[fix] role:owncloud

roles/owncloud/defaults/main.json

@@ -3,6 +3,7 @@
 	"var_owncloud_directory": "/opt/owncloud",
 	"var_owncloud_version": "5.0.0",
 	"var_owncloud_platform": "linux-amd64",
+	"var_owncloud_domain": "owncloud.example.org",
 	"var_owncloud_admin_password": "REPLACE_ME",
 	"var_owncloud_authentication_kind": "none",
 	"var_owncloud_authentication_data_authelia_url_base": "https://authelia.example.org",
@@ -13,8 +14,5 @@
 	"var_owncloud_authentication_data_authelia_android_client_id": "owncloud_android",
 	"var_owncloud_authentication_data_authelia_android_client_secret": "REPLACE_ME",
 	"var_owncloud_authentication_data_authelia_ios_client_id": "owncloud_ios",
-	"var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME",
+	"var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME"
-	"var_owncloud_bind_password": "XJY1n3yakq.ko8fO&Ysl3YBiCMslIMd4",
-	"var_owncloud_account_id": "a2b6ad84-a728-44d3-bc4c-07f8b275d7ba",
-	"var_owncloud_account_secret": "7ivhMgFMakmZeGdhgne5rMUi*.1FVy4A"
 }

roles/owncloud/info.md

@@ -5,9 +5,11 @@ Cloud-Plattform [ownCloud](https://owncloud.com/) (the rewrite in Go named "Infi
 
 ## Verweise
 
-- [GitHub | ocis](https://github.com/rhafer/ocis/)
 - [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/)
 - [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/)
+- [ownCloud-Dokumentation | Service | Proxy](https://doc.owncloud.com/ocis/next/deployment/services/s-list/proxy.html)
+- [ownCloud-Dokumentation | Service | Web](https://doc.owncloud.com/ocis/next/deployment/services/s-list/web.html)
+- [GitHub | ocis](https://github.com/owncloud/ocis/)
 
 
 ## ToDo

roles/owncloud/tasks/main.json

@@ -24,7 +24,16 @@
 		"become_user": "{{var_owncloud_user}}",
 		"ansible.builtin.shell": {
 			"chdir": "{{var_owncloud_directory}}",
-			"cmd": "./ocis --insecure no --admin-password={{var_owncloud_admin_password}}"
+			"cmd": "./ocis init --insecure no --admin-password={{var_owncloud_admin_password}}"
+		}
+	},
+	{
+		"name": "configuration",
+		"become": true,
+		"become_user": "{{var_owncloud_user}}",
+		"ansible.builtin.template": {
+			"src": "env.j2",
+			"dest": "{{var_owncloud_directory}}/.env"
 		}
 	},
 	{

roles/owncloud/templates/env.j2

@@ -0,0 +1,25 @@
+OCIS_URL="{{var_owncloud_domain}}"
+OCIS_INSECURE="false"
+
+PROXY_TLS="false"
+
+{% if var_owncloud_authentication_kind != 'none' %}
+PROXY_AUTOPROVISION_ACCOUNTS="false"
+{% endif %}
+
+{% if var_owncloud_authentication_kind == 'authelia' %}
+OCIS_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}"
+OCIS_OIDC_ISSUER="{{var_owncloud_authentication_data_authelia_url_base}}"
+
+PROXY_AUTOPROVISION_ACCOUNTS="true"
+PROXY_OIDC_REWRITE_WELLKNOWN="true"
+PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD="none"
+PROXY_OIDC_INSECURE="false"
+PROXY_USER_OIDC_CLAIM="name"
+PROXY_USER_CS3_CLAIM="username"
+
+WEB_OIDC_AUTHORITY="{{var_owncloud_authentication_data_authelia_url_base}}"
+WEB_OIDC_METADATA_URL="{{var_owncloud_authentication_data_authelia_url_base}}/.well-known/openid-configuration"
+WEB_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}"
+WEB_OIDC_SCOPE="openid profile email groups"
+{% endif %}

roles/owncloud/templates/ocis.yaml.j2

@@ -1,136 +0,0 @@
-token_manager:
-  jwt_secret: cv95NuKbq9zKlbmE-5H6fv*A2gRqzY1y
-machine_auth_api_key: BgY2%q1L2BwQTxqJpaWfbjHWzl@QAHGA
-system_user_api_key: kGnoApWytP%Bt&kn!H2nAMOBqZhKM!f3
-transfer_secret: X8THQbAA-rFfTskAaZdf936vnd9UpodR
-system_user_id: 2c56ae2c-881f-49a8-827b-c804d8ccb962
-admin_user_id: 253c3a04-5bb2-46de-bd4a-6d19dbbb50da
-graph:
-  application:
-    id: 5251ba75-4a4f-4713-bed0-18ddb5328793
-  events:
-    tls_insecure: true
-  spaces:
-    insecure: true
-  identity:
-    ldap:
-      bind_password: jqwCl3ix*wexA^SOIg=wiRF#&DIfezAf
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-idp:
-  ldap:
-    bind_password: BYd$k0lmb=.=T7NOGk.$^XKYKY13kHbh
-idm:
-  service_user_passwords:
-    admin_password: foobar
-    idm_password: jqwCl3ix*wexA^SOIg=wiRF#&DIfezAf
-    reva_password: {{var_owncloud_bind_password}}
-    idp_password: BYd$k0lmb=.=T7NOGk.$^XKYKY13kHbh
-proxy:
-  oidc:
-{% if var_owncloud_authentication_kind == 'none' %}
-    insecure: true
-{% endif %}
-{% if var_owncloud_authentication_kind == 'authelia' %}
-    insecure: false
-    issuer: "{{var_owncloud_authentication_data_authelia_url_base}}"
-    access_token_verify_method: none
-    rewrite_wellknown: true
-{% endif %}
-  user:
-    oidc:
-      claim: preferred_username
-  insecure_backends: true
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-frontend:
-  app_handler:
-    insecure: true
-  archiver:
-    insecure: true
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-auth_basic:
-  auth_providers:
-    ldap:
-      bind_password: {{var_owncloud_bind_password}}
-auth_bearer:
-  auth_providers:
-    oidc:
-      insecure: true
-users:
-  drivers:
-    ldap:
-      bind_password: {{var_owncloud_bind_password}}
-groups:
-  drivers:
-    ldap:
-      bind_password: {{var_owncloud_bind_password}}
-ocdav:
-  insecure: true
-ocm:
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-thumbnails:
-  thumbnail:
-    transfer_secret: vEycSxTtr+4kqQBx1XLM9db*2Ac4v5l#
-    webdav_allow_insecure: true
-    cs3_allow_insecure: true
-search:
-  events:
-    tls_insecure: true
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-audit:
-  events:
-    tls_insecure: true
-settings:
-  service_account_ids:
-  - {{var_owncloud_account_id}}
-sharing:
-  events:
-    tls_insecure: true
-storage_users:
-  events:
-    tls_insecure: true
-  mount_id: 7762e662-d016-4d2d-a353-28e439270b46
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-notifications:
-  notifications:
-    events:
-      tls_insecure: true
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-nats:
-  nats:
-    tls_skip_verify_client_cert: true
-gateway:
-  storage_registry:
-    storage_users_mount_id: 7762e662-d016-4d2d-a353-28e439270b46
-userlog:
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-auth_service:
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-clientlog:
-  service_account:
-    service_account_id: {{var_owncloud_account_id}}
-    service_account_secret: {{var_owncloud_account_secret}}
-web:
-{% if var_owncloud_authentication_kind == 'authelia' %}
-  oidc:
-    client_id: "{{var_owncloud_authentication_data_authelia_web_client_id}}"
-    client_secret: "{{var_owncloud_authentication_data_authelia_web_client_secret}}"
-    scope: "openid profile email groups"
-{% endif %}

roles/owncloud/templates/systemd_unit.j2

@@ -4,9 +4,7 @@ After=network.target
 
 [Service]
 WorkingDirectory={{var_owncloud_directory}}
-{% if var_owncloud_authentication_kind == 'authelia' %}
+EnvironmentFile={{var_owncloud_directory}}/.env
-Environment="OCIS_OIDC_ISSUER='{{var_owncloud_authentication_data_authelia_url_base}}'"
-{% endif %}
 ExecStart={{var_owncloud_directory}}/ocis server
 Type=simple
 Restart=always

roles/owncloud/vardef.json

@@ -15,6 +15,10 @@
 		"type": "string",
 		"mandatory": false
 	},
+	"domain": {
+		"type": "string",
+		"mandatory": false
+	},
 	"admin_password": {
 		"type": "string",
 		"mandatory": true
@@ -26,5 +30,41 @@
 			"none",
 			"authelia"
 		]
+	},
+	"authentication_data_authelia_url_base": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_web_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_web_client_secret": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_desktop_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_desktop_client_secret": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_android_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_android_client_secret": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_ios_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_authelia_ios_client_secret": {
+		"type": "string",
+		"mandatory": false
 	}
 }