diff --git a/roles/authelia-for-wiki_js/defaults/main.json b/roles/authelia-for-wiki_js/defaults/main.json new file mode 100644 index 0000000..adb7105 --- /dev/null +++ b/roles/authelia-for-wiki_js/defaults/main.json @@ -0,0 +1,6 @@ +{ + "var_authelia_for_wiki_js_wiki_js_url_base": "https://wiki_js.example.org", + "var_authelia_for_wiki_js_client_id": "wiki_js", + "var_authelia_for_wiki_js_client_secret": "REPLACE_ME", + "var_authelia_for_wiki_js_uuid": "REPLACE_ME", +} diff --git a/roles/authelia-for-wiki_js/info.md b/roles/authelia-for-wiki_js/info.md new file mode 100644 index 0000000..43e5da8 --- /dev/null +++ b/roles/authelia-for-wiki_js/info.md @@ -0,0 +1,9 @@ +## Beschreibung + +Um [Wiki.js](../wiki.js) gegen [Authelia](../authelia) authentifizieren zu lassen + + +## Verweise + +[Wiki.js-Dokumentation | Authentication](https://docs.requarks.io/auth) +[Authelia-Dokumentation | Wiki.js Integration](https://www.authelia.com/integration/openid-connect/wikijs/) diff --git a/roles/authelia-for-wiki_js/tasks/main.json b/roles/authelia-for-wiki_js/tasks/main.json new file mode 100644 index 0000000..185f052 --- /dev/null +++ b/roles/authelia-for-wiki_js/tasks/main.json @@ -0,0 +1,25 @@ +[ + { + "name": "configuration | emplace", + "become": true, + "ansible.builtin.template": { + "src": "authelia-client-conf.json.j2", + "dest": "/etc/authelia/conf.d/clients/wiki_js.json" + } + }, + { + "name": "configuration | apply", + "become": true, + "ansible.builtin.command": { + "cmd": "/usr/bin/authelia-conf-compose" + } + }, + { + "name": "restart service", + "become": true, + "ansible.builtin.systemd_service": { + "state": "restarted", + "name": "authelia" + } + } +] diff --git a/roles/authelia-for-wiki_js/templates/authelia-client-conf.json.j2 b/roles/authelia-for-wiki_js/templates/authelia-client-conf.json.j2 new file mode 100644 index 0000000..2bdc8e6 --- /dev/null +++ b/roles/authelia-for-wiki_js/templates/authelia-client-conf.json.j2 @@ -0,0 +1,17 @@ +{ + "client_id": "{{var_authelia_for_wiki_js_client_id}}", + "client_secret": "{{var_authelia_for_wiki_js_client_secret}}", + "client_name": "Wiki.js", + "public": false, + "authorization_policy": "one_factor", + "redirect_uris": [ + "{{var_authelia_for_wiki_js_wiki_js_url_base}}/login/{{var_authelia_for_wiki_js_uuid}}/calback" + ], + "scopes": [ + "openid", + "email", + "profile" + ], + "userinfo_signed_response_alg": "none", + "token_endpoint_auth_method": "client_secret_basic" +} diff --git a/roles/postgresql-for-wiki_js/defaults/main.json b/roles/postgresql-for-wiki_js/defaults/main.json new file mode 100644 index 0000000..b227a2e --- /dev/null +++ b/roles/postgresql-for-wiki_js/defaults/main.json @@ -0,0 +1,5 @@ +{ + "var_postgresql_for_wiki_js_username": "wiki_js_user", + "var_postgresql_for_wiki_js_password": "REPLACE_ME", + "var_postgresql_for_wiki_js_schema": "wiki_js" +} diff --git a/roles/postgresql-for-wiki_js/tasks/main.json b/roles/postgresql-for-wiki_js/tasks/main.json new file mode 100644 index 0000000..c8aafea --- /dev/null +++ b/roles/postgresql-for-wiki_js/tasks/main.json @@ -0,0 +1,49 @@ +[ + { + "name": "packages", + "become": true, + "ansible.builtin.apt": { + "update_cache": true, + "pkg": [ + "acl", + "python3-psycopg2" + ] + } + }, + { + "name": "user", + "become": true, + "become_user": "postgres", + "community.postgresql.postgresql_user": { + "state": "present", + "name": "{{var_postgresql_for_wiki_js_username}}", + "password": "{{var_postgresql_for_wiki_js_password}}" + }, + "environment": { + "PGOPTIONS": "-c password_encryption=scram-sha-256" + } + }, + { + "name": "schema", + "become": true, + "become_user": "postgres", + "community.postgresql.postgresql_db": { + "state": "present", + "name": "{{var_postgresql_for_wiki_js_schema}}", + "owner": "{{var_postgresql_for_wiki_js_username}}" + } + }, + { + "name": "rights", + "become": true, + "become_user": "postgres", + "community.postgresql.postgresql_privs": { + "state": "present", + "db": "{{var_postgresql_for_wiki_js_schema}}", + "objs": "ALL_IN_SCHEMA", + "roles": "{{var_postgresql_for_wiki_js_username}}", + "privs": "ALL", + "grant_option": true + } + } +] diff --git a/roles/wiki_js-and-nginx/defaults/main.json b/roles/wiki_js-and-nginx/defaults/main.json new file mode 100644 index 0000000..654de80 --- /dev/null +++ b/roles/wiki_js-and-nginx/defaults/main.json @@ -0,0 +1,5 @@ +{ + "var_vikunja_and_nginx_domain": "vikunja.example.org", + "var_wiki_js_and_nginx_internal_port": 5632, + "var_vikunja_and_nginx_tls_mode": "force" +} diff --git a/roles/wiki_js-and-nginx/info.md b/roles/wiki_js-and-nginx/info.md new file mode 100644 index 0000000..3e54803 --- /dev/null +++ b/roles/wiki_js-and-nginx/info.md @@ -0,0 +1,3 @@ +## Verweise + +- [Wiki.js-Dokumentation | Web Server](https://docs.requarks.io/en/install/requirements#web-server) diff --git a/roles/wiki_js-and-nginx/tasks/main.json b/roles/wiki_js-and-nginx/tasks/main.json new file mode 100644 index 0000000..d12f711 --- /dev/null +++ b/roles/wiki_js-and-nginx/tasks/main.json @@ -0,0 +1,35 @@ +[ + { + "name": "deactivate default site", + "become": true, + "ansible.builtin.file": { + "state": "absent", + "dest": "/etc/nginx/sites-enabled/default" + } + }, + { + "name": "emplace configuration | data", + "become": true, + "ansible.builtin.template": { + "src": "conf.j2", + "dest": "/etc/nginx/sites-available/{{var_wiki_js_and_nginx_domain}}" + } + }, + { + "name": "emplace configuration | link", + "become": true, + "ansible.builtin.file": { + "state": "link", + "src": "/etc/nginx/sites-available/{{var_wiki_js_and_nginx_domain}}", + "dest": "/etc/nginx/sites-enabled/{{var_wiki_js_and_nginx_domain}}" + } + }, + { + "name": "restart nginx", + "become": true, + "ansible.builtin.systemd_service": { + "state": "restarted", + "name": "nginx" + } + } +] diff --git a/roles/wiki_js-and-nginx/templates/conf.j2 b/roles/wiki_js-and-nginx/templates/conf.j2 new file mode 100644 index 0000000..186cc05 --- /dev/null +++ b/roles/wiki_js-and-nginx/templates/conf.j2 @@ -0,0 +1,33 @@ +{% macro wiki_js_common() %} + location / { + proxy_pass http://localhost:{{var_wiki_js_and_nginx_internal_port | string}}; + } +{% endmacro %} + +server { + server_name {{var_wiki_js_and_nginx_domain}}; + + listen 80; + listen [::]:80; + +{% if (var_wiki_js_and_nginx_tls_mode == 'force') %} + return 301 https://$http_host$request_uri; +{% else %} +{{ wiki_js_common() }} +{% endif %} +} + +{% if (var_wiki_js_and_nginx_tls_mode != 'disable') %} +server { + server_name {{var_wiki_js_and_nginx_domain}}; + + listen 443 ssl http2; + listen [::]:443 ssl http2; + + ssl_certificate_key /etc/ssl/private/{{var_wiki_js_and_nginx_domain}}.pem; + ssl_certificate /etc/ssl/fullchains/{{var_wiki_js_and_nginx_domain}}.pem; + include /etc/nginx/ssl-hardening.conf; + +{{ wiki_js_common() }} +} +{% endif %} diff --git a/roles/wiki_js-and-nginx/vardef.json b/roles/wiki_js-and-nginx/vardef.json new file mode 100644 index 0000000..81b266d --- /dev/null +++ b/roles/wiki_js-and-nginx/vardef.json @@ -0,0 +1,19 @@ +{ + "domain": { + "type": "string", + "mandatory": false + }, + "internal_port": { + "type": "integer", + "mandatory": false + }, + "tls_mode": { + "type": "string", + "options": [ + "disable", + "enable", + "force" + ], + "mandatory": false + } +} diff --git a/roles/wiki_js/data.json b/roles/wiki_js/data.json new file mode 100644 index 0000000..1ffd054 --- /dev/null +++ b/roles/wiki_js/data.json @@ -0,0 +1,11 @@ +{ + "key": "{{var_wiki_js_authentication_data_uuid}}", + "isEnabled": true, + "config": "{\"clientId\":\"{{var_wiki_js_authentication_data_authelia_client_id}}\",\"clientSecret\":\"{{var_wiki_js_authentication_data_authelia_client_secret}}\",\"authorizationURL\":\"{{var_wiki_js_authentication_data_authelia_url_base}}/api/oidc/authorization\",\"tokenURL\":\"{{var_wiki_js_authentication_data_authelia_url_base}}/api/oidc/token\",\"userInfoURL\":\"{{var_wiki_js_authentication_data_authelia_url_base}}/api/oidc/userinfo\",\"userIdClaim\":\"id\",\"displayNameClaim\":\"name\",\"emailClaim\":\"email\",\"mapGroups\":false,\"groupsClaim\":\"groups\",\"logoutURL\":\"\",\"scope\":\"openid profile email\",\"useQueryStringForAccessToken\":false,\"enableCSRFProtection\":true}", + "selfRegistration": true, + "domainWhitelist": "{\"v\":[]}", + "autoEnrollGroups": "{\"v\":[]}", + "order": 1, + "strategyKey": "oauth2", + "displayName": "{{var_wiki_js_authentication_data_authelia_provider_name}}" +} diff --git a/roles/wiki_js/defaults/main.json b/roles/wiki_js/defaults/main.json new file mode 100644 index 0000000..88216bd --- /dev/null +++ b/roles/wiki_js/defaults/main.json @@ -0,0 +1,23 @@ +{ + "var_wiki_js_port": 5632, + "var_wiki_js_distributed": false, + "var_wiki_js_user": "wiki_js", + "var_wiki_js_directory": "/opt/wiki_js", + "var_wiki_js_data_path": "/var/wiki_js/data", + "var_wiki_js_log_level": "info", + "var_wiki_js_log_format": "default", + "var_wiki_js_database_kind": "sqlite", + "var_wiki_js_database_data_sqlite_path": "/var/wiki.js/data.sqlite", + "var_wiki_js_database_data_postgresql_host": "postgresql.example.org", + "var_wiki_js_database_data_postgresql_port": 5432, + "var_wiki_js_database_data_postgresql_username": "wiki_js_user", + "var_wiki_js_database_data_postgresql_password": "REPLACE_ME", + "var_wiki_js_database_data_postgresql_schema": "wiki_js", + "var_wiki_js_authentication_kind": "internal", + "var_wiki_js_authentication_data_authelia_provider_id": "authelia", + "var_wiki_js_authentication_data_authelia_provider_name": "Authelia", + "var_wiki_js_authentication_data_authelia_client_id": "wiki_js", + "var_wiki_js_authentication_data_authelia_client_secret": "REPLACE_ME", + "var_wiki_js_authentication_data_authelia_url_base": "https://authelia.example.org", + "var_wiki_js_authentication_data_uuid": "REPLACE_ME", +} diff --git a/roles/wiki_js/info.md b/roles/wiki_js/info.md new file mode 100644 index 0000000..424f86a --- /dev/null +++ b/roles/wiki_js/info.md @@ -0,0 +1,9 @@ +## Beschreibung + +- Einrichtung der Aufgaben-Verwaltung [Wiki.js](https://js.wiki/) + + +## Verweise + +- [Wiki.js-Dokumentation | Linux-Installation](https://docs.requarks.io/install/linux) +- [Wiki.js-Dokumentation | Konfiguration](https://docs.requarks.io/install/config) diff --git a/roles/wiki_js/tasks/main.json b/roles/wiki_js/tasks/main.json new file mode 100644 index 0000000..2271dc3 --- /dev/null +++ b/roles/wiki_js/tasks/main.json @@ -0,0 +1,112 @@ +[ + { + "name": "packages", + "become": true, + "ansible.builtin.apt": { + "update_cache": true, + "pkg": [ + "npm" + ] + } + }, + { + "name": "user", + "become": true, + "ansible.builtin.user": { + "name": "{{var_wiki_js_user}}", + "create_home": true, + "home": "{{var_wiki_js_directory}}" + } + }, + { + "name": "directories", + "become": true, + "loop": [ + "{{var_wiki_js_data_path}}", + ], + "ansible.builtin.file": { + "owner": "{{var_wiki_js_user}}", + "state": "directory", + "path": "{{item}}" + } + }, + { + "name": "download", + "become": true, + "become_user": "{{var_wiki_js_user}}", + "ansible.builtin.get_url": { + "url": "https://github.com/Requarks/wiki/releases/latest/download/wiki-js.tar.gz", + "dest": "/tmp/wiki_js.zip" + } + }, + { + "name": "unpack", + "become": true, + "become_user": "{{var_wiki_js_user}}", + "ansible.builtin.unarchive": { + "remote_src": true, + "src": "/tmp/wiki_js.zip", + "dest": "{{var_wiki_js_directory}}" + } + }, + { + "name": "database | sqlite | dirctory", + "when": "var_wiki_js_database_kind == 'sqlite'", + "become": true, + "ansible.builtin.file": { + "path": "{{var_wiki_js_database_data_sqlite_path | dirname}}", + "state": "directory", + "owner": "{{var_wiki_js_user}}" + } + }, + { + "name": "database | sqlite | file", + "when": "var_wiki_js_database_kind == 'sqlite'", + "become": true, + "become_user": "{{var_wiki_js_user}}", + "ansible.builtin.file": { + "path": "{{var_wiki_js_database_data_sqlite_path}}", + "state": "touch" + } + }, + { + "name": "database | sqlite | setup", + "when": "var_wiki_js_database_kind == 'sqlite'", + "become": true, + "become_user": "{{var_wiki_js_user}}", + "ansible.builtin.command": { + "chdir": "{{var_wiki_js_directory}}", + "cmd": "npm rebuild sqlite3" + } + }, + { + "name": "conf | base", + "become": true, + "become_user": "{{var_wiki_js_user}}", + "ansible.builtin.template": { + "src": "config.yml.j2", + "dest": "{{var_wiki_js_directory}}/config.yml" + } + }, + { + "name": "conf | authentication | authelia", + "when": "var_wiki_js_authentication_kind == 'authelia'", + }, + { + "name": "systemd-unit", + "become": true, + "ansible.builtin.template": { + "src": "systemd-unit.j2", + "dest": "/etc/systemd/system/wiki_js.service" + } + }, + { + "name": "apply", + "become": true, + "ansible.builtin.systemd_service": { + "state": "restarted", + "enabled": true, + "name": "wiki_js" + } + } +] diff --git a/roles/wiki_js/templates/config.yml.j2 b/roles/wiki_js/templates/config.yml.j2 new file mode 100644 index 0000000..b52747a --- /dev/null +++ b/roles/wiki_js/templates/config.yml.j2 @@ -0,0 +1,49 @@ +port: {{var_wiki_js_port | string}} + +{% if var_wiki_js_database_kind == 'sqlite' %} +db: + type: sqlite + storage: {{var_wiki_js_database_data_sqlite_path}} +{% endif %} + +{% if var_wiki_js_database_kind == 'postgresql' %} +db: + type: postgres + host: {{var_wiki_js_database_data_postgresql_host}} + port: {{var_wiki_js_database_data_postgresql_port | to_yaml}} + user: {{var_wiki_js_database_data_postgresql_username}} + pass: {{var_wiki_js_database_data_postgresql_password}} + db: {{var_wiki_js_database_data_postgresql_schema}} + ssl: false + # schema: public +{% endif %} + +ssl: + enabled: false + port: 3443 + + # Provider to use, possible values: custom, letsencrypt + provider: custom + + format: pem + key: path/to/key.pem + cert: path/to/cert.pem + pfx: path/to/cert.pfx + passphrase: null + dhparam: null + + domain: wiki.yourdomain.com + subscriberEmail: admin@example.com + +bindIP: 0.0.0.0 + +logLevel: {{var_wiki_js_log_level}} +logFormat: {{var_wiki_js_log_format}} + +offline: false + +ha: {{var_wiki_js_distributed | to_yaml}} + +dataPath: {{var_wiki_js_data_path}} + +bodyParserLimit: 5mb diff --git a/roles/wiki_js/templates/systemd-unit.j2 b/roles/wiki_js/templates/systemd-unit.j2 new file mode 100644 index 0000000..3d6433a --- /dev/null +++ b/roles/wiki_js/templates/systemd-unit.j2 @@ -0,0 +1,14 @@ +[Unit] +Description=Wiki.js +After=network.target + +[Service] +Type=simple +ExecStart=/usr/bin/node server +Restart=always +User={{var_wiki_js_user}} +Environment=NODE_ENV=production +WorkingDirectory={{var_wiki_js_directory}} + +[Install] +WantedBy=multi-user.target diff --git a/roles/wiki_js/vardef.json b/roles/wiki_js/vardef.json new file mode 100644 index 0000000..61ecd9b --- /dev/null +++ b/roles/wiki_js/vardef.json @@ -0,0 +1,106 @@ +{ + "port": { + "mandatory": false, + "type": "integer" + }, + "distributed": { + "mandatory": false, + "type": "boolean" + }, + "user": { + "mandatory": false, + "type": "string" + }, + "directory": { + "mandatory": false, + "type": "string" + }, + "log_level": { + "mandatory": false, + "type": "string", + "options": [ + "error", + "warn", + "info", + "verbose", + "debug", + "silly" + ] + }, + "log_format": { + "mandatory": false, + "type": "string", + "options": [ + "default", + "json" + ] + }, + "data_path": { + "mandatory": false, + "type": "string" + }, + "database_kind": { + "mandatory": false, + "type": "string", + "options": [ + "sqlite", + "postgresql" + ] + }, + "database_data_sqlite_path": { + "mandatory": false, + "type": "string" + }, + "database_data_postgresql_host": { + "mandatory": false, + "type": "string" + }, + "database_data_postgresql_port": { + "mandatory": false, + "type": "integer" + }, + "database_data_postgresql_username": { + "mandatory": false, + "type": "string" + }, + "database_data_postgresql_password": { + "mandatory": false, + "type": "string" + }, + "database_data_postgresql_schema": { + "mandatory": false, + "type": "string" + }, + "authentication_kind": { + "mandatory": false, + "type": "string", + "options": [ + "internal", + "authelia" + ] + }, + "authentication_data_authelia_provider_id": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_provider_name": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_client_id": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_client_secret": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_url_base": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_uuid": { + "type": "string", + "mandatory": false + }, +}