roles/service/nextcloud/tasks/main.yml

   1 #####################################
   2 ### someone"s ansible provisioner ###
   3 #####################################
   4 # Part of: https://git.somenet.org/root/pub/somesible.git
   5 # 2017-2025 by someone <someone@somenet.org>
   6 #
   7 ---
   8 #- name: create postgres-db and user
   9 #  include_role:
  10 #    name: util/postgres-db-usr
  11 #  vars:
  12 #    pg_data:
  13 #      db_server_delegate: "{{nextcloud_db_server_delegate}}"
  14 #      dbname: "{{nextcloud_db_name}}"
  15 #      pw: "{{nextcloud_db_pw}}"
  16 #  when: nextcloud_db_create | default('True')
  17
  18
  19 - name: include vars_nginx_vhost_custom
  20   include_vars:
  21     file: "{{item}}"
  22     name: vars_nginx_vhost_custom
  23   with_first_found:
  24     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  25     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  26     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  27     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/vars_nginx_vhost_custom.yml"
  28     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/vars_nginx_vhost_custom.yml"
  29     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/vars_nginx_vhost_custom.yml"
  30     - "default/vars_nginx_vhost_custom.yml"
  31
  32
  33 - name: configure vhost
  34   include_role:
  35     name: server/nginx/vhost-unified
  36   vars:
  37     vhost_type: "custom+php"
  38     vhost_name: "{{nextcloud_domain}}"
  39     vhost_php_custom: ["bzip2", "php8.2-apcu", "php8.2-bcmath", "php8.2-pgsql", "php8.2-curl", "php8.2-gd", "php8.2-gmp", "php8.2-intl", "php-imagick", "php8.2-mbstring", "php8.2-xml", "php8.2-zip"]
  40     vhost_dotfile_protection: False
  41     vhost_custom:
  42       vhost_custom_pre_server: "{{vars_nginx_vhost_custom.vhost_custom_pre_server}}"
  43       vhost_custom: "{{vars_nginx_vhost_custom.vhost_custom}}"
  44
  45
  46 - name: set up data-dir
  47   file:
  48     path: "{{nextcloud_data_dir_path}}"
  49     state: directory
  50     mode: 0750
  51     owner: "www-data"
  52     group: "www-data"
  53
  54
  55 - name: set up log-dir
  56   file:
  57     path: "/var/log/nextcloud/"
  58     state: directory
  59     mode: 0750
  60     owner: "www-data"
  61     group: "adm"
  62
  63
  64 - name: nextcloud logrotate config
  65   copy:
  66     src: "{{item}}"
  67     dest: "/etc/logrotate.d/nextcloud"
  68     mode: 0644
  69     owner: "root"
  70     group: "root"
  71   with_first_found:
  72     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud.logrotate"
  73     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud.logrotate"
  74     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud.logrotate"
  75     - "default/nextcloud.logrotate"
  76
  77
  78 - name: download nextcloud release and check checksums
  79   get_url:
  80     url: "{{nextcloud_download_url}}"
  81     dest: "/var/www/{{nextcloud_domain}}-nextcloud.tar.bz2"
  82     mode: 0640
  83     owner: "www-data"
  84     group: "www-data"
  85     checksum: "{{nextcloud_download_checksum}}"
  86     timeout: 30
  87   tags: "online"
  88   register: download
  89
  90
  91 - name: set up new webroot-dir
  92   file:
  93     path: "/var/www/{{nextcloud_domain}}.tmp"
  94     state: directory
  95     mode: 0750
  96     owner: "www-data"
  97     group: "www-data"
  98   when: download.changed
  99
 100
 101 - name: download and extract nextcloud files
 102   unarchive:
 103     src: "/var/www/{{nextcloud_domain}}-nextcloud.tar.bz2"
 104     dest: "/var/www/{{nextcloud_domain}}.tmp"
 105     remote_src: yes
 106     mode: "u=rwX,g=rX,o-rwx"
 107     owner: "www-data"
 108     group: "www-data"
 109     extra_opts:
 110       - '--strip-components=1'
 111       - '--show-stored-names'
 112   when: download.changed
 113
 114
 115 - name: use existing config file
 116   command: "mv /var/www/{{nextcloud_domain}}/config/config.php /var/www/{{nextcloud_domain}}.tmp/config/"
 117   args:
 118     removes: "/var/www/{{nextcloud_domain}}/config/config.php"
 119   when: download.changed
 120
 121
 122 - name: remove old files
 123   file:
 124     path: "/var/www/{{nextcloud_domain}}"
 125     state: absent
 126   when: download.changed
 127
 128
 129 - name: move newly extracted files to destination
 130   command: "mv /var/www/{{nextcloud_domain}}.tmp /var/www/{{nextcloud_domain}}"
 131   args:
 132     creates: "/var/www/{{nextcloud_domain}}"
 133   when: download.changed
 134
 135
 136 - name: remove possibly left over files
 137   file:
 138     path: "/var/www/{{nextcloud_domain}}.tmp"
 139     state: absent
 140   when: download.changed
 141
 142
 143 - name: install nextcloud
 144   become: true
 145   become_user: "www-data"
 146   command: >
 147     php occ maintenance:install
 148     --database=pgsql
 149     --database-host="{{nextcloud_db_host}}"
 150     --database-name="{{nextcloud_db_name}}"
 151     --database-user="{{nextcloud_db_name}}"
 152     --database-pass="{{nextcloud_db_pw}}"
 153     --admin-user="{{nextcloud_admin_user}}"
 154     --admin-pass="{{nextcloud_admin_pw}}"
 155     --data-dir="{{nextcloud_data_dir_path}}/data"
 156   args:
 157     chdir: "/var/www/{{nextcloud_domain}}"
 158     creates: "/var/www/{{nextcloud_domain}}/config/config.php"
 159   when: download.changed
 160
 161
 162 - name: write-unlock config
 163   become: true
 164   become_user: "www-data"
 165   lineinfile:
 166     path: "/var/www/{{nextcloud_domain}}/config/config.php"
 167     state: absent
 168     regexp: 'config_is_read_only'
 169   changed_when: False
 170
 171
 172 - name: finish nextcloud upgrade by running occ upgrade
 173   become: true
 174   become_user: "www-data"
 175   shell: 'php --define apc.enable_cli=1 occ upgrade'
 176   args:
 177     chdir: "/var/www/{{nextcloud_domain}}"
 178   register: script_res
 179   changed_when: "'Nextcloud is already latest version' not in script_res.stdout"
 180
 181
 182 - name: ensure trusted domains are set
 183   become: true
 184   become_user: "www-data"
 185   shell: 'echo "prev-$(php --define apc.enable_cli=1 occ config:system:get trusted_domains {{ item.0 }})-"; php --define apc.enable_cli=1 occ config:system:set trusted_domains {{ item.0 }} --value "{{ item.1 }}"'
 186   args:
 187     chdir: "/var/www/{{nextcloud_domain}}"
 188   register: script_res
 189 #  changed_when: "'prev-{{item.1}}-' not in script_res.stdout"
 190   changed_when: False
 191   with_indexed_items:
 192     - 'localhost'
 193     - "{{nextcloud_domain}}"
 194
 195
 196 - name: install apps
 197   become: true
 198   become_user: "www-data"
 199   shell: 'php --define apc.enable_cli=1 occ app:disable -- "{{ item }}"; php --define apc.enable_cli=1 occ app:install -- "{{ item }}"; true'
 200   args:
 201     chdir: "/var/www/{{nextcloud_domain}}"
 202   register: script_res
 203 #  changed_when: "'{{item}} already installed' not in script_res.stdout"
 204   changed_when: False
 205   with_items:
 206     - "{{nextcloud_installed_apps[nextcloud_domain] | default(nextcloud_default_installed_apps)}}"
 207   tags: "online"
 208
 209
 210 - name: finish nextcloud upgrade by running occ db:add-missing-columns
 211   become: true
 212   become_user: "www-data"
 213   shell: 'php --define apc.enable_cli=1 occ db:add-missing-columns'
 214   args:
 215     chdir: "/var/www/{{nextcloud_domain}}"
 216   register: script_res
 217   changed_when: "'Adding' in script_res.stdout"
 218
 219
 220 - name: finish nextcloud upgrade by running occ db:add-missing-indices
 221   become: true
 222   become_user: "www-data"
 223   shell: 'php --define apc.enable_cli=1 occ db:add-missing-indices'
 224   args:
 225     chdir: "/var/www/{{nextcloud_domain}}"
 226   register: script_res
 227   changed_when: "'Adding' in script_res.stdout"
 228
 229
 230 - name: finish nextcloud upgrade by running occ db:add-missing-primary-keys
 231   become: true
 232   become_user: "www-data"
 233   shell: 'php --define apc.enable_cli=1 occ db:add-missing-primary-keys'
 234   args:
 235     chdir: "/var/www/{{nextcloud_domain}}"
 236   register: script_res
 237   changed_when: "'Adding' in script_res.stdout"
 238
 239
 240 - name: finish nextcloud upgrade by running occ maintenance:repair --include-expensive
 241   become: true
 242   become_user: "www-data"
 243   shell: 'php --define apc.enable_cli=1 occ maintenance:repair --include-expensive'
 244   args:
 245     chdir: "/var/www/{{nextcloud_domain}}"
 246   register: script_res
 247   changed_when: "'Adding' in script_res.stdout"
 248
 249
 250   # Failcloud expects an unsafe config-key behavior
 251   # Therefore  we must use
 252   #   shell: 'echo "prev-$(php occ config:system:get {{ item.key }})-"; php occ config:system:set $(echo -n "{{ item.key }}" ) --value "{{ item.value }}"'
 253   # instead of
 254   #   shell: 'echo "prev-$(php occ config:system:get {{ item.key }})-"; php occ config:system:set "{{ item.key }}"--value "{{ item.value }}"'
 255 - name: apply config options
 256   become: true
 257   become_user: "www-data"
 258   shell: 'echo "prev-$(php --define apc.enable_cli=1 occ config:system:get {{ item.key }})-"; php --define apc.enable_cli=1 occ config:system:set $(echo -n "{{ item.key }}" ) --value "{{ item.value }}"'
 259   args:
 260     chdir: "/var/www/{{nextcloud_domain}}"
 261   register: script_res
 262 #  changed_when: "'prev-{{item.value}}-' not in script_res.stdout"
 263   changed_when: False
 264   with_items:
 265     - "{{nextcloud_config_options[nextcloud_domain]|default(nextcloud_default_config_options)}}"
 266
 267
 268 - name: write-lock config
 269   become: true
 270   become_user: "www-data"
 271   shell: 'php --define apc.enable_cli=1 occ config:system:set config_is_read_only --value true'
 272   args:
 273     chdir: "/var/www/{{nextcloud_domain}}"
 274   changed_when: False
 275
 276
 277 - name: copy nextcloud-cron@.service to /etc/systemd/system/
 278   copy:
 279     src: "{{item}}"
 280     dest: "/etc/systemd/system/nextcloud-cron@.service"
 281     mode: 0644
 282     owner: "root"
 283     group: "root"
 284   with_first_found:
 285     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud-cron@.service"
 286     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud-cron@.service"
 287     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud-cron@.service"
 288     - "default/nextcloud-cron@.service"
 289
 290
 291 - name: copy nextcloud-cron@.timer to /etc/systemd/system/
 292   copy:
 293     src: "{{item}}"
 294     dest: "/etc/systemd/system/nextcloud-cron@.timer"
 295     mode: 0644
 296     owner: "root"
 297     group: "root"
 298   with_first_found:
 299     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud-cron@.timer"
 300     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud-cron@.timer"
 301     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud-cron@.timer"
 302     - "default/nextcloud-cron@.timer"
 303
 304
 305 - name: copy fail2ban.filter.d.nextcloud.conf to /etc/fail2ban/filter.d/
 306   copy:
 307     src: "{{item}}"
 308     dest: "/etc/fail2ban/filter.d/nextcloud.conf"
 309     mode: 0644
 310     owner: "root"
 311     group: "root"
 312   with_first_found:
 313     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 314     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 315     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 316     - "default/fail2ban.filter.d.nextcloud.conf"
 317   notify: reload fail2ban.service
 318
 319
 320 - name: copy fail2ban.jail.d.nextcloud.conf to /etc/fail2ban/jail.d/
 321   copy:
 322     src: "{{item}}"
 323     dest: "/etc/fail2ban/jail.d/nextcloud.conf"
 324     mode: 0644
 325     owner: "root"
 326     group: "root"
 327   with_first_found:
 328     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 329     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 330     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 331     - "default/fail2ban.jail.d.nextcloud.conf"
 332   notify: reload fail2ban.service
 333
 334
 335 - name: reload, enable and start nextcloud-cron@.timer.
 336   include_role: name="base/systemd/enable-and-start"
 337   vars:
 338     service_name: "nextcloud-cron@{{nextcloud_domain}}.timer"