add role for freshrss

lxd_host_playbook.yml

@@ -35,10 +35,6 @@
 
 # NOTE: do host routing last so we can fail on no sudo pass
 
-- name: install iptables packages
-  hosts: lxd_host
-  tags: install_lxd
-  tasks:
 - name: add DNAT rules for ssh to containers
   hosts: lxd_host
   tags: dnat_route
@@ -91,3 +87,15 @@
         destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
         to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
       become: yes
+
+    - iptables:
+        table: nat
+        chain: PREROUTING
+        in_interface: "{{ host_iface }}"
+        protocol: tcp
+        match: tcp
+        source: "{{ host_cidr }}"
+        jump: DNAT
+        destination_port: "{{ hostvars['freshrss']['dnat_dest_port'] }}"
+        to_destination: "{{ hostvars['freshrss']['internal_ip'] }}"
+      become: yes

role_test_playbook.yml

@@ -0,0 +1,9 @@
+---
+- hosts: lxd_containers
+  roles:
+    - webserver
+
+- hosts: freshrss
+  tags: freshrss
+  roles:
+    - freshrss

roles/freshrss/tasks/freshrss.yml

@@ -0,0 +1,65 @@
+---
+- name: test for previous install
+  find:
+    paths: "{{ freshrss_dir }}"
+    pattern: index.html
+  register: previous_install
+
+- name: download freshrss tarball
+  get_url:
+    url: "{{ freshrss_url }}"
+    dest: /tmp/
+  when: not previous_install.matched == 0
+
+- name: unarchive file
+  unarchive:
+    remote_src: yes
+    src: "{{ freshrss_tar }}"
+    dest: /tmp
+    owner: "{{ lighttpd_user }}"
+    group: "{{ lighttpd_group }}"
+  when: not previous_install.matched == 0
+
+- name: copy files to docroot
+  copy:
+    remote_src: yes
+    src: "/tmp/FreshRSS-{{ freshrss_version }}/"
+    dest: "{{ docroot }}/freshrss/"
+    owner: "{{ lighttpd_user }}"
+    group: "{{ lighttpd_group }}"
+  when: not previous_install.matched == 0
+
+- name: reset docroot to freshrss/p
+  lineinfile:
+    path: /etc/lighttpd/lighttpd.conf
+    regexp: '^server.document-root'
+    line: server.document-root = "{{ freshrss_dir }}/p"
+
+- name: restart lighttpd
+  service:
+    name: lighttpd
+    state: restarted
+
+#
+# install backup data
+#
+
+- name: test for backup guard
+  find:
+    path: "{{ freshrss_dir }}"
+    pattern: "{{ backup_guard }}"
+  register: backup_guard_present
+
+- name: extract backup data
+  unarchive:
+    src: "{{ backup_archive }}"
+    dest: "{{ freshrss_dir }}"
+    owner: "{{ lighttpd_user }}"
+    group: "{{ lighttpd_group }}"
+  when: use_backup and backup_guard_present.matched == 0
+
+- name: add guard file to let ansible know backup is completed
+  file:
+    path: "{{ freshrss_dir }}/{{ backup_guard }}"
+    state: touch
+  when: use_backup and backup_guard_present.matched == 0

roles/freshrss/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+- import_tasks: freshrss.yml
+  vars:
+    lighttpd_user: lighttpd
+    lighttpd_group: lighttpd
+    docroot: /var/www/localhost/htdocs
+
+    freshrss_version: 1.18.0
+    freshrss_url: "https://github.com/FreshRSS/FreshRSS/archive/refs/tags/{{ freshrss_version}}.tar.gz"
+    freshrss_tar: "/tmp/FreshRSS-{{ freshrss_version }}.tar.gz"
+    freshrss_dir: "{{ docroot }}/freshrss"
+
+    use_backup: True
+    backup_archive: data/freshrss_backup.tgz
+    backup_guard: ANSIBLE_BACKUP_GUARD

roles/webserver/tasks/lighttpd.yml

@@ -0,0 +1,47 @@
+---
+- name: install lighttpd packages
+  vars:
+    packages:
+      - fcgi
+      - lighttpd
+      - php7-common
+      - php7-cgi
+      - php7-ctype
+      - php7-curl
+      - php7-dom
+      - php7-fileinfo
+      - php7-gettext
+      - php7-gd
+      - php7-iconv
+      - php7-imap
+      - php7-json
+      - php7-ldap
+      - php7-mbstring
+      - php7-mcrypt
+      - php7-mysqli
+      - php7-pdo
+      - php7-pdo_mysql
+      - php7-pdo_sqlite
+      - php7-posix
+      - php7-soap
+      - php7-session
+      - php7-xml
+      - php7-xmlrpc
+      - php7-zip
+      # TODO: move tar to common packages
+      - tar
+  apk:
+    name: "{{ packages | join(' ') }}"
+    state: present
+
+- name: copy lighttpd.conf
+  template:
+    src: templates/lighttpd.conf.j2
+    dest: /etc/lighttpd/lighttpd.conf
+
+- name: ensure lighttpd service is started
+  service:
+    name: lighttpd
+    enabled: yes
+    state: started
+

roles/webserver/tasks/main.yml

@@ -0,0 +1,7 @@
+---
+- import_tasks: lighttpd.yml
+  vars:
+    lighttpd_user: lighttpd
+    lighttpd_group: lighttpd
+    docroot: /var/www/localhost/htdocs
+

roles/webserver/templates/etc/lighttpd/lighttpd.conf.j2

@@ -0,0 +1,32 @@
+
+var.basedir  = "/var/www/localhost"
+var.logdir   = "/var/log/lighttpd"
+var.statedir = "/var/lib/lighttpd"
+
+server.modules = (
+    "mod_access",
+    "mod_accesslog",
+    "mod_rewrite"
+)
+
+include "mime-types.conf"
+include "mod_fastcgi.conf"
+
+server.username      = "lighttpd"
+server.groupname     = "lighttpd"
+server.document-root = var.basedir + "/htdocs"
+server.pid-file      = "/run/lighttpd.pid"
+server.errorlog      = var.logdir  + "/error.log"
+server.indexfiles    = ("index.php", "index.html", "index.htm", "default.htm")
+server.follow-symlink = "enable"
+
+static-file.exclude-extensions = (".php", ".pl", ".cgi", ".fcgi")
+
+accesslog.filename   = var.logdir + "/access.log"
+
+url.access-deny = ("~", ".inc")
+
+$HTTP["url"] =~ "^/dokuwiki/(data|conf|bin|inc|vendor)/+." {
+    url.access-deny = ("")
+}
+

templates/lighttpd.conf.j2

@@ -12,8 +12,9 @@ server.modules = (
 include "mime-types.conf"
 include "mod_fastcgi.conf"
 
-server.username      = "lighttpd"
-server.groupname     = "lighttpd"
+server.port          = "{{ dnat_dest_port }}"
+server.username      = "{{ lighttpd_user }}"
+server.groupname     = "{{ lighttpd_group }}"
 server.document-root = var.basedir + "/htdocs"
 server.pid-file      = "/run/lighttpd.pid"
 server.errorlog      = var.logdir  + "/error.log"