Update to 2022-02-15 16:00

roles/kimai/templates/env.j2

@@ -0,0 +1,10 @@
+# for MySQL "serverVersion=5.7" and for MariaDB "serverVersion=mariadb-10.5.8"
+DATABASE_URL=mysql://{{ kimai_db_user }}:{{ kimai_db_pass | urlencode | regex_replace('/','%2F') }}@{{ kimai_db_server }}:{{ kimai_db_port }}/{{ kimai_db_name }}?charset=utf8&serverVersion=mariadb-10.5.8
+MAILER_FROM=kimai-no-replay@{{ ansible_domain }}
+MAILER_URL=smtp://localhost:25?encryption=&auth_mode=
+APP_ENV=prod
+APP_SECRET={{ kimai_secret_key }}
+CORS_ALLOW_ORIGIN=^https?://localhost(:[0-9]+)?$
+{% if kimai_src_ip is defined and kimai_src_ip | length > 0 %}
+TRUSTED_PROXIES={{ kimai_src_ip | join(',') }}
+{% endif %}

roles/kimai/templates/httpd.conf.j2

@@ -0,0 +1,31 @@
+{% if kimai_web_alias is defined and kimai_web_alias != False %}
+Alias /{{ kimai_web_alias | regex_replace('^/','') }} {{ kimai_root_dir }}/app/public
+{% else %}
+# No alias defined, create a vhost to access it
+{% endif %}
+
+<Directory {{ kimai_root_dir }}/app/public>
+  AllowOverride All
+  Options FollowSymLinks
+{% if kimai_src_ip is defined and kimai_src_ip | length > 0 %}
+  Require ip {{ kimai_src_ip | join(' ') }}
+{% else %}
+  Require all granted
+{% endif %}
+  <FilesMatch \.php$>
+    SetHandler "proxy:unix:/run/php-fpm/{{ kimai_php_fpm_pool | default('kimai_' + kimai_id | string) }}.sock|fcgi://localhost"
+  </FilesMatch>
+
+  RewriteEngine On
+
+  FallbackResource /index.php
+
+  <FilesMatch "(\.git.*)">
+    Require all denied
+  </FilesMatch>
+
+</Directory>
+
+<Directory {{ kimai_root_dir }}/public/bundles>
+  FallbackResource disabled
+</Directory>

roles/kimai/templates/local.yaml.j2

@@ -0,0 +1 @@
+{{ kimai_settings | to_nice_yaml(indent=4) }}    

roles/kimai/templates/logrotate.conf.j2

@@ -0,0 +1,7 @@
+{{ kimai_root_dir }}/data/log/*.log {
+  daily
+  rotate 90
+  compress
+  missingok
+  su {{ kimai_php_user }} {{ kimai_php_user }}
+}

roles/kimai/templates/perms.sh.j2

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -eo pipefail
+
+restorecon -R {{ kimai_root_dir }}
+chown root:root {{ kimai_root_dir }}
+chown -R root:root {{ kimai_root_dir }}/app/
+chmod 755 {{ kimai_root_dir }}
+setfacl -R -k -b {{ kimai_root_dir }}
+setfacl -m u:{{ kimai_php_user | default('apache') }}:rx,u:{{ httpd_user | default('apache') }}:x {{ kimai_root_dir }}
+find {{ kimai_root_dir }}/app -type f -exec chmod 644 "{}" \; -type d -exec chmod 755 "{}" \;
+chown root:{{ kimai_php_user }} {{ kimai_root_dir }}/app/.env {{ kimai_root_dir }}/app/config/packages/local.yaml
+chmod 640 {{ kimai_root_dir }}/app/.env {{ kimai_root_dir }}/app/config/packages/local.yaml
+chown -R {{ kimai_php_user }} {{ kimai_root_dir }}/data
+chmod 700 {{ kimai_root_dir }}/data
+setfacl -R -m u:{{ httpd_user | default('apache') }}:rX {{ kimai_root_dir }}/app/public
+find {{ kimai_root_dir }} -name .htaccess -exec chmod 644 "{}" \;
+

roles/kimai/templates/php.conf.j2

@@ -0,0 +1,35 @@
+[kimai_{{ kimai_id }}]
+
+listen.owner = root
+listen.group = apache
+listen.mode = 0660
+listen = /run/php-fpm/kimai_{{ kimai_id }}.sock
+user = {{ kimai_php_user }}
+group = {{ kimai_php_user }}
+catch_workers_output = yes
+
+pm = dynamic
+pm.max_children = 15
+pm.start_servers = 3
+pm.min_spare_servers = 3
+pm.max_spare_servers = 6
+pm.max_requests = 5000
+request_terminate_timeout = 5m
+
+php_flag[display_errors] = off
+php_admin_flag[log_errors] = on
+php_admin_value[error_log] = syslog
+php_admin_value[memory_limit] = 256M
+php_admin_value[session.save_path] = {{ kimai_root_dir }}/sessions
+php_admin_value[upload_tmp_dir] = {{ kimai_root_dir }}/tmp
+php_admin_value[sys_temp_dir] = {{ kimai_root_dir }}/tmp
+php_admin_value[post_max_size] = 100M
+php_admin_value[upload_max_filesize] = 100M
+php_admin_value[disable_functions] = system, show_source, symlink, exec, dl, shell_exec, passthru, escapeshellarg, escapeshellcmd
+php_admin_value[open_basedir] = {{ kimai_root_dir }}:/usr/share/pear/:/usr/share/php/
+php_admin_value[max_execution_time] = 60
+php_admin_value[max_input_time] = 60
+php_admin_flag[allow_url_include] = off
+php_admin_flag[allow_url_fopen] = off
+php_admin_flag[file_uploads] = on
+php_admin_flag[session.cookie_httponly] = on

roles/kimai/templates/post-backup.j2

@@ -0,0 +1,4 @@
+#!/bin/bash -e
+
+rm -f {{ kimai_root_dir }}/backup/*.sql.zst
+

roles/kimai/templates/pre-backup.j2

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eo pipefail
+
+/usr/bin/mysqldump \
+{% if kimai_db_server not in ['localhost','127.0.0.1'] %}
+  --user={{ kimai_db_user | quote }} \
+  --password={{ kimai_db_pass | quote }} \
+  --host={{ kimai_db_server | quote }} \
+  --port={{ kimai_db_port | quote }} \
+{% endif %}
+  --quick --single-transaction \
+  --add-drop-table {{ kimai_db_name | quote }} | zstd -c > {{ kimai_root_dir }}/backup/{{ kimai_db_name }}.sql.zst
+