Added apache, docker, and collabora roles

apache/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: restart apache
+  service:
+    name: apache2
+    state: restarted
+- name: reload apache
+  service:
+    name: apache2
+    state: reloaded

apache/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: common

apache/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: install apache 2
+  apt:
+    name: apache2
+    state: latest
+    update_cache: yes
+  tags:
+    - apache
+- name: allow apache through firewall
+  ufw:
+    name: Apache Full
+    rule: allow
+- name: enable mods
+  block:
+    - name: enable proxy
+      command:
+        cmd: a2enmod proxy
+    - name: enable proxy_wstunnel
+      command:
+        cmd: a2enmod proxy_wstunnel
+    - name: enable proxy_http
+      command:
+        cmd: a2enmod proxy_http
+    - name: enable ssl
+      command:
+        cmd: a2enmod ssl
+  notify: restart apache

collabora/meta/main.yml

@@ -0,0 +1,4 @@
+---
+dependencies:
+  - role: docker
+  - role: apache

collabora/tasks/apache.yml

@@ -0,0 +1,31 @@
+---
+- name: add collabora http site
+  template:
+    src: etc/apache2/sites-available/ansible_domain.conf.j2
+    dest: /etc/apache2/sites-available/{{ ansible_domain }}.conf
+    owner: root
+    group: root
+    mode: 0644
+- name: disable default site and enable collabora site
+  block:
+    - name: disable default site
+      command:
+        cmd: a2dissite 000-default.conf
+    - name: enable collabora site
+      command:
+        cmd: a2ensite {{ ansible_domain }}.conf
+  notify: reload apache
+- name: run certbot
+  command:
+    cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --redirect --renew-with-new-domains --agree-tos -d {{ ansible_domain }}
+- name: add collabora https site
+  template:
+    src: etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2
+    dest: /etc/apache2/sites-available/{{ ansible_domain }}-le-ssl.conf
+    owner: root
+    group: root
+    mode: 0644
+- name: enable collabora https site
+  command:
+    cmd: a2ensite {{ ansible_domain }}-le-ssl.conf
+  notify: restart apache

collabora/tasks/apt.yml

@@ -0,0 +1,9 @@
+---
+- name: add certbot repo
+  apt_repository:
+    repo: ppa:certbot/certbot
+- name: install certbot
+  apt:
+    name: python-certbot-apache
+    state: latest
+    update_cache: yes

collabora/tasks/collabora.yml

@@ -0,0 +1,14 @@
+---
+- name: copy docker compose file for collabora
+  template:
+    src: etc/collabora/docker-compose.yml.j2
+    dest: /etc/collabora/docker-compose.yml
+    owner: root
+    group: root
+    mode: 0644
+  vars_prompt:
+    - name: nextcloud_domain
+      prompt: "Nextcloud domain"
+      private: no
+- name: start collabora docker container
+  command: docker-compose --project-directory /etc/collabora up -d

collabora/tasks/main.yml

@@ -0,0 +1,4 @@
+---
+- include: apt.yml
+- include: apache.yml
+- include: collabora.yml

collabora/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2

@@ -0,0 +1,48 @@
+<IfModule mod_ssl.c>
+<VirtualHost *:443>
+  ServerName {{ ansible_domain }}
+  ServerAdmin {{ admin_mail }}
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+  SSLCertificateFile /etc/letsencrypt/live/{{ ansible_domain }}/fullchain.pem
+  SSLCertificateKeyFile /etc/letsencrypt/live/{{ ansible_domain }}/privkey.pem
+  Include /etc/letsencrypt/options-ssl-apache.conf
+
+  # Encoded slashes need to be allowed
+  AllowEncodedSlashes NoDecode
+
+  # Container uses a unique non-signed certificate
+  SSLProxyEngine On
+  SSLProxyVerify None
+  SSLProxyCheckPeerCN Off
+  SSLProxyCheckPeerName Off
+
+  # keep the host
+  ProxyPreserveHost On
+
+  # static html, js, images, etc. served from loolwsd
+  # loleaflet is the client part of LibreOffice Online
+  ProxyPass           /loleaflet https://127.0.0.1:9980/loleaflet retry=0
+  ProxyPassReverse    /loleaflet https://127.0.0.1:9980/loleaflet
+
+  # WOPI discovery URL
+  ProxyPass           /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0
+  ProxyPassReverse    /hosting/discovery https://127.0.0.1:9980/hosting/discovery
+
+  # Main websocket
+  ProxyPassMatch "/lool/(.*)/ws$" wss://127.0.0.1:9980/lool/$1/ws nocanon
+
+  # Admin Console websocket
+  ProxyPass   /lool/adminws wss://127.0.0.1:9980/lool/adminws
+
+  # Download as, Fullscreen presentation and Image upload operations
+  ProxyPass           /lool https://127.0.0.1:9980/lool
+  ProxyPassReverse    /lool https://127.0.0.1:9980/lool
+
+  # Endpoint with information about availability of various features
+  ProxyPass           /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0
+  ProxyPassReverse    /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities
+
+</VirtualHost>
+</IfModule>

collabora/templates/etc/apache2/sites-available/ansible_domain.conf.j2

@@ -0,0 +1,6 @@
+<VirtualHost *:80>
+  ServerName {{ ansible_domain }}
+  ServerAdmin {{ admin_mail }}
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>

collabora/templates/etc/collabora/docker-compose.yml.j2

@@ -0,0 +1,17 @@
+version: '3'
+
+services:
+  collabora:
+    image: collabora/code
+    ports:
+      - 9980:9980
+    restart: always
+    environment:
+      - domain={{ nextcloud_domain }}
+    volumes:
+      - config-volume:/etc/loolwsd
+    cap_add:
+      - MKNOD
+volumes:
+  config-volume:
+

docker/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies
+  - role: common

docker/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: install docker-compose
+  apt:
+    name: docker-compose
+    state: latest
+    update_cache: yes
+  tags:
+    - docker