blob: 2ca6026dcc4d67e18ac8c68de7577dc63a921902 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
---
- name: prepare storage volume
vars:
storage_volume: "{{ onlyoffice_instances[onlyoffice_instance].storage }}"
include_role:
name: "storage/{{ onlyoffice_instances[onlyoffice_instance].storage.type }}/volume"
- set_fact:
onlyoffice_instance_basepath: "{{ storage_volume_mountpoint }}"
- name: create onlyoffice database subdirectory
file:
path: "{{ onlyoffice_instance_basepath }}/postgres"
state: directory
- name: create onlyoffice tls subdirectory
file:
path: "{{ onlyoffice_instance_basepath }}/tls"
state: directory
mode: 0700
- name: generate/install TLS certificates for publishment
vars:
x509_certificate_name: "onlyoffice-{{ onlyoffice_instance }}_publish"
x509_certificate_hostnames: []
x509_certificate_config:
ca: "{{ onlyoffice_instances[onlyoffice_instance].publish.zone.certificate_ca_config }}"
cert:
common_name: "onlyoffice-{{ onlyoffice_instance }}.{{ inventory_hostname }}"
extended_key_usage:
- serverAuth
extended_key_usage_critical: yes
create_subject_key_identifier: yes
not_after: +100w
x509_certificate_renewal:
install:
- dest: "{{ onlyoffice_instance_basepath }}/tls/onlyoffice.crt"
src:
- cert
mode: "0400"
- dest: "{{ onlyoffice_instance_basepath }}/tls/onlyoffice.key"
src:
- key
mode: "0400"
include_role:
name: "x509/{{ onlyoffice_instances[onlyoffice_instance].publish.zone.certificate_provider }}/cert"
- name: install pod manifest
vars:
kubernetes_standalone_pod:
name: "onlyoffice-{{ onlyoffice_instance }}"
spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
mode: "0600"
include_role:
name: kubernetes/standalone/pod
- name: configure nginx vhost for publishment
vars:
nginx_vhost__yaml: |
name: "onlyoffice-{{ onlyoffice_instance }}.{{ inventory_hostname }}"
template: generic
{% if 'tls' in onlyoffice_instances[onlyoffice_instance].publish %}
tls:
{{ onlyoffice_instances[onlyoffice_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }}
{% endif %}
hostnames:
{% for hostname in onlyoffice_instances[onlyoffice_instance].publish.hostnames %}
- {{ hostname }}
{% endfor %}
locations:
'/':
{% if onlyoffice_instances[onlyoffice_instance].publish.zone.publisher == inventory_hostname %}
proxy_pass: "https://127.0.0.1:{{ onlyoffice_instances[onlyoffice_instance].port }}"
{% else %}
proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ onlyoffice_instances[onlyoffice_instance].port }}"
{% endif %}
proxy_ssl:
trusted_certificate: "/etc/ssl/apps-publish-{{ onlyoffice_instances[onlyoffice_instance].publish.zone.name }}/apps-publish-{{ onlyoffice_instances[onlyoffice_instance].publish.zone.name }}-ca-crt.pem"
verify: "on"
name: "onlyoffice-{{ onlyoffice_instance }}.{{ inventory_hostname }}"
protocols: "TLSv1.2 TLSv1.3"
extra_directives: |-
client_max_body_size 0;
nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}"
include_role:
name: nginx/vhost
apply:
delegate_to: "{{ onlyoffice_instances[onlyoffice_instance].publish.zone.publisher }}"
|
