fscotto/infra
1
0
Fork 0
mirror of https://github.com/fscotto/infra.git synced 2026-10-05 22:39:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Deploy temporary Atlas Nextcloud and ONLYOFFICE stack

Browse Source
This commit is contained in:
Fabio Scotto di Santolo
2026-10-03 17:42:16 +02:00
parent a00602973c
commit def3dbf313
20 changed files with 1074 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ansible/roles/profile_atlas/templates/atlas-nextcloud-cron.service.j2 Normal file
View File

@@ -0,0 +1,10 @@
[Unit]
Description=Atlas recurring Nextcloud background jobs
Requires=atlas-nextcloud.service
After=atlas-nextcloud.service
[Service]
Type=oneshot
ExecStart=/usr/bin/podman exec --user 33 atlas-nextcloud php -f /var/www/html/cron.php
TimeoutStartSec=15min
NoNewPrivileges=true

10
ansible/roles/profile_atlas/templates/atlas-nextcloud-cron.timer.j2 Normal file
View File

@@ -0,0 +1,10 @@
[Unit]
Description=Run Nextcloud background jobs every five minutes
[Timer]
OnBootSec=5min
OnUnitActiveSec=5min
Unit=atlas-nextcloud-cron.service
[Install]
WantedBy=timers.target

27
ansible/roles/profile_atlas/templates/atlas-nextcloud-db.container.j2 Normal file
View File

@@ -0,0 +1,27 @@
[Unit]
Description=Atlas Nextcloud PostgreSQL
RequiresMountsFor={{ atlas_nextcloud_root }}/database
[Container]
ContainerName=atlas-nextcloud-db
Image={{ atlas_nextcloud_postgres_image }}
Network=atlas-nextcloud.network
NetworkAlias=atlas-nextcloud-db
Environment=POSTGRES_DB=nextcloud
Environment=POSTGRES_USER=nextcloud
Environment=POSTGRES_PASSWORD_FILE=/run/secrets/postgres-password
Volume={{ atlas_nextcloud_private_dir }}/postgres-password:/run/secrets/postgres-password:ro,z
Volume={{ atlas_nextcloud_root }}/database:/var/lib/postgresql/data:Z
PodmanArgs=--memory=1g
HealthCmd=pg_isready -U nextcloud -d nextcloud
HealthInterval=30s
HealthStartPeriod=60s
NoNewPrivileges=true
[Service]
Restart=on-failure
RestartSec=10
TimeoutStartSec=900
[Install]
WantedBy=default.target

8
ansible/roles/profile_atlas/templates/atlas-nextcloud-redis.conf.j2 Normal file
View File

@@ -0,0 +1,8 @@
bind 0.0.0.0
protected-mode yes
port 6379
requirepass {{ vault_nextcloud_redis_password }}
maxmemory 128mb
maxmemory-policy noeviction
save ""
appendonly no

22
ansible/roles/profile_atlas/templates/atlas-nextcloud-redis.container.j2 Normal file
View File

@@ -0,0 +1,22 @@
[Unit]
Description=Atlas Nextcloud private Redis
RequiresMountsFor={{ atlas_nextcloud_root }}/cache
[Container]
ContainerName=atlas-nextcloud-redis
Image={{ atlas_nextcloud_redis_image }}
Network=atlas-nextcloud.network
NetworkAlias=atlas-nextcloud-redis
Volume={{ atlas_nextcloud_private_dir }}/redis.conf:/usr/local/etc/redis/atlas.conf:ro,z
Volume={{ atlas_nextcloud_root }}/cache:/data:Z
Exec=redis-server /usr/local/etc/redis/atlas.conf
PodmanArgs=--memory=256m
NoNewPrivileges=true
[Service]
Restart=on-failure
RestartSec=10
TimeoutStartSec=900
[Install]
WantedBy=default.target

23
ansible/roles/profile_atlas/templates/atlas-nextcloud.config.php.j2 Normal file
View File

@@ -0,0 +1,23 @@
<?php
// Managed ongoing application settings; never import or migrate user data.
$CONFIG = [
'trusted_domains' => ['{{ atlas_nextcloud_domain }}', 'atlas-nextcloud'],
'trusted_proxies' => ['{{ atlas_aegis_ip }}', '{{ atlas_nextcloud_network_gateway }}'],
'overwrite.cli.url' => 'https://{{ atlas_nextcloud_domain }}',
'overwritehost' => '{{ atlas_nextcloud_domain }}',
'overwriteprotocol' => 'https',
'allow_local_remote_servers' => true,
'default_quota' => 'none',
'skeletondirectory' => '',
'maintenance_window_start' => 1,
'default_phone_region' => 'IT',
'twofactor_enforced' => false,
'onlyoffice' => [
'DocumentServerUrl' => 'https://{{ atlas_onlyoffice_domain }}/',
'DocumentServerInternalUrl' => 'http://atlas-onlyoffice/',
'StorageUrl' => 'http://atlas-nextcloud/',
'jwt_secret' => trim(file_get_contents('/run/secrets/onlyoffice-jwt')),
'jwt_header' => 'AuthorizationJwt',
'allow_local_address' => true,
],
];

42
ansible/roles/profile_atlas/templates/atlas-nextcloud.container.j2 Normal file
View File

@@ -0,0 +1,42 @@
[Unit]
Description=Atlas Nextcloud
Requires=atlas-nextcloud-db.service atlas-nextcloud-redis.service
After=atlas-nextcloud-db.service atlas-nextcloud-redis.service
RequiresMountsFor={{ atlas_nextcloud_root }}/app {{ atlas_nextcloud_root }}/files
[Container]
ContainerName=atlas-nextcloud
Image={{ atlas_nextcloud_image }}
Network=atlas-nextcloud.network
NetworkAlias=atlas-nextcloud
PublishPort={{ ansible_host }}:{{ atlas_nextcloud_http_port }}:80
PublishPort=127.0.0.1:{{ atlas_nextcloud_http_port }}:80
Environment=POSTGRES_HOST=atlas-nextcloud-db
Environment=POSTGRES_DB=nextcloud
Environment=POSTGRES_USER=nextcloud
Environment=POSTGRES_PASSWORD_FILE=/run/secrets/postgres-password
Environment=NEXTCLOUD_ADMIN_USER={{ atlas_nextcloud_admin }}
Environment=NEXTCLOUD_ADMIN_PASSWORD_FILE=/run/secrets/admin-password
Environment="NEXTCLOUD_TRUSTED_DOMAINS={{ atlas_nextcloud_domain }} atlas-nextcloud"
Environment=REDIS_HOST=atlas-nextcloud-redis
Environment=REDIS_HOST_PASSWORD_FILE=/run/secrets/redis-password
Environment=APACHE_DISABLE_REWRITE_IP=1
Environment=PHP_MEMORY_LIMIT=512M
Environment=PHP_UPLOAD_LIMIT=2G
Volume={{ atlas_nextcloud_root }}/app:/var/www/html:Z
Volume={{ atlas_nextcloud_root }}/files:/var/www/html/data:Z
Volume={{ atlas_nextcloud_app_cache }}:/mnt/atlas-apps:ro,z
Volume={{ atlas_nextcloud_private_dir }}/postgres-password:/run/secrets/postgres-password:ro,z
Volume={{ atlas_nextcloud_private_dir }}/admin-password:/run/secrets/admin-password:ro,z
Volume={{ atlas_nextcloud_private_dir }}/redis-password:/run/secrets/redis-password:ro,z
Volume={{ atlas_nextcloud_private_dir }}/onlyoffice-jwt:/run/secrets/onlyoffice-jwt:ro,z
PodmanArgs=--memory=2g
NoNewPrivileges=true
[Service]
Restart=on-failure
RestartSec=10
TimeoutStartSec=900
[Install]
WantedBy=default.target

5
ansible/roles/profile_atlas/templates/atlas-nextcloud.network.j2 Normal file
View File

@@ -0,0 +1,5 @@
# Managed by Ansible: private rootless application network, no host services.
[Network]
NetworkName=atlas-nextcloud
Subnet={{ atlas_nextcloud_network_subnet }}
Gateway={{ atlas_nextcloud_network_gateway }}

26
ansible/roles/profile_atlas/templates/atlas-onlyoffice.container.j2 Normal file
View File

@@ -0,0 +1,26 @@
[Unit]
Description=Atlas ONLYOFFICE Docs Community
RequiresMountsFor={{ atlas_nextcloud_root }}/office
[Container]
ContainerName=atlas-onlyoffice
Image={{ atlas_onlyoffice_image }}
Network=atlas-nextcloud.network
NetworkAlias=atlas-onlyoffice
PublishPort={{ ansible_host }}:{{ atlas_onlyoffice_http_port }}:80
PublishPort=127.0.0.1:{{ atlas_onlyoffice_http_port }}:80
EnvironmentFile={{ atlas_nextcloud_private_dir }}/onlyoffice.env
Volume={{ atlas_nextcloud_root }}/office/data:/var/www/onlyoffice/Data:Z
Volume={{ atlas_nextcloud_root }}/office/lib:/var/lib/onlyoffice:Z
Volume={{ atlas_nextcloud_root }}/office/logs:/var/log/onlyoffice:Z
Volume={{ atlas_nextcloud_root }}/office/database:/var/lib/postgresql:Z
PodmanArgs=--memory=4g --shm-size=256m
NoNewPrivileges=true
[Service]
Restart=on-failure
RestartSec=10
TimeoutStartSec=1200
[Install]
WantedBy=default.target

7
ansible/roles/profile_atlas/templates/atlas-onlyoffice.env.j2 Normal file
View File

@@ -0,0 +1,7 @@
JWT_ENABLED=true
JWT_SECRET={{ vault_nextcloud_onlyoffice_jwt }}
JWT_HEADER=AuthorizationJwt
ALLOW_PRIVATE_IP_ADDRESS=true
ALLOW_META_IP_ADDRESS=false
USE_UNAUTHORIZED_STORAGE=false
WOPI_ENABLED=false