diff --git a/ansible/roles/dokuwiki/defaults/main.json b/ansible/roles/dokuwiki/defaults/main.json index d16f8f2..691ea9e 100644 --- a/ansible/roles/dokuwiki/defaults/main.json +++ b/ansible/roles/dokuwiki/defaults/main.json @@ -1,4 +1,15 @@ { "var_dokuwiki_directory": "/opt/dokuwiki", - "var_dokuwiki_title": "DokuWiki" + "var_dokuwiki_title": "DokuWiki", + "var_dokuwiki_oauth2_enable": false, + "var_dokuwiki_oauth2_title": "external auth", + "var_dokuwiki_oauth2_client_id": "dokuwiki", + "var_dokuwiki_oauth2_client_secret": "REPLACE_ME", + "var_dokuwiki_oauth2_auth_url": "https://auth.example.org/api/oidc/authorize", + "var_dokuwiki_oauth2_token_url": "https://auth.example.org/api/oidc/token", + "var_dokuwiki_oauth2_user_url": "https://auth.example.org/api/oidc/userinfo", + "var_dokuwiki_admin_user_define": true, + "var_dokuwiki_admin_user_name": "admin", + "var_dokuwiki_admin_user_password": "REPLACE_ME", + "var_dokuwiki_admin_user_email_address": "dokuwiki-admin@example.org" } diff --git a/ansible/roles/dokuwiki/info.md b/ansible/roles/dokuwiki/info.md index d670d5c..25eac97 100644 --- a/ansible/roles/dokuwiki/info.md +++ b/ansible/roles/dokuwiki/info.md @@ -2,3 +2,10 @@ Für das leicht-gewichtige Wiki-System [DokuWiki](https://www.dokuwiki.org/dokuwiki) + +## Verweise + +- [Dokumentation | Installation](https://www.dokuwiki.org/install) +- [Dokumentation | Ansible](https://www.dokuwiki.org/install:ansible) +- [Plugin: oAuth](https://www.dokuwiki.org/plugin:oauth) +- [Plugin: oAuthGeneric](https://www.dokuwiki.org/plugin:oauthgeneric) diff --git a/ansible/roles/dokuwiki/tasks/main.json b/ansible/roles/dokuwiki/tasks/main.json index e451cd5..c4c0563 100644 --- a/ansible/roles/dokuwiki/tasks/main.json +++ b/ansible/roles/dokuwiki/tasks/main.json @@ -1,6 +1,40 @@ [ { - "name": "directory", + "name": "packages", + "become": true, + "ansible.builtin.apt": { + "pkg": [ + "unzip", + "php8.2-fpm", + "php8.2-xml", + "php8.2-json" + ] + } + }, + { + "name": "core | acquisition", + "ansible.builtin.get_url": { + "url": "https://download.dokuwiki.org/src/dokuwiki/dokuwiki-stable.tgz", + "dest": "/tmp/dokuwiki.tgz" + } + }, + { + "name": "core | extraction", + "ansible.builtin.unarchive": { + "remote_src": true, + "src": "/tmp/dokuwiki.tgz", + "dest": "/tmp" + } + }, + { + "name": "core | version retrieval", + "ansible.builtin.shell": { + "cmd": "ls -1 /tmp/ | grep dokuwiki- | grep -v plugin" + }, + "register": "temp_core_version_output" + }, + { + "name": "core | directory", "become": true, "ansible.builtin.file": { "state": "directory", @@ -9,44 +43,144 @@ } }, { - "name": "acquisition", - "ansible.builtin.url_get": { - "url": "https://download.dokuwiki.org/src/dokuwiki/dokuwiki-stable.tgz", - "dest": "/tmp/dokuwiki.tgz" - } - }, - { - "name": "extraction", - "ansible.builtin.unarchive": { - "remote_src": true, - "src": "/tmp/dokuwiki.tgz", - "dest": "/tmp" - } - }, - { - "name": "version retrieval", - "ansible.builtin.shell": { - "cmd": "ls -1 /tmp/ | grep dokuwiki-" - }, - "register": "temp_version_output" - }, - { - "name": "emplacement", + "name": "core | emplacement", "become": true, "ansible.builtin.copy": { "remote_src": true, - "state": "directory", - "src": "/tmp/{{temp_version_output}}", + "src": "/tmp/{{temp_core_version_output.stdout}}/", "dest": "{{var_dokuwiki_directory}}", "owner": "www-data" } }, { - "name": "configuration", + "name": "plugin oauth2 base | acquisition", + "when": "var_dokuwiki_oauth2_enable", + "ansible.builtin.get_url": { + "url": "https://github.com/cosmocode/dokuwiki-plugin-oauth/zipball/master", + "dest": "/tmp/dokuwiki-plugin-oauth-base.zip" + } + }, + { + "name": "plugin oauth2 base | extraction", + "when": "var_dokuwiki_oauth2_enable", + "ansible.builtin.unarchive": { + "remote_src": true, + "src": "/tmp/dokuwiki-plugin-oauth-base.zip", + "dest": "/tmp" + } + }, + { + "name": "plugin oauth2 base | version retrieval", + "when": "var_dokuwiki_oauth2_enable", + "ansible.builtin.shell": { + "cmd": "ls -1 /tmp/ | grep cosmocode-dokuwiki-plugin-oauth-" + }, + "register": "temp_plugin_oauth_base_version_output" + }, + { + "name": "plugin oauth2 base | directory", + "when": "var_dokuwiki_oauth2_enable", + "become": true, + "ansible.builtin.file": { + "state": "directory", + "dest": "{{var_dokuwiki_directory}}/lib/plugins/oauth", + "owner": "www-data" + } + }, + { + "name": "plugin oauth2 base | emplacement", + "when": "var_dokuwiki_oauth2_enable", + "become": true, + "ansible.builtin.copy": { + "remote_src": true, + "src": "/tmp/{{temp_plugin_oauth_base_version_output.stdout}}/", + "dest": "{{var_dokuwiki_directory}}/lib/plugins/oauth", + "owner": "www-data" + } + }, + { + "name": "plugin oauth2 generic | acquisition", + "when": "var_dokuwiki_oauth2_enable", + "ansible.builtin.get_url": { + "url": "https://github.com/cosmocode/dokuwiki-plugin-oauthgeneric/zipball/master", + "dest": "/tmp/dokuwiki-plugin-oauth-generic.zip" + } + }, + { + "name": "plugin oauth2 generic | extraction", + "when": "var_dokuwiki_oauth2_enable", + "ansible.builtin.unarchive": { + "remote_src": true, + "src": "/tmp/dokuwiki-plugin-oauth-generic.zip", + "dest": "/tmp" + } + }, + { + "name": "plugin oauth2 generic | version retrieval", + "when": "var_dokuwiki_oauth2_enable", + "ansible.builtin.shell": { + "cmd": "ls -1 /tmp/ | grep cosmocode-dokuwiki-plugin-oauthgeneric-" + }, + "register": "temp_plugin_oauth_generic_version_output" + }, + { + "name": "plugin oauth2 generic | directory", + "when": "var_dokuwiki_oauth2_enable", + "become": true, + "ansible.builtin.file": { + "state": "directory", + "dest": "{{var_dokuwiki_directory}}/lib/plugins/oauthgeneric", + "owner": "www-data" + } + }, + { + "name": "plugin oauth2 generic | emplacement", + "when": "var_dokuwiki_oauth2_enable", + "become": true, + "ansible.builtin.copy": { + "remote_src": true, + "src": "/tmp/{{temp_plugin_oauth_generic_version_output.stdout}}/", + "dest": "{{var_dokuwiki_directory}}/lib/plugins/oauthgeneric", + "owner": "www-data" + } + }, + { + "name": "admin user | password hash", + "when": "var_dokuwiki_admin_user_define", + "set_fact": { + "temp_password_hash": "{{var_dokuwiki_admin_user_password | ansible.builtin.password_hash(hashtype=blowfish,rounds=10)}}" + } + }, + { + "name": "configuration | local", "become": true, "ansible.builtin.template": { - "src": "conf.php.j2", - "dest": "{{var_dokuwiki_directory}}/conf/dokuwiki.php" + "src": "conf-local.php.j2", + "dest": "{{var_dokuwiki_directory}}/conf/local.php" + } + }, + { + "name": "configuration | plugins", + "become": true, + "ansible.builtin.template": { + "src": "conf-plugins.local.php.j2", + "dest": "{{var_dokuwiki_directory}}/conf/plugins.local.php" + } + }, + { + "name": "configuration | acl", + "become": true, + "ansible.builtin.template": { + "src": "conf-acl.auth.php.j2", + "dest": "{{var_dokuwiki_directory}}/conf/acl.auth.php" + } + }, + { + "name": "configuration | users", + "become": true, + "ansible.builtin.template": { + "src": "conf-users.auth.php.j2", + "dest": "{{var_dokuwiki_directory}}/conf/users.auth.php" } } ] diff --git a/ansible/roles/dokuwiki/templates/conf-acl.auth.php.j2 b/ansible/roles/dokuwiki/templates/conf-acl.auth.php.j2 new file mode 100644 index 0000000..cacd42c --- /dev/null +++ b/ansible/roles/dokuwiki/templates/conf-acl.auth.php.j2 @@ -0,0 +1 @@ +* @ALL 8 diff --git a/ansible/roles/dokuwiki/templates/conf-local.php.j2 b/ansible/roles/dokuwiki/templates/conf-local.php.j2 new file mode 100644 index 0000000..194df94 --- /dev/null +++ b/ansible/roles/dokuwiki/templates/conf-local.php.j2 @@ -0,0 +1,23 @@ + +# Don't modify the lines above +# +# Userfile + +{% if var_dokuwiki_admin_user_define %} +{{var_dokuwiki_admin_user_name}}:{{temp_password_hash}}:var_dokuwiki_admin_user_email_address:admin,user +{% endif %} diff --git a/ansible/roles/dokuwiki/templates/conf.php.j2 b/ansible/roles/dokuwiki/templates/conf.php.j2 deleted file mode 100644 index e911e8f..0000000 --- a/ansible/roles/dokuwiki/templates/conf.php.j2 +++ /dev/null @@ -1,179 +0,0 @@ - tags - // 'htmldiff' - diff as HTML table - // 'html' - the full page rendered in XHTML -$conf['rss_media'] = 'both'; //what should be listed? - // 'both' - page and media changes - // 'pages' - page changes only - // 'media' - media changes only -$conf['rss_update'] = 5*60; //Update the RSS feed every n seconds (defaults to 5 minutes) -$conf['rss_show_summary'] = 1; //Add revision summary to title? 0|1 -$conf['rss_show_deleted'] = 1; //Show deleted items 0|1 - -/* Advanced Settings */ -$conf['updatecheck'] = 1; //automatically check for new releases? -$conf['userewrite'] = 0; //this makes nice URLs: 0: off 1: .htaccess 2: internal -$conf['useslash'] = 0; //use slash instead of colon? only when rewrite is on -$conf['sepchar'] = '_'; //word separator character in page names; may be a - // letter, a digit, '_', '-', or '.'. -$conf['canonical'] = 0; //Should all URLs use full canonical http://... style? -$conf['fnencode'] = 'url'; //encode filenames (url|safe|utf-8) -$conf['autoplural'] = 0; //try (non)plural form of nonexistent files? -$conf['compression'] = 'gz'; //compress old revisions: (0: off) ('gz': gnuzip) ('bz2': bzip) - // bz2 generates smaller files, but needs more cpu-power -$conf['gzip_output'] = 0; //use gzip content encoding for the output xhtml (if allowed by browser) -$conf['compress'] = 1; //Strip whitespaces and comments from Styles and JavaScript? 1|0 -$conf['cssdatauri'] = 512; //Maximum byte size of small images to embed into CSS, won't work on IE<8 -$conf['send404'] = 0; //Send an HTTP 404 status for nonexistent pages? -$conf['broken_iua'] = 0; //Platform with broken ignore_user_abort (IIS+CGI) 0|1 -$conf['xsendfile'] = 0; //Use X-Sendfile (1 = lighttpd, 2 = standard) -$conf['renderer_xhtml'] = 'xhtml'; //renderer to use for main page generation -$conf['readdircache'] = 0; //time cache in second for the readdir operation, 0 to deactivate. -$conf['search_nslimit'] = 0; //limit the search to the current X namespaces -$conf['search_fragment'] = 'exact'; //specify the default fragment search behavior -$conf['trustedproxy'] = '^(::1|[fF][eE]80:|127\.|10\.|192\.168\.|172\.((1[6-9])|(2[0-9])|(3[0-1]))\.)'; - //Regexp of trusted proxy address when reading IP using HTTP header - // if blank, do not trust any proxy (including local IP) - -/* Feature Flags */ -$conf['defer_js'] = 1; // Defer javascript to be executed after the page's HTML has been parsed. Setting will be removed in the next release. -$conf['hidewarnings'] = 0; // Hide warnings - -/* Network Settings */ -$conf['dnslookups'] = 1; //disable to disallow IP to hostname lookups -$conf['jquerycdn'] = 0; //use a CDN for delivering jQuery? -// Proxy setup - if your Server needs a proxy to access the web set these -$conf['proxy']['host'] = ''; -$conf['proxy']['port'] = ''; -$conf['proxy']['user'] = ''; -$conf['proxy']['pass'] = ''; -$conf['proxy']['ssl'] = 0; -$conf['proxy']['except'] = '';