fix(nextcloud): sources.list mode 0644 and keep backup

0744 sets an exec bit on a text file; backup preserves the previous
sources list instead of silently overwriting it.

README.md

@@ -1,3 +1,9 @@
 # sertilab-ansible
 
-Playbooks for Ansible
+Playbooks for HomeLab
+
+This Playbooks created for my HomeLab. You can use my playbooks for another tasks.
+
+[Wireguard](roles/homelab/wireguard/) - Create and dynamic create and delete peers.
+
+[NextCloud](roles/homelab/nextcloud/) - Create NextCloud server.

inventory.yml

@@ -4,3 +4,8 @@ main:
       ansible_host: 100.222.6.20
       ansible_user: ansible
       ansible_ssh_private_key_file: ssh/privkey
+
+    nextcloud:
+      ansible_host: 192.168.100.14
+      ansible_user: ansible
+      ansible_ssh_private_key_file: ssh/privkey

playbook.yml

@@ -5,3 +5,10 @@
   become: true
   roles:
     - homelab/wireguard
+
+- name: "Deploy NextCloud"
+  tags: configure, nextcloud
+  hosts: nextcloud
+  become: true
+  roles:
+    - homelab/nextcloud

roles/homelab/nextcloud/README.md

@@ -0,0 +1,10 @@
+# NextCloud
+
+This task for Up NextCloud Service.
+
+For Debian distributions.
+
+default attributes:
+
+1. `nextcloud_version` - Nextcloud version. Use for download for offical web site.
+2. `packages` - Name applications for install via apt.

roles/homelab/nextcloud/defaults/main.yml

@@ -0,0 +1,61 @@
+---
+
+nextcloud_version: "34.0.3"
+
+
+
+packages:
+    - vim
+    - curl
+    - wget
+    - bzip2 
+    - unzip 
+    - iperf3
+    - tcpdump
+    - apache2
+    - libapache2-mod-php8.4
+    - php-apcu
+    - php-bcmath
+    - php-bz2
+    - php-cli
+    - php-common
+    - php-curl
+    - php-dev
+    - php-fpm
+    - php-gd
+    - php-gmp
+    - php-imagick
+    - php-intl
+    - php-json
+    - php-mbstring
+    - php-mysql
+    - php-pear
+    - php-redis
+    - php-soap
+    - php-xml
+    - php-zip
+    - php8.4-apcu
+    - php8.4-bcmath
+    - php8.4-bz2
+    - php8.4-cli
+    - php8.4-common
+    - php8.4-curl
+    - php8.4-dev
+    - php8.4-fpm
+    - php8.4-gd
+    - php8.4-gmp
+    - php8.4-igbinary
+    - php8.4-imagick
+    - php8.4-intl
+    - php8.4-mbstring
+    - php8.4-mysql
+    - php8.4-opcache
+    - php8.4-readline
+    - php8.4-redis
+    - php8.4-soap
+    - php8.4-xml
+    - php8.4-zip
+    - php8.4
+    - php
+    - pkg-php-tools
+    - php-sqlite3

roles/homelab/nextcloud/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+
+- name: "restart nftables"
+  ansible.builtin.service:
+    name: nftables
+    state: restarted
+
+- name: "restart apache2"
+  ansible.builtin.service:
+    name: apache2
+    state: restarted

roles/homelab/nextcloud/tasks/configure_apache2.yml

@@ -0,0 +1,36 @@
+---
+
+- name: "Change document root in default site"
+  ansible.builtin.replace:
+    path: /etc/apache2/sites-available/000-default.conf
+    regexp: 'DocumentRoot /var/www/html'
+    replace: 'DocumentRoot /var/www/nextcloud'
+    backup: yes
+  notify: "restart apache2"
+
+- name: "Configure php - upload_max_filesize"
+  ansible.builtin.replace:
+    path: /etc/php/8.4/apache2/php.ini
+    regexp: "upload_max_filesize = 2M"
+    replace: "upload_max_filesize = 1G"
+    backup: yes
+#  changed_when: "'upload_max_filesize = 1G' in lookup('file', '/etc/php/8.4/apache2/php.ini')"
+  notify: "restart apache2"
+
+- name: "Configure php - memory_limit"
+  ansible.builtin.replace:
+    path: /etc/php/8.4/apache2/php.ini
+    regexp: "memory_limit = 128M"
+    replace: "memory_limit = 1G"
+    backup: yes
+#  changed_when: "'memory_limit = 1G' in lookup('file', '/etc/php/8.4/apache2/php.ini')"
+  notify: "restart apache2"
+
+- name: "Configure php - output_buffering"
+  ansible.builtin.replace:
+    path: /etc/php/8.4/apache2/php.ini
+    regexp: "output_buffering = 4096"
+    replace: "output_buffering = off"
+    backup: yes
+#  changed_when: "'output_buffering = off' in lookup('file', '/etc/php/8.4/apache2/php.ini')"
+  notify: "restart apache2"

roles/homelab/nextcloud/tasks/configure_system.yml

@@ -0,0 +1,10 @@
+---
+
+- name: "Upload nftables config"
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: "restart nftables"

roles/homelab/nextcloud/tasks/download_nextcloud.yml

@@ -0,0 +1,24 @@
+---
+
+- name: "unzip archive"
+  ansible.builtin.unarchive:
+    src: "https://download.nextcloud.com/server/releases/nextcloud-{{ nextcloud_version }}.zip"
+    dest: "/var/www/"
+    owner: www-data
+    group: www-data
+    creates: "/var/www/nextcloud"
+    remote_src: true
+
+- name: "Create nextcloud data directory"
+  ansible.builtin.file:
+    state: directory
+    path: /var/www/nextcloud-data
+    owner: www-data
+    group: www-data
+    mode: '0700'
+
+#- name: "Change path to nextcloud data"
+#  ansible.builtin.replace:
+#    path: /var/www/nextcloud/config/config.php
+#    regexp: "'datadirectory' => '/var/www/nextcloud/data'"
+#    replace: "'datadirectory' => '/var/www/nextcloud-data'"

roles/homelab/nextcloud/tasks/install_packages.yml

@@ -0,0 +1,16 @@
+---
+
+- name: "Change repos"
+  ansible.builtin.template:
+    src: mirror-yandex.ru.j2
+    dest: /etc/apt/sources.list
+    owner: root
+    group: root
+    mode: '0644'
+    backup: yes
+
+- name: "Install packages"
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    update_cache: true
+  register: deps_installed

roles/homelab/nextcloud/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+
+- name: "Install packages"
+  ansible.builtin.include_tasks: install_packages.yml
+
+- name: "Configure system"
+  ansible.builtin.include_tasks: configure_system.yml
+
+- name: "Download NextCloud"
+  ansible.builtin.include_tasks: download_nextcloud.yml
+
+- name: "Configure Apache2"
+  ansible.builtin.include_tasks: configure_apache2.yml

roles/homelab/nextcloud/templates/mirror-yandex.ru.j2

@@ -0,0 +1,8 @@
+deb http://mirror.yandex.ru/debian/ trixie main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian/ trixie main non-free-firmware
+
+deb http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware
+
+deb http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware

roles/homelab/nextcloud/templates/nftables.conf.j2

@@ -0,0 +1,40 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+	set home_net {
+		type ipv4_addr
+		flags interval
+		comment "Home subnet"
+		elements = {100.222.5.0/24}
+	} 
+	set iot_net {
+		type ipv4_addr
+		flags interval
+		comment "iOT subnet"
+		elements = {100.222.6.0/24}
+	} 
+	
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		iif lo accept comment "Accept any localhost trafic"
+		ct state invalid drop comment "Drop invalid connection"
+		fib daddr . iif type != {local, broadcast, multicast} drop
+		ct state { established, related } accept
+
+		#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"
+
+		tcp dport 22 accept comment "Allow ssh connection from home subnet"
+
+		tcp dport 443 accept comment "Wireguard port"
+		tcp dport 80 accept comment "Wireguard port"
+	}
+	chain forward {
+		type filter hook forward priority filter;
+	}
+	chain output {
+		type filter hook output priority filter;
+	}
+}