Merge branch 'dev-vikunja' into 'main'

Vikunja

See merge request roydfalk/ansible-base!8

roles/authelia-for-vikunja/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_authelia_for_vikunja_vikunja_url_base": "https://vikunja.example.org",
+	"var_authelia_for_vikunja_client_id": "vikunja",
+	"var_authelia_for_vikunja_client_secret": "REPLACE_ME"
+}

roles/authelia-for-vikunja/info.md

@@ -0,0 +1,10 @@
+## Beschreibung
+
+Um [Vikunja](../vikunja) gegen [Authelia](../authelia) authentifizieren zu lassen
+
+
+## Verweise
+
+- [Vikunja-Dokumentation | OpenID](https://vikunja.io/docs/openid/)
+- [Vikunja-Dokumentation | OpenID example configurations for Authelia](https://vikunja.io/docs/openid-example-configurations/#authelia)
+- [Authelia-Dokumentation | Vikunja Integration](https://www.authelia.com/integration/openid-connect/vikunja/)

roles/authelia-for-vikunja/tasks/main.json

@@ -0,0 +1,25 @@
+[
+	{
+		"name": "configuration | emplace",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "authelia-client-conf.json.j2",
+			"dest": "/etc/authelia/conf.d/clients/vikunja.json"
+		}
+	},
+	{
+		"name": "configuration | apply",
+		"become": true,
+		"ansible.builtin.command": {
+			"cmd": "/usr/bin/authelia-conf-compose"
+		}
+	},
+	{
+		"name": "restart service",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "authelia"
+		}
+	}
+]

roles/authelia-for-vikunja/templates/authelia-client-conf.json.j2

@@ -0,0 +1,17 @@
+{
+	"client_id": "{{var_authelia_for_vikunja_client_id}}",
+	"client_secret": "{{var_authelia_for_vikunja_client_secret}}",
+	"client_name": "Vikunja",
+	"public": false,
+	"authorization_policy": "one_factor",
+	"redirect_uris": [
+		"{{var_authelia_for_vikunja_vikunja_url_base}}/auth/openid/authelia"
+	],
+	"scopes": [
+		"openid",
+		"email",
+		"profile"
+	],
+	"userinfo_signed_response_alg": "none",
+	"token_endpoint_auth_method": "client_secret_basic"
+}

roles/postgresql-for-vikunja/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_postgresql_for_vikunja_username": "vikunja_user",
+	"var_postgresql_for_vikunja_password": "REPLACE_ME",
+	"var_postgresql_for_vikunja_schema": "vikunja"
+}

roles/postgresql-for-vikunja/tasks/main.json

@@ -0,0 +1,49 @@
+[
+	{
+		"name": "packages",
+		"become": true,
+		"ansible.builtin.apt": {
+			"update_cache": true,
+			"pkg": [
+				"acl",
+				"python3-psycopg2"
+			]
+		}
+	},
+	{
+		"name": "user",
+		"become": true,
+		"become_user": "postgres",
+		"community.postgresql.postgresql_user": {
+			"state": "present",
+			"name": "{{var_postgresql_for_vikunja_username}}",
+			"password": "{{var_postgresql_for_vikunja_password}}"
+		},
+		"environment": {
+			"PGOPTIONS": "-c password_encryption=scram-sha-256"
+		}
+	},
+	{
+		"name": "schema",
+		"become": true,
+		"become_user": "postgres",
+		"community.postgresql.postgresql_db": {
+			"state": "present",
+			"name": "{{var_postgresql_for_vikunja_schema}}",
+			"owner": "{{var_postgresql_for_vikunja_username}}"
+		}
+	},
+	{
+		"name": "rights",
+		"become": true,
+		"become_user": "postgres",
+		"community.postgresql.postgresql_privs": {
+			"state": "present",
+			"db": "{{var_postgresql_for_vikunja_schema}}",
+			"objs": "ALL_IN_SCHEMA",
+			"roles": "{{var_postgresql_for_vikunja_username}}",
+			"privs": "ALL",
+			"grant_option": true
+		}
+	}
+]

roles/vikunja-and-nginx/defaults/main.json

@@ -0,0 +1,3 @@
+{
+	"var_vikunja_and_nginx_domain": "vikunja.example.org"
+}

roles/vikunja-and-nginx/info.md

@@ -0,0 +1,3 @@
+## Verweise
+
+- [Vikunja-Dokumentation](https://vikunja.io/docs/reverse-proxy/#nginx)

roles/vikunja-and-nginx/tasks/main.json

@@ -0,0 +1,35 @@
+[
+	{
+		"name": "deactivate default site",
+		"become": true,
+		"ansible.builtin.file": {
+			"state": "absent",
+			"dest": "/etc/nginx/sites-enabled/default"
+		}
+	},
+	{
+		"name": "emplace configuration | data",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "conf.j2",
+			"dest": "/etc/nginx/sites-available/{{var_vikunja_and_nginx_domain}}"
+		}
+	},
+	{
+		"name": "emplace configuration | link",
+		"become": true,
+		"ansible.builtin.file": {
+			"state": "link",
+			"src": "/etc/nginx/sites-available/{{var_vikunja_and_nginx_domain}}",
+			"dest": "/etc/nginx/sites-enabled/{{var_vikunja_and_nginx_domain}}"
+		}
+	},
+	{
+		"name": "restart nginx",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "nginx"
+		}
+	}
+]

roles/vikunja-and-nginx/templates/conf.j2

@@ -0,0 +1,17 @@
+server {
+	listen 80;
+	listen [::]:80;
+	listen 443 ssl;
+	listen [::]:443 ssl;
+	
+	server_name {{var_vikunja_and_nginx_domain}};
+	
+	ssl_certificate /etc/ssl/fullchains/{{var_vikunja_and_nginx_domain}}.pem;
+	ssl_certificate_key /etc/ssl/private/{{var_vikunja_and_nginx_domain}}.pem;
+	include /etc/nginx/ssl-hardening.conf;
+	
+	location / {
+		proxy_pass http://localhost:3456;
+		client_max_body_size 20M;
+	}
+}

roles/vikunja/defaults/main.json

@@ -0,0 +1,30 @@
+{
+	"var_vikunja_version": "0.23.0",
+	"var_vikunja_architecture": "amd64",
+	"var_vikunja_domain": "vikunja.example.org",
+	"var_vikunja_directory": "/opt/vikunja",
+	"var_vikunja_user": "vikunja",
+	"var_vikunja_timezone": "Europe/Berlin",
+	"var_vikunja_default_language": "de",
+	"var_vikunja_database_kind": "sqlite",
+	"var_vikunja_database_data_sqlite_path": "data.sqlite",
+	"var_vikunja_database_data_postgresql_host": "postgresql.example.org",
+	"var_vikunja_database_data_postgresql_port": 5432,
+	"var_vikunja_database_data_postgresql_username": "vikunja_user",
+	"var_vikunja_database_data_postgresql_password": "REPLACE_ME",
+	"var_vikunja_database_data_postgresql_schema": "vikunja",
+	"var_vikunja_authentication_kind": "internal",
+	"var_vikunja_authentication_data_authelia_provider_id": "authelia",
+	"var_vikunja_authentication_data_authelia_provider_name": "Authelia",
+	"var_vikunja_authentication_data_authelia_client_id": "vikunja",
+	"var_vikunja_authentication_data_authelia_client_secret": "REPLACE_ME",
+	"var_vikunja_authentication_data_authelia_url_base": "https://authelia.example.org",
+	"var_vikunja_mail_sending_enabled": true,
+	"var_vikunja_mail_sending_smtp_host": "smtp.example.org",
+	"var_vikunja_mail_sending_smtp_port": 587,
+	"var_vikunja_mail_sending_smtp_authtype": "plain",
+	"var_vikunja_mail_sending_smtp_force_tls": false,
+	"var_vikunja_mail_sending_smtp_username": "REPLACE_ME",
+	"var_vikunja_mail_sending_smtp_password": "REPLACE_ME",
+	"var_vikunja_mail_sending_sender": "vikunja@example.org"
+}

roles/vikunja/info.md

@@ -0,0 +1,9 @@
+## Beschreibung
+
+- Einrichtung der Aufgaben-Verwaltung [Vikunja](https://vikunja.io/)
+
+
+## Verweise
+
+- [git-Repository](https://kolaente.dev/vikunja/vikunja)
+- [Konfiguration](https://vikunja.io/docs/config-options/)

roles/vikunja/tasks/main.json

@@ -0,0 +1,65 @@
+[
+	{
+		"name": "user",
+		"ansible.builtin.user": {
+			"name": "{{var_vikunja_user}}",
+			"create_home": true,
+			"home": "{{var_vikunja_directory}}"
+		}
+	},
+	{
+		"name": "download",
+		"become": true,
+		"become_user": "{{var_vikunja_user}}",
+		"ansible.builtin.get_url": {
+			"url": "https://dl.vikunja.io/vikunja/{{var_vikunja_version}}/vikunja-v{{var_vikunja_version}}-linux-{{var_vikunja_architecture}}-full.zip",
+			"dest": "/tmp/vikunja.zip"
+		}
+	},
+	{
+		"name": "unpack",
+		"become": true,
+		"become_user": "{{var_vikunja_user}}",
+		"ansible.builtin.unarchive": {
+			"remote_src": true,
+			"src": "/tmp/vikunja.zip",
+			"dest": "{{var_vikunja_directory}}"
+		}
+	},
+	{
+		"name": "link",
+		"become": true,
+		"become_user": "{{var_vikunja_user}}",
+		"ansible.builtin.file": {
+			"state": "link",
+			"src": "{{var_vikunja_directory}}/vikunja-v{{var_vikunja_version}}-linux-{{var_vikunja_architecture}}",
+			"dest": "{{var_vikunja_directory}}/vikunja"
+		}
+	},
+	{
+		"name": "conf",
+		"become": true,
+		"become_user": "{{var_vikunja_user}}",
+		"ansible.builtin.template": {
+			"src": "config.json.j2",
+			"dest": "{{var_vikunja_directory}}/config.json"
+		}
+	},
+	{
+		"name": "systemd-unit",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "systemd-unit.j2",
+			"dest": "/etc/systemd/system/vikunja.service"
+		}
+	},
+	{
+		"name": "apply",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"enabled": true,
+			"name": "vikunja"
+		}
+	}
+]

roles/vikunja/templates/config.json.j2

@@ -0,0 +1,63 @@
+{
+	"service": {
+		"publicurl": "https://{{var_vikunja_domain}}",
+		"rootpath": "{{var_vikunja_directory}}",
+		"timezone": "{{var_vikunja_timezone}}"
+	},
+	"defaultsettings": {
+		"language": "{{var_vikunja_default_language}}",
+		"timezone": "{{var_vikunja_timezone}}"
+	},
+	"database": {
+{% if var_vikunja_database_kind == 'sqlite' %}
+		"type": "sqlite",
+		"path": "{{var_vikunja_database_data_sqlite_path}}"
+{% endif %}
+{% if var_vikunja_database_kind == 'postgresql' %}
+		"type": "postgres",
+		"host": "{{var_vikunja_database_data_postgresql_host}}",
+		"port": {{var_vikunja_database_data_postgresql_port | string}},
+		"user": "{{var_vikunja_database_data_postgresql_username}}",
+		"password": "{{var_vikunja_database_data_postgresql_password}}",
+		"database": "{{var_vikunja_database_data_postgresql_schema}}"
+{% endif %}
+	},
+	"auth": {
+{% if var_vikunja_authentication_kind == 'internal' %}
+		"local": {
+			"enabled": true
+		},
+		"openid": {
+			"enabled": false
+		}
+{% endif %}
+{% if var_vikunja_authentication_kind == 'authelia' %}
+		"local": {
+			"enabled": false
+		},
+		"openid": {
+			"enabled": true,
+			"redirecturl": "https://{{var_vikunja_domain}}/auth/openid/",
+			"providers": [
+				{
+					"name": "Authelia",
+					"authurl": "{{var_vikunja_authentication_data_authelia_url_base}}",
+					"clientid": "{{var_vikunja_authentication_data_authelia_client_id}}",
+					"clientsecret": "{{var_vikunja_authentication_data_authelia_client_secret}}",
+					"scope": "openid profile email"
+				}
+			]
+		}
+{% endif %}
+	},
+	"mailer": {
+		"enabled": {{var_vikunja_mail_sending_enabled | to_json}},
+		"host": "{{var_vikunja_mail_sending_smtp_host}}",
+		"port": {{var_vikunja_mail_sending_smtp_port | string}},
+		"autthtype": "{{var_vikunja_mail_sending_smtp_authtype}}",
+		"username": "{{var_vikunja_mail_sending_smtp_username}}",
+		"password": "{{var_vikunja_mail_sending_smtp_password}}",
+		"fromemail": "{{var_vikunja_mail_sending_sender}}",
+		"forcessl": {{var_vikunja_mail_sending_smtp_force_tls | to_json}}
+	}
+}

roles/vikunja/templates/systemd-unit.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Vikunja
+After=syslog.target
+After=network.target
+
+[Service]
+User={{var_vikunja_user}}
+Group={{var_vikunja_user}}
+RestartSec=2s
+Type=simple
+WorkingDirectory={{var_vikunja_directory}}
+ExecStart=/usr/bin/vikunja
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

roles/vikunja/vardef.json

@@ -0,0 +1,123 @@
+{
+	"version": {
+		"type": "string",
+		"mandatory": false
+	},
+	"architecture": {
+		"type": "string",
+		"mandatory": false
+	},
+	"domain": {
+		"type": "string",
+		"mandatory": false
+	},
+	"directory": {
+		"type": "string",
+		"mandatory": false
+	},
+	"user": {
+		"type": "string",
+		"mandatory": false
+	},
+	"timezone": {
+		"type": "string",
+		"mandatory": false
+	},
+	"default_language": {
+		"type": "string",
+		"mandatory": false,
+		"description": "ISO 639-1"
+	},
+	"database_kind": {
+		"type": "string",
+		"mandatory": false,
+		"options": [
+			"sqlite",
+			"postgresql"
+		]
+	},
+	"database_data_sqlite_path": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_data_postgresql_host": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_data_postgresql_port": {
+		"type": "integer",
+		"mandatory": false
+	},
+	"database_data_postgresql_username": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_data_postgresql_password": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_data_postgresql_schema": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_kind": {
+		"type": "string",
+		"mandatory": false,
+		"options": [
+			"internal",
+			"authelia"
+		]
+	},
+	"authentication_data_authelia_provider_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_provider_name": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_client_secret": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_url_base": {
+		"type": "string",
+		"mandatory": false
+	},
+	"mail_sending_enabled": {
+		"type": "string",
+		"mandatory": false
+	},
+	"mail_sending_smtp_host": {
+		"type": "string",
+		"mandatory": false
+	},
+	"mail_sending_smtp_port": {
+		"type": "integer",
+		"mandatory": false
+	},
+	"mail_sending_smtp_authtype": {
+		"type": "string",
+		"mandatory": false
+	},
+	"mail_sending_smtp_force_tls": {
+		"type": "boolean",
+		"mandatory": false
+	},
+	"mail_sending_smtp_username": {
+		"type": "string",
+		"mandatory": false
+	},
+	"mail_sending_smtp_password": {
+		"type": "string",
+		"mandatory": false
+	},
+	"mail_sending_sender": {
+		"type": "string",
+		"mandatory": false
+	}
+}