owncloud
This commit is contained in:
parent
0a9bd90ddb
commit
272017b9d7
4
deploy-owncloud.yml
Normal file
4
deploy-owncloud.yml
Normal file
@ -0,0 +1,4 @@
|
||||
- name: owncloud setup
|
||||
hosts: owncloud
|
||||
roles:
|
||||
- owncloud
|
||||
10
group_vars/owncloud.yml
Normal file
10
group_vars/owncloud.yml
Normal file
@ -0,0 +1,10 @@
|
||||
---
|
||||
owncloud_admin_password: "{{ lookup('env', 'OWNCLOUD_ADMIN_PASSWORD') }}"
|
||||
owncloud_domain: "owncloud.internal.simponic.xyz"
|
||||
owncloud_version: "10.14.0"
|
||||
owncloud_trusted_domains: "owncloud.internal.simponic.xyz,localhost,127.0.0.1"
|
||||
owncloud_mount: "/mnt/ssd-01/owncloud"
|
||||
owncloud_oidc_secret: "{{ lookup('env', 'OWNCLOUD_OIDC_SECRET') }}"
|
||||
owncloud_mail_password: "{{ lookup('env', 'INFO_FROM_PASSWORD') }}"
|
||||
owncloud_secret: "{{ lookup('env', 'OWNCLOUD_SECRET') }}"
|
||||
owncloud_pwd_salt: "{{ lookup('env', 'OWNCLOUD_PWD_SALT') }}"
|
||||
@ -57,3 +57,6 @@ nijika ansible_user=root ansible_connection=ssh
|
||||
|
||||
[static]
|
||||
levi ansible_user=root ansible_connection=ssh
|
||||
|
||||
[owncloud]
|
||||
europa ansible_user=root ansible_connection=ssh
|
||||
|
||||
37
roles/owncloud/tasks/main.yml
Normal file
37
roles/owncloud/tasks/main.yml
Normal file
@ -0,0 +1,37 @@
|
||||
---
|
||||
- name: ensure owncloud docker/compose exist
|
||||
file:
|
||||
path: /etc/docker/compose/owncloud
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0700
|
||||
|
||||
- name: build owncloud docker-compose.yml.j2
|
||||
template:
|
||||
src: ../templates/docker-compose.yml.j2
|
||||
dest: /etc/docker/compose/owncloud/docker-compose.yml
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rw,g=r,o=r
|
||||
|
||||
- name: ensure owncloud config volume exist
|
||||
file:
|
||||
path: "{{ owncloud_mount }}/config"
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: root
|
||||
|
||||
- name: build owncloud config.php
|
||||
template:
|
||||
src: ../templates/config.php.j2
|
||||
dest: "{{ owncloud_mount }}/config/config.php"
|
||||
owner: www-data
|
||||
group: root
|
||||
mode: 0750
|
||||
|
||||
- name: daemon-reload and enable owncloud
|
||||
ansible.builtin.systemd_service:
|
||||
state: restarted
|
||||
enabled: true
|
||||
name: docker-compose@owncloud
|
||||
82
roles/owncloud/templates/config.php.j2
Normal file
82
roles/owncloud/templates/config.php.j2
Normal file
@ -0,0 +1,82 @@
|
||||
<?php
|
||||
$CONFIG = array (
|
||||
'apps_paths' =>
|
||||
array (
|
||||
0 =>
|
||||
array (
|
||||
'path' => '/var/www/owncloud/apps',
|
||||
'url' => '/apps',
|
||||
'writable' => false,
|
||||
),
|
||||
1 =>
|
||||
array (
|
||||
'path' => '/var/www/owncloud/custom',
|
||||
'url' => '/custom',
|
||||
'writable' => true,
|
||||
),
|
||||
),
|
||||
'trusted_domains' =>
|
||||
array (
|
||||
0 => 'owncloud.internal.simponic.xyz',
|
||||
1 => 'localhost',
|
||||
2 => '127.0.0.1',
|
||||
),
|
||||
'datadirectory' => '/mnt/data/files',
|
||||
'dbtype' => 'mysql',
|
||||
'dbhost' => 'mariadb:3306',
|
||||
'dbname' => 'owncloud',
|
||||
'dbuser' => 'owncloud',
|
||||
'dbpassword' => 'owncloud',
|
||||
'dbtableprefix' => 'oc_',
|
||||
'log_type' => 'owncloud',
|
||||
'supportedDatabases' =>
|
||||
array (
|
||||
0 => 'sqlite',
|
||||
1 => 'mysql',
|
||||
2 => 'pgsql',
|
||||
),
|
||||
'upgrade.disable-web' => true,
|
||||
'default_language' => 'en',
|
||||
'overwrite.cli.url' => 'https://owncloud.internal.simponic.xyz/',
|
||||
'htaccess.RewriteBase' => '/',
|
||||
'logfile' => '/mnt/data/files/owncloud.log',
|
||||
'memcache.local' => '\\OC\\Memcache\\APCu',
|
||||
'mysql.utf8mb4' => true,
|
||||
'filelocking.enabled' => true,
|
||||
'memcache.distributed' => '\\OC\\Memcache\\Redis',
|
||||
'memcache.locking' => '\\OC\\Memcache\\Redis',
|
||||
'redis' =>
|
||||
array (
|
||||
'host' => 'redis',
|
||||
'port' => '6379',
|
||||
),
|
||||
'passwordsalt' => '{{ owncloud_pwd_salt }}',
|
||||
'secret' => '{{ owncloud_secret }}',
|
||||
'version' => '10.14.0.3',
|
||||
'dbconnectionstring' => '',
|
||||
'allow_user_to_change_mail_address' => '',
|
||||
'logtimezone' => 'UTC',
|
||||
'installed' => true,
|
||||
'instanceid' => 'oco7aemx06vf',
|
||||
'mail_domain' => 'simponic.xyz',
|
||||
'mail_from_address' => 'info',
|
||||
'mail_smtpmode' => 'smtp',
|
||||
'mail_smtpauth' => 1,
|
||||
'mail_smtpsecure' => 'tls',
|
||||
'mail_smtphost' => 'mail.simponic.xyz',
|
||||
'mail_smtpport' => '587',
|
||||
'mail_smtpname' => 'info',
|
||||
'mail_smtppassword' => '{{ owncloud_mail_password }}',
|
||||
'ldapIgnoreNamingRules' => false,
|
||||
'allow_user_to_change_display_name' => false,
|
||||
'lost_password_link' => 'disabled',
|
||||
'openid-connect' => [
|
||||
'auto-provision' => ['enabled' => true],
|
||||
'autoRedirectOnLoginPage' => false,
|
||||
'client-id' => 'owncloud',
|
||||
'client-secret' => '{{ owncloud_oidc_secret }}',
|
||||
'loginButtonName' => 'Simponic Authelia',
|
||||
'provider-url' => 'https://authelia.simponic.xyz',
|
||||
'redirect-url' => 'https://owncloud.internal.simponic.xyz/apps/openidconnect/redirect'
|
||||
],
|
||||
);
|
||||
80
roles/owncloud/templates/docker-compose.yml.j2
Normal file
80
roles/owncloud/templates/docker-compose.yml.j2
Normal file
@ -0,0 +1,80 @@
|
||||
version: "3"
|
||||
|
||||
volumes:
|
||||
mysql:
|
||||
driver: local
|
||||
redis:
|
||||
driver: local
|
||||
|
||||
networks:
|
||||
owncloud:
|
||||
external: false
|
||||
|
||||
services:
|
||||
owncloud:
|
||||
image: owncloud/server:{{ owncloud_version }}
|
||||
container_name: owncloud_server
|
||||
restart: always
|
||||
ports:
|
||||
- "127.0.0.1:24734:8080"
|
||||
depends_on:
|
||||
- mariadb
|
||||
- redis
|
||||
environment:
|
||||
- OWNCLOUD_DOMAIN={{ owncloud_domain }}
|
||||
- OWNCLOUD_TRUSTED_DOMAINS={{ owncloud_trusted_domains }}
|
||||
- OWNCLOUD_DB_TYPE=mysql
|
||||
- OWNCLOUD_DB_NAME=owncloud
|
||||
- OWNCLOUD_DB_USERNAME=owncloud
|
||||
- OWNCLOUD_DB_PASSWORD=owncloud
|
||||
- OWNCLOUD_DB_HOST=mariadb
|
||||
- OWNCLOUD_ADMIN_USERNAME=admin
|
||||
- OWNCLOUD_ADMIN_PASSWORD={{ owncloud_admin_password }}
|
||||
- OWNCLOUD_MYSQL_UTF8MB4=true
|
||||
- OWNCLOUD_REDIS_ENABLED=true
|
||||
- OWNCLOUD_REDIS_HOST=redis
|
||||
healthcheck:
|
||||
test: ["CMD", "/usr/bin/healthcheck"]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
volumes:
|
||||
- {{ owncloud_mount }}:/mnt/data:rw
|
||||
networks:
|
||||
- owncloud
|
||||
|
||||
mariadb:
|
||||
image: mariadb:10.11 # minimum required ownCloud version is 10.9
|
||||
container_name: owncloud_mariadb
|
||||
restart: always
|
||||
environment:
|
||||
- MYSQL_ROOT_PASSWORD=owncloud
|
||||
- MYSQL_USER=owncloud
|
||||
- MYSQL_PASSWORD=owncloud
|
||||
- MYSQL_DATABASE=owncloud
|
||||
- MARIADB_AUTO_UPGRADE=1
|
||||
command: ["--max-allowed-packet=128M", "--innodb-log-file-size=64M"]
|
||||
healthcheck:
|
||||
test: ["CMD", "mysqladmin", "ping", "-u", "root", "--password=owncloud"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
volumes:
|
||||
- mysql:/var/lib/mysql
|
||||
networks:
|
||||
- owncloud
|
||||
|
||||
redis:
|
||||
image: redis:6
|
||||
container_name: owncloud_redis
|
||||
restart: always
|
||||
command: ["--databases", "1"]
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
volumes:
|
||||
- redis:/data
|
||||
networks:
|
||||
- owncloud
|
||||
@ -0,0 +1,13 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name owncloud.internal.simponic.xyz;
|
||||
|
||||
location /.well-known/acme-challenge {
|
||||
root /var/www/letsencrypt;
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location / {
|
||||
rewrite ^ https://owncloud.internal.simponic.xyz$request_uri? permanent;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,32 @@
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name owncloud.internal.simponic.xyz;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/owncloud.internal.simponic.xyz/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/owncloud.internal.simponic.xyz/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/owncloud.internal.simponic.xyz/fullchain.pem;
|
||||
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_timeout 5m;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
|
||||
|
||||
ssl_dhparam /etc/nginx/dhparams.pem;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:24734;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $server_name;
|
||||
proxy_buffering off;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
||||
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user