Update to 2021-12-01 19:13

roles/framadate/templates/config.php.j2

@@ -0,0 +1,39 @@
+<?php
+
+// {{ ansible_managed }}
+
+const NOMAPPLICATION = 'Framadate';
+const ADRESSEMAILADMIN = '{{ framadate_admin_email | default(system_admin_email) }}';
+const ADRESSEMAILREPONSEAUTO = '<no-reply@{{ ansible_domain }}>';
+const DB_USER = '{{ framadate_mysql_user | default('framadate') }}';
+const DB_PASSWORD = '{{ framadate_mysql_pass }}';
+const DB_CONNECTION_STRING = 'mysql:host={{ framadate_mysql_server }};dbname={{ framadate_mysql_db }};port={{ framadate_mysql_port }}';
+const MIGRATION_TABLE = 'framadate_migration';
+const TABLENAME_PREFIX = 'fd_';
+const DEFAULT_LANGUAGE = 'fr';
+$ALLOWED_LANGUAGES = [
+    'fr' => 'Français',
+    'en' => 'English',
+    'oc' => 'Occitan',
+    'es' => 'Español',
+    'de' => 'Deutsch',
+    'nl' => 'Dutch',
+    'it' => 'Italiano',
+    'br' => 'Brezhoneg',
+];
+const IMAGE_TITRE = '/images/{{ framadate_logo_url | basename }}';
+const URL_PROPRE = true;
+const USE_REMOTE_USER =  {{ framadate_proxy_auth | ternary('true','false') }};
+const LOG_FILE = '../logs/stdout.log';
+const PURGE_DELAY = 60;
+const MAX_SLOTS_PER_POLL = 366;
+const TIME_EDIT_LINK_EMAIL = 60;
+$config = [
+    'use_smtp'                   => true,
+    'show_what_is_that'          => false,
+    'show_the_software'          => false,
+    'show_cultivate_your_garden' => false,
+    'default_poll_duration'      => 180,
+    'user_can_add_img_or_link'   => true,
+    'provide_fork_awesome'       => true,
+];

roles/framadate/templates/httpd.conf.j2

@@ -0,0 +1,45 @@
+{% if framadate_alias is defined %}
+Alias /{{ framadate_alias }} {{ framadate_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ framadate_root_dir }}/web>
+  AllowOverride None
+  Options FollowSymLinks
+{% if framadate_allowed_ip is defined %}
+  Require ip {{ framadate_allowed_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ framadate_php_fpm_pool | default('framadate_' + framadate_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+{% if framadate_proxy_auth %}
+  SetEnvIfNoCase Auth-User "(.*)" REMOTE_USER=$1
+{% endif %}
+
+  RewriteEngine On
+  RewriteCond %{REQUEST_FILENAME} -f [OR]
+  RewriteCond %{REQUEST_FILENAME} -d
+  RewriteRule . - [L]
+
+  RewriteRule ^([a-zA-Z0-9-]+)$ studs.php?poll=$1 [L]
+  RewriteRule ^([a-zA-Z0-9-]+)/action/([a-zA-Z_-]+)/(.+)$ studs.php?poll=$1&$2=$3
+  RewriteRule ^([a-zA-Z0-9-]+)/vote/([a-zA-Z0-9]{16})$ studs.php?poll=$1&vote=$2
+  RewriteRule ^(action/)?([a-zA-Z0-9-]{24})/admin$ adminstuds.php?poll=$2
+  RewriteRule ^([a-zA-Z0-9-]{24})/admin/vote/([a-zA-Z0-9]{16})$ adminstuds.php?poll=$1&vote=$2
+  RewriteRule ^([a-zA-Z0-9-]{24})/admin/action/([a-zA-Z_-]+)(/(.+))?$ adminstuds.php?poll=$1&$2=$4
+
+  <FilesMatch "(composer\..*|\.gitignore|\.editorconfig|.*\.(md|bat|sh|ini)|LICEN[SC]E\..*|htaccess\.txt|\.ansible_version)">
+    <IfModule mod_authz_core.c>
+        Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order allow,deny
+        Deny from all
+    </IfModule>
+  </FilesMatch>
+
+</Directory>
+

roles/framadate/templates/perms.sh.j2

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+restorecon -R {{ framadate_root_dir }}
+chown root:root {{ framadate_root_dir }}
+chmod 700 {{ framadate_root_dir }}
+setfacl -k -b {{ framadate_root_dir }}
+setfacl -m u:{{ framadate_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ framadate_root_dir }}
+chown -R root:root {{ framadate_root_dir }}/web
+chown -R {{ framadate_php_user }} {{ framadate_root_dir }}/{tmp,sessions,logs}
+chmod 700 {{ framadate_root_dir }}/{tmp,sessions,logs}
+find {{ framadate_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ framadate_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown :{{ framadate_php_user }} {{ framadate_root_dir }}/web/app/inc/config.php
+chmod 640 {{ framadate_root_dir }}/web/app/inc/config.php
+[ -d {{ framadate_root_dir }}/web/tpl_c ] || mkdir -p {{ framadate_root_dir }}/web/tpl_c
+chown :{{ framadate_php_user }} {{ framadate_root_dir }}/web/tpl_c
+chmod 775 {{ framadate_root_dir }}/web/tpl_c

roles/framadate/templates/php.conf.j2

@@ -0,0 +1,36 @@
+[framadate_{{ framadate_id }}]
+
+listen.owner = root
+listen.group = apache
+listen.mode = 0660
+listen = /run/php-fpm/framadate_{{ framadate_id }}.sock
+user = {{ framadate_php_user }}
+group = {{ framadate_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 5m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 64M
+php_admin_value[session.save_path] = {{ framadate_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ framadate_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ framadate_root_dir }}/tmp
+php_admin_value[post_max_size] = 2M
+php_admin_value[upload_max_filesize] = 2M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ framadate_root_dir }}
+php_admin_value[max_execution_time] = 60
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = off
+php_admin_flag[file_uploads] = off
+php_admin_flag[session.cookie_httponly] = on
+