From 32c6748943872b1745dd6082c9f94c850ccf3171 Mon Sep 17 00:00:00 2001 From: Kurnesay Date: Thu, 3 Sep 2026 10:58:47 +0300 Subject: [PATCH] Add NextCloud task --- roles/homelab/nextcloud/defaults/main.yml | 61 +++++++++++++++++++ roles/homelab/nextcloud/handlers/main.yml | 11 ++++ .../nextcloud/tasks/configure_apache2.yml | 36 +++++++++++ .../nextcloud/tasks/configure_system.yml | 10 +++ .../nextcloud/tasks/download_nextcloud.yml | 24 ++++++++ .../nextcloud/tasks/install_packages.yml | 15 +++++ roles/homelab/nextcloud/tasks/main.yml | 13 ++++ .../nextcloud/templates/mirror-yandex.ru.j2 | 8 +++ .../nextcloud/templates/nftables.conf.j2 | 40 ++++++++++++ 9 files changed, 218 insertions(+) create mode 100644 roles/homelab/nextcloud/defaults/main.yml create mode 100644 roles/homelab/nextcloud/handlers/main.yml create mode 100644 roles/homelab/nextcloud/tasks/configure_apache2.yml create mode 100644 roles/homelab/nextcloud/tasks/configure_system.yml create mode 100644 roles/homelab/nextcloud/tasks/download_nextcloud.yml create mode 100644 roles/homelab/nextcloud/tasks/install_packages.yml create mode 100644 roles/homelab/nextcloud/tasks/main.yml create mode 100644 roles/homelab/nextcloud/templates/mirror-yandex.ru.j2 create mode 100644 roles/homelab/nextcloud/templates/nftables.conf.j2 diff --git a/roles/homelab/nextcloud/defaults/main.yml b/roles/homelab/nextcloud/defaults/main.yml new file mode 100644 index 0000000..eb7acca --- /dev/null +++ b/roles/homelab/nextcloud/defaults/main.yml @@ -0,0 +1,61 @@ +--- + +nextcloud_version: "34.0.3" + + + +packages: + - vim + - curl + - wget + - bzip2 + - unzip + - iperf3 + - tcpdump + - apache2 + - libapache2-mod-php8.4 + - php-apcu + - php-bcmath + - php-bz2 + - php-cli + - php-common + - php-curl + - php-dev + - php-fpm + - php-gd + - php-gmp + - php-imagick + - php-intl + - php-json + - php-mbstring + - php-mysql + - php-pear + - php-redis + - php-soap + - php-xml + - php-zip + - php8.4-apcu + - php8.4-bcmath + - php8.4-bz2 + - php8.4-cli + - php8.4-common + - php8.4-curl + - php8.4-dev + - php8.4-fpm + - php8.4-gd + - php8.4-gmp + - php8.4-igbinary + - php8.4-imagick + - php8.4-intl + - php8.4-mbstring + - php8.4-mysql + - php8.4-opcache + - php8.4-readline + - php8.4-redis + - php8.4-soap + - php8.4-xml + - php8.4-zip + - php8.4 + - php + - pkg-php-tools + - php-sqlite3 \ No newline at end of file diff --git a/roles/homelab/nextcloud/handlers/main.yml b/roles/homelab/nextcloud/handlers/main.yml new file mode 100644 index 0000000..64ad7f6 --- /dev/null +++ b/roles/homelab/nextcloud/handlers/main.yml @@ -0,0 +1,11 @@ +--- + +- name: "restart nftables" + ansible.builtin.systemd: + name: nftables + state: restarted + +- name: "restart apache2" + ansible.builtin.systemd: + name: apache2 + state: restarted diff --git a/roles/homelab/nextcloud/tasks/configure_apache2.yml b/roles/homelab/nextcloud/tasks/configure_apache2.yml new file mode 100644 index 0000000..9918f2b --- /dev/null +++ b/roles/homelab/nextcloud/tasks/configure_apache2.yml @@ -0,0 +1,36 @@ +--- + +- name: "Change document root in default site" + ansible.builtin.replace: + path: /etc/apache2/sites-available/000-default.conf + regexp: 'DocumentRoot /var/www/html' + replace: 'DocumentRoot /var/www/nextcloud' + backup: yes + notify: "restart apache2" + +- name: "Configure php - upload_max_filesize" + ansible.builtin.replace: + path: /etc/php/8.4/apache2/php.ini + regexp: "upload_max_filesize = 2M" + replace: "upload_max_filesize = 1G" + backup: yes +# changed_when: "'upload_max_filesize = 1G' in lookup('file', '/etc/php/8.4/apache2/php.ini')" + notify: "restart apache2" + +- name: "Configure php - memory_limit" + ansible.builtin.replace: + path: /etc/php/8.4/apache2/php.ini + regexp: "memory_limit = 128M" + replace: "memory_limit = 1G" + backup: yes +# changed_when: "'memory_limit = 1G' in lookup('file', '/etc/php/8.4/apache2/php.ini')" + notify: "restart apache2" + +- name: "Configure php - output_buffering" + ansible.builtin.replace: + path: /etc/php/8.4/apache2/php.ini + regexp: "output_buffering = 4096" + replace: "output_buffering = off" + backup: yes +# changed_when: "'output_buffering = off' in lookup('file', '/etc/php/8.4/apache2/php.ini')" + notify: "restart apache2" \ No newline at end of file diff --git a/roles/homelab/nextcloud/tasks/configure_system.yml b/roles/homelab/nextcloud/tasks/configure_system.yml new file mode 100644 index 0000000..f17006f --- /dev/null +++ b/roles/homelab/nextcloud/tasks/configure_system.yml @@ -0,0 +1,10 @@ +--- + +- name: "Upload nftables config" + ansible.builtin.template: + src: nftables.conf.j2 + dest: /etc/nftables.conf + owner: root + group: root + mode: '0644' + notify: "restart nftables" \ No newline at end of file diff --git a/roles/homelab/nextcloud/tasks/download_nextcloud.yml b/roles/homelab/nextcloud/tasks/download_nextcloud.yml new file mode 100644 index 0000000..7d3815a --- /dev/null +++ b/roles/homelab/nextcloud/tasks/download_nextcloud.yml @@ -0,0 +1,24 @@ +--- + +- name: "unzip archive" + ansible.builtin.unarchive: + src: "https://download.nextcloud.com/server/releases/nextcloud-{{ nextcloud_version }}.zip" + dest: "/var/www/" + owner: www-data + group: www-data + creates: "/var/www/nextcloud" + remote_src: true + +- name: "Create nextcloud data directory" + ansible.builtin.file: + state: directory + path: /var/www/nextcloud-data + owner: www-data + group: www-data + mode: '0700' + +#- name: "Change path to nextcloud data" +# ansible.builtin.replace: +# path: /var/www/nextcloud/config/config.php +# regexp: "'datadirectory' => '/var/www/nextcloud/data'" +# replace: "'datadirectory' => '/var/www/nextcloud-data'" \ No newline at end of file diff --git a/roles/homelab/nextcloud/tasks/install_packages.yml b/roles/homelab/nextcloud/tasks/install_packages.yml new file mode 100644 index 0000000..d1e136f --- /dev/null +++ b/roles/homelab/nextcloud/tasks/install_packages.yml @@ -0,0 +1,15 @@ +--- + +- name: "Change repos" + ansible.builtin.template: + src: mirror-yandex.ru.j2 + dest: /etc/apt/sources.list + owner: root + group: root + mode: '0744' + +- name: "Install packages" + ansible.builtin.apt: + name: "{{ packages }}" + update_cache: true + register: deps_installed \ No newline at end of file diff --git a/roles/homelab/nextcloud/tasks/main.yml b/roles/homelab/nextcloud/tasks/main.yml new file mode 100644 index 0000000..816580a --- /dev/null +++ b/roles/homelab/nextcloud/tasks/main.yml @@ -0,0 +1,13 @@ +--- + +- name: "Install packages" + ansible.builtin.include_tasks: install_packages.yml + +- name: "Configure system" + ansible.builtin.include_tasks: configure_system.yml + +- name: "Download NextCloud" + ansible.builtin.include_tasks: download_nextcloud.yml + +- name: "Configure Apache2" + ansible.builtin.include_tasks: configure_apache2.yml \ No newline at end of file diff --git a/roles/homelab/nextcloud/templates/mirror-yandex.ru.j2 b/roles/homelab/nextcloud/templates/mirror-yandex.ru.j2 new file mode 100644 index 0000000..646b499 --- /dev/null +++ b/roles/homelab/nextcloud/templates/mirror-yandex.ru.j2 @@ -0,0 +1,8 @@ +deb http://mirror.yandex.ru/debian/ trixie main non-free-firmware +#deb-src http://mirror.yandex.ru/debian/ trixie main non-free-firmware + +deb http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware +#deb-src http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware + +deb http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware +#deb-src http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware \ No newline at end of file diff --git a/roles/homelab/nextcloud/templates/nftables.conf.j2 b/roles/homelab/nextcloud/templates/nftables.conf.j2 new file mode 100644 index 0000000..822cb87 --- /dev/null +++ b/roles/homelab/nextcloud/templates/nftables.conf.j2 @@ -0,0 +1,40 @@ +#!/usr/sbin/nft -f + +flush ruleset + +table inet filter { + set home_net { + type ipv4_addr + flags interval + comment "Home subnet" + elements = {100.222.5.0/24} + } + set iot_net { + type ipv4_addr + flags interval + comment "iOT subnet" + elements = {100.222.6.0/24} + } + + chain input { + type filter hook input priority filter; policy drop; + + iif lo accept comment "Accept any localhost trafic" + ct state invalid drop comment "Drop invalid connection" + fib daddr . iif type != {local, broadcast, multicast} drop + ct state { established, related } accept + + #meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP" + + tcp dport 22 accept comment "Allow ssh connection from home subnet" + + tcp dport 443 accept comment "Wireguard port" + tcp dport 80 accept comment "Wireguard port" + } + chain forward { + type filter hook forward priority filter; + } + chain output { + type filter hook output priority filter; + } +} \ No newline at end of file