misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

[add] role:authelia-for-owncloud [add] owncloud [add] owncloud-and-nginx

Browse source
This commit is contained in:
roydfalk 2024-06-27 19:07:58 +02:00
parent 0b303849a8
commit 6c8b3d1b08
16 changed files with 428 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
roles/authelia-for-owncloud/defaults/main.json Normal file
View file

@ -0,0 +1,11 @@
{
"var_authelia_for_owncloud_owncloud_url_base": "https://owncloud.example.org",
"var_authelia_for_owncloud_web_client_id": "owncloud_web",
"var_authelia_for_owncloud_web_client_secret": "REPLACE_ME",
"var_authelia_for_owncloud_desktop_client_id": "owncloud_desktop",
"var_authelia_for_owncloud_desktop_client_secret": "REPLACE_ME",
"var_authelia_for_owncloud_android_client_id": "owncloud_android",
"var_authelia_for_owncloud_android_client_secret": "REPLACE_ME",
"var_authelia_for_owncloud_ios_client_id": "owncloud_ios",
"var_authelia_for_owncloud_ios_client_secret": "REPLACE_ME"
}

9
roles/authelia-for-owncloud/info.md Normal file
View file

@ -0,0 +1,9 @@
## Beschreibung
Um [ownCloud](../owncloud) gegen [Authelia](../authelia) authentifizieren zu lassen
## Verweise
- [Authelia-Dokumentation | ownCloud Infinite Scale Integration](https://www.authelia.com/integration/openid-connect/ocis/)
- [Helge Klein | SSO via Authelia: ownCloud OpenID Connect Authentication](https://helgeklein.com/blog/owncloud-infinite-scale-with-openid-connect-authentication-for-home-networks/#sso-via-authelia-owncloud-openid-connect-authentication)

31
roles/authelia-for-owncloud/tasks/main.json Normal file
View file

@ -0,0 +1,31 @@
[
{
"name": "configuration | emplace",
"become": true,
"loop": [
{"src": "authelia-client-conf-web.json.j2", "dest": "/etc/authelia/conf.d/clients/owncloud-web.json"},
{"src": "authelia-client-conf-desktop.json.j2", "dest": "/etc/authelia/conf.d/clients/owncloud-desktop.json"},
{"src": "authelia-client-conf-android.json.j2", "dest": "/etc/authelia/conf.d/clients/owncloud-android.json"},
{"src": "authelia-client-conf-ios.json.j2", "dest": "/etc/authelia/conf.d/clients/owncloud-ios.json"}
],
"ansible.builtin.template": {
"src": "{{item.src}}",
"dest": "{{item.dest}}"
}
},
{
"name": "configuration | apply",
"become": true,
"ansible.builtin.command": {
"cmd": "/usr/bin/authelia-conf-compose"
}
},
{
"name": "restart service",
"become": true,
"ansible.builtin.systemd_service": {
"state": "restarted",
"name": "authelia"
}
}
]

15
roles/authelia-for-owncloud/templates/authelia-client-conf-android.json.j2 Normal file
View file

@ -0,0 +1,15 @@
{
"client_id": "{{var_authelia_for_owncloud_android_client_id}}",
"client_secret": "{{var_authelia_for_owncloud_android_client_secret}}",
"client_name": "ownCloud Android app",
"scopes": [
"openid",
"groups",
"profile",
"email",
"offline_access"
],
"redirect_uris": [
"oc://android.owncloud.com"
]
}

16
roles/authelia-for-owncloud/templates/authelia-client-conf-desktop.json.j2 Normal file
View file

@ -0,0 +1,16 @@
{
"client_id": "{{var_authelia_for_owncloud_desktop_client_id}}",
"client_secret": "{{var_authelia_for_owncloud_desktop_client_secret}}",
"client_name": "ownCloud desktop client",
"scopes": [
"openid",
"groups",
"profile",
"email",
"offline_access"
],
"redirect_uris": [
"http://127.0.0.1",
"http://localhost"
]
}

16
roles/authelia-for-owncloud/templates/authelia-client-conf-ios.json.j2 Normal file
View file

@ -0,0 +1,16 @@
{
"client_id": "{{var_authelia_for_owncloud_ios_client_id}}",
"client_secret": "{{var_authelia_for_owncloud_ios_client_secret}}",
"client_name": "ownCloud iOS app",
"scopes": [
"openid",
"groups",
"profile",
"email",
"offline_access"
],
"redirect_uris": [
"oc://ios.owncloud.com",
"oc.ios://ios.owncloud.com"
]
}

11
roles/authelia-for-owncloud/templates/authelia-client-conf-web.json.j2 Normal file
View file

@ -0,0 +1,11 @@
{
"client_id": "{{var_authelia_for_owncloud_web_client_id}}",
"client_secret": "{{var_authelia_for_owncloud_web_client_secret}}",
"client_name": "ownCloud Infinite Scale",
"public": true,
"redirect_uris": [
"{{var_authelia_for_owncloud_owncloud_url_base}}",
"{{var_authelia_for_owncloud_owncloud_url_base}}/oidc-callback.html",
"{{var_authelia_for_owncloud_owncloud_url_base}}/oidc-silent-redirect.html"
]
}

3
roles/owncloud-and-nginx/defaults/main.json Normal file
View file

@ -0,0 +1,3 @@
{
"var_owncloud_and_nginx_domain": "owncloud.example.org"
}

35
roles/owncloud-and-nginx/tasks/main.json Normal file
View file

@ -0,0 +1,35 @@
[
{
"name": "deactivate default site",
"become": true,
"ansible.builtin.file": {
"state": "absent",
"dest": "/etc/nginx/sites-enabled/default"
}
},
{
"name": "emplace configuration | data",
"become": true,
"ansible.builtin.template": {
"src": "conf.j2",
"dest": "/etc/nginx/sites-available/{{var_owncloud_and_nginx_domain}}"
}
},
{
"name": "emplace configuration | link",
"become": true,
"ansible.builtin.file": {
"state": "link",
"src": "/etc/nginx/sites-available/{{var_owncloud_and_nginx_domain}}",
"dest": "/etc/nginx/sites-enabled/{{var_owncloud_and_nginx_domain}}"
}
},
{
"name": "restart nginx",
"become": true,
"ansible.builtin.systemd_service": {
"state": "restarted",
"name": "nginx"
}
}
]

16
roles/owncloud-and-nginx/templates/conf.j2 Normal file
View file

@ -0,0 +1,16 @@
server {
listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
server_name {{var_owncloud_and_nginx_domain}};
ssl_certificate /etc/ssl/fullchains/{{var_owncloud_and_nginx_domain}}.pem;
ssl_certificate_key /etc/ssl/private/{{var_owncloud_and_nginx_domain}}.pem;
include /etc/nginx/ssl-hardening.conf;
location / {
proxy_pass http://localhost:9200;
}
}

20
roles/owncloud/defaults/main.json Normal file
View file

@ -0,0 +1,20 @@
{
"var_owncloud_user": "owncloud",
"var_owncloud_directory": "/opt/owncloud",
"var_owncloud_version": "5.0.0",
"var_owncloud_platform": "linux-amd64",
"var_owncloud_admin_password": "REPLACE_ME",
"var_owncloud_authentication_kind": "none",
"var_owncloud_authentication_data_authelia_url_base": "https://authelia.example.org",
"var_owncloud_authentication_data_authelia_web_client_id": "owncloud_web",
"var_owncloud_authentication_data_authelia_web_client_secret": "REPLACE_ME",
"var_owncloud_authentication_data_authelia_desktop_client_id": "owncloud_desktop",
"var_owncloud_authentication_data_authelia_desktop_client_secret": "REPLACE_ME",
"var_owncloud_authentication_data_authelia_android_client_id": "owncloud_android",
"var_owncloud_authentication_data_authelia_android_client_secret": "REPLACE_ME",
"var_owncloud_authentication_data_authelia_ios_client_id": "owncloud_ios",
"var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME",
"var_owncloud_bind_password": "XJY1n3yakq.ko8fO&Ysl3YBiCMslIMd4",
"var_owncloud_account_id": "a2b6ad84-a728-44d3-bc4c-07f8b275d7ba",
"var_owncloud_account_secret": "7ivhMgFMakmZeGdhgne5rMUi*.1FVy4A"
}

15
roles/owncloud/info.md Normal file
View file

@ -0,0 +1,15 @@
## Beschreibung
Cloud-Plattform [ownCloud](https://owncloud.com/) (the rewrite in Go named "Infinite Scale")
## Verweise
- [GitHub | ocis](https://github.com/rhafer/ocis/)
- [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/)
- [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/)
## ToDo
- Downlowd prüfen

47
roles/owncloud/tasks/main.json Normal file
View file

@ -0,0 +1,47 @@
[
{
"name": "user",
"become": true,
"ansible.builtin.user": {
"name": "{{var_owncloud_user}}",
"create_home": true,
"home": "{{var_owncloud_directory}}"
}
},
{
"name": "download",
"become": true,
"become_user": "{{var_owncloud_user}}",
"ansible.builtin.get_url": {
"url": "https://download.owncloud.com/ocis/ocis/stable/{{var_owncloud_version}}/ocis-{{var_owncloud_version}}-{{var_owncloud_platform}}",
"dest": "{{var_owncloud_directory}}/ocis",
"mode": "u+rx"
}
},
{
"name": "setup",
"become": true,
"become_user": "{{var_owncloud_user}}",
"ansible.builtin.shell": {
"chdir": "{{var_owncloud_directory}}",
"cmd": "./ocis --insecure no --admin-password={{var_owncloud_admin_password}}"
}
},
{
"name": "systemd unit",
"become": true,
"ansible.builtin.template": {
"src": "systemd_unit.j2",
"dest": "/etc/systemd/system/owncloud.service"
}
},
{
"name": "run",
"become": true,
"ansible.builtin.systemd_service": {
"name": "owncloud",
"enabled": true,
"state": "restarted"
}
}
]

136
roles/owncloud/templates/ocis.yaml.j2 Normal file
View file

@ -0,0 +1,136 @@
token_manager:
jwt_secret: cv95NuKbq9zKlbmE-5H6fv*A2gRqzY1y
machine_auth_api_key: BgY2%q1L2BwQTxqJpaWfbjHWzl@QAHGA
system_user_api_key: kGnoApWytP%Bt&kn!H2nAMOBqZhKM!f3
transfer_secret: X8THQbAA-rFfTskAaZdf936vnd9UpodR
system_user_id: 2c56ae2c-881f-49a8-827b-c804d8ccb962
admin_user_id: 253c3a04-5bb2-46de-bd4a-6d19dbbb50da
graph:
application:
id: 5251ba75-4a4f-4713-bed0-18ddb5328793
events:
tls_insecure: true
spaces:
insecure: true
identity:
ldap:
bind_password: jqwCl3ix*wexA^SOIg=wiRF#&DIfezAf
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
idp:
ldap:
bind_password: BYd$k0lmb=.=T7NOGk.$^XKYKY13kHbh
idm:
service_user_passwords:
admin_password: foobar
idm_password: jqwCl3ix*wexA^SOIg=wiRF#&DIfezAf
reva_password: {{var_owncloud_bind_password}}
idp_password: BYd$k0lmb=.=T7NOGk.$^XKYKY13kHbh
proxy:
oidc:
{% if var_owncloud_authentication_kind == 'none' %}
insecure: true
{% endif %}
{% if var_owncloud_authentication_kind == 'authelia' %}
insecure: false
issuer: "{{var_owncloud_authentication_data_authelia_url_base}}"
access_token_verify_method: none
rewrite_wellknown: true
{% endif %}
user:
oidc:
claim: preferred_username
insecure_backends: true
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
frontend:
app_handler:
insecure: true
archiver:
insecure: true
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
auth_basic:
auth_providers:
ldap:
bind_password: {{var_owncloud_bind_password}}
auth_bearer:
auth_providers:
oidc:
insecure: true
users:
drivers:
ldap:
bind_password: {{var_owncloud_bind_password}}
groups:
drivers:
ldap:
bind_password: {{var_owncloud_bind_password}}
ocdav:
insecure: true
ocm:
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
thumbnails:
thumbnail:
transfer_secret: vEycSxTtr+4kqQBx1XLM9db*2Ac4v5l#
webdav_allow_insecure: true
cs3_allow_insecure: true
search:
events:
tls_insecure: true
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
audit:
events:
tls_insecure: true
settings:
service_account_ids:
- {{var_owncloud_account_id}}
sharing:
events:
tls_insecure: true
storage_users:
events:
tls_insecure: true
mount_id: 7762e662-d016-4d2d-a353-28e439270b46
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
notifications:
notifications:
events:
tls_insecure: true
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
nats:
nats:
tls_skip_verify_client_cert: true
gateway:
storage_registry:
storage_users_mount_id: 7762e662-d016-4d2d-a353-28e439270b46
userlog:
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
auth_service:
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
clientlog:
service_account:
service_account_id: {{var_owncloud_account_id}}
service_account_secret: {{var_owncloud_account_secret}}
web:
{% if var_owncloud_authentication_kind == 'authelia' %}
oidc:
client_id: "{{var_owncloud_authentication_data_authelia_web_client_id}}"
client_secret: "{{var_owncloud_authentication_data_authelia_web_client_secret}}"
scope: "openid profile email groups"
{% endif %}

17
roles/owncloud/templates/systemd_unit.j2 Normal file
View file

@ -0,0 +1,17 @@
[Unit]
Description=ownCloud
After=network.target
[Service]
WorkingDirectory={{var_owncloud_directory}}
{% if var_owncloud_authentication_kind == 'authelia' %}
Environment="OCIS_OIDC_ISSUER='{{var_owncloud_authentication_data_authelia_url_base}}'"
{% endif %}
ExecStart={{var_owncloud_directory}}/ocis server
Type=simple
Restart=always
User={{var_owncloud_user}}
[Install]
WantedBy=default.target
RequiredBy=network.target

30
roles/owncloud/vardef.json Normal file
View file

@ -0,0 +1,30 @@
{
"user": {
"type": "string",
"mandatory": false
},
"directory": {
"type": "string",
"mandatory": false
},
"version": {
"type": "string",
"mandatory": false
},
"platform": {
"type": "string",
"mandatory": false
},
"admin_password": {
"type": "string",
"mandatory": true
},
"authentication_kind": {
"type": "string",
"mandatory": false,
"options": [
"none",
"authelia"
]
}
}