From 28be7d1218d6287759935a0df06f92fe6eb83ce9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= <jlecour@evolix.fr>
Date: Thu, 29 Mar 2018 08:35:26 +0200
Subject: [PATCH] nextcloud: intall one instance at a time

* introduce many variable with sensible defaults
* generate an admin password if none is provided (default)
* execute occ commands as unprivileged user
---
 nextcloud/defaults/main.yml         | 18 +++++-
 nextcloud/tasks/archive.yml         | 32 +++++++---
 nextcloud/tasks/config.yml          | 95 ++++++++++++++++++-----------
 nextcloud/tasks/main.yml            |  4 ++
 nextcloud/tasks/mysql.yml           | 71 +++++++--------------
 nextcloud/tasks/user.yml            | 25 ++++----
 nextcloud/tasks/vhost.yml           | 20 ++----
 nextcloud/templates/nginx.conf.j2   | 12 ++--
 nextcloud/templates/php-fpm.conf.j2 | 22 ++++---
 9 files changed, 161 insertions(+), 138 deletions(-)

diff --git a/nextcloud/defaults/main.yml b/nextcloud/defaults/main.yml
index d2ca6983..69c4fe11 100644
--- a/nextcloud/defaults/main.yml
+++ b/nextcloud/defaults/main.yml
@@ -1,5 +1,19 @@
 ---
 nextcloud_webserver: 'nginx'
-nextcloud_root: '/home'
 nextcloud_version: "13.0.1"
-nextcloud_instances: {}
+nextcloud_archive_name: "nextcloud-{{ nextcloud_version }}.tar.bz2"
+nextcloud_releases_baseurl: "https://download.nextcloud.com/server/releases/"
+
+nextcloud_instance_name: "nextcloud"
+nextcloud_user: "{{ nextcloud_instance_name }}"
+nextcloud_domains: []
+
+nextcloud_home: "/home/{{ nextcloud_user }}"
+nextcloud_webroot: "{{ nextcloud_home }}/nextcloud"
+nextcloud_data: "{{ nextcloud_webroot }}/data"
+
+nextcloud_db_user: "{{ nextcloud_user }}"
+nextcloud_db_name: "{{ nextcloud_instance_name }}"
+
+nextcloud_admin_login: "admin"
+nextcloud_admin_password: ""
diff --git a/nextcloud/tasks/archive.yml b/nextcloud/tasks/archive.yml
index 8340654c..d59bd582 100644
--- a/nextcloud/tasks/archive.yml
+++ b/nextcloud/tasks/archive.yml
@@ -1,25 +1,37 @@
 ---
+
 - name: Retrieve Nextcloud archive
   get_url:
-    url: "https://download.nextcloud.com/server/releases/nextcloud-{{ item.value.version | default(nextcloud_version) }}.tar.bz2"
-    dest: "/home/nextcloud-{{ item.value.version | default(nextcloud_version) }}.tar.bz2"
-  with_dict: "{{ nextcloud_instances }}"
+    url: "{{ nextcloud_releases_baseurl }}{{ nextcloud_archive_name }}"
+    dest: "{{ nextcloud_home }}/{{ nextcloud_archive_name }}"
+    force: no
   tags:
     - nextcloud
 
 - name: Retrieve Nextcloud sha256 checksum
   get_url:
-    url: "https://download.nextcloud.com/server/releases/nextcloud-{{ item.value.version | default(nextcloud_version) }}.tar.bz2.sha256"
-    dest: "/home/nextcloud-{{ item.value.version | default(nextcloud_version) }}.tar.bz2.sha256"
-  with_dict: "{{ nextcloud_instances }}"
+    url: "{{ nextcloud_releases_baseurl }}{{ nextcloud_archive_name }}.sha256"
+    dest: "{{ nextcloud_home }}/{{ nextcloud_archive_name }}.sha256"
+    force: no
   tags:
     - nextcloud
 
 - name: Verify Nextcloud sha256 checksum
-  command: "sha256sum -c nextcloud-{{ item.value.version | default(nextcloud_version) }}.tar.bz2.sha256"
-  changed_when: False
+  command: "sha256sum -c {{ nextcloud_archive_name }}.sha256"
+  changed_when: "False"
   args:
-    chdir: "/home/"
-  with_dict: "{{ nextcloud_instances }}"
+    chdir: "{{ nextcloud_home }}"
+  tags:
+    - nextcloud
+
+- name: Extract Nextcloud archive
+  unarchive:
+    src: "{{ nextcloud_home }}/{{ nextcloud_archive_name }}"
+    dest: "{{ nextcloud_home }}"
+    creates: "{{ nextcloud_home }}/nextcloud"
+    remote_src: True
+    mode: "0750"
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_user }}"
   tags:
     - nextcloud
diff --git a/nextcloud/tasks/config.yml b/nextcloud/tasks/config.yml
index de143122..ae4f1391 100644
--- a/nextcloud/tasks/config.yml
+++ b/nextcloud/tasks/config.yml
@@ -1,31 +1,60 @@
 ---
-- name: Link config dir to global config dir
+
+- name: Create data directory
   file:
-    src: "{{ nextcloud_root }}/{{ item }}/config/config.php"
-    dest: "{{ nextcloud_root }}/{{ item }}/nextcloud/config/config.php"
-    state: link
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    force: True
-  with_items: "{{ nextcloud_instances | list }}"
+    dest: "{{ nextcloud_data | mandatory }}"
+    state: directory
+    mode: "0770"
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_user }}"
   tags:
     - nextcloud
 
+- name: Link config dir to global config dir
+  file:
+    src: "{{ nextcloud_home }}/config/config.php"
+    dest: "{{ nextcloud_webroot }}/config/config.php"
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_user }}"
+    state: link
+    force: True
+  tags:
+    - nextcloud
+
+- block:
+  - name: Generate admin password
+    command: 'apg -n 1 -m 16 -M lcN'
+    register: nextcloud_admin_password_apg
+    check_mode: no
+    changed_when: False
+  - debug:
+      var: nextcloud_admin_password_apg
+      verbosity: 1
+
+  - set_fact:
+      nextcloud_admin_password: "{{ nextcloud_admin_password_apg.stdout }}"
+
+  - debug:
+      msg: "WARNING: your generated admin password is '{{ nextcloud_admin_password }}'."
+  tags:
+    - nextcloud
+  when: nextcloud_admin_password == ""
+
+
 - name: Install Nextcloud
-  shell: "php ./occ maintenance:install --database mysql --database-name {{ item.key }} --database-user {{ item.key }} --database-pass {{ item.value.db_pass }} --admin-user admin --admin-pass toor --data-dir {{ nextcloud_root }}/{{ item.key }}/data"
+  command: "php ./occ maintenance:install --database mysql --database-name {{ nextcloud_db_name | mandatory }} --database-user {{ nextcloud_db_user | mandatory }} --database-pass {{ nextcloud_db_pass | mandatory }} --admin-user {{ nextcloud_admin_login | mandatory }} --admin-pass {{ nextcloud_admin_password | mandatory }} --data-dir {{ nextcloud_data | mandatory }}"
   args:
-    chdir: "{{ nextcloud_root }}/{{ item.key }}/nextcloud/"
-    creates: "{{ nextcloud_root }}/{{ item.key }}/config/config.php"
-  with_dict: "{{ nextcloud_instances }}"
+    chdir: "{{ nextcloud_webroot }}"
+    creates: "{{ nextcloud_home }}/config/config.php"
+  become_user: "{{ nextcloud_user }}"
   tags:
     - nextcloud
 
 - name: Configure Nextcloud Mysql password
   replace:
-    dest: "{{ nextcloud_root }}/{{ item.key }}/config/config.php"
-    regexp: "'dbpassword' => '([^']*)',"
-    replace: "'dbpassword' => '{{ item.value.db_pass }}',"
-  with_dict: "{{ nextcloud_instances }}"
+    dest: "{{ nextcloud_home }}/config/config.php"
+    regexp:  "'dbpassword' => '([^']*)',"
+    replace: "'dbpassword' => '{{ nextcloud_db_pass }}',"
   tags:
     - nextcloud
 
@@ -33,44 +62,42 @@
   cron:
     name: 'Nextcloud'
     minute: "*/15"
-    job: "php -f ~/nextcloud/cron.php"
-    user: "{{ item }}"
-  with_items: "{{ nextcloud_instances | list }}"
+    job: "php -f {{ nextcloud_webroot }}/cron.php"
+    user: "{{ nextcloud_user }}"
   tags:
     - nextcloud
 
 - name: Erase previously trusted domains config
-  shell: "php ./occ config:system:set trusted_domains"
+  command: "php ./occ config:system:set trusted_domains"
   args:
-    chdir: "{{ nextcloud_root }}/{{ item }}/nextcloud/"
-  with_items: "{{ nextcloud_instances | list }}"
+    chdir: "{{ nextcloud_webroot }}"
+  become_user: "{{ nextcloud_user }}"
   tags:
     - nextcloud
 
 - name: Configure trusted domains
-  shell: "php ./occ config:system:set trusted_domains {{ item[1] }} --value {{ nextcloud_instances[item[0]].domains[item[1]] }}"
+  command: "php ./occ config:system:set trusted_domains {{ item.0 }} --value {{ item.1 }}"
   args:
-    chdir: "{{ nextcloud_root }}/{{ item[0] }}/nextcloud/"
-  with_nested:
-    - "{{ nextcloud_instances | list }}"
-    - "{{ range(0, nextcloud_instances | list | length ) | list }}"
+    chdir: "{{ nextcloud_webroot }}"
+  with_indexed_items:
+    - "{{ nextcloud_domains }}"
+  become_user: "{{ nextcloud_user }}"
   tags:
     - nextcloud
 
 #- name: Configure memcache local to APCu
-#  shell: "php ./occ config:system:set memcache.local --value '\\OC\\Memcache\\APCu'"
+#  command: "php ./occ config:system:set memcache.local --value '\\OC\\Memcache\\APCu'"
 #  args:
-#    chdir: "{{ nextcloud_root }}/{{ item }}/nextcloud/"
-#  with_items: "{{ nextcloud_instances | list }}"
+#    chdir: "{{ nextcloud_webroot }}"
+#  become_user: "{{ nextcloud_user }}"
 #  tags:
 #    - nextcloud
 
 - name: Fix right on config.php
   file:
-    dest: "{{ nextcloud_root }}/{{ item }}/config/config.php"
-    owner: "{{ item }}"
-    group: "{{ item }}"
+    dest: "{{ nextcloud_home }}/config/config.php"
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_user }}"
     mode: "0660"
-  with_items: "{{ nextcloud_instances | list }}"
   tags:
     - nextcloud
diff --git a/nextcloud/tasks/main.yml b/nextcloud/tasks/main.yml
index 4b1c4532..031ba7e5 100644
--- a/nextcloud/tasks/main.yml
+++ b/nextcloud/tasks/main.yml
@@ -26,7 +26,11 @@
     - nextcloud
 
 - include: user.yml
+
 - include: archive.yml
+
 - include: vhost.yml
+
 - include: mysql.yml
+
 - include: config.yml
diff --git a/nextcloud/tasks/mysql.yml b/nextcloud/tasks/mysql.yml
index 62772d2b..f2fcee32 100644
--- a/nextcloud/tasks/mysql.yml
+++ b/nextcloud/tasks/mysql.yml
@@ -1,89 +1,62 @@
 ---
 - name: Get actual Mysql password
-  shell: "grep password /home/{{ item }}/.my.cnf | awk '{ print $3 }'"
-  register: nextcloud_grep_password
+  shell: "grep password {{ nextcloud_home }}/.my.cnf | awk '{ print $3 }'"
+  register: nextcloud_db_pass_grep
   check_mode: no
   changed_when: False
   failed_when: False
-  with_items: "{{ nextcloud_instances | list }}"
   tags:
     - nextcloud
 
 - name: Generate Mysql password
-  shell: 'apg -n 1 -m 16 -M lcN'
-  register: nextcloud_apg_password
+  command: 'apg -n 1 -m 16 -M lcN'
+  register: nextcloud_db_pass_apg
   check_mode: no
   changed_when: False
-  with_items: "{{ nextcloud_instances | list }}"
   tags:
     - nextcloud
 
 - name: Set Mysql password
   set_fact:
-    nextcloud_instances: "{{ nextcloud_instances | combine({ item[0]: nextcloud_instances[item[0]] | combine({ 'db_pass': (item[1].stdout | default(item[2].stdout, true)) }) }, recursive=True) }}"
-  with_together:
-    - "{{ nextcloud_instances | list }}"
-    - "{{ nextcloud_grep_password.results }}"
-    - "{{ nextcloud_apg_password.results }}"
+    nextcloud_db_pass: "{{ nextcloud_db_pass_grep.stdout | default(nextcloud_db_pass_apg.stdout, True) }}"
   tags:
     - nextcloud
 
+- debug:
+    var: nextcloud_db_pass
+    verbosity: 1
+
 - name: Create Mysql database
   mysql_db:
-    name: "{{ item }}"
+    name: "{{ nextcloud_db_name }}"
     config_file: "/root/.my.cnf"
     state: present
-  with_items: "{{ nextcloud_instances | list }}"
   tags:
     - nextcloud
 
 - name: Create Mysql user
   mysql_user:
-    name: "{{ item.key }}"
-    password: '{{ item.value.db_pass }}'
-    priv: "{{ item.key }}.*:ALL"
+    name: "{{ nextcloud_db_user }}"
+    password: '{{ nextcloud_db_pass }}'
+    priv: "{{ nextcloud_db_name }}.*:ALL"
     config_file: "/root/.my.cnf"
     update_password: always
     state: present
-  with_dict: "{{ nextcloud_instances }}"
   tags:
     - nextcloud
 
 - name: Store credentials in my.cnf
   ini_file:
-    dest: "/home/{{ item }}/.my.cnf"
-    owner: "{{ item }}"
-    group: "{{ item }}"
+    dest: "{{ nextcloud_home }}/.my.cnf"
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_user }}"
     mode: "0600"
     section: client
-    option: 'user'
-    value: '{{ item }}'
-  with_items: "{{ nextcloud_instances | list }}"
-  tags:
-    - nextcloud
-
-- name: Store credentials in my.cnf
-  ini_file:
-    dest: "/home/{{ item }}/.my.cnf"
-    owner: "{{ item }}"
-    group: "{{ item }}"
-    mode: "0600"
-    section: client
-    option: 'database'
-    value: '{{ item }}'
-  with_items: "{{ nextcloud_instances | list }}"
-  tags:
-    - nextcloud
-
-- name: Store credentials in my.cnf
-  ini_file:
-    dest: "/home/{{ item.key }}/.my.cnf"
-    owner: "{{ item.key }}"
-    group: "{{ item.key }}"
-    mode: "0600"
-    section: client
-    option: 'password'
-    value: '{{ item.value.db_pass }}'
-  with_dict: "{{ nextcloud_instances }}"
+    option: "{{ item.option }}"
+    value:  "{{ item.value }}"
+  with_items:
+    - { option: "user",     value: "{{ nextcloud_db_user }}" }
+    - { option: "database", value: "{{ nextcloud_db_name }}" }
+    - { option: "password", value: "{{ nextcloud_db_pass }}" }
   tags:
     - nextcloud
diff --git a/nextcloud/tasks/user.yml b/nextcloud/tasks/user.yml
index febc8017..432a9d03 100644
--- a/nextcloud/tasks/user.yml
+++ b/nextcloud/tasks/user.yml
@@ -1,33 +1,32 @@
 ---
 - name: Create Nextcloud groups
   group:
-    name: "{{ item }}"
+    name: "{{ nextcloud_instance_name | mandatory }}"
     state: present
-  with_items: "{{ nextcloud_instances | list }}"
   tags:
     - nextcloud
 
 - name: Create Nextcloud users
   user:
-    name: "{{ item }}"
-    group: "{{ item }}"
-    home: "{{ nextcloud_root }}/{{ item }}"
+    name: "{{ nextcloud_user | mandatory }}"
+    group: "{{ nextcloud_user }}"
+    home: "{{ nextcloud_home | mandatory }}"
     shell: '/bin/bash'
     createhome: True
     state: present
-  with_items: "{{ nextcloud_instances | list }}"
   tags:
   - nextcloud
 
-- name: Create needed directories
+- name: Create top-level directories
   file:
-    dest: "{{ nextcloud_root }}/{{ item[0] }}/{{ item[1] }}"
+    dest: "{{ item }}"
     state: directory
     mode: "0770"
-    owner: "{{ item[0] }}"
-    group: "{{ item[0] }}"
-  with_nested:
-    - "{{ nextcloud_instances | list }}"
-    - [ 'log', 'config', 'data', 'tmp' ]
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_user }}"
+  with_items:
+    - "{{ nextcloud_home }}/log"
+    - "{{ nextcloud_home }}/config"
+    - "{{ nextcloud_home }}/tmp"
   tags:
     - nextcloud
diff --git a/nextcloud/tasks/vhost.yml b/nextcloud/tasks/vhost.yml
index 612b7c74..52d699e6 100644
--- a/nextcloud/tasks/vhost.yml
+++ b/nextcloud/tasks/vhost.yml
@@ -3,35 +3,27 @@
   - name: Copy Nginx vhost
     template:
       src: nginx.conf.j2
-      dest: "/etc/nginx/sites-available/{{ name }}.conf"
+      dest: "/etc/nginx/sites-available/{{ nextcloud_instance_name }}.conf"
       mode: "0640"
     notify: reload nginx
-    with_dict: "{{ nextcloud_instances }}"
-    vars:
-      - name: "{{ item.key }}"
-      - domains: "{{ item.value.domains }}"
     tags:
       - nextcloud
-  
+
   - name: Enable Nginx vhost
     file:
-      src: "/etc/nginx/sites-available/{{ item }}.conf"
-      dest: "/etc/nginx/sites-enabled/{{ item }}.conf"
+      src: "/etc/nginx/sites-available/{{ nextcloud_instance_name }}.conf"
+      dest: "/etc/nginx/sites-enabled/{{ nextcloud_instance_name }}.conf"
       state: link
     notify: reload nginx
-    with_items: "{{ nextcloud_instances | list }}"
     tags:
       - nextcloud
-  when: "{{ nextcloud_webserver == 'nginx' }}"
+  when: nextcloud_webserver == 'nginx'
 
 - name: Copy PHP-FPM pool
   template:
     src: php-fpm.conf.j2
-    dest: "/etc/php/7.0/fpm/pool.d/{{ name }}.conf"
+    dest: "/etc/php/7.0/fpm/pool.d/{{ nextcloud_instance_name }}.conf"
     mode: "0640"
   notify: restart php-fpm
-  with_items: "{{ nextcloud_instances | list }}"
-  vars:
-    - name: "{{ item }}"
   tags:
     - nextcloud
diff --git a/nextcloud/templates/nginx.conf.j2 b/nextcloud/templates/nginx.conf.j2
index 01f219fe..48c738a3 100644
--- a/nextcloud/templates/nginx.conf.j2
+++ b/nextcloud/templates/nginx.conf.j2
@@ -4,12 +4,12 @@ server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
 
-    server_name{% for domain in domains %} {{ domain }}{% endfor %};
+    server_name {{ nextcloud_domains | join(' ') }};
 
-    access_log /home/{{ name }}/log/access.log;
-    error_log /home/{{ name }}/log/error.log;
+    access_log {{ nextcloud_home }}/log/access.log;
+    error_log {{ nextcloud_home }}/log/error.log;
 
-    include /etc/nginx/ssl/{{ name }}.conf;
+    include /etc/nginx/ssl/{{ nextcloud_instance_name }}.conf;
 
     add_header X-Content-Type-Options nosniff;
     add_header X-XSS-Protection "1; mode=block";
@@ -17,7 +17,7 @@ server {
     add_header X-Download-Options noopen;
     add_header X-Permitted-Cross-Domain-Policies none;
 
-    root /home/{{ name }}/nextcloud;
+    root {{ nextcloud_webroot }};
 
     include /etc/nginx/snippets/letsencrypt.conf;
 
@@ -69,7 +69,7 @@ server {
         #Avoid sending the security headers twice
         fastcgi_param modHeadersAvailable true;
         fastcgi_param front_controller_active true;
-        fastcgi_pass unix:///var/run/php/php7.0-fpm-{{ name }}.sock;
+        fastcgi_pass unix:///var/run/php/php7.0-fpm-{{ nextcloud_instance_name }}.sock;
         fastcgi_intercept_errors on;
         fastcgi_request_buffering off;
     }
diff --git a/nextcloud/templates/php-fpm.conf.j2 b/nextcloud/templates/php-fpm.conf.j2
index 94fa159b..45b29622 100644
--- a/nextcloud/templates/php-fpm.conf.j2
+++ b/nextcloud/templates/php-fpm.conf.j2
@@ -1,18 +1,20 @@
-[{{ name }}]
-user = {{ name }}
-group = {{ name }}
-listen = /run/php/php7.0-fpm-{{ name }}.sock
-listen.owner = {{ name }}
-listen.group = {{ name }}
+[{{ nextcloud_instance_name }}]
+user = {{ nextcloud_user }}
+group = {{ nextcloud_user }}
+listen = /run/php/php7.0-fpm-{{ nextcloud_instance_name }}.sock
+listen.owner = {{ nextcloud_user }}
+listen.group = {{ nextcloud_user }}
+
 pm = ondemand
 pm.max_children = 100
 pm.process_idle_timeout = 10s
 pm.status_path = /fpm_status
+
 request_terminate_timeout = 60s
-chdir = /home/{{ name }}/nextcloud
+chdir = {{ nextcloud_webroot }}
 
 env[HOSTNAME] = $HOSTNAME
 env[PATH] = /usr/local/bin:/usr/bin:/bin
-env[TMP] = /home/{{ name }}/tmp
-env[TMPDIR] = /home/{{ name }}/tmp
-env[TEMP] = /home/{{ name }}/tmp
+env[TMP] = {{ nextcloud_home }}/tmp
+env[TMPDIR] = {{ nextcloud_home }}/tmp
+env[TEMP] = {{ nextcloud_home }}/tmp