added apparmor write permission

playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml

@@ -437,6 +437,20 @@
         line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom"
       notify: Restart Apache
 
+    - name: Allow Apache AppArmor profile to write to Nextcloud config
+      ansible.builtin.blockinfile:
+        path: /etc/apparmor.d/local/usr.sbin.apache2
+        create: true
+        owner: root
+        group: root
+        mode: "0644"
+        block: |
+          {{ nextcloud_install_dir }}/ r,
+          {{ nextcloud_install_dir }}/** rw,
+          {{ nextcloud_data_dir }}/ r,
+          {{ nextcloud_data_dir }}/** rw,
+      notify: Reload AppArmor
+
     # ---------------------------------------------------------------
     # Setup fail2ban for Nextcloud
     # ---------------------------------------------------------------
@@ -497,5 +511,7 @@
       ansible.builtin.systemd:
         name: apache2
         state: restarted
+    - name: Reload AppArmor
+      ansible.builtin.command: apparmor_parser -r /etc/apparmor.d/usr.sbin.apache2
 
 # This file was written by Ebbe Baß (umpi) - ebbe@ping-mee.de