summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--inventory/host_vars/sk-cloudio/nextcloud.yml8
-rw-r--r--roles/apps/nextcloud/defaults/main.yml10
-rw-r--r--roles/apps/nextcloud/instance/tasks/main.yml72
-rw-r--r--roles/apps/nextcloud/instance/templates/apache-site.conf.j210
-rw-r--r--roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j211
5 files changed, 93 insertions, 18 deletions
diff --git a/inventory/host_vars/sk-cloudio/nextcloud.yml b/inventory/host_vars/sk-cloudio/nextcloud.yml
index df947c89..3c5e5ae0 100644
--- a/inventory/host_vars/sk-cloudio/nextcloud.yml
+++ b/inventory/host_vars/sk-cloudio/nextcloud.yml
@@ -96,8 +96,6 @@ nextcloud_instances:
# new: true
version: 29.0.3
port: 8105
- hostnames:
- - wolke.elev8.at
storage:
type: zfs
parent: "{{ _nextcloud_zfs_base_ }}"
@@ -110,3 +108,9 @@ nextcloud_instances:
type: mariadb
version: 10.11.5
password: "{{ vault_nextcloud_database_passwords['wolke.elev8.at'] }}"
+ publish:
+ zone: "{{ apps_publish_zone__sk_cloudio }}"
+ hostnames:
+ - wolke.elev8.at
+ tls:
+ certificate_provider: acmetool
diff --git a/roles/apps/nextcloud/defaults/main.yml b/roles/apps/nextcloud/defaults/main.yml
index ac87de94..158da180 100644
--- a/roles/apps/nextcloud/defaults/main.yml
+++ b/roles/apps/nextcloud/defaults/main.yml
@@ -13,9 +13,6 @@ nextcloud_redis_gid: "952"
# new: yes
# version: 17.0.0
# port: 8100
-# hostnames:
-# - wolke.example.com
-# - cloud.example.com
# storage:
# type: ...
# database:
@@ -26,3 +23,10 @@ nextcloud_redis_gid: "952"
# from: foo/bar:1.0 # optional
# dockerfile: |
# RUN apt-get install ...
+# publish:
+# zone: "{{ apps_publish_zone__foo }}"
+# hostnames:
+# - wolke.example.com
+# - cloud.example.com
+# tls:
+# certificate_provider: ...
diff --git a/roles/apps/nextcloud/instance/tasks/main.yml b/roles/apps/nextcloud/instance/tasks/main.yml
index 373aa0a8..3c8928b2 100644
--- a/roles/apps/nextcloud/instance/tasks/main.yml
+++ b/roles/apps/nextcloud/instance/tasks/main.yml
@@ -47,6 +47,43 @@
dest: "{{ nextcloud_instance_basepath }}/config/ports.conf"
+- name: create tls directory
+ file:
+ path: "{{ nextcloud_instance_basepath }}/tls"
+ owner: "{{ nextcloud_app_uid }}"
+ group: "{{ nextcloud_app_gid }}"
+ mode: 0500
+ state: directory
+
+- name: generate/install TLS certificates for publishment
+ vars:
+ x509_certificate_name: "nextcloud-{{ nextcloud_instance }}_publish"
+ x509_certificate_hostnames: []
+ x509_certificate_config:
+ ca: "{{ nextcloud_instances[nextcloud_instance].publish.zone.certificate_ca_config }}"
+ cert:
+ common_name: "nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}"
+ extended_key_usage:
+ - serverAuth
+ extended_key_usage_critical: yes
+ create_subject_key_identifier: yes
+ not_after: +100w
+ x509_certificate_renewal:
+ install:
+ - dest: "{{ nextcloud_instance_basepath }}/tls/cert.pem"
+ src:
+ - cert
+ owner: "{{ nextcloud_app_uid }}"
+ mode: "0400"
+ - dest: "{{ nextcloud_instance_basepath }}/tls/key.pem"
+ src:
+ - key
+ owner: "{{ nextcloud_app_uid }}"
+ mode: "0400"
+ include_role:
+ name: "x509/{{ nextcloud_instances[nextcloud_instance].publish.zone.certificate_provider }}/cert"
+
+
- name: build custom image
# when: "'custom_image' in nextcloud_instances[nextcloud_instance]"
include_tasks: custom-image.yml
@@ -84,29 +121,44 @@
enabled: yes
-- name: configure nginx vhost
+- name: configure nginx vhost for publishment
vars:
- nginx_vhost:
- name: "nextcloud-{{ nextcloud_instance }}"
+ nginx_vhost__yaml: |
+ name: "nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}"
template: generic
+ {% if 'tls' in nextcloud_instances[nextcloud_instance].publish %}
tls:
- certificate_provider: "{{ acme_client }}"
- hostnames: "{{ nextcloud_instances[nextcloud_instance].hostnames }}"
+ {{ nextcloud_instances[nextcloud_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }}
+ {% endif %}
+ hostnames:
+ {% for hostname in nextcloud_instances[nextcloud_instance].publish.hostnames %}
+ - {{ hostname }}
+ {% endfor %}
locations:
'/':
- proxy_pass: "http://127.0.0.1:{{ nextcloud_instances[nextcloud_instance].port }}"
+ {% if nextcloud_instances[nextcloud_instance].publish.zone.publisher == inventory_hostname %}
+ proxy_pass: "https://127.0.0.1:{{ nextcloud_instances[nextcloud_instance].port }}"
+ {% else %}
+ proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ nextcloud_instances[nextcloud_instance].port }}"
+ {% endif %}
proxy_redirect:
- - redirect: "http://$host/"
- replacement: "https://$host/"
- - redirect: "http://$host:8080/"
+ - redirect: "https://$host:8080/"
replacement: "https://$host/"
+ proxy_ssl:
+ trusted_certificate: "/etc/ssl/apps-publish-{{ nextcloud_instances[nextcloud_instance].publish.zone.name }}/apps-publish-{{ nextcloud_instances[nextcloud_instance].publish.zone.name }}-ca-crt.pem"
+ verify: "on"
+ name: "nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}"
+ protocols: "TLSv1.3"
extra_directives: |-
client_max_body_size 0;
types {
text/javascript js mjs;
}
+ nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}"
include_role:
name: nginx/vhost
+ apply:
+ delegate_to: "{{ nextcloud_instances[nextcloud_instance].publish.zone.publisher }}"
# TODO:
@@ -118,7 +170,7 @@
prompt: |
************* {{ nextcloud_instance }} is a new instance
**
- ** Go to https://{{ nextcloud_instances[nextcloud_instance].hostnames[0] }} and finalize the
+ ** Go to https://{{ nextcloud_instances[nextcloud_instance].publish.hostnames[0] }} and finalize the
** installation. After that run the following commands:
**
** $ nextcloud-occ {{ nextcloud_instance }} config:system:set default_phone_region --value='at'
diff --git a/roles/apps/nextcloud/instance/templates/apache-site.conf.j2 b/roles/apps/nextcloud/instance/templates/apache-site.conf.j2
index a52a7fc5..8df06113 100644
--- a/roles/apps/nextcloud/instance/templates/apache-site.conf.j2
+++ b/roles/apps/nextcloud/instance/templates/apache-site.conf.j2
@@ -1,3 +1,7 @@
+IncludeOptional mods-available/socache_shmcb.load
+IncludeOptional mods-available/ssl.load
+IncludeOptional mods-available/ssl.conf
+
<VirtualHost *:8080>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
@@ -5,6 +9,12 @@
UseCanonicalName Off
UseCanonicalPhysicalPort Off
+ ServerName nextcloud-{{ nextcloud_instance }}.{{ inventory_hostname }}
+ SSLEngine on
+ SSLCertificateFile "/etc/ssl/publish/cert.pem"
+ SSLCertificateKeyFile "/etc/ssl/publish/key.pem"
+ SSLProtocol TLSv1.3
+
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
diff --git a/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2 b/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2
index 42d76757..c1a4f2ea 100644
--- a/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2
+++ b/roles/apps/nextcloud/instance/templates/pod-spec-with-mariadb.yml.j2
@@ -13,9 +13,7 @@ containers:
{% if 'new' in nextcloud_instances[nextcloud_instance] and nextcloud_instances[nextcloud_instance].new %}
env:
- name: NEXTCLOUD_TRUSTED_DOMAINS
- value: "{{ nextcloud_instances[nextcloud_instance].hostnames | join(' ') }}"
- - name: OVERWRITEPROTOCOL
- value: "https"
+ value: "{{ nextcloud_instances[nextcloud_instance].publish.hostnames | join(' ') }}"
- name: MYSQL_HOST
value: 127.0.0.1
- name: MYSQL_DATABASE
@@ -36,6 +34,9 @@ containers:
mountPath: /etc/apache2/ports.conf
subPath: ports.conf
readOnly: true
+ - name: tls
+ mountPath: /etc/ssl/publish
+ readOnly: true
ports:
- containerPort: 8080
hostPort: {{ nextcloud_instances[nextcloud_instance].port }}
@@ -91,6 +92,10 @@ volumes:
hostPath:
path: "{{ nextcloud_instance_basepath }}/config/"
type: Directory
+- name: tls
+ hostPath:
+ path: "{{ nextcloud_instance_basepath }}/tls/"
+ type: Directory
- name: nextcloud
hostPath:
path: "{{ nextcloud_instance_basepath }}/nextcloud"