misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Actions Packages Projects Releases Wiki Activity

[int]

Browse source
This commit is contained in:
Christian Fraß 2025-10-08 09:30:29 +02:00
parent cdeedc7ac3
commit c8d4e4756e
6 changed files with 148 additions and 131 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
roles/owncloud/defaults/main.json
View file

@ -1,16 +1,18 @@
{ {
"cfg_owncloud_defaults": { "var_owncloud_user": "owncloud",
"user": "owncloud", "var_owncloud_directory": "/opt/owncloud",
"directory": "/opt/owncloud", "var_owncloud_version": "5.0.0",
"version": "7.2.0", "var_owncloud_platform": "linux-amd64",
"platform": "linux-amd64", "var_owncloud_domain": "owncloud.example.org",
"domain": "owncloud.example.org", "var_owncloud_admin_password": "REPLACE_ME",
"authentication": { "var_owncloud_authentication_kind": "internal",
"kind": "internal" "var_owncloud_authentication_data_authelia_url_base": "https://authelia.example.org",
}, "var_owncloud_authentication_data_authelia_web_client_id": "owncloud_web",
"public_share": { "var_owncloud_authentication_data_authelia_web_client_secret": "REPLACE_ME",
"password_necessity": "writable", "var_owncloud_authentication_data_authelia_android_client_id": "owncloud_android",
"password_policy_active": true "var_owncloud_authentication_data_authelia_android_client_secret": "REPLACE_ME",
} "var_owncloud_authentication_data_authelia_ios_client_id": "owncloud_ios",
} "var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME",
"var_owncloud_public_share_password_necessity": "writable",
"var_owncloud_public_share_password_policy_active": true
} }

14
roles/owncloud/info.md
View file

@ -7,25 +7,13 @@ Cloud-Plattform [ownCloud](https://owncloud.com/) (the rewrite in Go named "Infi
- [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/) - [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/)
- [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/) - [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/)
- [ownCloud-Dokumentation | Upgrading](https://doc.owncloud.com/ocis/next/migration/upgrading-ocis.html)
- [ownCloud-Dokumentation | env var types](https://doc.owncloud.com/ocis/next/deployment/services/envvar-types-description.html)
- [ownCloud-Dokumentation | Service | Web](https://doc.owncloud.com/ocis/next/deployment/services/s-list/web.html)
- [ownCloud-Dokumentation | Service | Proxy](https://doc.owncloud.com/ocis/next/deployment/services/s-list/proxy.html) - [ownCloud-Dokumentation | Service | Proxy](https://doc.owncloud.com/ocis/next/deployment/services/s-list/proxy.html)
- [ownCloud-Dokumentation | Service | Web](https://doc.owncloud.com/ocis/next/deployment/services/s-list/web.html)
- [ownCloud-Dokumentation | Service | Sharing](https://doc.owncloud.com/ocis/next/deployment/services/s-list/sharing.html) - [ownCloud-Dokumentation | Service | Sharing](https://doc.owncloud.com/ocis/next/deployment/services/s-list/sharing.html)
- [GitHub | ocis](https://github.com/owncloud/ocis/) - [GitHub | ocis](https://github.com/owncloud/ocis/)
- [ownCloud-Foren | OCIS + Authelia](https://central.owncloud.org/t/ocis-authelia/44222) - [ownCloud-Foren | OCIS + Authelia](https://central.owncloud.org/t/ocis-authelia/44222)
## Bemerkungen
- die `.ocis/config/ocis.yaml` wird erzeugt auf Grundlage der `.env`
- wenn man sich plötzlich nicht mehr über OIDC anmelden kann, kann das daran lieget, dass `.ocis/idm/ldap.crt` abgelaufen ist — siehe dazu [diesen Thread](https://central.owncloud.org/t/certificate-error-after-upgrade-to-5-0-0-from-4-0-6/47824/7); man könnte auch `OCIS_LDAP_INSECURE` auf `true` setzen, aber naja…
## ToDo ## ToDo
- Download prüfen - Download prüfen
- `csp.yaml` einsetzen
- prüfen ob folgende `.env`-Variablen gebraucht werden:
- `PROXY_OIDC_ISSUER`
- `PROXY_OIDC_SKIP_USER_INFO`

65
roles/owncloud/tasks/main.json
View file

@ -1,70 +1,39 @@
[ [
{
"name": "show vars",
"when": "switch_show_vars",
"ansible.builtin.debug": {
"var": "vars.cfg_owncloud"
}
},
{ {
"name": "user", "name": "user",
"become": true, "become": true,
"ansible.builtin.user": { "ansible.builtin.user": {
"name": "{{cfg_owncloud.user}}", "name": "{{var_owncloud_user}}",
"create_home": true, "create_home": true,
"home": "{{cfg_owncloud.directory}}" "home": "{{var_owncloud_directory}}"
} }
}, },
{ {
"name": "download", "name": "download",
"become": true, "become": true,
"become_user": "{{cfg_owncloud.user}}", "become_user": "{{var_owncloud_user}}",
"ansible.builtin.get_url": { "ansible.builtin.get_url": {
"url": "https://download.owncloud.com/ocis/ocis/stable/{{cfg_owncloud.version}}/ocis-{{cfg_owncloud.version}}-{{cfg_owncloud.platform}}", "url": "https://download.owncloud.com/ocis/ocis/stable/{{var_owncloud_version}}/ocis-{{var_owncloud_version}}-{{var_owncloud_platform}}",
"dest": "{{cfg_owncloud.directory}}/ocis", "dest": "{{var_owncloud_directory}}/ocis",
"mode": "u+rx" "mode": "u+rx"
} }
}, },
{
"name": "directories",
"become": true,
"become_user": "{{cfg_owncloud.user}}",
"loop": [
"log"
],
"ansible.builtin.file": {
"state": "directory",
"recurse": true,
"path": "{{cfg_owncloud.directory}}/{{item}}"
}
},
{
"name": "csp",
"become": true,
"become_user": "{{cfg_owncloud.user}}",
"ansible.builtin.template": {
"src": "csp.yaml.j2",
"mode": "644",
"dest": "{{cfg_owncloud.directory}}/csp.yaml"
}
},
{
"name": "env",
"become": true,
"become_user": "{{cfg_owncloud.user}}",
"ansible.builtin.template": {
"src": "env.j2",
"mode": "644",
"dest": "{{cfg_owncloud.directory}}/.env"
}
},
{ {
"name": "setup", "name": "setup",
"become": true, "become": true,
"become_user": "{{cfg_owncloud.user}}", "become_user": "{{var_owncloud_user}}",
"ansible.builtin.shell": { "ansible.builtin.shell": {
"chdir": "{{cfg_owncloud.directory}}", "chdir": "{{var_owncloud_directory}}",
"cmd": "rm -f {{cfg_owncloud.directory}}/.ocis/config/ocis.yaml && ./ocis init --insecure no --admin-password={{cfg_owncloud.admin_password}}" "cmd": "rm -f {{var_owncloud_directory}}/.ocis/config/ocis.yaml && ./ocis init --insecure no --admin-password={{var_owncloud_admin_password}}"
}
},
{
"name": "configuration",
"become": true,
"become_user": "{{var_owncloud_user}}",
"ansible.builtin.template": {
"src": "env.j2",
"dest": "{{var_owncloud_directory}}/.env"
} }
}, },
{ {

87
roles/owncloud/templates/env.j2
View file

@ -1,61 +1,44 @@
## web client OCIS_URL="https://{{var_owncloud_domain}}"
WEB_LOG_LEVEL=info OCIS_INSECURE="false"
WEB_LOG_FILE={{cfg_owncloud.directory}}/log/web
WEB_LOG_PRETTY=true PROXY_TLS="false"
WEB_LOG_COLOR=true
{% if cfg_owncloud.authentication.kind == 'internal' %} {% if var_owncloud_authentication_kind == 'internal' %}
{% endif %} PROXY_AUTOPROVISION_ACCOUNTS="false"
{% if cfg_owncloud.authentication.kind == 'authelia' %}
WEB_OIDC_AUTHORITY={{cfg_owncloud.authentication.data.url_base}}
WEB_OIDC_CLIENT_ID={{cfg_owncloud.authentication.data.web.client_id}}
WEB_OIDC_RESPONSE_TYPE=code
WEB_OIDC_SCOPE=openid profile email groups
WEB_OPTION_LOGIN_URL={{cfg_owncloud.authentication.data.url_base}}
WEB_OPTION_LOGOUT_URL={{cfg_owncloud.authentication.data.url_base}}
WEB_UI_THEME_SERVER={{cfg_owncloud.domain}}
WEB_UI_CONFIG_SERVER={{cfg_owncloud.domain}}
{% endif %} {% endif %}
## other clients {% if var_owncloud_authentication_kind == 'authelia' %}
PROXY_LOG_LEVEL=info OCIS_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}"
PROXY_LOG_FILE={{cfg_owncloud.directory}}/log/proxy OCIS_OIDC_ISSUER="{{var_owncloud_authentication_data_authelia_url_base}}"
PROXY_LOG_PRETTY=true
PROXY_LOG_COLOR=true PROXY_AUTOPROVISION_ACCOUNTS="true"
PROXY_CSP_CONFIG_FILE_LOCATION={{cfg_owncloud.directory}}/csp.yaml PROXY_OIDC_REWRITE_WELLKNOWN="true"
PROXY_TLS=false PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD="none"
{% if cfg_owncloud.authentication.kind == 'internal' %} PROXY_OIDC_INSECURE="false"
PROXY_AUTOPROVISION_ACCOUNTS=false PROXY_USER_OIDC_CLAIM="name"
{% endif %} PROXY_USER_CS3_CLAIM="username"
{% if cfg_owncloud.authentication.kind == 'authelia' %}
PROXY_OIDC_ISSUER={{cfg_owncloud.authentication.data.url_base}} WEB_OIDC_AUTHORITY="{{var_owncloud_authentication_data_authelia_url_base}}"
PROXY_OIDC_REWRITE_WELLKNOWN=true WEB_OIDC_METADATA_URL="{{var_owncloud_authentication_data_authelia_url_base}}/.well-known/openid-configuration"
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none WEB_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}"
PROXY_OIDC_SKIP_USER_INFO=false WEB_OIDC_SCOPE="openid profile email groups"
PROXY_AUTOPROVISION_ACCOUNTS=true
PROXY_AUTOPROVISION_CLAIM_USERNAME=preferred_username
PROXY_AUTOPROVISION_CLAIM_EMAIL=email
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME=name
PROXY_AUTOPROVISION_CLAIM_GROUPS=groups
PROXY_USER_OIDC_CLAIM=preferred_username
PROXY_USER_CS3_CLAIM=username
{% endif %} {% endif %}
## sharing {% if var_owncloud_public_share_password_necessity == 'nothing' %}
{% if cfg_owncloud.public_share.password_necessity == 'nothing' %} OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD="false"
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=false OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD="false"
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=false
{% endif %} {% endif %}
{% if cfg_owncloud.public_share.password_necessity == 'writable' %} {% if var_owncloud_public_share_password_necessity == 'writable' %}
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=false OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD="false"
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=true OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD="true"
{% endif %} {% endif %}
{% if cfg_owncloud.public_share.password_necessity == 'all' %} {% if var_owncloud_public_share_password_necessity == 'all' %}
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=true OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD="true"
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=true OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD="true"
{% endif %} {% endif %}
{% if cfg_owncloud.public_share.password_policy_active %}
OCIS_SHARING_PASSWORD_POLICY_DISABLED=false {% if var_owncloud_public_share_password_policy_active %}
OCIS_SHARING_PASSWORD_POLICY_DISABLED="false"
{% else %} {% else %}
OCIS_SHARING_PASSWORD_POLICY_DISABLED=true OCIS_SHARING_PASSWORD_POLICY_DISABLED="true"
{% endif %} {% endif %}

8
roles/owncloud/templates/systemd_unit.j2
View file

@ -3,12 +3,12 @@ Description=ownCloud
After=network.target After=network.target
[Service] [Service]
WorkingDirectory={{cfg_owncloud.directory}} WorkingDirectory={{var_owncloud_directory}}
EnvironmentFile={{cfg_owncloud.directory}}/.env EnvironmentFile={{var_owncloud_directory}}/.env
ExecStart={{cfg_owncloud.directory}}/ocis server ExecStart={{var_owncloud_directory}}/ocis server
Type=simple Type=simple
Restart=always Restart=always
User={{cfg_owncloud.user}} User={{var_owncloud_user}}
[Install] [Install]
WantedBy=default.target WantedBy=default.target

75
roles/owncloud/vardef.json Normal file
View file

@ -0,0 +1,75 @@
{
"user": {
"type": "string",
"mandatory": false
},
"directory": {
"type": "string",
"mandatory": false
},
"version": {
"type": "string",
"mandatory": false
},
"platform": {
"type": "string",
"mandatory": false
},
"domain": {
"type": "string",
"mandatory": false
},
"admin_password": {
"type": "string",
"mandatory": true
},
"authentication_kind": {
"type": "string",
"mandatory": false,
"options": [
"internal",
"authelia"
]
},
"authentication_data_authelia_url_base": {
"type": "string",
"mandatory": false
},
"authentication_data_authelia_web_client_id": {
"type": "string",
"mandatory": false
},
"authentication_data_authelia_web_client_secret": {
"type": "string",
"mandatory": false
},
"authentication_data_authelia_android_client_id": {
"type": "string",
"mandatory": false
},
"authentication_data_authelia_android_client_secret": {
"type": "string",
"mandatory": false
},
"authentication_data_authelia_ios_client_id": {
"type": "string",
"mandatory": false
},
"authentication_data_authelia_ios_client_secret": {
"type": "string",
"mandatory": false
},
"public_share_password_necessity": {
"type": "string",
"mandatory": false,
"options": [
"nothing",
"writable",
"all"
]
},
"public_share_password_policy_active": {
"type": "boolean",
"mandatory": false
}
}