[add] tandoor-and-nginx

roles/postgresql-for-tandoor/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_postgresql_for_tandoor_username": "tandoor_user",
+	"var_postgresql_for_tandoor_password": "REPLACE_ME",
+	"var_postgresql_for_tandoor_schema": "tandoor"
+}

roles/postgresql-for-tandoor/tasks/main.json

@@ -0,0 +1,50 @@
+[
+	{
+		"name": "packages",
+		"become": true,
+		"ansible.builtin.apt": {
+			"update_cache": true,
+			"pkg": [
+				"acl",
+				"python3-psycopg2",
+				"libpq-dev"
+			]
+		}
+	},
+	{
+		"name": "user",
+		"become": true,
+		"become_user": "tandoor",
+		"community.tandoorql.tandoorql_user": {
+			"state": "present",
+			"name": "{{var_postgresql_for_tandoor_username}}",
+			"password": "{{var_postgresql_for_tandoor_password}}"
+		},
+		"environment": {
+			"PGOPTIONS": "-c password_encryption=scram-sha-256"
+		}
+	},
+	{
+		"name": "schema",
+		"become": true,
+		"become_user": "tandoor",
+		"community.tandoorql.tandoorql_db": {
+			"state": "present",
+			"name": "{{var_postgresql_for_tandoor_schema}}",
+			"owner": "{{var_postgresql_for_tandoor_username}}"
+		}
+	},
+	{
+		"name": "rights",
+		"become": true,
+		"become_user": "tandoor",
+		"community.tandoorql.tandoorql_privs": {
+			"state": "present",
+			"db": "{{var_postgresql_for_tandoor_schema}}",
+			"objs": "ALL_IN_SCHEMA",
+			"roles": "{{var_postgresql_for_tandoor_username}}",
+			"privs": "ALL",
+			"grant_option": true
+		}
+	}
+]

roles/tandoor-and-nginx/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_tandoor_and_nginx_domain": "tandoor.example.org",
+	"var_tandoor_and_nginx_port": 1256,
+	"var_tandoor_and_nginx_tls_mode": "force"
+}

roles/tandoor-and-nginx/info.md

@@ -0,0 +1,4 @@
+## Verweise
+
+- [Tandoor-Dokumentation | nginx](https://docs.tandoor.dev/install/manual/#nginx)
+

roles/tandoor-and-nginx/tasks/main.json

@@ -0,0 +1,35 @@
+[
+	{
+		"name": "deactivate default site",
+		"become": true,
+		"ansible.builtin.file": {
+			"state": "absent",
+			"dest": "/etc/nginx/sites-enabled/default"
+		}
+	},
+	{
+		"name": "emplace configuration | data",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "conf.j2",
+			"dest": "/etc/nginx/sites-available/{{var_tandoor_and_nginx_domain}}"
+		}
+	},
+	{
+		"name": "emplace configuration | link",
+		"become": true,
+		"ansible.builtin.file": {
+			"state": "link",
+			"src": "/etc/nginx/sites-available/{{var_tandoor_and_nginx_domain}}",
+			"dest": "/etc/nginx/sites-enabled/{{var_tandoor_and_nginx_domain}}"
+		}
+	},
+	{
+		"name": "restart nginx",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "nginx"
+		}
+	}
+]

roles/tandoor-and-nginx/templates/conf.j2

@@ -0,0 +1,43 @@
+{% macro tandoor_common() %}
+	location /static/ {
+		alias /var/www/recipes/staticfiles;
+	}
+
+	location /media/ {
+		alias /var/www/recipes/mediafiles;
+	}
+
+	location / {
+		proxy_set_header Host $http_host;
+		proxy_pass http://unix:/var/www/recipes/recipes.sock;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+{% endmacro %}
+
+server {
+	listen 80;
+	listen [::]:80;
+	
+	server_name {{var_tandoor_and_nginx_domain}};
+	
+{% if var_tandoor_and_nginx_tls_mode == 'force' %}
+	return 301 https://$http_host$request_uri;
+{% else %}
+{{ tandoor_common() }}
+{% endif %}
+}
+
+{% if var_tandoor_and_nginx_tls_mode != 'disable' %}
+server {
+	listen 443 ssl;
+	listen [::]:443 ssl;
+	
+	server_name {{var_tandoor_and_nginx_domain}};
+	
+	ssl_certificate_key /etc/ssl/private/{{var_tandoor_and_nginx_domain}}.pem;
+	ssl_certificate /etc/ssl/fullchains/{{var_tandoor_and_nginx_domain}}.pem;
+	include /etc/nginx/ssl-hardening.conf;
+	
+{{ tandoor_common() }}
+}
+{% endif %}

roles/tandoor-and-nginx/vardef.json

@@ -0,0 +1,19 @@
+{
+	"domain": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"port": {
+		"mandatory": false,
+		"type": "integer"
+	},
+	"tls_mode": {
+		"mandatory": false,
+		"type": "string",
+		"options": [
+			"disable",
+			"enable",
+			"force"
+		]
+	}
+}

roles/tandoor/defaults/main.json

@@ -0,0 +1,20 @@
+{
+	"var_tandoor_user": "tandoor",
+	"var_tandoor_directory": "/opt/tandoor",
+	"var_tandoor_repository_url": "https://github.com/vabene1111/recipes.git",
+	"var_tandoor_repository_reference": "master",
+	"var_tandoor_database_kind": "sqlite",
+	"var_tandoor_database_data_postgresql_host": "postgresql.example.org",
+	"var_tandoor_database_data_postgresql_port": 5432,
+	"var_tandoor_database_data_postgresql_username": "tandoor_user",
+	"var_tandoor_database_data_postgresql_password": "REPLACE_ME",
+	"var_tandoor_database_data_postgresql_schema": "tandoor",
+	"var_tandoor_authentication_kind": "internal",
+	"var_tandoor_authentication_data_authelia_client_id": "REPLACE_ME",
+	"var_tandoor_authentication_data_authelia_client_secret": "REPLACE_ME",
+	"var_tandoor_authentication_data_authelia_url_base": "authelia.example.org",
+	"var_tandoor_authentication_data_authelia_label": "Authelia",
+	"var_tandoor_secret_key": "REPLACE_ME",
+	"var_tandoor_port": 1256,
+	"var_tandoor_domain": "tandoor.exmaple.org"
+}

roles/tandoor/info.md

@@ -0,0 +1,11 @@
+## Beschreibung
+
+Für Rezepte-Sammlung [Tandoor](https://tandoor.dev/)
+
+
+## Verweise
+
+- [Tandoor-Dokumentation | Installation](https://docs.tandoor.dev/install/manual/)
+- [Tandoor-Dokumentation | Konfiguration](https://docs.tandoor.dev/system/configuration/)
+- [Tandoor-Dokumentation | Allauth](https://docs.tandoor.dev/features/authentication/#allauth)
+https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html

roles/tandoor/tasks/main.json

@@ -0,0 +1,91 @@
+[
+	{
+		"name": "packages",
+		"become": true,
+		"ansible.builtin.apt": {
+			"update_cache": true,
+			"pkg": [
+				"git",
+				"nodejs",
+				"yarnpkg"
+			]
+		}
+	},
+	{
+		"name": "user and directory",
+		"become": true,
+		"ansible.builtin.user": {
+			"name": "{{var_tandoor_user}}",
+			"create_home": true,
+			"home": "{{var_tandoor_directory}}"
+		}
+	},
+	{
+		"name": "sources",
+		"become": true,
+		"become_user": "{{var_tandoor_user}}",
+		"ansible.builtin.git": {
+			"repo": "{{var_tandoor_repository_url}}",
+			"version": "{{var_tandoor_repository_reference}}",
+			"dest": "{{var_tandoor_directory}}"
+		}
+	},
+	{
+		"name": "python requirements",
+		"ansible.builtin.pip": {
+			"virtualenv": "{{var_tandoor_directory}}",
+			"requirements": "{{var_tandoor_directory}}/requirements.txt"
+		}
+	},
+	{
+		"name": "database",
+		"ansible.builtin.shell": {
+			"environment": "VIRTUAL_ENV={{var_tandoor_directory}}",
+			"cmd": "bin/python3 manage.py migrate"
+		}
+	},
+	{
+		"name": "static files",
+		"ansible.builtin.shell": {
+			"environment": "VIRTUAL_ENV={{var_tandoor_directory}}",
+			"cmd": "bin/python3 manage.py collectstatic --no-input"
+		}
+	},
+	{
+		"name": "static files",
+		"ansible.builtin.shell": {
+			"environment": "VIRTUAL_ENV={{var_tandoor_directory}}",
+			"cmd": "bin/python3 manage.py collectstatic_js_reverse"
+		}
+	},
+	{
+		"name": "frontend stuff",
+		"ansible.builtin.shell": {
+			"chdir": "{{var_tandoor_directory}}/vue",
+			"cmd": "yarn install && yarn build"
+		}
+	},
+	{
+		"name": "configuration",
+		"ansible.builtin.template": {
+			"src": "conf.j2",
+			"dest": "{{var_tandoor_directory}}/.env"
+		}
+	},
+	{
+		"name": "systemd unit",
+		"ansible.builtin.template": {
+			"src": "systemd-unit.js",
+			"dest": "/etc/systemd/system/tandoor.service"
+		}
+	},
+	{
+		"name": "start",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"enabled": true,
+			"state": "started",
+			"name": "tandoor"
+		}
+	}
+]

roles/tandoor/templates/conf.j2

@@ -0,0 +1,48 @@
+{% if var_tandoor_database_kind == 'sqlite' %}
+DB_ENGINE=django.db.backends.sqlite3
+{% endif %}
+
+{% if var_tandoor_database_kind == 'postgresql' %}
+DB_ENGINE=django.db.backends.postgresql
+POSTGRES_HOST={{var_tandoor_database_data_postgresql_host}}
+POSTGRES_DB={{var_tandoor_database_data_postgresql_schema}}
+POSTGRES_PORT={{var_tandoor_database_data_postgresql_port | string}}
+POSTGRES_USER={{var_tandoor_database_data_postgresql_username}}
+POSTGRES_PASSWORD={{var_tandoor_database_data_postgresql_password}}
+{% endif %}
+
+{% if var_tandoor_authentication_kind == 'internal' %}
+ENABLE_SIGNUP=1
+REMOTE_USER_AUTH=0
+{% endif %}
+
+{% if var_tandoor_authentication_kind == 'authelia' %}
+ENABLE_SIGNUP=0
+REMOTE_USER_AUTH=1
+SOCIALACCOUNT_PROVIDERS = {
+    "openid_connect": {
+        "OAUTH_PKCE_ENABLED": False,
+        "APPS": [
+            {
+                "provider_id": "authelia",
+                "name": "{{var_tandoor_authentication_data_authelia_label}}",
+                "client_id": "{{var_tandoor_authentication_data_authelia_client_id}}",
+                "secret": "{{var_tandoor_authentication_data_authelia_client_secret}}",
+                "settings": {
+                    "server_url": "{{var_tandoor_authentication_data_authelia_url_base}}",
+                    "token_auth_method": "client_secret_basic",
+                    "oauth_pkce_enabled": False,
+                },
+            },
+        ]
+    }
+}
+{% endif %}
+
+SECRET_KEY={{var_tandoor_secret_key}}
+
+ALLOWED_HOSTS={{var_tandoor_domain}}
+TANDOOR_PORT={{var_tandoor_port | string}}
+
+ENABLE_METRICS=0
+ENABLE_PDF_EXPORT=0

roles/tandoor/templates/systemd-unit.j2

@@ -0,0 +1,13 @@
+[Unit]
+Description=Tandoor
+After=multi-user.target
+
+[Service]
+WorkingDirectory={{var_tandoor_directory}}
+User={{var_tandoor_user}}
+# Environment="VIRTUAL_ENV={{var_tandoor_directory}}"
+ExecStart="{{var_tandoor_directory}}/bin/python3 manage.py runserver"
+SyslogIdentifier=tandoor
+
+[Install]
+WantedBy=multi-user.target