feat(oidc_user_backend): add ansible role

README.md

@@ -7,15 +7,17 @@ and managing nextcloud installations
 
 ## Roles
 
-- [`roles/server`](roles/server/README.md): For deploying
+- [`server`](roles/server/README.md): For deploying
   and configuring a bare nextcloud instance in a docker container.
   Supports both the `-apache` (default) and `-fpm` variants.
-- [`roles/apps`](roles/apps/README.md):
+- [`apps`](roles/apps/README.md):
   For managing nextcloud apps in an already installed nextcloud
   server instance. Can install, remove, enable/disable and update apps.
-- [`roles/ldap-user-backend`](roles/ldap-user-backend/README.md):
+- [`ldap_user_backend`](roles/ldap_user_backend/README.md):
   Manages LDAP authentication sources in installed nextcloud instances.
-- [`roles/nginx-fpm-proxy`](roles/nginx-fpm-proxy/README.md):
+- [`oidc_user_backend`](roles/oidc_user_backend/README.md):
+  Manage OIDC authentication sources in installed nextcloud instances.
+- [`nginx_fpm_proxy`](roles/nginx_fpm_proxy/README.md):
   Reverse proxy role which connects to nextcloud using FPM
   and serves static content.
 

galaxy.yml

@@ -1,14 +1,14 @@
 namespace: finallycoffee
 name: nextcloud
-version: 0.5.1
+version: 0.6.1
 readme: README.md
 authors:
 - transcaffeine <transcaffeine@finally.coffee>
 description: Installing and configuring nextcloud (and related apps/services) using docker
 dependencies:
-  "community.docker": "^1.10.0"
+  "community.docker": "^3.0.0"
 license_file: LICENSE.md
 build_ignore:
 - '*.tar.gz'
 repository: https://git.finally.coffee/finallycoffee/nextcloud
-issues: https://git.finally.coffee/finallycoffee/nextcloud/issues
+issues: https://codeberg.org/finallycoffee/ansible-collection-nextcloud/issues

meta/runtime.yml

@@ -1,3 +1,3 @@
 ---
 
-requires_ansible: ">=2.12"
+requires_ansible: ">=2.15"

roles/apps/handlers/main.yml

@@ -1,7 +1,9 @@
 ---
 
 - name: restart-nextcloud
-  docker_container:
+  community.docker.docker_container:
     name: "{{ nextcloud_container_name }}"
     state: started
-    restart: yes
+    restart: true
+    comparisons:
+      '*': ignore

roles/apps/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Ensure nextcloud user is created
-  user:
+  ansible.builtin.user:
     name: "{{ nextcloud_run_user }}"
     state: present
   register: nextcloud_user_res

roles/ldap_user_backend/tasks/load_config_http.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Set default api parameters for HTTP
-  meta: noop
+  ansible.builtin.meta: noop
   vars: &api_defaults
     http_agent: "{{ nc_ldap_meta_http_agent }}"
     headers: "{{ nc_ldap_api_headers }}"
@@ -11,7 +11,7 @@
     force: yes
 
 - name: Check if configuration with given config ID already exists
-  uri:
+  ansible.builtin.uri:
     <<: *api_defaults
     url: "{{ nc_ldap_api_path }}/{{ nc_ldap_config_id }}{{ query_params }}"
     method: GET
@@ -21,19 +21,19 @@
 
 # TODO: Can we force an ID on POST?
 - name: Create ldap configuration with id={{ nc_ldap_config_id }}
-  uri:
+  ansible.builtin.uri:
     <<: *api_defaults
     url: "{{ nc_ldap_api_path }}"
     method: POST
   when: nc_ldap_existing_config_api.status != 200
 
 - name: Parse output of query command to dict
-  set_fact:
+  ansible.builtin.set_fact:
     nc_ldap_existing_config: "{{ nc_ldap_existing_config_api.stdout | from_json }}"
   changed_when: false
 
 - name: Create changeset
-  set_fact:
+  ansible.builtin.set_fact:
     nc_ldap_config_changeset: "{{ nc_ldap_config_changeset | combine(changed_entry) }}"
   vars:
     changed_entry: "{{ { item : nc_ldap_config_keys[item] } }}"
@@ -41,7 +41,7 @@
   when: nc_ldap_config_keys[item] is defined and nc_ldap_config_keys[item] and nc_ldap_config_keys[item] != nc_ldap_existing_config[nc_ldap_config_id][item]
 
 - name: Ensure ldap configuration is in sync (http)
-  uri:
+  ansible.builtin.uri:
     <<: *api_defaults
     url: "{{ nc_lap_api_path }}/{{ nc_ldap_config_id }}"
     method: PUT

roles/ldap_user_backend/tasks/load_config_occ.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Check if configuration with given config ID already exists
-  docker_container_exec:
+  community.docker.docker_container_exec:
     container: "{{ nc_ldap_container }}"
     command: "{{ nc_ldap_occ_command }} ldap:show-config --output json {{ '--show-password' if nc_ldap_config_agent_password else '' }} {{ nc_ldap_config_id }}"
     user: "{{ nc_ldap_occ_user }}"
@@ -11,7 +11,7 @@
   register: nc_ldap_existing_config_occ
 
 - name: Create ldap configuration with id={{ nc_ldap_config_id }}
-  docker_container_exec:
+  community.docker.docker_container_exec:
     container: "{{ nc_ldap_container }}"
     command: "{{ nc_ldap_occ_command }} ldap:create-empty-config --output json {{ nc_ldap_config_id }}"
     user: "{{ nc_ldap_occ_user }}"
@@ -19,12 +19,12 @@
   when: nc_ldap_existing_config_occ.rc != 0 and nc_ldap_config_id not in (nc_ldap_existing_config_occ.stdout | from_json).keys()
 
 - name: Parse output of query command to dict
-  set_fact:
+  ansible.builtin.set_fact:
     nc_ldap_existing_config: "{{ nc_ldap_existing_config_occ.stdout | from_json }}"
   changed_when: false
 
 - name: Create changeset
-  set_fact:
+  ansible.builtin.set_fact:
     nc_ldap_config_changeset: "{{ nc_ldap_config_changeset | combine(changed_entry) }}"
   vars:
     changed_entry: "{{ { item : nc_ldap_config_keys[item] } }}"
@@ -32,7 +32,7 @@
   when: nc_ldap_config_keys[item] is defined and nc_ldap_config_keys[item] and nc_ldap_config_keys[item] != nc_ldap_existing_config[nc_ldap_config_id][item]
 
 - name: Ensure ldap configuration is in sync
-  docker_container_exec:
+  community.docker.docker_container_exec:
     container: "{{ nc_ldap_container }}"
     command: "{{ nc_ldap_occ_command }} ldap:set-config \"{{ nc_ldap_config_id }}\" \"{{ item.key }}\" \"{{ item.value }}\""
     user: "{{ nc_ldap_occ_user }}"
@@ -40,7 +40,7 @@
   loop: "{{ nc_ldap_config_changeset | dict2items }}"
 
 - name: Ensure ldap configuration is working
-  docker_container_exec:
+  community.docker.docker_container_exec:
     container: "{{ nc_ldap_container }}"
     command: "{{ nc_ldap_occ_command }} ldap:test-config {{ nc_ldap_config_id }}"
     user: "{{ nc_ldap_occ_user }}"

roles/ldap_user_backend/tasks/main.yml

@@ -1,10 +1,10 @@
 ---
 
 - name: Load config {{ nc_ldap_config_id }} (and create if not exists) when running mode is http
-  include_tasks: load_config_http.yml
+  ansible.builtin.include_tasks: load_config_http.yml
   when: nc_ldap_api_method == 'http'
 
 - name: Load config {{ nc_ldap_config_id }} (and create if not exists) when running mode is occ
-  include_tasks: load_config_occ.yml
+  ansible.builtin.include_tasks: load_config_occ.yml
   when: nc_ldap_api_method == 'occ'
 

roles/nginx_fpm_proxy/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
 
 - name: Create directory for nginx config
-  file:
+  ansible.builtin.file:
     path: "{{ nextcloud_nginx_basepath }}"
     state: directory
     mode: 0750
 
 - name: Template nginx reverse proxy config for nextcloud
-  template:
+  ansible.builtin.template:
     src: nextcloud-nginx.conf.j2
     dest: "{{ nextcloud_nginx_config }}"
   vars:
@@ -18,19 +18,20 @@
   notify: restart-nextcloud-nginx
 
 - name: Ensure nginx docker image is pulled
-  docker_image:
+  community.general.docker_image:
     name: "{{ nextcloud_nginx_container_image_ref }}"
     state: present
     source: pull
     force_source: "{{ nextcloud_nginx_container_image_force_pull }}"
 
 - name: Ensure nginx is running for FPM and static file serving
-  docker_container:
+  community.docker.docker_container:
+    env: "{{ nextcloud_nginx_container_env }}"
     name: "{{ nextcloud_nginx_container_name }}"
     image: "{{ nextcloud_nginx_container_image_ref }}"
+    ports: "{{ nextcloud_nginx_container_ports }}"
     volumes: "{{ nextcloud_nginx_container_volumes }}"
     labels: "{{ nextcloud_nginx_container_labels }}"
-    env: "{{ nextcloud_nginx_container_env }}"
     networks: "{{ nextcloud_nginx_container_networks | default(omit) }}"
     restart_policy: "{{ nextcloud_nginx_container_restart_policy }}"
     state: started

roles/oidc_user_backend/README.md

@@ -0,0 +1,29 @@
+# `finallycoffee.nextcloud.oidc_user_backend` ansible role
+
+Configure OIDC user backends in nextcloud using this ansible role.
+This role can be run multiple times with different arguments in order to
+configure multiple oidc-based user backends.
+
+> [!WARNING]
+> This role is not production ready or finished
+
+## Configuration
+
+Set `oidc_user_occ_user_oidc_provider_identifier` to a unique identifier.
+Populate your provider information in the `oidc_user_config_(settings_)`
+like this:
+
+```yaml
+oidc_user_config_identifier: my_provider
+oidc_user_config_discovery_endpoint: https://idp.example.com/
+oidc_user_config_client_id: my-client-id
+oidc_user_config_client_secret: my-client-secret
+
+# All options to the occ command are avaible in the
+# `oidc_user_config_settings_` namespace
+oidc_user_config_settings_unique_id: true
+oidc_user_config_settings_send_id_token_hint: true
+oidc_user_config_settings_mapping_display_name: name
+oidc_user_config_settings_mapping_uid: preferred_username
+oidc_user_config_settings_mapping_email: email
+```

roles/oidc_user_backend/defaults/main.yml

@@ -0,0 +1,47 @@
+---
+oidc_user_deployment_method: host
+oidc_user_deployment_become_user: ~
+oidc_user_deployment_method_docker_container_name: nextcloud
+oidc_user_deployment_method_podman_container_name: nextcloud
+oidc_user_occ_command: "php occ"
+oidc_user_occ_user_oidc_provider_identifier: ~
+
+oidc_user_config_identifier: ~
+oidc_user_config_client_id: ~
+oidc_user_config_client_secret: ~
+oidc_user_config_discovery_endpoint: ~
+oidc_user_config_end_session_endpoint: ~
+oidc_user_config_scopes:
+  - openid
+  - email
+  - profile
+
+oidc_user_config_settings_unique_id: true
+oidc_user_config_settings_check_bearer: true
+oidc_user_config_settings_send_id_token_hint: true
+oidc_user_config_settings_bearer_provisioning: false
+oidc_user_config_settings_extra_claims: []
+oidc_user_config_settings_provider_based_id: false
+oidc_user_config_settings_group_provisioning: false
+
+oidc_user_config_settings_mapping_display_name: name
+oidc_user_config_settings_mapping_email: email
+oidc_user_config_settings_mapping_quota: ~
+oidc_user_config_settings_mapping_uid: sub
+oidc_user_config_settings_mapping_groups: ~
+oidc_user_config_settings_mapping_address: ~
+oidc_user_config_settings_mapping_street_address: ~
+oidc_user_config_settings_mapping_postal_code: ~
+oidc_user_config_settings_mapping_locality: ~
+oidc_user_config_settings_mapping_region: ~
+oidc_user_config_settings_mapping_country: ~
+oidc_user_config_settings_mapping_website: ~
+oidc_user_config_settings_mapping_avatar: ~
+oidc_user_config_settings_mapping_twitter: ~
+oidc_user_config_settings_mapping_fediverse: ~
+oidc_user_config_settings_mapping_organisation: ~
+oidc_user_config_settings_mapping_role: ~
+oidc_user_config_settings_mapping_headline: ~
+oidc_user_config_settings_mapping_biography: ~
+oidc_user_config_settings_mapping_phone: ~
+oidc_user_config_settings_mapping_gender: ~

roles/oidc_user_backend/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+
+- name: Check if deployment method is supported
+  ansible.builtin.fail:
+    msg: >-2
+      Deployment method '{{ oidc_user_deployment_method }}' is not supported!
+      Supported are: {{ oidc_user_deployment_methods | join(', ') }}
+  when: oidc_user_deployment_method not in oidc_user_deployment_methods
+
+- name: Configure OIDC provider
+  ansible.builtin.command:
+    cmd: "{{ oidc_user_occ_user_oidc_provider_set_command }}"
+  become_user: "{{ oidc_user_deployment_become_user }}"
+  become: "{{ oidc_user_deployment_become_user | default(false, true) }}"
+  when: oidc_user_deployment_method == 'host'
+
+- name: Configure OIDC provider (docker)
+  community.docker.docker_container_exec:
+    container: "{{ oidc_user_deployment_method_docker_container_name }}"
+    command: "{{ oidc_user_occ_user_oidc_provider_set_command }}"
+    user: "{{ oidc_user_deployment_become_user | default(omit, true) }}"
+  when: oidc_user_deployment_method == 'docker'
+
+- name: Configure OIDC provider (podman)
+  containers.podman.podman_container_exec:
+    name: "{{ oidc_user_deployment_method_podman_container_name }}"
+    command: "{{ oidc_user_occ_user_oidc_provider_set_command }}"
+    user: "{{ oidc_user_deployment_become_user | default(omit, true) }}"
+  when: oidc_user_deployment_method == 'podman'

roles/oidc_user_backend/vars/main.yml

@@ -0,0 +1,63 @@
+---
+oidc_user_deployment_methods:
+  - host
+  - docker
+  - podman
+
+oidc_user_occ_user_oidc_options_dict:
+  clientid: "{{ oidc_user_config_client_id }}"
+  clientsecret: "{{ oidc_user_config_client_secret }}"
+  discoveryuri: "{{ oidc_user_config_discovery_endpoint }}"
+  endsessionendpointuri: "{{ oidc_user_config_end_session_endpoint }}"
+  scope: "'{{ oidc_user_config_scopes | default([], true) | join(' ') }}'"
+  "unique-uid": >-2
+    {{ oidc_user_config_settings_unique_id | bool | ternary(1, 0) }}
+  "check-bearer": >-2
+    {{ oidc_user_config_settings_check_bearer | bool | ternary(1, 0) }}
+  "send-id-token-hint": >-2
+    {{ oidc_user_config_settings_send_id_token_hint | bool | ternary(1, 0) }}
+  "group-provisioning": >-2
+    {{ oidc_user_config_settings_group_provisioning | bool | ternary(1, 0) }}
+  "extra-claims": >-2
+    {{ (oidc_user_config_settings_extra_claims | default([]) | length > 0)
+       | ternary(oidc_user_config_settings_extra_claims | join(' ') | quote, '') }}
+
+oidc_user_occ_user_oidc_mapping_options_dict:
+  "display-name": "{{ oidc_user_config_settings_mapping_display_name }}"
+  email: "{{ oidc_user_config_settings_mapping_email }}"
+  quota: "{{ oidc_user_config_settings_mapping_quota }}"
+  uid: "{{ oidc_user_config_settings_mapping_uid }}"
+  groups: "{{ oidc_user_config_settings_mapping_groups }}"
+  website: "{{ oidc_user_config_settings_mapping_website }}"
+  avatar: "{{ oidc_user_config_settings_mapping_avatar }}"
+  twitter: "{{ oidc_user_config_settings_mapping_twitter }}"
+  fediverse: "{{ oidc_user_config_settings_mapping_fediverse }}"
+  organisation: "{{ oidc_user_config_settings_mapping_organisation }}"
+  role: "{{ oidc_user_config_settings_mapping_role }}"
+  headline: "{{ oidc_user_config_settings_mapping_headline }}"
+  biography: "{{ oidc_user_config_settings_mapping_biography }}"
+  phone: "{{ oidc_user_config_settings_mapping_phone }}"
+  gender: "{{ oidc_user_config_settings_mapping_gender }}"
+  address: "{{ oidc_user_config_settings_mapping_address }}"
+  street_address: "{{ oidc_user_config_settings_mapping_street_address }}"
+  postal_code: "{{ oidc_user_config_settings_mapping_postal_code }}"
+  locality: "{{ oidc_user_config_settings_mapping_locality }}"
+  region: "{{ oidc_user_config_settings_mapping_region }}"
+  country: "{{ oidc_user_config_settings_mapping_country }}"
+
+oidc_user_occ_user_oidc_provider_options: >-2
+  {% for tuple in oidc_user_occ_user_oidc_options_dict | dict2items %}
+  {% if tuple.value | default(false, true) %}
+  --{{ tuple.key }}={{ tuple.value }}
+  {% endif %}
+  {% endfor %}
+  {% for tuple in oidc_user_occ_user_oidc_mapping_options_dict | dict2items %}
+  {% if tuple.value | default(false, true) %}
+  --mapping-{{ tuple.key }}={{ tuple.value }}
+  {% endif %}
+  {% endfor %}
+
+oidc_user_occ_user_oidc_provider_set_command: >-2
+  {{ oidc_user_occ_command }} user_oidc:provider
+  {{ oidc_user_occ_user_oidc_provider_options }}
+  {{ oidc_user_occ_user_oidc_provider_identifier }}

roles/server/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 
-nextcloud_version: 28.0.8
+nextcloud_version: 30.0.0
 nextcloud_user: nextcloud
 nextcloud_basepath: /opt/nextcloud
 nextcloud_config_path: "{{ nextcloud_basepath }}/config"

roles/server/tasks/main.yml

@@ -1,14 +1,14 @@
 ---
 
 - name: Create nextcloud user
-  user:
+  ansible.builtin.user:
     name: "{{ nextcloud_user }}"
     state: present
     system: yes
   register: nextcloud_user_info
 
 - name: Map nextcloud socket path if defined
-  set_fact:
+  ansible.builtin.set_fact:
     nextcloud_paths: "{{ nextcloud_paths + [ socket_dir ] }}"
     nextcloud_container_base_volumes: "{{ nextcloud_container_base_volumes + [ socket_map ] }}"
   vars:
@@ -21,7 +21,7 @@
   when: nextcloud_socket_path is defined and nextcloud_socket_path is string
 
 - name: Ensure nextcloud directories exist and have correct permissions
-  file:
+  ansible.builtin.file:
     path: "{{ item.path }}"
     state: directory
     mode: "{{ item.mode }}"
@@ -30,14 +30,14 @@
   loop: "{{ nextcloud_paths }}"
 
 - name: Ensure docker container for nextcloud is pulled
-  docker_image:
+  community.docker.docker_image:
     name: "{{ nextcloud_container_image_ref }}"
     state: present
     source: pull
     force_source: "{{ nextcloud_container_image_force_source }}"
 
 - name: Template OpCache configuration
-  template:
+  ansible.builtin.template:
     src: nextcloud-fpm-opcache.ini.j2
     dest: "{{ nextcloud_fpm_config_path }}/opcache.ini"
     mode: "0640"
@@ -47,7 +47,7 @@
     - reload-nextcloud
 
 - name: Template PHP FPM configuration
-  template:
+  ansible.builtin.template:
     src: nextcloud-fpm.ini.j2
     dest: "{{ nextcloud_fpm_config_path }}/fpm.ini"
     mode: "0640"
@@ -57,7 +57,7 @@
     - reload-nextcloud
 
 - name: Template PHP FPM docker-specific configuration
-  template:
+  ansible.builtin.template:
     src: nextcloud-fpm-docker.ini.j2
     dest: "{{ nextcloud_fpm_config_path }}/fpm-docker.ini"
     mode: "0640"
@@ -67,7 +67,7 @@
     - reload-nextcloud
 
 - name: Template modified /etc/passwd for nextcloud container
-  template:
+  ansible.builtin.template:
     src: nextcloud-passwd.j2
     dest: "{{ nextcloud_basepath }}/nextcloud-passwd"
     mode: "0640"
@@ -77,7 +77,7 @@
     - reload-nextcloud
 
 - name: Template modified /etc/passwd for nextcloud container
-  template:
+  ansible.builtin.template:
     src: nextcloud-group.j2
     dest: "{{ nextcloud_basepath }}/nextcloud-group"
     mode: "0640"
@@ -87,7 +87,7 @@
     - reload-nextcloud
 
 - name: Template systemd service for nextcloud's cron job
-  template:
+  ansible.builtin.template:
     src: systemd-nextcloud-cron.service.j2
     dest: /etc/systemd/system/nextcloud-cron.service
     mode: "0640"
@@ -98,7 +98,7 @@
     - reload-systemd
 
 - name: Template timer for nextcloud's cron job
-  template:
+  ansible.builtin.template:
     src: systemd-nextcloud-cron.timer.j2
     dest: /etc/systemd/system/nextcloud-cron.timer
     mode: "0640"
@@ -109,10 +109,10 @@
     - reload-systemd
 
 - name: Flush handlers now to ensure systemd can know about the timer before it's enabled
-  meta: flush_handlers
+  ansible.builtin.meta: flush_handlers
 
 - name: Ensure docker container for nextcloud is running
-  docker_container:
+  community.docker.docker_container:
     name: "{{ nextcloud_container_name }}"
     image: "{{ nextcloud_container_image_ref }}"
     volumes: "{{ nextcloud_container_volumes }}"
@@ -124,19 +124,19 @@
     state: started
 
 - name: Enable systemd timer for nextcloud cron
-  systemd:
+  ansible.builtin.systemd:
     name: "nextcloud-cron.timer"
     enabled: yes
   when: nextcloud_background_job_mode == 'cron'
 
 - name: Ensure systemd timer for nextcloud cron is started
-  systemd:
+  ansible.builtin.systemd:
     name: "nextcloud-cron.timer"
     state: started
   when: nextcloud_background_job_mode == 'cron'
 
 - name: Configure nextcloud
-  include_tasks:
+  ansible.builtin.include_tasks:
     file: configure-single-setting.yml
   vars:
     key: "{{ item.key | replace('[', '.') | replace(']', '.') }}"