diff --git a/apache/handlers/.main.yml.swp b/apache/handlers/.main.yml.swp new file mode 100644 index 0000000..bee0725 Binary files /dev/null and b/apache/handlers/.main.yml.swp differ diff --git a/apache/handlers/main.yml b/apache/handlers/main.yml new file mode 100644 index 0000000..00dec4e --- /dev/null +++ b/apache/handlers/main.yml @@ -0,0 +1,9 @@ +--- +- name: restart apache + service: + name: apache2 + state: restarted +- name: reload apache + service: + name: apache2 + state: reloaded diff --git a/apache/meta/main.yml b/apache/meta/main.yml new file mode 100644 index 0000000..fdda41b --- /dev/null +++ b/apache/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: common diff --git a/apache/tasks/main.yml b/apache/tasks/main.yml new file mode 100644 index 0000000..bc3da05 --- /dev/null +++ b/apache/tasks/main.yml @@ -0,0 +1,27 @@ +--- +- name: install apache 2 + apt: + name: apache2 + state: latest + update_cache: yes + tags: + - apache +- name: allow apache through firewall + ufw: + name: Apache Full + rule: allow +- name: enable mods + block: + - name: enable proxy + command: + cmd: a2enmod proxy + - name: enable proxy_wstunnel + command: + cmd: a2enmod proxy_wstunnel + - name: enable proxy_http + command: + cmd: a2enmod proxy_http + - name: enable ssl + command: + cmd: a2enmod ssl + notify: restart apache diff --git a/collabora/meta/main.yml b/collabora/meta/main.yml new file mode 100644 index 0000000..61b221b --- /dev/null +++ b/collabora/meta/main.yml @@ -0,0 +1,4 @@ +--- +dependencies: + - role: docker + - role: apache diff --git a/collabora/tasks/apache.yml b/collabora/tasks/apache.yml new file mode 100644 index 0000000..074c93c --- /dev/null +++ b/collabora/tasks/apache.yml @@ -0,0 +1,31 @@ +--- +- name: add collabora http site + template: + src: etc/apache2/sites-available/ansible_domain.conf.j2 + dest: /etc/apache2/sites-available/{{ ansible_domain }}.conf + owner: root + group: root + mode: 0644 +- name: disable default site and enable collabora site + block: + - name: disable default site + command: + cmd: a2dissite 000-default.conf + - name: enable collabora site + command: + cmd: a2ensite {{ ansible_domain }}.conf + notify: reload apache +- name: run certbot + command: + cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --redirect --renew-with-new-domains --agree-tos -d {{ ansible_domain }} +- name: add collabora https site + template: + src: etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 + dest: /etc/apache2/sites-available/{{ ansible_domain }}-le-ssl.conf + owner: root + group: root + mode: 0644 +- name: enable collabora https site + command: + cmd: a2ensite {{ ansible_domain }}-le-ssl.conf + notify: restart apache diff --git a/collabora/tasks/apt.yml b/collabora/tasks/apt.yml new file mode 100644 index 0000000..a7f1720 --- /dev/null +++ b/collabora/tasks/apt.yml @@ -0,0 +1,9 @@ +--- +- name: add certbot repo + apt_repository: + repo: ppa:certbot/certbot +- name: install certbot + apt: + name: python-certbot-apache + state: latest + update_cache: yes diff --git a/collabora/tasks/collabora.yml b/collabora/tasks/collabora.yml new file mode 100644 index 0000000..53ceffb --- /dev/null +++ b/collabora/tasks/collabora.yml @@ -0,0 +1,14 @@ +--- +- name: copy docker compose file for collabora + template: + src: etc/collabora/docker-compose.yml.j2 + dest: /etc/collabora/docker-compose.yml + owner: root + group: root + mode: 0644 + vars_prompt: + - name: nextcloud_domain + prompt: "Nextcloud domain" + private: no +- name: start collabora docker container + command: docker-compose --project-directory /etc/collabora up -d diff --git a/collabora/tasks/main.yml b/collabora/tasks/main.yml new file mode 100644 index 0000000..bcaba69 --- /dev/null +++ b/collabora/tasks/main.yml @@ -0,0 +1,4 @@ +--- +- include: apt.yml +- include: apache.yml +- include: collabora.yml diff --git a/collabora/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 b/collabora/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 new file mode 100644 index 0000000..c861b92 --- /dev/null +++ b/collabora/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 @@ -0,0 +1,48 @@ + + + ServerName {{ ansible_domain }} + ServerAdmin {{ admin_mail }} + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + + SSLCertificateFile /etc/letsencrypt/live/{{ ansible_domain }}/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/{{ ansible_domain }}/privkey.pem + Include /etc/letsencrypt/options-ssl-apache.conf + + # Encoded slashes need to be allowed + AllowEncodedSlashes NoDecode + + # Container uses a unique non-signed certificate + SSLProxyEngine On + SSLProxyVerify None + SSLProxyCheckPeerCN Off + SSLProxyCheckPeerName Off + + # keep the host + ProxyPreserveHost On + + # static html, js, images, etc. served from loolwsd + # loleaflet is the client part of LibreOffice Online + ProxyPass /loleaflet https://127.0.0.1:9980/loleaflet retry=0 + ProxyPassReverse /loleaflet https://127.0.0.1:9980/loleaflet + + # WOPI discovery URL + ProxyPass /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0 + ProxyPassReverse /hosting/discovery https://127.0.0.1:9980/hosting/discovery + + # Main websocket + ProxyPassMatch "/lool/(.*)/ws$" wss://127.0.0.1:9980/lool/$1/ws nocanon + + # Admin Console websocket + ProxyPass /lool/adminws wss://127.0.0.1:9980/lool/adminws + + # Download as, Fullscreen presentation and Image upload operations + ProxyPass /lool https://127.0.0.1:9980/lool + ProxyPassReverse /lool https://127.0.0.1:9980/lool + + # Endpoint with information about availability of various features + ProxyPass /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0 + ProxyPassReverse /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities + + + diff --git a/collabora/templates/etc/apache2/sites-available/ansible_domain.conf.j2 b/collabora/templates/etc/apache2/sites-available/ansible_domain.conf.j2 new file mode 100644 index 0000000..532d775 --- /dev/null +++ b/collabora/templates/etc/apache2/sites-available/ansible_domain.conf.j2 @@ -0,0 +1,6 @@ + + ServerName {{ ansible_domain }} + ServerAdmin {{ admin_mail }} + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + diff --git a/collabora/templates/etc/collabora/docker-compose.yml.j2 b/collabora/templates/etc/collabora/docker-compose.yml.j2 new file mode 100644 index 0000000..1e1c376 --- /dev/null +++ b/collabora/templates/etc/collabora/docker-compose.yml.j2 @@ -0,0 +1,17 @@ +version: '3' + +services: + collabora: + image: collabora/code + ports: + - 9980:9980 + restart: always + environment: + - domain={{ nextcloud_domain }} + volumes: + - config-volume:/etc/loolwsd + cap_add: + - MKNOD +volumes: + config-volume: + diff --git a/docker/meta/main.yml b/docker/meta/main.yml new file mode 100644 index 0000000..18ba9a5 --- /dev/null +++ b/docker/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies + - role: common diff --git a/docker/tasks/main.yml b/docker/tasks/main.yml new file mode 100644 index 0000000..a80103b --- /dev/null +++ b/docker/tasks/main.yml @@ -0,0 +1,8 @@ +--- +- name: install docker-compose + apt: + name: docker-compose + state: latest + update_cache: yes + tags: + - docker