Git initial commit

roles/nextcloud/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

roles/nextcloud/README.md

@@ -0,0 +1,3 @@
+# cloud-nextcloud
+
+Ansible role to provide nextcloud

roles/nextcloud/defaults/main.yml

@@ -0,0 +1,59 @@
+---
+cloud_apps: /opt
+cloud_storage: /opt/storage
+cloud_stage: prod
+cloud_update: false
+
+nextcloud_version: 23.0.1
+
+www_group: www-data
+
+ncloud_db:
+  type: pgsql
+  name: ncloud_db
+  user: ncloud_dbu
+  pass: ncloud_dbpw
+
+ncloud_admin_user: "nc-admin"
+ncloud_admin_pass: "nc-password"
+ncloud_data_location: "{{ cloud_storage }}/nextcloud"
+ncloud_npush_port: 7867
+
+ncloud_domain:
+  - my_domain.tld
+ncloud_config:
+  - key: default_phone_region
+    value: "'DE'"
+
+
+redis_port: 6379
+redis_remote_url: ""
+
+
+ncloud_coturn_pass: SomeRandomString
+ncloud_coturn_port: 5349
+ncloud_coturn_parallel_connection: 0 #0 is unlimited
+ncloud_coturn_bandwitdh: 0 #0 B/s is unlimited
+ncloud_coturn_session_lifetime: 600
+
+ncloud_coturn_cert: "/etc/letsencrypt/live/{{ ncloud_domain[0] }}/fullchain.pem"
+ncloud_coturn_pkey: "/etc/letsencrypt/live/{{ ncloud_domain[0] }}/privkey.pem"
+ncloud_coturn_dhparam: "/etc/letsencrypt/ssl-dhparams.pem"
+
+coturn_configs:
+  - "tls-listening-port={{ ncloud_coturn_port }}"
+  - fingerprint
+  - use-auth-secret
+  - "static-auth-secret={{ ncloud_coturn_pass }}"
+  - "realm={{ ncloud_domain[0] }}"
+  - "total-quota={{ ncloud_coturn_parallel_connection }}"
+  - "bps-capacity={{ ncloud_coturn_bandwitdh }}"
+  - "stale-nonce={{ ncloud_coturn_session_lifetime }}"
+  - cipher-list=\“ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384\″
+  - no-multicast-peers
+  - no-tlsv1
+  - no-tlsv1_1
+  - no-stdout-log
+  - "cert={{ ncloud_coturn_cert }}"
+  - "pkey={{ ncloud_coturn_pkey }}"
+  - "dh-file={{ ncloud_coturn_dhparam }}"

roles/nextcloud/handlers/main.yml

@@ -0,0 +1,23 @@
+---
+- name: restart redis
+  systemd:
+    name: redis
+    state: restarted
+
+- name: setup notify_push
+  command:
+    chdir: "{{ ncloud_dir }}"
+    cmd: "php occ notify_push:setup https://{{ ncloud_domain[0] }}/push"
+  become: yes
+  become_user: "{{ www_group }}"
+
+- name: restart notify_push
+  systemd:
+    name: notify_push
+    state: restarted
+    daemon_reload: yes
+
+- name: restart coturn
+  systemd:
+    name: coturn
+    state: restarted

roles/nextcloud/meta/.galaxy_install_info

@@ -0,0 +1,2 @@
+install_date: 'So 29 Mai 2022 13:55:11 '
+version: ''

roles/nextcloud/meta/main.yml

@@ -0,0 +1,19 @@
+---
+galaxy_info:
+  role_name: nextcloud
+  namespace: hahn-cloud
+  author: Lars Hahn
+  company: OpenDevChain
+  license: MIT
+  description: Role to setup nextcloud; shoudld be used in combination with an DB-, HTTP-Server and letsencrypt.
+  min_ansible_version: 2.7
+  platforms:
+    - name: Debian
+      versions:
+        - 11
+  galaxy_tags:
+    - nextcloud
+dependencies:
+  - postgres
+  - php
+  - nginx

roles/nextcloud/tasks/coturn.yml

@@ -0,0 +1,32 @@
+---
+- name: install coturn server
+  apt:
+    update_cache: yes
+    state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
+    install_recommends: yes
+    pkg:
+      - "coturn"
+
+- name: enable coturn server
+  lineinfile:
+    path: "/etc/default/coturn"
+    regexp: '^#?TURNSERVER_ENABLED='
+    line: "TURNSERVER_ENABLED=1"
+  notify: restart coturn
+
+- name: enable coturn server
+  lineinfile:
+    path: "/etc/turnserver.conf"
+    regexp: '^#?{{ configline.split("=")[0] }}{% if configline.split("=") | length > 1 %}={% endif %}'
+    line: "{{ configline }}"
+  loop: "{{ coturn_configs }}"
+  loop_control:
+    loop_var: configline
+    label: "{{ configline }}"
+  notify: restart coturn
+
+- name: set coturn capabilities for port setting
+  capabilities:
+    path: /usr/bin/turnserver
+    capability: cap_net_bind_service=+ep
+    state: present

roles/nextcloud/tasks/file_hpb.yml

@@ -0,0 +1,44 @@
+---
+- name: install notify_push
+  command:
+    chdir: "{{ ncloud_dir }}"
+    creates: "{{ ncloud_dir }}/apps/notify_push"
+    cmd: php occ app:install notify_push
+  become: yes
+  become_user: "{{ www_group }}"
+  notify: setup notify_push
+  register: notify_push
+
+- name: enable notify_push
+  command:
+    chdir: "{{ ncloud_dir }}"
+    creates: "{{ ncloud_dir }}/apps/notify_push"
+    cmd: php occ app:enable notify_push
+  become: yes
+  become_user: "{{ www_group }}"
+  when: notify_push.changed
+
+- name: configure trusted proxies
+  blockinfile:
+    marker: "// {mark} ANSIBLE MANAGED BLOCK"
+    path: "{{ ncloud_dir }}/config/config.php"
+    block: |
+      'trusted_proxies' => 
+      array (
+        {% for proxy in ncloud_notify_trusted_proxies %}
+        {{ loop.index - 1}} => '{{ proxy }}',
+        {% endfor %}
+      ),
+    insertbefore: "\\);"
+
+- name: setup notify_push systemd unit
+  template:
+    src: etc/systemd/system/notify_push.service.j2
+    dest: /etc/systemd/system/notify_push.service
+
+- name: enable notify_push systemd unit
+  systemd:
+    name: notify_push
+    enabled: yes
+    daemon_reload: yes
+    state: started

roles/nextcloud/tasks/main.yml

@@ -0,0 +1,46 @@
+---
+- name: setup nextcloud group
+  group:
+    name: "{{ ncgrp }}"
+    state: "present"
+
+- name: setup nextcloud user
+  user:
+    name: "{{ ncusr }}"
+    group: "{{ ncgrp }}"
+    groups:
+      - "{{ ncgrp }}"
+    comment: Virtual Nextcloud User
+    shell: /sbin/nologin
+    state: present
+
+- name: setup nextcloud storage folder
+  file:
+    path: "{{ ncloud_data_location }}"
+    state: directory
+    owner: "{{ www_group }}"
+    group: "{{ ncgrp }}"
+    mode: "o="
+
+
+- name: install nextcloud recommendations
+  apt:
+    update_cache: yes
+    state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}"
+    install_recommends: yes
+    pkg:
+      - "libxml2"
+      - "openssl"
+      - "ffmpeg"
+      - "libreoffice"
+      - "redis-server"
+      - "unzip"
+
+- name: install basic nextcloud
+  include_tasks: nextcloud.yml
+
+- name: install notify_push (file high-performance-backend)
+  include_tasks: file_hpb.yml
+
+- name: install coturn server
+  include_tasks: coturn.yml

roles/nextcloud/tasks/nextcloud.yml

@@ -0,0 +1,111 @@
+---
+- name: download nextcloud and unarchive
+  unarchive:
+    src: "https://download.nextcloud.com/server/releases/nextcloud-{{ nextcloud_version }}.zip"
+    dest: "{{ cloud_apps }}"
+    remote_src: yes
+    owner: "{{ www_group }}"
+    group: "{{ ncgrp }}"
+    mode: "o="
+    creates: "{{ ncloud_dir }}"
+
+- name: install nextcloud
+  command:
+    chdir: "{{ ncloud_dir }}"
+    creates: "{{ ncloud_data_location }}/index.html"
+    cmd: >
+      php occ maintenance:install
+      --database '{{ ncloud_db.type }}'
+      --database-name '{{ ncloud_db.name }}'
+      --database-user '{{ ncloud_db.user }}'
+      --database-pass '{{ ncloud_db.pass }}'
+      --admin-user '{{ ncloud_admin_user }}'
+      --admin-pass '{{ ncloud_admin_pass }}'
+      --data-dir '{{ ncloud_data_location }}'
+  become: yes
+  become_user: "{{ www_group }}"
+  register: ncloud_installation
+
+- name: set nextcloud folder permission
+  file:
+    path: "{{ ncloud_data_location }}"
+    owner: "{{ www_group }}"
+    group: "{{ ncusr }}"
+    mode: "o="
+    recurse: yes
+
+- name: configure php cron jobs
+  cron: 
+    name: nextcloud-php
+    minute: "*/5"
+    job: "php -f {{ ncloud_dir }}/cron.php"
+    user: "{{ www_group }}"
+
+- name: configure local memory caching APCu
+  lineinfile:
+    path: "{{ ncloud_dir }}/config/config.php"
+    regexp: "\\s*'memcache.local' => "
+    line: "  'memcache.local' => '\\OC\\Memcache\\APCu',"
+    insertbefore: "\\);"
+  when: ncloud_installation.changed
+
+- name: configure redis conig
+  lineinfile:
+    path: "/etc/redis/redis.conf"
+    regexp: "(# |){{ item.key }} "
+    line: "{{ item.key }} {{ item.value }}"
+  loop:
+    - key: unixsocket
+      value: "{{ redis_socket }}"
+    - key: unixsocketperm
+      value: 775
+    - key: bind
+      value: 127.0.0.1
+    - key: daemonize
+      value: !unsafe yes
+    - key: stop-writes-on-bgsave-error
+      value: !unsafe no
+    - key: rdbcompression
+      value: !unsafe yes
+    - key: maxmemory
+      value: 50M
+    - key: maxmemory-policy
+      value: allkeys-lru
+  when: redis_remote_url | length == 0
+  notify: restart redis
+
+- name: configure distributed memory caching APCu
+  lineinfile:
+    path: "{{ ncloud_dir }}/config/config.php"
+    regexp: "\\s*'{{ item.key }}' => "
+    line: "  '{{ item.key }}' => {{ item.value }},"
+    insertbefore: "\\);"
+  loop:
+     - key: memcache.locking
+       value: "'\\OC\\Memcache\\Redis'"
+#    - key: memcache.distributed
+#      value: "'\\OC\\Memcache\\Redis'"
+#    - key: redis
+#      value: "['host' => '{% if redis_remote_url | length > 0 %}{{ redis_remote_url }}{% else %}{{ redis_socket }}{% endif %}','port' => {% if redis_remote_url | length > 0 %}{{ redis_port }}{% else %}0{% endif %}]"
+  loop_control:
+    label: "{{ item.key }}"
+  when: ncloud_installation.changed
+
+- name: configure other settings
+  lineinfile:
+    path: "{{ ncloud_dir }}/config/config.php"
+    regexp: "\\s*'{{ item.key }}' => "
+    line: "  '{{ item.key }}' => {{ item.value }},"
+    insertbefore: "\\);"
+  loop: "{{ ncloud_config }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: ncloud_installation.changed
+
+
+- name: configure nextcloud domain
+  replace:
+    path: "{{ ncloud_dir }}/config/config.php"
+    regexp: "^\\s*'trusted_domains'\\s*=>\\s*array\\s*\\((.*\\n)+\\s*\\),$"
+    replace: "  'trusted_domains' => \\n  array ({% for domain in ncloud_domain %}\\n    {{ loop.index - 1}} => '{{ domain }}',{% endfor %}\\n  ),"
+  when: ncloud_installation.changed

roles/nextcloud/templates/etc/systemd/system/notify_push.service.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Push daemon for Nextcloud clients
+Documentation=https://github.com/nextcloud/notify_push
+
+[Service]
+Environment=PORT={{ ncloud_npush_port }}
+Environment=NEXTCLOUD_URL=https://{{ ncloud_domain[0] }}
+ExecStart={{ ncloud_dir }}/apps/notify_push/bin/x86_64/notify_push {{ ncloud_dir }}/config/config.php
+User={{ www_group }}
+
+[Install]
+WantedBy = multi-user.target

roles/nextcloud/vars/main.yml

@@ -0,0 +1,13 @@
+---
+ncusr: "ncloud"
+ncgrp: "{{ ncusr }}"
+
+ncloud_dir: "{{ cloud_apps }}/nextcloud"
+
+redis_socket: "/var/run/redis/redis-server.sock"
+
+ncloud_notify_trusted_proxies:
+  - "127.0.0.1"
+  - "::1"
+  - "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
+  - "{{ hostvars[inventory_hostname]['ansible_default_ipv6']['address'] }}"