Update to 2021-12-01 19:13

roles/kanboard/templates/config.php.j2

@@ -0,0 +1,84 @@
+<?php
+
+define('DATA_DIR', '{{ kanboard_root_dir}}/data');
+define('DEBUG', false);
+define('LOG_DRIVER', 'syslog');
+define('PLUGINS_DIR', 'plugins');
+define('CACHE_DRIVER', 'memory');
+define('CACHE_DIR', '{{ kanboard_root_dir}}/cache');
+define('FILES_DIR', DATA_DIR.DIRECTORY_SEPARATOR.'files');
+define('MAIL_FROM', 'no-reply@{{ ansible_domain }}');
+define('MAIL_TRANSPORT', 'mail');
+define('DB_DRIVER', 'mysql');
+define('DB_USERNAME', '{{ kanboard_mysql_user }}');
+define('DB_PASSWORD', '{{ kanboard_mysql_pass }}');
+define('DB_HOSTNAME', '{{ kanboard_mysql_server }}');
+define('DB_NAME', '{{ kanboard_mysql_db }}');
+
+# TODO: LDAP / Proxy settings
+{% if kanboard_ldap_auth %}
+define('LDAP_AUTH', true);
+define('LDAP_SERVER', '{{ kanboard_ldap_server | default(ldap_uri) | default('') }}');
+define('LDAP_START_TLS', {{ kanboard_ldap_starttls | default(True) | ternary('true','false') }});
+define('LDAP_USERNAME_CASE_SENSITIVE', false);
+{% if kanboard_ldap_bind_user is defined and kanboard_ldap_bind_pass is defined %}
+define('LDAP_BIND_TYPE', 'proxy');
+define('LDAP_USERNAME', '{{ kanboard_ldap_bind_user }}');
+define('LDAP_PASSWORD', '{{ kanboard_ldap_bind_pass }}');
+{% else %}
+define('LDAP_BIND_TYPE', 'anonymous');
+{% endif %}
+{% if kanboard_ldap_user_base is defined %}
+{% set user_base = kanboard_ldap_user_base %}
+{% elif ldap_base is defined %}
+{% set user_base = ldap_user_base | default('ou=Users') ~ ',' ~ ldap_base %}
+{% else %}
+{% set user_base = '' %}
+{% endif %}
+define('LDAP_USER_BASE_DN', '{{ user_base }}');
+define('LDAP_USER_FILTER', '{{ kanboard_ldap_user_filter }}');
+define('LDAP_USER_ATTRIBUTE_USERNAME', '{{ kanboard_ldap_user_attr_username }}');
+define('LDAP_USER_ATTRIBUTE_FULLNAME', '{{ kanboard_ldap_user_attr_fullname }}');
+define('LDAP_USER_ATTRIBUTE_EMAIL', '{{ kanboard_ldap_user_attr_mail }}');
+define('LDAP_USER_ATTRIBUTE_GROUPS', '{{ kanboard_ldap_user_attr_groups }}');
+define('LDAP_USER_ATTRIBUTE_PHOTO', '{{ kanboard_ldap_user_attr_photo }}');
+define('LDAP_USER_ATTRIBUTE_LANGUAGE', '{{ kanboard_ldap_user_attr_lang }}');
+define('LDAP_USER_CREATION', true);
+define('LDAP_GROUP_PROVIDER', true);
+{% if kanboard_ldap_group_base is defined %}
+{% set group_base = kanboard_ldap_group_base %}
+{% elif ldap_base is defined %}
+{% set group_base = ldap_group_base | default('ou=Groups') ~ ',' ~ ldap_base %}
+{% else %}
+{% set group_base = '' %}
+{% endif %}
+define('LDAP_GROUP_BASE_DN', '{{ group_base }}');
+define('LDAP_GROUP_ADMIN_DN', '{{ kanboard_ldap_admin_group | default('cn=admins,' ~ group_base) }}');
+define('LDAP_GROUP_MANAGER_DN', '{{ kanboard_ldap_manager_group | default('cn=admins,' ~ group_base) }}');
+define('LDAP_GROUP_FILTER', '{{ kanboard_ldap_group_filter }}');
+define('LDAP_GROUP_ATTRIBUTE_NAME', '{{ kanboard_ldap_group_attr_name }}');
+{% if kanboard_ldap_group_user_filter is defined and kanboard_ldap_group_user_filter != '' %}
+define('LDAP_GROUP_USER_FILTER', '{{ kanboard_ldap_group_user_filter | default('(&(objectClass=posixGroup)(memberUid=%s))') }}');
+{% endif %}
+{% endif %}
+
+{% if kanboard_proxy_auth %}
+define('REVERSE_PROXY_AUTH', {{ kanboard_ldap_auth | ternary('false', 'true') }});
+define('REVERSE_PROXY_USER_HEADER', '{{ kanboard_proxy_user_header | default('REMOTE_USER') }}');
+define('REVERSE_PROXY_DEFAULT_ADMIN', '{{ kanboard_proxy_admin | default('admin') }}');
+define('REVERSE_PROXY_DEFAULT_DOMAIN', '{{ kanboard_proxy_domain | default(ansible_domain) }}');
+{% endif %}
+
+define('HIDE_LOGIN_FORM', false);
+define('DISABLE_LOGOUT', false);
+define('ENABLE_HSTS', true);
+define('ENABLE_XFRAME', true);
+define('ENABLE_URL_REWRITE', false);
+define('BRUTEFORCE_CAPTCHA', 3);
+define('BRUTEFORCE_LOCKDOWN', 6);
+define('BRUTEFORCE_LOCKDOWN_DURATION', 15);
+define('SESSION_DURATION', 0);
+
+
+?>
+

roles/kanboard/templates/cron.j2

@@ -0,0 +1 @@
+0 0 * * * {{ kanboard_php_user }} cd {{ kanboard_root_dir }}/web && ./kanboard cronjob >/dev/null 2>&1

roles/kanboard/templates/httpd.conf.j2

@@ -0,0 +1,32 @@
+{% if kanboard_alias is defined %}
+Alias /{{ kanboard_alias }} {{ kanboard_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ kanboard_root_dir }}/web>
+  AllowOverride None
+  Options FollowSymLinks
+{% if kanboard_src_ip is defined and kanboard_src_ip | length > 0 %}
+  Require ip {{ kanboard_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ kanboard_php_fpm_pool | default('kanboard_' + kanboard_id) }}.sock|fcgi://localhost"
+  </FilesMatch>
+  <IfModule mod_rewrite.c>
+    Options -MultiViews
+    SetEnv HTTP_MOD_REWRITE On
+    RewriteEngine On
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule ^ index.php [QSA,L]
+  </IfModule>
+  <FilesMatch "(kanboard|config.php|config.default.php|.ansible_version|.git.*)">
+    Require all denied
+  </FilesMatch>
+</Directory>
+
+<Directory {{ kanboard_root_dir }}/web/app>
+  Require all denied
+</Directory>

roles/kanboard/templates/perms.sh.j2

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+restorecon -R {{ kanboard_root_dir }}
+chown root:root {{ kanboard_root_dir }}
+chmod 700 {{ kanboard_root_dir }}
+chown root:root {{ kanboard_root_dir }}/meta
+chmod 700 {{ kanboard_root_dir }}/meta
+setfacl -k -b {{ kanboard_root_dir }}
+setfacl -m u:{{ kanboard_php_user }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ kanboard_root_dir }}
+chown -R root:root {{ kanboard_root_dir }}/web
+chown -R {{ kanboard_php_user }} {{ kanboard_root_dir }}/{tmp,sessions,cache,data}
+chmod 700 {{ kanboard_root_dir }}/{tmp,sessions,cache,data}
+find {{ kanboard_root_dir }}/web -type f -exec chmod 644 "{}" \;
+find {{ kanboard_root_dir }}/web -type d -exec chmod 755 "{}" \;
+chown :{{ kanboard_php_user }} {{ kanboard_root_dir }}/web/config.php
+chmod 640 {{ kanboard_root_dir }}/web/config.php
+chmod 755 {{ kanboard_root_dir }}/web/cli
+restorecon -R {{ kanboard_root_dir }}

roles/kanboard/templates/php.conf.j2

@@ -0,0 +1,36 @@
+; {{ ansible_managed }}
+[kanboard_{{ kanboard_id }}]
+
+listen.owner = root
+listen.group = {{ httpd_user | default('apache') }}
+listen.mode = 0660
+listen = /run/php-fpm/kanboard_{{ kanboard_id }}.sock
+user = {{ kanboard_php_user }}
+group = {{ kanboard_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 5m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 128M
+php_admin_value[session.save_path] = {{ kanboard_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ kanboard_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ kanboard_root_dir }}/tmp
+php_admin_value[post_max_size] = 25M
+php_admin_value[upload_max_filesize] = 25M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ kanboard_root_dir }}
+php_admin_value[max_execution_time] = 60
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = off
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on