Fixed file permissions and multitenancy feature (manually tested).

defaults/main.yml

@@ -1,35 +1,39 @@
 ---
 # defaults file for nextcloud
-mariadb_root_password: changeme
+nextcloud_install_user: '{{ ansible_user }}' # This user must be present on the host
-mysql_host: mysqldb
+nextcloud_install_path: '/home/{{ nextcloud_install_user }}'
-mysql_database: nextcloud
+nextcloud_multitenant_label: 
+nextcloud_mariadb_root_password: changeme
+nextcloud_mysql_host: mysqldb
+nextcloud_mysql_database: nextcloud
 nextcloud_mariadb_user: nextcloud
 nextcloud_mariadb_password: nextcloud
 nextcloud_admin_user: admin
 nextcloud_admin_password: mynextcloud
-nextcloud_trusted_domains: localhost
+nextcloud_virtual_host: localhost
-virtual_host: localhost
+nextcloud_trusted_domains: "localhost {{ ansible_host }} {{ nextcloud_virtual_host }}"
-letsencrypt_host:
+nextcloud_letsencrypt_host:
-letsencrypt_email:
+nextcloud_letsencrypt_email:
-docker_user: deploy
+nextcloud_smtp_host:
-smtp_host:
+nextcloud_smtp_secure:
-smtp_secure:
+nextcloud_smtp_port: 25
-smtp_port: 25
+nextcloud_smtp_authtype: PLAIN
-smtp_authtype: PLAIN
+nextcloud_smtp_name:
-smtp_name:
+nextcloud_smtp_password:
-smtp_password:
+nextcloud_mail_from_address:
-mail_from_address:
+nextcloud_mail_domain:
-mail_domain:
 nextcloud_overwrite_cli_url:
 nextcloud_overwrite_host:
 nextcloud_overwrite_protocol:
 nextcloud_enable_restic_compose_backup: False
-restic_aws_access_key_id:
+nextcloud_restic_aws_access_key_id:
-restic_aws_secret_access_key:
+nextcloud_restic_aws_secret_access_key:
-restic_repository:
+nextcloud_restic_repository:
-restic_password:
+nextcloud_restic_password:
-restic_keep_daily: 7
+nextcloud_restic_keep_daily: 7
-restic_keep_weekly: 4
+nextcloud_restic_keep_weekly: 4
-restic_keep_monthly: 12
+nextcloud_restic_keep_monthly: 12
-restic_keep_yearly: 3
+nextcloud_restic_keep_yearly: 3
-restic_cron_schedule: "0 1 * * *"
+nextcloud_restic_cron_schedule: "0 1 * * *"
+# Internal variables
+nextcloud_multitenant_postfix: "{{ '_' + nextcloud_multitenant_label if (nextcloud_multitenant_label) else '' }}"

tasks/main.yml

@@ -2,95 +2,72 @@
 # tasks file for nextcloud
 - name: Ensure nextcloud config directory exists
   file:
-    path: /home/{{ docker_user }}/nextcloud
+    path: "{{ nextcloud_install_path }}/nextcloud"
     state: directory
-    owner: '{{ docker_user }}'
+    owner: '{{ nextcloud_install_user }}'
-    group: '{{ docker_user }}'
+    group: '{{ nextcloud_install_user }}'
 
 - name: Provide docker-compose.yml
   template:
     src: templates/docker-compose.nextcloud.yml.j2
-    dest: /home/{{ docker_user }}/nextcloud/docker-compose.yml
+    dest: "{{ nextcloud_install_path }}/nextcloud/docker-compose.yml"
-    owner: "{{ docker_user }}"
+    owner: "{{ nextcloud_install_user }}"
-    group: "{{ docker_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0644'
 
 - name: Output docker-compose.yml
-  shell: cat /home/{{ docker_user }}/nextcloud/docker-compose.yml
+  shell: cat {{ nextcloud_install_path }}/nextcloud/docker-compose.yml
   register: output
 
 - debug:
     var: output
 
-- name: Provide database env vars
+- name: Provide compose project env vars
-  copy:
+  template:
-    dest: /home/{{ docker_user }}/nextcloud/db.env
+    src: templates/env.j2
-    owner: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/.env"
-    group: "{{ docker_user }}"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0640'
-    content: |
+  tags: config
-      # See https://github.com/docker-library/mariadb/issues/262
+
-      MYSQL_INITDB_SKIP_TZINFO=1
+- name: Provide database env vars
-      MYSQL_ROOT_PASSWORD={{ mariadb_root_password }}
+  template:
-      MYSQL_DATABASE={{ mysql_database }}
+    src: templates/db.env.j2
-      MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
+    dest: "{{ nextcloud_install_path }}/nextcloud/db.env"
-      MYSQL_USER={{ nextcloud_mariadb_user }}
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
+    mode: '0640'
+  tags: config
 
 - name: Provide Nextcloud env vars
-  copy:
+  template:
-    dest: /home/{{ docker_user }}/nextcloud/nextcloud.env
+    src: templates/nextcloud.env.j2
-    owner: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/nextcloud.env"
-    group: "{{ docker_user }}"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0640'
-    content: |
+  tags: config
-      VIRTUAL_HOST={{ virtual_host }}
-      LETSENCRYPT_HOST={{ letsencrypt_host }}
-      LETSENCRYPT_EMAIL={{ letsencrypt_email }}
-      MYSQL_HOST={{ mysql_host }}
-      MYSQL_DATABASE={{ mysql_database }}
-      MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
-      MYSQL_USER={{ nextcloud_mariadb_user }}
-      NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
-      NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
-      NEXTCLOUD_TRUSTED_DOMAINS={{ nextcloud_trusted_domains }}
-      SMTP_HOST={{ smtp_host }}
-      SMTP_SECURE={{ smtp_secure }}
-      SMTP_PORT={{ smtp_port }}
-      SMTP_AUTHTYPE={{ smtp_authtype }}
-      SMTP_NAME={{ smtp_name }}
-      SMTP_PASSWORD={{ smtp_password }}
-      MAIL_FROM_ADDRESS={{ mail_from_address }}
-      MAIL_DOMAIN={{ mail_domain }}
 
 - name: Provide restic-compose-backup env vars
-  copy:
+  template:
-    dest: /home/{{ docker_user }}/nextcloud/restic-compose-backup.env
+    src: templates/restic-compose-backup.env.j2
-    owner: "{{ docker_user }}"
+    dest: "{{ nextcloud_install_path }}/nextcloud/restic-compose-backup.env"
-    group: "{{ docker_user }}"
+    owner: "{{ nextcloud_install_user }}"
+    group: "{{ nextcloud_install_user }}"
     mode: '0640'
-    content: |
+  tags: config
-      AWS_ACCESS_KEY_ID={{ restic_aws_access_key_id }}
-      AWS_SECRET_ACCESS_KEY={{ restic_aws_secret_access_key }}
-      RESTIC_REPOSITORY={{ restic_repository }}
-      RESTIC_PASSWORD={{ restic_password }}
-      # snapshot prune rules
-      RESTIC_KEEP_DAILY={{ restic_keep_daily}}
-      RESTIC_KEEP_WEEKLY={{ restic_keep_weekly }}
-      RESTIC_KEEP_MONTHLY={{ restic_keep_monthly }}
-      RESTIC_KEEP_YEARLY={{ restic_keep_yearly }}
-      # Cron schedule. Run every day at 1am
-      CRON_SCHEDULE="{{ restic_cron_schedule }}"
   when: nextcloud_enable_restic_compose_backup == true
 
 - name: "docker-compose: Teardown existing Nextcloud service"
   docker_compose:
-    project_src: "/home/{{ docker_user }}/nextcloud/"
+    project_src: "{{ nextcloud_install_path }}/nextcloud/"
     state: absent
   tags: ['never', 'teardown']
 
 - name: "docker-compose: Start Nextcloud service"
   docker_compose:
-    project_src: "/home/{{ docker_user }}/nextcloud/"
+    project_src: "{{ nextcloud_install_path }}/nextcloud/"
   register: output
   tags: service_start
 
@@ -99,11 +76,11 @@
 
 - assert:
     that:
-      - "output.ansible_facts['nextcloud-app']['nextcloud-app'].state.running"
+      - "output.ansible_facts['nextcloud-app']['nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1'].state.running"
 
-- name: Get container IP
+- name: "Get container IP"
   set_fact:
-    nextcloud_ip: "{{ output.ansible_facts['nextcloud-app']['nextcloud-app'].networks.nextcloud_default.IPAddress }}"
+    nextcloud_ip: "{{ output.ansible_facts['nextcloud-app']['nextcloud' + nextcloud_multitenant_postfix + '_nextcloud-app_1'].networks['nextcloud' + nextcloud_multitenant_postfix + '_default'].IPAddress }}"
 
 - name: "Waiting for Nextcloud container to become available"
   become: false
@@ -113,18 +90,18 @@
 
 - name: "docker-compose: Set overwriteprotocol using occ"
   shell:
-    chdir: /home/{{ docker_user }}/nextcloud/
+    chdir: "{{ nextcloud_install_path }}/nextcloud/"
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1 /bin/bash -c './occ config:system:set overwriteprotocol --value="{{ nextcloud_overwrite_protocol }}"'
 
 - name: "docker-compose: Set overwrite.cli.url using occ"
   shell:
-    chdir: /home/{{ docker_user }}/nextcloud/
+    chdir: "{{ nextcloud_install_path }}/nextcloud/"
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1 /bin/bash -c './occ config:system:set overwrite.cli.url --value="{{ nextcloud_overwrite_cli_url }}"'
 
 - name: "docker-compose: Set overwritehost using occ"
   shell:
-    cmd: docker-compose exec -T -u www-data nextcloud-app /bin/bash -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
+    cmd: docker-compose exec -T -u www-data nextcloud{{ nextcloud_multitenant_postfix }}_nextcloud-app_1 /bin/bash -c './occ config:system:set overwritehost --value="{{ nextcloud_overwrite_host }}"'
-    chdir: /home/{{ docker_user }}/nextcloud/
+    chdir: "{{ nextcloud_install_path }}/nextcloud/"
 
 - name: "Test whether Nextcloud is healthy from the outside"
   when: not ansible_check_mode

templates/db.env.j2

@@ -0,0 +1,6 @@
+# See https://github.com/docker-library/mariadb/issues/262
+MYSQL_INITDB_SKIP_TZINFO=1
+MYSQL_ROOT_PASSWORD={{ nextcloud_mariadb_root_password }}
+MYSQL_DATABASE={{ nextcloud_mysql_database }}
+MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
+MYSQL_USER={{ nextcloud_mariadb_user }}

templates/docker-compose.nextcloud.yml.j2

@@ -10,7 +10,7 @@ services:
     image: mariadb:10.4.11
     command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
     volumes:
-      - mysqldb:/var/lib/mysql
+      - mysqldb{{ nextcloud_multitenant_postfix }}:/var/lib/mysql
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - db.env
@@ -22,38 +22,37 @@ services:
 
   nextcloud-app:
     image: nextcloud:apache
-    container_name: nextcloud-app
     networks:
       - public
       - default
     depends_on:
       - mysqldb
     volumes:
-      - nextcloud:/var/www/html
+      - nextcloud{{ nextcloud_multitenant_postfix }}:/var/www/html
       - /etc/localtime:/etc/localtime:ro
     env_file:
       - nextcloud.env
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik_public"
-      - "traefik.http.routers.nextcloud.rule=Host(`{{ nextcloud_virtual_host }}`)"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.rule=Host(`{{ nextcloud_virtual_host }}`)"
-      - "traefik.http.routers.nextcloud.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.entrypoints=websecure"
-      - "traefik.http.routers.nextcloud.tls=true"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.tls=true"
-      - "traefik.http.routers.nextcloud.tls.certresolver=defaultresolver"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.tls.certresolver=defaultresolver"
-      - "traefik.http.middlewares.nextcloud-rep.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-rep.redirectregex.regex=https://(.*)/.well-known/(card|cal)dav"
-      - "traefik.http.middlewares.nextcloud-rep.redirectregex.replacement=https://$$1/remote.php/dav/"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-rep.redirectregex.replacement=https://$$1/remote.php/dav/"
-      - "traefik.http.middlewares.nextcloud-rep.redirectregex.permanent=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-rep.redirectregex.permanent=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.SSLRedirect=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.SSLRedirect=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.browserXSSFilter=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.browserXSSFilter=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.contentTypeNosniff=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.contentTypeNosniff=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.forceSTSHeader=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.forceSTSHeader=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.STSSeconds=315360000"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.STSSeconds=315360000"
-      - "traefik.http.middlewares.nextcloud-headers.headers.STSIncludeSubdomains=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.STSIncludeSubdomains=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.STSPreload=true"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.STSPreload=true"
-      - "traefik.http.middlewares.nextcloud-headers.headers.featurePolicy=payment 'none'"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.featurePolicy=payment 'none'"
-      - "traefik.http.middlewares.nextcloud.headers.customFrameOptionsValue=SAMEORIGIN"
+      - "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}.headers.customFrameOptionsValue=SAMEORIGIN"
-      #- "traefik.http.middlewares.nextcloud-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content"
+      #- "traefik.http.middlewares.nextcloud{{ nextcloud_multitenant_postfix }}-headers.headers.contentSecurityPolicy=default-src 'self'; img-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content"
-      - "traefik.http.routers.nextcloud.middlewares=nextcloud-rep,nextcloud-headers"
+      - "traefik.http.routers.nextcloud{{ nextcloud_multitenant_postfix }}.middlewares=nextcloud{{ nextcloud_multitenant_postfix }}-rep,nextcloud{{ nextcloud_multitenant_postfix }}-headers"
 {% if nextcloud_enable_restic_compose_backup %}
       - "restic-compose-backup.volumes=true"
       - "restic-compose-backup.volumes.include=nextcloud"
@@ -70,12 +69,12 @@ services:
       # We need to communicate with docker
       - /var/run/docker.sock:/tmp/docker.sock:ro
       # Persistent storage of restic cache (greatly speeds up all restic operations)
-      - backup-cache:/cache
+      - backup-cache{{ nextcloud_multitenant_postfix }}:/cache
 {% endif %}
 
 volumes:
-  mysqldb:
+  mysqldb{{ nextcloud_multitenant_postfix }}:
-  nextcloud:
+  nextcloud{{ nextcloud_multitenant_postfix }}:
 {% if nextcloud_enable_restic_compose_backup %}
-  backup-cache:
+  backup-cache{{ nextcloud_multitenant_postfix }}:
 {% endif %}

templates/env.j2

@@ -0,0 +1,5 @@
+#
+# Docker Compose configuration
+#
+# Project name for this Docker Compose setup
+COMPOSE_PROJECT_NAME=nextcloud{{ nextcloud_multitenant_postfix }}

templates/nextcloud.env.j2

@@ -0,0 +1,21 @@
+# See https://github.com/nextcloud/docker/ for available env vars
+VIRTUAL_HOST={{ nextcloud_virtual_host }}
+LETSENCRYPT_HOST={{ nextcloud_letsencrypt_host }}
+LETSENCRYPT_EMAIL={{ nextcloud_letsencrypt_email }}
+MYSQL_HOST={{ nextcloud_mysql_host }}
+MYSQL_DATABASE={{ nextcloud_mysql_database }}
+MYSQL_PASSWORD={{ nextcloud_mariadb_password }}
+MYSQL_USER={{ nextcloud_mariadb_user }}
+NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
+NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
+NEXTCLOUD_TRUSTED_DOMAINS={{ nextcloud_trusted_domains }}
+OVERWRITEPROTOCOL=https
+OVERWRITECLIURL=https://{{ nextcloud_virtual_host }}
+SMTP_HOST={{ nextcloud_smtp_host }}
+SMTP_SECURE={{ nextcloud_smtp_secure }}
+SMTP_PORT={{ nextcloud_smtp_port }}
+SMTP_AUTHTYPE={{ nextcloud_smtp_authtype }}
+SMTP_NAME={{ nextcloud_smtp_name }}
+SMTP_PASSWORD={{ nextcloud_smtp_password }}
+MAIL_FROM_ADDRESS={{ nextcloud_mail_from_address }}
+MAIL_DOMAIN={{ nextcloud_mail_domain }}

templates/restic-compose-backup.env.j2

@@ -0,0 +1,11 @@
+AWS_ACCESS_KEY_ID={{ nextcloud_restic_aws_access_key_id }}
+AWS_SECRET_ACCESS_KEY={{ nextcloud_restic_aws_secret_access_key }}
+RESTIC_REPOSITORY={{ nextcloud_restic_repository }}
+RESTIC_PASSWORD={{ nextcloud_restic_password }}
+# snapshot prune rules
+RESTIC_KEEP_DAILY={{ nextcloud_restic_keep_daily}}
+RESTIC_KEEP_WEEKLY={{ nextcloud_restic_keep_weekly }}
+RESTIC_KEEP_MONTHLY={{ nextcloud_restic_keep_monthly }}
+RESTIC_KEEP_YEARLY={{ nextcloud_restic_keep_yearly }}
+# Cron schedule. Run every day at 1am
+CRON_SCHEDULE="{{ nextcloud_restic_cron_schedule }}"