ebbe.bass/ping-mee-ansible-library
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added globalised vars

Browse Source
This commit is contained in:
Ebbe Baß
2026-07-14 14:45:29 +02:00
parent 78fbd40d73
commit 8cc8b950d6
7 changed files with 92 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml
+4 -5
View File
@@ -23,9 +23,8 @@
- name: Install richdocuments and configure Office - name: Install richdocuments and configure Office
hosts: nextcloud hosts: nextcloud
become: true become: true
vars: vars_files:
nextcloud_install_dir: "/etc/nextcloud" #EDIT based on your needs - vars/shared_vars.yml
collabora_fqdn: "collabora.test.local" #EDIT based on your needs
tasks: tasks:
- name: Enable richdocuments app - name: Enable richdocuments app
@@ -40,7 +39,7 @@
- name: Point richdocuments at the Collabora server - name: Point richdocuments at the Collabora server
ansible.builtin.command: > ansible.builtin.command: >
sudo -u www-data php occ config:app:set richdocuments wopi_url sudo -u www-data php occ config:app:set richdocuments wopi_url
--value="https://{{ collabora_fqdn }}:443" --value="https://{{ collabora_code_domain }}:443"
args: args:
chdir: /etc/nextcloud chdir: /etc/nextcloud
changed_when: true changed_when: true
@@ -48,7 +47,7 @@
- name: Set the public WOPI URL (same value, used for editor loading) - name: Set the public WOPI URL (same value, used for editor loading)
ansible.builtin.command: > ansible.builtin.command: >
sudo -u www-data php occ config:app:set richdocuments public_wopi_url sudo -u www-data php occ config:app:set richdocuments public_wopi_url
--value="https://{{ collabora_fqdn }}:443" --value="https://{{ collabora_code_domain }}:443"
args: args:
chdir: /etc/nextcloud chdir: /etc/nextcloud
changed_when: true changed_when: true
playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml
+8 -12
View File
@@ -63,10 +63,8 @@
hosts: collabora_code hosts: collabora_code
become: true become: true
vars: vars_files:
collabora_code_domain: "office.test.local" #EDIT based on your needs - vars/shared_vars.yml
collabora_admin_password: "Start2026!" #EDIT based on your needs
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
tasks: tasks:
- name: Configure Collabora CODE to use the correct nextcloud domain - name: Configure Collabora CODE to use the correct nextcloud domain
@@ -90,10 +88,8 @@
hosts: collabora_code hosts: collabora_code
become: true become: true
vars: vars_files:
collabora_code_domain: "office.test.local" #EDIT based on your needs - vars/shared_vars.yml
ssl_cert: "/etc/ssl/certs/office-selfsigned.crt"
ssl_key: "/etc/ssl/private/office-selfsigned.key"
tasks: tasks:
- name: Generate self-signed TLS certificate (10-year validity) - name: Generate self-signed TLS certificate (10-year validity)
@@ -101,15 +97,15 @@
cmd: > cmd: >
openssl req -x509 -nodes -days 3650 openssl req -x509 -nodes -days 3650
-newkey rsa:4096 -newkey rsa:4096
-keyout {{ ssl_key }} -keyout {{ nc_ssl_key }}
-out {{ ssl_cert }} -out {{ nc_ssl_cert }}
-subj "/CN={{ collabora_code_domain }}/O=Office/C=DE" -subj "/CN={{ collabora_code_domain }}/O=Office/C=DE"
-addext "subjectAltName=DNS:{{ collabora_code_domain }}" -addext "subjectAltName=DNS:{{ collabora_code_domain }}"
creates: "{{ ssl_cert }}" creates: "{{ nc_ssl_cert }}"
- name: Restrict private key permissions - name: Restrict private key permissions
ansible.builtin.file: ansible.builtin.file:
path: "{{ ssl_key }}" path: "{{ nc_ssl_key }}"
owner: root owner: root
group: root group: root
mode: "0600" mode: "0600"
playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_hardened_nextcloud.yml
+41 -66
View File
@@ -24,26 +24,8 @@
hosts: nextcloud hosts: nextcloud
become: true become: true
vars: vars_files:
nextcloud_version: "34.0.0" #EDIT based on your needs - vars/shared_vars.yml
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
nextcloud_data_dir: "/etc/nextcloud/data"
nextcloud_install_dir: "/etc/nextcloud"
db_name: "nextcloud" #EDIT based on your needs
db_user: "nextcloud" #EDIT based on your needs
db_password: "Start2026!" #EDIT based on your needs
admin_user: "admin" #EDIT based on your needs
admin_password: "Start2026!" #EDIT based on your needs
php_version: "8.3" #EDIT based on your needs
# TLS certificate paths (self-signed, generated by this playbook)
ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt"
ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key"
# Maintenance window (UTC): tasks run between start and start+4h
# 1 = 01:00 UTC → adjust to your timezone offset as needed
maintenance_window_start: 1
# --------------------------------------------------------------- # ---------------------------------------------------------------
# 1. System packages # 1. System packages
@@ -98,15 +80,15 @@
cmd: > cmd: >
openssl req -x509 -nodes -days 3650 openssl req -x509 -nodes -days 3650
-newkey rsa:4096 -newkey rsa:4096
-keyout {{ ssl_key }} -keyout {{ nc_ssl_key }}
-out {{ ssl_cert }} -out {{ nc_ssl_cert }}
-subj "/CN={{ nextcloud_domain }}/O=Nextcloud/C=DE" -subj "/CN={{ nextcloud_domain }}/O=Nextcloud/C=DE"
-addext "subjectAltName=DNS:{{ nextcloud_domain }}" -addext "subjectAltName=DNS:{{ nextcloud_domain }}"
creates: "{{ ssl_cert }}" creates: "{{ nc_ssl_cert }}"
- name: Restrict private key permissions - name: Restrict private key permissions
ansible.builtin.file: ansible.builtin.file:
path: "{{ ssl_key }}" path: "{{ nc_ssl_key }}"
owner: root owner: root
group: root group: root
mode: "0600" mode: "0600"
@@ -114,32 +96,32 @@
# --------------------------------------------------------------- # ---------------------------------------------------------------
# 4. PHP 8.3 + extensions # 4. PHP 8.3 + extensions
# --------------------------------------------------------------- # ---------------------------------------------------------------
- name: Install PHP {{ php_version }} and extensions - name: Install PHP {{ nc_php_version }} and extensions
ansible.builtin.apt: ansible.builtin.apt:
name: name:
- "php{{ php_version }}" - "php{{ nc_php_version }}"
- "php{{ php_version }}-cli" - "php{{ nc_php_version }}-cli"
- "php{{ php_version }}-common" - "php{{ nc_php_version }}-common"
- "php{{ php_version }}-curl" - "php{{ nc_php_version }}-curl"
- "php{{ php_version }}-gd" - "php{{ nc_php_version }}-gd"
- "php{{ php_version }}-gmp" - "php{{ nc_php_version }}-gmp"
- "php{{ php_version }}-imagick" - "php{{ nc_php_version }}-imagick"
- "php{{ php_version }}-intl" - "php{{ nc_php_version }}-intl"
- "php{{ php_version }}-mbstring" - "php{{ nc_php_version }}-mbstring"
- "php{{ php_version }}-mysql" - "php{{ nc_php_version }}-mysql"
- "php{{ php_version }}-opcache" - "php{{ nc_php_version }}-opcache"
- "php{{ php_version }}-readline" - "php{{ nc_php_version }}-readline"
- "php{{ php_version }}-redis" - "php{{ nc_php_version }}-redis"
- "php{{ php_version }}-xml" - "php{{ nc_php_version }}-xml"
- "php{{ php_version }}-zip" - "php{{ nc_php_version }}-zip"
- "php{{ php_version }}-bcmath" - "php{{ nc_php_version }}-bcmath"
- "php{{ php_version }}-apcu" - "php{{ nc_php_version }}-apcu"
state: present state: present
notify: Restart Apache notify: Restart Apache
- name: Configure PHP for Nextcloud (php.ini tweaks) - name: Configure PHP for Nextcloud (php.ini tweaks)
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/php/{{ php_version }}/apache2/php.ini" path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
regexp: "{{ item.regexp }}" regexp: "{{ item.regexp }}"
line: "{{ item.line }}" line: "{{ item.line }}"
backup: true backup: true
@@ -154,7 +136,7 @@
- name: Enable OPcache settings - name: Enable OPcache settings
ansible.builtin.blockinfile: ansible.builtin.blockinfile:
path: "/etc/php/{{ php_version }}/apache2/conf.d/10-opcache.ini" path: "/etc/php/{{ nc_php_version }}/apache2/conf.d/10-opcache.ini"
block: | block: |
opcache.enable=1 opcache.enable=1
opcache.interned_strings_buffer=32 opcache.interned_strings_buffer=32
@@ -183,7 +165,7 @@
- name: Create Nextcloud database - name: Create Nextcloud database
community.mysql.mysql_db: community.mysql.mysql_db:
name: "{{ db_name }}" name: "{{ nc_db_name }}"
collation: utf8mb4_general_ci collation: utf8mb4_general_ci
encoding: utf8mb4 encoding: utf8mb4
state: present state: present
@@ -191,9 +173,9 @@
- name: Create Nextcloud database user - name: Create Nextcloud database user
community.mysql.mysql_user: community.mysql.mysql_user:
name: "{{ db_user }}" name: "{{ nc_db_user }}"
password: "{{ db_password }}" password: "{{ nc_db_password }}"
priv: "{{ db_name }}.*:ALL" priv: "{{ nc_db_name }}.*:ALL"
host: localhost host: localhost
state: present state: present
login_unix_socket: /var/run/mysqld/mysqld.sock login_unix_socket: /var/run/mysqld/mysqld.sock
@@ -258,8 +240,8 @@
DocumentRoot {{ nextcloud_install_dir }} DocumentRoot {{ nextcloud_install_dir }}
SSLEngine on SSLEngine on
SSLCertificateFile {{ ssl_cert }} SSLCertificateFile {{ nc_ssl_cert }}
SSLCertificateKeyFile {{ ssl_key }} SSLCertificateKeyFile {{ nc_ssl_key }}
# Recommended TLS hardening # Recommended TLS hardening
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
@@ -319,11 +301,11 @@
su -s /bin/bash www-data -c \ su -s /bin/bash www-data -c \
'php {{ nextcloud_install_dir }}/occ maintenance:install \ 'php {{ nextcloud_install_dir }}/occ maintenance:install \
--database "mysql" \ --database "mysql" \
--database-name "{{ db_name }}" \ --database-name "{{ nc_db_name }}" \
--database-user "{{ db_user }}" \ --database-user "{{ nc_db_user }}" \
--database-pass "{{ db_password }}" \ --database-pass "{{ nc_db_password }}" \
--admin-user "{{ admin_user }}" \ --admin-user "{{ nc_admin_user }}" \
--admin-pass "{{ admin_password }}" \ --admin-pass "{{ nc_admin_password }}" \
--data-dir "{{ nextcloud_data_dir }}"' --data-dir "{{ nextcloud_data_dir }}"'
args: args:
creates: "{{ nextcloud_install_dir }}/config/config.php" creates: "{{ nextcloud_install_dir }}/config/config.php"
@@ -361,7 +343,7 @@
ansible.builtin.shell: | ansible.builtin.shell: |
su -s /bin/bash www-data -c \ su -s /bin/bash www-data -c \
'php {{ nextcloud_install_dir }}/occ config:system:set \ 'php {{ nextcloud_install_dir }}/occ config:system:set \
maintenance_window_start --type=integer --value="{{ maintenance_window_start }}"' nc_maintenance_window_start --type=integer --value="{{ nc_maintenance_window_start }}"'
when: occ_install.changed when: occ_install.changed
# --------------------------------------------------------------- # ---------------------------------------------------------------
@@ -396,20 +378,13 @@
hosts: nextcloud hosts: nextcloud
become: true become: true
vars: vars_files:
nextcloud_version: "34.0.0" #EDIT based on your needs - vars/shared_vars.yml
nextcloud_domain: "cloud.test.local" #EDIT based on your needs
nextcloud_data_dir: "/etc/nextcloud/data"
nextcloud_install_dir: "/etc/nextcloud"
fail2ban_dir: "/etc/fail2ban" #EDIT based on your needs
php_version: "8.3" #EDIT based on your needs
tasks: tasks:
- name: Set correct open_basedir restriction - name: Set correct open_basedir restriction
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "/etc/php/{{ php_version }}/apache2/php.ini" path: "/etc/php/{{ nc_php_version }}/apache2/php.ini"
regexp: '^;?open_basedir' regexp: '^;?open_basedir'
line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom" line: "open_basedir = {{ nextcloud_install_dir }}:{{ nextcloud_data_dir }}:/tmp:/dev/urandom"
notify: Restart Apache notify: Restart Apache
playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/collabora_code
-6
View File
@@ -1,6 +0,0 @@
[collabora_code]
10.0.0.103
[collabora_code:vars]
ansible_user=it-admin
ansible_password=Start2026!
playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/hosts.ini
+15
View File
@@ -0,0 +1,15 @@
[nextcloud]
10.0.0.101
10.0.0.102
[nextcloud:vars]
ansible_user=it-admin
ansible_password=Start2026!
[collabora_code]
10.0.0.103
[collabora_code:vars]
ansible_user=it-admin
ansible_password=Start2026!
playbooks/linux/ubuntu-server/nextcloud_full_deployment/inventory/nextcloud
-7
View File
@@ -1,7 +0,0 @@
[nextcloud]
10.0.0.101
10.0.0.102
[nextcloud:vars]
ansible_user=it-admin
ansible_password=Start2026!
playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml
+24
View File
@@ -0,0 +1,24 @@
nextcloud_version: "34.0.0"
nextcloud_domain: "cloud.test.local"
nextcloud_data_dir: "/etc/nextcloud/data"
nextcloud_install_dir: "/etc/nextcloud"
nc_db_name: "nextcloud"
nc_db_user: "nextcloud"
nc_db_password: "Start2026!"
nc_admin_user: "admin"
nc_admin_password: "Start2026!"
nc_php_version: "8.3"
# TLS certificate paths (self-signed, generated by this playbook)
nc_ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt"
nc_ssl_key: "/etc/ssl/private/nextcloud-selfsigned.key"
# Maintenance window (UTC): tasks run between start and start+4h
# 1 = 01:00 UTC → adjust to your timezone offset as needed
nc_maintenance_window_start: 1
fail2ban_dir: "/etc/fail2ban"
collabora_code_domain: "office.test.local"
collabora_admin_password: "Start2026!"