From 013d64f1d79732eada87cce79afaee6cfddb93e4 Mon Sep 17 00:00:00 2001 From: akshay Date: Mon, 20 Jan 2025 06:12:50 +0530 Subject: [PATCH] Nextcloud playbook tasks update --- README.md | 20 +- ansible-install.sh | 4 + main.yml | 4 +- roles/collaboraoffice/handlers/main.yml | 5 + roles/collaboraoffice/tasks/main.yml | 38 ++ .../templates/collaboraonline.sources | 4 + .../templates/coolwsd-nginx.j2 | 82 +++++ .../collaboraoffice/templates/coolwsd.xml.j2 | 333 ++++++++++++++++++ roles/mysql/tasks/main.yml | 89 ++--- roles/nextcloud/tasks/main.yml | 86 +++-- roles/nextcloud/templates/nextcloud.j2 | 136 +++++++ roles/postgres/tasks/main.yml | 61 ++-- vars.yml | 144 ++++---- 13 files changed, 836 insertions(+), 170 deletions(-) create mode 100755 ansible-install.sh create mode 100644 roles/collaboraoffice/handlers/main.yml create mode 100644 roles/collaboraoffice/tasks/main.yml create mode 100644 roles/collaboraoffice/templates/collaboraonline.sources create mode 100644 roles/collaboraoffice/templates/coolwsd-nginx.j2 create mode 100644 roles/collaboraoffice/templates/coolwsd.xml.j2 create mode 100644 roles/nextcloud/templates/nextcloud.j2 diff --git a/README.md b/README.md index 7316729..f4ca992 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,16 @@ -# Ansible playbook for Nextcloud with MySQL/PostgreSQL -This playbook downloads and installs Nextcloud and its required database. The database options are either MySQL or PostgreSQL. Default values are given in [variables file](vars.yml) and it must be modified accordingly. +# Ansible playbook for Nextcloud +This playbook download and install Nextcloud along with mail and collabora office integration. The database options are MySQL or PostgreSQL. Default values are given in [variables file](vars.yml) and it must be modified accordingly. ### [Variables File](vars.yml) + domainname: Domain name nc_admin_username: Nextcloud dmin username nc_admin_pass: Nextcloud admin password +nc_app_list: List of apps to be installed in nextcloud + nc_root: Root folder for Nextcloud. nc_trusted_domains: Domains/IP for accessing nextcloud. This is in dictionary format. The format for adding multiple domains is given below @@ -18,8 +21,15 @@ nc_trusted_domains: Domains/IP for accessing nextcloud. This is in dictionary fo ``` nc_version: Nextcloud version which is to be downloaded +#### Collabora office integration +collabora_nc_apps: Apps to be installed for collabora office integration + +collabora_packages: Debian packages to be installed + +collabora_server: Host running coolwsd [Collabora]. Default is https://example.com:8443 + #### Database configuration -nc_db: Database software used. Currently supports MySQL(mysql) and PostgreSQL(pgsql) +nc_db: Database software used. Currently supports MySQL [mysql] and PostgreSQL [pgsql] nc_db_host: Host running database. @@ -30,7 +40,9 @@ nc_db_user: Name of role/database user for accessing the database nc_db_pass: Role/Database user password #### LDAP configration -ldapBaseDN: Base DN for LDAP. This role uses freeipa dn structure hence the default value is cn=users,cn=accounts,dc=example,dc=com. Inorder to change the default Base DN value modify roles/nextcloud/tasks/main.yml Line 24. +ldapsuffix: Creates suffix [dc=example,dc=com] from domain [example.com]. This variable is registered by [nextcloud role](roles/nextcloud/tasks/main.yml) Line 16 + +ldapBaseDN: Base DN for LDAP. This role uses freeipa dn structure hence the default value is cn=users,cn=accounts,dc=example,dc=com. Variable is registered by [nextcloud role](roles/nextcloud/tasks/main.yml) Line 24. ldapAgentName: DN of LDAP user that is used for ldap connection. diff --git a/ansible-install.sh b/ansible-install.sh new file mode 100755 index 0000000..94ab84a --- /dev/null +++ b/ansible-install.sh @@ -0,0 +1,4 @@ +#! /bin/bash +apt install ansible +ansible-galaxy collection install community.postgresql +ansible-galaxy collection install community.mysql diff --git a/main.yml b/main.yml index 296fca9..3b128a5 100644 --- a/main.yml +++ b/main.yml @@ -4,6 +4,8 @@ remote_user: root vars_files: - vars.yml - roles: + roles: - mysql + - postgres - nextcloud + - collaboraoffice diff --git a/roles/collaboraoffice/handlers/main.yml b/roles/collaboraoffice/handlers/main.yml new file mode 100644 index 0000000..2e593d3 --- /dev/null +++ b/roles/collaboraoffice/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Restart nginx + service: + name: nginx + state: restarted diff --git a/roles/collaboraoffice/tasks/main.yml b/roles/collaboraoffice/tasks/main.yml new file mode 100644 index 0000000..8f93533 --- /dev/null +++ b/roles/collaboraoffice/tasks/main.yml @@ -0,0 +1,38 @@ +--- +- name: Import signing key + get_url: + url: https://collaboraoffice.com/downloads/gpg/collaboraonline-release-keyring.gpg + dest: /usr/share/keyrings + +- name: Add CODE package repository + template: + src: collaboraonline.sources + dest: /etc/apt/sources.list.d/ + +- name: Install packages + apt: + name: "{{ collabora_packages }}" + state: present + update_cache: yes + +- name: Copy configuration and restart nginx + template: + src: coolwsd.j2 + dest: /etc/nginx/sites-enabled/coolwsd + notify: Restart nginx +- name: Copy Collobora config file. + template: + src: coolwsd.xml.j2 + dest: /etc/coolwsd/coolwsd.xml + +- name: Install collabora app for nextcloud + shell: occ app:install "{{ item }}" + with_items: + - "{{ collabora_nc_apps }}" + +- name: Configure app using occ + shell: "{{ item }}" + with_items: + - occ config:app:set --value "{{ collabora_server }}" richdocuments wopi_url + - occ richdocuments:activate-config + diff --git a/roles/collaboraoffice/templates/collaboraonline.sources b/roles/collaboraoffice/templates/collaboraonline.sources new file mode 100644 index 0000000..4568fbb --- /dev/null +++ b/roles/collaboraoffice/templates/collaboraonline.sources @@ -0,0 +1,4 @@ +Types: deb +URIs: https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-deb +Suites: ./ +Signed-By: /usr/share/keyrings/collaboraonline-release-keyring.gpg diff --git a/roles/collaboraoffice/templates/coolwsd-nginx.j2 b/roles/collaboraoffice/templates/coolwsd-nginx.j2 new file mode 100644 index 0000000..4d71417 --- /dev/null +++ b/roles/collaboraoffice/templates/coolwsd-nginx.j2 @@ -0,0 +1,82 @@ +server { + listen *:8443 http2 ssl; + ssl on; + + ssl_certificate /etc/letsencrypt/live/{{ domainname }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ domainname }}/privkey.pem; + ssl_session_timeout 5m; + + ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES"; + ssl_prefer_server_ciphers on; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + gzip_types text/plain text/css application/json application/x-javascript + text/xml application/xml application/xml+rss text/javascript; + + server_name {{ domainname }}; + + # static files + location ^~ /browser { + proxy_pass http://127.0.0.1:9980; + proxy_set_header Host $http_host; + } + + # WOPI discovery URL + location ^~ /hosting/discovery { + proxy_pass http://127.0.0.1:9980; + proxy_set_header Host $http_host; + } + + # Capabilities + location ^~ /hosting/capabilities { + proxy_pass http://127.0.0.1:9980; + proxy_set_header Host $http_host; + } + + # main websocket + location ~ ^/cool/(.*)/ws$ { + proxy_pass http://127.0.0.1:9980; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header Host $http_host; + proxy_read_timeout 36000s; + } + + # download, presentation and image upload + location ~ ^/(c|l)ool { + proxy_pass http://127.0.0.1:9980; + proxy_set_header Host $http_host; + } + + # Admin Console websocket + location ^~ /cool/adminws { + proxy_pass http://127.0.0.1:9980; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "Upgrade"; + proxy_set_header Host $http_host; + proxy_read_timeout 36000s; + } +} + diff --git a/roles/collaboraoffice/templates/coolwsd.xml.j2 b/roles/collaboraoffice/templates/coolwsd.xml.j2 new file mode 100644 index 0000000..8fb6cf8 --- /dev/null +++ b/roles/collaboraoffice/templates/coolwsd.xml.j2 @@ -0,0 +1,333 @@ + + + + + + + + + + false + + + de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru + + + + + + + + + + + + + false + + + + + + + + + {{ domain_name }}:8443 + + + true + + + 1 + + + 4 + 5 + false + 96 + 3600 + 30 + 300 + false + 0 + 8000 + 0 + 0 + 100 + 5 + 100 + 500 + 5000 + + 10000 + 60 + 300 + 3072 + 85 + 120 + + + + + true + 300 + 900 + + + + + + + true + + debug + trace + notice + fatal + false + + -INFO-WARN + + + /var/log/coolwsd.log + never + timestamp + true + 10 days + 10 + true + false + + + false + 82589933 + + false + false + + + + + /var/log/coolwsd.trace.json + + + false + + + + + + + + false + + + + + + all + any + + + + 192\.168\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3} + 127\.0\.0\.1 + ::ffff:127\.0\.0\.1 + ::1 + 172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3} + 172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3} + 172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3} + 10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} + + + 192\.168\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3} + 127\.0\.0\.1 + ::ffff:127\.0\.0\.1 + ::1 + 172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3} + 172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3} + 172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3} + 10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} + ::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} + localhost + + + + + + + + + + + + true + + false + /etc/coolwsd/cert.pem + /etc/coolwsd/key.pem + + + + 1000 + + + + + + + false + 31536000 + + + + + true + true + 1800 + false + 1 + false + false + + + + + + + + + + + + + + default + true + + + + + + 0 + + 900 + + + + + + https://{{ domain_name }}:443 + https://{{ domain_name }} + https://{{ domain_name }}:8443 + + + + + + + + true + false + /etc/coolwsd/cert.pem + /etc/coolwsd/key.pem + + + + + + + true + false + + + + true + true + true + true + + + + + + + + + + + + + + + + + + + false + + + + + + + false + + + + log + + + + + + + + + + + + true + + + https://help.collaboraoffice.com/help.html? + + + true + + + + + + + + diff --git a/roles/mysql/tasks/main.yml b/roles/mysql/tasks/main.yml index 165a302..65ecdda 100644 --- a/roles/mysql/tasks/main.yml +++ b/roles/mysql/tasks/main.yml @@ -1,44 +1,47 @@ --- -- name: Install MySQL packages - apt: - name: "{{ mysql_packages }}" - state: present - -- name: Create DB user - {{ nc_db_user }} - community.mysql.mysql_user: - name: "{{ nc_db_user }}" - password: "{{ nc_db_pass }}" - login_unix_socket: /var/run/mysqld/mysqld.sock - register: mysql_user - -- debug: - var: mysql_user - -- name: Create DB - community.mysql.mysql_db: - name: "{{ nc_db_name }}" - encoding: utf8mb4 - collation: utf8mb4_general_ci - login_unix_socket: /var/run/mysqld/mysqld.sock - state: present - register: mysql_db -- debug: - var: mysql_db - -- name: Grant all privilages to {{ nc_db_name }} - community.mysql.mysql_user: - name: "{{ nc_db_user }}" - priv: "{{ nc_db_name }}.*:ALL" - login_unix_socket: /var/run/mysqld/mysqld.sock - register: mysql_grant -- debug: - var: mysql_grant - -- name: "{{ nc_db_user }} privileges" - community.mysql.mysql_query: - login_db: "{{ nc_db_name }}" - login_unix_socket: /var/run/mysqld/mysqld.sock - query: SELECT user, host, db, select_priv, insert_priv, grant_priv FROM mysql.db WHERE user="{{ nc_db_user }}" - register: user_privileges -- debug: - var: user_privileges.query_result +- name: Install MySQL + block: + - name: Install debian packages + apt: + name: "{{ mysql_packages }}" + state: present + + - name: Create DB user - {{ nc_db_user }} + community.mysql.mysql_user: + name: "{{ nc_db_user }}" + password: "{{ nc_db_pass }}" + login_unix_socket: /var/run/mysqld/mysqld.sock + register: mysql_user + + - debug: + var: mysql_user + + - name: Create DB + community.mysql.mysql_db: + name: "{{ nc_db_name }}" + encoding: utf8mb4 + collation: utf8mb4_general_ci + login_unix_socket: /var/run/mysqld/mysqld.sock + state: present + register: mysql_db + - debug: + var: mysql_db + + - name: Grant all privileges to {{ nc_db_name }} + community.mysql.mysql_user: + name: "{{ nc_db_user }}" + priv: "{{ nc_db_name }}.*:ALL" + login_unix_socket: /var/run/mysqld/mysqld.sock + register: mysql_grant + - debug: + var: mysql_grant + + - name: "{{ nc_db_user }} privileges" + community.mysql.mysql_query: + login_db: "{{ nc_db_name }}" + login_unix_socket: /var/run/mysqld/mysqld.sock + query: SELECT user, host, db, select_priv, insert_priv, grant_priv FROM mysql.db WHERE user="{{ nc_db_user }}" + register: user_privileges + - debug: + var: user_privileges.query_result + when: "{{ nc_db == 'mysql' }}" diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml index 67163b8..d5ecaa1 100644 --- a/roles/nextcloud/tasks/main.yml +++ b/roles/nextcloud/tasks/main.yml @@ -1,41 +1,49 @@ --- -#- name: Install dependency packages -# apt: -# name: "{{ nc_dependency_packages }}" -# state: present -# register: installed -#- debug: -# var: installed -# -# -#- name: Download Nextcloud -# get_url: -# url: https://download.nextcloud.com/server/releases/nextcloud-{{ nc_version }}.zip -# dest: /tmp/ -# -- name: Create LDAP suffix from domain name of the form dc=example,dc=com +- name: Add PHP repository + get_url: + url: https://packages.sury.org/php/README.txt + dest: /usr/local/src/nextcloud-playbooks/php_latest.sh + +- name: Update repository + shell: bash /usr/local/src/nextcloud-playbooks/php_latest.sh + +- name: Install dependency packages + apt: + name: "{{ nc_dependency_packages }}" + state: present + register: installed +- debug: + var: installed + +- name: Download Nextcloud + get_url: + url: https://download.nextcloud.com/server/releases/latest.zip + dest: /var/www/ + +- name: Create data directory + file: + path: "{{ nc_data_dir }}" + state: directory + owner: www-data + group: www-data + +- name: Create LDAP suffix from domain name shell: echo "{{ domainname }}" | sed -e 's/^/dc=/' -e 's/\./,dc=/g' args: executable: /bin/bash register: ldap_suffix -- name: Passing value to ldapBaseDN - set_fact: - ldapBaseDN: cn=users,cn=accounts,{{ ldap_suffix.stdout }} -- debug: - var: ldapBaseDN - -- name: Extract nextcloud +- name: Extract nextcloud zip file unarchive: - src: "/tmp/nextcloud-{{ nc_version }}.zip" - dest: /var/www + src: "/var/www/latest.zip" + dest: /var/www/ owner: www-data group: www-data -- name: Copy occ to /usr/bin +- name: Copy occ to /usr/local/bin template: src: occ.j2 - dest: /usr/bin/occ + dest: /usr/local/bin/occ mode: u+x,g+x,o+x - name: Installistaion using occ @@ -56,6 +64,14 @@ - debug: msg: "{{ occ_trusted_domains.results | json_query('[*].{ Command: cmd, Result: stdout }') }}" +- name: Set data directory + shell: occ config:system:set datadirectory --value="/opt/nextcloud-data" + with_dict: + - "{{ nc_data_directory }}" + register: occ_trusted_domains +- debug: + msg: "{{ occ_data_directory.results | json_query('[*].{ Command: cmd, Result: stdout }') }}" + - name: Installing apps shell: occ app:install "{{ item }}" with_items: @@ -92,3 +108,21 @@ login_unix_socket: /var/run/mysqld/mysqld.sock query: INSERT into oc_mail_provisionings (provisioning_domain,email_template,imap_user,imap_host,imap_port,imap_ssl_mode,smtp_user,smtp_host,smtp_port,smtp_ssl_mode) VALUES ('*', '%EMAIL%', '%EMAIL%' , '{{ domainname }}', 993, 'ssl','%USERID%','{{ domainname }}',587,'tls') when: "{{ nc_db == 'mysql' }}" + +- name: Configure Redis host + shell: occ config:system:set redis "hostname" --value "{{ redis_host }}" + +- name: Configure Redis Port + shell: occ config:system:set redis "port" --value "{{ redis_port }}" + +- name: Configure memory caching with Redis + shell: occ config:system:set memcache."{{ item }}" --value "\\OC\\Memcache\\Redis" + with_items: + - local + - distributed + - locking + +- name: Install nginx config + template: + src: nexcloud.j2 + dest: /etc/nginx/sites-enabled/nextcloud diff --git a/roles/nextcloud/templates/nextcloud.j2 b/roles/nextcloud/templates/nextcloud.j2 new file mode 100644 index 0000000..633779e --- /dev/null +++ b/roles/nextcloud/templates/nextcloud.j2 @@ -0,0 +1,136 @@ +server { + listen 443 http2 ssl; + ssl on; + + ssl_certificate /etc/letsencrypt/live/{{ domainname }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ domainname }}/privkey.pem; + + ssl_session_timeout 5m; + + ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES"; + ssl_prefer_server_ciphers on; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + gzip_types text/plain text/css application/json application/x-javascript + text/xml application/xml application/xml+rss text/javascript; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + server_name {{ domainname }} ; + root /var/www/nextcloud/; + index index.php; + + location ^~ /.well-known { + location = /.well-known/carddav { return 301 /remote.php/dav/; } + location = /.well-known/caldav { return 301 /remote.php/dav/; } + location = /.well-known/webfinger { return 301 /public.php?service=webfinger; } + location ^~ /.well-known { return 301 /index.php$uri; } + try_files $uri $uri/ =404; + } + + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + location / { + rewrite ^ /index.php; + } + + location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { + deny all; + } + location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; + } + + location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+)\.php(?:$|\/) { + fastcgi_split_path_info ^(.+?\.php)(\/.*|)$; + set $path_info $fastcgi_path_info; + try_files $fastcgi_script_name =404; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + fastcgi_param HTTPS on; + # Avoid sending the security headers twice + fastcgi_param modHeadersAvailable true; + # Enable pretty urls + fastcgi_param front_controller_active true; + fastcgi_pass php7.4; + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) { + try_files $uri/ =404; + index index.php; + } + + # Adding the cache control header for js, css and map files + # Make sure it is BELOW the PHP block + location ~ \.(?:css|js|woff2?|svg|gif|map)$ { + try_files $uri /index.php$request_uri; + add_header Cache-Control "public, max-age=15778463"; + # Add headers to serve security related headers (It is intended to + # have those duplicated to the ones above) + # Before enabling Strict-Transport-Security headers please read into + # this topic first. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Optional: Don't log access to assets + access_log off; + } + + location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ { + try_files $uri /index.php$request_uri; + # Optional: Don't log access to other assets + access_log off; + } +} diff --git a/roles/postgres/tasks/main.yml b/roles/postgres/tasks/main.yml index c4716ba..f8de65e 100644 --- a/roles/postgres/tasks/main.yml +++ b/roles/postgres/tasks/main.yml @@ -1,30 +1,33 @@ --- -- name: Install Postgresql - apt: - name: "{{ postgres_packages }}" - state: present - register: psql - -- name: Create DB user - become: yes - become_user: postgres - community.postgresql.postgresql_user: - name: "{{ nc_db_user }}" - password: "{{ nc_db_pass }}" - -- name: Create nextcloud db - become: yes - become_user: postgres - community.postgresql.postgresql_db: - name: nextcloud - template: template0 - encoding: UNICODE - owner: "{{ nc_db_user }}" - -- name: Grant privilages for db to user - become: yes - become_user: postgres - community.postgresql.postgresql_user: - name: "{{ nc_db_user }}" - db: "{{ nc_db_name }}" - priv: ALL +- name: Install Postgres + block: + - name: Install debian packages + apt: + name: "{{ postgres_packages }}" + state: present + register: psql + + - name: Create DB user + become: yes + become_user: postgres + community.postgresql.postgresql_user: + name: "{{ nc_db_user }}" + password: "{{ nc_db_pass }}" + + - name: Create nextcloud db + become: yes + become_user: postgres + community.postgresql.postgresql_db: + name: nextcloud + template: template0 + encoding: UNICODE + owner: "{{ nc_db_user }}" + + - name: Grant privilages for db to user + become: yes + become_user: postgres + community.postgresql.postgresql_user: + name: "{{ nc_db_user }}" + db: "{{ nc_db_name }}" + priv: ALL + when: "{{ nc_db == 'pgsql' }}" diff --git a/vars.yml b/vars.yml index e0a276f..99e1cce 100644 --- a/vars.yml +++ b/vars.yml @@ -1,107 +1,117 @@ --- -# Line 18: Domain Name -# Line 21: DN of user which connect to nextcloud -# Line 22: Password of user set in line 21 -# Line 29: LDAP server hostname/ip -# Line 31: Port for connecting LDAP server -# Line 42: Administrator username for Nextcloud -# Line 43: Administrator password -# Line 57: Database Software used. -# Line 58: Database host -# Line 59: Database name -# Line 60: Database Role name -# Line 61: Database Role password -# Line 62: Root folder for Nextcloud -# Line 63: Trusted domains -# Line 64: Version number that is to be downloaded +# Line 28: Domain Name +# Line 31: DN of user which connect to nextcloud +# Line 32: Password of user set in line 21 +# Line 39: LDAP server hostname/ip +# Line 41: Port for connecting LDAP server +# Line 52: Administrator username for Nextcloud +# Line 53: Administrator password # Line 64: Database Software used. +# Line 64: Database host +# Line 65: Database name +# Line 66: Database User name +# Line 67: Database User password +# Line 104: Root folder for Nextcloud +# Line 105: Data directory +# Line 106: Trusted domains +# Line 116: Redis host ip +# Line 117: Redis port -domainname: example.com +# Collabora +collabora_nc_apps: + - richdocumentscode + - richdocuments +collabora_packages: + - coolwsd + - code-brand +collabora_server: "https://{{ domainname }}:8443" + +domainname: amogha.labnetwork.in ldap: ldapAgentName: "uid=rouser,{{ ldapBaseDN }}" - ldapAgentPassword: secret + ldapAgentPassword: dGVzdGFkbWluCg== ldapBase: "{{ ldapBaseDN }}" ldapBaseGroups: "{{ ldapBaseDN }}" ldapBaseUsers: "{{ ldapBaseDN }}" ldapConfigurationActive: 1 ldapEmailAttribute: mail ldapExpertUsernameAttr: uid - ldapHost: localhost + ldapHost: 127.0.0.1 ldapLoginFilter: (&(|(objectclass=inetorgperson))(mail=%uid)) ldapPort: 389 ldapUserFilter: (|(objectclass=inetorgperson)) ldapUserFilterObjectclass: inetorgperson turnOnPasswordChange: 1 +ldapBaseDN: cn=users,cn=accounts,{{ ldap_suffix.stdout }} mysql_packages: - mariadb-server - mariadb-client - - php7.4-mysql - python3-pymysql -nc_admin_username: nextcloudadmin -nc_admin_pass: nextcloudadminpass +nc_admin_username: test +nc_admin_pass: adminpass nc_app_list: - - mail - - richdocumentscod - - richdocuments - - contacts - - deck - - spreed - announcementcenter - - apporder - - bruteforcesettings - calendar + - contacts + - deck - groupfolders + - mail + - spreed # mysql or pgsql nc_db: mysql nc_db_host: localhost nc_db_name: nextcloud -nc_db_user: nextcloud -nc_db_pass: databasepassword +nc_db_user: ncuser +nc_db_pass: vTHOt1AUKv nc_dependency_packages: - - php7.4-bcmath - - php7.4-bz2 - - php7.4-cgi - - php7.4-cli - - php7.4-common - - php7.4-curl - - php7.4-dba - - php7.4-dev - - php7.4-enchant - - php7.4-fpm - - php7.4-gd - - php7.4-gmp - - php7.4-imap - - php7.4-interbase - - php7.4-intl - - php7.4-json - - php7.4-ldap - - php7.4-mbstring - - php7.4-mysql - - php7.4-odbc - - php7.4-opcache - - php7.4-pgsql - - php7.4-phpdbg - - php7.4-pspell - - php7.4-readline - - php7.4-snmp - - php7.4-soap - - php7.4-sqlite3 - - php7.4-sybase - - php7.4-tidy - - php7.4-xml - - php7.4-xmlrpc - - php7.4-xsl - - php7.4-zip + - php{{ php_version }}-bcmath + - php{{ php_version }}-bz2 + - php{{ php_version }}-cgi + - php{{ php_version }}-cli + - php{{ php_version }}-common + - php{{ php_version }}-curl + - php{{ php_version }}-dba + - php{{ php_version }}-dev + - php{{ php_version }}-enchant + - php{{ php_version }}-fpm + - php{{ php_version }}-gd + - php{{ php_version }}-gmp + - php{{ php_version }}-imap + - php{{ php_version }}-interbase + - php{{ php_version }}-intl + - php{{ php_version }}-ldap + - php{{ php_version }}-mbstring + - php{{ php_version }}-mysql + - php{{ php_version }}-odbc + - php{{ php_version }}-opcache + - php{{ php_version }}-pgsql + - php{{ php_version }}-phpdbg + - php{{ php_version }}-pspell + - php{{ php_version }}-readline + - php{{ php_version }}-redis + - php{{ php_version }}-tidy + - php{{ php_version }}-xml + - php{{ php_version }}-xmlrpc + - php{{ php_version }}-xsl + - php{{ php_version }}-zip + - unzip + - nginx + - redis-server nc_root: /var/www/nextcloud +nc_data_dir: /opt/nextcloud-data nc_trusted_domains: 0: "{{ domainname }}" -nc_version: 23.0.3 postgres_packages: - - php7.4-pgsql + - php8.1-pgsql - python3-psycopg2 - postgresql +php_version: 8.1 + + +redis_host: localhost +redis_port: 6379