ansible-roles/webapps/hedgedoc/tasks/main.yml

---
# tasks file for hedgedoc install

- name: Install main system dependencies
  apt:
    name: "{{ system_dep }}"
    update_cache: yes

- name: Install node-gyp from npm
  shell: npm install --global node-gyp

- name: Enable yarn (via corepack)
  shell: "corepack enable; yarn set version classic"

- name: Add UNIX account
  user:
    name: "{{ service }}"
    shell: /bin/bash

- name: Add PostgreSQL user
  postgresql_user:
    name: "{{ db_user }}"
    password: "{{ db_password }}"
    no_password_changes: true
  become_user: postgres

- name: Add PostgreSQL database
  postgresql_db:
    name: "{{ db_name }}"
    owner: "{{ db_user }}"
  become_user: postgres

- block:
  - name: Clone hedgedoc repo (git)
    git:
      repo: "{{ git_url }}"
      dest: "~/hedgedoc/"
      version: "{{ git_version | default(omit) }}"
      update: yes
      umask: '0022'
#  - name: Set cache dir for yarn
#    shell: yarn config set cache-folder /var/tmp/cache/yarn
#    args:
#      chdir: "~/"
  - name: Run setup
    shell: "bin/setup"
    args:
      chdir: "~/hedgedoc"
  - name: Install dependencies for frontend app
    shell: "yarn install --frozen-lockfile"
    args:
      chdir: "~/hedgedoc"
  - name: Build frontend app
    shell: "yarn build"
    args:
      chdir: "~/hedgedoc"
  become_user: "{{ service }}"

- name: Template json config file
  template:
    src: "config.json.j2"
    dest: "~{{ service }}/hedgedoc/config.json"
    owner: "{{ service }}"
    group: "{{ service }}"
    mode: "0640"

- name: Add systemd unit
  template:
    src: "hedgedoc.service.j2"
    dest: "/etc/systemd/system/{{ service }}.service"

- name: Enable systemd units
  systemd:
    name: "{{ service }}.service"
    enabled: yes
    daemon_reload: yes

- name: Start service
  service:
    name: "{{ service }}.service"
    state: restarted

- name: Template nginx snippet for Let's Encrypt/Certbot
  template: 
    src: "letsencrypt.conf.j2"
    dest: "/etc/nginx/snippets/letsencrypt.conf"

- name: Check if SSL certificate is present and register result
  stat:
    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
  register: ssl

- name: Generate certificate only if required (first time)
  block:
  - name: Template vhost without SSL for successfull LE challengce
    template: 
      src: "vhost.conf.j2"
      dest: "/etc/nginx/sites-available/{{ service }}"
  - name: Enable temporary nginx vhost for LE
    file:
      src: "/etc/nginx/sites-available/{{ service }}"
      dest: "/etc/nginx/sites-enabled/{{ service }}"
      state: link
  - name: Reload nginx conf
    service:
      name: nginx
      state: reloaded
  - name: Make sure /var/lib/letsencrypt exists and has correct permissions
    file: 
      path: /var/lib/letsencrypt
      state: directory
      mode: '0755'
  - name: Generate certificate with certbot
    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
  - name: Create the ssl dir if needed
    file:
      path: /etc/nginx/ssl
      state: directory
      mode: '0750'
  - name: Template ssl bloc for nginx vhost
    template: 
      src: "ssl.conf.j2"
      dest: "/etc/nginx/ssl/{{ domains |first }}.conf"
  when: ssl.stat.exists != true

- name: (Re)check if SSL certificate is present and register result
  stat:
    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
  register: ssl

- name: (Re)template conf file for nginx vhost with SSL
  template:
    src: "vhost.conf.j2"
    dest: "/etc/nginx/sites-available/{{ service }}"

- name: Enable nginx vhost for hedgedoc
  file:
    src: "/etc/nginx/sites-available/{{ service }}"
    dest: "/etc/nginx/sites-enabled/{{ service }}"
    state: link

- name: Reload nginx conf
  service:
    name: nginx
    state: reloaded