PPBe
/
ansible-role-mumble
3
0
Fork 0
Code Issues 1 Pull Requests Releases Wiki Activity

replace nginx with caddy2

3-replace-nginx-with-caddy2
HgO 2021-03-28 10:48:06 +02:00
parent 7bb919e184
commit 66b27f9087
18 changed files with 254 additions and 142 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
defaults/main.yml
View File

@ -2,37 +2,32 @@ mumble_domain: "{{ inventory_hostname }}.local"
acme_enabled: no
acme_domains:
- name: "{{ mumble_domain }}"
hooks: |
{{ (
'systemctl reload nginx' if mumble_web_enabled else None,
'systemctl restart mumble-server' if murmur_enabled else None
) | reject("none") | list }}
- name: "{{ murmur_domains | first }}"
alt_domains: "{{ murmur_domains[1:] }}"
hooks:
- systemctl restart mumble-server
acme_directory_url: https://acme-v02.api.letsencrypt.org/directory
mumble_web_enabled: no
mumble_web_domain: "{{ mumble_domain }}"
mumble_web_domains:
- "{{ mumble_domain }}"
mumble_web_owner: mumble-web
mumble_web_group: "{{ mumble_web_owner }}"
mumble_web_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/{{ acme_enabled | ternary('fullchain','cert') }}.pem"
mumble_web_trusted_certificate: "{{ acme_certs_dir }}/{{ mumble_web_domain }}.d/chain.pem"
mumble_web_private_key: "{{ acme_keys_dir }}/{{ mumble_web_domain }}.key"
mumble_web_www_dir: /var/www/mumble-web
mumble_web_dist_dir: "{{ mumble_web_www_dir }}/dist"
mumble_web_home_dir: /var/www/mumble-web
mumble_web_code_dir: "{{ mumble_web_home_dir }}/code"
mumble_web_dist_dir: "{{ mumble_web_code_dir }}/dist"
mumble_web_version: master
mumble_web_websockify_port: "64737"
mumble_web_nginx_enabled: yes
mumble_web_nginx_domains:
- "{{ mumble_web_domain }}"
mumble_web_nginx_config_dir: /etc/nginx
mumble_web_nginx_log_dir: /var/log/nginx
mumble_web_nginx_generate_dhparam: yes
mumble_web_nginx_dhparam: "{{ mumble_web_nginx_config_dir }}/ssl/dhparam.pem"
mumble_web_nginx_dhparam_size: 2048
mumble_web_caddy_enabled: yes
caddy_config_dir: /etc/caddy/conf.d
caddy_log_dir: /var/log/caddy
caddy_owner: caddy
caddy_group: caddy
murmur_enabled: no
murmur_domain: "{{ mumble_domain }}"
murmur_domains:
- "{{ mumble_domain }}"
murmur_superuser_password: supersecret
murmur_database:
path: "/var/lib/mumble-server/mumble-server.sqlite"
@ -82,9 +77,9 @@ murmur_register:
hostname: "mymumblehostname.domain.org"
# Enable Bonjour for dev purpose
murmur_bonjour_enabled: no
murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/{{ acme_enabled | ternary('fullchain', 'cert') }}.pem"
murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domain }}.d/chain.pem"
murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domain }}.key"
murmur_certificate: "{{ acme_certs_dir }}/{{ murmur_domains | first }}.d/fullchain.pem"
murmur_trusted_certificate: "{{ acme_certs_dir }}/{{ murmur_domains | first }}.d/chain.pem"
murmur_private_key: "{{ acme_keys_dir }}/{{ murmur_domains | first }}.key"
murmur_dhparam: "@ffdhe4096"
murmur_owner: "mumble-server"
murmur_group: "{{ murmur_owner }}"

6
handlers/main.yml
View File

@ -17,8 +17,10 @@
when:
- not (mumble_web_started.changed | default(false))
- name: reload nginx
include_tasks: ../handlers/nginx.yml
- name: reload caddy
service:
name: caddy
state: reloaded
- name: change murmur superuser password
command: murmurd -ini /etc/mumble-server.ini -supw "{{ murmur_superuser_password }}"

7
handlers/nginx.yml
View File

@ -1,7 +0,0 @@
- name: Validate Nginx config
command: nginx -t
- name: Reload Nginx server
service:
name: nginx
state: reloaded

45
molecule/default/prepare.yml
View File

@ -8,7 +8,48 @@
update_cache: yes
cache_valid_time: 3600
- name: Install nginx package
- name: Install GPG package
package:
name: nginx-light
name: gpg
state: present
- name: Add Caddy2 APT key
apt_key:
url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
state: present
- name: Add Caddy2 APT repository
apt_repository:
repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
filename: caddy-stable
state: present
- name: Install caddy package
package:
name: caddy
state: present
- name: Create Caddy2 config directory
file:
path: "/etc/caddy/conf.d"
state: directory
owner: root
group: root
mode: "0755"
- name: Create Caddy2 log directory
file:
path: "/var/log/caddy"
state: directory
owner: caddy
group: caddy
mode: "0755"
- name: Copy Caddy2 config file
copy:
content:
import conf.d/*.conf
dest: /etc/caddy/Caddyfile
owner: root
group: root
mode: "0644"

45
molecule/mumble-web/prepare.yml
View File

@ -8,7 +8,48 @@
update_cache: yes
cache_valid_time: 3600
- name: Install nginx package
- name: Install GPG package
package:
name: nginx-light
name: gpg
state: present
- name: Add Caddy2 APT key
apt_key:
url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
state: present
- name: Add Caddy2 APT repository
apt_repository:
repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
filename: caddy-stable
state: present
- name: Install caddy package
package:
name: caddy
state: present
- name: Create Caddy2 config directory
file:
path: "/etc/caddy/conf.d"
state: directory
owner: root
group: root
mode: "0755"
- name: Create Caddy2 log directory
file:
path: "/var/log/caddy"
state: directory
owner: caddy
group: caddy
mode: "0755"
- name: Copy Caddy2 config file
copy:
content:
import conf.d/*.conf
dest: /etc/caddy/Caddyfile
owner: root
group: root
mode: "0644"

46
molecule/murmur/prepare.yml
View File

@ -7,3 +7,49 @@
apt:
update_cache: yes
cache_valid_time: 3600
- name: Install GPG package
package:
name: gpg
state: present
- name: Add Caddy2 APT key
apt_key:
url: https://dl.cloudsmith.io/public/caddy/stable/gpg.155B6D79CA56EA34.key
state: present
- name: Add Caddy2 APT repository
apt_repository:
repo: deb https://dl.cloudsmith.io/public/caddy/stable/deb/{{ ansible_distribution | lower }} any-version main
filename: caddy-stable
state: present
- name: Install caddy package
package:
name: caddy
state: present
- name: Create Caddy2 config directory
file:
path: "/etc/caddy/conf.d"
state: directory
owner: root
group: root
mode: "0755"
- name: Create Caddy2 log directory
file:
path: "/var/log/caddy"
state: directory
owner: caddy
group: caddy
mode: "0755"
- name: Copy Caddy2 config file
copy:
content:
import conf.d/*.conf
dest: /etc/caddy/Caddyfile
owner: root
group: root
mode: "0644"

13
tasks/caddy.yml 100644
View File

@ -0,0 +1,13 @@
- name: Copy Caddy2 config file
template:
src: mumble-web/Caddyfile.j2
dest: "{{ caddy_config_dir }}/mumble.conf"
owner: "{{ caddy_owner }}"
group: "{{ caddy_group }}"
mode: "0640"
# validate: caddy validate -config %s
notify: reload caddy
tags: caddy_config
- name: Trigger Caddy2 handlers
meta: flush_handlers

21
tasks/dhparam/begin.yml
View File

@ -1,21 +0,0 @@
- name: Ensure Diffie-Hellman directory exists
file:
path: "{{ mumble_web_nginx_dhparam | dirname }}"
state: directory
owner: root
group: www-data
mode: "755"
- name: Generate Diffie-Hellman parameters
# This can take a long time... So we are doing it in async mode
openssl_dhparam:
path: "{{ mumble_web_nginx_dhparam }}"
state: present
owner: root
group: www-data
mode: "640"
size: "{{ mumble_web_nginx_dhparam_size }}"
async: 3600
poll: 0
changed_when: no
register: _mumble_web_nginx_dhparam

7
tasks/dhparam/end.yml
View File

@ -1,7 +0,0 @@
- name: Waiting for Diffie-Hellman task to complete…
async_status:
jid: "{{ _mumble_web_nginx_dhparam.ansible_job_id }}"
register: _mumble_web_nginx_dhparam_job
retries: 60
delay: 30 # will retry every 30s for 30min (60 retries)
until: _mumble_web_nginx_dhparam_job.finished

26
tasks/main.yml
View File

@ -1,21 +1,14 @@
- name: Generate Diffie-Hellman parameters in async mode
import_tasks: dhparam/begin.yml
when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
tags:
- certificate
- dhparam
- name: Install ACME certificates
import_role:
name: ppbe.acme
when: acme_enabled
when: acme_enabled and murmur_enabled
tags:
- certificate
- acme
- name: Install Self-Signed certificates
import_tasks: self_signed.yml
when: not acme_enabled
when: not acme_enabled and murmur_enabled
tags:
- certificate
- self_signed
@ -30,14 +23,7 @@
when: mumble_web_enabled
tags: mumble_web
- name: Wait for Diffie-Hellman task to complete
import_tasks: dhparam/end.yml
when: mumble_web_enabled and mumble_web_nginx_generate_dhparam
tags:
- certificate
- dhparam
- name: Configure Nginx for mumble web client
import_tasks: nginx.yml
when: mumble_web_enabled and mumble_web_nginx_enabled
tags: nginx
- name: Configure Caddy2 for mumble web client
import_tasks: caddy.yml
when: mumble_web_enabled and mumble_web_caddy_enabled
tags: caddy

33
tasks/mumble_web.yml
View File

@ -19,19 +19,19 @@
- name: Create mumble-web system user
user:
name: "{{ mumble_web_owner }}"
home: "{{ mumble_web_www_dir }}"
home: "{{ mumble_web_home_dir }}"
groups:
- www-data
- www-data
shell: /sbin/nologin
password: '*'
state: present
system: yes
append: yes
create_home: no
tags: mumble_web_install
- name: Change mumble-web home directory's permissions
file:
path: "{{ mumble_web_www_dir }}"
path: "{{ mumble_web_home_dir }}"
owner: "{{ mumble_web_owner }}"
group: "{{ mumble_web_group }}"
mode: "755"
@ -41,7 +41,7 @@
- name: Clone mumble-web git repository
git:
repo: https://github.com/Johni0702/mumble-web.git
dest: "{{ mumble_web_www_dir }}"
dest: "{{ mumble_web_code_dir }}"
version: "{{ mumble_web_version }}"
register: mumble_web_cloned
become_user: "{{ mumble_web_owner }}"
@ -49,26 +49,33 @@
- name: Check if mumble-web dist directory exists
stat:
path: "{{ mumble_web_www_dir }}/dist"
path: "{{ mumble_web_dist_dir }}"
register: _mumble_web_dist
tags:
- mumble_web_install
- mumble_web_build
- name: Build mumble-web from sources
command: npm clean-install
command: npm clean-install {{ mumble_web_dist_dir | quote }}
args:
chdir: "{{ mumble_web_www_dir }}"
chdir: "{{ mumble_web_code_dir }}"
register: _mumble_web_installed
become_user: "{{ mumble_web_owner }}"
when: mumble_web_cloned is changed or not _mumble_web_dist.stat.exists
tags: [mumble_web_install,mumble_web_build]
tags:
- mumble_web_install
- mumble_web_build
- name: Copy mumble-web config file
template:
src: mumble-web/config.js.j2
dest: "{{ mumble_web_www_dir }}/dist/config.local.js"
dest: "{{ mumble_web_dist_dir }}/config.local.js"
owner: "{{ mumble_web_owner }}"
group: "{{ mumble_web_group }}"
mode: "644"
tags: [mumble_web_install,mumble_web_config]
tags:
- mumble_web_install
- mumble_web_config
- name: Copy mumble-web systemd service
template:
@ -80,7 +87,9 @@
notify:
- reload systemd
- reload mumble-web
tags: [mumble_web_install,mumble_web_config]
tags:
- mumble_web_install
- mumble_web_config
- name: Start mumble-web service
service:

34
tasks/murmur.yml
View File

@ -3,17 +3,16 @@
name: mumble-server
state: present
register: murmur_installed
tags: murmur_install
- name: Install ICE dependencies for Python
package:
name: "{{ package }}"
name:
- python3-zeroc-ice
- python3-yaml
- zeroc-ice-compilers
state: present
loop:
- python3-zeroc-ice
- python3-yaml
- zeroc-ice-compilers
loop_control:
loop_var: package
tags: murmur_install
- name: Append ssl-cert group to {{ murmur_owner }} user
user:
@ -24,6 +23,7 @@
append: yes
system: yes
notify: restart murmur
tags: murmur_install
- name: Copy Murmur config file
template:
@ -33,12 +33,16 @@
group: "{{ murmur_group }}"
mode: "640"
notify: restart murmur
tags:
- murmur_install
- murmur_config
- name: Start mumble-server service
service:
name: mumble-server
enabled: yes
state: started
tags: murmur_install
- name: Write superuser password to a file
copy:
@ -49,6 +53,9 @@
mode: "600"
when: murmur_superuser_password is defined
notify: change murmur superuser password
tags:
- murmur_install
- murmur_config
- name: Trigger Murmur handlers
meta: flush_handlers
@ -60,6 +67,9 @@
owner: root
group: root
mode: "755"
tags:
- murmur_install
- murmur_ice
- name: Copy mice Python script
copy:
@ -70,6 +80,9 @@
mode: "755"
notify: create murmur channels
register: _murmur_mice_script_copied
tags:
- murmur_install
- murmur_ice
- name: Compile Murmur.ice slice file
command: |-
@ -81,6 +94,9 @@
args:
chdir: "{{ murmur_ice_script_dir }}"
when: _murmur_mice_script_copied is changed
tags:
- murmur_install
- murmur_ice
- name: Copy mice config
copy:
@ -91,6 +107,10 @@
group: root
mode: "644"
notify: create murmur channels
tags:
- murmur_install
- murmur_config
- murmur_ice
- name: Trigger Mice handlers
meta: flush_handlers

18
tasks/nginx.yml
View File

@ -1,18 +0,0 @@
- name: Copy Nginx config file
template:
src: mumble-web/nginx.conf.j2
dest: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
owner: root
group: www-data
mode: "755"
notify: reload nginx
- name: Enable Nginx config file
file:
src: "{{ mumble_web_nginx_config_dir }}/sites-available/mumble.conf"
path: "{{ mumble_web_nginx_config_dir }}/sites-enabled/mumble.conf"
state: link
notify: reload nginx
- name: Trigger Nginx handlers
meta: flush_handlers

9
tasks/self_signed.yml
View File

@ -1,12 +1,9 @@
- name: Install SSL dependencies
package:
name: "{{ package }}"
name:
- ssl-cert
- python3-openssl
state: present
loop:
- ssl-cert
- python3-openssl
loop_control:
loop_var: package
tags: selfsigned_install
- name: Create SSL config directories

3
tasks/self_signed_domain.yml
View File

@ -31,7 +31,7 @@
- name: Generate self-signed certificate
openssl_certificate:
path: "{{ acme_certs_dir }}/{{ domain.name }}.d/cert.pem"
path: "{{ acme_certs_dir }}/{{ domain.name }}.d/fullchain.pem"
csr_path: "{{ acme_csr_dir }}/{{ domain.name }}.csr"
privatekey_path: "{{ acme_keys_dir }}/{{ domain.name }}.key"
provider: selfsigned
@ -39,3 +39,4 @@
owner: root
group: root
mode: "644"
tags: selfsigned_config

14
templates/mumble-web/Caddyfile.j2 100644
View File

@ -0,0 +1,14 @@
{{ ansible_managed | comment }}
{{ mumble_web_domains | join(',') }} {
root * {{ mumble_web_dist_dir }}
file_server
{% if not acme_enabled %}
tls internal
{% endif %}
reverse_proxy /mumble http://localhost:{{ mumble_web_websockify_port }}
log {
output file {{ caddy_log_dir }}/{{ mumble_web_domains | first }}.log
}
}

2
templates/mumble-web/config.js.j2
View File

@ -20,4 +20,4 @@ config.connectDialog.password = {{ (murmur_server_password != '') | lower }}
config.settings.pttKey = 'shift'
// Default values (can be changed by passing a query parameter of the same name)
config.defaults.address = "{{ mumble_web_domain }}/mumble"
config.defaults.address = "{{ mumble_web_domains | first }}/mumble"

16
templates/mumble-web/nginx.conf.j2
View File

@ -2,7 +2,7 @@
server {
listen 80;
listen [::]:80;
server_name {{ mumble_web_nginx_domains | join(' ') }};
server_name {{ mumble_web_domains | join(' ') }};
location / {
return 301 https://$host$request_uri;
@ -16,15 +16,15 @@ server {
}
{% endif %}
access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
access_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-access.log;
error_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-error.log;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ mumble_web_nginx_domains | join(' ') }};
server_name {{ mumble_web_domains | join(' ') }};
ssl_certificate {{ mumble_web_certificate }};
ssl_certificate_key {{ mumble_web_private_key }};
@ -33,8 +33,8 @@ server {
ssl_session_cache shared:AnsibleSSL:10m; # about 40000 sessions
ssl_session_tickets off;
{% if mumble_web_nginx_dhparam %}
ssl_dhparam {{ mumble_web_nginx_dhparam }};
{% if nginx_dhparam %}
ssl_dhparam {{ nginx_dhparam }};
{% endif %}
ssl_protocols TLSv1.2 TLSv1.3;
@ -63,8 +63,8 @@ server {
proxy_set_header Connection $connection_upgrade;
}
access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
access_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-access.log;
error_log {{ nginx_log_dir }}/{{ mumble_web_domains | first }}-error.log;
}
map $http_upgrade $connection_upgrade {