From 5ad9fc5e963b9a461f60799d7f185a9e2e13522f Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 3 Dec 2018 03:37:19 +0100 Subject: Define new host "calima" serving Nextcloud. --- roles/common/templates/etc/iptables/services.j2 | 4 +- .../lacme/templates/etc/lacme/lacme-certs.conf.j2 | 9 ++ roles/nextcloud/files/etc/cron.d/nextcloud | 2 + roles/nextcloud/files/etc/ldap/ldap.conf | 10 ++ .../files/etc/nginx/sites-available/nextcloud | 112 +++++++++++++++++++++ roles/nextcloud/handlers/main.yml | 6 ++ roles/nextcloud/tasks/ldap.yml | 17 ++++ roles/nextcloud/tasks/main.yml | 108 ++++++++++++++++++++ .../nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 | 1 + 9 files changed, 267 insertions(+), 2 deletions(-) create mode 100644 roles/nextcloud/files/etc/cron.d/nextcloud create mode 100644 roles/nextcloud/files/etc/ldap/ldap.conf create mode 100644 roles/nextcloud/files/etc/nginx/sites-available/nextcloud create mode 100644 roles/nextcloud/handlers/main.yml create mode 100644 roles/nextcloud/tasks/ldap.yml create mode 100644 roles/nextcloud/tasks/main.yml create mode 120000 roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 (limited to 'roles') diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2 index 563a310..8c606e8 100644 --- a/roles/common/templates/etc/iptables/services.j2 +++ b/roles/common/templates/etc/iptables/services.j2 @@ -22,7 +22,7 @@ out udp 123 123 # NTP in tcp {{ ansible_port|default('22') }} # SSH {% if 'LDAP-provider' in group_names %} in tcp 636 # LDAPS -{% elif 'MX' in group_names or 'lists' in group_names %} +{% elif 'MX' in group_names or 'lists' in group_names or 'nextcloud' in group_names %} out tcp 636 # LDAPS {% endif %} {% if 'MX' in group_names %} @@ -38,7 +38,7 @@ in tcp 4190 # MANAGESIEVE {% if 'MSA' in group_names %} in tcp 587 # SMTP-AUTH {% endif %} -{% if 'webmail' in group_names or 'lists' in group_names or 'wiki' in group_names %} +{% if 'webmail' in group_names or 'lists' in group_names or 'wiki' in group_names or 'nextcloud' in group_names %} in tcp 80,443 # HTTP/HTTPS {% endif %} {% if 'LDAP-provider' in group_names %} diff --git a/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2 b/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2 index f7b255a..8550d0f 100644 --- a/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2 +++ b/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2 @@ -60,4 +60,13 @@ subject = /O=Fripost/CN=git.fripost.org notify = /bin/systemctl reload nginx {% endif %} +{% if 'nextcloud' in group_names %} +[cloud] +certificate-key = /etc/nginx/ssl/cloud.fripost.org.key +certificate-chain = /etc/nginx/ssl/cloud.fripost.org.pem +subject = /O=Fripost/CN=cloud.fripost.org +subjectAltName = DNS:cloud.fripost.org,DNS:www.cloud.fripost.org +notify = /bin/systemctl reload nginx +{% endif %} + ; vim:ft=dosini diff --git a/roles/nextcloud/files/etc/cron.d/nextcloud b/roles/nextcloud/files/etc/cron.d/nextcloud new file mode 100644 index 0000000..8bd7d86 --- /dev/null +++ b/roles/nextcloud/files/etc/cron.d/nextcloud @@ -0,0 +1,2 @@ +MAILTO=root +*/15 * * * * www-data php -f /var/www/nextcloud/cron.php diff --git a/roles/nextcloud/files/etc/ldap/ldap.conf b/roles/nextcloud/files/etc/ldap/ldap.conf new file mode 100644 index 0000000..5f388f1 --- /dev/null +++ b/roles/nextcloud/files/etc/ldap/ldap.conf @@ -0,0 +1,10 @@ +# +# LDAP Defaults +# + +# See ldap.conf(5) for details +# This file should be world readable but not world writable. + +# TLS certificates (needed for GnuTLS) +TLS_CACERT /etc/ldap/ssl/ldap.fripost.org.pem +TLS_REQCERT hard diff --git a/roles/nextcloud/files/etc/nginx/sites-available/nextcloud b/roles/nextcloud/files/etc/nginx/sites-available/nextcloud new file mode 100644 index 0000000..9e5e9b0 --- /dev/null +++ b/roles/nextcloud/files/etc/nginx/sites-available/nextcloud @@ -0,0 +1,112 @@ +server { + listen 80; + listen [::]:80; + + server_name cloud.fripost.org; + + include snippets/acme-challenge.conf; + + access_log /var/log/nginx/cloud.access.log; + error_log /var/log/nginx/cloud.error.log info; + + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name cloud.fripost.org; + + root /var/www/nextcloud/; + + include snippets/headers.conf; + add_header X-Robots-Tag none; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + + include snippets/ssl.conf; + ssl_certificate ssl/cloud.fripost.org.pem; + ssl_certificate_key ssl/cloud.fripost.org.key; + include snippets/cloud.fripost.org.hpkp-hdr; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + access_log /var/log/nginx/cloud.access.log; + error_log /var/log/nginx/cloud.error.log info; + + location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; } + location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; } + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + fastcgi_buffer_size 32k; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + error_page 403 /core/templates/403.php; + error_page 404 /core/templates/404.php; + + location = / { return 303 $scheme://$host/apps/files/; } + location / { rewrite ^ /index.php$uri last; } + + location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { internal; } + location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { internal; } + + location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) { + fastcgi_split_path_info ^(.+\.php)(/.*)$; + include snippets/fastcgi-php.conf; + fastcgi_param modHeadersAvailable true; + fastcgi_param front_controller_active true; + fastcgi_request_buffering off; + fastcgi_param PHP_VALUE "upload_max_filesize=512M + post_max_size=512M + memory_limit=512M"; + fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/mnt/nextcloud-data:/etc/nextcloud:/usr/share/php:/tmp:/dev"; + } + + location ~ ^/(?:updater|ocs-provider)(?:$|/) { + try_files $uri/ =404; + index index.php; + } + + location ~* \.(?:css|js|woff|svg|gif)$ { + try_files $uri /index.php$uri$is_args$args; + expires 30d; + } + + location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ { + try_files $uri /index.php$uri$is_args$args; + } +} + +server { + listen 80; + listen [::]:80; + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name www.cloud.fripost.org; + + include snippets/acme-challenge.conf; + + access_log /var/log/nginx/cloud.access.log; + error_log /var/log/nginx/cloud.error.log info; + + location / { + return 301 https://cloud.fripost.org$request_uri; + } +} diff --git a/roles/nextcloud/handlers/main.yml b/roles/nextcloud/handlers/main.yml new file mode 100644 index 0000000..6552940 --- /dev/null +++ b/roles/nextcloud/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: Restart php7.0-fpm + service: name=php7.0-fpm state=restarted + +- name: Restart Nginx + service: name=nginx state=restarted diff --git a/roles/nextcloud/tasks/ldap.yml b/roles/nextcloud/tasks/ldap.yml new file mode 100644 index 0000000..17cd963 --- /dev/null +++ b/roles/nextcloud/tasks/ldap.yml @@ -0,0 +1,17 @@ +- name: Create /etc/ldap/ssl + file: path=/etc/ldap/ssl + state=directory + owner=root group=root + mode=0755 + +- name: Copy the slapd X.509 certificate + copy: src=certs/ldap/ldap.fripost.org.pem + dest=/etc/ldap/ssl/ldap.fripost.org.pem + owner=root group=root + mode=0644 + +- name: Copy ldap.conf(5) + copy: src=etc/ldap/ldap.conf + dest=/etc/ldap/ldap.conf + owner=root group=root + mode=0644 diff --git a/roles/nextcloud/tasks/main.yml b/roles/nextcloud/tasks/main.yml new file mode 100644 index 0000000..09554e0 --- /dev/null +++ b/roles/nextcloud/tasks/main.yml @@ -0,0 +1,108 @@ +- name: Install PHP + apt: pkg={{ packages }} + vars: + packages: + - php-cli + - php-fpm + - php-apcu + - php-gd + - php-imagick + - php-mbstring + - php-mcrypt + - php-xml + - php-curl + - php-intl + - php-ldap + - php-mysql + - php-zip + - php-json + +- name: Configure PHP 7.0 Zend opcache + lineinfile: dest=/etc/php/7.0/fpm/php.ini + regexp='^;?{{ item.var }}\\s*=' + line="{{ item.var }} = {{ item.value }}" + owner=root group=root + mode=0644 + with_items: + - { var: opcache.enable, value: 1 } + - { var: opcache.enable_cli, value: 1 } + - { var: opcache.memory_consumption, value: 128 } + - { var: opcache.interned_strings_buffer, value: 8 } + - { var: opcache.max_accelerated_files, value: 10000 } + - { var: opcache.revalidate_freq, value: 1 } + - { var: opcache.fast_shutdown, value: 1 } + notify: + - Restart php7.0-fpm + +- name: Configure PHP 7.0 pool environment + lineinfile: dest=/etc/php/7.0/fpm/pool.d/www.conf + regexp='^;?env\[{{ item.var }}\]\\s*=' + line="env[{{ item.var }}] = {{ item.value }}" + owner=root group=root + mode=0644 + with_items: + - { var: HOSTNAME, value: "$HOSTNAME" } + - { var: PATH, value: "/usr/bin:/bin" } + - { var: TMP, value: "/tmp" } + - { var: TMPDIR, value: "/tmp" } + - { var: TEMP, value: "/tmp" } + notify: + - Restart php7.0-fpm + +- name: Start php7.0-fpm + service: name=php7.0-fpm state=started + +- name: Copy /etc/cron.d/nextcloud + copy: src=etc/cron.d/nextcloud + dest=/etc/cron.d/nextcloud + owner=root group=root + mode=0644 + +- name: Copy /etc/nginx/sites-available/nextcloud + copy: src=etc/nginx/sites-available/nextcloud + dest=/etc/nginx/sites-available/nextcloud + owner=root group=root + mode=0644 + register: r1 + notify: + - Restart Nginx + +- name: Create /etc/nginx/sites-enabled/nextcloud + file: src=../sites-available/nextcloud + dest=/etc/nginx/sites-enabled/nextcloud + owner=root group=root + state=link force=yes + register: r2 + notify: + - Restart Nginx + +- name: Copy HPKP header snippet + # never modify the pined pubkeys as we don't want to lock out our users + template: src=etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 + dest=/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr + validate=/bin/false + owner=root group=root + mode=0644 + register: r3 + notify: + - Restart Nginx + +- name: Start Nginx + service: name=nginx state=started + when: not (r1.changed or r2.changed or r3.changed) + +- meta: flush_handlers + +- name: Fetch Nginx's X.509 certificate + # Ensure we don't fetch private data + become: False + fetch_cmd: cmd="openssl x509 -noout -pubkey" + stdin=/etc/nginx/ssl/cloud.fripost.org.pem + dest=certs/public/cloud.fripost.org.pub + tags: + - genkey + +- import_tasks: ldap.yml + when: "'LDAP-provider' not in group_names" + tags: + - ldap diff --git a/roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 b/roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 new file mode 120000 index 0000000..a8ba598 --- /dev/null +++ b/roles/nextcloud/templates/etc/nginx/snippets/cloud.fripost.org.hpkp-hdr.j2 @@ -0,0 +1 @@ +../../../../../../certs/hpkp-hdr.j2 \ No newline at end of file -- cgit v1.2.3