From 8cc8b950d627ad2ea287b58831e3a2097bea76c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ebbe=20Ba=C3=9F?= Date: Tue, 14 Jul 2026 14:45:29 +0200 Subject: [PATCH] added globalised vars --- .../connect_nextcloud_collabora.yml | 9 +- .../deploy_collabora_code.yml | 20 ++-- .../deploy_hardened_nextcloud.yml | 107 +++++++----------- .../inventory/collabora_code | 6 - .../inventory/hosts.ini | 15 +++ .../inventory/nextcloud | 7 -- .../vars/shared_vars.yml | 24 ++++ 7 files changed, 92 insertions(+), 96 deletions(-) delete mode 100644 playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/collabora_code create mode 100644 playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/hosts.ini delete mode 100644 playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/nextcloud create mode 100644 playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml index cf3d41c..6834cda 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml @@ -23,9 +23,8 @@ - name: Install richdocuments and configure Office hosts: nextcloud become: true - vars: - nextcloud_install_dir: "/etc/nextcloud" #EDIT based on your needs - collabora_fqdn: "collabora.test.local" #EDIT based on your needs + vars_files: + - vars/shared_vars.yml tasks: - name: Enable richdocuments app @@ -40,7 +39,7 @@ - name: Point richdocuments at the Collabora server ansible.builtin.command: > sudo -u www-data php occ config:app:set richdocuments wopi_url - --value="https://{{ collabora_fqdn }}:443" + --value="https://{{ collabora_code_domain }}:443" args: chdir: /etc/nextcloud changed_when: true @@ -48,7 +47,7 @@ - name: Set the public WOPI URL (same value, used for editor loading) ansible.builtin.command: > sudo -u www-data php occ config:app:set richdocuments public_wopi_url - --value="https://{{ collabora_fqdn }}:443" + --value="https://{{ collabora_code_domain }}:443" args: chdir: /etc/nextcloud changed_when: true \ No newline at end of file diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml index fd7aae7..2ce9ce3 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml @@ -63,10 +63,8 @@ hosts: collabora_code become: true - vars: - collabora_code_domain: "office.test.local" #EDIT based on your needs - collabora_admin_password: "Start2026!" #EDIT based on your needs - nextcloud_domain: "cloud.test.local" #EDIT based on your needs + vars_files: + - vars/shared_vars.yml tasks: - name: Configure Collabora CODE to use the correct nextcloud domain @@ -90,10 +88,8 @@ hosts: collabora_code become: true - vars: - collabora_code_domain: "office.test.local" #EDIT based on your needs - ssl_cert: "/etc/ssl/certs/office-selfsigned.crt" - ssl_key: "/etc/ssl/private/office-selfsigned.key" + vars_files: + - vars/shared_vars.yml tasks: - name: Generate self-signed TLS certificate (10-year validity) @@ -101,15 +97,15 @@ cmd: > openssl req -x509 -nodes -days 3650 -newkey rsa:4096 - -keyout {{ ssl_key }} - -out {{ ssl_cert }} + -keyout {{ nc_ssl_key }} + -out {{ nc_ssl_cert }} -subj "/CN={{ collabora_code_domain }}/O=Office/C=DE" -addext "subjectAltName=DNS:{{ collabora_code_domain }}" - creates: "{{ ssl_cert }}" + creates: "{{ nc_ssl_cert }}" - name: Restrict private key permissions ansible.builtin.file: - path: "{{ ssl_key }}" + path: "{{ nc_ssl_key }}" owner: root group: root mode: "0600" diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml index fbab306..7e29363 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml @@ -24,26 +24,8 @@ hosts: nextcloud become: true - vars: - nextcloud_version: "34.0.0" #EDIT based on your needs - nextcloud_domain: "cloud.test.local" #EDIT based on your needs - nextcloud_data_dir: "/etc/nextcloud/data" - nextcloud_install_dir: "/etc/nextcloud" - - db_name: "nextcloud" #EDIT based on your needs - db_user: "nextcloud" #EDIT based on your needs - db_password: "Start2026!" #EDIT based on your needs - admin_user: "admin" #EDIT based on your needs - admin_password: "Start2026!" #EDIT based on your needs - php_version: "8.3" #EDIT based on your needs - - # TLS certificate paths (self-signed, generated by this playbook) - ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt" - ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key" - - # Maintenance window (UTC): tasks run between start and start+4h - # 1 = 01:00 UTC → adjust to your timezone offset as needed - maintenance_window_start: 1 + vars_files: + - vars/shared_vars.yml # --------------------------------------------------------------- # 1. System packages @@ -98,15 +80,15 @@ cmd: > openssl req -x509 -nodes -days 3650 -newkey rsa:4096 - -keyout {{ ssl_key }} - -out {{ ssl_cert }} + -keyout {{ nc_ssl_key }} + -out {{ nc_ssl_cert }} -subj "/CN={{ nextcloud_domain }}/O=Nextcloud/C=DE" -addext "subjectAltName=DNS:{{ nextcloud_domain }}" - creates: "{{ ssl_cert }}" + creates: "{{ nc_ssl_cert }}" - name: Restrict private key permissions ansible.builtin.file: - path: "{{ ssl_key }}" + path: "{{ nc_ssl_key }}" owner: root group: root mode: "0600" @@ -114,32 +96,32 @@ # --------------------------------------------------------------- # 4. PHP 8.3 + extensions # --------------------------------------------------------------- - - name: Install PHP {{ php_version }} and extensions + - name: Install PHP {{ nc_php_version }} and extensions ansible.builtin.apt: name: - - "php{{ php_version }}" - - "php{{ php_version }}-cli" - - "php{{ php_version }}-common" - - "php{{ php_version }}-curl" - - "php{{ php_version }}-gd" - - "php{{ php_version }}-gmp" - - "php{{ php_version }}-imagick" - - "php{{ php_version }}-intl" - - "php{{ php_version }}-mbstring" - - "php{{ php_version }}-mysql" - - "php{{ php_version }}-opcache" - - "php{{ php_version }}-readline" - - "php{{ php_version }}-redis" - - "php{{ php_version }}-xml" - - "php{{ php_version }}-zip" - - "php{{ php_version }}-bcmath" - - "php{{ php_version }}-apcu" + - "php{{ nc_php_version }}" + - "php{{ nc_php_version }}-cli" + - "php{{ nc_php_version }}-common" + - "php{{ nc_php_version }}-curl" + - "php{{ nc_php_version }}-gd" + - "php{{ nc_php_version }}-gmp" + - "php{{ nc_php_version }}-imagick" + - "php{{ nc_php_version }}-intl" + - "php{{ nc_php_version }}-mbstring" + - "php{{ nc_php_version }}-mysql" + - "php{{ nc_php_version }}-opcache" + - "php{{ nc_php_version }}-readline" + - "php{{ nc_php_version }}-redis" + - "php{{ nc_php_version }}-xml" + - "php{{ nc_php_version }}-zip" + - "php{{ nc_php_version }}-bcmath" + - "php{{ nc_php_version }}-apcu" state: present notify: Restart Apache - name: Configure PHP for Nextcloud (php.ini tweaks) ansible.builtin.lineinfile: - path: "/etc/php/{{ php_version }}/apache2/php.ini" + path: "/etc/php/{{ nc_php_version }}/apache2/php.ini" regexp: "{{ item.regexp }}" line: "{{ item.line }}" backup: true @@ -154,7 +136,7 @@ - name: Enable OPcache settings ansible.builtin.blockinfile: - path: "/etc/php/{{ php_version }}/apache2/conf.d/10-opcache.ini" + path: "/etc/php/{{ nc_php_version }}/apache2/conf.d/10-opcache.ini" block: | opcache.enable=1 opcache.interned_strings_buffer=32 @@ -183,7 +165,7 @@ - name: Create Nextcloud database community.mysql.mysql_db: - name: "{{ db_name }}" + name: "{{ nc_db_name }}" collation: utf8mb4_general_ci encoding: utf8mb4 state: present @@ -191,9 +173,9 @@ - name: Create Nextcloud database user community.mysql.mysql_user: - name: "{{ db_user }}" - password: "{{ db_password }}" - priv: "{{ db_name }}.*:ALL" + name: "{{ nc_db_user }}" + password: "{{ nc_db_password }}" + priv: "{{ nc_db_name }}.*:ALL" host: localhost state: present login_unix_socket: /var/run/mysqld/mysqld.sock @@ -258,8 +240,8 @@ DocumentRoot {{ nextcloud_install_dir }} SSLEngine on - SSLCertificateFile {{ ssl_cert }} - SSLCertificateKeyFile {{ ssl_key }} + SSLCertificateFile {{ nc_ssl_cert }} + SSLCertificateKeyFile {{ nc_ssl_key }} # Recommended TLS hardening SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 @@ -319,11 +301,11 @@ su -s /bin/bash www-data -c \ 'php {{ nextcloud_install_dir }}/occ maintenance:install \ --database "mysql" \ - --database-name "{{ db_name }}" \ - --database-user "{{ db_user }}" \ - --database-pass "{{ db_password }}" \ - --admin-user "{{ admin_user }}" \ - --admin-pass "{{ admin_password }}" \ + --database-name "{{ nc_db_name }}" \ + --database-user "{{ nc_db_user }}" \ + --database-pass "{{ nc_db_password }}" \ + --admin-user "{{ nc_admin_user }}" \ + --admin-pass "{{ nc_admin_password }}" \ --data-dir "{{ nextcloud_data_dir }}"' args: creates: "{{ nextcloud_install_dir }}/config/config.php" @@ -361,7 +343,7 @@ ansible.builtin.shell: | su -s /bin/bash www-data -c \ 'php {{ nextcloud_install_dir }}/occ config:system:set \ - maintenance_window_start --type=integer --value="{{ maintenance_window_start }}"' + nc_maintenance_window_start --type=integer --value="{{ nc_maintenance_window_start }}"' when: occ_install.changed # --------------------------------------------------------------- @@ -396,20 +378,13 @@ hosts: nextcloud become: true - vars: - nextcloud_version: "34.0.0" #EDIT based on your needs - nextcloud_domain: "cloud.test.local" #EDIT based on your needs - nextcloud_data_dir: "/etc/nextcloud/data" - nextcloud_install_dir: "/etc/nextcloud" - - fail2ban_dir: "/etc/fail2ban" #EDIT based on your needs - - php_version: "8.3" #EDIT based on your needs + vars_files: + - vars/shared_vars.yml tasks: - name: Set correct open_basedir restriction ansible.builtin.lineinfile: - path: "/etc/php/{{ php_version }}/apache2/php.ini" + path: "/etc/php/{{ nc_php_version }}/apache2/php.ini" regexp: '^;?open_basedir' line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom" notify: Restart Apache diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/collabora_code b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/collabora_code deleted file mode 100644 index e88d335..0000000 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/collabora_code +++ /dev/null @@ -1,6 +0,0 @@ -[collabora_code] -10.0.0.103 - -[collabora_code:vars] -ansible_user=it-admin -ansible_password=Start2026! \ No newline at end of file diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/hosts.ini b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/hosts.ini new file mode 100644 index 0000000..9e750e5 --- /dev/null +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/hosts.ini @@ -0,0 +1,15 @@ +[nextcloud] +10.0.0.101 +10.0.0.102 + +[nextcloud:vars] +ansible_user=it-admin +ansible_password=Start2026! + + +[collabora_code] +10.0.0.103 + +[collabora_code:vars] +ansible_user=it-admin +ansible_password=Start2026! \ No newline at end of file diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/nextcloud b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/nextcloud deleted file mode 100644 index 92759d8..0000000 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/nextcloud +++ /dev/null @@ -1,7 +0,0 @@ -[nextcloud] -10.0.0.101 -10.0.0.102 - -[nextcloud:vars] -ansible_user=it-admin -ansible_password=Start2026! \ No newline at end of file diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml new file mode 100644 index 0000000..fbcfe65 --- /dev/null +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml @@ -0,0 +1,24 @@ +nextcloud_version: "34.0.0" +nextcloud_domain: "cloud.test.local" +nextcloud_data_dir: "/etc/nextcloud/data" +nextcloud_install_dir: "/etc/nextcloud" + +nc_db_name: "nextcloud" +nc_db_user: "nextcloud" +nc_db_password: "Start2026!" +nc_admin_user: "admin" +nc_admin_password: "Start2026!" +nc_php_version: "8.3" + +# TLS certificate paths (self-signed, generated by this playbook) +nc_ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt" +nc_ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key" + +# Maintenance window (UTC): tasks run between start and start+4h +# 1 = 01:00 UTC → adjust to your timezone offset as needed +nc_maintenance_window_start: 1 + +fail2ban_dir: "/etc/fail2ban" + +collabora_code_domain: "office.test.local" +collabora_admin_password: "Start2026!" \ No newline at end of file