Changeset - 7be03b9a5d15
Parent rev.
Child rev.
[Not reviewed]
0 2 0
Branko Majic (branko) - 9 months ago 2025-02-21 19:01:44
branko@majic.rs
MAR-245: Fix some linting errors in documentation:

- Use proper truthy YAML expressions.
- Explicitly specify file permissions.
2 files changed with 31 insertions and 29 deletions:
docs/rolereference.rst
1
1
docs/usage.rst
30
28
0 comments (0 inline, 0 general)
docs/rolereference.rst
➞
Show inline comments
 
@@ -1476,13 +1476,13 @@ Here is an example configuration for setting-up the mail forwarder:
 
    root: "root john.doe@example.com"
 

			




	
	
	
		
 
  smtp_relay_host: mail.example.com

			




	
	
	
		
 

			




	
	
	
		
 
  smtp_relay_host_port: 27

			




	
	
	
		
 

			




	
	
	
		
 
  smtp_from_relay_allowed: False

			




	
	
	
		
 
  smtp_from_relay_allowed: false

			




	
	
	
		
 

			




	
	
	
		
 
  smtp_relay_truststore: /etc/ssl/certs/example_ca_chain.pem

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
Web Server

			




	
	
	
		
 
----------

			




        

    


    
    

    

        

                

                    docs/usage.rst
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -519,39 +519,39 @@ Let's take care of this common configuration right away:

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: communications

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 

			




	
	
	
		
 
2. Create playbook for the web server:

			




	
	
	
		
 

			




	
	
	
		
 
   :file:`~/mysite/playbooks/web.yml`

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 

			




	
	
	
		
 
3. Create playbook for the backup server:

			




	
	
	
		
 

			




	
	
	
		
 
   :file:`~/mysite/playbooks/backup.yml`

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: backup

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 

			




	
	
	
		
 
4. Create the global site playbook:

			




	
	
	
		
 

			




	
	
	
		
 
   :file:`~/mysite/playbooks/site.yml`

			




	
	
		
 
@@ -631,13 +631,13 @@ one up first. This includes both the LDAP *server* and *client* configuration.

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: communications

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - ldap_server

			




	
	
	
		
 

			




	
	
	
		
 
2. Update the playbook for web server to include the LDAP client role

			




	
	
		
 
@@ -647,13 +647,13 @@ one up first. This includes both the LDAP *server* and *client* configuration.

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 

			




	
	
	
		
 
3. Time to configure the roles. For start, let us configure the LDAP

			




	
	
	
		
 
   server role. Keep in mind that there is a lot of default variables

			




	
	
		
 
@@ -782,13 +782,13 @@ role.

			




	
	
	
		
 
    ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: communications

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - ldap_server

			




	
	
	
		
 
          - mail_server

			




	
	
	
		
 

			




	
	
		
 
@@ -993,26 +993,26 @@ external addresses on those two servers goes through our anti-virus scanner.

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 

			




	
	
	
		
 
   :file:`~/mysite/playbooks/backup.yml`

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: backup

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 

			




	
	
	
		
 
2. The next thing is to set-up the configuration for the new role. We can define

			




	
	
	
		
 
   this globally for all servers

			




	
	
		
 
@@ -1083,13 +1083,13 @@ role.

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: communications

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - ldap_server

			




	
	
	
		
 
          - mail_server

			




	
	
	
		
 
          - xmpp_server

			




	
	
		
 
@@ -1258,13 +1258,13 @@ Nginx.

			




	
	
	
		
 
    ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 
          - web_server

			




	
	
	
		
 

			




	
	
		
 
@@ -1341,13 +1341,13 @@ server.

			




	
	
	
		
 
    ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 
          - web_server

			




	
	
	
		
 
          - database_server

			




	
	
		
 
@@ -1555,22 +1555,23 @@ Before we start, here is a couple of useful pointers regarding the

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Download the application archive

			




	
	
	
		
 
        ansible.builtin.get_url:

			




	
	
	
		
 
          url: "https://download.nextcloud.com/server/releases/nextcloud-29.0.4.tar.bz2"

			




	
	
	
		
 
          dest: "/var/www/nextcloud.example.com/nextcloud-29.0.4.tar.gz"

			




	
	
	
		
 
          checksum: "sha256:19c469e264b31ee80400f8396460854546569e88db4c15fc0854e192f96027eb"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
          mode: "0640"

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: admin-nextcloud_example_com

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Unpack the application archive

			




	
	
	
		
 
        ansible.builtin.unarchive:

			




	
	
	
		
 
          src: "/var/www/nextcloud.example.com/nextcloud-29.0.4.tar.gz"

			




	
	
	
		
 
          dest: "/var/www/nextcloud.example.com/"

			




	
	
	
		
 
          copy: no

			




	
	
	
		
 
          copy: false

			




	
	
	
		
 
          creates: "/var/www/nextcloud.example.com/nextcloud"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: admin-nextcloud_example_com

			




	
	
	
		
 

			




	
	
	
		
 
      # Majic Ansible Roles currently only support utf8 encoding.

			




	
	
	
		
 
      - name: Disable opportunistic use of utf8mb4 on fresh installs

			




	
	
	
		
 
        ansible.builtin.lineinfile:

			




	
	
	
		
 
          dest: "/var/www/nextcloud.example.com/nextcloud/lib/private/Setup/MySQL.php"

			




	
	
		
 
@@ -1604,13 +1605,14 @@ Before we start, here is a couple of useful pointers regarding the

			




	
	
	
		
 
          group: "web-nextcloud_example_com"

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Create an empty log file if it does not exist

			




	
	
	
		
 
        ansible.builtin.copy:

			




	
	
	
		
 
          content: ""

			




	
	
	
		
 
          dest: "/var/www/nextcloud.example.com/data/nextcloud.log"

			




	
	
	
		
 
          force: no

			




	
	
	
		
 
          force: false

			




	
	
	
		
 
          mode: "0660"

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Set-up log file permissions

			




	
	
	
		
 
        ansible.builtin.file:

			




	
	
	
		
 
          path: "/var/www/nextcloud.example.com/data/nextcloud.log"

			




	
	
	
		
 
          owner: "admin-nextcloud_example_com"

			




	
	
	
		
 
          group: "web-nextcloud_example_com"

			




	
	
		
 
@@ -1629,17 +1631,17 @@ Before we start, here is a couple of useful pointers regarding the

			




	
	
	
		
 

			




	
	
	
		
 
      # Installation

			




	
	
	
		
 
      # ============

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Get application installation status

			




	
	
	
		
 
        ansible.builtin.command: "/var/www/nextcloud.example.com/nextcloud/occ status"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: "admin-nextcloud_example_com"

			




	
	
	
		
 
        register: nextcloud_status

			




	
	
	
		
 
        changed_when: False

			




	
	
	
		
 
        failed_when: False

			




	
	
	
		
 
        changed_when: false

			




	
	
	
		
 
        failed_when: false

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Check if application is installed

			




	
	
	
		
 
        ansible.builtin.set_fact:

			




	
	
	
		
 
          nextcloud_installed: "{{ 'Nextcloud is not installed' not in nextcloud_status.stderr }}"

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Deploy installation script

			




	
	
		
 
@@ -1650,27 +1652,27 @@ Before we start, here is a couple of useful pointers regarding the

			




	
	
	
		
 
          group: "web-nextcloud_example_com"

			




	
	
	
		
 
          mode: "0700"

			




	
	
	
		
 
        when: "not nextcloud_installed"

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Install application

			




	
	
	
		
 
        ansible.builtin.command: "/var/www/nextcloud.example.com/install_nextcloud.py"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: "admin-nextcloud_example_com"

			




	
	
	
		
 
        when: "not nextcloud_installed"

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Remove installation script

			




	
	
	
		
 
        ansible.builtin.file:

			




	
	
	
		
 
          path: "/var/www/nextcloud.example.com/install_nextcloud.py"

			




	
	
	
		
 
          state: absent

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Fix data file permissions for application user/group

			




	
	
	
		
 
        ansible.builtin.file:

			




	
	
	
		
 
          path: "/var/www/nextcloud.example.com/data"

			




	
	
	
		
 
          mode: g+w

			




	
	
	
		
 
          recurse: yes

			




	
	
	
		
 
          follow: no

			




	
	
	
		
 
          recurse: true

			




	
	
	
		
 
          follow: false

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Deploy local configuration overrides

			




	
	
	
		
 
        ansible.builtin.copy:

			




	
	
	
		
 
          src: "local.config.php"

			




	
	
	
		
 
          dest: "/var/www/nextcloud.example.com/nextcloud/config/local.config.php"

			




	
	
	
		
 
          owner: "admin-nextcloud_example_com"

			




	
	
		
 
@@ -1751,13 +1753,13 @@ Before we start, here is a couple of useful pointers regarding the

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 
          - web_server

			




	
	
	
		
 
          - database_server

			




	
	
		
 
@@ -1940,13 +1942,13 @@ on the safe side:

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Start Django project for the Wiki website

			




	
	
	
		
 
        ansible.builtin.command: "/var/www/wiki.example.com/virtualenv/bin/exec django-admin startproject wiki_example_com /var/www/wiki.example.com/code"

			




	
	
	
		
 
        args:

			




	
	
	
		
 
          chdir: "/var/www/wiki.example.com"

			




	
	
	
		
 
          creates: "/var/www/wiki.example.com/code/wiki_example_com"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: admin-wiki_example_com

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Deploy settings for wiki website

			




	
	
	
		
 
        ansible.builtin.copy:

			




	
	
	
		
 
          src: "{{ item }}"

			




	
	
	
		
 
          dest: "/var/www/wiki.example.com/code/wiki_example_com/{{ item }}"

			




	
	
		
 
@@ -1961,13 +1963,13 @@ on the safe side:

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Deploy project database and deploy static files

			




	
	
	
		
 
        community.general.django_manage:

			




	
	
	
		
 
          command: "{{ item }}"

			




	
	
	
		
 
          app_path: "/var/www/wiki.example.com/code/"

			




	
	
	
		
 
          virtualenv: "/var/www/wiki.example.com/virtualenv/"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: admin-wiki_example_com

			




	
	
	
		
 
        with_items:

			




	
	
	
		
 
          - migrate

			




	
	
	
		
 
          - collectstatic

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Deploy the superuser creation script

			




	
	
		
 
@@ -1979,13 +1981,13 @@ on the safe side:

			




	
	
	
		
 
          mode: "0750"

			




	
	
	
		
 

			




	
	
	
		
 
      - name: Create initial superuser

			




	
	
	
		
 
        ansible.builtin.command: "/var/www/wiki.example.com/virtualenv/bin/exec ./create_superuser.py"

			




	
	
	
		
 
        args:

			




	
	
	
		
 
          chdir: "/var/www/wiki.example.com/code/"

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        become_user: admin-wiki_example_com

			




	
	
	
		
 
        register: wiki_superuser

			




	
	
	
		
 
        changed_when: "wiki_superuser.stdout ==  'Created superuser.'"

			




	
	
	
		
 

			




	
	
	
		
 
   :file:`~/mysite/roles/wiki/handlers/main.yml`

			




	
	
	
		
 
   ::

			




	
	
		
 
@@ -2208,13 +2210,13 @@ on the safe side:

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: web

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - ldap_client

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 
          - web_server

			




	
	
	
		
 
          - database_server

			




	
	
		
 
@@ -2286,13 +2288,13 @@ straight to it:

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      ---

			




	
	
	
		
 

			




	
	
	
		
 
      - hosts: backup

			




	
	
	
		
 
        remote_user: ansible

			




	
	
	
		
 
        become: yes

			




	
	
	
		
 
        become: true

			




	
	
	
		
 
        roles:

			




	
	
	
		
 
          - common

			




	
	
	
		
 
          - mail_forwarder

			




	
	
	
		
 
          - backup_server

			




	
	
	
		
 

			




	
	
	
		
 
2. There is just one mandatory parameter for the role - OpenSSH server keys to

			




	
	
		
 
@@ -2369,13 +2371,13 @@ So, back to the business:

			




	
	
	
		
 
      invalid. Therefore the example below explicitly disables

			




	
	
	
		
 
      stripping newline from the end of the file.

			




	
	
	
		
 

			




	
	
	
		
 
   :file:`~/mysite/group_vars/all.yml`

			




	
	
	
		
 
   ::

			




	
	
	
		
 

			




	
	
	
		
 
      enable_backup: yes

			




	
	
	
		
 
      enable_backup: true

			




	
	
	
		
 
      backup_encryption_key: "{{ lookup('pipe', 'gpg --homedir ~/mysite/gnupg/ --armour --export-secret-keys ' + ansible_fqdn ) }}"

			




	
	
	
		
 
      backup_server: bak.example.com

			




	
	
	
		
 
      backup_server_host_ssh_public_keys:

			




	
	
	
		
 
        - "{{ lookup('file', inventory_dir + '/ssh/bak_rsa_key.pub') }}"

			




	
	
	
		
 
        - "{{ lookup('file', inventory_dir + '/ssh/bak_ed25519_key.pub') }}"

			




	
	
	
		
 
        - "{{ lookup('file', inventory_dir + '/ssh/bak_ecdsa_key.pub') }}"

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.