Define new host "calima" serving Nextcloud.

9 files changed, 267 insertions, 2 deletions

diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 563a310..8c606e8 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -22,7 +22,7 @@ out     udp     123      123                            # NTP
 in      tcp     {{ ansible_port|default('22') }}        # SSH
 {% if 'LDAP-provider' in group_names %}
 in      tcp     636                                     # LDAPS
-{% elif 'MX' in group_names or  'lists' in group_names %}
+{% elif 'MX' in group_names or 'lists' in group_names or 'nextcloud' in group_names %}
 out     tcp     636                                     # LDAPS
 {% endif %}
 {% if 'MX' in group_names %}
@@ -38,7 +38,7 @@ in      tcp     4190                                    # MANAGESIEVE
 {% if 'MSA' in group_names %}
 in      tcp     587                                     # SMTP-AUTH
 {% endif %}
-{% if 'webmail' in group_names or 'lists' in group_names or 'wiki' in group_names %}
+{% if 'webmail' in group_names or 'lists' in group_names or 'wiki' in group_names or 'nextcloud' in group_names %}
 in      tcp     80,443                                  # HTTP/HTTPS
 {% endif %}
 {% if 'LDAP-provider' in group_names %}
diff --git a/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2 b/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2
index f7b255a..8550d0f 100644
--- a/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2
+++ b/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2
@@ -60,4 +60,13 @@ subject = /O=Fripost/CN=git.fripost.org
 notify = /bin/systemctl reload nginx
 {% endif %}
 
+{% if 'nextcloud' in group_names %}
+[cloud]
+certificate-key = /etc/nginx/ssl/cloud.fripost.org.key
+certificate-chain = /etc/nginx/ssl/cloud.fripost.org.pem
+subject = /O=Fripost/CN=cloud.fripost.org
+subjectAltName = DNS:cloud.fripost.org,DNS:www.cloud.fripost.org
+notify = /bin/systemctl reload nginx
+{% endif %}
+
 ; vim:ft=dosini
diff --git a/roles/nextcloud/files/etc/cron.d/nextcloud b/roles/nextcloud/files/etc/cron.d/nextcloud
new file mode 100644
index 0000000..8bd7d86
--- /dev/null
+++ b/roles/nextcloud/files/etc/cron.d/nextcloud
@@ -0,0 +1,2 @@
+MAILTO=root
+*/15 * * * * www-data php -f /var/www/nextcloud/cron.php
diff --git a/roles/nextcloud/files/etc/ldap/ldap.conf b/roles/nextcloud/files/etc/ldap/ldap.conf
new file mode 100644
index 0000000..5f388f1
--- /dev/null
+++ b/roles/nextcloud/files/etc/ldap/ldap.conf
@@ -0,0 +1,10 @@
+#
+# LDAP Defaults
+#
+
+# See ldap.conf(5) for details
+# This file should be world readable but not world writable.
+
+# TLS certificates (needed for GnuTLS)
+TLS_CACERT  /etc/ldap/ssl/ldap.fripost.org.pem
+TLS_REQCERT hard
diff --git a/roles/nextcloud/files/etc/nginx/sites-available/nextcloud b/roles/nextcloud/files/etc/nginx/sites-available/nextcloud
new file mode 100644
index 0000000..9e5e9b0
--- /dev/null
+++ b/roles/nextcloud/files/etc/nginx/sites-available/nextcloud
@@ -0,0 +1,112 @@
+server {
+    listen      80;
+    listen [::]:80;
+
+    server_name cloud.fripost.org;
+
+    include snippets/acme-challenge.conf;
+
+    access_log  /var/log/nginx/cloud.access.log;
+    error_log   /var/log/nginx/cloud.error.log info;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen      443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name cloud.fripost.org;
+
+    root /var/www/nextcloud/;
+
+    include snippets/headers.conf;
+    add_header X-Robots-Tag                      none;
+    add_header X-Download-Options                noopen;
+    add_header X-Permitted-Cross-Domain-Policies none;
+
+    include snippets/ssl.conf;
+    ssl_certificate     ssl/cloud.fripost.org.pem;
+    ssl_certificate_key ssl/cloud.fripost.org.key;
+    include             snippets/cloud.fripost.org.hpkp-hdr;
+
+    location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
+    }
+
+    access_log  /var/log/nginx/cloud.access.log;
+    error_log   /var/log/nginx/cloud.error.log info;
+
+    location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; }
+    location = /.well-known/caldav  { return 301 $scheme://$host/remote.php/dav; }
+
+    # set max upload size
+    client_max_body_size 512M;
+    fastcgi_buffers 64 4K;
+    fastcgi_buffer_size 32k;
+
+    # Enable gzip but do not remove ETag headers
+    gzip on;
+    gzip_vary on;
+    gzip_comp_level 4;
+    gzip_min_length 256;
+    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+    error_page 403 /core/templates/403.php;
+    error_page 404 /core/templates/404.php;
+
+    location = / { return 303 $scheme://$host/apps/files/; }
+    location   / { rewrite ^ /index.php$uri last; }
+
+    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { internal; }
+    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)         { internal; }
+
+    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
+        fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        include snippets/fastcgi-php.conf;
+        fastcgi_param modHeadersAvailable     true;
+        fastcgi_param front_controller_active true;
+        fastcgi_request_buffering off;
+        fastcgi_param PHP_VALUE "upload_max_filesize=512M
+                                 post_max_size=512M
+                                 memory_limit=512M";
+        fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/mnt/nextcloud-data:/etc/nextcloud:/usr/share/php:/tmp:/dev";
+    }
+
+    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
+        try_files $uri/ =404;
+        index index.php;
+    }
+
+    location ~* \.(?:css|js|woff|svg|gif)$ {
+        try_files $uri /index.php$uri$is_args$args;
+        expires 30d;
+    }
+
+    location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
+        try_files $uri /index.php$uri$is_args$args;
+    }
+}
+
+server {
+    listen      80;
+    listen [::]:80;
+    listen      443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name www.cloud.fripost.org;
+
+    include snippets/acme-challenge.conf;
+
+    access_log  /var/log/nginx/cloud.access.log;
+    error_log   /var/log/nginx/cloud.error.log info;
+
+    location / {
+        return 301 https://cloud.fripost.org$request_uri;
+    }
+}
diff --git a/roles/nextcloud/handlers/main.yml b/roles/nextcloud/handlers/main.yml
new file mode 100644
index 0000000..6552940
--- /dev/null
+++ b/roles/nextcloud/handlers/main.yml
@@ -0,0 +1,6 @@
+---
+- name: Restart php7.0-fpm
+  service: name=php7.0-fpm state=restarted
+
+- name: Restart Nginx
+  service: name=nginx state=restarted
diff --git a/roles/nextcloud/tasks/ldap.yml b/roles/nextcloud/tasks/ldap.yml
new file mode 100644
index 0000000..17cd963
--- /dev/null
+++ b/roles/nextcloud/tasks/ldap.yml
@@ -0,0 +1,17 @@
+- name: Create /etc/ldap/ssl
+  file: path=/etc/ldap/ssl
+        state=directory
+        owner=root group=root
+        mode=0755
+
+- name: Copy the slapd X.509 certificate
+  copy: src=certs/ldap/ldap.fripost.org.pem
+        dest=/etc/ldap/ssl/ldap.fripost.org.pem
+        owner=root group=root
+        mode=0644
+
+- name: Copy ldap.conf(5)
+  copy: src=etc/ldap/ldap.conf
+        dest=/etc/ldap/ldap.conf
+        owner=root group=root
+        mode=0644
diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml
new file mode 100644
index 0000000..09554e0
--- /dev/null
+++ b/roles/nextcloud/tasks/main.yml
@@ -0,0 +1,108 @@
+- name: Install PHP
+  apt: pkg={{ packages }}
+  vars:
+    packages:
+    - php-cli
+    - php-fpm
+    - php-apcu
+    - php-gd
+    - php-imagick
+    - php-mbstring
+    - php-mcrypt
+    - php-xml
+    - php-curl
+    - php-intl
+    - php-ldap
+    - php-mysql
+    - php-zip
+    - php-json
+
+- name: Configure PHP 7.0 Zend opcache
+  lineinfile: dest=/etc/php/7.0/fpm/php.ini
+              regexp='^;?{{ item.var }}\\s*='
+              line="{{ item.var }} = {{ item.value }}"
+              owner=root group=root
+              mode=0644
+  with_items:
+    - { var: opcache.enable,                  value: 1     }
+    - { var: opcache.enable_cli,              value: 1     }
+    - { var: opcache.memory_consumption,      value: 128   }
+    - { var: opcache.interned_strings_buffer, value: 8     }
+    - { var: opcache.max_accelerated_files,   value: 10000 }
+    - { var: opcache.revalidate_freq,         value: 1     }
+    - { var: opcache.fast_shutdown,           value: 1     }
+  notify:
+    - Restart php7.0-fpm
+
+- name: Configure PHP 7.0 pool environment
+  lineinfile: dest=/etc/php/7.0/fpm/pool.d/www.conf
+              regexp='^;?env\[{{ item.var }}\]\\s*='
+              line="env[{{ item.var }}] = {{ item.value }}"
+              owner=root group=root
+              mode=0644
+  with_items:
+    - { var: HOSTNAME, value: "$HOSTNAME"     }
+    - { var: PATH,     value: "/usr/bin:/bin" }
+    - { var: TMP,      value: "/tmp"          }
+    - { var: TMPDIR,   value: "/tmp"          }
+    - { var: TEMP,     value: "/tmp"          }
+  notify:
+    - Restart php7.0-fpm
+
+- name: Start php7.0-fpm
+  service: name=php7.0-fpm state=started
+
+- name: Copy /etc/cron.d/nextcloud
+  copy: src=etc/cron.d/nextcloud
+        dest=/etc/cron.d/nextcloud
+        owner=root group=root
+        mode=0644
+
+- name: Copy /etc/nginx/sites-available/nextcloud
+  copy: src=etc/nginx/sites-available/nextcloud
+        dest=/etc/nginx/sites-available/nextcloud
+        owner=root group=root
+        mode=0644
+  register: r1
+  notify:
+    - Restart Nginx
+
+- name: Create /etc/nginx/sites-enabled/nextcloud
+  file: src=../sites-available/nextcloud
+        dest=/etc/nginx/sites-enabled/nextcloud
+        owner=root group=root
+        state=link force=yes
+  register: r2
+  notify:
+    - Restart Nginx
+
+- name: Copy HPKP header snippet
+  # never modify the pined pubkeys as we don't want to lock out our users
+  template: src=etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2
+            dest=/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr
+            validate=/bin/false
+            owner=root group=root
+            mode=0644
+  register: r3
+  notify:
+    - Restart Nginx
+
+- name: Start Nginx
+  service: name=nginx state=started
+  when: not (r1.changed or r2.changed or r3.changed)
+
+- meta: flush_handlers
+
+- name: Fetch Nginx's X.509 certificate
+  # Ensure we don't fetch private data
+  become: False
+  fetch_cmd: cmd="openssl x509 -noout -pubkey"
+             stdin=/etc/nginx/ssl/cloud.fripost.org.pem
+             dest=certs/public/cloud.fripost.org.pub
+  tags:
+    - genkey
+
+- import_tasks: ldap.yml
+  when: "'LDAP-provider' not in group_names"
+  tags:
+    - ldap
diff --git a/roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 b/roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2
new file mode 120000
index 0000000..a8ba598
--- /dev/null
+++ b/roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2
@@ -0,0 +1 @@
+../../../../../../certs/hpkp-hdr.j2
\ No newline at end of file