diff options
Diffstat (limited to 'roles/elevate/media/templates')
7 files changed, 201 insertions, 0 deletions
diff --git a/roles/elevate/media/templates/nextcloud-apache-site.conf.j2 b/roles/elevate/media/templates/nextcloud-apache-site.conf.j2 new file mode 100644 index 00000000..a52a7fc5 --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-apache-site.conf.j2 @@ -0,0 +1,10 @@ +<VirtualHost *:8080> + ServerAdmin webmaster@localhost + DocumentRoot /var/www/html + + UseCanonicalName Off + UseCanonicalPhysicalPort Off + + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined +</VirtualHost> diff --git a/roles/elevate/media/templates/nextcloud-cron-.timer.j2 b/roles/elevate/media/templates/nextcloud-cron-.timer.j2 new file mode 100644 index 00000000..b8caa377 --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-cron-.timer.j2 @@ -0,0 +1,9 @@ +[Unit] +Description=Nextcloud cron.php job timer for %i + +[Timer] +OnCalendar=*:{{ 5 | random(seed=elevate_media_nextcloud_instance_name) }}/5 +Unit=nextcloud-cron@{{ elevate_media_nextcloud_instance_name }}.service + +[Install] +WantedBy=timers.target diff --git a/roles/elevate/media/templates/nextcloud-cron@.service.j2 b/roles/elevate/media/templates/nextcloud-cron@.service.j2 new file mode 100644 index 00000000..33623c16 --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-cron@.service.j2 @@ -0,0 +1,15 @@ +[Unit] +Description=Nextcloud cron.php job for %i + +[Service] +Type=oneshot +ExecStart={{ elevate_media_nextcloud_base_path }}/%i/config/run-cron.sh +NoNewPrivileges=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectKernelTunables=yes +ProtectControlGroups=yes +RestrictRealtime=yes +RestrictAddressFamilies=AF_UNIX AF_INET diff --git a/roles/elevate/media/templates/nextcloud-occ.j2 b/roles/elevate/media/templates/nextcloud-occ.j2 new file mode 100755 index 00000000..f12f1259 --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-occ.j2 @@ -0,0 +1,19 @@ +#!/bin/bash + +INST_NAME="$1" +shift + +if [ -z "$INST_NAME" ]; then + echo "Usage: $0 <instance> [ <arguments for occ.php> ... ]" + exit 1 +fi + +set -eu + +pod_id=$(crictl pods -q --state ready --name "^nextcloud-$INST_NAME-{{ ansible_nodename }}$") +if [ -z "$pod_id" ]; then echo "Pod not found"; exit 1; fi + +container_id=$(crictl ps -q --name '^nextcloud$' -p "$pod_id") +if [ -z "$container_id" ]; then echo "Container not found"; exit 1; fi + +exec crictl exec -it "$container_id" php /var/www/html/occ $@ diff --git a/roles/elevate/media/templates/nextcloud-pod-spec-with-mariadb.yml.j2 b/roles/elevate/media/templates/nextcloud-pod-spec-with-mariadb.yml.j2 new file mode 100644 index 00000000..b67066fc --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-pod-spec-with-mariadb.yml.j2 @@ -0,0 +1,79 @@ +securityContext: + allowPrivilegeEscalation: false +containers: +- name: nextcloud + image: "nextcloud/{{ elevate_media_nextcloud_instance_name }}:{{ elevate_media_nextcloud_instance.version }}" + securityContext: + runAsUser: {{ elevate_media_share_uid }} + runAsGroup: {{ elevate_media_share_gid }} + resources: + limits: + memory: "4Gi" +{% if 'new' in elevate_media_nextcloud_instance and elevate_media_nextcloud_instance.new %} + env: + - name: NEXTCLOUD_TRUSTED_DOMAINS + value: "{{ elevate_media_nextcloud_instance.hostnames | join(' ') }}" + - name: OVERWRITEPROTOCOL + value: "https" + - name: MYSQL_HOST + value: 127.0.0.1 + - name: MYSQL_DATABASE + value: nextcloud + - name: MYSQL_USER + value: nextcloud + - name: MYSQL_PASSWORD + value: "{{ elevate_media_nextcloud_instance.database.password }}" +{% endif %} + volumeMounts: + - name: nextcloud + mountPath: /var/www/html + - name: config + mountPath: /etc/apache2/sites-available/000-default.conf + subPath: apache-site.conf + readOnly: true + - name: config + mountPath: /etc/apache2/ports.conf + subPath: ports.conf + readOnly: true + ports: + - containerPort: 8080 + hostPort: {{ elevate_media_nextcloud_instance.port }} + hostIP: 127.0.0.1 +- name: database + image: "mariadb:{{ elevate_media_nextcloud_instance.database.version }}" + args: + - --transaction-isolation=READ-COMMITTED + - --binlog-format=ROW + securityContext: + runAsUser: {{ elevate_media_nextcloud_db_uid }} + runAsGroup: {{ elevate_media_nextcloud_db_gid }} + resources: + limits: + memory: "2Gi" +{% if 'new' in elevate_media_nextcloud_instance and elevate_media_nextcloud_instance.new %} + env: + - name: MYSQL_RANDOM_ROOT_PASSWORD + value: "true" + - name: MYSQL_DATABASE + value: nextcloud + - name: MYSQL_USER + value: nextcloud + - name: MYSQL_PASSWORD + value: "{{ elevate_media_nextcloud_instance.database.password }}" +{% endif %} + volumeMounts: + - name: database + mountPath: /var/lib/mysql +volumes: +- name: config + hostPath: + path: "{{ elevate_media_nextcloud_base_path }}/{{ elevate_media_nextcloud_instance_name }}/config/" + type: Directory +- name: nextcloud + hostPath: + path: "{{ elevate_media_nextcloud_base_path }}/{{ elevate_media_nextcloud_instance_name }}/nextcloud" + type: Directory +- name: database + hostPath: + path: "{{ elevate_media_nextcloud_base_path }}/{{ elevate_media_nextcloud_instance_name }}/{{ elevate_media_nextcloud_instance.database.type }}" + type: Directory diff --git a/roles/elevate/media/templates/nextcloud-run-cron.sh.j2 b/roles/elevate/media/templates/nextcloud-run-cron.sh.j2 new file mode 100644 index 00000000..0824d6ba --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-run-cron.sh.j2 @@ -0,0 +1,7 @@ +#!/bin/bash + +POD_NAME="{{ elevate_media_nextcloud_instance_name }}-$(hostname)" +POD_ID=$(crictl pods --name "$POD_NAME" --state ready -q) +CONTAINER_ID=$(crictl ps --pod "$POD_ID" --name nextcloud -q) + +exec crictl exec "$CONTAINER_ID" php -f /var/www/html/cron.php diff --git a/roles/elevate/media/templates/nextcloud-upgrade.j2 b/roles/elevate/media/templates/nextcloud-upgrade.j2 new file mode 100755 index 00000000..a4221edc --- /dev/null +++ b/roles/elevate/media/templates/nextcloud-upgrade.j2 @@ -0,0 +1,62 @@ +#!/bin/bash + +INST_NAME="$1" +VERSION="$2" +if [ -z "$INST_NAME" ] || [ -z "$VERSION" ]; then + echo "Usage: $0 <instance> <version>" + exit 1 +fi + +set -eu + +K8S_CONFIG_HASH_D="/etc/kubernetes/config-hashes/" +K8S_CONFIG_HASH_FILE="$K8S_CONFIG_HASH_D/nextcloud-$INST_NAME.yml" +K8S_MANIFEST_D="/etc/kubernetes/manifests/" +K8S_MANIFEST_FILE="$K8S_MANIFEST_D/nextcloud-$INST_NAME.yml" +if [ ! -e "$K8S_MANIFEST_FILE" ]; then + echo "could not find manifest file: $K8S_MANIFEST_FILE" + exit 2 +fi + +TMP_D=$(mktemp -d -t nextcloud-upgrade.XXXXXXX) +function cleanup { + rm -rf "$TMP_D" +} +trap cleanup EXIT + +IMAGE_BUILD_D="{{ elevate_media_nextcloud_base_path }}/$INST_NAME/build" +IMAGE_NAME="nextcloud" +if [ -e "$IMAGE_BUILD_D/Dockerfile" ]; then + ## this only works if docker is installed... + echo "*** Building custom image" + echo "" + sed "0,/FROM \(.*\):.*/s//FROM \1:$VERSION/" -i "$IMAGE_BUILD_D/Dockerfile" + IMAGE_NAME="nextcloud/$INST_NAME" + docker build --rm --network host -t "$IMAGE_NAME:$VERSION" "$IMAGE_BUILD_D" + echo "" +else + echo "*** Pre-Pulling the image" + echo "" + crictl pull "docker.io/library/nextcloud:$VERSION" + echo "" +fi + +echo "*** Rebuilding config-hash file" +echo "" +cat "$K8S_CONFIG_HASH_FILE" | grep '^/.*:' | sed 's/:$//' | xargs sha256sum | awk '{ print($2":\n checksum: "$1) }' > "$TMP_D/config-hash.yml" +CONFIG_HASH=$(sha256sum "$TMP_D/config-hash.yml" | awk '{ print($1) }') + +echo "*** Patching manifest file" +echo "" +sed -e "s#image: \"$IMAGE_NAME:.*\"#image: \"$IMAGE_NAME:$VERSION\"#" -e "s#config-hash: \".*\"#config-hash: \"$CONFIG_HASH\"#" "$K8S_MANIFEST_FILE" > "$TMP_D/manifest.yml" +set +e +diff -u "$K8S_MANIFEST_FILE" "$TMP_D/manifest.yml" +if [ $? -eq 0 ]; then + echo "patching file failed?" + exit 2 +fi +cat "$TMP_D/config-hash.yml" > "$K8S_CONFIG_HASH_FILE" +cat "$TMP_D/manifest.yml" > "$K8S_MANIFEST_FILE" +echo "" + +exit 0 |