n0mad1k
3542913689
- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN, HSTS max-age=0 for self-signed certs, split LAN vs public messages - Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact - Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream) - Module prompts: accept IPs for matrix/cloud/vault/media, hard error on email with IP, all_in_one skips certbot email for LAN - Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name - OS family guards: ansible_os_family == Debian on all apt tasks - SSH key path: expanduser().resolve() on user-provided key paths - Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API token — no browser auth needed, creates tunnel + credentials + DNS + systemd Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
107 lines
2.2 KiB
YAML
107 lines
2.2 KiB
YAML
---
|
|
# Nextcloud package and dependency installation
|
|
|
|
- name: Install Nextcloud dependencies
|
|
apt:
|
|
name:
|
|
- php-fpm
|
|
- php-xml
|
|
- php-mbstring
|
|
- php-gd
|
|
- php-curl
|
|
- php-zip
|
|
- php-intl
|
|
- php-mysql
|
|
- php-redis
|
|
- php-apcu
|
|
- php-imagick
|
|
- php-bcmath
|
|
- php-gmp
|
|
- mariadb-server
|
|
- redis-server
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- unzip
|
|
- curl
|
|
- ca-certificates
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Detect installed PHP version
|
|
command: php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;'
|
|
register: _php_ver_result
|
|
changed_when: false
|
|
|
|
- name: Set PHP version fact
|
|
set_fact:
|
|
php_ver: "{{ _php_ver_result.stdout }}"
|
|
|
|
- name: Enable and start MariaDB
|
|
service:
|
|
name: mariadb
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Enable and start Redis
|
|
service:
|
|
name: redis-server
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Enable and start PHP-FPM
|
|
service:
|
|
name: "php{{ php_ver }}-fpm"
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Get latest Nextcloud version
|
|
uri:
|
|
url: https://download.nextcloud.com/server/releases/latest.tar.bz2.sha256
|
|
return_content: true
|
|
register: nc_checksum_response
|
|
|
|
- name: Parse Nextcloud checksum
|
|
set_fact:
|
|
nc_checksum: "{{ nc_checksum_response.content.split()[0] }}"
|
|
|
|
- name: Download Nextcloud tarball
|
|
get_url:
|
|
url: https://download.nextcloud.com/server/releases/latest.tar.bz2
|
|
dest: /tmp/nextcloud.tar.bz2
|
|
checksum: "sha256:{{ nc_checksum }}"
|
|
mode: "0644"
|
|
|
|
- name: Extract Nextcloud
|
|
unarchive:
|
|
src: /tmp/nextcloud.tar.bz2
|
|
dest: /var/www/
|
|
remote_src: true
|
|
creates: /var/www/nextcloud/index.php
|
|
|
|
- name: Set Nextcloud ownership
|
|
file:
|
|
path: /var/www/nextcloud
|
|
state: directory
|
|
owner: www-data
|
|
group: www-data
|
|
recurse: true
|
|
|
|
- name: Create Nextcloud data directory
|
|
file:
|
|
path: /var/www/nextcloud/data
|
|
state: directory
|
|
owner: www-data
|
|
group: www-data
|
|
mode: "0770"
|
|
|
|
- name: Allow HTTP/HTTPS through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item }}"
|
|
proto: tcp
|
|
loop:
|
|
- "80"
|
|
- "443"
|