From fc889a0d6d50c40555ee391b9d3f4c8dd8e06e37 Mon Sep 17 00:00:00 2001 From: lhahn Date: Sun, 20 Aug 2023 11:13:45 +0200 Subject: [PATCH] Git initial commit --- LICENSE | 9 ++ README.md | 3 + defaults/main.yml | 59 ++++++++++ handlers/main.yml | 23 ++++ meta/main.yml | 19 +++ tasks/coturn.yml | 32 +++++ tasks/file_hpb.yml | 44 +++++++ tasks/main.yml | 46 ++++++++ tasks/nextcloud.yml | 111 ++++++++++++++++++ .../etc/systemd/system/notify_push.service.j2 | 12 ++ vars/main.yml | 13 ++ 11 files changed, 371 insertions(+) create mode 100755 LICENSE create mode 100755 README.md create mode 100755 defaults/main.yml create mode 100755 handlers/main.yml create mode 100755 meta/main.yml create mode 100755 tasks/coturn.yml create mode 100755 tasks/file_hpb.yml create mode 100755 tasks/main.yml create mode 100755 tasks/nextcloud.yml create mode 100755 templates/etc/systemd/system/notify_push.service.j2 create mode 100755 vars/main.yml diff --git a/LICENSE b/LICENSE new file mode 100755 index 0000000..2071b23 --- /dev/null +++ b/LICENSE @@ -0,0 +1,9 @@ +MIT License + +Copyright (c) + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md new file mode 100755 index 0000000..4de85a6 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# cloud-nextcloud + +Ansible role to provide nextcloud \ No newline at end of file diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100755 index 0000000..e78f8af --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,59 @@ +--- +cloud_apps: /opt +cloud_storage: /opt/storage +cloud_stage: prod +cloud_update: false + +nextcloud_version: 23.0.1 + +www_group: www-data + +ncloud_db: + type: pgsql + name: ncloud_db + user: ncloud_dbu + pass: ncloud_dbpw + +ncloud_admin_user: "nc-admin" +ncloud_admin_pass: "nc-password" +ncloud_data_location: "{{ cloud_storage }}/nextcloud" +ncloud_npush_port: 7867 + +ncloud_domain: + - my_domain.tld +ncloud_config: + - key: default_phone_region + value: "'DE'" + + +redis_port: 6379 +redis_remote_url: "" + + +ncloud_coturn_pass: SomeRandomString +ncloud_coturn_port: 5349 +ncloud_coturn_parallel_connection: 0 #0 is unlimited +ncloud_coturn_bandwitdh: 0 #0 B/s is unlimited +ncloud_coturn_session_lifetime: 600 + +ncloud_coturn_cert: "/etc/letsencrypt/live/{{ ncloud_domain[0] }}/fullchain.pem" +ncloud_coturn_pkey: "/etc/letsencrypt/live/{{ ncloud_domain[0] }}/privkey.pem" +ncloud_coturn_dhparam: "/etc/letsencrypt/ssl-dhparams.pem" + +coturn_configs: + - "tls-listening-port={{ ncloud_coturn_port }}" + - fingerprint + - use-auth-secret + - "static-auth-secret={{ ncloud_coturn_pass }}" + - "realm={{ ncloud_domain[0] }}" + - "total-quota={{ ncloud_coturn_parallel_connection }}" + - "bps-capacity={{ ncloud_coturn_bandwitdh }}" + - "stale-nonce={{ ncloud_coturn_session_lifetime }}" + - cipher-list=\“ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384\″ + - no-multicast-peers + - no-tlsv1 + - no-tlsv1_1 + - no-stdout-log + - "cert={{ ncloud_coturn_cert }}" + - "pkey={{ ncloud_coturn_pkey }}" + - "dh-file={{ ncloud_coturn_dhparam }}" \ No newline at end of file diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100755 index 0000000..a52cb0a --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,23 @@ +--- +- name: restart redis + systemd: + name: redis + state: restarted + +- name: setup notify_push + command: + chdir: "{{ ncloud_dir }}" + cmd: "php occ notify_push:setup https://{{ ncloud_domain[0] }}/push" + become: yes + become_user: "{{ www_group }}" + +- name: restart notify_push + systemd: + name: notify_push + state: restarted + daemon_reload: yes + +- name: restart coturn + systemd: + name: coturn + state: restarted \ No newline at end of file diff --git a/meta/main.yml b/meta/main.yml new file mode 100755 index 0000000..9231502 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,19 @@ +--- +galaxy_info: + role_name: nextcloud + namespace: hahn-cloud + author: Lars Hahn + company: OpenDevChain + license: MIT + description: Role to setup nextcloud; shoudld be used in combination with an DB-, HTTP-Server and letsencrypt. + min_ansible_version: 2.7 + platforms: + - name: Debian + versions: + - 11 + galaxy_tags: + - nextcloud +dependencies: + - postgres + - php + - nginx diff --git a/tasks/coturn.yml b/tasks/coturn.yml new file mode 100755 index 0000000..eb4d732 --- /dev/null +++ b/tasks/coturn.yml @@ -0,0 +1,32 @@ +--- +- name: install coturn server + apt: + update_cache: yes + state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}" + install_recommends: yes + pkg: + - "coturn" + +- name: enable coturn server + lineinfile: + path: "/etc/default/coturn" + regexp: '^#?TURNSERVER_ENABLED=' + line: "TURNSERVER_ENABLED=1" + notify: restart coturn + +- name: enable coturn server + lineinfile: + path: "/etc/turnserver.conf" + regexp: '^#?{{ configline.split("=")[0] }}{% if configline.split("=") | length > 1 %}={% endif %}' + line: "{{ configline }}" + loop: "{{ coturn_configs }}" + loop_control: + loop_var: configline + label: "{{ configline }}" + notify: restart coturn + +- name: set coturn capabilities for port setting + capabilities: + path: /usr/bin/turnserver + capability: cap_net_bind_service=+ep + state: present diff --git a/tasks/file_hpb.yml b/tasks/file_hpb.yml new file mode 100755 index 0000000..e4db521 --- /dev/null +++ b/tasks/file_hpb.yml @@ -0,0 +1,44 @@ +--- +- name: install notify_push + command: + chdir: "{{ ncloud_dir }}" + creates: "{{ ncloud_dir }}/apps/notify_push" + cmd: php occ app:install notify_push + become: yes + become_user: "{{ www_group }}" + notify: setup notify_push + register: notify_push + +- name: enable notify_push + command: + chdir: "{{ ncloud_dir }}" + creates: "{{ ncloud_dir }}/apps/notify_push" + cmd: php occ app:enable notify_push + become: yes + become_user: "{{ www_group }}" + when: notify_push.changed + +- name: configure trusted proxies + blockinfile: + marker: "// {mark} ANSIBLE MANAGED BLOCK" + path: "{{ ncloud_dir }}/config/config.php" + block: | + 'trusted_proxies' => + array ( + {% for proxy in ncloud_notify_trusted_proxies %} + {{ loop.index - 1}} => '{{ proxy }}', + {% endfor %} + ), + insertbefore: "\\);" + +- name: setup notify_push systemd unit + template: + src: etc/systemd/system/notify_push.service.j2 + dest: /etc/systemd/system/notify_push.service + +- name: enable notify_push systemd unit + systemd: + name: notify_push + enabled: yes + daemon_reload: yes + state: started \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100755 index 0000000..fd43cd9 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,46 @@ +--- +- name: setup nextcloud group + group: + name: "{{ ncgrp }}" + state: "present" + +- name: setup nextcloud user + user: + name: "{{ ncusr }}" + group: "{{ ncgrp }}" + groups: + - "{{ ncgrp }}" + comment: Virtual Nextcloud User + shell: /sbin/nologin + state: present + +- name: setup nextcloud storage folder + file: + path: "{{ ncloud_data_location }}" + state: directory + owner: "{{ www_group }}" + group: "{{ ncgrp }}" + mode: "o=" + + +- name: install nextcloud recommendations + apt: + update_cache: yes + state: "{% if cloud_update | bool %}latest{% else %}present{% endif %}" + install_recommends: yes + pkg: + - "libxml2" + - "openssl" + - "ffmpeg" + - "libreoffice" + - "redis-server" + - "unzip" + +- name: install basic nextcloud + include_tasks: nextcloud.yml + +- name: install notify_push (file high-performance-backend) + include_tasks: file_hpb.yml + +- name: install coturn server + include_tasks: coturn.yml diff --git a/tasks/nextcloud.yml b/tasks/nextcloud.yml new file mode 100755 index 0000000..1479fc0 --- /dev/null +++ b/tasks/nextcloud.yml @@ -0,0 +1,111 @@ +--- +- name: download nextcloud and unarchive + unarchive: + src: "https://download.nextcloud.com/server/releases/nextcloud-{{ nextcloud_version }}.zip" + dest: "{{ cloud_apps }}" + remote_src: yes + owner: "{{ www_group }}" + group: "{{ ncgrp }}" + mode: "o=" + creates: "{{ ncloud_dir }}" + +- name: install nextcloud + command: + chdir: "{{ ncloud_dir }}" + creates: "{{ ncloud_data_location }}/index.html" + cmd: > + php occ maintenance:install + --database '{{ ncloud_db.type }}' + --database-name '{{ ncloud_db.name }}' + --database-user '{{ ncloud_db.user }}' + --database-pass '{{ ncloud_db.pass }}' + --admin-user '{{ ncloud_admin_user }}' + --admin-pass '{{ ncloud_admin_pass }}' + --data-dir '{{ ncloud_data_location }}' + become: yes + become_user: "{{ www_group }}" + register: ncloud_installation + +- name: set nextcloud folder permission + file: + path: "{{ ncloud_data_location }}" + owner: "{{ www_group }}" + group: "{{ ncusr }}" + mode: "o=" + recurse: yes + +- name: configure php cron jobs + cron: + name: nextcloud-php + minute: "*/5" + job: "php -f {{ ncloud_dir }}/cron.php" + user: "{{ www_group }}" + +- name: configure local memory caching APCu + lineinfile: + path: "{{ ncloud_dir }}/config/config.php" + regexp: "\\s*'memcache.local' => " + line: " 'memcache.local' => '\\OC\\Memcache\\APCu'," + insertbefore: "\\);" + when: ncloud_installation.changed + +- name: configure redis conig + lineinfile: + path: "/etc/redis/redis.conf" + regexp: "(# |){{ item.key }} " + line: "{{ item.key }} {{ item.value }}" + loop: + - key: unixsocket + value: "{{ redis_socket }}" + - key: unixsocketperm + value: 775 + - key: bind + value: 127.0.0.1 + - key: daemonize + value: !unsafe yes + - key: stop-writes-on-bgsave-error + value: !unsafe no + - key: rdbcompression + value: !unsafe yes + - key: maxmemory + value: 50M + - key: maxmemory-policy + value: allkeys-lru + when: redis_remote_url | length == 0 + notify: restart redis + +- name: configure distributed memory caching APCu + lineinfile: + path: "{{ ncloud_dir }}/config/config.php" + regexp: "\\s*'{{ item.key }}' => " + line: " '{{ item.key }}' => {{ item.value }}," + insertbefore: "\\);" + loop: + - key: memcache.locking + value: "'\\OC\\Memcache\\Redis'" +# - key: memcache.distributed +# value: "'\\OC\\Memcache\\Redis'" +# - key: redis +# value: "['host' => '{% if redis_remote_url | length > 0 %}{{ redis_remote_url }}{% else %}{{ redis_socket }}{% endif %}','port' => {% if redis_remote_url | length > 0 %}{{ redis_port }}{% else %}0{% endif %}]" + loop_control: + label: "{{ item.key }}" + when: ncloud_installation.changed + +- name: configure other settings + lineinfile: + path: "{{ ncloud_dir }}/config/config.php" + regexp: "\\s*'{{ item.key }}' => " + line: " '{{ item.key }}' => {{ item.value }}," + insertbefore: "\\);" + loop: "{{ ncloud_config }}" + loop_control: + label: "{{ item.key }}" + when: ncloud_installation.changed + + +- name: configure nextcloud domain + replace: + path: "{{ ncloud_dir }}/config/config.php" + regexp: "^\\s*'trusted_domains'\\s*=>\\s*array\\s*\\((.*\\n)+\\s*\\),$" + replace: " 'trusted_domains' => \\n array ({% for domain in ncloud_domain %}\\n {{ loop.index - 1}} => '{{ domain }}',{% endfor %}\\n )," + when: ncloud_installation.changed \ No newline at end of file diff --git a/templates/etc/systemd/system/notify_push.service.j2 b/templates/etc/systemd/system/notify_push.service.j2 new file mode 100755 index 0000000..732c138 --- /dev/null +++ b/templates/etc/systemd/system/notify_push.service.j2 @@ -0,0 +1,12 @@ +[Unit] +Description=Push daemon for Nextcloud clients +Documentation=https://github.com/nextcloud/notify_push + +[Service] +Environment=PORT={{ ncloud_npush_port }} +Environment=NEXTCLOUD_URL=https://{{ ncloud_domain[0] }} +ExecStart={{ ncloud_dir }}/apps/notify_push/bin/x86_64/notify_push {{ ncloud_dir }}/config/config.php +User={{ www_group }} + +[Install] +WantedBy = multi-user.target diff --git a/vars/main.yml b/vars/main.yml new file mode 100755 index 0000000..87b003d --- /dev/null +++ b/vars/main.yml @@ -0,0 +1,13 @@ +--- +ncusr: "ncloud" +ncgrp: "{{ ncusr }}" + +ncloud_dir: "{{ cloud_apps }}/nextcloud" + +redis_socket: "/var/run/redis/redis-server.sock" + +ncloud_notify_trusted_proxies: + - "127.0.0.1" + - "::1" + - "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}" + - "{{ hostvars[inventory_hostname]['ansible_default_ipv6']['address'] }}" \ No newline at end of file