diff --git a/README.md b/README.md index 253fc46..c17ee1c 100644 --- a/README.md +++ b/README.md @@ -17,8 +17,6 @@ TODO Dependencies ------------ -- Collection: community.docker - Example Playbook ---------------- diff --git a/defaults/main.yml b/defaults/main.yml index 6a4693b..a708a3c 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -8,10 +8,6 @@ nextcloud_mariadb_password: nextcloud nextcloud_admin_user: admin nextcloud_admin_password: mynextcloud nextcloud_trusted_domains: localhost -nextcloud_trusted_proxies: [ '172.18.0.0/16' ] -nextcloud_default_phone_region: DE -nextcloud_database_utils: - - nextcloud-mysql-innodb-convert-row-format.sh virtual_host: localhost letsencrypt_host: letsencrypt_email: @@ -28,7 +24,6 @@ nextcloud_overwrite_cli_url: nextcloud_overwrite_host: nextcloud_overwrite_protocol: nextcloud_enable_restic_compose_backup: False -nextcloud_app_list_to_install: [] restic_aws_access_key_id: restic_aws_secret_access_key: restic_repository: diff --git a/files/nextcloud-mysql-innodb-convert-row-format.sh b/files/nextcloud-mysql-innodb-convert-row-format.sh deleted file mode 100755 index e6360c4..0000000 --- a/files/nextcloud-mysql-innodb-convert-row-format.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh - -# Source: https://help.nextcloud.com/t/upgrade-to-nextcloud-hub-10-31-0-0-incorrect-row-format-found-in-your-database/218366/13 - -# # Prompt for database credentials -# read -p "Enter Database Name: " MYSQL_DATABASE -# read -p "Enter Username: " MYSQL_USER -# read -s -p "Enter Password: " MYSQL_PASSWORD -# echo - -mysql -u "$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" -Bse " -SELECT CONCAT('ALTER TABLE \`', TABLE_NAME, '\` ROW_FORMAT=DYNAMIC;') -FROM INFORMATION_SCHEMA.TABLES -WHERE TABLE_SCHEMA = '$MYSQL_DATABASE' -AND ENGINE = 'InnoDB' -" | mysql -u "$MYSQL_USER" -p"$MYSQL_PASSWORD" "$MYSQL_DATABASE" \ No newline at end of file diff --git a/files/nginx.conf b/files/nginx.conf index 31a5023..0f134fa 100644 --- a/files/nginx.conf +++ b/files/nginx.conf @@ -11,10 +11,6 @@ events { http { include /etc/nginx/mime.types; - types { - application/javascript js mjs; - } - default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' @@ -24,17 +20,7 @@ http { access_log /var/log/nginx/access.log main; sendfile on; - send_timeout 3600; - tcp_nopush on; - tcp_nodelay on; - - open_file_cache max=500 inactive=10m; - open_file_cache_errors on; - reset_timedout_connection on; - - set_real_ip_from revproxy; - real_ip_header X-Forwarded-For; - real_ip_recursive on; + #tcp_nopush on; # Prevent nginx HTTP Server Detection server_tokens off; @@ -60,21 +46,7 @@ http { # set max upload size client_max_body_size 512M; - - # Do not limit download file size (default: 1G) - fastcgi_max_temp_file_size 0; - - #fastcgi_buffers 64 4K; - fastcgi_buffers 64 64K; - fastcgi_buffer_size 256k; - fastcgi_busy_buffers_size 3840K; - fastcgi_read_timeout 3600; - fastcgi_send_timeout 3600; - fastcgi_connect_timeout 3600; - fastcgi_cache_key $http_cookie$request_method$host$request_uri; - fastcgi_cache_use_stale error timeout invalid_header http_500; - fastcgi_ignore_headers Cache-Control Expires Set-Cookie; - + fastcgi_buffers 64 4K; # Enable gzip but do not remove ETag headers gzip on; @@ -83,7 +55,6 @@ http { gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; - gzip_disable "MSIE [1-6]\." # Pagespeed is not supported by Nextcloud, so if your server is built # with the `ngx_pagespeed` module, uncomment this line to disable it. @@ -171,11 +142,6 @@ http { fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice fastcgi_param front_controller_active true; # Enable pretty urls - - fastcgi_cache_valid 404 1m; - fastcgi_cache_valid any 1h; - fastcgi_cache_methods GET HEAD; - fastcgi_pass php-handler; fastcgi_intercept_errors on; diff --git a/meta/main.yml b/meta/main.yml index 9461006..a52e2b3 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -49,6 +49,7 @@ galaxy_info: dependencies: - geerlingguy.pip + - geerlingguy.docker # List your role dependencies here, one per line. Be sure to remove the '[]' above, # if you add dependencies to this list. \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml index 2fc162d..572fe16 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -15,25 +15,6 @@ group: "{{ docker_user }}" mode: '0644' -- name: Ensure database utils scripts directory exists - file: - path: /home/{{ docker_user }}/nextcloud/utils - state: directory - owner: '{{ docker_user }}' - group: '{{ docker_user }}' - -- name: Provide database utils scripts - copy: - src: "{{ item }}" - dest: /home/{{ docker_user }}/nextcloud/utils/ - owner: "{{ docker_user }}" - group: "{{ docker_user }}" - mode: '0644' - loop: "{{ nextcloud_database_utils }}" - when: - - nextcloud_database_utils is defined - - nextcloud_database_utils | length > 0 - - name: Provide docker-compose.yml template: src: templates/docker-compose.nextcloud.yml.j2 @@ -120,16 +101,15 @@ CRON_SCHEDULE="{{ restic_cron_schedule }}" when: nextcloud_enable_restic_compose_backup == true -- name: "docker-compose: Teardown existing Nextcloud service (will keep your volumes)" +- name: "docker-compose: Teardown existing Nextcloud service" docker_compose: project_src: "/home/{{ docker_user }}/nextcloud/" state: absent - tags: ['teardown'] + tags: ['never', 'teardown'] - name: "docker-compose: Start Nextcloud service" docker_compose: project_src: "/home/{{ docker_user }}/nextcloud/" - pull: true register: output tags: service_start @@ -151,114 +131,25 @@ host: "{{ nextcloud_ip }}" port: 80 -- name: "docker-compose: Enable maintenance mode using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ maintenance:mode --on' - - name: "docker-compose: Set overwriteprotocol using occ" shell: chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"' + cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"' - name: "docker-compose: Set overwrite.cli.url using occ" shell: chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"' + cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"' - name: "docker-compose: Set overwritehost using occ" shell: chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"' - -- name: "docker-compose: Set trusted_proxies using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set trusted_proxies {{ idx }} --value="{{ item }}"' - loop: "{{ nextcloud_trusted_proxies }}" - loop_control: - index_var: idx + cmd: docker-compose exec -u www-data nextcloud-app /bin/sh -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"' - name: "docker-compose: Fix ownership of /var/www/html" shell: chdir: /home/{{ docker_user }}/nextcloud/ - cmd: "docker-compose exec -T --user root nextcloud-app /bin/sh -c 'chown -R www-data: /var/www/html'" - -- name: "docker-compose: Install Nextcloud apps (will not fail)" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ app:install "{{ item }}"' - loop: "{{ nextcloud_app_list_to_install }}" - when: nextcloud_app_list_to_install | count - failed_when: false - register: nextcloud_app_install_result - -- name: "Output app install result" - debug: - var: "{{ nextcloud_app_install_result }}" - -- name: "docker-compose: Set default_phone_region using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set default_phone_region --value="{{ nextcloud_default_phone_region }}"' - -- name: "docker-compose: Set maintenance_window_start to 1 using occ (This will run maintenance tasks between 01:00-05:00 UTC)" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ config:system:set maintenance_window_start --value=1 --type=integer' - -- name: "docker-compose: Update all apps using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ app:update --all' - -- name: "docker-compose: Add missing indices using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ db:add-missing-indices' - -- name: "docker-compose: Run maintenance:repair --include-expensive using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ maintenance:repair --include-expensive' - -- name: "docker-compose: Run database utils" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T mysqldb /bin/sh '/opt/utils/{{ item }}' - loop: "{{ nextcloud_database_utils }}" - when: - - nextcloud_database_utils is defined - - nextcloud_database_utils | length > 0 - -- name: Run background jobs - tags: ['never', 'run_background_jobs'] - block: - - name: Get list of background jobs - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ background-job:list --output=json' - register: background_jobs - - - name: Output background jobs - debug: - msg: "{{ background_jobs.stdout }}" - - - name: Run background jobs - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ background-job:execute --force-execute {{ item.id }}' - loop: "{{ background_jobs.stdout }}" - register: background_jobs_execution_result - - - name: Output background jobs execution result - debug: - msg: "{{ background_jobs_execution_result }}" - -- name: "docker-compose: Disable maintenance mode using occ" - shell: - chdir: /home/{{ docker_user }}/nextcloud/ - cmd: docker-compose exec -T -u www-data nextcloud-app /bin/sh -c './occ maintenance:mode --off' + cmd: "docker-compose exec --user root nextcloud-app /bin/sh -c 'chown -R www-data: /var/www/html'" - name: "Test whether Nextcloud is healthy from the outside" when: not ansible_check_mode diff --git a/templates/docker-compose.nextcloud.yml.j2 b/templates/docker-compose.nextcloud.yml.j2 index fc48522..156b020 100644 --- a/templates/docker-compose.nextcloud.yml.j2 +++ b/templates/docker-compose.nextcloud.yml.j2 @@ -12,7 +12,6 @@ services: volumes: - mysqldb:/var/lib/mysql - /etc/localtime:/etc/localtime:ro - - ./utils/:/opt/utils:ro env_file: - db.env {% if nextcloud_enable_restic_compose_backup %} @@ -22,8 +21,7 @@ services: restart: unless-stopped nextcloud-app: - image: nextcloud:31-fpm-alpine - restart: unless-stopped + image: nextcloud:27-fpm-alpine container_name: nextcloud-app depends_on: - mysqldb @@ -44,7 +42,7 @@ services: web: image: nginx - restart: unless-stopped + restart: always depends_on: - nextcloud-app volumes: @@ -72,7 +70,6 @@ services: - "traefik.http.middlewares.nextcloud-headers.headers.STSIncludeSubdomains=true" - "traefik.http.middlewares.nextcloud-headers.headers.STSPreload=true" - "traefik.http.middlewares.nextcloud-headers.headers.featurePolicy=payment 'none'" - - "traefik.http.middlewares.nextcloud-headers.headers.referrerPolicy=no-referrer" - "traefik.http.middlewares.nextcloud.headers.customFrameOptionsValue=SAMEORIGIN" #- "traefik.http.middlewares.nextcloud-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content" - "traefik.http.routers.nextcloud.middlewares=nextcloud-rep,nextcloud-headers"