misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Actions Packages Projects Releases Wiki Activity

[task-406] hedgedoc

Browse source
This commit is contained in:
fenris 2025-10-09 01:47:20 +02:00
parent 5b283c7804
commit 88a65ad919
9 changed files with 81 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
roles/authelia-for-hedgedoc/cfg.schema.json Normal file
View file

@ -0,0 +1,25 @@
{
"nullable": false,
"type": "object",
"properties": {
"hedgedoc_url_base": {
"nullable": false,
"type": "string"
},
"client_id": {
"nullable": false,
"type": "string",
"default": "hedgedoc"
},
"client_secret": {
"nullable": false,
"type": "string"
}
},
"additionalProperties": false,
"required": [
"hedgedoc_url_base",
"client_id",
"client_secret"
]
}

6
roles/authelia-for-hedgedoc/defaults/main.json
View file

@ -1,5 +1,5 @@
{
"var_authelia_for_hedgedoc_hedgedoc_url_base": "https://hedgedoc.example.org",
"var_authelia_for_hedgedoc_client_id": "hedgedoc",
"var_authelia_for_hedgedoc_client_secret": "REPLACE_ME"
"cfg_authelia_for_hedgedoc_defaults": {
"client_id": "hedgedoc"
}
}

9
roles/authelia-for-hedgedoc/tasks/main.json
View file

@ -1,9 +1,16 @@
[
{
"name": "show vars",
"when": "switch_show_vars",
"ansible.builtin.debug": {
"var": "vars.cfg_authelia_for_hedgedoc"
}
},
{
"name": "configuration | compute client secret hash",
"become": true,
"ansible.builtin.shell": {
"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_hedgedoc_client_secret}} | cut --delimiter=' ' --fields='2-'"
"cmd": "authelia crypto hash generate bcrypt --password {{cfg_authelia_for_hedgedoc.client_secret}} | cut --delimiter=' ' --fields='2-'"
},
"register": "temp_authelia_for_hedgedoc_client_secret_hashed"
},

4
roles/authelia-for-hedgedoc/templates/authelia-client-conf.json.j2
View file

@ -1,5 +1,5 @@
{
"client_id": "{{var_authelia_for_hedgedoc_client_id}}",
"client_id": "{{cfg_authelia_for_hedgedoc.client_id}}",
"client_secret": "{{temp_authelia_for_hedgedoc_client_secret_hashed.stdout}}",
"client_name": "Hedgedoc",
"public": false,
@ -10,7 +10,7 @@
"profile"
],
"redirect_uris": [
"{{var_authelia_for_hedgedoc_hedgedoc_url_base}}/auth/oauth2/callback"
"{{cfg_authelia_for_hedgedoc.hedgedoc_url_base}}/auth/oauth2/callback"
],
"response_types": [
"code"

24
roles/hedgedoc-and-nginx/cfg.schema.json Normal file
View file

@ -0,0 +1,24 @@
{
"nullable": false,
"type": "object",
"properties": {
"domain": {
"nullable": false,
"type": "string"
},
"tls_mode": {
"nullable": false,
"type": "string",
"options": [
"disable",
"enable",
"force"
],
"default": "force"
}
},
"additionalProperties": false,
"required": [
"domain"
]
}

5
roles/hedgedoc-and-nginx/defaults/main.json
View file

@ -1,4 +1,5 @@
{
"var_hedgedoc_and_nginx_domain": "hedgedoc.example.org",
"var_hedgedoc_and_nginx_tls_mode": "force"
"cfg_hedgedoc_and_nginx_defaults": {
"tls_mode": "force"
}
}

13
roles/hedgedoc-and-nginx/tasks/main.json
View file

@ -1,4 +1,11 @@
[
{
"name": "show vars",
"when": "switch_show_vars",
"ansible.builtin.debug": {
"var": "vars.cfg_hedgedoc_and_nginx"
}
},
{
"name": "deactivate default site",
"become": true,
@ -12,7 +19,7 @@
"become": true,
"ansible.builtin.template": {
"src": "conf.j2",
"dest": "/etc/nginx/sites-available/{{var_hedgedoc_and_nginx_domain}}"
"dest": "/etc/nginx/sites-available/{{cfg_hedgedoc_and_nginx.domain}}"
}
},
{
@ -20,8 +27,8 @@
"become": true,
"ansible.builtin.file": {
"state": "link",
"src": "/etc/nginx/sites-available/{{var_hedgedoc_and_nginx_domain}}",
"dest": "/etc/nginx/sites-enabled/{{var_hedgedoc_and_nginx_domain}}"
"src": "/etc/nginx/sites-available/{{cfg_hedgedoc_and_nginx.domain}}",
"dest": "/etc/nginx/sites-enabled/{{cfg_hedgedoc_and_nginx.domain}}"
}
},
{

12
roles/hedgedoc-and-nginx/templates/conf.j2
View file

@ -24,27 +24,27 @@ map $http_upgrade $connection_upgrade {
{% endmacro %}
server {
server_name {{var_hedgedoc_and_nginx_domain}};
server_name {{cfg_hedgedoc_and_nginx.domain}};
listen 80;
listen [::]:80;
{% if (var_element_and_nginx_tls_mode == 'force') %}
{% if (cfg_hedgedoc_and_nginx.tls_mode == 'force') %}
return 301 https://$http_host$request_uri;
{% else %}
{{ hedgedoc_common() }}
{% endif %}
}
{% if (var_hedgedoc_and_nginx_tls_mode != 'disable') %}
{% if (cfg_hedgedoc_and_nginx.tls_mode != 'disable') %}
server {
server_name {{var_hedgedoc_and_nginx_domain}};
server_name {{cfg_hedgedoc_and_nginx.domain}};
listen [::]:443 ssl http2;
listen 443 ssl http2;
ssl_certificate_key /etc/ssl/private/{{var_hedgedoc_and_nginx_domain}}.pem;
ssl_certificate /etc/ssl/fullchains/{{var_hedgedoc_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{cfg_hedgedoc_and_nginx.domain}}.pem;
ssl_certificate /etc/ssl/fullchains/{{cfg_hedgedoc_and_nginx.domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
{{ hedgedoc_common() }}

15
roles/hedgedoc-and-nginx/vardef.json
View file

@ -1,15 +0,0 @@
{
"domain": {
"type": "string",
"mandatory": false
},
"tls_mode": {
"type": "string",
"options": [
"disable",
"enable",
"force"
],
"mandatory": false
}
}