ebbe.bass/ping-mee-ansible-library
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added globalised vars

Browse Source
This commit is contained in:
Ebbe Baß
2026-07-14 14:45:29 +02:00
parent 78fbd40d73
commit 8cc8b950d6
7 changed files with 92 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml
+4 -5
View File
@@ -23,9 +23,8 @@
- name: Install richdocuments and configure Office
hosts: nextcloud
become: true
vars:
nextcloud_install_dir: "/etc/nextcloud" #EDIT based on your needs
collabora_fqdn: "collabora.test.local" #EDIT based on your needs
vars_files:
- vars/shared_vars.yml
tasks:
- name: Enable richdocuments app
@@ -40,7 +39,7 @@
- name: Point richdocuments at the Collabora server
ansible.builtin.command: >
sudo -u www-data php occ config:app:set richdocuments wopi_url
--value="https://{{ collabora_fqdn }}:443"
--value="https://{{ collabora_code_domain }}:443"
args:
chdir: /etc/nextcloud
changed_when: true
@@ -48,7 +47,7 @@
- name: Set the public WOPI URL (same value, used for editor loading)
ansible.builtin.command: >
sudo -u www-data php occ config:app:set richdocuments public_wopi_url
--value="https://{{ collabora_fqdn }}:443"
--value="https://{{ collabora_code_domain }}:443"
args:
chdir: /etc/nextcloud
changed_when: true
playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
+8 -12
View File
@@ -63,10 +63,8 @@
hosts: collabora_code
become: true
vars:
collabora_code_domain: "office.test.local" #EDIT based on your needs
collabora_admin_password: "Start2026!" #EDIT based on your needs
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
vars_files:
- vars/shared_vars.yml
tasks:
- name: Configure Collabora CODE to use the correct nextcloud domain
@@ -90,10 +88,8 @@
hosts: collabora_code
become: true
vars:
collabora_code_domain: "office.test.local" #EDIT based on your needs
ssl_cert: "/etc/ssl/certs/office-selfsigned.crt"
ssl_key: "/etc/ssl/private/office-selfsigned.key"
vars_files:
- vars/shared_vars.yml
tasks:
- name: Generate self-signed TLS certificate (10-year validity)
@@ -101,15 +97,15 @@
cmd: >
openssl req -x509 -nodes -days 3650
-newkey rsa:4096
-keyout {{ ssl_key }}
-out {{ ssl_cert }}
-keyout {{ nc_ssl_key }}
-out {{ nc_ssl_cert }}
-subj "/CN={{ collabora_code_domain }}/O=Office/C=DE"
-addext "subjectAltName=DNS:{{ collabora_code_domain }}"
creates: "{{ ssl_cert }}"
creates: "{{ nc_ssl_cert }}"
- name: Restrict private key permissions
ansible.builtin.file:
path: "{{ ssl_key }}"
path: "{{ nc_ssl_key }}"
owner: root
group: root
mode: "0600"
playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml
+41 -66
View File
@@ -24,26 +24,8 @@
hosts: nextcloud
become: true
vars:
nextcloud_version: "34.0.0" #EDIT based on your needs
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
nextcloud_data_dir: "/etc/nextcloud/data"
nextcloud_install_dir: "/etc/nextcloud"
db_name: "nextcloud" #EDIT based on your needs
db_user: "nextcloud" #EDIT based on your needs
db_password: "Start2026!" #EDIT based on your needs
admin_user: "admin" #EDIT based on your needs
admin_password: "Start2026!" #EDIT based on your needs
php_version: "8.3" #EDIT based on your needs
# TLS certificate paths (self-signed, generated by this playbook)
ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt"
ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key"
# Maintenance window (UTC): tasks run between start and start+4h
# 1 = 01:00 UTC → adjust to your timezone offset as needed
maintenance_window_start: 1
vars_files:
- vars/shared_vars.yml
# ---------------------------------------------------------------
# 1. System packages
@@ -98,15 +80,15 @@
cmd: >
openssl req -x509 -nodes -days 3650
-newkey rsa:4096
-keyout {{ ssl_key }}
-out {{ ssl_cert }}
-keyout {{ nc_ssl_key }}
-out {{ nc_ssl_cert }}
-subj "/CN={{ nextcloud_domain }}/O=Nextcloud/C=DE"
-addext "subjectAltName=DNS:{{ nextcloud_domain }}"
creates: "{{ ssl_cert }}"
creates: "{{ nc_ssl_cert }}"
- name: Restrict private key permissions
ansible.builtin.file:
path: "{{ ssl_key }}"
path: "{{ nc_ssl_key }}"
owner: root
group: root
mode: "0600"
@@ -114,32 +96,32 @@
# ---------------------------------------------------------------
# 4. PHP 8.3 + extensions
# ---------------------------------------------------------------
- name: Install PHP {{ php_version }} and extensions
- name: Install PHP {{ nc_php_version }} and extensions
ansible.builtin.apt:
name:
- "php{{ php_version }}"
- "php{{ php_version }}-cli"
- "php{{ php_version }}-common"
- "php{{ php_version }}-curl"
- "php{{ php_version }}-gd"
- "php{{ php_version }}-gmp"
- "php{{ php_version }}-imagick"
- "php{{ php_version }}-intl"
- "php{{ php_version }}-mbstring"
- "php{{ php_version }}-mysql"
- "php{{ php_version }}-opcache"
- "php{{ php_version }}-readline"
- "php{{ php_version }}-redis"
- "php{{ php_version }}-xml"
- "php{{ php_version }}-zip"
- "php{{ php_version }}-bcmath"
- "php{{ php_version }}-apcu"
- "php{{ nc_php_version }}"
- "php{{ nc_php_version }}-cli"
- "php{{ nc_php_version }}-common"
- "php{{ nc_php_version }}-curl"
- "php{{ nc_php_version }}-gd"
- "php{{ nc_php_version }}-gmp"
- "php{{ nc_php_version }}-imagick"
- "php{{ nc_php_version }}-intl"
- "php{{ nc_php_version }}-mbstring"
- "php{{ nc_php_version }}-mysql"
- "php{{ nc_php_version }}-opcache"
- "php{{ nc_php_version }}-readline"
- "php{{ nc_php_version }}-redis"
- "php{{ nc_php_version }}-xml"
- "php{{ nc_php_version }}-zip"
- "php{{ nc_php_version }}-bcmath"
- "php{{ nc_php_version }}-apcu"
state: present
notify: Restart Apache
- name: Configure PHP for Nextcloud (php.ini tweaks)
ansible.builtin.lineinfile:
path: "/etc/php/{{ php_version }}/apache2/php.ini"
path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
backup: true
@@ -154,7 +136,7 @@
- name: Enable OPcache settings
ansible.builtin.blockinfile:
path: "/etc/php/{{ php_version }}/apache2/conf.d/10-opcache.ini"
path: "/etc/php/{{ nc_php_version }}/apache2/conf.d/10-opcache.ini"
block: |
opcache.enable=1
opcache.interned_strings_buffer=32
@@ -183,7 +165,7 @@
- name: Create Nextcloud database
community.mysql.mysql_db:
name: "{{ db_name }}"
name: "{{ nc_db_name }}"
collation: utf8mb4_general_ci
encoding: utf8mb4
state: present
@@ -191,9 +173,9 @@
- name: Create Nextcloud database user
community.mysql.mysql_user:
name: "{{ db_user }}"
password: "{{ db_password }}"
priv: "{{ db_name }}.*:ALL"
name: "{{ nc_db_user }}"
password: "{{ nc_db_password }}"
priv: "{{ nc_db_name }}.*:ALL"
host: localhost
state: present
login_unix_socket: /var/run/mysqld/mysqld.sock
@@ -258,8 +240,8 @@
DocumentRoot {{ nextcloud_install_dir }}
SSLEngine on
SSLCertificateFile {{ ssl_cert }}
SSLCertificateKeyFile {{ ssl_key }}
SSLCertificateFile {{ nc_ssl_cert }}
SSLCertificateKeyFile {{ nc_ssl_key }}
# Recommended TLS hardening
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
@@ -319,11 +301,11 @@
su -s /bin/bash www-data -c \
'php {{ nextcloud_install_dir }}/occ maintenance:install \
--database "mysql" \
--database-name "{{ db_name }}" \
--database-user "{{ db_user }}" \
--database-pass "{{ db_password }}" \
--admin-user "{{ admin_user }}" \
--admin-pass "{{ admin_password }}" \
--database-name "{{ nc_db_name }}" \
--database-user "{{ nc_db_user }}" \
--database-pass "{{ nc_db_password }}" \
--admin-user "{{ nc_admin_user }}" \
--admin-pass "{{ nc_admin_password }}" \
--data-dir "{{ nextcloud_data_dir }}"'
args:
creates: "{{ nextcloud_install_dir }}/config/config.php"
@@ -361,7 +343,7 @@
ansible.builtin.shell: |
su -s /bin/bash www-data -c \
'php {{ nextcloud_install_dir }}/occ config:system:set \
maintenance_window_start --type=integer --value="{{ maintenance_window_start }}"'
nc_maintenance_window_start --type=integer --value="{{ nc_maintenance_window_start }}"'
when: occ_install.changed
# ---------------------------------------------------------------
@@ -396,20 +378,13 @@
hosts: nextcloud
become: true
vars:
nextcloud_version: "34.0.0" #EDIT based on your needs
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
nextcloud_data_dir: "/etc/nextcloud/data"
nextcloud_install_dir: "/etc/nextcloud"
fail2ban_dir: "/etc/fail2ban" #EDIT based on your needs
php_version: "8.3" #EDIT based on your needs
vars_files:
- vars/shared_vars.yml
tasks:
- name: Set correct open_basedir restriction
ansible.builtin.lineinfile:
path: "/etc/php/{{ php_version }}/apache2/php.ini"
path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
regexp: '^;?open_basedir'
line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom"
notify: Restart Apache
playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/collabora_code
-6
View File
@@ -1,6 +0,0 @@
[collabora_code]
10.0.0.103
[collabora_code:vars]
ansible_user=it-admin
ansible_password=Start2026!
playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/hosts.ini
+15
View File
@@ -0,0 +1,15 @@
[nextcloud]
10.0.0.101
10.0.0.102
[nextcloud:vars]
ansible_user=it-admin
ansible_password=Start2026!
[collabora_code]
10.0.0.103
[collabora_code:vars]
ansible_user=it-admin
ansible_password=Start2026!
playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/nextcloud
-7
View File
@@ -1,7 +0,0 @@
[nextcloud]
10.0.0.101
10.0.0.102
[nextcloud:vars]
ansible_user=it-admin
ansible_password=Start2026!
playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml
+24
View File
@@ -0,0 +1,24 @@
nextcloud_version: "34.0.0"
nextcloud_domain: "cloud.test.local"
nextcloud_data_dir: "/etc/nextcloud/data"
nextcloud_install_dir: "/etc/nextcloud"
nc_db_name: "nextcloud"
nc_db_user: "nextcloud"
nc_db_password: "Start2026!"
nc_admin_user: "admin"
nc_admin_password: "Start2026!"
nc_php_version: "8.3"
# TLS certificate paths (self-signed, generated by this playbook)
nc_ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt"
nc_ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key"
# Maintenance window (UTC): tasks run between start and start+4h
# 1 = 01:00 UTC → adjust to your timezone offset as needed
nc_maintenance_window_start: 1
fail2ban_dir: "/etc/fail2ban"
collabora_code_domain: "office.test.local"
collabora_admin_password: "Start2026!"