Add task in playbook.yml

This reverts commit 9a515af34a.

.gitignore

@@ -1,4 +1,3 @@
 # ---> Ansible
 *.retry
 .venv
-ssh

playbook.yml

@@ -5,3 +5,10 @@
   become: true
   roles:
     - homelab/wireguard
+
+- name: "Deploy NextCloud"
+  tags: configure, nextcloud
+  hosts: nextcloud
+  become: true
+  roles:
+    - homelab/nextcloud

roles/homelab/nextcloud/defaults/main.yml

@@ -0,0 +1,61 @@
+---
+
+nextcloud_version: "34.0.3"
+
+
+
+packages:
+    - vim
+    - curl
+    - wget
+    - bzip2 
+    - unzip 
+    - iperf3
+    - tcpdump
+    - apache2
+    - libapache2-mod-php8.4
+    - php-apcu
+    - php-bcmath
+    - php-bz2
+    - php-cli
+    - php-common
+    - php-curl
+    - php-dev
+    - php-fpm
+    - php-gd
+    - php-gmp
+    - php-imagick
+    - php-intl
+    - php-json
+    - php-mbstring
+    - php-mysql
+    - php-pear
+    - php-redis
+    - php-soap
+    - php-xml
+    - php-zip
+    - php8.4-apcu
+    - php8.4-bcmath
+    - php8.4-bz2
+    - php8.4-cli
+    - php8.4-common
+    - php8.4-curl
+    - php8.4-dev
+    - php8.4-fpm
+    - php8.4-gd
+    - php8.4-gmp
+    - php8.4-igbinary
+    - php8.4-imagick
+    - php8.4-intl
+    - php8.4-mbstring
+    - php8.4-mysql
+    - php8.4-opcache
+    - php8.4-readline
+    - php8.4-redis
+    - php8.4-soap
+    - php8.4-xml
+    - php8.4-zip
+    - php8.4
+    - php
+    - pkg-php-tools
+    - php-sqlite3

roles/homelab/nextcloud/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+
+- name: "restart nftables"
+  ansible.builtin.systemd:
+    name: nftables
+    state: restarted
+
+- name: "restart apache2"
+  ansible.builtin.systemd:
+    name: apache2
+    state: restarted

roles/homelab/nextcloud/tasks/configure_apache2.yml

@@ -0,0 +1,36 @@
+---
+
+- name: "Change document root in default site"
+  ansible.builtin.replace:
+    path: /etc/apache2/sites-available/000-default.conf
+    regexp: 'DocumentRoot /var/www/html'
+    replace: 'DocumentRoot /var/www/nextcloud'
+    backup: yes
+  notify: "restart apache2"
+
+- name: "Configure php - upload_max_filesize"
+  ansible.builtin.replace:
+    path: /etc/php/8.4/apache2/php.ini
+    regexp: "upload_max_filesize = 2M"
+    replace: "upload_max_filesize = 1G"
+    backup: yes
+#  changed_when: "'upload_max_filesize = 1G' in lookup('file', '/etc/php/8.4/apache2/php.ini')"
+  notify: "restart apache2"
+
+- name: "Configure php - memory_limit"
+  ansible.builtin.replace:
+    path: /etc/php/8.4/apache2/php.ini
+    regexp: "memory_limit = 128M"
+    replace: "memory_limit = 1G"
+    backup: yes
+#  changed_when: "'memory_limit = 1G' in lookup('file', '/etc/php/8.4/apache2/php.ini')"
+  notify: "restart apache2"
+
+- name: "Configure php - output_buffering"
+  ansible.builtin.replace:
+    path: /etc/php/8.4/apache2/php.ini
+    regexp: "output_buffering = 4096"
+    replace: "output_buffering = off"
+    backup: yes
+#  changed_when: "'output_buffering = off' in lookup('file', '/etc/php/8.4/apache2/php.ini')"
+  notify: "restart apache2"

roles/homelab/nextcloud/tasks/configure_system.yml

@@ -0,0 +1,10 @@
+---
+
+- name: "Upload nftables config"
+  ansible.builtin.template:
+    src: nftables.conf.j2
+    dest: /etc/nftables.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: "restart nftables"

roles/homelab/nextcloud/tasks/download_nextcloud.yml

@@ -0,0 +1,24 @@
+---
+
+- name: "unzip archive"
+  ansible.builtin.unarchive:
+    src: "https://download.nextcloud.com/server/releases/nextcloud-{{ nextcloud_version }}.zip"
+    dest: "/var/www/"
+    owner: www-data
+    group: www-data
+    creates: "/var/www/nextcloud"
+    remote_src: true
+
+- name: "Create nextcloud data directory"
+  ansible.builtin.file:
+    state: directory
+    path: /var/www/nextcloud-data
+    owner: www-data
+    group: www-data
+    mode: '0700'
+
+#- name: "Change path to nextcloud data"
+#  ansible.builtin.replace:
+#    path: /var/www/nextcloud/config/config.php
+#    regexp: "'datadirectory' => '/var/www/nextcloud/data'"
+#    replace: "'datadirectory' => '/var/www/nextcloud-data'"

roles/homelab/nextcloud/tasks/install_packages.yml

@@ -0,0 +1,15 @@
+---
+
+- name: "Change repos"
+  ansible.builtin.template:
+    src: mirror-yandex.ru.j2
+    dest: /etc/apt/sources.list
+    owner: root
+    group: root
+    mode: '0744'
+
+- name: "Install packages"
+  ansible.builtin.apt:
+    name: "{{ packages }}"
+    update_cache: true
+  register: deps_installed

roles/homelab/nextcloud/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+
+- name: "Install packages"
+  ansible.builtin.include_tasks: install_packages.yml
+
+- name: "Configure system"
+  ansible.builtin.include_tasks: configure_system.yml
+
+- name: "Download NextCloud"
+  ansible.builtin.include_tasks: download_nextcloud.yml
+
+- name: "Configure Apache2"
+  ansible.builtin.include_tasks: configure_apache2.yml

roles/homelab/nextcloud/templates/mirror-yandex.ru.j2

@@ -0,0 +1,8 @@
+deb http://mirror.yandex.ru/debian/ trixie main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian/ trixie main non-free-firmware
+
+deb http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian-security trixie-security main non-free-firmware
+
+deb http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware
+#deb-src http://mirror.yandex.ru/debian/ trixie-updates main non-free-firmware

roles/homelab/nextcloud/templates/nftables.conf.j2

@@ -0,0 +1,40 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+	set home_net {
+		type ipv4_addr
+		flags interval
+		comment "Home subnet"
+		elements = {100.222.5.0/24}
+	} 
+	set iot_net {
+		type ipv4_addr
+		flags interval
+		comment "iOT subnet"
+		elements = {100.222.6.0/24}
+	} 
+	
+	chain input {
+		type filter hook input priority filter; policy drop;
+
+		iif lo accept comment "Accept any localhost trafic"
+		ct state invalid drop comment "Drop invalid connection"
+		fib daddr . iif type != {local, broadcast, multicast} drop
+		ct state { established, related } accept
+
+		#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"
+
+		tcp dport 22 accept comment "Allow ssh connection from home subnet"
+
+		tcp dport 443 accept comment "Wireguard port"
+		tcp dport 80 accept comment "Wireguard port"
+	}
+	chain forward {
+		type filter hook forward priority filter;
+	}
+	chain output {
+		type filter hook output priority filter;
+	}
+}

ssh/privkey

@@ -0,0 +1,25 @@
+$ANSIBLE_VAULT;1.1;AES256
+34663861613730363666623830613439663038353262373461313237646461666636623633353961
+6562636133386262373261643339303435333866373937300a396235643662366431363731626464
+31326662646133386361383730333364313061393134363962396632386537613765373866353532
+3634643930666365310a333366656539633263326236343533373533656136613535656464613331
+64643837323165313766353632396230613262616131373338363430363732393261343165653631
+61653266373432383262396430643038323135396164653739373238383562326663326266386461
+61383437633964643133353935393365643637636639626136653563303262356435333863623735
+38616230373762346436613536306663303263613236366137353137396264386161633561336164
+33663537316334343432316236363631393837366131373437373930633665323135633934386365
+62383962353531363439653762383338616232663833613430393866386331303832653433363138
+32653762353732653365353362323335663332363031323933346632333364336136323361363338
+61623131623837613930656332653530646663646266383366383032306337626532666561653435
+65333462303234623236613933316634353636383937336637626631336639643863326237373262
+61393835666431663432383330343431636435336537336162666536333736313433313062323638
+32366638393431663665656334613539363833333363343461313433646134336138396563353930
+64323263313764383936666138613537383064666635333761616265636436623661396464376533
+64643432643632626530383565316166336431613632303939646666323762393265626565663132
+31396139333136643338356436393338633361663262653833623133343437343636346466376164
+38326432656133393866373439646131396637613631626563623937623733326535663234626430
+37613039356339616531623561313334393135343564663063626562326665643534343832326335
+63636539333531316636363165663533306266643066326432333436326532383265363466373430
+64383561396231396638343836326635363230353666386563383339316661326632326662343235
+35353832346562663830316466303233343963346539636662343333613830373131616530343063
+66373036636239303961

ssh/pubkey

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+62373232393163613134613134376666336265666638646361353639313637346531323166323239
+3465393266646433343535316363616466383063663736310a323562613731363862653634373165
+32626164653563666566653533643334313636306333633032643062396634383561646163396232
+6338373266373234340a626466376132653135316134303732663033343838303938313232303133
+32653764363063623464623766343166653965626161653134636164346631356166383962363238
+64393561363763643031383635663566633465366134323865643434376461356462633639363737
+32313130303136366630346337393537343536353130353462373361313438623636653137666435
+66336530326638636331353337643866333135663932393436393762303733323832373465623266
+3161