ansible-roles/webapps/etherpad/tasks/main.yml

---
# tasks file for etherpad install

- name: Install main system dependencies
  apt:
    name: "{{ system_dep }}"
    update_cache: yes

- name: Add UNIX account
  user:
    name: "{{ service }}"
    shell: /bin/bash

- name: Add database
  mysql_db:
    name: "{{ db_name }}"

- name: Add database user
  mysql_user:
    name: "{{ db_user }}"
    password: "{{ db_password }}"
    priv: "{{ db_name }}.*:{{privileges |default('SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,INDEX,ALTER,CREATE TEMPORARY TABLES')}}"
    update_password: on_create

- name: Clone etherpad repo (git)
  git:
    repo: "{{ git_url }}"
    dest: "~/etherpad-lite/"
    version: "{{ git_version | default(omit) }}"
    update: yes
    force: true
    umask: '0022'
  become_user: "{{ service }}"

- name: Fix run.sh so it does not start etherpad at the end
  lineinfile: 
    path: "~/etherpad-lite/src/bin/run.sh"
    state: absent
    regexp: 'exec node src/node/server.js'
  become_user: "{{ service }}"

- name: Run setup
  shell: "src/bin/run.sh"
  args:
    chdir: "~/etherpad-lite"
  become_user: "{{ service }}"

- name: Template json config file
  template:
    src: "settings.json.j2"
    dest: "~{{ service }}/etherpad-lite/settings.json"
    owner: "{{ service }}"
    group: "{{ service }}"
    mode: "0640"

- name: Add systemd unit
  template:
    src: "etherpad.service.j2"
    dest: "/etc/systemd/system/{{ service }}.service"

- name: Enable systemd units
  systemd:
    name: "{{ service }}.service"
    enabled: yes
    daemon_reload: yes

- name: Start service
  service:
    name: "{{ service }}.service"
    state: restarted

- name: Template nginx snippet for Let's Encrypt/Certbot
  template: 
    src: "letsencrypt.conf.j2"
    dest: "/etc/nginx/snippets/letsencrypt.conf"

- name: Check if SSL certificate is present and register result
  stat:
    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
  register: ssl

- name: Generate certificate only if required (first time)
  block:
  - name: Template vhost without SSL for successfull LE challengce
    template: 
      src: "vhost.conf.j2"
      dest: "/etc/nginx/sites-available/{{ service }}.conf"
  - name: Enable temporary nginx vhost for LE
    file:
      src: "/etc/nginx/sites-available/{{ service }}.conf"
      dest: "/etc/nginx/sites-enabled/{{ service }}.conf"
      state: link
  - name: Reload nginx conf
    service:
      name: nginx
      state: reloaded
  - name: Make sure /var/lib/letsencrypt exists and has correct permissions
    file: 
      path: /var/lib/letsencrypt
      state: directory
      mode: '0755'
  - name: Generate certificate with certbot
    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
  - name: Create the ssl dir if needed
    file:
      path: /etc/nginx/ssl
      state: directory
      mode: '0750'
  - name: Template ssl bloc for nginx vhost
    template: 
      src: "ssl.conf.j2"
      dest: "/etc/nginx/ssl/{{ domains |first }}.conf"
  when: ssl.stat.exists != true

- name: (Re)check if SSL certificate is present and register result
  stat:
    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
  register: ssl

- name: (Re)template conf file for nginx vhost with SSL
  template:
    src: "vhost.conf.j2"
    dest: "/etc/nginx/sites-available/{{ service }}.conf"

- name: Enable nginx vhost for etherpad
  file:
    src: "/etc/nginx/sites-available/{{ service }}.conf"
    dest: "/etc/nginx/sites-enabled/{{ service }}.conf"
    state: link

- name: Reload nginx conf
  service:
    name: nginx
    state: reloaded