update dokuwiki playbook

lxd_host_playbook.yml

@@ -1,6 +1,7 @@
 ---
-- name: top level playbook for lxd server provisioning
+- name: top level play for lxd server provisioning
   hosts: lxd_host
+  tags: install_lxd
   tasks:
     - name: include variables
       include_vars:
@@ -11,8 +12,8 @@
       copy:
         src: "{{ lookup('env', 'HOME') + '/.ssh/id_rsa.pub' }}"
         dest: "{{ tmp_pubkey }}"
-      when: not debug_skip
 
+    # TODO: might make sense to add a cache redirect for alpine packages
     - include_tasks: tasks/container_common.yml
       vars:
         container_name: "{{ item.key }}"
@@ -21,17 +22,23 @@
         tmp_sshd_config: "/tmp/sshd_config_{{ item.key }}"
       with_items: "{{ containers | dict2items }}"
 
-    # NOTE: do container specific provisioning
+        #- name: testing ssh connection to container
-    - import_tasks: tasks/dokuwiki.yml
+        #  hosts: dokuwiki
-      vars:
+        #  tags: containers
-        doku_lxc_cmd: "{{ lxc_cmd }}"
+        #  tasks:
-      when: not debug_skip
+        #    - include_tasks: tasks/dokuwiki.yml
+- import_playbook: tasks/dokuwiki.yml
 
-    # NOTE: do host routing last so we can can on no sudo pass
+# NOTE: do host routing last so we can fail on no sudo pass
-    # TODO: add task for installing iptables & iptables-persistent on debian
+# TODO: add task for installing iptables & iptables-persistent on debian
-    # TODO: save rules after updating
+# TODO: save rules after updating
-    - name: add DNAT rules for ssh to containers
+- name: add DNAT rules for ssh to containers
-      iptables:
+  hosts: lxd_host
+  tags: dnat_route
+  tasks:
+    - include_vars:
+        file: site_vars.yml
+    - iptables:
         table: nat
         chain: PREROUTING
         in_interface: "{{ host_iface }}"
@@ -42,6 +49,24 @@
         destination_port: "{{ item.value.sshd_port }}"
         to_destination: "{{ item.value.ip }}"
       become: yes
-      when: not debug_skip
+      #when: not debug_skip_iptables
       with_items: "{{ containers | dict2items }}"
 
+- name: add DNAT rules for individual containers
+  hosts: lxd_host
+  tags: dnat_route_2
+  tasks:
+    - include_vars:
+        file: site_vars.yml
+
+    - iptables:
+        table: nat
+        chain: PREROUTING
+        in_interface: "{{ host_iface }}"
+        protocol: tcp
+        match: tcp
+        source: "{{ host_cidr }}"
+        jump: DNAT
+        destination_port: "{{ hostvars['dokuwiki']['dnat_dest_port'] }}"
+        to_destination: "{{ hostvars['dokuwiki']['internal_ip'] }}"
+      become: yes

site_vars.yml

@@ -1,8 +1,10 @@
 ---
-debug_skip: False # NOTE: skip tasks when debugging
+# NOTE: skip tasks when debugging
+debug_skip: True
+debug_skip_iptables: True
 
 img_server: https://images.linuxcontainers.org
-alp_img_alias: alpine/edge/amd64
+alp_img_alias: alpine/3.13/amd64
 lxc_cmd: /snap/bin/lxc
 lxd_subnet_pfx: 10.98.46
 lxd_bridge: lxdbr0

tasks/container_common.yml

@@ -17,51 +17,41 @@
         nictype: bridged
         parent: "{{ lxd_bridge }}"
         ipv4.address: "{{ container_ip }}"
-  when: not debug_skip
 
 - name: update container packages
   command: "{{ lxc_cmd }} exec {{ container_name }} -- apk upgrade -U"
-  when: not debug_skip
 
 - name: install openssh, rsync, and shadow packages in containers
-  command: "{{ lxc_cmd }} exec {{ container_name }} -- apk add openssh rsync shadow"
+  command: "{{ lxc_cmd }} exec {{ container_name }} -- \
-  when: not debug_skip
+        apk add openssh rsync shadow python3"
 
 - name: "copy container sshd_config for {{ container_name }} to lxd host"
   template:
     src: templates/sshd_config.j2
     dest: "{{ tmp_sshd_config }}"
-  when: not debug_skip
 
 - name: use lxc file push to get sshd_config into container
   command: "{{ lxc_cmd }} file push {{ tmp_sshd_config}} \
         {{ container_name }}/etc/ssh/sshd_config"
-  when: not debug_skip
 
 - name: mkdir /root/.ssh in {{ container_name }}
   command: "{{ lxc_cmd }} exec {{ container_name }} -- mkdir -p /root/.ssh"
-  when: not debug_skip
 
 - name: add controller public key to {{ container_name }} authorized keys
   command: "{{ lxc_cmd }} file push {{ tmp_pubkey }} \
         {{ container_name }}/root/.ssh/authorized_keys \
         --gid 0 --uid 0 --mode 600"
-  when: not debug_skip
 
 - name: make hash of a random password
   set_fact:
     root_pass: "{{ lookup('password', '/dev/null length=15 chars=ascii_letters') | password_hash('sha512') }}"
-  when: not debug_skip
 
 - name: "set password to unlock root account (NOTE: still using pubkey only)"
   shell: '{{ lxc_cmd }} exec {{ container_name }} -- usermod -p {{ root_pass }} root'
-  when: not debug_skip
 
 - name: ensure sshd service is enabled
   command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-update add sshd"
-  when: not debug_skip
 
-- name: ensure sshd service is enabled
+- name: ensure sshd service is started
   command: "{{ lxc_cmd }} exec {{ container_name }} -- rc-service sshd start"
-  when: not debug_skip
 

tasks/dokuwiki.yml

@@ -1,11 +1,17 @@
 ---
 # NOTE: https://wiki.alpinelinux.org/wiki/DokuWiki
-
+- name: testing ssh connection to container
-- name: test task variables
+  hosts: dokuwiki
-  debug:
+  tags: containers
-    var: doku_lxc_cmd
+  vars:
-
+    lighttpd_user: lighttpd
-- name: install packages
+    lighttpd_group: lighttpd
+    docroot: /var/www/localhost/htdocs
+    doku_url: https://download.dokuwiki.org/src/dokuwiki/dokuwiki-stable.tgz
+    doku_tar: /tmp/dokuwiki-stable.tgz
+    doku_dir: "{{ docroot }}/dokuwiki"
+  tasks:
+  - name: install packages
     vars:
       packages:
         - lighttpd
@@ -30,7 +36,78 @@
         - php7-ctype
         - php7-dom
         - fcgi
-  command:
+        - tar
-    "{{ lxc_cmd }} exec dokuwiki -- apk add {{ packages | join(' ') }}"
+    apk:
-  when: True
+      name: "{{ packages | join(' ') }}"
+      state: present
+
+  # TODO: break out lighttpd default config to a separate playlist
+
+  - name: copy lighttpd.conf
+    copy:
+      src: ../templates/lighttpd.conf.j2
+      dest: /etc/lighttpd/lighttpd.conf
+
+  - name: ensure lighttpd service is started
+    service:
+      name: lighttpd
+      enabled: yes
+      state: started
+
+  - name: test if dokuwiki was already installed
+    find:
+      paths: "{{ doku_dir }}"
+      pattern: README
+    register: doku_find_result
+
+  - name: download dokuwiki stable
+    get_url:
+      url: "{{ doku_url }}"
+      dest: "{{ doku_tar }}"
+    when: doku_find_result.matched == 0
+
+  - name: make directory for dokiwiki in docroot
+    file:
+      path: "{{ doku_dir }}"
+      state: directory
+      owner: "{{ lighttpd_user }}"
+      group: "{{ lighttpd_group }}"
+    when: doku_find_result.matched == 0
+
+  - name: unarchive downloaded file
+    unarchive:
+      remote_src: yes
+      src: "{{ doku_tar }}"
+      dest: /tmp
+      owner: "{{ lighttpd_user }}"
+      group: "{{ lighttpd_group }}"
+    when: doku_find_result.matched == 0
+
+  - name: find doku temporary directory
+    find:
+      paths: /tmp/
+      file_type: directory
+      pattern: "dokuwiki-20*"
+      use_regex: true
+    register: doku_tmp_dir
+
+  - name: copy dokuwiki files to webroot
+    copy:
+      remote_src: yes
+      src: "{{ doku_tmp_dir.files[0].path }}"
+      dest: "{{ doku_dir }}"
+    when: doku_tmp_dir.matched > 0
+
+  - name: remove archive
+    file:
+      path: "{{ doku_tar }}"
+      state: absent
+
+  - name: remove temporary files
+    file:
+      path: "{{ doku_tmp_dir.files[0].path }}"
+      state: absent
+    when: doku_tmp_dir.matched > 0
+
+  # TODO: copy archived dokuwiki files
 

templates/lighttpd.conf.j2

@@ -0,0 +1,32 @@
+
+var.basedir  = "/var/www/localhost"
+var.logdir   = "/var/log/lighttpd"
+var.statedir = "/var/lib/lighttpd"
+
+server.modules = (
+    "mod_access",
+    "mod_accesslog",
+    "mod_rewrite"
+)
+
+include "mime-types.conf"
+include "mod_fastcgi.conf"
+
+server.username      = "lighttpd"
+server.groupname     = "lighttpd"
+server.document-root = var.basedir + "/htdocs"
+server.pid-file      = "/run/lighttpd.pid"
+server.errorlog      = var.logdir  + "/error.log"
+server.indexfiles    = ("index.php", "index.html", "index.htm", "default.htm")
+server.follow-symlink = "enable"
+
+static-file.exclude-extensions = (".php", ".pl", ".cgi", ".fcgi")
+
+accesslog.filename   = var.logdir + "/access.log"
+
+url.access-deny = ("~", ".inc")
+
+$HTTP["url"] =~ "^/dokuwiki/(data|conf|bin|inc|vendor)/+." {
+    url.access-deny = ("")
+}
+

templates/sshd_config.j2

@@ -1,117 +1,11 @@
-#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
-
-# This is the sshd server system-wide configuration file.  See
-# sshd_config(5) for more information.
-
-# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
-
-# The strategy used for options in the default sshd_config shipped with
-# OpenSSH is to specify options with their default value where
-# possible, but leave them commented.  Uncommented options override the
-# default value.
 
 Port {{ container_sshd_port }}
-#AddressFamily any
-#ListenAddress 0.0.0.0
-#ListenAddress ::
-
-#HostKey /etc/ssh/ssh_host_rsa_key
-#HostKey /etc/ssh/ssh_host_ecdsa_key
-#HostKey /etc/ssh/ssh_host_ed25519_key
-
-# Ciphers and keying
-#RekeyLimit default none
-
-# Logging
-#SyslogFacility AUTH
-#LogLevel INFO
-
-# Authentication:
-
-#LoginGraceTime 2m
 PermitRootLogin yes
-#StrictModes yes
-#MaxAuthTries 6
-#MaxSessions 10
-
-#PubkeyAuthentication yes
-
-# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
-# but this is overridden so installations will only check .ssh/authorized_keys
 AuthorizedKeysFile	.ssh/authorized_keys
-
-#AuthorizedPrincipalsFile none
-
-#AuthorizedKeysCommand none
-#AuthorizedKeysCommandUser nobody
-
-# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
-#HostbasedAuthentication no
-# Change to yes if you don't trust ~/.ssh/known_hosts for
-# HostbasedAuthentication
-#IgnoreUserKnownHosts no
-# Don't read the user's ~/.rhosts and ~/.shosts files
-#IgnoreRhosts yes
-
-# To disable tunneled clear text passwords, change to no here!
 PasswordAuthentication no
-#PermitEmptyPasswords no
-
-# Change to no to disable s/key passwords
-#ChallengeResponseAuthentication yes
 
-# Kerberos options
-#KerberosAuthentication no
-#KerberosOrLocalPasswd yes
-#KerberosTicketCleanup yes
-#KerberosGetAFSToken no
-
-# GSSAPI options
-#GSSAPIAuthentication no
-#GSSAPICleanupCredentials yes
-
-# Set this to 'yes' to enable PAM authentication, account processing,
-# and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
-# PasswordAuthentication.  Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
-# If you just want the PAM account and session checks to run without
-# PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
-#UsePAM no
-
-#AllowAgentForwarding yes
-# Feel free to re-enable these if your use case requires them.
 AllowTcpForwarding no
 GatewayPorts no
 X11Forwarding no
-#X11DisplayOffset 10
-#X11UseLocalhost yes
-#PermitTTY yes
-#PrintMotd yes
-#PrintLastLog yes
-#TCPKeepAlive yes
-#PermitUserEnvironment no
-#Compression delayed
-#ClientAliveInterval 0
-#ClientAliveCountMax 3
-#UseDNS no
-#PidFile /run/sshd.pid
-#MaxStartups 10:30:100
-#PermitTunnel no
-#ChrootDirectory none
-#VersionAddendum none
-
-# no default banner path
-#Banner none
-
-# override default of no subsystems
 Subsystem	sftp	/usr/lib/ssh/sftp-server
 
-# Example of overriding settings on a per-user basis
-#Match User anoncvs
-#	X11Forwarding no
-#	AllowTcpForwarding no
-#	PermitTTY no
-#	ForceCommand cvs server