New role to install + upgrade PrivateBin
All checks were successful
gitea/ansible-roles/pipeline/head This commit looks good
All checks were successful
gitea/ansible-roles/pipeline/head This commit looks good
This commit is contained in:
parent
49e92d20b0
commit
8634c92ef8
49
webapps/privatebin/LISEZMOI.md
Normal file
49
webapps/privatebin/LISEZMOI.md
Normal file
|
@ -0,0 +1,49 @@
|
|||
privatebin
|
||||
=========
|
||||
|
||||
Ce rôle installe un serveur PrivateBin.
|
||||
|
||||
Notez qu'hormis le présent fichier LISEZMOI.md, tous les fichiers du rôle privatebin sont rédigés en anglais afin de suivre les conventions de la communauté Ansible, favoriser sa réutilisation et son amélioration, etc. Libre à vous cependant de faire appel à ce role dans un playbook rédigé principalement en français ou toute autre langue.
|
||||
|
||||
Requis
|
||||
------
|
||||
|
||||
...
|
||||
|
||||
Variables du rôle
|
||||
-----------------
|
||||
|
||||
Plusieurs des valeurs par défaut dans defaults/main.yml doivent être changées soit directement dans defaults/main.yml ou mieux encore en les supplantant ailleurs, par exemple dans votre playbook (voir l'exemple ci-bas).
|
||||
|
||||
Dépendances
|
||||
------------
|
||||
|
||||
Ce rôle Ansible dépend des rôles suivants :
|
||||
|
||||
- nodejs
|
||||
|
||||
Exemple de playbook
|
||||
-------------------
|
||||
|
||||
```
|
||||
- name: "Déployer un serveur PrivateBin"
|
||||
hosts:
|
||||
- all
|
||||
vars:
|
||||
# Supplanter ici les variables du rôle
|
||||
domains: ['votre-vrai-domaine.org']
|
||||
service: 'mon-privatebin'
|
||||
|
||||
roles:
|
||||
- { role: webapps/privatebin , tags: "privatebin" }
|
||||
```
|
||||
|
||||
Licence
|
||||
-------
|
||||
|
||||
GPLv3
|
||||
|
||||
Infos sur l'auteur
|
||||
------------------
|
||||
|
||||
Mathieu Gauthier-Pilote, administrateur de systèmes chez Evolix.
|
49
webapps/privatebin/README.md
Normal file
49
webapps/privatebin/README.md
Normal file
|
@ -0,0 +1,49 @@
|
|||
privatebin
|
||||
=========
|
||||
|
||||
This role installs or upgrades the server for PrivateBin.
|
||||
|
||||
FRENCH: Voir le fichier LISEZMOI.md pour le français.
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
...
|
||||
|
||||
Role Variables
|
||||
--------------
|
||||
|
||||
Several of the default values in defaults/main.yml must be changed either directly in defaults/main.yml or better even by overwriting them somewhere else, for example in your playbook (see the example below).
|
||||
|
||||
Dependencies
|
||||
------------
|
||||
|
||||
This Ansible role depends on the following other roles:
|
||||
|
||||
- nodejs
|
||||
|
||||
Example Playbook
|
||||
----------------
|
||||
|
||||
```
|
||||
- name: "Deploy an PrivateBin server"
|
||||
hosts:
|
||||
- all
|
||||
vars:
|
||||
# Overwrite the role variable here
|
||||
domains: ['your-real-domain.org']
|
||||
service: 'my-privatebin'
|
||||
|
||||
roles:
|
||||
- { role: webapps/privatebin , tags: "privatebin" }
|
||||
```
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
GPLv3
|
||||
|
||||
Author Information
|
||||
------------------
|
||||
|
||||
Mathieu Gauthier-Pilote, sys. admin. at Evolix.
|
6
webapps/privatebin/defaults/main.yml
Normal file
6
webapps/privatebin/defaults/main.yml
Normal file
|
@ -0,0 +1,6 @@
|
|||
---
|
||||
# defaults file for vars
|
||||
system_dep: "['apt-transport-https', 'git', 'certbot', 'libapache2-mod-php', 'libapache2-mpm-itk', 'php-gd']"
|
||||
git_url: 'https://github.com/PrivateBin/PrivateBin'
|
||||
git_version: '1.5.1'
|
||||
domains: ['example.domain.org']
|
2
webapps/privatebin/handlers/main.yml
Normal file
2
webapps/privatebin/handlers/main.yml
Normal file
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
# handlers file
|
52
webapps/privatebin/meta/main.yml
Normal file
52
webapps/privatebin/meta/main.yml
Normal file
|
@ -0,0 +1,52 @@
|
|||
galaxy_info:
|
||||
author: Mathieu Gauthier-Pilote
|
||||
description: sys. admin.
|
||||
company: Evolix
|
||||
|
||||
# If the issue tracker for your role is not on github, uncomment the
|
||||
# next line and provide a value
|
||||
# issue_tracker_url: http://example.com/issue/tracker
|
||||
|
||||
# Choose a valid license ID from https://spdx.org - some suggested licenses:
|
||||
# - BSD-3-Clause (default)
|
||||
# - MIT
|
||||
# - GPL-2.0-or-later
|
||||
# - GPL-3.0-only
|
||||
# - Apache-2.0
|
||||
# - CC-BY-4.0
|
||||
license: license GPL-3.0-only
|
||||
|
||||
min_ansible_version: 2.10
|
||||
|
||||
# If this a Container Enabled role, provide the minimum Ansible Container version.
|
||||
# min_ansible_container_version:
|
||||
|
||||
#
|
||||
# Provide a list of supported platforms, and for each platform a list of versions.
|
||||
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
|
||||
# To view available platforms and versions (or releases), visit:
|
||||
# https://galaxy.ansible.com/api/v1/platforms/
|
||||
#
|
||||
# platforms:
|
||||
# - name: Fedora
|
||||
# versions:
|
||||
# - all
|
||||
# - 25
|
||||
# - name: SomePlatform
|
||||
# versions:
|
||||
# - all
|
||||
# - 1.0
|
||||
# - 7
|
||||
# - 99.99
|
||||
|
||||
galaxy_tags: []
|
||||
# List tags for your role here, one per line. A tag is a keyword that describes
|
||||
# and categorizes the role. Users find roles by searching for tags. Be sure to
|
||||
# remove the '[]' above, if you add tags to this list.
|
||||
#
|
||||
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
|
||||
# Maximum 20 tags per role.
|
||||
|
||||
dependencies: []
|
||||
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
|
||||
# if you add dependencies to this list.
|
97
webapps/privatebin/tasks/main.yml
Normal file
97
webapps/privatebin/tasks/main.yml
Normal file
|
@ -0,0 +1,97 @@
|
|||
---
|
||||
# tasks file for privatebin install
|
||||
|
||||
- name: Install main system dependencies
|
||||
apt:
|
||||
name: "{{ system_dep }}"
|
||||
|
||||
- name: Add UNIX account
|
||||
user:
|
||||
name: "{{ service }}"
|
||||
shell: /bin/bash
|
||||
|
||||
- name: Clone privatebin repo (git)
|
||||
git:
|
||||
repo: "{{ git_url }}"
|
||||
dest: "~/PrivateBin/"
|
||||
version: "{{ git_version | default(omit) }}"
|
||||
update: yes
|
||||
force: true
|
||||
umask: '0022'
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Check if SSL certificate is present and register result
|
||||
stat:
|
||||
path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||
register: ssl
|
||||
|
||||
- name: Generate certificate only if required (first time)
|
||||
block:
|
||||
- name: Template vhost without SSL for successfull LE challengce
|
||||
template:
|
||||
src: "vhost.conf.j2"
|
||||
dest: "/etc/apache2/sites-available/{{ service }}.conf"
|
||||
- name: Enable apache vhost for privatebin
|
||||
command: "/usr/sbin/a2ensite {{ service }}"
|
||||
- name: Reload apache conf
|
||||
service:
|
||||
name: apache2
|
||||
state: reloaded
|
||||
- name: Make sure /var/lib/letsencrypt exists and has correct permissions
|
||||
file:
|
||||
path: /var/lib/letsencrypt
|
||||
state: directory
|
||||
mode: '0755'
|
||||
- name: Generate certificate with certbot
|
||||
shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt -d {{ domains |first }}
|
||||
when: ssl.stat.exists == true
|
||||
|
||||
- name: (Re)check if SSL certificate is present and register result
|
||||
stat:
|
||||
path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
|
||||
register: ssl
|
||||
|
||||
- name: (Re)template conf file for apache vhost with SSL
|
||||
template:
|
||||
src: "vhost.conf.j2"
|
||||
dest: "/etc/apache2/sites-available/{{ service }}.conf"
|
||||
|
||||
- name: Enable apache mode_rewrite
|
||||
command: "/usr/sbin/a2enmod rewrite"
|
||||
|
||||
- name: Enable .htaccess configuration
|
||||
copy:
|
||||
src: "~/PrivateBin/.htaccess.disabled"
|
||||
dest: "~/PrivateBin/.htaccess"
|
||||
remote_src: true
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Creates directory outside DocumentRoot
|
||||
file:
|
||||
path: "~/secret"
|
||||
state: directory
|
||||
become_user: "{{ service }}"
|
||||
register: directory
|
||||
|
||||
- name: Move some directories outside DocumentRoot
|
||||
shell:
|
||||
cmd: "mv {bin,cfg,doc,lib,tpl,tst,vendor} ~/secret/"
|
||||
chdir: "~/PrivateBin/"
|
||||
executable: /bin/bash
|
||||
become_user: "{{ service }}"
|
||||
when: directory.changed
|
||||
|
||||
- name: Ajust path needed for directories outside DocumentRoot
|
||||
lineinfile:
|
||||
path: "~/PrivateBin/index.php"
|
||||
regexp: ^define\('PATH', ''\);
|
||||
line: define('PATH', '../secret/');
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Enable apache vhost for privatebin
|
||||
command: "/usr/sbin/a2ensite {{ service }}"
|
||||
|
||||
- name: Reload apache conf
|
||||
service:
|
||||
name: apache2
|
||||
state: reloaded
|
37
webapps/privatebin/tasks/upgrade.yml
Normal file
37
webapps/privatebin/tasks/upgrade.yml
Normal file
|
@ -0,0 +1,37 @@
|
|||
---
|
||||
# tasks file for etherpad upgrade
|
||||
|
||||
- name: Move some directories back to DocumentRoot
|
||||
shell:
|
||||
cmd: "mv {bin,cfg,doc,lib,tpl,tst,vendor} ~/PrivateBin/"
|
||||
chdir: "~/secret/"
|
||||
executable: /bin/bash
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Update privatebin repo (git)
|
||||
git:
|
||||
repo: "{{ git_url }}"
|
||||
dest: "~/PrivateBin/"
|
||||
version: "{{ git_version }}"
|
||||
update: yes
|
||||
force: true
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Move back some directories outside DocumentRoot
|
||||
shell:
|
||||
cmd: "mv {bin,cfg,doc,lib,tpl,tst,vendor} ~/secret/"
|
||||
chdir: "~/PrivateBin/"
|
||||
executable: /bin/bash
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Ajust path needed for directories outside DocumentRoot
|
||||
lineinfile:
|
||||
path: "~/PrivateBin/index.php"
|
||||
regexp: ^define\('PATH', ''\);
|
||||
line: define('PATH', '../secret/');
|
||||
become_user: "{{ service }}"
|
||||
|
||||
- name: Reload apache conf
|
||||
service:
|
||||
name: apache2
|
||||
state: reloaded
|
39
webapps/privatebin/templates/vhost.conf.j2
Normal file
39
webapps/privatebin/templates/vhost.conf.j2
Normal file
|
@ -0,0 +1,39 @@
|
|||
<VirtualHost *:80>
|
||||
ServerName {{ domains |first }}
|
||||
|
||||
{% if not ssl.stat.exists %}
|
||||
RewriteEngine On
|
||||
RewriteCond %{HTTPS} !=on
|
||||
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
||||
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R=permanent]
|
||||
{% endif %}
|
||||
|
||||
</VirtualHost>
|
||||
|
||||
{% if not ssl.stat.exists %}
|
||||
<VirtualHost *:443>
|
||||
ServerName {{ domains |first }}
|
||||
|
||||
DocumentRoot /home/{{ service }}/PrivateBin
|
||||
|
||||
<Directory /home/{{ service }}/PrivateBin>
|
||||
Options SymLinksIfOwnerMatch
|
||||
AllowOverride Options=All AuthConfig Limit FileInfo Indexes
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
AssignUserID {{ service }} {{ service }}
|
||||
|
||||
SSLEngine On
|
||||
#SSLCertificateFile /etc/letsencrypt/live/{{ domains |first }}/fullchain.pem
|
||||
#SSLCertificateKeyFile /etc/letsencrypt/live/{{ domains |first }}/privkey.pem
|
||||
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
|
||||
|
||||
RewriteEngine On
|
||||
RewriteCond %{HTTPS} !=on
|
||||
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
|
||||
RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R=permanent]
|
||||
|
||||
</VirtualHost>
|
||||
{% endif %}
|
2
webapps/privatebin/tests/inventory
Normal file
2
webapps/privatebin/tests/inventory
Normal file
|
@ -0,0 +1,2 @@
|
|||
localhost
|
||||
|
5
webapps/privatebin/tests/test.yml
Normal file
5
webapps/privatebin/tests/test.yml
Normal file
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
- hosts: localhost
|
||||
remote_user: root
|
||||
roles:
|
||||
- privatebin
|
2
webapps/privatebin/vars/main.yml
Normal file
2
webapps/privatebin/vars/main.yml
Normal file
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
# vars file
|
Loading…
Reference in a new issue