Update to 2022-03-07 16:00

roles/unmaintained/matomo/templates/config.ini.php.j2

@@ -0,0 +1,24 @@
+[database]
+host = "{{ matomo_db_server }}"
+username = "{{ matomo_db_user }}"
+password = "{{ matomo_db_pass }}"
+dbname = "{{ matomo_db_name }}"
+port = {{ matomo_db_port }}
+
+[General]
+assume_secure_protocol = 1
+{% if httpd_src_ip is defined and httpd_src_ip | length > 0 and '0.0.0.0/0' not in httpd_src_ip %}
+proxy_client_headers[] = "HTTP_X_FORWARDED_FOR"
+proxy_host_headers[] = "HTTP_X_FORWARDED_HOST"
+{% endif %}
+salt = "{{ matomo_salt }}"
+force_ssl = 0
+assume_secure_protocol = 1
+
+[Tracker]
+enable_fingerprinting_across_websites = 1
+
+[mail]
+transport = "smtp"
+host = "localhost"
+

roles/unmaintained/matomo/templates/httpd.conf.j2

@@ -0,0 +1,32 @@
+{% if matomo_alias is defined %}
+Alias /{{ matomo_alias }} {{ matomo_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ matomo_root_dir }}/web>
+  AllowOverride All
+  Options FollowSymLinks
+{% if matomo_src_ip is defined %}
+  Require ip {{ matomo_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ matomo_php_fpm_pool | default('matomo_' + matomo_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+
+  <FilesMatch "^(\.ansible_version|\.git.*|(README|LICENSE|AUTHORS|CHANGELOG|CONTRIBUTING|LEGALNOTICE|PRIVACY|SECURITY)(\.md)?|.*\.co?nf|\.htaccess|composer\.(json|lock))">
+    Require all denied
+  </FilesMatch>
+</Directory>
+
+<Directory {{ matomo_root_dir }}/web/config>
+  Require all denied
+</Directory>
+<Directory {{ matomo_root_dir }}/web/inc>
+  Require all denied
+</Directory>
+<Directory {{ matomo_root_dir }}/web/config>
+  Require all denied
+</Directory>

roles/unmaintained/matomo/templates/perms.sh.j2

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+restorecon -R {{ matomo_root_dir }}
+chown root:root {{ matomo_root_dir }}
+chmod 700 {{ matomo_root_dir }}
+setfacl -k -b {{ matomo_root_dir }}
+setfacl -m u:{{ matomo_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ matomo_root_dir }}
+chown -R root:root {{ matomo_root_dir }}/web
+chown -R {{ matomo_php_user | default('apache') }} {{ matomo_root_dir }}/web/plugins
+chown {{ matomo_php_user | default('apache') }} {{ matomo_root_dir }}/web/matomo.js
+find {{ matomo_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ matomo_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown -R :{{ matomo_php_user }} {{ matomo_root_dir }}/web/{config,tmp,misc}/
+find {{ matomo_root_dir }}/web/{config,tmp,misc} -type f -exec chmod 660 "{}" \;
+find {{ matomo_root_dir }}/web/{config,tmp,misc} -type d -exec chmod 770 "{}" \;
+chown -R {{ matomo_php_user }} {{ matomo_root_dir }}/tmp/*
+find {{ matomo_root_dir }}/tmp/ -type f -exec chmod 660 "{}" \;
+find {{ matomo_root_dir }}/tmp/ -type d -exec chmod 770 "{}" \;
+chown :{{ matomo_php_user }} {{ matomo_root_dir }}/web/piwik.js
+chmod 664 {{ matomo_root_dir }}/web/piwik.js
+

roles/unmaintained/matomo/templates/php.conf.j2

@@ -0,0 +1,37 @@
+; {{ ansible_managed }}
+
+[matomo_{{ matomo_id }}]
+
+listen.owner = root
+listen.group = {{ httpd_user | default('apache') }}
+listen.mode = 0660
+listen = /run/php-fpm/matomo_{{ matomo_id }}.sock
+user = {{ matomo_php_user }}
+group = {{ matomo_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 60m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 256M
+php_admin_value[session.save_path] = {{ matomo_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ matomo_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ matomo_root_dir }}/tmp
+php_admin_value[post_max_size] = 2M
+php_admin_value[upload_max_filesize] = 2M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ matomo_root_dir }}
+php_admin_value[max_execution_time] = 300
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = on
+php_admin_flag[file_uploads] = off
+php_admin_flag[session.cookie_httponly] = on

roles/unmaintained/matomo/templates/post-backup.j2

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+rm -f {{ matomo_root_dir }}/backup/*

roles/unmaintained/matomo/templates/pre-backup.j2

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -eo pipefail
+
+/usr/bin/mysqldump --user={{ matomo_db_user | quote }} \
+                   --password={{ matomo_db_pass | quote }} \
+                   --host={{ matomo_db_server | quote }} \
+                   --quick --single-transaction \
+                   --add-drop-table {{ matomo_db_name | quote }} | zstd -c > {{ matomo_root_dir }}/backup/{{ matomo_db_name }}.sql.zst