Daniel Allaire
79d0529686
Maison numérique souveraine (offres maison-obnl + cabinet). Tâches découpées : paquets → php (512M + TLS PG) → install (occ, PG verify-full) → exposition (vhost .mjs) → configure (overwrite/redis/anti-SSRF/import CA) → OIDC user_oidc → Collabora richdocuments (WOPI split URL) → thème Alliance (ciel étoilé). Chaque réglage encode un piège prouvé sur collab-01 : imagick Debian 13, PGSSLMODE dans php-fpm, MIME .mjs, allow_local_remote_servers (SSRF), import root step-ca, memory_limit 512M, public_wopi_url après activate-config… Version épinglée (robustesse). ansible-lint profil production : 0 échec. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
79 lines
3.4 KiB
YAML
79 lines
3.4 KiB
YAML
---
|
|
- name: Configuration Nextcloud (occ, en www-data avec TLS PG)
|
|
become: true
|
|
become_user: "{{ serveur_nextcloud_utilisateur }}"
|
|
environment:
|
|
PGSSLMODE: "{{ serveur_nextcloud_pg_sslmode }}"
|
|
PGSSLROOTCERT: "{{ serveur_nextcloud_ca_racine }}"
|
|
when: not ansible_check_mode
|
|
block:
|
|
- name: Reglages systeme (overwrite, redis, anti-SSRF)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- php
|
|
- "{{ serveur_nextcloud_racine }}/occ"
|
|
- config:system:set
|
|
- "{{ item.k }}"
|
|
- "--value={{ item.v }}"
|
|
- "{{ item.t | default('--type=string') }}"
|
|
changed_when: false
|
|
loop:
|
|
- { k: "overwrite.cli.url", v: "https://{{ serveur_nextcloud_hostname }}" }
|
|
- { k: "overwritehost", v: "{{ serveur_nextcloud_hostname }}" }
|
|
- { k: "overwriteprotocol", v: "https" }
|
|
# Gotcha : Nextcloud REFUSE les IP privees (SSRF) => OIDC injoignable sans ceci.
|
|
- { k: "allow_local_remote_servers", v: "true", t: "--type=boolean" }
|
|
- { k: "memcache.local", v: "\\OC\\Memcache\\Redis" }
|
|
- { k: "memcache.locking", v: "\\OC\\Memcache\\Redis" }
|
|
|
|
- name: Redis (hote + port)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- php
|
|
- "{{ serveur_nextcloud_racine }}/occ"
|
|
- config:system:set
|
|
- redis
|
|
- "{{ item.k }}"
|
|
- "--value={{ item.v }}"
|
|
- "{{ item.t | default('--type=string') }}"
|
|
changed_when: false
|
|
loop:
|
|
- { k: "host", v: "{{ serveur_nextcloud_redis_host }}" }
|
|
- { k: "port", v: "{{ serveur_nextcloud_redis_port }}", t: "--type=integer" }
|
|
|
|
- name: Domaines de confiance (trusted_domains)
|
|
ansible.builtin.command:
|
|
argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "config:system:set", "trusted_domains", "{{ idx }}", "--value={{ item }}"]
|
|
changed_when: false
|
|
loop: "{{ serveur_nextcloud_trusted_domains }}"
|
|
loop_control:
|
|
index_var: idx
|
|
|
|
- name: Proxy de confiance (edge) — voir la vraie IP client, ne pas throttler l'edge
|
|
ansible.builtin.command:
|
|
argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "config:system:set", "trusted_proxies", "0", "--value={{ serveur_nextcloud_edge_ip }}"]
|
|
changed_when: false
|
|
when: serveur_nextcloud_edge_ip | length > 0
|
|
|
|
# Gotcha : Nextcloud a son PROPRE bundle CA (pas le systeme) => OIDC/HTTPS interne echoue sans import.
|
|
- name: Importer le certificat racine step-ca dans le bundle CA de Nextcloud
|
|
ansible.builtin.command:
|
|
argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "security:certificates:import", "{{ serveur_nextcloud_ca_racine }}"]
|
|
changed_when: false
|
|
|
|
- name: Whitelister le sous-reseau d'admin (anti-force-brute, plutot que desactiver)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- php
|
|
- "{{ serveur_nextcloud_racine }}/occ"
|
|
- config:system:set
|
|
- "{{ item.k }}"
|
|
- "--value={{ item.v }}"
|
|
- "{{ item.t | default('--type=string') }}"
|
|
changed_when: false
|
|
loop:
|
|
- { k: "bruteForceProtection.whitelist.0.ip", v: "{{ serveur_nextcloud_bruteforce_whitelist.split('/')[0] }}" }
|
|
- { k: "bruteForceProtection.whitelist.0.mask", v: "{{ serveur_nextcloud_bruteforce_whitelist.split('/')[1] }}", t: "--type=integer" }
|
|
when:
|
|
- serveur_nextcloud_bruteforce_whitelist | length > 0
|
|
- "'/' in serveur_nextcloud_bruteforce_whitelist"
|