terraform and Ansible to configure the VMs Terraform and Ansible take further configuration steps: a. Change the IP addresses to known IPs b. Change the Ansible configuration file to reflect the IP changes c. Put the VMs into the AD domain Using Terraform and Ansible to deploy the Delivery Controllers Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the DDCs c. Install all required server roles and features before installing the DDCs d. Change some necessary registry settings Using Terraform and Ansible to deploy the StoreFront server Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the StoreFront server c. Install all required server roles and features before installing the StoreFront d. Change some necessary registry settings Using Terraform and Ansible to deploy the WebStudio server Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the WebStudio server c. Install all required server roles and features before installing the WebStudio server d. Change some necessary registry settings e. Configure WebStudio server as proxy for the DDCs Using Terraform and Ansible to change the SSL Bindings Terraform and Ansible take further configuration steps: a. Change the SSL bindings on all servers and listeners to achieve complete HTTPS communication Using Terraform and Ansible to create the CVAD site and all its necessities Terraform and Ansible take further configuration steps: a. Create all databases b. Create the site c. Add the second DDC to the site d. Configure additional site configurations e. Configure a dedicated Administrators group f. Configure the licensing Using Terraform to create the StoreFront deployment and all its necessities Terraform takes further configuration steps: a. Create the StoreFront deployment b. Create a StoreFront Authentication service c. Create a StoreFront Store service d. Create a StoreFront WebReceiver service Using Terraform to create all CVAD entities and all their necessities Terraform takes further configuration steps: a. Create a StoreFront Server object b. Create a Hypervisor connection c. Create a Hypervisor connection resource pool d. Create a Machine Catalog e. Create a Delivery Group f. Create a Policy Set and its policies Note: All Ansible playbooks are directly called from Terraform. Terraform stops the workflow if an error occurs by checking Ansible's return code. Important: All shown Terraform codes, Ansible Playbooks, and PowerShell scripts are tailored exclusively for the specific environment used for this guide. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. Using all the provided code snippets is at your own risk – please read the disclaimer at the end of the document for further information. Terraform verifies the successful execution of each Ansible playbook. If an error occurs, Terraform will halt the deployment and write out the failed Playbook: Example snippet: ##### Create Databases Start ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCDB" { depends_on = [null_resource.RunCreateDatabasePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { depends_on = [data.external.CheckAnsibleReturnCodeCDB] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCDB.result.found}\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }" } }In this example, Terraform runs the Ansible playbook to create the CVAD databases. If an error occurs, Terraform writes an error message indicating that deploying the CVAD databases failed. You would find more information in the LogFile directory on the corresponding server. Terraform then stops the further execution of the snippets. Part 1: Using Packer to create the Master ImagesHashicorp Packer is our standard framework for creating, maintaining, and deploying Master Images using IaC. Our vSphere cluster has no VDI-related VMs before running the snippet: Example Packer HCL file to create a Windows 11-based on vSphere: locals { WinRMUser = "administrator" WinRMPass = "!XxXxXxXxXxXxXxXxX!" vcenter_admin = "administrator@vsphere.local" vcenter_password = "!XxXxXxXxXxXxXxXxX!" timestamp = regex_replace(timestamp(), "[- TZ:01]", "") buildtime = formatdate("DD-MM-YYYY hh:mm ZZZ", timestamp()) manifest_date = formatdate("DD-MM-YYYY hh:mm:ss", timestamp()) } packer { required_version = ">= 1.9.0" required_plugins { vsphere = { version = ">= v1.4.2" source = "github.com/vmware/vsphere" } } required_plugins { windows-update = { version = ">= 0.16.8" source = "github.com/rgl/windows-update" } } } variable "host" { type = string description = "VMware ESXi host" } variable "name" { type = string description = "Golden Image name" } variable "operating_system_vm" { type = string description = "OS Guest OS" } variable "vcenter_cluster" { type = string description = "vCenter cluster name" } variable "vcenter_datastore" { type = string description = "vSphere datastore" } variable "vcenter_host" { type = string description = "vCenter Server" } variable "vcenter_network" { type = string description = "Portgroup name" } variable "vm_cores" { type = string description = "Amount of cores" } variable "vm_cpus" { type = string description = "amount of vCPUs" } variable "vm_disk_controller_type" { type = list(string) description = "Controller type" } variable "vm_disk_size" { type = string description = "Harddisk size" } variable "vm_disk_thin" { type = string description = "Enable/Disable thin provisioning" } variable "vm_hardwareversion" { type = string description = "VM hardware version" } variable "vm_firmware" { type = string description = "The virtual machine firmware. (e.g. 'efi-secure'. 'efi', or 'bios')" default = "efi-secure" } variable "vm_cdrom_type" { type = string description = "The virtual machine CD-ROM type. (e.g. 'sata', or 'ide')" default = "sata" } variable "common_remove_cdrom" { type = bool description = "Remove the virtual CD-ROM(s)." default = true } variable "vm_hotplug" { type = string description = "Enable/Disable hotplug?" } variable "vm_logging" { type = string description = "Enable/Disable VM Logging" } variable "vm_memory" { type = string description = "VM Memory" } variable "vm_memory_reserve_all" { type = string description = "Reserve all memory?" } variable "vm_network_card" { type = string description = "Networkcard type" } variable "winsrv_iso" { type = string description = "Windows Server ISO location" } variable "vm_vgpu" { type = string description = "VM vGPU size" } variable "vm_boot_order" { type = string description = "The boot order for virtual machines devices. (e.g. 'disk,cdrom')" default = "disk,cdrom" } variable "vm_boot_wait" { type = string description = "The time to wait before boot." } variable "vm_boot_command" { type = list(string) description = "The virtual machine boot command." default = [] } variable "vm_shutdown_command" { type = string description = "Command(s) for guest operating system shutdown." } variable "vm_tpm" { type = string default = "true" } variable "create_snapshot" { type = string } variable "remove_cdrom" { type = string } variable "vbs_enabled" { type = string } variable "vvtd_enabled" { type = string } source "vsphere-iso" "win11_iso" { CPUs = var.vm_cpus notes = "Built by HashiCorp Packer on ${local.buildtime}." RAM = var.vm_memory firmware = var.vm_firmware NestedHV = true RAM_reserve_all = var.vm_memory_reserve_all cluster = var.vcenter_cluster configuration_parameters = { "devices.hotplug" = var.vm_hotplug "logging" = var.vm_logging "svga.autodetect" = "FALSE" "svga.numDisplays" = "2" } create_snapshot = var.create_snapshot remove_cdrom = var.remove_cdrom cpu_cores = var.vm_cores datastore = var.vcenter_datastore disk_controller_type = var.vm_disk_controller_type floppy_files = ["${path.root}/setup/"] guest_os_type = var.operating_system_vm host = var.host iso_paths = [var.winsrv_iso] network_adapters { network = var.vcenter_network network_card = var.vm_network_card } storage { disk_size = var.vm_disk_size disk_thin_provisioned = var.vm_disk_thin } username = local.vcenter_admin password = local.vcenter_password vcenter_server = var.vcenter_host vm_name = var.name vm_version = var.vm_hardwareversion vTPM = var.vm_tpm vbs_enabled = var.vbs_enabled vvtd_enabled = var.vvtd_enabled insecure_connection = "true" communicator = "winrm" winrm_port = "5985" winrm_username = local.WinRMUser winrm_password = local.WinRMPass winrm_timeout = "12h" boot_order = var.vm_boot_order boot_wait = var.vm_boot_wait boot_command = var.vm_boot_command shutdown_command = var.vm_shutdown_command } build { sources = ["source.vsphere-iso.win11_iso"] provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Output 'restarted.'}\"" restart_timeout = "20m" } provisioner "powershell" { elevated_user = local.WinRMUser elevated_password = local.WinRMPass valid_exit_codes = [0] scripts = [ "./setup/install-vda.ps1", ] } provisioner "powershell" { elevated_user = local.WinRMUser elevated_password = local.WinRMPass valid_exit_codes = [0, 267014] scripts = [ "./setup/windows-init.ps1", ] } post-processors { post-processor "vsphere-template"{ host = var.vcenter_host insecure = true username = local.vcenter_admin password = local.vcenter_password datacenter = var.vcenter_datacenter folder = "/vmfs/volumes/XxXxXxXxXxXxXxX" } } } In this example, we use a modified autounattend.xml file to configure the Windows VM during creation. <?xml version="1.0" encoding="utf-8"?> <unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="windowsPE"> <component name="Microsoft-Windows-PnpCustomizationsWinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <DriverPaths> <PathAndCredentials wcm:action="add" wcm:keyValue="1"> <Path>E:\</Path> </PathAndCredentials> </DriverPaths> </component> <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <DiskConfiguration> <Disk wcm:action="add"> <CreatePartitions> <CreatePartition wcm:action="add"> <Order>1</Order> <Type>EFI</Type> <Size>100</Size> </CreatePartition> <CreatePartition wcm:action="add"> <Order>2</Order> <Type>MSR</Type> <Size>16</Size> </CreatePartition> <CreatePartition wcm:action="add"> <Order>3</Order> <Type>Primary</Type> <Extend>true</Extend> </CreatePartition> </CreatePartitions> <ModifyPartitions> <ModifyPartition wcm:action="add"> <Order>1</Order> <Format>FAT32</Format> <Label>System</Label> <PartitionID>1</PartitionID> </ModifyPartition> <ModifyPartition wcm:action="add"> <Order>2</Order> <PartitionID>2</PartitionID> </ModifyPartition> <ModifyPartition wcm:action="add"> <Order>3</Order> <Format>NTFS</Format> <Label>Windows</Label> <Letter>C</Letter> <PartitionID>3</PartitionID> </ModifyPartition> </ModifyPartitions> <DiskID>0</DiskID> <WillWipeDisk>true</WillWipeDisk> </Disk> </DiskConfiguration> <ImageInstall> <OSImage> <InstallTo> <DiskID>0</DiskID> <PartitionID>3</PartitionID> </InstallTo> <InstallFrom> <MetaData wcm:action="add"> <Key>/IMAGE/INDEX</Key> <Value>1</Value> </MetaData> </InstallFrom> </OSImage> </ImageInstall> <UserData> <ProductKey> <Key>VK7JG-NPHTM-C97JM-9MPGT-3V66T</Key> <WillShowUI>OnError</WillShowUI> </ProductKey> <AcceptEula>true</AcceptEula> <FullName>TACG</FullName> <Organization>TACG</Organization> </UserData> <RunSynchronous> <RunSynchronousCommand wcm:action="add"> <Order>1</Order> <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1</Path> </RunSynchronousCommand> <RunSynchronousCommand wcm:action="add"> <Order>2</Order> <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1</Path> </RunSynchronousCommand> <RunSynchronousCommand wcm:action="add"> <Order>3</Order> <Path>reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1</Path> </RunSynchronousCommand> </RunSynchronous> </component> <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <SetupUILanguage> <UILanguage>en-US</UILanguage> </SetupUILanguage> <InputLocale>en-US</InputLocale> <SystemLocale>en-US</SystemLocale> <UILanguage>en-US</UILanguage> <UILanguageFallback>en-US</UILanguageFallback> <UserLocale>en-US</UserLocale> </component> </settings> <settings pass="oobeSystem"> <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <InputLocale>en-US</InputLocale> <SystemLocale>en-US</SystemLocale> <UILanguage>en-US</UILanguage> <UILanguageFallback>en-US</UILanguageFallback> <UserLocale>en-US</UserLocale> </component> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <OOBE> <HideEULAPage>true</HideEULAPage> <HideLocalAccountScreen>true</HideLocalAccountScreen> <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen> <HideOnlineAccountScreens>true</HideOnlineAccountScreens> <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> <ProtectYourPC>1</ProtectYourPC> </OOBE> <TimeZone>UTC</TimeZone> <UserAccounts> <AdministratorPassword> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </AdministratorPassword> <LocalAccounts> <LocalAccount wcm:action="add"> <Name>azadmin</Name> <DisplayName></DisplayName> <Group>Administrators</Group> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> </LocalAccount> <LocalAccount wcm:action="add"> <Name>User</Name> <DisplayName></DisplayName> <Group>Users</Group> <Password> <Value></Value> <PlainText>true</PlainText> </Password> </LocalAccount> </LocalAccounts> </UserAccounts> <AutoLogon> <Username>Administrator</Username> <Enabled>true</Enabled> <LogonCount>1</LogonCount> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> </AutoLogon> <FirstLogonCommands> <SynchronousCommand wcm:action="add"> <Order>1</Order> <CommandLine>PowerShell "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine> <Description>Change the default PowerShell Execution Policy from Restricted to RemoteSigned</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>2</Order> <CommandLine>C:\Windows\SysWOW64\cmd /c PowerShell -Command "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"</CommandLine> <Description>Change the default PowerShell (32-bit) Execution Policy from Restricted to RemoteSigned</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>3</Order> <CommandLine>PowerShell -WindowStyle Maximized -Command "Get-PSDrive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root provision-autounattend.ps1; if (Test-Path $p) {&$p}}"</CommandLine> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\install-vmwtools.ps1</CommandLine> <Order>4</Order> <Description>Install VMware Tools</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <CommandLine>%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -File a:\windows-init.ps1</CommandLine> <Order>5</Order> <Description>Initial Configuration</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Description>Sysprep Generalize</Description> <CommandLine>cmd /c C:\Windows\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown</CommandLine> <Order>5</Order> </SynchronousCommand> </FirstLogonCommands> </component> </settings> <settings pass="offlineServicing"> <component name="Microsoft-Windows-LUA-Settings" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <EnableLUA>false</EnableLUA> </component> </settings> </unattend>As the syntax of the autounattend.xml is very sensitive to errors, we use a self-written configuration tool to create the autounattend.xml more comfortably: Example: Running the Windows 11-related Packer IaC snippet should create a vSphere VM that is converted to a template: azadmin@tacg-cicd:~$ packer build -force -var-file=".\win11-std.auto.pkrvars.hcl" win11-std-config.pkr.hcl vsphere-iso.win11_iso: output will be in this color. ==> vsphere-iso.win11_iso: Creating virtual machine... ==> vsphere-iso.win11_iso: Customizing hardware... ==> vsphere-iso.win11_iso: Adding virtual machine flags... ==> vsphere-iso.win11_iso: Mounting ISO images... ==> vsphere-iso.win11_iso: Adding configuration parameters... ==> vsphere-iso.win11_iso: Creating floppy disk... ==> vsphere-iso.win11_iso: Copying files flatly from floppy_files ==> vsphere-iso.win11_iso: Copying directory: ./setup/ ==> vsphere-iso.win11_iso: Adding file: setup\add-domain.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\autounattend.xml ==> vsphere-iso.win11_iso: Adding file: setup\autounattend.xml-orig ==> vsphere-iso.win11_iso: Adding file: setup\disable-autolog.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\disable-network-discovery.cmd ==> vsphere-iso.win11_iso: Adding file: setup\disable-ssh.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\enable-rdp.cmd ==> vsphere-iso.win11_iso: Adding file: setup\enable-ssh.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\enable-winrm.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\install-vmwtools.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\install_windowsfeatures.ps1 ==> vsphere-iso.win11_iso: Adding file: setup\windows-init.ps1 ==> vsphere-iso.win11_iso: Done copying files from floppy_files ==> vsphere-iso.win11_iso: Collecting paths from floppy_dirs ==> vsphere-iso.win11_iso: Resulting paths from floppy_dirs : [] ==> vsphere-iso.win11_iso: Done copying paths from floppy_dirs ==> vsphere-iso.win11_iso: Copying files from floppy_content ==> vsphere-iso.win11_iso: Done copying files from floppy_content ==> vsphere-iso.win11_iso: Uploading floppy image... ==> vsphere-iso.win11_iso: Adding generated floppy image... ==> vsphere-iso.win11_iso: Setting boot order... ==> vsphere-iso.win11_iso: Powering on virtual machine... ==> vsphere-iso.win11_iso: Waiting 3s for boot... ==> vsphere-iso.win11_iso: Typing boot command... ==> vsphere-iso.win11_iso: Waiting for IP... ==> vsphere-iso.win11_iso: IP address: 10.10.11.186 ==> vsphere-iso.win11_iso: Using WinRM communicator to connect: 10.10.11.186 ==> vsphere-iso.win11_iso: Waiting for WinRM to become available... ==> vsphere-iso.win11_iso: WinRM connected. ==> vsphere-iso.win11_iso: Connected to WinRM! ==> vsphere-iso.win11_iso: Restarting Machine ==> vsphere-iso.win11_iso: Waiting for machine to restart... ==> vsphere-iso.win11_iso: A system shutdown is in progress.(1115) ==> vsphere-iso.win11_iso: A system shutdown is in progress.(1115) ==> vsphere-iso.win11_iso: restarted. ==> vsphere-iso.win11_iso: TACGTAC-8KAGCAS restarted. ==> vsphere-iso.win11_iso: Machine successfully restarted, moving on ==> vsphere-iso.win11_iso: Provisioning with Powershell... ==> vsphere-iso.win11_iso: Provisioning with powershell script: ./setup/windows-init.ps1 ==> vsphere-iso.win11_iso: Configuring important Windows Features... ==> vsphere-iso.win11_iso: Setting the network connection profiles to Private... ==> vsphere-iso.win11_iso: Setting the Windows Remote Management configuration... ==> vsphere-iso.win11_iso: WinRM service is already running on this machine. ==> vsphere-iso.win11_iso: WinRM is already set up for remote management on this computer. ==> vsphere-iso.win11_iso: Service ==> vsphere-iso.win11_iso: RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD) ==> vsphere-iso.win11_iso: MaxConcurrentOperations = 4294967295 ==> vsphere-iso.win11_iso: MaxConcurrentOperationsPerUser = 1500 ==> vsphere-iso.win11_iso: EnumerationTimeoutms = 240000 ==> vsphere-iso.win11_iso: MaxConnections = 300 ==> vsphere-iso.win11_iso: MaxPacketRetrievalTimeSeconds = 120 ==> vsphere-iso.win11_iso: AllowUnencrypted = true ==> vsphere-iso.win11_iso: Auth ==> vsphere-iso.win11_iso: Basic = true ==> vsphere-iso.win11_iso: Kerberos = true ==> vsphere-iso.win11_iso: Negotiate = true ==> vsphere-iso.win11_iso: Certificate = false ==> vsphere-iso.win11_iso: CredSSP = false ==> vsphere-iso.win11_iso: CbtHardeningLevel = Relaxed ==> vsphere-iso.win11_iso: DefaultPorts ==> vsphere-iso.win11_iso: HTTP = 5985 ==> vsphere-iso.win11_iso: HTTPS = 5986 ==> vsphere-iso.win11_iso: IPv4Filter = * ==> vsphere-iso.win11_iso: IPv6Filter = * ==> vsphere-iso.win11_iso: EnableCompatibilityHttpListener = false ==> vsphere-iso.win11_iso: EnableCompatibilityHttpsListener = false ==> vsphere-iso.win11_iso: CertificateThumbprint ==> vsphere-iso.win11_iso: AllowRemoteAccess = true ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Auth ==> vsphere-iso.win11_iso: Basic = true ==> vsphere-iso.win11_iso: Kerberos = true ==> vsphere-iso.win11_iso: Negotiate = true ==> vsphere-iso.win11_iso: Certificate = false ==> vsphere-iso.win11_iso: CredSSP = false ==> vsphere-iso.win11_iso: CbtHardeningLevel = Relaxed ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Allowing Windows Remote Management in the Windows Firewall... ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: No rules match the specified criteria. ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Updated 2 rule(s). ==> vsphere-iso.win11_iso: Ok. ==> vsphere-iso.win11_iso: ==> vsphere-iso.win11_iso: Running shutdown command... ==> vsphere-iso.win11_iso: Deleting floppy drives... ==> vsphere-iso.win11_iso: Deleting floppy image... ==> vsphere-iso.win11_iso: Ejecting CD-ROM media... ==> vsphere-iso.win11_iso: Removing CD-ROM devices... ==> vsphere-iso.win11_iso: Closing sessions... Build 'vsphere-iso.win11_iso' finished after 20 minutes 40 seconds. ==> Wait completed after 20 minutes 40 seconds ==> Builds finished. The artifacts of successful builds are: --> vsphere-iso.win11_iso: win11-p01 azadmin@tacg-cicd:~$ The exact process is also done to create the Windows Server Master Image and Template. After a successful run, vSphere should reflect the created VMs, and after conversion, the corresponding templates: Since the Master Images have been created, we can proceed to the next step. Part 2: Using Terraform to create the needed VMs based on the Master ImagesTerraform now creates all the required Infrastructure VMs for deploying CVAD: Two Windows Server 2025-based VMs for the Delivery Controllers One Windows Server 2025-based VM for the StoreFront server One Windows Server 2025-based VM for the WebStudio server. All needed settings are defined in a dedicated JSON file, where all variables and their values are stored. This allows maximum code flexibility and reusability, as it does not need to be changed when other VM configurations arise. Note: Those are the key principles of IaC – repeatability, reusability, and flexibility. Example of the VM settings in Terraform: { "vsphere_W2K25_template_name":"winsrv2025-02wi", "vsphere_ddc1_vmname":"TF-CVAD-V-DDC1", "vsphere_ddc2_vmname":"TF-CVAD-V-DDC2", "vsphere_sf_vmname":"TF-CVAD-V-SF", "vsphere_ws_vmname":"TF-CVAD-V-WS", "vsphere_ddc1_cpus":2, "vsphere_ddc2_cpus":2, "vsphere_sf_cpus":2, "vsphere_ws_cpus":2, "vsphere_ddc1_ram":8192, "vsphere_ddc2_ram":8192, "vsphere_sf_ram":8192, "vsphere_ws_ram":8192, "vsphere_ddc1_disk_name":0, "vsphere_ddc2_disk_name":0, "vsphere_sf_disk_name":0, "vsphere_ws_disk_name":0, "vsphere_ddc1_disk_size":80, "vsphere_ddc2_disk_size":80, "vsphere_ws_disk_size":80, "vsphere_sf_disk_size":80, "vsphere_ddc1_disk_provtype":true, "vsphere_ddc2_disk_provtype":true, "vsphere_sf_disk_provtype":true, "vsphere_ws_disk_provtype":true, "vsphere_local_admin_pw":"!XxXxXxXxXxXxXxXxX!", "vsphere_ddc1_ipv4":"10.10.119.31", "vsphere_ddc2_ipv4":"10.10.119.32", "vsphere_sf_ipv4":"10.10.119.33", "vsphere_ws_ipv4":"10.10.119.34", "vsphere_ddc_ipv4netmask":16, "vsphere_ddc_ipv4_gateway":"10.10.0.1" }For example, if you want to change the main disk size, you only need to change the corresponding value: From to would double the disk size to 160GB. Important: The Terraform provider for vSphere supports joining a newly created VM to an AD domain, but we want our code to be as Hypervisor-agnostic as possible – that is one of the main principles of Automation – Code reusability. The Domain join will be performed in the next block using an Ansible Playbook. Example Terraform snippet for VM creation: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs data "vsphere_datacenter" "datacenter" { name = var.vsphere_datacenter } data "vsphere_datastore" "datastore" { name = var.vsphere_datastore datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_network" "network" { name = var.vsphere_network datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_host" "host" { name = var.vsphere_host datacenter_id = data.vsphere_datacenter.datacenter.id } ### If a cluster is available, uncomment this block data "vsphere_compute_cluster" "cluster" { name = "TACG" datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_virtual_machine" "W2K22_Template" { name = var.vsphere_W2K22_template_name datacenter_id = data.vsphere_datacenter.datacenter.id } ### Create DDC1-VM resource "vsphere_virtual_machine" "ddc1-vm" { name = var.vsphere_ddc1_vmname resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id datastore_id = data.vsphere_datastore.datastore.id num_cpus = var.vsphere_ddc1_cpus memory = var.vsphere_ddc1_ram guest_id = data.vsphere_virtual_machine.W2K22_Template.guest_id scsi_type = data.vsphere_virtual_machine.W2K22_Template.scsi_type firmware = "efi" network_interface { network_id = data.vsphere_network.network.id adapter_type = data.vsphere_virtual_machine.W2K22_Template.network_interface_types[0] } disk { label = var.vsphere_ddc1_disk_name ### If you want to use the same disk size and type as hte template, uncomment this block size = data.vsphere_virtual_machine.W2K22_Template.disks.0.size thin_provisioned = data.vsphere_virtual_machine.W2K22_Template.disks.0.thin_provisioned ### If you want to override the disk size and disk provisioning type, uncomment this block and set the corresponding variables #size = var.vsphere_ddc1_disk_size #thin_provisioned = var.vsphere_ddc1_disk_provtype } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = var.vsphere_cvad_iso_destination_path } clone { template_uuid = data.vsphere_virtual_machine.W2K22_Template.id customize { network_interface { ipv4_address = var.vsphere_ddc1_ipv4 ipv4_netmask = var.vsphere_ddc_ipv4netmask dns_server_list = [var.vsphere_ddc_dns[0]] } windows_options { computer_name = var.vsphere_computernames[0] } ipv4_gateway = var.vsphere_ddc_ipv4_gateway } } } ### Create DDC2-VM resource "vsphere_virtual_machine" "ddc2-vm" { name = var.vsphere_ddc2_vmname resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id datastore_id = data.vsphere_datastore.datastore.id num_cpus = var.vsphere_ddc2_cpus memory = var.vsphere_ddc2_ram guest_id = data.vsphere_virtual_machine.W2K22_Template.guest_id scsi_type = data.vsphere_virtual_machine.W2K22_Template.scsi_type firmware = "efi" network_interface { network_id = data.vsphere_network.network.id adapter_type = data.vsphere_virtual_machine.W2K22_Template.network_interface_types[0] } disk { label = var.vsphere_ddc2_disk_name ### If you want to use the same disk size and type as hte template, uncomment this block size = data.vsphere_virtual_machine.W2K22_Template.disks.0.size thin_provisioned = data.vsphere_virtual_machine.W2K22_Template.disks.0.thin_provisioned ### If you want to override the disk size and disk provisioning type, uncomment this block and set the corresponding variables #size = var.vsphere_ddc2_disk_size #thin_provisioned = var.vsphere_ddc2_disk_provtype } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = var.vsphere_cvad_iso_destination_path } clone { template_uuid = data.vsphere_virtual_machine.W2K22_Template.id customize { network_interface { ipv4_address = var.vsphere_ddc2_ipv4 ipv4_netmask = var.vsphere_ddc_ipv4netmask dns_server_list = [var.vsphere_ddc_dns[0]] } windows_options { computer_name = var.vsphere_computernames[0] } ipv4_gateway = var.vsphere_ddc_ipv4_gateway } } } ### Create SF-VM resource "vsphere_virtual_machine" "sf-vm" { name = var.vsphere_sf_vmname resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id datastore_id = data.vsphere_datastore.datastore.id num_cpus = var.vsphere_sf_cpus memory = var.vsphere_sf_ram guest_id = data.vsphere_virtual_machine.W2K22_Template.guest_id scsi_type = data.vsphere_virtual_machine.W2K22_Template.scsi_type firmware = "efi" network_interface { network_id = data.vsphere_network.network.id adapter_type = data.vsphere_virtual_machine.W2K22_Template.network_interface_types[0] } disk { label = var.vsphere_sf_disk_name ### If you want to use the same disk size and type as hte template, uncomment this block size = data.vsphere_virtual_machine.W2K22_Template.disks.0.size thin_provisioned = data.vsphere_virtual_machine.W2K22_Template.disks.0.thin_provisioned ### If you want to override the disk size and disk provisioning type, uncomment this block and set the corresponding variables #size = var.vsphere_sf_disk_size #thin_provisioned = var.vsphere_sf_disk_provtype } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = var.vsphere_cvad_iso_destination_path } clone { template_uuid = data.vsphere_virtual_machine.W2K22_Template.id customize { network_interface { ipv4_address = var.vsphere_sf_ipv4 ipv4_netmask = var.vsphere_ddc_ipv4netmask dns_server_list = [var.vsphere_ddc_dns[0]] } windows_options { computer_name = var.vsphere_computernames[0] } ipv4_gateway = var.vsphere_ddc_ipv4_gateway } } } ### Create WS-VM resource "vsphere_virtual_machine" "ws-vm" { name = var.vsphere_ws_vmname resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id datastore_id = data.vsphere_datastore.datastore.id num_cpus = var.vsphere_ws_cpus memory = var.vsphere_ws_ram guest_id = data.vsphere_virtual_machine.W2K22_Template.guest_id scsi_type = data.vsphere_virtual_machine.W2K22_Template.scsi_type firmware = "efi" network_interface { network_id = data.vsphere_network.network.id adapter_type = data.vsphere_virtual_machine.W2K22_Template.network_interface_types[0] } disk { label = var.vsphere_ws_disk_name ### If you want to use the same disk size and type as hte template, uncomment this block size = data.vsphere_virtual_machine.W2K22_Template.disks.0.size thin_provisioned = data.vsphere_virtual_machine.W2K22_Template.disks.0.thin_provisioned ### If you want to override the disk size and disk provisioning type, uncomment this block and set the corresponding variables #size = var.vsphere_ws_disk_size #thin_provisioned = var.vsphere_ws_disk_provtype } cdrom { datastore_id = data.vsphere_datastore.datastore.id path = var.vsphere_cvad_iso_destination_path } clone { template_uuid = data.vsphere_virtual_machine.W2K22_Template.id customize { network_interface { ipv4_address = var.vsphere_ws_ipv4 ipv4_netmask = var.vsphere_ddc_ipv4netmask dns_server_list = [var.vsphere_ddc_dns[0]] } windows_options { computer_name = var.vsphere_computernames[0] } ipv4_gateway = var.vsphere_ddc_ipv4_gateway } } }Running this snippet should create all 4 VMs on vSphere: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_Creation$ terraform apply data.vsphere_datacenter.datacenter: Reading... data.vsphere_datacenter.datacenter: Read complete after 0s [id=datacenter-3] data.vsphere_network.network: Reading... data.vsphere_virtual_machine.W2K22_Template: Reading... data.vsphere_host.host: Reading... data.vsphere_compute_cluster.cluster: Reading... data.vsphere_datastore.datastore: Reading... data.vsphere_network.network: Read complete after 0s [id=network-12] data.vsphere_datastore.datastore: Read complete after 0s [id=datastore-11] data.vsphere_host.host: Read complete after 0s [id=host-8] data.vsphere_virtual_machine.W2K22_Template: Read complete after 0s [id=422a5cdf-8e0a-339e-e7d4-a674484d2eba] data.vsphere_compute_cluster.cluster: Read complete after 0s [id=domain-c17] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # vsphere_virtual_machine.ddc1-vm will be created + resource "vsphere_virtual_machine" "ddc1-vm" { + annotation = (known after apply) + boot_retry_delay = 10000 + change_version = (known after apply) + cpu_limit = -1 + cpu_share_count = (known after apply) + cpu_share_level = "normal" + datastore_id = "datastore-11" + default_ip_address = (known after apply) + ept_rvi_mode = (known after apply) + extra_config_reboot_required = true + firmware = "efi" + force_power_off = true + guest_id = "windows2019srv_64Guest" + guest_ip_addresses = (known after apply) + hardware_version = (known after apply) + host_system_id = (known after apply) + hv_mode = (known after apply) + id = (known after apply) + ide_controller_count = 2 + imported = (known after apply) + latency_sensitivity = "normal" + memory = 8192 + memory_limit = -1 + memory_share_count = (known after apply) + memory_share_level = "normal" + migrate_wait_timeout = 30 + moid = (known after apply) + name = "TF-CVAD-V-DDC1" + num_cores_per_socket = 1 + num_cpus = 2 + nvme_controller_count = 0 + power_state = (known after apply) + poweron_timeout = 300 + reboot_required = (known after apply) + resource_pool_id = "resgroup-18" + run_tools_scripts_after_power_on = true + run_tools_scripts_after_resume = true + run_tools_scripts_before_guest_shutdown = true + run_tools_scripts_before_guest_standby = true + sata_controller_count = 0 + scsi_bus_sharing = "noSharing" + scsi_controller_count = 1 + scsi_type = "lsilogic-sas" + shutdown_wait_timeout = 3 + storage_policy_id = (known after apply) + swap_placement_policy = "inherit" + sync_time_with_host = true + tools_upgrade_policy = "manual" + uuid = (known after apply) + vapp_transport = (known after apply) + vmware_tools_status = (known after apply) + vmx_path = (known after apply) + wait_for_guest_ip_timeout = 0 + wait_for_guest_net_routable = true + wait_for_guest_net_timeout = 5 + cdrom { + datastore_id = "datastore-11" + device_address = (known after apply) + key = (known after apply) + path = "TF-CVAD-V-ISO/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" } + clone { + template_uuid = "422a5cdf-8e0a-339e-e7d4-a674484d2eba" + timeout = 30 + customize { + ipv4_gateway = "10.10.0.1" + timeout = 10 + network_interface { + dns_server_list = [ + "10.10.100.1", ] + ipv4_address = "10.10.119.31" + ipv4_netmask = 16 } + windows_options { + auto_logon_count = 1 + computer_name = "tf-cvad-v-ddc1" + full_name = "Administrator" + organization_name = "Managed by Terraform" + time_zone = 85 } } } + disk { + attach = false + controller_type = "scsi" + datastore_id = "<computed>" + device_address = (known after apply) + disk_mode = "persistent" + disk_sharing = "sharingNone" + eagerly_scrub = false + io_limit = -1 + io_reservation = 0 + io_share_count = 0 + io_share_level = "normal" + keep_on_remove = false + key = 0 + label = "0" + path = (known after apply) + size = 90 + storage_policy_id = (known after apply) + thin_provisioned = true + unit_number = 0 + uuid = (known after apply) + write_through = false } + network_interface { + adapter_type = "vmxnet3" + bandwidth_limit = -1 + bandwidth_reservation = 0 + bandwidth_share_count = (known after apply) + bandwidth_share_level = "normal" + device_address = (known after apply) + key = (known after apply) + mac_address = (known after apply) + network_id = "network-12" } } # vsphere_virtual_machine.ddc2-vm will be created + resource "vsphere_virtual_machine" "ddc2-vm" { + annotation = (known after apply) + boot_retry_delay = 10000 + change_version = (known after apply) + cpu_limit = -1 + cpu_share_count = (known after apply) + cpu_share_level = "normal" + datastore_id = "datastore-11" + default_ip_address = (known after apply) + ept_rvi_mode = (known after apply) + extra_config_reboot_required = true + firmware = "efi" + force_power_off = true + guest_id = "windows2019srv_64Guest" + guest_ip_addresses = (known after apply) + hardware_version = (known after apply) + host_system_id = (known after apply) + hv_mode = (known after apply) + id = (known after apply) + ide_controller_count = 2 + imported = (known after apply) + latency_sensitivity = "normal" + memory = 8192 + memory_limit = -1 + memory_share_count = (known after apply) + memory_share_level = "normal" + migrate_wait_timeout = 30 + moid = (known after apply) + name = "TF-CVAD-V-DDC2" + num_cores_per_socket = 1 + num_cpus = 2 + nvme_controller_count = 0 + power_state = (known after apply) + poweron_timeout = 300 + reboot_required = (known after apply) + resource_pool_id = "resgroup-18" + run_tools_scripts_after_power_on = true + run_tools_scripts_after_resume = true + run_tools_scripts_before_guest_shutdown = true + run_tools_scripts_before_guest_standby = true + sata_controller_count = 0 + scsi_bus_sharing = "noSharing" + scsi_controller_count = 1 + scsi_type = "lsilogic-sas" + shutdown_wait_timeout = 3 + storage_policy_id = (known after apply) + swap_placement_policy = "inherit" + sync_time_with_host = true + tools_upgrade_policy = "manual" + uuid = (known after apply) + vapp_transport = (known after apply) + vmware_tools_status = (known after apply) + vmx_path = (known after apply) + wait_for_guest_ip_timeout = 0 + wait_for_guest_net_routable = true + wait_for_guest_net_timeout = 5 + cdrom { + datastore_id = "datastore-11" + device_address = (known after apply) + key = (known after apply) + path = "TF-CVAD-V-ISO/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" } + clone { + template_uuid = "422a5cdf-8e0a-339e-e7d4-a674484d2eba" + timeout = 30 + customize { + ipv4_gateway = "10.10.0.1" + timeout = 10 + network_interface { + dns_server_list = [ + "10.10.100.1", ] + ipv4_address = "10.10.119.32" + ipv4_netmask = 16 } + windows_options { + auto_logon_count = 1 + computer_name = "tf-cvad-v-ddc2" + full_name = "Administrator" + organization_name = "Managed by Terraform" + time_zone = 85 } } } + disk { + attach = false + controller_type = "scsi" + datastore_id = "<computed>" + device_address = (known after apply) + disk_mode = "persistent" + disk_sharing = "sharingNone" + eagerly_scrub = false + io_limit = -1 + io_reservation = 0 + io_share_count = 0 + io_share_level = "normal" + keep_on_remove = false + key = 0 + label = "0" + path = (known after apply) + size = 90 + storage_policy_id = (known after apply) + thin_provisioned = true + unit_number = 0 + uuid = (known after apply) + write_through = false } + network_interface { + adapter_type = "vmxnet3" + bandwidth_limit = -1 + bandwidth_reservation = 0 + bandwidth_share_count = (known after apply) + bandwidth_share_level = "normal" + device_address = (known after apply) + key = (known after apply) + mac_address = (known after apply) + network_id = "network-12" } } # vsphere_virtual_machine.sf-vm will be created + resource "vsphere_virtual_machine" "sf-vm" { + annotation = (known after apply) + boot_retry_delay = 10000 + change_version = (known after apply) + cpu_limit = -1 + cpu_share_count = (known after apply) + cpu_share_level = "normal" + datastore_id = "datastore-11" + default_ip_address = (known after apply) + ept_rvi_mode = (known after apply) + extra_config_reboot_required = true + firmware = "efi" + force_power_off = true + guest_id = "windows2019srv_64Guest" + guest_ip_addresses = (known after apply) + hardware_version = (known after apply) + host_system_id = (known after apply) + hv_mode = (known after apply) + id = (known after apply) + ide_controller_count = 2 + imported = (known after apply) + latency_sensitivity = "normal" + memory = 8192 + memory_limit = -1 + memory_share_count = (known after apply) + memory_share_level = "normal" + migrate_wait_timeout = 30 + moid = (known after apply) + name = "TF-CVAD-V-SF" + num_cores_per_socket = 1 + num_cpus = 2 + nvme_controller_count = 0 + power_state = (known after apply) + poweron_timeout = 300 + reboot_required = (known after apply) + resource_pool_id = "resgroup-18" + run_tools_scripts_after_power_on = true + run_tools_scripts_after_resume = true + run_tools_scripts_before_guest_shutdown = true + run_tools_scripts_before_guest_standby = true + sata_controller_count = 0 + scsi_bus_sharing = "noSharing" + scsi_controller_count = 1 + scsi_type = "lsilogic-sas" + shutdown_wait_timeout = 3 + storage_policy_id = (known after apply) + swap_placement_policy = "inherit" + sync_time_with_host = true + tools_upgrade_policy = "manual" + uuid = (known after apply) + vapp_transport = (known after apply) + vmware_tools_status = (known after apply) + vmx_path = (known after apply) + wait_for_guest_ip_timeout = 0 + wait_for_guest_net_routable = true + wait_for_guest_net_timeout = 5 + cdrom { + datastore_id = "datastore-11" + device_address = (known after apply) + key = (known after apply) + path = "TF-CVAD-V-ISO/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" } + clone { + template_uuid = "422a5cdf-8e0a-339e-e7d4-a674484d2eba" + timeout = 30 + customize { + ipv4_gateway = "10.10.0.1" + timeout = 10 + network_interface { + dns_server_list = [ + "10.10.100.1", ] + ipv4_address = "10.10.119.33" + ipv4_netmask = 16 } + windows_options { + auto_logon_count = 1 + computer_name = "tf-cvad-v-sf" + full_name = "Administrator" + organization_name = "Managed by Terraform" + time_zone = 85 } } } + disk { + attach = false + controller_type = "scsi" + datastore_id = "<computed>" + device_address = (known after apply) + disk_mode = "persistent" + disk_sharing = "sharingNone" + eagerly_scrub = false + io_limit = -1 + io_reservation = 0 + io_share_count = 0 + io_share_level = "normal" + keep_on_remove = false + key = 0 + label = "0" + path = (known after apply) + size = 90 + storage_policy_id = (known after apply) + thin_provisioned = true + unit_number = 0 + uuid = (known after apply) + write_through = false } + network_interface { + adapter_type = "vmxnet3" + bandwidth_limit = -1 + bandwidth_reservation = 0 + bandwidth_share_count = (known after apply) + bandwidth_share_level = "normal" + device_address = (known after apply) + key = (known after apply) + mac_address = (known after apply) + network_id = "network-12" } } # vsphere_virtual_machine.ws-vm will be created + resource "vsphere_virtual_machine" "ws-vm" { + annotation = (known after apply) + boot_retry_delay = 10000 + change_version = (known after apply) + cpu_limit = -1 + cpu_share_count = (known after apply) + cpu_share_level = "normal" + datastore_id = "datastore-11" + default_ip_address = (known after apply) + ept_rvi_mode = (known after apply) + extra_config_reboot_required = true + firmware = "efi" + force_power_off = true + guest_id = "windows2019srv_64Guest" + guest_ip_addresses = (known after apply) + hardware_version = (known after apply) + host_system_id = (known after apply) + hv_mode = (known after apply) + id = (known after apply) + ide_controller_count = 2 + imported = (known after apply) + latency_sensitivity = "normal" + memory = 8192 + memory_limit = -1 + memory_share_count = (known after apply) + memory_share_level = "normal" + migrate_wait_timeout = 30 + moid = (known after apply) + name = "TF-CVAD-V-WS" + num_cores_per_socket = 1 + num_cpus = 2 + nvme_controller_count = 0 + power_state = (known after apply) + poweron_timeout = 300 + reboot_required = (known after apply) + resource_pool_id = "resgroup-18" + run_tools_scripts_after_power_on = true + run_tools_scripts_after_resume = true + run_tools_scripts_before_guest_shutdown = true + run_tools_scripts_before_guest_standby = true + sata_controller_count = 0 + scsi_bus_sharing = "noSharing" + scsi_controller_count = 1 + scsi_type = "lsilogic-sas" + shutdown_wait_timeout = 3 + storage_policy_id = (known after apply) + swap_placement_policy = "inherit" + sync_time_with_host = true + tools_upgrade_policy = "manual" + uuid = (known after apply) + vapp_transport = (known after apply) + vmware_tools_status = (known after apply) + vmx_path = (known after apply) + wait_for_guest_ip_timeout = 0 + wait_for_guest_net_routable = true + wait_for_guest_net_timeout = 5 + cdrom { + datastore_id = "datastore-11" + device_address = (known after apply) + key = (known after apply) + path = "TF-CVAD-V-ISO/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" } + clone { + template_uuid = "422a5cdf-8e0a-339e-e7d4-a674484d2eba" + timeout = 30 + customize { + ipv4_gateway = "10.10.0.1" + timeout = 10 + network_interface { + dns_server_list = [ + "10.10.100.1", ] + ipv4_address = "10.10.119.34" + ipv4_netmask = 16 } + windows_options { + auto_logon_count = 1 + computer_name = "tf-cvad-v-ws" + full_name = "Administrator" + organization_name = "Managed by Terraform" + time_zone = 85 } } } + disk { + attach = false + controller_type = "scsi" + datastore_id = "<computed>" + device_address = (known after apply) + disk_mode = "persistent" + disk_sharing = "sharingNone" + eagerly_scrub = false + io_limit = -1 + io_reservation = 0 + io_share_count = 0 + io_share_level = "normal" + keep_on_remove = false + key = 0 + label = "0" + path = (known after apply) + size = 90 + storage_policy_id = (known after apply) + thin_provisioned = true + unit_number = 0 + uuid = (known after apply) + write_through = false } + network_interface { + adapter_type = "vmxnet3" + bandwidth_limit = -1 + bandwidth_reservation = 0 + bandwidth_share_count = (known after apply) + bandwidth_share_level = "normal" + device_address = (known after apply) + key = (known after apply) + mac_address = (known after apply) + network_id = "network-12" } } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes vsphere_virtual_machine.ws-vm: Creating... vsphere_virtual_machine.ddc1-vm: Creating... vsphere_virtual_machine.ddc2-vm: Creating... vsphere_virtual_machine.sf-vm: Creating... vsphere_virtual_machine.ws-vm: Still creating... [00m10s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [00m10s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [00m10s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [00m10s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [00m20s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [00m20s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [00m20s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [00m20s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [00m30s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [00m30s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [00m30s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [00m30s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [00m40s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [00m40s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [00m40s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [00m40s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [00m50s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [00m50s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [00m50s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [00m50s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [01m00s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [01m00s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [01m00s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [01m00s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [01m10s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [01m10s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [01m10s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [01m10s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [01m20s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [01m20s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [01m20s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [01m20s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [01m30s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [01m30s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [01m30s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [01m30s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [01m40s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [01m40s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [01m40s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [01m40s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [01m50s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [01m50s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [01m50s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [01m50s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [02m00s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [02m00s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [02m00s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [02m00s elapsed] vsphere_virtual_machine.ws-vm: Still creating... [02m10s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [02m10s elapsed] vsphere_virtual_machine.ddc2-vm: Still creating... [02m10s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [02m10s elapsed] vsphere_virtual_machine.ddc2-vm: Creation complete after 2m17s [id=422aea50-ccb4-77c2-a72e-dea631b95b29] vsphere_virtual_machine.ws-vm: Still creating... [02m20s elapsed] vsphere_virtual_machine.ddc1-vm: Still creating... [02m20s elapsed] vsphere_virtual_machine.sf-vm: Still creating... [02m20s elapsed] vsphere_virtual_machine.sf-vm: Creation complete after 2m26s [id=422adb85-f8e7-5582-de6d-06b339bd2c26] vsphere_virtual_machine.ddc1-vm: Creation complete after 2m26s [id=422a3cc3-34b9-d92c-d507-1d13995645a5] vsphere_virtual_machine.ws-vm: Still creating... [02m30s elapsed] vsphere_virtual_machine.ws-vm: Creation complete after 2m36s [id=422a774a-03fc-1cfd-a07e-f36471098f09] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_Creation$vSphere reflects the successful run: Since the VMs have been created, we can proceed to the next step. Part 3: Using Terraform and Ansible to configure the VMsThis configuration block now uses the combination of Terraform and Ansible for all needed configuration steps. As mentioned, Terraform excels at creating components; Ansible excels at configuring them. Together, we have everything we need for a successful deployment. Note: In all our guides, we try to be as Hypervisor- and Hyperscaler-agnostic as possible. For example, the vSphere provider could add a VM to an AD domain, but not all providers support this, and each provider uses a different syntax. Using the same Ansible playbook across all Hypervisors/Hyperscalers, regardless of built-in capabilities, also improves code reuse, as no specific code needs to be changed for different Hypervisor-/Hyperscaler deployments. This block also shows the main flow: Terraform decides which steps are necessary and starts the corresponding Ansible playbooks to achieve the needed outcome. The following configuration steps are sequentially done: Change the Ansible configuration file to reflect the IP changes Put the VMs into the AD domain Usually, when VMs are created, they will receive an IP address from a DHCP server. This is not true for the vSphere provider – there, you can provide the fixed IP addresses during creation. As Ansible needs to know how to contact the VM, the IP settings must be reflected in Ansible´s etc/ansible/HOSTS file: ... [ddc1_ipaddr] 10.10.119.31 [ddc2_ipaddr] 10.10.119.32 [sf_ipaddr] 10.10.119.33 [ws_ipaddr] 10.10.119.34 ...Typically, our agnostic Ansible snippet would take care of DHCP-based IP addresses and would change all relevant settings to ensure the usage of all communications using the fixed IP addresses, You can find more information about that process in our guide, "Using Infrastructure-as-Code to deploy Citrix Virtual Apps and Desktops 2507 LTSR on XenServer 8.4". Terraform usually takes three steps to correct that: 1. It changes the IPs to fixed IPs defined in the Ansible playbook's corresponding variables 2. The etc/ansible/HOSTS file is updated with the correct IPs 3. The VMs are added to the domain. In the vSphere case, only the third step is used. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs ## Definition of all required local variables ### Get Needed Data #### Call Ansible to Join VM to Domain ##### Copy Ansible Playbooks to Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyPlaybooksForCC1ToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-CC1-Source destination = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-CC1-Destination } } resource "null_resource" "CopyPlaybooksForCC2ToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-CC2-Source destination = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-CC2-Destination } } resource "null_resource" "CopyPlaybooksForSFToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-SF-Source destination = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-SF-Destination } } resource "null_resource" "CopyPlaybooksForWebStudioToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-WS-Source destination = var.TACG-TMM-VSP-CL-Ansible-DomainJoinPlaybook-WS-Destination } } #### Wait 10s Minute for Background Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyPlaybooksForCC1ToAnsibleServer, null_resource.CopyPlaybooksForCC2ToAnsibleServer, null_resource.CopyPlaybooksForSFToAnsibleServer, null_resource.CopyPlaybooksForWebStudioToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and Add DDC1 To Domain resource "null_resource" "AddCC1ToDomain" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-DomainJoinCMDForCC1 } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeD1" { depends_on = [null_resource.AddCC1ToDomain] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltD1" { depends_on = [data.external.CheckAnsibleReturnCodeD1] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeD1.result.found}\" = \"1\" ] && echo \"Adding DDC1 to Domain: Everything OK\" || { echo \"Adding DDC1 to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### End of necessary changes on DDC1 #### Wait 10s Minute for Background Processes to Settle resource "time_sleep" "wait_10_seconds_afterddc1" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltD1] create_duration = "10s" } ... The same steps are needed for all the other servers ... ##### All necessary changes on the VMs are completeExample Ansible Playbook for adding the VM to the AD domain: ... - name: join host to domain with automatic reboot hosts: ddc1_ipaddr tasks: - name: join host to domain with automatic reboot microsoft.ad.membership: dns_domain_name: the-austrian-citrix-guy.at hostname: tf-cvad-v-ddc1 domain_admin_user: XxXxXxXxX@the-austrian-citrix-guy.at domain_admin_password: "!XxXxXxXxXxXxXxXxX!" domain_ou_path: "OU=_COMPUTER,OU=TACG-CVAD,DC=the-austrian-citrix-guy,DC=at" state: domain reboot: trueRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_UseAnsibleToJoinDomain$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode1 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode1" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCode2 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode2" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } ... # time_sleep.wait_10_seconds_afterddc2 will be created + resource "time_sleep" "wait_10_seconds_afterddc2" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_seconds_aftersf will be created + resource "time_sleep" "wait_10_seconds_aftersf" { + create_duration = "10s" + id = (known after apply) } Plan: 32 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Creating... null_resource.CopyPlaybooksForSFToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Creation complete after 0s [id=9099395716454281124] null_resource.CopyPlaybooksForCC2ToAnsibleServer: Creation complete after 1s [id=2239027084142302025] null_resource.CopyPlaybooksForCC1ToAnsibleServer: Creation complete after 1s [id=8241870746583503880] null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Creation complete after 1s [id=85414301571074153] ... time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-03T12:50:35Z] null_resource.AddCC1ToDomain: Creating... null_resource.AddCC1ToDomain: Provisioning with 'local-exec'... null_resource.AddCC1ToDomain (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/Join-VMToDomain-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.AddCC1ToDomain (local-exec): PLAY [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.AddCC1ToDomain (local-exec): ok: [10.10.119.31] null_resource.AddCC1ToDomain (local-exec): TASK [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain: Still creating... [00m10s elapsed] null_resource.AddCC1ToDomain: Still creating... [00m20s elapsed] null_resource.AddCC1ToDomain (local-exec): changed: [10.10.119.31] => {"changed": true, "reboot_required": false} null_resource.AddCC1ToDomain (local-exec): PLAY RECAP ********************************************************************* null_resource.AddCC1ToDomain (local-exec): 10.10.119.31 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.AddCC1ToDomain: Creation complete after 28s [id=6625761552218837946] data.external.CheckAnsibleReturnCodeD1: Reading... data.external.CheckAnsibleReturnCodeD1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltD1: Creating... null_resource.IfExitCodeIsNotZeroThenHaltD1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltD1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Adding DDC1 to Domain: Everything OK\" || { echo \"Adding DDC1 to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltD1 (local-exec): Adding DDC1 to Domain: Everything OK null_resource.IfExitCodeIsNotZeroThenHaltD1: Creation complete after 0s [id=7818126381059512591] time_sleep.wait_10_seconds_afterddc1: Creating... time_sleep.wait_10_seconds_afterddc1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_afterddc1: Creation complete after 10s [id=2025-11-16T12:51:13Z] ... All these steps are the same for the other three servers. Output omitted due to length ... data.external.CheckAnsibleReturnCodeDWS: Reading... data.external.CheckAnsibleReturnCodeDWS: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltDWS: Creating... null_resource.IfExitCodeIsNotZeroThenHaltDWS: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltDWS (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Adding WebStudio to Domain: Everything OK\" || { echo \"Adding WebStudio to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltDWS (local-exec): Adding WebStudio to Domain: Everything OK null_resource.IfExitCodeIsNotZeroThenHaltDWS: Creation complete after 0s [id=975638781208917805] Apply complete! Resources: 32 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_UseAnsibleToJoinDomain$All VMs are added to the AD domain: Ansible´s further used inventory.ini file also reflects all these changes: [cvad:children] cvad-ddcs cvad-sf-vs cvad-ws cvad-ddcs-v cvad-sf-vs-v cvad-ws-v ... [cvad-ddcs-v] tf-cvad-v-ddc1.the-austrian-citrix-guy.at tf-cvad-v-ddc2.the-austrian-citrix-guy.at [cvad-ddc1-v] tf-cvad-v-ddc1.the-austrian-citrix-guy.at [cvad-ddc2-v] tf-cvad-v-ddc2.the-austrian-citrix-guy.at [cvad-ddc1-v-nb] TF-CVAD-V-DDC1 [cvad-ddc2-v-nb] TF-CVAD-V-DDC2 [cvad-sf-vs-v] tf-cvad-v-sf.the-austrian-citrix-guy.at [cvad-ws-v] tf-cvad-v-ws.the-austrian-citrix-guy.at ... [all:vars] ansible_user="svc_ansible" ansible_domainuser="XxXxXxXxX@the-austrian-citrix-guy.at" ansible_password="!XxXxXxXxXxXxXxXxXx!” ansible_connection=winrm ansible_winrm_scheme=https ansible_winrm_transport=certificate ansible_winrm_port=5986 ansible_winrm_cert_pem=/etc/ssl/certs/svc_ansible.pem ansible_winrm_cert_key_pem=/etc/ssl/certs/svc_ansible.pemSince the VMs and their dependencies were successfully reconfigured, we can proceed to the next step. Part 4: Using Terraform and Ansible to deploy the Delivery ControllersThe VMs dedicated to holding the Delivery Controller™ roles are now ready for the deployment of the Delivery Controller components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the DDCs Install all required server roles and features before installing the DDCs Change some necessary registry settings Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VMs: Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleDDCAssetsToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } # Copy vars-ddcs.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-Vars-Source destination = var.TACG-TMM-VSP-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-Inventory-Source destination = var.TACG-TMM-VSP-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForDDCs-Source destination = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForDDCs-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleDDCAssetsToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on DDCs resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-InitialCMDForDDCs } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying CVAD: Everything OK\" || { echo \"Deploying the CVAD software and its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } Example Ansible Playbook for deploying and configuring the DDCs and all needed further configurations: --- # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the Delivery Controllers - name: Configure the DDCs initially hosts: cvad-ddcs-v vars_files: - ./vars-ddcs.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ ddc_req_roles }}" state: present register: requirements - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 3010] creates_path: C:\Program Files\Citrix\Desktop Studio register: ddc_install - name: Reboot after DDC ansible.windows.win_reboot: when: ddc_install.changed - name: Remove DDC RunOnce Key ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce name: "!XenDesktopSetup" state: absent register: ddc_resume - name: Resume DDC Install ansible.windows.win_package: path: C:\ProgramData\Citrix\XenDesktopSetup\XenDesktopServerSetup.exe state: present expected_return_code: [0, 3, 3010] creates_path: C:\Program Files\Citrix\Desktop Studio when: ddc_resume.changed - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Restart a service ansible.windows.win_service: name: CitrixHostService state: startedRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_InstallCVAD$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleDDCAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleDDCAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Creation complete after 0s [id=3392935108841645613] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-18T07:13:29Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForDDCs.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the DDCs initially] ******************************************** null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [00m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [12m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [12m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Group Policy Management", "id": 69, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Remote Server Administration Tools", "id": 67, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS and AD LDS Tools", "id": 329, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Tools", "id": 257, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Snap-Ins and Command-Line Tools", "id": 299, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Role Administration Tools", "id": 256, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Group Policy Management", "id": 69, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Remote Server Administration Tools", "id": 67, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS and AD LDS Tools", "id": 329, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Tools", "id": 257, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Snap-Ins and Command-Line Tools", "id": 299, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Role Administration Tools", "id": 256, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook: Still creating... [15m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [15m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [15m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [25m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after DDC] ******************************************************** null_resource.RunInitialPlaybook: Still creating... [25m30s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m40s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m50s elapsed] null_resource.RunInitialPlaybook: Still creating... [26m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 34, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 43, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): TASK [Remove DDC RunOnce Key] ************************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "data_changed": false, "data_type_changed": false} null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "data_changed": false, "data_type_changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Resume DDC Install] ****************************************************** null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "ddc_resume.changed", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "ddc_resume.changed", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook: Still creating... [26m10s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-v-ddc1.the-austrian-citrix-guy.at : ok=12 changed=9 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 null_resource.RunInitialPlaybook (local-exec): tf-cvad-v-ddc2.the-austrian-citrix-guy.at : ok=12 changed=9 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 26m11s [id=3927491137125445482] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying CVAD: Everything OK\" || { echo \"Deploying the CVAD software and its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying CVAD: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=8978265277076340502] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_InstallCVAD$ After successful deployment, the CVAD software is installed and can be configured later. Caution: We have noticed that in some environments, the Citrix Host Service does not start after the initial reboot, even though it is set to Automatic start. Therefore, we added a new task to the Ansible Playbook to ensure that the Citrix Host Service starts after the initial reboot and before the following configuration steps. Since the CVAD software and its dependencies were successfully deployed, we can proceed to the next step. Part 5: Using Terraform and Ansible to deploy the StoreFront serverThe VM dedicated to holding the StoreFront™ role is now ready for the deployment of the StoreFront components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the DDCs Install all required server roles and features before installing the DDCs Change some necessary registry settings Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VMs. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs #### Copy the required Ansible Assets for installing StoreFront to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSFAssetsToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } # Copy vars-sf.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-Vars-Source destination = var.TACG-TMM-VSP-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-Inventory-Source destination = var.TACG-TMM-VSP-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForSF-Source destination = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForSF-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSFAssetsToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on SF resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-InitialCMDForSF } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying StoreFront - Everything OK\" || { echo \"Deploying the StoreFront software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } }Example Ansible Playbook for deploying and configuring Storefront and all needed further configurations: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the StoreFront Server - name: Configure the StoreFront Server initially hosts: cvad-sf-v vars_files: - ./vars-sf.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ sf_req_roles }}" state: present register: requirements become: true become_method: runas become_user: SYSTEM - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Create database server record ansible.windows.win_dns_record: computer_name: "{{ sf_dns_ip }}" name: "{{ sf_dns_name }}" type: "A" value: "{{ sf_dns_value }}" zone: "{{ sf_dns_zone }}" state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 4, 3010] creates_path: C:\ProgramData\Citrix\Storefront Install register: sf_install become: true become_method: runas become_user: "{{ ansible_domainuser }}" - name: Reboot after sf ansible.windows.win_reboot: when: sf_install.changedRunning the snippet should fulfill all required steps: At first, all missing Windows features are installed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_InstallStoreFront$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSFAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSFAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleSFAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Creation complete after 0s [id=3119681656948818723] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-15T16:59:29Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForStoreFront.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the StoreFront Server initially] ******************************* null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-sf.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [00m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [09m50s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook: Still creating... [10m00s elapsed] null_resource.RunInitialPlaybook: Still creating... [10m10s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [19m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Message Queuing", "id": 49, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Server", "id": 191, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Services", "id": 190, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 (includes .NET 2.0 and 3.0)", "id": 220, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 Features", "id": 475, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Activation", "id": 421, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing (MSMQ) Activation", "id": 422, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Named Pipe Activation", "id": 423, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "TCP Activation", "id": 424, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Telnet Client", "id": 44, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Process Activation Service", "id": 41, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Configuration APIs", "id": 217, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Process Model", "id": 219, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Initialization", "id": 445, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP", "id": 150, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Basic Authentication", "id": 163, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "CGI", "id": 151, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Dynamic Content Compression", "id": 173, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Redirection", "id": 146, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Tracing", "id": 159, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Server Side Includes", "id": 154, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Logging Tools", "id": 157, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Metabase Compatibility", "id": 179, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Management Compatibility", "id": 178, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Scripts and Tools", "id": 176, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 WMI Compatibility", "id": 180, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [19m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m20s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m30s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "22A6C5D5BB516ABD6DF5DC6E6CA0C0CEFBB19082", "rc": 3010, "reboot_required": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after sf] ********************************************************* null_resource.RunInitialPlaybook: Still creating... [19m40s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m50s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m00s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-sf.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 42, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-v-sf.the-austrian-citrix-guy.at : ok=11 changed=10 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 20m24s [id=7847329303251523226] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying StoreFront - Everything OK\" || { echo \"Deploying the StoreFront software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying StoreFront - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=6843415180162545622] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_InstallStoreFront$ After successful deployment, the StoreFront software is installed and can be configured later. Since the StoreFront software and its dependencies were successfully deployed, we can proceed to the next step. Part 6: Using Terraform and Ansible to deploy the Web Studio ServerThe VM dedicated to holding the Web Studio role is now ready for the deployment of the Web Studio components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the Web Studio server Install all required server roles and features before installing the Web Studio server Change some necessary registry settings Configure the Web Studio server as a proxy for the DDCs Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VM again. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs #### Copy the required Ansible Assets for installing Web Studio to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleWSAssetsToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-Ansible-Connection-Type user = var.TACG-TMM-VSP-CL-Ansible-Connection-User password = var.TACG-TMM-VSP-CL-Ansible-Connection-Password host = var.TACG-TMM-VSP-CL-Ansible-Connection-HostIP port = var.TACG-TMM-VSP-CL-Ansible-Connection-Port https = var.TACG-TMM-VSP-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-Ansible-Connection-Timeout } # Copy vars-ws.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-Vars-Source destination = var.TACG-TMM-VSP-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-Inventory-Source destination = var.TACG-TMM-VSP-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForWS-Source destination = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForWS-Destination } # Copy SetProxy Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-SetProxyPlaybookWS-Source destination = var.TACG-TMM-VSP-CL-Ansible-InitialPlaybookForWS-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleWSAssetsToAnsibleServer] create_duration = "10s" } #### Run initial configuration ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on WS resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-InitialCMDForWS } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying WebStudio: Everything OK\" || { echo \"Deploying the WebStudio software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_IC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt] create_duration = "10s" } ##### End of intitial configuration #### Run SetProxy configuration ##### Connect to Ansible Interpreter and run SetProxy Playbook on WS resource "null_resource" "RunSetProxyConfigurationPlaybook" { depends_on = [time_sleep.wait_10_seconds_IC] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-SetProxyPlaybookWS } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodePC" { depends_on = [null_resource.RunSetProxyConfigurationPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltPC" { depends_on = [data.external.CheckAnsibleReturnCodePC] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodePC.result.found}\" = \"1\" ] && echo \"Configuring WebStudio as Proxy: Everything OK\" || { echo \"Configuring WebStudio as Proxy failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_PC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltPC] create_duration = "10s" } ##### End of initial configurationExample Ansible Playbook for deploying and configuring Web Studio and all needed further configurations: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the Web Studio Server - name: Configure the WebStudio Server initially hosts: cvad-ws-v vars_files: - ./vars-ws.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ ws_req_roles }}" state: present register: requirements become: true become_method: runas become_user: SYSTEM - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 4, 3010] creates_path: C:\ProgramData\Citrix\WebStudio Install register: ws_install become: true become_method: runas become_user: "{{ ansible_domainuser }}" - name: Reboot after ws ansible.windows.win_reboot: when: ws_install.changedExample Ansible Playbook for configuring Web Studio as Proxy: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Configure WS as Proxy - name: Configure WebStudio as Proxy hosts: cvad-ws gather_facts: no tasks: - name: Run PS to enable Proxy Mode ansible.windows.win_powershell: script: | & "c:\Program Files\Citrix\Web Studio\Tool\StudioConfig.exe" --enableproxy --proxyserver "tf-cvad-v-ws.the-austrian-citrix-guy.at" register: runps - name: Print results ansible.builtin.debug: var: runpsRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_InstallWebStudio$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleWSAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleWSAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleWSAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Creation complete after 1s [id=8218302926752497323] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-18T07:52:23Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForWS.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the WebStudio Server initially] ******************************** null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ws.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [09m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook: Still creating... [09m30s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [18m40s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Message Queuing", "id": 49, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Server", "id": 191, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Services", "id": 190, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 (includes .NET 2.0 and 3.0)", "id": 220, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 Features", "id": 475, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Activation", "id": 421, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing (MSMQ) Activation", "id": 422, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Named Pipe Activation", "id": 423, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "TCP Activation", "id": 424, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Telnet Client", "id": 44, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Process Activation Service", "id": 41, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Configuration APIs", "id": 217, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Process Model", "id": 219, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Initialization", "id": 445, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP", "id": 150, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Basic Authentication", "id": 163, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "CGI", "id": 151, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Dynamic Content Compression", "id": 173, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Redirection", "id": 146, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Tracing", "id": 159, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Server Side Includes", "id": 154, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Logging Tools", "id": 157, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Metabase Compatibility", "id": 179, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Management Compatibility", "id": 178, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Scripts and Tools", "id": 176, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 WMI Compatibility", "id": 180, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [18m50s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [22m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after sf] ********************************************************* null_resource.RunInitialPlaybook: Still creating... [22m30s elapsed] null_resource.RunInitialPlaybook: Still creating... [22m40s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-v-ws.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 23, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-v-ws.the-austrian-citrix-guy.at : ok=11 changed=9 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 22m45s [id=7191293509250199804] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying WebStudio: Everything OK\" || { echo \"Deploying the WebStudio software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying WebStudio: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=416418525198442619] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_InstallWebStudio$After successful deployment, the Web Studio server is now installed and ready. We can continue with the next step. Part 7: Using Terraform and Ansible to change the SSL BindingsWe want to configure all transport in our environment as securely as possible. Therefore, Terraform and Ansible take additional steps to configure all SSL bindings across all servers and listeners to enable complete HTTPS communication. Where applicable, the SSL certificate is changed to a publicly signed certificate to avoid certificate trust errors. The change is applied by a PowerShell script, which Ansible runs on each applicable host. To obtain all required elevated privileges, we use PsExec64.exe as the host to run the PowerShell scripts. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-Ansible port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Playbook-Destination } } #### Copy the required PowerShell Scripts to the DDC1 resource "null_resource" "CopyPowerShellScriptsToDDC1" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-DDC1 port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the DDC1 provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the DDC1 provisioner "file" { source = var.TACG-TMM-VSP-CL-PsExec64-Source destination = var.TACG-TMM-VSP-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the DDC2 resource "null_resource" "CopyPowerShellScriptsToDDC2" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-DDC2 port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the DDC2 provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the DDC2 provisioner "file" { source = var.TACG-TMM-VSP-CL-PsExec64-Source destination = var.TACG-TMM-VSP-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the SF resource "null_resource" "CopyPowerShellScriptsToSF" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-SF port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the SF provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the SF provisioner "file" { source = var.TACG-TMM-VSP-CL-PsExec64-Source destination = var.TACG-TMM-VSP-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the WS resource "null_resource" "CopyPowerShellScriptsToWS" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-WS port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the WS provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the WS provisioner "file" { source = var.TACG-TMM-VSP-CL-PsExec64-Source destination = var.TACG-TMM-VSP-CL-PsExec64-Destination } } resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSiteAssetsToAnsibleServer, null_resource.CopyPowerShellScriptsToDDC1] create_duration = "10s" } ##### Change the SSL Bindings Start ##### Connect to Ansible Interpreter and run ChangeSSLOnServers-Playbook resource "null_resource" "RunChangeSSLPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-ChangeSSLOnServers-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunChangeSSLPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Change SSL Bindings - Everything OK\" || { echo \"Changing the SSL bindings failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### Change the SSL Bindings EndExample Ansible Playbook for changing the SSL bindings on the DDCs: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Change SSL Certificate bindings to the previously uploaded public SSL Certificate by running a PowerShell script on all CVAD servers - name: Change SSL Certificate bindings hosts: cvad-ddcs-v gather_facts: no collections: - community.windows vars: domain_user: "TACG\\XxXxXxXxX" domain_pass: "!XxXxXxXxXxXxXxXxX!" psexec_path: "C:\\InstallCVAD\\PsExec64.exe" remote_script: "C:\\InstallCVAD\\ChangeSSLOnServers.ps1" ansible_user: "svc_ansible" ansible_password: „!XxXxXxXxXxXxXxXxX!“ ansible_connection: winrm ansible_winrm_transport: certificate tasks: - name: Run the ChangeSSLOnDDCs-PowerShell script as Domain Administrator community.windows.win_psexec: command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{{ remote_script }}" #hostnames: # - "{{ target_host }}" executable: "{{ psexec_path }}" username: "{{ domain_user }}" password: "{{ domain_pass }}" elevated: true noprofile: true interactive: true wait: trueExample PowerShell script to change the SSL bindings: Try { $friendlyName = "*.the-austrian-citrix-guy.at" $Thumbprint = (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.FriendlyName -eq $friendlyName}).Thumbprint -join ';' $ThumbprintC = ($ThumbPrint.Replace(" ","")) netsh http delete sslcert ipport=0.0.0.0:443 $NGuid = [guid]::NewGuid().ToString("B") netsh http add sslcert ipport=0.0.0.0:443 certhash=$ThumbprintC appid=$NGuid disablelegacytls=enable netsh http show sslcert } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ChangeSSLCertificateBindings: Error: $errorMessage" Write-Output "An error occurred trying to change the SSL-Certificate bindings (error: $($Error[0]))" Exit 1 }Running the snippet should fulfill all needed steps – example for running it on the DDCs: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_ChangeSSLOnServers$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSiteAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC1 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC1" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC2 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC2" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToSF will be created + resource "null_resource" "CopyPowerShellScriptsToSF" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToWS will be created + resource "null_resource" "CopyPowerShellScriptsToWS" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunChangeSSLPlaybook will be created + resource "null_resource" "RunChangeSSLPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 8 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creating... null_resource.CopyPowerShellScriptsToWS: Creating... null_resource.CopyPowerShellScriptsToDDC1: Creating... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToWS: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToSF: Creating... null_resource.CopyPowerShellScriptsToDDC2: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC2: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToSF: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creation complete after 0s [id=8882922836300404953] #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> ... null_resource.CopyPowerShellScriptsToDDC1: Creation complete after 10s [id=4814951330333809760] null_resource.CopyPowerShellScriptsToSF: Creation complete after 10s [id=6247443398511140586] null_resource.CopyPowerShellScriptsToDDC2: Creation complete after 10s [id=4396737003381006003] ... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-13T12:24:08Z] null_resource.RunChangeSSLPlaybook: Creating... null_resource.RunChangeSSLPlaybook: Provisioning with 'local-exec'... null_resource.RunChangeSSLPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeSSLOnServers.ansible.yml -i /etc/ansible/assets/inventory.ini -vvv -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunChangeSSLPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunChangeSSLPlaybook (local-exec): PLAYBOOK: ChangeSSLOnServers.ansible.yml *************************************** null_resource.RunChangeSSLPlaybook (local-exec): 1 plays in /etc/ansible/assets/ChangeSSLOnServers.ansible.yml null_resource.RunChangeSSLPlaybook (local-exec): PLAY [Change SSL Certificate bindings] ***************************************** null_resource.RunChangeSSLPlaybook (local-exec): TASK [Run the ChangeSSLOnDDCs-PowerShell script as Domain Administrator] ******* null_resource.RunChangeSSLPlaybook (local-exec): task path: /etc/ansible/assets/ChangeSSLOnServers.ansible.yml:26 null_resource.RunChangeSSLPlaybook (local-exec): Using module file /usr/lib/python3/dist-packages/ansible_collections/community/windows/plugins/modules/win_psexec.ps1 null_resource.RunChangeSSLPlaybook (local-exec): Pipelining is enabled. null_resource.RunChangeSSLPlaybook (local-exec): <tf-cvad-v-ddc1.the-austrian-citrix-guy.at> ESTABLISH WINRM CONNECTION FOR USER: svc_ansible on PORT 5986 TO tf-cvad-v-ddc1.the-austrian-citrix-guy.at null_resource.RunChangeSSLPlaybook (local-exec): EXEC (via pipeline wrapper) null_resource.RunChangeSSLPlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => { null_resource.RunChangeSSLPlaybook (local-exec): "changed": true, null_resource.RunChangeSSLPlaybook (local-exec): "delta": "0:00:01.130213", null_resource.RunChangeSSLPlaybook (local-exec): "end": "2025-11-13 12:24:09.735282", null_resource.RunChangeSSLPlaybook (local-exec): "invocation": { null_resource.RunChangeSSLPlaybook (local-exec): "module_args": { null_resource.RunChangeSSLPlaybook (local-exec): "chdir": null, null_resource.RunChangeSSLPlaybook (local-exec): "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\ChangeSSLOnServers.ps1\"", null_resource.RunChangeSSLPlaybook (local-exec): "elevated": true, null_resource.RunChangeSSLPlaybook (local-exec): "executable": "C:\\InstallCVAD\\PsExec64.exe", null_resource.RunChangeSSLPlaybook (local-exec): "hostnames": null, null_resource.RunChangeSSLPlaybook (local-exec): "interactive": true, null_resource.RunChangeSSLPlaybook (local-exec): "limited": false, null_resource.RunChangeSSLPlaybook (local-exec): "nobanner": false, null_resource.RunChangeSSLPlaybook (local-exec): "noprofile": true, null_resource.RunChangeSSLPlaybook (local-exec): "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", null_resource.RunChangeSSLPlaybook (local-exec): "priority": null, null_resource.RunChangeSSLPlaybook (local-exec): "session": null, null_resource.RunChangeSSLPlaybook (local-exec): "system": false, null_resource.RunChangeSSLPlaybook (local-exec): "timeout": null, null_resource.RunChangeSSLPlaybook (local-exec): "username": "TACG\\administrator", null_resource.RunChangeSSLPlaybook (local-exec): "wait": true null_resource.RunChangeSSLPlaybook (local-exec): } null_resource.RunChangeSSLPlaybook (local-exec): }, null_resource.RunChangeSSLPlaybook (local-exec): "psexec_command": "C:\\InstallCVAD\\PsExec64.exe -u TACG\\administrator -p *PASSWORD_REPLACED* -e -h -i -accepteula powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\ChangeSSLOnServers.ps1\"", null_resource.RunChangeSSLPlaybook (local-exec): "rc": 0, null_resource.RunChangeSSLPlaybook (local-exec): "start": "2025-11-13 12:24:08.605068", null_resource.RunChangeSSLPlaybook (local-exec): "stderr": "Connecting to local system...\r\r\rStarting PSEXESVC service on local system...\r\r\rCopying authentication key to TF-CVAD-V-DDC1...\r\r\rConnecting with PsExec service on TF-CVAD-V-DDC1...\r\r\rStarting powershell.exe on TF-CVAD-V-DDC1...\r\r\r\r\npowershell.exe exited on TF-CVAD-V-DDC1 with error code 0.\r\n", null_resource.RunChangeSSLPlaybook (local-exec): "stderr_lines": [ null_resource.RunChangeSSLPlaybook (local-exec): "Connecting to local system...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Starting PSEXESVC service on local system...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Copying authentication key to TF-CVAD-V-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Connecting with PsExec service on TF-CVAD-V-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Starting powershell.exe on TF-CVAD-V-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "powershell.exe exited on TF-CVAD-V-DDC1 with error code 0." null_resource.RunChangeSSLPlaybook (local-exec): ], null_resource.RunChangeSSLPlaybook (local-exec): "stdout": "\r\nPsExec v2.43 - Execute processes remotely\r\nCopyright (C) 2001-2023 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\n", null_resource.RunChangeSSLPlaybook (local-exec): "stdout_lines": [ null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "PsExec v2.43 - Execute processes remotely", null_resource.RunChangeSSLPlaybook (local-exec): "Copyright (C) 2001-2023 Mark Russinovich", null_resource.RunChangeSSLPlaybook (local-exec): "Sysinternals - www.sysinternals.com", null_resource.RunChangeSSLPlaybook (local-exec): "" null_resource.RunChangeSSLPlaybook (local-exec): ] null_resource.RunChangeSSLPlaybook (local-exec): } null_resource.RunChangeSSLPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunChangeSSLPlaybook (local-exec): tf-cvad-v-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunChangeSSLPlaybook (local-exec): tf-cvad-v-ddc2.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 ... null_resource.RunChangeSSLPlaybook: Creation complete after 3s [id=6734265951530601448] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Change SSL Bindings - Everything OK\" || { echo \"Changing the SSL bindings failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Change SSL Bindings - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=5221894585109127965] Apply complete! Resources: 8 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_ChangeSSLOnServers$ Part 8: Using Terraform and Ansible to create the CVAD site and all its necessitiesCreating the CVAD site, including its requirements and dependencies, is a complex task that involves many steps. Terraform and Ansible together fulfill the following tasks: Create all databases Create the site Add the second DDC to the site Configure additional site configurations Configure a dedicated Administrators group Configure the licensing Before running these tasks, we see that no vSphere-related databases exist on SQL Server, and no site is configured on the primary Delivery Controller: (Remark: the DB-CitrixTF-TACG-CVAD2507-Databases are for the XenServer-based CVAD deployment!) Important: All Terraform configurations and Ansible Playbooks, as well as the corresponding PowerShell scripts, must be run in the Site Administrator´s context – it must be a Domain user account. To obtain all required elevated privileges, we use PsExec64.exe as the host to run the PowerShell scripts. If we do not use the correct user account and privileges, the deployment will fail. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-HostIP port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-AdditionalSiteConfiguration-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-AdditionalSiteConfiguration-Playbook-Destination } # Copy AddSecondDDCToSite Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-AddSecondDDCToSite-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-AddSecondDDCToSite-Playbook-Destination } # Copy ConfigureAdminGroup Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-ConfigureAdminGroup-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-ConfigureAdminGroup-Playbook-Destination } # Copy CreateDatabase Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-CreateDatabase-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-CreateDatabase-Playbook-Destination } # Copy CreateSite Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-CreateSite-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-CreateSite-Playbook-Destination } # Copy SetLicensing Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-VSP-CL-Ansible-SetLicensing-Playbook-Source destination = var.TACG-TMM-VSP-CL-Ansible-SetLicensing-Playbook-Destination } } #### Copy the required PowerShell Scripts to the DDC resource "null_resource" "CopyPowerShellScriptsToDDC1" { connection { type = var.TACG-TMM-VSP-CL-WinRM-Connection-Type user = var.TACG-TMM-VSP-CL-WinRM-Connection-User password = var.TACG-TMM-VSP-CL-WinRM-Connection-Password host = var.TACG-TMM-VSP-CL-WinRM-Connection-HostIP port = var.TACG-TMM-VSP-CL-WinRM-Connection-Port https = var.TACG-TMM-VSP-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-VSP-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-AdditionalSiteConfiguration-Source destination = var.TACG-TMM-VSP-CL-DDC-AdditionalSiteConfiguration-Destination } # Copy AddSecondDDCToSite.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-AddSecondDDCToSite-Source destination = var.TACG-TMM-VSP-CL-DDC-AddSecondDDCToSite-Destination } # Copy ConfigureAdminGroup.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-ConfigureAdminGroup-Source destination = var.TACG-TMM-VSP-CL-DDC-ConfigureAdminGroup-Destination } # Copy CreateDatabase.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-CreateDatabase-Source destination = var.TACG-TMM-VSP-CL-DDC-CreateDatabase-Destination } # Copy CreateSite.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-CreateSite-Source destination = var.TACG-TMM-VSP-CL-DDC-CreateSite-Destination } # Copy SetLicensing.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-SetLicensing-Source destination = var.TACG-TMM-VSP-CL-DDC-SetLicensing-Destination } # Copy PsExec.exe file To the DDC provisioner "file" { source = var.TACG-TMM-VSP-CL-DDC-PsExec-Source destination = var.TACG-TMM-VSP-CL-DDC-PsExec-Destination } } resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSiteAssetsToAnsibleServer, null_resource.CopyPowerShellScriptsToDDC1] create_duration = "10s" } ##### Create Databases Start ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-CreateDatabase-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCDB" { depends_on = [null_resource.RunCreateDatabasePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { depends_on = [data.external.CheckAnsibleReturnCodeCDB] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCDB.result.found}\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_300_secondsCDB" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltCDB] create_duration = "300s" } ##### Create Databases End ##### Create Site Start ##### Connect to Ansible Interpreter and run CreateSite-Playbook on DDCs resource "null_resource" "RunCreateSitePlaybook" { depends_on = [time_sleep.wait_300_secondsCDB] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-CreateSite-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCS" { depends_on = [null_resource.RunCreateSitePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCS" { depends_on = [data.external.CheckAnsibleReturnCodeCS] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCS.result.found}\" = \"1\" ] && echo \"Create Site - Everything OK\" || { echo \"Deploying the CVAD Site failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_60_secondsCS" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltCS] create_duration = "60s" } ##### Create Site End ##### Create SiteAddSecondDDC Start ##### Connect to Ansible Interpreter and run AddSecondDDC-Playbook on DDCs resource "null_resource" "RunAddSecondDDCPlaybook" { depends_on = [time_sleep.wait_60_secondsCS] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-AddSecondDDCToSite-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeSecondDDC" { depends_on = [null_resource.RunAddSecondDDCPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltSecondDDC" { depends_on = [data.external.CheckAnsibleReturnCodeSecondDDC] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeSecondDDC.result.found}\" = \"1\" ] && echo \"Add Second DDC - Everything OK\" || { echo \"Adding second DDC to the CVAD Site failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsSecondDDC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltSecondDDC] create_duration = "10s" } ##### Create SiteAddSecondDDC End ##### Create AdditionalSiteConfiguration Start ##### Connect to Ansible Interpreter and run AdditionalSiteConfiguration-Playbook on DDCs resource "null_resource" "RunAdditionalSiteConfigurationPlaybook" { depends_on = [time_sleep.wait_10_secondsSecondDDC] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-AdditionalSiteConfiguration-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeAdditionalSiteConfiguration" { depends_on = [null_resource.RunAdditionalSiteConfigurationPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration" { depends_on = [data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration.result.found}\" = \"1\" ] && echo \"Additional Site Configuration - Everything OK\" || { echo \"Running the additional Site Configurations failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsAdditionalSiteConfiguration" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration] create_duration = "10s" } ##### Create AdditionalSiteConfiguration End ##### Create ConfigureAdminGroup Start ##### Connect to Ansible Interpreter and run ConfigureAdminGroup-Playbook on DDCs resource "null_resource" "RunConfigureAdminGroupPlaybook" { depends_on = [time_sleep.wait_10_secondsAdditionalSiteConfiguration] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-ConfigureAdminGroup-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeConfigureAdminGroup" { depends_on = [null_resource.RunConfigureAdminGroupPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltConfigureAdminGroup" { depends_on = [data.external.CheckAnsibleReturnCodeConfigureAdminGroup] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeConfigureAdminGroup.result.found}\" = \"1\" ] && echo \"Admin Group Configuration - Everything OK\" || { echo \"Running the Configuration of the AdminGroup failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsConfigureAdminGroup" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltConfigureAdminGroup] create_duration = "10s" } ##### Create ConfigureAdminGroup End ##### Create SetLicensing Start ##### Connect to Ansible Interpreter and run SetLicensing-Playbook on DDCs resource "null_resource" "RunConfigureSetLicensingPlaybook" { depends_on = [time_sleep.wait_10_secondsConfigureAdminGroup] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-VSP-CL-Ansible-SetLicensing-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeSetLicensing" { depends_on = [null_resource.RunConfigureSetLicensingPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltSetLicensing" { depends_on = [data.external.CheckAnsibleReturnCodeSetLicensing] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeSetLicensing.result.found}\" = \"1\" ] && echo \"Licensing Configuration - Everything OK\" || { echo \"Configuration of Licensing failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### Create SetLicensing EndExample Ansible Playbook calling the corresponding PowerShell script in PsExec64.exe for creating the needed databases: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Create CVAD Databases by running a PowerShell script on DDC1 - name: Create CVAD Databases hosts: cvad-ddc1-v gather_facts: no collections: - community.windows vars: domain_user: "TACG\\XxXxXxXxXxXxX" domain_pass: "!XxXxXxXxXxXxXxXxX!" psexec_path: "C:\\InstallCVAD\\PsExec64.exe" target_host: "tf-cvad-v-ddc1.the-austrian-citrix-guy.at" remote_script: "C:\\InstallCVAD\\CreateDatabases.ps1" ansible_user: "svc_ansible" ansible_password: "!XxXxXxXxXxXxXxXxX!" ansible_connection: winrm ansible_winrm_transport: certificate tasks: - name: Run the Create Database-PowerShell script as Domain Administrator community.windows.win_psexec: command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{{ remote_script }}" executable: "{{ psexec_path }}" username: "{{ domain_user }}" password: "{{ domain_pass }}" elevated: true noprofile: true interactive: true wait: trueExample PowerShell script for creating the required databases: Import-Module Citrix.XenDesktop®.Admin asnp citrix.* $SiteName = "TF-TACG-CVAD2507" $DatabaseServer = "tacg-sql.the-austrian-citrix-guy.at" $DDCName = "tf-cvad-v-ddc1.the-austrian-citrix-guy.at" $DatabasePrefix = "DB-" try { New-XDDatabase -AdminAddress $DDCName -SiteName $SiteName -AllDefaultDatabases -DatabaseServer $DatabaseServer -DatabaseNamePrefix $DatabasePrefix -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - CreateDB: Error: $errorMessage" Write-Output "An error occurred trying to create the databases (error: $($Error[0]))" Exit 1 } Note: The corresponding Ansible Playbooks for all the needed steps mentioned above are mostly the same – they differ only in running the feasible PowerShell script. Example PowerShell script for creating the CVAD site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $SiteName = "TF-TACG-CVAD2507-V" $DatabaseServer = "tacg-sql.the-austrian-citrix-guy.at" $DatabaseName_Site = "DB-CitrixTF-TACG-CVAD2507-VSite" $DatabaseName_Logging = "DB-CitrixTF-TACG-CVAD2507-VLogging" $DatabaseName_Monitoring = "DB-CitrixTF-TACG-CVAD2507-VMonitoring" $DDCName = "tf-cvad-v-ddc1.the-austrian-citrix-guy.at" try { New-XDSite -DatabaseServer $DatabaseServer -LoggingDatabaseName $DatabaseName_Logging -MonitorDatabaseName $DatabaseName_Monitoring -SiteDatabaseName $DatabaseName_Site -SiteName $SiteName -AdminAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - CreateSite: Error: $errorMessage" Write-Output "An error occurred trying to create the CVAD site (error: $($Error[0]))" Exit 1 } Example PowerShell script for adding the second DDC to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-v-ddc1.the-austrian-citrix-guy.at" $NewDDCName = "TF-CVAD-V-DDC2.the-austrian-citrix-guy.at" try { Add-XDController -AdminAddress $NewDDCName -SiteControllerAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - Add2ndDDC: Error: $errorMessage" Write-Output "An error occurred trying to add the 2nd DDC (error: $($Error[0]))" Exit 1 }Example PowerShell script for running additional site configurations: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $GroomingDays = 90 try { Set-MonitorConfiguration -GroomApplicationInstanceRetentionDays $GroomingDays -GroomDeletedRetentionDays $GroomingDays -GroomFailuresRetentionDays $GroomingDays -GroomLoadIndexesRetentionDays $GroomingDays -GroomMachineHotfixLogRetentionDays $GroomingDays -GroomNotificationLogRetentionDays $GroomingDays -GroomResourceUsageDayDataRetentionDays $GroomingDays -GroomSessionsRetentionDays $GroomingDays -GroomSummariesRetentionDays $GroomingDays Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true Set-BrokerSite -ConnectionLeasingEnabled $false Set-BrokerSite -LocalHostCacheEnabled $true Set-AnalyticsSite -Enabled $false } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - AdditionalSiteConfiguration: Error: $errorMessage" Write-Output "An error occurred trying to run the additional Site configuration (error: $($Error[0]))" Exit 1 }Example PowerShell script for adding a dedicated Administrators group to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-v-ddc1.the-austrian-citrix-guy.at" $AdminGroup = "TACG-CTX-Admins" try { New-AdminAdministrator -AdminAddress $DDCName -Name $AdminGroup Add-AdminRight -AdminAddress $DDCName -Administrator $AdminGroup -Role 'Full Administrator' -Scope "All" } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ConfigureCTXAdminGroup: Error: $errorMessage" Write-Output "An error occurred trying to run the CTXAdminGroup script (error: $($Error[0]))" Exit 1 }Example PowerShell script for configuring the Licensing: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-v-ddc1.the-austrian-citrix-guy.at" $LicenseServer = "tacg-dc.the-austrian-citrix-guy.at" $LicenseServerPort = 27000 $LicensingModel = "UserDevice" $ProductCode = "XDT" $ProductEdition = "PLT" try { Set-XDLicensing -AdminAddress $DDCName -LicenseServerAddress $LicenseServer -LicenseServerPort $LicenseServerPort -Force Set-ConfigSite -AdminAddress $DDCName -LicensingModel $LicensingModel -ProductCode $ProductCode -ProductEdition $ProductEdition -UseLicenseActivationService $true Set-ConfigSiteMetadata -AdminAddress $DDCName -Name 'CertificateHash' -Value $(Get-LicCertificate -AdminAddress "https://$($LicenseServer):8083").CertHash } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ConfigureLicensing: Error: $errorMessage" Write-Output "An error occurred trying to run the ConfigureLicensing script (error: $($Error[0]))" Exit 1 }Running the snippet should fulfill all the steps mentioned above and create the CVAD site: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_ConfigureSite$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeAdditionalSiteConfiguration" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeCDB will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeCDB" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeCS will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeCS" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeConfigureAdminGroup will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeConfigureAdminGroup" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeSecondDDC will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeSecondDDC" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeSetLicensing will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeSetLicensing" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSiteAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC1 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC1" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltCDB will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltCS will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltCS" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltConfigureAdminGroup will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltConfigureAdminGroup" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltSecondDDC will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltSecondDDC" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltSetLicensing" { + id = (known after apply) } # null_resource.RunAddSecondDDCPlaybook will be created + resource "null_resource" "RunAddSecondDDCPlaybook" { + id = (known after apply) } # null_resource.RunAdditionalSiteConfigurationPlaybook will be created + resource "null_resource" "RunAdditionalSiteConfigurationPlaybook" { + id = (known after apply) } # null_resource.RunConfigureAdminGroupPlaybook will be created + resource "null_resource" "RunConfigureAdminGroupPlaybook" { + id = (known after apply) } # null_resource.RunConfigureSetLicensingPlaybook will be created + resource "null_resource" "RunConfigureSetLicensingPlaybook" { + id = (known after apply) } # null_resource.RunCreateDatabasePlaybook will be created + resource "null_resource" "RunCreateDatabasePlaybook" { + id = (known after apply) } # null_resource.RunCreateSitePlaybook will be created + resource "null_resource" "RunCreateSitePlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsAdditionalSiteConfiguration will be created + resource "time_sleep" "wait_10_secondsAdditionalSiteConfiguration" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsConfigureAdminGroup will be created + resource "time_sleep" "wait_10_secondsConfigureAdminGroup" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsSecondDDC will be created + resource "time_sleep" "wait_10_secondsSecondDDC" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_300_secondsCDB will be created + resource "time_sleep" "wait_300_secondsCDB" { + create_duration = "300s" + id = (known after apply) } # time_sleep.wait_60_secondsCS will be created + resource "time_sleep" "wait_60_secondsCS" { + create_duration = "60s" + id = (known after apply) } Plan: 20 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPowerShellScriptsToDDC1: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creation complete after 1s [id=3364084582988389224] time_sleep.wait_10_seconds: Creating... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> ... null_resource.CopyPowerShellScriptsToDDC1: Creation complete after 10s [id=6861429796874371568] time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-18T16:58:47Z] null_resource.RunCreateDatabasePlaybook: Creating... null_resource.RunCreateDatabasePlaybook: Provisioning with 'local-exec'... null_resource.RunCreateDatabasePlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/CreateDatabases.ansible.yml -i /etc/ansible/assets/inventory.ini -vvv -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunCreateDatabasePlaybook (local-exec): PLAYBOOK: CreateDatabases.ansible.yml ****************************************** null_resource.RunCreateDatabasePlaybook (local-exec): 1 plays in /etc/ansible/assets/CreateDatabases.ansible.yml null_resource.RunCreateDatabasePlaybook (local-exec): PLAY [Run PowerShell script on Windows Server as Domain Admin] ***************** null_resource.RunCreateDatabasePlaybook (local-exec): TASK [Run the StoreFront installer PowerShell script as domain user] *********** null_resource.RunCreateDatabasePlaybook (local-exec): task path: /etc/ansible/assets/CreateDatabases.ansible.yml:20 null_resource.RunCreateDatabasePlaybook (local-exec): Using module file /usr/lib/python3/dist-packages/ansible_collections/community/windows/plugins/modules/win_psexec.ps1 null_resource.RunCreateDatabasePlaybook (local-exec): Pipelining is enabled. null_resource.RunCreateDatabasePlaybook (local-exec): <tf-cvad-v-ddc1.the-austrian-citrix-guy.at> ESTABLISH WINRM CONNECTION FOR USER: svc_ansible on PORT 5986 TO tf-cvad-v-ddc1.the-austrian-citrix-guy.at null_resource.RunCreateDatabasePlaybook (local-exec): EXEC (via pipeline wrapper) null_resource.RunCreateDatabasePlaybook (local-exec): changed: [tf-cvad-v-ddc1.the-austrian-citrix-guy.at] => { null_resource.RunCreateDatabasePlaybook (local-exec): "changed": true, null_resource.RunCreateDatabasePlaybook (local-exec): "delta": "0:00:32.533635", null_resource.RunCreateDatabasePlaybook (local-exec): "end": "2025-11-12 04:59:20.201075", null_resource.RunCreateDatabasePlaybook (local-exec): "invocation": { null_resource.RunCreateDatabasePlaybook (local-exec): "module_args": { null_resource.RunCreateDatabasePlaybook (local-exec): "chdir": null, null_resource.RunCreateDatabasePlaybook (local-exec): "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\CreateDatabases.ps1\"", null_resource.RunCreateDatabasePlaybook (local-exec): "elevated": true, null_resource.RunCreateDatabasePlaybook (local-exec): "executable": "C:\\InstallCVAD\\PsExec64.exe", null_resource.RunCreateDatabasePlaybook (local-exec): "hostnames": null, null_resource.RunCreateDatabasePlaybook (local-exec): "interactive": true, null_resource.RunCreateDatabasePlaybook (local-exec): "limited": false, null_resource.RunCreateDatabasePlaybook (local-exec): "nobanner": false, null_resource.RunCreateDatabasePlaybook (local-exec): "noprofile": true, null_resource.RunCreateDatabasePlaybook (local-exec): "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", null_resource.RunCreateDatabasePlaybook (local-exec): "priority": null, null_resource.RunCreateDatabasePlaybook (local-exec): "session": null, null_resource.RunCreateDatabasePlaybook (local-exec): "system": false, null_resource.RunCreateDatabasePlaybook (local-exec): "timeout": null, null_resource.RunCreateDatabasePlaybook (local-exec): "username": "TACG\\administrator", null_resource.RunCreateDatabasePlaybook (local-exec): "wait": true null_resource.RunCreateDatabasePlaybook (local-exec): } null_resource.RunCreateDatabasePlaybook (local-exec): }, null_resource.RunCreateDatabasePlaybook (local-exec): "psexec_command": "C:\\InstallCVAD\\PsExec64.exe -u TACG\\administrator -p *PASSWORD_REPLACED* -e -h -i -accepteula powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\CreateDatabases.ps1\"", null_resource.RunCreateDatabasePlaybook (local-exec): "rc": 0, null_resource.RunCreateDatabasePlaybook (local-exec): "start": "2025-11-12 04:58:47.667440", null_resource.RunCreateDatabasePlaybook (local-exec): "stderr": "Connecting to local system...\r\r\rStarting PSEXESVC service on local system...\r\r\rCopying authentication key to TF-CVAD-V-DDC1...\r\r\rConnecting with PsExec service on TF-CVAD-V-DDC1...\r\r\rStarting powershell.exe on TF-CVAD-V-DDC1...\r\r\r\r\npowershell.exe exited on TF-CVAD-V-DDC1 with error code 0.\r\n", null_resource.RunCreateDatabasePlaybook (local-exec): "stderr_lines": [ null_resource.RunCreateDatabasePlaybook (local-exec): "Connecting to local system...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Starting PSEXESVC service on local system...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Copying authentication key to TF-CVAD-V-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Connecting with PsExec service on TF-CVAD-V-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Starting powershell.exe on TF-CVAD-V-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "powershell.exe exited on TF-CVAD-V-DDC1 with error code 0." null_resource.RunCreateDatabasePlaybook (local-exec): ], null_resource.RunCreateDatabasePlaybook (local-exec): "stdout": "\r\nPsExec v2.43 - Execute processes remotely\r\nCopyright (C) 2001-2023 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\n", null_resource.RunCreateDatabasePlaybook (local-exec): "stdout_lines": [ null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "PsExec v2.43 - Execute processes remotely", null_resource.RunCreateDatabasePlaybook (local-exec): "Copyright (C) 2001-2023 Mark Russinovich", null_resource.RunCreateDatabasePlaybook (local-exec): "Sysinternals - www.sysinternals.com", null_resource.RunCreateDatabasePlaybook (local-exec): "" null_resource.RunCreateDatabasePlaybook (local-exec): ] null_resource.RunCreateDatabasePlaybook (local-exec): } null_resource.RunCreateDatabasePlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunCreateDatabasePlaybook (local-exec): tf-cvad-v-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunCreateDatabasePlaybook: Creation complete after 35s [id=5576848404034541586] data.external.CheckAnsibleReturnCodeCDB: Reading... data.external.CheckAnsibleReturnCodeCDB: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltCDB: Creating... null_resource.IfExitCodeIsNotZeroThenHaltCDB: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltCDB (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltCDB (local-exec): Create Databases - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltCDB: Creation complete after 0s [id=449387280135483830] ... Running all Playbooks looks similar, omitted due to the length of the output. ... null_resource.RunConfigureSetLicensingPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunConfigureSetLicensingPlaybook (local-exec): tf-cvad-v-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunConfigureSetLicensingPlaybook: Creation complete after 13s [id=5106544801416722566] data.external.CheckAnsibleReturnCodeSetLicensing: Reading... data.external.CheckAnsibleReturnCodeSetLicensing: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Creating... null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Licensing Configuration - Everything OK\" || { echo \"Configuration of Licensing failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing (local-exec): Licensing Configuration - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Creation complete after 0s [id=1454545395290283154] Apply complete! Resources: 26 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_ConfigureSite$The Terraform snippet has successfully created the site and all needed configurations: The CVAD databases for the vSphere-based deployment were created: The CVAD site was successfully created: All site tests are successful: With the CVAD site ready, we can proceed to the next step. Part 9: Using Terraform to create the StoreFront deployment and all its necessitiesCreating a StoreFront deployment is a simple, straightforward task. Terraform can create the Storefront site on its own – no Ansible interaction is needed. Caution: As already mentioned, this module, Module 9, must be run on a Windows-based, domain-joined VM due to limitations in StoreFront´s automation capabilities. Terraform will sequentially run the following tasks: Create the StoreFront deployment Create a StoreFront Authentication service Create a StoreFront Store service Create a StoreFront WebReceiver service Warning: The current Automation snippets of StoreFront will only run on Windows Powershell <=5.1. They will not run on Powershell >=6. Be sure to start the Terraform code on the correct PowerShell version. You may encounter this error after starting the Terraform snippet: Error: Error fetching StoreFront version │ │ with citrix_stf_webreceiver_service.CreateSFWebReceiverService, │ on CVADOnXS-ConfigureStoreFront.tf line 48, in resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService": │ 48: resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { │ │ Error message: error executing command: Get-STFVersion │ Error Message: │ ConvertTo-SecureString : "ConvertTo-SecureString" was found in module "Microsoft.PowerShell.Security", │ we were unable to load the module. Run "Import-Module │ Microsoft.PowerShell.Security". │ In row:1 column:205 │ + ... n@the-austrian-citrix-guy.at',(ConvertTo-SecureString -Force ... │ + ~~~~~~~~~~~~~~~~~~~~~~ │ + CategoryInfo : ObjectNotFound: (ConvertTo-SecureString:String) [], CommandNotFoundException │ + FullyQualifiedErrorId : CouldNotAutoloadMatchingModuleThat error means you have not loaded the module Microsoft.PowerShell.Security in Windows PowerShell. Be sure to load the module in Windows PowerShell, not PowerShell: PS C:\__PPMM\__TF\_CVADOnVSP-25.11\_ConfigureStoreFront> Import-Module Microsoft.PowerShell.Security After loading the module in Windows PowerShell, the error should be gone and the Terraform snippet run through. Before running the snippet, the StoreFront server has no StoreFront site configured: Example Terraform snippet to create a StoreFront site: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of vSphere Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/vmware/vsphere/latest/docs #### Configuring StoreFront ##### Reference https://github.com/citrix/terraform-provider-citrix/blob/main/StoreFront.md ###### Create an initial StoreFront Deployment resource "citrix_stf_deployment" "CreateInitialSFDeployment" { site_id = var.TACG-TMM-SF-SiteID host_base_url = var.TACG-TMM-SF-SiteURL roaming_gateway = [ { name = var.TACG-TMM-SF-Gateway-Name logon_type = var.TACG-TMM-SF-Gateway-LogonType gateway_url = var.TACG-TMM-SF-Gateway-URL callback_url = var.TACG-TMM-SF-Gateway-CallbackURL subnet_ip_address = var.TACG-TMM-SF-Gateway-SNIP secure_ticket_authority_urls = var.TACG-TMM-SF-Gateway-STAs } ] roaming_beacon = { internal_address = var.TACG-TMM-SF-Beacon-Internal external_addresses = var.TACG-TMM-SF-Beacon-External } } ##### Create an Authentication service resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-AuthService-Name virtual_path = var.TACG-TMM-SF-AuthService-Path } ##### Create a Store service resource "citrix_stf_store_service" "CreateSFStoreService" { depends_on = [citrix_stf_authentication_service.CreateSFAuthenticationService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id virtual_path = var.TACG-TMM-SF-StoreService-Path friendly_name = var.TACG-TMM-SF-StoreService-Name authentication_service_virtual_path = citrix_stf_authentication_service.CreateSFAuthenticationService.virtual_path pna = { enable = false } farms = var.TACG-TMM-SF-StoreService-Farms } ##### Create a WebReceiver service resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment, citrix_stf_store_service.CreateSFStoreService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-WebService-Name virtual_path = var.TACG-TMM-SF-WebService-Path store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path authentication_methods = [ "ExplicitForms", "CitrixAGBasic" ] plugin_assistant = { enabled = var.TACG-TMM-SF-WebService-PA-Enabled html5_single_tab_launch = var.TACG-TMM-SF-WebService-PA-HTML5SingleTab upgrade_at_login = var.TACG-TMM-SF-WebService-PA-UpgradeAtLogin html5_enabled = var.TACG-TMM-SF-WebService-PA-HTML5Enabled } application_shortcuts = { prompt_for_untrusted_shortcuts = var.TACG-TMM-SF-WebService-AppSC-Prompt trusted_urls = var.TACG-TMM-SF-WebService-AppSC-TrustedURLs } user_interface = { auto_launch_desktop = var.TACG-TMM-SF-WebService-UI-AutoLaunchDesktop multi_click_timeout = var.TACG-TMM-SF-WebService-UI-Timeout enable_apps_folder_view = var.TACG-TMM-SF-WebService-UI-AppFolderView workspace_control = { enabled = var.TACG-TMM-SF-WebService-UI-WC-Enabled auto_reconnect_at_logon = var.TACG-TMM-SF-WebService-UI-WC-AutoReconnect logoff_action = var.TACG-TMM-SF-WebService-UI-LogoffAction show_reconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowReconnect show_disconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowDisconnect } receiver_configuration = { enabled = var.TACG-TMM-SF-WebService-RC-Enabled } app_shortcuts = { enabled = var.TACG-TMM-SF-WebService-ASC-Enabled show_desktop_shortcut = var.TACG-TMM-SF-WebService-ASC-ShowDesktopShortcut } ui_views = { show_apps_view = var.TACG-TMM-SF-WebService-UIViews-Apps show_desktops_view = var.TACG-TMM-SF-WebService-UIViews-Desktops default_view = var.TACG-TMM-SF-WebService-UIViews-Default } category_view_collapsed = var.TACG-TMM-SF-WebService-CategoryView move_app_to_uncategorized = var.TACG-TMM-SF-WebService-Uncategorized progressive_web_app = { enabled = var.TACG-TMM-SF-WebService-PWA-Enabled show_install_prompt = var.TACG-TMM-SF-WebService-PWA-Install } show_activity_manager = var.TACG-TMM-SF-WebService-ActivityManager show_first_time_use = var.TACG-TMM-SF-WebService-FirstTimeUse prevent_ica_downloads = var.TACG-TMM-SF-WebService-PreventICADownloads } resources_service = { ica_file_cache_expiry = var.TACG-TMM-SF-WebService-RS-IcaFileExpiry persistent_icon_cache_enabled = var.TACG-TMM-SF-WebService-RS-IconCacheEnabled } } ##### A PNA site is not installed due to no effective needs #resource "citrix_stf_xenapp_default_store" "CreateSFXenAppPath" { # depends_on = [citrix_stf_store_service.CreateSFStoreService] # store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path # store_site_id = citrix_stf_store_service.CreateSFStoreService.site_id #}Running the snippet should fulfill all needed steps – during the run, the StoreFront server installs missing roles and features: PS C:\__PPMM\__TF\_CVADOnVSP-25.11\_ConfigureStoreFront> terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_stf_authentication_service.CreateSFAuthenticationService will be created + resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { + claims_factory_name = "standardClaimsFactory" + friendly_name = "TACG-SF-AuthService" + site_id = "1" + virtual_path = "/Citrix/Authentication" } # citrix_stf_deployment.CreateInitialSFDeployment will be created + resource "citrix_stf_deployment" "CreateInitialSFDeployment" { + host_base_url = "https://storefront-v.the-austrian-citrix-guy.at" + roaming_beacon = { + external_addresses = [ + "https://www.orf.at/", + "https://www.microsoft.com/", ] + internal_address = "http://10.10.100.1/" } + roaming_gateway = [ + { + callback_url = "https://access.the-austrian-citrix-guy.at/CitrixAuthService/AuthService.asmx" + gateway_url = "https://access.the-austrian-citrix-guy.at/" + is_cloud_gateway = false + logon_type = "Domain" + name = "TACG-NS" + request_ticket_from_two_stas = false + secure_ticket_authority_urls = [ + { + sta_url = "http://tf-cvad-v-ddc1.the-austrian-citrix-guy.at/scripts/ctxsta.dll" + sta_validation_enabled = false }, + { + sta_url = "http://tf-cvad-v-ddc2.the-austrian-citrix-guy.at/scripts/ctxsta.dll" + sta_validation_enabled = false }, ] + session_reliability = false + smart_card_fallback_logon_type = "None" + stas_bypass_duration = "0.1:0:0" + stas_use_load_balancing = false + subnet_ip_address = "10.10.119.112" + version = "Version10_0_69_4" }, ] + site_id = "1" } # citrix_stf_store_service.CreateSFStoreService will be created + resource "citrix_stf_store_service" "CreateSFStoreService" { + authentication_service_virtual_path = "/Citrix/Authentication" + farms = [ + { + all_failed_bypass_duration = 0 + bypass_duration = 60 + farm_name = "TACG443" + farm_type = "XenDesktop" + load_balance = true + max_failed_servers_per_request = 0 + port = 443 + rade_ticket_time_to_live = 100 + server_urls = [] + servers = [ + "tf-cvad-v-ddc1.the-austrian-citrix-guy.at", + "tf-cvad-v-ddc2.the-austrian-citrix-guy.at", ] + ssl_relay_port = 443 + ticket_time_to_live = 200 + transport_type = "HTTPS" + xml_validation_enabled = false + zones = [] # (4 unchanged attributes hidden) }, ] + friendly_name = "TACG-SF-StoreService" + pna = { + enable = false } + site_id = "1" + virtual_path = "/Citrix/Store" } # citrix_stf_webreceiver_service.CreateSFWebReceiverService will be created + resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { + application_shortcuts = { + gateway_urls = [] + prompt_for_untrusted_shortcuts = true + trusted_urls = [ + "https://storefront-v.the-austrian-citrix-guy.at/", ] } + authentication_methods = [ + "CitrixAGBasic", + "ExplicitForms", ] + friendly_name = "TACG-SF-WebReceiverService" + plugin_assistant = { + enabled = true + html5_enabled = "Fallback" + html5_single_tab_launch = true + show_after_login = false + upgrade_at_login = true } + resources_service = { + ica_file_cache_expiry = 80 + icon_size = 128 + persistent_icon_cache_enabled = true + show_desktop_viewer = true } + site_id = "1" + store_virtual_path = "/Citrix/Store" + user_interface = { + app_shortcuts = { + allow_session_reconnect = false } + auto_launch_desktop = true + category_view_collapsed = false + enable_apps_folder_view = true + move_app_to_uncategorized = true + multi_click_timeout = 3 + prevent_ica_downloads = false + progressive_web_app = { + enabled = false + show_install_prompt = false } + receiver_configuration = { + download_url = (known after apply) + enabled = true } + show_activity_manager = true + show_first_time_use = true + ui_views = { + default_view = "Auto" + show_apps_view = true + show_desktops_view = true } + workspace_control = { + auto_reconnect_at_logon = true + enabled = true + logoff_action = "Disconnect" + show_disconnect_button = false + show_reconnect_button = false } } + virtual_path = "/Citrix/StoreWeb" } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_stf_deployment.CreateInitialSFDeployment: Creating... citrix_stf_deployment.CreateInitialSFDeployment: Still creating... [00m10s elapsed] citrix_stf_deployment.CreateInitialSFDeployment: Still creating... [00m20s elapsed] citrix_stf_deployment.CreateInitialSFDeployment: Creation complete after 25s citrix_stf_authentication_service.CreateSFAuthenticationService: Creating... citrix_stf_authentication_service.CreateSFAuthenticationService: Creation complete after 6s citrix_stf_store_service.CreateSFStoreService: Creating... citrix_stf_store_service.CreateSFStoreService: Still creating... [00m10s elapsed] citrix_stf_store_service.CreateSFStoreService: Creation complete after 16s citrix_stf_webreceiver_service.CreateSFWebReceiverService: Creating... citrix_stf_webreceiver_service.CreateSFWebReceiverService: Still creating... [00m10s elapsed] citrix_stf_webreceiver_service.CreateSFWebReceiverService: Creation complete after 15s Apply complete! Resources: 4 added, 0 changed, 0 destroyed. PS C:\__PPMM\__TF\_CVADOnVSP-25.11\_ConfigureStoreFront>The StoreFront server now has a valid StoreFront site deployed: The StoreFront server now accepts logons: With the StoreFront site ready, we can proceed to the final step: deploying all CVAD-related entities. Important: You can now switch back to the Ubuntu IaC machine or stay on the Windows machine to run the last Terraform snippet. Part 10: Using Terraform to create all CVAD entities and all their necessitiesCreating the final steps is a simple, straightforward task. Terraform can create the CVAD entities site on its own – no Ansible interaction is needed. Create a StoreFront Server object Create a Hypervisor connection Create a Hypervisor connection resource pool Create a Machine Catalog Create a Delivery Group Create a Policy Set and its policies Before running the snippet, no CVAD-related entity is configured: No Hypervisor Connection and Hypervisor Connection pool exist: No Machine Catalog exists: No Delivery Group exists: No dedicated Policy Set exists: Example Terraform snippet to create all needed CVAD entities as mentioned above: # Terraform Deployment of Citrix CVAD on vSphere 8 - 25.11 ## Definition of CVAD Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/citrix/citrix/latest/docs #### Definition of all required local variables or data ##### Get vSphere-related Data data "vsphere_datacenter" "datacenter" { name = var.vsphere_datacenter } data "vsphere_datastore" "datastore" { name = var.vsphere_datastore datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_network" "network" { name = var.vsphere_network datacenter_id = data.vsphere_datacenter.datacenter.id } data "vsphere_host" "host" { name = var.vsphere_host datacenter_id = data.vsphere_datacenter.datacenter.id } ### If a cluster is available, uncomment this block data "vsphere_compute_cluster" "cluster" { name = "TACG" datacenter_id = data.vsphere_datacenter.datacenter.id } ##### Get CVAD-related Data ###### Get the Zone in CVAD data "citrix_zone" "TACG-TMM-CVAD-Zone" { name = var.TACG-TMM-CVAD-Zone-Name } #### Create a StoreFront Server object - we assume a load-balanced server resource "citrix_storefront_server" "CreateSFServer" { name = var.TACG-TMM-SF-Server-Name description = var.TACG-TMM-SF-Server-Description url = var.TACG-TMM-SF-Server-URL enabled = true } #### Create a Hypervisor Connection resource "citrix_vsphere_hypervisor " "TACG-TMM-CVAD-V-HypConn" { depends_on = [data.citrix_zone.TACG-TMM-CVAD-Zone] name = var.TACG-TMM-CVAD-HypConn-Name zone = data.citrix_zone.TACG-TMM-CVAD-Zone.id username = var.VSP-CL-UN password = var.VSP-CL-PW password_format = "PlainText" addresses = var.VSP-CL-IPs } resource "null_resource" "WriteProgress1" { depends_on = [citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn] provisioner "local-exec" { command = "echo The Hypervisor Connection was successfully created..." } } #### Create a Hypervisor Connection Resource Pool resource "citrix_vsphere_hypervisor_resource_pool" "TACG-TMM-CVAD-V-HypConnPool" { depends_on = [citrix_vsphere-hypervisor.TACG-TMM-CVAD-V-HypConn] name = var.TACG-TMM-CVAD-HypConnPool-Name hypervisor = citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn.id networks = [data.vsphere_network.network.data_items[0].name_label] cluster = { datacenter = data.vsphere_datacenter.datacenter.name cluster_name = data.vsphere_compute_cluster.cluster.name } networks = [ data.vsphere_network.network.name, ] storage = [ { storage_name = data.vsphere_datastore.datastore.name } ] temporary_storage = [ { storage_name = data.vsphere_datastore.datastore.name } ] use_local_storage_caching = false } resource "null_resource" "WriteProgress2" { depends_on = [citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool] provisioner "local-exec" { command = "echo The Hypervisor Connection Pool was successfully created..." } } #### Create the Machine Catalog ##### Important: You need to use standard Master Image VMs/Snapshots for creation of a Machine Catalog! resource "citrix_machine_catalog" "TACG-TMM-CVAD-V-MC" { depends_on = [citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool] name = var.TACG-TMM-CVAD-MC-Name description = var.TACG-TMM-CVAD-MC-Description provisioning_type = var.TACG-TMM-CVAD-MC-ProvisioningType allocation_type = var.TACG-TMM-CVAD-MC-AllocationType session_support = var.TACG-TMM-CVAD-MC-SessionType zone = data.citrix_zone.TACG-TMM-CVAD-Zone.id provisioning_scheme = { hypervisor = citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn.id hypervisor_resource_pool = citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool.id identity_type = var.TACG-TMM-CVAD-MC-IdentityType machine_domain_identity = { domain = var.TACG-TMM-CVAD-MC-VM-DomainFQDN domain_ou = var.TACG-TMM-CVAD-MC-VM-DomainOU service_account = var.TACG-TMM-CVAD-MC-VM-ServiceUserName service_account_password = var.TACG-TMM-CVAD-MC-VM-ServiceUserPassword } vsphere_machine_config = { master_image_vm = "${var.CVAD_MC-MasterImageName}" cpu_count = "${var.CVAD_MC-CpuCount}" memory_mb = "${var.CVAD_MC-MemorySize}" image_snapshot = "${var.CVAD_MC-MasterImageSnapshot}" } number_of_total_machines = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs machine_account_creation_rules = { naming_scheme = var.TACG-TMM-CVAD-MC-VM-NamingScheme naming_scheme_type = var.TACG-TMM-CVAD-MC-VM-NamingSchemeType } } } resource "null_resource" "WriteProgress3" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-V-MC] provisioner "local-exec" { command = "echo The Machine Catalog was successfully created..." } } /* data "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { name = var.TACG-TMM-CVAD-MC-Name } */ #### Create the Delivery Group resource "citrix_delivery_group" "TACG-TMM-CVAD-V-DG" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-V-MC, citrix_storefront_server.CreateSFServer] #depends_on = [data.citrix_machine_catalog.TACG-TMM-CVAD-MC] name = var.TACG-TMM-CVAD-DG-Name description = var.TACG-TMM-CVAD-DG-Description minimum_functional_level = var.TACG-TMM-CVAD-DG-FunctionalLevel storefront_servers = [citrix_storefront_server.CreateSFServer.id] associated_machine_catalogs = [ { machine_catalog = citrix_machine_catalog.TACG-TMM-CVAD-V-MC.id #machine_catalog = data.citrix_machine_catalog.TACG-TMM-CVAD-MC.id machine_count = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-CVAD-DG-Desktops-Name description = var.TACG-TMM-CVAD-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } enabled = var.TACG-TMM-CVAD-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC # enable_session_roaming = var.TACG-TMM-CVAD-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-CVAD-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-CVAD-DG-AS-Days display_name = var.TACG-TMM-CVAD-DG-AS-Name peak_time_ranges = var.TACG-TMM-CVAD-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-CVAD-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-CVAD-DG-RS-Enabled frequency = var.TACG-TMM-CVAD-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-CVAD-DG-RS-RebootDays start_time = var.TACG-TMM-CVAD-DG-RS-RebootStartTime start_date = var.TACG-TMM-CVAD-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-CVAD-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-CVAD-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-CVAD-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-CVAD-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-MessageRepeat #} } ] } resource "null_resource" "WriteProgress4" { depends_on = [citrix_delivery_group.TACG-TMM-CVAD-V-DG] provisioner "local-exec" { command = "echo The Delivery Group was successfully created..." } } #### Create a default Policy Set resource "citrix_policy_set_v2" "TACG-TMM-CVAD-V-DefaultPolicySet" { depends_on = [citrix_delivery_group.TACG-TMM-CVAD-V-DG] name = var.TACG-TMM-CVAD-PS-Name description = var.TACG-TMM-CVAD-PS-Description delivery_groups = [citrix_delivery_group.TACG-TMM-CVAD-V-DG.id] } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-Printing" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "Printing" description = "Example of Printer-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-HDX" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "HDX Graphics" description = "Example of HDX Graphics-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-ClientDrives" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "Client Drives" description = "Example of Client Drive-related policy in default Policy Set" enabled = true } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id name = "ClientPrinterAutoCreation" value = "DefaultPrinterOnly" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id name = "UniversalPrintDriverUsage" value = "FallbackToSpecific" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "AllowVisuallyLosslessCompression" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "UseVideoCodecForCompression" value = "UseVideoCodecIfPreferred" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX3" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "UseHardwareEncodingForVideoCodec" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "AutoConnectDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientDriveRedirection" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD3" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientFixedDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD4" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientFloppyDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD5" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientOpticalDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD6" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientNetworkDrives" enabled = false use_default = false } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } resource "null_resource" "WriteProgress5" { depends_on = [citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2] provisioner "local-exec" { command = "echo The default Policy Set and its policies and filters were successfully created..." } }Running the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_CreateCitrixEntities$ terraform apply data.vsphere_datacenter.datacenter: Reading... data.vsphere_datacenter.datacenter: Read complete after 0s [id=datacenter-3] data.vsphere_host.host: Reading... data.vsphere_datastore.datastore: Reading... data.vsphere_compute_cluster.cluster: Reading... data.vsphere_network.network: Reading... data.vsphere_network.network: Read complete after 0s [id=network-12] data.vsphere_datastore.datastore: Read complete after 0s [id=datastore-11] data.vsphere_host.host: Read complete after 0s [id=host-8] data.vsphere_compute_cluster.cluster: Read complete after 0s [id=domain-c17] data.citrix_zone.TACG-TMM-CVAD-V-Zone: Reading... data.citrix_zone.TACG-TMM-CVAD-V-Zone: Read complete after 0s [id=31fbc844-779f-4dc9-88f5-05f6de165187] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_machine_catalog.TACG-TMM-CVAD-V-MC will be created + resource "citrix_machine_catalog" "TACG-TMM-CVAD-V-MC" { + allocation_type = "Static" + built_in_scopes = (known after apply) + delete_machine_accounts = "None" + description = "Terraform-created Machine Catalog for TACG running on XS8-Cluster" + id = (known after apply) + inherited_scopes = (known after apply) + minimum_functional_level = "L7_20" + name = "TACG-TMM-CVAD-VSP-MC" + persist_user_changes = (known after apply) + provisioning_scheme = { + hypervisor = (known after apply) + hypervisor_resource_pool = (known after apply) + identity_type = "ActiveDirectory" + machine_account_creation_rules = { + naming_scheme = "tf-mcs-v-w11-#" + naming_scheme_type = "Numeric" } + machine_domain_identity = { + domain = "the-austrian-citrix-guy.at" + domain_ou = "OU=_COMPUTER,OU=TACG-CVAD,DC=the-austrian-citrix-guy,DC=at" + service_account = (sensitive value) + service_account_password = (sensitive value) } + number_of_total_machines = 2 + vsphere_machine_config = { + cpu_count = 2 + image_snapshot = "V1" + master_image_note = "" + master_image_vm = "win11-p01" + memory_mb = 4096 + resource_pool_path = "" + use_full_disk_clone_provisioning = false } } + provisioning_type = "MCS" + scopes = [] + session_support = "SingleSession" + tenants = (known after apply) + zone = "31fbc844-779f-4dc9-88f5-05f6de165187" } # citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn will be created + resource "citrix_vsphere_hypervisor" "TACG-TMM-CVAD-V-HypConn" { + addresses = [ + (sensitive value), ] + id = (known after apply) + max_absolute_active_actions = 20 + max_absolute_new_actions_per_minute = 10 + max_power_actions_percentage_of_machines = 20 + name = "TACG-TMM-CVAD-VSP-Cluster" + password = (sensitive value) + password_format = "PlainText" + scopes = [] + tenants = (known after apply) + username = (sensitive value) + zone = "31fbc844-779f-4dc9-88f5-05f6de165187" } # citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool will be created + resource "citrix_vsphere_hypervisor_resource_pool" "TACG-TMM-CVAD-V-HypConnPool" { + cluster = { + cluster_name = "TACG" + datacenter = (sensitive value) } + hypervisor = (known after apply) + id = (known after apply) + name = "TACG-TMM-CVAD-VSP-Cluster" + networks = [ + (sensitive value), ] + storage = [ + { + storage_name = (sensitive value) + superseded = false }, ] + temporary_storage = [ + { + storage_name = (sensitive value) + superseded = false }, ] + use_local_storage_caching = false + vm_tagging = true } # null_resource.WriteProgress2 will be created + resource "null_resource" "WriteProgress2" { + id = (known after apply) } # null_resource.WriteProgress3 will be created + resource "null_resource" "WriteProgress3" { + id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_delivery_group.TACG-TMM-CVAD-V-DG will be created + resource "citrix_delivery_group" "TACG-TMM-CVAD-V-DG" { + associated_machine_catalogs = [ + { + machine_catalog = "bf005a81-2235-4f6a-af65-bccf431a0b31" + machine_count = 2 }, ] + autoscale_settings = { + autoscale_enabled = true + disconnect_off_peak_idle_session_after_seconds = 0 + disconnect_peak_idle_session_after_seconds = 0 + log_off_off_peak_disconnected_session_after_seconds = 0 + log_off_peak_disconnected_session_after_seconds = 0 + log_off_reminder_enabled = false + log_off_reminder_message = "" + log_off_reminder_title = "" + log_off_warning_message = "" + log_off_warning_title = "" + off_peak_buffer_size_percent = 0 + off_peak_disconnect_action = "Suspend" + off_peak_disconnect_timeout_minutes = 5 + off_peak_extended_disconnect_action = "Nothing" + off_peak_extended_disconnect_timeout_minutes = 0 + off_peak_limit_seconds_to_force_log_off_user = 0 + off_peak_log_off_action = "Suspend" + off_peak_log_off_reminder_interval = 0 + off_peak_log_off_timeout_minutes = 5 + peak_autoscale_assigned_power_on_idle_action = "Nothing" + peak_autoscale_assigned_power_on_idle_timeout_minutes = 0 + peak_buffer_size_percent = 0 + peak_disconnect_action = "Suspend" + peak_disconnect_timeout_minutes = 5 + peak_extended_disconnect_action = "Nothing" + peak_extended_disconnect_timeout_minutes = 0 + peak_limit_seconds_to_force_log_off_user = 0 + peak_log_off_action = "Suspend" + peak_log_off_reminder_interval = 0 + peak_log_off_timeout_minutes = 5 + power_off_delay_minutes = 30 + power_time_schemes = [ + { + days_of_week = [ + "Friday", + "Monday", + "Thursday", + "Tuesday", + "Wednesday", ] + display_name = "TACG-TMM-CVAD-VSP-AS" + peak_time_ranges = [ + "09:00-17:00", ] + pool_using_percentage = false }, ] + timezone = "UTC" } + built_in_scopes = (known after apply) + color_depth = "TwentyFourBit" + default_desktop_icon = "1" + description = "Terraform-created Delivery Group for TACG running on XS8-Cluster" + desktops = [ + { + description = "Terraform-created W11 Desktops running on XS8-Cluster" + enabled = true + id = (known after apply) + published_name = "TACG-VSP-W11" + restricted_access_users = { + allow_list = [ + "TACG\\vdaallowed", ] + block_list = [] } }, ] + enabled = true + force_delete = false + id = (known after apply) + in_maintenance_mode = false + inherited_scopes = (known after apply) + load_balancing_type = "None" + minimum_functional_level = "L7_20" + name = "TACG-TMM-CVAD-VSP-DG" + reboot_schedules = [ + { + days_in_week = [ + "Sunday", ] + frequency = "Weekly" + frequency_factor = 1 + ignore_maintenance_mode = true + name = "TACG-TMM-CVAD-VSP-RS" + natural_reboot_schedule = false + reboot_duration_minutes = 0 + reboot_schedule_enabled = true + start_date = "2025-01-01" + start_time = "02:00" # (1 unchanged attribute hidden) }, ] + restricted_access_users = { + allow_list = [ + "TACG\\vdaallowed", ] + block_list = [] } + scopes = [] + secure_ica_required = false + storefront_servers = [ + (known after apply), ] + tenants = (known after apply) + total_machines = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-ClientDrives" { + description = "Example of Client Drive-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "Client Drives" + policy_set_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-HDX" { + description = "Example of HDX Graphics-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "HDX Graphics" + policy_set_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-Printing" { + description = "Example of Printer-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "Printing" + policy_set_id = (known after apply) } # citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet will be created + resource "citrix_policy_set_v2" "TACG-TMM-CVAD-DefaultPolicySet" { + assigned = (known after apply) + delivery_groups = [ + (known after apply), ] + description = "Terraform-created default Policy Set for TACG running on VSP-Cluster" + id = (known after apply) + name = "TACG-TMM-CVAD-VSP-PS-Default" + scopes = [] } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD1" { + enabled = true + id = (known after apply) + name = "AutoConnectDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD2" { + enabled = true + id = (known after apply) + name = "ClientDriveRedirection" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD3" { + enabled = true + id = (known after apply) + name = "ClientFixedDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD4" { + enabled = false + id = (known after apply) + name = "ClientFloppyDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD5" { + enabled = false + id = (known after apply) + name = "ClientOpticalDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD6" { + enabled = false + id = (known after apply) + name = "ClientNetworkDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX1" { + enabled = true + id = (known after apply) + name = "AllowVisuallyLosslessCompression" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX2" { + id = (known after apply) + name = "UseVideoCodecForCompression" + policy_id = (known after apply) + use_default = false + value = "UseVideoCodecIfPreferred" } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX3" { + enabled = true + id = (known after apply) + name = "UseHardwareEncodingForVideoCodec" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing1" { + id = (known after apply) + name = "ClientPrinterAutoCreation" + policy_id = (known after apply) + use_default = false + value = "DefaultPrinterOnly" } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing2" { + id = (known after apply) + name = "UniversalPrintDriverUsage" + policy_id = (known after apply) + use_default = false + value = "FallbackToSpecific" } # citrix_storefront_server.CreateSFServer will be created + resource "citrix_storefront_server" "CreateSFServer" { + description = "Terraform-created StoreFront Server for TACG-CVAD" + enabled = true + id = (known after apply) + name = "TACG-SF-Server1" + url = "https://storefront-v.the-austrian-citrix-guy.at/Citrix/Store" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # null_resource.WriteProgress4 will be created + resource "null_resource" "WriteProgress4" { + id = (known after apply) } # null_resource.WriteProgress5 will be created + resource "null_resource" "WriteProgress5" { + id = (known after apply) } Plan: 33 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn: Creating... citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn: Still creating... [00m10s elapsed] citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn: Still creating... [00m20s elapsed] citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn: Still creating... [00m30s elapsed] citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn: Still creating... [00m40s elapsed] citrix_vsphere_hypervisor.TACG-TMM-CVAD-V-HypConn: Creation complete after 40s [id=7743fb34-1e31-4cb0-b7e7-6a0d65ca871a] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Creating... citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Still creating... [00m10s elapsed] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Still creating... [00m20s elapsed] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Still creating... [00m30s elapsed] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Still creating... [00m40s elapsed] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Still creating... [00m50s elapsed] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Still creating... [01m00s elapsed] citrix_vsphere_hypervisor_resource_pool.TACG-TMM-CVAD-V-HypConnPool: Creation complete after 1m0s [id=7fe362b3-6f9f-4880-ba6e-8d7af5dc1b48] null_resource.WriteProgress2: Creating... null_resource.WriteProgress2: Provisioning with 'local-exec'... null_resource.WriteProgress2 (local-exec): Executing: ["cmd" "/C" "echo The Hypervisor Connection Pool was successfully created..."] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Creating... null_resource.WriteProgress2 (local-exec): The Hypervisor Connection Pool was successfully created... null_resource.WriteProgress2: Creation complete after 0s [id=2523874641761484813] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [00m10s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [00m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [00m30s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [00m40s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [00m50s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [01m00s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [01m10s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [01m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [01m30s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [01m40s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [01m50s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [02m00s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [02m10s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [02m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [02m30s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [02m40s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Still creating... [02m50s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-V-MC: Creation complete after 2m51s [id=bf005a81-2235-4f6a-af65-bccf431a0b31] null_resource.WriteProgress3: Creating... null_resource.WriteProgress3: Provisioning with 'local-exec'... null_resource.WriteProgress3 (local-exec): Executing: ["cmd" "/C" "echo The Machine Catalog was successfully created..."] null_resource.WriteProgress3 (local-exec): The Machine Catalog was successfully created... null_resource.WriteProgress3: Creation complete after 1s [id=1626259821095883122] citrix_storefront_server.CreateSFServer: Creating... citrix_storefront_server.CreateSFServer: Still creating... [00m10s elapsed] citrix_storefront_server.CreateSFServer: Creation complete after 10s [id=7b1a5810-57f8-4381-9d1b-8d12232bfd1d1] citrix_delivery_group.TACG-TMM-CVAD-V-DG: Creating... citrix_delivery_group.TACG-TMM-CVAD-V-DG: Still creating... [00m10s elapsed] citrix_delivery_group.TACG-TMM-CVAD-V-DG: Still creating... [00m20s elapsed] citrix_delivery_group.TACG-TMM-CVAD-V-DG: Creation complete after 21s [id=3f259eed-b038-4811-acb5-8b605e243454] null_resource.WriteProgress4: Creating... citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Creating... null_resource.WriteProgress4: Provisioning with 'local-exec'... null_resource.WriteProgress4 (local-exec): Executing: ["cmd" "/C" "echo The Delivery Group was successfully created..."] null_resource.WriteProgress4 (local-exec): The Delivery Group was successfully created... null_resource.WriteProgress4: Creation complete after 0s [id=8623307076369312790] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m10s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m20s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m30s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Creation complete after 31s [id=e59ec7dd-548d-4ee5-9f12-265a72e57eab] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives: Creation complete after 0s [id=6857750b-be93-4496-bcf3-a158be09a2f4] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX: Creation complete after 0s [id=d89d8c8b-643d-4b4d-b18d-a113db441377] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing: Creation complete after 0s [id=a2a37d82-84cd-40ad-a8d3-b2a40e6cd9cf] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2: Creation complete after 0s [id=1655477d-ae9f-41b1-b8a8-dfa3946b03ca] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3: Creation complete after 0s [id=ee6b4eec-603d-4100-9645-deae77fda9c1] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3: Creation complete after 0s [id=a0c3ea85-bb37-4951-9452-00ae3fa0989a] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4: Creation complete after 0s [id=192657fb-3d4e-4c33-af52-5592d27f2850] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3: Creation complete after 0s [id=be88bf99-dea0-4b92-97a7-98aaeb93582c] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2: Creation complete after 0s [id=5575e198-b0f7-4153-9111-578d34687f02] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3: Creation complete after 0s [id=70adc8c4-3d7a-4b0f-a1c9-5e15ed46d660] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5: Creation complete after 0s [id=3e91fc16-69f8-4300-a76c-0dfe3b98c2bb] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1: Creation complete after 0s [id=d936a75a-001c-492d-9a33-ae386a484077] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6: Creation complete after 1s [id=da97b2b0-6b99-471f-8814-9c7cdd1d81e9] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2: Creation complete after 1s [id=f07abd42-1719-4a35-989f-67b43d5e57da] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2: Creation complete after 1s [id=d7c336fd-1da3-490b-9c25-4f339960610f] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1: Creation complete after 1s [id=23ba2ee7-e3cf-4f98-8ab3-0f54ae4c901e] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1: Creation complete after 1s [id=7da46401-84dd-4770-b3d3-7a83cc156a72] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3: Creation complete after 1s [id=d99c2aca-eadf-40f5-b3b2-850bbc451149] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2: Creation complete after 1s [id=df8c4b99-4c40-4d63-b72d-935a79fa53db] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1: Creation complete after 1s [id=4767a94b-fb63-4196-a6e5-f62cfc371e8a] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1: Creation complete after 1s [id=55b82b00-518f-4f65-b6a5-b695a64f7357] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1: Creation complete after 0s [id=d547e435-d3fb-4742-aacc-c31d2d3c9309] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2: Creation complete after 0s [id=48e05a9f-faaa-4454-a688-991a05985db1] null_resource.WriteProgress5: Creating... null_resource.WriteProgress5: Provisioning with 'local-exec'... null_resource.WriteProgress5 (local-exec): Executing: ["cmd" "/C" "echo The default Policy Set and its policies and filters were successfully created..."] null_resource.WriteProgress5 (local-exec): The default Policy Set and its policies and filters were successfully created... null_resource.WriteProgress5: Creation complete after 0s [id=3744815402207074589] Apply complete! Resources: 33 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADVS/_CreateCitrixEntities$Terraform has successfully installed all needed Citrix entities: A Hypervisor Connection and Hypervisor Connection Pool were created: All related tests are OK: A Machine Catalog was created: All related tests are OK: A Delivery Group was created: All related tests are OK: A dedicated Policy Set and its policies were created: Web Studio shows a complete, error-free deployment of Citrix Virtual Apps and Desktops 2507 LTSR: As the deployment is complete, we can now log on to StoreFront and start our assigned desktop. Using the DeploymentAs all prerequisites are met, we can now log on to our CVAD site and start our assigned VDI desktop. Logging on through Citrix Workspace App or Storefront is possible: Let´s choose our desktop and start it: That completes our guide “Using Infrastructure-as-Code for deploying Citrix Virtual Apps and Desktops 2507 LTSR on vSphere 8”. As the importance of Infrastructure-as-Code and Automation steadily increases, we will continue to focus on these topics. Stay tuned for new guides and our soon-to-be-published Automation Handbook on our Automation landing page in Citrix TechZone (https://community.citrix.com/tech-zone/automation), where we cover all relevant aspects of IaC and Automation in a Citrix Environment. DisclaimerDisclaimer: EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>Deployment Guide: Using Infrastructure-as-Code for deploying Citrix® Virtual Apps and Desktops™ 2507 LTSR on XenServer™ 8.4</h1> <p>Wed, 19 Nov 2025 13:08:00 +0000</p> Using Infrastructure-as-Code for deploying Citrix® Virtual Apps and Desktops™ 2507 LTSR on XenServer™ 8.4 Citrix’s goal is to help customers automate their environments with minimal friction. We support multiple automation interfaces, REST APIs, PowerShell SDKs, Terraform providers, Ansible playbooks, and all current CI/CD frameworks, so customers can choose the tools that fit their workflow. Automation enhances Citrix’s ability to deliver repeatable, scalable, and secure deployments across hybrid and multi-cloud environments. It supports Citrix’s broader goals of reducing time-to-value, improving customer satisfaction, and deeply integrating into customer ecosystems. IntroductionIn this guide, we cover the usage of three distinct Infrastructure-as-Code (IaC) frameworks to deploy a Citrix Virtual Desktops™ 2507 LTSR-based deployment on a XenServer® 8.4 cluster. The instructions are divided into blocks that must be started in a specific, predetermined order. However, it is not necessary to start all blocks in one go—the dependencies on previous blocks are recorded during runtime, so that essential time intervals or even execution stops between the individual blocks are not a problem. Components and frameworks used in this guideLet´s have a short overview of all the components and frameworks used in this guide. We use Hashicorp Packer as the framework for generating the Master Images and templates for deploying all needed Windows-based virtual machines on XenServer 8.4, Hashicorp Terraform as the backbone and “coordinating” framework for creating all needed Infrastructure components, and Ansible as the configuration framework for all configuration needs of the components that Terraform cannot do during the initial creation of the respective element. XenServer 8.4For customers who want to virtualize Citrix workloads, XenServer delivers an affordable, straightforward hypervisor optimized for Citrix Virtual Apps™ and Desktops™ deployments. XenServer 8.4 is the most optimized hypervisor for running Citrix workloads, with features only available with Citrix and XenServer – relevant for this deployment guide are: IntelliCache™ MCS Read Cache You can find more information about XenServer 8 in its respective product documentation. Caution: XenServer currently lacks an official Packer plugin. In this guide, we use an open-source Tech Preview plugin maintained by my fellow Citrite colleagues Rody Kossen and Marshall Wu. You can find more about this TP on GitHub: https://github.com/xenserver/packer-plugin-xenserver/tree/feature-rodyk-revamp Please read the disclaimer at the end of the document for further information. Hashicorp TerraformTerraform is one of the most widely adopted Infrastructure-as-Code (IaC) platforms for provisioning and managing cloud and on-prem infrastructure at scale. Its declarative configuration model, strong ecosystem support, and provider-agnostic architecture make it a foundational tool for organizations seeking consistency, compliance, and operational maturity in their infrastructure lifecycle. Terraform relies on declarative code to define infrastructure in a predictable, reproducible manner. By representing compute, networking, storage, IAM, and platform services as version-controlled code artifacts, Terraform: Eliminates configuration drift Ensures consistent provisioning across development, staging, and production Produces deployments that can be rebuilt deterministically This consistency is particularly valuable in regulated environments where documentation, repeatability, and environmental fidelity are required for audits and certification processes. For highly regulated verticals—such as finance, healthcare, government, and critical infrastructure—Terraform provides the governance, repeatability, and auditability required to meet stringent compliance obligations. These regulated verticals often operate under strict frameworks, such as: Finance: PCI-DSS, FFIEC, SOX Healthcare: HIPAA, HITECH Government/Public Sector: FedRAMP, NIST 800-53, DoD SRG Energy/Critical Infrastructure: NERC CIP Global Privacy Requirements: GDPR, regional data sovereignty mandates Terraform helps organizations meet these obligations by providing: Complete Traceability and Auditability: All infrastructure changes can be captured in version control systems. This enables traceable change histories, approvals, and rollbacks—supporting SOX, NIST, and ISO 27001 requirements around change management and configuration governance. Standardized, Repeatable Environments: Terraform modules enable organizations to define compliant “building blocks” that development teams cannot inadvertently modify, ensuring every environment meets baseline controls for security, networking, identity, and data protection. Operational Efficiency and Reduced Risk: Terraform’s execution plan and state management capabilities allow organizations to preview changes before applying them, reducing misconfigurations—a key risk driver in regulated environments. Additional operational benefits include: Automated provisioning at scale Predictable change outcomes through planning and applying workflows Reduced human error, a significant source of compliance violations Consistent rollback and recovery patterns Integration With Secure DevOps and Platform Engineering Practices Terraform fits seamlessly into CI/CD, GitOps, and automated compliance frameworks, enabling regulated organizations to adopt modern DevOps practices without compromising governance. It perfectly integrates with frameworks such as: Terraform Cloud/Enterprise for controlled workflows Vault for secure secrets injection Packer for master image pipelines GitHub Actions, GitLab, Azure DevOps for automated deployment Hashicorp PackerHashiCorp Packer is a foundational tool for organizations seeking to standardize, automate, and scale the creation of master images across multi-cloud and hybrid environments. As organizations increasingly adopt Infrastructure-as-Code (IaC) approaches, Packer provides a consistent, version-controlled, and repeatable way to build golden images aligned with modern DevOps and platform engineering practices. Standardization and Consistency Across Environments: Packer enables the creation of identically configured images for AWS, Azure, GCP, VMware, and other platforms from a single source template. This eliminates configuration drift and ensures that compute instances, virtual desktops, containers, or on-prem VMs are consistently built from the same baseline. For enterprises managing multiple environments, Packer’s multi-builder architecture ensures that every deployment starts from a deterministic, verified image. Full Infrastructure-as-Code Alignment: Packer templates are declarative and integrate seamlessly into IaC workflows using tools such as Terraform, Ansible, and even cloud-native configuration tools. This yields several architectural advantages: Versioned images: Each new image build is immutable and tied to a version-controlled configuration. Reproducibility: Builds can be recreated deterministically at any time, supporting compliance and audit requirements. Automation-ready: Image creation fits naturally into CI/CD pipelines, enabling continuous delivery of operating system and middleware baselines. Efficient, Scalable Deployments: Master images generated by Packer accelerate workload provisioning by drastically reducing runtime bootstrap configuration. This leads to: Faster autoscaling responsiveness Reduced risk of configuration failures during provisioning Decreased cloud compute costs due to shorter initialization times Better operational consistency across development, staging, and production These benefits scale exceptionally well for enterprise cloud deployments, VDI environments, and large-scale microservice platforms. Multi-Cloud Flexibility and Future-Proofing Packer’s provider-agnostic architecture helps organizations avoid lock-in and stay adaptable. A single template can create AMIs, Azure Managed Images, GCP images, Docker images, and VMware templates. This uniformity supports long-term cloud strategy, modernization efforts, and disaster recovery architectures that depend on identical images across regions and providers. Integration with Modern Platform Engineering Practices Packer integrates tightly with modern platform engineering toolchains: Terraform for downstream deployment Vault for secure secrets handling GitHub Actions, GitLab CI, Azure DevOps for automated pipelines This positions Packer as a first-class component in automated golden image pipelines, enabling platform teams to provide self-service, pre-validated, compliant images to developers and operations teams. Packer is a mature, efficient, and cloud-agnostic solution that brings the rigor of Infrastructure-as-Code to master image creation. It ensures repeatability, security, compliance, and operational speed while integrating seamlessly into modern CI/CD and platform engineering ecosystems. For organizations pursuing scalable, automated, and consistent image-based deployments, Packer is not only valid but strategically advantageous. Packer is an open-source tool that automates the creation of machine images for multiple platforms from a single source configuration. It enables developers and DevOps teams to define image-creation workflows in code, resulting in consistent, repeatable, and version-controlled image builds. RedHat AnsibleMany organizations that have matured their Infrastructure-as-Code (IaC) practices increasingly require tooling that not only provisions infrastructure but also configures systems, applications, and operating environments in a controlled, repeatable manner. Ansible is a leading configuration management and automation platform that aligns naturally with IaC principles and complements provisioning tools such as Terraform, or cloud-native IaC engines. Its agentless architecture, declarative playbook model, and extensive ecosystem make it a strategic choice for enterprises seeking predictable, scalable, and compliant post-provision configuration. Ansible provides a declarative, idempotent configuration model that ensures systems converge to a desired state regardless of their current configuration. This makes it ideally suited for environments provisioned using IaC tools, allowing organizations to: Configure compute resources, operating systems, middleware, and applications immediately after provisioning Apply consistent baseline templates across development, staging, and production Avoid configuration drift and reduce manual intervention Enforce standardization across diverse platforms and environments Because Ansible uses standard protocols (SSH, WinRM, API calls) and does not require agents, it can manage virtually any resource created by IaC tooling with minimal setup. Ansible excels by enabling: OS configuration (packages, services, permissions, patching) Deployment and maintenance of middleware or applications Secure configuration of agents (monitoring, logging, EDR, secrets managers) Post-provision checks and compliance enforcement Continuous updates and lifecycle operations long after initial provisioning Ansible delivers operational benefits such as: Idempotent reruns that safely correct drift Automated configuration updates Consistent rollout of application versions or patches Reduced human error and faster recovery Centralized configuration logic rather than ad-hoc scripts These capabilities support long-term environment stability, which is often a weak point in IaC deployments if configuration is not managed separately. Better togetherTerraform and Ansible serve complementary roles in modern Infrastructure-as-Code (IaC) architectures. Terraform excels at provisioning infrastructure resources—compute, networks, storage, identity, and cloud services—while Ansible specializes in configuring and managing the software, applications, and operating system state on those resources once they are created. When combined, they form a robust, scalable, and fully automated delivery pipeline that allows organizations to provision secure, consistent environments and configure them in a modular, policy-driven manner. Terraform is primarily designed for infrastructure lifecycle management, while Ansible is engineered for post-provisioning configuration. This clean separation ensures: Terraform builds and destroys infrastructure predictably Ansible configures servers, middleware, application stacks, and OS settings Changes to infrastructure and configuration are maintained in distinct codebases, improving clarity and reducing risk IT can version, audit, and test both layers independently This division of responsibilities aligns with architectural patterns used in platform engineering and regulated environments, where infrastructure and system configuration often have separate compliance requirements. Schematic workflow in this guide: PrerequisitesLet´s have a short overview of all the prerequisites needed: IaC Deployment MachineWe assume you have a dedicated machine or a cluster running all Automation components. If all IaC frameworks reside on the same machine/cluster, communication between them is less error-prone. We recommend an Ubuntu-based machine for various reasons: An Ubuntu VM is one of the most reliable, flexible, and well-supported environments for running IaC tools like Terraform, Ansible, Jenkins, and Packer, thanks to its stability, compatibility, and strong community support. Most IaC tools (Terraform, Ansible, Packer) are developed and tested primarily on Linux. Note: You can find a guide to create such an all-in-one deployment machine on Citrix TechZone. If you use the Ubuntu-based IaC machine, all Terraform, Packer, and Ansible snippets are running on Ubuntu. All local-exec provisioners also run on the Ubuntu machine: Example of a local-exec provisioner: ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } Caution: Due to current limitations in Citrix StoreFront´s automation capabilities, you must run the automated deployment and configuration of Citrix StoreFront™ from a domain-joined Windows machine with Terraform installed. Important: Suppose you decide to switch to running all Terraform snippets on a Windows machine. In that case, you need to change the provisioner types and the code from local-exec provisioners to remote-exec provisioners, as Ansible cannot run on a Windows machine! Example of the local-exec provisioner mentioned above - converted to a remote-exec provisioner: ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD ] } }You can find instructions for setting up the necessary WinRM/SSH configuration later in this guide. XenServer 8.4We assume that you already have a XenServer 8.4 cluster in place, which will serve as the Hypervisor host for all required virtual machines. Important: There is no need to have template VMs or template snapshots configured if you want to follow our IaC-based approach to create and configure all needed Master images using Packer. If you do not want to use Packer but have already configured Master images, you can use them and reference them in the corresponding Terraform variables later. Communication Flow between Terraform, Ansible, and the Target MachinesAll communication between Terraform, Packer, and Ansible on the IaC-VM and the target VMs on the XenServer cluster uses SSH and WinRM. WinRM (Windows Remote Management) is a Microsoft protocol that enables remote management of Windows systems by allowing access to remote computers to perform management tasks. It is Microsoft's implementation of the WS-Management (Web Services Management Protocol) standard. It often uses SOAP (Simple Object Access Protocol) for communication over HTTP or HTTPS, using ports 5985 (HTTP) and 5986 (HTTPS) by default. WinRM provides the basis for remote management with PowerShell and is used for tasks such as running remote scripts, automating, configuring, and performing system inventory. Therefore, WinRM and SSH must be configured correctly. Important: We emphasize ensuring the communication flow works as intended from the outset of the pre-domain-joined stage; otherwise, Terraform and Ansible will fail to configure the VMs. During the pre-domain-join stage, you can configure these settings using the local Group Policy Editor on the VM or in the autounattend.xml file as we do in our Packer scripts. After a successful domain join, you can set all relevant settings using GPOs. To provide maximum flexibility and a fallback mechanism, you can use both listeners - HTTP and HTTPS - but we recommend using the secure transport whenever and wherever possible. You can check all available listeners using PowerShell: PS > winrm e winrm/config/listener Listener [Source="GPO"] Address = * Transport = HTTP Port = 5985 Hostname Enabled = true URLPrefix = wsman CertificateThumbprint ListeningOn = 10.10.119.11, 127.0.0.1, ::1, fe80::287c:216e:9bd9:18e5%7 Listener [Source="GPO"] Address = * Transport = HTTPS Port = 5986 Hostname = tf-cvad-ddc1.the-austrian-citrix-guy.at Enabled = true URLPrefix = wsman CertificateThumbprint = e3bf89dd77c95dd6c0f1b94480ea63782df4279e ListeningOn = 10.10.119.11, 127.0.0.1, ::1, fe80::287c:216e:9bd9:18e5%7To check the communication, you can use a Terraform snippet: Unsecure Communication - connecting to the HTTP listener: resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_IP1 timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_Admin-Username password = var.Provisioner_Admin-Password host = var.Provisioner_IP1 timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } }Output: ... null_resource.InstallonIP1: Creating... null_resource.InstallonIP1: Provisioning with 'remote-exec'... null_resource.InstallonIP1 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP1 (remote-exec): Host: tf-cvad-ddc1 null_resource.InstallonIP1 (remote-exec): Port: 5985 null_resource.InstallonIP1 (remote-exec): User: administrator null_resource.InstallonIP1 (remote-exec): Password: true null_resource.InstallonIP1 (remote-exec): HTTPS: false null_resource.InstallonIP1 (remote-exec): Insecure: false null_resource.InstallonIP1 (remote-exec): NTLM: false null_resource.InstallonIP1 (remote-exec): CACert: false null_resource.InstallonIP1 (remote-exec): Connected! ... Secure Communication - connecting to the HTTPS listener: resource "null_resource" "UploadTestFileToIP1" { connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } ###### Upload Test script to IP1 provisioner "file" { source = "${path.module}/DATA/Test-Script.ps1" destination = "c:/temp/Test-Script.ps1" } } resource "null_resource" "InstallonIP1" { depends_on = [ null_resource.UploadTestFileToIP1 ] connection { type = var.Provisioner_Type user = var.Provisioner_SecureAdmin-Username password = var.Provisioner_SecureAdmin-Password host = var.Provisioner_IP1 port = var.Provisioner_Port https = var.Provisioner_HTTPS timeout = var.Provisioner_Timeout } provisioner "remote-exec" { inline = [ "powershell -File c:/temp/Test-Script.ps1" ] } }Output: ... null_resource.InstallonIP1: Creating... null_resource.InstallonIP1: Provisioning with 'remote-exec'... null_resource.InstallonIP1 (remote-exec): Connecting to remote host via WinRM... null_resource.InstallonIP1 (remote-exec): Host: tf-cvad-ddc1 null_resource.InstallonIP1 (remote-exec): Port: 5986 null_resource.InstallonIP1 (remote-exec): User: svc_ansible null_resource.InstallonIP1 (remote-exec): Password: true null_resource.InstallonIP1 (remote-exec): HTTPS: true null_resource.InstallonIP1 (remote-exec): Insecure: false null_resource.InstallonIP1 (remote-exec): NTLM: false null_resource.InstallonIP1 (remote-exec): CACert: false null_resource.InstallonIP1 (remote-exec): Connected! ...Important: Configuring secure communication, especially for Ansible on the Ubuntu machine, is a complex task that involves certificates and user mappings – you can find many comprehensive configuration guides online. A good start can be found in Ansible´s own documentation. Active Directory DomainAn existing AD domain is imperative for a successful CVAD deployment. We assume you have a domain with all the needed configurations in place. Creation of the CVAD Environment using IaCAs all prerequisites are met, we can now start with the workflow to create our Citrix Virtual Apps and Desktops deployment. As already stated, the workflow is divided into blocks that must be started in a specific, predetermined order: Caution: As already mentioned above, Module 9 - Using Terraform to create the StoreFront deployment and all its necessities, must be run on a Windows-based, domain-joined VM to be supported. This is due to limitations in StoreFront´s automation capabilities. Using Packer to create the Master Images In this IaC block, we use Packer to create the Master Images for the VDI machines and the Windows Servers. Using Terraform to create the needed VMs based on the Master Images Terraform will create these VMs: a. Two Windows Server 2025-based VMs for the Delivery Controllers b. One Windows Server 2025-based VM for the StoreFront™ server c. One Windows Server 2025-based VM for the WebStudio™ server d. One Windows 11-based VM as a VDI Worker Using Terraform and Ansible to configure the VMs Terraform and Ansible take further configuration steps: a. Change the IP addresses to known IPs b. Change the Ansible configuration file to reflect the IP changes c. Put the VMs into the AD domain Using Terraform and Ansible to deploy the Delivery Controllers Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the DDCs c. Install all required server roles and features before installing the DDCs d. Change some necessary registry settings Using Terraform and Ansible to deploy the StoreFront server Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the StoreFront server c. Install all required server roles and features before installing the StoreFront d. Change some necessary registry settings Using Terraform and Ansible to deploy the WebStudio server Terraform and Ansible take further configuration steps: a. Mount the CVAD ISO installer b. Copy the publicly-signed SSL certificate to the WebStudio server c. Install all required server roles and features before installing the WebStudio server d. Change some necessary registry settings e. Configure WebStudio server as proxy for the DDCs Using Terraform and Ansible to change the SSL Bindings Terraform and Ansible take further configuration steps: a. Change the SSL bindings on all servers and listeners to achieve complete HTTPS communication Using Terraform and Ansible to create the CVAD site and all its necessities Terraform and Ansible take further configuration steps: a. Create all databases b. Create the site c. Add the second DDC to the site d. Configure additional site configurations e. Configure a dedicated Administrators group f. Configure the licensing Using Terraform to create the StoreFront deployment and all its necessities Terraform takes further configuration steps: a. Create the StoreFront deployment b. Create a StoreFront Authentication service c. Create a StoreFront Store service d. Create a StoreFront WebReceiver service Using Terraform to create all CVAD entities and all their necessities Terraform takes further configuration steps: a. Create a StoreFront Server object b. Create a Hypervisor connection c. Create a Hypervisor connection resource pool d. Create a Machine Catalog e. Create a Delivery Group f. Create a Policy Set and its policies Note: All Ansible playbooks are directly called from Terraform. Terraform stops the workflow if an error occurs by checking Ansible's return code. Important: All shown Terraform codes, Ansible Playbooks, and PowerShell scripts are tailored exclusively for the specific environment used for this guide. You need to adjust all settings, values, snippets, etc., in the most suitable way tailored to your requirements, regulations, and existing environments. All settings, scripts, and code examples listed in this document are intended only to illustrate the possibilities and serve as a basis for your own deployment. Using all the provided code snippets is at your own risk – please read the disclaimer at the end of the document for further information. Terraform verifies the successful execution of each Ansible playbook. If an error occurs, Terraform will halt the deployment and write out the failed Playbook: Example snippet: ##### Create Databases Start ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCDB" { depends_on = [null_resource.RunCreateDatabasePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { depends_on = [data.external.CheckAnsibleReturnCodeCDB] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCDB.result.found}\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } In this example, Terraform runs the Ansible playbook to create the CVAD databases. If an error occurs, Terraform writes an error message indicating that deploying the CVAD databases failed. You would find more information in the LogFile directory on the corresponding server. Terraform then stops the further execution of the snippets. Part 1: Using Packer to create the Master ImagesHashicorp Packer is our standard framework for creating, maintaining, and deploying Master Images using IaC. Our XenServer cluster has no VMs before running the snippet: UPDATE: We changed the used Packer plugin: Caution: XenServer currently lacks an official Packer plugin. In this guide, we use an open-source Tech Preview plugin maintained by my Citrite colleagues Rody Kossen and Marshall Wu to showcase the feasibility of end-to-end IaC. You can find more about this TP on GitHub: https://github.com/xenserver/packer-plugin-xenserver/tree/feature-rodyk-revamp Use the plugin at your own risk – please read the disclaimer at the end of the document for further information. There is NO warranty that it will work as intended – we cannot provide any support. You can find a more thorough example of using a supported Packer deployment in our TechZone guide "Using Infrastructure-as-Code for deploying Citrix® Virtual Apps and Desktops™ 2507 LTSR on vSphere™ 8". Before you can use the mentioned plugin, you need to compile it: Here´s a guide for compiling it – we use our Ubuntu IaC machine for compilation. Before compilation, we need to ensure that these prerequisites are installed: Packer – is installed. Golang 1.24.1 – is not installed, need to install Step 1: Install Golang 1.24.1 azadmin@tacg-cicd:~$ wget https://go.dev/dl/go1.24.1.linux-amd64.tar.gz --2025-11-21 09:32:35-- https://go.dev/dl/go1.24.1.linux-amd64.tar.gz Resolving go.dev (go.dev)... 216.239.36.21, 216.239.32.21, 216.239.34.21, ... Connecting to go.dev (go.dev)|216.239.36.21|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://dl.google.com/go/go1.24.1.linux-amd64.tar.gz [following] --2025-11-21 09:32:36-- https://dl.google.com/go/go1.24.1.linux-amd64.tar.gz Resolving dl.google.com (dl.google.com)... 142.251.39.78, 2a00:1450:400d:80e::200e Connecting to dl.google.com (dl.google.com)|142.251.39.78|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 78503123 (75M) [application/x-gzip] Saving to: ‘go1.24.1.linux-amd64.tar.gz’ go1.24.1.linux-amd64.tar.gz 100%[=================================================>] 74.87M 29.5MB/s in 2.5s 2025-11-21 09:32:38 (29.5 MB/s) - ‘go1.24.1.linux-amd64.tar.gz’ saved [78503123/78503123] azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ sudo tar -C /usr/local -xzf go1.24.1.linux-amd64.tar.gz azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ ls -l /usr/local/go* total 76 drwxr-xr-x 2 root root 4096 Feb 27 2025 api drwxr-xr-x 2 root root 4096 Feb 27 2025 bin -rw-r--r-- 1 root root 52 Feb 27 2025 codereview.cfg -rw-r--r-- 1 root root 1337 Feb 27 2025 CONTRIBUTING.md drwxr-xr-x 3 root root 4096 Feb 27 2025 doc -rw-r--r-- 1 root root 505 Feb 27 2025 go.env drwxr-xr-x 5 root root 4096 Feb 27 2025 lib -rw-r--r-- 1 root root 1453 Feb 27 2025 LICENSE drwxr-xr-x 8 root root 4096 Feb 27 2025 misc -rw-r--r-- 1 root root 1303 Feb 27 2025 PATENTS drwxr-xr-x 4 root root 4096 Feb 27 2025 pkg -rw-r--r-- 1 root root 1454 Feb 27 2025 README.md -rw-r--r-- 1 root root 426 Feb 27 2025 SECURITY.md drwxr-xr-x 56 root root 4096 Feb 27 2025 src drwxr-xr-x 28 root root 16384 Feb 27 2025 test -rw-r--r-- 1 root root 35 Feb 27 2025 VERSION azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ sudo nano ~/.profile azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ source ~/.profile azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ go version go version go1.24.1 linux/amd64 azadmin@tacg-cicd:~$ Step 2: Download the plugin source from GitHub and place it into a feasible directory We downloaded the source and put it into “packer-plugin-xenserver-feature-rodyk-revamp” azadmin@tacg-cicd:~$ ls cert_key.pem Documents Music packer-templates snap cert.pem Downloads packer-examples-for-vsphere Pictures Templates Desktop go1.24.1.linux-amd64.tar.gz packer-plugin-xenserver-feature-rodyk-revamp Public Videos azadmin@tacg-cicd:~$ Step 3: Compile the plugin azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ make builder/xenserver/common/client.go:9:2: xenapi@v0.0.0-00010101000000-000000000000: replacement directory ./goSDK does not exist make: *** [GNUmakefile:11: build] Error 1 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ This error indicates that the XenServer SDK-Go files are missing. We need to download them into a subdirectory to make them accessible for compilation: azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ wget -P /home/azadmin/Downloads https://downloads.xenserver.com/sdk/25.30.0/XenServer-SDK-25.30.0.zip --2025-11-21 10:39:31-- https://downloads.xenserver.com/sdk/25.30.0/XenServer-SDK-25.30.0.zip Resolving downloads.xenserver.com (downloads.xenserver.com)... 13.107.226.44, 13.107.253.44, 2620:1ec:48:1::44, ... Connecting to downloads.xenserver.com (downloads.xenserver.com)|13.107.226.44|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 19568538 (19M) [application/zip] Saving to: ‘/home/azadmin/Downloads/XenServer-SDK-25.30.0.zip’ XenServer-SDK-25.30.0.zip 100%[================================================================================================================>] 18.66M 21.7MB/s in 0.9s 2025-11-21 10:39:32 (21.7 MB/s) - ‘/home/azadmin/Downloads/XenServer-SDK-25.30.0.zip’ saved [19568538/19568538] azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ mkdir goSDK azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp/goSDK$ unzip /home/azadmin/Downloads/XenServer-SDK-25.30.0.zip -d /home/azadmin/Downloads/XenServer-SDK-25.30.0 ... azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ cp -r /home/azadmin/Downloads/XenServer-SDK-25.30.0/XenServer-SDK/XenServerGo/src/. /home/azadmin/packer-plugin-xenserver-feature-rodyk-re vamp/goSDK azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ cd goSDK azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp/goSDK$ ls api_errors.go cluster_host.go enums.go host_driver.go network_sriov.go pool_patch.go repository.go subject.go vdi_nbd_server_info.go vm_group.go api_messages.go console.go event.go host.go observer.go pool_update.go role.go task.go vgpu.go vm_guest_metrics.go api_versions.go convert.go export_test.go host_metrics.go pbd.go probe_result.go sdn_controller.go tunnel.go vgpu_type.go vm_metrics.go auth.go convert_test.go feature.go host_patch.go pci.go pusb.go secret.go usb_group.go vif.go vmpp.go blob.go crashdump.go go.mod jsonrpc_client.go pgpu.go pvs_cache_storage.go session.go user.go vif_metrics.go vmss.go bond.go data_source.go gpu_group.go lvhd.go pif.go pvs_proxy.go sm.go vbd.go vlan.go vtpm.go certificate.go driver_variant.go host_cpu.go message.go pif_metrics.go pvs_server.go sr.go vbd_metrics.go vm_appliance.go vusb.go cluster.go dr_task.go host_crashdump.go network.go pool.go pvs_site.go sr_stat.go vdi.go vm.go azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp/goSDK$ As the required SDK files are now in place, we can start the compilation again: azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ make go: downloading github.com/hashicorp/packer-plugin-sdk v0.6.2 go: downloading github.com/hashicorp/hcl/v2 v2.24.0 go: downloading github.com/hashicorp/hcl v1.0.0 ... go: downloading github.com/golang/protobuf v1.5.3 go: downloading github.com/mattn/go-colorable v0.1.13 go: downloading github.com/hashicorp/go-immutable-radix v1.3.1 go: downloading golang.org/x/sync v0.14.0 go: downloading github.com/hashicorp/golang-lru v0.5.4 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ ls builder docs examples GNUmakefile go.mod goSDK go.sum LICENSE main.go packer-plugin-xenserver README.md version azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$The compilation was successful, now we need to install the plugin in Packer. Step 4: Install the plugin azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ sudo packer plugins install --path packer-plugin-xenserver github.com/xenserver/xenserver Successfully installed plugin github.com/xenserver/xenserver from /home/azadmin/packer-plugin-xenserver-feature-rodyk-revamp/packer-plugin-xenserver to /root/.config/packer/plugins/github.com/xenserver/xenserver/packer-plugin-xenserver_v0.9.1_x5.0_linux_amd64 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ sudo packer plugins installed /root/.config/packer/plugins/github.com/xenserver/xenserver/packer-plugin-xenserver_v0.9.1_x5.0_linux_amd64 azadmin@tacg-cicd:~/packer-plugin-xenserver-feature-rodyk-revamp$ Installation is complete, let´s create some VMs now. For a detailed overview of the builder, please look at the plugin´s documentation. Example Packer HCL file for deploying a Windows Server 2025-VM on XenServer 8: packer { required_plugins { xenserver= { version = ">= v0.1.0" source = "github.com/xenserver/xenserver" } } } source "xenserver-iso" "XSTEST" { iso_checksum_type = "none" iso_name = var.os_iso_path sr_iso_name = var.sr_iso_name sr_name = var.sr_name tools_iso_name = var.tools_iso_name remote_host = var.remote_host remote_password = var.remote_password remote_username = var.remote_username vm_name = var.vm_name vm_description = var.vm_description vm_memory = var.memory disk_size = var.disksize vcpus = var.cpu cores_per_socket = var.cpu network_names = ["${var.virtual_network_name}"] firmware = var.firmware secure_boot = var.secure_boot vTPM = var.vtpm vgpu_profile = var.vgpu_profile clone_template = var.clone_template cd_files = ["W2K25AutoUnattendInclWinRM.xml"] ssh_username = var.ssh_username ssh_password = var.ssh_password ssh_wait_timeout = "60000s" boot_command = [ "<spacebar><wait2><spacebar>" ] boot_wait = "1s" #Export Options format = "xva" keep_vm = "on_success" communicator = "winrm" winrm_insecure = true winrm_password = var.winrm_password winrm_timeout = "5m" winrm_use_ssl = false winrm_username = var.winrm_username } build { sources = ["xenserver-iso.windows"] provisioner "powershell" { inline = ["Write-Host 'Installing updates and XenServer Tools...'", "Start-Process msiexec.exe -ArgumentList '/i D:\\xensetup\\managementagentx64.msi /qn' -Wait”] } } In this example, we use a modified autounattend.xml file to configure the Windows VM during creation: <?xml version="1.0" encoding="utf-8"?> <unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="windowsPE"> <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <DiskConfiguration> <Disk wcm:action="add"> <DiskID>0</DiskID> <WillWipeDisk>true</WillWipeDisk> <CreatePartitions> <CreatePartition wcm:action="add"> <Order>1</Order> <Type>Primary</Type> <Size>100</Size> </CreatePartition> <CreatePartition wcm:action="add"> <Order>2</Order> <Type>Primary</Type> <Extend>true</Extend> </CreatePartition> </CreatePartitions> <ModifyPartitions> <ModifyPartition wcm:action="add"> <Order>1</Order> <PartitionID>1</PartitionID> <Active>true</Active> <Label>System</Label> <Format>NTFS</Format> </ModifyPartition> <ModifyPartition wcm:action="add"> <Order>2</Order> <PartitionID>2</PartitionID> <Label>Windows</Label> <Format>NTFS</Format> <Letter>C</Letter> </ModifyPartition> </ModifyPartitions> </Disk> <WillShowUI>OnError</WillShowUI> </DiskConfiguration> <ImageInstall> <OSImage> <InstallFrom> <MetaData wcm:action="add"> <Key>/IMAGE/INDEX</Key> <Value>1</Value> </MetaData> </InstallFrom> <InstallTo> <DiskID>0</DiskID> <PartitionID>2</PartitionID> </InstallTo> </OSImage> </ImageInstall> <UserData> <ProductKey> <Key></Key> <WillShowUI>Never</WillShowUI> </ProductKey> <AcceptEula>true</AcceptEula> <FullName>Packer Builder</FullName> <Organization>ExampleCorp</Organization> </UserData> </component> </settings> <settings pass="specialize"> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <ComputerName>WIN2025BASE</ComputerName> <TimeZone>UTC</TimeZone> </component> <component name="Microsoft-Windows-Deployment" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <RunSynchronous> <RunSynchronousCommand> <Order>1</Order> <Path>cmd /c winrm quickconfig -quiet</Path> <Description>Enable WinRM</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>2</Order> <Path>cmd /c winrm set winrm/config/service/auth @{Basic="true"}</Path> <Description>Enable Basic Auth</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>3</Order> <Path>cmd /c winrm set winrm/config/service @{AllowUnencrypted="true"}</Path> <Description>Allow Unencrypted</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>4</Order> <Path>cmd /c netsh advfirewall set allprofiles state off</Path> <Description>Disable Firewall</Description> </RunSynchronousCommand> <RunSynchronousCommand> <Order>5</Order> <Path>cmd /c winrm set winrm/config/client @{TrustedHosts="*"}</Path> <Description>Disable Firewall</Description> </RunSynchronousCommand> </RunSynchronous> </component> </settings> <settings pass="oobeSystem"> <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <InputLocale>de-AT</InputLocale> <SystemLocale>en-US</SystemLocale> <UILanguage>en-US</UILanguage> <UserLocale>de-AT</UserLocale> </component> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>3</ProtectYourPC> </OOBE> <UserAccounts> <AdministratorPassword> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> <AutoLogon> <Username>Administrator</Username> <Password> <Value>!XxXxXxXxXxXxXxXxX!</Value> <PlainText>true</PlainText> </Password> <Enabled>true</Enabled> <LogonCount>1</LogonCount> </AutoLogon> <FirstLogonCommands> </FirstLogonCommands> </component> </settings> <cpi:offlineImage cpi:source="wim://wimfile/install.wim#Windows Server 2025 SERVERSTANDARD" xmlns:cpi="urn:schemas-microsoft-com:cpi" /> </unattend> As the syntax of the autounattend.xml is very sensitive to errors, we use a self-written configuration tool to create the autounattend.xml more comfortably: Running the Packer IaC snippet should create a XenServer XVA that can then be used as a Master Image. azadmin@tacg-cicd:~$ packer build packer-tmpl-w2k25-xs.pkr.hcl xenserver-iso.XSTEST: output will be in this color. ==> xenserver-iso.XSTEST: XAPI client session established ==> xenserver-iso.XSTEST: Retrieving ISO ==> xenserver-iso.XSTEST: Trying http://10.10.100.1/iso/windows_server_2025.iso ==> xenserver-iso.XSTEST: Trying http://10.10.100.1/iso/windows_server_2025.iso ==> xenserver-iso.XSTEST: http://10.10.100.1/iso/windows_server_2025.iso => C:\__PPMM\_PACKER\_XENSERVER\packer_cache\4282f11098333441b4a8c39028041a36490797cb ==> xenserver-iso.XSTEST: Creating CD disk... xenserver-iso.XSTEST: OSCDIMG 2.56 CD-ROM and DVD-ROM Premastering Utility xenserver-iso.XSTEST: Copyright (C) Microsoft, 1993-2012. All rights reserved. xenserver-iso.XSTEST: Licensed only for producing Microsoft authorized content. xenserver-iso.XSTEST: Scanning source tree xenserver-iso.XSTEST: Scanning source tree complete (1 files in 1 directories) xenserver-iso.XSTEST: Computing directory information complete xenserver-iso.XSTEST: Image file is 57344 bytes (before optimization) xenserver-iso.XSTEST: Writing 1 files in 1 directories to tmp/packer1625305315.iso xenserver-iso.XSTEST: Storage optimization saved 0 files, 0 bytes (0% of image) xenserver-iso.XSTEST: After optimization, image file is 57344 bytes xenserver-iso.XSTEST: Done. xenserver-iso.XSTEST: 100% complete xenserver-iso.XSTEST: Done copying paths from CD_dirs ==> xenserver-iso.XSTEST: Step: Upload VDI 'Packer-CD' ==> xenserver-iso.XSTEST: Step: Found SR for upload 'OpaqueRef:ed24af24-cd3e-4ed0-2303-d885e72a691a' ==> xenserver-iso.XSTEST: PUT 'https://10.10.119.1/import_raw_vdi?session_id=OpaqueRef%3A93b232ae-a9bf-8b83-bb54-9aaf7412b6ba&task_id=OpaqueRef%3A99d66110-5044-37b2-7b21-baa23c54d2e1&vdi=OpaqueRef%3A65a7da41-3aba-e5b1-d1f1-0e5f006286f4' ==> xenserver-iso.XSTEST: Attemping to find VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Step: Upload VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Step: Found SR for upload 'OpaqueRef:ed24af24-cd3e-4ed0-2303-d885e72a691a' ==> xenserver-iso.XSTEST: PUT 'https://10.10.119.1/import_raw_vdi?session_id=OpaqueRef%3A93b232ae-a9bf-8b83-bb54-9aaf7412b6ba&task_id=OpaqueRef%3Ac8d26e51-2289-49b5-5363-220848bb4b6c&vdi=OpaqueRef%3A4893a784-2514-12b3-20bf-9880fc5bf3be' ==> xenserver-iso.XSTEST: Step: Create Instance ==> xenserver-iso.XSTEST: Using the following SR for the VM: OpaqueRef:67690a5f-2856-f785-7cac-fb59728d7ef2 ==> xenserver-iso.XSTEST: Created instance '2d4f4efc-5a3d-d915-380c-f86b0108eabe' ==> xenserver-iso.XSTEST: Step: Start VM Paused ==> xenserver-iso.XSTEST: Step: Set SSH address to VM host IP ==> xenserver-iso.XSTEST: Set host SSH address to '10.10.119.1'. ==> xenserver-iso.XSTEST: Set host SSH port to 22. ==> xenserver-iso.XSTEST: Unpausing VM 2d4f4efc-5a3d-d915-380c-f86b0108eabe ==> xenserver-iso.XSTEST: Waiting 10s for boot... ==> xenserver-iso.XSTEST: Connecting to VNC over XAPI... xenserver-iso.XSTEST: Making HTTP request to initiate VNC connection: CONNECT /console?uuid=6e861319-fb00-a8c8-d607-615b6c4561fe HTTP/1.0 xenserver-iso.XSTEST: Host: 10.10.119.1 xenserver-iso.XSTEST: Cookie: session_id=OpaqueRef:93b232ae-a9bf-8b83-bb54-9aaf7412b6ba xenserver-iso.XSTEST: xenserver-iso.XSTEST: xenserver-iso.XSTEST: Received response: HTTP/1.1 200 OK xenserver-iso.XSTEST: Connection: keep-alive xenserver-iso.XSTEST: Cache-Control: no-cache, no-store xenserver-iso.XSTEST: xenserver-iso.XSTEST: xenserver-iso.XSTEST: Found local IP: 10.10.11.99 ==> xenserver-iso.XSTEST: Typing boot commands over VNC... ==> xenserver-iso.XSTEST: Step: Wait for VMs IP to become known to us. ==> xenserver-iso.XSTEST: Successfully installed ==> xenserver-iso.XSTEST: Destroying VDI ==> xenserver-iso.XSTEST: Destroyed VDI 'windows_server_2025.iso' ==> xenserver-iso.XSTEST: Destroyed VDI 'Packer-CD' ==> xenserver-iso.XSTEST: Deleting output directory... ==> xenserver-iso.XSTEST: Closing sessions .... Build 'xenserver-iso.XSTEST' finished after 43 minutes 52 seconds. ==> Wait completed after 43 minutes 52 seconds ==> Builds finished. The artifacts of successful builds are: --> ==> xenserver-iso.XSTEST: W2K25.2511 azadmin@tacg-cicd:~$ After a successful run, XenServer should reflect the created VM, and after conversion, the corresponding template: The exact same process is done to create the Windows 11 Master Image and Template: Since the Master Images have been created, we can proceed to the next step. Part 2: Using Terraform to create the needed VMs based on the Master ImagesTerraform now creates all the required Infrastructure VMs for deploying CVAD: Two Windows Server 2025-based VMs for the Delivery Controllers One Windows Server 2025-based VM for the StoreFront server One Windows Server 2025-based VM for the WebStudio server. All needed settings are defined in a dedicated JSON file, where all variables and their values are stored. This allows maximum code flexibility and reusability, as it does not need to be changed when other VM configurations arise. Note: Those are the key principles of IaC – repeatability, reusability, and flexibility. Example of the VM settings in Terraform: { "TACG-TMM-XS-CL-VMSR":"local storage", "TACG-TMM-XS-CL-ISOSR":"ENTERPRISE ISO", "TACG-TMM-XS-CL-NW":"Network 0", "TACG-TMM-XS-CL-W2K25-MI":"W2K25.2511", "TACG-TMM-XS-CL-VM-DDC1-Name":"VM-TF-TACG-DDC1", "TACG-TMM-XS-CL-VM-DDC2-Name":"VM-TF-TACG-DDC2", "TACG-TMM-XS-CL-VM-StoreFront-Name":"VM-TF-TACG-SF", "TACG-TMM-XS-CL-VM-WebStudio-Name":"VM-TF-TACG-WS", "TACG-TMM-XS-CL-VM-DDC1-DiskName":"vdi-tacg-ddc1", "TACG-TMM-XS-CL-VM-DDC2-DiskName":"vdi-tacg-ddc2", "TACG-TMM-XS-CL-VM-StoreFront-DiskName":"vdi-tacg-sf", "TACG-TMM-XS-CL-VM-WebStudio-DiskName":"vdi-tacg-ws", "TACG-TMM-XS-CL-VM-DDC1-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-DDC2-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-StoreFront-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-WebStudio-DiskSize":64424509440, "TACG-TMM-XS-CL-VM-DDC1-MemSize":8589934592, "TACG-TMM-XS-CL-VM-DDC2-MemSize":8589934592, "TACG-TMM-XS-CL-VM-StoreFront-MemSize":8589934592, "TACG-TMM-XS-CL-VM-WebStudio-MemSize":8589934592, "TACG-TMM-XS-CL-VM-DDC1-CPUs":2, "TACG-TMM-XS-CL-VM-DDC2-CPUs":2, "TACG-TMM-XS-CL-VM-StoreFront-CPUs":2, "TACG-TMM-XS-CL-VM-DDC1-Cores":2, "TACG-TMM-XS-CL-VM-DDC2-Cores":2, "TACG-TMM-XS-CL-VM-StoreFront-Cores":2 }For example, if you want to change the main disk size, you only need to change the corresponding value: From to would double the disk size to 128GB. Important: As the current Terraform provider for XenServer does not support joining a newly created VM to an AD domain, this step will be performed in the next block using an Ansible playbook. Caution: The current version of the Terraform provider (1.0.30) at the time of writing this guide has a bug: The storage name is processed internally only in lowercase; however, if it contains an uppercase letter, an error message is returned. That is why the code snippets always refer to “local storage” rather than its original name, “Local storage”. Please rename the storage name you want to use in XenCenter™ to lowercase characters. Example Terraform snippet for VM creation: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs ## Definition of all required local variables ### Get XenServer-related Data #### Get the VM SR object data "xenserver_sr" "vmsr" { name_label = var.TACG-TMM-XS-CL-VMSR } #### Get the ISO SR object data "xenserver_sr" "isosr" { name_label = var.TACG-TMM-XS-CL-ISOSR } #### Get the Network object data "xenserver_network" "network" { } # Create a Windows Server 2025 VM for DDC1 from the custom template resource "xenserver_vm" "VM-DDC1" { name_label = var.TACG-TMM-XS-CL-VM-DDC1-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-DDC1-MemSize vcpus = var.TACG-TMM-XS-CL-VM-DDC1-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-DDC1-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] } # Create a Windows Server 2025 VM for DDC2 from the custom template resource "xenserver_vm" "VM-DDC2" { name_label = var.TACG-TMM-XS-CL-VM-DDC2-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-DDC2-MemSize vcpus = var.TACG-TMM-XS-CL-VM-DDC2-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-DDC2-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] } # Create a Windows Server 2025 VM for SF from the custom template resource "xenserver_vm" "VM-StoreFront" { name_label = var.TACG-TMM-XS-CL-VM-StoreFront-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-StoreFront-MemSize vcpus = var.TACG-TMM-XS-CL-VM-StoreFront-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-StoreFront-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] } # Create a Windows Server 2025 VM for WebStudio from the custom template resource "xenserver_vm" "VM-WebStudio" { name_label = var.TACG-TMM-XS-CL-VM-WebStudio-Name template_name = var.TACG-TMM-XS-CL-W2K25-MI static_mem_max = var.TACG-TMM-XS-CL-VM-WebStudio-MemSize vcpus = var.TACG-TMM-XS-CL-VM-StoreFront-CPUs cores_per_socket = var.TACG-TMM-XS-CL-VM-StoreFront-Cores sr_for_full_disk_copy = data.xenserver_sr.vmsr.data_items[0].uuid network_interface = [ { device = "0" network_uuid = data.xenserver_network.network.data_items[0].uuid, }, ] }Running this snippet should create all four VMs on XenServer: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_Creation$ terraform apply data.xenserver_sr.vmsr: Reading... data.xenserver_sr.isosr: Reading... data.xenserver_network.network: Reading... data.xenserver_sr.vmsr: Read complete after 0s data.xenserver_network.network: Read complete after 0s data.xenserver_sr.isosr: Read complete after 0s Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # xenserver_vm.VM-DDC1 will be created + resource "xenserver_vm" "VM-DDC1" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-DDC1" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } # xenserver_vm.VM-DDC2 will be created + resource "xenserver_vm" "VM-DDC2" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-DDC2" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } # xenserver_vm.VM-StoreFront will be created + resource "xenserver_vm" "VM-StoreFront" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-SF" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } # xenserver_vm.VM-WebStudio will be created + resource "xenserver_vm" "VM-WebStudio" { + boot_mode = (known after apply) + boot_order = (known after apply) + cdrom = "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso" + check_ip_timeout = 0 + cores_per_socket = 2 + default_ip = (known after apply) + dynamic_mem_max = (known after apply) + dynamic_mem_min = (known after apply) + hard_drive = (known after apply) + id = (known after apply) + name_description = "" + name_label = "VM-TF-TACG-WS" + network_interface = [ + { + device = "0" + mac = (known after apply) + network_uuid = "48045591-9653-12a9-edd9-62b345080a75" + other_config = (known after apply) + vif_ref = (known after apply) }, ] + other_config = {} + sr_for_full_disk_copy = "ab9a9821-a664-8727-788e-0bb4bbd692b8" + static_mem_max = 8589934592 + static_mem_min = (known after apply) + template_name = "W2K25.1025" + uuid = (known after apply) + vcpus = 2 } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes xenserver_vm.VM-DDC2: Creating... xenserver_vm.VM-DDC1: Creating... xenserver_vm.VM-StoreFront: Creating... xenserver_vm.VM-WebStudio: Creating... xenserver_vm.VM-DDC2: Still creating... [00m10s elapsed] xenserver_vm.VM-StoreFront: Still creating... [00m10s elapsed] xenserver_vm.VM-DDC1: Still creating... [00m10s elapsed] xenserver_vm.VM-WebStudio: Still creating... [00m10s elapsed] ... xenserver_vm.VM-DDC2: Still creating... [01m50s elapsed] xenserver_vm.VM-StoreFront: Still creating... [01m50s elapsed] xenserver_vm.VM-DDC1: Still creating... [01m50s elapsed] xenserver_vm.VM-WebStudio: Still creating... [01m50s elapsed] xenserver_vm.VM-DDC2: Creation complete after 1m59s [id=5e08ba70-f038-f926-9650-99148985018e] xenserver_vm.VM-DDC1: Creation complete after 1m59s [id=16330ad2-4c9a-e2db-cdc5-9c9b765fa879] xenserver_vm.VM-StoreFront: Creation complete after 1m59s [id=db28575f-34f1-7624-184a-9f9c69bebc0b] xenserver_vm.VM-WebStudio: Creation complete after 1m59s [id=88e132dd-45ed-1121-9eab-1e7fda2361aa] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_Creation$XenServer reflects the successful run: Since the VMs have been created, we can proceed to the next step. Part 3: Using Terraform and Ansible to configure the VMsThis configuration block now uses the combination of Terraform and Ansible for all needed configuration steps. As mentioned, Terraform excels at creating components; Ansible excels at configuring them. Together, we have everything we need for a successful deployment. Note: In all our guides, we try to be as Hypervisor- and Hyperscaler-agnostic as possible. For example, the vSphere provider could add a VM to an AD domain, but not all providers support this, and each provider uses a different syntax. Using the same Ansible playbook across all Hypervisors/Hyperscalers, regardless of built-in capabilities, also improves code reuse, as no specific code needs to be changed for different Hypervisor-/Hyperscaler deployments. This block also shows the main flow: Terraform decides which steps are necessary and starts the corresponding Ansible playbooks to achieve the needed outcome. The following configuration steps are sequentially done: Change the IP addresses to known IPs. Change the Ansible configuration file to reflect the IP changes. Put the VMs into the AD domain. As the VMs are created, they will get an IP address from a DHCP server. This is expected behavior, but it will break any communication flow between Ansible and the VMs, as Ansible needs to know how to contact the VM. It can also lead to interruptions if the VMs are still configured to use DHCP when the Delivery Controllers and StoreFront are installed, so it is imperative to update the Ansible hosts file to reflect the assigned, static IP addresses after IP assignment. In our example, the VMs will get DHCP-based IP addresses in the 10.10.11.x/24 range. This is reflected in Ansible´s etc/ansible/HOSTS file: ... [ddc1_ipaddr] 10.10.11.178 [ddc2_ipaddr] 10.10.11.179 [sf_ipaddr] 10.10.11.180 [ws_ipaddr] 10.10.11.181 ...After the VMs are created, Ansible can contact them using the originally assigned DHCP-based IPs. Terraform now takes the three steps mentioned above to correct that. Therefore, it changes the IPs to fixed IPs defined in the Ansible playbook's corresponding variables. The etc/ansible/HOSTS file is updated with the correct IPs, and the VMs are added to the domain. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs ## Definition of all required local variables ### Get Needed Data #### Call Ansible to Join VM to Domain ##### Copy Ansible Playbooks to Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyPlaybooksForCC1ToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC1-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC1-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC1-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC1-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC1-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC1-Destination } } resource "null_resource" "CopyPlaybooksForCC2ToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC2-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-CC2-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC2-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-CC2-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC2-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-CC2-Destination } } resource "null_resource" "CopyPlaybooksForSFToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-SF-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-SF-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-SF-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-SF-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-SF-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-SF-Destination } } resource "null_resource" "CopyPlaybooksForWebStudioToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-WS-Source destination = var.TACG-TMM-XS-CL-Ansible-DomainJoinPlaybook-WS-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-WS-Source destination = var.TACG-TMM-XS-CL-Ansible-IPChangePlaybook-WS-Destination } provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-WS-Source destination = var.TACG-TMM-XS-CL-Ansible-HostChangePlaybook-WS-Destination } } #### Wait 10s Minute for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyPlaybooksForCC1ToAnsibleServer, null_resource.CopyPlaybooksForCC2ToAnsibleServer, null_resource.CopyPlaybooksForSFToAnsibleServer, null_resource.CopyPlaybooksForWebStudioToAnsibleServer] create_duration = "10s" } #### Use Ansible to change all relevant settings on DDC1 ##### Connect to Ansible Interpreter and change IP of DDC1 resource "null_resource" "ChangeIPOfDDC1" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-IPChangeCMDForCC1 } } ##### Connect to Ansible Interpreter and change IP of DDC1 in Ansible´s HOSTS file resource "null_resource" "ChangeHostIPOfDDC1" { depends_on = [null_resource.ChangeIPOfDDC1] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-HostChangeCMDForCC1 } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode1" { depends_on = [null_resource.ChangeHostIPOfDDC1] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt1" { depends_on = [data.external.CheckAnsibleReturnCode1] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode1.result.found}\" = \"1\" ] && echo \"Changing IP/HOSTS: Everything OK\" || { echo \"Changing the IP of DDC1 and/or changing the Ansible HOSTS file failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } resource "time_sleep" "wait_10_seconds_1" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt1] create_duration = "10s" } ##### Connect to Ansible Interpreter and Add DDC1 To Domain resource "null_resource" "AddCC1ToDomain" { depends_on = [time_sleep.wait_10_seconds_1] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-DomainJoinCMDForCC1 } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeD1" { depends_on = [null_resource.AddCC1ToDomain] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltD1" { depends_on = [data.external.CheckAnsibleReturnCodeD1] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeD1.result.found}\" = \"1\" ] && echo \"Adding DDC1 to Domain: Everything OK\" || { echo \"Adding DDC1 to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### End of necessary changes on DDC1 #### Wait 10s Minute for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_afterddc1" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltD1] create_duration = "10s" } ... The same steps are needed for all the other servers ... ##### All necessary changes on the VMs are completeExample Ansible Playbook for changing the IP Address: ... - name: Change DDC1 IP address hosts: ddc1_ipaddr gather_facts: yes vars: ip: "10.10.119.11" sn: "16" gw: "10.10.0.1" dns: "10.10.100.1" tasks: - name: Set up static IP address ansible.windows.win_shell: | $interface = Get-NetAdapter | ? {$_.Status -eq "up"} $IpAddre = "{{ ip }}" $Prefx = "{{ sn }}" $GW = "{{ gw }}" $DNSAddre = "{{ dns }}" $interface | New-NetIPAddress -IPAddress $IpAddre -PrefixLength $Prefx -DefaultGateway $GW $interface | Set-DnsClientServerAddress -ServerAddresses $DNSAddre Start-Sleep -Seconds 10 async: 100 poll: 0 register: ip_resultExample Ansible Playbook for changing the etc/ansible/HOSTS file: ... - name: Replace old IP with new IP in /etc/ansible/hosts hosts: localhost connection: local become: true vars: ip: "10.10.119.11" oldip: "10.10.11.163" tasks: - name: Replace old IP with new IP in /etc/ansible/hosts lineinfile: path: /etc/ansible/hosts search_string: '{{ oldip }}' line: '{{ ip }}' state: presentExample Ansible Playbook for adding the VM to the AD domain: ... - name: join host to domain with automatic reboot hosts: ddc1_ipaddr tasks: - name: join host to domain with automatic reboot microsoft.ad.membership: dns_domain_name: the-austrian-citrix-guy.at hostname: tf-cvad-ddc1 domain_admin_user: XxXxXxXxX@the-austrian-citrix-guy.at domain_admin_password: "!XxXxXxXxXxXxXxXxX!" domain_ou_path: "OU=_COMPUTER,OU=TACG-CVAD,DC=the-austrian-citrix-guy,DC=at" state: domain reboot: trueRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_UseAnsibleToJoinDomain$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode1 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode1" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCode2 will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode2" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } ... # time_sleep.wait_10_seconds_afterddc2 will be created + resource "time_sleep" "wait_10_seconds_afterddc2" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_seconds_aftersf will be created + resource "time_sleep" "wait_10_seconds_aftersf" { + create_duration = "10s" + id = (known after apply) } Plan: 32 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Creating... null_resource.CopyPlaybooksForSFToAnsibleServer: Creating... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC2ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForCC1ToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Provisioning with 'file'... null_resource.CopyPlaybooksForSFToAnsibleServer: Creation complete after 0s [id=9099395716454281124] null_resource.CopyPlaybooksForCC2ToAnsibleServer: Creation complete after 1s [id=2239027084142302025] null_resource.CopyPlaybooksForCC1ToAnsibleServer: Creation complete after 1s [id=8241870746583503880] null_resource.CopyPlaybooksForWebStudioToAnsibleServer: Creation complete after 1s [id=85414301571074153] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-03T12:50:18Z] null_resource.ChangeIPOfDDC1: Creating... null_resource.ChangeIPOfDDC1: Provisioning with 'local-exec'... null_resource.ChangeIPOfDDC1 (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeIPAddress-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.ChangeIPOfDDC1 (local-exec): PLAY [Change DDC1 IP address] ************************************************** null_resource.ChangeIPOfDDC1 (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.ChangeIPOfDDC1 (local-exec): ok: [10.10.11.163] null_resource.ChangeIPOfDDC1 (local-exec): TASK [Set up static IP address] ************************************************ null_resource.ChangeIPOfDDC1 (local-exec): ok: [10.10.11.163] => {"ansible_async_watchdog_pid": 2392, "ansible_job_id": "j399189549114.3256", "changed": false, "finished": false, "results_file": "C:\\Users\\Administrator\\.ansible_async\\j399189549114.3256", "started": true} null_resource.ChangeIPOfDDC1 (local-exec): PLAY RECAP ********************************************************************* null_resource.ChangeIPOfDDC1 (local-exec): 10.10.11.163 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.ChangeIPOfDDC1: Creation complete after 5s [id=679400677203292951] null_resource.ChangeHostIPOfDDC1: Creating... null_resource.ChangeHostIPOfDDC1: Provisioning with 'local-exec'... null_resource.ChangeHostIPOfDDC1 (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeHostFile-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.ChangeHostIPOfDDC1 (local-exec): PLAY [Replace old IP with new IP in /etc/ansible/hosts] ************************ null_resource.ChangeHostIPOfDDC1 (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.ChangeHostIPOfDDC1 (local-exec): ok: [localhost] null_resource.ChangeHostIPOfDDC1 (local-exec): TASK [Replace old IP with new IP in /etc/ansible/hosts] ************************ null_resource.ChangeHostIPOfDDC1 (local-exec): changed: [localhost] => {"backup": "", "changed": true, "msg": "line replaced"} null_resource.ChangeHostIPOfDDC1 (local-exec): PLAY RECAP ********************************************************************* null_resource.ChangeHostIPOfDDC1 (local-exec): localhost : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.ChangeHostIPOfDDC1: Creation complete after 1s [id=4435900660469540446] data.external.CheckAnsibleReturnCode1: Reading... data.external.CheckAnsibleReturnCode1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt1: Creating... null_resource.IfExitCodeIsNotZeroThenHalt1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Changing IP/HOSTS: Everything OK\" || { echo \"Changing the IP of DDC1 and/or changing the Ansible HOSTS file failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt1 (local-exec): Changing IP/HOSTS: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt1: Creation complete after 0s [id=8720650856500940604] time_sleep.wait_10_seconds_1: Creating... time_sleep.wait_10_seconds_1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_1: Creation complete after 10s [id=2025-11-03T12:50:35Z] null_resource.AddCC1ToDomain: Creating... null_resource.AddCC1ToDomain: Provisioning with 'local-exec'... null_resource.AddCC1ToDomain (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/Join-VMToDomain-DDC1.microsoft.ad.ansible.yml -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.AddCC1ToDomain (local-exec): PLAY [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.AddCC1ToDomain (local-exec): ok: [10.10.119.11] null_resource.AddCC1ToDomain (local-exec): TASK [join host to domain with automatic reboot] ******************************* null_resource.AddCC1ToDomain: Still creating... [00m10s elapsed] null_resource.AddCC1ToDomain: Still creating... [00m20s elapsed] null_resource.AddCC1ToDomain (local-exec): changed: [10.10.119.11] => {"changed": true, "reboot_required": false} null_resource.AddCC1ToDomain (local-exec): PLAY RECAP ********************************************************************* null_resource.AddCC1ToDomain (local-exec): 10.10.119.11 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.AddCC1ToDomain: Creation complete after 28s [id=6625761552218837946] data.external.CheckAnsibleReturnCodeD1: Reading... data.external.CheckAnsibleReturnCodeD1: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltD1: Creating... null_resource.IfExitCodeIsNotZeroThenHaltD1: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltD1 (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Adding DDC1 to Domain: Everything OK\" || { echo \"Adding DDC1 to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltD1 (local-exec): Adding DDC1 to Domain: Everything OK null_resource.IfExitCodeIsNotZeroThenHaltD1: Creation complete after 0s [id=7818126381059512591] time_sleep.wait_10_seconds_afterddc1: Creating... time_sleep.wait_10_seconds_afterddc1: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds_afterddc1: Creation complete after 10s [id=2025-11-03T12:51:13Z] ... All these steps are the same for the other three servers. Output omitted due to length ... data.external.CheckAnsibleReturnCodeDWS: Reading... data.external.CheckAnsibleReturnCodeDWS: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltDWS: Creating... null_resource.IfExitCodeIsNotZeroThenHaltDWS: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltDWS (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Adding WebStudio to Domain: Everything OK\" || { echo \"Adding WebStudio to the domain failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltDWS (local-exec): Adding WebStudio to Domain: Everything OK null_resource.IfExitCodeIsNotZeroThenHaltDWS: Creation complete after 0s [id=975638781208917805] Apply complete! Resources: 32 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_UseAnsibleToJoinDomain$The etc/ansible/HOSTS file is updated with the correct IPs: ... [ddc1_ipaddr] 10.10.119.11 [ddc2_ipaddr] 10.10.119.12 [sf_ipaddr] 10.10.119.13 [ws_ipaddr] 10.10.119.14 ..All VMs are added to the AD domain: Ansible´s further used inventory.ini file also reflects all these changes: [cvad:children] cvad-ddcs cvad-sfs cvad-ws [cvad-ddcs] tf-cvad-ddc1.the-austrian-citrix-guy.at tf-cvad-ddc2.the-austrian-citrix-guy.at [cvad-ddc1] tf-cvad-ddc1.the-austrian-citrix-guy.at [cvad-ddc2] tf-cvad-ddc2.the-austrian-citrix-guy.at [cvad-ddc1-nb] TF-CVAD-DDC1 [cvad-ddc2-nb] TF-CVAD-DDC2 [cvad-sfs] tf-cvad-sf.the-austrian-citrix-guy.at [cvad-ws] tf-cvad-ws.the-austrian-citrix-guy.at [all:vars] ansible_user="svc_ansible" ansible_domainuser="XxXxXxXxX@the-austrian-citrix-guy.at" ansible_password="!XxXxXxXxXxXxXxXxXx!” ansible_connection=winrm ansible_winrm_scheme=https ansible_winrm_transport=certificate ansible_winrm_port=5986 ansible_winrm_server_cert_validation=ignore ansible_winrm_cert_pem=/etc/ssl/certs/svc_ansible.pem ansible_winrm_cert_key_pem=/etc/ssl/certs/svc_ansible.pem ansible_winrm_server_cert_validation=ignoreSince the VMs and their dependencies were successfully reconfigured, we can proceed to the next step. Part 4: Using Terraform and Ansible to deploy the Delivery ControllersThe VMs dedicated to holding the Delivery Controller™ roles are now ready for the deployment of the Delivery Controller components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the DDCs Install all required server roles and features before installing the DDCs Change some necessary registry settings Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VMs: Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleDDCAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } # Copy vars-ddcs.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Vars-Source destination = var.TACG-TMM-XS-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Inventory-Source destination = var.TACG-TMM-XS-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForDDCs-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForDDCs-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleDDCAssetsToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on DDCs resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-InitialCMDForDDCs } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying CVAD: Everything OK\" || { echo \"Deploying the CVAD software and its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } Example Ansible Playbook for deploying and configuring the DDCs and all needed further configurations: --- # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the Delivery Controllers - name: Configure the DDCs initially hosts: cvad-ddcs vars_files: - ./vars-ddcs.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ ddc_req_roles }}" state: present register: requirements - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 3010] creates_path: C:\Program Files\Citrix\Desktop Studio register: ddc_install - name: Reboot after DDC ansible.windows.win_reboot: when: ddc_install.changed - name: Remove DDC RunOnce Key ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce name: "!XenDesktopSetup" state: absent register: ddc_resume - name: Resume DDC Install ansible.windows.win_package: path: C:\ProgramData\Citrix\XenDesktopSetup\XenDesktopServerSetup.exe state: present expected_return_code: [0, 3, 3010] creates_path: C:\Program Files\Citrix\Desktop Studio when: ddc_resume.changed - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Restart a service ansible.windows.win_service: name: CitrixHostService state: startedRunning the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallCVAD$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleDDCAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleDDCAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleDDCAssetsToAnsibleServer: Creation complete after 0s [id=3392935108841645613] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-12T07:13:29Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForDDCs.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the DDCs initially] ******************************************** null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc1.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc2.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [00m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [12m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [12m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Group Policy Management", "id": 69, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Remote Server Administration Tools", "id": 67, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS and AD LDS Tools", "id": 329, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Tools", "id": 257, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Snap-Ins and Command-Line Tools", "id": 299, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Role Administration Tools", "id": 256, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Group Policy Management", "id": 69, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Remote Server Administration Tools", "id": 67, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS and AD LDS Tools", "id": 329, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Tools", "id": 257, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "AD DS Snap-Ins and Command-Line Tools", "id": 299, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Role Administration Tools", "id": 256, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook: Still creating... [15m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [15m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [15m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [25m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after DDC] ******************************************************** null_resource.RunInitialPlaybook: Still creating... [25m30s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m40s elapsed] null_resource.RunInitialPlaybook: Still creating... [25m50s elapsed] null_resource.RunInitialPlaybook: Still creating... [26m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 34, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 43, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): TASK [Remove DDC RunOnce Key] ************************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "data_changed": false, "data_type_changed": false} null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "data_changed": false, "data_type_changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Resume DDC Install] ****************************************************** null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "ddc_resume.changed", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "ddc_resume.changed", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook: Still creating... [26m10s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ddc2.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=12 changed=9 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 null_resource.RunInitialPlaybook (local-exec): tf-cvad-ddc2.the-austrian-citrix-guy.at : ok=12 changed=9 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 26m11s [id=3927491137125445482] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying CVAD: Everything OK\" || { echo \"Deploying the CVAD software and its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying CVAD: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=8978265277076340502] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallCVAD$ After successful deployment, the CVAD software is installed and can be configured later. Caution: We have noticed that in some environments, the Citrix Host Service does not start after the initial reboot, even though it is set to Automatic start. Therefore, we added a new task to the Ansible Playbook to ensure that the Citrix Host Service starts after the initial reboot and before the following configuration steps. Since the CVAD software and its dependencies were successfully deployed, we can proceed to the next step. Part 5: Using Terraform and Ansible to deploy the StoreFront serverThe VM dedicated to holding the StoreFront™ role is now ready for the deployment of the StoreFront components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the DDCs Install all required server roles and features before installing the DDCs Change some necessary registry settings Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VMs. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets for installing StoreFront to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSFAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP port = var.TACG-TMM-XS-CL-Ansible-Connection-Port https = var.TACG-TMM-XS-CL-Ansible-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-Ansible-Connection-Timeout } # Copy vars-sf.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Vars-Source destination = var.TACG-TMM-XS-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Inventory-Source destination = var.TACG-TMM-XS-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForSF-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForSF-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSFAssetsToAnsibleServer] create_duration = "10s" } ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on SF resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-InitialCMDForSF } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying StoreFront - Everything OK\" || { echo \"Deploying the StoreFront software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } }Example Ansible Playbook for deploying and configuring Storefront and all needed further configurations: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the StoreFront Server - name: Configure the StoreFront Server initially hosts: cvad-sf vars_files: - ./vars-sf.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ sf_req_roles }}" state: present register: requirements become: true become_method: runas become_user: SYSTEM - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Create database server record ansible.windows.win_dns_record: computer_name: "{{ sf_dns_ip }}" name: "{{ sf_dns_name }}" type: "A" value: "{{ sf_dns_value }}" zone: "{{ sf_dns_zone }}" state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 4, 3010] creates_path: C:\ProgramData\Citrix\Storefront Install register: sf_install become: true become_method: runas become_user: "{{ ansible_domainuser }}" - name: Reboot after sf ansible.windows.win_reboot: when: sf_install.changed Running the snippet should fulfill all required steps: At first, all missing Windows features are installed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallStoreFront$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSFAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSFAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleSFAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSFAssetsToAnsibleServer: Creation complete after 0s [id=3119681656948818723] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-04T16:59:29Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForStoreFront.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the StoreFront Server initially] ******************************* null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-sf.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [00m20s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [09m50s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook: Still creating... [10m00s elapsed] null_resource.RunInitialPlaybook: Still creating... [10m10s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [19m00s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Message Queuing", "id": 49, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Server", "id": 191, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Services", "id": 190, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 (includes .NET 2.0 and 3.0)", "id": 220, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 Features", "id": 475, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Activation", "id": 421, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing (MSMQ) Activation", "id": 422, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Named Pipe Activation", "id": 423, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "TCP Activation", "id": 424, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Telnet Client", "id": 44, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Process Activation Service", "id": 41, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Configuration APIs", "id": 217, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Process Model", "id": 219, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Initialization", "id": 445, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP", "id": 150, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Basic Authentication", "id": 163, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "CGI", "id": 151, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Dynamic Content Compression", "id": 173, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Redirection", "id": 146, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Tracing", "id": 159, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Server Side Includes", "id": 154, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Logging Tools", "id": 157, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Metabase Compatibility", "id": 179, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Management Compatibility", "id": 178, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Scripts and Tools", "id": 176, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 WMI Compatibility", "id": 180, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [19m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m20s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m30s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "22A6C5D5BB516ABD6DF5DC6E6CA0C0CEFBB19082", "rc": 3010, "reboot_required": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after sf] ********************************************************* null_resource.RunInitialPlaybook: Still creating... [19m40s elapsed] null_resource.RunInitialPlaybook: Still creating... [19m50s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m00s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m10s elapsed] null_resource.RunInitialPlaybook: Still creating... [20m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-sf.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 42, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-sf.the-austrian-citrix-guy.at : ok=11 changed=10 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 20m24s [id=7847329303251523226] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying StoreFront - Everything OK\" || { echo \"Deploying the StoreFront software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying StoreFront - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=6843415180162545622] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallStoreFront$ After successful deployment, the StoreFront software is installed and can be configured later. Since the StoreFront software and its dependencies were successfully deployed, we can proceed to the next step. Part 6: Using Terraform and Ansible to deploy the Web Studio ServerThe VM dedicated to holding the Web Studio role is now ready for the deployment of the Web Studio components. This is a multi-step approach: Mount the CVAD ISO installer Copy the publicly signed SSL certificate to the Web Studio server Install all required server roles and features before installing the Web Studio server Change some necessary registry settings Configure the Web Studio server as a proxy for the DDCs Therefore, we again use the well-proven combination of Terraform and Ansible. Initially, no Citrix software is installed on the VM again. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets for installing WebStudio to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleWSAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-Ansible-Connection-Type user = var.TACG-TMM-XS-CL-Ansible-Connection-User password = var.TACG-TMM-XS-CL-Ansible-Connection-Password host = var.TACG-TMM-XS-CL-Ansible-Connection-HostIP } # Copy vars-ws.yml file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Vars-Source destination = var.TACG-TMM-XS-CL-Ansible-Vars-Destination } # Copy inventory.ini file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-Inventory-Source destination = var.TACG-TMM-XS-CL-Ansible-Inventory-Destination } # Copy InitialConfig Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForWS-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForWS-Destination } # Copy SetProxy Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-SetProxyPlaybookWS-Source destination = var.TACG-TMM-XS-CL-Ansible-InitialPlaybookForWS-Destination } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleWSAssetsToAnsibleServer] create_duration = "10s" } #### Run initial configuration ##### Connect to Ansible Interpreter and run Initial Configuration Playbook on WS resource "null_resource" "RunInitialPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-InitialCMDForWS } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunInitialPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Deploying WebStudio: Everything OK\" || { echo \"Deploying the WebStudio software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_IC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt] create_duration = "10s" } ##### End of intitial configuration #### Run SetProxy configuration ##### Connect to Ansible Interpreter and run SetProxy Playbook on WS resource "null_resource" "RunSetProxyConfigurationPlaybook" { depends_on = [time_sleep.wait_10_seconds_IC] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-SetProxyPlaybookWS } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodePC" { depends_on = [null_resource.RunSetProxyConfigurationPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltPC" { depends_on = [data.external.CheckAnsibleReturnCodePC] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodePC.result.found}\" = \"1\" ] && echo \"Configuring WebStudio as Proxy: Everything OK\" || { echo \"Configuring WebStudio as Proxy failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Backgroud Processes to Settle resource "time_sleep" "wait_10_seconds_IC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHalt] create_duration = "10s" } ##### End of intitial configuration Example Ansible Playbook for deploying and configuring WebStudio and all needed further configurations: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Prepare the WebStudio Server - name: Configure the WebStudio Server initially hosts: cvad-ws vars_files: - ./vars-ws.yml tasks: - name: Create Installer directory ansible.windows.win_file: path: "{{ installdir }}" state: directory - name: Create Log Folder ansible.windows.win_file: path: "{{ logdir }}" state: directory - name: Alter unwanted Registry Keys-UserIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Alter unwanted Registry Keys-AdminIEESC ansible.windows.win_regedit: path: HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} name: IsInstalled data: 0 - name: Copy Citrix iso to the host ansible.windows.win_copy: src: "{{ sourceiso }}" dest: "{{ destiso }}" force: no - name: Copy the SSL certificate to the hosts ansible.windows.win_copy: src: "{{ certificate_source_path }}" dest: "{{ certificate_destination_path }}" force: no - name: Install Required Server Roles for Citrix ansible.windows.win_feature: name: "{{ ws_req_roles }}" state: present register: requirements become: true become_method: runas become_user: SYSTEM - name: Reboot when Required Roles need a restart ansible.windows.win_reboot: post_reboot_delay: 120 when: requirements.reboot_required - name: Install SSL-Certificate on Servers ansible.windows.win_certificate_store: path: "{{ certificate_destination_path }}" password: "{{ certificate_pfx_password }}" key_exportable: yes file_type: pkcs12 store_location: LocalMachine key_storage: machine state: present become: true become_method: runas become_user: SYSTEM - name: Run installer from mounted ISO ansible.windows.win_package: path: "{{ install_exe }} " arguments: "{{ install_params }}" state: present expected_return_code: [0, 3, 4, 3010] creates_path: C:\ProgramData\Citrix\Storefront Install register: ws_install become: true become_method: runas become_user: "{{ ansible_domainuser }}" - name: Reboot after ws ansible.windows.win_reboot: when: ws_install.changedExample Ansible Playbook for configuring Web Studio as Proxy: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Configure WS as Proxy - name: Configure WebStudio as Proxy hosts: cvad-ws gather_facts: no tasks: - name: Run PS to enable Proxy Mode ansible.windows.win_powershell: script: | & "c:\Program Files\Citrix\Web Studio\Tool\StudioConfig.exe" --enableproxy --proxyserver "tf-cvad-ws.the-austrian-citrix-guy.at" register: runps - name: Print results ansible.builtin.debug: var: runps Running the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallWebStudio$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleWSAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleWSAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunInitialPlaybook will be created + resource "null_resource" "RunInitialPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleWSAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleWSAssetsToAnsibleServer: Creation complete after 1s [id=8218302926752497323] time_sleep.wait_10_seconds: Creating... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-12T07:52:23Z] null_resource.RunInitialPlaybook: Creating... null_resource.RunInitialPlaybook: Provisioning with 'local-exec'... null_resource.RunInitialPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/InitialConfigurationForWS.ansible.yml -i /etc/ansible/assets/inventory.ini -v -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunInitialPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunInitialPlaybook (local-exec): PLAY [Configure the WebStudio Server initially] ******************************** null_resource.RunInitialPlaybook (local-exec): TASK [Gathering Facts] ********************************************************* null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ws.the-austrian-citrix-guy.at] null_resource.RunInitialPlaybook (local-exec): TASK [Create Installer directory] ********************************************** null_resource.RunInitialPlaybook (local-exec): ok: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": false} null_resource.RunInitialPlaybook (local-exec): TASK [Create Log Folder] ******************************************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-UserIEESC] ********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Alter unwanted Registry Keys-AdminIEESC] ********************************* null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "data_changed": false, "data_type_changed": true} null_resource.RunInitialPlaybook (local-exec): TASK [Copy Citrix iso to the host] ********************************************* null_resource.RunInitialPlaybook: Still creating... [00m10s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [09m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "operation": "file_copy", "original_basename": "Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso", "size": 4124442624, "src": "/etc/ansible/isos/Citrix_Virtual_Apps_and_Desktops_7_2507_LTSR.iso"} null_resource.RunInitialPlaybook (local-exec): TASK [Copy the SSL certificate to the hosts] *********************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": null, "dest": "C:\\InstallCVAD\\2025-wildcard.the-austrian-citrix-guy.at.PFX", "operation": "file_copy", "original_basename": "2025-wildcard.the-austrian-citrix-guy.at.PFX", "size": 3593, "src": "/etc/ansible/assets/2025-wildcard.the-austrian-citrix-guy.at.PFX"} null_resource.RunInitialPlaybook (local-exec): TASK [Install Required Server Roles for Citrix] ******************************** null_resource.RunInitialPlaybook: Still creating... [09m30s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [18m40s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "exitcode": "Success", "feature_result": [{"display_name": "Message Queuing", "id": 49, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Server", "id": 191, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing Services", "id": 190, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 429, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 (includes .NET 2.0 and 3.0)", "id": 220, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Framework 3.5 Features", "id": 475, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Activation", "id": 421, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Message Queuing (MSMQ) Activation", "id": 422, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Named Pipe Activation", "id": 423, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "TCP Activation", "id": 424, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Telnet Client", "id": 44, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Process Activation Service", "id": 41, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Configuration APIs", "id": 217, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Process Model", "id": 219, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Development", "id": 147, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Application Initialization", "id": 445, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP", "id": 150, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ASP.NET 4.8", "id": 413, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Basic Authentication", "id": 163, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "CGI", "id": 151, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Common HTTP Features", "id": 141, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Default Document", "id": 143, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Directory Browsing", "id": 144, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Dynamic Content Compression", "id": 173, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Request Filtering", "id": 169, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Health and Diagnostics", "id": 155, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Errors", "id": 145, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Logging", "id": 156, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "HTTP Redirection", "id": 146, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Tracing", "id": 159, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Server Side Includes", "id": 154, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Extensions", "id": 152, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "ISAPI Filters", "id": 153, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Logging Tools", "id": 157, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Metabase Compatibility", "id": 179, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 Management Compatibility", "id": 178, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Console", "id": 175, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Management Tools", "id": 174, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": ".NET Extensibility 4.8", "id": 414, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Performance", "id": 171, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS Management Scripts and Tools", "id": 176, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Security", "id": 162, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server (IIS)", "id": 2, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content Compression", "id": 172, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Static Content", "id": 142, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Web Server", "id": 140, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "Windows Authentication", "id": 164, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}, {"display_name": "IIS 6 WMI Compatibility", "id": 180, "message": [], "reboot_required": false, "skip_reason": "NotSkipped", "success": true}], "reboot_required": false, "success": true} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot when Required Roles need a restart] ******************************* null_resource.RunInitialPlaybook (local-exec): skipping: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": false, "false_condition": "requirements.reboot_required", "skip_reason": "Conditional result was False"} null_resource.RunInitialPlaybook (local-exec): TASK [Install SSL-Certificate on Servers] ************************************** null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "thumbprints": ["0BB52BDDEB78E6E8E32FF3B1949CAA462B8EC386"]} null_resource.RunInitialPlaybook (local-exec): TASK [Run installer from mounted ISO] ****************************************** null_resource.RunInitialPlaybook: Still creating... [18m50s elapsed] ... null_resource.RunInitialPlaybook: Still creating... [22m20s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "checksum": "EADE21C7B09DED5626F3BB51D4DF7A4C0E7AC607", "rc": 0, "reboot_required": false} null_resource.RunInitialPlaybook (local-exec): TASK [Reboot after sf] ********************************************************* null_resource.RunInitialPlaybook: Still creating... [22m30s elapsed] null_resource.RunInitialPlaybook: Still creating... [22m40s elapsed] null_resource.RunInitialPlaybook (local-exec): changed: [tf-cvad-ws.the-austrian-citrix-guy.at] => {"changed": true, "elapsed": 23, "rebooted": true, "unreachable": false} null_resource.RunInitialPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunInitialPlaybook (local-exec): tf-cvad-ws.the-austrian-citrix-guy.at : ok=11 changed=9 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0 null_resource.RunInitialPlaybook: Creation complete after 22m45s [id=7191293509250199804] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Deploying WebStudio: Everything OK\" || { echo \"Deploying the WebStudio software and/or its prerequisites failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Deploying WebStudio: Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=416418525198442619] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_InstallWebStudio$ After successful deployment, the WebStudio server is now installed and ready. We can continue with the next step. Part 7: Using Terraform and Ansible to change the SSL BindingsWe want to configure all transport in our environment as securely as possible. Therefore, Terraform and Ansible take additional steps to configure all SSL bindings across all servers and listeners to enable complete HTTPS communication. Where applicable, the SSL certificate is changed to a publicly signed certificate to avoid certificate trust errors. The change is applied by a PowerShell script, which Ansible runs on each applicable host. To obtain all required elevated privileges, we use PsExec64.exe as the host to run the PowerShell scripts. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-Ansible port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Playbook-Destination } } #### Copy the required PowerShell Scripts to the DDC1 resource "null_resource" "CopyPowerShellScriptsToDDC1" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-DDC1 port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the DDC1 provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the DDC1 provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the DDC2 resource "null_resource" "CopyPowerShellScriptsToDDC2" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-DDC2 port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the DDC2 provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the DDC2 provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the SF resource "null_resource" "CopyPowerShellScriptsToSF" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-SF port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the SF provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the SF provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } #### Copy the required PowerShell Scripts to the WS resource "null_resource" "CopyPowerShellScriptsToWS" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-WS port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy ChangeSSLCOnServers.ps1 file To the WS provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Source destination = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-Destination } # Copy PSExec64.exe file To the WS provisioner "file" { source = var.TACG-TMM-XS-CL-PsExec64-Source destination = var.TACG-TMM-XS-CL-PsExec64-Destination } } resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSiteAssetsToAnsibleServer, null_resource.CopyPowerShellScriptsToDDC1] create_duration = "10s" } ##### Change the SSL Bindings Start ##### Connect to Ansible Interpreter and run ChangeSSLOnServers-Playbook resource "null_resource" "RunChangeSSLPlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-ChangeSSLOnServers-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCode" { depends_on = [null_resource.RunChangeSSLPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { depends_on = [data.external.CheckAnsibleReturnCode] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCode.result.found}\" = \"1\" ] && echo \"Change SSL Bindings - Everything OK\" || { echo \"Changing the SSL bindings failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### Change the SSL Bindings EndExample Ansible Playbook for changing the SSL bindings on the DDCs: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Change SSL Certificate bindings to the previously uploaded public SSL Certificate by running a PowerShell script on all CVAD servers - name: Change SSL Certificate bindings hosts: cvad-ddcs gather_facts: no collections: - community.windows vars: domain_user: "TACG\\XxXxXxXxX" domain_pass: "!XxXxXxXxXxXxXxXxX!" psexec_path: "C:\\InstallCVAD\\PsExec64.exe" remote_script: "C:\\InstallCVAD\\ChangeSSLOnServers.ps1" ansible_user: "svc_ansible" ansible_password: "!XxXxXxXxXxXxXxXxX!" ansible_connection: winrm ansible_winrm_transport: certificate tasks: - name: Run the ChangeSSLOnDDCs-PowerShell script as Domain Administrator community.windows.win_psexec: command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{{ remote_script }}" executable: "{{ psexec_path }}" username: "{{ domain_user }}" password: "{{ domain_pass }}" elevated: true noprofile: true interactive: true wait: true Example PowerShell script to change the SSL bindings: Try { $friendlyName = "*.the-austrian-citrix-guy.at" $Thumbprint = (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.FriendlyName -eq $friendlyName}).Thumbprint -join ';' $ThumbprintC = ($ThumbPrint.Replace(" ","")) netsh http delete sslcert ipport=0.0.0.0:443 $NGuid = [guid]::NewGuid().ToString("B") netsh http add sslcert ipport=0.0.0.0:443 certhash=$ThumbprintC appid=$NGuid disablelegacytls=enable netsh http show sslcert } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ChangeSSLCertificateBindings: Error: $errorMessage" Write-Output "An error occurred trying to change the SSL-Certificate bindings (error: $($Error[0]))" Exit 1 }Running the snippet should fulfill all needed steps – example for running it on the DDCs: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ChangeSSLOnServers$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCode will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCode" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSiteAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC1 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC1" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC2 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC2" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToSF will be created + resource "null_resource" "CopyPowerShellScriptsToSF" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToWS will be created + resource "null_resource" "CopyPowerShellScriptsToWS" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHalt will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHalt" { + id = (known after apply) } # null_resource.RunChangeSSLPlaybook will be created + resource "null_resource" "RunChangeSSLPlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } Plan: 8 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creating... null_resource.CopyPowerShellScriptsToWS: Creating... null_resource.CopyPowerShellScriptsToDDC1: Creating... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToWS: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToSF: Creating... null_resource.CopyPowerShellScriptsToDDC2: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC2: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToSF: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creation complete after 0s [id=8882922836300404953] #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> ... null_resource.CopyPowerShellScriptsToDDC1: Creation complete after 10s [id=4814951330333809760] null_resource.CopyPowerShellScriptsToSF: Creation complete after 10s [id=6247443398511140586] null_resource.CopyPowerShellScriptsToDDC2: Creation complete after 10s [id=4396737003381006003] ... time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-13T12:24:08Z] null_resource.RunChangeSSLPlaybook: Creating... null_resource.RunChangeSSLPlaybook: Provisioning with 'local-exec'... null_resource.RunChangeSSLPlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/ChangeSSLOnServers.ansible.yml -i /etc/ansible/assets/inventory.ini -vvv -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunChangeSSLPlaybook (local-exec): Using /etc/ansible/ansible.cfg as config file null_resource.RunChangeSSLPlaybook (local-exec): PLAYBOOK: ChangeSSLOnServers.ansible.yml *************************************** null_resource.RunChangeSSLPlaybook (local-exec): 1 plays in /etc/ansible/assets/ChangeSSLOnServers.ansible.yml null_resource.RunChangeSSLPlaybook (local-exec): PLAY [Change SSL Certificate bindings] ***************************************** null_resource.RunChangeSSLPlaybook (local-exec): TASK [Run the ChangeSSLOnDDCs-PowerShell script as Domain Administrator] ******* null_resource.RunChangeSSLPlaybook (local-exec): task path: /etc/ansible/assets/ChangeSSLOnServers.ansible.yml:26 null_resource.RunChangeSSLPlaybook (local-exec): Using module file /usr/lib/python3/dist-packages/ansible_collections/community/windows/plugins/modules/win_psexec.ps1 null_resource.RunChangeSSLPlaybook (local-exec): Pipelining is enabled. null_resource.RunChangeSSLPlaybook (local-exec): <tf-cvad-ddc1.the-austrian-citrix-guy.at> ESTABLISH WINRM CONNECTION FOR USER: svc_ansible on PORT 5986 TO tf-cvad-ddc1.the-austrian-citrix-guy.at null_resource.RunChangeSSLPlaybook (local-exec): EXEC (via pipeline wrapper) null_resource.RunChangeSSLPlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => { null_resource.RunChangeSSLPlaybook (local-exec): "changed": true, null_resource.RunChangeSSLPlaybook (local-exec): "delta": "0:00:01.130213", null_resource.RunChangeSSLPlaybook (local-exec): "end": "2025-11-13 12:24:09.735282", null_resource.RunChangeSSLPlaybook (local-exec): "invocation": { null_resource.RunChangeSSLPlaybook (local-exec): "module_args": { null_resource.RunChangeSSLPlaybook (local-exec): "chdir": null, null_resource.RunChangeSSLPlaybook (local-exec): "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\ChangeSSLOnServers.ps1\"", null_resource.RunChangeSSLPlaybook (local-exec): "elevated": true, null_resource.RunChangeSSLPlaybook (local-exec): "executable": "C:\\InstallCVAD\\PsExec64.exe", null_resource.RunChangeSSLPlaybook (local-exec): "hostnames": null, null_resource.RunChangeSSLPlaybook (local-exec): "interactive": true, null_resource.RunChangeSSLPlaybook (local-exec): "limited": false, null_resource.RunChangeSSLPlaybook (local-exec): "nobanner": false, null_resource.RunChangeSSLPlaybook (local-exec): "noprofile": true, null_resource.RunChangeSSLPlaybook (local-exec): "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", null_resource.RunChangeSSLPlaybook (local-exec): "priority": null, null_resource.RunChangeSSLPlaybook (local-exec): "session": null, null_resource.RunChangeSSLPlaybook (local-exec): "system": false, null_resource.RunChangeSSLPlaybook (local-exec): "timeout": null, null_resource.RunChangeSSLPlaybook (local-exec): "username": "TACG\\administrator", null_resource.RunChangeSSLPlaybook (local-exec): "wait": true null_resource.RunChangeSSLPlaybook (local-exec): } null_resource.RunChangeSSLPlaybook (local-exec): }, null_resource.RunChangeSSLPlaybook (local-exec): "psexec_command": "C:\\InstallCVAD\\PsExec64.exe -u TACG\\administrator -p *PASSWORD_REPLACED* -e -h -i -accepteula powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\ChangeSSLOnServers.ps1\"", null_resource.RunChangeSSLPlaybook (local-exec): "rc": 0, null_resource.RunChangeSSLPlaybook (local-exec): "start": "2025-11-13 12:24:08.605068", null_resource.RunChangeSSLPlaybook (local-exec): "stderr": "Connecting to local system...\r\r\rStarting PSEXESVC service on local system...\r\r\rCopying authentication key to TF-CVAD-DDC1...\r\r\rConnecting with PsExec service on TF-CVAD-DDC1...\r\r\rStarting powershell.exe on TF-CVAD-DDC1...\r\r\r\r\npowershell.exe exited on TF-CVAD-DDC1 with error code 0.\r\n", null_resource.RunChangeSSLPlaybook (local-exec): "stderr_lines": [ null_resource.RunChangeSSLPlaybook (local-exec): "Connecting to local system...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Starting PSEXESVC service on local system...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Copying authentication key to TF-CVAD-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Connecting with PsExec service on TF-CVAD-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "Starting powershell.exe on TF-CVAD-DDC1...", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "powershell.exe exited on TF-CVAD-DDC1 with error code 0." null_resource.RunChangeSSLPlaybook (local-exec): ], null_resource.RunChangeSSLPlaybook (local-exec): "stdout": "\r\nPsExec v2.43 - Execute processes remotely\r\nCopyright (C) 2001-2023 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\n", null_resource.RunChangeSSLPlaybook (local-exec): "stdout_lines": [ null_resource.RunChangeSSLPlaybook (local-exec): "", null_resource.RunChangeSSLPlaybook (local-exec): "PsExec v2.43 - Execute processes remotely", null_resource.RunChangeSSLPlaybook (local-exec): "Copyright (C) 2001-2023 Mark Russinovich", null_resource.RunChangeSSLPlaybook (local-exec): "Sysinternals - www.sysinternals.com", null_resource.RunChangeSSLPlaybook (local-exec): "" null_resource.RunChangeSSLPlaybook (local-exec): ] null_resource.RunChangeSSLPlaybook (local-exec): } null_resource.RunChangeSSLPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunChangeSSLPlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunChangeSSLPlaybook (local-exec): tf-cvad-ddc2.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunChangeSSLPlaybook: Creation complete after 3s [id=6734265951530601448] data.external.CheckAnsibleReturnCode: Reading... data.external.CheckAnsibleReturnCode: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHalt: Creating... null_resource.IfExitCodeIsNotZeroThenHalt: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Change SSL Bindings - Everything OK\" || { echo \"Changing the SSL bindings failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHalt (local-exec): Change SSL Bindings - Everything OK null_resource.IfExitCodeIsNotZeroThenHalt: Creation complete after 0s [id=5221894585109127965] Apply complete! Resources: 8 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ChangeSSLOnServers$As all server operations are complete, we can now start with creating the CVAD site, the StoreFront site, and all the CVAD entities. Part 8: Using Terraform and Ansible to create the CVAD site and all its necessitiesCreating the CVAD site, including its requirements and dependencies, is a complex task that involves many steps. Terraform and Ansible together fulfill the following tasks: Create all databases Create the site Add the second DDC to the site Configure additional site configurations Configure a dedicated Administrators group Configure the licensing Before running these tasks, we see that no related databases exist on SQL Server, and no site is configured on the primary Delivery Controller: Important: All Terraform configurations and Ansible Playbooks, as well as the corresponding PowerShell scripts, must be run in the Site Administrator´s context – it must be a Domain user account. To obtain all required elevated privileges, we use PsExec64.exe as the host to run the PowerShell scripts. If we do not use the correct user account and privileges, the deployment will fail. Terraform monitors each Ansible Playbook run and stops further steps if a Playbook fails. Example Terraform snippet: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Copy the required Ansible Assets to the Ansible Server ###### ***** IMPORTANT: You must set the permissions to the destination directory accordingly (sudo) chmod 777 otherwise the provisioning will fail ***** resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-HostIP port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-AdditionalSiteConfiguration-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-AdditionalSiteConfiguration-Playbook-Destination } # Copy AddSecondDDCToSite Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-AddSecondDDCToSite-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-AddSecondDDCToSite-Playbook-Destination } # Copy ConfigureAdminGroup Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-ConfigureAdminGroup-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-ConfigureAdminGroup-Playbook-Destination } # Copy CreateDatabase Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-Playbook-Destination } # Copy CreateSite Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-CreateSite-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-CreateSite-Playbook-Destination } # Copy SetLicensing Playbook file To Ansible Server provisioner "file" { source = var.TACG-TMM-XS-CL-Ansible-SetLicensing-Playbook-Source destination = var.TACG-TMM-XS-CL-Ansible-SetLicensing-Playbook-Destination } } #### Copy the required PowerShell Scripts to the DDC resource "null_resource" "CopyPowerShellScriptsToDDC1" { connection { type = var.TACG-TMM-XS-CL-WinRM-Connection-Type user = var.TACG-TMM-XS-CL-WinRM-Connection-User password = var.TACG-TMM-XS-CL-WinRM-Connection-Password host = var.TACG-TMM-XS-CL-WinRM-Connection-HostIP port = var.TACG-TMM-XS-CL-WinRM-Connection-Port https = var.TACG-TMM-XS-CL-WinRM-Connection-HTTPS timeout = var.TACG-TMM-XS-CL-WinRM-Connection-Timeout } # Copy AdditionalSiteConfiguration.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-AdditionalSiteConfiguration-Source destination = var.TACG-TMM-XS-CL-DDC-AdditionalSiteConfiguration-Destination } # Copy AddSecondDDCToSite.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-AddSecondDDCToSite-Source destination = var.TACG-TMM-XS-CL-DDC-AddSecondDDCToSite-Destination } # Copy ConfigureAdminGroup.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-ConfigureAdminGroup-Source destination = var.TACG-TMM-XS-CL-DDC-ConfigureAdminGroup-Destination } # Copy CreateDatabase.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-CreateDatabase-Source destination = var.TACG-TMM-XS-CL-DDC-CreateDatabase-Destination } # Copy CreateSite.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-CreateSite-Source destination = var.TACG-TMM-XS-CL-DDC-CreateSite-Destination } # Copy SetLicensing.ps1 file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-SetLicensing-Source destination = var.TACG-TMM-XS-CL-DDC-SetLicensing-Destination } # Copy PsExec.exe file To the DDC provisioner "file" { source = var.TACG-TMM-XS-CL-DDC-PsExec-Source destination = var.TACG-TMM-XS-CL-DDC-PsExec-Destination } } resource "time_sleep" "wait_10_seconds" { depends_on = [null_resource.CopyAnsibleSiteAssetsToAnsibleServer, null_resource.CopyPowerShellScriptsToDDC1] create_duration = "10s" } ##### Create Databases Start ##### Connect to Ansible Interpreter and run CreateDatabase-Playbook on DDCs resource "null_resource" "RunCreateDatabasePlaybook" { depends_on = [time_sleep.wait_10_seconds] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateDatabase-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCDB" { depends_on = [null_resource.RunCreateDatabasePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { depends_on = [data.external.CheckAnsibleReturnCodeCDB] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCDB.result.found}\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_300_secondsCDB" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltCDB] create_duration = "300s" } ##### Create Databases End ##### Create Site Start ##### Connect to Ansible Interpreter and run CreateSite-Playbook on DDCs resource "null_resource" "RunCreateSitePlaybook" { depends_on = [time_sleep.wait_300_secondsCDB] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-CreateSite-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeCS" { depends_on = [null_resource.RunCreateSitePlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltCS" { depends_on = [data.external.CheckAnsibleReturnCodeCS] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeCS.result.found}\" = \"1\" ] && echo \"Create Site - Everything OK\" || { echo \"Deploying the CVAD Site failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_60_secondsCS" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltCS] create_duration = "60s" } ##### Create Site End ##### Create SiteAddSecondDDC Start ##### Connect to Ansible Interpreter and run AddSecondDDC-Playbook on DDCs resource "null_resource" "RunAddSecondDDCPlaybook" { depends_on = [time_sleep.wait_60_secondsCS] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-AddSecondDDCToSite-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeSecondDDC" { depends_on = [null_resource.RunAddSecondDDCPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltSecondDDC" { depends_on = [data.external.CheckAnsibleReturnCodeSecondDDC] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeSecondDDC.result.found}\" = \"1\" ] && echo \"Add Second DDC - Everything OK\" || { echo \"Adding second DDC to the CVAD Site failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsSecondDDC" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltSecondDDC] create_duration = "10s" } ##### Create SiteAddSecondDDC End ##### Create AdditionalSiteConfiguration Start ##### Connect to Ansible Interpreter and run AdditionalSiteConfiguration-Playbook on DDCs resource "null_resource" "RunAdditionalSiteConfigurationPlaybook" { depends_on = [time_sleep.wait_10_secondsSecondDDC] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-AdditionalSiteConfiguration-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeAdditionalSiteConfiguration" { depends_on = [null_resource.RunAdditionalSiteConfigurationPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration" { depends_on = [data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration.result.found}\" = \"1\" ] && echo \"Additional Site Configuration - Everything OK\" || { echo \"Running the additional Site Configurations failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsAdditionalSiteConfiguration" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration] create_duration = "10s" } ##### Create AdditionalSiteConfiguration End ##### Create ConfigureAdminGroup Start ##### Connect to Ansible Interpreter and run ConfigureAdminGroup-Playbook on DDCs resource "null_resource" "RunConfigureAdminGroupPlaybook" { depends_on = [time_sleep.wait_10_secondsAdditionalSiteConfiguration] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-ConfigureAdminGroup-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeConfigureAdminGroup" { depends_on = [null_resource.RunConfigureAdminGroupPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltConfigureAdminGroup" { depends_on = [data.external.CheckAnsibleReturnCodeConfigureAdminGroup] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeConfigureAdminGroup.result.found}\" = \"1\" ] && echo \"Admin Group Configuration - Everything OK\" || { echo \"Running the Configuration of the AdminGroup failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } #### Wait 10s for Background Processes to Settle resource "time_sleep" "wait_10_secondsConfigureAdminGroup" { depends_on = [null_resource.IfExitCodeIsNotZeroThenHaltConfigureAdminGroup] create_duration = "10s" } ##### Create ConfigureAdminGroup End ##### Create SetLicensing Start ##### Connect to Ansible Interpreter and run SetLicensing-Playbook on DDCs resource "null_resource" "RunConfigureSetLicensingPlaybook" { depends_on = [time_sleep.wait_10_secondsConfigureAdminGroup] provisioner "local-exec" { working_dir = "/etc/ansible" command = var.TACG-TMM-XS-CL-Ansible-SetLicensing-CMD } } ##### Check Ansible Return Code data "external" "CheckAnsibleReturnCodeSetLicensing" { depends_on = [null_resource.RunConfigureSetLicensingPlaybook] program = ["bash", "/etc/ansible/assets/CheckAnsibleReturnCode.sh", "/etc/ansible/assets/ansible_exit_code.txt", "0"] } ##### Terminate if Return Code is not 0 resource "null_resource" "IfExitCodeIsNotZeroThenHaltSetLicensing" { depends_on = [data.external.CheckAnsibleReturnCodeSetLicensing] provisioner "local-exec" { interpreter = ["/bin/bash", "-c"] command = "[ \"${data.external.CheckAnsibleReturnCodeSetLicensing.result.found}\" = \"1\" ] && echo \"Licensing Configuration - Everything OK\" || { echo \"Configuration of Licensing failed. Please review the settings. Halting Terraform.\"; exit 1; }" } } ##### Create SetLicensing End Example Ansible Playbook calling the corresponding PowerShell script in PsExec64.exe for creating the required databases: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## For installation and configuration of the Delivery Controllers, StoreFront-Servers and WebStudio-Servers, we use Ansible Playbooks ### Reference https://docs.ansible.com/ansible/latest/getting_started/index.html #### We assume that the communication between the Ansible Server and all needed Hosts via WinRM is working as intended - check your Group Policies ##### All hosts and its corresponding communication-related Ansible variables are stored in assets/inventory.ini ###### Create CVAD Databases by running a PowerShell script on DDC1 - name: Create CVAD Databases hosts: cvad-ddc1 gather_facts: no collections: - community.windows vars: domain_user: "TACG\\XxXxXxXxXxXxX" domain_pass: "!XxXxXxXxXxXxXxXxX!" psexec_path: "C:\\InstallCVAD\\PsExec64.exe" target_host: "tf-cvad-ddc1.the-austrian-citrix-guy.at" remote_script: "C:\\InstallCVAD\\CreateDatabases.ps1" ansible_user: "svc_ansible" ansible_password: "!XxXxXxXxXxXxXxXxX!" ansible_connection: winrm ansible_winrm_transport: certificate tasks: - name: Run the Create Database-PowerShell script as Domain Administrator community.windows.win_psexec: command: powershell.exe -NoProfile -ExecutionPolicy Bypass -File "{{ remote_script }}" executable: "{{ psexec_path }}" username: "{{ domain_user }}" password: "{{ domain_pass }}" elevated: true noprofile: true interactive: true wait: trueExample PowerShell script for creating the required databases: Import-Module Citrix.XenDesktop®.Admin asnp citrix.* $SiteName = "TF-TACG-CVAD2507" $DatabaseServer = "tacg-sql.the-austrian-citrix-guy.at" $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $DatabasePrefix = "DB-" try { New-XDDatabase -AdminAddress $DDCName -SiteName $SiteName -AllDefaultDatabases -DatabaseServer $DatabaseServer -DatabaseNamePrefix $DatabasePrefix -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - CreateDB: Error: $errorMessage" Write-Output "An error occurred trying to create the databases (error: $($Error[0]))" Exit 1 } Note: The corresponding Ansible Playbooks for all the needed steps mentioned above are mostly the same – they differ only in running the feasible PowerShell script. Example PowerShell script for creating the CVAD site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $SiteName = "TF-TACG-CVAD2507" $DatabaseServer = "tacg-sql.the-austrian-citrix-guy.at" $DatabaseName_Site = "DB-CitrixTF-TACG-CVAD2507Site" $DatabaseName_Logging = "DB-CitrixTF-TACG-CVAD2507Logging" $DatabaseName_Monitoring = "DB-CitrixTF-TACG-CVAD2507Monitoring" $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" try { New-XDSite -DatabaseServer $DatabaseServer -LoggingDatabaseName $DatabaseName_Logging -MonitorDatabaseName $DatabaseName_Monitoring -SiteDatabaseName $DatabaseName_Site -SiteName $SiteName -AdminAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - CreateSite: Error: $errorMessage" Write-Output "An error occurred trying to create the CVAD site (error: $($Error[0]))" Exit 1 } Example PowerShell script for adding the second DDC to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $NewDDCName = "tf-cvad-ddc2.the-austrian-citrix-guy.at" try { Add-XDController -AdminAddress $NewDDCName -SiteControllerAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - Add2ndDDC: Error: $errorMessage" Write-Output "An error occurred trying to add the 2nd DDC (error: $($Error[0]))" Exit 1 } Example PowerShell script for adding the second DDC to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $NewDDCName = "tf-cvad-ddc2.the-austrian-citrix-guy.at" try { Add-XDController -AdminAddress $NewDDCName -SiteControllerAddress $DDCName -Verbose } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - Add2ndDDC: Error: $errorMessage" Write-Output "An error occurred trying to add the 2nd DDC (error: $($Error[0]))" Exit 1 }Example PowerShell script for running additional site configurations: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $GroomingDays = 90 try { Set-MonitorConfiguration -GroomApplicationInstanceRetentionDays $GroomingDays -GroomDeletedRetentionDays $GroomingDays -GroomFailuresRetentionDays $GroomingDays -GroomLoadIndexesRetentionDays $GroomingDays -GroomMachineHotfixLogRetentionDays $GroomingDays -GroomNotificationLogRetentionDays $GroomingDays -GroomResourceUsageDayDataRetentionDays $GroomingDays -GroomSessionsRetentionDays $GroomingDays -GroomSummariesRetentionDays $GroomingDays Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true Set-BrokerSite -ConnectionLeasingEnabled $false Set-BrokerSite -LocalHostCacheEnabled $true Set-AnalyticsSite -Enabled $false } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - AdditionalSiteConfiguration: Error: $errorMessage" Write-Output "An error occurred trying to run the additional Site configuration (error: $($Error[0]))" Exit 1 }Example PowerShell script for adding a dedicated Administrators group to the site: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $AdminGroup = "TACG-CTX-Admins" try { New-AdminAdministrator -AdminAddress $DDCName -Name $AdminGroup Add-AdminRight -AdminAddress $DDCName -Administrator $AdminGroup -Role 'Full Administrator' -Scope "All" } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ConfigureCTXAdminGroup: Error: $errorMessage" Write-Output "An error occurred trying to run the CTXAdminGroup script (error: $($Error[0]))" Exit 1 }Example PowerShell script for configuring the Licensing: Import-Module Citrix.XenDesktop.Admin asnp citrix.* $DDCName = "tf-cvad-ddc1.the-austrian-citrix-guy.at" $LicenseServer = "tacg-dc.the-austrian-citrix-guy.at" $LicenseServerPort = 27000 $LicensingModel = "UserDevice" $ProductCode = "XDT" $ProductEdition = "PLT" try { Set-XDLicensing -AdminAddress $DDCName -LicenseServerAddress $LicenseServer -LicenseServerPort $LicenseServerPort -Force Set-ConfigSite -AdminAddress $DDCName -LicensingModel $LicensingModel -ProductCode $ProductCode -ProductEdition $ProductEdition -UseLicenseActivationService $true Set-ConfigSiteMetadata -AdminAddress $DDCName -Name 'CertificateHash' -Value $(Get-LicCertificate -AdminAddress "https://$($LicenseServer):8083").CertHash } catch { $logFile = "C:\Logs\MyLogFile.log" $errorMessage = $_.Exception.Message Add-Content -Path $logFile -Value "$(Get-Date) - ConfigureLicensing: Error: $errorMessage" Write-Output "An error occurred trying to run the ConfigureLicensing script (error: $($Error[0]))" Exit 1 }Running the snippet should fulfill all the steps mentioned above and create the CVAD site: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ConfigureSite$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create <= read (data resources) Terraform will perform the following actions: # data.external.CheckAnsibleReturnCodeAdditionalSiteConfiguration will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeAdditionalSiteConfiguration" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeCDB will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeCDB" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeCS will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeCS" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeConfigureAdminGroup will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeConfigureAdminGroup" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeSecondDDC will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeSecondDDC" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # data.external.CheckAnsibleReturnCodeSetLicensing will be read during apply # (depends on a resource or a module with changes pending) <= data "external" "CheckAnsibleReturnCodeSetLicensing" { + id = (known after apply) + program = [ + "bash", + "/etc/ansible/assets/CheckAnsibleReturnCode.sh", + "/etc/ansible/assets/ansible_exit_code.txt", + "0", ] + result = (known after apply) } # null_resource.CopyAnsibleSiteAssetsToAnsibleServer will be created + resource "null_resource" "CopyAnsibleSiteAssetsToAnsibleServer" { + id = (known after apply) } # null_resource.CopyPowerShellScriptsToDDC1 will be created + resource "null_resource" "CopyPowerShellScriptsToDDC1" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltAdditionalSiteConfiguration" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltCDB will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltCDB" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltCS will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltCS" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltConfigureAdminGroup will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltConfigureAdminGroup" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltSecondDDC will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltSecondDDC" { + id = (known after apply) } # null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing will be created + resource "null_resource" "IfExitCodeIsNotZeroThenHaltSetLicensing" { + id = (known after apply) } # null_resource.RunAddSecondDDCPlaybook will be created + resource "null_resource" "RunAddSecondDDCPlaybook" { + id = (known after apply) } # null_resource.RunAdditionalSiteConfigurationPlaybook will be created + resource "null_resource" "RunAdditionalSiteConfigurationPlaybook" { + id = (known after apply) } # null_resource.RunConfigureAdminGroupPlaybook will be created + resource "null_resource" "RunConfigureAdminGroupPlaybook" { + id = (known after apply) } # null_resource.RunConfigureSetLicensingPlaybook will be created + resource "null_resource" "RunConfigureSetLicensingPlaybook" { + id = (known after apply) } # null_resource.RunCreateDatabasePlaybook will be created + resource "null_resource" "RunCreateDatabasePlaybook" { + id = (known after apply) } # null_resource.RunCreateSitePlaybook will be created + resource "null_resource" "RunCreateSitePlaybook" { + id = (known after apply) } # time_sleep.wait_10_seconds will be created + resource "time_sleep" "wait_10_seconds" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsAdditionalSiteConfiguration will be created + resource "time_sleep" "wait_10_secondsAdditionalSiteConfiguration" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsConfigureAdminGroup will be created + resource "time_sleep" "wait_10_secondsConfigureAdminGroup" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_10_secondsSecondDDC will be created + resource "time_sleep" "wait_10_secondsSecondDDC" { + create_duration = "10s" + id = (known after apply) } # time_sleep.wait_300_secondsCDB will be created + resource "time_sleep" "wait_300_secondsCDB" { + create_duration = "300s" + id = (known after apply) } # time_sleep.wait_60_secondsCS will be created + resource "time_sleep" "wait_60_secondsCS" { + create_duration = "60s" + id = (known after apply) } Plan: 20 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes null_resource.CopyPowerShellScriptsToDDC1: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creating... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Provisioning with 'file'... null_resource.CopyAnsibleSiteAssetsToAnsibleServer: Creation complete after 1s [id=3364084582988389224] time_sleep.wait_10_seconds: Creating... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> null_resource.CopyPowerShellScriptsToDDC1: Provisioning with 'file'... #< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>#< CLIXML <Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs> ... null_resource.CopyPowerShellScriptsToDDC1: Creation complete after 10s [id=6861429796874371568] time_sleep.wait_10_seconds: Still creating... [00m10s elapsed] time_sleep.wait_10_seconds: Creation complete after 10s [id=2025-11-12T16:58:47Z] null_resource.RunCreateDatabasePlaybook: Creating... null_resource.RunCreateDatabasePlaybook: Provisioning with 'local-exec'... null_resource.RunCreateDatabasePlaybook (local-exec): Executing: ["/bin/sh" "-c" "ansible-playbook /etc/ansible/assets/CreateDatabases.ansible.yml -i /etc/ansible/assets/inventory.ini -vvv -c winrm; echo $? > /etc/ansible/assets/ansible_exit_code.txt"] null_resource.RunCreateDatabasePlaybook (local-exec): PLAYBOOK: CreateDatabases.ansible.yml ****************************************** null_resource.RunCreateDatabasePlaybook (local-exec): 1 plays in /etc/ansible/assets/CreateDatabases.ansible.yml null_resource.RunCreateDatabasePlaybook (local-exec): PLAY [Run PowerShell script on Windows Server as Domain Admin] ***************** null_resource.RunCreateDatabasePlaybook (local-exec): TASK [Run the StoreFront installer PowerShell script as domain user] *********** null_resource.RunCreateDatabasePlaybook (local-exec): task path: /etc/ansible/assets/CreateDatabases.ansible.yml:20 null_resource.RunCreateDatabasePlaybook (local-exec): Using module file /usr/lib/python3/dist-packages/ansible_collections/community/windows/plugins/modules/win_psexec.ps1 null_resource.RunCreateDatabasePlaybook (local-exec): Pipelining is enabled. null_resource.RunCreateDatabasePlaybook (local-exec): <tf-cvad-ddc1.the-austrian-citrix-guy.at> ESTABLISH WINRM CONNECTION FOR USER: svc_ansible on PORT 5986 TO tf-cvad-ddc1.the-austrian-citrix-guy.at null_resource.RunCreateDatabasePlaybook (local-exec): EXEC (via pipeline wrapper) null_resource.RunCreateDatabasePlaybook (local-exec): changed: [tf-cvad-ddc1.the-austrian-citrix-guy.at] => { null_resource.RunCreateDatabasePlaybook (local-exec): "changed": true, null_resource.RunCreateDatabasePlaybook (local-exec): "delta": "0:00:32.533635", null_resource.RunCreateDatabasePlaybook (local-exec): "end": "2025-11-12 04:59:20.201075", null_resource.RunCreateDatabasePlaybook (local-exec): "invocation": { null_resource.RunCreateDatabasePlaybook (local-exec): "module_args": { null_resource.RunCreateDatabasePlaybook (local-exec): "chdir": null, null_resource.RunCreateDatabasePlaybook (local-exec): "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\CreateDatabases.ps1\"", null_resource.RunCreateDatabasePlaybook (local-exec): "elevated": true, null_resource.RunCreateDatabasePlaybook (local-exec): "executable": "C:\\InstallCVAD\\PsExec64.exe", null_resource.RunCreateDatabasePlaybook (local-exec): "hostnames": null, null_resource.RunCreateDatabasePlaybook (local-exec): "interactive": true, null_resource.RunCreateDatabasePlaybook (local-exec): "limited": false, null_resource.RunCreateDatabasePlaybook (local-exec): "nobanner": false, null_resource.RunCreateDatabasePlaybook (local-exec): "noprofile": true, null_resource.RunCreateDatabasePlaybook (local-exec): "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", null_resource.RunCreateDatabasePlaybook (local-exec): "priority": null, null_resource.RunCreateDatabasePlaybook (local-exec): "session": null, null_resource.RunCreateDatabasePlaybook (local-exec): "system": false, null_resource.RunCreateDatabasePlaybook (local-exec): "timeout": null, null_resource.RunCreateDatabasePlaybook (local-exec): "username": "TACG\\administrator", null_resource.RunCreateDatabasePlaybook (local-exec): "wait": true null_resource.RunCreateDatabasePlaybook (local-exec): } null_resource.RunCreateDatabasePlaybook (local-exec): }, null_resource.RunCreateDatabasePlaybook (local-exec): "psexec_command": "C:\\InstallCVAD\\PsExec64.exe -u TACG\\administrator -p *PASSWORD_REPLACED* -e -h -i -accepteula powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\\InstallCVAD\\CreateDatabases.ps1\"", null_resource.RunCreateDatabasePlaybook (local-exec): "rc": 0, null_resource.RunCreateDatabasePlaybook (local-exec): "start": "2025-11-12 04:58:47.667440", null_resource.RunCreateDatabasePlaybook (local-exec): "stderr": "Connecting to local system...\r\r\rStarting PSEXESVC service on local system...\r\r\rCopying authentication key to TF-CVAD-DDC1...\r\r\rConnecting with PsExec service on TF-CVAD-DDC1...\r\r\rStarting powershell.exe on TF-CVAD-DDC1...\r\r\r\r\npowershell.exe exited on TF-CVAD-DDC1 with error code 0.\r\n", null_resource.RunCreateDatabasePlaybook (local-exec): "stderr_lines": [ null_resource.RunCreateDatabasePlaybook (local-exec): "Connecting to local system...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Starting PSEXESVC service on local system...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Copying authentication key to TF-CVAD-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Connecting with PsExec service on TF-CVAD-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "Starting powershell.exe on TF-CVAD-DDC1...", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "powershell.exe exited on TF-CVAD-DDC1 with error code 0." null_resource.RunCreateDatabasePlaybook (local-exec): ], null_resource.RunCreateDatabasePlaybook (local-exec): "stdout": "\r\nPsExec v2.43 - Execute processes remotely\r\nCopyright (C) 2001-2023 Mark Russinovich\r\nSysinternals - www.sysinternals.com\r\n\r\n", null_resource.RunCreateDatabasePlaybook (local-exec): "stdout_lines": [ null_resource.RunCreateDatabasePlaybook (local-exec): "", null_resource.RunCreateDatabasePlaybook (local-exec): "PsExec v2.43 - Execute processes remotely", null_resource.RunCreateDatabasePlaybook (local-exec): "Copyright (C) 2001-2023 Mark Russinovich", null_resource.RunCreateDatabasePlaybook (local-exec): "Sysinternals - www.sysinternals.com", null_resource.RunCreateDatabasePlaybook (local-exec): "" null_resource.RunCreateDatabasePlaybook (local-exec): ] null_resource.RunCreateDatabasePlaybook (local-exec): } null_resource.RunCreateDatabasePlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunCreateDatabasePlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunCreateDatabasePlaybook: Creation complete after 35s [id=5576848404034541586] data.external.CheckAnsibleReturnCodeCDB: Reading... data.external.CheckAnsibleReturnCodeCDB: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltCDB: Creating... null_resource.IfExitCodeIsNotZeroThenHaltCDB: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltCDB (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Create Databases - Everything OK\" || { echo \"Deploying the CVAD Databases failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltCDB (local-exec): Create Databases - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltCDB: Creation complete after 0s [id=449387280135483830] ... Running all Playbooks looks similar, omitted due to the length of the output. ... null_resource.RunConfigureSetLicensingPlaybook (local-exec): PLAY RECAP ********************************************************************* null_resource.RunConfigureSetLicensingPlaybook (local-exec): tf-cvad-ddc1.the-austrian-citrix-guy.at : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 null_resource.RunConfigureSetLicensingPlaybook: Creation complete after 13s [id=5106544801416722566] data.external.CheckAnsibleReturnCodeSetLicensing: Reading... data.external.CheckAnsibleReturnCodeSetLicensing: Read complete after 0s [id=-] null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Creating... null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Provisioning with 'local-exec'... null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing (local-exec): Executing: ["/bin/bash" "-c" "[ \"1\" = \"1\" ] && echo \"Licensing Configuration - Everything OK\" || { echo \"Configuration of Licensing failed. Please review the settings. Halting Terraform.\"; exit 1; }"] null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing (local-exec): Licensing Configuration - Everything OK null_resource.IfExitCodeIsNotZeroThenHaltSetLicensing: Creation complete after 0s [id=1454545395290283154] Apply complete! Resources: 26 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_ConfigureSite$The Terraform snippet has successfully created the site and all needed configurations: The CVAD site was successfully created: All site tests are successful: With the CVAD site ready, we can proceed to the next step. Part 9: Using Terraform to create the StoreFront deployment and all its necessitiesCreating a StoreFront deployment is a simple, straightforward task. Terraform can create the Storefront site on its own – no Ansible interaction is needed. Caution: As already mentioned, this module, Module 9, must be run on a Windows-based, domain-joined VM due to limitations in StoreFront´s automation capabilities. Terraform will sequentially run the following tasks: Create the StoreFront deployment Create a StoreFront Authentication service Create a StoreFront Store service Create a StoreFront WebReceiver service Warning: The current Automation snippets of StoreFront will only run on Windows Powershell <=5.1. They will not run on Powershell >=6. Be sure to start the Terraform code on the correct PowerShell version. You may encounter this error after starting the Terraform snippet: Error: Error fetching StoreFront version │ │ with citrix_stf_webreceiver_service.CreateSFWebReceiverService, │ on CVADOnXS-ConfigureStoreFront.tf line 48, in resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService": │ 48: resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { │ │ Error message: error executing command: Get-STFVersion │ Error Message: │ ConvertTo-SecureString : "ConvertTo-SecureString" was found in module "Microsoft.PowerShell.Security", │ we were unable to load the module. Run "Import-Module │ Microsoft.PowerShell.Security". │ In row:1 column:205 │ + ... n@the-austrian-citrix-guy.at',(ConvertTo-SecureString -Force ... │ + ~~~~~~~~~~~~~~~~~~~~~~ │ + CategoryInfo : ObjectNotFound: (ConvertTo-SecureString:String) [], CommandNotFoundException │ + FullyQualifiedErrorId : CouldNotAutoloadMatchingModuleThat error means you have not loaded the module Microsoft.PowerShell.Security in Windows PowerShell. Be sure to load the module in Windows PowerShell, not PowerShell: PS C:\__PPMM\__TF\_CVADOnXS-25.11\_ConfigureStoreFront> Import-Module Microsoft.PowerShell.Security After loading the module in Windows PowerShell, the error should be gone and the Terraform snippet run through. Before running the snippet, the StoreFront server has no StoreFront site configured: Example Terraform snippet to create a StoreFront site: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/xenserver/xenserver/latest/docs #### Configuring StoreFront ##### Reference https://github.com/citrix/terraform-provider-citrix/blob/main/StoreFront.md ###### Create an initial StoreFront Deployment resource "citrix_stf_deployment" "CreateInitialSFDeployment" { site_id = var.TACG-TMM-SF-SiteID host_base_url = var.TACG-TMM-SF-SiteURL roaming_gateway = [ { name = var.TACG-TMM-SF-Gateway-Name logon_type = var.TACG-TMM-SF-Gateway-LogonType gateway_url = var.TACG-TMM-SF-Gateway-URL callback_url = var.TACG-TMM-SF-Gateway-CallbackURL subnet_ip_address = var.TACG-TMM-SF-Gateway-SNIP secure_ticket_authority_urls = var.TACG-TMM-SF-Gateway-STAs } ] roaming_beacon = { internal_address = var.TACG-TMM-SF-Beacon-Internal external_addresses = var.TACG-TMM-SF-Beacon-External } } ##### Create an Authentication service resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-AuthService-Name virtual_path = var.TACG-TMM-SF-AuthService-Path } ##### Create a Store service resource "citrix_stf_store_service" "CreateSFStoreService" { depends_on = [citrix_stf_authentication_service.CreateSFAuthenticationService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id virtual_path = var.TACG-TMM-SF-StoreService-Path friendly_name = var.TACG-TMM-SF-StoreService-Name authentication_service_virtual_path = citrix_stf_authentication_service.CreateSFAuthenticationService.virtual_path pna = { enable = false } farms = var.TACG-TMM-SF-StoreService-Farms } ##### Create a WebReceiver service resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { depends_on = [citrix_stf_deployment.CreateInitialSFDeployment, citrix_stf_store_service.CreateSFStoreService] site_id = citrix_stf_deployment.CreateInitialSFDeployment.site_id friendly_name = var.TACG-TMM-SF-WebService-Name virtual_path = var.TACG-TMM-SF-WebService-Path store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path authentication_methods = [ "ExplicitForms", "CitrixAGBasic" ] plugin_assistant = { enabled = var.TACG-TMM-SF-WebService-PA-Enabled html5_single_tab_launch = var.TACG-TMM-SF-WebService-PA-HTML5SingleTab upgrade_at_login = var.TACG-TMM-SF-WebService-PA-UpgradeAtLogin html5_enabled = var.TACG-TMM-SF-WebService-PA-HTML5Enabled } application_shortcuts = { prompt_for_untrusted_shortcuts = var.TACG-TMM-SF-WebService-AppSC-Prompt trusted_urls = var.TACG-TMM-SF-WebService-AppSC-TrustedURLs } user_interface = { auto_launch_desktop = var.TACG-TMM-SF-WebService-UI-AutoLaunchDesktop multi_click_timeout = var.TACG-TMM-SF-WebService-UI-Timeout enable_apps_folder_view = var.TACG-TMM-SF-WebService-UI-AppFolderView workspace_control = { enabled = var.TACG-TMM-SF-WebService-UI-WC-Enabled auto_reconnect_at_logon = var.TACG-TMM-SF-WebService-UI-WC-AutoReconnect logoff_action = var.TACG-TMM-SF-WebService-UI-LogoffAction show_reconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowReconnect show_disconnect_button = var.TACG-TMM-SF-WebService-UI-WC-ShowDisconnect } receiver_configuration = { enabled = var.TACG-TMM-SF-WebService-RC-Enabled } app_shortcuts = { enabled = var.TACG-TMM-SF-WebService-ASC-Enabled show_desktop_shortcut = var.TACG-TMM-SF-WebService-ASC-ShowDesktopShortcut } ui_views = { show_apps_view = var.TACG-TMM-SF-WebService-UIViews-Apps show_desktops_view = var.TACG-TMM-SF-WebService-UIViews-Desktops default_view = var.TACG-TMM-SF-WebService-UIViews-Default } category_view_collapsed = var.TACG-TMM-SF-WebService-CategoryView move_app_to_uncategorized = var.TACG-TMM-SF-WebService-Uncategorized progressive_web_app = { enabled = var.TACG-TMM-SF-WebService-PWA-Enabled show_install_prompt = var.TACG-TMM-SF-WebService-PWA-Install } show_activity_manager = var.TACG-TMM-SF-WebService-ActivityManager show_first_time_use = var.TACG-TMM-SF-WebService-FirstTimeUse prevent_ica_downloads = var.TACG-TMM-SF-WebService-PreventICADownloads } resources_service = { ica_file_cache_expiry = var.TACG-TMM-SF-WebService-RS-IcaFileExpiry persistent_icon_cache_enabled = var.TACG-TMM-SF-WebService-RS-IconCacheEnabled } } ##### A PNA site is not installed due to no effective needs #resource "citrix_stf_xenapp_default_store" "CreateSFXenAppPath" { # depends_on = [citrix_stf_store_service.CreateSFStoreService] # store_virtual_path = citrix_stf_store_service.CreateSFStoreService.virtual_path # store_site_id = citrix_stf_store_service.CreateSFStoreService.site_id #} Running the snippet should fulfill all needed steps – during the run, the StoreFront server installs missing roles and features: PS C:\_ppmm\__TF\CVADOnXS-2511\_ConfigureStoreFront> terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_stf_authentication_service.CreateSFAuthenticationService will be created + resource "citrix_stf_authentication_service" "CreateSFAuthenticationService" { + claims_factory_name = "standardClaimsFactory" + friendly_name = "TACG-SF-AuthService" + site_id = "1" + virtual_path = "/Citrix/Authentication" } # citrix_stf_deployment.CreateInitialSFDeployment will be created + resource "citrix_stf_deployment" "CreateInitialSFDeployment" { + host_base_url = "https://storefront.the-austrian-citrix-guy.at" + roaming_beacon = { + external_addresses = [ + "https://www.orf.at/", + "https://www.microsoft.com/", ] + internal_address = "http://10.10.100.1/" } + roaming_gateway = [ + { + callback_url = "https://access.the-austrian-citrix-guy.at/CitrixAuthService/AuthService.asmx" + gateway_url = "https://access.the-austrian-citrix-guy.at/" + is_cloud_gateway = false + logon_type = "Domain" + name = "TACG-NS" + request_ticket_from_two_stas = false + secure_ticket_authority_urls = [ + { + sta_url = "http://tf-cvad-ddc1.the-austrian-citrix-guy.at/scripts/ctxsta.dll" + sta_validation_enabled = false }, + { + sta_url = "http://tf-cvad-ddc2.the-austrian-citrix-guy.at/scripts/ctxsta.dll" + sta_validation_enabled = false }, ] + session_reliability = false + smart_card_fallback_logon_type = "None" + stas_bypass_duration = "0.1:0:0" + stas_use_load_balancing = false + subnet_ip_address = "10.10.119.112" + version = "Version10_0_69_4" }, ] + site_id = "1" } # citrix_stf_store_service.CreateSFStoreService will be created + resource "citrix_stf_store_service" "CreateSFStoreService" { + authentication_service_virtual_path = "/Citrix/Authentication" + farms = [ + { + all_failed_bypass_duration = 0 + bypass_duration = 60 + farm_name = "TACG80" + farm_type = "XenDesktop" + load_balance = true + max_failed_servers_per_request = 0 + port = 80 + rade_ticket_time_to_live = 100 + server_urls = [] + servers = [ + "tf-cvad-sf.the-austrian-citrix-guy.at", ] + ssl_relay_port = 443 + ticket_time_to_live = 200 + transport_type = "HTTPS" + xml_validation_enabled = false + zones = [] # (4 unchanged attributes hidden) }, + { + all_failed_bypass_duration = 0 + bypass_duration = 60 + farm_name = "TACG443" + farm_type = "XenDesktop" + load_balance = true + max_failed_servers_per_request = 0 + port = 443 + rade_ticket_time_to_live = 100 + server_urls = [] + servers = [ + "tf-cvad-sf.the-austrian-citrix-guy.at", ] + ssl_relay_port = 443 + ticket_time_to_live = 200 + transport_type = "HTTPS" + xml_validation_enabled = false + zones = [] # (4 unchanged attributes hidden) }, ] + friendly_name = "TACG-SF-StoreService" + pna = { + enable = false } + site_id = "1" + virtual_path = "/Citrix/Store" } # citrix_stf_webreceiver_service.CreateSFWebReceiverService will be created + resource "citrix_stf_webreceiver_service" "CreateSFWebReceiverService" { + application_shortcuts = { + gateway_urls = [] + prompt_for_untrusted_shortcuts = true + trusted_urls = [ + "https://storefront.the-austrian-citrix-guy.at/", ] } + authentication_methods = [ + "CitrixAGBasic", + "ExplicitForms", ] + friendly_name = "TACG-SF-WebReceiverService" + plugin_assistant = { + enabled = true + html5_enabled = "Fallback" + html5_single_tab_launch = true + show_after_login = false + upgrade_at_login = true } + resources_service = { + ica_file_cache_expiry = 80 + icon_size = 128 + persistent_icon_cache_enabled = true + show_desktop_viewer = true } + site_id = "1" + store_virtual_path = "/Citrix/Store" + user_interface = { + app_shortcuts = { + allow_session_reconnect = false } + auto_launch_desktop = true + category_view_collapsed = false + enable_apps_folder_view = true + move_app_to_uncategorized = true + multi_click_timeout = 3 + prevent_ica_downloads = false + progressive_web_app = { + enabled = false + show_install_prompt = false } + receiver_configuration = { + download_url = (known after apply) + enabled = true } + show_activity_manager = true + show_first_time_use = true + ui_views = { + default_view = "Auto" + show_apps_view = true + show_desktops_view = true } + workspace_control = { + auto_reconnect_at_logon = true + enabled = true + logoff_action = "Disconnect" + show_disconnect_button = false + show_reconnect_button = false } } + virtual_path = "/Citrix/StoreWeb" } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_stf_deployment.CreateInitialSFDeployment: Creating... citrix_stf_deployment.CreateInitialSFDeployment: Still creating... [00m10s elapsed] citrix_stf_deployment.CreateInitialSFDeployment: Still creating... [00m20s elapsed] citrix_stf_deployment.CreateInitialSFDeployment: Creation complete after 25s citrix_stf_authentication_service.CreateSFAuthenticationService: Creating... citrix_stf_authentication_service.CreateSFAuthenticationService: Creation complete after 6s citrix_stf_store_service.CreateSFStoreService: Creating... citrix_stf_store_service.CreateSFStoreService: Still creating... [00m10s elapsed] citrix_stf_store_service.CreateSFStoreService: Creation complete after 16s citrix_stf_webreceiver_service.CreateSFWebReceiverService: Creating... citrix_stf_webreceiver_service.CreateSFWebReceiverService: Still creating... [00m10s elapsed] citrix_stf_webreceiver_service.CreateSFWebReceiverService: Creation complete after 15s Apply complete! Resources: 4 added, 0 changed, 0 destroyed. PS C:\_ppmm\__TF\CVADOnXS-2511\_ConfigureStoreFront>The StoreFront server now has a valid StoreFront site deployed: The StoreFront server now accepts logons: With the StoreFront site ready, we can proceed to the final step: deploying all CVAD-related entities. Important: You can now switch back to the Ubuntu IaC machine or stay on the Windows machine to run the last Terraform snippet. Part 10: Using Terraform to create all CVAD entities and all their necessitiesCreating the final steps is a simple, straightforward task. Terraform can create the CVAD entities site on its own – no Ansible interaction is needed. Create a StoreFront Server object Create a Hypervisor connection Create a Hypervisor connection resource pool Create a Machine Catalog Create a Delivery Group Create a Policy Set and its policies Before running the snippet, no CVAD-related entity is configured: No Hypervisor Connection and Hypervisor Connection pool exist: No Machine Catalog exists: No Delivery Group exists: No dedicated Policy Set exists: Example Terraform snippet to create all needed CVAD entities as mentioned above: # Terraform Deployment of Citrix CVAD on XenServer 8 - 25.11 ## Definition of XenCVADServer Provider Variables - not all available variables are defined, only these we use ### Reference https://registry.terraform.io/providers/citrix/citrix/latest/docs #### Definition of all required local variables or data ##### Get XenServer-related Data ###### Get the VM SR object data "xenserver_sr" "vmsr" { name_label = var.TACG-TMM-XS-CL-VMSR } /* output "name" { value = data.xenserver_sr.vmsr.data_items[0].name_label } */ ###### Get the Network object data "xenserver_network" "network" { } ##### Get CVAD-related Data ###### Get the Zone in CVAD data "citrix_zone" "TACG-TMM-CVAD-Zone" { name = var.TACG-TMM-CVAD-Zone-Name } #### Create a StoreFront Server object - we assume a load-balanced server resource "citrix_storefront_server" "CreateSFServer" { name = var.TACG-TMM-SF-Server-Name description = var.TACG-TMM-SF-Server-Description url = var.TACG-TMM-SF-Server-URL enabled = true } #### Create a Hypervisor Connection resource "citrix_xenserver_hypervisor" "TACG-TMM-CVAD-HypConn" { depends_on = [data.citrix_zone.TACG-TMM-CVAD-Zone] name = var.TACG-TMM-CVAD-HypConn-Name zone = data.citrix_zone.TACG-TMM-CVAD-Zone.id username = var.XS-CL-UN password = var.XS-CL-PW password_format = "PlainText" addresses = var.XS-CL-IPs ssl_thumbprints = var.XS-CL-SSLTP } resource "null_resource" "WriteProgress1" { depends_on = [citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn] provisioner "local-exec" { command = "echo The Hypervisor Connection was successfully created..." } } #### Create a Hypervisor Connection Resource Pool resource "citrix_xenserver_hypervisor_resource_pool" "TACG-TMM-CVAD-HypConnPool" { depends_on = [citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn] name = var.TACG-TMM-CVAD-HypConnPool-Name hypervisor = citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn.id networks = [data.xenserver_network.network.data_items[0].name_label] storage = [ { storage_name = data.xenserver_sr.vmsr.data_items[0].name_label } ] temporary_storage = [ { storage_name = data.xenserver_sr.vmsr.data_items[0].name_label } ] use_local_storage_caching = false } resource "null_resource" "WriteProgress2" { depends_on = [citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool] provisioner "local-exec" { command = "echo The Hypervisor Connection Pool was successfully created..." } } #### Create the Machine Catalog ##### Important: Using CVAD Image Definitions and Image Versions is currently not supported on a XenServer-based deployment. ##### Important: You need to use standard Master Image VMs/Snapshots for creation of a Machine Catalog! resource "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { depends_on = [citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool] name = var.TACG-TMM-CVAD-MC-Name description = var.TACG-TMM-CVAD-MC-Description provisioning_type = var.TACG-TMM-CVAD-MC-ProvisioningType allocation_type = var.TACG-TMM-CVAD-MC-AllocationType session_support = var.TACG-TMM-CVAD-MC-SessionType zone = data.citrix_zone.TACG-TMM-CVAD-Zone.id provisioning_scheme = { hypervisor = citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn.id hypervisor_resource_pool = citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool.id identity_type = var.TACG-TMM-CVAD-MC-IdentityType machine_domain_identity = { domain = var.TACG-TMM-CVAD-MC-VM-DomainFQDN domain_ou = var.TACG-TMM-CVAD-MC-VM-DomainOU service_account = var.TACG-TMM-CVAD-MC-VM-ServiceUserName service_account_password = var.TACG-TMM-CVAD-MC-VM-ServiceUserPassword } xenserver_machine_config = { master_image_vm = var.TACG-TMM-CVAD-MC-MasterImageVMName cpu_count = var.TACG-TMM-CVAD-MC-VM-CPUCount memory_mb = var.TACG-TMM-CVAD-MC-VM-MemorySize image_snapshot = var.TACG-TMM-CVAD-MC-MasterImageVMName-SnapshotName use_full_disk_clone_provisioning = var.TACG-TMM-CVAD-MC-MasterImageVMName-UseFullDiskClone } number_of_total_machines = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs machine_account_creation_rules = { naming_scheme = var.TACG-TMM-CVAD-MC-VM-NamingScheme naming_scheme_type = var.TACG-TMM-CVAD-MC-VM-NamingSchemeType } } } resource "null_resource" "WriteProgress3" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-MC] provisioner "local-exec" { command = "echo The Machine Catalog was successfully created..." } } /* data "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { name = var.TACG-TMM-CVAD-MC-Name } */ #### Create the Delivery Group resource "citrix_delivery_group" "TACG-TMM-CVAD-DG" { depends_on = [citrix_machine_catalog.TACG-TMM-CVAD-MC, citrix_storefront_server.CreateSFServer] #depends_on = [data.citrix_machine_catalog.TACG-TMM-CVAD-MC] name = var.TACG-TMM-CVAD-DG-Name description = var.TACG-TMM-CVAD-DG-Description minimum_functional_level = var.TACG-TMM-CVAD-DG-FunctionalLevel storefront_servers = [citrix_storefront_server.CreateSFServer.id] associated_machine_catalogs = [ { machine_catalog = citrix_machine_catalog.TACG-TMM-CVAD-MC.id #machine_catalog = data.citrix_machine_catalog.TACG-TMM-CVAD-MC.id machine_count = var.TACG-TMM-CVAD-MC-VM-NumberOfVMs } ] desktops = [ { published_name = var.TACG-TMM-CVAD-DG-Desktops-Name description = var.TACG-TMM-CVAD-DG-Desktops-Description restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } enabled = var.TACG-TMM-CVAD-DG-Desktops-Enabled ###### Not needed due to Static assignment type-MC # enable_session_roaming = var.TACG-TMM-CVAD-DG-Desktops-SessionRoaming } ] autoscale_settings = { autoscale_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectTime off_peak_disconnect_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectTime peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_disconnect_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction off_peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime peak_log_off_timeout_minutes = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction ###### Not needed due to Static assignment type-MC #log_off_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-PeakLogoffTime #log_off_peak_disconnected_session_after_seconds = var.TACG-TMM-CVAD-DG-AS-OffPeakLogoffTime #peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-PeakDisconnectAction #off_peak_log_off_action = var.TACG-TMM-CVAD-DG-AS-OffPeakDisconnectAction #log_off_reminder_enabled = var.TACG-TMM-CVAD-DG-AS-Enabled #log_off_reminder_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_reminder_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle #log_off_warning_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #log_off_warning_title = var.TACG-TMM-CVAD-DG-AS-Notification-MessageTitle timezone = var.TACG-TMM-CVAD-DG-AS-TimeZone power_time_schemes = [ { days_of_week = var.TACG-TMM-CVAD-DG-AS-Days display_name = var.TACG-TMM-CVAD-DG-AS-Name peak_time_ranges = var.TACG-TMM-CVAD-DG-AS-PeakTime pool_using_percentage = false }, ] } restricted_access_users = { allow_list = var.TACG-TMM-CVAD-DG-Desktops-AllowList } reboot_schedules = [ { name = var.TACG-TMM-CVAD-DG-RS-Name reboot_schedule_enabled = var.TACG-TMM-CVAD-DG-RS-Enabled frequency = var.TACG-TMM-CVAD-DG-RS-Frequency frequency_factor = 1 days_in_week = var.TACG-TMM-CVAD-DG-RS-RebootDays start_time = var.TACG-TMM-CVAD-DG-RS-RebootStartTime start_date = var.TACG-TMM-CVAD-DG-RS-RebootStartDate reboot_duration_minutes = var.TACG-TMM-CVAD-DG-RS-RebootDuration ignore_maintenance_mode = var.TACG-TMM-CVAD-DG-RS-IgnoreMaintenanceMode natural_reboot_schedule = var.TACG-TMM-CVAD-DG-RS-NormalRebootSchedule ###### Not needed due to SingleSession type-MC #reboot_notification_to_users = { #notification_duration_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-Duration #notification_message = var.TACG-TMM-CVAD-DG-RS-Notification-MessageBody #notification_title = var.TACG-TMM-CVAD-DG-RS-Notification-MessageTitle #notification_repeat_every_5_minutes = var.TACG-TMM-CVAD-DG-RS-Notification-MessageRepeat #} } ] } resource "null_resource" "WriteProgress4" { depends_on = [citrix_delivery_group.TACG-TMM-CVAD-DG] provisioner "local-exec" { command = "echo The Delivery Group was successfully created..." } } #### Create a default Policy Set resource "citrix_policy_set_v2" "TACG-TMM-CVAD-DefaultPolicySet" { depends_on = [citrix_delivery_group.TACG-TMM-CVAD-DG] name = var.TACG-TMM-CVAD-PS-Name description = var.TACG-TMM-CVAD-PS-Description delivery_groups = [citrix_delivery_group.TACG-TMM-CVAD-DG.id] } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-Printing" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "Printing" description = "Example of Printer-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-HDX" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "HDX™ Graphics" description = "Example of HDX Graphics-related policy in default Policy Set" enabled = true } #### Create a Policy in the Policy Set resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-ClientDrives" { depends_on = [citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet] policy_set_id = citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet.id name = "Client Drives" description = "Example of Client Drive-related policy in default Policy Set" enabled = true } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id name = "ClientPrinterAutoCreation" value = "DefaultPrinterOnly" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id name = "UniversalPrintDriverUsage" value = "FallbackToSpecific" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "AllowVisuallyLosslessCompression" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "UseVideoCodecForCompression" value = "UseVideoCodecIfPreferred" use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX3" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id name = "UseHardwareEncodingForVideoCodec" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD1" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "AutoConnectDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD2" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientDriveRedirection" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD3" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientFixedDrives" enabled = true use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD4" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientFloppyDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD5" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientOpticalDrives" enabled = false use_default = false } #### Create the corresponding Policy settings resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD6" { policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id name = "ClientNetworkDrives" enabled = false use_default = false } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true delivery_group_id = citrix_delivery_group.TACG-TMM-CVAD-DG.id } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true sid = var.TACG-TMM-CVAD-PS-UserSID } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } #### Create the corresponding Policy Filters resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3" { depends_on = [citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives] policy_id = citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives.id enabled = true allowed = true ip_address = var.TACG-TMM-CVAD-PS-IPRange } resource "null_resource" "WriteProgress5" { depends_on = [citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1, citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2] provisioner "local-exec" { command = "echo The default Policy Set and its policies and filters were successfully created..." } }Running the snippet should fulfill all needed steps: azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_CreateCitrixEntities$ terraform apply data.xenserver_network.network: Reading... data.xenserver_sr.vmsr: Reading... data.xenserver_network.network: Read complete after 0s data.xenserver_sr.vmsr: Read complete after 0s data.citrix_zone.TACG-TMM-CVAD-Zone: Reading... data.citrix_zone.TACG-TMM-CVAD-Zone: Read complete after 0s [id=47010f19-5c99-4414-ab73-01a31aacff9a] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # citrix_machine_catalog.TACG-TMM-CVAD-MC will be created + resource "citrix_machine_catalog" "TACG-TMM-CVAD-MC" { + allocation_type = "Static" + built_in_scopes = (known after apply) + delete_machine_accounts = "None" + description = "Terraform-created Machine Catalog for TACG running on XS8-Cluster" + id = (known after apply) + inherited_scopes = (known after apply) + minimum_functional_level = "L7_20" + name = "TACG-TMM-CVAD-XS8-MC" + persist_user_changes = (known after apply) + provisioning_scheme = { + hypervisor = (known after apply) + hypervisor_resource_pool = (known after apply) + identity_type = "ActiveDirectory" + machine_account_creation_rules = { + naming_scheme = "tf-mcs-w11-#" + naming_scheme_type = "Numeric" } + machine_domain_identity = { + domain = "the-austrian-citrix-guy.at" + domain_ou = "OU=_COMPUTER,OU=TACG-CVAD,DC=the-austrian-citrix-guy,DC=at" + service_account = (sensitive value) + service_account_password = (sensitive value) } + number_of_total_machines = 2 + xenserver_machine_config = { + cpu_count = 2 + image_snapshot = "" + master_image_note = "" + master_image_vm = "W1125H2" + memory_mb = 4096 + use_full_disk_clone_provisioning = false } } + provisioning_type = "MCS" + scopes = [] + session_support = "SingleSession" + tenants = (known after apply) + zone = "47010f19-5c99-4414-ab73-01a31aacff9a" } # citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn will be created + resource "citrix_xenserver_hypervisor" "TACG-TMM-CVAD-HypConn" { + addresses = [ + "http://10.10.119.1", ] + id = (known after apply) + max_absolute_active_actions = 40 + max_absolute_new_actions_per_minute = 10 + max_power_actions_percentage_of_machines = 20 + name = "TACG-TMM-CVAD-XS8-Cluster" + password = (sensitive value) + password_format = "PlainText" + scopes = [] + ssl_thumbprints = (sensitive value) + tenants = (known after apply) + username = (sensitive value) + zone = "47010f19-5c99-4414-ab73-01a31aacff9a" } # citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool will be created + resource "citrix_xenserver_hypervisor_resource_pool" "TACG-TMM-CVAD-HypConnPool" { + hypervisor = (known after apply) + id = (known after apply) + name = "TACG-TMM-CVAD-XS8-Cluster" + networks = [ + "Network0", ] + storage = [ + { + storage_name = "local storage" + superseded = false }, ] + temporary_storage = [ + { + storage_name = "local storage" + superseded = false }, ] + use_local_storage_caching = false + vm_tagging = true } # null_resource.WriteProgress1 will be created + resource "null_resource" "WriteProgress1" { + id = (known after apply) } # null_resource.WriteProgress2 will be created + resource "null_resource" "WriteProgress2" { + id = (known after apply) } # null_resource.WriteProgress3 will be created + resource "null_resource" "WriteProgress3" { + id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3 will be created + resource "citrix_client_ip_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3" { + allowed = true + enabled = true + id = (known after apply) + ip_address = "10.10.0.0" + policy_id = (known after apply) } # citrix_delivery_group.TACG-TMM-CVAD-DG will be created + resource "citrix_delivery_group" "TACG-TMM-CVAD-DG" { + associated_machine_catalogs = [ + { + machine_catalog = "c052bbc4-d5a7-407a-baa3-d0faf901a0b1" + machine_count = 2 }, ] + autoscale_settings = { + autoscale_enabled = true + disconnect_off_peak_idle_session_after_seconds = 0 + disconnect_peak_idle_session_after_seconds = 0 + log_off_off_peak_disconnected_session_after_seconds = 0 + log_off_peak_disconnected_session_after_seconds = 0 + log_off_reminder_enabled = false + log_off_reminder_message = "" + log_off_reminder_title = "" + log_off_warning_message = "" + log_off_warning_title = "" + off_peak_buffer_size_percent = 0 + off_peak_disconnect_action = "Suspend" + off_peak_disconnect_timeout_minutes = 5 + off_peak_extended_disconnect_action = "Nothing" + off_peak_extended_disconnect_timeout_minutes = 0 + off_peak_limit_seconds_to_force_log_off_user = 0 + off_peak_log_off_action = "Suspend" + off_peak_log_off_reminder_interval = 0 + off_peak_log_off_timeout_minutes = 5 + peak_autoscale_assigned_power_on_idle_action = "Nothing" + peak_autoscale_assigned_power_on_idle_timeout_minutes = 0 + peak_buffer_size_percent = 0 + peak_disconnect_action = "Suspend" + peak_disconnect_timeout_minutes = 5 + peak_extended_disconnect_action = "Nothing" + peak_extended_disconnect_timeout_minutes = 0 + peak_limit_seconds_to_force_log_off_user = 0 + peak_log_off_action = "Suspend" + peak_log_off_reminder_interval = 0 + peak_log_off_timeout_minutes = 5 + power_off_delay_minutes = 30 + power_time_schemes = [ + { + days_of_week = [ + "Friday", + "Monday", + "Thursday", + "Tuesday", + "Wednesday", ] + display_name = "TACG-TMM-CVAD-XS8-AS" + peak_time_ranges = [ + "09:00-17:00", ] + pool_using_percentage = false }, ] + timezone = "UTC" } + built_in_scopes = (known after apply) + color_depth = "TwentyFourBit" + default_desktop_icon = "1" + description = "Terraform-created Delivery Group for TACG running on XS8-Cluster" + desktops = [ + { + description = "Terraform-created W11 Desktops running on XS8-Cluster" + enabled = true + id = (known after apply) + published_name = "TACG-XS8-W11" + restricted_access_users = { + allow_list = [ + "TACG\\vdaallowed", ] + block_list = [] } }, ] + enabled = true + force_delete = false + id = (known after apply) + in_maintenance_mode = false + inherited_scopes = (known after apply) + load_balancing_type = "None" + minimum_functional_level = "L7_20" + name = "TACG-TMM-CVAD-XS8-DG" + reboot_schedules = [ + { + days_in_week = [ + "Sunday", ] + frequency = "Weekly" + frequency_factor = 1 + ignore_maintenance_mode = true + name = "TACG-TMM-CVAD-XS8-RS" + natural_reboot_schedule = false + reboot_duration_minutes = 0 + reboot_schedule_enabled = true + start_date = "2025-01-01" + start_time = "02:00" # (1 unchanged attribute hidden) }, ] + restricted_access_users = { + allow_list = [ + "TACG\\vdaallowed", ] + block_list = [] } + scopes = [] + secure_ica_required = false + tenants = (known after apply) + total_machines = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3 will be created + resource "citrix_delivery_group_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3" { + allowed = true + delivery_group_id = (known after apply) + enabled = true + id = (known after apply) + policy_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-ClientDrives" { + description = "Example of Client Drive-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "Client Drives" + policy_set_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-HDX" { + description = "Example of HDX Graphics-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "HDX Graphics" + policy_set_id = (known after apply) } # citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing will be created + resource "citrix_policy" "TACG-TMM-CVAD-DefaultPolicySet-Printing" { + description = "Example of Printer-related policy in default Policy Set" + enabled = true + id = (known after apply) + name = "Printing" + policy_set_id = (known after apply) } # citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet will be created + resource "citrix_policy_set_v2" "TACG-TMM-CVAD-DefaultPolicySet" { + assigned = (known after apply) + delivery_groups = [ + (known after apply), ] + description = "Terraform-created default Policy Set for TACG running on XS8-Cluster" + id = (known after apply) + name = "TACG-TMM-CVAD-XS8-PS-Default" + scopes = [] } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD1" { + enabled = true + id = (known after apply) + name = "AutoConnectDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD2" { + enabled = true + id = (known after apply) + name = "ClientDriveRedirection" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD3" { + enabled = true + id = (known after apply) + name = "ClientFixedDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD4" { + enabled = false + id = (known after apply) + name = "ClientFloppyDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD5" { + enabled = false + id = (known after apply) + name = "ClientOpticalDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-CD6" { + enabled = false + id = (known after apply) + name = "ClientNetworkDrives" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX1" { + enabled = true + id = (known after apply) + name = "AllowVisuallyLosslessCompression" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX2" { + id = (known after apply) + name = "UseVideoCodecForCompression" + policy_id = (known after apply) + use_default = false + value = "UseVideoCodecIfPreferred" } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-HDX3" { + enabled = true + id = (known after apply) + name = "UseHardwareEncodingForVideoCodec" + policy_id = (known after apply) + use_default = false } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing1" { + id = (known after apply) + name = "ClientPrinterAutoCreation" + policy_id = (known after apply) + use_default = false + value = "DefaultPrinterOnly" } # citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2 will be created + resource "citrix_policy_setting" "TACG-TMM-CVAD-DefaultPolicySet-Printing2" { + id = (known after apply) + name = "UniversalPrintDriverUsage" + policy_id = (known after apply) + use_default = false + value = "FallbackToSpecific" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3 will be created + resource "citrix_user_policy_filter" "TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3" { + allowed = true + enabled = true + id = (known after apply) + policy_id = (known after apply) + sid = "S-1-5-21-3919795815-764310115-1491410927-2116" } # null_resource.WriteProgress4 will be created + resource "null_resource" "WriteProgress4" { + id = (known after apply) } # null_resource.WriteProgress5 will be created + resource "null_resource" "WriteProgress5" { + id = (known after apply) } Plan: 33 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Creating... citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m10s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m20s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m30s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Still creating... [00m40s elapsed] citrix_xenserver_hypervisor.TACG-TMM-CVAD-HypConn: Creation complete after 41s [id=f6f129aa-c9c6-4b9f-84c3-cb0834342fa6] null_resource.WriteProgress1: Creating... null_resource.WriteProgress1: Provisioning with 'local-exec'... null_resource.WriteProgress1 (local-exec): Executing: ["/bin/sh" "-c" "echo The Hypervisor Connection was successfully created..."] null_resource.WriteProgress1 (local-exec): The Hypervisor Connection was successfully created... null_resource.WriteProgress1: Creation complete after 0s [id=7102860708396185821] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Creating... citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m10s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m20s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m30s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Still creating... [00m40s elapsed] citrix_xenserver_hypervisor_resource_pool.TACG-TMM-CVAD-HypConnPool: Creation complete after 40s [id=6d2214be-5d23-44bb-8f90-90acc6151e97] null_resource.WriteProgress2: Creating... null_resource.WriteProgress2: Provisioning with 'local-exec'... null_resource.WriteProgress2 (local-exec): Executing: ["/bin/sh" "-c" "echo The Hypervisor Connection Pool was successfully created..."] null_resource.WriteProgress2 (local-exec): The Hypervisor Connection Pool was successfully created... null_resource.WriteProgress2: Creation complete after 0s [id=4353748660640660049] citrix_machine_catalog.TACG-TMM-CVAD-MC: Creating... citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m10s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m30s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [00m40s elapsed] ... citrix_machine_catalog.TACG-TMM-CVAD-MC: Still creating... [09m20s elapsed] citrix_machine_catalog.TACG-TMM-CVAD-MC: Creation complete after 41s [id=47df73ea-fde2-3431-33f13-ae8909328dd1] ... citrix_delivery_group.TACG-TMM-CVAD-DG: Creating... citrix_delivery_group.TACG-TMM-CVAD-DG: Still creating... [00m10s elapsed] citrix_delivery_group.TACG-TMM-CVAD-DG: Still creating... [00m20s elapsed] citrix_delivery_group.TACG-TMM-CVAD-DG: Creation complete after 21s [id=e57c8f65-c8a2-4788-bdda-dac19816192b] null_resource.WriteProgress4: Creating... citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Creating... null_resource.WriteProgress4: Provisioning with 'local-exec'... null_resource.WriteProgress4 (local-exec): Executing: ["/bin/sh" "-c" "echo The Delivery Group was successfully created..."] null_resource.WriteProgress4 (local-exec): The Delivery Group was successfully created... null_resource.WriteProgress4: Creation complete after 0s [id=1603009483001819548] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m10s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m20s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Still creating... [00m30s elapsed] citrix_policy_set_v2.TACG-TMM-CVAD-DefaultPolicySet: Creation complete after 30s [id=f06d0abd-bfba-4da2-853a-22f1d0f29c94] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing: Creating... citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-HDX: Creation complete after 1s [id=7d2605d3-8e15-4358-81c0-3e6fecefe31c] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-Printing: Creation complete after 1s [id=ccc01f86-0120-4293-85e6-92ca430553c6] citrix_policy.TACG-TMM-CVAD-DefaultPolicySet-ClientDrives: Creation complete after 1s [id=51ee45df-68c8-4221-a9f4-b65fa37c0299] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2: Creating... citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1: Creating... citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-2: Creation complete after 1s [id=f4e7a4ba-b9af-4808-86bf-451f2747729d] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-2: Creation complete after 1s [id=30c858f9-437c-42af-b917-2938284aae76] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3: Creating... citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-2: Creation complete after 1s [id=cc621016-8e1e-48e8-bdcd-244d6bcdaf6e] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3: Creating... citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-1: Creation complete after 1s [id=1b24d545-130a-429e-8c7e-a8340d38d18c] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-1: Creation complete after 1s [id=b6a0b752-fcc1-4bcc-87a1-34bc132bddb1] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6: Creating... citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-1: Creation complete after 0s [id=64f9bffa-bd49-44f8-953a-ae15f7137838] citrix_client_ip_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-ClientIPFilter-3: Creation complete after 0s [id=0c1174c4-cc2c-45cb-9183-aca6857b46f1] citrix_delivery_group_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-DGFilter-3: Creation complete after 0s [id=dc53bebb-9ddf-409c-9df3-a29abf995bd0] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD2: Creation complete after 1s [id=99327137-cee4-4ad9-81c8-cdc489bf9bf5] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX3: Creation complete after 3s [id=d80f6146-6a4f-4950-8f0f-1bf157f64824] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing1: Creation complete after 3s [id=41fe293e-0f1a-48a9-bc13-83b44f7d1fb9] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1: Creating... citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX1: Creation complete after 3s [id=89866698-9c9e-4c9a-946b-a0e6cca6b856] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-HDX2: Creation complete after 3s [id=e40d7c92-2b67-4d85-94c6-9d648cc4cd16] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD5: Creation complete after 1s [id=32b89ef9-d542-4a09-8863-391a7132c80d] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD6: Creation complete after 2s [id=0d7e6233-946a-442b-96ab-004a62e72088] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD4: Creation complete after 1s [id=45d0697b-b39f-4e70-9c8d-bfb50aef7db2] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD3: Creation complete after 2s [id=09d39467-ba5a-4057-ad3c-427789900339] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-Printing2: Creation complete after 3s [id=2297952e-611f-4d08-b9c2-a9587d119838] citrix_user_policy_filter.TACG-TMM-CVAD-DefaultPolicySet-SIDFilter-3: Creation complete after 0s [id=a9332544-c5d4-495b-b800-12f976d4cdef] citrix_policy_setting.TACG-TMM-CVAD-DefaultPolicySet-CD1: Creation complete after 0s [id=dde0f25c-7a9e-4429-b1c7-7d5b978a180e] null_resource.WriteProgress5: Creating... null_resource.WriteProgress5: Provisioning with 'local-exec'... null_resource.WriteProgress5 (local-exec): Executing: ["/bin/sh" "-c" "echo The default Policy Set and its policies and filters were successfully created..."] null_resource.WriteProgress5 (local-exec): The default Policy Set and its policies and filters were successfully created... null_resource.WriteProgress5: Creation complete after 0s [id=3134505013310827667] Apply complete! Resources: 33 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:/etc/terraform-tmm/CVADXS/_CreateCitrixEntities$Terraform has successfully installed all needed Citrix entities: A Hypervisor Connection and Hypervisor Connection Pool were created: All related tests are OK: A Machine Catalog was created: All related tests are OK: A Delivery Group was created: All related tests are OK: A dedicated Policy Set and its policies were created: WebStudio shows a complete, error-free deployment of Citrix Virtual Apps and Desktops 2507 LTSR: As the deployment is complete, we can now log on to StoreFront and start our assigned desktop. Using the DeploymentAs all prerequisites are met, we can now log on to our CVAD site and start our assigned VDI desktop. Logging on through Citrix Workspace App or Storefront is possible: Let´s choose our desktop and start it: That completes our guide “Using Infrastructure-as-Code for deploying Citrix Virtual Apps and Desktops 2507 LTSR on XenServer 8.4”. As the importance of Infrastructure-as-Code and Automation steadily increases, we will continue to focus on these topics. Stay tuned for new guides and our soon-to-be-published Automation Handbook on our Automation landing page in Citrix TechZone (https://community.citrix.com/tech-zone/automation), where we cover all relevant aspects of IaC and Automation in a Citrix Environment. DisclaimerDisclaimer: EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>Citrix Integration for Windows 365</h1> <p>Fri, 31 Oct 2025 04:04:00 +0000</p> AudienceThe Citrix Integration for Windows 365 Reference Architecture is intended for Citrix practitioners—including administrators, engineers, architects, partners, and consultants—who design, build, and maintain Citrix platform deployments for enterprises of all sizes. OverviewCitrix Desktops-as-a-Service (DaaS) enables you to deliver high-performance virtual apps and desktops securely to any device. Managed by a Citrix-hosted service, this solution securely grants end-users access to Windows, Linux, and macOS (limited to desktop) applications and desktops from a central location, regardless of the operating system on their endpoints. The Citrix Integration for Windows 365 combines Citrix DaaS™ with Windows 365 to provide a high-performance, secure, and easy-to-manage solution. This integration enables organizations to offer a seamless hybrid work experience, supporting a variety of use cases beyond standard Windows 365 features. The Citrix Integration for Windows 365 Reference Architecture provides an overview of the Windows 365 service, a conceptual architecture of the Citrix DaaS™ and Windows 365 integration, traffic flow diagrams for the integration, and use cases for the integration. Windows 365 OverviewMicrosoft Windows 365 is a fully managed desktop virtualization SaaS platform hosted in Microsoft Azure. Windows 365 provides dedicated, persistent, turn-key desktops for a flat-rate price. Windows 365 is available in four editions as detailed here: Edition Description Windows 365 Business1 Geared towards smaller companies with up to 300 seats that need a ready-to-use solution with easy management options and is only available within a fully Microsoft-managed Azure subscription. Windows 365 Enterprise Provides enterprises with unlimited seats and full integration with Microsoft Intune, allowing for custom image creation, connection to enterprise networks, and additional management options. Windows 365 Government2 Provides Cloud PCs within the regulated US Government Azure cloud, providing a regulated and secure environment. *Please note that Windows 365 Government is currently not supported by Citrix. Windows 365 Frontline Dedicated Provides enterprises with a single Windows 365 license that provisions up to three Cloud PCs for nonconcurrent use. Windows 365 Frontline Shared 2 Provides enterprises with the ability to provision a single Cloud PC that can be shared non-concurrently among a group of users. 1 This edition does not apply to the Citrix DaaS + Windows 365 Reference Architecture. Any references to Windows 365 from now on will only pertain to the Enterprise or Frontline Dedicated editions. 2 Please note that these editions are currently not supported by Citrix. Windows 365 supports four identity and two device join types: Identity Type Description Hybrid Users are created in an on-premises Active Directory and synchronized to Microsoft Entra ID with the Microsoft Entra ID Connector. Cloud-only Users are created directly in Microsoft Entra ID, and the cloud service handles authentication. Federated Provides support for users created in a third-party identity provider other than Active Directory or Entra ID, and then federated with Entra ID. External Users who are created and managed outside of Entra ID are invited into the Entra ID tenant to access resources. Device Join Type Description Microsoft Entra hybrid joined Joins the Cloud PC to the on-premises Active Directory and Microsoft Entra ID via Microsoft Entra Connect. Microsoft Entra joined Joins the Cloud PC directly to Entra ID. Microsoft Intune manages provisioning, software installs, updates, patching, and policy enforcement for all Cloud PCs. Users connect to Cloud PCs over the Remote Desktop Protocol (RDP) through the Windows 365 Gateway, which is provided by the Azure Virtual Desktop (AVD) service. The AVD service also provides connection brokering and web client service. Citrix Integration for Windows 365 Conceptual ArchitectureThe conceptual architecture for integrating Citrix DaaS with Windows 365 brings together Citrix’s high-performance application and desktop delivery capabilities with Microsoft’s Windows 365 platform, all under a unified identity and management framework. The Citrix Integration for Windows 365 supports both Microsoft Entra joined and Microsoft Entra Hybrid joined Cloud PCs. The supported architectures are illustrated at a high level here. Note: Citrix supports connecting multiple Windows 365 tenants to a single Citrix DaaS tenant. This is not detailed here in this architecture. Microsoft Entra Joined Devices Following the standard Citrix architecture layer method, the conceptual architecture for Microsoft Entra joined devices consists of five layers. User Layer The User Layer includes Citrix Workspace™ app endpoints on all supported devices, such as Windows, Linux, macOS, iOS, Android, and browser-based clients. Users access a single Workspace interface to view both Citrix-delivered applications and desktops, as well as access their Windows 365 Cloud PCs. Microsoft Intune handles endpoint management, configuration, application deployment, and compliance reporting, ensuring that devices meet security standards. Citrix real-time deviceTrust checks verify a device's compliance and context (such as location, security status, or the presence of unauthorized USB devices) to enforce granular, contextual access policies. Access Layer In the Microsoft Entra Joined architecture, Citrix Workspace and the Citrix Gateway Service provide the Access Layer. All users authenticate with Citrix Workspace, with Microsoft Entra ID set as the identity provider (IdP). At the same time, the Citrix Gateway service provides VPN-less access to their Windows 365 Cloud PCs alongside other Citrix desktop and application resources (virtual desktops, published applications, Web/SaaS applications). Connections to Windows 365 Cloud PCs use connector-less connections with the Citrix Rendezvous protocol, so Citrix Cloud™ Connectors are not required within the Windows 365 Resource Locations. Control Layer In the Control Layer, Citrix DaaS orchestrates brokering, policy enforcement, resource aggregation, and monitoring for the Windows 365 Cloud PCs. The Citrix Windows 365 Connector is enabled in Intune, allowing a connection between the Windows 365 service and Citrix Cloud. The Citrix DaaS VDA Upgrade service is used to upgrade the Citrix Virtual Delivery Agent on each Cloud PC. From the user’s perspective, all resources, whether hosted in Citrix infrastructure or delivered via Windows 365, appear side by side in a single workspace. The Windows 365 platform is akin to other virtual desktop hosting platforms like Azure, AWS, and on-premises hypervisors, and is viewed by Citrix DaaS as a Resource Location. Resource Layer In the Resource Layer, the Microsoft tenant provides the core Windows 365 Cloud PCs. When a Windows 365 Cloud PC is launched from Citrix Workspace™, the user is seamlessly directed through the Citrix Gateway service and optimized with HDX™. This layered approach ensures that each platform is used for what it does best—Citrix for rich, virtualized applications and complex, multi-session environments, and Windows 365 for personal, always-on cloud desktops—while still delivering a unified and secure user experience. Observability Layer The Observability Layer includes all other layers, providing end-to-end visibility, diagnostics, and user experience analytics. Citrix DaaS Monitor offers detailed insights into Citrix sessions, logon performance, HDX™ bandwidth, and application responsiveness. This enables administrators to identify issues in real-time, analyze trends, and enhance performance across the entire Citrix environment. For endpoint-level telemetry, uberAgent® is installed on Workspace app endpoints to collect comprehensive performance and UX metrics, such as logon duration breakdowns, application load times, and resource usage—covering both Citrix virtual sessions and local workloads. These tools create a unified observability framework that links Citrix-hosted resources, Windows 365 Cloud PCs, and endpoint devices, supporting a proactive approach to troubleshooting and performance improvement. Microsoft Entra hybrid joined DevicesFollowing the standard Citrix architecture layer method, the conceptual architecture for Microsoft Entra hybrid joined devices consists of the same five layers noted above. However, with the Hybrid Entra ID Join architecture, new options are available for the Access Layer, as multiple on-premises components are introduced. Citrix Cloud Access Layer Changes to the Microsoft Entra hybrid joined architecture using the Citrix Cloud Access Layer include: Within the Control Layer, an on-premises site has been added. This site includes Microsoft Entra ID Connect, which enables synchronization between Active Directory and Entra ID. Cloud Connectors are also deployed, enabling Active Directory integration with Citrix and Windows 365 Cloud PCs. Finally, Citrix Federated Authentication Service (FAS) servers are set up to provide Single Sign-On (SSO) access to Windows 365 Cloud PCs. Citrix Workspace and Citrix Gateway continue to manage user authentication; however, in the Hybrid Entra ID join model, any of the supported identity platforms by Citrix Workspace can be used. In this architecture, Hybrid Entra ID authentication is employed. On-Premises Access Layer Changes to the Microsoft Entra hybrid joined architecture using an on-premises Access Layer include: Within the Control Layer, an on-premises location has been added. This location includes Microsoft Entra ID Connect, which enables synchronization between Active Directory and Entra ID. Cloud Connectors are also deployed, enabling Active Directory integration with Citrix and Windows 365 Cloud PCs. By default, the Windows 365 Cloud PCs are connector-less, and the cloud connectors are only needed to connect Citrix Cloud to the AD domain. However, you can choose to have the VDAs register via cloud connectors if required. More details can be found in the product documentation. Lastly, Citrix Federated Authentication Service (FAS) is implemented to provide Single Sign-On (SSO) access to the Windows 365 Cloud PCs. The Access Layer has been moved to the on-premises location, and Citrix StoreFront and NetScaler Gateway are now used for user access, authentication, and enumeration of the Windows 365 Cloud PCs. Citrix Integration for Windows 365 Configuration Configuring the integration between Citrix DaaS and Windows 365 involves several components that administrators should be familiar with, including Citrix Cloud™ and the Citrix DaaS service, as well as the Microsoft Windows 365 service and Windows 365 Cloud PCs. Citrix Cloud handles the integration of the Citrix DaaS and Windows 365 services by registering and assigning Cloud PC licenses within Citrix DaaS. A Cloud PC registration token is generated to establish trust between the Cloud PCs and the Citrix Cloud services. Microsoft Entra ID manages user and Cloud PC identities. It also enables authentication and authorization between Windows 365 and Citrix Cloud services. The process of integrating Citrix DaaS and Windows 365 involves several workflows that Citrix administrators must initiate, as well as background service-related workflows. Windows 365 Connect Flow A one-time operation, Windows 365 Connect Flow provides consent for Citrix Cloud to obtain the necessary permissions. Following the Azure consent framework, an Azure application is registered within the customer's Entra ID tenant. A Global Administrator must grant these permissions, as Citrix Cloud will perform all tasks on behalf of administrators. When consent is granted, a new service principal is created using the Citrix application template with the required permissions. Citrix Cloud is granted an access token on behalf of the customer's tenant and is used to communicate with the Windows 365 service. Once consent is complete, Citrix Cloud stores the connection information in a database that includes the Windows 365 tenant ID. It lets the Windows 365 service know that a new Citrix customer is connected to the tenant. The Citrix Integration for Windows 365 supports connecting to multiple Entra ID tenants. License Assignment Flow The License Assignment Flow begins when the Citrix administrator assigns a Citrix license to a Windows 365 user or group. Citrix Cloud provides a registration token begins the Cloud PC registration process, which includes installation of the Citrix Virtual Delivery Agent (VDA), Cloud PC registration with Citrix DaaS, creation of the Machine Catalog and Delivery Group, adding the Cloud PC to the Machine Catalog and Delivery Group, assign the user to the Cloud PC, and create a Citrix policy enabling the rendezvous protocol for the Delivery Group. It is worth noting that the Citrix DaaS Windows 365 license assignment is per-user rather than per-machine. License Removal Flow The License Removal Flow begins when a Citrix administrator removes a license assignment from a user or group. As a result, each Cloud PC assigned to that user is removed from Citrix DaaS, and Citrix Cloud notifies the Windows 365 service of the license removal, triggering the uninstallation of the Citrix VDA. After the VDA is uninstalled, the Cloud PC can be accessed via the Windows 365 portal or the Windows App using RDP. Windows 365 Disconnect Flow Citrix administrators initiate the Windows 365 Disconnect Flow to completely disconnect their Citrix Cloud tenant from the Windows 365 service. This is only possible when all Citrix licenses have been unassigned from users or groups. When executed, Citrix Cloud notifies the Windows 365 service to offboard the customer, and once confirmed, Citrix Cloud will remove the connection information from the Citrix customer. Citrix Workspace URL Update Running every hour, this task monitors any changes to the Workspace URL used for Windows 365 Cloud PC access. This ensures that the Windows 365 portal has the correct URL for Citrix Workspace if users use this method to access their Cloud PC. Ghost Cloud PC Removal This daily task checks and verifies that each Cloud PC in each Cloud PC Machine Catalog still exists within the Windows 365 service and removes the Cloud PC from the catalog if it no longer exists. When machines are reprovisioned, a real-time cleanup of the old machine is performed before the new machine is created. Citrix Integration for Windows 365 AuthenticationThe Citrix Integration for Windows 365 supports Windows 365 deployments with Entra ID-joined and Entra Hybrid-joined Cloud PCs. For user authentication, this table provides details on the supported identity providers for both Entra ID join and Hybrid Entra ID join machine identity types. Machine Identity Entra ID Active Directory Active Directory + Token Okta SAML Citrix Gateway Adaptive Authentication Microsoft Entra join √ X X X √ X X Microsoft Entra Hybrid join √ √ √ √ √ √ √ √: Supported X: Not Supported Microsoft Entra Join with Citrix WorkspaceWhen using Microsoft Entra join with the Citrix Integration for Windows 365, end users' Entra IDs are used for authentication into the Cloud PC. In the diagram above, you see a typical Citrix Integration for a Windows 365 deployment with Microsoft Entra joined Cloud PCs. The user authentication flow to the Cloud PC is as follows: The end user opens the Citrix Workspace app or a web browser and navigates to their organization's Citrix Workspace URL. Citrix Workspace, configured to use Microsoft Entra ID as the identity provider, redirects the user's browser to the Microsoft login page (login.microsoftonline.com). The user enters their Entra ID username and password. Microsoft Entra ID processes the credentials, performs the authentication, and applies any relevant Conditional Access policies. Upon successful authentication, Entra ID issues an authentication token (e.g., SAML assertion or OpenID Connect ID token) back to Citrix Workspace. Citrix Workspace validates the received token and communicates with Citrix DaaS to enumerate the list of available Windows 365 Cloud PCs configured for the user. The user selects the desired Windows 365 Cloud PC from the Workspace interface. The Citrix HDX protocol initiates the connection to the selected Windows 365 Cloud PC. The user is presented with their Windows 365 Cloud PC desktop login screen. Microsoft Entra Hybrid Join with Citrix Workspace and Gateway ServiceWhen using the Microsoft Entra Hybrid join option to integrate Citrix with Windows 365, all identity providers supported in Citrix Workspace are available. In this case, authentication into the Cloud PC is performed using Active Directory credentials rather than Entra ID credentials. Although Cloud PCs are assigned to a user's Entra ID by default, the machines are assigned to the corresponding Active Directory user so that connections can be brokered for those users. In this diagram, you see a typical Citrix Integration for a Windows 365 deployment with Microsoft Entra Hybrid joined Cloud PCs. As shown, Entra ID Connect is required to synchronize your Active Directory and Entra ID Directory domains, and it is essential for the hybrid join model. Additionally, a VPN or ExpressRoute is set up to provide connectivity between the Azure virtual networks (vNets) and the Citrix Cloud Resource location, allowing the Cloud PCs to join the Active Directory domain. A Citrix Cloud Connector™ is necessary for Citrix Cloud to connect to the Active Directory domain. The user authentication flow to the Cloud PCs is as follows: Microsoft Entra ID Connect synchronizes the on-premises Active Directory and Microsoft Entra ID tenant. The end user opens the Citrix Workspace app or a web browser and navigates to their organization's Citrix Workspace URL. In this case, Citrix Workspace is configured to use Active Directory as the identity provider, so users enter their Active Directory username and password. The credentials are securely transmitted via the established secure tunnel provided by the Cloud Connectors to the Active Directory domain controller to process the credentials and perform the authentication. Upon successful authentication, the successful result is sent back to Cloud Connector, which relays the result to Citrix Workspace. Citrix Workspace establishes the user's session and presents a list of available Windows 365 Cloud PCs configured for the user. The user selects the desired Windows 365 Cloud PC from the Workspace interface. The Citrix HDX protocol initiates the connection to the selected Windows 365 Cloud PC. The user is presented with their Windows 365 Cloud PC desktop via HDX, ready for use. Microsoft Entra Hybrid Join with Citrix Workspace (3rd Party IdP)For environments using an identity provider (IdP) other than Active Directory, the deployment described above still applies. However, in this case, the Citrix Federated Authentication Service (FAS) provides Single Sign-On (SSO) for sessions. In the scenario below, Okta is used as the primary IdP for Citrix Workspace. Okta's role in this scenario is to serve as the primary authentication provider for Citrix Workspace. When a user logs into Citrix Workspace, Okta verifies their credentials and issues a token to Citrix Workspace. However, Okta does not replace the underlying user directory that Windows 365 Cloud PC and its management use. The user account that the Cloud PC recognizes and the identity that FAS uses to issue a certificate for desktop logon still reside in on-premises Active Directory, which is then synced to Entra ID. Microsoft Entra ID Connect synchronizes the on-premises Active Directory and Microsoft Entra ID tenant. The end user opens the Citrix Workspace app or a web browser and navigates to their organization's Citrix Workspace URL. Citrix Workspace is configured in Citrix Cloud to use Okta as its primary identity provider, and it redirects the user to the Okta login page. The user enters their Okta username and password. Okta processes the credentials, performs the authentication against its user store (which might be Okta's own directory, an integrated Active Directory, or another source), and applies any relevant Okta policies. Upon successful authentication, Okta issues an authentication token back to Citrix Workspace. Citrix Workspace validates the received token from Okta, establishes the user's session, and presents the list of available Windows 365 Cloud PCs that the user is entitled to access. The user selects the desired Windows 365 Cloud PC from the Workspace interface. The Citrix HDX protocol initiates the connection to the selected Windows 365 Cloud PC. In the background, Citrix Federated Authentication Service (FAS) leverages the user's successful authentication to Citrix Workspace to issue a short-lived, digitally signed certificate specifically for that user. The Citrix Virtual Delivery Agent (VDA) on the Hybrid Entra ID joined Windows 365 Cloud PC uses this certificate provided by FAS to perform a "certificate logon" to the on-premises Active Directory Domain Services (AD DS). This process automatically logs the user into their Cloud PC's Windows desktop session, eliminating the need for them to re-enter their credentials. Microsoft Entra Hybrid Join with Citrix StoreFront and NetScaler Gateway Microsoft Entra ID Connect synchronizes the on-premises Active Directory and Microsoft Entra ID tenant. The end user opens the Citrix Workspace app or a web browser and navigates to their organization’s NetScaler Gateway URL. The user connects to the NetScaler Gateway, which is configured to use Active Directory in this case as the identity provider, so users enter their Active Directory username and password. Upon successful authentication, the NetScaler Gateway establishes a secure SSL/TLS tunnel (often DTLS for ICA traffic) from the user's device into your network. This tunnel secures all subsequent communication. The NetScaler Gateway forwards the authenticated user's session information to the internal Citrix StoreFront server. This is often configured for pass-through authentication, meaning StoreFront recognizes the user as already authenticated by the Gateway and does not prompt for credentials again. Upon successful authentication, the successful result is sent back to Cloud Connector, which relays the result to Citrix DaaS. The Citrix DaaS control plane queries your on-premises Active Directory (via the Cloud Connectors) to determine the user's group memberships and entitlements. It then compiles a list of virtual applications and desktops that the user is authorized to access. This list is sent back to StoreFront (via Cloud Connectors). StoreFront then presents the users with the list of available resources, including Cloud PCs The user selects the desired Windows 365 Cloud PC from the Workspace interface. The Citrix HDX protocol initiates the connection to the selected Windows 365 Cloud PC. The user is presented with their Windows 365 Cloud PC desktop via HDX, ready for use. In the background, Citrix Federated Authentication Service (FAS) leverages the user's successful authentication to Citrix Workspace to issue a short-lived, digitally signed certificate specifically for that user. The Citrix Virtual Delivery Agent (VDA) on the Hybrid Entra ID joined Windows 365 Cloud PC uses this certificate provided by FAS to perform a "certificate logon" to the on-premises Active Directory Domain Services (AD DS). This process automatically logs the user into their Cloud PC's Windows desktop session, eliminating the need for them to re-enter their credentials. Monitoring Citrix + Windows 365When integrating Citrix with Windows 365, the user experience (UX) relies on several control planes and hops, including Microsoft Entra ID, Microsoft Intune, Citrix Gateway service, Citrix Workspace, and the endpoint. Comprehensive, correlated monitoring is therefore crucial to: Detect and triage issues in real time (enumeration, brokering, logon phases, session failures) and verify impact across users/sites. Citrix DaaS Monitor offers a live troubleshooting dashboard for DaaS workloads, featuring failure surfacing and site health panels. Quantify UX and identify the root cause (such as network latency, policy issues, codec choice, or bandwidth constraints) at the HDX session layer; Installing Citrix uberAgent on the Windows 365 Cloud PC provides protocol-level and session configuration metrics that explain why a session feels fast or slow. Close visibility gaps caused by spanning Microsoft’s Cloud PC fabric and Citrix services; The Citrix Integration for Windows 365 connects Citrix Cloud with Windows 365 to implement HDX technologies and policies—observability must cover both sides. What To MonitorArea Description Why It Matters Primary Source Site health & failures (enumeration, brokering, launch) Watch the live failures panel and site/region health. Pivot from spikes to impacted users; drill into failure reasons (auth, brokering, STA/gateway). Set alerts on sudden changes. Catches widespread issues fast; validates the end-to-end launch flow for Cloud PCs via HDX. Citrix DaaS Monitor Logon duration breakdown (GPO, profile, shell) Use the phase breakdown to see where time is spent (e.g., GPO processing, profile attach, shell init). Compare outliers to baselines and correlate them with profile/storage health. Speeds root cause for slow logon complaints Citrix DaaS Monitor Session performance (ICA/HDX RTT, jitter, bandwidth) Track HDX RTT, network jitter, and throughput per session. Overlay with user reports and time of day; flag links or sites with unstable latency. Differentiates network vs host bottlenecks Citrix uberAgent HDX policy & codec settings (EDT/Thinwire, video, QoS Capture active HDX policy/codec per session and compare to your standards. Watch for unintended policy drift after changes. Confirms runtime behavior matches design (e.g., EDT enabled, proper codec for task/knowledge worker). Citrix uberAgent Gateway path health (Citrix Gateway / CGS) Correlate gateway VIP health, auth latency, and throughput with session UX. Identify overloaded gateways or GEO issues. Ties the access tier to user experience and explains intermittent launch/performance issues. Citrix uberAgent Teams & collaboration experience Track call join times, jitter, packet loss, device redirection state, and optimization mode. Compare optimized vs. fallback sessions. Collaboration quality is a top UX driver for hybrid workers. Citrix uberAgent Cloud PC resource saturation (CPU, RAM, disk, GPU) Trend per-session and per-SKU utilization; watch for CPU-ready, RAM pressure, disk queue spikes, and GPU headroom (if present) Right-sizes Windows 365 SKUs and prevents chronic contention. Citrix uberAgent App performance & hangs Monitor app start times, responsiveness, crashes, and slow I/O paths. Tie app events to the affected sessions/users. Moves troubleshooting from “the desktop is slow” to the exact app/process. Citrix DaaS Monitor, Citrix uberAgent Usage & capacity trends (concurrency, duration) Review daily/weekly concurrency, session duration, and license consumption. Identify peak windows and idle time. Informs scaling policies and cost optimization for Cloud PCs + HDX. Citrix DaaS Monitor, Citrix uberAgent ReferencesTech Brief: Citrix for Windows 365 POC Guide: Citrix for Windows 365 POC Guide: Integrating Windows 365 with Citrix Session Recording Microsoft Windows 365 Architecture </article> <article> <h1>Tech Brief: Citrix Secure Access with Chrome Enterprise</h1> <p>Wed, 17 Sep 2025 17:01:00 +0000</p> Overview Citrix Secure Private Access (SPA) offers a powerful and adaptive Zero Trust Network Access (ZTNA) solution for SaaS and private applications. Building on this foundation, organizations can integrate with Chrome Enterprise to create Citrix Secure Access with Chrome Enterprise (CSA/CE). This expanded architecture delivers comprehensive security services—like Advanced Threat Protection (ATP) and Data Loss Prevention (DLP)—directly in the browser, enabling a wider range of critical enterprise use cases. This integrated solution addresses several key enterprise initiatives and challenges: Addressing the "Last Mile" Security Gap: Extends consolidated security policies directly to the endpoint browser, complementing cloud-delivered SSE services by providing granular control and visibility for SaaS, web, and private on-premises applications that may otherwise introduce access complexities or latency. VDI Cost Optimization: Reduces reliance on expensive Virtual Desktop Infrastructure (VDI) for delivering web and SaaS applications, leading to significant infrastructure and operational cost savings. VPN Replacement: Provides a modern, application-centric alternative to traditional network-level VPNs, enhancing security, user experience, and management simplicity. Secure Third-Party Access: Enables highly secure, granular access for contractors, temporary workers, and partners to specific applications without granting broad network access. Secure Remote and Hybrid Workforce: Facilitates seamless and secure access for a distributed workforce, ensuring productivity and compliance from any location. By delivering Zero Trust access to private, web, and SaaS applications at the application layer via the familiar Chrome browser, the combined power of Citrix Secure Access and Chrome Enterprise offers a tailored, comprehensive solution for these use cases. This architecture is engineered to deliver advanced threat protection against malware and phishing, and enforce Data Loss Prevention (DLP) policies for confidential data. Furthermore, Chrome Enterprise provides IT with a robust set of browser-level security and management controls that work seamlessly with Citrix Secure Access, enabling employees to securely access IT sanctioned applications, while maintaining granular control and optimized performance for direct access to internal applications. Watch this video to learn more: Conceptual Architecture The high-level conceptual architecture for securely delivering applications using Citrix Secure Access with Chrome Enterprise supports both corporate-managed and unmanaged (BYOD) endpoints. While the core security framework remains consistent across device types—leveraging Zero Trust principles, adaptive access controls, and centralized policy enforcement—the method of endpoint integration and the scope of accessible resources differ. Subject: The foundation of the zero trust model begins with the subject. Who or what is trying to access resources. The user: identity seeking access The device: the endpoint being used to access a resource. For managed devices, Citrix Secure Access leverages a local agent that provides deep OS integration. This enables access to both web applications and TCP/UDP-based private applications, along with enhanced posture checks and continuous monitoring. For unmanaged devices, the solution uses a browser extension to deliver lightweight, privacy-respecting access. While limited to web and SaaS applications, it still enforces robust security controls through Chrome Enterprise Premium policies. The browser: the interface being used to access a resource Zero Trust Decision Point: When the user tries to access Citrix Workspace, the zero trust decision point (Policy service engine), needs to determine if they get access. Its first job is to determine the full context of the request by querying the Information Points Zero Trust Information Points: The decision to grant, or deny access leverages the information gathered by the corresponding services Device Posture: Compliance status of the device. The endpoint protection agent scans the endpoint verifying if it adheres to requirements for the operating system, antivirus, firewall, certificates, etc. Adaptive Authentication: Utilizes a customer provided Identity Provider (IdP) to determine if the user's identity is valid Network Location: Allows you to define your network topology to better determine if the user is external or internal (and which physical location). Geolocation: Leverages DNS to determine broad geo location for the user. Zero Trust Enforcement Points: These are strategic control locations within the solution where access decisions are enforced based on contextual policies. Once the Policy Engine evaluates the context—such as user identity, device posture, and location—the enforcement point carries out the decision, allowing or denying the connection accordingly. Browser Security Controls: The secure browser acts as a Zero Trust enforcement point by applying granular session-level controls. Leveraging Chrome Enterprise Premium policies, it enforces security measures such as blocking copy/paste, downloads, or printing, ensuring sensitive data remains protected even on unmanaged or BYO devices. If you are applying DLP Rules to inspect content, the browser sends the content to Chrome Enterprise for machine learning inspection. Browser URL Filtering: When users attempt to access public websites, the browser acts as a Zero Trust enforcement point by applying URL filtering and session controls. Local browser policies restrict access to risky or non-compliant sites, while Chrome Enterprise Premium enhances enforcement with advanced controls—such as blocking access to specific categories, enforcing safe browsing, and applying data protection policies in real time. Google Security Gateway: The Security Gateway acts as a Zero Trust enforcement point when users access SaaS applications. Operating as a forward proxy, it does not inspect traffic but enforces access control by routing requests through customer-specific egress IP addresses. These unique IPs can be allowlisted by SaaS providers, ensuring that only authorized traffic reaches the application. Secure Private Access Service: For private resources, Secure Private Access establishes a micro-tunnel within the on-prem connector’s outbound tunnel. The micro-tunnel limits which resource can be accessed (North-South connection). Because BYO devices leverage a browser plugin, access to private resources is restricted to authorized web-based apps. Managed devices that leverage the local agent are able to access authorized web apps as well as TCP/UDP apps. In addition, SaaS app access can also be tunneled through the local connector. This approach allows organizations to perform traffic inspection with their on-prem security controls. Deployment Models The Deployment Models for Citrix Secure Access with Chrome Enterprise include Cloud-delivered and Hybrid-delivered options. These delivery models allow you to align the solution with your organizations' existing infrastructure, security requirements, and operational preferences, ensuring seamless integration and optimal performance. Cloud-Delivered Model The Cloud-delivered model represents a modern, agile approach to Zero Trust Network Access, leveraging the full power of cloud-native services for simplified deployment, enhanced scalability, and reduced operational overhead. In this architecture, the majority of the Citrix Secure Private Access components and Chrome Enterprise Premium management reside in the cloud, providing a streamlined and globally accessible solution. Architecture Overview: Cloud-Native Infrastructure: All core Citrix Secure Private Access components, including the ZTNA service, policy engine, and authentication services, are hosted and managed within Citrix's cloud infrastructure. Identity Provider Integration: Users authenticate against their existing Identity Provider (IdP), which can be cloud-based (e.g., Entra ID, Okta, Google Workspace Identity) or on-premises (e.g., Active Directory), and which integrates directly with the Citrix cloud service. Chrome Enterprise Premium Cloud Management: Chrome browsers on endpoints are centrally managed through the Google Admin console in the cloud. This allows for seamless policy distribution, extension management, and security updates without requiring on-premises infrastructure. Direct-to-Cloud Access: SaaS applications and public web resources are accessed directly through the Chrome browser, with security policies and DLP enforced at the browser edge. Private App Connectors: For on-premises private applications, lightweight connectors are deployed within the corporate network. These connectors establish secure, outbound-only connections to the Citrix cloud service, enabling Zero Trust access to internal resources without opening inbound firewall ports. Scalability and Resilience: The cloud-native architecture inherently provides high availability, global reach, and elastic scalability, adapting to fluctuating user demands and geographic distribution. Benefits: Simplified Deployment: Minimal on-premises infrastructure requirements, accelerating time to value. Global Accessibility: Consistent security and performance for a distributed workforce, regardless of location. Reduced TCO: Eliminates the need for significant hardware investments and ongoing maintenance of on-premises components. Automatic Updates: Cloud services are continuously updated, ensuring access to the latest features and security patches. Hybrid-Delivered Model The Hybrid-delivered model offers organizations the flexibility to integrate existing on-premises infrastructure with cloud-delivered Zero Trust capabilities. This approach is particularly beneficial for enterprises with significant investments in on-premises identity management, legacy applications, or specific compliance requirements that necessitate keeping certain components within the data centers. Architecture Overview: Cloud-Managed ZTNA with On-Prem Components: While the core ZTNA policy enforcement and Chrome Enterprise management remain cloud-based, this model incorporates specific on-premises components of Secure Private Access to extend granular control and integrate with existing infrastructure. On-Premises Identity Provider Integration: Organizations can leverage their existing on-premises Identity Providers (e.g., Active Directory Federation Services (ADFS), traditional Active Directory) for user authentication, with Citrix Gateway acting as a secure proxy or IdP for these on-premises directories. NetScaler Gateway (On-Prem): An on-premises NetScaler Gateway instance can be utilized for initial authentication, advanced policy evaluation, and integration with on-premises identity stores or multi-factor authentication solutions. It can also serve as a traditional VPN for specific legacy use cases while the ZTNA model handles modern application access. Citrix StoreFront (On-Prem): For seamless user experience and aggregation of both cloud-delivered and on-premises applications, an on-premises Citrix StoreFront can be deployed. This acts as a unified portal where users can discover and launch all their sanctioned applications, regardless of their hosting location. Secure Private Access Connectors: Similar to the cloud model, lightweight connectors are deployed on-premises to establish secure, outbound connections to the Citrix cloud service for ZTNA access to private applications. Chrome Enterprise Premium Cloud Management: Chrome browsers are still managed centrally via the Google Admin console in the cloud, ensuring consistent browser security and policy enforcement across all endpoints. Benefits: Leverage Existing Investments: Maximizes the value of current on-premises infrastructure and identity solutions. Phased Migration: Allows for a gradual transition to a full cloud-delivered model, reducing disruption. Compliance Flexibility: Addresses specific regulatory or data residency requirements by keeping certain components on-premises. Complex Environment Support: Ideal for organizations with a mix of modern cloud applications and traditional on-premises client/server applications requiring integrated access. Adaptive Security The combined solution of Citrix Secure Access and Chrome Enterprise Premium provides a powerful adaptive security framework designed to protect corporate resources based on real-time context. This goes beyond static access rules, enabling dynamic policy enforcement that responds to changes in user, device, and environmental conditions. Adaptive Authentication Adaptive authentication determines the right authentication flow for the current request. It can identify the device posture, geographical location, network segment, and user organization/department membership. Based on the information obtained, an administrator can define how they want to authenticate users to their IT sanctioned apps. This allows organizations to implement the same authentication policy framework across every resource including public SaaS apps, private web apps, and Desktops as a Service (DaaS). Adaptive Authentication policies can easily incorporate business logic to create a stronger authentication solution. This could include scenarios like: Internal vs External: Users who connect from internal locations from managed devices could authenticate with a username and password. External users on BYO devices would require multi-factor authentication. Employee vs Contractor vs Partner: Organizations will often require different authentication flows based on the user identity. If an employee, authenticate against Active Directory. If the user is a contractor, utilize a personal Gmail account. If the user is a partner, utilize a managed Azure Active Directory account. Mergers and Acquisitions: Adaptive Authentication can help organizations overcome the authentication challenges associated with a merger or acquisition. Adaptive Authentication lets users authenticate against their pre-merger identity provider. The pre-merger identity can then be used to provide ZTNA access to authorized resources from either organization. Watch this video to learn more: Context-Aware Policy Engine: Policies are not just based on user identity, but also incorporate a rich set of contextual signals. With adaptive access, organizations can provide users with different levels of access to SaaS, private web, and private client/server apps. When a user tries to access an authorized resource, adaptive access determines how the current request aligns with the defined conditions. The conditions can include a combination of: User or group membership Device type GEO Location Network Location Device posture Workspace URL Based on the results of these conditions, access to the resource is either allowed or denied. Real-time Threat Detection & Remediation Leveraging the advanced threat protection capabilities, the Citrix Secure Access with Chrome Enterprise can detect and mitigate threats in real-time, providing a robust first line of defense directly at the browser level. The solution's deep integration with Google's extensive threat intelligence and security infrastructure is fundamental to these capabilities, ensuring proactive defense against evolving cyber threats. Key aspects of this real-time protection include: Google Safe Browsing: This is a primary defense wall, using Google's continuously updated lists of known malware, phishing sites, and unwanted software. If a user attempts to navigate to a dangerous site or a download originates from a known malicious source, Chrome will proactively block it or display a warning. Real-time File Scanning: For downloaded files, Chrome Enterprise Premium performs real-time scanning using Google's cloud-based analysis. This includes advanced AI and machine learning techniques to detect and block unknown or zero-day malware before it can reach the endpoint device. Proactive Phishing Protection: Beyond Safe Browsing lists, Chrome Enterprise utilizes Google's broader threat intelligence to identify and block sophisticated phishing attempts, safeguarding user credentials and sensitive information in real-time. Harmful Site Isolation: Potentially dangerous or compromised websites are isolated within the browser's sandboxed environment, preventing them from interacting with other browser tabs or the underlying operating system, thus containing any potential threats. Integration with Threat Intelligence: Chrome Enterprise continuously integrates with Google's vast threat intelligence feeds, providing an up-to-the-minute view of global threats and enabling proactive policy adjustments directly within the browser. Automated Remediation: Upon detection of a threat or policy violation, Chrome Enterprise can initiate automated actions, such as blocking access to a malicious site, preventing a download, or triggering alerts for administrators. Forensic Logging and Reporting: Chrome Enterprise provides detailed logs of security events and threat detections, offering valuable data for security investigations, compliance auditing, and continuous improvement of security policies. This comprehensive approach ensures that web-based threats are identified and addressed immediately at the browser level, significantly reducing the risk of data breaches and system compromises. Application Access Citrix Secure Access with Chrome Enterprise fundamentally transforms how users access applications, moving from a traditional network-centric model to a highly secure and efficient application-centric approach. This enhances security, simplifies the user experience, and optimizes performance across the entire application portfolio. Unified Access to All Application Types: The solution provides a single, consistent access point for a diverse application portfolio, including SaaS applications, internal web applications, and even traditional client-server applications. Users can access all necessary tools directly through their managed Chrome Enterprise Premium browser or, for specific use cases, via the Citrix Workspace app, depending on the application type and defined security policies. Zero Trust Network Access (ZTNA) for Private Applications: For private applications, ZTNA ensures that micro-segmented tunnels are established only for the specific application being accessed. This eliminates broad network access, significantly reducing the attack surface and preventing lateral movement within the network, even if an endpoint is compromised. This granular approach is a cornerstone of Zero Trust security. Optimized Performance for SaaS and Web: By intelligently routing traffic and applying security policies at the browser edge, the solution ensures low-latency and high-performance access to SaaS and public web applications. This direct, secure access leads to a superior user experience by minimizing the need to backhaul traffic through a corporate data center or through forward security proxies, common with Security Service Edge (SSE) type solutions. Enterprise Browser Chrome Enterprise Premium serves as the cornerstone of the endpoint security and access strategy, providing a highly secure, manageable, and user-friendly browser environment that is integral to the Zero Trust architecture. Centralized Management and Policy Enforcement: IT administrators gain comprehensive control over the browser environment through Google's Chrome Enterprise administration console. This powerful platform allows for the centralized deployment and enforcement of security policies, granular browser configurations, efficient extension management, and scheduled updates across the entire fleet of managed devices. This ensures consistency and simplifies administration. Built-in security features: Chrome Enterprise Premium leverages Chrome's robust, built-in security features, providing a strong foundation for endpoint protection: Google safe browsing: Actively protects users from phishing attempts, malware, and dangerous websites in real-time by warning them about suspicious sites. Browser isolation and sandboxing: Isolates web processes to prevent malicious code from impacting the underlying operating system or other applications, containing potential threats. Site isolation: Provides an additional, critical layer of security by isolating websites from each other, preventing cross-site scripting (XSS) and other web-based attacks from compromising data across different sites. Automatic updates: Ensures that browsers are always running the latest security patches and feature enhancements, minimizing vulnerability windows and keeping the environment protected against emerging threats. User familiarity and productivity: By utilizing the widely adopted Chrome browser, the solution minimizes the learning curve for end-users. This familiarity promotes rapid adoption and maintains high levels of productivity, all while ensuring enterprise-grade security is seamlessly integrated into their daily workflow. Data Loss PreventionData Loss Prevention (DLP) is a critical component of the Citrix Secure Access with Chrome Enterprise solution, designed to prevent sensitive information from leaving the organization's control. The solution implements multi-layered DLP capabilities across various points of interaction. The benefit of data protection at the browser level, particularly with Chrome Enterprise, lies in its ability to enforce highly granular Data Loss Prevention (DLP) controls directly at the point of user interaction with an application or website. For example, many SSE solutions excel at granular DLP for a limited number of popular SaaS applications where they have built deep integrations. However, for the vast majority of other SaaS applications, and certainly for general web sites or private web applications, their DLP capabilities are often restricted to simply preventing or allowing full file uploads and downloads. Organizations frequently utilize a much larger portfolio of SaaS applications than any single SSE solution can provide deep, application-specific DLP for. By contrast, Chrome Enterprise, when integrated with Citrix Secure Private Access, allows for application-aware DLP directly at the browser. This means it can understand and control data interactions within the application itself, such as: Preventing copying and pasting of sensitive text from a web form field, a document viewer, or a specific element on a private application page. Disabling printing of content from sensitive web pages or within a SaaS application. Blocking screen captures of confidential information displayed in the browser. This provides a critical layer of contextual DLP that complements network-edge security, extending robust data protection across a far broader range of SaaS, web, and private applications. The multi-layered DLP capabilities include: Endpoint DLP: Policies are enforced directly on the endpoint device to prevent unauthorized data exfiltration originating from the device itself. This includes crucial protections against malicious software such as keyloggers, which attempt to capture sensitive keystrokes, and screen capture malware, which tries to steal visual data from the screen. By operating at this foundational level, Endpoint DLP ensures that data remains secure even before it interacts with specific applications or browsers. Browser DLP: Policies are applied directly within the browser to control data movement between applications. This allows administrators to prevent sensitive data from being copied or pasted between specific applications, such as from a corporate web app to a personal web app or a desktop app like Notepad. Watermarking: Dynamically overlays a watermark on the application screen, displaying user and session information. This acts as a visual deterrent against unauthorized sharing and provides traceability if data is exfiltrated via screen capture. Visual DLP: Within application sessions, particularly for private web and SaaS applications, visual DLP controls are enforced. Visual DLP automatically masks or redacts sensitive data fields within the application interface itself, ensuring that confidential information is not displayed or accessible to unauthorized individuals, even if they have legitimate access to other parts of the application. Deep Inspection DLP: For files, images, and content transmitted through Citrix Secure Access, deep content inspection is performed by Google's advanced scanning capabilities. This allows the solution to identify and block sensitive data patterns (e.g., credit card numbers, social security numbers, intellectual property) embedded within various file types, images, and fields, regardless of the application or protocol being used. This provides an additional, powerful layer of protection at the network edge, ensuring comprehensive data security for both structured and unstructured data. </article> <article> <h1>Citrix Secure Access with Chrome Enterprise</h1> <p>Wed, 17 Sep 2025 16:29:00 +0000</p> Overview The Citrix Secure Access (CSA) with Chrome Enterprise (CE) solution enables secure, adaptive, and high-performance Zero Trust Network Access (ZTNA) to all applications from Chrome Enterprise-managed browsers. Designed as a cutting-edge, cloud-delivered platform, it leverages the robust security and management capabilities of Chrome Enterprise directly at the endpoint, providing a comprehensive solution for modern application access. By leveraging Citrix Secure Private Access, it adheres strictly to Zero Trust principles, ensuring that access is continuously verified based on user identity, device posture, and application context, rather than implicit trust. This deployment guide provides you with the essential steps to install and configure Citrix Secure Private Access in conjunction with Chrome Enterprise. It focuses on establishing a foundation for secure application delivery, allowing you to leverage your existing knowledge of Citrix policy and access management in this modern context. The following key steps are covered in this guide: Prepare the Citrix Cloud Environment for Secure Private Access Configure Chrome Enterprise for managed browser and policy integration Deploy and Configure Citrix Secure Access connectors for private application access Define and Apply Adaptive Access Policies for SaaS, private web, and private TCP/UDP applications Enable User Access and validate the secure application delivery flow from Chrome Enterprise endpoints For detailed information regarding advanced Chrome Enterprise policies (beyond basic integration), specific application-level security controls, or in-depth troubleshooting, please refer to the respective Citrix Secure Private Access product documentation and Google Chrome Enterprise documentation. Secure Access Delivery Options Modern secure access solutions offer flexibility in deployment, catering to various organizational needs and infrastructure setups. The two primary models are cloud-native and hybrid. This proof-of-concept (PoC) guide will focus exclusively on the steps for a cloud-native deployment, as it represents a streamlined and increasingly popular approach for modern secure access delivery. Prerequisites Chrome Enterprise Premium subscription Citrix Workspace subscription configured with an identity provider (IdP) Citrix Secure Private Access subscription Admin access to Google Workspace Admin Console Google Customer ID Create a Resource Location A Resource Location is a logically defined grouping within your network (on-premises or cloud) where your private applications and resources reside. It is connected to the Citrix Cloud service via a connector appliance for Zero Trust access. It serves as the bridge between your private app infrastructure and the cloud-delivered access control plane. Within Citrix Cloud, select the menu button in the upper left hand corner and launch Resource Locations If no resource locations exist, go ahead and create one by selecting “+ Resource Locations” Once a Resource Location has been defined, add a Connector Appliance Select your preferred hypervisor and download the corresponding file Once downloaded, import it into your hypervisor. Once the appliance starts, you will see the access IP Address to complete configuration of the appliance. The first time you connect to the appliance, you have to configure the logon password. Once complete, you will see the appliance dashboard. If you want to reconfigure the network settings, do it now by selecting the Edit Network Settings button. Once updated, the appliance will automatically reboot. Register the connector by selecting the appropriate button. Give the appliance a name When you get the registration code, copy the value Go back to the Citrix Cloud web page and paste this code into the Add a Connector Appliance dialog box Once the details have been confirmed, you can register the appliance. Once complete, you will see the new connector appliance in your resource location Note: If this is the first appliance, you will receive a warning message indicating that you should have at least two connectors per resource location to provide high availability. As this is just a test environment, you can ignore it. Onboarding WorkflowOnce your Resource Locations are established, the next step is to define the specific applications that your users will access through Citrix Secure Access. An app, in this context, refers to a discreet service or resource (such as a SaaS application, an internal web application, or a private TCP/UDP application) that requires secure, policy-driven access. Each defined app represents an entry point for secure access, allowing the Citrix Cloud service to apply granular Zero Trust policies and deliver the application securely to the user's endpoint. In this example, an internal web application will get added. Within Citrix Cloud, select the menu button in the upper left hand corner and launch Secure Private Access If this is your first time building Secure Private Access, you will be guided through an initial setup flow. Select Fully Cloud-delivered Service architecture Google Chrome IntegrationTo integrate with Google Chrome, copy the Citrix service account address and select the Google Workspace admin roles link. In the Google Chrome – Admin Roles console, select Create New Role Select Create new role and give it a name like Chrome Enterprise Premium Admin Add the following privileges to this role. When the privileges are added, select Continue and Create Role With the role created, select Assign Service Accounts Paste the Citrix Service Account Address you copied earlier. Select Add and Assign Role Back in the Citrix console, use the workflow and link to find and add your Google customer ID With the information provided, select "Run CEP Verification”. Select Next. If verification was not successful, verify the privileges are assigned correctly. Device PostureYou can obtain device posture status from third party services, but in this example, simply skip this option Citrix also provides a device posture service integrated with Secure Private Access. For this example, skip this process Add a Private Web App The next part of the process is to define an application. Select Add an app The first part of your application definition is to define the initial details for the app. In this example, the app is Inside your corporate network App Type: HTTP/HTTPS App Name: This is the name users will see App Icon: This will be the icon users will see The second part of the application definition is to specify the URL for the app. Agentless Access: Disabled. Citrix Secure Private Access provides the ability to access private web apps without requiring an agent. However, this configuration is out-of-scope for this guide. URL: Provide the internal HTTPS address for the private web application Routing Type: Select Internal via Connector. This routes the connection through the resource location and connector created earlier. Resource Location: Select the resource location created earlier. A related domain entry was created. Edit this to select the correct resource location Select Finish to end the Add an app workflow You now have a list of applications you are creating with the initial workflow. Select Next to define the access policies Define Adaptive Access PolicyBuilding upon the foundation of defined Resource Locations and Applications, the next critical phase in securing your digital workspace involves Creating Adaptive Access Policies. These policies are the intelligence layer of Citrix Secure Private Access, allowing you to move beyond static, binary access decisions to a dynamic, context-aware security model. By leveraging real-time information about the user, their device posture, location, and the specific application being accessed, Adaptive Access Policies enable granular control and significantly enhance your Zero Trust security posture. This section will guide you through the process of designing and implementing these powerful policies, ensuring that the right users receive the right level of access to the right applications, under the right conditions. Note You would typically have one Policy per application (or group of similar applications), and that Policy would contain multiple Rules to handle different scenarios for accessing that specific app. Continuing from the initial app setup workflow, select Create policy to start defining your access policy Policy Definition Give the policy a name. This is the overarching name for a set of conditions that determine access to a specific application or group of applications Select the applications associated with this policy. So far, you should only have one app Inside each Policy, you define one or more Rules. Each rule specifies a particular set of conditions (e.g., device posture, user group, network location) and the actions to take (e.g., allow access, deny access, apply watermarking, force browser isolation) if those conditions are met. Rules are evaluated in order of precedence. Go ahead and Create a Rule Provide a name for the rule. A good rule name should quickly convey who it applies to, what conditions trigger it, and what action or outcome it produces For conditions of the policy, this will be a very simple policy applied to all domain users The action is to allow access to the app Once defined, complete the workflow by selecting Finish Select Save to complete the policy workflow This is the final step for the initial app creation wizard. Go ahead and complete the workflow Verify Google Chrome OnboardingOnce the workflow is complete, backend processes will integrate your Google Chrome tenant with Citrix Services. To monitor the status of the onboarding process, in the Citrix Cloud console, navigate to: Secure Private Access – Browser Settings – Browser. Do not continue until integration is complete. Create Google Chrome Users There are a few ways to define users in Google's directory, and the best method depends on the size of your organization and whether you have an existing directory like Active Directory. For Chrome Enterprise Premium, users must exist in Cloud Identity or a Google Workspace account. Manual User CreationFor small organizations or for a few specific accounts, you can create users one-by-one directly in the Google Admin console. Sign in to your Google Admin console with a super administrator account. Navigate to Directory > Users. Click the "Add new user" button. Fill in the user's details, including first name, last name, and primary email address. Set a temporary password and choose whether to force the user to change it on their first login. Bulk User Creation with a CSV If you have a larger number of users but don't use an on-premises directory, you can create them in bulk by uploading a CSV file. From the Users page in the Admin console, click the "Bulk update users" icon. Download the provided CSV template. Fill in the template with your users' information (name, email, password, etc.). Upload the completed CSV file to create all the user accounts at once. Automated Sync with Google Cloud Directory Sync (GCDS) This is the most common and recommended method for organizations with an existing on-premises LDAP directory, such as Microsoft Active Directory. GCDS is a one-way synchronization tool that keeps your Google directory up to date. Install GCDS: Install the GCDS application on a server in your environment. Configure the Connection: Use the GCDS Configuration Manager to connect to your LDAP server and your Google account. Create Sync Rules: Define which users, groups, and organizational units (OUs) you want to sync from your LDAP server to Google using LDAP queries. You can also set exclusion rules to prevent certain accounts from syncing. Simulate and Sync: Run a simulation to preview the changes. Once you are satisfied, run a full sync to apply the changes to your Google directory. Schedule Syncs: Set up a scheduled task to run GCDS regularly, ensuring your Google directory stays synchronized. Use the Google Cloud Directory Sync guide to provide details on how to setup and configure Third-Party Identity Provider (IdP) Provisioning If you use a cloud-based IdP like Microsoft Entra ID (formerly Azure AD), you can set up automatic provisioning using the SCIM protocol. This allows user and group changes made in your IdP to automatically sync to your Google directory, streamlining the user lifecycle management process. Configure Chrome Policies Policies control how your users interact with Chrome. By configuring these policies, you can enforce a wide range of settings—from managing privacy and security features to controlling app and extension behavior—to ensure a consistent and secure Browse environment. In the Google Admin console (admin.google.com), navigate to Chrome Browser - Settings Search for the setting “Custom theme color” Select the setting Modify the Hex Color to be #003893. This will change the browser’s color when it is being managed by the policies. Save the configuration. Validate Chrome Configuration Start Chrome and Sign in to Chrome Once you successfully authenticate to Chrome, the browser’s color should change. You will also notice that three Chrome browser extensions were also automatically added. These extensions are used to provide agentless access to your private apps. Validate Private App AccessWith Chrome settings verified, the final step is private app access validation. This ensures that your newly defined application is accessible as intended, and that your granular policies are being enforced correctly. Within your managed Chrome browser profile, try to access the private web app you defined earlier. If this doesn't succeed, verify the app is configured correctly, the cloud connector appliance is functional, that the cloud connector can communicate with the web app, and that the web app is online. , Once you connect to the private web app, verify session details within the Citrix Cloud admin console. On your admin desktop, log into the Citrix Cloud console. Select Monitor from the menu bar in the top left corner. You should see an active session within the Web/SaaS/TCP/UDP-Active Sessions graph. Select the number to get more details Select the active session from the list To get more details, select the Resource Name link from the session This dashboard provides extensive information about the current session, including topology, app, policy, and more. Summary This deployment guide walked you through the end-to-end process of setting up secure access to private web applications using Citrix Secure Access with Chrome Enterprise. By following these steps, you have successfully: Established a secure foundation by creating a resource location and defining your private web applications. Implemented a robust security model by configuring adaptive access policies to control who can access your applications and under what conditions. Provisioned user accounts in your Google directory, ensuring a seamless user experience. Enforced a secure browser environment by configuring policies across your organization. With this setup complete, you have a powerful and secure framework for delivering applications to your users, fully leveraging the Zero Trust capabilities of Citrix Secure Access with Chrome Enterprise. </article> <article> <h1>Integrating Scout Board with Okta SAML 2.0 for Single Sign-On</h1> <p>Thu, 14 Aug 2025 13:49:06 +0000</p> OverviewThis guide describes how to integrate Scout Board with Okta using the SAML 2.0 protocol to enable Single Sign-On (SSO) for end users. By leveraging Okta’s identity platform, organizations can centralize authentication, improve security, and streamline the login experience for Scout Board users. PrerequisitesBefore starting, ensure the following requirements are met: Scout Board 15 2507 or above. Administrative access to both the Okta Console and the Scout Board server. An SSL/TLS certificate (public/private key pair) for signing SAML requests. A designated Scout Board URL that is accessible by Administrators. This article guides on configuring the integration when installing Scout Board or when switching from another authentication method to Okta SAML 2.0 during an existing installation. Note: For testing purposes, you can create a self-signed certificate for signing the SAML requests using OpenSSL using the following command: openssl req -x509 -newkey rsa:4096 -keyout private_key.pem -out public_cert.pem -days 365 -nodes –subj "/C=US/ST=California/L=San Francisco/O=MyOrg/CN=my-test-domain.com" Create the Okta SAML IntegrationFrom the Okta Admin Console, create a new App integration: Navigate to Applications → Create App Integration. Select Sign-in method: SAML 2.0 Provide an App Name (i.e. Scout Board SAML app) Configure Okta SAML settingsConfigure the SAMLsettings as described below, replacing <HOSTNAME> with the Scout Board URL. If your Scout Board uses a different port than 22160, update the setting as needed. General Settings:Attribute Value Single sign-on URL https://<HOSTNAME>:22160/api/v1/auth/login-saml/callback Audience URI (SP Entity ID) https://scoutboard.com/47d899fb-3002-4692-b741-8068b8f7fbb4 Name ID format Email Application username Email Advanced Settings:Attribute Value Enable Single Logout Yes Signature Certificate Upload the public key certificate to verify the signature Single Logout URL https://<HOSTNAME>:22160/api/v1/auth/logout-saml/callback SP Issuer https://scoutboard.com/47d899fb-3002-4692-b741-8068b8f7fbb4 *** Only replace if you are not using the Scout Board issuer Signed Requests Yes Attribute Statements:Name Name Format Value firstName Basic user.firstName lastName Basic user.lastName email Basic user.email Group Attribute Statement:Name Name Format Filter Value Groups Basic Matches regex .* Note: Use the filter expression required by your environment. The .* sends all group memberships. After completing the configuration, download the SAML Signing Certificate (okta.cert). Assign Users and GroupsUnder the Assignments tab in Okta, add the users or groups that should have access to Scout Board. Retrieve required Okta InformationUsing the newly created Okta SAML integration, retrieve the values for the following parameters: ● Sign On URL ● Single Logout URL ● SAML Signing Certificate (okta.cert) At this point, ensure that you already have the private key associated with the signing certificate. Configure Scout Board for Okta SAMLOkta SAML authentication for Scout Board can be enabled either during the initial installation or after the system is already deployed. This flexibility allows you to start with one authentication method (such as Active Directory) and later transition to Okta if needed. During Installation – If you are enabling Okta SAML as part of the Scout Board installation, provide the required parameter values below during the setup of the Scout Enterprise Management Suite. The initial user parameter must be an existing user in Okta with access to the Scout Board application. The installer will then add the user as an administrator for Scout Board. Post-Installation – If Scout Board is already installed and you are switching to Okta SAML, locate the .env configuration file at C:\Program Files\Unicon\Scout\ScoutBoard and update the relevant parameters with the corresponding values listed below. Parameters Value AUTH_TYPE OKTA_SAML SAML_SSO_ENTRY Sign on URL SAML_LOGOUT_URL Single Logout URL SAML_SERVICE_PROVIDER_ISSUER https://scoutboard.com/47d899fb-3002-4692-b741-8068b8f7fbb4 *** Only replace if you are not using the Scout Board issuer SAML_CERT_PATH Okta app integration certificate okta.cert (i.e: C:\Program Files\Unicon\Scout\ScoutBoard\okta.cert) Upload the okta.cert to the Scout Board machine SAML_PRIVATE_KEY_PATH private.key used to sign the requests (i.e: C:\Program Files\Unicon\Scout\ScoutBoard\okta_private_key.pem) Upload the private key to the Scout Board machine Template for the .env file: AUTH_TYPE=OKTA_SAML SAML_SSO_ENTRY= SAML_LOGOUT_URL= SAML_SERVICE_PROVIDER_ISSUER=https://scoutboard.com/47d899fb-3002-4692-b741-8068b8f7fbb4 SAML_CERT_PATH= SAML_PRIVATE_KEY_PATH= Note: If you enable Okta SAML authentication after Scout Board has been installed, ensure that at least one user with permissions for the Okta SAML integration app is added to the Scout database. ● Using SQL Server Management Studio, open the dbo.Administrator table. ● Insert a new record by copying all values from AdministratorID = 1, but update the Name column with the user’s email address. This is required because the Okta initial user does not yet exist in the Scout Board. Restart the Scout Board service for the changes to take effect. ValidationThe configured integration supports both Service Provider (SP)-initiated and Identity Provider (IdP)-initiated flows. It’s recommended to validate both: SP-Initiated Flow – From a browser, navigate to the Scout Board URL: You should be redirected to the Okta login page. After entering your credentials, you should be automatically signed in to Scout Board. IdP-Initiated Flow – If you make the Scout Board app available in the Okta portal: Sign in to the Okta portal. Launch the Scout Board app, and confirm you are automatically signed in without being prompted for credentials. Finally, test Single Logout (SLO) by signing out of Scout Board and verifying that you are also logged out of your Okta session. SummaryIntegrating Scout Board and Okta for SAML 2.0 authentication enables seamless, secure authentication using your organization’s existing identity infrastructure. With SSO in place, users benefit from a simplified login process, and administrators gain centralized control over access policies. In addition to SAML 2.0, administrators can configure Okta OpenID Connect (OICD) for authentication with Scout Board. For configuration details, refer to the Scout Board Installation Guide. For further guidance, reach out to your Citrix representative or consult the official documentation at https://docs.citrix.com/en-us/unicon-elux-scout. </article> <article> <h1>Deployment Guide: Citrix MCS for Amazon WorkSpaces Core Managed Instances</h1> <p>Tue, 22 Jul 2025 10:00:00 +0000</p> OverviewIn this Deployment Guide, we will walk you through the process of deploying Citrix MCS for Amazon WorkSpaces Core Managed Instances environments. The new integration introduces an Amazon WorkSpaces Core Host Connection type, which allows Citrix MCS to manage the power and lifecycle of VDAs across Amazon WorkSpaces Core environments. What´s NewWith this new product, we’re expanding Citrix MCS non-persistent and persistent provisioning capabilities to work with Amazon WorkSpaces Core Managed Instances environments. Here’s what’s now possible: Non-Persistent and persistent Workload Management: power management and provisioning of non-persistent and persistent WorkSpaces instances VM and Image lifecycle management (create, view, update, delete) Bring existing AWS EC2 AMIs to use as images for WorkSpaces BYOL Windows 11/10 Desktop, Windows Server 2025/2022/2019/2016, Ubuntu Server 24.04 LTS, and Debian 12 support Flexibility to bring Microsoft 365 Apps for enterprise licenses to run on WorkSpaces Core or purchase Microsoft Office bundles (https://aws.amazon.com/workspaces-family/core/faqs/) Global WorkSpaces Core regional support Customer-controlled account flexibility Identity management flexibility: Active Directory and Entra Hybrid support, Citrix FAS for SSO to VDAs A similar resource location setup, host connection configuration, and catalog creation process as existing MCS workflows (making the experience familiar for current MCS users) Full suite of DaaS capabilities beyond MCS: Studio management console, session brokering/management, HDX, Workspace app, Director monitoring, WEM, deviceTRUST PrerequisitesFollow our Product Docs to set up an AWS virtualization environment (Amazon WorkSpaces Core environments share similarities with AWS EC2 environments) Install VDAs on the Master VMs (for creating Master Image AMIs, which will be used to prepare Images for MCS Machine Catalogs) Create a service-linked role Creating a Host ConnectionThe Host Connection creation process for Amazon WorkSpaces Core will be similar to the existing MCS connection to AWS EC2, except for IAM permissions policy. Please see the “Minimal IAM permissions” in the “Appendix” section of this guide to properly define IAM permissions for your IAM user or role’s policy for Citrix to manage resources in your AWS account. If you’d like to create a host connection configured with a proxy, please see the section “Create a secure environment for AWS-managed traffic” section of our product docs. Create a new connection. Go to the Hosting tab on the Studio console and click Add Connection and Resources. Use the Resource Location (e.g., WSC) you set up for your AWS environment (see prerequisites) and select “Amazon WorkSpaces Core” as the Connection Type. Next, you can either use: an IAM user access key, or an IAM role. For the IAM user access key approach, please provide your “API key” and “Secret key” for the IAM user that has the proper IAM permissions policy for Citrix to manage resources in your AWS account. For the IAM role approach, select “Use IAM role”: Ensure that you've assigned an IAM role to the Citrix Cloud Connector (or Delivery Controller) instance with the proper IAM permissions policy, allowing Citrix to manage resources in your AWS account. Refer to our Role-based Authentication guide for more information. Finally, give the connection a name. Specify the location where your VMs will be provisioned. Select the Cloud region, VPC, and Availability Zone for creating new VMs. Name the resources in the previously selected Availability Zone and choose one or more subnets in the VPC that you configured in the previous menu. Click through the remaining pages until the Summary page. Click Finish to create the Host Connection to Amazon WorkSpaces Core. Create a Prepared ImageGo to the Images tab on the Studio console and click Create Image Definition. Select an OS type and Session type for the prepared Image. Provide the Host Connection that you created in the Create a Host Connection section of this guide. Select the resources you created in the Create a Host Connection section of this guide. Select a Master Image as the template for creating a prepared Image version in this Image Definition. The Master Image should be an AMI created from a Master VM with VDA installed (see the prerequisites section of this guide). Select a Machine Profile that will serve as a hardware template to use when provisioning machines in the Create a Machine Catalog section of this guide. The Machine Profile can be an EC2 instance or Launch Template Version in your resources with hardware properties (e.g., Instance type, Tenancy type, Network mappings, Security Groups, Volume properties) that will be captured for provisioning new VMs. Select a machine specification that the provisioned VMs will take on during Machine Catalog creation. By default, the Machine Profile’s instance type is selected. Select one or more network interfaces that the provisioned VMs will use during Machine Catalog creation. You can provide an optional description to highlight information about this initial version of the Image Definition. Name the definition and click Finish to create the Image Definition and an initial Image version. To create another Image version (beyond the initial Image version), navigate to the Image Definition you just created, and click Create Image version. Select Resources, a Master Image, and/or a Machine Profile for the new Image version. The initial Image version’s properties are used by default and can be modified. Create a Machine CatalogGo to the Machine Catalogs tab on the Studio console and click Create Machine Catalog. Select a Machine Type for this catalog (e.g., Multi-session OS or Single-session OS, which is required for persistent machines). Use the dropdown menu under Resources to select the Resources (Availability Zone) you configured in the Create a Host Connection section of this guide. To create a machine catalog containing persistent machines, select the option for a “static desktop” experience that “creates a dedicated VM and saves changes on the local disk.” For non-persistent machines, select a “random desktop” or “static desktop” that discards all changes. Click Select an Image to select a Prepared Image for the Machine Catalog. Select the Prepared Image version that you would like to use, created in the Create a Prepared Image section of this guide, and click Done. The Machine Profile associated with the Prepared Image will appear, and its hardware properties (e.g., Instance type, Tenancy type, Network mappings, Security groups, Volume properties) will be used to create machines in the catalogs. You can change the Machine Profile source to another VM or launch template version by clicking the Edit button. Define how many VMs you want to create in the Machine Catalog. The default Machine Specification is based on the Machine Profile. To change it, click Select a Machine Specification and pick the Instance type you’d like to use for the VMs. Configure on-prem AD (or Hybrid Azure AD) for the machines in the catalog by selecting the domain and creating new AD accounts for the VMs that will be created in this Machine Catalog. The provisioned VMs will be joined to the selected Domain. After configuring the Domain account options for the VMs in the catalog, you’ll have to provide the credentials for the selected domain by clicking Enter credentials, where you’ll be prompted to enter an admin-level Username and Password. You can also use a Service Account if you already have Domain credentials saved, as outlined in our Product Docs. Click through the remaining pages until the Summary page. Give the Machine Catalog a name and select Finish to create the Machine Catalog. AppendixMinimal IAM Permissions{ "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:AttachVolume", "ec2:AssociateIamInstanceProfile", "ec2:AuthorizeSecurityGroupEgress", "ec2:RevokeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateImage", "ec2:CreateLaunchTemplate", "ec2:CreateNetworkInterface", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteLaunchTemplate", "ec2:DeleteNetworkInterface", "ec2:DeleteSecurityGroup", "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:DeleteVolume", "ec2:DeregisterImage", "ec2:DescribeAccountAttributes", "ec2:DescribeAvailabilityZones", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInstanceTypes", "ec2:DescribeInstanceStatus", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRegions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeInstanceCreditSpecifications", "ec2:DescribeInstanceAttribute", "ec2:GetLaunchTemplateData", "ec2:DescribeVolumes", "ec2:DescribeVpcs", "ec2:DetachVolume", "ec2:DisassociateIamInstanceProfile", "ec2:RebootInstances", "ec2:RunInstances", "ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ec2:CreateSecurityGroup", "ec2:DeleteSecurityGroup" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ebs:StartSnapshot", "ebs:GetSnapshotBlock", "ebs:PutSnapshotBlock", "ebs:CompleteSnapshot", "ebs:ListSnapshotBlocks", "ebs:ListChangedBlocks", "ec2:CreateSnapshot" ], "Effect": "Allow", "Resource": "*" }, { "Effect": "Allow", "Action": [ "kms:CreateGrant", "kms:Decrypt", "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlainText", "kms:GenerateDataKey", "kms:ReEncryptTo", "kms:ReEncryptFrom" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*" }, { "Effect": "Allow", "Action": [ "workspaces-instances:*" ], "Resource": "*" } ] } Confidentiality and DisclaimerConfidentiality and Disclaimer The information in this document is confidential information of Cloud Software Group, Inc. and/or its affiliates. Use, duplication, transmission, or republication for any purpose without the prior written consent of Cloud Software Group, Inc. is expressly prohibited. This document (including, without limitation, any product roadmap or statement of direction data) illustrates the planned testing, release and availability dates for Cloud Software Group, Inc. products and services. This document is provided for informational purposes only and its contents are subject to change without notice. Cloud Software Group, Inc. makes no warranties, express or implied, in or relating to this document or any information in it, including, without limitation, that this document, or any information in it, is error-free or meets any conditions of merchantability or fitness for a particular purpose. The material provided is for informational purposes only, and should not be relied on in making a purchasing decision. The information is not a commitment, promise or legal obligation to deliver any material, code, or functionality. The development, release, and timing of any features or functionality described for our products remains at our sole discretion. During the course of this presentation, Cloud Software Group, Inc. or its representatives may make forward-looking statements regarding future events Cloud Software Group, Inc.'s future results or our future financial performance. These statements are based on management's current expectations. Although we believe that the expectations reflected in the forward-looking statements contained in this presentation are reasonable, these expectations or any such forward-looking statements could prove to be incorrect and actual results or financial performance could differ materially from those stated herein. Cloud Software Group, Inc. does not undertake to update any forward-looking statement that may be made from time to time or on its behalf. </article> <article> <h1>AWS Cross-Account Provisioning</h1> <p>Thu, 03 Jul 2025 16:01:40 +0000</p> OverviewAdmins using Citrix Machine Creation Services (MCS) technology have use-cases where Cloud Connectors (or Delivery Controllers) would like to be placed in a primary AWS account with IAM roles that have cross-account resource access to MCS-provisioned machine catalogs in separate secondary accounts. No additional Cloud Connectors should be needed in the secondary accounts. Such a deployment model is not currently supported by MCS, which requires cloud connectors to be placed in every AWS account, each with its own IAM role or IAM user access, including API/secret keys. The current methods are thus not scalable and costly (e.g., resource and management costs of multiple cloud connectors and/or API/secret keys) To address such challenges and more, Citrix MCS is introducing a new capability known as "AWS Cross-Account Provisioning," which enables the use of cross-account IAM roles to provision machine catalogs in one or more different AWS accounts from where the Cloud Connectors (or Delivery Controllers) reside. What is Cross-Account Provisioning?MCS Cross-Account Provisioning for AWS allows admins to provision machine catalogs across multiple AWS accounts using cross-account IAM roles. The Cloud Connector(s) (or Delivery Controller) only needs to reside in a single account with a cross-account IAM role. At the same time, provisioned VMs can span multiple accounts, providing cross-account resource access through IAM. Prerequisites and requirements to enable the feature: Ability for the Domain Controller in the "primary" account to talk to provisioned VMs in other accounts. One option is VPC peering (https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html) Domain Controller in one account can talk to the Cloud connectors in the same account Provisioned VMs in other accounts Cloud connector can talk to the provisioned VMs in separate accounts Cross-account resource access in IAM (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) The destination/target account (where machine catalogs of provisioned VMs will reside) needs to provide (1) trust policy and (2) permissions policy to assume role for the originating account (CC/DDC and DC) The originating account must have a permissions policy in place to pass the role from the destination account to the cloud connector. The cloud connector will then assume the passed-on role and be able to provision VMs in the destination account. Why Use Cross-Account Provisioning?Administrators will benefit from: Saving compute and storage costs since cloud connector(s) only need to be created in one account (rather than multiple, which can cause significant cost increases as a function of the number of accounts) Being able to create and manage machine catalogs in an account separate from that of their CC, DDC, and/or DC Provisioning capabilities similar to Azure with multi-subscription or multi-tenancy A scalable solution for (1) large enterprises that have many subdivisions managed in separate AWS accounts, and (2) big orgs that act like or as partners for smaller orgs and manage AWS accounts in a hierarchical fashion Only needing role-based authentication and not creating multiple API or secret keys for every account and host connection. Much more scalable and manageable, since API keys/secrets have to be rotated on a regular/periodic basis Role-based authentication is also the AWS best practice for leveraging the API/SDK, making Citrix environments much more secure and compliant. How To Enable Cross-Account Provisioning?Using Web StudioLet's assume that Account "A" is a primary or originating account where shared infrastructure or service components reside. At the same time, Account "B" is a destination/target account where we would like to provision VMs/machine catalogs. Set up VPC peering between Account A and Account B. See the following guides to do so: Citrix product documentation https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html Delegate cross-account access using IAM roles. See the following guides to do so: Citrix product documentation https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html Under the Citrix Web Studio hosting page, select "Add Connection and Resources." Select "Create a new connection" and then select "Use cross-account Access to provision resources." Provide the ARN of the IAM role in Account B that the Cloud Connectors (or Delivery Controllers) in Account A will assume and need to perform provisioning operations in. Also, give the connection a name. Complete host connection creation. You can now provision VMs in Account B associated with this newly created host connection. Using PowershellFollow steps 1-2 of the "Using Web Studio" section to configure IAM roles for VPC peering and cross-account access. Use PowerShell commands to create the host connection and add two custom properties: CrossAccountRoleArn: If you don’t provide the CrossAccountRoleArn property, then the regular Host Connection is created. In this case, MaximumAssumeRoleDurationInSeconds is ignored even if it is provided. MaximumAssumeRoleDurationInSeconds: DurationInSeconds must be between 900 seconds to 3600 seconds. The default is 900 seconds. If you provide a value of more than 3600, then DurationInSeconds is set to 3600. Example: $connectionName = "cross-account-conn" $cloudRegion = "us-east-1" $apiKey = "role_based_auth" $secretKey = "role_based_auth" $zoneUid = "xxxxxx" $secureKey = (ConvertTo-SecureString -String $secretKey -AsPlainText -Force) $connectionPath = "XDHyp:\Connections\" + $connectionName $customProperties = '<CustomProperties xmlns="http://schemas.citrix.com/2014/xd/machinecreation" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <Property xsi:type="StringProperty" Name="CrossAccountRoleArn" Value="arn:aws:iam::5678:role/citrix-role" /><Property xsi:type="StringProperty" Name="MaximumAssumeRoleDurationInSeconds" Value="3600" /> "</CustomProperties>' $connection = New-Item -Path $connectionPath -ConnectionType "AWS" -HypervisorAddress "https://ec2.$($cloudRegion).amazonaws.com" -Persist -Scope @() -UserName $apiKey -SecurePassword $secureKey -ZoneUid $zoneUid -CustomProperties $customProperties New-BrokerHypervisorConnection -HypHypervisorConnectionUid $connection.HypervisorConnectionUid </article> <article> <h1>Deployment Guide: Using HashiCorp Packer to Automate the Creation of Master Images</h1> <p>Mon, 30 Jun 2025 09:05:57 +0000</p> OverviewWhat is HashiCorp Packer?HashiCorp Packer is an open-source tool designed to automate the creation of machine images for multiple platforms from a single source configuration. It enables developers and DevOps teams to define Image Creation workflows in code, allowing for consistent, repeatable, and version-controlled Image builds. Packer supports a wide range of platforms, including: AWS AMIs (Amazon Machine Images) Azure Managed Images Azure Compute Galleries Google Cloud Images Docker containers vSphere, VirtualBox, and other Hypervisors Core ConceptsImportant: Packer does not replace configuration management like Chef or Puppet. Packer can use tools like Chef or Puppet to install software onto the Image. Immutable InfrastructurePacker promotes the concept of immutable infrastructure, where Images are not modified after deployment. Instead, new Images are built and deployed. This approach ensures zero Configuration drift as the Image contains all configurations. The reproducibility is also 100% - all Image builds are the same. Common Use CasesGolden Image Creation Create pre-configured, secure, and tested Base Images for cloud or on-prem environments. CI/CD Integration Integrate with CI/CD pipelines to automatically build and test Images during deployment. Multi-Cloud/Hybrid-Cloud Deployments Build identical Images for multiple cloud providers or even hybrid cloud deployments to ensure consistency across environments. Container Image Creation Use Packer to build Docker Images with consistent provisioning steps. Disaster Recovery Maintain up-to-date Images that can be quickly deployed in the event of a failure. Benefits of using PackerBenefit Description Consistency Ensures all environments use the same base image, reducing "it works on my machine" issues. Automation Fully automates image creation, reducing manual errors and saving time. Speed Speeds up instance provisioning by using pre-baked images. Version Control Templates can be stored, for example, in Git, enabling change tracking and collaboration. Multi-Platform Support Build images for multiple platforms from a single template. Security Embed security patches and configurations into images before deployment. Installing PackerThe installation of Packer is straightforward. There are many ways to install Packer – you can find more information about Installation on the Packer homepage. Note: In our case, we use a dedicated Ubuntu-based VM, where all automation-related frameworks are installed. You can find more information about creating and installing such a dedicated machine on Citrix TechZone. Example of installing Packer on Ubuntu: azadmin@tacg-cicd:~$curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add - OK azadmin@tacg-cicd:~$echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(grep -oP '(?<=UBUNTU_CODENAME=).*' /etc/os-release || lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list deb [arch=amd64 signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com noble main azadmin@tacg-cicd:~$ sudo apt-get update && sudo apt-get install packer Hit:1 http://at.archive.ubuntu.com/ubuntu noble InRelease Get:2 http://at.archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB] Get:3 https://apt.releases.hashicorp.com noble InRelease [12.9 kB] Ign:4 https://pkg.jenkins.io/debian binary/ InRelease Get:5 http://at.archive.ubuntu.com/ubuntu noble-backports InRelease [126 kB] Hit:6 https://pkg.jenkins.io/debian binary/ Release Get:7 http://at.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1,110 kB] Hit:9 https://ppa.launchpadcontent.net/ansible/ansible/ubuntu noble InRelease Get:10 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB] Get:11 http://at.archive.ubuntu.com/ubuntu noble-updates/main amd64 Components [161 kB] Get:12 http://at.archive.ubuntu.com/ubuntu noble-updates/restricted amd64 Components [212 B] Get:13 http://at.archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages [1,068 kB] Get:14 http://at.archive.ubuntu.com/ubuntu noble-updates/universe amd64 Components [376 kB] Get:15 http://security.ubuntu.com/ubuntu noble-security/main amd64 Components [21.6 kB] Get:16 http://at.archive.ubuntu.com/ubuntu noble-updates/multiverse amd64 Components [940 B] Get:17 http://at.archive.ubuntu.com/ubuntu noble-backports/main amd64 Components [7,072 B] Get:18 http://at.archive.ubuntu.com/ubuntu noble-backports/restricted amd64 Components [216 B] Get:19 http://at.archive.ubuntu.com/ubuntu noble-backports/universe amd64 Components [16.4 kB] Get:20 http://at.archive.ubuntu.com/ubuntu noble-backports/multiverse amd64 Components [212 B] Get:21 http://security.ubuntu.com/ubuntu noble-security/restricted amd64 Components [212 B] Get:22 http://security.ubuntu.com/ubuntu noble-security/universe amd64 Components [52.2 kB] Get:23 http://security.ubuntu.com/ubuntu noble-security/multiverse amd64 Components [212 B] Fetched 3,206 kB in 1s (3,247 kB/s) Reading package lists... Done Reading package lists... Done Building dependency tree... Done Reading state information... Done The following NEW packages will be installed: packer 0 upgraded, 1 newly installed, 0 to remove and 20 not upgraded. Need to get 14.4 MB of archives. After this operation, 42.0 MB of additional disk space will be used. Get:1 https://apt.releases.hashicorp.com noble/main amd64 packer amd64 1.13.0-1 [14.4 MB] Fetched 14.4 MB in 0s (32.6 MB/s) Selecting previously unselected package packer. (Reading database ... 223616 files and directories currently installed.) Preparing to unpack .../packer_1.13.0-1_amd64.deb ... Unpacking packer (1.13.0-1) ... Setting up packer (1.13.0-1) ... azadmin@tacg-cicd:~$ azadmin@tacg-cicd:~$ packer --version Packer v1.13.0 azadmin@tacg-cicd:~$ Packer CommandsPacker is controlled using its command-line interface (CLI). Calling packer without any subcommand shows all currently implemented commands: azadmin@tacg-cicd:~$ packer Usage: packer [--version] [--help] <command> [<args>] Available commands are: build build image(s) from template console creates a console for testing variable interpolation fix fixes templates from old versions of packer fmt Rewrites HCL2 config files to canonical format hcl2_upgrade transform a JSON template into an HCL2 configuration init Install missing plugins or upgrade plugins inspect see components of a template plugins Interact with Packer plugins and catalog validate check that a template is valid version Prints the Packer version azadmin@tacg-cicd:~$ Note: You can find a detailed description of the commands on the Packer homepage. For this guide, we will use only 3 commands – these are making up the core workflow: packer init -upgrade path_to_template.hcl: This command downloads and installs all needed plugins according to the template file. azadmin@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer init -upgrade win2025-std-config.pkr.hcl Installed plugin github.com/hashicorp/vsphere v1.4.2 in "/home/azadmin/.config/packer/plugins/github.com/hashicorp/vsphere/packer-plugin-vsphere_v1.4.2_x5.0_linux_amd64" Installed plugin github.com/rgl/windows-update v0.16.10 in "/home/azadmin/.config/packer/plugins/github.com/rgl/windows-update/packer-plugin-windows-update_v0.16.10_x5.0_linux_amd64" azadmin@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer validate -var-file=path_to_varfile.hcl path_to_template.hcl: This command is used to validate the syntax and configuration of a template file. It returns a specific exit status, depending on whether the operation was successful or not. An error message will be shown if a template cannot be validated successfully. azadmin@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer validate -var-file win2025-std.auto.pkrvars.hcl win2025-std- config.pkr.hcl The configuration is valid. azadmin@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer build -var-file=path_to_varfile.hcl -force -on-error=abort path_to_template.hcl: This command is used to build an Image based on the template file and the variables for the template. The -force parameter instructs Packer to overwrite existing artifacts. If a previous build has created an artifact (such as an AMI or Vagrant box) with the same name or ID, Packer will delete or overwrite it without prompting. It also instructs Packer to skip confirmation prompts, thereby bypassing any interactive confirmation that might otherwise halt the build. In case of an error during the building process, the -on-error=abort parameter instructs Packer to exit without removing any created stuff, which is helpful during debugging. Example of the output of a successful Image Build: azadmin@tacg-cicd:~/packer-templates/winsrv2025-ssh$ packer build -var-file win2025-std.auto.pkrvars.hcl -force -on-error=abort win2025-std-config.pkr.hcl The configuration is valid. vsphere-iso.winsrv2025: output will be in this color. ==> vsphere-iso.winsrv2025: Creating virtual machine... ==> vsphere-iso.winsrv2025: Customizing hardware... ==> vsphere-iso.winsrv2025: Adding virtual machine flags... ==> vsphere-iso.winsrv2025: Mounting ISO images... ==> vsphere-iso.winsrv2025: Adding configuration parameters... ==> vsphere-iso.winsrv2025: Creating floppy disk... vsphere-iso.winsrv2025: Copying files flatly from floppy_files ... vsphere-iso.winsrv2025: Successfully installed vsphere-iso.winsrv2025: ==> vsphere-iso.winsrv2025: Provisioning with Powershell... ==> vsphere-iso.winsrv2025: Provisioning with powershell script: ./setup/post-setup.ps1 vsphere-iso.winsrv2025: Disable SSH ==> vsphere-iso.winsrv2025: Provisioning with powershell script: ./setup/disable-ssh.ps1 ==> vsphere-iso.winsrv2025: Running shutdown command... ==> vsphere-iso.winsrv2025: Deleting floppy drives... ==> vsphere-iso.winsrv2025: Deleting floppy image... ==> vsphere-iso.winsrv2025: Ejecting CD-ROM media... ==> vsphere-iso.winsrv2025: Removing CD-ROM devices... vsphere-iso.winsrv2025: Closing sessions .... Build 'vsphere-iso.winsrv2025' finished after 57 minutes 36 seconds. ==> Wait completed after 57 minutes 36 seconds ==> Builds finished. The artifacts of successful builds are: --> vsphere-iso.winsrv2025: winsrv2025-01 azadmin@tacg-cicd:~/packer-templates/winsrv2025-ssh$ Packer TerminologyA short overview of terms related to Packer: Artifacts Each Builder creates a single Artifact during the building process. For example, the vSphere Builder creates a directory containing all files of the created VM. Builds A Build is a task that produces an Artifact based on the instructions set in the Template. Builder A Builder is specific to each platform and is the process that creates the Virtual Machine. Each Builder has different capabilities and needs depending on the underlying platform. For example, the azure-arm builder allows you to build VHDs and Managed Images in ARM. The vsphere-ISO builder uses an OS ISO file and builds a VM Image on vSphere. Provisioner A Provisioner allows Packer to install Software before the Build finishes. Provisioners are the main component that adds all the desired elements to the underlying OS. Provisioners can also call other IaC Frameworks, such as Ansible, or run scripts like Shell Scripts or PowerShell snippets, or upload files. It is imperative that communication between the Packer Machine and the Windows Machine, using WinRM and/or SSH, can be established without error. Post-Processor A Post-Processor takes a successful build and can be used, e.g., to upload an Artifact or package the files. For example, the vsphere Post-Processor uploads a successfully created Artifact to vSphere. Template A JSON- or HCL-based human-readable file which defines the build process. It holds the configuration and tells the Builder what to do. Data Source A Data Source fetches Data from the outer World and makes it accessible to Packer. Important: Communication between the Packer Machine and the Windows Machine must use WinRM and/or SSH . Please check the communication flow for errors. Note: You can assure that WinRM is configured correctly by adding the configuration script to the unattend.xml or autounattend.xml file, which Packer will use. Packer StructurePacker uses Templates written in HCL as the receipt for creating an Image. You must follow a simple structure in the Templates (see example of a Windows Server 2025 Template below): # Windows Server 2025 deployment using Hashicorp Packer locals { SSHUser = "XxXxXxXxXxXxX" SSHPass = "XxXxXxXxXxXxX" WinRMUser = "administrator" WinRMPass = "XxXxXxXxXxXxX" vcenter_admin = "admin@vspXxX.tmmXxXxX" vcenter_password = "XxXxXxXxXxXxX" timestamp = regex_replace(timestamp(), "[- TZ:01]", "") buildtime = formatdate("DD-MM-YYYY hh:mm ZZZ", timestamp()) manifest_date = formatdate("DD-MM-YYYY hh:mm:ss", timestamp()) } packer { required_version = ">= 1.12.0" required_plugins { vsphere = { version = ">= v1.4.2" source = "github.com/hashicorp/vsphere" } } required_plugins { windows-update = { version = ">= 0.16.8" source = "github.com/rgl/windows-update" } } } variable "host" { type = string description = "Name of the Host to use" } variable "name" { type = string description = "Name of the Image" } ... variable "vvtd_enabled" { type = string } source "vsphere-iso" "winsrv2025" { CPUs = var.vm_cpus notes = "TMM - Built by HashiCorp Packer on ${local.buildtime}." RAM = var.vm_memory firmware = var.vm_firmware ... network_adapters { network = var.vcenter_network network_card = var.vm_network_card } ... storage { disk_size = var.vm_disk_size disk_thin_provisioned = var.vm_disk_thin } ... boot_order = var.vm_boot_order boot_wait = var.vm_boot_wait boot_command = var.vm_boot_command shutdown_command = var.vm_shutdown_command } build { sources = ["source.vsphere-iso.winsrv2025"] provisioner "windows-update" { pause_before = "30s" search_criteria = "IsInstalled=0" filters = [ "exclude:$_.Title -like '*Preview*'", "exclude:$_.InstallationBehavior.CanRequestUserInput", "include:$true" ] restart_timeout = "120m" } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Output 'restarted.'}\"" restart_timeout = "20m" } provisioner "powershell" { elevated_user = local.SSHUser elevated_password = local.SSHPass scripts = [ "./setup/disable-autolog.ps1", "./setup/disable-ssh.ps1" ] } }The locals {} block defines variables used locally in this particular Template. The packer {} block is the root block of this Template and contains all settings. It specifies a required version – in this case, at least Packer version 1.12 or higher. The required_plugins {} block defines all plugins needed for a successful build. The variable {} blocks define all the variable names, the types, and, if needed, default values. Packer looks for the values in the variable file mentioned in the CLI command you used to start the build (remember packer build -var-file=path_to_varfile.hcl -force -on-error=abort path_to_template.hcl). The source {} block configures a plugin for building an Image on a specific platform and defines all needed settings. Important: This block differs based on the underlying platform and its needs. It can be reused whenever you need to build an Image on the same platform. The build {} block defines all necessary steps that Packer should do sequentially after the complete source {} block. Now, as all needed blocks are defined, you can build your Image. If you are unsure whether your Template is valid, you can run 'packer validate -var-file=path_to_varfile.hcl path_to_template. hcl' to check and identify any errors. Creating Master Images with PackerIn this guide, we will look at two ways to automate the creation of Master Images using Packer: Creating a Master Image on vSphere Creating a Master Image on Azure The HCL-based Packer templates are primarily built using variables for maximum flexibility and reusability. There are different ways of modifying the Master Image during the creation process – in this guide, we look at the following steps: Packer initially creates the Base Images and sets the initial Software configurations on the Master Image using PowerShell scripts embedded in the autounattend.xml file and using different provisioners. After creating the Master Image initially, we use Ansible to automate further software installations and configurations. Using this approach, you can maximize the flexibility during the automated creation of your Master Images. Modifying the Master Image using Autounattend.xmlThe autounattend.xml file is an unattended answer file used during the Windows setup process. It contains configuration settings and instructions that Windows Setup uses to perform an automated installation without requiring user interaction. Important: The autounattend.xml file is only needed for Hypervisor-based Images. It is not required for all Hyperscaler-/Cloud-based deployments. Of course, you could convert an upload Hypervisor-based Image to the Hyperscaler… Caution: The syntax and structure of the autounattend.xml file are very complex and differ between the Operating Systems. Please be aware of the correct structure and syntax, as an erroneous autounattend.xml file can break the deployment of the Windows Master Image. Some benefits of using autounattend.xml files for modifying the Windows Master Image are: Fully Automated Installation: It eliminates the need for manual input during installation (e.g., language selection, disk partitioning, product key entry) Consistency Across Deployments: Ensures every machine is set up precisely the same way — ideal for enterprise environments or mass deployments Time-Saving: Speeds up the deployment process, especially when installing Windows on many machines. Customization: You can predefine: Computer name User accounts Network settings Domain-join settings Application installations Post-install scripts Hands-Free Setup: Useful for remote or unattended installations where no technician is present. Note: You can decide when to use the autounattend.xml method for initial configuration and when to use Ansible after the initial deployment. For demonstration purposes, we use both ways sequentially in this guide. Example of an autounattend.xml file for initial configuration: ... <settings pass="oobeSystem"> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <AutoLogon> <Enabled>true</Enabled> <Username>administrator</Username> <Password> <Value>XxXxXxXxXxXxXxX</Value> <PlainText>true</PlainText> </Password> <LogonCount>5</LogonCount> </AutoLogon> <FirstLogonCommands> <SynchronousCommand wcm:action="add"> <Order>1</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\install-vmwtools.ps1</CommandLine> <Description>VMware Tools Installation</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>2</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\enable-ssh.ps1</CommandLine> <Description>Enable SSH service</Description> <RequiresUserInput>true</RequiresUserInput> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>3</Order> <CommandLine>cmd.exe /c a:\enable-rdp.cmd</CommandLine> <Description>Enable RDP</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>4</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\configure-firewall.ps1</CommandLine> <Description>Configure Windows Firewall</Description> </SynchronousCommand> <SynchronousCommand wcm:action="add"> <Order>5</Order> <CommandLine>powershell -ExecutionPolicy Bypass -File a:\enable-winrm.ps1</CommandLine> <Description>Enable WinRM service</Description> <RequiresUserInput>true</RequiresUserInput> </SynchronousCommand> </FirstLogonCommands> <OOBE> <HideEULAPage>true</HideEULAPage> <HideLocalAccountScreen>true</HideLocalAccountScreen> <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen> <HideOnlineAccountScreens>true</HideOnlineAccountScreens> <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> <NetworkLocation>Home</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> </OOBE> <UserAccounts> <AdministratorPassword> <Value>XxXxXxXxXxXxXValue> <PlainText>true</PlainText> </AdministratorPassword> </UserAccounts> </component> </settings>In this example, autounattend.xml sequentially starts five scripts for further configuration: install-vmwtools.ps1 Installs the actual version of the VMware Tools enable-ssh.ps1 Enables and configures SSH communication for Ansible and Terraform enable-rdp.cmd Enables RDP Access configure-firewall.ps1 Configures the Windows Firewall adjacent with the further needs enable-winrm.ps1 Enables and configures WinRM communication for Ansible and Terraform Note: You can reuse or modify the working ones if you need different autounattend.xml files. Therefore, we created a web-based application with a graphical interface to configure and structure a corresponding autounattend.xml file. Important: To begin, you can find many examples of valid autounattend.xml files on the Internet. Example screenshot of the PACKERGEN web application: Using this application and its framework simplifies the creation of a valid autounattend.xml file. That concludes the part about modifying the Master Image using autounattend.xml. A valid and well-structured autounattend.xml lays the foundation for successfully deploying a Windows-based Master Image. Modifying the Master Image using AnsibleAnsible is an open-source automation tool used primarily for: Configuration management Application deployment Task automation IT orchestration Ansible describes automation jobs using YAML (in the form of Ansible Playbooks), a simple, human-readable language. It connects to your nodes (Servers, Devices, etc.) over SSH (or WinRM for Windows) and doesn’t require Agent software installed on the target machines. Important: The Ansible Playbooks depend entirely on the correct syntax and structure of the corresponding YAML file. Please be aware that writing YAML using the correct structure and syntax is crucial, as an erroneous Playbook can break the deployment of the Windows Master Image. Some benefits of using Ansible Playbooks for modifying the Windows Master Image, especially when you're aiming for consistency, scalability, and automation in your infrastructure, are: Consistency and Repeatability: Ansible Playbooks ensure that every Master Image is built the same way, every time. Reduces human error and configuration drift. Modular and Reusable: Ansible roles and tasks can be reused across different images or environments. Makes it easy to maintain and update configurations. Testable and Version-Controlled: Ansible Playbooks can be stored in Git, enabling version control, collaboration, and code reviews. You can test changes in a staging environment before applying them to production images. Agentless and Cross-Platform: No need to install agents on the Image. Works across Linux, Windows, and Cloud platforms (AWS, Azure, GCP, etc.). Using Ansible to modify your Windows Master Images is a powerful way to ensure consistency and repeatability in your infrastructure. Note: You can reuse or modify working Ansible Playbooks again if you need different Ansible Playbooks . Therefore, we also created a web-based application with a graphical interface to configure and structure the corresponding Ansible Playbooks . As you can see from this example screenshot of the application, you can choose different System settings and Software Packages - Ansible will install and configure all your desired items. Therefore, the application and its framework directly edit the underlying Ansible Playbooks and Configuration files. Example of an Ansible Playbook showcasing the flexibility – the Web application lets you choose an existing Ansible Playbook and modifies it automatically according to your desired settings (shortened due to the original length of the code/decision logic) : --- # Install WWCO Golden Master # Version 100625v2GK # Windows 11 23H2 - name: Install WWCO Master Image 100625v2GK hosts: all gather_facts: true vars: vm_join_domain: true vm_enable_rdp: true vm_install_windows_updates: false vm_join_domain_config: "wwco.net.json" vm_optimize_image: true vm_install_vda: true vm_install_vda_mcsio: false vm_install_vda_firewall: false vm_install_vda_rtt: false vm_install_vda_pm: false vm_install_vda_pm_wmi: true vm_install_vda_upgr: true vm_install_wem: false vm_install_pvs: false vm_install_uber: false vm_install_wapp: false vm_install_o365: true vm_install_python: false vm_install_ps7: false vm_install_crm: false vm_install_chrome: true vm_install_firefox: true vm_install_slack: false roles: - role: join_domain when: vm_join_domain == true - role: enable_rdp when: vm_enable_rdp == true - role: install_vda_std when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_mcsio when: vm_install_vda == true and vm_install_vda_mcsio == true and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_fw when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == true and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_rtt when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == true and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false - role: install_vda_std_pm when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == true and vm_install_vda_upgr == false - role: install_vda_std_pm_wmi when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm_wmi == true and vm_install_vda_upgr == false - role: install_vda_std_upgr when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == true and vm_install_vda_upgr == true ... - role: install_wem when: vm_install_wem == true - role: install_pvs when: vm_install_pvs == true - role: install_uber when: vm_install_uber == true - role: install_wapp when: vm_install_wapp == true - role: install_o365 when: vm_install_o365 == true - role: install_python when: vm_install_python == true - role: install_ps7 when: vm_install_ps7 == true - role: install_crm when: vm_install_crm == true - role: install_chrome when: vm_install_chrome == true - role: install_firefox when: vm_install_firefox == true - role: install_slack when: vm_install_slack == true - role: install_windows_updates when: vm_install_windows_updates == true - role: optimize_image when: vm_optimize_image == true ...Important: The vars: part is the most essential part, as the variables decide whether a specific package or configuration will be deployed. For example, checking “Install VDA” sets the corresponding variable to true. vm_install_vda: trueAnsible will now run the corresponding role install_vda_std: - role: install_vda_std when: vm_install_vda == true and vm_install_vda_mcsio == false and vm_install_vda_firewall == false and vm_install_vda_rtt == false and vm_install_vda_pm == false and vm_install_vda_pm_wmi == false and vm_install_vda_upgr == false The Ansible roles contain all needed Tasks for deploying the corresponding functionality – for example, these are the Tasks for the Ansible role “Join-Domain”: --- # Ansible Role Join-Domain ## Generic Tasks file for Join-Domain Role - name: Create the DNS Server List ansible.builtin.set_fact: dns_servers_list: "{{ dns_servers | split(',') }}" when: dns_servers is search(",") - name: Set DNS to DCs ansible.windows.win_dns_client: adapter_names: "*" dns_servers: "{{ dns_servers_list }}" when: dns_servers and dns_servers is search(",") - name: Change Computer Name ansible.windows.win_hostname: name: "{{ vm_hostname }}" register: hostname_state - name: Reboot after Computer Name was changed ansible.windows.win_reboot: post_reboot_delay: 30 when: hostname_state.reboot_required - name: Join to Domain - Variables are set by PACKERGEN-Tool according to chosen Domain-Join configuration microsoft.ad.membership: dns_domain_name: "{{ dns_domain_name }}" domain_admin_user: "{{ domain_join_user }}" domain_admin_password: "{{ domain_join_pw }}" domain_ou_path: "{{ domain_join_ou_path }}" hostname: "{{ vm_hostname }}" state: domain ignore_unreachable: true register: domain_state - name: Reboot after Domain Join ansible.windows.win_reboot: ... Most of the Ansible Tasks are built on Variables modified and read by the Web application. The Domain configuration is stored as a JSON-based file on an Azure Vault and loaded by the Web application. { "dns_domain_name":"WWCO.NET", "domain_admin_user":"XxXxXxX@wwco.net", "domain_admin_password":"SWFtU29ycnlCdXRUaGF0SXNPZkNvdXJzZU5vdFRoZVJpZ2h0UGFzc3dvcmQ=", "domain_ou_path":"OU=VDA,OU=XxXxXxXxX,OU=XxXxXxXxX,OU=XxXxXxXxX,OU=XxXxXxXxX,DC=wwco,DC=net", "hostname": "GENMI100625V2", "dns1":"10.53.XXX.XXX", "dns2":"10.53.XXX.XXX", "state": "domain" }It is written in the corresponding Ansible YAML file: --- # Variable files for Domain-Join Role ## DNS dns_servers: "10.53.XXX.XXX,10.53.XXX.XXX" dns_domain_name: "WWCO.NET" # Domain domain_join_user: "XxXxXxX@wwco.net" domain_join_pw: "SWFtU29ycnlCdXRUaGF0SXNPZkNvdXJzZU5vdFRoZVJpZ2h0UGFzc3dvcmQ=" domain_join_ou_path: "OU=VDA,OU=XxXxXxXxX,OU=XxXxXxXxX,OU=XxXxXxXxX,OU=XxXxXxXxX,DC=wwco,DC=net" vm_hostname: "GENMI100625V2"That concludes the Ansible section on modifying the Master Image – the possibilities are endless if Ansible is part of the Master Image Creation. Example Workflow for Packer creating a Master Image on AzureThe workflow below is an example of automating the creation of a Windows Server 2025-based Master Image using all parts mentioned in this guide. As the environment is fully automated, we use Terraform to create all necessary Azure prerequisites. Terraform output for creation of the needed prerequisites: azadmin@tacg-cicd:~$ terraform init Initializing the backend... Initializing provider plugins... - Finding hashicorp/azurerm versions matching "4.6.0"... - Installing hashicorp/azurerm v4.6.0... - Installed hashicorp/azurerm v4.6.0 (signed by HashiCorp) Terraform has created a lock file .terraform.lock.hcl to record the provider selections it made above. Include this file in your version control repository so that Terraform can guarantee to make the same selections by default when you run "terraform init" in the future. Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary. azadmin@tacg-cicd:~$ terraform plan Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # azurerm_resource_group.WWCONET-TF-PCKR-RG will be created + resource "azurerm_resource_group" "WWCONET-TF-PCKR-RG" { + id = (known after apply) + location = "westeurope" + name = "PACKR_WEUR" + tags = { + "Environment" = "WWCONET_TMM" + "Tech" = "WWCONET_TMM_Tech" } } # azurerm_shared_image.WWCONET-TF-PCKR-SIG-IDW11M will be created + resource "azurerm_shared_image" "WWCONET-TF-PCKR-SIG-IDW11M" { + accelerated_network_support_enabled = true + architecture = "x64" + gallery_name = "PACKR_SIG" + hibernation_enabled = true + hyper_v_generation = "V2" + id = (known after apply) + location = "westeurope" + name = "PACKR_W2K25_MI" + os_type = "Windows" + resource_group_name = "PACKR_WEUR" + tags = { + "Environment" = "WWCONET_TMM" + "Tech" = "WWCONET_TMM_Tech" } + identifier { + offer = "windowsserver" + publisher = "microsoftwindowsserver" + sku = "2025-datacenter-azure-edition" } } # azurerm_shared_image_gallery.WWCONET-TF-PCKR-SIG will be created + resource "azurerm_shared_image_gallery" "WWCONET-TF-PCKR-SIG" { + description = "Shared Image Gallery for Packer Demo" + id = (known after apply) + location = "westeurope" + name = "PACKR_SIG" + resource_group_name = "PACKR_WEUR" + tags = { + "Environment" = "WWCONET_TMM" + "Tech" = "WWCONET_TMM_Tech" } + unique_name = (known after apply) } # azurerm_storage_account.WWCONET-TF-PCKR-STAC will be created + resource "azurerm_storage_account" "WWCONET-TF-PCKR-STAC" { + access_tier = (known after apply) + account_kind = "StorageV2" + account_replication_type = "LRS" ... + sftp_enabled = false + shared_access_key_enabled = true + table_encryption_key_type = "Service" + blob_properties (known after apply) + network_rules (known after apply) + queue_properties (known after apply) + routing (known after apply) + share_properties (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now. azadmin@tacg-cicd:~$ terraform apply Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # azurerm_resource_group.WWCONET-TF-PCKR-RG will be created + resource "azurerm_resource_group" "WWCONET-TF-PCKR-RG" { + id = (known after apply) + location = "westeurope" + name = "PACKR_WEUR" + tags = { + "Environment" = "WWCONET_TMM" + "Tech" = "WWCONET_TMM_Tech" } } # azurerm_shared_image.WWCONET-TF-PCKR-SIG-IDW11M will be created + resource "azurerm_shared_image" "WWCONET-TF-PCKR-SIG-IDW11M" { + accelerated_network_support_enabled = true + architecture = "x64" + gallery_name = "PACKR_SIG" + hibernation_enabled = true + hyper_v_generation = "V2" + id = (known after apply) + location = "westeurope" + name = "PACKR_W2K25_MI" + os_type = "Windows" + resource_group_name = "PACKR_WEUR" + tags = { + "Environment" = "WWCONET_TMM" + "Tech" = "WWCONET_TMM_Tech" } + identifier { + offer = "windowsserver" + publisher = "microsoftwindowsserver" + sku = "2025-datacenter-azure-edition" } } # azurerm_shared_image_gallery.WWCONET-TF-PCKR-SIG will be created + resource "azurerm_shared_image_gallery" "WWCONET-TF-PCKR-SIG" { + description = "Shared Image Gallery for Packer Demo" + id = (known after apply) + location = "westeurope" + name = "PACKR_SIG" + resource_group_name = "PACKR_WEUR" + tags = { + "Environment" = "WWCONET_TMM" + "Tech" = "WWCONET_TMM_Tech" } + unique_name = (known after apply) } # azurerm_storage_account.WWCONET-TF-PCKR-STAC will be created + resource "azurerm_storage_account" "WWCONET-TF-PCKR-STAC" { + access_tier = (known after apply) + account_kind = "StorageV2" + account_replication_type = "LRS" ... + sftp_enabled = false + shared_access_key_enabled = true + table_encryption_key_type = "Service" + blob_properties (known after apply) + network_rules (known after apply) + queue_properties (known after apply) + routing (known after apply) + share_properties (known after apply) } Plan: 4 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes azurerm_resource_group.WWCONET-TF-PCKR-RG: Creating... azurerm_resource_group.WWCONET-TF-PCKR-RG: Still creating... [00m10s elapsed] azurerm_resource_group.WWCONET-TF-PCKR-RG: Creation complete after 11s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR] azurerm_shared_image_gallery.WWCONET-TF-PCKR-SIG: Creating... azurerm_storage_account.WWCONET-TF-PCKR-STAC: Creating... azurerm_shared_image_gallery.WWCONET-TF-PCKR-SIG: Still creating... [00m10s elapsed] azurerm_storage_account.WWCONET-TF-PCKR-STAC: Still creating... [00m10s elapsed] azurerm_shared_image_gallery.WWCONET-TF-PCKR-SIG: Creation complete after 13s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR/providers/Microsoft.Compute/galleries/PACKR_SIG] azurerm_shared_image.WWCONET-TF-PCKR-SIG-IDW11M: Creating... azurerm_storage_account.WWCONET-TF-PCKR-STAC: Still creating... [00m20s elapsed] azurerm_shared_image.WWCONET-TF-PCKR-SIG-IDW11M: Still creating... [00m10s elapsed] azurerm_shared_image.WWCONET-TF-PCKR-SIG-IDW11M: Creation complete after 12s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR/providers/Microsoft.Compute/galleries/PACKR_SIG/images/PACKR_W2K25_MI] azurerm_storage_account.WWCONET-TF-PCKR-STAC: Still creating... [00m30s elapsed] azurerm_storage_account.WWCONET-TF-PCKR-STAC: Still creating... [00m40s elapsed] azurerm_storage_account.WWCONET-TF-PCKR-STAC: Still creating... [00m50s elapsed] azurerm_storage_account.WWCONET-TF-PCKR-STAC: Still creating... [01m00s elapsed] azurerm_storage_account.WWCONET-TF-PCKR-STAC: Creation complete after 1m6s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR/providers/Microsoft.Storage/storageAccounts/wwcoXxXxXxXxX] Apply complete! Resources: 4 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:~$All necessary prerequisites were successfully created. Important: Please ensure that you upload all necessary scripts, Software components, etc., to the newly created Azure Storage Vault. You can also leverage Terraform or the Azure Storage Explorer. Example using Terraform (output shortened due to length): azadmin@tacg-cicd:~$ terraform apply data.azurerm_resource_group.WWCONET-TF-PCKR-RG: Reading... data.azurerm_resource_group.WWCONET-TF-PCKR-RG: Read complete after 1s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR] data.azurerm_storage_account.WWCONET-TF-PCKR-STAC: Reading... data.azurerm_storage_account.WWCONET-TF-PCKR-STAC: Read complete after 1s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR/providers/Microsoft.Storage/storageAccounts/wwcoXxXxXxXxX] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: ... # azurerm_storage_blob.VDASRV will be created + resource "azurerm_storage_blob" "VDASRV" { + access_tier = (known after apply) + content_type = "application/octet-stream" + id = (known after apply) + metadata = (known after apply) + name = "VDAServerSetup_2503.exe" + parallelism = 8 + size = 0 + source = "SRC/VDAServerSetup_2503.exe" + storage_account_name = "wwcoXxXxXxXxX" + storage_container_name = "packer" + type = "Block" + url = (known after apply) } # azurerm_storage_blob.VDAWK will be created + resource "azurerm_storage_blob" "VDAWK" { + access_tier = (known after apply) + content_type = "application/octet-stream" + id = (known after apply) + metadata = (known after apply) + name = "VDAWorkstationSetup_2503.exe" + parallelism = 8 + size = 0 + source = "SRC/VDAWorkstationSetup_2503.exe" + storage_account_name = "wwcoXxXxXxXxX" + storage_container_name = "packer" + type = "Block" + url = (known after apply) } ... # azurerm_storage_blob.WAPP will be created + resource "azurerm_storage_blob" "WAPP" { + access_tier = (known after apply) + content_type = "application/octet-stream" + id = (known after apply) + metadata = (known after apply) + name = "CitrixWorkspaceApp2503.exe" + parallelism = 8 + size = 0 + source = "SRC/CitrixWorkspaceApp2503.exe" + storage_account_name = "wwcoXxXxXxXxX" + storage_container_name = "packer" + type = "Block" + url = (known after apply) } # azurerm_storage_container.WWCONET-TF-PCKR-STAC-STCO will be created + resource "azurerm_storage_container" "WWCONET-TF-PCKR-STAC-STCO" { + container_access_type = "private" + default_encryption_scope = (known after apply) + encryption_scope_override_enabled = true + has_immutability_policy = (known after apply) + has_legal_hold = (known after apply) + id = (known after apply) + metadata = (known after apply) + name = "packer" + resource_manager_id = (known after apply) + storage_account_id = "/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR/providers/Microsoft.Storage/storageAccounts/wwcoXxXxXxXxX" } Plan: 29 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes azurerm_storage_container.WWCONET-TF-PCKR-STAC-STCO: Creating... azurerm_storage_container.WWCONET-TF-PCKR-STAC-STCO: Creation complete after 2s [id=/subscriptions/dd5bXXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13/resourceGroups/PACKR_WEUR/providers/Microsoft.Storage/storageAccounts/wwcoXxXxXxXxX/blobServices/default/containers/packer] azurerm_storage_blob.WAPP: Creating... azurerm_storage_blob.VDAWK: Creating... ... azurerm_storage_blob.VDASRV: Creating... ... azurerm_storage_blob.WAPP: Still creating... [00m10s elapsed] azurerm_storage_blob.VDASRV: Still creating... [00m10s elapsed] ... azurerm_storage_blob.VDAWK: Still creating... [00m10s elapsed] azurerm_storage_blob.VDASRV: Still creating... [00m10s elapsed] ... azurerm_storage_blob.WAPP: Creation complete after 2m41s [id=https://wwcoXxXxXxXxX.blob.core.windows.net/packer/CitrixWorkspaceApp2503.exe] ... azurerm_storage_blob.VDAWK: Creation complete after 7m13s [id=https://wwcoXxXxXxXxX.blob.core.windows.net/packer/VDAWorkstationSetup_2503.exe] ... azurerm_storage_blob.VDASRV: Creation complete after 8m8s [id=https://wwcoXxXxXxXxX.blob.core.windows.net/packer/VDAServerSetup_2503.exe] ... Apply complete! Resources: 29 added, 0 changed, 0 destroyed. azadmin@tacg-cicd:~$ Now that all prerequisites are complete, the building process using Packer can be initiated. Example: Creating a Windows Server 2025 Master Image on Azure using an existing custom Base ImageIn this example, we use Packer and Ansible to create a tailored Master Image on Azure. We defined the Software packages and needed configurations in Ansible using the Web application. Packer will create the Master Image on Azure based on a custom Base Image and then use Ansible for further configuration and Software deployment. Note: In this example, we use an Ansible playbook to install the Citrix Virtual Delivery Agent (VDA) on the Master Image. Later in this guide, we will explore an alternative method for deploying the VDA if Ansible is not an option. Important: Please ensure that you upload all necessary scripts, Software components, etc., to the Azure Storage Vault created above. You can also leverage Terraform or the Azure Storage Explorer as mentioned above. After completion, the Master Image will be put into the Shared Image Gallery. Example Packer HCL code: # Packer File for Creation of a Windows Server 2025-based Master Image based on an existing custom Base Image using Packer and Ansible ## Version 06.2025 ### Modified by PACKERGEN packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = ">= 2.3.3" } ansible = { source = "github.com/hashicorp/ansible" version = ">= 1.1.3" } } } source "azure-arm" "windows" { async_resourcegroup_delete = true client_id = var.client_id client_secret = var.client_secret communicator = "winrm" location = var.location build_resource_group_name = var.build_resource_group_name # Security settings security_type = var.security_type vtpm_enabled = var.vtpm secure_boot_enabled = var.secure_boot # Temp Image Storage Type managed_image_storage_account_type = var.managed_image_storage_account_type os_type = var.os_type shared_image_gallery { subscription = var.subscription_id resource_group = var.resource_group_name gallery_name = var.shared_gallery_name image_name = var.image_name image_version = var.image_version } shared_image_gallery_destination { gallery_name = var.shared_gallery_name image_name = var.dest_image_name image_version = var.dest_image_version replication_regions = ["${var.image_replication_regions}"] resource_group = var.resource_group_name storage_account_type = var.sig_storage_type } azure_tags = { build_number = var.build_number build_id = var.build_id } private_virtual_network_with_public_ip = "false" subscription_id = var.subscription_id tenant_id = var.tenant_id vm_size = var.vm_size virtual_network_name = var.virtual_network_name virtual_network_resource_group_name = var.virtual_network_resource_group_name virtual_network_subnet_name = var.virtual_network_subnet_name winrm_insecure = "true" winrm_timeout = var.winrm_timeout winrm_use_ssl = "true" winrm_username = var.winrm_username } build { name = "WWCOW2K25MIFromARMTemplate" sources = ["source.azure-arm.windows"] # Enable WinRM provisioner "powershell" { script = "/scripts/enable-winrm.ps1" } # Provisioning of Configuration and Packages using Ansible ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_generic}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_CTX}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } provisioner "powershell" { script = "/scripts/sysprep.ps1" } post-processor "manifest" { output = "manifest.json" strip_path = true custom_data = { source_image_name = "${build.SourceImageName}" tenant_id = "${build.TenantID}" subscription_id = "${build.SubscriptionID}" temp_deployment_name = "${build.TempDeploymentName}" temp_compute_name = "${build.TempComputeName}" temp_nic_name = "${build.TempNicName}" temp_os_disk_name = "${build.TempOSDiskName}" temp_data_disk_name = "${build.TempDataDiskName}" temp_resource_group_name = "${build.TempResourceGroupName}" temp_nsg_name = "${build.TempNsgName}" temp_key_vault_name = "${build.TempKeyVaultName}" temp_subnet_name = "${build.TempSubnetName}" temp_virtual_network_name = "${build.TempVirtualNetworkName}" temp_public_ip_address_name = "${build.TempPublicIPAddressName}" } } } ...Important: Please do not forget to follow the correct sequence of the packer commands – e.g.: packer init -upgrade WWCO-W2K25ARMWithAnsible.pkr.hcl packer validate -var-file=WWCO-W2K25ARMWithAnsible.variables.pkr.hcl WWCO-W2K25ARMWithAnsible.pkr.hcl packer build -on-error=abort -force -var-file=WWCO-W2K25ARMWithAnsible.variables.pkr.hcl WWCO-W2K25ARMWithAnsible.pkr.hcl Example: Creating a Windows Server 2025 Master Image on vSphereIn this example, we use Packer and Ansible to create a customized Master Image on vSphere. We defined the Software packages and needed configurations in Ansible using the Web application. Note: In this example, we use an Ansible Playbook to install the Citrix Virtual Delivery Agent (VDA) on the Master Image. Later in this guide, we will explore an alternative method for deploying the VDA if Ansible is not an option. Important: Please ensure that you upload all necessary scripts, Software components, etc., to the Azure Storage Vault created above. You can also leverage Terraform or the Azure Storage Explorer as mentioned above. Packer will create the Master Image on Azure based on an official Windows Server 2025 ISO file and then use Ansible for further configuration and Software deployment. Example Packer HCL code: # Packer File for Creation of a Windows Server 2025-based Master Image based on an official Windows-ISO file using Packer and Ansible ## Version 06.2025 ### Modified by PACKERGEN packer { required_plugins { azure = { source = "github.com/hashicorp/vsphere" version = ">= 1.4.2" } ansible = { source = "github.com/hashicorp/ansible" version = ">= 1.1.3" } windows-update = { version = ">= 0.16.8" source = "github.com/rgl/windows-update" } } } source "vsphere-iso" "windows" { vcenter_server = var.vcenter_server username = var.vcenter_username password = var.vcenter_password insecure_connection = true cluster = var.vsphere_cluster host = var.vsphere_host datacenter = var.vsphere_datacenter datastore = var.vsphere_datastore folder = var.vsphere_folder vm_name = var.vm_name notes = "Created by Packer and PACKERGEN." guest_os_type = "windows9Server64Guest" firmware = var.firmware vTPM = var.vtpm CPUs = var.cpu cpu_cores = var.cpu RAM = var.memory RAM_reserve_all = true remove_cdrom = true cdrom_type = "sata" vm_version = var.vm_version iso_paths = [ "${var.os_iso_path}" ] cd_files = [ "/autounattend/Autounattend.xml", "/scripts/enable-winrm.ps1", "/scripts/install-vmwaretools.ps1", "/drivers/" ] disk_controller_type = ["pvscsi"] storage { disk_size = var.disksize disk_thin_provisioned = true } network_adapters { network = var.vsphere_network network_card = "vmxnet3" } boot_order = "disk,cdrom" boot_command = [ "<spacebar><wait2><spacebar>" ] boot_wait = "1s" communicator = "winrm" winrm_insecure = true winrm_password = var.connection_password winrm_timeout = "20m" winrm_use_ssl = true winrm_username = var.connection_username } build { name = "WWCOW2K25MIFromISOvSphere" source "vsphere-iso.windows" { convert_to_template = false create_snapshot = var.create_snapshot snapshot_name = "Created by Packer and PACKERGEN" } # Provisioning of Configuration and Packages using Ansible ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_generic}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } ## Modified by PACKERGEN provisioner "ansible" { playbook_file = "${var.ansible_playbook_CTX}" user = "packer" use_proxy = false extra_arguments = [ "--extra-vars", "@${var.ansible_config}", "-e", "ansible_winrm_server_cert_validation=ignore", "-e", "vm_hostname=${var.vm_name}", "${var.ansible_debug}" ] } post-processor "manifest" { output = "manifest.json" strip_path = true custom_data = { source_image_name = "${build.SourceImageName}" tenant_id = "${build.TenantID}" subscription_id = "${build.SubscriptionID}" temp_deployment_name = "${build.TempDeploymentName}" temp_compute_name = "${build.TempComputeName}" temp_nic_name = "${build.TempNicName}" temp_os_disk_name = "${build.TempOSDiskName}" temp_data_disk_name = "${build.TempDataDiskName}" temp_resource_group_name = "${build.TempResourceGroupName}" temp_nsg_name = "${build.TempNsgName}" temp_key_vault_name = "${build.TempKeyVaultName}" temp_subnet_name = "${build.TempSubnetName}" temp_virtual_network_name = "${build.TempVirtualNetworkName}" temp_public_ip_address_name = "${build.TempPublicIPAddressName}" } } } Example: Packer Image Management Module for Citrix® Virtual Apps and DesktopsAs mentioned above, there are different ways to deploy the Citrix® Virtual Delivery Agent (VDA) on the Master Image: using the autounattend.xml file, a Packer Provisioner, or Ansible. The VDA is a crucial component for a successful Citrix infrastructure. The Packer Image Management Module for Citrix® Virtual Apps and Desktops aims to streamline image management by creating a custom Golden Image with the VDA. It runs the Citrix® Optimizer to improve image efficiency by removing unnecessary bloatware, resulting in optimized performance and resource utilization. A single command can deploy an Image by creating it using Packer. Note: Please note that this module is still in Tech Preview. You can find the actual version here: https://github.com/citrix/citrix-packer-tools Important: Please ensure that you upload all necessary scripts, Software components, etc., to the Azure Storage Vault created above. You can also leverage Terraform or the Azure Storage Explorer as mentioned above. Example HCL code for creating a Windows 11-based Image: packer { required_plugins { azure = { source = "github.com/hashicorp/azure" version = "~> 1" } } } variable "client_id" { type = string default = "ff1bXXXX-XXXX-XXXX-XXXX-XXXXXXXX53b6" } variable "client_object_id" { type = string default = "69bdXXXX-XXXX-XXXX-XXXX-XXXXXXXX4244" } variable "client_secret" { type = string default = "XxXxXxXxXxXxXxXxX" } variable "client_subscription_id" { type = string default = "de13XXXX-XXXX-XXXX-XXXX-XXXXXXXX9e13" } variable "client_tenant_id" { type = string default = "1974XXXX-XXXX-XXXX-XXXX-XXXXXXXX474b" } variable "image_name" { type = string default = "win_office_11_22h2" } variable "image_resource_group" { type = string default = "TMM-XxXxXxXxX-WEUR" } variable "install_browser_chrome_flag" { type = string default = "true" } variable "install_browser_firefox_flag" { type = string default = "true" } variable "location_setup" { type = string default = "c:\\setup" } variable "optimizer_location" { type = string default = "https://XxXxXxX.blob.core.windows.net/packer/VDAWorkstationSetup_2503.exe" } variable "optimizer_template" { type = string default = "Citrix_Windows_11_2009.xml" } variable "script_cleanup" { type = string default = "run-cleanup.ps1" } variable "script_installchrome" { type = string default = "install-browser-chrome.ps1" } variable "script_installfirefox" { type = string default = "install-browser-firefox.ps1" } variable "script_installvda" { type = string default = "install-vda.ps1" } variable "script_optimizer" { type = string default = "run-optimizer.ps1" } variable "username" { type = string default = "XxXxXxXxXxXxXxXxX" } variable "userpass" { type = string default = "XxXxXxXxXxXxXxXxX" } variable "vda_location" { type = string default = "https://XxXxXxX.blob.core.windows.net/packer/CitrixOptimizerTool.zip" } variable "winrm_insecure" { type = string default = "true" } # The "legacy_isotime" function has been provided for backwards compatability, but we recommend switching to the timestamp and formatdate functions. source "azure-arm" "autogenerated_1" { azure_tags = { Image = "Packer Generated" } client_id = "${var.client_id}" client_secret = "${var.client_secret}" communicator = "winrm" image_offer = "office-365" image_publisher = "MicrosoftWindowsDesktop" image_sku = "WIN11-22H2-AVD-M365" image_version = "latest" location = "East US" managed_image_name = "${var.image_name}_${legacy_isotime("200601020304")}" managed_image_os_disk_snapshot_name = "${var.image_name}_${legacy_isotime("200601020304")}" managed_image_resource_group_name = "${var.image_resource_group}" object_id = "${var.client_object_id}" os_type = "Windows" subscription_id = "${var.client_subscription_id}" tenant_id = "${var.client_tenant_id}" vm_size = "Standard_D2s_v3" winrm_insecure = "${var.winrm_insecure}" winrm_password = "${var.userpass}" winrm_timeout = "20m" winrm_use_ssl = false winrm_username = "${var.username}" } build { sources = ["source.azure-arm.autogenerated_1"] ... provisioner "powershell" { inline = ["New-Item -Path ${var.location_setup} -ItemType \"directory\" | Out-Null"] } provisioner "file" { destination = "${var.location_setup}\\${var.script_installvda}" source = ".\\scripts\\${var.script_installvda}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_optimizer}" source = ".\\scripts\\${var.script_optimizer}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_installchrome}" source = ".\\scripts\\${var.script_installchrome}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_installfirefox}" source = ".\\scripts\\${var.script_installfirefox}" } provisioner "file" { destination = "${var.location_setup}\\${var.script_cleanup}" source = ".\\scripts\\${var.script_cleanup}" } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "windows-restart" { restart_check_command = "powershell -command \"& {Write-Host 'Script: computer restarted.'}\"" restart_timeout = "30m" } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installvda} -VdaSetupDownloadUri ${var.vda_location}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_optimizer} -OptimizerDownloadUri ${var.optimizer_location} -Template ${var.optimizer_template}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installchrome} -InstallSoftware ${var.install_browser_chrome_flag}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_installfirefox} -InstallSoftware ${var.install_browser_firefox_flag}"] } provisioner "powershell" { inline = ["${var.location_setup}\\${var.script_cleanup} -Username ${var.username} -LocationPath ${var.location_setup}"] } ... }Our Packer Image Management Module is a prime example of a comprehensive, purpose-built set of HCL commands for deploying a Master Image using Packer. ConclusionIn today's fast-paced DevOps landscape, automating infrastructure and application deployment is essential for efficiency and scalability. Image creation with Ansible and Packer provides a powerful, flexible, and repeatable approach to building standardized images across various platforms. Here's why this combination is the best: Consistency Across Environments: Using Packer with Ansible, you can define a single source of truth for your infrastructure. The exact configuration can be applied to different environments, ensuring that your development, testing, and production systems are identical. This reduces discrepancies and environment-specific bugs, providing more reliable deployments. Automation and Efficiency: Packer automates the process of building machine images, and when combined with Ansible’s powerful configuration management capabilities, the entire pipeline becomes seamless. This results in faster provisioning, less manual intervention, and reduced human error, a key benefit for teams aiming to speed up delivery cycles. Reusability and Modularity: Ansible’s playbooks are reusable and modular, allowing you to create images that are easily adjusted to suit different applications or environments. With Packer, you can create reusable templates for multiple platforms (AWS, Azure, GCP, VMware, etc.), ensuring a wide range of use cases are covered with minimal changes to your configuration. Scalability: As organizations grow, so do their infrastructure needs. The combination of Ansible and Packer scales well, enabling you to create images for thousands of virtual machines or instances across a range of platforms without manually configuring each one. This scalability is a key advantage for larger enterprises or cloud-native applications. Cost-Effective: Automating image creation reduces the overhead of manual configuration, testing, and re-deployment. With more predictable and stable environments, you can minimize downtime and reduce operational costs. Additionally, since Packer allows you to build and manage images for multiple providers, it can help you choose the most cost-efficient infrastructure options. Version Control and Auditing: Packer and Ansible encourage best practices around infrastructure as code (IaC). Integrating these tools into your CI/CD pipeline allows you to version control your image templates and configurations, making it easier to audit, roll back, and trace changes over time. This leads to more transparent, accountable, and manageable operations. Using Ansible and Packer together for image creation combines the best of both worlds—Packer’s ability to build and version machine images across multiple platforms, and Ansible’s power for configuration management. The result is an automated, scalable, and consistent process that enhances operational efficiency, fosters collaboration, mitigates risk, and ultimately ensures a smoother journey toward reliable and repeatable infrastructure. This approach is the best for teams seeking to streamline their workflows, enhance consistency, and maintain control over their environments. Our following guides will discuss implementing the automated Image Creation in CI/CD-based deployments using Jenkins and Azure Pipelines. AcknowledgementsThank you to my colleagues Rody Kossen and Alan Goldman for providing valuable information and granting me access to their repositories. DisclaimerDisclaimer: EXCEPT WHERE EXPRESSLY PROVIDED OTHERWISE BY CLOUD SOFTWARE GROUP, THE CONTENT IN THIS DOCUMENT IS PROVIDED “AS IS” AND CLOUD SOFTWARE GROUP HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED REPRESENTATIONS, WARRANTIES, GUARANTIES, AND CONDITIONS, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. CLOUD SOFTWARE GROUP MAKES NO REPRESENTATIONS, WARRANTIES, GUARANTIES, OR CONDITIONS AS TO THE QUALITY, SUITABILITY, TRUTH, ACCURACY, OR COMPLETENESS OF ANY OF THE CONTENT CONTAINED ON THE WEBSITE. The above disclaimer applies to any damages, liability, or injuries caused by any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communication line failure, theft or destruction of or unauthorized access to, alteration of, or use, whether for breach of contract, tort, negligence or any other cause of action. </article> <article> <h1>Deploying Citrix Secure Developer Spaces on OpenShift</h1> <p>Tue, 10 Jun 2025 09:04:00 +0000</p> OverviewThis guide explains in detail how to deploy Citrix Secure Developer Spaces, formerly known as Strong Network proof of concept platform, to an existing OpenShift cluster. General prerequisitesContainer registry to which you have push permissions An up-and-running OpenShift cluster Basic tools for working with that OpenShift cluster: oc and kubectl You should already be authenticated in both oc and kubectl with your OpenShift cluster. Deployment stepsObtain a Citrix Secure Developer Spaces platform licenseYou need a valid license to use the Citrix Secure Developer Spaces platform. Please contact your ATS or Solution Architect to request that one be issued to you. To issue a license, we only need to know which URL will be used to access the Citrix Secure Developer Spaces platform. In case of OpenShift, we need to find out the cluster domain first, which we can easily do in two ways: From the web console URL: The cluster domain is part of the OpenShift web console address. If you access the console at https://console-OpenShift-console.apps.cluster.example.com, then your cluster domain is apps.cluster.example.com Using the OpenShift CLI (oc): oc get ingresses.config/cluster -o jsonpath='{.spec.domain}' You will get an output like: apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io Once you have the cluster domain, the final Citrix Secure Developer Spaces platform domain will be in the form of: sn.<cluster-domain> In our case, it will look like the following: sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io Now that we have the domain, we will register it with the Citrix Secure Developer Spaces License server. Check the Wildcard policy of your OpenShift clusterTo be able to create and use workspaces on the Citrix Secure Developer Spaces platform, which have dynamic routes, you need to make sure that the wildcard policy of your OpenShift cluster routing is set to WildcardsAllowed. To do that, you can follow these steps: Find out the name of your ingress controller by running: oc get ingresscontroller -n OpenShift-ingress-operator -o jsonpath='{.items[*].metadata.name}' If you made a default installation of an OpenShift cluster and haven’t changed any of the settings, the name will most likely be default. Check if your ingress controller has a WildcardsAllowed policy already set, using the name of the controller obtained from the previous step. In our case, it is default, so the command looks like: oc get ingresscontroller default -n OpenShift-ingress-operator -o jsonpath='{.spec.routeAdmission.wildcardPolicy}' If the output is WildcardsAllowed, then everything is set, and you can go to the next step of the guide. If the output is empty, it means we need to set the policy manually. This can be done by editing the configuration of that particular ingress controller (named default) by executing: oc patch ingresscontroller default -n OpenShift-ingress-operator --type=merge -p '{"spec":{"routeAdmission":{"wildcardPolicy":"WildcardsAllowed"}}}' You can now check that the previous command was successful by executing: oc get ingresscontroller default -n OpenShift-ingress-operator -o jsonpath='{.spec.routeAdmission.wildcardPolicy}' and getting WildcardsAllowed as a response. If you want to see the complete ingress controller configuration, you can execute: oc get ingresscontroller default -n OpenShift-ingress-operator -o yaml More info on the subject of Ingress controllers and wildcard policies in particular can be found at: https://docs.redhat.com/en/documentation/OpenShift_container_platform/4.18/html/operator_apis/ingresscontroller-operator-OpenShift-io-v1#spec-routeadmission Create a Kubernetes namespace for your deploymentSelect the name of the namespace that you want to use for Citrix Secure Developer Spaces deployment. It is advised not to reuse existing namespaces for deploying our platform. For this guide, we will use the name Strong Network. First, you need to check if that namespace already exists by running: kubectl get namespaces | grep strong-network If it does not exist, you can create it by running: kubectl create namespace strong-network Run the Citrix Secure Developer Spaces installerYou can start the installation process by running the following command from the console of your device: docker run -it --rm -v ${PWD}:/strong-network/shared strongnetwork/strong_installer:2025.5.2 After this is executed and the installer image is pulled and run, you can run the installer. The installer will create a configuration file that should be used to upgrade the product in the future. It will also download the Helm chart to the shared host directory and push Citrix Secure Developer Spaces images to your (client’s) container registry. Since we provide a large number of pre-built workspace images by default, which occupy a significant amount of space, you can reduce the number of images that we pull or push by editing the list of workspace images that we will pull or push, or by not downloading them at all. This could also be useful if you (the client) plan to use your workspace images, so you do not need Citrix Secure Developer Spaces' prebuilt ones. In case you need only specific workspace images but do not want to download the rest, you can edit the workspace_images.txt file and remove the ones that you do not need. Then you can run: ./strong-cli install You will have to go through a wizard that helps you create the YAML configuration file. Enter the main domain of the platform (e.g, strong-network.example.com): sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io The default domain used to access workspaces is: proxy.sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io Do you want to change it? (y/n): n Set the email of the platform admin: admin:admin@admin.com Set password for admin (leave empty to autogenerate): Define the base64 database encryption key (leave empty to autogenerate): Define the JWT secret (leave empty to autogenerate): Do you want to enable node affinities for workspaces and strong network services? (y/n): n Use two-factor authentication for users? (y/n): n Installing version 2025.5.2... In case you get an error in the terminal like the following: Failed to fetch access token with error: permission denied, try using a service account.., This means that your domain is not registered correctly on the Citrix Secure Developer Spaces License server, and therefore, we cannot automatically generate the access token for our container registry. If you did not encounter any problems during the wizard, your whole wizard will look something like the output below. root@0f7ca7f89e78:/strong-network# ./strong-cli install Enter the main domain of the platform (e.g, strong-network.example.com): sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io The default domain used to access workspaces is: proxy.sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io Do you want to change it? (y/n): n Set the email of the platform admin: admin:admin@admin.com Set password for admin (leave empty to autogenerate): Define the base64 database encryption key (leave empty to autogenerate): Define the JWT secret (leave empty to autogenerate): Do you want to enable node affinities for workspaces and strong network services? (y/n): n Use two-factor authentication for users? (y/n): n Installing version 2025.5.2... ⢿ Authenticating... Done. ⣟ Finding best source registry... Selected EU region. Pulling helm chart version 2025.5.2.. File ninjahchart-2025.5.2.tgz downloaded to /strong-network/shared/ninjahchart-2025.5.2.tgz Destination Registry URL:your-docker-registry.azurecr.io Detected Azure Registry Type.. Select Type For Authentication: [1] User Account [2] Service Principal Please Enter Your Numeric Choice: 2 Enter service principal ID: your-docker-registry-token Enter service principal password: Authentication successful. src: europe-docker.pkg.dev/strong-network-release/images/frontend:2025.5.2 dst: http://your-docker-registry.azurecr.io/frontend:2025.5.2 Getting image source signatures Copying blob fb6ab0edbcbd done | Copying blob ab9385d5595c done | Copying blob 0c1c1add5fb1 done | … Copying blob 4f4fb700ef54 skipped: already exists Copying config 3564c26c52 done | Writing manifest to image destination ⢿ Finishing up... Done. Run your deployment like this: helm upgrade --install \\ --namespace default \\ --create-namespace \\ -f "./config_2025.5.2.yaml" \\ release ./ninjahchart-2025.5.2.tgz root@0f7ca7f89e78:/strong-network# Add Docker registry secrets to KubernetesDocker images for the Citrix Secure Developer Spaces platform itself and later for workspace images need to be hosted in a suitable location. This is why you (customer) need to provide your Container registry (or Artifactory), because the Citrix Secure Developer Spaces installer is going to pull the images from Citrix Secure Developer Spaces private GCP Artifactory and push them to your registry. Citrix Secure Developer Spaces container registry is likely not going to be public, and this is why you need to authenticate with it. The credentials for this authentication must be present during the Citrix Secure Developer Spaces platform installation so that images can be pulled for each of the Citrix Secure Developer Spaces service pods. Once you have the credentials ready, you can add them by running: kubectl create secret docker-registry acr-secret --namespace=strong-network --docker-server=your-docker-registry.azurecr.io --docker-username=your-docker-registry-token --docker-password=10E+xxvXEF/CwkRa25fg/i7ZLOYAwHuX42u2DKsDu7+ACRCDjoDL This creates a new Docker registry secret named 'acr-secret' in the 'strong-network' namespace. You can verify that the secret is successfully added by executing: kubectl get secrets | grep acr-secret Now you need to manually edit the YAML configuration that you got as a result of running the Strong installer and add the following line in the platform section: imagePullSecrets: acr-secret Set proper Security Context ConstraintsSince the OpenShift security model differs from the standard Kubernetes security model, you must apply additional policies; otherwise, Citrix Secure Developer Spaces services or workspaces will not start properly. You need to set policies for both service deployments and workspaces that will be made on the platform. Set policies for the service accounts of platform servicesExecute the instructions below: oc adm policy -n strong-network add-scc-to-user privileged -z release-central-service oc adm policy -n strong-network add-scc-to-user privileged -z release-coordinator oc adm policy -n strong-network add-scc-to-user privileged -z release-proxy oc adm policy -n strong-network add-scc-to-user privileged -z release-workspace-api oc adm policy -n strong-network add-scc-to-user privileged -z release-mongodb oc adm policy -n strong-network add-scc-to-user privileged -z release-frontend oc adm policy -n strong-network add-scc-to-user privileged -z release-cron-service-account This will add the elevated permissions to all platform services’ service accounts that Citrix Secure Developer Spaces uses. The -z flag indicates that what follows is a service account name, for example, release-proxy. Create a new service account, its policy, and assign itCreate a file named workspaces-policy.yaml: apiVersion: security.OpenShift.io/v1 kind: SecurityContextConstraints metadata: annotations: kubernetes.io/description: anyuid provides all features of the restricted SCC but allows users to run with any UID and any GID. creationTimestamp: "2024-08-07T12:25:28Z" generation: 1 name: strongnetwork-scc resourceVersion: "998061" uid: 434809ab-e25a-41eb-aa4b-bd918513ac1f allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: true allowPrivilegedContainer: true allowedCapabilities: - NET_ADMIN - NET_RAW defaultAddCapabilities: null fsGroup: type: RunAsAny groups: - system:cluster-admins priority: 10 readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: RunAsAny seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny users: [] volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClaim - projected - secret Apply it by running: kubectl apply -f workspaces-policy.yaml Now you need to check if a service account named statefulset-sa already exists: oc get serviceaccounts | grep statefulset-sa Service account already existsIf the service account already exists, you can check if it is already assigned the strongnetwork-scc SecurityContextConstraints. You can do so by running: oc get rolebindings,clusterrolebindings --all-namespaces -o wide | grep statefulset-sa You can expect to get an output like the one below, which would mean that it is using a strongnetwork-scc: If this is the case, you do not need to do any extra steps regarding the service account and its policies. Service account does not existIf the service account does not exist, you need to create one and assign the strongnetwork-scc policy to it: oc create serviceaccount statefulset-sa -n strong-network oc adm policy add-scc-to-user strongnetwork-scc -z statefulset-sa Editing the YAML configurationFinally, you need to manually edit the YAML configuration that you got as a result of running the Strong installer. You need to add the following lines in the platform section: useOpenShift: true You need to add the following lines in the region section: clusterConfig: privilegedWorkspaces: true customServiceAccount: statefulset-sa Final YAMLAfter all the edits made in previous steps, the YAML configuration should look like this: mongodb: auth: replicaSetKey: aEKuc2XTY6MEvnW7f0avejLXsElnuTVb password: ayYeIGVyIi1WGkhVIOoKMntXz1lHRlq4 rootPassword: a6aiZ0qW8uxh9koOammtSCt0nvU7Ofh8 platform: imageTag: 2025.5.2 dockerRegistry: your-docker-registry.azurecr.io/ workspaceRegistry: your-docker-registry.azurecr.io/ws-images/ publicRegistryLatestTag: 2.2.5 secureBrowserTag: 2025.5.2 sidecarTag: 2025.5.2 hostName: sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io centralProxyHostname: proxy.sn.apps.sm8kda46je6e9a9c7b.swedencentral.aroapp.io userAdminEmail: admin@admin.com userAdminPassword: 53Vr8KEROiF!Jl&E8F9I&@rg5sF*G5xU secretKeyReposB64: x94X0jttiAw2Tl74eeS3Aw== jwtSecret: 935HcvhL3Ja8jHKUbCG2dzH355pIXyQp sslCertificateSecret: "" sslCertificateSecretProxy: "" twoFaDisabled: true useOpenShift: true imagePullSecrets: acr-secret region: clusterConfig: privilegedWorkspaces: true customServiceAccount: statefulset-sa DeploymentNow what’s left is to run the helm upgrade and deploy the application: helm upgrade --install \\ --namespace strong-network \\ -f "./config_2025.5.2.yaml" \\ release ./ninjahchart-2025.5.2.tgz The terminal will freeze for a few seconds while deployment is in progress. Now you can go to the OpenShift console and Workloads -> Pods and verify that all pods are running correctly: If there is a problem with a particular pod, click on that pod and have a look at its Logs/Events. When everything is ok with all the pods, you can proceed to log in to the platform on the URL that is defined by the hostName value in the YAML, using the userAdminEmail and userAdminPassword from the YAML. After creating the initial organization and project, you can try creating a workspace and see if it deploys correctly. If the workspace does not deploy correctly, examine the logs of the relevant Pod/StatefulSet, as explained above. </article> <article> <h1>Citrix® Hypervisor 8.2 to XenServer® 8.4 Migration</h1> <p>Fri, 06 Jun 2025 16:45:00 +0000</p> OverviewCitrix Hypervisor 8.2 CU1 will reach its end of life on June 25, 2025. It was initially released in June 2020 and was the first Long-Term Service Release (LTSR) version released under the Citrix Hypervisor name. With its end of life near, migrating your Citrix Hypervisor 8.2 servers to XenServer 8.4 is necessary. This guide provides detailed steps to ensure that Citrix Virtual Apps and Desktops™ infrastructure servers and Virtual Delivery Agent hosts running on Citrix Hypervisor 8.2 CU1 are upgraded and migrated to the XenServer 8.4 release. PrerequisitesThe following prerequisites must be met to upgrade and migrate your host servers to XenServer 8.4: All host servers must be running Citrix Hypervisor 8.2 Cumulative Update 1. All hosts should have installed the recommended Citrix Hypervisor 8.2 Cumulative 1 Update Hotfixes. Citrix Virtual Apps and Desktops v2203 LTSR or later is supported on XenServer 8.4 Partitions must use a supported partition layout. Legacy partitions are no longer supported and cannot be upgraded directly to XenServer 8.4. A virtual Windows-based Citrix License Server Resize Heartbeat SR to a minimum of 4GB Validate that the server host hardware is compatible with XenServer 8.4 XenServer Premium Edition license applied to the Citrix Hypervisor 8.2 hosts. XenServer 8.4 ISO and the latest version of XenCenter® downloaded Network location where you can access the installation ISO through HTTP, FTP, or NFS. Note: In this guide, we will use NFS. Ensure that the NFS client is installed on the machine you are running XenCenter, and that you have the correct permissions to access the share if you use NFS. XenCenter 2502.2.0 or later is required. XenServer VM tools on each virtual machine have been updated. Snapshot of all virtual machines on the host to be migrated to XenServer 8.4 For vGPU-enabled virtual machines, ensure the GPU is supported and the NVIDIA GRID drivers are upgraded to the latest version. Ensure all virtual machine DVD drives are empty Perform the upgrade during planned maintenance windows Please refer to the official XenServer product documentation for up-to-date requirements. Upgrade Using XenCenterOur migration will begin by upgrading our first Citrix Hypervisor 8.2 CU1 server that hosts Citrix Virtual Apps and Desktops infrastructure components. (Reference: Rolling Pool upgrade with XenCenter) Connect to XenCenter and select the pool master. Select Help > Rolling Pool Upgrade… Click Next. Select the first Citrix Hypervisor 8.2 CU1 server (pool master) to be upgraded. Click Next. Select the upgrade mode, either Automatic (HTTP, FTP, NFS) or Manual (USB, DVD, PXE). In our case, we are hosting our ISO file on an NFS share. We select Automatic Mode and NFS from the drop-down menu, enter the NFS share path, and then click Next. If you have any supplemental packs to install, enter the file name/location. Otherwise, click Run Pre-checks. Note: If your hosts use NVIDIA vGPU you will need to provide the NVIDIA supplemental pack at this point. Select Resolve All to resolve any issues the pre-check has found. Once completed, click Check Again. Review and, if satisfied, accept the existing EUA to proceed. Click Start Upgrade. XenCenter provides an update status as we go through the installation process on our host. Upon completion of the upgrade process, click Finish. The host has been upgraded to XenServer 8.4. In addition to upgrading XenServer hosts using XenCenter, the XenServer CLI is also available for use. For the step-by-step process, please refer to the XenServer product documentation. Install XenServer UpdatesWith XenServer 8.4 now installed, you can install any updates that have been released. In XenCenter, click Tools > Configure Updates. Select the host just upgraded, the appropriate update channel, and the synchronization schedule. Click OK. Click Yes, Synchronize. Right-click on the host, select Updates >Synchronize with update channel. In XenCenter, click Tools > Install Updates. Select XenServer 8.4 or later. Click Next. Select Apply updates and click Next. Select the upgraded host and click Next. Review the required tasks and click Next. Review the pre-checks and click Install updates. Updates are installed. When updates have been installed, click Finish. </article> <article> <h1>Deploying Secure Developer Spaces in Azure Kubernetes</h1> <p>Thu, 05 Jun 2025 12:46:00 +0000</p> OverviewThe Citrix Secure Developer Spaces™ platform provides a secure and productive cloud development environment that can be deployed on public, private clouds, and self-hosted servers. It also works in full air-gapped modes, such as high-security settings. The primary purpose of the Secure Developer Spaces platform is to provide secure, cloud development environments (CDEs) that boost developer productivity while ensuring enterprise-level security. It allows organizations to streamline the provisioning and management of coding environments, improving efficiency and collaboration among internal and external teams. By centralizing development resources and integrating automated security features, the platform reduces the risk of data leaks and intellectual property theft, enabling safe remote work and supporting DevSecOps practices. Specifically, typical usage scenarios encompass IT efficiency, developer productivity, and governance of the development process. This deployment guide provides the steps to deploy the Secure Developer Spaces secure CDE using Azure Managed Kubernetes Service (AKS) and MongoDB Atlas. The CDEs can be accessed through cloud or local integrated development environments (IDEs), offering a secure and isolated environment for developers. This guide helps the user perform the following tasks: Preparing for the installation Installing and configuring the Secure Developer Spaces platform Accessing and upgrading the Secure Developer Spaces workspace Onboarding end users For more information, see the Secure Developer Spaces documentation website. Additionally, the Secure Developer Spaces website’s Resources and Knowledge Center offers a variety of insightful resources on CDEs, including topics, such as DevOps integration, secure coding practices, and comparisons with other development tools. Architecture Diagram The architectural diagram of a CDE has the following components: One Kubernetes cluster with auto-scaling node and storage Container Storage Interface(CSI) driver capacity to host the Secure Developer Spaces platform and workspace A container registry MongoDB database Code repositories, for example, Bitbucket or GitHub Optional: Additional Kubernetes clusters set up in different regions to ensure global access with optimized network latency Optional: An identity provider (SAML), such as Okta Optional: Observability Optional: Private access using Citrix® Workspace The key components of Secure Developer Spaces - the Cloud Development Environment (CDE) Platform include Kubernetes clusters, a container registry, and a MongoDB database. You can leverage resources from any cloud service provider, use your hardware in a data center, or even use a hybrid. The following hardware specifications are required for Azure deployment: Azure Kubernetes Services for platform and regions Service node pool with two Standard_D8as_v5 VMs Workspace node pool with Standard_D16as_v5 VMs with auto-scaling Azure Container Registry Premium Tier Geo Replication peers MongoDB Atlas cluster M10 (2 GB RAM, 8 GB Storage) with auto-scaling Read-only nodes for regions If you are not using Azure, you can choose from the following alternatives: Kubernetes Cluster: Amazon Elastic Kubernetes Service Google Kubernetes Engine Container Registry Amazon Elastic Container Registry Google Container Registry PrerequisitesThe Secure Developer Spaces CDE platform deployment has the following prerequisites: An Azure subscription for cloud infrastructure A MongoDB Atlas subscription for database management Two domain names: Regular, such as sample.com A wildcard subdomain for proxy support, such as *.proxy.example.com SSL certificates for secure communications An identity provider (SAML), such as Okta, for identity and access management Preparing for the InstallationYou can prepare for the installation by setting up the prerequisites listed in the previous section. In addition, you must perform the procedures given in this section. Creating a Managed Kubernetes ServiceAzure Kubernetes Service (AKS) is a managed Kubernetes service that you can use to deploy and manage containerized applications. Before starting, download and install the following tools: az command-line tool kubectl command-line tool Procedure To create a resource group, run the following command: az group create --name $MY_RESOURCE_GROUP_NAME --location $REGION An Azure resource group is a logical container for deploying and managing Azure resources. When creating a resource group, you are prompted to specify a location. This location is the storage site for your resource group metadata. It determines where your resources run if the Azure location is not specified during resource creation. To create an AKS cluster, use the az aks create command. The following example creates a cluster with one node that enables a system-assigned managed identity: az aks create \ --resource-group $MY_RESOURCE_GROUP_NAME \ --name $MY_AKS_CLUSTER_NAME \ --node-count 1 \ --generate-ssh-keys To manage a Kubernetes cluster, use the kubectl command to download the credentials and configure the Kubernetes CLI to use them. az aks get-credentials --resource-group $MY_RESOURCE_GROUP_NAME --name $MY_AKS_CLUSTER_NAME To verify the connection to your cluster and get a list of cluster nodes, run the following command: kubectl get nodes Creating an Azure Container RegistryAzure Container Registry (ACR) is a managed registry service based on open-source Docker Registry 2.0. You can store and manage your container images and related artifacts by creating and maintaining Azure container registries. Secure Developer Spaces fetches service images and workspace images that you uploaded from Azure Container Registry. Procedure Create an ACR instance using the az acr create command. Ensure that the registry name is unique within Azure and contains 5 to 50 lowercase alphanumeric characters. The name in the following example is mycontainerregistry. az acr create --resource-group myResourceGroup --name mycontainerregistry --sku Basic Before pushing and pulling container images, you must log in to the registry using a service principal. Run the following command to create a service principal and assign the AcrOwner role: acr_resource_id=$(az acr show --name <acr-name> --query id --output tsv) az ad sp create-for-rbac --name <service-principal-name> --role AcrOwner --scopes ${acr_resource_id} --sdk-auth This command generates the details of the service principal, including the appId, displayName, password, and tenant. To verify the service principal, run the following command to log in to ACR: docker login <acr-name>.azurecr.io --username <service-principal-id> Password: Login Succeeded Establish an authentication mechanism between ACR and AKS using the following command: az aks update --name myAKSCluster --resource-group myResourceGroup --attach-acr <acr-name> You can configure the required permissions between Azure Container Registry and Azure Kubernetes Service. Creating a MongoDB ServiceThis procedure guides you through creating a MongoDB database and configuring it for use with your Kubernetes cluster. Procedure 1. Open the database page and click Create. 2. Configure your settings and click Create Deployment. 3. Go to the Database Access page and add a user. 4. Go to the Network Access page and add your Kubernetes cluster IP. Downloading Container Images and Helm ChartThis procedure guides you in downloading container images and the Helm chart necessary for deploying the Secure Developer Spaces platform. Procedure To download container images and Helm chart, run the Docker container from Docker Hub: docker run -it --rm -v ${PWD}:/strong-network/shared strongnetwork/strong_installer:${VERSION} Creating ConfigIf you are installing Secure Developer Spaces for the first time, you must create the config.yml file for deployment. Procedure Run the following command: ./strong-cli create-config Set up the platform by responding to the prompts based on your preferences and requirements. The following example shows a generated config.yml file: ninja: image_tag: "latest" docker_registry: "<acr-name>" workspace_registry: "<acr-name>/ws-images/" user_admin_email: "" # Default admin@strong-network.com user_admin_password: "" # command: openssl rand -base64 16 | tr '/+' '_-' | tr -d '=' secret_key_repos_b64: "" # 16bytes base64 encoded; command: openssl rand -base64 16 proxy_host_name: "" # example: proxy.example.com host_name: "" # example: example.com ssl_certificate_secret: "" # secret for ssl certs; created using: kubectl create -n release-name secret tls helloworld-credential --key=private.key --cert=public.crt externalMongodb: hostName: "" # MongoDB Atlas host name auth: username: "" # set MongoDB Atlas user password: "" # set MongoDB Atlas password Where: image_tag: The Docker image tag of services. docker_registry: The URL of the Docker registry where services are hosted. workspace_registry: The URL of the Docker registry where workspace images are hosted. user_admin_email: The email of the administrator. user_admin_password: The password for the administrator of the platform. secret_key_repos_b64: The secret to encrypt the private keys to access the repositories. host_name: The URL of deployment (for example, company.strong-network.com). proxy_host_name: The proxy URL used to access the workspace application. ssl_certificate_secret: The Kubernetes TLS secret that contains a private key and a chain of SSL certificates. Fetching Helm Chart and Container ImagesThis section outlines the steps to fetch the Helm chart and container images required for deploying the Secure Developer Spaces platform. Procedure Go to the /strong-network directory and run the following strong-cli Binary command: ./strong-cli install \ --source-region eu \ --domain your-domain.com \ --dst-reg-url <acr-name> \ --azure-service-principal-id <service-principal-id> \ --azure-service-principal-password <service-principal-password> Where: --source-region: It is the closest region to you (us, eu, asia). If this flag is not provided, the program auto-detects the best region. --domain: The host domain. If this flag is not provided, the domain is extracted from the ./shared/config.yml file. --src-reg-key-file: The path to the Service Account Key file of the Secure Developer Spaces registry. If this flag is not provided, the program tries to auto-authenticate to the source registry. --dst-reg-url: Your destination registry URL to which you want to push images. Based on the destination registry URL, you must provide the following inputs for Azure: --azure-service-principal-id: The service principal ID of your Azure registry. --azure-service-principal-password: The service principal password of your Azure registry. The CLI downloads the Helm chart and starts pushing images to your registry. Preinstalling NGINX Ingress ControllerEnsure you have a pre-installed NGINX Ingress controller on the Kubernetes cluster. If not, then go to the installation guide and see the installation per Cloud Provider. If the Cloud Provider is not on the list, perform the following steps. Procedure Run the following helm commands: helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo update helm install --namespace nginx --create-namespace ingress-nginx ingress-nginx/ingress-nginx It is best practice to set up this NGINX configuration to optimize the platform's performance in customer deployments. A default ConfigMap exists in the ingress-nginx namespace, usually named ingress-nginx-controller. kubectl edit configmap ingress-nginx-controller Add keep-alive-requests: “10000” to the ConfigMap as shown in the following command: apiVersion: v1 data: allow-snippet-annotations: "true" enable-brotli: "true" keep-alive: 120s keep-alive-requests: "10000" use-gzip: "true" use-http2: "true" kind: ConfigMap Uploading the SSL SecretThe SSL secret is used in the Secure Developer Spaces ingress configuration. Perform the following step to upload your SSL secret. Procedure Run the kubectl create secret command to upload your SSL secret. See the command in the following example: kubectl create secret tls my-ssl-secret --cert=path/to/tls.crt --key=path/to/tls.key Installing the Secure Developer Spaces PlatformAfter you have followed the prerequisite procedures, you can install the Secure Developer Spaces platform. Procedure Configure and run the .yml file using Helm. Replace the values in the following example with the actual values: helm upgrade --install my_release ninjahchart-${SN_VERSION}.tgz -f config.yml Once the deployment is complete, inspect the running services with the kubectl get all command to generate an output similar to the following example: > kubectl get pods pod/release-central-service-7794bf97db 1/1 Running 0 3h24m pod/release-central-service-55f74bb5d 1/1 Running 0 3h24m pod/release-mongodb-869ddfb7c-7q58h 1/1 Running 0 3h24m pod/release-coordinator-7f9c4c95bd5fd 1/1 Running 0 3h24m pod/release-proxy-569859ddb9-748jj 1/1 Running 0 3h24m pod/release-frontend-7b4b8b97d4-67d2k 1/1 Running 0 3h24m pod/release-workspace-api-74cb48675c-9x4v8 1/1 Running 0 3h24m To log into the platform, enter the URL of your deployment in the Chrome browser. Use the admin credentials that you set in the Helm values. You can configure the platform to connect to the service providers, such as GitHub, GitLab, GSuite, and Microsoft Teams. Configuring the Secure Developer Spaces PlatformAfter installing the Secure Developer Spaces platform, you must configure it for use. This section covers the configuration procedures. Configuring Okta as SAML Identity ProviderIn the Okta Admin menu, navigate to Applications > Application. Click Create App Integration. In the modal for the sign-in method, select SAML 2.0. Enter the application name. Click Configure SAML and enter the following values in the dialog. Single Sign-On URL: Enter the URL, for example http(s)://yourdomain/saml/acs Audience URI: Enter the URI, for example: http(s)://yourdomain/saml/metadata Attribute Statements: email: (Mandatory) firstName: (Optional) If not set, the email is used as the username. lastName: (Optional) If not set, the email is used as the username. Click Continue and Finish. The app is successfully created in Okta. To configure the Secure Developer Spaces platform to trust Okta, log in to the platform as the administrator and go to http(s)://yourdomain/platform/system_configuration/saml_sp or click System Configuration > SAML Service Provider Configuration Click Configure and upload the metadata of the SAML Identity Provider (Okta in this case) or enter a metadata URL. The SAML configuration is now complete and ready to use. The SAML configuration is now complete and ready to use. Configuring the Code RepositoryTo configure the code repository, you must set up the Secure Developer Spaces platform, configure the Bitbucket instance, and configure SSH Access. Configuring the Secure Developer Spaces Platform Go to the Secure Developer Spaces platform settings. Open the Code Repository Applications menu. Click Add Bitbucket. Select the checkbox for Bitbucket Server or Data Center (self-hosted). Set the following fields: Bitbucket App Name: Users see it when using this Code Repository Provider. Custom Domain: Enter the URL where the Bitbucket instance is hosted. If none is given, HTTPS is chosen by default. Enforce Users to Connect: If selected, users must connect to Bitbucket before opening their workspaces. This can prevent misconfiguration and permission issues on the user side. Click the Create button to complete the configuration on the Secure Developer Spaces platform. Save the Bitbucket Server Public Key for later use. This can also be found in the edit menu after clicking the Create button. Configuring the Bitbucket InstanceGo to Administration > Applications > Application Links and click Create link. Enter the following information in the fields: Application Type: External application Direction: Incoming Click Continue. Set a unique name. Redirect URL: Set to https://example.com/oauth/v1/apps/callback, where example.com should be replaced with the proper domain name. Application Permissions: Set Account: Write, Repositories: Admin. Click Save. Enter strong_network for both the Client ID and Client Secret. SSH Access ConfigurationThe platform optionally allows users to connect to their workspaces using SSH. Developers can securely access the remote file system of the workspace and leverage remote IDE features in applications, such as Visual Studio Code and JetBrains Gateway. This section covers the following procedures: Configure the NGINX Load Balancer: Forward TCP requests on port 22 to allow SSH access. Enable SSH Access in the Admin Platform Configuration: Adjust settings on the admin platform configuration page to enable the SSH feature. Utilize SSH Access: Show developers how to use the SSH feature to connect to their workspaces. Configuring the NGINX Load BalancerTo create ConfigMap, switch to the namespace of the NGINX controller. By default, it is Nginx. Run the following command: kubectl create configmap ssh-mapping To edit the data field of the ConfigMap to include a mapping from the SSH port (default 22) to your release’s workspace API, run the following commands: kubectl edit configmap ssh-mapping apiVersion: v1 data: "22": default/release-workspace-api:2222 kind: ConfigMap To edit the DeploymentApp of the NGINX Ingress Controller, run the following command: kubectl edit deployments.apps ingress-nginx-controller Add the following line to the Arguments of the controller (under the Args header): spec: --tcp-services-configmap=$(POD_NAMESPACE)/ssh-mapping To expose Port 22 in the Service of the NGINX Ingress Controller, run the following commands: kubectl edit svc -n=nginx nginx-ingress-controller name: ssh port: 22 protocol: TCP targetPort: 22 TCP requests to port 22 in the load balancer are set to automatically be redirected to port 22 on the Secure Developer Spaces workspace service. Enabling SSH Access on the PlatformLog in to the Secure Developer Spaces platform. You must have an administrator or security officer role. Go to Platform Overview > Settings > Workspace Settings. Scroll down to the Connect Via SSH section. Click the toggle button to enable the feature. Note: Ensure that the port for SSH connection matches the port exposed in the NGINX load balancer. Creating Your First Secure Developer Spaces WorkspaceTo create your first Secure Developer Spaces workspace, you must create an organization and a project administrator. Creating an OrganizationClick Add New Organization. Enter the following information: Organization Name: Name of the organization Owner: Any user with the right permissions to own an organization Creating a Project AdminClick Add New Project. Enter the following information: Project Name: Name of the project Owner: Any existing user on the platform or a new user you want to onboard Installing the Secure Developer Spaces RegionThe following topics cover the procedures required to install the Secure Developer Spaces region. Creating MongoDB Read-Only NodesNavigate to the Database page and edit the database config as shown in the following image: Enable Multi-Region and add a read-only node of the region you want to create. Then, save the change. Creating the Kubernetes Cluster in the New RegionPerform the steps in the Creating a Managed Kubernetes Service topic. Configure NGINX Ingress Controller. For more information, see Preinstalling NGINX Ingress Controller. Preparing the Helm Chart and Container ImagesThe regional instance uses the same set of service container images as the primary region. Use the same installer to pull the images. For more information, see Fetching Helm Charts and Container Images. Obtain the regional chart from Secure Developer Spaces support. Creating the Helm Chart ValuesTo create the Helm chart values, you need a config.yml file. Here is an example of the config.yml file: regional: secretKeyReposB64: "" # Set the value same as primary region jwtSecret: "" # Set the value same as primary region regionalDomain: "" centralHostname: "" # primary region proxy URL centralService: "" # primary region URL externalMongodb: # The same as primary region hostname: "" auth: username: "" password: "" Deploying the Secure Developer Spaces RegionConfigure and run the following .yml file using Helm. helm upgrade --install my_release regionchart-${SN_VERSION}.tgz -f config.yml Upgrading the Secure Developer Spaces PlatformThis section provides instructions for upgrading the Secure Developer Spaces platform to the latest version. Pulling the New Helm Chart and Container ImagesTo pull the new Helm chart and container images, perform the steps in the Preparing the Helm Chart and Container Images topic. To upgrade with Helm, run the following command. helm upgrade my_release ninjahchart-${SN_VERSION}.tgz Note: The service restarts during the upgrade, resetting active connections and affecting users. Onboarding End UsersThe Strong Agent ensures seamless access control to source code across all working environments. Once end users are added to the workspace and assigned to project teams, they can use the environments for cloud-native and legacy Windows, Linux, and Mac development. Cloud Native EnvironmentIn this section, you create and configure a workspace for cloud-native development using the Secure Developer Spaces platform. Creating a WorkspaceClick Create Workspace. Select and enter the following information: Basic Info: Name Embedded Cloud IDE User Sharing Options Docker Image Image Version Resource Allocation (requires Workspaces::Manage Project permission) Attach various project resources to your workspace. Resources must have been previously added to the project, and you might need to update access rights. You can add the following resources: Git Applications and Repositories: Connect the entire Git applications available from your platform or single repositories that have been previously imported to the project's or organization's resources. Specify a default folder location within your workspace where the Git files are cloned. Secrets: Import secrets to the workspace as files or environment variables. Choose from existing secrets or create one. Connected HTTP and SSH Services: Connect services as environment variables in the workspace. Supported and available services are part of the project's and organization's resources and depend on the platform's configuration. Startup Script: Set up a startup script to be run automatically at the workspace's boot time. This allows you to customize the software available in the container. Review your Workspace configuration and open it. Your workspace is automatically deployed. You can edit its configuration from the Overview or Workspaces pages. Accessing Your Workspace Through SSHThis topic explains how to access your workspace through SSH, allowing you to edit code directly using a local command-line editor. You must generate an SSH key pair for this process. To generate an SSH Key Pair on UNIX and UNIX-like systems, run the following command in your terminal: ssh-keygen The terminal suggests a default path and file name (for example, /home/user_name/.ssh/id_rsa). To accept the default path and file name, press Enter. To specify a different path and file name, enter those details and press Enter. Option: Enter a passphrase. It is best practice to set a passphrase for additional security against unauthorized use of your private key. If you set a passphrase, you are prompted to enter it again for confirmation. If you did not set a passphrase, press Enter. The generated SSH public and private keys are saved in the specified path. The public key file name is automatically created by appending .pub to the private key file name. For example, if the private key file is named id_rsa, the public key file is id_rsa.pub. Upload your public key to the SSH Keys section in your profile. To enable the SSH connection to your workspace, drag the SSH access. Authorize the workspace using your SSH key. To connect to your workspace using a shell, navigate to the Running Actions List of your workspace Select the Connect With SSH option. This action displays the SSH command required to establish an SSH connection to your workspace. Enter this command in your terminal. Connecting to Your Workspace Through SSH Using Visual Studio CodeInstall the Secure Developer Spaces Remote SSH extension from the marketplace. Sign in using the < Secure Developer Spaces URL>. Open the assigned workspace to begin working in a secure environment. Working from Windows/Linux/Mac VDASecure Developer Spaces supports proxy mode, using which you can install Strong Agents on existing Windows VDA, Linux VDA, and Mac VDA. In this mode, all source code access traffic is routed through the Strong Agent, which uses existing source credentials or keys. This eliminates the need for engineers to create personal SSH keys to access source code. Note: The following procedure applies to Windows, Linux, and the Citrix VDA for macOS. Setting up the ProfileIf you have not used the cloud-native environment, activate your Strong account with your company's Strong instance URL. Contact your project admin to add you to a project. Configure your profile to set up the source code access permission. Installing the AgentInstall the Strong agent and run the Strong VDI library after installation. Setting up the ConfigurationRun the binary and enter the Secure Developer Spaces workspace URL Click Let’s Get Started and log into your account. Authorize the connection to Secure Developer Spaces Configure the environment and complete the setup. You can now use any terminal to clone your source code and use a local IDE, such as Visual Studio or Xcode, to perform your daily tasks. Secure Developer Spaces securely and centrally manages credentials in the backend. </article> </main></body></html>