diff --git a/defaults/main.yml b/defaults/main.yml index e484403..553982f 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -11,6 +11,7 @@ nextcloud_mysql_user: "nc_{{ common_name }}" nextcloud_install_path: "/data/nextcloud/{{ nextcloud_domain }}" nextcloud_config_file: "{{ nextcloud_install_path }}/config/config.php" nextcloud_php_memory_limit: 512M +nextcloud_php_upload_limit: 512M nextcloud_trusted_domains: ['localhost', '{{ nextcloud_domain }}'] nextcloud_trusted_proxies: ['10.42.7.1'] nextcloud_version: nextcloud-20.0.2 diff --git a/tasks/main.yml b/tasks/main.yml index 40a22d6..be573b6 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -5,5 +5,6 @@ tags: database - import_tasks: php.yml - import_tasks: apache.yml +- import_tasks: redis.yml - import_tasks: nextcloud.yml tags: nextcloud diff --git a/tasks/nextcloud.yml b/tasks/nextcloud.yml index 29e95a2..6a7a0b3 100644 --- a/tasks/nextcloud.yml +++ b/tasks/nextcloud.yml @@ -52,9 +52,11 @@ - "php {{ nextcloud_install_path }}/occ app:enable encryption" - "php {{ nextcloud_install_path }}/occ encryption:enable" - 'php {{ nextcloud_install_path }}/occ config:system:set memcache.local --value "\\OC\\Memcache\\APCu"' + - 'php {{ nextcloud_install_path }}/occ config:system:set memcache.distributed --value "\OC\Memcache\Redis"' - "php {{ nextcloud_install_path }}/occ background:cron" - 'php {{ nextcloud_install_path }}/occ config:system:set overwrite.cli.url --value https://{{ nextcloud_domain }}' - 'php {{ nextcloud_install_path }}/occ config:system:set htaccess.RewriteBase --value /' + - 'php {{ nextcloud_install_path }}/occ maintenance:update:htaccess' - name: "NC Mailversand einrichten" blockinfile: @@ -70,10 +72,24 @@ 'mail_smtphost' => '{{ nextcloud_smtp_host }}', 'mail_smtpport' => '{{ nextcloud_smtp_port}}', -- name: "NC trusted proxies eirichten" +- name: "NC Filelocking" + blockinfile: + path: "{{ nextcloud_config_file }}" + insertbefore: '^\);' + marker_begin: filelocking + block: |2 + 'filelocking.enabled' => true, + 'memcache.locking' => '\OC\Memcache\Redis', + 'redis' => array( + 'host' => '/var/run/redis/redis-server.sock', + 'port' => 0, + 'timeout' => 0.0, + ), + +- name: "NC trusted proxies einrichten" command: 'php {{ nextcloud_install_path }}/occ config:system:set trusted_proxies {{ item.0 }} --value "{{ item.1 }}"' become: true become_user: "{{ common_name }}" changed_when: true with_indexed_items: - - '{{ nextcloud_trusted_proxies }}' + - '{{ nextcloud_trusted_proxies }}' diff --git a/tasks/php.yml b/tasks/php.yml index dc5c866..9feebab 100644 --- a/tasks/php.yml +++ b/tasks/php.yml @@ -5,6 +5,7 @@ name: "{{ common_name }}" create_home: no password: "!" + groups: "{{ common_name }},redis" shell: /bin/false state: present diff --git a/tasks/redis.yml b/tasks/redis.yml new file mode 100644 index 0000000..d53e8f7 --- /dev/null +++ b/tasks/redis.yml @@ -0,0 +1,13 @@ +--- + +- name: "Redis Aktiviere Socket" + lineinfile: + path: /etc/redis/redis.conf + regexp: '^# unixsocket /var/run/redis/redis-server.sock' + line: 'unixsocket /var/run/redis/redis-server.sock' + +- name: "Redis Berechtigungen" + lineinfile: + path: /etc/redis/redis.conf + regexp: '^# unixsocketperm 700' + line: 'unixsocketperm 770' diff --git a/templates/php_fpm_pool.j2 b/templates/php_fpm_pool.j2 index d91f2d5..309f940 100644 --- a/templates/php_fpm_pool.j2 +++ b/templates/php_fpm_pool.j2 @@ -30,17 +30,19 @@ pm.max_requests = 100 ;chroot = chdir = / ;catch_workers_output = yes -;clear_env = no +clear_env = no security.limit_extensions = .php .php3 .php4 .php5 -;env[HOSTNAME] = $HOSTNAME -;env[PATH] = /usr/local/bin:/usr/bin:/bin -;env[TMP] = /tmp -;env[TMPDIR] = /tmp -;env[TEMP] = /tmp +env[HOSTNAME] = $HOSTNAME +env[PATH] = /usr/local/bin:/usr/bin:/bin +env[TMP] = /tmp +env[TMPDIR] = /tmp +env[TEMP] = /tmp ;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com ;php_flag[display_errors] = off ;php_admin_value[error_log] = /var/log/fpm-php.www.log ;php_admin_flag[log_errors] = on php_admin_value[memory_limit] = {{ nextcloud_php_memory_limit }} +php_admin_value[upload_max_filesize] = {{ nextcloud_php_upload_limit }} +php_admin_value[post_max_size] = {{ nextcloud_php_upload_limit }} php_admin_value[open_basedir] = {{ nextcloud_install_path }}:/tmp:/dev/urandom:/proc/meminfo:/var/log ;php_admin_value[disable_functions] = mail,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_exec,passthru,system,proc_get_status,proc_close,proc_nice,proc_terminate,proc_open,curl_ini,parse_ini_file,show_source,dl,symlink,system_exec,exec,shell_exec,phpinfo