Daniel Allaire
79d0529686
Maison numérique souveraine (offres maison-obnl + cabinet). Tâches découpées : paquets → php (512M + TLS PG) → install (occ, PG verify-full) → exposition (vhost .mjs) → configure (overwrite/redis/anti-SSRF/import CA) → OIDC user_oidc → Collabora richdocuments (WOPI split URL) → thème Alliance (ciel étoilé). Chaque réglage encode un piège prouvé sur collab-01 : imagick Debian 13, PGSSLMODE dans php-fpm, MIME .mjs, allow_local_remote_servers (SSRF), import root step-ca, memory_limit 512M, public_wopi_url après activate-config… Version épinglée (robustesse). ansible-lint profil production : 0 échec. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
---
|
|
- name: Collabora / Office (occ, en www-data avec TLS PG)
|
|
become: true
|
|
become_user: "{{ serveur_nextcloud_utilisateur }}"
|
|
environment:
|
|
PGSSLMODE: "{{ serveur_nextcloud_pg_sslmode }}"
|
|
PGSSLROOTCERT: "{{ serveur_nextcloud_ca_racine }}"
|
|
when: not ansible_check_mode
|
|
block:
|
|
- name: Installer + activer l'app richdocuments (idempotent)
|
|
ansible.builtin.shell:
|
|
executable: /bin/bash
|
|
cmd: |
|
|
set -eo pipefail
|
|
OCC="php {{ serveur_nextcloud_racine }}/occ"
|
|
if $OCC app:list | grep -qw richdocuments; then echo SETOPS_OK; else $OCC app:install richdocuments && echo SETOPS_CHANGED; fi
|
|
register: serveur_nextcloud_office_app
|
|
changed_when: "'SETOPS_CHANGED' in serveur_nextcloud_office_app.stdout"
|
|
|
|
- name: URL serveur -> Collabora (locale, rapide)
|
|
ansible.builtin.command:
|
|
argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "config:app:set", "richdocuments", "wopi_url", "--value={{ serveur_nextcloud_wopi_url }}"]
|
|
changed_when: false
|
|
|
|
- name: Valider la configuration WOPI (autodetection)
|
|
ansible.builtin.command:
|
|
argv: ["php", "{{ serveur_nextcloud_racine }}/occ", "richdocuments:activate-config"]
|
|
changed_when: false
|
|
|
|
# Gotcha : public_wopi_url APRES activate-config (qui l'ecrase). Navigateur -> edge.
|
|
- name: URL navigateur -> Collabora (publique, via edge)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- php
|
|
- "{{ serveur_nextcloud_racine }}/occ"
|
|
- config:app:set
|
|
- richdocuments
|
|
- public_wopi_url
|
|
- "--value={{ serveur_nextcloud_wopi_public_url }}"
|
|
changed_when: false
|