added globalised vars
This commit is contained in:
Ebbe Baß
+41
-66
@@ -24,26 +24,8 @@
|
||||
hosts: nextcloud
|
||||
become: true
|
||||
|
||||
vars:
|
||||
nextcloud_version: "34.0.0" #EDIT based on your needs
|
||||
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
|
||||
nextcloud_data_dir: "/etc/nextcloud/data"
|
||||
nextcloud_install_dir: "/etc/nextcloud"
|
||||
|
||||
db_name: "nextcloud" #EDIT based on your needs
|
||||
db_user: "nextcloud" #EDIT based on your needs
|
||||
db_password: "Start2026!" #EDIT based on your needs
|
||||
admin_user: "admin" #EDIT based on your needs
|
||||
admin_password: "Start2026!" #EDIT based on your needs
|
||||
php_version: "8.3" #EDIT based on your needs
|
||||
|
||||
# TLS certificate paths (self-signed, generated by this playbook)
|
||||
ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt"
|
||||
ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key"
|
||||
|
||||
# Maintenance window (UTC): tasks run between start and start+4h
|
||||
# 1 = 01:00 UTC → adjust to your timezone offset as needed
|
||||
maintenance_window_start: 1
|
||||
vars_files:
|
||||
- vars/shared_vars.yml
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# 1. System packages
|
||||
@@ -98,15 +80,15 @@
|
||||
cmd: >
|
||||
openssl req -x509 -nodes -days 3650
|
||||
-newkey rsa:4096
|
||||
-keyout {{ ssl_key }}
|
||||
-out {{ ssl_cert }}
|
||||
-keyout {{ nc_ssl_key }}
|
||||
-out {{ nc_ssl_cert }}
|
||||
-subj "/CN={{ nextcloud_domain }}/O=Nextcloud/C=DE"
|
||||
-addext "subjectAltName=DNS:{{ nextcloud_domain }}"
|
||||
creates: "{{ ssl_cert }}"
|
||||
creates: "{{ nc_ssl_cert }}"
|
||||
|
||||
- name: Restrict private key permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ ssl_key }}"
|
||||
path: "{{ nc_ssl_key }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
@@ -114,32 +96,32 @@
|
||||
# ---------------------------------------------------------------
|
||||
# 4. PHP 8.3 + extensions
|
||||
# ---------------------------------------------------------------
|
||||
- name: Install PHP {{ php_version }} and extensions
|
||||
- name: Install PHP {{ nc_php_version }} and extensions
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "php{{ php_version }}"
|
||||
- "php{{ php_version }}-cli"
|
||||
- "php{{ php_version }}-common"
|
||||
- "php{{ php_version }}-curl"
|
||||
- "php{{ php_version }}-gd"
|
||||
- "php{{ php_version }}-gmp"
|
||||
- "php{{ php_version }}-imagick"
|
||||
- "php{{ php_version }}-intl"
|
||||
- "php{{ php_version }}-mbstring"
|
||||
- "php{{ php_version }}-mysql"
|
||||
- "php{{ php_version }}-opcache"
|
||||
- "php{{ php_version }}-readline"
|
||||
- "php{{ php_version }}-redis"
|
||||
- "php{{ php_version }}-xml"
|
||||
- "php{{ php_version }}-zip"
|
||||
- "php{{ php_version }}-bcmath"
|
||||
- "php{{ php_version }}-apcu"
|
||||
- "php{{ nc_php_version }}"
|
||||
- "php{{ nc_php_version }}-cli"
|
||||
- "php{{ nc_php_version }}-common"
|
||||
- "php{{ nc_php_version }}-curl"
|
||||
- "php{{ nc_php_version }}-gd"
|
||||
- "php{{ nc_php_version }}-gmp"
|
||||
- "php{{ nc_php_version }}-imagick"
|
||||
- "php{{ nc_php_version }}-intl"
|
||||
- "php{{ nc_php_version }}-mbstring"
|
||||
- "php{{ nc_php_version }}-mysql"
|
||||
- "php{{ nc_php_version }}-opcache"
|
||||
- "php{{ nc_php_version }}-readline"
|
||||
- "php{{ nc_php_version }}-redis"
|
||||
- "php{{ nc_php_version }}-xml"
|
||||
- "php{{ nc_php_version }}-zip"
|
||||
- "php{{ nc_php_version }}-bcmath"
|
||||
- "php{{ nc_php_version }}-apcu"
|
||||
state: present
|
||||
notify: Restart Apache
|
||||
|
||||
- name: Configure PHP for Nextcloud (php.ini tweaks)
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/php/{{ php_version }}/apache2/php.ini"
|
||||
path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
backup: true
|
||||
@@ -154,7 +136,7 @@
|
||||
|
||||
- name: Enable OPcache settings
|
||||
ansible.builtin.blockinfile:
|
||||
path: "/etc/php/{{ php_version }}/apache2/conf.d/10-opcache.ini"
|
||||
path: "/etc/php/{{ nc_php_version }}/apache2/conf.d/10-opcache.ini"
|
||||
block: |
|
||||
opcache.enable=1
|
||||
opcache.interned_strings_buffer=32
|
||||
@@ -183,7 +165,7 @@
|
||||
|
||||
- name: Create Nextcloud database
|
||||
community.mysql.mysql_db:
|
||||
name: "{{ db_name }}"
|
||||
name: "{{ nc_db_name }}"
|
||||
collation: utf8mb4_general_ci
|
||||
encoding: utf8mb4
|
||||
state: present
|
||||
@@ -191,9 +173,9 @@
|
||||
|
||||
- name: Create Nextcloud database user
|
||||
community.mysql.mysql_user:
|
||||
name: "{{ db_user }}"
|
||||
password: "{{ db_password }}"
|
||||
priv: "{{ db_name }}.*:ALL"
|
||||
name: "{{ nc_db_user }}"
|
||||
password: "{{ nc_db_password }}"
|
||||
priv: "{{ nc_db_name }}.*:ALL"
|
||||
host: localhost
|
||||
state: present
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
@@ -258,8 +240,8 @@
|
||||
DocumentRoot {{ nextcloud_install_dir }}
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile {{ ssl_cert }}
|
||||
SSLCertificateKeyFile {{ ssl_key }}
|
||||
SSLCertificateFile {{ nc_ssl_cert }}
|
||||
SSLCertificateKeyFile {{ nc_ssl_key }}
|
||||
|
||||
# Recommended TLS hardening
|
||||
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
||||
@@ -319,11 +301,11 @@
|
||||
su -s /bin/bash www-data -c \
|
||||
'php {{ nextcloud_install_dir }}/occ maintenance:install \
|
||||
--database "mysql" \
|
||||
--database-name "{{ db_name }}" \
|
||||
--database-user "{{ db_user }}" \
|
||||
--database-pass "{{ db_password }}" \
|
||||
--admin-user "{{ admin_user }}" \
|
||||
--admin-pass "{{ admin_password }}" \
|
||||
--database-name "{{ nc_db_name }}" \
|
||||
--database-user "{{ nc_db_user }}" \
|
||||
--database-pass "{{ nc_db_password }}" \
|
||||
--admin-user "{{ nc_admin_user }}" \
|
||||
--admin-pass "{{ nc_admin_password }}" \
|
||||
--data-dir "{{ nextcloud_data_dir }}"'
|
||||
args:
|
||||
creates: "{{ nextcloud_install_dir }}/config/config.php"
|
||||
@@ -361,7 +343,7 @@
|
||||
ansible.builtin.shell: |
|
||||
su -s /bin/bash www-data -c \
|
||||
'php {{ nextcloud_install_dir }}/occ config:system:set \
|
||||
maintenance_window_start --type=integer --value="{{ maintenance_window_start }}"'
|
||||
nc_maintenance_window_start --type=integer --value="{{ nc_maintenance_window_start }}"'
|
||||
when: occ_install.changed
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
@@ -396,20 +378,13 @@
|
||||
hosts: nextcloud
|
||||
become: true
|
||||
|
||||
vars:
|
||||
nextcloud_version: "34.0.0" #EDIT based on your needs
|
||||
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
|
||||
nextcloud_data_dir: "/etc/nextcloud/data"
|
||||
nextcloud_install_dir: "/etc/nextcloud"
|
||||
|
||||
fail2ban_dir: "/etc/fail2ban" #EDIT based on your needs
|
||||
|
||||
php_version: "8.3" #EDIT based on your needs
|
||||
vars_files:
|
||||
- vars/shared_vars.yml
|
||||
|
||||
tasks:
|
||||
- name: Set correct open_basedir restriction
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/php/{{ php_version }}/apache2/php.ini"
|
||||
path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
|
||||
regexp: '^;?open_basedir'
|
||||
line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom"
|
||||
notify: Restart Apache
|
||||
|
||||
Reference in New Issue
Block a user