Beginne Nextcloud-Rolle

This commit is contained in:
phil 2020-12-03 14:52:14 +00:00
commit db196d0567
15 changed files with 316 additions and 0 deletions

29
.travis.yml Normal file
View file

@ -0,0 +1,29 @@
---
language: python
python: "2.7"
# Use the new container infrastructure
sudo: false
# Install ansible
addons:
apt:
packages:
- python-pip
install:
# Install ansible
- pip install ansible
# Check ansible version
- ansible --version
# Create ansible.cfg with correct roles_path
- printf '[defaults]\nroles_path=../' >ansible.cfg
script:
# Basic role syntax check
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

38
README.md Normal file
View file

@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

15
defaults/main.yml Normal file
View file

@ -0,0 +1,15 @@
---
nextcloud_admin_pw: admin
nextcloud_admin_user: systemausfall.org
nextcloud_admin_pw: admin
nextcloud_database_host: database.kahlo
nextcloud_dl_url: https://download.nextcloud.com/server/releases
nextcloud_gateway: kahlo.kahlo
nextcloud_mysql_db: "nc_{{ common_name }}"
nextcloud_mysql_pw: admin
nextcloud_mysql_user: "nc_{{ common_name }}"
nextcloud_install_path: "/data/nextcloud/{{ nextcloud_domain }}"
nextcloud_trusted_domains: ['localhost', '{{ nextcloud_domain }}']
nextcloud_version: nextcloud-20.0.2
php_version: "7.3"

21
handlers/main.yml Normal file
View file

@ -0,0 +1,21 @@
---
- name: reload apache
service:
name: apache2
state: reloaded
-name: restart apache
service:
name: apache2
state: restarted
- name: reload nginx
service:
name: nginx
state: reloaded
- name: restart phpfpm
service:
name: "php{{ php_version }}-fpm"
state: restarted

10
meta/main.yml Normal file
View file

@ -0,0 +1,10 @@
galaxy_info:
author: systemausfall.org
description: Role to deploy Nextcloud
company: Sense.Lab
license: GPLv3
min_ansible_version: 2.4
platforms:
- name: Debian
versions:
- Buster

17
tasks/database.yml Normal file
View file

@ -0,0 +1,17 @@
---
- name: "Ensure nextcloud database exists"
mysql_db:
name: '{{ nextcloud_mysql_db }}'
state: present
config_file: /etc/mysql/debian.cnf
delegate_to: "{{ nextcloud_database_host }}"
# Todo: Formatierung des Nutzernamens und Zuordnung des hosts schlaegt fehl
- name: "Ensure database user exists and has all privileges"
mysql_user:
name: "{{ nextcloud_mysql_user }}"
password: "{{ lookup('password', '/tmp/passwordfile chars=ascii_letters') }}"
priv: "{{ nextcloud_mysql_db }}.{{ inventory_hostname }}:ALL"
state: present
config_file: /etc/mysql/debian.cnf
delegate_to: "{{ nextcloud_database_host }}"

29
tasks/gateway.yml Normal file
View file

@ -0,0 +1,29 @@
---
- name: "Add domain to cerificate list"
lineinfile:
path: /etc/dehydrated/domains.txt
insertafter: "^# nextcloud"
line: "{{ nextcloud_domain }}"
# when: dehydrated_installiert
delegate_to: "{{ nextcloud_gateway }}"
- name: "Obtain certificate"
command: dehydrated --cron -g
delegate_to: "{{ nextcloud_gateway }}"
- name: "Copy webserver site configuration"
template:
src: nginx_site.j2
dest: "/etc/nginx/sites-available/{{ nextcloud_domain }}"
owner: root
group: root
mode: 0644
delegate_to: "{{ nextcloud_gateway }}"
- name: "Enable site configuration"
file:
src: "/etc/nginx/sites-available/{{ nextcloud_domain }}"
dest: "/etc/nginx/sites-enabled/{{ nextcloud_domain }}"
state: link
notify: reload nginx
delegate_to: "{{ nextcloud_gateway }}"

7
tasks/main.yml Normal file
View file

@ -0,0 +1,7 @@
---
- import_tasks: gateway.yml
- import_tasks: database.yml
tags: database
- import_tasks: nextcloud.yml
tags: nextcloud
- import_tasks: php.yml

50
tasks/nextcloud.yml Normal file
View file

@ -0,0 +1,50 @@
---
- name: "Ensure install dir is present"
file:
path: "{{ nextcloud_install_path }}"
mode: 0755
state: directory
- name: "Download und unarchive Nextcloud"
unarchive:
src: "{{ nextcloud_dl_url }}/{{ nextcloud_version }}.tar.bz2"
remote_src: true
extra_opts:
- "--strip-components=1"
dest: "{{ nextcloud_install_path }}"
owner: "{{ common_name }}"
group: "{{ common_name }}"
mode: 0755
- name: "Install Nextcloud"
command: >
php "{{ nextcloud_install_path }}"/occ maintenance:install --database "mysql"
--database-name "{{ nextcloud_mysql_db }}" --database-user "{{ nextcloud_mysql_user }}"
--database-pass 2CHbJwLpXTgHQkiUnFCgoowfT7vQdt85BX7VfRBCtb --database-host "{{ nextcloud_database_host }}"
--admin-user "{{ nextcloud_admin_user }}" --admin-pass "{{ nextcloud_admin_pw }}"
become: true
become_user: "{{ common_name }}"
changed_when: true
- name: "Ensure trusted domains are set"
command: 'php {{ nextcloud_install_path }}/occ config:system:set trusted_domains {{ item.0 }} --value "{{ item.1 }}"'
become: true
become_user: "{{ common_name }}"
changed_when: true
with_indexed_items:
- '{{ nextcloud_trusted_domains }}'
- name: "Ensure Apache marco module is loaded"
apache2_module:
state: present
name: macro
notify: restart apache
- name: "Setup Apache site config"
lineinfile:
path: /etc/apache2/conf-available/nextcloud_sites.conf
insertafter: "^Ansbile"
line: "Use NCSite {{ nextcloud_domain }} {{ common_name }}"
state: present
notify: reload apache

18
tasks/php.yml Normal file
View file

@ -0,0 +1,18 @@
---
- name: "Create PHP-FPM-User"
user:
name: "{{ common_name }}"
create_home: no
password: "!"
shell: /bin/false
state: present
- name: "Copy PHP-FPM configuration"
template:
src: php_fpm_pool.j2
dest: "/etc/php/{{ php_version }}/fpm/pool.d/{{ common_name }}.conf"
owner: root
group: root
mode: 0644
notify: restart phpfpm

27
templates/nginx_site.j2 Normal file
View file

@ -0,0 +1,27 @@
server {
listen 80;
server_name {{ nextcloud_domain }};
include snippets/letsencrypt.conf;
location / { return 301 https://$http_host$request_uri; }
}
server {
server_name {{ nextcloud_domain }};
listen 443 ssl http2;
ssl_certificate /var/lib/dehydrated/certs/{{ nextcloud_domain }}/fullchain.pem;
ssl_certificate_key /var/lib/dehydrated/certs/{{ nextcloud_domain }}/privkey.pem;
include /etc/nginx/proxy_params;
add_header Referrer-Policy $referrerpolicy;
add_header Strict-Transport-Security $sts;
add_header X-Content-Type-Options $xcontentoptions;
add_header X-XSS-Protection $xxssprotection;
# include /etc/nginx/snippets/hpkp.conf;
location ~ /.well-known/(carddav|caldav) {
return 301 $scheme://$host/remote.php/dav;
}
location ~ \.* {
proxy_pass http://{{ inventory_hostname }}:80;
}
}

46
templates/php_fpm_pool.j2 Normal file
View file

@ -0,0 +1,46 @@
[{{ common_name }}]
;prefix = /path/to/pools/$pool
user = $pool
group = www-data
listen = /run/php/php-fpm-$pool.sock
;listen.backlog = 65535
listen.owner = $pool
listen.group = www-data
listen.mode = 0660
;listen.acl_users =
;listen.acl_groups =
listen.allowed_clients = 127.0.0.1
pm = ondemand
pm.max_children = 5
pm.start_servers = 2
;pm.min_spare_servers = 2
;pm.max_spare_servers = 5
pm.process_idle_timeout = 10s;
pm.max_requests = 100
;pm.status_path = /status
;ping.path = /ping
;ping.response = pong
;access.log = log/$pool.access.log
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
;slowlog = log/$pool.log.slow
;request_slowlog_timeout = 0
;request_terminate_timeout = 0
;rlimit_files = 1024
;rlimit_core = 0
;chroot =
chdir = /
;catch_workers_output = yes
;clear_env = no
security.limit_extensions = .php .php3 .php4 .php5
;env[HOSTNAME] = $HOSTNAME
;env[PATH] = /usr/local/bin:/usr/bin:/bin
;env[TMP] = /tmp
;env[TMPDIR] = /tmp
;env[TEMP] = /tmp
;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
;php_flag[display_errors] = off
;php_admin_value[error_log] = /var/log/fpm-php.www.log
;php_admin_flag[log_errors] = on
;php_admin_value[memory_limit] = 32M
php_admin_value[open_basedir] = {{ nextcloud_install_path }}:/tmp:/dev/urandom:/proc/meminfo:/var/log
;php_admin_value[disable_functions] = mail,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_exec,passthru,system,proc_get_status,proc_close,proc_nice,proc_terminate,proc_open,curl_ini,parse_ini_file,show_source,dl,symlink,system_exec,exec,shell_exec,phpinfo

2
tests/inventory Normal file
View file

@ -0,0 +1,2 @@
localhost

5
tests/test.yml Normal file
View file

@ -0,0 +1,5 @@
---
- hosts: localhost
remote_user: root
roles:
- nextcloud

2
vars/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# vars file for nextcloud