Update to 2021-12-01 19:13

roles/dolibarr/templates/dolibarr.conf.j2

@@ -0,0 +1,30 @@
+<?php
+
+{% if dolibarr_public_url is defined %}
+$dolibarr_main_url_root='{{ dolibarr_public_url }}';
+{% endif %}
+$dolibarr_main_document_root='{{ dolibarr_root_dir }}/web/htdocs';
+$dolibarr_main_url_root_alt='/custom';
+$dolibarr_main_document_root_alt='{{ dolibarr_root_dir }}/web/htdocs/custom';
+$dolibarr_main_data_root='{{ dolibarr_root_dir }}/data';
+$dolibarr_main_db_host='{{ dolibarr_db_server }}';
+$dolibarr_main_db_port='{{ dolibarr_db_port | default('3306') }}';
+$dolibarr_main_db_name='{{ dolibarr_db_name }}';
+$dolibarr_main_db_prefix='llx_';
+$dolibarr_main_db_user='{{ dolibarr_db_user }}';
+$dolibarr_main_db_pass='{{ dolibarr_db_pass }}';
+$dolibarr_main_db_type='mysqli';
+$dolibarr_main_db_character_set='utf8';
+$dolibarr_main_db_collation='utf8_unicode_ci';
+
+// Authentication settings
+$dolibarr_main_authentication='{{ dolibarr_auth }}';
+
+// Security settings
+$dolibarr_main_prod='1';
+$dolibarr_main_force_https='0';
+$dolibarr_main_restrict_os_commands='mysqldump, mysql';
+$dolibarr_nocsrfcheck='0';
+$dolibarr_main_cookie_cryptkey='{{ dolibarr_cookie_key }}';
+$dolibarr_mailing_limit_sendbyweb='0';
+

roles/dolibarr/templates/httpd.conf.j2

@@ -0,0 +1,19 @@
+{% if dolibarr_alias is defined %}
+Alias /{{ dolibarr_alias }} {{ dolibarr_root_dir }}/web/htdocs
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+RewriteEngine On
+<Directory {{ dolibarr_root_dir }}/web/htdocs>
+  AllowOverride All
+  Options FollowSymLinks
+{% if dolibarr_src_ip is defined %}
+  Require ip {{ dolibarr_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ dolibarr_php_fpm_pool  | default('dolibarr_' + dolibarr_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+</Directory>

roles/dolibarr/templates/logrotate.conf.j2

@@ -0,0 +1,7 @@
+{{ dolibarr_root_dir }}/data/*.log {
+  daily
+  rotate 90
+  compress
+  missingok
+  create 640 {{ dolibarr_php_user }} {{ dolibarr_php_user }}
+}

roles/dolibarr/templates/perms.sh.j2

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+restorecon -R {{ dolibarr_root_dir }}
+chown root:root {{ dolibarr_root_dir }}
+chmod 700 {{ dolibarr_root_dir }}
+chown root:root {{ dolibarr_root_dir }}/{meta,db_dumps}
+chmod 700 {{ dolibarr_root_dir }}/{meta,db_dumps}
+setfacl -k -b {{ dolibarr_root_dir }}
+setfacl -m u:{{ dolibarr_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ dolibarr_root_dir }}
+chown -R root:root {{ dolibarr_root_dir }}/web
+chown -R {{ dolibarr_php_user }} {{ dolibarr_root_dir }}/{tmp,sessions,data}
+chmod 700 {{ dolibarr_root_dir }}/{tmp,sessions,data}
+setfacl -R -m u:{{ httpd_user | default('apache') }}:rX {{ dolibarr_root_dir }}/data
+find {{ dolibarr_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ dolibarr_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown -R :{{ dolibarr_php_user }} {{ dolibarr_root_dir }}/web/htdocs/{conf,custom}
+chmod 770 {{ dolibarr_root_dir }}/web/htdocs/custom
+setfacl -R -m u:{{ httpd_user | default('apache') }}:rX {{ dolibarr_root_dir }}/web/htdocs/custom
+chmod 770 {{ dolibarr_root_dir }}/web/htdocs/conf
+chmod 640 {{ dolibarr_root_dir }}/web/htdocs/conf/*
+chmod 755 {{ dolibarr_root_dir }}/web/scripts/user/sync_ldap2dolibarr.sh

roles/dolibarr/templates/php.conf.j2

@@ -0,0 +1,37 @@
+; {{ ansible_managed }}
+
+[dolibarr_{{ dolibarr_id }}]
+
+listen.owner = root
+listen.group = {{ httpd_user | default('apache') }}
+listen.mode = 0660
+listen = /run/php-fpm/dolibarr_{{ dolibarr_id }}.sock
+user = {{ dolibarr_php_user }}
+group = {{ dolibarr_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 60m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 512M
+php_admin_value[session.save_path] = {{ dolibarr_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ dolibarr_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ dolibarr_root_dir }}/tmp
+php_admin_value[post_max_size] = 20M
+php_admin_value[upload_max_filesize] = 20M
+php_admin_value[disable_functions] = system, show_source, symlink, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ dolibarr_root_dir }}
+php_admin_value[max_execution_time] = 900
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = on
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on

roles/dolibarr/templates/post-backup.j2

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+rm -f {{ dolibarr_root_dir }}/db_dumps/*

roles/dolibarr/templates/pre-backup.j2

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -eo pipefail
+
+/usr/bin/mysqldump --user={{ dolibarr_db_user }} \
+                   --password={{ dolibarr_db_pass | quote }} \
+                   --host={{ dolibarr_db_server }} \
+                   --quick --single-transaction \
+                   --add-drop-table {{ dolibarr_db_name }} | zstd -c > {{ dolibarr_root_dir }}/db_dumps/{{ dolibarr_db_name }}.sql.zst