lemur/nextcloud/ansible/nextcloud_appliance.yaml

---
- hosts: all
  vars:
    nextcloud_path: "{{ '/usr/share/nginx/html' if ansible_distribution_file_variety == 'RedHat' else '/var/www/html' }}"
    nextcloud_occ: "{{ nextcloud_path }}/occ"
    nginx_path: "{{ '/etc/nginx/conf.d' if ansible_distribution_file_variety == 'RedHat' else '/etc/nginx/sites-enabled' }}"
    # FIXME: Set PHP version from Debian version: 7.4 for Debian 11, 7.3 for Debian 10
    php_ini_path: "{{ '/etc' if ansible_distribution_file_variety == 'RedHat' else '/etc/php/7.3/fpm' }}"
    php_pool_path: "{{ '/etc/php-fpm.d' if ansible_distribution_file_variety == 'RedHat' else '/etc/php/7.3/fpm/pool.d' }}"
    php_fpm_service: "{{ 'php-fpm' if ansible_distribution_file_variety == 'RedHat' else 'php7.3-fpm' }}"
    document_root: "{{ '/usr/share/nginx/html' if ansible_distribution_file_variety == 'RedHat' else '/var/www/html' }}"
    web_user: "{{ 'nginx' if ansible_distribution_file_variety == 'RedHat' else 'www-data' }}"
    pg_hba_conf: "{{ '/var/lib/pgsql/data/pg_hba.conf' if ansible_distribution_file_variety == 'RedHat' else '/etc/postgresql/13/main/pg_hba.conf' }}"
    redis_dir: "{{ '/etc' if ansible_distribution_file_variety == 'RedHat' else '/etc/redis' }}"
    redis_user: "nextcloud"
    redis_url: "https://127.0.0.1"
    redis_password: "2XenoNNBtLJqrELTfmCLum/42Guz72Ym0RPMxXh5+pT"
    nextcloud_version: "22.1.0"
    nextcloud_database: "nextcloud"
    nextcloud_database_user: "nextcloud"
    nextcloud_database_user_password: "nVdUe6%Ua9c,Rd.8BVugPHPm2yqUSXWCAy%1GXOQGn8tg9F?k%R"
    nextcloud_admin_user: "nextcloud_admin"
    nextcloud_admin_password: "prueba123"
    nextcloud_domain_name: "{{ ansible_default_ipv4.address }}"
    # The only way to make notify_push work without a signed cert is to use plain http
    notify_push_nextcloud_url: "http://localhost"
    key_size: 4096
    key_type: "RSA" # Others include DSA, ECC, Ed25519, Ed448, X25519, X448
    country_name: "MX"
    email_address: "ssl@example.com"
    organization_name: "AnsibleNextcloud"
    server_hostname: "example.com"
    redis_cert_private_key: "/etc/redis/cert_private_key.pem"
    redis_cert: "/etc/redis/redis-self-cert.crt"
    redis_csr: "/etc/redis/redis-self.csr"
    nginx_ssl_cert_file: "/etc/ssl/nginx/self_signed.crt"
    nginx_ssl_key_file: "/etc/ssl/nginx/self_signed.key" 
    nginx_ssl_csr_file: "/etc/ssl/nginx/self_signed.csr"
    #nextcloud_domain: "cloud.example.com"
    code_enable_ssl: false
    code_enable_ssl_termination: true
    code_ssl_key: ""
    code_ssl_cert: ""
    code_ssl_ca: ""

  pre_tasks:

  - name: Create fact directory
    file:
      path: /etc/ansible/facts.d/
      state: directory

  - name: Create nextcloud custom facts
    copy:
      dest: /etc/ansible/facts.d/nextcloud.fact
      mode: 0775
      force: yes
      content: |
        #!/usr/bin/bash 
          FACTS=''
          INSTALLED=$(sudo -u www-data /usr/bin/php /var/www/html/occ status | grep installed | cut -d':' -f 2 | sed 's/ //')
          if [[ "${INSTALLED}" == "true" ]]; then
            FACTS="{\"is_installed\": true"
          else
            FACTS="{\"is_installed\": false"
          fi
          CODE_INSTALLED=$(sudo -u www-data /usr/bin/php /var/www/html/occ app:list | grep richdocuments)
           if [[ "${CODE_INSTALLED}" == *"richdocumentscode"* ]]; then
            FACTS="${FACTS},\n\"is_code_installed\": true}"
          else
            FACTS="${FACTS},\n\"is_code_installed\": false}"
          fi
          echo -e "${FACTS}"        
    tags:
      - check_facts

  - name: Reload facts
    setup:
    tags:
      - check_facts

  tasks:

  - name: Display local facts
    debug: var=ansible_local
    tags:
      - check_facts

  # System setup
  - name: sysctl -w net.core.somaxconn=65535
    sysctl:
      name: net.core.somaxconn
      value: "65535"
      state: present
      reload: true
      sysctl_file: /etc/sysctl.conf

  - name: Red Hat Distros Tasks
    block:
    - name: Install System Packages
      action: package name={{item}} state=present
      with_items:
         - nginx
         - sudo
         - php-fpm
         - postgresql
         - postgresql-server
         - python3-psycopg2
         - redis
         - php-pgsql
         - php-cli
         - php-curl
         - php-dom
         - php-exif
         - php-fileinfo
         - php-gd
         - php-iconv
         - php-json
         - php-ldap
         - php-mbstring
         - php-openssl
         - php-pcre
         - php-pdo
         - php-session
         - php-simplexml
         - php-xmlwriter
         - php-spl
         - php-zip
         - php-filter
         - php-ldap
         - php-smbclient
         - php-imap
         - php-gmp
         - php-process
         - php-pecl-imagick
         - php-pecl-memcached
         - php-pecl-apcu
         - php-pecl-redis
         - python3-openssl

    - name: Import Collabora key
      ansible.builtin.rpm_key:
        state: present
        key: https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-centos8/repodata/repomd.xml.key

    - name: Add Collabora repository for Red Hat distros
      yum_repository:
        name: CollaboraOnline
        description: Collabora Online
        baseurl: https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-centos8

    - name: Install Collabora Online Packages
      action: package name={{item}} state=present
      with_items:
         - loolwsd
         - CODE-brand

    - name: Initialize postgres database
      ansible.builtin.shell:
        cmd: /usr/bin/postgresql-setup --initdb

    when:
      ansible_distribution_file_variety == 'RedHat'
  
  - name: Debian Distros Tasks
    block:
    - name: Install System Packages
      action: package name={{item}} state=present
      with_items:
         - dirmngr
         - nginx
         - sudo
         - php-fpm
         - postgresql-all
         - python3-psycopg2
         - redis
         - php-pgsql
         - php-cli
         - php-curl
         - php-gd
         - php-json
         - php-ldap
         - php-mbstring
         #- php7.4-xml # en Debián 10 la versión de PHP es 7.3 y en este paquete el 7.4 causa conflicto
         - php-xml
         #- php-xmlwriter
         - php-zip
         - php-ldap
         #- php-smbclient
         - php-imap
         - php-gmp
         #- php-process
         - php-imagick
         - php-memcached
         - php-apcu
         - php-redis
         - python3-openssl

    - name: Get php version
      shell: "php -v | grep built | cut -d '.' -f 1,2 | sed 's/PHP //'"
      register: php_version
      tags:
        - php_ver

    - name: Update the php_ini_path variable
      set_fact:
        php_ini_path: "/etc/php/{{ php_version.stdout }}/fpm"

    - name: Update the php_pool_path variable
      set_fact:
        php_pool_path: "/etc/php/{{ php_version.stdout }}/fpm/pool.d"

    - name: Update the php_fpm_service variable
      set_fact:
        php_fpm_service: "php{{ php_version.stdout }}-fpm"

    - name: Add Collabora apt key by id from keyserver for Debian 10
      ansible.builtin.apt_key:
        #keyserver: keyserver.ubuntu.com
        id: 0C54D189F4BA284D
        data: "{{ lookup('file', 'files/0C54D189F4BA284D.asc') }}"
      tags:
        - debian-collabora-repos 
        - collabora

    - name: Add Collabora repository for Debian distros (10)
      ansible.builtin.apt_repository:
        repo: deb https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-debian10 ./
        state: present
      tags:
        - debian-collabora-repos 
        - collabora

    - name: Install Collabora Online Packages
      action: package name={{item}} state=present
      with_items:
         - loolwsd
         - code-brand
      tags:
        - collabora

    - name: Remove nginx default configuration
      ansible.builtin.file:
        path: /etc/nginx/sites-enabled/default
        state: absent
      tags:
        - clean_defaults

    when:
      ansible_distribution_file_variety == 'Debian'
  
  - name: Configure Nginx Nextcloud pool
    template: src=files/nextcloud_nginx.conf.j2 dest="{{ nginx_path }}/nextcloud_nginx.conf"
    tags:
      - notify_push

  - name: Configure PHP
    template: src=files/php.ini.j2 dest="{{ php_ini_path }}/php.ini"

  - name: Configure PHP FPM pool
    template: src=files/www.conf.j2 dest="{{ php_pool_path }}/www.conf"

  # nextcloud specific tasks
  #- name: Ensure that Nextcloud target directory exists
  #  ansible.builtin.file:
  #    path: /var/www/nextcloud
  #    state: directory
  #    mode: '0755'
  #    owner: "{{ web_user }}"

  # FIXME: Download only once
  - name: Download Nextcloud
    ansible.builtin.unarchive:
      src: "https://download.nextcloud.com/server/releases/nextcloud-{{nextcloud_version}}.tar.bz2"
      dest: "{{ nextcloud_path }}"
      remote_src: yes
      owner: "{{ web_user }}"
      extra_opts:
        - --strip-components=1
    when:
      ansible_local['nextcloud']['is_installed'] != true

  - name: Create nginx ssl directory
    file:
      path: /etc/ssl/nginx
      state: directory

  - name: Generate Nginx SSL Private Key
    openssl_privatekey:
      path: "{{ nginx_ssl_key_file }}"
      size: "{{ key_size }}"
      type: "{{ key_type }}"
      backup: yes
      owner: redis

  - name: Generate Nginx SSL CSR
    openssl_csr:
      path: "{{ nginx_ssl_csr_file }}"
      privatekey_path: "{{ nginx_ssl_key_file }}"
      country_name: "{{ country_name }}"
      organization_name: "{{ organization_name }}"
      email_address: "{{ email_address }}"
      common_name: "{{ server_hostname }}"
      owner: redis

  - name: Generate Nginx Self Signed OpenSSL certificate
    openssl_certificate:
      path: "{{ nginx_ssl_cert_file }}" 
      privatekey_path: "{{ nginx_ssl_key_file }}"
      csr_path: "{{ nginx_ssl_csr_file }}"
      provider: selfsigned
      owner: redis

  - name: Enable nginx service
    systemd:
      name: nginx
      enabled: yes
      state: restarted
    tags:
      - notify_push

  - name: Enable php-fpm service
    systemd:
      name: "{{ php_fpm_service }}"
      enabled: yes
      state: restarted

  - name: Enable PostgreSQL service
    systemd:
      name: postgresql
      enabled: yes
      state: restarted

  - name: Generate Redis SSL Private Key
    openssl_privatekey:
      path: "{{ redis_cert_private_key }}"
      size: "{{ key_size }}"
      type: "{{ key_type }}"
      backup: yes
      owner: redis

  - name: Generate Redis SSL CSR
    openssl_csr:
      path: "{{ redis_csr }}"
      privatekey_path: "{{ redis_cert_private_key }}"
      country_name: "{{ country_name }}"
      organization_name: "{{ organization_name }}"
      email_address: "{{ email_address }}"
      common_name: "{{ server_hostname }}"
      owner: redis

  - name: Generate Redis Self Signed OpenSSL certificate
    openssl_certificate:
      path: "{{ redis_cert }}" 
      privatekey_path: "{{ redis_cert_private_key }}"
      csr_path: "{{ redis_csr }}"
      provider: selfsigned
      owner: redis

  - name: Set Redis Configuration
    template: src=files/redis.conf.j2 dest="{{ redis_dir }}/redis.conf" owner=root group=root mode=0644

  - name: Enable Redis service
    systemd:
      name: redis
      enabled: yes
      state: restarted

  - name: "Create database user"
    postgresql_user:
      name: "{{ nextcloud_database_user }}"
      password: "{{ nextcloud_database_user_password }}"
    become_user: postgres
    become: yes
    tags:
      - database

  - name: "Create nextcloud database"
    postgresql_db:
      name: "{{ nextcloud_database }}"
      encoding: UTF-8
      template: template0
      owner: "{{ nextcloud_database_user }}"
    become_user: postgres
    become: yes
    tags:
      - database

  - name: Allow postgres user to connect to the database
    blockinfile:
      dest: "{{ pg_hba_conf }}"
      block: |
        host    all             all             0.0.0.0/0                md5        

  - name: Install nextcloud to database
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" maintenance:install --database "pgsql" --database-name "{{ nextcloud_database }}"  --database-user "{{ nextcloud_database_user }}" --database-pass "{{ nextcloud_database_user_password}}" --admin-user "{{ nextcloud_admin_user }}" --admin-pass "{{ nextcloud_admin_password }}"
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"

    when:
      ansible_local['nextcloud']['is_installed'] != true

  - name: Configure Nextcloud Redis
    ansible.builtin.shell:
      cmd: | 
        /usr/bin/php "{{ nextcloud_occ }}" config:system:set redis host --value=localhost
        /usr/bin/php "{{ nextcloud_occ }}" config:system:set redis port --value=6379
        /usr/bin/php "{{ nextcloud_occ }}" config:system:set redis dbindex --value=0
        /usr/bin/php "{{ nextcloud_occ }}" config:system:set redis user --value="{{ redis_user }}"
        /usr/bin/php "{{ nextcloud_occ }}" config:system:set redis password --value="{{ redis_password }}"
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - nextcloud_redis

  - name: Configure trusted domain
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" config:system:set trusted_domains 1 --value={{ nextcloud_domain_name}}
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"

  - name: Configure localhost as trusted proxy
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" config:system:set trusted_proxies 0 --value=127.0.0.1
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - notify_push

  - name: "configure {{ nextcloud_domain }}  as trusted proxy"
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" config:system:set trusted_proxies 1 --value={{ nextcloud_domain_name}}
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - notify_push

  - name: "configure ::1  as trusted proxy"
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" config:system:set trusted_proxies 2 --value=::1
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - notify_push

  - name: Enable Nextcloud High Performance Backend
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" app:enable notify_push
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"

  - name: Install Nextcloud High Performance Backend Systemd Service
    template: src=files/notify_push.service.j2 dest=/etc/systemd/system/notify_push.service
  - name: Set Nextcloud High Performance Backend Systemd Service environment
    template: src=files/notify_push_environment.j2 dest="{{ nextcloud_path }}/apps/notify_push/environment"
  - name: Enable  Nextcloud Notify Push Service
    systemd: state=restarted name=notify_push daemon_reload=yes

  - name: Setup Nextcloud High Performance Backend
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}"  notify_push:setup "https://{{ nextcloud_domain_name }}/push"
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - redis
      - notify_push

  - name: Copy collabora configuration files
    template: src=files/loolwsd.xml.j2 dest=/etc/loolwsd/loolwsd.xml

  - name: Enable Libre Office Web services
    systemd:
      name: loolwsd
      enabled: yes
      state: restarted
    tags:
      - nextcloud_collabora

  - name: Install Collabora Office nextcloud app
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" app:install richdocuments
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - nextcloud_collabora
    when:
      ansible_local['nextcloud']['is_code_installed'] != true

  - name: Configure Collabora Office nextcloud app
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" config:app:set --value "https://{{nextcloud_domain_name}}" richdocuments wopi_url
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - nextcloud_collabora
    when:
      ansible_local['nextcloud']['is_code_installed'] == true


  - name: Activate Collabora Office nextcloud app
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" richdocuments:activate-config
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - nextcloud_collabora
    when:
      ansible_local['nextcloud']['is_code_installed'] == true

  - name: Allow local remote servers for nextcloud
    ansible.builtin.shell:
      cmd: /usr/bin/php "{{ nextcloud_occ }}" config:system:set allow_local_remote_servers --value true --type bool
      chdir: "{{ document_root }}"
    become: true
    become_user: "{{ web_user }}"
    tags:
      - nextcloud_collabora
    when:
      ansible_local['nextcloud']['is_code_installed'] == true