mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-10-31 02:10:05 +00:00
Kevin Veen-Birkenbach
79e702a3ab
- sys-service:
- Set explicit ownership and permissions for generated unit files:
owner=root, group=root, mode=0644. Prevents drift and makes idempotence
predictable when handlers reload/refresh systemd.
- web-svc-collabora:
- Move cmp-docker-proxy include into tasks/01_core.yml and run it
before Nginx config generation. Use public: true only to initialize the
proxy/compose context and docker_compose_flush_handlers: true to ensure
timely handler execution.
- Define role-local variables domain and http_port in vars/main.yml
and use {{ domain }} for the Nginx server file path. These values MUST
be defined locally because they cannot be reliably imported via
public: true — other roles may override them later in the play, leading
to leakage and nondeterministic behavior. Localizing avoids precedence
conflicts without resorting to host-wide set_fact.
- CSP adjusted: add server.security.flags.style-src.unsafe-inline: true
to accommodate Collabora’s inline styles (requested as “csr” in notes).
- Minor variable alignment/cleanup and TODO note for future refactor.
- Housekeeping:
- Rename task title to reflect {{ domain }} usage.
Refs:
- Discussion and rationale in this chat https://chatgpt.com/share/68a731aa-d394-800f-9eb4-2499f45ed54b (2025-08-21, Europe/Berlin).
19 lines
1011 B
YAML
19 lines
1011 B
YAML
---
|
|
# General
|
|
application_id: web-svc-collabora
|
|
|
|
# @todo in a later step it makes sense to refactor the use of them, but they are used atm in the role
|
|
domain: "{{ domains | get_domain(application_id) }}"
|
|
http_port: "{{ ports.localhost.http[application_id] }}"
|
|
|
|
# Container
|
|
container_port: 9980
|
|
container_healthcheck: "/hosting/discovery"
|
|
|
|
# Collabora
|
|
COLLABORA_CONTAINER: "{{ applications | get_app_conf(application_id, 'docker.services.collabora.name') }}"
|
|
COLLABORA_IMAGE: "{{ applications | get_app_conf(application_id, 'docker.services.collabora.image') }}"
|
|
COLLABORA_VERSION: "{{ applications | get_app_conf(application_id, 'docker.services.collabora.version') }}"
|
|
COLLABORA_DOCKER_CONF_EXEC: "docker exec {{ COLLABORA_CONTAINER }} coolconfig"
|
|
COLLABORA_ALLOWED_DOMAINS: "(.*\\.|){{ PRIMARY_DOMAIN | regex_replace('\\.', '\\\\.') }}"
|
|
COLLABORA_ALLOWED_HOSTS: "{{ domains | get_domain('web-app-nextcloud') }}" |