127 lines
4.4 KiB
YAML
127 lines
4.4 KiB
YAML
#!/usr/bin/ansible-playbook
|
|
# vim:ft=ansible:
|
|
---
|
|
- name: Install, configure, and start Nextcloud
|
|
block:
|
|
- name: Install Nextcloud-required packages
|
|
apt:
|
|
name: "{{ packages }}"
|
|
vars:
|
|
packages:
|
|
- apache2
|
|
- mariadb-server
|
|
- libapache2-mod-php7.2
|
|
- php7.2
|
|
- php7.2-gd
|
|
- php7.2-json
|
|
- php7.2-mysql
|
|
- php7.2-curl
|
|
- php7.2-mbstring
|
|
- php7.2-intl
|
|
- php-imagick
|
|
- php7.2-xml
|
|
- php7.2-zip
|
|
- php7.2-cgi
|
|
- php7.2-cli
|
|
- python-openssl # Needed for keygen
|
|
- name: Copy configuration
|
|
copy:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { src: "php-apache2.ini", dest: "/etc/php/7.2/apache2/php.ini", mode: "0644" }
|
|
- { src: "php-cgi.ini", dest: "/etc/php/7.2/cgi/php.ini", mode: "0644" }
|
|
- name: Set up Apache
|
|
block:
|
|
- name: Configure virtual host
|
|
template:
|
|
src: apache2-vhost.conf
|
|
dest: "/etc/apache2/sites-enabled/{{ website_url }}.conf"
|
|
- name: Create webroot
|
|
file:
|
|
path: "{{ website_root }}"
|
|
mode: "0644"
|
|
recurse: yes
|
|
state: directory
|
|
- name: Check for existing installation
|
|
stat:
|
|
path: "{{ website_root }}/index.html"
|
|
register: stat_webroot_index
|
|
- name: Install Nextcloud
|
|
block:
|
|
- name: Download Nextcloud
|
|
get_url:
|
|
dest: /var/www/nextcloud.tar.gz
|
|
url: "{{ nextcloud_targz }}"
|
|
- name: Extract Nextcloud
|
|
unarchive:
|
|
src: /var/www/nextcloud.tar.gz
|
|
dest: "{{ website_root }}"
|
|
extra_opts: [--strip-components=1]
|
|
- name: Cleanup
|
|
file:
|
|
path: /var/www/nextcloud.tar.gz
|
|
state: absent
|
|
when: not stat_webroot_index.stat.exists
|
|
- name: Register certificates
|
|
block:
|
|
- name: Set up our filesystem heirarchy
|
|
file:
|
|
path: "{{ item.dir }}"
|
|
mode: "{{ item.mode }}"
|
|
recurse: yes
|
|
state: directory
|
|
loop:
|
|
- { dir: "/etc/pki", mode: "0600" }
|
|
- { dir: "/etc/pki/cert", mode: "0600" }
|
|
- { dir: "/etc/pki/cert/crt", mode: "0600" }
|
|
- { dir: "/etc/pki/cert/csr", mode: "0600" }
|
|
- { dir: "/etc/pki/cert/private", mode: "0600" }
|
|
- { dir: "/etc/pki/cert/challenge/{{ website_url }}", mode: "0600" }
|
|
- name: Create ACME account key
|
|
openssl_privatekey:
|
|
path: "/etc/pki/cert/private/account.key"
|
|
size: 4096
|
|
- name: Create certificate key
|
|
openssl_privatekey:
|
|
path: "/etc/pki/cert/private/{{ website_url }}.key"
|
|
size: 4096
|
|
- name: Create CSR
|
|
openssl_csr:
|
|
path: "/etc/pki/cert/csr/{{ website_url }}.csr"
|
|
common_name: "{{ website_url }}"
|
|
privatekey_path: /etc/pki/cert/private/account.key
|
|
email_address: "rehashedsalt@cock.li"
|
|
- name: Create well-known directory
|
|
file:
|
|
path: "{{ website_root }}/.well-known/acme-challenge"
|
|
mode: "0644"
|
|
recurse: yes
|
|
state: directory
|
|
- name: Create challenge for CSR
|
|
acme_certificate:
|
|
acme_directory: "https://acme-staging-v02.api.letsencrypt.org/directory"
|
|
acme_version: 2
|
|
terms_agreed: yes
|
|
account_email: "rehashedsalt@cock.li"
|
|
account_key: "/etc/pki/cert/private/account.key"
|
|
csr: "/etc/pki/cert/csr/{{ website_url }}.csr"
|
|
dest: "/etc/pki/cert/crt/{{ website_url }}.crt"
|
|
fullchain_dest: "/etc/pki/cert/crt/{{ website_url }}-fullchain.crt"
|
|
register: com_challenge
|
|
- name: Fulfill challenge
|
|
copy:
|
|
dest: "{{ website_root }}/{{ com_challenge['challenge_data'][website_url]['http-01']['resource'] }}"
|
|
content: "{{ com_challenge['challenge_data'][website_url]['http-01']['resource_value'] }}"
|
|
when: com_challenge is changed
|
|
- name: Create certificate
|
|
acme_certificate:
|
|
account_key: /etc/pki/cert/private/account.key
|
|
csr: "/etc/pki/cert/csr/{{ website_url }}.csr"
|
|
dest: "/etc/pki/cert/crt/{{ website_url }}.crt"
|
|
fullchain_dest: "/etc/pki/cert/crt/{{ website_url }}-fullchain.crt"
|
|
chain_dest: "/etc/pki/cert/crt/{{ website_url }}-intermediate.crt"
|
|
data: "{{ com_challenge }}"
|
|
become: yes
|