DTSV/Ansible
1
0
Fork 0
Code Issues Pull Requests Releases Activity

initial ansible code

Browse Source
This commit is contained in:
Oli
2022-10-09 21:41:56 +00:00
parent 4a64eab4a0
commit feaec34dd2
103 changed files with 4473 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
roles/bastion/files/ssh/dtsv_ed25519 Normal file
View File

@@ -0,0 +1,25 @@
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
61613262653734376165353363343366363661616561636563306430613665343137643863613632
6432336361373838643733306565313830373065363663620a306163373632626366303837373530
34393833656466326339383538363933313738616131373338336534393538366262306462616432
6334343936346339320a333336623532383230643738333938366336636565343762376138333066
36333964373865666534373830376132343636336139613835663830383432386237623935303239
64613636316565326334643962326133313364323966303837303739653634373638326335623563
38653763376234376533643561356561666438323238396162313662383566646362313732346538
36376166313132393839383763393835626435333537313531323134373639303462373564613234
34356664316562623336383535383431363366653238373130363362376361383361643762623533
35323136333731343734393236613331616531343962366132653730613561346564316132396237
64393163373561383961303137313666336338376161356464313563373031393463623266396138
39653561663838393239633462626231313932386339623035396463623236633861333562666163
65333035613038366639653565623362343163313561636666356364333263366162383639313363
35636436376665626265643535663234623462626462633361373639613730616665346535626631
31666333386433373734333830336662663331373666313231636437316136613137306233663433
30633839343633366262653365383364366535613761303264353634366138326166316536643830
34646336393939383630376537646538356439346235303036376239646662643933636130363266
39363363393461333736343533643032353462396331336565663262363730336338333236613234
65666535613363616263393933383233646566363962633163366136313636663963346163316430
37313764633636303565366564643763656162396262663834653637613166353438666530303337
34336533393738633862653262313930633336363038313634396666313331356566393436366263
38363064656231393964323736666638316633346339366165633931646564383132353735343461
64393231653039666536643638333431383333613364303438373564663635303763343062313630
39303137656230626531

6
roles/bastion/tasks/main.yml Normal file
View File

@@ -0,0 +1,6 @@
---
- name: Install Terraform
import_tasks: terraform.yml
- name: Add SSH config/keys
import_tasks: ssh.yml

9
roles/bastion/tasks/ssh.yml Normal file
View File

@@ -0,0 +1,9 @@
---
- name: Copy SSH config/keys
copy:
src: "ssh/"
dest: "~/.ssh/"
mode: 0600
directory_mode: true
become_user: "{{ main_user }}"

16
roles/bastion/tasks/terraform.yml Normal file
View File

@@ -0,0 +1,16 @@
---
- name: Create .tfvars_token_dtsv
template:
src: "tfvars_token.j2"
dest: "~/.tfvars_token_dtsv"
mode: 0640
become_user: "{{ main_user }}"
- name: Add .tfvars_token to .bash_profile
lineinfile:
path: "~/.bash_profile"
create: true
line: "source ~/.tfvars_token_dtsv"
mode: 0644
become_user: "{{ main_user }}"

5
roles/bastion/templates/tfvars_token.j2 Normal file
View File

@@ -0,0 +1,5 @@
## Managed by Ansible ##
export TF_VAR_dtsv_ionos_token='{{ vault_ionos_token_terraform }}'
export TF_VAR_dtsv_hcloud_token={{ vault_hcloud_token_terraform }}
export TF_VAR_dtsv_hcloud_ssh_key='{{ vault_hcloud_ssh_key }}'

4
roles/bastion/vars/main.yml Normal file
View File

@@ -0,0 +1,4 @@
---
# Hetzner Cloud public ssh key
vault_hcloud_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpczZfQ5MrfjSYz8MnDHG4sM2cQ8cIsj3ALDGtmW3zu

1
roles/common/files/public_keys.pub Normal file
View File

@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpczZfQ5MrfjSYz8MnDHG4sM2cQ8cIsj3ALDGtmW3zu terraform

8
roles/common/tasks/authorized_keys.yml Normal file
View File

@@ -0,0 +1,8 @@
---
- name: Set authorized keys
authorized_key:
user: "{{ main_user }}"
key: "{{ lookup('file', 'public_keys.pub') }}"
state: present
exclusive: true # removing all the authorized keys already set

9
roles/common/tasks/main.yml Normal file
View File

@@ -0,0 +1,9 @@
---
- name: Install system packages
import_tasks: system_packages.yml
- name: Configure unattended upgrades
import_tasks: unattended_upgrades.yml
- name: Add authorized_keys
import_tasks: authorized_keys.yml

7
roles/common/tasks/system_packages.yml Normal file
View File

@@ -0,0 +1,7 @@
---
- name: Install common required system packages
apt:
name: "{{ common_system_packages }}"
state: latest
update_cache: true
cache_valid_time: 3600

15
roles/common/tasks/unattended_upgrades.yml Normal file
View File

@@ -0,0 +1,15 @@
---
- name: Modify auto-upgrades
replace:
path: /etc/apt/apt.conf.d/20auto-upgrades
regexp: "{{ item.regexp }}"
replace: "{{ item.replace }}"
loop: "{{ auto_upgrades }}"
- name: Modify unattended-upgrades (enable recommended updates)
replace:
path: /etc/apt/apt.conf.d/50unattended-upgrades
regexp: "{{ item.regexp }}"
replace: "{{ item.replace }}"
loop: "{{ unattended_upgrades }}"

15
roles/common/vars/main.yml Normal file
View File

@@ -0,0 +1,15 @@
---
common_system_packages:
- "software-properties-common"
- "apt-transport-https"
- "ca-certificates"
auto_upgrades:
- {regexp: 'APT::Periodic::Update-Package-Lists "0";', replace: 'APT::Periodic::Update-Package-Lists "1";'}
- {regexp: 'APT::Periodic::Unattended-Upgrade "0";', replace: 'APT::Periodic::Unattended-Upgrade "1";'}
unattended_upgrades:
- {regexp: '\/\/.*\"\${distro_id}:\${distro_codename}-updates\";', replace: ' "${distro_id}:${distro_codename}-updates";'}
- {regexp: '\/\/.*Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";', replace: ' Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";'}
- {regexp: '\/\/.*Unattended-Upgrade::Remove-New-Unused-Dependencies "true";', replace: ' Unattended-Upgrade::Remove-New-Unused-Dependencies "true";'}
- {regexp: '\/\/.*Unattended-Upgrade::Remove-Unused-Dependencies "false";', replace: ' Unattended-Upgrade::Remove-Unused-Dependencies "true";'}

14
roles/lego/handlers/main.yml Normal file
View File

@@ -0,0 +1,14 @@
---
- name: restart lego_timer
systemd:
daemon_reload: true
enabled: true
name: lego.timer
state: restarted
- name: restart lego_service
systemd:
daemon_reload: true
enabled: true
name: lego.service
state: restarted

67
roles/lego/tasks/main.yml Normal file
View File

@@ -0,0 +1,67 @@
---
- name: Get latest lego version
github_release:
user: go-acme
repo: lego
action: latest_release
token: "{{ vault_github_token }}"
delegate_to: localhost
run_once: true
register: lego_version
- name: Download lego {{ lego_version.tag }} from GitHub
get_url:
url: "https://github.com/go-acme/lego/releases/download/\
{{ lego_version.tag }}/lego_{{ lego_version.tag }}\
_linux_{{ deb_architecture }}.tar.gz"
dest: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}.tar.gz"
register: _download_archive
until: _download_archive is succeeded
retries: 3
delay: 5
- name: unpack lego binaries
unarchive:
src: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}.tar.gz"
dest: "/tmp"
creates: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}"
remote_src: true
extra_opts:
- --one-top-level
- name: Copy lego
copy:
src: "/tmp/lego_{{ lego_version.tag }}_linux_{{ deb_architecture }}/lego"
dest: "{{ lego_install_dir }}/lego"
remote_src: true
mode: 0755
- name: Create lego config directory
file:
path: "{{ lego_config_dir }}"
mode: 0755
state: directory
- name: Check lego registration
stat:
path: "{{ lego_config_dir }}/accounts"
register: account_dir
- name: Register lego and create cert
command: |
{{ lego_install_dir }}/lego --accept-tos
{% for dns in certificate_domains %}
--domains="{{ dns }}"
{% endfor %}
{{ lego_cli_params|join(' ') }}
run
environment: '{ "{{ lego_provider|upper }}_API_KEY": "{{ vault_ionos_token_dns }}" }'
when: not account_dir.stat.exists
- name: Copy lego systemd service
template:
src: "{{ item }}.j2"
dest: "/etc/systemd/system/{{ item }}"
mode: 0644
loop: [lego.service, lego.timer]
notify: [restart lego_service, restart lego_timer]

19
roles/lego/templates/lego.service.j2 Normal file
View File

@@ -0,0 +1,19 @@
## Managed by Ansible ##
[Unit]
Description=Run lego renew
After=network-online.target
[Service]
Type=oneshot
Environment={{ lego_provider|upper }}_API_KEY={{ vault_ionos_token_dns }}
ExecStart={{ lego_install_dir }}/lego \
{% for dns in certificate_domains %}
--domains="{{ dns }}" \
{% endfor %}
{{ lego_cli_params|join(' ') }} \
renew
User=root
[Install]
WantedBy=multi-user.target

12
roles/lego/templates/lego.timer.j2 Normal file
View File

@@ -0,0 +1,12 @@
## Managed by Ansible ##
[Unit]
Description=Start lego renew
[Timer]
Persistent=true
OnCalendar=Mon 05:00:00
RandomizedDelaySec=3600
[Install]
WantedBy=timers.target

21
roles/lego/vars/main.yml Normal file
View File

@@ -0,0 +1,21 @@
---
lego_install_dir: "/usr/local/bin"
lego_config_dir: "/etc/lego"
lego_provider: "ionos"
lego_cert_mail: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
32353064653631636431646333633664363866666439306235303138306461313266343939346463
6565636462656666366133653638333433393730656362360a333363623561646436613530623662
34623331313964316464653333646134353037333065373063346164623037663235316361646666
3466623937663061340a643863633034633665316364313065303166643363653366363063303261
34316163616637633837333539626337356563616566346561333439646565373665
lego_cli_params:
- --path={{ lego_config_dir }}
- --email={{ lego_cert_mail }}
- --dns={{ lego_provider }}
- --key-type=ec384
# Certificates
certificate_domains:
- "twirling.de"
- "*.twirling.de"

2
roles/nextcloud/defaults/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
nextcloud_updater: false # update Nextcloud via updater.phar

44
roles/nextcloud/handlers/main.yml Normal file
View File

@@ -0,0 +1,44 @@
---
- name: restart rclone_mount_nextcloud
systemd:
daemon_reload: true
enabled: true
name: rclone_mount_nextcloud.service
state: restarted
- name: restart nextcloudcron
systemd:
daemon_reload: true
enabled: true
name: "{{ item }}"
state: restarted
loop: [nextcloudcron.service, nextcloudcron.timer]
- name: restart nextcloud_nightlycron
systemd:
daemon_reload: true
enabled: true
name: nextcloud_nightlycron.timer
state: restarted
- name: restart nextcloud_notify_push
systemd:
daemon_reload: true
enabled: true
name: nextcloud_notify_push.service
state: restarted
- name: restart nextcloud_exporter
systemd:
daemon_reload: true
enabled: true
name: nextcloud_exporter.service
state: restarted
- name: restart nextcloud_backup_timer
systemd:
daemon_reload: true
enabled: true
name: nextcloud_backup.timer
state: restarted

8
roles/nextcloud/meta/main.yml Normal file
View File

@@ -0,0 +1,8 @@
---
dependencies:
- role: rclone
- role: systemd_exporter
vars:
systemd_exporter_include: '^rclone.*\.service|^nextcloud.*(cron|push)\..+'
- role: webserver
- role: redis

145
roles/nextcloud/tasks/configure.yml Normal file
View File

@@ -0,0 +1,145 @@
---
- name: Configure .user.ini
lineinfile:
path: "{{ nextcloud_dir }}/.user.ini"
line: '{{ item.type }} {{ item.option }} {{ item.value }}'
create: true
owner: "{{ webserver_user }}"
group: "{{ webserver_group }}"
loop: "{{ nextcloud_user_ini }}"
- name: Install apps
become: true
become_user: "{{ webserver_user }}"
command: php occ app:install {{ item }}
args:
chdir: "{{ nextcloud_dir }}"
creates: "{{ nextcloud_dir }}/apps/{{ item }}"
with_items: "{{ nextcloud_apps }}"
- name: Set configs via occ
become: true
become_user: "{{ webserver_user }}"
command: php occ config:app:set {{ item }}
args:
chdir: "{{ nextcloud_dir }}"
loop:
- "preview jpeg_quality --value=60"
- "previewgenerator squareSizes --value='256 1024'"
- "previewgenerator widthSizes --value=2048"
- "previewgenerator heightSizes --value=2048"
- "files_trashbin background_job_expire_trash --value=no"
- "files_versions background_job_expire_versions --value=no"
when: not nextcloud_dir_stat.stat.exists
- name: Get latest nextcloud_exporter version
github_release:
user: xperimental
repo: nextcloud-exporter
action: latest_release
token: "{{ vault_github_token }}"
delegate_to: localhost
run_once: true
register: nextcloud_exporter_version
- name: "{{ nextcloud_exporter_version }}"
set_fact:
nextcloud_exporter_version: "{{ nextcloud_exporter_version | replace ('v', '', 1) | trim }}"
run_once: true
- name: download nextcloud_exporter {{ nextcloud_exporter_version.tag }} from GitHub
get_url:
url: "https://github.com/xperimental/nextcloud-exporter/releases/download/\
v{{ nextcloud_exporter_version.tag }}/nextcloud-exporter-{{ nextcloud_exporter_version.tag }}\
-{{ deb_architecture }}.bz2"
dest: "/tmp/nextcloud-exporter-{{ nextcloud_exporter_version.tag }}-{{ deb_architecture }}.bz2"
register: _download_archive
until: _download_archive is succeeded
retries: 3
delay: 5
- name: decompress nextcloud_exporter binaries
command:
cmd: "bzip2 -dk nextcloud-exporter-{{ nextcloud_exporter_version.tag }}-{{ deb_architecture }}.bz2"
chdir: /tmp
creates: /tmp/nextcloud-exporter-{{ nextcloud_exporter_version.tag }}-{{ deb_architecture }}
- name: Copy nextcloud_exporter
copy:
src: "/tmp/nextcloud-exporter-{{ nextcloud_exporter_version.tag }}-{{ deb_architecture }}"
dest: "{{ nextcloud_exporter_install_dir }}/nextcloud_exporter"
remote_src: true
owner: "{{ nextcloud_exporter_system_user }}"
group: "{{ nextcloud_exporter_system_group }}"
mode: 0755
notify: restart nextcloud_exporter
- name: Get latest nextcloud_notify_push version
github_release:
user: nextcloud
repo: notify_push
action: latest_release
token: "{{ vault_github_token }}"
delegate_to: localhost
run_once: true
register: nextcloud_notify_push_version
- name: "{{ nextcloud_notify_push_version }}"
set_fact:
nextcloud_notify_push_version: "{{ nextcloud_notify_push_version | replace ('v', '', 1) | trim }}"
run_once: true
- name: "set deb_architecture alias"
set_fact:
deb_architecture_alias: "x86_64"
when: deb_architecture == "amd64"
- name: "set deb_architecture alias"
set_fact:
deb_architecture_alias: "{{ deb_architecture }}"
when: deb_architecture != "amd64"
- name: download nextcloud_notify_push {{ nextcloud_notify_push_version.tag }} from GitHub
get_url:
url: "https://github.com/nextcloud/notify_push/releases/download/v{{ nextcloud_notify_push_version.tag }}\
/notify_push-{{ deb_architecture_alias }}-unknown-linux-musl"
dest: "/tmp/notify_push-{{ deb_architecture_alias }}-unknown-linux-musl"
register: _download_archive
until: _download_archive is succeeded
retries: 3
delay: 5
- name: Copy nextcloud_notify_push
copy:
src: "/tmp/notify_push-{{ deb_architecture_alias }}-unknown-linux-musl"
dest: "{{ nextcloud_notify_push_install_dir }}/nextcloud_notify_push-{{ deb_architecture_alias }}"
remote_src: true
owner: "{{ webserver_user }}"
group: "{{ webserver_group }}"
mode: 0700
notify: restart nextcloud_notify_push
- name: Copy nextcloud_nightlycron
template:
src: nextcloud_nightlycron.sh.j2
dest: "{{ nextcloud_background_script_dir }}/nextcloud_nightlycron.sh"
owner: "{{ webserver_user }}"
group: "{{ webserver_group }}"
mode: 0700
- name: Copy the Nextcloud systemd service file
template:
src: "{{ item }}.j2"
dest: "/etc/systemd/system/{{ item }}"
owner: root
group: root
mode: 0644
loop:
- nextcloudcron.service
- nextcloudcron.timer
- nextcloud_notify_push.service
- nextcloud_exporter.service
- nextcloud_nightlycron.service
- nextcloud_nightlycron.timer
notify:
- restart {{ item | regex_replace ('\..*', '') }}
- restart systemd_exporter

25
roles/nextcloud/tasks/dependencies.yml Normal file
View File

@@ -0,0 +1,25 @@
---
- name: Install required system packages
apt:
name:
- python3-pip
state: latest
update_cache: true
cache_valid_time: 3600
- name: Install required python packages
pip:
name: gtar # needed for latest nextcloud tar.bz archive
state: latest
- name: Enable APCu
lineinfile:
path: /etc/php/{{ php_version }}/cli/conf.d/20-apcu.ini
line: apc.enable_cli=1
notify: restart php-fpm
- name: "Add {{ webserver_user }} user to redis group"
user:
name: "{{ webserver_user }}"
groups: redis
append: true

13
roles/nextcloud/tasks/main.yml Normal file
View File

@@ -0,0 +1,13 @@
---
- name: Configure rclone
import_tasks: rclone.yml
- name: Configure dependencies
import_tasks: dependencies.yml
- name: Check nextcloud
import_tasks: nextcloud.yml
- name: Configure nextcloud
import_tasks: configure.yml

104
roles/nextcloud/tasks/nextcloud.yml Normal file
View File

@@ -0,0 +1,104 @@
---
# flush handlers to restart code-server before install extensions
- name: Flush handlers befor continue
meta: flush_handlers
- name: Check nextcloud directory
stat:
path: '{{ nextcloud_dir }}'
register: nextcloud_dir_stat
- name: Install Nextcloud
block:
- name: Create nextcloud directory
file:
path: "{{ nextcloud_dir }}"
state: directory
owner: "{{ webserver_user }}"
group: "{{ webserver_group }}"
mode: 0775
force: false
- name: unpack nextcloud latest from nextcloud.com
unarchive:
remote_src: true
src: "https://download.nextcloud.com/server/releases/latest.tar.bz2"
dest: "{{ nextcloud_dir }}"
owner: "{{ webserver_user }}"
group: "{{ webserver_group }}"
extra_opts:
- --strip-components=1
- name: Change directory ownership to webserver user
file:
path: "{{ item }}"
state: directory
recurse: true
owner: "{{ webserver_user }}"
group: "{{ webserver_group }}"
loop:
- "{{ nextcloud_dir }}"
- "{{ nextcloud_cache_dir }}"
- "{{ nextcloud_log_dir }}"
- name: Copy default config
template:
src: "nextcloud.config.json.j2"
dest: /tmp/nextcloud.config.json
owner: "{{ webserver_user }}"
mode: 0600
- name: Ensure nextcloud installation is finished
become: true
become_user: "{{ webserver_user }}"
command: >
php occ maintenance:install
--database "pgsql"
--database-host "{{ nextcloud_db_host }}:{{ nextcloud_db_port }}"
--database-name "{{ nextcloud_db_name }}"
--database-user "{{ nextcloud_db_user }}"
--database-pass "{{ vault_nextcloud_db_pass }}"
--admin-user "{{ nexcloud_admin_user }}"
--admin-pass "{{ vault_nexcloud_admin_pass }}"
--data-dir "{{ nextcloud_data_dir }}"
args:
chdir: "{{ nextcloud_dir }}"
changed_when: true
- name: Set default config
become: true
become_user: "{{ webserver_user }}"
command: php occ config:import /tmp/nextcloud.config.json
args:
chdir: "{{ nextcloud_dir }}"
when: not nextcloud_dir_stat.stat.exists
- name: Update Nextcloud
block:
- name: Run nextcloud's updater.phar in non-interactive way
become: true
become_user: "{{ webserver_user }}"
command: 'php updater/updater.phar --no-interaction'
args:
chdir: "{{ nextcloud_dir }}"
register: nextcloud_update_result
changed_when: "'Start update' in nextcloud_update_result.stdout"
- name: Update result
debug:
msg: "{{ nextcloud_update_result.stdout_lines }}"
when: nextcloud_update_result.changed
- name: DB tuning after update
become: true
become_user: "{{ webserver_user }}"
command: php occ {{ item }}
args:
chdir: "{{ nextcloud_dir }}"
loop:
- db:add-missing-indices
- db:convert-filecache-bigint
- integrity:check-core
when: nextcloud_update_result.changed
when: nextcloud_updater

30
roles/nextcloud/tasks/rclone.yml Normal file
View File

@@ -0,0 +1,30 @@
---
# ensure rclone.conf is present (meta role dependencies)
- name: Create rclone mount dir
file:
path: "{{ nextcloud_rclone_mount_dir }}"
mode: 0755
state: directory
# Touch rclone log file to set permissions
- name: Touch rclone mount log file
file:
path: "{{ rclone_log_dir }}/mount_nextcloud.log"
state: touch
mode: 0644
access_time: preserve
modification_time: preserve
- name: Copy rclone mount nextcloud systemd service
template:
src: rclone_mount_nextcloud.service.j2
dest: /etc/systemd/system/rclone_mount_nextcloud.service
mode: 0644
notify: restart rclone_mount_nextcloud
- name: "Add {{ webserver_user }} user to rclone group"
user:
name: "{{ webserver_user }}"
groups: rclone
append: true

54
roles/nextcloud/templates/nextcloud.config.json.j2 Normal file
View File

@@ -0,0 +1,54 @@
{
"system": {
"trusted_proxies": {{ trusted_proxies | to_json }},
"trusted_domains": [
"{{ nextcloud_domain_name }}"
],
"overwrite.cli.url": "https:\/\/{{ nextcloud_domain_name }}",
"datadirectory": "{{ nextcloud_data_dir }}",
"dbtype": "pgsql",
"dbname": "{{ nextcloud_db_name }}",
"dbhost": "{{ nextcloud_db_host }}",
"dbport": "{{ nextcloud_db_port }}",
"dbtableprefix": "oc_",
"dbuser": "{{ nextcloud_db_user }}",
"dbpassword": "{{ vault_nextcloud_db_pass }}",
"skeletondirectory": "",
"default_language": "de",
"default_phone_region": "DE",
"mail_smtpmode": "smtp",
"mail_smtphost": "{{ nextcloud_smtp_host }}",
"mail_smtpport": "{{ nextcloud_smtp_port }}",
"mail_smtptimeout": 10,
"mail_smtpauthtype": "LOGIN",
"mail_from_address": "{{ nextcloud_smtp_from_address }}",
"mail_sendmailmode": "smtp",
"mail_domain": "{{ nextcloud_smtp_from_domain }}",
"mail_smtpauth": 1,
"mail_smtpname": "{{ nextcloud_smtp_user }}",
"mail_smtppassword": "{{ nextcloud_smtp_pass }}",
"mail_smtpsecure": "ssl",
"loglevel": 1,
"logfile": {{ nextcloud_log_file | to_json }},
"logtimezone": "Europe\/Berlin",
"memcache.local": "\\OC\\Memcache\\APCu",
"filelocking.enabled": true,
"memcache.distributed": "\\OC\\Memcache\\Redis",
"memcache.locking": "\\OC\\Memcache\\Redis",
"redis": {
"host": {{ redis_unixsocket | to_json }},
"port": 0,
"timeout": 0,
"dbindex": 0
},
"trashbin_retention_obligation": "auto, 90",
"versions_retention_obligation": "auto, 180",
"tempdirectory": {{ nextcloud_temp_dir | to_json }},
"cache_path": {{ nextcloud_cache_dir | to_json }},
"localstorage.allowsymlinks": true,
"enable_previews": "true",
"preview_max_x": "2048",
"preview_max_y": "2048",
"preview_max_scale_factor": 1
}
}

15
roles/nextcloud/templates/nextcloud_exporter.service.j2 Normal file
View File

@@ -0,0 +1,15 @@
## Managed by Ansible ##
[Unit]
Description=Nextcloud Exporter
After=network-online.target
[Service]
User={{ nextcloud_exporter_system_user }}
Group={{ nextcloud_exporter_system_group }}
Type=simple
ExecStart={{ nextcloud_exporter_install_dir }}/nextcloud_exporter --server https://{{ nextcloud_domain_name }} --auth-token {{ vault_nextcloud_exporter_token }}
Restart=always
[Install]
WantedBy=multi-user.target

12
roles/nextcloud/templates/nextcloud_nightlycron.service.j2 Normal file
View File

@@ -0,0 +1,12 @@
## Managed by Ansible ##
[Unit]
Description = Nextcloud nightly background job
[Service]
Type=simple
User={{ webserver_user }}
ExecStart=/usr/local/bin/nextcloud_nightlycron.sh
[Install]
WantedBy=multi-user.target

10
roles/nextcloud/templates/nextcloud_nightlycron.sh.j2 Normal file
View File

@@ -0,0 +1,10 @@
#!/bin/bash
## Managed by Ansible ##
cd {{ nextcloud_dir }}
# Print start status message.
echo "delete expired versions"
/usr/bin/php occ versions:expire --quiet
echo "permanently delete trashed files"
/usr/bin/php occ trashbin:expire --quiet

12
roles/nextcloud/templates/nextcloud_nightlycron.timer.j2 Normal file
View File

@@ -0,0 +1,12 @@
## Managed by Ansible ##
[Unit]
Description=Run Nextcloud nightly background job every night
[Timer]
OnCalendar=02:00:00
RandomizedDelaySec=600
Unit=nextcloud_nightlycron.service
[Install]
WantedBy=timers.target

17
roles/nextcloud/templates/nextcloud_notify_push.service.j2 Normal file
View File

@@ -0,0 +1,17 @@
## Managed by Ansible ##
[Unit]
Description = Push daemon for Nextcloud clients
[Service]
Environment = SOCKET_PATH={{ nextcloud_notify_push_socket }} METRICS_PORT=9206
User={{ webserver_user }}
Group={{ webserver_user }}
RuntimeDirectory=nextcloud
RuntimeDirectoryMode=0750
PIDFile=/run/nextcloud/notify_push.pid
ExecStart = {{ nextcloud_notify_push_install_dir }}/nextcloud_notify_push-{{ deb_architecture_alias }} {{ nextcloud_dir }}/config/config.php
Restart=always
[Install]
WantedBy = multi-user.target

9
roles/nextcloud/templates/nextcloudcron.service.j2 Normal file
View File

@@ -0,0 +1,9 @@
## Managed by Ansible ##
[Unit]
Description=Nextcloud background job (cron.php)
[Service]
User={{ webserver_user }}
ExecStart=/usr/bin/php -f /var/www/nextcloud/cron.php
KillMode=process

12
roles/nextcloud/templates/nextcloudcron.timer.j2 Normal file
View File

@@ -0,0 +1,12 @@
## Managed by Ansible ##
[Unit]
Description=Run Nextcloud background job (cron.php) every 5min
[Timer]
OnBootSec=5min
OnUnitActiveSec=5min
Unit=nextcloudcron.service
[Install]
WantedBy=timers.target

47
roles/nextcloud/templates/rclone_mount_nextcloud.service.j2 Normal file
View File

@@ -0,0 +1,47 @@
## Managed by Ansible ##
[Unit]
Description = rclone crypt mount {{ nextcloud_rclone_mount_dir }}
After = network-online.target
[Service]
Environment=RCLONE_RCD_USER=rclone
Environment=RCLONE_RCD_PASSWORD={{ vault_rclone_rcd_pass }}
Type=notify
ExecStart=/usr/bin/rclone mount GD3_crypt:cloud_data {{ nextcloud_rclone_mount_dir }} \
--devname rclone \
--use-mmap \
--allow-other \
--uid {{ created_rclone_user.uid }} \
--gid {{ created_rclone_group.gid }} \
--umask 002 \
--dir-perms 775 \
--file-perms 664 \
--dir-cache-time 8760h \
--poll-interval 1h \
--buffer-size 32M \
--drive-chunk-size 256M \
--drive-pacer-min-sleep 10ms \
--drive-pacer-burst 1000 \
--vfs-cache-max-age 720h \
--vfs-cache-mode full \
--vfs-cache-max-size 100G \
--vfs-read-chunk-size 128M \
--vfs-read-chunk-size-limit off \
--vfs-write-back 20s \
--cache-dir={{ rclone_cache_dir }} \
--log-file={{ rclone_log_dir }}/mount_nextcloud.log \
--log-level=INFO \
--rc \
--rc-addr "0.0.0.0:5572" \
--rc-enable-metrics \
--rc-user $RCLONE_RCD_USER \
--rc-pass $RCLONE_RCD_PASSWORD \
--user-agent "{{ rclone_user_agent_gd }}"
ExecStop=/bin/fusermount -u -z {{ nextcloud_rclone_mount_dir }}
Restart=on-failure
RestartSec=20s
User=root
[Install]
WantedBy=multi-user.target

87
roles/nextcloud/vars/main.yml Normal file
View File

@@ -0,0 +1,87 @@
---
# Rclone
nextcloud_rclone_mount_dir: "/mnt/cloud_data"
nextcloud_scripts_path: "/root/.scripts"
# Nextcloud
nextcloud_dir: "/var/www/nextcloud"
nextcloud_data_dir: "{{ hcloud_webserver_volume_path }}/nextcloud_data"
nextcloud_temp_dir: "/tmp"
nextcloud_cache_dir: "/var/cache/nextcloud"
nextcloud_log_dir: "/var/log/nextcloud"
nextcloud_log_file: "{{ nextcloud_log_dir }}/nextcloud.log"
nextcloud_domain_name: "cloud.{{ webserver_domain }}"
nexcloud_admin_user: "admin-{{ lookup('community.general.random_string', length=6, upper=false, special=false) }}"
vault_nexcloud_admin_pass: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
64373333336533333764643235613338306437306134333831393434326631306165653336383732
3537313164663762373636316462346438663634393237340a613565633865663665396531616133
39373637653839623736653531636361633739643137386537633464653332373066366336336532
6566313533383031310a663863616164633331313431396362373161646531663134313637626263
6562
trusted_proxies:
- "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
- "{{ hostvars[inventory_hostname]['ansible_default_ipv6']['address'] }}"
nextcloud_trashbin_retention_obligation: "auto, 90"
nextcloud_versions_retention_obligation: "auto, 30"
nextcloud_max_upload_size: "50G"
# database
nextcloud_db_host: "{{ pgsql_server_ip }}"
nextcloud_db_port: "{{ pgsql_server_port }}"
nextcloud_db_name: "nextcloud_db"
nextcloud_db_user: "nextcloud_db_user"
vault_nextcloud_db_pass: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
61393238366632366635373432343739373830393635656139643532663737313661643062626566
6538383561323332313231313235666437636631363030630a386665373562613936303038626638
63303861306461353734316530653231343132376130373835643236653836303031626431326265
3461333932626438630a393134653333323431323631653235643639316634383938666264623339
66323964336436303934373833353161313163353734343637303165393431376262323065306362
6664303132626565316665306263373761626139316432666333
# mailer
nextcloud_smtp_host: "{{ smtp_hostname }}"
nextcloud_smtp_port: "{{ smtp_port }}"
nextcloud_smtp_from_address: "cloud"
nextcloud_smtp_from_domain: "twirling.de"
nextcloud_smtp_user: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
37323762356630343133346634653965303530363966646236383962313163623637326165346439
3234303935353134633238396365363036313363663031310a663339363665376564306565393538
33663566663534383133623965316362383731303565326632623430303565343134393939343734
3930376165653536310a656632373336623663356431333136303165653162333137626632333033
35363439346237666662333537613363386266653865656238323638666533356535
nextcloud_smtp_pass: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
61303737376466646164313766373639376133633935313433356637323038626437663736363631
3864616433353737666137663663666333366463626337630a643034323935613833633439306236
36373763393762376533393663303436373939356561363036366535666134613731316530626536
6231626666643937340a326134636337666130356639383864346639316535663638636266323535
6562
nextcloud_user_ini:
- {type: php_value, option: upload_max_filesize, value: 50GB}
- {type: php_value, option: post_max_size, value: 50GB}
- {type: php_value, option: max_input_time, value: 3600}
- {type: php_value, option: max_execution_time, value: 3600}
nextcloud_apps:
- breezedark
- calendar
- contacts
- external
- extract
- files_external
- groupfolders
- notes
- notify_push
- tasks
- twofactor_totp
nextcloud_exporter_install_dir: "/usr/local/bin"
nextcloud_exporter_system_group: "node-exporter"
nextcloud_exporter_system_user: "{{ nextcloud_exporter_system_group }}"
vault_nextcloud_exporter_token: secret
nextcloud_notify_push_install_dir: "/usr/local/bin"
nextcloud_notify_push_socket: "/run/nextcloud/notify_push.sock"
nextcloud_background_script_dir: "/usr/local/bin"

5
roles/nginx/handlers/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
- name: reload nginx
systemd:
name: nginx.service
state: reloaded

44
roles/nginx/tasks/main.yml Normal file
View File

@@ -0,0 +1,44 @@
---
- name: Add Nginx GPG apt Key
apt_key:
url: https://nginx.org/keys/nginx_signing.key
keyring: /usr/share/keyrings/nginx-archive-keyring.gpg
state: present
- name: Add Nginx Mainline Repository
apt_repository:
repo: "deb [arch={{ deb_architecture }} signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/mainline/ubuntu {{ ansible_distribution_release }} nginx"
state: present
update_cache: true
- name: Install Nginx
apt:
name: nginx
state: latest
update_cache: true
cache_valid_time: 3600
- name: Remove default.conf
ansible.builtin.file:
path: /etc/nginx/conf.d/default.conf
state: absent
- name: Create global config folder
file:
path: "/etc/nginx/global"
mode: 0755
state: directory
- name: Copy Nginx SSL Config
template:
dest: /etc/nginx/global/ssl.conf
src: ssl.conf.j2
mode: 0644
notify: reload nginx
- name: Download pre-defined DHE group # as recommended by IETF RFC 7919
get_url:
url: https://github.com/internetstandards/dhe_groups/raw/main/ffdhe4096.pem
dest: "{{ nginx_ssl_dhparam }}"
notify: reload nginx

17
roles/nginx/templates/ssl.conf.j2 Normal file
View File

@@ -0,0 +1,17 @@
## Managed by Ansible ##
# Configure SSL
ssl_ciphers "{{ nginx_ssl_ciphers }}";
ssl_protocols {{ nginx_ssl_protocols }};
ssl_prefer_server_ciphers off;
ssl_early_data on;
ssl_dhparam {{ nginx_ssl_dhparam }};
# OCSP Stapling fetch OCSP records from URL in ssl_certificate and cache them
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001];
# SSL session handling
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_buffer_size 4k;

7
roles/nginx/vars/main.yml Normal file
View File

@@ -0,0 +1,7 @@
---
nginx_ssl_ciphers: "ALL:!AES128:!CAMELLIA128:!CAMELLIA:!ARIA128:!RSA:!SEED:!aNULL:!eNULL:!EXPORT:\
!DES:!RC4:!3DES:!MD5:!PSK:!DHE-RSA-AES256:!ECDHE-RSA-AES256-SHA384:\
!DHE-RSA-AES256-SHA256:!ECDHE-RSA-AES256-SHA:!DHE-RSA-AES256-SHA:@STRENGTH"
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
nginx_ssl_dhparam: "/etc/ssl/dhparams.pem"

7
roles/node_exporter/handlers/main.yml Normal file
View File

@@ -0,0 +1,7 @@
---
- name: restart node_exporter
systemd:
daemon_reload: true
enabled: true
name: node_exporter.service
state: restarted

69
roles/node_exporter/tasks/main.yml Normal file
View File

@@ -0,0 +1,69 @@
---
- name: Create node_exporter group
group:
name: "{{ node_exporter_system_group }}"
state: present
system: true
when: node_exporter_system_group != "root"
- name: Create node_exporter user
user:
name: "{{ node_exporter_system_user }}"
group: "{{ node_exporter_system_group }}"
groups: "{{ node_exporter_system_group }}"
append: true
shell: /usr/sbin/nologin
system: true
create_home: false
home: /
- name: Get latest node_exporter version
github_release:
user: prometheus
repo: node_exporter
action: latest_release
token: "{{ vault_github_token }}"
delegate_to: localhost
run_once: true
register: node_exporter_version
- name: "{{ node_exporter_version }}"
set_fact:
node_exporter_version: "{{ node_exporter_version | replace ('v', '', 1) | trim }}"
run_once: true
- name: download node_exporter {{ node_exporter_version.tag }} from GitHub
get_url:
url: "https://github.com/prometheus/node_exporter/releases/download/\
v{{ node_exporter_version.tag }}/node_exporter-{{ node_exporter_version.tag }}\
.linux-{{ deb_architecture }}.tar.gz"
dest: "/tmp/node_exporter-{{ node_exporter_version.tag }}-linux-{{ deb_architecture }}.tar.gz"
register: _download_archive
until: _download_archive is succeeded
retries: 3
delay: 5
- name: unpack node_exporter binaries
unarchive:
src: "/tmp/node_exporter-{{ node_exporter_version.tag }}-linux-{{ deb_architecture }}.tar.gz"
dest: "/tmp"
creates: "node_exporter-{{ node_exporter_version.tag }}.linux-{{ deb_architecture }}"
remote_src: true
- name: Copy node_exporter
copy:
src: "/tmp/node_exporter-{{ node_exporter_version.tag }}.linux-{{ deb_architecture }}/node_exporter"
dest: "{{ node_exporter_install_dir }}/node_exporter"
remote_src: true
owner: "{{ node_exporter_system_user }}"
group: "{{ node_exporter_system_group }}"
mode: 0755
notify: restart node_exporter
- name: Copy node_exporter systemd service
template:
src: node_exporter.service.j2
dest: /etc/systemd/system/node_exporter.service
owner: root
group: root
mode: 0644
notify: restart node_exporter

16
roles/node_exporter/templates/node_exporter.service.j2 Normal file
View File

@@ -0,0 +1,16 @@
## Managed by Ansible ##
[Unit]
Description=Prometheus Node Exporter
After=network-online.target
[Service]
Type=simple
User={{ node_exporter_system_user }}
Group={{ node_exporter_system_group }}
ExecStart={{ node_exporter_install_dir }}/node_exporter --collector.filesystem.ignored-mount-points=^/(sys|proc|dev|run)($|/)
Restart=always
RestartSec=1
[Install]
WantedBy=multi-user.target

5
roles/node_exporter/vars/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
# Variables
node_exporter_install_dir: "/usr/local/bin"
node_exporter_system_group: "node-exporter"
node_exporter_system_user: "{{ node_exporter_system_group }}"

5
roles/php/defaults/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
# Default PHP installation without version/module specification
# php_old_version: # specify old verison to uninstall
php_version: "8.1"
php_modules: ["common"]

5
roles/php/handlers/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
- name: restart php-fpm
systemd:
name: php{{ php_version }}-fpm.service
state: reloaded

3
roles/php/meta/main.yml Normal file
View File

@@ -0,0 +1,3 @@
---
dependencies:
- role: nginx

29
roles/php/tasks/main.yml Normal file
View File

@@ -0,0 +1,29 @@
---
- name: Add Sury PHP Repository
apt_repository:
repo: ppa:ondrej/php
state: present
update_cache: true
when: php_version is defined # add repo when version is specified, otherwise use default repo
- name: "Uninstall old PHP version"
apt:
name: "php{{ php_old_version }}*"
state: absent
purge: true
when: php_old_version is defined # uninstall when old version is specified
- name: "Install custom PHP modules {{ php_modules }}"
apt:
name: "{{ ['php' + php_version] | product(php_modules) | map('join', '-') | list }}"
state: latest
update_cache: true
cache_valid_time: 3600
- name: Copy Nginx PHP-Handler
template:
dest: /etc/nginx/conf.d/php-handler.conf
src: php-handler.conf.j2
mode: 0644
when: '"fpm" in php_modules'
notify: reload nginx

6
roles/php/templates/php-handler.conf.j2 Normal file
View File

@@ -0,0 +1,6 @@
## Managed by Ansible ##
# PHP Handler
upstream php-handler {
server unix:{{ php_socket }};
}

2
roles/php/vars/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
php_socket: "/run/php/php{{ php_version }}-fpm.sock"

17
roles/postgresql/handlers/main.yml Normal file
View File

@@ -0,0 +1,17 @@
---
- name: restart postgresql
systemd:
name: postgresql.service
state: restarted
- name: reload postgresql
systemd:
name: postgresql.service
state: reloaded
- name: restart postgres_exporter
systemd:
daemon_reload: true
enabled: true
name: postgres_exporter.service
state: restarted

3
roles/postgresql/meta/main.yml Normal file
View File

@@ -0,0 +1,3 @@
---
dependencies:
# - role: rclone # for backup

7
roles/postgresql/tasks/main.yml Normal file
View File

@@ -0,0 +1,7 @@
---
- name: Install postgresql
import_tasks: postgresql.yml
- name: Install postgresql exporter
import_tasks: postgres_exporter.yml

50
roles/postgresql/tasks/postgres_exporter.yml Normal file
View File

@@ -0,0 +1,50 @@
---
- name: Get latest postgres_exporter version
github_release:
user: prometheus-community
repo: postgres_exporter
action: latest_release
token: "{{ vault_github_token }}"
delegate_to: localhost
run_once: true
register: postgres_exporter_version
- name: "{{ postgres_exporter_version }}"
set_fact:
postgres_exporter_version: "{{ postgres_exporter_version | replace ('v', '', 1) | trim }}"
run_once: true
- name: download postgres_exporter {{ postgres_exporter_version.tag }} from GitHub
get_url:
url: "https://github.com/prometheus-community/postgres_exporter/releases/download/\
v{{ postgres_exporter_version.tag }}/postgres_exporter-{{ postgres_exporter_version.tag }}\
.linux-{{ deb_architecture }}.tar.gz"
dest: "/tmp/postgres_exporter-{{ postgres_exporter_version.tag }}-linux-{{ deb_architecture }}.tar.gz"
register: _download_archive
until: _download_archive is succeeded
retries: 3
delay: 5
- name: unpack postgres_exporter binaries
unarchive:
src: "/tmp/postgres_exporter-{{ postgres_exporter_version.tag }}-linux-{{ deb_architecture }}.tar.gz"
dest: "/tmp"
creates: "/tmp/postgres_exporter-{{ postgres_exporter_version.tag }}.linux-{{ deb_architecture }}"
remote_src: true
- name: Copy postgres_exporter
copy:
src: "/tmp/postgres_exporter-{{ postgres_exporter_version.tag }}.linux-{{ deb_architecture }}/postgres_exporter"
dest: "{{ pgsql_exporter_install_dir }}/postgres_exporter"
remote_src: true
mode: 0755
notify: restart postgres_exporter
- name: Copy the postgres_exporter systemd service file
template:
src: postgres_exporter.service.j2
dest: /etc/systemd/system/postgres_exporter.service
owner: root
group: root
mode: 0644
notify: restart postgres_exporter

34
roles/postgresql/tasks/postgresql.yml Normal file
View File

@@ -0,0 +1,34 @@
---
- name: Add PostgreSQL GPG apt key
apt_key:
url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
keyring: /usr/share/keyrings/apt.postgresql.org.gpg
state: present
- name: Add PostgreSQL Repository
apt_repository:
repo: "deb [arch={{ deb_architecture }} signed-by=/usr/share/keyrings/apt.postgresql.org.gpg] \
http://apt.postgresql.org/pub/repos/apt {{ ansible_distribution_release }}-pgdg main"
state: present
update_cache: true
- name: Install PostgreSQL
apt:
name: "postgresql-{{ pgsql_server_version }}"
state: latest
update_cache: true
cache_valid_time: 3600
- name: Create PostgreSQL Config
template:
dest: "/etc/postgresql/{{ pgsql_server_version }}/main/postgresql.conf"
src: "postgresql.conf.j2"
mode: 0644
notify: restart postgresql
- name: Create PostgreSQL Client Authentication Config
template:
dest: "/etc/postgresql/{{ pgsql_server_version }}/main/pg_hba.conf"
src: "pg_hba.conf.j2"
mode: 0644
notify: reload postgresql

111
roles/postgresql/templates/pg_hba.conf.j2 Normal file
View File

@@ -0,0 +1,111 @@
## Managed by Ansible ##
# PostgreSQL Client Authentication Configuration File
# ===================================================
#
# Refer to the "Client Authentication" section in the PostgreSQL
# documentation for a complete description of this file. A short
# synopsis follows.
#
# This file controls: which hosts are allowed to connect, how clients
# are authenticated, which PostgreSQL user names they can use, which
# databases they can access. Records take one of these forms:
#
# local DATABASE USER METHOD [OPTIONS]
# host DATABASE USER ADDRESS METHOD [OPTIONS]
# hostssl DATABASE USER ADDRESS METHOD [OPTIONS]
# hostnossl DATABASE USER ADDRESS METHOD [OPTIONS]
# hostgssenc DATABASE USER ADDRESS METHOD [OPTIONS]
# hostnogssenc DATABASE USER ADDRESS METHOD [OPTIONS]
#
# (The uppercase items must be replaced by actual values.)
#
# The first field is the connection type:
# - "local" is a Unix-domain socket
# - "host" is a TCP/IP socket (encrypted or not)
# - "hostssl" is a TCP/IP socket that is SSL-encrypted
# - "hostnossl" is a TCP/IP socket that is not SSL-encrypted
# - "hostgssenc" is a TCP/IP socket that is GSSAPI-encrypted
# - "hostnogssenc" is a TCP/IP socket that is not GSSAPI-encrypted
#
# DATABASE can be "all", "sameuser", "samerole", "replication", a
# database name, or a comma-separated list thereof. The "all"
# keyword does not match "replication". Access to replication
# must be enabled in a separate record (see example below).
#
# USER can be "all", a user name, a group name prefixed with "+", or a
# comma-separated list thereof. In both the DATABASE and USER fields
# you can also write a file name prefixed with "@" to include names
# from a separate file.
#
# ADDRESS specifies the set of hosts the record matches. It can be a
# host name, or it is made up of an IP address and a CIDR mask that is
# an integer (between 0 and 32 (IPv4) or 128 (IPv6) inclusive) that
# specifies the number of significant bits in the mask. A host name
# that starts with a dot (.) matches a suffix of the actual host name.
# Alternatively, you can write an IP address and netmask in separate
# columns to specify the set of hosts. Instead of a CIDR-address, you
# can write "samehost" to match any of the server's own IP addresses,
# or "samenet" to match any address in any subnet that the server is
# directly connected to.
#
# METHOD can be "trust", "reject", "md5", "password", "scram-sha-256",
# "gss", "sspi", "ident", "peer", "pam", "ldap", "radius" or "cert".
# Note that "password" sends passwords in clear text; "md5" or
# "scram-sha-256" are preferred since they send encrypted passwords.
#
# OPTIONS are a set of options for the authentication in the format
# NAME=VALUE. The available options depend on the different
# authentication methods -- refer to the "Client Authentication"
# section in the documentation for a list of which options are
# available for which authentication methods.
#
# Database and user names containing spaces, commas, quotes and other
# special characters must be quoted. Quoting one of the keywords
# "all", "sameuser", "samerole" or "replication" makes the name lose
# its special character, and just match a database or username with
# that name.
#
# This file is read on server startup and when the server receives a
# SIGHUP signal. If you edit the file on a running system, you have to
# SIGHUP the server for the changes to take effect, run "pg_ctl reload",
# or execute "SELECT pg_reload_conf()".
#
# Put your actual configuration here
# ----------------------------------
#
# If you want to allow non-local connections, you need to add more
# "host" records. In that case you will also need to make PostgreSQL
# listen on a non-local interface via the listen_addresses
# configuration parameter, or via the -i or -h command line switches.
# DO NOT DISABLE!
# If you change this first entry you will need to make sure that the
# database superuser can access the database using some other method.
# Noninteractive access to all databases is required during automatic
# maintenance (custom daily cronjobs, replication, and similar tasks).
#
# Database administrative login by Unix domain socket
local all postgres peer
# TYPE DATABASE USER ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all peer
# IPv4 local connections:
host all all 127.0.0.1/32 scram-sha-256
# IPv6 local connections:
host all all ::1/128 scram-sha-256
# Allow replication connections from localhost, by a user with the
# replication privilege.
local replication all peer
host replication all 127.0.0.1/32 scram-sha-256
host replication all ::1/128 scram-sha-256
# Rules managed by Ansible
{% for client in pgsql_client_auth %}
host {{ client.db }} {{ client.user }} {{ client.address }} {{ client.method }}
{% endfor %}

18
roles/postgresql/templates/postgres_exporter.service.j2 Normal file
View File

@@ -0,0 +1,18 @@
## Managed by Ansible ##
[Unit]
Description=PostgreSQL Exporter
After=network-online.target
[Service]
Environment=PG_EXPORTER_AUTO_DISCOVER_DATABASES=true
Environment=PG_EXPORTER_EXCLUDE_DATABASES=postgres,template1,template0
Environment=DATA_SOURCE_NAME="user=postgres host=/var/run/postgresql/ sslmode=disable"
User={{ pgsql_exporter_user }}
Type=simple
ExecStart=postgres_exporter
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target

800
roles/postgresql/templates/postgresql.conf.j2 Normal file
View File

@@ -0,0 +1,800 @@
## Managed by Ansible ##
# -----------------------------
# PostgreSQL configuration file
# -----------------------------
#
# This file consists of lines of the form:
#
# name = value
#
# (The "=" is optional.) Whitespace may be used. Comments are introduced with
# "#" anywhere on a line. The complete list of parameter names and allowed
# values can be found in the PostgreSQL documentation.
#
# The commented-out settings shown in this file represent the default values.
# Re-commenting a setting is NOT sufficient to revert it to the default value;
# you need to reload the server.
#
# This file is read on server startup and when the server receives a SIGHUP
# signal. If you edit the file on a running system, you have to SIGHUP the
# server for the changes to take effect, run "pg_ctl reload", or execute
# "SELECT pg_reload_conf()". Some parameters, which are marked below,
# require a server shutdown and restart to take effect.
#
# Any parameter can also be given as a command-line option to the server, e.g.,
# "postgres -c log_connections=on". Some parameters can be changed at run time
# with the "SET" SQL command.
#
# Memory units: B = bytes Time units: us = microseconds
# kB = kilobytes ms = milliseconds
# MB = megabytes s = seconds
# GB = gigabytes min = minutes
# TB = terabytes h = hours
# d = days
#------------------------------------------------------------------------------
# FILE LOCATIONS
#------------------------------------------------------------------------------
# The default values of these variables are driven from the -D command-line
# option or PGDATA environment variable, represented here as ConfigDir.
data_directory = '/var/lib/postgresql/14/main' # use data in another directory
# (change requires restart)
hba_file = '/etc/postgresql/14/main/pg_hba.conf' # host-based authentication file
# (change requires restart)
ident_file = '/etc/postgresql/14/main/pg_ident.conf' # ident configuration file
# (change requires restart)
# If external_pid_file is not explicitly set, no extra PID file is written.
external_pid_file = '/var/run/postgresql/14-main.pid' # write an extra PID file
# (change requires restart)
#------------------------------------------------------------------------------
# CONNECTIONS AND AUTHENTICATION
#------------------------------------------------------------------------------
# - Connection Settings -
listen_addresses = '{{ pgsql_listen_addresses }}'
# what IP address(es) to listen on;
# comma-separated list of addresses;
# defaults to 'localhost'; use '*' for all
# (change requires restart)
port = {{ pgsql_server_port }}
max_connections = {{ pgsql_max_connections }}
#superuser_reserved_connections = 3 # (change requires restart)
unix_socket_directories = '{{ pgsql_unix_socket }}'
#unix_socket_group = '' # (change requires restart)
#unix_socket_permissions = 0777 # begin with 0 to use octal notation
# (change requires restart)
#bonjour = off # advertise server via Bonjour
# (change requires restart)
#bonjour_name = '' # defaults to the computer name
# (change requires restart)
# - TCP settings -
# see "man tcp" for details
#tcp_keepalives_idle = 0 # TCP_KEEPIDLE, in seconds;
# 0 selects the system default
#tcp_keepalives_interval = 0 # TCP_KEEPINTVL, in seconds;
# 0 selects the system default
#tcp_keepalives_count = 0 # TCP_KEEPCNT;
# 0 selects the system default
#tcp_user_timeout = 0 # TCP_USER_TIMEOUT, in milliseconds;
# 0 selects the system default
#client_connection_check_interval = 0 # time between checks for client
# disconnection while running queries;
# 0 for never
# - Authentication -
#authentication_timeout = 1min # 1s-600s
password_encryption = {{ pgsql_password_encryption }}
#db_user_namespace = off
# GSSAPI using Kerberos
#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab'
#krb_caseins_users = off
# - SSL -
ssl = on
#ssl_ca_file = ''
ssl_cert_file = '/etc/ssl/certs/ssl-cert-snakeoil.pem'
#ssl_crl_file = ''
#ssl_crl_dir = ''
ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
#ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
#ssl_min_protocol_version = 'TLSv1.2'
#ssl_max_protocol_version = ''
#ssl_dh_params_file = ''
#ssl_passphrase_command = ''
#ssl_passphrase_command_supports_reload = off
#------------------------------------------------------------------------------
# RESOURCE USAGE (except WAL)
#------------------------------------------------------------------------------
# - Memory -
shared_buffers = {{ pgsql_shared_buffers }}
# (change requires restart)
#huge_pages = try # on, off, or try
# (change requires restart)
#huge_page_size = 0 # zero for system default
# (change requires restart)
#temp_buffers = 8MB # min 800kB
#max_prepared_transactions = 0 # zero disables the feature
# (change requires restart)
# Caution: it is not advisable to set max_prepared_transactions nonzero unless
# you actively intend to use prepared transactions.
work_mem = {{ pgsql_work_mem }}
#hash_mem_multiplier = 1.0 # 1-1000.0 multiplier on hash table work_mem
maintenance_work_mem = {{ pgsql_maintenance_work_mem }}
#autovacuum_work_mem = -1 # min 1MB, or -1 to use maintenance_work_mem
#logical_decoding_work_mem = 64MB # min 64kB
#max_stack_depth = 2MB # min 100kB
#shared_memory_type = mmap # the default is the first option
# supported by the operating system:
# mmap
# sysv
# windows
# (change requires restart)
dynamic_shared_memory_type = posix # the default is the first option
# supported by the operating system:
# posix
# sysv
# windows
# mmap
# (change requires restart)
#min_dynamic_shared_memory = 0MB # (change requires restart)
# - Disk -
#temp_file_limit = -1 # limits per-process temp file space
# in kilobytes, or -1 for no limit
# - Kernel Resources -
#max_files_per_process = 1000 # min 64
# (change requires restart)
# - Cost-Based Vacuum Delay -
#vacuum_cost_delay = 0 # 0-100 milliseconds (0 disables)
#vacuum_cost_page_hit = 1 # 0-10000 credits
#vacuum_cost_page_miss = 2 # 0-10000 credits
#vacuum_cost_page_dirty = 20 # 0-10000 credits
#vacuum_cost_limit = 200 # 1-10000 credits
# - Background Writer -
#bgwriter_delay = 200ms # 10-10000ms between rounds
#bgwriter_lru_maxpages = 100 # max buffers written/round, 0 disables
#bgwriter_lru_multiplier = 2.0 # 0-10.0 multiplier on buffers scanned/round
#bgwriter_flush_after = 512kB # measured in pages, 0 disables
# - Asynchronous Behavior -
#backend_flush_after = 0 # measured in pages, 0 disables
effective_io_concurrency = {{ pgsql_effective_io_concurrency }}
#maintenance_io_concurrency = 10 # 1-1000; 0 disables prefetching
max_worker_processes = {{ pgsql_max_worker_processes }}
max_parallel_workers_per_gather = {{ pgsql_max_parallel_workers_per_gather }}
max_parallel_maintenance_workers = {{ pgsql_max_parallel_maintenance_workers }}
max_parallel_workers = {{ pgsql_max_parallel_workers }}
#parallel_leader_participation = on
#old_snapshot_threshold = -1 # 1min-60d; -1 disables; 0 is immediate
# (change requires restart)
#------------------------------------------------------------------------------
# WRITE-AHEAD LOG
#------------------------------------------------------------------------------
# - Settings -
#wal_level = replica # minimal, replica, or logical
# (change requires restart)
#fsync = on # flush data to disk for crash safety
# (turning this off can cause
# unrecoverable data corruption)
#synchronous_commit = on # synchronization level;
# off, local, remote_write, remote_apply, or on
#wal_sync_method = fsync # the default is the first option
# supported by the operating system:
# open_datasync
# fdatasync (default on Linux and FreeBSD)
# fsync
# fsync_writethrough
# open_sync
#full_page_writes = on # recover from partial page writes
#wal_log_hints = off # also do full page writes of non-critical updates
# (change requires restart)
#wal_compression = off # enable compression of full-page writes
#wal_init_zero = on # zero-fill new WAL files
#wal_recycle = on # recycle WAL files
wal_buffers = {{ pgsql_wal_buffers }}
# (change requires restart)
#wal_writer_delay = 200ms # 1-10000 milliseconds
#wal_writer_flush_after = 1MB # measured in pages, 0 disables
#wal_skip_threshold = 2MB
#commit_delay = 0 # range 0-100000, in microseconds
#commit_siblings = 5 # range 1-1000
# - Checkpoints -
#checkpoint_timeout = 5min # range 30s-1d
checkpoint_completion_target = {{ pgsql_checkpoint_completion_target }}
#checkpoint_flush_after = 256kB # measured in pages, 0 disables
#checkpoint_warning = 30s # 0 disables
min_wal_size = {{ pgsql_min_wal_size }}
max_wal_size = {{ pgsql_max_wal_size }}
# - Archiving -
#archive_mode = off # enables archiving; off, on, or always
# (change requires restart)
#archive_command = '' # command to use to archive a logfile segment
# placeholders: %p = path of file to archive
# %f = file name only
# e.g. 'test ! -f /mnt/server/archivedir/%f && cp %p /mnt/server/archivedir/%f'
#archive_timeout = 0 # force a logfile segment switch after this
# number of seconds; 0 disables
# - Archive Recovery -
# These are only used in recovery mode.
#restore_command = '' # command to use to restore an archived logfile segment
# placeholders: %p = path of file to restore
# %f = file name only
# e.g. 'cp /mnt/server/archivedir/%f %p'
#archive_cleanup_command = '' # command to execute at every restartpoint
#recovery_end_command = '' # command to execute at completion of recovery
# - Recovery Target -
# Set these only when performing a targeted recovery.
#recovery_target = '' # 'immediate' to end recovery as soon as a
# consistent state is reached
# (change requires restart)
#recovery_target_name = '' # the named restore point to which recovery will proceed
# (change requires restart)
#recovery_target_time = '' # the time stamp up to which recovery will proceed
# (change requires restart)
#recovery_target_xid = '' # the transaction ID up to which recovery will proceed
# (change requires restart)
#recovery_target_lsn = '' # the WAL LSN up to which recovery will proceed
# (change requires restart)
#recovery_target_inclusive = on # Specifies whether to stop:
# just after the specified recovery target (on)
# just before the recovery target (off)
# (change requires restart)
#recovery_target_timeline = 'latest' # 'current', 'latest', or timeline ID
# (change requires restart)
#recovery_target_action = 'pause' # 'pause', 'promote', 'shutdown'
# (change requires restart)
#------------------------------------------------------------------------------
# REPLICATION
#------------------------------------------------------------------------------
# - Sending Servers -
# Set these on the primary and on any standby that will send replication data.
#max_wal_senders = 10 # max number of walsender processes
# (change requires restart)
#max_replication_slots = 10 # max number of replication slots
# (change requires restart)
#wal_keep_size = 0 # in megabytes; 0 disables
#max_slot_wal_keep_size = -1 # in megabytes; -1 disables
#wal_sender_timeout = 60s # in milliseconds; 0 disables
#track_commit_timestamp = off # collect timestamp of transaction commit
# (change requires restart)
# - Primary Server -
# These settings are ignored on a standby server.
#synchronous_standby_names = '' # standby servers that provide sync rep
# method to choose sync standbys, number of sync standbys,
# and comma-separated list of application_name
# from standby(s); '*' = all
#vacuum_defer_cleanup_age = 0 # number of xacts by which cleanup is delayed
# - Standby Servers -
# These settings are ignored on a primary server.
#primary_conninfo = '' # connection string to sending server
#primary_slot_name = '' # replication slot on sending server
#promote_trigger_file = '' # file name whose presence ends recovery
#hot_standby = on # "off" disallows queries during recovery
# (change requires restart)
#max_standby_archive_delay = 30s # max delay before canceling queries
# when reading WAL from archive;
# -1 allows indefinite delay
#max_standby_streaming_delay = 30s # max delay before canceling queries
# when reading streaming WAL;
# -1 allows indefinite delay
#wal_receiver_create_temp_slot = off # create temp slot if primary_slot_name
# is not set
#wal_receiver_status_interval = 10s # send replies at least this often
# 0 disables
#hot_standby_feedback = off # send info from standby to prevent
# query conflicts
#wal_receiver_timeout = 60s # time that receiver waits for
# communication from primary
# in milliseconds; 0 disables
#wal_retrieve_retry_interval = 5s # time to wait before retrying to
# retrieve WAL after a failed attempt
#recovery_min_apply_delay = 0 # minimum delay for applying changes during recovery
# - Subscribers -
# These settings are ignored on a publisher.
#max_logical_replication_workers = 4 # taken from max_worker_processes
# (change requires restart)
#max_sync_workers_per_subscription = 2 # taken from max_logical_replication_workers
#------------------------------------------------------------------------------
# QUERY TUNING
#------------------------------------------------------------------------------
# - Planner Method Configuration -
#enable_async_append = on
#enable_bitmapscan = on
#enable_gathermerge = on
#enable_hashagg = on
#enable_hashjoin = on
#enable_incremental_sort = on
#enable_indexscan = on
#enable_indexonlyscan = on
#enable_material = on
#enable_memoize = on
#enable_mergejoin = on
#enable_nestloop = on
#enable_parallel_append = on
#enable_parallel_hash = on
#enable_partition_pruning = on
#enable_partitionwise_join = off
#enable_partitionwise_aggregate = off
#enable_seqscan = on
#enable_sort = on
#enable_tidscan = on
# - Planner Cost Constants -
#seq_page_cost = 1.0 # measured on an arbitrary scale
random_page_cost = {{ pgsql_random_page_cost }}
# same scale as above
#cpu_tuple_cost = 0.01 # same scale as above
#cpu_index_tuple_cost = 0.005 # same scale as above
#cpu_operator_cost = 0.0025 # same scale as above
#parallel_setup_cost = 1000.0 # same scale as above
#parallel_tuple_cost = 0.1 # same scale as above
#min_parallel_table_scan_size = 8MB
#min_parallel_index_scan_size = 512kB
effective_cache_size = {{ pgsql_effective_cache_size }}
#jit_above_cost = 100000 # perform JIT compilation if available
# and query more expensive than this;
# -1 disables
#jit_inline_above_cost = 500000 # inline small functions if query is
# more expensive than this; -1 disables
#jit_optimize_above_cost = 500000 # use expensive JIT optimizations if
# query is more expensive than this;
# -1 disables
# - Genetic Query Optimizer -
#geqo = on
#geqo_threshold = 12
#geqo_effort = 5 # range 1-10
#geqo_pool_size = 0 # selects default based on effort
#geqo_generations = 0 # selects default based on effort
#geqo_selection_bias = 2.0 # range 1.5-2.0
#geqo_seed = 0.0 # range 0.0-1.0
# - Other Planner Options -
default_statistics_target = {{ pgsql_default_statistics_target }}
#constraint_exclusion = partition # on, off, or partition
#cursor_tuple_fraction = 0.1 # range 0.0-1.0
#from_collapse_limit = 8
#jit = on # allow JIT compilation
#join_collapse_limit = 8 # 1 disables collapsing of explicit
# JOIN clauses
#plan_cache_mode = auto # auto, force_generic_plan or
# force_custom_plan
#------------------------------------------------------------------------------
# REPORTING AND LOGGING
#------------------------------------------------------------------------------
# - Where to Log -
#log_destination = 'stderr' # Valid values are combinations of
# stderr, csvlog, syslog, and eventlog,
# depending on platform. csvlog
# requires logging_collector to be on.
# This is used when logging to stderr:
#logging_collector = off # Enable capturing of stderr and csvlog
# into log files. Required to be on for
# csvlogs.
# (change requires restart)
# These are only used if logging_collector is on:
#log_directory = 'log' # directory where log files are written,
# can be absolute or relative to PGDATA
#log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log' # log file name pattern,
# can include strftime() escapes
#log_file_mode = 0600 # creation mode for log files,
# begin with 0 to use octal notation
#log_rotation_age = 1d # Automatic rotation of logfiles will
# happen after that time. 0 disables.
#log_rotation_size = 10MB # Automatic rotation of logfiles will
# happen after that much log output.
# 0 disables.
#log_truncate_on_rotation = off # If on, an existing log file with the
# same name as the new log file will be
# truncated rather than appended to.
# But such truncation only occurs on
# time-driven rotation, not on restarts
# or size-driven rotation. Default is
# off, meaning append to existing files
# in all cases.
# These are relevant when logging to syslog:
#syslog_facility = 'LOCAL0'
#syslog_ident = 'postgres'
#syslog_sequence_numbers = on
#syslog_split_messages = on
# This is only relevant when logging to eventlog (Windows):
# (change requires restart)
#event_source = 'PostgreSQL'
# - When to Log -
#log_min_messages = warning # values in order of decreasing detail:
# debug5
# debug4
# debug3
# debug2
# debug1
# info
# notice
# warning
# error
# log
# fatal
# panic
#log_min_error_statement = error # values in order of decreasing detail:
# debug5
# debug4
# debug3
# debug2
# debug1
# info
# notice
# warning
# error
# log
# fatal
# panic (effectively off)
#log_min_duration_statement = -1 # -1 is disabled, 0 logs all statements
# and their durations, > 0 logs only
# statements running at least this number
# of milliseconds
#log_min_duration_sample = -1 # -1 is disabled, 0 logs a sample of statements
# and their durations, > 0 logs only a sample of
# statements running at least this number
# of milliseconds;
# sample fraction is determined by log_statement_sample_rate
#log_statement_sample_rate = 1.0 # fraction of logged statements exceeding
# log_min_duration_sample to be logged;
# 1.0 logs all such statements, 0.0 never logs
#log_transaction_sample_rate = 0.0 # fraction of transactions whose statements
# are logged regardless of their duration; 1.0 logs all
# statements from all transactions, 0.0 never logs
# - What to Log -
#debug_print_parse = off
#debug_print_rewritten = off
#debug_print_plan = off
#debug_pretty_print = on
#log_autovacuum_min_duration = -1 # log autovacuum activity;
# -1 disables, 0 logs all actions and
# their durations, > 0 logs only
# actions running at least this number
# of milliseconds.
#log_checkpoints = off
#log_connections = off
#log_disconnections = off
#log_duration = off
#log_error_verbosity = default # terse, default, or verbose messages
#log_hostname = off
log_line_prefix = '%m [%p] %q%u@%d ' # special values:
# %a = application name
# %u = user name
# %d = database name
# %r = remote host and port
# %h = remote host
# %b = backend type
# %p = process ID
# %P = process ID of parallel group leader
# %t = timestamp without milliseconds
# %m = timestamp with milliseconds
# %n = timestamp with milliseconds (as a Unix epoch)
# %Q = query ID (0 if none or not computed)
# %i = command tag
# %e = SQL state
# %c = session ID
# %l = session line number
# %s = session start timestamp
# %v = virtual transaction ID
# %x = transaction ID (0 if none)
# %q = stop here in non-session
# processes
# %% = '%'
# e.g. '<%u%%%d> '
#log_lock_waits = off # log lock waits >= deadlock_timeout
#log_recovery_conflict_waits = off # log standby recovery conflict waits
# >= deadlock_timeout
#log_parameter_max_length = -1 # when logging statements, limit logged
# bind-parameter values to N bytes;
# -1 means print in full, 0 disables
#log_parameter_max_length_on_error = 0 # when logging an error, limit logged
# bind-parameter values to N bytes;
# -1 means print in full, 0 disables
#log_statement = 'none' # none, ddl, mod, all
#log_replication_commands = off
#log_temp_files = -1 # log temporary files equal or larger
# than the specified size in kilobytes;
# -1 disables, 0 logs all temp files
log_timezone = 'Europe/Berlin'
#------------------------------------------------------------------------------
# PROCESS TITLE
#------------------------------------------------------------------------------
cluster_name = '14/main' # added to process titles if nonempty
# (change requires restart)
#update_process_title = on
#------------------------------------------------------------------------------
# STATISTICS
#------------------------------------------------------------------------------
# - Query and Index Statistics Collector -
#track_activities = on
#track_activity_query_size = 1024 # (change requires restart)
#track_counts = on
#track_io_timing = off
#track_wal_io_timing = off
#track_functions = none # none, pl, all
stats_temp_directory = '/var/run/postgresql/14-main.pg_stat_tmp'
# - Monitoring -
#compute_query_id = auto
#log_statement_stats = off
#log_parser_stats = off
#log_planner_stats = off
#log_executor_stats = off
#------------------------------------------------------------------------------
# AUTOVACUUM
#------------------------------------------------------------------------------
#autovacuum = on # Enable autovacuum subprocess? 'on'
# requires track_counts to also be on.
#autovacuum_max_workers = 3 # max number of autovacuum subprocesses
# (change requires restart)
#autovacuum_naptime = 1min # time between autovacuum runs
#autovacuum_vacuum_threshold = 50 # min number of row updates before
# vacuum
#autovacuum_vacuum_insert_threshold = 1000 # min number of row inserts
# before vacuum; -1 disables insert
# vacuums
#autovacuum_analyze_threshold = 50 # min number of row updates before
# analyze
#autovacuum_vacuum_scale_factor = 0.2 # fraction of table size before vacuum
#autovacuum_vacuum_insert_scale_factor = 0.2 # fraction of inserts over table
# size before insert vacuum
#autovacuum_analyze_scale_factor = 0.1 # fraction of table size before analyze
#autovacuum_freeze_max_age = 200000000 # maximum XID age before forced vacuum
# (change requires restart)
#autovacuum_multixact_freeze_max_age = 400000000 # maximum multixact age
# before forced vacuum
# (change requires restart)
#autovacuum_vacuum_cost_delay = 2ms # default vacuum cost delay for
# autovacuum, in milliseconds;
# -1 means use vacuum_cost_delay
#autovacuum_vacuum_cost_limit = -1 # default vacuum cost limit for
# autovacuum, -1 means use
# vacuum_cost_limit
#------------------------------------------------------------------------------
# CLIENT CONNECTION DEFAULTS
#------------------------------------------------------------------------------
# - Statement Behavior -
#client_min_messages = notice # values in order of decreasing detail:
# debug5
# debug4
# debug3
# debug2
# debug1
# log
# notice
# warning
# error
#search_path = '"$user", public' # schema names
#row_security = on
#default_table_access_method = 'heap'
#default_tablespace = '' # a tablespace name, '' uses the default
#default_toast_compression = 'pglz' # 'pglz' or 'lz4'
#temp_tablespaces = '' # a list of tablespace names, '' uses
# only default tablespace
#check_function_bodies = on
#default_transaction_isolation = 'read committed'
#default_transaction_read_only = off
#default_transaction_deferrable = off
#session_replication_role = 'origin'
#statement_timeout = 0 # in milliseconds, 0 is disabled
#lock_timeout = 0 # in milliseconds, 0 is disabled
#idle_in_transaction_session_timeout = 0 # in milliseconds, 0 is disabled
#idle_session_timeout = 0 # in milliseconds, 0 is disabled
#vacuum_freeze_table_age = 150000000
#vacuum_freeze_min_age = 50000000
#vacuum_failsafe_age = 1600000000
#vacuum_multixact_freeze_table_age = 150000000
#vacuum_multixact_freeze_min_age = 5000000
#vacuum_multixact_failsafe_age = 1600000000
#bytea_output = 'hex' # hex, escape
#xmlbinary = 'base64'
#xmloption = 'content'
#gin_pending_list_limit = 4MB
# - Locale and Formatting -
datestyle = 'iso, mdy'
#intervalstyle = 'postgres'
timezone = 'Europe/Berlin'
#timezone_abbreviations = 'Default' # Select the set of available time zone
# abbreviations. Currently, there are
# Default
# Australia (historical usage)
# India
# You can create your own file in
# share/timezonesets/.
#extra_float_digits = 1 # min -15, max 3; any value >0 actually
# selects precise output mode
#client_encoding = sql_ascii # actually, defaults to database
# encoding
# These settings are initialized by initdb, but they can be changed.
lc_messages = 'en_US.UTF-8' # locale for system error message
# strings
lc_monetary = 'en_US.UTF-8' # locale for monetary formatting
lc_numeric = 'en_US.UTF-8' # locale for number formatting
lc_time = 'en_US.UTF-8' # locale for time formatting
# default configuration for text search
default_text_search_config = 'pg_catalog.english'
# - Shared Library Preloading -
#local_preload_libraries = ''
#session_preload_libraries = ''
#shared_preload_libraries = '' # (change requires restart)
#jit_provider = 'llvmjit' # JIT library to use
# - Other Defaults -
#dynamic_library_path = '$libdir'
#extension_destdir = '' # prepend path when loading extensions
# and shared objects (added by Debian)
#gin_fuzzy_search_limit = 0
#------------------------------------------------------------------------------
# LOCK MANAGEMENT
#------------------------------------------------------------------------------
#deadlock_timeout = 1s
#max_locks_per_transaction = 64 # min 10
# (change requires restart)
#max_pred_locks_per_transaction = 64 # min 10
# (change requires restart)
#max_pred_locks_per_relation = -2 # negative values mean
# (max_pred_locks_per_transaction
# / -max_pred_locks_per_relation) - 1
#max_pred_locks_per_page = 2 # min 0
#------------------------------------------------------------------------------
# VERSION AND PLATFORM COMPATIBILITY
#------------------------------------------------------------------------------
# - Previous PostgreSQL Versions -
#array_nulls = on
#backslash_quote = safe_encoding # on, off, or safe_encoding
#escape_string_warning = on
#lo_compat_privileges = off
#quote_all_identifiers = off
#standard_conforming_strings = on
#synchronize_seqscans = on
# - Other Platforms and Clients -
#transform_null_equals = off
#------------------------------------------------------------------------------
# ERROR HANDLING
#------------------------------------------------------------------------------
#exit_on_error = off # terminate session on any error?
#restart_after_crash = on # reinitialize after backend crash?
#data_sync_retry = off # retry or panic on failure to fsync
# data?
# (change requires restart)
#recovery_init_sync_method = fsync # fsync, syncfs (Linux 5.8+)
#------------------------------------------------------------------------------
# CONFIG FILE INCLUDES
#------------------------------------------------------------------------------
# These options allow settings to be loaded from files other than the
# default postgresql.conf. Note that these are directives, not variable
# assignments, so they can usefully be given more than once.
include_dir = 'conf.d' # include files ending in '.conf' from
# a directory, e.g., 'conf.d'
#include_if_exists = '...' # include file only if it exists
#include = '...' # include file
#------------------------------------------------------------------------------
# CUSTOMIZED OPTIONS
#------------------------------------------------------------------------------
# Add settings for extensions here

31
roles/postgresql/vars/main.yml Normal file
View File

@@ -0,0 +1,31 @@
---
pgsql_server_version: 14
pgsql_unix_socket: "/var/run/postgresql" # comma-separated list of directories
pgsql_listen_addresses: "{{ pgsql_server_ip }}" # what IP address(es) to listen on;
pgsql_password_encryption: "scram-sha-256" # scram-sha-256 or md5
pgsql_max_connections: "200" # default 100
pgsql_shared_buffers: "1GB" # min 128kB, default 128MB
pgsql_effective_cache_size: "3GB" # default 4GB
pgsql_maintenance_work_mem: "256MB" # min 1MB, default 64MB
pgsql_checkpoint_completion_target: "0.9" # checkpoint target duration, 0.0 - 1.0, default 0.9
pgsql_wal_buffers: "16MB" # min 32kB, default -1 sets based on shared_buffers
pgsql_default_statistics_target: "100" # range 1-10000, default 100
pgsql_random_page_cost: "1.1" # how long it take to seek to a random disk page, default 4.0
pgsql_effective_io_concurrency: "200" # 1-1000; 0 disables prefetching, default 1
pgsql_work_mem: "5242kB" # min 64kB, default 4MB
pgsql_min_wal_size: "1GB" # default 80MB
pgsql_max_wal_size: "4GB" # default 1GB
pgsql_max_worker_processes: "2" # default 8
pgsql_max_parallel_workers_per_gather: "1" # taken from max_parallel_workers, default 2
pgsql_max_parallel_workers: "2" # maximum number of max_worker_processes that can be used in parallel, default 8
pgsql_max_parallel_maintenance_workers: "1" # taken from max_parallel_workers, default 2
pgsql_exporter_install_dir: "/usr/local/bin"
pgsql_exporter_user: "postgres"
pgsql_client_auth:
- name: nextcloud
db: nextcloud_db
user: nextcloud_db_user
address: "{{ nextcloud_server_ip }}/32"
method: scram-sha-256

3
roles/rclone/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
---
# rclone config file changes while using to force update set this "true"
rclone_config_force: false

121
roles/rclone/files/DTSV_GD_service_account.json Normal file
View File

@@ -0,0 +1,121 @@
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
62646235323433313363376439333961373139613464323833366263656433653761323133656437
3331326266643131386336303465646162303962353339310a653330316264613462623963646536
32303364353236346261303263303965326537663863653436653161383239613165306263653036
6632356336313634330a396433303036323563653838333537373661326333623936306638333932
38616239383462653062643031663361646463343930303265626136393635353835313339313939
62626236373735343530366530613062306463393565613561643632323966663965613034623932
35373438643739383832393333383732393963666136396537316163353135316233636638626666
64343639376665623131343464353266623234666135663864333234366666326563386264373539
31643231313437363135613965396339663762656466396433313335303561383864356533636264
61363330633464353839353264613338306133623565663835636632626636356662643032396466
39663336353738363662313833366530336334646462656432306439396136383762303537343532
33396261353835376163366337393937363761323965356538393561343639363132353762373531
35656532363631353531613231353435663862333366663565663838383536633666653332636262
31643562363337393038636163333265663834306330393830353262386634336135636436323431
62353338326430313662373962333733656434336138376466336534383963346261636233653232
62643165383034386233376263333533666162346531623362313337666362356136313266613937
34373266323034653736666163316135633261303037376632623266366333336635306461636536
34386633636230663663383565623861326665373062636339663566313433633930656161373134
35373464643738346366643338373534373163393962393266393936313433653863303066373530
61303163666162356561623930313636303836383131323230356564306334393161303263333966
36636361323037366539363338666537633134326561656666613764323266363432656235343931
36653566373330643762646435656266663333323336366434393066303839653039643064343862
64366434396564643064316439383438333633623539333338353862663136656539336139343863
64643234353162376237626563663339633332303535303133313064336433623662393762643032
33343062653539306539373437326161343461623331666531343138616331393439613361626561
32653133366633326236636561366433646631656434396365383736616235666539313562653863
64306332393361353831333562356232656432323138623637653731323030613062343830646665
63333937666635393039393337313332663834336330643138383338623336633930653532363862
33663237343939666236663333363765326261616566663765353231643936653036353434613164
31643233626130303864343961663737326432353230336135393230373066613536353833343932
62303631623630356636386163663362613432316531353865653639366339316230396238366635
37636637633032316466663133343664643761303735666365616531643034323365613932633364
36316562366365373231373235303634646566393731326662343136343130306239333534326230
39373764663232343135323366333862336164653439363538316234313365643035636133383561
37336361373961373866353430646337643661303035323837383433633033346134633839623865
65636333666664346436356235333831303336386531653835326439626665666162653262613366
39373262623238326430376163356232343763383762643163383932663934336535316465386132
34363331666563393236613331663463333665363337653162306630666638326565626431636166
38343631343664626135653638323733393562373435633939316563613131636535343833366638
66323363393536363938623634656134356531373835646339373437353432373435636134303835
33376461393835363661373761383463666264353933636231643232633565373636376335623964
34356530323236666538363861333939306362666133323636313636336433636332386130346331
34313862643132386166613765646466303035333136353837393130626330346262313335313362
62373262666137366235363533376366316435653835303334613436613763663732363635656663
37623962373766666338313864623632663166343730386530333266616430366233393138653563
64363438333565646137643065386234333064643036656165666535646239333961396530646163
61353436343134663539663036653863353636353861373836326362643562623030616637376536
63303761313166323336393963343938366632386339366633363061336139333432366431346533
61363934656239396631626530613639646634306436346561616534313738623035323537343330
36366133363235653535656465663531383236653165346130366439356535633435663239313763
35326532616365646163653262393333303535623937636631383665303230626266666562363563
32326164323930396633366539323033656230386263616230323532626366333530386335303166
37653930366262343630326365396262393231633237653138343664633165666531616631653530
66316230396362363565646338383461663765633865666231366265363962623636363932356436
63306564666361346439386161386166633934326631656665363839653665633465653365646238
30323162396433346630383965666436643465333332633962343931393534326539626335343237
36333763656364376164613639663862666263663237623237393232323963396233373930316238
31626530353037386362373637626334616239316534653166366237336263633362626238656664
61613931303036353164623538323432303761303163633635633730663836653333643433393937
63666136356134393764386163646266323863393236646532613533373133663164363937376230
31316433333564666662393563303365376562363932343963333462383139336135356666636238
62653664323238646162633636336539373237613661666330626336626632633139393934653537
65623335313931623439326634393065303736396134386236353134363263353031336331376664
66646139646565323465343332623936613735626663653264633064633564373133353037656263
39656635666232653138663738636661643566326539613364636535323435363139656238333531
64326636656263303733623031643164653733646137396461396338373866383931626637633066
62363530303965383464643536323065373238626232646564363566366463376566303632346137
37363936346130383439663062613236646336653861316462396437383466346363643062323834
36643034336434646331313764376237636464383165326136656363356236333936623834653934
36666561333463663937363231386662646261653365636264336265373264663766626265623330
66346436633235343761663963323533393534363034323135333832353738346435653734333766
32633435666537633961626533636436653766353066633461353561636262643965363432316235
65303536316531653463306432646631353535356335623532643730353030373261343836663066
36353831366231633363396336663666303465303138326537383863616662623637383832636166
66326536633062626135636530386466386235666462343462393966373637653166643539356235
66333531613636373733643831396339376162313335313436303531303264393537326231663865
30383464326230633639366236316265353262306235383734383462353562383433396565373937
30306662346663373464383038626666333761346162343133343262613164316137323162613035
63623335373738356538396537386533306537633237616332643962363632383532376237383332
31393632386333633939363737353531623637346336636135623162303131613538666561343734
30306437656462346238363839303334613366643031356366323133373663393037323236353834
65663239633333383066393332336230333337656239313732633962386437336362383564343963
34303038666132383339373631346666336434333133393432316631363236633734623838643965
66656238303335393630623033366236326435616537303862353464376561373832373663356532
39313236646130646266316633336265396132323730313136386436656263663035646534346364
30626330396432366230386534623839663339376134323639323433383666383035373136613037
65303330636265353135373066656265373539623839323732653832303562643966386232373566
64646161326461356533616366653966633638326431306433393739656463316430383664356163
39643433316136633030333461303362623861396136626433303736326436336539616330613831
64626133303561333263653331323631343861323530353937333538366466333539373937393732
65313231336332396463633364663264346430613964363561396339613230303962643834393731
35656663313335373331396430363062353834636232303165306566633461326533653665636431
38333563636666643930376235656663303638653134666466376533396639343131306633656331
35303566363466363362373138343966346339313963613330336337323831353733386531363263
32343237346332613536353834613163386333313937323739333638336561363431363135393036
32313863323730343765356437366466393262326535356266313734656664346663663635393639
34383739613536613931376637373238323139326533333631653963343131663431663639383733
62316535633337333439363835326435393338313061666335343837353839663133343230326134
65353935656233613634633162313761376363323438346432613630346662313834323964383163
30636339633066643666343532306332343338333135373334306537636665353936363833363964
38396561396463313230656531333632313532623735393935643532663764643533646636313230
61613766366235303639643031623464396138653463333438356134366361613739366235663136
61386362663437663266323762363034396132383935353831336436626432303732393731336265
61343863376237363562353834333862613130373330316333323838396636663631366666653832
31343534316162356662623563373164326239396361623766366139316630333666346237326162
38353631633630333139323661666132643035626263633533343766636330336434326131633438
63303465653531643130393631363432653362393339366536323936666661343639306537383764
38393739366665633332633062383134383263646138346437613964663233636134326431616639
63613464353666306363613437353033646362343134646337323935616330353834666138356263
37656236373833326665633531663537623662343439383263393566643463313437376466303039
39356463633438656166313036383739306166646663363762333333636338646134323234333034
33383834633231346533323333326432643464323063363063383665306133663862343230333135
61366332343464306362643732613635653239306234373665303863326437373962393639616265
32326638636638393335383734346331323932333030306139386138303935346438306631343836
31646432393830303662376466353632646564343361393635373436313231393866363931613161
39636233366465653638356236373232323633636339646162353239323130323437613736346236
62616235633831616561386666626264326434383534356637363335363039646530653839646539
35386136396634636264666536383662363366666530626163623835363935353238306133633666
64633136663634393066623134653738666563363337303039386465393961313637643934393939
38373632646234393430

4
roles/rclone/files/set-rclone-password Normal file
View File

@@ -0,0 +1,4 @@
#!/bin/echo Source this file don't run it
read -s -p "Password: " RCLONE_CONFIG_PASS
export RCLONE_CONFIG_PASS

90
roles/rclone/tasks/main.yml Normal file
View File

@@ -0,0 +1,90 @@
---
# Get latest Rclone version via downloads.rclone.org/version.txt
- name: Check latest stable rclone version
uri:
url: https://downloads.rclone.org/version.txt
return_content: true
delegate_to: localhost
run_once: true
register:
rclone_version
- name: "{{ rclone_version.content }}"
set_fact:
rclone_version: "{{ rclone_version.content | replace ('rclone v', '', 1) | trim }}"
run_once: true
- name: "Install rclone {{ rclone_version }}"
apt:
deb: "https://downloads.rclone.org/v{{ rclone_version }}/rclone-v{{ rclone_version }}-linux-{{ deb_architecture }}.deb"
register: _install_package
until: _install_package is succeeded
retries: 3
delay: 5
- name: Symlink rclone binary to use mount helper
file:
src: "/usr/bin/rclone"
dest: "/sbin/mount.rclone"
state: link
- name: Create rclone config directory
file:
path: "{{ rclone_config_dir }}"
state: directory
mode: 700
- name: Create rclone group
group:
name: "{{ rclone_system_group }}"
state: present
system: true
register: created_rclone_group
when: rclone_system_group != "root"
- name: Create rclone user
user:
name: "{{ rclone_system_user }}"
group: "{{ rclone_system_group }}"
groups: "{{ rclone_system_group }}"
append: true
shell: /usr/sbin/nologin
system: true
create_home: false
home: /
register: created_rclone_user
- name: adding existing user {{ main_user }} to group rclone
user:
name: "{{ main_user }}"
groups: "{{ rclone_system_group }}"
append: true
- name: Create rclone cache/log directory
file:
path: "{{ item }}"
mode: 0755
state: directory
loop:
- "{{ rclone_cache_dir }}"
- "{{ rclone_log_dir }}"
- name: Copy rclone logrotate file
template:
src: logrotate.rclone.j2
dest: /etc/logrotate.d/rclone
mode: 0644
- name: Copy service account files
copy:
src: "{{ item }}"
dest: "{{ rclone_config_dir }}/{{ item }}"
mode: 0600
loop:
- DTSV_GD_service_account.json
- name: Copy config password script
copy:
src: set-rclone-password
dest: ~/set-rclone-password
mode: 0644

10
roles/rclone/templates/logrotate.rclone.j2 Normal file
View File

@@ -0,0 +1,10 @@
## Managed by Ansible ##
{{ rclone_log_dir }}/*.log {
rotate 3
copytruncate
daily
compress
missingok
notifempty
}

51
roles/rclone/vars/main.yml Normal file
View File

@@ -0,0 +1,51 @@
---
rclone_system_group: "rclone"
rclone_system_user: "{{ rclone_system_group }}"
rclone_config_dir: "/root/.config/rclone"
rclone_config_file: "{{ rclone_config_dir }}/rclone.conf"
rclone_cache_dir: "/var/cache/rclone"
rclone_log_dir: "/var/log/rclone"
rclone_user_agent_gd: 'GoogleDriveFS/64.0.4.0 (Windows;OSVer=10.0.22621;)'
vault_gd3_crypt_password: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
37663062636264363661343664303536653930393430353735366135633739333732353937666362
3164313666363530643666303430326334326462393665390a363831326239363032323939613732
30376330313164633131313761343735313333653866623931343762643333666136626137383862
3030666263616663370a636634666565333638353634363463326630306462646137343231656663
39313938373366623461636666393432333663663134396334353931353465393137366665363165
64353236376133396364656561333962636635623832366461303831346338666364353239316634
356138346235666165653061313636346364
vault_gd3_crypt_password2: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
30383339356132613064653366633531663963343665636439343862653965366662353836646633
6634346435313962396365396338633032663937616361370a386531663266353732643561346464
35373664356335313363333265326461653430333236623932646362393439393462616533303063
6431393236303662650a393434346137393564663765376161386234363063313463663066313630
36666336303537663036656463316239346563393365373664323538663864303463346535316331
66383034653464303861393333623833393261646138653531396461313166366132343539383238
386631653433313336636339363839316266
# Rclone Service Account Block
DTSV_GD_service_account_remote: |
[GD3]
type = drive
scope = drive
server_side_across_configs = true
service_account_file = {{ rclone_config_dir }}/DTSV_GD_service_account.json
[GD3_crypt]
type = crypt
remote = GD3:crypt
password = {{ vault_gd3_crypt_password }}
password2 = {{ vault_gd3_crypt_password2 }}
# Rclone Exporter (same password see monitoring role)
vault_rclone_rcd_pass: !vault |
$ANSIBLE_VAULT;1.2;AES256;dtsv-dev
34616137336639363734323532366663626166336638356538663534346530636564333066636337
6636626538653634383063616532393461393036383464620a613765363037306365666236396661
65356565383436383664356338333266353962396239316533303330626335303961383066633066
3032623266653639340a376361376361373235373939623137633630666333383237363138303933
66333735646465306165396536396166616462633766333732323965363566656132

4
roles/redis/defaults/main.yml Normal file
View File

@@ -0,0 +1,4 @@
---
# If port 0 is specified Redis will not listen on a TCP socket.
redis_port: 0

5
roles/redis/handlers/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
- name: restart redis
systemd:
name: redis-server.service
state: restarted

14
roles/redis/tasks/main.yml Normal file
View File

@@ -0,0 +1,14 @@
---
- name: Install Redis
apt:
name: redis
state: present
- name: Copy redis config
template:
src: redis.conf.j2
dest: /etc/redis/redis.conf
owner: redis
group: redis
mode: 0640
notify: restart redis

1055
roles/redis/templates/redis.conf.j2 Normal file
View File

File diff suppressed because it is too large Load Diff

4
roles/redis/vars/main.yml Normal file
View File

@@ -0,0 +1,4 @@
---
redis_unixsocket: "/var/run/redis/redis.sock"
redis_unixsocketperm: 770

2
roles/systemd_exporter/defaults/main.yml Normal file
View File

@@ -0,0 +1,2 @@
---
systemd_exporter_include: '^rclone.*\.service'

7
roles/systemd_exporter/handlers/main.yml Normal file
View File

@@ -0,0 +1,7 @@
---
- name: restart systemd_exporter
systemd:
daemon_reload: true
enabled: true
name: systemd_exporter
state: restarted

52
roles/systemd_exporter/tasks/main.yml Normal file
View File

@@ -0,0 +1,52 @@
---
- name: Get latest systemd_exporter version
github_release:
user: povilasv
repo: systemd_exporter
action: latest_release
token: "{{ vault_github_token }}"
delegate_to: localhost
run_once: true
register: systemd_exporter_version
- name: "{{ systemd_exporter_version }}"
set_fact:
systemd_exporter_version: "{{ systemd_exporter_version | replace ('v', '', 1) | trim }}"
run_once: true
- name: download systemd_exporter {{ systemd_exporter_version.tag }} from GitHub
get_url:
url: "https://github.com/povilasv/systemd_exporter/releases/download/\
v{{ systemd_exporter_version.tag }}/systemd_exporter-{{ systemd_exporter_version.tag }}\
.linux-{{ deb_architecture }}.tar.gz"
dest: "/tmp/systemd_exporter-{{ systemd_exporter_version.tag }}-linux-{{ deb_architecture }}.tar.gz"
register: _download_archive
until: _download_archive is succeeded
retries: 3
delay: 5
- name: unpack systemd_exporter binaries
unarchive:
src: "/tmp/systemd_exporter-{{ systemd_exporter_version.tag }}-linux-{{ deb_architecture }}.tar.gz"
dest: "/tmp"
creates: "/tmp/systemd_exporter-{{ systemd_exporter_version.tag }}.linux-{{ deb_architecture }}"
remote_src: true
- name: Copy systemd_exporter
copy:
src: "/tmp/systemd_exporter-{{ systemd_exporter_version.tag }}.linux-{{ deb_architecture }}/systemd_exporter"
dest: "{{ systemd_exporter_install_dir }}/systemd_exporter"
remote_src: true
owner: "{{ systemd_exporter_system_user }}"
group: "{{ systemd_exporter_system_group }}"
mode: 0755
notify: restart systemd_exporter
- name: Copy the systemd_exporter systemd service file
template:
src: systemd_exporter.service.j2
dest: /etc/systemd/system/systemd_exporter.service
owner: root
group: root
mode: 0644
notify: restart systemd_exporter

16
roles/systemd_exporter/templates/systemd_exporter.service.j2 Normal file
View File

@@ -0,0 +1,16 @@
## Managed by Ansible ##
[Unit]
Description=Prometheus Systemd Exporter
After=network-online.target
[Service]
Type=simple
User={{ systemd_exporter_system_user }}
Group={{ systemd_exporter_system_group }}
ExecStart={{ systemd_exporter_install_dir }}/systemd_exporter --systemd.collector.unit-include="{{ systemd_exporter_include }}"
Restart=always
RestartSec=1
[Install]
WantedBy=multi-user.target

5
roles/systemd_exporter/vars/main.yml Normal file
View File

@@ -0,0 +1,5 @@
---
# Variables
systemd_exporter_install_dir: "/usr/local/bin"
systemd_exporter_system_group: "node-exporter"
systemd_exporter_system_user: "{{ systemd_exporter_system_group }}"

11
roles/webserver/handlers/main.yml Normal file
View File

@@ -0,0 +1,11 @@
---
- name: reload nginx
systemd:
name: nginx.service
state: reloaded
- name: restart nginx
systemd:
name: nginx.service
daemon_reload: true
state: restarted

8
roles/webserver/meta/main.yml Normal file
View File

@@ -0,0 +1,8 @@
---
dependencies:
- role: rclone
- role: nginx
# - role: nginx_exporter
- role: php
# - role: php_fpm_exporter
- role: redis

15
roles/webserver/tasks/main.yml Normal file
View File

@@ -0,0 +1,15 @@
---
- name: Mount Volume
import_tasks: volume.yml
- name: Configure Rclone
import_tasks: rclone.yml
- name: Configure Nginx
import_tasks: nginx.yml
- name: Configure PHP
import_tasks: php.yml
- name: Flush handlers befor continue
meta: flush_handlers

55
roles/webserver/tasks/nginx.yml Normal file
View File

@@ -0,0 +1,55 @@
---
- name: Copy Nginx configs
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: 0644
loop:
- {src: "nginx.conf.j2", dest: "/etc/nginx/nginx.conf"}
- {src: "cert.conf.j2", dest: "/etc/nginx/global/cert.conf"}
- {src: "header.conf.j2", dest: "/etc/nginx/global/header.conf"}
- {src: "proxy.conf.j2", dest: "/etc/nginx/global/proxy.conf"}
- {src: "php_optimization.j2", dest: "/etc/nginx/global/php_optimization"}
notify: reload nginx
- name: Copy virtual server configs
template:
src: "{{ item }}"
dest: /etc/nginx/conf.d/{{ item | basename | regex_replace('\.j2$', '') }}
mode: 0644
with_fileglob: "../templates/conf.d/*.j2"
notify: reload nginx
## Certificates
- name: Create Certificate directory
file:
path: "{{ webserver_nginx_cert_path }}"
state: directory
mode: 0755
- name: Copy SSL certificates for {{ webserver_domain }}
copy:
remote_src: true
# make sure that ssl certs are available
src: "{{ lego_config_dir }}/certificates/{{ webserver_domain }}.{{ item }}"
dest: "{{ webserver_nginx_cert_path }}/{{ webserver_domain }}.{{ item }}"
owner: root
group: root
mode: 0600
loop: [crt, key, issuer.crt]
notify: reload nginx
- name: Create nginx.service.d directory
file:
path: /etc/systemd/system/nginx.service.d
mode: 0755
state: directory
- name: Increase max open files
template:
src: nginx_systemd.conf.j2
dest: /etc/systemd/system/nginx.service.d/nginx.conf
mode: 0644
notify: restart nginx

37
roles/webserver/tasks/php.yml Normal file
View File

@@ -0,0 +1,37 @@
---
- name: Set PHP options for FPM
ini_file:
path: /etc/php/{{ php_version }}/fpm/php.ini
section: "{{ item.section | default('PHP') }}"
option: "{{ item.option }}"
value: "{{ item.value }}"
state: "{{ item.state | default('present') }}"
loop: "{{ php_fpm_ini_options }}"
when: '"fpm" in php_modules'
notify: restart php-fpm
- name: Configure FPM pool
lineinfile:
path: /etc/php/{{ php_version }}/fpm/pool.d/www.conf
regexp: '^{{ item.option }}\s'
line: '{{ item.option }} = {{ item.value }}'
loop: "{{ php_fpm_pool_options }}"
when: '"fpm" in php_modules'
notify: restart php-fpm
- name: Configure FPM environment variables
replace:
path: /etc/php/{{ php_version }}/fpm/pool.d/www.conf
regexp: "^{{ item.regexp }}"
replace: "{{ item.replace }}"
loop:
- {regexp: ";env", replace: "env"}
- {regexp: ";clear_env", replace: "clear_env"}
when: '"fpm" in php_modules'
notify: restart php-fpm
- name: Install imagemagick package
apt:
name: imagemagick
when: '"imagick" in php_modules'

8
roles/webserver/tasks/rclone.yml Normal file
View File

@@ -0,0 +1,8 @@
---
- name: Copy rclone config file
template:
src: "rclone.conf.j2"
dest: "{{ rclone_config_file }}"
mode: 0600
# rclone config file changes while using to force update via ansible use rclone_config_force
force: "{{ rclone_config_force }}"

22
roles/webserver/tasks/volume.yml Normal file
View File

@@ -0,0 +1,22 @@
---
- name: Gather hcloud volume infos
hetzner.hcloud.hcloud_volume_info:
api_token: "{{ vault_hcloud_token }}"
name: "{{ hcloud_webserver_volume_name }}"
delegate_to: localhost
register: web_hcloud_volume
- name: Creates mount directory
file:
path: "{{ hcloud_webserver_volume_path }}"
state: directory
force: false
- name: Mount hcloud volume
ansible.posix.mount:
path: "{{ hcloud_webserver_volume_path }}"
src: "{{ web_hcloud_volume.hcloud_volume_info[0].linux_device }}"
fstype: ext4
opts: discard,nofail,defaults
state: mounted

6
roles/webserver/templates/cert.conf.j2 Normal file
View File

@@ -0,0 +1,6 @@
## Managed by Ansible ##
# Certificates
ssl_certificate {{ webserver_nginx_cert_path }}/{{ webserver_domain }}.crt;
ssl_certificate_key {{ webserver_nginx_cert_path }}/{{ webserver_domain }}.key;
ssl_trusted_certificate {{ webserver_nginx_cert_path }}/{{ webserver_domain }}.issuer.crt;

182
roles/webserver/templates/conf.d/cloud.conf.j2 Normal file
View File

@@ -0,0 +1,182 @@
## Managed by Ansible ##
upstream nextcloud-notify-push {
server unix:{{ nextcloud_notify_push_socket }};
}
# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
"" "";
default "immutable";
}
server {
listen 80;
listen [::]:80;
server_name {{ nextcloud_domain_name }} www.{{ nextcloud_domain_name }};
# enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ nextcloud_domain_name }} www.{{ nextcloud_domain_name }};
include global/cert.conf;
# Path to the root of your installation
root {{ nextcloud_dir }};
# HSTS settings
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
add_header Strict-Transport-Security "max-age=63072000" always;
# set max upload size and increase upload timeout:
client_max_body_size {{ nextcloud_max_upload_size }};
client_body_timeout 300s;
fastcgi_buffers 64 4K;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Pagespeed is not supported by Nextcloud, so if your server is built
# with the `ngx_pagespeed` module, uncomment this line to disable it.
#pagespeed off;
# The settings allows you to optimize the HTTP2 bandwitdth.
# See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
# for tunning hints
client_body_buffer_size 512k;
# HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
# Specify how to handle directories -- specifying `/index.php$request_uri`
# here as the fallback means that Nginx always exhibits the desired behaviour
# when a client requests a path that corresponds to a directory that exists
# on the server. In particular, if that directory contains an index.php file,
# that file is correctly served; if it doesn't, then the request is passed to
# the front-end controller. This consistent behaviour means that we don't need
# to specify custom rules for certain paths (e.g. images and other assets,
# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
# `try_files $uri $uri/ /index.php$request_uri`
# always provides the desired behaviour.
index index.php index.html /index.php$request_uri;
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
location = / {
if ( $http_user_agent ~ ^DavClnt ) {
return 302 /remote.php/webdav/$is_args$args;
}
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Make a regex exception for `/.well-known` so that clients can still
# access it despite the existence of the regex rule
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
# for `/.well-known`.
location ^~ /.well-known {
# The rules in this block are an adaptation of the rules
# in `.htaccess` that concern `/.well-known`.
location = /.well-known/carddav { return 301 /remote.php/dav/; }
location = /.well-known/caldav { return 301 /remote.php/dav/; }
location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
location /.well-known/pki-validation { try_files $uri $uri/ =404; }
# Let Nextcloud's API for `/.well-known` URIs handle all other
# requests by passing them to the front-end controller.
return 301 /index.php$request_uri;
}
# Rules borrowed from `.htaccess` to hide certain paths from clients
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
# which handle static assets (as seen below). If this block is not declared first,
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
# to the URI, resulting in a HTTP 500 error response.
location ~ \.php(?:$|/) {
# Required for legacy support
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on;
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
fastcgi_param front_controller_active true; # Enable pretty urls
fastcgi_pass php-handler;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
fastcgi_max_temp_file_size 0;
}
location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
access_log off; # Optional: Don't log access to assets
location ~ \.wasm$ {
default_type application/wasm;
}
}
location ~ \.woff2?$ {
try_files $uri /index.php$request_uri;
expires 7d; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets
}
# Rule borrowed from `.htaccess`
location /remote {
return 301 /remote.php$request_uri;
}
location /push/ {
proxy_pass http://nextcloud-notify-push/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location / {
try_files $uri $uri/ /index.php$request_uri;
}
}

27
roles/webserver/templates/conf.d/twirling.conf.j2 Normal file
View File

@@ -0,0 +1,27 @@
## Managed by Ansible ##
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name {{ webserver_domain }} www.{{ webserver_domain }};
# enforce https
return 301 https://$server_name$request_uri;
}
server {
# Enable HTTP/2
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name {{ webserver_domain }} www.{{ webserver_domain }};
include global/cert.conf;
include global/header.conf;
add_header Strict-Transport-Security "max-age=63072000" always;
# deny access and return teapot
location / {
deny all;
return 418;
}
}

57
roles/webserver/templates/header.conf.j2 Normal file
View File

@@ -0,0 +1,57 @@
## Managed by Ansible ##
# Add headers to serve security related headers
# Before enabling Strict-Transport-Security headers please read into this
# topic first.
# add_header Strict-Transport-Security "max-age=15768000;
# includeSubDomains; preload;";
#
# WARNING: Only add the preload option once you read about
# the consequences in https://hstspreload.org/. This option
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
# config to don't allow the browser to render the page inside an frame or iframe
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
#add_header X-Frame-Options SAMEORIGIN;
add_header X-Frame-Options "SAMEORIGIN" always;
# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
# to disable content-type sniffing on some browsers.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
#add_header X-Content-Type-Options nosniff;
add_header X-Content-Type-Options "nosniff" always;
# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
# this particular website if it was disabled by the user.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
#add_header X-XSS-Protection "1; mode=block";
add_header X-XSS-Protection "1; mode=block" always;
# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
# you can tell the browser that it can only download content from the domains you explicitly allow
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
# https://www.owasp.org/index.php/Content_Security_Policy
# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
# directives for css and js(if you have inline css or js, you will need to keep it too).
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
#add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src to 'none'; frame-ancestors 'self' https://*.twirling.de https://twirling.de";
#add_header Referrer-Policy no-referrer;
add_header Referrer-Policy "no-referrer" always;
add_header Feature-Policy "accelerometer 'none'; autoplay 'self'; geolocation 'self'; midi 'none'; notifications 'self'; push 'self'; sync-xhr 'self' https://*.twirling.de; microphone 'self'; camera 'self'; magnetometer 'none'; gyroscope 'none'; speaker 'self'; vibrate 'self'; fullscreen 'self'; payment 'none'; usb 'none'";
add_header Permissions-Policy "geolocation=(self);midi=();notifications=(self);push=(self);sync-xhr=(self 'https://*.twirling.de');microphone=(self);camera=(self);magnetometer=();gyroscope=();speaker=(self);vibrate=();fullscreen=(self);payment=()";
# Add Alt-Svc header to negotiate HTTP/3.
#add_header Alt-Svc 'quic=":443"'; # Advertise that QUIC is available
#add_header QUIC-Status $quic; # Sent when QUIC was used

79
roles/webserver/templates/nginx.conf.j2 Normal file
View File

@@ -0,0 +1,79 @@
## Managed by Ansible ##
user {{ webserver_user }};
pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log warn;
# you must set worker processes based on your CPU cores, nginx does not benefit from setting more than that
worker_processes {{ webserver_nginx_worker_processes }};
# number of file descriptors used for nginx
# the limit for the maximum FDs on the server is usually set by the OS.
# if you don't set FD's then OS settings will be used which is by default 2000
worker_rlimit_nofile {{ webserver_nginx_worker_rlimit_nofile }};
# only log critical errors
error_log /var/log/nginx/error.log crit;
# provides the configuration file context in which the directives that affect connection processing are specified.
events {
# determines how much clients will be served per worker
# max clients = worker_connections * worker_processes
# max clients is also limited by the number of socket connections available on the system (~64k)
worker_connections 8192;
# optmized to serve many clients with each thread, essential for linux -- for testing environment
use epoll;
# accept as many connections as possible, may flood worker connections if set too low -- for testing environment
multi_accept on;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'$request_time $upstream_response_time $ssl_protocol '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
aio threads;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
reset_timedout_connection on;
# reduce the data that needs to be sent over network -- for testing environment
gzip on;
# gzip_static on;
gzip_min_length 10240;
gzip_comp_level 1;
gzip_vary on;
gzip_disable msie6;
gzip_proxied expired no-cache no-store private auth;
gzip_types
# text/html is always compressed by HttpGzipModule
text/css
text/javascript
text/xml
text/plain
text/x-component
application/javascript
application/x-javascript
application/json
application/xml
application/rss+xml
application/atom+xml
font/truetype
font/opentype
application/vnd.ms-fontobject
image/svg+xml;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/global/*.conf;
server_tokens off;
}

3
roles/webserver/templates/nginx_systemd.conf.j2 Normal file
View File

@@ -0,0 +1,3 @@
# Raise the nofile/max open files/file descriptors/file handles limit for nginx
[Service]
LimitNOFILE=30000

9
roles/webserver/templates/php_optimization.j2 Normal file
View File

@@ -0,0 +1,9 @@
## Managed by Ansible ##
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
fastcgi_param HTTPS on;
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_intercept_errors on;
fastcgi_request_buffering off;

15
roles/webserver/templates/proxy.conf.j2 Normal file
View File

@@ -0,0 +1,15 @@
## Managed by Ansible ##
proxy_hide_header X-Powered-By;
proxy_set_header Early-Data $ssl_early_data;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Server $host;
proxy_redirect off;
proxy_headers_hash_max_size 1024;
proxy_headers_hash_bucket_size 128;

3
roles/webserver/templates/rclone.conf.j2 Normal file
View File

@@ -0,0 +1,3 @@
## Managed by Ansible ##
{{ DTSV_GD_service_account_remote }}

60
roles/webserver/vars/main.yml Normal file
View File

@@ -0,0 +1,60 @@
---
# Volume
hcloud_webserver_volume_name: "WEB"
hcloud_webserver_volume_path: "/mnt/web"
# Dependency variables
# php_old_version: "8.1"
php_version: "8.1"
php_modules:
- "fpm"
- "common"
- "curl"
- "gd"
- "gmp"
- "intl"
- "mbstring"
- "xml"
- "zip"
- "bz2"
- "bcmath"
- "imagick"
- "smbclient"
- "opcache"
- "apcu"
- "redis"
- "pgsql"
# Main
webserver_user: "www-data"
webserver_group: "www-data"
webserver_domain: "twirling.de"
# Nginx
webserver_nginx_cert_path: "/etc/nginx/ssl/{{ webserver_domain }}"
webserver_nginx_worker_processes: "auto"
webserver_nginx_worker_rlimit_nofile: "100000"
# PHP
php_fpm_ini_options:
- {option: post_max_size, value: 512M}
- {option: upload_max_filesize, value: 512M}
- {option: memory_limit, value: 512M}
- {section: opcache, option: opcache.enable, value: 1}
- {section: opcache, option: opcache.interned_strings_buffer, value: 32}
- {section: opcache, option: opcache.max_accelerated_files, value: 10000}
- {section: opcache, option: opcache.memory_consumption, value: 256}
- {section: opcache, option: opcache.save_comments, value: 1}
- {section: opcache, option: opcache.revalidate_freq, value: 1}
- {section: opcache, option: opcache.validate_timestamps, value: 0}
- {section: redis, option: redis.session.locking_enabled, value: 1}
- {section: redis, option: redis.session.lock_retries, value: -1}
- {section: redis, option: redis.session.lock_wait_time, value: 10000}
php_fpm_pool_options:
- {option: pm, value: dynamic}
- {option: pm.max_children, value: 60}
- {option: pm.start_servers, value: 20}
- {option: pm.min_spare_servers, value: 10}
- {option: pm.max_spare_servers, value: 30}
- {option: pm.max_requests, value: 1000}