initial commit
This commit is contained in:
commit
684191060c
8 changed files with 340 additions and 0 deletions
3
README.md
Normal file
3
README.md
Normal file
|
@ -0,0 +1,3 @@
|
|||
# plemora-ansible-role
|
||||
|
||||
This role installs and configures Pleroma, PostgreSQL and Nginx on a single instance with Alpine Linux.
|
11
defaults/main.yml
Normal file
11
defaults/main.yml
Normal file
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
pleroma_config_email: admin@localhost
|
||||
pleroma_config_host: pleroma.localhost
|
||||
pleroma_config_listeningPort: 4000
|
||||
pleroma_config_instanceName: "New Pleroma Instance"
|
||||
pleroma_config_characterLimit: 5000
|
||||
pleroma_config_registrationsOpen: "false"
|
||||
pleroma_config_dynamicConfiguration: "false"
|
||||
|
||||
plerom_db_user: pleroma
|
||||
plerom_db_name: pleroma_db
|
27
tasks/main.yml
Normal file
27
tasks/main.yml
Normal file
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
- name: Installing and configuring PostgreSQL.
|
||||
include_tasks:
|
||||
file: postgres.yml
|
||||
apply:
|
||||
tags:
|
||||
- postgres
|
||||
tags:
|
||||
- postgres
|
||||
|
||||
- name: Installing and configuring Pleroma.
|
||||
include_tasks:
|
||||
file: pleroma.yml
|
||||
apply:
|
||||
tags:
|
||||
- pleroma
|
||||
tags:
|
||||
- pleroma
|
||||
|
||||
- name: Installing and configuring Nginx.
|
||||
include_tasks:
|
||||
file: nginx.yml
|
||||
apply:
|
||||
tags:
|
||||
- nginx
|
||||
tags:
|
||||
- nginx
|
55
tasks/nginx.yml
Normal file
55
tasks/nginx.yml
Normal file
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
# py-cryptography is needed for self-signed certificates
|
||||
# we could probably do away with certbot.
|
||||
- name: Nginx -- Ensuring Nginx dependencies are installed.
|
||||
apk:
|
||||
name: nginx, certbot, py-cryptography
|
||||
state: present
|
||||
|
||||
- name: Nginx -- Ensuring that the ssl folder exists
|
||||
file:
|
||||
name: "{{ pleroma_ssl_folder }}"
|
||||
state: directory
|
||||
mode: '0700'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Nginx -- Ensuring that the ssl private key is generated.
|
||||
openssl_privatekey:
|
||||
mode: '0400'
|
||||
group: root
|
||||
owner: root
|
||||
path: "{{ pleroma_ssl_privateKeyPath }}"
|
||||
size: 4096
|
||||
state: present
|
||||
type: RSA
|
||||
|
||||
- name: Nginx -- Ensuring that the certificate signing request is generated.
|
||||
openssl_csr:
|
||||
mode: '0400'
|
||||
group: root
|
||||
owner: root
|
||||
path: "{{ pleroma_ssl_csrPath }}"
|
||||
privatekey_path: "{{ pleroma_ssl_privateKeyPath }}"
|
||||
common_name: "{{ pleroma_config_host }}"
|
||||
|
||||
- name: Nginx -- Ensuring the self-signed certificate is generated.
|
||||
openssl_certificate:
|
||||
path: "{{ pleroma_ssl_selfSignedCertPath }}"
|
||||
privatekey_path: "{{ pleroma_ssl_privateKeyPath }}"
|
||||
csr_path: "{{ pleroma_ssl_csrPath }}"
|
||||
provider: selfsigned
|
||||
|
||||
- name: Nginx -- Ensuring the Nginx configuration is present.
|
||||
template:
|
||||
src: etc_ngnix_confd_pleroma.conf.j2
|
||||
dest: /etc/nginx/conf.d/pleroma.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0400'
|
||||
|
||||
- name: Nginx -- Ensuring that Nginx is enabled and started.
|
||||
service:
|
||||
name: nginx
|
||||
enabled: yes
|
||||
state: started
|
99
tasks/pleroma.yml
Normal file
99
tasks/pleroma.yml
Normal file
|
@ -0,0 +1,99 @@
|
|||
---
|
||||
- name: Ensure Pleroma dependencies are installed.
|
||||
apk:
|
||||
name: unzip, ncurses
|
||||
state: present
|
||||
|
||||
- name: Ensure group 'pleroma' exists.
|
||||
group:
|
||||
gid: 1200
|
||||
name: pleroma
|
||||
state: present
|
||||
system: yes
|
||||
|
||||
- name: Ensure user 'pleroma' exists.
|
||||
user:
|
||||
group: pleroma
|
||||
home: /opt/pleroma
|
||||
name: pleroma
|
||||
shell: /bin/false
|
||||
state: present
|
||||
system: yes
|
||||
uid: 1200
|
||||
|
||||
# Directories
|
||||
- name: Ensure the Pleroma data and config directories exists.
|
||||
file:
|
||||
name: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0700'
|
||||
owner: pleroma
|
||||
group: pleroma
|
||||
loop:
|
||||
- /etc/pleroma
|
||||
- /var/lib/pleroma
|
||||
- /var/lib/pleroma/uploads
|
||||
- /var/lib/pleroma/static
|
||||
|
||||
- name: Ensuring that the release build of pleroma is downloaded.
|
||||
get_url:
|
||||
url: https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/master/download?job=amd64-musl
|
||||
dest: /tmp/pleroma.zip
|
||||
|
||||
- name: Unzipping the release build of pleroma.
|
||||
unarchive:
|
||||
remote_src: yes
|
||||
src: /tmp/pleroma.zip
|
||||
dest: /tmp
|
||||
owner: pleroma
|
||||
group: pleroma
|
||||
|
||||
- name: Ensuring that Pleroma is installed.
|
||||
shell: |
|
||||
find /tmp/release/ -mindepth 1 -maxdepth 1 | xargs -I dir mv dir /opt/pleroma/
|
||||
args:
|
||||
creates: /opt/pleroma/bin/pleroma
|
||||
|
||||
- name: Ensuring the configuration file is set.
|
||||
template:
|
||||
src: etc_pleroma_config.exs.j2
|
||||
dest: /etc/pleroma/config.exs
|
||||
owner: pleroma
|
||||
group: pleroma
|
||||
mode: '0400'
|
||||
|
||||
- name: Running database migrations.
|
||||
command:
|
||||
argv:
|
||||
- pleroma_ctl
|
||||
- migrate
|
||||
environment:
|
||||
PATH: "{{ ansible_env.PATH }}:/opt/pleroma/bin"
|
||||
|
||||
- name: Ensuring that folder permissions are set properly in /opt/pleroma.
|
||||
shell: |
|
||||
find /opt/pleroma -mindepth 1 -maxdepth 1 -type d | xargs -I dir chmod 0700 dir
|
||||
find /opt/pleroma -mindepth 1 -maxdepth 1 -type d | xargs -I dir chown -R pleroma:pleroma dir
|
||||
|
||||
- name: Setting up the Pleroma service.
|
||||
copy:
|
||||
src: /opt/pleroma/installation/init.d/pleroma
|
||||
dest: /etc/init.d/pleroma
|
||||
remote_src: yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0700'
|
||||
|
||||
- name: Ensuring that the Pleroma service is enabled and started.
|
||||
service:
|
||||
name: pleroma
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: Cleaning up
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /tmp/pleroma.zip
|
||||
- /tmp/release
|
55
tasks/postgres.yml
Normal file
55
tasks/postgres.yml
Normal file
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
- name: Postgres -- Ensure that PostgreSQL is installed.
|
||||
apk:
|
||||
name: postgresql, postgresql-contrib, py-psycopg2
|
||||
state: present
|
||||
|
||||
- name: Postgres -- Ensure that the database is initialised.
|
||||
command:
|
||||
argv:
|
||||
- /etc/init.d/postgresql
|
||||
- setup
|
||||
creates: /var/lib/postgresql/11/data/postgresql.conf
|
||||
|
||||
# TODO: Take a look at the postgres configuration file before going into production.
|
||||
# TODO: Take a look at pg_hba before going into production.
|
||||
|
||||
- name: Postgres -- Ensure that PostgreSQL is enabled and started
|
||||
service:
|
||||
name: postgresql
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
- name: waiting for Postgres to become available.
|
||||
wait_for:
|
||||
connect_timeout: 10
|
||||
delay: 5
|
||||
host: localhost
|
||||
port: 5432
|
||||
state: started
|
||||
|
||||
- name: Postgres -- Ensuring that the database user {{ pleroma_db_user }} exists.
|
||||
postgresql_user:
|
||||
db: postgres
|
||||
encrypted: yes
|
||||
name: "{{ pleroma_db_user }}"
|
||||
password: "{{ pleroma_db_password }}"
|
||||
state: present
|
||||
|
||||
- name: Postgres -- Ensuring that the database {{ pleroma_db_name }} exists.
|
||||
postgresql_db:
|
||||
conn_limit: "20"
|
||||
encoding: UTF-8
|
||||
name: "{{ pleroma_db_name }}"
|
||||
owner: "{{ pleroma_db_user }}"
|
||||
state: present
|
||||
|
||||
- name: Postgres -- Ensuring the PostgreSQL extensions is added to the database.
|
||||
postgresql_ext:
|
||||
name: "{{ item }}"
|
||||
db: "{{ pleroma_db_name }}"
|
||||
state: present
|
||||
loop:
|
||||
- citext
|
||||
- pg_trgm
|
||||
- uuid-ossp
|
85
templates/etc_ngnix_confd_pleroma.conf.j2
Normal file
85
templates/etc_ngnix_confd_pleroma.conf.j2
Normal file
|
@ -0,0 +1,85 @@
|
|||
proxy_cache_path /tmp/pleroma-media-cache levels=1:2 keys_zone=pleroma_media_cache:10m max_size=10g
|
||||
inactive=720m use_temp_path=off;
|
||||
|
||||
server {
|
||||
server_name {{ pleroma_config_host }};
|
||||
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
# Uncomment this if you need to use the 'webroot' method with certbot. Make sure
|
||||
# that the directory exists and that it is accessible by the webserver. If you followed
|
||||
# the guide, you already ran 'mkdir -p /var/lib/letsencrypt' to create the folder.
|
||||
# You may need to load this file with the ssl server block commented out, run certbot
|
||||
# to get the certificate, and then uncomment it.
|
||||
#
|
||||
# location ~ /\.well-known/acme-challenge {
|
||||
# root /var/lib/letsencrypt/;
|
||||
# }
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# Enable SSL session caching for improved performance
|
||||
ssl_session_cache shared:ssl_session_cache:10m;
|
||||
|
||||
server {
|
||||
server_name {{ pleroma_config_host }};
|
||||
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_session_timeout 5m;
|
||||
|
||||
# ssl_trusted_certificate /etc/letsencrypt/live/{{ pleroma_config_host }}/chain.pem;
|
||||
ssl_certificate {{ pleroma_ssl_selfSignedCertPath }};
|
||||
ssl_certificate_key {{ pleroma_ssl_privateKeyPath }};
|
||||
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
|
||||
ssl_prefer_server_ciphers on;
|
||||
# In case of an old server with an OpenSSL version of 1.0.2 or below,
|
||||
# leave only prime256v1 or comment out the following line.
|
||||
ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
|
||||
|
||||
# the nginx default is 1m, not enough for large media uploads
|
||||
client_max_body_size 16m;
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $http_host;
|
||||
|
||||
# this is explicitly IPv4 since Pleroma.Web.Endpoint binds on IPv4 only
|
||||
# and `localhost.` resolves to [::0] on some systems: see issue #930
|
||||
proxy_pass http://127.0.0.1:{{ pleroma_config_listeningPort }};
|
||||
|
||||
client_max_body_size 16m;
|
||||
}
|
||||
|
||||
location ~ ^/(media|proxy) {
|
||||
proxy_cache pleroma_media_cache;
|
||||
slice 1m;
|
||||
proxy_cache_key $host$uri$is_args$args$slice_range;
|
||||
proxy_set_header Range $slice_range;
|
||||
proxy_http_version 1.1;
|
||||
proxy_cache_valid 200 206 301 304 1h;
|
||||
proxy_cache_lock on;
|
||||
proxy_ignore_client_abort on;
|
||||
proxy_buffering on;
|
||||
chunked_transfer_encoding on;
|
||||
proxy_ignore_headers Cache-Control;
|
||||
proxy_hide_header Cache-Control;
|
||||
proxy_pass http://localhost:{{ pleroma_config_listeningPort }};
|
||||
}
|
||||
}
|
5
vars/main.yml
Normal file
5
vars/main.yml
Normal file
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
pleroma_ssl_folder: /etc/ssl/pleroma
|
||||
pleroma_ssl_privateKeyPath: "{{ pleroma_ssl_folder }}/pleroma.key"
|
||||
pleroma_ssl_csrPath: "{{ pleroma_ssl_folder }}/pleroma.csr"
|
||||
pleroma_ssl_selfSignedCertPath: "{{ pleroma_ssl_folder }}/pleroma.crt"
|
Reference in a new issue