roles/service/nextcloud/tasks/main.yml

   1 #####################################
   2 ### someone"s ansible provisioner ###
   3 #####################################
   4 # Part of: https://git.somenet.org/root/pub/somesible.git
   5 # 2017-2025 by someone <someone@somenet.org>
   6 #
   7 ---
   8 #- name: create postgres-db and user
   9 #  include_role:
  10 #    name: util/postgres-db-usr
  11 #  vars:
  12 #    pg_data:
  13 #      db_server_delegate: "{{nextcloud_db_server_delegate}}"
  14 #      dbname: "{{nextcloud_db_name}}"
  15 #      pw: "{{nextcloud_db_pw}}"
  16 #  when: nextcloud_db_create | default('True')
  17
  18
  19 - name: include vars_nginx_vhost_custom
  20   include_vars:
  21     file: "{{item}}"
  22     name: vars_nginx_vhost_custom
  23   with_first_found:
  24     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  25     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  26     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/{{nextcloud_domain}}-vars_nginx_vhost_custom.yml"
  27     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/vars_nginx_vhost_custom.yml"
  28     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/vars_nginx_vhost_custom.yml"
  29     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/vars_nginx_vhost_custom.yml"
  30     - "default/vars_nginx_vhost_custom.yml"
  31
  32
  33 - name: configure vhost
  34   include_role:
  35     name: server/nginx/vhost-unified
  36   vars:
  37     vhost_type: "custom+php"
  38     vhost_name: "{{nextcloud_domain}}"
  39     vhost_php_custom: ["bzip2", "php8.2-apcu", "php8.2-bcmath", "php8.2-pgsql", "php8.2-curl", "php8.2-gd", "php8.2-gmp", "php8.2-intl", "php-imagick", "php8.2-mbstring", "php8.2-xml", "php8.2-zip", "php8.2-ldap"]
  40     vhost_dotfile_protection: False
  41     vhost_custom:
  42       vhost_custom_pre_server: "{{vars_nginx_vhost_custom.vhost_custom_pre_server}}"
  43       vhost_custom: "{{vars_nginx_vhost_custom.vhost_custom}}"
  44
  45
  46 - name: set up data-dir
  47   file:
  48     path: "{{nextcloud_data_dir_path}}"
  49     state: directory
  50     mode: 0750
  51     owner: "www-data"
  52     group: "www-data"
  53
  54
  55 - name: set up log-dir
  56   file:
  57     path: "/var/log/nextcloud/"
  58     state: directory
  59     mode: 0750
  60     owner: "www-data"
  61     group: "adm"
  62
  63
  64 - name: nextcloud logrotate config
  65   copy:
  66     src: "{{item}}"
  67     dest: "/etc/logrotate.d/nextcloud"
  68     mode: 0644
  69     owner: "root"
  70     group: "root"
  71   with_first_found:
  72     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud.logrotate"
  73     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud.logrotate"
  74     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud.logrotate"
  75     - "default/nextcloud.logrotate"
  76
  77
  78 - name: download nextcloud release and check checksums
  79   get_url:
  80     url: "{{nextcloud_download_url}}"
  81     dest: "/var/www/{{nextcloud_domain}}-nextcloud.tar.bz2"
  82     mode: 0640
  83     owner: "www-data"
  84     group: "www-data"
  85     checksum: "{{nextcloud_download_checksum}}"
  86     timeout: 30
  87   tags: "online"
  88   register: download
  89
  90
  91 - name: set up new webroot-dir
  92   file:
  93     path: "/var/www/{{nextcloud_domain}}.tmp"
  94     state: directory
  95     mode: 0750
  96     owner: "www-data"
  97     group: "www-data"
  98   when: download.changed
  99
 100
 101 - name: download and extract nextcloud files
 102   unarchive:
 103     src: "/var/www/{{nextcloud_domain}}-nextcloud.tar.bz2"
 104     dest: "/var/www/{{nextcloud_domain}}.tmp"
 105     remote_src: yes
 106     mode: "u=rwX,g=rX,o-rwx"
 107     owner: "www-data"
 108     group: "www-data"
 109     extra_opts:
 110       - '--strip-components=1'
 111       - '--show-stored-names'
 112   when: download.changed
 113
 114
 115 - name: use existing config file
 116   command: "mv /var/www/{{nextcloud_domain}}/config/config.php /var/www/{{nextcloud_domain}}.tmp/config/"
 117   args:
 118     removes: "/var/www/{{nextcloud_domain}}/config/config.php"
 119   when: download.changed
 120
 121
 122 - name: remove old files
 123   file:
 124     path: "/var/www/{{nextcloud_domain}}"
 125     state: absent
 126   when: download.changed
 127
 128
 129 - name: move newly extracted files to destination
 130   command: "mv /var/www/{{nextcloud_domain}}.tmp /var/www/{{nextcloud_domain}}"
 131   args:
 132     creates: "/var/www/{{nextcloud_domain}}"
 133   when: download.changed
 134
 135
 136 - name: remove possibly left over files
 137   file:
 138     path: "/var/www/{{nextcloud_domain}}.tmp"
 139     state: absent
 140   when: download.changed
 141
 142
 143 - name: install nextcloud
 144   become: true
 145   become_user: "www-data"
 146   command: >
 147     php occ maintenance:install
 148     --database=pgsql
 149     --database-host="{{nextcloud_db_host}}"
 150     --database-name="{{nextcloud_db_name}}"
 151     --database-user="{{nextcloud_db_name}}"
 152     --database-pass="{{nextcloud_db_pw}}"
 153     --admin-user="{{nextcloud_admin_user}}"
 154     --admin-pass="{{nextcloud_admin_pw}}"
 155     --data-dir="{{nextcloud_data_dir_path}}/data"
 156   args:
 157     chdir: "/var/www/{{nextcloud_domain}}"
 158     creates: "/var/www/{{nextcloud_domain}}/config/config.php"
 159   when: download.changed
 160
 161
 162 - name: write-unlock config
 163   become: true
 164   become_user: "www-data"
 165   lineinfile:
 166     path: "/var/www/{{nextcloud_domain}}/config/config.php"
 167     state: absent
 168     regexp: 'config_is_read_only'
 169   changed_when: False
 170
 171
 172 - name: finish nextcloud upgrade by running occ upgrade
 173   become: true
 174   become_user: "www-data"
 175   shell: 'php --define apc.enable_cli=1 occ upgrade'
 176   args:
 177     chdir: "/var/www/{{nextcloud_domain}}"
 178   register: script_res
 179   changed_when: "'Nextcloud is already latest version' not in script_res.stdout"
 180
 181
 182 - name: ensure trusted domains are set
 183   become: true
 184   become_user: "www-data"
 185   shell: 'echo "prev-$(php --define apc.enable_cli=1 occ config:system:get trusted_domains {{ item.0 }})-"; php --define apc.enable_cli=1 occ config:system:set trusted_domains {{ item.0 }} --value "{{ item.1 }}"'
 186   args:
 187     chdir: "/var/www/{{nextcloud_domain}}"
 188   register: script_res
 189 #  changed_when: "'prev-{{item.1}}-' not in script_res.stdout"
 190   changed_when: False
 191   with_indexed_items:
 192     - 'localhost'
 193     - "{{nextcloud_domain}}"
 194
 195
 196 - name: "(re)install apps"
 197   become: true
 198   become_user: "www-data"
 199   shell: 'php --define apc.enable_cli=1 occ app:disable -- "{{ item }}"; php --define apc.enable_cli=1 occ app:install -- "{{ item }}"; php --define apc.enable_cli=1 occ app:enable -- "{{ item }}"; true'
 200   args:
 201     chdir: "/var/www/{{nextcloud_domain}}"
 202   with_items:
 203     - "{{nextcloud_installed_apps[nextcloud_domain] | default(nextcloud_default_installed_apps)}}"
 204   tags: "online"
 205
 206
 207 - name: finish nextcloud upgrade by running occ db:add-missing-columns
 208   become: true
 209   become_user: "www-data"
 210   shell: 'php --define apc.enable_cli=1 occ db:add-missing-columns'
 211   args:
 212     chdir: "/var/www/{{nextcloud_domain}}"
 213   register: script_res
 214   changed_when: "'Adding' in script_res.stdout"
 215
 216
 217 - name: finish nextcloud upgrade by running occ db:add-missing-indices
 218   become: true
 219   become_user: "www-data"
 220   shell: 'php --define apc.enable_cli=1 occ db:add-missing-indices'
 221   args:
 222     chdir: "/var/www/{{nextcloud_domain}}"
 223   register: script_res
 224   changed_when: "'Adding' in script_res.stdout"
 225
 226
 227 - name: finish nextcloud upgrade by running occ db:add-missing-primary-keys
 228   become: true
 229   become_user: "www-data"
 230   shell: 'php --define apc.enable_cli=1 occ db:add-missing-primary-keys'
 231   args:
 232     chdir: "/var/www/{{nextcloud_domain}}"
 233   register: script_res
 234   changed_when: "'Adding' in script_res.stdout"
 235
 236
 237 - name: finish nextcloud upgrade by running occ maintenance:repair --include-expensive
 238   become: true
 239   become_user: "www-data"
 240   shell: 'php --define apc.enable_cli=1 occ maintenance:repair --include-expensive'
 241   args:
 242     chdir: "/var/www/{{nextcloud_domain}}"
 243   register: script_res
 244   changed_when: "'Adding' in script_res.stdout"
 245
 246
 247   # Failcloud expects an unsafe config-key behavior
 248   # Therefore  we must use
 249   #   shell: 'echo "prev-$(php occ config:system:get {{ item.key }})-"; php occ config:system:set $(echo -n "{{ item.key }}" ) --value "{{ item.value }}"'
 250   # instead of
 251   #   shell: 'echo "prev-$(php occ config:system:get {{ item.key }})-"; php occ config:system:set "{{ item.key }}"--value "{{ item.value }}"'
 252 - name: apply config options
 253   become: true
 254   become_user: "www-data"
 255   shell: 'echo "prev-$(php --define apc.enable_cli=1 occ config:system:get {{ item.key }})-"; php --define apc.enable_cli=1 occ config:system:set $(echo -n "{{ item.key }}" ) --value "{{ item.value }}"'
 256   args:
 257     chdir: "/var/www/{{nextcloud_domain}}"
 258   register: script_res
 259 #  changed_when: "'prev-{{item.value}}-' not in script_res.stdout"
 260   changed_when: False
 261   with_items:
 262     - "{{nextcloud_config_options[nextcloud_domain]|default(nextcloud_default_config_options)}}"
 263
 264
 265 - name: finish nextcloud upgrade by running occ upgrade again
 266   become: true
 267   become_user: "www-data"
 268   shell: 'php --define apc.enable_cli=1 occ upgrade'
 269   args:
 270     chdir: "/var/www/{{nextcloud_domain}}"
 271   register: script_res
 272   changed_when: "'Nextcloud is already latest version' not in script_res.stdout"
 273
 274
 275 - name: write-lock config
 276   become: true
 277   become_user: "www-data"
 278   shell: 'php --define apc.enable_cli=1 occ config:system:set config_is_read_only --value true'
 279   args:
 280     chdir: "/var/www/{{nextcloud_domain}}"
 281   changed_when: False
 282
 283
 284 - name: copy nextcloud-cron@.service to /etc/systemd/system/
 285   copy:
 286     src: "{{item}}"
 287     dest: "/etc/systemd/system/nextcloud-cron@.service"
 288     mode: 0644
 289     owner: "root"
 290     group: "root"
 291   with_first_found:
 292     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud-cron@.service"
 293     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud-cron@.service"
 294     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud-cron@.service"
 295     - "default/nextcloud-cron@.service"
 296
 297
 298 - name: copy nextcloud-cron@.timer to /etc/systemd/system/
 299   copy:
 300     src: "{{item}}"
 301     dest: "/etc/systemd/system/nextcloud-cron@.timer"
 302     mode: 0644
 303     owner: "root"
 304     group: "root"
 305   with_first_found:
 306     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/nextcloud-cron@.timer"
 307     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/nextcloud-cron@.timer"
 308     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/nextcloud-cron@.timer"
 309     - "default/nextcloud-cron@.timer"
 310
 311
 312 - name: copy fail2ban.filter.d.nextcloud.conf to /etc/fail2ban/filter.d/
 313   copy:
 314     src: "{{item}}"
 315     dest: "/etc/fail2ban/filter.d/nextcloud.conf"
 316     mode: 0644
 317     owner: "root"
 318     group: "root"
 319   with_first_found:
 320     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 321     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 322     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/fail2ban.filter.d.nextcloud.conf"
 323     - "default/fail2ban.filter.d.nextcloud.conf"
 324   notify: reload fail2ban.service
 325
 326
 327 - name: copy fail2ban.jail.d.nextcloud.conf to /etc/fail2ban/jail.d/
 328   copy:
 329     src: "{{item}}"
 330     dest: "/etc/fail2ban/jail.d/nextcloud.conf"
 331     mode: 0644
 332     owner: "root"
 333     group: "root"
 334   with_first_found:
 335     - "{{lookup('env','PWD')}}/host_files/{{inventory_hostname}}/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 336     - "{{lookup('env','PWD')}}/group_files/{{group_files_group}}/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 337     - "{{lookup('env','PWD')}}/group_files/all/{{role_name}}/fail2ban.jail.d.nextcloud.conf"
 338     - "default/fail2ban.jail.d.nextcloud.conf"
 339   notify: reload fail2ban.service
 340
 341
 342 - name: reload, enable and start nextcloud-cron@.timer.
 343   include_role: name="base/systemd/enable-and-start"
 344   vars:
 345     service_name: "nextcloud-cron@{{nextcloud_domain}}.timer"