ansible/roles/nextcloud/tasks/main.yml
2020-02-06 04:05:34 -06:00

199 lines
6.6 KiB
YAML

#!/usr/bin/ansible-playbook
# vim:ft=ansible:
---
- name: Include MySQL role
include_role:
name: mysql
- name: Install, configure, and start Nextcloud
block:
- name: Install Nextcloud-required packages
apt:
name: "{{ packages }}"
vars:
packages:
- apache2
- libapache2-mod-php7.2
- php7.2
- php7.2-gd
- php7.2-json
- php7.2-mysql
- php7.2-curl
- php7.2-mbstring
- php7.2-intl
- php-imagick
- php7.2-xml
- php7.2-zip
- php7.2-cgi
- php7.2-cli
- python-openssl # Needed for keygen
- name: Copy configuration
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
loop:
- { src: "php-apache2.ini", dest: "/etc/php/7.2/apache2/php.ini", mode: "0644" }
- { src: "php-cgi.ini", dest: "/etc/php/7.2/cgi/php.ini", mode: "0644" }
- name: Set up MySQL
block:
- name: Create database
mysql_db:
name: nextcloud
login_user: root
login_password: "{{ mysql_root_password }}"
state: present
- name: Create Nextcloud user
mysql_user:
name: nextcloud
host: localhost
password: "{{ nextcloud_mysql_password }}"
priv: "nextcloud.*:ALL,GRANT"
login_user: root
login_password: "{{ mysql_root_password }}"
- name: Set up Apache
block:
- name: Disable default configuration
file:
# This is a symlink so who cares
path: "/etc/apache2/sites-enabled/000-default.conf"
state: absent
- name: Create webroot
file:
path: "{{ nextcloud_webroot }}"
mode: "0755"
recurse: yes
state: directory
- name: Check for existing installation
stat:
path: "{{ nextcloud_webroot }}/index.html"
register: stat_webroot_index
- name: Install Nextcloud
block:
- name: Download Nextcloud
get_url:
dest: /var/www/nextcloud.tar.bz2
url: "{{ nextcloud_tarbz2 }}"
- name: Extract Nextcloud
unarchive:
src: /var/www/nextcloud.tar.bz2
remote_src: yes
dest: "{{ nextcloud_webroot }}"
extra_opts: [--strip-components=1]
- name: Create data directory
file:
path: "/var/nextcloud"
state: directory
mode: 0700
owner: www-data
group: www-data
- name: Chown webroot
# Nextcloud docs say Apache needs write access, so it gets write access
file:
path: "{{ nextcloud_webroot }}"
state: directory
recurse: yes
owner: www-data
group: www-data
- name: Cleanup
file:
path: /var/www/nextcloud.tar.bz2
state: absent
when: not stat_webroot_index.stat.exists
- name: Set up Nextcloud cronjob
cron:
user: www-data
name: "nextcloud-cron"
minute: "*/5"
job: 'php -f "{{ nextcloud_webroot }}/cron.php"'
- name: Enable Apache configs and modules
shell: "{{ item }}"
loop:
- "a2enmod rewrite"
- "a2enmod ssl"
- name: Register certificates
block:
- name: Set up PKI filesystem hierarchy
file:
path: "{{ item.dir }}"
mode: "{{ item.mode }}"
recurse: yes
owner: root
group: www-data
state: directory
loop:
- { dir: "/etc/pki", mode: "0750" }
- { dir: "/etc/pki/cert", mode: "0750" }
- { dir: "/etc/pki/cert/crt", mode: "0750" }
- { dir: "/etc/pki/cert/csr", mode: "0750" }
- { dir: "/etc/pki/cert/private", mode: "0750" }
- name: Create ACME account key
openssl_privatekey:
path: "/etc/pki/cert/private/account.key"
- name: Create certificate key
openssl_privatekey:
path: "/etc/pki/cert/private/{{ nextcloud_url }}.key"
- name: Create CSR
openssl_csr:
path: "/etc/pki/cert/csr/{{ nextcloud_url }}.csr"
common_name: "{{ nextcloud_url }}"
privatekey_path: /etc/pki/cert/private/{{ nextcloud_url }}.key
email_address: "rehashedsalt@cock.li"
- name: Create challenge for CSR
acme_certificate:
acme_directory: "{{ acme_directory }}"
acme_version: 2
terms_agreed: yes
account_email: "rehashedsalt@cock.li"
account_key: "/etc/pki/cert/private/account.key"
csr: "/etc/pki/cert/csr/{{ nextcloud_url }}.csr"
dest: "/etc/pki/cert/crt/{{ nextcloud_url }}.crt"
fullchain_dest: "/etc/pki/cert/crt/{{ nextcloud_url }}-fullchain.crt"
register: com_challenge
- name: Fulfill challenge
block:
- name: Configure insecure virtual host configs
template:
src: apache2-vhost.conf
dest: "/etc/apache2/sites-enabled/{{ nextcloud_url }}.conf"
- name: Reload Apache
service:
name: apache2
state: reloaded
- name: Create well-known directory
file:
path: "{{ nextcloud_webroot }}/.well-known/acme-challenge"
mode: "0755"
recurse: yes
state: directory
- name: Copy challenge files
copy:
dest: "{{ nextcloud_webroot }}/{{ com_challenge['challenge_data'][nextcloud_url]['http-01']['resource'] }}"
content: "{{ com_challenge['challenge_data'][nextcloud_url]['http-01']['resource_value'] }}"
- name: Create certificate
acme_certificate:
acme_directory: "{{ acme_directory }}"
acme_version: 2
account_key: /etc/pki/cert/private/account.key
csr: "/etc/pki/cert/csr/{{ nextcloud_url }}.csr"
dest: "/etc/pki/cert/crt/{{ nextcloud_url }}.crt"
fullchain_dest: "/etc/pki/cert/crt/{{ nextcloud_url }}-fullchain.crt"
chain_dest: "/etc/pki/cert/crt/{{ nextcloud_url }}-intermediate.crt"
data: "{{ com_challenge }}"
- name: Clean up
file:
path: "{{ nextcloud_webroot }}/.well-known"
state: absent
when: com_challenge is changed
- name: Secure Apache
block:
- name: Copy over virtual host configs
template:
src: apache2-vhost-ssl.conf
dest: "/etc/apache2/sites-enabled/{{ nextcloud_url }}.conf"
- name: Reload Apache
service:
name: apache2
state: reloaded
enabled: true
become: yes