Update to 2021-12-01 19:13

roles/unmaintained/ttrss/templates/config.php.j2

@@ -0,0 +1,43 @@
+<?php
+
+define('DB_TYPE', "mysql");
+define('DB_HOST', "{{ ttrss_mysql_server }}");
+define('DB_USER', "{{ ttrss_mysql_user }}");
+define('DB_NAME', "{{ ttrss_mysql_db }}");
+define('DB_PASS', "{{ ttrss_mysql_pass }}");
+define('DB_PORT', "{{ ttrss_mysql_port | default('') }}");
+define('MYSQL_CHARSET', 'UTF8');
+define('SELF_URL_PATH', '{{ ttrss_public_url }}');
+define('FEED_CRYPT_KEY', '');
+define('SINGLE_USER_MODE', false);
+define('SIMPLE_UPDATE_MODE', false);
+define('PHP_EXECUTABLE', '{{ ttrss_php_bin }}');
+define('LOCK_DIRECTORY', '{{ ttrss_root_dir }}/tmp/');
+define('CACHE_DIR', '{{ ttrss_root_dir }}/cache');
+define('ICONS_DIR', "{{ ttrss_root_dir }}/data/icons");
+define('ICONS_URL', "feed-icons");
+define('AUTH_AUTO_CREATE', true);
+define('AUTH_AUTO_LOGIN', true);
+define('FORCE_ARTICLE_PURGE', 0);
+define('ENABLE_REGISTRATION', false);
+define('SESSION_COOKIE_LIFETIME', 0);
+define('SMTP_FROM_NAME', 'Tiny Tiny RSS');
+define('SMTP_FROM_ADDRESS', 'noreply@{{ ansible_domain }}');
+define('DIGEST_SUBJECT', '[tt-rss] New headlines for last 24 hours');
+define('SMTP_SERVER', 'localhost:25');
+define('PLUGINS', 'auth_remote, auth_internal, note');
+define('LOG_DESTINATION', 'syslog');
+
+define('SPHINX_SERVER', 'localhost:9312');
+define('SPHINX_INDEX', 'ttrss, delta');
+define('REG_NOTIFY_ADDRESS', 'user@your.domain.dom');
+define('REG_MAX_USERS', 1);
+define('SMTP_LOGIN', '');
+define('SMTP_PASSWORD', '');
+define('SMTP_SECURE', '');
+define('CHECK_FOR_UPDATES', false);
+define('ENABLE_GZIP_OUTPUT', false);
+
+define('CONFIG_VERSION', 26);
+
+?>

roles/unmaintained/ttrss/templates/dump_db.j2

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+/usr/bin/mysqldump --user={{ ttrss_mysql_user }} \
+                   --password={{ ttrss_mysql_pass }} \
+                   --host={{ ttrss_mysql_server }} \
+                   --quick --single-transaction \
+                   --add-drop-table {{ ttrss_mysql_db }} | lz4 -c > {{ ttrss_root_dir }}/db_dumps/{{ ttrss_mysql_db }}.sql.lz4

roles/unmaintained/ttrss/templates/httpd.conf.j2

@@ -0,0 +1,45 @@
+{% if ttrss_alias is defined %}
+Alias /{{ ttrss_alias }}/feed-icons {{ ttrss_root_dir }}/data/icons
+Alias /{{ ttrss_alias }} {{ ttrss_root_dir }}/web
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ ttrss_root_dir }}/web>
+  AllowOverride All
+  Options FollowSymLinks
+{% if ttrss_src_ip is defined %}
+  Require ip {{ ttrss_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ ttrss_php_fpm_pool | default('ttrss_' + ttrss_id) }}.sock|fcgi://localhost"
+  </FilesMatch>
+
+{% if httpd_src_ip is defined and httpd_src_ip | length > 0 and '0.0.0.0/0' not in httpd_src_ip %}
+  RewriteEngine On
+  RewriteCond %{HTTP:Auth-User} ^(\w+)$
+  RewriteRule .* - [E=REMOTE_USER:%1]
+{% endif %}
+
+  <FilesMatch "(\.ansible_version|\.git.*|config\.php)">
+    Require all denied
+  </FilesMatch>
+</Directory>
+<Directory {{ ttrss_root_dir }}/data/icons>
+  AllowOverride None
+  Options None
+  Require all granted
+</Directory>
+
+<Directory {{ ttrss_root_dir }}/web/.git>
+    Require all denied
+</Directory>
+<Directory {{ ttrss_root_dir }}/web/schema>
+    Require all denied
+</Directory>
+<Directory {{ ttrss_root_dir }}/web/cache>
+    Require all denied
+</Directory>
+

roles/unmaintained/ttrss/templates/perms.sh.j2

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+restorecon -R {{ ttrss_root_dir }}
+chown -R root:root {{ ttrss_root_dir }}/meta
+chmod 700 {{ ttrss_root_dir }}/meta
+chown -R {{ ttrss_php_user }}:apache {{ ttrss_root_dir }}/{cache,data}
+chmod 750 {{ ttrss_root_dir }}/{cache,data}
+chmod 700 {{ ttrss_root_dir }}
+chown -R {{ ttrss_php_user }} {{ ttrss_root_dir }}/{sessions,tmp}
+chmod 700 {{ ttrss_root_dir }}/{sessions,tmp}
+setfacl -k -b {{ ttrss_root_dir }}
+setfacl -m u:{{ ttrss_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:rx {{ ttrss_root_dir }}
+restorecon -R {{ ttrss_root_dir }}

roles/unmaintained/ttrss/templates/php.conf.j2

@@ -0,0 +1,35 @@
+[ttrss_{{ ttrss_id }}]
+
+listen.owner = root
+listen.group = apache
+listen.mode = 0660
+listen = /run/php-fpm/ttrss_{{ ttrss_id }}.sock
+user = {{ ttrss_php_user }}
+group = {{ ttrss_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 5m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 128M
+php_admin_value[session.save_path] = {{ ttrss_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ ttrss_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ ttrss_root_dir }}/tmp
+php_admin_value[post_max_size] = 5M
+php_admin_value[upload_max_filesize] = 5M
+php_admin_value[disable_functions] = system, show_source, symlink, dl, shell_exec, passthru, phpinfo, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ ttrss_root_dir }}
+php_admin_value[max_execution_time] = 60
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = on
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on

roles/unmaintained/ttrss/templates/rm_dump.j2

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+rm -f {{ ttrss_root_dir }}/db_dump/*

roles/unmaintained/ttrss/templates/ttrss-updater.service.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=Update Tiny Tiny RSS feeds
+After=network.target mysql.service
+
+[Service]
+User={{ ttrss_php_user }}
+ExecStart={{ ttrss_php_bin }} {{ ttrss_root_dir }}/web/update_daemon2.php
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
+MemoryLimit=256M
+SyslogIdentifier=ttrss_{{ ttrss_id }}
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+