added http https redirect
This commit is contained in:
Ebbe Baß
+2
-2
@@ -40,7 +40,7 @@
|
||||
- name: Point richdocuments at the Collabora server
|
||||
ansible.builtin.command: >
|
||||
sudo -u www-data php occ config:app:set richdocuments wopi_url
|
||||
--value="http://{{ collabora_fqdn }}:9980"
|
||||
--value="https://{{ collabora_fqdn }}:9980"
|
||||
args:
|
||||
chdir: /etc/nextcloud
|
||||
changed_when: true
|
||||
@@ -48,7 +48,7 @@
|
||||
- name: Set the public WOPI URL (same value, used for editor loading)
|
||||
ansible.builtin.command: >
|
||||
sudo -u www-data php occ config:app:set richdocuments public_wopi_url
|
||||
--value="http://{{ collabora_fqdn }}:9980"
|
||||
--value="https://{{ collabora_fqdn }}:9980"
|
||||
args:
|
||||
chdir: /etc/nextcloud
|
||||
changed_when: true
|
||||
@@ -83,4 +83,110 @@
|
||||
name: coolwsd
|
||||
state: restarted
|
||||
|
||||
# ================================================================
|
||||
# PLAY 2 — Install apache2 and configure reverse proxy with SSL for Collabora CODE
|
||||
# ================================================================
|
||||
- name: Install apache2 and configure reverse proxy with SSL for Collabora CODE
|
||||
hosts: collabora_code
|
||||
become: true
|
||||
|
||||
vars:
|
||||
collabora_code_domain: "office.test.local" #EDIT based on your needs
|
||||
ssl_cert: "/etc/ssl/certs/office-selfsigned.crt"
|
||||
ssl_key: "/etc/ssl/private/office-selfsigned.key"
|
||||
|
||||
tasks:
|
||||
- name: Generate self-signed TLS certificate (10-year validity)
|
||||
ansible.builtin.command:
|
||||
cmd: >
|
||||
openssl req -x509 -nodes -days 3650
|
||||
-newkey rsa:4096
|
||||
-keyout {{ ssl_key }}
|
||||
-out {{ ssl_cert }}
|
||||
-subj "/CN={{ collabora_code_domain }}/O=Office/C=DE"
|
||||
-addext "subjectAltName=DNS:{{ collabora_code_domain }}"
|
||||
creates: "{{ ssl_cert }}"
|
||||
|
||||
- name: Restrict private key permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ ssl_key }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
|
||||
- name: Install apache2 and required modules
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- apache2
|
||||
- libapache2-mod-proxy-html
|
||||
- libxml2-dev
|
||||
state: present
|
||||
|
||||
- name: Enable required Apache modules
|
||||
ansible.builtin.apache2_module:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
loop:
|
||||
- proxy
|
||||
- proxy_http
|
||||
- proxy_wstunnel
|
||||
- rewrite
|
||||
- headers
|
||||
|
||||
- name: Deploy Nextcloud Apache virtual host (HTTP redirect + HTTPS)
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/apache2/sites-available/nextcloud.conf
|
||||
mode: "0644"
|
||||
content: |
|
||||
<VirtualHost *:443>
|
||||
ServerName {{ collabora_code_domain }}
|
||||
Options -Indexes
|
||||
|
||||
ErrorLog "/var/log/apache2/collabora_error"
|
||||
# Encoded slashes need to be allowed
|
||||
AllowEncodedSlashes NoDecode
|
||||
|
||||
# keep the host
|
||||
ProxyPreserveHost On
|
||||
|
||||
# static html, js, images, etc. served from coolwsd
|
||||
# loleaflet/browser is the client part of Collabora Online
|
||||
ProxyPass /loleaflet http://127.0.0.1:9980/loleaflet retry=0
|
||||
ProxyPassReverse /loleaflet http://127.0.0.1:9980/loleaflet
|
||||
ProxyPass /browser http://127.0.0.1:9980/browser retry=0
|
||||
ProxyPassReverse /browser http://127.0.0.1:9980/browser
|
||||
|
||||
# WOPI discovery URL
|
||||
ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0
|
||||
ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery
|
||||
|
||||
# Capabilities
|
||||
ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0
|
||||
ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities
|
||||
|
||||
# Main websocket
|
||||
ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
|
||||
|
||||
# Admin Console websocket
|
||||
ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws
|
||||
|
||||
# Download as, Fullscreen presentation and Image upload operations
|
||||
ProxyPass /cool http://127.0.0.1:9980/cool
|
||||
ProxyPassReverse /cool http://127.0.0.1:9980/cool
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/certs/office-selfsigned.crt
|
||||
SSLCertificateKeyFile /etc/ssl/private/office-selfsigned.key
|
||||
</VirtualHost>
|
||||
|
||||
- name: Enable Collabora virtual host
|
||||
ansible.builtin.apache2_site:
|
||||
name: collabora.conf
|
||||
state: enabled
|
||||
|
||||
- name: Restart Apache to apply changes
|
||||
ansible.builtin.service:
|
||||
name: apache2
|
||||
state: restarted
|
||||
|
||||
# This file was written by Ebbe Baß (umpi) - ebbe@ping-mee.de
|
||||
@@ -1,25 +0,0 @@
|
||||
- name: Deploy hardened Nextcloud
|
||||
hosts: nextcloud
|
||||
tags: dp-hnc
|
||||
tasks:
|
||||
- ansible.builtin.include: deploy_hardened_nextcloud.yml
|
||||
|
||||
- name: Deploy Collabora CODE
|
||||
hosts: collabora_code
|
||||
tags: dp-code
|
||||
tasks:
|
||||
- ansible.builtin.include: deploy_collabora_code.yml
|
||||
|
||||
- name: Connect Nextcloud and Collabora CODE
|
||||
hosts: nc2code
|
||||
tags: nc2code
|
||||
tasks:
|
||||
- ansible.builtin.include: connect_nextcloud_collabora.yml
|
||||
|
||||
- name: Connect Nextcloud to OpenExchange
|
||||
hosts: nc2ex
|
||||
tags: nc2ex
|
||||
tasks:
|
||||
- ansible.builtin.include: connect_nextcloud_openexchange.yml
|
||||
|
||||
# This file was written by Ebbe Baß (umpi) - ebbe@ping-mee.de
|
||||
Reference in New Issue
Block a user