Update to 2021-12-01 19:13

roles/kanboard/defaults/main.yml

@@ -0,0 +1,65 @@
+---
+
+kanboard_id: "1"
+kanboard_manage_upgrade: True
+kanboard_version: '1.2.20'
+kanboard_zip_url: https://github.com/kanboard/kanboard/archive/v{{ kanboard_version }}.zip
+kanboard_zip_sha1: 114d6c5a368c6c1b58c8b98bdfcbf04df8fae67a
+# enabled prop for the ReverseProxyLdap plugin is managed automatically
+# True if kanboard_ldap_auth and kanboard_proxy_auth are both True, or
+# False otherwise
+kanboard_plugins:
+  reverse-proxy-ldap:
+    name: ReverseProxyLdap
+    version: '1.0.2'
+    zip_sha1: d264754e0de2c0e2500b839e8adb693cf59c3f66
+  calendar:
+    name: Calendar
+    version: '1.1.1'
+    zip_sha1: de4195ade4391bc6e46f7a993e9220144581f913
+    enabled: True
+  gantt:
+    name: Gantt
+    version: '1.0.6'
+    zip_sha1: 8ff400fe5c2385fee725219ba1f1f4dca5f3e878
+    enabled: True
+kanboard_root_dir: /opt/kanboard_{{ kanboard_id }}
+kanboard_php_user: php-kanboard_{{ kanboard_id }}
+kanboard_php_version: 73
+# kanboard_php_fpm_pool: php70
+kanboard_mysql_server: "{{ mysql_server | default('localhost') }}"
+kanboard_mysql_db: kanboard_{{ kanboard_id }}
+kanboard_mysql_user: kanboard_{{ kanboard_id }}
+# A random pass will be generated and stored in the meta dir if not set here
+#kanboard_mysql_pass: S3cr3t.P@ssw0rd
+
+kanboard_ldap_auth: "{{ (ad_auth | default(False) or ldap_auth | default(False)) | ternary(True,False) }}"
+kanboard_ldap_server: "{{ ad_auth | default(False) | ternary('ldap://' + ad_realm | default(samba_realm) | default(ansible_domain) | lower, ldap_uri) }}"
+#kanboard_ldap_bind_user:
+#kanboard_ldap_bind_pass:
+kanboard_ldap_start_tls: True
+kanboard_ldap_user_base: "{{ ad_auth | default(False) | ternary((ad_ldap_user_search_base is defined) | ternary(ad_ldap_user_search_base,'DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC=')), ldap_user_base + ',' + ldap_base) }}"
+kanboard_ldap_user_filter: "{{ ad_auth | default(False) | ternary('(&(objectClass=user)(sAMAccountName=%s))','(&(objectClass=inetOrgPerson)(uid=%s))') }}"
+kanboard_ldap_user_attr_username: "{{ ad_auth | default(False) | ternary('sAMAccountName','uid') }}"
+kanboard_ldap_user_attr_fullname: cn
+kanboard_ldap_user_attr_mail: mail
+kanboard_ldap_user_attr_groups: memberOf
+kanboard_ldap_user_attr_photo: jpegPhoto
+kanboard_ldap_user_attr_lang: preferredLanguagepre
+kanboard_ldap_admin_group: "{{ ad_auth | default(False) | ternary('CN=Domain Admins,CN=Users,DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC='), 'cn=admins,' + ldap_group_base + ',' + ldap_base) }}"
+kanboard_ldap_manager_group: "{{ kanboard_ldap_admin_group }}"
+kanboard_ldap_group_base: "{{ ad_auth | default(False) | ternary((ad_ldap_group_search_base is defined) | ternary(ad_ldap_group_search_base,'DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC=')), ldap_group_base + ',' + ldap_base) }}"
+kanboard_ldap_group_filter: "{{ ad_auth | default(False) | ternary('(&(objectClass=group)(cn=%s))','(&(objectClass=posixGroup)(cn=%s))') }}"
+kanboard_ldap_group_user_filter: "{{ ad_auth | default(False) | ternary('','(&(objectClass=posixGroup)(memberUid=%s))') }}"
+kanboard_ldap_group_attr_name: cn
+
+kanboard_proxy_auth: False
+kanboard_proxy_user_header: REMOTE_USER
+kanboard_proxy_admin: admin
+kanboard_proxy_domain: "{{ ansible_domain }}"
+
+# kanboard_alias: kanboard
+# kanboard_src_ip:
+#   - 192.168.7.0/24
+#   - 10.2.0.0/24
+...

roles/kanboard/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- include: ../httpd_common/handlers/main.yml
+- include: ../httpd_php/handlers/main.yml
+...

roles/kanboard/meta/main.yml

@@ -0,0 +1,5 @@
+---
+allow_duplicates: True
+dependencies:
+  - role: httpd_php
+...

roles/kanboard/tasks/archive_post.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: ../includes/webapps_compress_archive.yml
+  vars:
+    - root_dir: "{{ kanboard_root_dir }}"
+    - version: "{{ kanboard_current_version }}"
+  tags: kanboard

roles/kanboard/tasks/archive_pre.yml

@@ -0,0 +1,9 @@
+---
+
+- import_tasks: ../includes/webapps_archive.yml
+  vars:
+    - root_dir: "{{ kanboard_root_dir }}"
+    - version: "{{ kanboard_current_version }}"
+    - db_name: "{{ kanboard_mysql_db }}"
+  tags: kanboard
+

roles/kanboard/tasks/cleanup.yml

@@ -0,0 +1,14 @@
+---
+
+- name: Remove temp files
+  file: path={{ item }} state=absent
+  with_items:
+    - "{{ kanboard_root_dir }}/tmp/kanboard-{{ kanboard_version }}/"
+    - "{{ kanboard_root_dir }}/tmp/kanboard-v{{ kanboard_version }}.zip"
+    - "{{ kanboard_root_dir }}/web/data"
+  tags: kanboard
+
+- name: Remove plugins archives
+  file: path={{ kanboard_root_dir }}/tmp/{{ kanboard_plugins[item].name }}-{{ kanboard_plugins[item].version }}.zip state=absent
+  with_items: "{{ kanboard_plugins.keys() | list }}"
+  tags: kanboard

roles/kanboard/tasks/conf.yml

@@ -0,0 +1,12 @@
+---
+
+- import_tasks: ../includes/webapps_webconf.yml
+  vars:
+    - app_id: kanboard_{{ kanboard_id }}
+    - php_version: "{{ kanboard_php_version }}"
+    - php_fpm_pool: "{{ kanboard_php_fpm_pool | default('') }}"
+  tags: kanboard
+
+- name: Deploy kanboard configuration
+  template: src=config.php.j2 dest={{ kanboard_root_dir }}/web/config.php owner=root group={{ kanboard_php_user }} mode=640
+  tags: kanboard

roles/kanboard/tasks/directories.yml

@@ -0,0 +1,13 @@
+---
+
+- name: Create directory structure
+  file: path={{ item }} state=directory
+  with_items:
+    - "{{ kanboard_root_dir }}"
+    - "{{ kanboard_root_dir }}/web"
+    - "{{ kanboard_root_dir }}/tmp"
+    - "{{ kanboard_root_dir }}/sessions"
+    - "{{ kanboard_root_dir }}/data"
+    - "{{ kanboard_root_dir }}/cache"
+    - "{{ kanboard_root_dir }}/meta"
+  tags: kanboard

roles/kanboard/tasks/facts.yml

@@ -0,0 +1,21 @@
+---
+
+- import_tasks: ../includes/webapps_set_install_mode.yml
+  vars:
+    - root_dir: "{{ kanboard_root_dir }}"
+    - version: "{{ kanboard_version }}"
+  tags: kanboard
+- set_fact: kanboard_install_mode={{ (install_mode == 'upgrade' and not kanboard_manage_upgrade) | ternary('none',install_mode) }}
+  tags: kanboard
+- set_fact: kanboard_current_version={{ current_version | default('') }}
+  tags: kanboard
+
+- import_tasks: ../includes/get_rand_pass.yml
+  vars:
+    - pass_file: "{{kanboard_root_dir }}/meta/ansible_dbpass"
+  when: kanboard_mysql_pass is not defined
+  tags: kanboard
+- set_fact: kanboard_mysql_pass={{ rand_pass }}
+  when: kanboard_mysql_pass is not defined
+  tags: kanboard
+

roles/kanboard/tasks/install.yml

@@ -0,0 +1,81 @@
+---
+
+- name: Install needed tools
+  yum:
+    name:
+      - unzip
+      - tar
+      - acl
+  tags: kanboard
+
+- name: Download Kanboard
+  get_url:
+    url: "{{ kanboard_zip_url }}"
+    dest: "{{ kanboard_root_dir }}/tmp/kanboard-v{{ kanboard_version }}.zip"
+    checksum: "sha1:{{ kanboard_zip_sha1 }}"
+  when: kanboard_install_mode != 'none'
+  tags: kanboard
+
+- name: Extract kanboard archive
+  unarchive:
+    src: "{{ kanboard_root_dir }}/tmp/kanboard-v{{ kanboard_version }}.zip"
+    dest: "{{ kanboard_root_dir }}/tmp/"
+    remote_src: yes
+  when: kanboard_install_mode != 'none'
+  tags: kanboard
+
+- name: Move the content of kanboard to the correct top directory
+  synchronize:
+    src: "{{ kanboard_root_dir }}/tmp/kanboard-{{ kanboard_version }}/"
+    dest: "{{ kanboard_root_dir }}/web/"
+    recursive: True
+    delete: True
+  delegate_to: "{{ inventory_hostname }}"
+  when: kanboard_install_mode != 'none'
+  tags: kanboard
+
+- name: Check if ReverseProxyLdap plugin needs to be enabled
+  set_fact:
+    kanboard_plugin_proxy_ldap_enabled: True
+  when: kanboard_ldap_auth and kanboard_proxy_auth
+  tags: kanboard
+
+- name: Check if ReverseProxyLdap plugin needs to be disabled
+  set_fact:
+    kanboard_plugin_proxy_ldap_enabled: False
+  when: not kanboard_ldap_auth or not kanboard_proxy_auth
+  tags: kanboard
+
+- name: Download plugins
+  get_url:
+    url: https://github.com/kanboard/plugin-{{ item }}/releases/download/v{{ kanboard_plugins[item].version }}/{{ kanboard_plugins[item].name }}-{{ kanboard_plugins[item].version }}.zip
+    dest: "{{ kanboard_root_dir }}/tmp/"
+    checksum: "sha1:{{ kanboard_plugins[item].zip_sha1 }}"
+  when:
+    - kanboard_install_mode != 'none'
+    - (item != 'reverse-proxy-ldap' and (kanboard_plugins[item].enabled | default(True))) or kanboard_plugin_proxy_ldap_enabled
+  with_items: "{{ kanboard_plugins.keys() | list }}"
+  tags: kanboard
+
+- name: Extract plugins
+  unarchive:
+    src: "{{ kanboard_root_dir }}/tmp/{{ kanboard_plugins[item].name }}-{{ kanboard_plugins[item].version }}.zip"
+    dest: "{{ kanboard_root_dir }}/web/plugins/"
+    remote_src: yes
+  when:
+    - kanboard_install_mode != 'none'
+    - (item != 'reverse-proxy-ldap' and (kanboard_plugins[item].enabled | default(True))) or kanboard_plugin_proxy_ldap_enabled
+  with_items: "{{ kanboard_plugins.keys() | list }}"
+  tags: kanboard
+
+- import_tasks: ../includes/webapps_create_mysql_db.yml
+  vars:
+    - db_name: "{{ kanboard_mysql_db }}"
+    - db_user: "{{ kanboard_mysql_user }}"
+    - db_server: "{{ kanboard_mysql_server }}"
+    - db_pass: "{{ kanboard_mysql_pass }}"
+  tags: kanboard
+
+- name: Deploy cron task
+  template: src=cron.j2 dest=/etc/cron.d/kanboard_{{ kanboard_id }} mode=644
+  tags: kanboard

roles/kanboard/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+
+- include: user.yml
+- include: directories.yml
+- include: facts.yml
+- include: archive_pre.yml
+  when: kanboard_install_mode == 'upgrade'
+- include: install.yml
+- include: conf.yml
+- include: write_version.yml
+  when: kanboard_install_mode != 'none'
+- include: archive_post.yml
+  when: kanboard_install_mode == 'upgrade'
+- include: cleanup.yml
+

roles/kanboard/tasks/user.yml

@@ -0,0 +1,8 @@
+---
+
+- import_tasks: ../includes/create_system_user.yml
+  vars:
+    - user: "{{ kanboard_php_user }}"
+    - comment: "PHP FPM for kanboard {{ kanboard_id }}"
+  tags: kanboard
+

roles/kanboard/tasks/write_version.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: ../includes/webapps_post.yml
+  vars:
+    - root_dir: "{{ kanboard_root_dir }}"
+    - version: "{{ kanboard_version }}"
+  tags: kanboard

roles/kanboard/templates/config.php.j2

@@ -0,0 +1,84 @@
+<?php
+
+define('DATA_DIR', '{{ kanboard_root_dir}}/data');
+define('DEBUG', false);
+define('LOG_DRIVER', 'syslog');
+define('PLUGINS_DIR', 'plugins');
+define('CACHE_DRIVER', 'memory');
+define('CACHE_DIR', '{{ kanboard_root_dir}}/cache');
+define('FILES_DIR', DATA_DIR.DIRECTORY_SEPARATOR.'files');
+define('MAIL_FROM', 'no-reply@{{ ansible_domain }}');
+define('MAIL_TRANSPORT', 'mail');
+define('DB_DRIVER', 'mysql');
+define('DB_USERNAME', '{{ kanboard_mysql_user }}');
+define('DB_PASSWORD', '{{ kanboard_mysql_pass }}');
+define('DB_HOSTNAME', '{{ kanboard_mysql_server }}');
+define('DB_NAME', '{{ kanboard_mysql_db }}');
+
+# TODO: LDAP / Proxy settings
+{% if kanboard_ldap_auth %}
+define('LDAP_AUTH', true);
+define('LDAP_SERVER', '{{ kanboard_ldap_server | default(ldap_uri) | default('') }}');
+define('LDAP_START_TLS', {{ kanboard_ldap_starttls | default(True) | ternary('true','false') }});
+define('LDAP_USERNAME_CASE_SENSITIVE', false);
+{% if kanboard_ldap_bind_user is defined and kanboard_ldap_bind_pass is defined %}
+define('LDAP_BIND_TYPE', 'proxy');
+define('LDAP_USERNAME', '{{ kanboard_ldap_bind_user }}');
+define('LDAP_PASSWORD', '{{ kanboard_ldap_bind_pass }}');
+{% else %}
+define('LDAP_BIND_TYPE', 'anonymous');
+{% endif %}
+{% if kanboard_ldap_user_base is defined %}
+{% set user_base = kanboard_ldap_user_base %}
+{% elif ldap_base is defined %}
+{% set user_base = ldap_user_base | default('ou=Users') ~ ',' ~ ldap_base %}
+{% else %}
+{% set user_base = '' %}
+{% endif %}
+define('LDAP_USER_BASE_DN', '{{ user_base }}');
+define('LDAP_USER_FILTER', '{{ kanboard_ldap_user_filter }}');
+define('LDAP_USER_ATTRIBUTE_USERNAME', '{{ kanboard_ldap_user_attr_username }}');
+define('LDAP_USER_ATTRIBUTE_FULLNAME', '{{ kanboard_ldap_user_attr_fullname }}');
+define('LDAP_USER_ATTRIBUTE_EMAIL', '{{ kanboard_ldap_user_attr_mail }}');
+define('LDAP_USER_ATTRIBUTE_GROUPS', '{{ kanboard_ldap_user_attr_groups }}');
+define('LDAP_USER_ATTRIBUTE_PHOTO', '{{ kanboard_ldap_user_attr_photo }}');
+define('LDAP_USER_ATTRIBUTE_LANGUAGE', '{{ kanboard_ldap_user_attr_lang }}');
+define('LDAP_USER_CREATION', true);
+define('LDAP_GROUP_PROVIDER', true);
+{% if kanboard_ldap_group_base is defined %}
+{% set group_base = kanboard_ldap_group_base %}
+{% elif ldap_base is defined %}
+{% set group_base = ldap_group_base | default('ou=Groups') ~ ',' ~ ldap_base %}
+{% else %}
+{% set group_base = '' %}
+{% endif %}
+define('LDAP_GROUP_BASE_DN', '{{ group_base }}');
+define('LDAP_GROUP_ADMIN_DN', '{{ kanboard_ldap_admin_group | default('cn=admins,' ~ group_base) }}');
+define('LDAP_GROUP_MANAGER_DN', '{{ kanboard_ldap_manager_group | default('cn=admins,' ~ group_base) }}');
+define('LDAP_GROUP_FILTER', '{{ kanboard_ldap_group_filter }}');
+define('LDAP_GROUP_ATTRIBUTE_NAME', '{{ kanboard_ldap_group_attr_name }}');
+{% if kanboard_ldap_group_user_filter is defined and kanboard_ldap_group_user_filter != '' %}
+define('LDAP_GROUP_USER_FILTER', '{{ kanboard_ldap_group_user_filter | default('(&(objectClass=posixGroup)(memberUid=%s))') }}');
+{% endif %}
+{% endif %}
+
+{% if kanboard_proxy_auth %}
+define('REVERSE_PROXY_AUTH', {{ kanboard_ldap_auth | ternary('false', 'true') }});
+define('REVERSE_PROXY_USER_HEADER', '{{ kanboard_proxy_user_header | default('REMOTE_USER') }}');
+define('REVERSE_PROXY_DEFAULT_ADMIN', '{{ kanboard_proxy_admin | default('admin') }}');
+define('REVERSE_PROXY_DEFAULT_DOMAIN', '{{ kanboard_proxy_domain | default(ansible_domain) }}');
+{% endif %}
+
+define('HIDE_LOGIN_FORM', false);
+define('DISABLE_LOGOUT', false);
+define('ENABLE_HSTS', true);
+define('ENABLE_XFRAME', true);
+define('ENABLE_URL_REWRITE', false);
+define('BRUTEFORCE_CAPTCHA', 3);
+define('BRUTEFORCE_LOCKDOWN', 6);
+define('BRUTEFORCE_LOCKDOWN_DURATION', 15);
+define('SESSION_DURATION', 0);
+
+
+?>
+

roles/kanboard/templates/cron.j2

@@ -0,0 +1 @@
+0 0 * * * {{ kanboard_php_user }} cd {{ kanboard_root_dir }}/web && ./kanboard cronjob >/dev/null 2>&1

roles/kanboard/templates/httpd.conf.j2

@@ -0,0 +1,32 @@
+{% if kanboard_alias is defined %}
+Alias /{{ kanboard_alias }} {{ kanboard_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ kanboard_root_dir }}/web>
+  AllowOverride None
+  Options FollowSymLinks
+{% if kanboard_src_ip is defined and kanboard_src_ip | length > 0 %}
+  Require ip {{ kanboard_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ kanboard_php_fpm_pool | default('kanboard_' + kanboard_id) }}.sock|fcgi://localhost"
+  </FilesMatch>
+  <IfModule mod_rewrite.c>
+    Options -MultiViews
+    SetEnv HTTP_MOD_REWRITE On
+    RewriteEngine On
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^ index.php [QSA,L]
+  </IfModule>
+  <FilesMatch "(kanboard|config.php|config.default.php|.ansible_version|.git.*)">
+    Require all denied
+  </FilesMatch>
+</Directory>
+
+<Directory {{ kanboard_root_dir }}/web/app>
+  Require all denied
+</Directory>

roles/kanboard/templates/perms.sh.j2

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+restorecon -R {{ kanboard_root_dir }}
+chown root:root {{ kanboard_root_dir }}
+chmod 700 {{ kanboard_root_dir }}
+chown root:root {{ kanboard_root_dir }}/meta
+chmod 700 {{ kanboard_root_dir }}/meta
+setfacl -k -b {{ kanboard_root_dir }}
+setfacl -m u:{{ kanboard_php_user }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ kanboard_root_dir }}
+chown -R root:root {{ kanboard_root_dir }}/web
+chown -R {{ kanboard_php_user }} {{ kanboard_root_dir }}/{tmp,sessions,cache,data}
+chmod 700 {{ kanboard_root_dir }}/{tmp,sessions,cache,data}
+find {{ kanboard_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ kanboard_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown :{{ kanboard_php_user }} {{ kanboard_root_dir }}/web/config.php
+chmod 640 {{ kanboard_root_dir }}/web/config.php
+chmod 755 {{ kanboard_root_dir }}/web/cli
+restorecon -R {{ kanboard_root_dir }}

roles/kanboard/templates/php.conf.j2

@@ -0,0 +1,36 @@
+; {{ ansible_managed }}
+[kanboard_{{ kanboard_id }}]
+
+listen.owner = root
+listen.group = {{ httpd_user | default('apache') }}
+listen.mode = 0660
+listen = /run/php-fpm/kanboard_{{ kanboard_id }}.sock
+user = {{ kanboard_php_user }}
+group = {{ kanboard_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 5m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 128M
+php_admin_value[session.save_path] = {{ kanboard_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ kanboard_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ kanboard_root_dir }}/tmp
+php_admin_value[post_max_size] = 25M
+php_admin_value[upload_max_filesize] = 25M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ kanboard_root_dir }}
+php_admin_value[max_execution_time] = 60
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = off
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on