From 4cc3e922f17b10245aba7d46fa21d2e5136a86fb Mon Sep 17 00:00:00 2001 From: Julien GOMES DIAS Date: Thu, 20 Jan 2022 10:32:54 +0100 Subject: [PATCH 01/11] [add] etherpad role --- roles/etherpad/.travis.yml | 29 ++ roles/etherpad/README.md | 38 ++ roles/etherpad/defaults/main.yml | 16 + roles/etherpad/handlers/main.yml | 9 + roles/etherpad/meta/main.yml | 52 ++ roles/etherpad/tasks/main.yml | 27 + roles/etherpad/templates/app_etherpad.j2 | 603 +++++++++++++++++++++++ roles/etherpad/templates/nginx_app.j2 | 73 +++ roles/etherpad/tests/inventory | 2 + roles/etherpad/tests/test.yml | 5 + roles/etherpad/vars/main.yml | 10 + 11 files changed, 864 insertions(+) create mode 100644 roles/etherpad/.travis.yml create mode 100644 roles/etherpad/README.md create mode 100644 roles/etherpad/defaults/main.yml create mode 100644 roles/etherpad/handlers/main.yml create mode 100644 roles/etherpad/meta/main.yml create mode 100644 roles/etherpad/tasks/main.yml create mode 100644 roles/etherpad/templates/app_etherpad.j2 create mode 100644 roles/etherpad/templates/nginx_app.j2 create mode 100644 roles/etherpad/tests/inventory create mode 100644 roles/etherpad/tests/test.yml create mode 100644 roles/etherpad/vars/main.yml diff --git a/roles/etherpad/.travis.yml b/roles/etherpad/.travis.yml new file mode 100644 index 00000000..36bbf620 --- /dev/null +++ b/roles/etherpad/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/roles/etherpad/README.md b/roles/etherpad/README.md new file mode 100644 index 00000000..225dd44b --- /dev/null +++ b/roles/etherpad/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/roles/etherpad/defaults/main.yml b/roles/etherpad/defaults/main.yml new file mode 100644 index 00000000..3cf8a5b6 --- /dev/null +++ b/roles/etherpad/defaults/main.yml @@ -0,0 +1,16 @@ +--- +# defaults file for etherpad +app_version: 1.1.14 + +app_user_chrooted: "yes" + +smtp_security: STARTTLS +smtp_host: false +smtp_user: null +smtp_pass: null +smtp_port: 587 + + +app_backup_data: "yes" + +etherpad_port: 9001 \ No newline at end of file diff --git a/roles/etherpad/handlers/main.yml b/roles/etherpad/handlers/main.yml new file mode 100644 index 00000000..b416782e --- /dev/null +++ b/roles/etherpad/handlers/main.yml @@ -0,0 +1,9 @@ +--- +# handlers file for etherpad +- name: reload nginx web_app - Garradin + service: name=nginx state=reloaded + +- name: reload php-fpm web_app - Garradin + service: name=php{{ php_version }}-fpm state=reloaded + + \ No newline at end of file diff --git a/roles/etherpad/meta/main.yml b/roles/etherpad/meta/main.yml new file mode 100644 index 00000000..c572acc9 --- /dev/null +++ b/roles/etherpad/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.1 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/roles/etherpad/tasks/main.yml b/roles/etherpad/tasks/main.yml new file mode 100644 index 00000000..e7afc32b --- /dev/null +++ b/roles/etherpad/tasks/main.yml @@ -0,0 +1,27 @@ +--- +# tasks file for etherpad +- name: "install nodejs" + apt: + name: "nodejs" + state: latest + update_cache: yes + tags: + - nodejs + +- import_role: + name: _web_app + +- name: "etherpad configuration for {{ app_domain }}" + template: + src: "app_etherpad.j2" + dest: "{{ app_instance_root }}settings.json" + register: etherpad_conf + +- name: "template {{ rev_proxy }}_app.j2 {{ app_instance_id }}" + template: + src: "{{ rev_proxy }}_app.j2" + dest: "/etc/{{ rev_proxy }}/sites-available/{{ app_instance_id }}.conf" + when: app_wsgi == "no" + notify: reload {{ rev_proxy }} web_app + tags: + - etherpad_rev_proxy \ No newline at end of file diff --git a/roles/etherpad/templates/app_etherpad.j2 b/roles/etherpad/templates/app_etherpad.j2 new file mode 100644 index 00000000..0f400626 --- /dev/null +++ b/roles/etherpad/templates/app_etherpad.j2 @@ -0,0 +1,603 @@ +/* + * This file must be valid JSON. But comments are allowed + * + * Please edit settings.json, not settings.json.template + * + * Please note that starting from Etherpad 1.6.0 you can store DB credentials in + * a separate file (credentials.json). + * + * + * ENVIRONMENT VARIABLE SUBSTITUTION + * ================================= + * + * All the configuration values can be read from environment variables using the + * syntax "${ENV_VAR}" or "${ENV_VAR:default_value}". + * + * This is useful, for example, when running in a Docker container. + * + * DETAILED RULES: + * - If the environment variable is set to the string "true" or "false", the + * value becomes Boolean true or false. + * - If the environment variable is set to the string "null", the value + * becomes null. + * - If the environment variable is set to the string "undefined", the setting + * is removed entirely, except when used as the member of an array in which + * case it becomes null. + * - If the environment variable is set to a string representation of a finite + * number, the string is converted to that number. + * - If the environment variable is set to any other string, including the + * empty string, the value is that string. + * - If the environment variable is unset and a default value is provided, the + * value is as if the environment variable was set to the provided default: + * - "${UNSET_VAR:}" becomes the empty string. + * - "${UNSET_VAR:foo}" becomes the string "foo". + * - "${UNSET_VAR:true}" and "${UNSET_VAR:false}" become true and false. + * - "${UNSET_VAR:null}" becomes null. + * - "${UNSET_VAR:undefined}" causes the setting to be removed (or be set + * to null, if used as a member of an array). + * - If the environment variable is unset and no default value is provided, + * the value becomes null. THIS BEHAVIOR MAY CHANGE IN A FUTURE VERSION OF + * ETHERPAD; if you want the default value to be null, you should explicitly + * specify "null" as the default value. + * + * EXAMPLE: + * "port": "${PORT:9001}" + * "minify": "${MINIFY}" + * "skinName": "${SKIN_NAME:colibris}" + * + * Would read the configuration values for those items from the environment + * variables PORT, MINIFY and SKIN_NAME. + * + * If PORT and SKIN_NAME variables were not defined, the default values 9001 and + * "colibris" would be used. + * The configuration value "minify", on the other hand, does not have a + * designated default value. Thus, if the environment variable MINIFY were + * undefined, "minify" would be null. + * + * REMARKS: + * 1) please note that variable substitution always needs to be quoted. + * + * "port": 9001, <-- Literal values. When not using + * "minify": false substitution, only strings must be + * "skinName": "colibris" quoted. Booleans and numbers must not. + * + * "port": "${PORT:9001}" <-- CORRECT: if you want to use a variable + * "minify": "${MINIFY:true}" substitution, put quotes around its name, + * "skinName": "${SKIN_NAME}" even if the required value is a number or + * a boolean. + * Etherpad will take care of rewriting it + * to the proper type if necessary. + * + * "port": ${PORT:9001} <-- ERROR: this is not valid json. Quotes + * "minify": ${MINIFY} around variable names are missing. + * "skinName": ${SKIN_NAME} + * + * 2) Beware of undefined variables and default values: nulls and empty strings + * are different! + * + * This is particularly important for user's passwords (see the relevant + * section): + * + * "password": "${PASSW}" // if PASSW is not defined would result in password === null + * "password": "${PASSW:}" // if PASSW is not defined would result in password === '' + * + * If you want to use an empty value (null) as default value for a variable, + * simply do not set it, without putting any colons: "${ABIWORD}". + * + * 3) if you want to use newlines in the default value of a string parameter, + * use "\n" as usual. + * + * "defaultPadText" : "${DEFAULT_PAD_TEXT}Line 1\nLine 2" + */ +{ + /* + * Name your instance! + */ + "title": "Etherpad", + + /* + * Pathname of the favicon you want to use. If null, the skin's favicon is + * used if one is provided by the skin, otherwise the default Etherpad favicon + * is used. If this is a relative path it is interpreted as relative to the + * Etherpad root directory. + */ + "favicon": null, + + /* + * Skin name. + * + * Its value has to be an existing directory under src/static/skins. + * You can write your own, or use one of the included ones: + * + * - "no-skin": an empty skin (default). This yields the unmodified, + * traditional Etherpad theme. + * - "colibris": the new experimental skin (since Etherpad 1.8), candidate to + * become the default in Etherpad 2.0 + */ + "skinName": "colibris", + + /* + * Skin Variants + * + * Use the UI skin variants builder at /p/test#skinvariantsbuilder + * + * For the colibris skin only, you can choose how to render the three main + * containers: + * - toolbar (top menu with icons) + * - editor (containing the text of the pad) + * - background (area outside of editor, mostly visible when using page style) + * + * For each of the 3 containers you can choose 4 color combinations: + * super-light, light, dark, super-dark. + * + * For example, to make the toolbar dark, you will include "dark-toolbar" into + * skinVariants. + * + * You can provide multiple skin variants separated by spaces. Default + * skinVariant is "super-light-toolbar super-light-editor light-background". + * + * For the editor container, you can also make it full width by adding + * "full-width-editor" variant (by default editor is rendered as a page, with + * a max-width of 900px). + */ + "skinVariants": "super-light-toolbar super-light-editor light-background", + + /* + * IP and port which Etherpad should bind at. + * + * Binding to a Unix socket is also supported: just use an empty string for + * the ip, and put the full path to the socket in the port parameter. + * + * EXAMPLE USING UNIX SOCKET: + * "ip": "", // <-- has to be an empty string + * "port" : "/somepath/etherpad.socket", // <-- path to a Unix socket + */ + "ip": "0.0.0.0", + "port": {{ etherpad_port }}, + + /* + * Option to hide/show the settings.json in admin page. + * + * Default option is set to true + */ + "showSettingsInAdminPage": true, + + /* + * Node native SSL support + * + * This is disabled by default. + * Make sure to have the minimum and correct file access permissions set so + * that the Etherpad server can access them + */ + + /* + "ssl" : { + "key" : "/path-to-your/epl-server.key", + "cert" : "/path-to-your/epl-server.crt", + "ca": ["/path-to-your/epl-intermediate-cert1.crt", "/path-to-your/epl-intermediate-cert2.crt"] + }, + */ + + /* + * The type of the database. + * + * You can choose between many DB drivers, for example: dirty, postgres, + * sqlite, mysql. + * + * You shouldn't use "dirty" for for anything else than testing or + * development. + * + * + * Database specific settings are dependent on dbType, and go in dbSettings. + * Remember that since Etherpad 1.6.0 you can also store this information in + * credentials.json. + * + * For a complete list of the supported drivers, please refer to: + * https://www.npmjs.com/package/ueberdb2 + */ + + "dbType" : "mysql", + "dbSettings" : { + "user": "{{ database_user }}", + "host": "localhost", + "port": 3306, + "password": "{{ database_password }}", + "database": "{{ database_name }}", + "charset": "utf8mb4" + }, + + /* + * An Example of MySQL Configuration (commented out). + * + * See: https://github.com/ether/etherpad-lite/wiki/How-to-use-Etherpad-Lite-with-MySQL + */ + + /* + "dbType" : "mysql", + "dbSettings" : { + "user": "db_user", + "host": "localhost", + "port": 3306, + "password": "db_pass", + "database": "db_name", + "charset": "utf8mb4" + }, + */ + + /* + * The default text of a pad + */ + "defaultPadText" : "Welcome to Etherpad!\n\nThis pad text is synchronized as you type, so that everyone viewing this page sees the same text. This allows you to collaborate seamlessly on documents!\n\nGet involved with Etherpad at https:\/\/etherpad.org\n", + + /* + * Default Pad behavior. + * + * Change them if you want to override. + */ + "padOptions": { + "noColors": false, + "showControls": true, + "showChat": true, + "showLineNumbers": true, + "useMonospaceFont": false, + "userName": false, + "userColor": false, + "rtl": false, + "alwaysShowChat": false, + "chatAndUsers": false, + "lang": "en-gb" + }, + + /* + * Pad Shortcut Keys + */ + "padShortcutEnabled" : { + "altF9": true, /* focus on the File Menu and/or editbar */ + "altC": true, /* focus on the Chat window */ + "cmdShift2": true, /* shows a gritter popup showing a line author */ + "delete": true, + "return": true, + "esc": true, /* in mozilla versions 14-19 avoid reconnecting pad */ + "cmdS": true, /* save a revision */ + "tab": true, /* indent */ + "cmdZ": true, /* undo/redo */ + "cmdY": true, /* redo */ + "cmdI": true, /* italic */ + "cmdB": true, /* bold */ + "cmdU": true, /* underline */ + "cmd5": true, /* strike through */ + "cmdShiftL": true, /* unordered list */ + "cmdShiftN": true, /* ordered list */ + "cmdShift1": true, /* ordered list */ + "cmdShiftC": true, /* clear authorship */ + "cmdH": true, /* backspace */ + "ctrlHome": true, /* scroll to top of pad */ + "pageUp": true, + "pageDown": true + }, + + /* + * Should we suppress errors from being visible in the default Pad Text? + */ + "suppressErrorsInPadText": false, + + /* + * If this option is enabled, a user must have a session to access pads. + * This effectively allows only group pads to be accessed. + */ + "requireSession": false, + + /* + * Users may edit pads but not create new ones. + * + * Pad creation is only via the API. + * This applies both to group pads and regular pads. + */ + "editOnly": false, + + /* + * If true, all css & js will be minified before sending to the client. + * + * This will improve the loading performance massively, but makes it difficult + * to debug the javascript/css + */ + "minify": true, + + /* + * How long may clients use served javascript code (in seconds)? + * + * Not setting this may cause problems during deployment. + * Set to 0 to disable caching. + */ + "maxAge": 21600, // 60 * 60 * 6 = 6 hours + + /* + * Absolute path to the Abiword executable. + * + * Abiword is needed to get advanced import/export features of pads. Setting + * it to null disables Abiword and will only allow plain text and HTML + * import/exports. + */ + "abiword": null, + + /* + * This is the absolute path to the soffice executable. + * + * LibreOffice can be used in lieu of Abiword to export pads. + * Setting it to null disables LibreOffice exporting. + */ + "soffice": null, + + /* + * Path to the Tidy executable. + * + * Tidy is used to improve the quality of exported pads. + * Setting it to null disables Tidy. + */ + "tidyHtml": null, + + /* + * Allow import of file types other than the supported ones: + * txt, doc, docx, rtf, odt, html & htm + */ + "allowUnknownFileEnds": true, + + /* + * This setting is used if you require authentication of all users. + * + * Note: "/admin" always requires authentication. + */ + "requireAuthentication": false, + + /* + * Require authorization by a module, or a user with is_admin set, see below. + */ + "requireAuthorization": false, + + /* + * When you use NGINX or another proxy/load-balancer set this to true. + * + * This is especially necessary when the reverse proxy performs SSL + * termination, otherwise the cookies will not have the "secure" flag. + * + * The other effect will be that the logs will contain the real client's IP, + * instead of the reverse proxy's IP. + */ + "trustProxy": true, + + /* + * Settings controlling the session cookie issued by Etherpad. + */ + "cookie": { + /* + * Value of the SameSite cookie property. "Lax" is recommended unless + * Etherpad will be embedded in an iframe from another site, in which case + * this must be set to "None". Note: "None" will not work (the browser will + * not send the cookie to Etherpad) unless https is used to access Etherpad + * (either directly or via a reverse proxy with "trustProxy" set to true). + * + * "Strict" is not recommended because it has few security benefits but + * significant usability drawbacks vs. "Lax". See + * https://stackoverflow.com/q/41841880 for discussion. + */ + "sameSite": "Lax" + }, + + /* + * Privacy: disable IP logging + */ + "disableIPlogging": false, + + /* + * Time (in seconds) to automatically reconnect pad when a "Force reconnect" + * message is shown to user. + * + * Set to 0 to disable automatic reconnection. + */ + "automaticReconnectionTimeout": 0, + + /* + * By default, when caret is moved out of viewport, it scrolls the minimum + * height needed to make this line visible. + */ + "scrollWhenFocusLineIsOutOfViewport": { + + /* + * Percentage of viewport height to be additionally scrolled. + * + * E.g.: use "percentage.editionAboveViewport": 0.5, to place caret line in + * the middle of viewport, when user edits a line above of the + * viewport + * + * Set to 0 to disable extra scrolling + */ + "percentage": { + "editionAboveViewport": 0, + "editionBelowViewport": 0 + }, + + /* + * Time (in milliseconds) used to animate the scroll transition. + * Set to 0 to disable animation + */ + "duration": 0, + + /* + * Flag to control if it should scroll when user places the caret in the + * last line of the viewport + */ + "scrollWhenCaretIsInTheLastLineOfViewport": false, + + /* + * Percentage of viewport height to be additionally scrolled when user + * presses arrow up in the line of the top of the viewport. + * + * Set to 0 to let the scroll to be handled as default by Etherpad + */ + "percentageToScrollWhenUserPressesArrowUp": 0 + }, + + /* + * User accounts. These accounts are used by: + * - default HTTP basic authentication if no plugin handles authentication + * - some but not all authentication plugins + * - some but not all authorization plugins + * + * User properties: + * - password: The user's password. Some authentication plugins will ignore + * this. + * - is_admin: true gives access to /admin. Defaults to false. If you do not + * uncomment this, /admin will not be available! + * - readOnly: If true, this user will not be able to create new pads or + * modify existing pads. Defaults to false. + * - canCreate: If this is true and readOnly is false, this user can create + * new pads. Defaults to true. + * + * Authentication and authorization plugins may define additional properties. + * + * WARNING: passwords should not be stored in plaintext in this file. + * If you want to mitigate this, please install ep_hash_auth and + * follow the section "secure your installation" in README.md + */ + + /* + "users": { + "admin": { + // 1) "password" can be replaced with "hash" if you install ep_hash_auth + // 2) please note that if password is null, the user will not be created + "password": "adminpwd", + "is_admin": true + }, + "user": { + // 1) "password" can be replaced with "hash" if you install ep_hash_auth + // 2) please note that if password is null, the user will not be created + "password": "changeme1", + "is_admin": false + } + }, + */ + + /* + * Restrict socket.io transport methods + */ + "socketTransportProtocols" : ["xhr-polling", "jsonp-polling", "htmlfile"], + + "socketIo": { + /* + * Maximum permitted client message size (in bytes). All messages from + * clients that are larger than this will be rejected. Large values make it + * possible to paste large amounts of text, and plugins may require a larger + * value to work properly, but increasing the value increases susceptibility + * to denial of service attacks (malicious clients can exhaust memory). + */ + "maxHttpBufferSize": 10000 + }, + + /* + * Allow Load Testing tools to hit the Etherpad Instance. + * + * WARNING: this will disable security on the instance. + */ + "loadTest": false, + + /** + * Disable dump of objects preventing a clean exit + */ + "dumpOnUncleanExit": false, + + /* + * Disable indentation on new line when previous line ends with some special + * chars (':', '[', '(', '{') + */ + + /* + "indentationOnNewLine": false, + */ + + /* + * From Etherpad 1.8.3 onwards, import and export of pads is always rate + * limited. + * + * The default is to allow at most 10 requests per IP in a 90 seconds window. + * After that the import/export request is rejected. + * + * See https://github.com/nfriedly/express-rate-limit for more options + */ + "importExportRateLimiting": { + // duration of the rate limit window (milliseconds) + "windowMs": 90000, + + // maximum number of requests per IP to allow during the rate limit window + "max": 10 + }, + + /* + * From Etherpad 1.8.3 onwards, the maximum allowed size for a single imported + * file is always bounded. + * + * File size is specified in bytes. Default is 50 MB. + */ + "importMaxFileSize": 52428800, // 50 * 1024 * 1024 + + /* + * From Etherpad 1.8.5 onwards, when Etherpad is in production mode commits from individual users are rate limited + * + * The default is to allow at most 10 changes per IP in a 1 second window. + * After that the change is rejected. + * + * See https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#websocket-single-connection-prevent-flooding for more options + */ + "commitRateLimiting": { + // duration of the rate limit window (seconds) + "duration": 1, + + // maximum number of changes per IP to allow during the rate limit window + "points": 10 + }, + + + /* + * Toolbar buttons configuration. + * + * Uncomment to customize. + */ + + /* + "toolbar": { + "left": [ + ["bold", "italic", "underline", "strikethrough"], + ["orderedlist", "unorderedlist", "indent", "outdent"], + ["undo", "redo"], + ["clearauthorship"] + ], + "right": [ + ["importexport", "timeslider", "savedrevision"], + ["settings", "embed"], + ["showusers"] + ], + "timeslider": [ + ["timeslider_export", "timeslider_returnToPad"] + ] + }, + */ + + /* + * Expose Etherpad version in the web interface and in the Server http header. + * + * Do not enable on production machines. + */ + "exposeVersion": false, + + /* + * The log level we are using. + * + * Valid values: DEBUG, INFO, WARN, ERROR + */ + "loglevel": "INFO", + + /* Override any strings found in locale directories */ + "customLocaleStrings": {}, + + /* Disable Admin UI tests */ + "enableAdminUITests": false +} diff --git a/roles/etherpad/templates/nginx_app.j2 b/roles/etherpad/templates/nginx_app.j2 new file mode 100644 index 00000000..2e4d34df --- /dev/null +++ b/roles/etherpad/templates/nginx_app.j2 @@ -0,0 +1,73 @@ +upstream php-handler{{ app_instance_id }} { + server unix:/var/run/php/php{{ php_version }}-fpm-{{ app_user }}.sock; +} + + +map $http_user_agent $log_ua { + ~Monit 0; + default 1; +} + +server { + listen 80; + listen [::]:80; + server_name {{ app_domain | mandatory }}; + # enforce https + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ app_domain }}; + + ssl_certificate /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ app_domain }}/privkey.pem; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + # add_header Strict-Transport-Security "max-age=15768000; + # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag all; # https://developers.google.com/search/docs/advanced/robots/robots_meta_tag + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header Strict-Transport-Security "max-age=15768000"; + + access_log {{ www_log }}/{{ app_instance_id }}/access.log combined if=$log_ua; + error_log {{ www_log }}/{{ app_instance_id }}/error.log; + + include {{ app_instance_www_root }}/nginx/*.conf; + + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + location / { + proxy_pass http://127.0.0.1:{{ etherpad_port }}; + + proxy_set_header Host $host; + proxy_set_header Connection $http_connection; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Scheme $scheme; + proxy_buffering off; + } + +} diff --git a/roles/etherpad/tests/inventory b/roles/etherpad/tests/inventory new file mode 100644 index 00000000..878877b0 --- /dev/null +++ b/roles/etherpad/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/roles/etherpad/tests/test.yml b/roles/etherpad/tests/test.yml new file mode 100644 index 00000000..fde5b819 --- /dev/null +++ b/roles/etherpad/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - etherpad diff --git a/roles/etherpad/vars/main.yml b/roles/etherpad/vars/main.yml new file mode 100644 index 00000000..90e44477 --- /dev/null +++ b/roles/etherpad/vars/main.yml @@ -0,0 +1,10 @@ +--- +# vars file for etherpad +app_program: "Etherpad" + +app_src_root_name: "etherpad-lite-{{ app_version }}" +database_type: "mysql" + +app_src: "https://github.com/ether/etherpad-lite/archive/refs/tags/{{ app_version }}.tar.gz" + +app_group: www-data -- GitLab From ee73965743be5007ec0ca61346479a69d1668125 Mon Sep 17 00:00:00 2001 From: Julien GOMES DIAS Date: Mon, 24 Jan 2022 14:43:51 +0100 Subject: [PATCH 02/11] [fix] fix etherpad service --- roles/etherpad/tasks/main.yml | 22 ++++++++++++-------- roles/etherpad/templates/etherpad_service.j2 | 17 +++++++++++++++ roles/etherpad/vars/main.yml | 3 +++ 3 files changed, 33 insertions(+), 9 deletions(-) create mode 100644 roles/etherpad/templates/etherpad_service.j2 diff --git a/roles/etherpad/tasks/main.yml b/roles/etherpad/tasks/main.yml index e7afc32b..3daa9961 100644 --- a/roles/etherpad/tasks/main.yml +++ b/roles/etherpad/tasks/main.yml @@ -1,13 +1,5 @@ --- # tasks file for etherpad -- name: "install nodejs" - apt: - name: "nodejs" - state: latest - update_cache: yes - tags: - - nodejs - - import_role: name: _web_app @@ -24,4 +16,16 @@ when: app_wsgi == "no" notify: reload {{ rev_proxy }} web_app tags: - - etherpad_rev_proxy \ No newline at end of file + - etherpad_rev_proxy + +- name: "template etherpad_service.j2 {{ app_instance_id }}" + template: + src: etherpad_service.j2 + dest: "/lib/systemd/system/{{ app_service }}" + +- name: "start and enable service {{ app_service }}" + systemd: + name: "{{ app_service }}" + state: started + enabled: yes + daemon_reload: yes \ No newline at end of file diff --git a/roles/etherpad/templates/etherpad_service.j2 b/roles/etherpad/templates/etherpad_service.j2 new file mode 100644 index 00000000..60145e45 --- /dev/null +++ b/roles/etherpad/templates/etherpad_service.j2 @@ -0,0 +1,17 @@ +[Unit] +Description=Etherpad-lite, the collaborative editor. +After=syslog.target network.target + +[Service] +Type=simple +User={{ app_user }} +Group={{ app_group }} +WorkingDirectory={{ app_instance_root }}/etherpad-lite +Environment=NODE_ENV=production + +ExecStart=/usr/bin/node {{ app_instance_root }}/src/node/server.js + +Restart=always + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/roles/etherpad/vars/main.yml b/roles/etherpad/vars/main.yml index 90e44477..b86d8d8e 100644 --- a/roles/etherpad/vars/main.yml +++ b/roles/etherpad/vars/main.yml @@ -8,3 +8,6 @@ database_type: "mysql" app_src: "https://github.com/ether/etherpad-lite/archive/refs/tags/{{ app_version }}.tar.gz" app_group: www-data + + +app_service_name: "{{ app_instance_id }}" \ No newline at end of file -- GitLab From 9ed1ab6d3c6585b38d10da730f62e6ed7a4984a0 Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Mon, 24 Jan 2022 16:15:56 +0100 Subject: [PATCH 03/11] [fix] etherpad service --- roles/etherpad/tasks/main.yml | 6 +++--- roles/etherpad/templates/etherpad_service.j2 | 9 ++++++--- roles/etherpad/vars/main.yml | 3 ++- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/roles/etherpad/tasks/main.yml b/roles/etherpad/tasks/main.yml index 3daa9961..9230420d 100644 --- a/roles/etherpad/tasks/main.yml +++ b/roles/etherpad/tasks/main.yml @@ -1,12 +1,12 @@ --- # tasks file for etherpad - import_role: - name: _web_app + name: _web_app - name: "etherpad configuration for {{ app_domain }}" template: src: "app_etherpad.j2" - dest: "{{ app_instance_root }}settings.json" + dest: "{{ app_instance_root }}/settings.json" register: etherpad_conf - name: "template {{ rev_proxy }}_app.j2 {{ app_instance_id }}" @@ -28,4 +28,4 @@ name: "{{ app_service }}" state: started enabled: yes - daemon_reload: yes \ No newline at end of file + daemon_reload: yes diff --git a/roles/etherpad/templates/etherpad_service.j2 b/roles/etherpad/templates/etherpad_service.j2 index 60145e45..8c2d60cc 100644 --- a/roles/etherpad/templates/etherpad_service.j2 +++ b/roles/etherpad/templates/etherpad_service.j2 @@ -6,12 +6,15 @@ After=syslog.target network.target Type=simple User={{ app_user }} Group={{ app_group }} -WorkingDirectory={{ app_instance_root }}/etherpad-lite +StandardOutput=syslog +StandardError=syslog +SyslogIdentifier={{ app_instance_id }} +WorkingDirectory={{ app_instance_root }} Environment=NODE_ENV=production -ExecStart=/usr/bin/node {{ app_instance_root }}/src/node/server.js +ExecStart=/usr/local/bin/node {{ app_instance_root }}/src/node/server.js Restart=always [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target diff --git a/roles/etherpad/vars/main.yml b/roles/etherpad/vars/main.yml index b86d8d8e..fad2ce39 100644 --- a/roles/etherpad/vars/main.yml +++ b/roles/etherpad/vars/main.yml @@ -10,4 +10,5 @@ app_src: "https://github.com/ether/etherpad-lite/archive/refs/tags/{{ app_versio app_group: www-data -app_service_name: "{{ app_instance_id }}" \ No newline at end of file +app_service_name: "{{ app_instance_id }}" +app_service: "{{ app_instance_id }}.service" -- GitLab From 8d362bb4e79437da1f1799b1f4941c89b4877818 Mon Sep 17 00:00:00 2001 From: Julien GOMES DIAS Date: Thu, 27 Jan 2022 11:26:22 +0100 Subject: [PATCH 04/11] [fix] Uninstall Etherpad --- roles/etherpad/handlers/main.yml | 4 ++-- roles/etherpad/tasks/install.yml | 31 ++++++++++++++++++++++++++++ roles/etherpad/tasks/main.yml | 33 ++++-------------------------- roles/etherpad/tasks/uninstall.yml | 4 ++++ 4 files changed, 41 insertions(+), 31 deletions(-) create mode 100644 roles/etherpad/tasks/install.yml create mode 100644 roles/etherpad/tasks/uninstall.yml diff --git a/roles/etherpad/handlers/main.yml b/roles/etherpad/handlers/main.yml index b416782e..6b3b5fc2 100644 --- a/roles/etherpad/handlers/main.yml +++ b/roles/etherpad/handlers/main.yml @@ -1,9 +1,9 @@ --- # handlers file for etherpad -- name: reload nginx web_app - Garradin +- name: reload nginx web_app - Etherpad service: name=nginx state=reloaded -- name: reload php-fpm web_app - Garradin +- name: reload php-fpm web_app - Etherpad service: name=php{{ php_version }}-fpm state=reloaded \ No newline at end of file diff --git a/roles/etherpad/tasks/install.yml b/roles/etherpad/tasks/install.yml new file mode 100644 index 00000000..9230420d --- /dev/null +++ b/roles/etherpad/tasks/install.yml @@ -0,0 +1,31 @@ +--- +# tasks file for etherpad +- import_role: + name: _web_app + +- name: "etherpad configuration for {{ app_domain }}" + template: + src: "app_etherpad.j2" + dest: "{{ app_instance_root }}/settings.json" + register: etherpad_conf + +- name: "template {{ rev_proxy }}_app.j2 {{ app_instance_id }}" + template: + src: "{{ rev_proxy }}_app.j2" + dest: "/etc/{{ rev_proxy }}/sites-available/{{ app_instance_id }}.conf" + when: app_wsgi == "no" + notify: reload {{ rev_proxy }} web_app + tags: + - etherpad_rev_proxy + +- name: "template etherpad_service.j2 {{ app_instance_id }}" + template: + src: etherpad_service.j2 + dest: "/lib/systemd/system/{{ app_service }}" + +- name: "start and enable service {{ app_service }}" + systemd: + name: "{{ app_service }}" + state: started + enabled: yes + daemon_reload: yes diff --git a/roles/etherpad/tasks/main.yml b/roles/etherpad/tasks/main.yml index 9230420d..27b0405f 100644 --- a/roles/etherpad/tasks/main.yml +++ b/roles/etherpad/tasks/main.yml @@ -1,31 +1,6 @@ --- -# tasks file for etherpad -- import_role: - name: _web_app +- import_tasks: install.yml + when: app_run in ['install', 'reinstall', 'upgrade'] -- name: "etherpad configuration for {{ app_domain }}" - template: - src: "app_etherpad.j2" - dest: "{{ app_instance_root }}/settings.json" - register: etherpad_conf - -- name: "template {{ rev_proxy }}_app.j2 {{ app_instance_id }}" - template: - src: "{{ rev_proxy }}_app.j2" - dest: "/etc/{{ rev_proxy }}/sites-available/{{ app_instance_id }}.conf" - when: app_wsgi == "no" - notify: reload {{ rev_proxy }} web_app - tags: - - etherpad_rev_proxy - -- name: "template etherpad_service.j2 {{ app_instance_id }}" - template: - src: etherpad_service.j2 - dest: "/lib/systemd/system/{{ app_service }}" - -- name: "start and enable service {{ app_service }}" - systemd: - name: "{{ app_service }}" - state: started - enabled: yes - daemon_reload: yes +- import_tasks: uninstall.yml + when: app_run == 'uninstall' \ No newline at end of file diff --git a/roles/etherpad/tasks/uninstall.yml b/roles/etherpad/tasks/uninstall.yml new file mode 100644 index 00000000..068349f3 --- /dev/null +++ b/roles/etherpad/tasks/uninstall.yml @@ -0,0 +1,4 @@ +--- +# tasks file for etherpad +- import_role: + name: _web_app -- GitLab From 91295700e3d8834e5389eb21101ecbdc41db4957 Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Wed, 2 Feb 2022 17:27:35 +0100 Subject: [PATCH 05/11] =?UTF-8?q?[fix]=20passage=20de=20mysql=20=C3=A0=20p?= =?UTF-8?q?ostgresql?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/etherpad/templates/app_etherpad.j2 | 3 +-- roles/etherpad/templates/nginx_app.j2 | 5 ----- roles/etherpad/vars/main.yml | 2 +- 3 files changed, 2 insertions(+), 8 deletions(-) diff --git a/roles/etherpad/templates/app_etherpad.j2 b/roles/etherpad/templates/app_etherpad.j2 index 0f400626..3f228251 100644 --- a/roles/etherpad/templates/app_etherpad.j2 +++ b/roles/etherpad/templates/app_etherpad.j2 @@ -196,11 +196,10 @@ * https://www.npmjs.com/package/ueberdb2 */ - "dbType" : "mysql", + "dbType" : "postrges", "dbSettings" : { "user": "{{ database_user }}", "host": "localhost", - "port": 3306, "password": "{{ database_password }}", "database": "{{ database_name }}", "charset": "utf8mb4" diff --git a/roles/etherpad/templates/nginx_app.j2 b/roles/etherpad/templates/nginx_app.j2 index 2e4d34df..ac4d18dc 100644 --- a/roles/etherpad/templates/nginx_app.j2 +++ b/roles/etherpad/templates/nginx_app.j2 @@ -1,8 +1,3 @@ -upstream php-handler{{ app_instance_id }} { - server unix:/var/run/php/php{{ php_version }}-fpm-{{ app_user }}.sock; -} - - map $http_user_agent $log_ua { ~Monit 0; default 1; diff --git a/roles/etherpad/vars/main.yml b/roles/etherpad/vars/main.yml index fad2ce39..d3f078b3 100644 --- a/roles/etherpad/vars/main.yml +++ b/roles/etherpad/vars/main.yml @@ -3,7 +3,7 @@ app_program: "Etherpad" app_src_root_name: "etherpad-lite-{{ app_version }}" -database_type: "mysql" +database_type: "postgres" app_src: "https://github.com/ether/etherpad-lite/archive/refs/tags/{{ app_version }}.tar.gz" -- GitLab From 5d2cbe745d9cf78b96a378ef4b82147e39a9189d Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Thu, 3 Feb 2022 10:41:15 +0100 Subject: [PATCH 06/11] [fix] correction service etherpad --- roles/etherpad/tasks/install.yml | 3 +++ roles/etherpad/templates/app_etherpad.j2 | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/roles/etherpad/tasks/install.yml b/roles/etherpad/tasks/install.yml index 9230420d..e1e03c0c 100644 --- a/roles/etherpad/tasks/install.yml +++ b/roles/etherpad/tasks/install.yml @@ -23,6 +23,9 @@ src: etherpad_service.j2 dest: "/lib/systemd/system/{{ app_service }}" +- name: "install dependencies and set permissions correctly" + command: "bash {{ app_instance_root }}/src/bin/installDeps.sh && chown {{ app_user }}:{{ app_group }} {{ app_instance_root }} -R" + - name: "start and enable service {{ app_service }}" systemd: name: "{{ app_service }}" diff --git a/roles/etherpad/templates/app_etherpad.j2 b/roles/etherpad/templates/app_etherpad.j2 index 3f228251..0536b190 100644 --- a/roles/etherpad/templates/app_etherpad.j2 +++ b/roles/etherpad/templates/app_etherpad.j2 @@ -196,7 +196,7 @@ * https://www.npmjs.com/package/ueberdb2 */ - "dbType" : "postrges", + "dbType" : "postgres", "dbSettings" : { "user": "{{ database_user }}", "host": "localhost", -- GitLab From 8a65ade9c8fbf3ef9d1f6320e70e9a052eb863be Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Thu, 3 Feb 2022 10:56:17 +0100 Subject: [PATCH 07/11] [fix] admin_pwd + fix abiword install --- roles/etherpad/tasks/install.yml | 9 +++++++++ roles/etherpad/templates/app_etherpad.j2 | 15 +++------------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/roles/etherpad/tasks/install.yml b/roles/etherpad/tasks/install.yml index 9230420d..78db980d 100644 --- a/roles/etherpad/tasks/install.yml +++ b/roles/etherpad/tasks/install.yml @@ -1,5 +1,14 @@ --- # tasks file for etherpad + +- name: "Install abiword for export features" + apt: + name: "abiword" + state: latest + update_cache: yes + tags: + - abiword + - import_role: name: _web_app diff --git a/roles/etherpad/templates/app_etherpad.j2 b/roles/etherpad/templates/app_etherpad.j2 index 3f228251..539e94ec 100644 --- a/roles/etherpad/templates/app_etherpad.j2 +++ b/roles/etherpad/templates/app_etherpad.j2 @@ -317,7 +317,7 @@ * it to null disables Abiword and will only allow plain text and HTML * import/exports. */ - "abiword": null, + "abiword": "/usr/bin/abiword", /* * This is the absolute path to the soffice executable. @@ -459,22 +459,13 @@ * follow the section "secure your installation" in README.md */ - /* + "users": { "admin": { - // 1) "password" can be replaced with "hash" if you install ep_hash_auth - // 2) please note that if password is null, the user will not be created - "password": "adminpwd", + "password": "{{ admin_pwd }}", "is_admin": true - }, - "user": { - // 1) "password" can be replaced with "hash" if you install ep_hash_auth - // 2) please note that if password is null, the user will not be created - "password": "changeme1", - "is_admin": false } }, - */ /* * Restrict socket.io transport methods -- GitLab From 845bb94194c39ee1b6c8ee4affe81e687b139cbf Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Thu, 3 Feb 2022 11:22:54 +0100 Subject: [PATCH 08/11] [fix] security by hashing pass using bcrypt --- roles/etherpad/tasks/install.yml | 2 +- roles/etherpad/templates/app_etherpad.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/etherpad/tasks/install.yml b/roles/etherpad/tasks/install.yml index 0609cb5d..d6481e19 100644 --- a/roles/etherpad/tasks/install.yml +++ b/roles/etherpad/tasks/install.yml @@ -33,7 +33,7 @@ dest: "/lib/systemd/system/{{ app_service }}" - name: "install dependencies and set permissions correctly" - command: "bash {{ app_instance_root }}/src/bin/installDeps.sh && chown {{ app_user }}:{{ app_group }} {{ app_instance_root }} -R" + command: "cd {{ app_instance_root }} && sudo -u {{ app_user }} bash src/bin/installDeps.sh && sudo -u {{ app_user }} npm install ep_hash_auth && chown {{ app_user }}:{{ app_group }} {{ app_instance_root }} -R" - name: "start and enable service {{ app_service }}" systemd: diff --git a/roles/etherpad/templates/app_etherpad.j2 b/roles/etherpad/templates/app_etherpad.j2 index 5ad434de..19166cf1 100644 --- a/roles/etherpad/templates/app_etherpad.j2 +++ b/roles/etherpad/templates/app_etherpad.j2 @@ -462,7 +462,7 @@ "users": { "admin": { - "password": "{{ admin_pwd }}", + "hash": "{{ admin_hash_pwd }}", "is_admin": true } }, -- GitLab From 57035ddc2794ad0d1a3f35b8c854c20febbfaa0d Mon Sep 17 00:00:00 2001 From: Admin paquerette Date: Thu, 3 Feb 2022 12:11:22 +0100 Subject: [PATCH 09/11] [fix] fix etherpad task about installing dep --- roles/etherpad/tasks/install.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/etherpad/tasks/install.yml b/roles/etherpad/tasks/install.yml index d6481e19..c2d3f9c3 100644 --- a/roles/etherpad/tasks/install.yml +++ b/roles/etherpad/tasks/install.yml @@ -33,7 +33,8 @@ dest: "/lib/systemd/system/{{ app_service }}" - name: "install dependencies and set permissions correctly" - command: "cd {{ app_instance_root }} && sudo -u {{ app_user }} bash src/bin/installDeps.sh && sudo -u {{ app_user }} npm install ep_hash_auth && chown {{ app_user }}:{{ app_group }} {{ app_instance_root }} -R" + shell: "cd {{ app_instance_root }} && src/bin/installDeps.sh && npm install ep_hash_auth" + become_user: "{{ app_user }}" - name: "start and enable service {{ app_service }}" systemd: -- GitLab From 282f05988d17fad0c9f3e2623e5501e244ab935c Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Mon, 7 Feb 2022 10:46:49 +0100 Subject: [PATCH 10/11] [fix] Give up hash password for the moment --- roles/etherpad/templates/app_etherpad.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/etherpad/templates/app_etherpad.j2 b/roles/etherpad/templates/app_etherpad.j2 index 19166cf1..5ad434de 100644 --- a/roles/etherpad/templates/app_etherpad.j2 +++ b/roles/etherpad/templates/app_etherpad.j2 @@ -462,7 +462,7 @@ "users": { "admin": { - "hash": "{{ admin_hash_pwd }}", + "password": "{{ admin_pwd }}", "is_admin": true } }, -- GitLab From 3b0c8b2aa704b0784d4c1181379cd33f2e9d6be8 Mon Sep 17 00:00:00 2001 From: Julien Gomes Dias Date: Mon, 7 Feb 2022 10:53:40 +0100 Subject: [PATCH 11/11] [fix] Give up hash password for the moment --- roles/etherpad/tasks/install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/etherpad/tasks/install.yml b/roles/etherpad/tasks/install.yml index c2d3f9c3..d1ad9a01 100644 --- a/roles/etherpad/tasks/install.yml +++ b/roles/etherpad/tasks/install.yml @@ -33,7 +33,7 @@ dest: "/lib/systemd/system/{{ app_service }}" - name: "install dependencies and set permissions correctly" - shell: "cd {{ app_instance_root }} && src/bin/installDeps.sh && npm install ep_hash_auth" + shell: "cd {{ app_instance_root }} && src/bin/installDeps.sh" become_user: "{{ app_user }}" - name: "start and enable service {{ app_service }}" -- GitLab