Update to 2021-12-01 19:13

roles/paperless_ng/tasks/archive_post.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Compress previous version
+  command: tar cf {{ paperless_root_dir }}/archives/{{ paperless_current_version }}.tar.zst --use-compress-program=zstd ./
+  args:
+    chdir: "{{ paperless_root_dir }}/archives/{{ paperless_current_version }}"
+    warn: False
+  environment:
+    ZSTD_CLEVEL: 10
+  tags: ged

roles/paperless_ng/tasks/archive_pre.yml

@@ -0,0 +1,39 @@
+---
+
+- name: Create the archive dir
+  file: path={{ paperless_root_dir }}/archives/{{ paperless_current_version }} state=directory
+  tags: ged
+
+- name: Install postgresql client
+  package:
+    name:
+      - postgresql14
+  tags: ged
+
+- name: Archive previous version
+  synchronize:
+    src: "{{ paperless_root_dir }}/{{ item }}"
+    dest: "{{ paperless_root_dir }}/archives/{{ paperless_current_version }}/"
+    recursive: True
+    delete: True
+    compress: False
+  loop:
+    - venv
+    - app
+  delegate_to: "{{ inventory_hostname }}"
+  tags: ged
+
+- name: Dump the database
+  command: >
+    /usr/pgsql-14/bin/pg_dump
+    --clean
+    --create 
+    --host={{ paperless_db_server | quote }}
+    --port={{ paperless_db_port | quote }}
+    --username=sqladmin {{ paperless_db_name | quote }}
+    --file="{{ paperless_root_dir }}/archives/{{ paperless_current_version }}/{{ paperless_db_name }}.sql"
+  environment:
+    - PGPASSWORD: "{{ pg_admin_pass }}"
+  tags: ged
+
+

roles/paperless_ng/tasks/cleanup.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Remove tmp and obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - "{{ paperless_root_dir }}/archives/{{ paperless_current_version }}"
+    - "{{ paperless_root_dir }}/tmp/paperless-ng-{{ paperless_version }}.tar.xz"
+    - "{{ paperless_root_dir }}/tmp/paperless-ng"
+  tags: ged

roles/paperless_ng/tasks/conf.yml

@@ -0,0 +1,44 @@
+---
+
+- name: Deploy configuration
+  template: src={{ item }}.j2 dest={{ paperless_root_dir }}/app/{{ item }} group={{ paperless_user }} mode=640
+  loop:
+    - paperless.conf
+    - gunicorn.conf.py
+  notify: restart paperless
+  tags: ged
+
+- when: paperless_install_mode != 'none'
+  block:
+    - name: Migrate database
+      django_manage:
+        command: migrate
+        app_path: "{{ paperless_root_dir }}/app/src"
+        virtualenv: "{{ paperless_root_dir }}/venv"
+      notify: restart paperless
+      become_user: "{{ paperless_user }}"
+
+    - name: Collect static files
+      django_manage:
+        command: collectstatic
+        app_path: "{{ paperless_root_dir }}/app/src"
+        virtualenv: "{{ paperless_root_dir }}/venv"
+
+    - name: Set correct permissions
+      file: path={{ paperless_root_dir }}/media recurse=True owner={{ paperless_user }} group={{ paperless_user }}
+
+  tags: ged
+
+- when: paperless_install_mode == 'install'
+  block:
+    - name: Create admin user
+      django_manage:
+        command: createsuperuser --noinput --username admin --email admin@{{ ansible_domain }}
+        app_path: "{{ paperless_root_dir }}/app/src"
+        virtualenv: "{{ paperless_root_dir }}/venv"
+      environment:
+        DJANGO_SUPERUSER_PASSWORD: '{{ paperless_admin_pass }}'
+      failed_when: False
+  become_user: "{{ paperless_user }}"
+  tags: ged
+

roles/paperless_ng/tasks/directories.yml

@@ -0,0 +1,32 @@
+---
+
+- name: Create directories
+  file: path={{ paperless_root_dir }}/{{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }}
+  loop:
+    - dir: /
+      owner: "{{ paperless_user }}"
+      mode: 700
+    - dir: /meta
+      mode: 700
+    - dir: /tmp
+      owner: "{{ paperless_user }}"
+      mode: 700
+    - dir: archives
+      mode: 700
+    - dir: backup
+      mode: 700
+    - dir: venv
+    - dir: app
+    - dir: data
+      owner: "{{ paperless_user }}"
+      mode: 700
+    - dir: media
+      owner: "{{ paperless_user }}"
+      mode: 700
+    - dir: static
+    - dir: consume
+      owner: "{{ paperless_user }}"
+    - dir: log
+      owner: "{{ paperless_user }}"
+      mode: 700
+  tags: ged

roles/paperless_ng/tasks/facts.yml

@@ -0,0 +1,63 @@
+---
+
+- fail: msg="pg_admin_pass must be set"
+  when: pg_admin_pass is not defined
+  tags: ged
+
+- include_vars: "{{ item }}"
+  with_first_found:
+    - vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_distribution }}.yml
+    - vars/{{ ansible_os_family }}.yml
+  tags: ged
+
+- block:
+    - import_tasks: ../includes/webapps_set_install_mode.yml
+      vars:
+        - root_dir: "{{ paperless_root_dir }}"
+        - version: "{{ paperless_version }}"
+    - set_fact: paperless_install_mode={{ (install_mode == 'upgrade' and not paperless_manage_upgrade) | ternary('none',install_mode) }}
+    - set_fact: paperless_current_version={{ current_version | default('') }}
+  tags: ged
+
+# Create a random pass for the DB if needed
+- when: paperless_db_pass is not defined
+  block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ paperless_root_dir }}/meta/ansible_dbpass"
+    - set_fact: paperless_db_pass={{ rand_pass }}
+  tags: ged
+
+# Create a random secret key
+- when: paperless_secret_key is not defined
+  block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ paperless_root_dir }}/meta/ansible_secret_key"
+    - set_fact: paperless_secret_key={{ rand_pass }}
+  tags: ged
+
+# Create a random secret key
+- when: paperless_admin_pass is not defined
+  block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ paperless_root_dir }}/meta/ansible_admin_pass"
+    - set_fact: paperless_admin_pass={{ rand_pass }}
+  tags: ged
+
+# Reset consumption dir to default if it doesn't exist
+# This is useful when the consumption dir is from a network mount point but the mount
+# isn't available yet when initializing paperless
+- name: Check if consumption dir exists
+  stat: path={{ paperless_consume_dir }}
+  register: paperless_consume_dir_stat
+  become_user: "{{ paperless_user }}" # we check if paperless has access, root could be denied when using a FUSE FS for example
+  tags: ged
+
+- name: Reset consumption dir to the default value
+  set_fact: paperless_consume_dir={{ paperless_root_dir }}/consume
+  when: not paperless_consume_dir_stat.stat.exists
+  tags: ged

roles/paperless_ng/tasks/install.yml

@@ -0,0 +1,97 @@
+---
+
+- name: Install packages
+  package: name={{ paperless_packages }}
+  tags: ged
+
+- when: paperless_install_mode != 'none'
+  block:
+    - name: Download paperless
+      get_url:
+        url: "{{ paperless_archive_url }}"
+        dest: "{{ paperless_root_dir }}/tmp"
+        checksum: sha1:{{ paperless_archive_sha1 }}
+
+    - name: Extract archive
+      unarchive:
+        src: "{{ paperless_root_dir }}/tmp/paperless-ng-{{ paperless_version }}.tar.xz"
+        dest: "{{ paperless_root_dir }}/tmp"
+        remote_src: True
+
+    - name: Move paperless app
+      synchronize:
+        src: "{{ paperless_root_dir }}/tmp/paperless-ng/"
+        dest: "{{ paperless_root_dir }}/app/"
+        delete: True
+        compress: False
+      delegate_to: "{{ inventory_hostname }}"
+
+    - name: Fix permissions
+      file: path={{ paperless_root_dir }}/app/ owner=root group=root recurse=True
+
+    - name: Add exec perm on manage.py
+      file: path={{ paperless_root_dir }}/app/src/manage.py mode=755
+
+  tags: ged
+
+- name: Create the virtualenv
+  pip:
+    requirements: "{{ paperless_root_dir }}/app/requirements.txt"
+    state: "{{ (paperless_install_mode == 'upgrade') | ternary('latest', 'present') }}"
+    virtualenv: "{{ paperless_root_dir }}/venv"
+    virtualenv_command: /bin/python3.9 -m venv
+  tags: ged
+
+- block:
+    - name: Create the PostgreSQL role
+      postgresql_user:
+        db: postgres
+        name: "{{ paperless_db_user }}"
+        password: "{{ paperless_db_pass }}"
+        login_host: "{{ paperless_db_server }}"
+        login_user: sqladmin
+        login_password: "{{ pg_admin_pass }}"
+    
+    - name: Create the PostgreSQL database
+      postgresql_db:
+        name: "{{ paperless_db_name }}"
+        encoding: UTF-8
+        template: template0
+        owner: "{{ paperless_db_user }}"
+        login_host: "{{ paperless_db_server }}"
+        login_user: sqladmin
+        login_password: "{{ pg_admin_pass }}"
+  tags: ged
+
+- name: Install a wrapper for manage.py
+  copy:
+    content: |
+      #!/bin/bash
+      cd {{ paperless_root_dir }}/app/src
+      {{ paperless_root_dir }}/venv/bin/python ./manage.py $@
+    dest: /usr/local/bin/paperless_{{ paperless_id }}
+    mode: 0755
+  tags: ged
+
+- name: Install systemd units
+  template: src={{ item }}.service.j2 dest=/etc/systemd/system/{{ item | regex_replace('^paperless','paperless_' ~ paperless_id) }}.service
+  loop:
+    - paperless-webserver
+    - paperless-scheduler
+    - paperless-consumer
+  notify: restart paperless
+  register: paperless_units
+  tags: ged
+
+- name: Reload systemd
+  systemd: daemon_reload=True
+  when: paperless_units.results | selectattr('changed','equalto',True) | list | length > 0
+  tags: ged
+
+- name: Install backup hooks
+  template: src={{ item }}-backup.j2 dest=/etc/backup/{{ item }}.d/paperless_{{ paperless_id }} mode=700
+  loop:
+    - pre
+    - post
+  tags: ged
+

roles/paperless_ng/tasks/iptables.yml

@@ -0,0 +1,14 @@
+---
+
+- name:  Handle paperless port in the firewall
+  iptables_raw:
+    name: paperless_{{ paperless_id }}_port
+    state: "{{ (paperless_src_ip | length > 0) | ternary('present','absent') }}"
+    rules: "-A INPUT -m state --state NEW -p tcp --dport {{ paperless_port }} -s {{ paperless_src_ip | join(',') }} -j ACCEPT"
+  tags: firewall,ged
+
+- name: Remove old (single instance) paperless rule
+  iptables_raw:
+    name: paperless_port
+    state: absent
+  tags: firewall,ged

roles/paperless_ng/tasks/main.yml

@@ -0,0 +1,18 @@
+---
+
+- include: user.yml
+- include: directories.yml
+- include: facts.yml
+- include: archive_pre.yml
+  when: paperless_install_mode == 'upgrade'
+- include: install.yml
+- include: conf.yml
+- include: iptables.yml
+  when: iptables_manage | default(True)
+- include: selinux.yml
+  when: ansible_selinux.status == 'enabled'
+- include: services.yml
+- include: write_version.yml
+- include: archive_post.yml
+  when: paperless_install_mode == 'upgrade'
+- include: cleanup.yml

roles/paperless_ng/tasks/selinux.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Copy SELinux policy
+  copy: src=paperless.te dest=/etc/selinux/targeted/local/
+  register: paperless_selinux_policy
+  tags: ged
+
+- name: Compile and load SELinux policy
+  shell: |
+    cd /etc/selinux/targeted/local/
+    checkmodule -M -m -o paperless.mod paperless.te
+    semodule_package -o paperless.pp -m paperless.mod
+    semodule -i /etc/selinux/targeted/local/paperless.pp
+  when: paperless_selinux_policy.changed
+  tags: ged

roles/paperless_ng/tasks/services.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Start and enable services
+  service: name={{ item }} state=started enabled=True
+  loop:
+    - paperless_{{ paperless_id }}-webserver
+    - paperless_{{ paperless_id }}-scheduler
+    - paperless_{{ paperless_id }}-consumer
+  tags: ged

roles/paperless_ng/tasks/user.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Create system user
+  user:
+    name: "{{ paperless_user }}"
+    shell: /bin/false
+    home: "{{ paperless_root_dir }}"
+    system: True
+  tags: ged

roles/paperless_ng/tasks/write_version.yml

@@ -0,0 +1,5 @@
+---
+
+- name: Write installed version
+  copy: content={{ paperless_version }} dest={{ paperless_root_dir }}/meta/ansible_version
+  tags: ged