mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-26 21:45:20 +02:00
Kevin Veen-Birkenbach
79e702a3ab
- sys-service:
- Set explicit ownership and permissions for generated unit files:
owner=root, group=root, mode=0644. Prevents drift and makes idempotence
predictable when handlers reload/refresh systemd.
- web-svc-collabora:
- Move cmp-docker-proxy include into tasks/01_core.yml and run it
before Nginx config generation. Use public: true only to initialize the
proxy/compose context and docker_compose_flush_handlers: true to ensure
timely handler execution.
- Define role-local variables domain and http_port in vars/main.yml
and use {{ domain }} for the Nginx server file path. These values MUST
be defined locally because they cannot be reliably imported via
public: true — other roles may override them later in the play, leading
to leakage and nondeterministic behavior. Localizing avoids precedence
conflicts without resorting to host-wide set_fact.
- CSP adjusted: add server.security.flags.style-src.unsafe-inline: true
to accommodate Collabora’s inline styles (requested as “csr” in notes).
- Minor variable alignment/cleanup and TODO note for future refactor.
- Housekeeping:
- Rename task title to reflect {{ domain }} usage.
Refs:
- Discussion and rationale in this chat https://chatgpt.com/share/68a731aa-d394-800f-9eb4-2499f45ed54b (2025-08-21, Europe/Berlin).
33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
- name: "load docker, proxy for '{{ application_id }}'"
|
|
include_role:
|
|
name: cmp-docker-proxy
|
|
public: true
|
|
vars:
|
|
docker_compose_flush_handlers: true
|
|
|
|
- name: "generate {{ domain }}.conf"
|
|
template:
|
|
src: "nginx.conf.j2"
|
|
dest: "{{ NGINX.DIRECTORIES.HTTP.SERVERS }}{{ domain }}.conf"
|
|
notify: restart openresty
|
|
|
|
- name: Update Collabora systemplate to include new fonts
|
|
command: "{{ COLLABORA_DOCKER_CONF_EXEC }} update-system-template"
|
|
register: collabora_fonts
|
|
changed_when: >
|
|
(not ASYNC_ENABLED | bool )
|
|
and
|
|
('updated' in (collabora_fonts.stdout | default('')))
|
|
async: "{{ ASYNC_TIME if (ASYNC_ENABLED | default(false) | bool) else omit }}"
|
|
poll: "{{ ASYNC_POLL if (ASYNC_ENABLED | default(false) | bool) else omit }}"
|
|
when: MODE_UPDATE | bool
|
|
|
|
- name: Allow Nextcloud host IP for Collabora preview conversion
|
|
command: "{{ COLLABORA_DOCKER_CONF_EXEC }} set net.post_allow.host {{ networks.internet.ip4 }}"
|
|
register: collabora_preview
|
|
changed_when: >
|
|
(not ASYNC_ENABLED | bool )
|
|
and
|
|
('already present' not in (collabora_preview.stdout | default('')))
|
|
async: "{{ ASYNC_TIME if ASYNC_ENABLED | bool else omit }}"
|
|
poll: "{{ ASYNC_POLL if ASYNC_ENABLED | bool else omit }}" |