- - name: 'install requirements'
- apt:
- pkg:
- - 'sudo'
- - 'bzip2'
- #- 'ffmpeg'
- - 'postgresql'
- - 'postgresql-contrib'
- - 'python3-psycopg2'
- - 'ca-certificates'
- state: 'present'
- update_cache: true
- cache_valid_time: 3600
- tags:
- - 'packages'
-
- - name: 'install php'
- import_role: name='service'
- vars:
- service_name: 'php7.4-fpm'
- service_packages:
- - 'php7.4-fpm'
- - 'php7.4-common'
- - 'php7.4-xml'
- - 'php7.4-gd'
- - 'php7.4-json'
- - 'php7.4-mbstring'
- - 'php7.4-zip'
- - 'php7.4-pgsql'
- - 'php7.4-ldap'
- - 'php7.4-curl'
- - 'php7.4-intl'
- - 'php7.4-bz2'
- - 'php7.4-redis'
- - 'php7.4-apcu'
- - 'php-imagick'
- - 'php7.4-bcmath'
- - 'php7.4-gmp'
-
- - block:
- - name: 'create nextcloud DB'
- postgresql_db:
- name: 'nextcloud'
- - name: 'create nextcloud DB user'
- postgresql_user:
- name: 'www-data'
- db: 'nextcloud'
- priv: 'ALL'
- become: true
- become_method: 'su'
- become_user: 'postgres'
-
- - name: 'configure php-fpm'
- lineinfile:
- path: '/etc/php/7.4/fpm/pool.d/www.conf'
- line: '{{ item.line }}'
- regexp: '{{ item.regexp }}'
- loop:
- - { line: 'env[PATH] = /usr/local/bin:/usr/bin:/bin', regexp: '^;?env\[PATH\] = ' }
- - { line: 'env[TEMP] = /tmp', regexp: '^;?env\[TEMP\] = ' }
- - { line: 'env[TMP] = /tmp', regexp: '^;?env\[TMP\] = ' }
- - { line: 'env[TMPDIR] = /tmp', regexp: '^;?env\[TMPDIR\] = ' }
- - { line: 'pm = dynamic', regexp: '^;?pm = ' }
- - { line: 'pm.max_children = 120', regexp: '^;?pm.max_children = ' }
- - { line: 'pm.start_servers = 12', regexp: '^;?pm.start server = ' }
- - { line: 'pm.min_spare_servers = 6', regexp: '^;?pm.min_spare_servers = ' }
- - { line: 'pm.max_spare_servers = 18', regexp: '^;?pm.max_spare_servers = ' }
- notify: 'restart php7.4-fpm'
-
- - name: 'configure php.ini'
- lineinfile:
- path: '/etc/php/7.4/fpm/php.ini'
- line: '{{ item.line }}'
- regexp: '{{ item.regexp }}'
- loop:
- - { line: 'memory_limit = 512M', regexp: '^memory_limit =' }
- - { line: 'opcache.enable=1', regexp: '^[;]?opcache_enable=' }
- - { line: 'opcache.interned_strings_buffer=8', regexp: '^;?opcache.interned_strings_buffer=' }
- - { line: 'opcache.max_accelerated_files=10000', regexp: '^;?opcache.max_accelerated_files=' }
- - { line: 'opcache.memory_consumption=128', regexp: '^;?opcache.memory_consumption=' }
- - { line: 'opcache.save_comments=1', regexp: '^;?opcache.save_comments=' }
- - { line: 'opcache.revalidate_freq=1', regexp: '^;?opcache.revalidate_freq=' }
- notify: 'restart php7.4-fpm'
-
- - name: 'download nextcloud'
- get_url:
- url: 'https://download.nextcloud.com/server/releases/nextcloud-{{ nextcloud_version }}.tar.bz2'
- dest: '/opt/nextcloud.tar.bz2'
- register: 'nextcloud_new_download'
- tags:
- - 'packages'
-
- - name: 'unpack nextcloud'
- unarchive:
- remote_src: true
- src: '/opt/nextcloud.tar.bz2'
- dest: '/opt'
- owner: 'www-data'
- group: 'www-data'
- mode: '0750'
- when: nextcloud_new_download.changed
- tags:
- - 'packages'
-
- - name: 'create nextcloud data folder'
- file:
- path: '/opt/nextcloud_data'
- owner: 'www-data'
- group: 'www-data'
- state: 'directory'
-
- - name: 'create nginx configuration'
- template:
- src: 'nextcloud.conf.j2'
- dest: '/etc/nginx/locations/{{ nextcloud_nginx_fqdn }}/nextcloud.conf'
- notify: 'reload nginx'
-
- - import_tasks: 'occ.yaml'
- vars:
- occ_args: '--no-warnings status --output json'
- ignore_changes: true
-
- - name: 'read installation status'
- set_fact:
- nextcloud_installed: '{{ occ_out.installed }}'
-
- - block:
- - name: 'create random root password'
- gen_passwd: length=20
- register: 'nextcloud_password'
- no_log: true
- - name: 'set initial root password'
- set_fact:
- nextcloud_initial_root_password: '{{ nextcloud_password.passwd }}'
- no_log: true
- - name: 'store root password plaintext'
- copy:
- content: '{{ nextcloud_initial_root_password }}'
- dest: '/etc/nextcloud.secret'
- mode: '0700'
- no_log: true
- diff: false
- - name: 'emit warning for initial_root_password not set'
- fail:
- msg: >-
- Warning! First Install and `initial_root_password` not provided.
- Random password generated and stored in /etc/nextcloud.secret.
- **WIPE AS SOON AS POSSIBLE**
- failed_when: false
- when: (nextcloud_initial_root_password is not defined) and (not nextcloud_installed)
-
- - name: 'install nextcloud'
- include_tasks: 'occ.yaml'
- vars:
- occ_args: >-
- maintenance:install
- --database 'pgsql'
- --database-name 'nextcloud'
- --database-host '/var/run/postgresql'
- --database-user 'www-data'
- --database-pass ''
- --admin-pass '{{ nextcloud_initial_root_password }}'
- --data-dir '/opt/nextcloud_data'
- --no-interaction
- nojson: true
- when: not nextcloud_installed
-
- - name: 'set trusted_domains'
- occ:
- command: 'config:system:set'
- key: 'trusted_domains {{ idx }}'
- value: '{{ item }}'
- loop: '{{ [ "localhost", nextcloud_nginx_fqdn ] + nextcloud_nginx_alternate_fqdns }}'
- loop_control:
- index_var: idx
-
- - name: 'update tls ldap server ca'
- copy:
- content: '{{ ldap_tls_server_ca }}'
- dest: '/etc/ldap/server_ca.crt'
- tags:
- - 'tls_int'
-
- - name: 'configure ldap client'
- copy:
- src: 'ldap.conf'
- dest: '/etc/ldap/ldap.conf'
- when: ldap_tls_enabled
-
- - name: 'enable user_ldap'
- occ:
- command: 'config:app:set'
- key: 'user_ldap enabled'
- value: 'yes'
- register: nextcloud_ldap_was_disabled
- tags:
- - 'service_password'
-
- - name: 'insall app user_ldap'
- import_tasks: 'occ.yaml'
- vars:
- occ_args: 'app:enable user_ldap'
- nojson: true
- ignore_changes: true
-
- - name: 'configure user_ldap'
- occ:
- command: 'config:app:set'
- key: 'user_ldap s01{{ item.key }}'
- value: '{{ item.value }}'
- loop: '{{ ldap_settings|dict2items }}'
- vars:
- ldap_settings:
- has_memberof_filter_support: '0'
- use_memberof_to_detect_membership: '0'
- ldap_host: '{{ ldap_server }}'
- ldap_port: '389'
- ldap_dn: 'cn={{ host_fqdn }},ou=Server,{{ ldap_basedn }}'
- ldap_base: 'ou=People,{{ ldap_basedn }}'
- ldap_base_users: 'ou=People,{{ ldap_basedn }}'
- ldap_base_groups: 'ou=Group,{{ ldap_basedn }}'
- ldap_login_filter: '(&(uid=%uid)(authorizedService=nextcloud))'
- ldap_user_filter: '(authorizedService=nextcloud)'
- ldap_userlist_filter: '(authorizedService=nextcloud)'
- ldap_group_filter: '(&(objectClass=groupOfNames)(authorizedService=nextcloud))'
- ldap_group_display_name: 'description'
- ldap_group_member_assoc_attribute: 'member'
- ldap_attributes_for_user_search: 'cn'
- ldap_attributes_for_group_search: 'cn'
- ldap_display_name: 'cn'
- ldap_display_name2: 'uid'
- ldap_email_attr: 'mail'
- ldap_tls: '{{ 1 if ldap_tls_enabled else 0 }}'
- ldap_experienced_admin: '1'
- ldap_configuration_active: '1'
- ldap_expert_username_attr: 'uid'
- ldap_paging_size: '0'
- tags:
- - 'ldap'
-
- - name: 'generate nextcloud ldap password'
- gen_passwd: 'length=32'
- register: 'nextcloud_ldap_passwd'
- no_log: true
- when:
- - ldap_admin_dn is defined
- - ldap_admin_pw is defined
- tags:
- - 'service_password'
-
- - name: 'set nextcloud ldap password in ldap'
- delegate_to: 'localhost'
- ldap_passwd:
- dn: 'cn={{ host_fqdn }},ou=Server,{{ ldap_basedn }}'
- passwd: '{{ nextcloud_ldap_passwd.passwd }}'
- server_uri: 'ldap://{{ ldap_server }}'
- start_tls: '{{ ldap_tls_enabled }}'
- bind_dn: '{{ ldap_admin_dn }}'
- bind_pw: '{{ ldap_admin_pw }}'
- when: nextcloud_ldap_passwd.changed
- register: nextcloud_ldap_passwd_result
- tags:
- - 'service_password'
-
- - name: 'configure nextcloud ldap password with occ'
- import_tasks: 'occ.yaml'
- vars:
- occ_args: 'ldap:set-config s01 ldapAgentPassword {{ nextcloud_ldap_passwd.passwd }}'
- nojson: true
- no_log: true
- when: nextcloud_ldap_passwd_result.changed
- tags:
- - 'service_password'
-
- - name: 'MONITORING | add HTTP service'
- block:
- - name: 'MONITORING | add service to monitoring entry'
- set_fact:
- monitoring_entry: >
- {{ monitoring_entry | default({}) | combine({
- 'address': ansible_host,
- 'vhosts_uri': { nextcloud_nginx_fqdn: {'/': { 'content': 'nextcloud.com'}} },
- }, recursive=true) }}
- - name: 'MONITORING | update monitoring facts'
- set_fact:
- monitoring_facts: >
- {{ hostvars[monitoring_host]['monitoring_facts']
- | default({})
- | combine({host_fqdn: monitoring_entry}) }}
- delegate_facts: true
- delegate_to: '{{ monitoring_host }}'
- tags:
- - 'monitoring'
- ...
|
