webapps/privatebin/LISEZMOI.md

@@ -0,0 +1,49 @@
+privatebin
+=========
+
+Ce rôle installe un serveur PrivateBin. 
+
+Notez qu'hormis le présent fichier LISEZMOI.md, tous les fichiers du rôle privatebin sont rédigés en anglais afin de suivre les conventions de la communauté Ansible, favoriser sa réutilisation et son amélioration, etc. Libre à vous cependant de faire appel à ce role dans un playbook rédigé principalement en français ou toute autre langue.
+
+Requis
+------
+
+...
+
+Variables du rôle
+-----------------
+
+Plusieurs des valeurs par défaut dans defaults/main.yml doivent être changées soit directement dans defaults/main.yml ou mieux encore en les supplantant ailleurs, par exemple dans votre playbook (voir l'exemple ci-bas).
+
+Dépendances
+------------
+
+Ce rôle Ansible dépend des rôles suivants :
+
+- nodejs
+
+Exemple de playbook
+-------------------
+
+```
+- name: "Déployer un serveur PrivateBin"
+  hosts: 
+    - all
+  vars:
+    # Supplanter ici les variables du rôle
+    privatebin_domains: ['votre-vrai-domaine.org']
+    service: 'mon-privatebin'
+
+  roles:
+    - { role: webapps/privatebin , tags: "privatebin" }
+```
+
+Licence
+-------
+
+GPLv3
+
+Infos sur l'auteur
+------------------
+
+Mathieu Gauthier-Pilote, administrateur de systèmes chez Evolix.

webapps/privatebin/README.md

@@ -0,0 +1,49 @@
+privatebin
+=========
+
+This role installs or upgrades the server for PrivateBin. 
+
+FRENCH: Voir le fichier LISEZMOI.md pour le français.
+
+Requirements
+------------
+
+...
+
+Role Variables
+--------------
+
+Several of the default values in defaults/main.yml must be changed either directly in defaults/main.yml or better even by overwriting them somewhere else, for example in your playbook (see the example below).
+
+Dependencies
+------------
+
+This Ansible role depends on the following other roles:
+
+- nodejs
+
+Example Playbook
+----------------
+
+```
+- name: "Deploy an PrivateBin server"
+  hosts: 
+    - all
+  vars:
+    # Overwrite the role variable here
+    privatebin_domains: ['your-real-domain.org']
+    service: 'my-privatebin'
+
+  roles:
+    - { role: webapps/privatebin , tags: "privatebin" }
+```
+
+License
+-------
+
+GPLv3
+
+Author Information
+------------------
+
+Mathieu Gauthier-Pilote, sys. admin. at Evolix.

webapps/privatebin/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+# defaults file for vars
+privatebin_system_dep: "['apt-transport-https', 'git', 'certbot', 'acl', 'apache2', 'libapache2-mpm-itk', 'libapache2-mod-php', 'php-gd']"
+privatebin_git_url: 'https://github.com/PrivateBin/PrivateBin'
+privatebin_git_version: '1.5.1'
+privatebin_domains: ['example.domain.net']
+privatebin_certbot_admin_email: 'security@example.net'

webapps/privatebin/handlers/main.yml

@@ -0,0 +1,12 @@
+---
+# handlers file
+
+- name: reload apache
+  ansible.builtin.systemd:
+    name: apache2
+    state: reloaded
+
+- name: restart apache
+  ansible.builtin.systemd:
+    name: apache2
+    state: restarted

webapps/privatebin/meta/main.yml

@@ -0,0 +1,52 @@
+galaxy_info:
+  author: Mathieu Gauthier-Pilote
+  description: sys. admin.
+  company: Evolix
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license GPL-3.0-only
+
+  min_ansible_version: 2.10
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

webapps/privatebin/tasks/main.yml

@@ -0,0 +1,120 @@
+---
+# tasks file for privatebin install
+
+- name: Install main system dependencies
+  ansible.builtin.apt:
+    name: "{{ privatebin_system_dep }}"
+    update_cache: yes
+
+- name: Add UNIX account
+  ansible.builtin.user:
+    name: "{{ service }}"
+    shell: /bin/bash
+
+- name: Clone privatebin repo (git)
+  ansible.builtin.git:
+    repo: "{{ privatebin_git_url }}"
+    dest: "~/PrivateBin/"
+    version: "{{ privatebin_git_version | default(omit) }}"
+    update: yes
+    force: true
+    umask: '0022'
+  become_user: "{{ service }}"
+
+- name: Template apache conf for Let's Encrypt/Certbot
+  ansible.builtin.template: 
+    src: "letsencrypt.conf.j2"
+    dest: "/etc/apache2/conf-available/letsencrypt.conf"
+
+- name: Enable apache conf for Let's Encrypt/Certbot
+  ansible.builtin.command: 
+    cmd: "/usr/sbin/a2enconf letsencrypt.conf"
+  notify: reload apache
+
+- name: Check if SSL certificate is present and register result
+  ansible.builtin.stat:
+    path: "/etc/letsencrypt/live/{{ privatebin_domains |first }}/fullchain.pem"
+  register: ssl
+
+- name: Generate certificate only if required (first time)
+  block:
+  - name: Template vhost without SSL for successfull LE challengce
+    ansible.builtin.template: 
+      src: "vhost.conf.j2"
+      dest: "/etc/apache2/sites-available/{{ service }}.conf"
+    notify: reload apache
+  - name: Enable apache vhost for privatebin
+    ansible.builtin.command: 
+      cmd: "/usr/sbin/a2ensite {{ service }}"
+    notify: reload apache
+  - name: Flush handlers
+    ansible.builtin.meta: flush_handlers
+  - name: Make sure /var/lib/letsencrypt exists and has correct permissions
+    ansible.builtin.file: 
+      path: /var/lib/letsencrypt
+      state: directory
+      mode: '0755'
+  - name: Generate certificate with certbot
+    ansible.builtin.command:
+      cmd: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ privatebin_certbot_admin_email }} -d {{ privatebin_domains | first }}
+  - name: Create the ssl dir if needed
+    ansible.builtin.file:
+      path: /etc/apache2/ssl
+      state: directory
+      mode: '0750'
+  - name: Template ssl block for apache vhost
+    ansible.builtin.template: 
+      src: "ssl.conf.j2"
+      dest: "/etc/apache2/ssl/{{ service }}.conf"
+    notify: reload apache
+  when: ssl.stat.exists != true
+
+- name: (Re)check if SSL certificate is present and register result
+  ansible.builtin.stat:
+    path: "/etc/letsencrypt/live/{{ privatebin_domains |first }}/fullchain.pem"
+  register: ssl
+
+- name: (Re)template conf file for apache vhost with SSL
+  ansible.builtin.template:
+    src: "vhost.conf.j2"
+    dest: "/etc/apache2/sites-available/{{ service }}.conf"
+    notify: reload apache
+
+- name: Enable apache mode_rewrite
+  ansible.builtin.command: 
+    cmd: "/usr/sbin/a2enmod ssl rewrite"
+  notify: restart apache
+  
+- name: Enable .htaccess configuration
+  ansible.builtin.copy:
+    src: "~/PrivateBin/.htaccess.disabled"
+    dest: "~/PrivateBin/.htaccess"
+    remote_src: true
+  become_user: "{{ service }}"
+
+- name: Creates directory outside DocumentRoot
+  ansible.builtin.file:
+    path: "~/secret"
+    state: directory
+  become_user: "{{ service }}"
+  register: directory
+
+- name: Move some directories outside DocumentRoot
+  ansible.builtin.shell: 
+    cmd: "mv {bin,cfg,doc,lib,tpl,tst,vendor} ~/secret/"
+    chdir: "~/PrivateBin/"
+    executable: /bin/bash
+  become_user: "{{ service }}"
+  when: directory.changed
+
+- name: Ajust path needed for directories outside DocumentRoot
+  ansible.builtin.lineinfile:
+    path: "~/PrivateBin/index.php"
+    regexp: ^define\('PATH', ''\);
+    line: define('PATH', '../secret/');
+  become_user: "{{ service }}"
+
+- name: Enable apache vhost for privatebin
+  ansible.builtin.command: 
+    cmd: "/usr/sbin/a2ensite {{ service }}"
+  notify: reload apache

webapps/privatebin/tasks/upgrade.yml

@@ -0,0 +1,37 @@
+---
+# tasks file for etherpad upgrade
+
+- name: Move some directories back to DocumentRoot
+  ansible.builtin.shell: 
+    cmd: "mv {bin,cfg,doc,lib,tpl,tst,vendor} ~/PrivateBin/"
+    chdir: "~/secret/"
+    executable: /bin/bash
+  become_user: "{{ service }}"
+
+- name: Update privatebin repo (git)
+  ansible.builtin.git:
+    repo: "{{ privatebin_git_url }}"
+    dest: "~/PrivateBin/"
+    version: "{{ privatebin_git_version }}"
+    update: yes
+    force: true
+  become_user: "{{ service }}"
+
+- name: Move back some directories outside DocumentRoot
+  ansible.builtin.shell: 
+    cmd: "mv {bin,cfg,doc,lib,tpl,tst,vendor} ~/secret/"
+    chdir: "~/PrivateBin/"
+    executable: /bin/bash
+  become_user: "{{ service }}"
+
+- name: Ajust path needed for directories outside DocumentRoot
+  ansible.builtin.lineinfile:
+    path: "~/PrivateBin/index.php"
+    regexp: ^define\('PATH', ''\);
+    line: define('PATH', '../secret/');
+  become_user: "{{ service }}"
+
+- name: Reload apache conf
+  ansible.builtin.systemd:
+    name: apache2
+    state: reloaded

webapps/privatebin/templates/letsencrypt.conf.j2

@@ -0,0 +1,11 @@
+<IfModule jk_module>
+    SetEnvIf Request_URI "/.well-known/acme-challenge/*" no-jk
+</IfModule>
+<IfModule proxy_module>
+    ProxyPass /.well-known/acme-challenge/ !
+</IfModule>
+Alias /.well-known/acme-challenge /var/lib/letsencrypt/.well-known/acme-challenge
+<Directory "/var/lib/letsencrypt/.well-known/acme-challenge">
+    Options -Indexes
+    Require all granted
+</Directory>

webapps/privatebin/templates/ssl.conf.j2

@@ -0,0 +1,3 @@
+SSLEngine On
+SSLCertificateFile /etc/letsencrypt/live/{{ privatebin_domains |first }}/fullchain.pem
+SSLCertificateKeyFile /etc/letsencrypt/live/{{ privatebin_domains |first }}/privkey.pem

webapps/privatebin/templates/vhost.conf.j2

@@ -0,0 +1,30 @@
+<VirtualHost *:80>
+    ServerName {{ privatebin_domains |first }}
+    
+    {% if ssl.stat.exists %}
+    RewriteEngine On
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [L,R=permanent]
+    {% endif %}
+
+</VirtualHost>
+
+{% if ssl.stat.exists %}
+<VirtualHost *:443>
+    ServerName {{ privatebin_domains |first }}
+
+    DocumentRoot /home/{{ service }}/PrivateBin
+    
+    <Directory /home/{{ service }}/PrivateBin>
+        Options SymLinksIfOwnerMatch
+        AllowOverride Options=All AuthConfig Limit FileInfo Indexes
+        Require all granted
+    </Directory>
+    
+    AssignUserID {{ service }} {{ service }}
+
+    IncludeOptional /etc/apache2/ssl/{{ service }}.conf
+
+</VirtualHost>
+{% endif %}

webapps/privatebin/tests/inventory

@@ -0,0 +1,2 @@
+localhost
+

webapps/privatebin/tests/test.yml

@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - privatebin

webapps/privatebin/vars/main.yml

@@ -0,0 +1,2 @@
+---
+# vars file