roles/service/nextcloud/tasks/main.yml

   1 #####################################
   2 ### someone"s ansible provisioner ###
   3 #####################################
   4 # Part of: https://git.somenet.org/root/pub/somesible.git
   5 # 2017-2026 by someone <someone@somenet.org>
   6 #
   7 ---
   8 #- name: create postgres-db and user
   9 #  include_role:
  10 #    name: util/postgres-db-usr
  11 #  vars:
  12 #    pg_data:
  13 #      db_server_delegate: "{{nextcloud_db_server_delegate}}"
  14 #      dbname: "{{nextcloud_db_name}}"
  15 #      pw: "{{nextcloud_db_pw}}"
  16 #  when: nextcloud_db_create | default('True')
  17
  18
  19 - name: include vars_nginx_vhost_custom
  20   include_vars:
  21     file: "{{item}}"
  22     name: vars_nginx_vhost_custom
  23   with_first_found:
  24     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  25     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  26     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  27     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/vars_nginx_vhost_custom.yml"
  28     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/vars_nginx_vhost_custom.yml"
  29     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/vars_nginx_vhost_custom.yml"
  30     - "default/vars_nginx_vhost_custom.yml"
  31
  32
  33 - name: configure vhost
  34   include_role:
  35     name: server/nginx/vhost-unified
  36   vars:
  37     vhost_type: "custom+php"
  38     vhost_name: "{{nextcloud_domain}}"
  39     vhost_php_custom: ["bzip2", "php8.4-apcu", "php8.4-bcmath", "php8.4-pgsql", "php8.4-curl", "php8.4-gd", "php8.4-gmp", "php8.4-intl", "php-imagick", "php8.4-mbstring", "php8.4-xml", "php8.4-zip", "php8.4-ldap"]
  40     vhost_dotfile_protection: False
  41     vhost_custom:
  42       vhost_custom_pre_server: "{{vars_nginx_vhost_custom.vhost_custom_pre_server}}"
  43       vhost_custom: "{{vars_nginx_vhost_custom.vhost_custom}}"
  44
  45
  46 - name: set up data-dir
  47   file:
  48     path: "{{nextcloud_data_dir_path}}"
  49     state: directory
  50     mode: 0750
  51     owner: "www-data"
  52     group: "www-data"
  53
  54
  55 - name: set up log-dir
  56   file:
  57     path: "/var/log/nextcloud/"
  58     state: directory
  59     mode: 0750
  60     owner: "www-data"
  61     group: "adm"
  62
  63
  64 - name: nextcloud logrotate config
  65   copy:
  66     src: "{{item}}"
  67     dest: "/etc/logrotate.d/nextcloud"
  68     mode: 0644
  69     owner: "root"
  70     group: "root"
  71   with_first_found:
  72     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud.logrotate"
  73     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud.logrotate"
  74     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud.logrotate"
  75     - "default/nextcloud.logrotate"
  76
  77
  78 - name: download nextcloud release and check checksums
  79   get_url:
  80     url: "{{nextcloud_download_url}}"
  81     dest: "/var/www/{{nextcloud_domain}}-nextcloud.tar.bz2"
  82     mode: 0640
  83     owner: "www-data"
  84     group: "www-data"
  85     checksum: "{{nextcloud_download_checksum}}"
  86     timeout: 30
  87   tags: "online"
  88   register: download
  89
  90
  91 - name: set up new webroot-dir
  92   file:
  93     path: "/var/www/{{nextcloud_domain}}.tmp"
  94     state: directory
  95     mode: 0750
  96     owner: "www-data"
  97     group: "www-data"
  98   when: download is defined and download.changed
  99
 100
 101 - name: extract downloaded nextcloud files
 102   unarchive:
 103     src: "/var/www/{{nextcloud_domain}}-nextcloud.tar.bz2"
 104     dest: "/var/www/{{nextcloud_domain}}.tmp"
 105     remote_src: yes
 106     mode: "u=rwX,g=rX,o-rwx"
 107     owner: "www-data"
 108     group: "www-data"
 109     extra_opts:
 110       - '--strip-components=1'
 111       - '--show-stored-names'
 112   when: download is defined and download.changed
 113
 114
 115 - name: use existing config file
 116   command: "mv /var/www/{{nextcloud_domain}}/config/config.php /var/www/{{nextcloud_domain}}.tmp/config/"
 117   args:
 118     removes: "/var/www/{{nextcloud_domain}}/config/config.php"
 119   when: download is defined and download.changed
 120
 121
 122 - name: remove old files
 123   file:
 124     path: "/var/www/{{nextcloud_domain}}"
 125     state: absent
 126   when: download is defined and download.changed
 127
 128
 129 - name: move newly extracted files to destination
 130   command: "mv /var/www/{{nextcloud_domain}}.tmp /var/www/{{nextcloud_domain}}"
 131   args:
 132     creates: "/var/www/{{nextcloud_domain}}"
 133   when: download is defined and download.changed
 134
 135
 136 - name: remove possibly left over files
 137   file:
 138     path: "/var/www/{{nextcloud_domain}}.tmp"
 139     state: absent
 140   when: download is defined and download.changed
 141
 142
 143 - name: install nextcloud
 144   become: true
 145   become_user: "www-data"
 146   command: >
 147     php occ maintenance:install
 148     --database=pgsql
 149     --database-host="{{nextcloud_db_host}}"
 150     --database-name="{{nextcloud_db_name}}"
 151     --database-user="{{nextcloud_db_name}}"
 152     --database-pass="{{nextcloud_db_pw}}"
 153     --admin-user="{{nextcloud_admin_user}}"
 154     --admin-pass="{{nextcloud_admin_pw}}"
 155     --data-dir="{{nextcloud_data_dir_path}}/data"
 156   args:
 157     chdir: "/var/www/{{nextcloud_domain}}"
 158     creates: "/var/www/{{nextcloud_domain}}/config/config.php"
 159   when: download is defined and download.changed
 160
 161
 162 - name: write-unlock config
 163   become: true
 164   become_user: "www-data"
 165   lineinfile:
 166     path: "/var/www/{{nextcloud_domain}}/config/config.php"
 167     state: absent
 168     regexp: 'config_is_read_only'
 169   changed_when: False
 170
 171
 172 - name: finish nextcloud upgrade by running occ upgrade
 173   become: true
 174   become_user: "www-data"
 175   shell: 'php --define apc.enable_cli=1 occ upgrade'
 176   args:
 177     chdir: "/var/www/{{nextcloud_domain}}"
 178   register: script_res
 179   changed_when: "'Nextcloud is already latest version' not in script_res.stdout"
 180
 181
 182 - name: finish nextcloud upgrade by running occ upgrade
 183   become: true
 184   become_user: "www-data"
 185   shell: 'php --define apc.enable_cli=1 occ maintenance:repair --include-expensive'
 186   args:
 187     chdir: "/var/www/{{nextcloud_domain}}"
 188   register: script_res
 189   when: script_res.changed
 190
 191
 192 - name: ensure trusted domains are set
 193   become: true
 194   become_user: "www-data"
 195   shell: 'echo "prev-$(php --define apc.enable_cli=1 occ config:system:get trusted_domains {{ item.0 }})-"; php --define apc.enable_cli=1 occ config:system:set trusted_domains {{ item.0 }} --value "{{ item.1 }}"'
 196   args:
 197     chdir: "/var/www/{{nextcloud_domain}}"
 198   register: script_res
 199 #  changed_when: "'prev-{{item.1}}-' not in script_res.stdout"
 200   changed_when: False
 201   with_indexed_items:
 202     - 'localhost'
 203     - "{{nextcloud_domain}}"
 204
 205
 206 - name: "install/update/enable apps"
 207   become: true
 208   become_user: "www-data"
 209   shell: 'php --define apc.enable_cli=1 occ app:install -- "{{ item }}"; php --define apc.enable_cli=1 occ app:update -- "{{ item }}"; php --define apc.enable_cli=1 occ app:enable -- "{{ item }}"; true'
 210   args:
 211     chdir: "/var/www/{{nextcloud_domain}}"
 212   with_items:
 213     - "{{nextcloud_installed_apps[nextcloud_domain] | default(nextcloud_default_installed_apps)}}"
 214   tags: "online"
 215
 216
 217 - name: finish nextcloud upgrade by running occ db:add-missing-columns
 218   become: true
 219   become_user: "www-data"
 220   shell: 'php --define apc.enable_cli=1 occ db:add-missing-columns'
 221   args:
 222     chdir: "/var/www/{{nextcloud_domain}}"
 223   register: script_res
 224   changed_when: "'Adding' in script_res.stdout"
 225
 226
 227 - name: finish nextcloud upgrade by running occ db:add-missing-indices
 228   become: true
 229   become_user: "www-data"
 230   shell: 'php --define apc.enable_cli=1 occ db:add-missing-indices'
 231   args:
 232     chdir: "/var/www/{{nextcloud_domain}}"
 233   register: script_res
 234   changed_when: "'Adding' in script_res.stdout"
 235
 236
 237 - name: finish nextcloud upgrade by running occ db:add-missing-primary-keys
 238   become: true
 239   become_user: "www-data"
 240   shell: 'php --define apc.enable_cli=1 occ db:add-missing-primary-keys'
 241   args:
 242     chdir: "/var/www/{{nextcloud_domain}}"
 243   register: script_res
 244   changed_when: "'Adding' in script_res.stdout"
 245
 246
 247 - name: finish nextcloud upgrade by running occ maintenance:repair --include-expensive
 248   become: true
 249   become_user: "www-data"
 250   shell: 'php --define apc.enable_cli=1 occ maintenance:repair --include-expensive'
 251   args:
 252     chdir: "/var/www/{{nextcloud_domain}}"
 253   register: script_res
 254   changed_when: "'Adding' in script_res.stdout"
 255
 256
 257   # Failcloud expects an unsafe config-key behavior
 258   # Therefore  we must use
 259   #   shell: 'echo "prev-$(php occ config:system:get {{ item.key }})-"; php occ config:system:set $(echo -n "{{ item.key }}" ) --value "{{ item.value }}"'
 260   # instead of
 261   #   shell: 'echo "prev-$(php occ config:system:get {{ item.key }})-"; php occ config:system:set "{{ item.key }}"--value "{{ item.value }}"'
 262 - name: apply config options
 263   become: true
 264   become_user: "www-data"
 265   shell: 'echo "prev-$(php --define apc.enable_cli=1 occ config:system:get {{ item.key }})-"; php --define apc.enable_cli=1 occ config:system:set $(echo -n "{{ item.key }}" ) --value "{{ item.value }}"'
 266   args:
 267     chdir: "/var/www/{{nextcloud_domain}}"
 268   register: script_res
 269 #  changed_when: "'prev-{{item.value}}-' not in script_res.stdout"
 270   changed_when: False
 271   with_items:
 272     - "{{nextcloud_config_options[nextcloud_domain]|default(nextcloud_default_config_options)}}"
 273
 274
 275 - name: finish nextcloud upgrade by running occ upgrade again
 276   become: true
 277   become_user: "www-data"
 278   shell: 'php --define apc.enable_cli=1 occ upgrade'
 279   args:
 280     chdir: "/var/www/{{nextcloud_domain}}"
 281   register: script_res
 282   changed_when: "'Nextcloud is already latest version' not in script_res.stdout"
 283
 284
 285 - name: write-lock config
 286   become: true
 287   become_user: "www-data"
 288   shell: 'php --define apc.enable_cli=1 occ config:system:set config_is_read_only --value true'
 289   args:
 290     chdir: "/var/www/{{nextcloud_domain}}"
 291   changed_when: False
 292
 293
 294 - name: copy nextcloud-cron@.service to /etc/systemd/system/
 295   copy:
 296     src: "{{item}}"
 297     dest: "/etc/systemd/system/nextcloud-cron@.service"
 298     mode: 0644
 299     owner: "root"
 300     group: "root"
 301   with_first_found:
 302     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud-cron@.service"
 303     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud-cron@.service"
 304     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud-cron@.service"
 305     - "default/nextcloud-cron@.service"
 306
 307
 308 - name: copy nextcloud-cron@.timer to /etc/systemd/system/
 309   copy:
 310     src: "{{item}}"
 311     dest: "/etc/systemd/system/nextcloud-cron@.timer"
 312     mode: 0644
 313     owner: "root"
 314     group: "root"
 315   with_first_found:
 316     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud-cron@.timer"
 317     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud-cron@.timer"
 318     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud-cron@.timer"
 319     - "default/nextcloud-cron@.timer"
 320
 321
 322 - name: copy fail2ban.filter.d.nextcloud.conf to /etc/fail2ban/filter.d/
 323   copy:
 324     src: "{{item}}"
 325     dest: "/etc/fail2ban/filter.d/nextcloud.conf"
 326     mode: 0644
 327     owner: "root"
 328     group: "root"
 329   with_first_found:
 330     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 331     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 332     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 333     - "default/fail2ban.filter.d.nextcloud.conf"
 334   notify: reload fail2ban.service
 335
 336
 337 - name: copy fail2ban.jail.d.nextcloud.conf to /etc/fail2ban/jail.d/
 338   copy:
 339     src: "{{item}}"
 340     dest: "/etc/fail2ban/jail.d/nextcloud.conf"
 341     mode: 0644
 342     owner: "root"
 343     group: "root"
 344   with_first_found:
 345     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 346     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 347     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 348     - "default/fail2ban.jail.d.nextcloud.conf"
 349   notify: reload fail2ban.service
 350
 351
 352 - name: reload, enable and start nextcloud-cron@.timer.
 353   include_role: name="base/systemd/enable-and-start"
 354   vars:
 355     service_name: "nextcloud-cron@{{nextcloud_domain}}.timer"