Optimized Nextcloud Configuration

roles/docker-nextcloud/tasks/config.yml

@@ -1,33 +0,0 @@
-- name: "Substitute http with https in {{ nextcloud_config_file_host_path }}"
-  replace:
-    path: "{{ nextcloud_config_file_host_path }}"
-    regexp: "http://{{ domain | regex_escape }}"
-    replace: "https://{{ domain }}"
-  notify:
-    - docker compose restart
-
-#- name: Ensure 'overwriteprotocol' is set to 'https' in Nextcloud {{ nextcloud_config_file_host_path }}
-#  block:
-#     Deactivated because it was really heavy to fix. 
-#     @todo implement
-#    - name: Check if 'overwriteprotocol' is already set
-#      lineinfile:
-#        path: "{{ nextcloud_config_file_host_path }}"
-#        regexp: "^\s*overwriteprotocol\s*=>\s*http"
-#        line: "overwriteprotocol => 'https',"
-#        backrefs: yes
-#        state: present
-#        notify:
-#          - docker compose restart
-#
-#    - name: Add 'overwriteprotocol' => 'https' if not present
-#      lineinfile:
-#        path: "{{ nextcloud_config_file_host_path }}"
-#        regexp: "^\s*\);$"
-#        line: "overwriteprotocol => 'https',"
-#        insertafter: "^\s*\);$"
-#        state: present
-#        notify:
-#          - docker compose restart        
-#  notify:
-#    - docker compose restart

roles/docker-nextcloud/tasks/ldap.yml

@@ -1,17 +0,0 @@
-# @See https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html
-# @See https://chatgpt.com/c/67aa2d21-cb4c-800f-b1be-8629b6bd3f55
-# @todo implement
-- name: Load LDAP Nextcloud configuration variables
-  include_vars:
-    file: ldap.yml
-
-- name: Set Nextcloud LDAP config
-  loop: "{{ nextcloud_ldap_configuration }}"
-  command: >
-    docker exec -u www-data {{ applications.nextcloud.container.application }}
-    php occ config:app:set {{ item.appid }} {{ item.configkey }} --value "{{ item.configvalue }}"
-
-- name: Set Nextcloud LDAP bind password
-  command: >
-    docker exec -u www-data {{ applications.nextcloud.container.application }}
-    php occ ldap:set-config s01 ldapAgentPassword "{{ ldap.bind_credential }}"

roles/docker-nextcloud/tasks/legacy_login_mask.yml

@@ -1,5 +0,0 @@
-- name: Set hide_login_form to true
-  command: "docker exec -u www-data {{applications.nextcloud.container.application}} {{nextcloud_docker_path}}occ config:system:set --type boolean --value {{ (not applications[application_id].legacy_login_mask.enabled) | lower }} hide_login_form"
-
-- name: "Set auth.webauthn.enabled to false"
-  command: "docker exec -u www-data {{applications.nextcloud.container.application}} {{nextcloud_docker_path}}occ config:system:set --type boolean --value {{applications[application_id].legacy_login_mask.enabled | lower}} auth.webauthn.enabled"

roles/docker-nextcloud/tasks/main.yml

@@ -3,22 +3,20 @@
   include_role: 
     name: docker-central-database
 
-- name: copy oidc.config.php
-  template: 
-    src: oidc.config.php.j2
-    dest: "{{nextcloud_host_oidc_login_path}}"
-    owner: 82 # User www-data in Nextcloud container
-    group: 82 # User www-data in Nextcloud container
-  when: applications[application_id].oidc.flavor == "oidc_login" 
+- name: "create {{ nextcloud_docker_config_additives_directory }}"
+  file:
+    path: "{{ nextcloud_docker_config_additives_directory }}"
+    state: directory
+    mode: 0755
 
-- name: Remove OIDC configuration lines from config.php if present (container)
-  command: >
-    docker exec -u www-data {{ applications.nextcloud.container.application }} sh -c "sed -i '/CONFIG_EXTRA = include.*oidc\.config\.php/d' /var/www/html/config/config.php && sed -i '/CONFIG = array_merge(\\$CONFIG, \\$CONFIG_EXTRA)/d' /var/www/html/config/config.php"
-  when: applications[application_id].oidc.flavor == "sociallogin" and mode_cleanup | bool 
-
-- name: Set maintanance window 
-  command: >
-    docker exec -u www-data {{ applications.nextcloud.container.application }} php occ config:system:set maintenance_window_start --type=integer --value={{on_calendar_nextcloud}}"
+- name: "Create config files at {{ nextcloud_docker_config_additives_directory }}"
+  template:
+    src:    "{{ item }}"
+    dest:   "{{ nextcloud_docker_config_additives_directory }}/{{ item | basename | regex_replace('\\.j2$', '') }}"
+    owner:  "{{nextcloud_docker_user_id}}"
+    group:  "{{nextcloud_docker_user_id}}"
+  loop:     "{{ lookup('fileglob', role_path ~ '/templates/config/*.j2', wantlist=True) }}"
+  notify: docker compose restart
 
 - name: "include role for {{application_id}} to recieve certs & do modification routines"
   include_role:
@@ -26,15 +24,15 @@
 
 - name: create nextcloud nginx proxy configuration file
   template: 
-    src:  "proxy-nginx.conf.j2" 
+    src:  "nginx/host.conf.j2" 
     dest: "{{nginx.directories.http.servers}}{{domains[application_id]}}.conf"
   notify: restart nginx
 
 - name: create internal nextcloud nginx configuration
   template: 
-    src:  "internal-nginx.conf.j2" 
+    src:  "nginx/docker.conf.j2" 
     dest: "{{docker_compose.directories.volumes}}nginx.conf"
-  notify: restart docker nginx service
+  notify: restart nextcloud nginx service
 
 - name: "copy docker-compose.yml and env file"
   include_tasks: copy-docker-compose-and-env.yml
@@ -42,25 +40,43 @@
 - name: Flush all handlers immediately so that occ can be used
   meta: flush_handlers
 
+- name: Merge all files in cymais directory (container)
+  block:
+    - name: Add dynamic config merging from Jinja template
+      template:
+        src: include.php.j2
+        dest: "{{nextcloud_host_include_instructions_file}}"
+      notify: docker compose restart
+
+    - name: Copy include instructions to the container
+      command: >
+        docker cp {{ nextcloud_host_include_instructions_file }} {{ applications.nextcloud.container.application }}:{{nextcloud_docker_include_instructions_file}}
+
+    - name: Append generated config to config.php only if not present
+      command: >
+        docker exec -u {{nextcloud_docker_user}} {{ applications.nextcloud.container.application }} sh -c "
+          grep -q 'foreach (glob(\"{{ nextcloud_docker_config_additives_directory }}*.php\") as \$file)' {{ nextcloud_docker_config_file }} || 
+          cat {{nextcloud_docker_include_instructions_file}} >> {{ nextcloud_docker_config_file }}"
+      notify: docker compose restart
+
 - name: Setup Nextcloud Plugins
   include_tasks: plugin.yml
   loop: "{{applications[application_id].plugins | dict2items }}"
   loop_control:
     loop_var: plugin_item
   vars:
-    plugin_name: "{{ plugin_item.key }}"
-    plugin_configuration: "{{ plugin_item.value }}"
+    plugin_key:   "{{ plugin_item.key }}"
+    plugin_value: "{{ plugin_item.value }}"
 
-- name: "Include OIDC-specific tasks with flavor {{applications[application_id].oidc.flavor}}"
-  include_tasks: "{{applications[application_id].oidc.flavor}}.yml"
-  when: applications[application_id].oidc.enabled | bool
+- name: Load system configuration
+  include_tasks: system.yml
 
-- name: Include LDAP specific tasks
-  include_tasks: ldap.yml
-  when: applications[application_id].ldap.enabled | bool
-
-- name: Include Config specific tasks
-  include_tasks: config.yml
-
-- name: De\Activate legacy login mask
-  include_tasks: legacy_login_mask.yml
+- name: Add missing database indices in Nextcloud
+  command: >
+    {{nextcloud_docker_exec_occ}} db:add-missing-indices
+  register: db_indices_result
+  changed_when: >
+    'Adding additional' in db_indices_result.stdout or 
+    'Removing' in db_indices_result.stdout or 
+    'updated successfully' in db_indices_result.stdout
+  failed_when: db_indices_result.rc != 0

roles/docker-nextcloud/tasks/oidc_login.yml

@@ -1,3 +0,0 @@
-- name: Add OIDC configuration if not implemented yet
-  command: >
-    docker exec -u www-data {{ applications.nextcloud.container.application }} sh -c 'grep -q "CONFIG_EXTRA = include" ./config/config.php || echo -e "\n\$CONFIG_EXTRA = include '\''{{nextcloud_docker_oidc_login_config_path}}'\'';\n\$CONFIG = array_merge(\$CONFIG, \$CONFIG_EXTRA);" >> ./config/config.php'

roles/docker-nextcloud/tasks/plugin.yml

@@ -1,29 +1,47 @@
-- name: "Disable incompatible plugins for {{plugin_name}}."
-  command: "docker exec -u www-data {{applications.nextcloud.container.application}} {{nextcloud_docker_path}}occ app:disable {{incompatible_plugin}}"
-  loop: "{{plugin_configuration.incompatible_plugins}}"
+- name: "Disable incompatible plugins for {{plugin_key}}."
+  command: "{{nextcloud_docker_exec_occ}} app:disable {{incompatible_plugin}}"
+  loop: "{{plugin_value.incompatible_plugins}}"
   loop_control: 
     loop_var: incompatible_plugin
   register: disable_incompatible_plugin_result
   changed_when: disable_incompatible_plugin_result.rc == 0 and ("No such app enabled" not in disable_incompatible_plugin_result.stdout)
   when: 
-    - plugin_configuration.incompatible_plugins is defined and plugin_configuration.incompatible_plugins | length > 0
-    - plugin_configuration.enabled | bool
+    - plugin_value.incompatible_plugins is defined and plugin_value.incompatible_plugins | length > 0
+    - plugin_value.enabled | bool
 
-- name: disable {{ plugin_name }} nextcloud plugin
-  command: "docker exec -u www-data {{ applications.nextcloud.container.application }} {{ nextcloud_docker_path }}occ app:disable {{ plugin_name }}"
+- name: disable {{ plugin_key }} nextcloud plugin
+  command: "{{nextcloud_docker_exec_occ}} app:disable {{ plugin_key }}"
   register: disable_result
   changed_when: disable_result.rc == 0 and ("No such app enabled" not in disable_result.stdout)
-  when: not (plugin_configuration.enabled | bool)
+  when: not (plugin_value.enabled | bool)
 
-- name: install {{ plugin_name }} nextcloud plugin
-  command: "docker exec -u www-data {{ applications.nextcloud.container.application }} {{ nextcloud_docker_path }}occ app:install {{ plugin_name }}"
+- name: install {{ plugin_key }} nextcloud plugin
+  command: "{{nextcloud_docker_exec_occ}} app:install {{ plugin_key }}"
   register: install_result
   failed_when: install_result.rc != 0 and ("already installed" not in install_result.stdout)
   changed_when: install_result.rc == 0 and ("already installed" not in install_result.stdout)
-  when: plugin_configuration.enabled | bool
+  when: plugin_value.enabled | bool
 
-- name: enable {{plugin_name}} nextcloud plugin
-  command: "docker exec -u www-data {{applications.nextcloud.container.application}} {{nextcloud_docker_path}}occ app:enable {{plugin_name}}"
+- name: enable {{plugin_key}} nextcloud plugin
+  command: "{{nextcloud_docker_exec_occ}} app:enable {{plugin_key}}"
   register: enable_result
   changed_when: enable_result.rc == 0 and ("already enabled" not in enable_result.stdout)
-  when: plugin_configuration.enabled | bool
+  when: plugin_value.enabled | bool
+
+- name: Check if {{nextcloud_localhost_plugin_configuration_directory}}{{ plugin_key }}.yml exists
+  stat:
+    path: "{{nextcloud_localhost_plugin_configuration_directory}}{{ plugin_key }}.yml"
+  register: plugin_config_file
+
+- name: Apply configuration to {{ plugin_key }} 
+  block:
+  - name: Load {{ plugin_key }} configuration variables
+    include_vars:
+      file: "{{nextcloud_localhost_plugin_configuration_directory}}{{ plugin_key }}.yml"
+  
+  - name: "Set {{ item.configkey }} for {{ item.appid }}"
+    loop: "{{ plugin_configuration }}"
+    command: >
+      {{ nextcloud_docker_exec_occ }} config:app:set {{ item.appid }} {{ item.configkey }} --value '{{ item.configvalue | to_json if item.configvalue is mapping else item.configvalue }}'
+  
+  when: plugin_config_file.stat.exists

roles/docker-nextcloud/tasks/plugins/ldap.yml

@@ -0,0 +1,6 @@
+# @See https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html
+# @See https://chatgpt.com/c/67aa2d21-cb4c-800f-b1be-8629b6bd3f55
+
+- name: Set Nextcloud LDAP bind password
+  command: >
+    {{ nextcloud_docker_exec_occ }} ldap:set-config s01 ldapAgentPassword "{{ ldap.bind_credential }}"

roles/docker-nextcloud/tasks/sociallogin.yml

@@ -1,11 +0,0 @@
-# @See https://chatgpt.com/share/6798189e-9c00-800f-923c-5ce3cfbdf405
-- name: Load Sociallogin configuration variables
-  include_vars:
-    file: sociallogin.yml
-
-- name: Configure Sociallogin
-  loop: "{{ nextcloud_sociallogin_configuration}}"
-  # The | to_json function is necessary to escape custom_providers correct.
-  command: >
-    docker exec -u www-data {{ applications.nextcloud.container.application }}
-    php occ config:app:set {{ item.appid }} {{ item.configkey }} --value '{{ item.configvalue | to_json if item.configvalue is mapping else item.configvalue }}'

roles/docker-nextcloud/tasks/system.yml

@@ -0,0 +1,8 @@
+- name: Load System Nextcloud configuration variables
+  include_vars:
+    file: system.yml
+
+- name:     Apply Nextcloud configurations
+  loop:     "{{ nextcloud_system_config }}"
+  command:  "{{nextcloud_docker_exec_occ}} config:system:set {{ item.parameter }}{% if item.type is defined %} --type {{ item.type }}{% endif %} --value {{ item.value }}"
+  # No good changed_when condition available