From 86545d60efc2058621f64cdaf917008dc41d47a3 Mon Sep 17 00:00:00 2001 From: phil Date: Sun, 22 Oct 2023 20:29:30 +0200 Subject: [PATCH] Nextcloud: Setup NC configuration via occ import --- README.md | 39 ++++++++++++++- tasks/configuration.yml | 83 ++++---------------------------- tasks/hiddenservice.yml | 11 ----- tasks/main.yml | 5 ++ templates/apache2/custom.conf.j2 | 2 +- templates/config.json.j2 | 1 + 6 files changed, 54 insertions(+), 87 deletions(-) create mode 100644 templates/config.json.j2 diff --git a/README.md b/README.md index 7f09e23..8add19d 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,42 @@ Diese Rolle installiert [Nextcloud](https://nextcloud.com). Sie umfasst: - Anlegen eines Zertifikates + Konfigurarion des Reverse Proxies - Anlegen eines PHP-FPM-Master-Prozesses mit socket activation +# Verfügbare Variablen + +Zur Konfiguration von Nextcloud stehen zwei Dictionaries zur Verfügung. Unter `groups_vars/all/nextcloud.yaml` +befinden sich im Dictionary `default_occ_config` die Default-Einstellungen für alle Instanzen. + +Zur individuellen Konfiguration können weitere Variablen in den `host_vars` unter `nextcloud_instaces` als Dictionary +`occ_config` angegeben werden. Beide Dictionaries werden beim Ausführen des Playbooks gemergt. + +Die Struktur der Dictonaries muss dabei zwingend der Nextcloud-Syntax folgen. Diese lässt sich auf eine bestenden Instanz mit [occ](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html#config-commands) ausgeben: +```Shell +occ config:list --private +``` + +Beispiel-Konfiguration: + + +```YAML +default_occ_config: + system: + default_language: de + default_locale: de_DE + +nextcloud_instances: + - name: coop.systemausfall.org + user: nextcloud + database: nextcloud + hiddenservice: true + occ_config: + apps: + core: + backgroundjobs_mode: cron + system: + mail_from: noreply + mail_domain: systemausfall.org +``` + # Neue Nextcloud-Instanz anlegen - Trage die Informationen zur neuen Instanz in die entsprechende `host_vars`-Datei unter `nextcloud_instances` ein: @@ -17,11 +53,12 @@ Diese Rolle installiert [Nextcloud](https://nextcloud.com). Sie umfasst: | `alias`| string | Array mit weiteren Domain-Alias-Namen für diese Instanz | | `user` | string | Name eines anzulegenden Systemnutzers, der den PHP-FPM-Prozess ausführt | | `database` | string | Name der anzulegenden MariaDB-Datenbank | + | `hiddenservice` | bol | Richtet für die Instanz einen Onion Service ein | - Starte anschließend das Playbook: ```Shell ansible-playbook playbooks/nextcloud.yml ``` -- Bei der Erstinstallation einer Nextclou-Instanz gibt die Rolle anschließend die Anmeldeinformationen für den Admin-Zugang aus. +- Bei der Erstinstallation einer Nextcloud-Instanz gibt die Rolle anschließend die Anmeldeinformationen für den Admin-Zugang aus. # Aktualisierung des Cores/ von Apps diff --git a/tasks/configuration.yml b/tasks/configuration.yml index 1ea3d6f..dde0952 100644 --- a/tasks/configuration.yml +++ b/tasks/configuration.yml @@ -3,16 +3,6 @@ ansible.builtin.set_fact: nextcloud_install_path: "{{ nextcloud_root }}/{{ instances.name }}" -- name: "Configuration | Richte trusted domains ein | {{ instances.name }}" - ansible.builtin.command: - cmd: 'php occ config:system:set trusted_domains {{ item.0 }} --value "{{ item.1 }}"' - chdir: "{{ nextcloud_install_path }}" - become: true - become_user: "{{ instances.user }}" - changed_when: true - with_indexed_items: - - '{{ instances.config.trusted_domains }}' - - name: "Configuration | Richte cron-Job ein | {{ instances.name }}" ansible.builtin.cron: name: "nextcloud {{ instances.name }}" @@ -21,79 +11,24 @@ job: "php -f {{ nextcloud_install_path }}/cron.php" cron_file: "nextcloud" -- name: "Configuration | Richte allgemeie Konfiguration ein | {{ instances.name }}" +- name: "Configuration | Aktualisiere htaccess-Datei | {{ instances.name }}" ansible.builtin.command: - cmd: "{{ commands }}" + cmd: "php occ maintenance:update:htaccess --quiet" chdir: "{{ nextcloud_install_path }}" become: true become_user: "{{ instances.user }}" changed_when: true - loop: - - 'php occ config:system:set memcache.local --value "\\OC\\Memcache\\APCu"' - - 'php occ config:system:set memcache.distributed --value "\OC\Memcache\Redis"' - - "php occ background:cron" - - 'php occ config:system:set overwrite.cli.url --value https://{{ instances.name }}' - - 'php occ config:system:set htaccess.RewriteBase --value /' - - 'php occ maintenance:update:htaccess' - - 'php occ config:system:set default_language --value "de"' - - 'php occ config:system:set default_phone_region --value "DE"' - loop_control: - loop_var: commands -- name: "Configuration | Richte Mailversand ein | {{ instances.name }}" - ansible.builtin.blockinfile: - path: "{{ nextcloud_config_file }}" - insertbefore: '^\);' - marker: "// {mark} ANSIBLE MANAGED BLOCK Mailversand" - block: |2 - 'mail_from_address' => '{{ instances.config.mail_from }}', - 'mail_smtpmode' => 'smtp', - 'mail_sendmailmode' => 'smtp', - 'mail_domain' => '{{ instances.config.mail_domain }}', - 'mail_smtpauthtype' => '{{ instances.config.smtp_auth_type }}', - 'mail_smtphost' => '{{ instances.config.smtp_host }}', - 'mail_smtpport' => '{{ instances.config.smtp_port }}', +- name: "Configuration | Erstelle Konfiguration | {{ instances.name }}" + ansible.builtin.template: + src: config.json.j2 + dest: "/tmp/{{ instances.name }}_config.json" + mode: "0644" -- name: "Configuration | Richte Filelocking ein | {{ instances.name }}" - ansible.builtin.blockinfile: - path: "{{ nextcloud_config_file }}" - insertbefore: '^\);' - marker: "// {mark} ANSIBLE MANAGED BLOCK Filelocking" - block: |2 - 'filelocking.enabled' => true, - 'memcache.locking' => '\OC\Memcache\Redis', - 'redis' => array( - 'host' => '/var/run/redis/redis-server.sock', - 'port' => 0, - 'dbindex' => {{ instance_id }}, - 'timeout' => 1.5, - ), - -- name: "Configuration | Richte trusted proxies ein | {{ instances.name }}" +- name: "Configuration | Importiere Konfuration | {{ instances.name }}" ansible.builtin.command: - cmd: 'php occ config:system:set trusted_proxies {{ item.0 }} --value "{{ item.1 }}"' + cmd: "php occ config:import /tmp/{{ instances.name }}_config.json --quiet" chdir: "{{ nextcloud_install_path }}" become: true become_user: "{{ instances.user }}" changed_when: true - with_indexed_items: - - "{{ instances.config.trusted_proxies }}" - -- name: "Configuration | Richte Logging ein | {{ instances.name }}" - ansible.builtin.blockinfile: - path: "{{ nextcloud_config_file }}" - insertbefore: '^\);' - marker: "// {mark} ANSIBLE MANAGED BLOCK Logging" - block: |2 - 'log_type' => 'file', - 'loglevel' => 1, - 'logdateformat' => 'F d, Y H:i:s', - 'log_type_audit' => 'file', - -- name: "Configuration | Erstelle OIDC-Konfiguration | {{ instances.name }}" - ansible.builtin.blockinfile: - path: "{{ nextcloud_config_file }}" - insertbefore: '^\);' - marker: "// {mark} ANSIBLE MANGED BLOCK OIDC" - block: "{{ instances.config.oidc }}" - when: instances.config.oidc is defined diff --git a/tasks/hiddenservice.yml b/tasks/hiddenservice.yml index 8a53fed..8315543 100644 --- a/tasks/hiddenservice.yml +++ b/tasks/hiddenservice.yml @@ -3,7 +3,6 @@ ansible.builtin.import_role: name: configure-hiddenservice delegate_to: "{{ onion_host }}" - when: item.config.hiddenservice is defined and item.config.hiddenservice - name: "Hiddenservice | Kopiere Apache-Anpassungen | {{ item.name }}" ansible.builtin.template: @@ -11,13 +10,3 @@ dest: "/etc/apache2/conf-available/{{ item.name }}.conf" mode: "0644" notify: reload apache - -# Das erste Argument gibt den Platz im Array an, beginnend mit 0. -- name: "Hiddenservice | Richte trusted domains ein | {{ item.name }}" - ansible.builtin.command: - cmd: 'php occ config:system:set trusted_domains {{ item.config.trusted_domains | length }} --value "{{ hiddenservice_address.stdout }}"' - chdir: "{{ nextcloud_install_path }}" - become: true - become_user: "{{ item.user }}" - changed_when: true - when: item.config.hiddenservice is defined and item.config.hiddenservice diff --git a/tasks/main.yml b/tasks/main.yml index d221224..4a3810b 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -38,7 +38,12 @@ - name: Run Hiddenservice tasks ansible.builtin.include_tasks: hiddenservice.yml + when: item.hiddenservice is defined loop: "{{ nextcloud_instances }}" + tags: always + args: + apply: + tags: hiddenservice - name: Run Webserver tasks ansible.builtin.import_tasks: apache.yml diff --git a/templates/apache2/custom.conf.j2 b/templates/apache2/custom.conf.j2 index c1cfcfe..5fcb3d8 100644 --- a/templates/apache2/custom.conf.j2 +++ b/templates/apache2/custom.conf.j2 @@ -6,7 +6,7 @@ ServerAlias {{ alias }} {% endfor %} {% endif %} -{% if item.config.hiddenservice is defined and item.config.hiddenservice %} +{% if item.hiddenservice is defined and item.hiddenservice %} ServerAlias {{ hiddenservice_address.stdout }} diff --git a/templates/config.json.j2 b/templates/config.json.j2 new file mode 100644 index 0000000..984f0a1 --- /dev/null +++ b/templates/config.json.j2 @@ -0,0 +1 @@ +{{ default_occ_config | ansible.builtin.combine(instances.occ_config, list_merge="appendi_rp", recursive=true) | to_json(indent=4, sort_keys=true) }}