From 704012f888fe6954110423308e0caa4f224ee22a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Fra=C3=9F?= Date: Tue, 2 Jul 2024 00:11:36 +0200 Subject: [PATCH] [fix] role:owncloud --- roles/owncloud/defaults/main.json | 6 +- roles/owncloud/info.md | 4 +- roles/owncloud/tasks/main.json | 11 +- roles/owncloud/templates/env.j2 | 25 +++++ roles/owncloud/templates/ocis.yaml.j2 | 136 ----------------------- roles/owncloud/templates/systemd_unit.j2 | 4 +- roles/owncloud/vardef.json | 40 +++++++ 7 files changed, 81 insertions(+), 145 deletions(-) create mode 100644 roles/owncloud/templates/env.j2 delete mode 100644 roles/owncloud/templates/ocis.yaml.j2 diff --git a/roles/owncloud/defaults/main.json b/roles/owncloud/defaults/main.json index a4e3063..0f5e6df 100644 --- a/roles/owncloud/defaults/main.json +++ b/roles/owncloud/defaults/main.json @@ -3,6 +3,7 @@ "var_owncloud_directory": "/opt/owncloud", "var_owncloud_version": "5.0.0", "var_owncloud_platform": "linux-amd64", + "var_owncloud_domain": "owncloud.example.org", "var_owncloud_admin_password": "REPLACE_ME", "var_owncloud_authentication_kind": "none", "var_owncloud_authentication_data_authelia_url_base": "https://authelia.example.org", @@ -13,8 +14,5 @@ "var_owncloud_authentication_data_authelia_android_client_id": "owncloud_android", "var_owncloud_authentication_data_authelia_android_client_secret": "REPLACE_ME", "var_owncloud_authentication_data_authelia_ios_client_id": "owncloud_ios", - "var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME", - "var_owncloud_bind_password": "XJY1n3yakq.ko8fO&Ysl3YBiCMslIMd4", - "var_owncloud_account_id": "a2b6ad84-a728-44d3-bc4c-07f8b275d7ba", - "var_owncloud_account_secret": "7ivhMgFMakmZeGdhgne5rMUi*.1FVy4A" + "var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME" } diff --git a/roles/owncloud/info.md b/roles/owncloud/info.md index 9bfee3e..c81bd53 100644 --- a/roles/owncloud/info.md +++ b/roles/owncloud/info.md @@ -5,9 +5,11 @@ Cloud-Plattform [ownCloud](https://owncloud.com/) (the rewrite in Go named "Infi ## Verweise -- [GitHub | ocis](https://github.com/rhafer/ocis/) - [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/) - [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/) +- [ownCloud-Dokumentation | Service | Proxy](https://doc.owncloud.com/ocis/next/deployment/services/s-list/proxy.html) +- [ownCloud-Dokumentation | Service | Web](https://doc.owncloud.com/ocis/next/deployment/services/s-list/web.html) +- [GitHub | ocis](https://github.com/owncloud/ocis/) ## ToDo diff --git a/roles/owncloud/tasks/main.json b/roles/owncloud/tasks/main.json index f7c8c3b..5c63d19 100644 --- a/roles/owncloud/tasks/main.json +++ b/roles/owncloud/tasks/main.json @@ -24,7 +24,16 @@ "become_user": "{{var_owncloud_user}}", "ansible.builtin.shell": { "chdir": "{{var_owncloud_directory}}", - "cmd": "./ocis --insecure no --admin-password={{var_owncloud_admin_password}}" + "cmd": "./ocis init --insecure no --admin-password={{var_owncloud_admin_password}}" + } + }, + { + "name": "configuration", + "become": true, + "become_user": "{{var_owncloud_user}}", + "ansible.builtin.template": { + "src": "env.j2", + "dest": "{{var_owncloud_directory}}/.env" } }, { diff --git a/roles/owncloud/templates/env.j2 b/roles/owncloud/templates/env.j2 new file mode 100644 index 0000000..3b3b194 --- /dev/null +++ b/roles/owncloud/templates/env.j2 @@ -0,0 +1,25 @@ +OCIS_URL="{{var_owncloud_domain}}" +OCIS_INSECURE="false" + +PROXY_TLS="false" + +{% if var_owncloud_authentication_kind != 'none' %} +PROXY_AUTOPROVISION_ACCOUNTS="false" +{% endif %} + +{% if var_owncloud_authentication_kind == 'authelia' %} +OCIS_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}" +OCIS_OIDC_ISSUER="{{var_owncloud_authentication_data_authelia_url_base}}" + +PROXY_AUTOPROVISION_ACCOUNTS="true" +PROXY_OIDC_REWRITE_WELLKNOWN="true" +PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD="none" +PROXY_OIDC_INSECURE="false" +PROXY_USER_OIDC_CLAIM="name" +PROXY_USER_CS3_CLAIM="username" + +WEB_OIDC_AUTHORITY="{{var_owncloud_authentication_data_authelia_url_base}}" +WEB_OIDC_METADATA_URL="{{var_owncloud_authentication_data_authelia_url_base}}/.well-known/openid-configuration" +WEB_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}" +WEB_OIDC_SCOPE="openid profile email groups" +{% endif %} diff --git a/roles/owncloud/templates/ocis.yaml.j2 b/roles/owncloud/templates/ocis.yaml.j2 deleted file mode 100644 index 89254ff..0000000 --- a/roles/owncloud/templates/ocis.yaml.j2 +++ /dev/null @@ -1,136 +0,0 @@ -token_manager: - jwt_secret: cv95NuKbq9zKlbmE-5H6fv*A2gRqzY1y -machine_auth_api_key: BgY2%q1L2BwQTxqJpaWfbjHWzl@QAHGA -system_user_api_key: kGnoApWytP%Bt&kn!H2nAMOBqZhKM!f3 -transfer_secret: X8THQbAA-rFfTskAaZdf936vnd9UpodR -system_user_id: 2c56ae2c-881f-49a8-827b-c804d8ccb962 -admin_user_id: 253c3a04-5bb2-46de-bd4a-6d19dbbb50da -graph: - application: - id: 5251ba75-4a4f-4713-bed0-18ddb5328793 - events: - tls_insecure: true - spaces: - insecure: true - identity: - ldap: - bind_password: jqwCl3ix*wexA^SOIg=wiRF#&DIfezAf - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -idp: - ldap: - bind_password: BYd$k0lmb=.=T7NOGk.$^XKYKY13kHbh -idm: - service_user_passwords: - admin_password: foobar - idm_password: jqwCl3ix*wexA^SOIg=wiRF#&DIfezAf - reva_password: {{var_owncloud_bind_password}} - idp_password: BYd$k0lmb=.=T7NOGk.$^XKYKY13kHbh -proxy: - oidc: -{% if var_owncloud_authentication_kind == 'none' %} - insecure: true -{% endif %} -{% if var_owncloud_authentication_kind == 'authelia' %} - insecure: false - issuer: "{{var_owncloud_authentication_data_authelia_url_base}}" - access_token_verify_method: none - rewrite_wellknown: true -{% endif %} - user: - oidc: - claim: preferred_username - insecure_backends: true - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -frontend: - app_handler: - insecure: true - archiver: - insecure: true - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -auth_basic: - auth_providers: - ldap: - bind_password: {{var_owncloud_bind_password}} -auth_bearer: - auth_providers: - oidc: - insecure: true -users: - drivers: - ldap: - bind_password: {{var_owncloud_bind_password}} -groups: - drivers: - ldap: - bind_password: {{var_owncloud_bind_password}} -ocdav: - insecure: true -ocm: - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -thumbnails: - thumbnail: - transfer_secret: vEycSxTtr+4kqQBx1XLM9db*2Ac4v5l# - webdav_allow_insecure: true - cs3_allow_insecure: true -search: - events: - tls_insecure: true - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -audit: - events: - tls_insecure: true -settings: - service_account_ids: - - {{var_owncloud_account_id}} -sharing: - events: - tls_insecure: true -storage_users: - events: - tls_insecure: true - mount_id: 7762e662-d016-4d2d-a353-28e439270b46 - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -notifications: - notifications: - events: - tls_insecure: true - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -nats: - nats: - tls_skip_verify_client_cert: true -gateway: - storage_registry: - storage_users_mount_id: 7762e662-d016-4d2d-a353-28e439270b46 -userlog: - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -auth_service: - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -clientlog: - service_account: - service_account_id: {{var_owncloud_account_id}} - service_account_secret: {{var_owncloud_account_secret}} -web: -{% if var_owncloud_authentication_kind == 'authelia' %} - oidc: - client_id: "{{var_owncloud_authentication_data_authelia_web_client_id}}" - client_secret: "{{var_owncloud_authentication_data_authelia_web_client_secret}}" - scope: "openid profile email groups" -{% endif %} diff --git a/roles/owncloud/templates/systemd_unit.j2 b/roles/owncloud/templates/systemd_unit.j2 index 46203ff..7e43971 100644 --- a/roles/owncloud/templates/systemd_unit.j2 +++ b/roles/owncloud/templates/systemd_unit.j2 @@ -4,9 +4,7 @@ After=network.target [Service] WorkingDirectory={{var_owncloud_directory}} -{% if var_owncloud_authentication_kind == 'authelia' %} -Environment="OCIS_OIDC_ISSUER='{{var_owncloud_authentication_data_authelia_url_base}}'" -{% endif %} +EnvironmentFile={{var_owncloud_directory}}/.env ExecStart={{var_owncloud_directory}}/ocis server Type=simple Restart=always diff --git a/roles/owncloud/vardef.json b/roles/owncloud/vardef.json index 2940d4a..0fe8404 100644 --- a/roles/owncloud/vardef.json +++ b/roles/owncloud/vardef.json @@ -15,6 +15,10 @@ "type": "string", "mandatory": false }, + "domain": { + "type": "string", + "mandatory": false + }, "admin_password": { "type": "string", "mandatory": true @@ -26,5 +30,41 @@ "none", "authelia" ] + }, + "authentication_data_authelia_url_base": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_web_client_id": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_web_client_secret": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_desktop_client_id": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_desktop_client_secret": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_android_client_id": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_android_client_secret": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_ios_client_id": { + "type": "string", + "mandatory": false + }, + "authentication_data_authelia_ios_client_secret": { + "type": "string", + "mandatory": false } }