Update to 2021-12-01 19:13

2025-07-27 08:15:54 +02:00 · 2021-12-01 19:13:34 +01:00
commit 4c4556c660
2153 changed files with 60999 additions and 0 deletions
--- a/roles/dokuwiki/defaults/main.yml
+++ b/roles/dokuwiki/defaults/main.yml
@@ -0,0 +1,204 @@
+---
+
+# A unique ID for this instance. You can deploy several dokuwiki instances on the same machine
+dokuwiki_id: 1
+
+# Version to deploy
+dokuwiki_version: 2020-07-29
+# The sha1 checksum of the archive
+dokuwiki_archive_sha1: 119f3875d023d15070068a6aca1e23acd7f9a19a
+
+# Root dir where the app will be installed. Each instance must have a different install path
+dokuwiki_root_dir: /opt/dokuwiki_{{ dokuwiki_id }}
+
+# Should upgrades be handled by ansible
+dokuwiki_manage_upgrade: True
+
+# The URL to download dokuwiki archive
+dokuwiki_archive_url: https://download.dokuwiki.org/src/dokuwiki/dokuwiki-{{ dokuwiki_version }}.tgz
+
+# The user account under which PHP is executed
+dokuwiki_php_user: php-dokuwiki_{{ dokuwiki_id }}
+
+dokuwiki_php_version: 74
+
+# The name of the PHP-FPM pool to use
+# dokuwiki_php_fpm_pool: php70
+
+# List of default DokuWiki plugins
+dokuwiki_plugins:
+  todo:
+    archive_name: dokuwiki-plugin-todo-stable.zip
+    url: https://github.com/leibler/dokuwiki-plugin-todo/archive/stable.zip
+  note:
+    archive_name: dokuwiki_note-master.zip
+    url: https://github.com/LarsGit223/dokuwiki_note/archive/master.zip
+  odt:
+    archive_name: dokuwiki-plugin-odt-master.zip
+    url: https://github.com/LarsGit223/dokuwiki-plugin-odt/archive/master.zip
+  dw2pdf:
+    archive_name: dokuwiki-plugin-dw2pdf-master.zip
+    url: https://github.com/splitbrain/dokuwiki-plugin-dw2pdf/archive/master.zip
+  color:
+    archive_name: dokuwiki_plugin_color-master.zip
+    url: https://github.com/leeyc0/dokuwiki_plugin_color/archive/master.zip
+  hidden:
+    archive_name: hidden-master.zip
+    url: https://github.com/gturri/hidden/archive/master.zip
+  encryptedpasswords:
+    archive_name: dw-plugin-encryptedpasswords-master.zip
+    url: https://github.com/ssahara/dw-plugin-encryptedpasswords/archive/master.zip
+  tag:
+    archive_name: plugin-tag-master.zip
+    url: https://github.com/dokufreaks/plugin-tag/archive/master.zip
+  pagelist:
+    archive_name: plugin-pagelist-master.zip
+    url: https://github.com/dokufreaks/plugin-pagelist/archive/master.zip
+  nspages:
+    archive_name: nspages-master.zip
+    url: https://github.com/gturri/nspages/archive/master.zip
+  changes:
+    archive_name: changes-master.zip
+    url: https://github.com/cosmocode/changes/archive/master.zip
+  pagemove:
+    archive_name: DokuWiki-Pagemove-Plugin-master.zip
+    url: https://github.com/desolat/DokuWiki-Pagemove-Plugin/archive/master.zip
+  loglog:
+    archive_name: dokuwiki-plugin-loglog-master.zip
+    url: https://github.com/splitbrain/dokuwiki-plugin-loglog/archive/master.zip
+  ckgdoku:
+    archive_name: ckgdoku-master.zip
+    url: https://github.com/turnermm/ckgdoku/archive/master.zip
+  ckgedit:
+    archive_name: ckgedit-master.zip
+    url: https://github.com/turnermm/ckgedit/archive/master.zip
+  edittable:
+    archive_name: edittable-master.zip
+    url: https://github.com/cosmocode/edittable/archive/master.zip
+  sortablejs:
+    archive_name: sortablejs-master.zip
+    url: https://github.com/FyiurAmron/sortablejs/archive/master.zip
+  howhard:
+    archive_name: howhard-master.zip
+    url: https://github.com/chtiland/howhard/archive/master.zip
+  indexmenu:
+    url: https://github.com/samuelet/indexmenu/archive/master.zip
+    archive_name: indexmenu-master.zip
+  discussion:
+    url: https://github.com/dokufreaks/plugin-discussion/archive/master.zip
+    archive_name: plugin-discussion-master.zip
+  piwik2:
+    url: https://github.com/Bravehartk2/dokuwiki-piwik2/archive/master.zip
+    archive_name: dokuwiki-piwik2-master.zip
+  authorstats:
+    url: https://github.com/ConX/dokuwiki-plugin-authorstats/archive/master.zip
+    archive_name: dokuwiki-plugin-authorstats-master.zip
+  gallery:
+    url: https://github.com/splitbrain/dokuwiki-plugin-gallery/archive/master.zip
+    archive_name: dokuwiki-plugin-gallery-master.zip
+  custombuttons:
+    url: https://github.com/ConX/dokuwiki-plugin-custombuttons/archive/master.zip
+    archive_name: dokuwiki-plugin-custombuttons-master.zip
+  include:
+    url: https://github.com/dokufreaks/plugin-include/archive/master.zip
+    archive_name: plugin-include-master.zip
+  blockquote:
+    url: https://github.com/dokufreaks/plugin-blockquote/archive/master.zip
+    archive_name: plugin-blockquote-master.zip
+  wrap:
+    url: https://github.com/selfthinker/dokuwiki_plugin_wrap/archive/master.zip
+    archive_name: dokuwiki_plugin_wrap-master.zip
+  bureaucracy:
+    url: https://github.com/splitbrain/dokuwiki-plugin-bureaucracy/archive/master.zip
+    archive_name: dokuwiki-plugin-bureaucracy-master.zip
+  struct:
+    url: https://github.com/cosmocode/dokuwiki-plugin-struct/archive/master.zip
+    archive_name: dokuwiki-plugin-struct-master.zip
+  bootstrap3:
+    url: https://github.com/LotarProject/dokuwiki-template-bootstrap3/archive/master.zip
+    archive_name: dokuwiki-template-bootstrap3-master.zip
+    type: tpl
+  material:
+    url: https://github.com/LeonStaufer/material-dokuwiki/archive/master.zip
+    archive_name: material-dokuwiki-master.zip
+    type: tpl
+
+# List of core plugins which won't be uninstalled
+dokuwiki_core_plugins:
+  - acl
+  - authhttpldap
+  - authad
+  - authldap
+  - authmysql
+  - authpdo
+  - authpgsql
+  - authplain
+  - config
+  - extension
+  - info
+  - popularity
+  - revert
+  - safefnrecode
+  - styling
+  - usermanager
+
+# List of plugin to install
+dokuwiki_base_plugins_to_install:
+  - edittable
+  - todo
+  - color
+  - hidden
+  - indexmenu
+  - odt
+  - dw2pdf
+  - loglog
+  - changes
+  - pagemove
+  - authorstats
+  - note
+# An additional list, so you can just keep the default and add more if needed, in hosts_var
+dokuwiki_extra_plugins_to_install: []
+dokuwiki_plugins_to_install: "{{ dokuwiki_base_plugins_to_install + dokuwiki_extra_plugins_to_install }}"
+
+# List of templates to install
+dokuwiki_base_tpl_to_install:
+  - bootstrap3
+  - material
+dokuwiki_extra_tpl_to_install: []
+dokuwiki_tpl_to_install: "{{ dokuwiki_base_tpl_to_install + dokuwiki_extra_tpl_to_install }}"
+
+dokuwiki_remove_unmanaged_plugins: True
+dokuwiki_remove_unmanaged_tpl: True
+
+# An alias for httpd config
+# dokuwiki_alias: wiki
+
+# A list of ip address allowed to access dokuwiki
+# dokuwiki_src_ip:
+#   - 192.168.7.0/24
+#   - 10.99.0.0/16
+
+
+# Auth plugin. Can be authldap, authhttpldap, authplain
+dokuwiki_auth: "{{  ad_auth | default(False) | ternary('authad', ldap_auth | default(False) | ternary('authhttpldap', 'authplain')) }}"
+
+# LDAP Auth settings
+dokuwiki_ldap_uri: "{{ ldap_uri | default('ldap://ldap.' ~ ansible_domain) }}"
+dokuwiki_ldap_starttls: True
+dokuwiki_ldap_user_base: "{{ ldap_user_base | default('ou=Users') + ',' + ldap_base | default(ansible_domain | regex_replace('\\.',',dc=')) }}"
+dokuwiki_ldap_group_base: "{{ ldap_group_base | default('ou=Groups') + ',' + ldap_base | default(ansible_domain | regex_replace('\\.',',dc=')) }}"
+dokuwiki_ldap_user_filter: '(&(uid=%{user})(objectClass=inetOrgPerson))'
+dokuwiki_ldap_group_filter: '(&(objectClass=posixGroup)(memberUid=%{user}))'
+dokuwiki_ldap_group_key: cn
+# dokuwiki_ldap_bind_dn:
+# dokuwiki_ldap_bind_pass:
+
+# AD Settings
+dokuwiki_ad_dc: "{{ ad_ldap_servers | default(ansible_domain) }}"
+dokuwiki_ad_starttls: True
+dokuwiki_ad_user_base: "{{ ad_ldap_user_search_base | default('DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC=')) }}"
+dokuwiki_ad_domain: "{{ samba_realm | default(ansible_domain) }}"
+# AD user. Do not use full DN notation, just simple login
+# dokuwiki_ad_bind_user:
+# dokuwiki_ad_bind_pass:
+...
--- a/roles/dokuwiki/files/authhttpldap/auth.php
+++ b/roles/dokuwiki/files/authhttpldap/auth.php
@@ -0,0 +1,63 @@
+<?php
+
+if(!defined('DOKU_INC')) die();
+
+/**
+ * HTTP/LDAP authentication backend
+ * HTTP (your web server) handle the authentication
+ * LDAP handle user informations, and group membership
+ * This plugin have been written to work with LemonLDAP::NG WebSSO
+ * @license   GPL 2 (http://www.gnu.org/licenses/gpl.html)
+ * @author    Daniel Berteaud <daniel@firewall-services.com>
+ */
+
+require(DOKU_PLUGIN."authldap/auth.php");
+class auth_plugin_authhttpldap extends auth_plugin_authldap {
+    /**
+     * Constructor
+     */
+    public function __construct() {
+        parent::__construct();
+
+        // ldap extension is needed
+        if(!function_exists('ldap_connect')) {
+            $this->debug("LDAP err: PHP LDAP extension not found.", -1, __LINE__, __FILE__);
+            $this->success = false;
+            return;
+        }
+        $this->cando = array (
+            'addUser'     => false, // can Users be created?
+            'delUser'     => false, // can Users be deleted?
+            'modLogin'    => false, // can login names be changed?
+            'modPass'     => false, // can passwords be changed?
+            'modName'     => false, // can real names be changed?
+            'modMail'     => false, // can emails be changed?
+            'modGroups'   => false, // can groups be changed?
+            'getUsers'    => true,  // can a (filtered) list of users be retrieved?
+            'getUserCount'=> false, // can the number of users be retrieved?
+            'getGroups'   => true,  // can a list of available groups be retrieved?
+            'external'    => true,  // does the module do external auth checking?
+            'logout'      => true,  // can the user logout again? (eg. not possible with HTTP auth)
+        );
+    }
+
+    /**
+    * Check if REMOTE_USER is set
+    */
+    function trustExternal($user,$pass,$sticky=false){
+        global $USERINFO;
+        $success = false;
+        if (!isset($_SERVER['REMOTE_USER'])) return false;
+        $username = $_SERVER['REMOTE_USER'];
+        $this->debug('HTTP User Name: '.htmlspecialchars($username),0,__LINE__,__FILE__);
+        if (!empty($username)){
+            $USERINFO = $this->getUserData($username,true);
+            if ($USERINFO !== false){
+                $success = true;
+                $_SESSION[DOKU_COOKIE]['auth']['user'] = $username;
+                $_SESSION[DOKU_COOKIE]['auth']['info'] = $USERINFO;
+            }
+        }
+        return $success;
+    }
+}
--- a/roles/dokuwiki/files/authhttpldap/plugin.info.txt
+++ b/roles/dokuwiki/files/authhttpldap/plugin.info.txt
@@ -0,0 +1,7 @@
+base   authhttpldap
+author Daniel Berteaud
+email  daniel@firewall-services.com
+date   2014-05-06
+name   HTTP+LDAP auth plugin
+desc   This plugin uses a basic HTTP authentication, but LDAP to get info and authorization
+url    https://www.firewall-services.com
--- a/roles/dokuwiki/handlers/main.yml
+++ b/roles/dokuwiki/handlers/main.yml
@@ -0,0 +1,3 @@
+---
+
+...
--- a/roles/dokuwiki/meta/main.yml
+++ b/roles/dokuwiki/meta/main.yml
@@ -0,0 +1,6 @@
+---
+allow_duplicates: true
+dependencies:
+  - role: mkdir
+  - role: httpd_php
+...
--- a/roles/dokuwiki/tasks/filebeat.yml
+++ b/roles/dokuwiki/tasks/filebeat.yml
@@ -0,0 +1,5 @@
+---
+
+- name: Deploy filebeat configuration
+  template: src=filebeat.yml.j2 dest=/etc/filebeat/ansible_inputs.d/dokuwiki_{{ dokuwiki_id }}.yml
+  tags: dokuwiki,log
--- a/roles/dokuwiki/tasks/main.yml
+++ b/roles/dokuwiki/tasks/main.yml
@@ -0,0 +1,393 @@
+---
+
+- name: Set default install mode to none
+  set_fact: dokuwiki_install_mode="none"
+  tags: dokuwiki
+
+- name: Install dependencies
+  yum:
+    name:
+      - acl
+  tags: dokuwiki
+
+- name: Create PHP user acount
+  user:
+    name: "{{ dokuwiki_php_user }}"
+    comment: "PHP FPM for dokuwiki {{ dokuwiki_id }}"
+    system: yes
+    shell: /sbin/nologin
+  tags: dokuwiki
+
+- name: Check if dokuwiki is already installed
+  stat: path={{ dokuwiki_root_dir }}/meta/ansible_version
+  register: dokuwiki_version_file
+  changed_when: False
+  tags: dokuwiki
+
+- name: Check dokuwiki version
+  command:  cat {{ dokuwiki_root_dir }}/meta/ansible_version
+  register: dokuwiki_current_version
+  changed_when: False
+  when: dokuwiki_version_file.stat.exists
+  tags: dokuwiki
+
+- name: Set installation process to install
+  set_fact: dokuwiki_install_mode='install'
+  when: not dokuwiki_version_file.stat.exists
+  tags: dokuwiki
+
+- name: Set installation process to upgrade
+  set_fact: dokuwiki_install_mode='upgrade'
+  when:
+    - dokuwiki_version_file.stat.exists
+    - dokuwiki_current_version.stdout | string != dokuwiki_version | string
+    - dokuwiki_manage_upgrade
+  tags: dokuwiki
+
+- name: Create archive dir
+  file: path={{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }} state=directory mode=700
+  when: dokuwiki_install_mode == 'upgrade'
+  tags: dokuwiki
+
+- name: Prepare dokuwiki upgrade
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/web"
+    dest: "{{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}/"
+    recursive: True
+    delete: True
+  delegate_to: "{{ inventory_hostname }}"
+  when: dokuwiki_install_mode == 'upgrade'
+  tags: dokuwiki
+
+- name: Create directory structure
+  file: path={{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.groupe | default(omit) }} mode={{ item.mode | default(omit) }}
+  with_items:
+    - dir: "{{ dokuwiki_root_dir }}"
+    - dir: "{{ dokuwiki_root_dir }}/web"
+    - dir: "{{ dokuwiki_root_dir }}/tmp"
+      owner: "{{ dokuwiki_php_user }}"
+      mode: 700
+    - dir: "{{ dokuwiki_root_dir }}/cache"
+      owner: "{{ dokuwiki_php_user }}"
+      mode: 700
+    - dir: "{{ dokuwiki_root_dir }}/sessions"
+      owner: "{{ dokuwiki_php_user }}"
+      mode: 700
+    - dir: "{{ dokuwiki_root_dir }}/data"
+    - dir: "{{ dokuwiki_root_dir }}/meta"
+      mode: 700
+    - dir: "{{ dokuwiki_root_dir }}/web/conf/tpl"
+      group: "{{ dokuwiki_php_user }}"
+      mode: 770
+  tags: dokuwiki
+
+- name: Download Dokuwiki
+  get_url:
+    url: "{{ dokuwiki_archive_url }}"
+    dest: "{{ dokuwiki_root_dir }}/tmp/"
+    checksum: "sha1:{{ dokuwiki_archive_sha1 }}"
+  when: dokuwiki_install_mode != 'none'
+  tags: dokuwiki
+
+- name: Extract dokuwiki archive
+  unarchive:
+    src: "{{ dokuwiki_root_dir }}/tmp/dokuwiki-{{ dokuwiki_version }}.tgz"
+    dest: "{{ dokuwiki_root_dir }}/tmp/"
+    remote_src: yes
+  when: dokuwiki_install_mode != 'none'
+  tags: dokuwiki
+
+- name: Move the content of dokuwiki to the correct top directory
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/tmp/dokuwiki-{{ dokuwiki_version }}/"
+    dest: "{{ dokuwiki_root_dir }}/web/"
+    recursive: True
+    delete: True
+    rsync_opts:
+      - '--exclude=data/'
+  delegate_to: "{{ inventory_hostname }}"
+  when: dokuwiki_install_mode != 'none'
+  tags: dokuwiki
+
+- name: Populate the data dir
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/tmp/dokuwiki-{{ dokuwiki_version }}/data/"
+    dest: "{{ dokuwiki_root_dir }}/data/"
+    recursive: True
+  delegate_to: "{{ inventory_hostname }}"
+  when: dokuwiki_install_mode != 'none'
+  tags: dokuwiki
+
+- name: Check existing conf to restore
+  stat: path={{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}/web/{{ item }}
+  with_items:
+    - conf/local.php
+    - conf/acl.auth.php
+    - conf/users.auth.php
+    - conf/plugins.local.php
+    - conf/tpl/
+  register: dokuwiki_conf_to_restore
+  when: dokuwiki_install_mode == 'upgrade'
+  tags: dokuwiki
+
+- name: Restore Configuration
+  synchronize:
+    src: "{{ item.stat.path }}"
+    dest: "{{ dokuwiki_root_dir }}/web/{{ item.item }}"
+    recursive: True
+  delegate_to: "{{ inventory_hostname }}"
+  with_items: "{{ dokuwiki_conf_to_restore.results }}"
+  when:
+    - dokuwiki_install_mode == 'upgrade'
+    - item.stat.exists
+  tags: dokuwiki
+
+- name: List previously installed plugins
+  shell: find {{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}/web/lib/plugins -maxdepth 1 -mindepth 1 -type d -exec basename "{}" \;
+  register: dokuwiki_current_plugins
+  when:
+    - dokuwiki_install_mode == 'upgrade'
+    - not dokuwiki_remove_unmanaged_plugins
+  tags: dokuwiki
+
+- name: Restore unmanaged previous plugins
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}/web/lib/plugins/{{ item }}"
+    dest: "{{ dokuwiki_root_dir }}/web/lib/plugins/"
+    recursive: True
+  delegate_to: "{{ inventory_hostname }}"
+  with_items: "{{ dokuwiki_current_plugins.stdout_lines }}"
+  when:
+    - dokuwiki_install_mode == 'upgrade'
+    - not dokuwiki_remove_unmanaged_plugins
+  tags: dokuwiki
+
+- name: List previously installed templates
+  shell: find {{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}/web/lib/tpl -maxdepth 1 -mindepth 1 -type d -exec basename "{}" \;
+  register: dokuwiki_current_tpl
+  when:
+    - dokuwiki_install_mode == 'upgrade'
+    - not dokuwiki_remove_unmanaged_tpl
+  tags: dokuwiki
+
+- name: Restore unmanaged previous templates
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}/web/lib/tpl/{{ item }}"
+    dest: "{{ dokuwiki_root_dir }}/web/lib/tpl/"
+    recursive: True
+  delegate_to: "{{ inventory_hostname }}"
+  with_items: "{{ dokuwiki_current_tpl.stdout_lines }}"
+  when:
+    - dokuwiki_install_mode == 'upgrade'
+    - not dokuwiki_remove_unmanaged_tpl
+  tags: dokuwiki
+
+- name: Write dokuwiki version
+  copy: content={{ dokuwiki_version }} dest={{ dokuwiki_root_dir }}/meta/ansible_version
+  when: dokuwiki_install_mode != 'none'
+  tags: dokuwiki
+
+- name: Compress previous version
+  command: tar cJf {{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}.txz ./
+  environment:
+    XZ_OPT: -T0
+  args:
+    chdir: "{{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }}"
+  when: dokuwiki_install_mode == 'upgrade'
+  tags: dokuwiki
+
+- name: Remove archive directory
+  file: path={{ dokuwiki_root_dir }}/archives/{{ dokuwiki_current_version.stdout }} state=absent
+  when: dokuwiki_install_mode == 'upgrade'
+  tags: dokuwiki
+
+- name: Build a list of installed plugins
+  shell: find {{ dokuwiki_root_dir }}/web/lib/plugins -maxdepth 1 -mindepth 1 -type d -exec basename "{}" \;
+  register: dokuwiki_installed_plugins
+  changed_when: False
+  tags: dokuwiki
+
+- name: Install authhttpldap plugin
+  copy: src=authhttpldap dest={{ dokuwiki_root_dir }}/web/lib/plugins
+  tags: dokuwiki
+
+- name: Download plugins
+  get_url:
+    url: "{{ dokuwiki_plugins[item].url }}"
+    dest: "{{ dokuwiki_root_dir }}/tmp/"
+  when:
+    - item not in dokuwiki_installed_plugins.stdout_lines
+    - dokuwiki_plugins[item] is defined
+    - dokuwiki_plugins[item].type | default('plugin') == 'plugin'
+  with_items: "{{ dokuwiki_plugins_to_install }}"
+  tags: dokuwiki
+
+- name: Extract plugins
+  unarchive:
+    src: "{{ dokuwiki_root_dir }}/tmp/{{ dokuwiki_plugins[item].archive_name }}"
+    dest: "{{ dokuwiki_root_dir }}/tmp"
+    remote_src: yes
+  when:
+    - item not in dokuwiki_installed_plugins.stdout_lines
+    - dokuwiki_plugins[item] is defined
+    - dokuwiki_plugins[item].type | default('plugin') == 'plugin'
+  with_items: "{{ dokuwiki_plugins_to_install }}"
+  tags: dokuwiki
+
+- name: Move plugins to the final dir
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/tmp/{{ dokuwiki_plugins[item].archive_dir | default(dokuwiki_plugins[item].archive_name | splitext | first) }}/"
+    dest: "{{ dokuwiki_root_dir }}/web/lib/plugins/{{ item }}"
+    recursive: True
+    delete: True
+  delegate_to: "{{ inventory_hostname }}"
+  when:
+    - item not in dokuwiki_installed_plugins.stdout_lines
+    - dokuwiki_plugins[item] is defined
+    - dokuwiki_plugins[item].type | default('plugin') == 'plugin'
+  with_items: "{{ dokuwiki_plugins_to_install }}"
+  tags: dokuwiki
+
+- name: Remove unmanaged plugins
+  file: path={{ dokuwiki_root_dir }}/web/lib/plugins/{{ item }} state=absent
+  with_items: "{{ dokuwiki_installed_plugins.stdout_lines }}"
+  when:
+    - item not in dokuwiki_plugins_to_install
+    - item not in dokuwiki_core_plugins
+    - dokuwiki_remove_unmanaged_plugins
+  tags: dokuwiki
+
+- name: Build a list of installed templates
+  shell: find {{ dokuwiki_root_dir }}/web/lib/tpl -maxdepth 1 -mindepth 1 -type d -exec basename "{}" \;
+  register: dokuwiki_installed_tpl
+  changed_when: False
+  tags: dokuwiki
+
+- name: Download templates
+  get_url:
+    url: "{{ dokuwiki_plugins[item].url }}"
+    dest: "{{ dokuwiki_root_dir }}/tmp/"
+  when:
+    - dokuwiki_plugins[item] is defined
+    - dokuwiki_plugins[item].type | default('plugin') == 'tpl'
+    - item not in dokuwiki_installed_tpl.stdout_lines | difference(['dokuwiki'])
+  with_items: "{{ dokuwiki_tpl_to_install }}"
+  tags: dokuwiki
+
+- name: Extract templates
+  unarchive:
+    src: "{{ dokuwiki_root_dir }}/tmp/{{ dokuwiki_plugins[item].archive_name }}"
+    dest: "{{ dokuwiki_root_dir }}/tmp"
+    remote_src: yes
+  when:
+    - dokuwiki_plugins[item] is defined
+    - dokuwiki_plugins[item].type | default('plugin') == 'tpl'
+    - item not in dokuwiki_installed_tpl.stdout_lines | difference(['dokuwiki'])
+  with_items: "{{ dokuwiki_tpl_to_install }}"
+  tags: dokuwiki
+
+- name: Move templates to the final dir
+  synchronize:
+    src: "{{ dokuwiki_root_dir }}/tmp/{{ dokuwiki_plugins[item].archive_dir | default(dokuwiki_plugins[item].archive_name | splitext | first) }}/"
+    dest: "{{ dokuwiki_root_dir }}/web/lib/tpl/{{ item }}"
+    recursive: True
+    delete: True
+  delegate_to: "{{ inventory_hostname }}"
+  when:
+    - dokuwiki_plugins[item] is defined
+    - dokuwiki_plugins[item].type | default('plugin') == 'tpl'
+    - item not in dokuwiki_installed_tpl.stdout_lines | difference(['dokuwiki'])
+  with_items: "{{ dokuwiki_tpl_to_install }}"
+  tags: dokuwiki
+
+- name: Remove unmanaged tpl
+  file: path={{ dokuwiki_root_dir }}/web/lib/tpl/{{ item }} state=absent
+  with_items: "{{ dokuwiki_installed_plugins.stdout_lines }}"
+  when:
+    - item not in dokuwiki_tpl_to_install
+    - item != 'dokuwiki'
+    - dokuwiki_remove_unmanaged_tpl
+  tags: dokuwiki
+
+- name: Remove temp files
+  file: path={{ dokuwiki_root_dir }}/tmp/{{ item }} state=absent
+  with_items:
+    - dokuwiki-{{ dokuwiki_version }}
+    - dokuwiki-{{ dokuwiki_version }}.tgz
+  tags: dokuwiki
+
+- name: Remove plugins archives
+  file: path={{ dokuwiki_root_dir }}/tmp/{{ dokuwiki_plugins[item].archive_name }} state=absent
+  when: dokuwiki_plugins[item] is defined
+  with_items: "{{ dokuwiki_plugins_to_install + dokuwiki_tpl_to_install }}"
+  tags: dokuwiki
+
+- name: Remove plugins temp files
+  file: path={{ dokuwiki_root_dir }}/tmp/{{ dokuwiki_plugins[item].archive_dir | default(dokuwiki_plugins[item].archive_name | splitext | first) }} state=absent
+  when: dokuwiki_plugins[item] is defined
+  with_items: "{{ dokuwiki_plugins_to_install + dokuwiki_tpl_to_install }}"
+  tags: dokuwiki
+
+- name: Deploy permission script
+  template: src=perms.sh.j2 dest={{ dokuwiki_root_dir }}/perms.sh mode=755
+  tags: dokuwiki
+
+- name: Deploy httpd configuration
+  template: src=httpd.conf.j2 dest=/etc/httpd/ansible_conf.d/10-dokuwiki_{{ dokuwiki_id }}.conf
+  notify: reload httpd
+  tags: dokuwiki
+
+- name: Deploy php configuration
+  template: src=php.conf.j2 dest=/etc/opt/remi/php{{ dokuwiki_php_version }}/php-fpm.d/dokuwiki_{{ dokuwiki_id }}.conf
+  notify: restart php-fpm
+  tags: dokuwiki
+
+- name: Remove PHP config from other versions
+  file: path=/etc/opt/remi/php{{ item }}/php-fpm.d/dokuwiki_{{ dokuwiki_id }}.conf state=absent
+  with_items: "{{ httpd_php_versions | difference([ dokuwiki_php_version ]) }}"
+  notify: restart php-fpm
+  tags: dokuwiki
+
+- name: Remove PHP config (using a custom pool)
+  file: path=/etc/opt/remi/php{{ dokuwiki_php_version }}/php-fpm.d/dokuwiki_{{ dokuwiki_id }}.conf state=absent
+  with_items: "{{ httpd_php_versions }}"
+  when: dokuwiki_php_fpm_pool is defined
+  notify: restart php-fpm
+  tags: dokuwiki
+
+- name: Deploy dokuwiki configuration
+  template: src={{ item }}.j2 dest={{ dokuwiki_root_dir }}/web/conf/{{ item }} owner=root group={{ dokuwiki_php_user }} mode=660
+  with_items:
+    - local.protected.php
+    - plugins.protected.php
+  tags: dokuwiki
+
+- name: Check if local.php exists
+  stat: path={{ dokuwiki_root_dir }}/web/conf/local.php
+  register: dokuwiki_local_php
+  tags: dokuwiki
+
+- name: Set default values
+  template: src=local.php.j2 dest={{ dokuwiki_root_dir }}/web/conf/local.php
+  when: not dokuwiki_local_php.stat.exists
+  tags: dokuwiki
+
+- name: Deploy htaccess
+  template: src=htaccess.j2 dest={{ dokuwiki_root_dir }}/web/.htaccess
+  tags: dokuwiki
+
+- name: Set correct SElinux context
+  sefcontext:
+    target: "{{ dokuwiki_root_dir }}(/.*)?"
+    setype: httpd_sys_content_t
+    state: present
+  when: ansible_selinux.status == 'enabled'
+  tags: dokuwiki
+
+- name: Set optimal permissions
+  command: "{{ dokuwiki_root_dir }}/perms.sh"
+  changed_when: False
+  tags: dokuwiki
+
+- include: filebeat.yml
+...
--- a/roles/dokuwiki/templates/filebeat.yml.j2
+++ b/roles/dokuwiki/templates/filebeat.yml.j2
@@ -0,0 +1,7 @@
+- type: log
+  enabled: True
+  paths:
+    - {{ dokuwiki_root_dir }}/data/cache/loglog.log
+  exclude_files:
+    - '\.[gx]z$'
+    - '\d+$'
--- a/roles/dokuwiki/templates/htaccess.j2
+++ b/roles/dokuwiki/templates/htaccess.j2
@@ -0,0 +1,17 @@
+<Files ~ "^([\._]ht|README$|VERSION$|COPYING$)">
+  Require all denied
+</Files>
+<IfModule alias_module>
+  RedirectMatch 404 /\.git
+</IfModule>
+
+RewriteEngine on
+RewriteRule ^_media/(.*)              lib/exe/fetch.php?media=$1   [QSA,L]
+RewriteRule ^_detail/(.*)             lib/exe/detail.php?media=$1  [QSA,L]
+RewriteRule ^_export/([^/]+)/(.*)     doku.php?do=export_$1&id=$2  [QSA,L]
+RewriteRule ^$                        doku.php  [L]
+RewriteCond %{REQUEST_FILENAME}       !-f
+RewriteCond %{REQUEST_FILENAME}       !-d
+RewriteRule (.*)                      doku.php?id=$1  [QSA,L]
+RewriteRule ^index.php$               doku.php
+
--- a/roles/dokuwiki/templates/httpd.conf.j2
+++ b/roles/dokuwiki/templates/httpd.conf.j2
@@ -0,0 +1,41 @@
+{% if dokuwiki_alias is defined %}
+Alias /{{ dokuwiki_alias }} {{ dokuwiki_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ dokuwiki_root_dir }}/web>
+  AllowOverride All
+  Options FollowSymLinks
+{% if dokuwiki_src_ip is defined %}
+  Require ip {{ dokuwiki_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ dokuwiki_php_fpm_pool | default('dokuwiki_' + dokuwiki_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+
+  <FilesMatch "^(\.ansible_version|\.git.*|README(\.md)?|LICENSE|AUTHORS|.*\.cnf|\.htaccess|_deprecated\.txt|plugin\.info\.txt)">
+    Require all denied
+  </FilesMatch>
+
+{% if httpd_src_ip is defined and httpd_src_ip | length > 0 and '0.0.0.0/0' not in httpd_src_ip and dokuwiki_auth == 'authhttpldap' %}
+  RewriteEngine On
+  RewriteCond %{HTTP:Auth-User} ^(\w+)$
+  RewriteRule .* - [E=REMOTE_USER:%1]
+{% endif %}
+</Directory>
+
+<DirectoryMatch {{ dokuwiki_root_dir }}/web/lib/plugins/\w+/conf>
+  Require all denied
+</DirectoryMatch>
+<Directory {{ dokuwiki_root_dir }}/web/conf>
+  Require all denied
+</Directory>
+<Directory {{ dokuwiki_root_dir }}/web/inc>
+  Require all denied
+</Directory>
+<Directory {{ dokuwiki_root_dir }}/web/config>
+  Require all denied
+</Directory>
--- a/roles/dokuwiki/templates/local.php.j2
+++ b/roles/dokuwiki/templates/local.php.j2
@@ -0,0 +1,14 @@
+<?php
+$conf['lang'] = 'fr';
+$conf['license'] = '';
+$conf['superuser'] = '@admins,admin';
+$conf['showuseras'] = 'username';
+$conf['passcrypt'] = 'sha512';
+$conf['disableactions'] = 'register';
+$conf['subscribers'] = 1;
+$conf['userewrite'] = '1';
+$conf['useslash'] = 1;
+{% if 'bootstrap3' in dokuwiki_tpl_to_install %}
+$conf['template'] = 'bootstrap3';
+{% endif %}
+?>
--- a/roles/dokuwiki/templates/local.protected.php.j2
+++ b/roles/dokuwiki/templates/local.protected.php.j2
@@ -0,0 +1,37 @@
+<?php
+
+$conf['useacl'] = 1;
+$conf['savedir'] = '{{ dokuwiki_root_dir }}/data';
+
+$conf['authtype'] = '{{ dokuwiki_auth }}';
+{% if dokuwiki_auth == 'authldap' or dokuwiki_auth == 'authhttpldap' %}
+$conf['plugin']['{{ dokuwiki_auth }}']['server'] = "{{ dokuwiki_ldap_uri }}";
+$conf['plugin']['{{ dokuwiki_auth }}']['starttls'] = {{ dokuwiki_ldap_starttls | ternary('1','0') }};
+$conf['plugin']['{{ dokuwiki_auth }}']['version'] = '3';
+$conf['plugin']['{{ dokuwiki_auth }}']['usertree'] = '{{ dokuwiki_ldap_user_base }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['attributes'] = array();
+$conf['plugin']['{{ dokuwiki_auth }}']['grouptree'] = '{{ dokuwiki_ldap_group_base }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['userfilter'] = '{{ dokuwiki_ldap_user_filter }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['groupfilter'] = '{{ dokuwiki_ldap_group_filter }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['groupkey'] = '{{ dokuwiki_ldap_group_key }}';
+{% if dokuwiki_ldap_bind_dn is defined and dokuwiki_ldap_bind_pass is defined %}
+$conf['plugin']['{{ dokuwiki_auth }}']['binddn'] = '{{ dokuwiki_ldap_bind_dn }}';
+$conf['plugin']['{{ dokuwiki_auth }}']['bindpw'] = '{{ dokuwiki_ldap_bind_pass }}';
+{% endif %}
+{% elif dokuwiki_auth == 'authad' %}
+$conf['plugin']['authad']['base_dn'] = '{{ dokuwiki_ad_user_base }}';
+$conf['plugin']['authad']['domain_controllers'] = '{{ dokuwiki_ad_dc | join(', ') }}';
+{% if dokuwiki_ad_bind_user is defined and dokuwiki_ad_bind_pass is defined %}
+$conf['plugin']['authad']['admin_username'] = '{{ dokuwiki_ad_bind_user }}';
+$conf['plugin']['authad']['admin_password'] = '{{ dokuwiki_ad_bind_pass }}';
+{% endif %}
+{% if dokuwiki_ad_domain is defined %}
+$conf['plugin']['authad']['account_suffix'] = '@{{ dokuwiki_ad_domain }}';
+{% endif %}
+$conf['plugin']['authad']['sso'] = 1;
+$conf['plugin']['authad']['use_tls'] = {{ dokuwiki_ad_starttls | ternary('1','0') }};
+$conf['plugin']['authad']['recursive_groups'] = 1;
+$conf['plugin']['authad']['expirywarn'] = 15;
+{% endif %}
+
+?>
--- a/roles/dokuwiki/templates/perms.sh.j2
+++ b/roles/dokuwiki/templates/perms.sh.j2
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+restorecon -R {{ dokuwiki_root_dir }}
+chown root:root {{ dokuwiki_root_dir }}
+chmod 700 {{ dokuwiki_root_dir }}
+setfacl -k -b {{ dokuwiki_root_dir }}
+setfacl -m u:{{ dokuwiki_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ dokuwiki_root_dir }}
+chown -R root:root {{ dokuwiki_root_dir }}/web
+chown -R {{ dokuwiki_php_user | default('apache') }} {{ dokuwiki_root_dir }}/web/lib/{plugins,tpl}
+chown -R {{ dokuwiki_php_user }} {{ dokuwiki_root_dir }}/{tmp,sessions,cache,data}
+chmod 700 {{ dokuwiki_root_dir }}/{tmp,sessions,cache,data}
+find {{ dokuwiki_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ dokuwiki_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown -R :{{ dokuwiki_php_user }} {{ dokuwiki_root_dir }}/web/conf
+find {{ dokuwiki_root_dir }}/web/conf -type f -exec chmod 660 "{}" \;
+find {{ dokuwiki_root_dir }}/web/conf -type d -exec chmod 770 "{}" \;
--- a/roles/dokuwiki/templates/php.conf.j2
+++ b/roles/dokuwiki/templates/php.conf.j2
@@ -0,0 +1,37 @@
+; {{ ansible_managed }}
+
+[dokuwiki_{{ dokuwiki_id }}]
+
+listen.owner = root
+listen.group = {{ httpd_user | default('apache') }}
+listen.mode = 0660
+listen = /run/php-fpm/dokuwiki_{{ dokuwiki_id }}.sock
+user = {{ dokuwiki_php_user }}
+group = {{ dokuwiki_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 60m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 256M
+php_admin_value[session.save_path] = {{ dokuwiki_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ dokuwiki_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ dokuwiki_root_dir }}/tmp
+php_admin_value[post_max_size] = 50M
+php_admin_value[upload_max_filesize] = 50M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ dokuwiki_root_dir }}
+php_admin_value[max_execution_time] = 300
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = on
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on
--- a/roles/dokuwiki/templates/plugins.protected.php.j2
+++ b/roles/dokuwiki/templates/plugins.protected.php.j2
@@ -0,0 +1,3 @@
+<?php
+
+$plugins['{{ dokuwiki_auth }}'] = 1;