diff --git a/group_vars/horde.yml b/group_vars/horde.yml new file mode 100644 index 00000000..11ea1957 --- /dev/null +++ b/group_vars/horde.yml @@ -0,0 +1,20 @@ +glob_horde: + secret: '{{ vault_horde_secret }}' + imap: imap.adm.crans.org + smtp: smtp.crans.org + maildomain: crans.org + db: thot.adm.crans.org + admins: + - "'paulon'" + - "'vulcain'" + - "'graillot'" + - "'bombar'" + - "'pa'" + - "'erdnaxe'" + redirection: https://wiki.crans.org/VieCrans/PagesDeDeconnexion/ERR_CHOOSE_WEBMAIL + src_hostname: horde.crans.org + dest_hostname : webmail.crans.org + admin_src_hostname : horde.adm.crans.org + admin_dest_hostname : webmail.adm.crans.org + zone_ipv4 : 10.231.136.0/24 + zone_ipv6 : 2a0c:700:0:2::/64 diff --git a/host_vars/horde-srv.adm.crans.org.yml b/host_vars/horde-srv.adm.crans.org.yml new file mode 100644 index 00000000..54e2e5fc --- /dev/null +++ b/host_vars/horde-srv.adm.crans.org.yml @@ -0,0 +1,2 @@ +loc_horde: + ipv6: '[2a0c:700:0:2:5474:8dff:fe5d:e2be]' diff --git a/hosts b/hosts index 49bd79fc..e44a481d 100644 --- a/hosts +++ b/hosts @@ -4,6 +4,8 @@ # > We name servers according to location, then type. # > Then we regroup everything in global geographic and type groups. +[horde] +horde-srv.adm.crans.org [dhcp] dhcp.adm.crans.org diff --git a/plays/horde.yml b/plays/horde.yml new file mode 100755 index 00000000..bc775369 --- /dev/null +++ b/plays/horde.yml @@ -0,0 +1,6 @@ +#!/usr/bin/env ansible-playbook +--- +# Moi j'aime le ocaml et lui il installe horde +- hosts: horde + roles: + - horde diff --git a/roles/horde/README.md b/roles/horde/README.md new file mode 100644 index 00000000..874a42e6 --- /dev/null +++ b/roles/horde/README.md @@ -0,0 +1,26 @@ +# Horde +Ce rôle ansible deploie une instance du webmail horde. + +## Variables + - glob_horde. : + - secret : le secret de horde + - imap : le serveur imap + - smtp : le serveur smtp (il doit juste être contactable depuis le serveur + imap) + - maildomain : le nom de domaine depuis qui envoyé les mails + - db : la bdd + - admins : la liste des admins de horde + - redirection : ou rediriger les utilisateurs si il essaie de voir la racine + du site + - src_hostname : on utilise deux hostnames, le premier va rediriger vers le + second. Ici c'est le premier + - dest_hostname : Ici c'est le second + - admin_src_hostname : même chose mais sur le réseau d'administration. Ici + c'est le premier + - admin_dest_hostname : Ici c'est le second + - zone_ipv4 : la zone ipv4 du réseaux sur lequel le proxy discute avec le + serveur + - zone ipv6 : la zone ipv6 du réseaux sur lequel le proxy discute avec le + serveur + - loc_horde : + - ipv6 : l'ipv6 du serveur diff --git a/roles/horde/handlers/main.yml b/roles/horde/handlers/main.yml new file mode 100644 index 00000000..721ac462 --- /dev/null +++ b/roles/horde/handlers/main.yml @@ -0,0 +1,6 @@ +--- + +- name: Restart nginx + service: + name: nginx.service + state: restarted diff --git a/roles/horde/tasks/main.yml b/roles/horde/tasks/main.yml new file mode 100644 index 00000000..55ab2891 --- /dev/null +++ b/roles/horde/tasks/main.yml @@ -0,0 +1,45 @@ +--- +# Setup dependencies +- name: Install horde APT dependencies + apt: + update_cache: true + name: + - nginx + - php-horde-webmail + register: apt_result + retries: 3 + until: apt_result is succeeded + +- name: Configure horde + template: + src: '{{ item }}.j2' + dest: '/etc/{{ item }}' + owner: www-data + group: www-data + mode: 0640 + loop: + - horde/horde/conf.php + - horde/imp/backends.php + +- name: Configure nginx site + template: + src: '{{ item }}.j2' + dest: '/etc/{{ item }}' + owner: root + group: root + mode: 0644 + loop: + - nginx/sites-available/webmail + - nginx/sites-available/horde + - nginx/snippets/php.conf + notify: Restart nginx + +- name: Enable nginx site + file: + src: '/etc/nginx/sites-available/{{ item }}' + dest: '/etc/nginx/sites-enabled/{{ item }}' + state: link + loop: + - webmail + - horde + notify: Restart nginx diff --git a/roles/horde/templates/horde/horde/conf.php.j2 b/roles/horde/templates/horde/horde/conf.php.j2 new file mode 100644 index 00000000..6da1cbab --- /dev/null +++ b/roles/horde/templates/horde/horde/conf.php.j2 @@ -0,0 +1,127 @@ +{{ ansible_header | comment(decoration='// ') }} + false, + 'name' => 'IMAP Cr@ns', + 'hostspec' => '{{ glob_horde.imap }}', + 'hordeauth' => true, + 'protocol' => 'imap', + 'port' => 143, + 'secure' => 'tls', + 'maildomain' => '{{ glob_horde.maildomain }}', + 'smtp' => array( + 'host' => '{{ glob_horde.smtp }}', + 'port' => 25, + ), + 'cache' => false, +); +?> diff --git a/roles/horde/templates/nginx/sites-available/horde.j2 b/roles/horde/templates/nginx/sites-available/horde.j2 new file mode 100644 index 00000000..cbf84402 --- /dev/null +++ b/roles/horde/templates/nginx/sites-available/horde.j2 @@ -0,0 +1,17 @@ +{{ ansible_header | comment }} +server { + listen {{ glob_horde.admin_src_hostname }}:80; + listen {{ loc_horde.ipv6 }}:80 ipv6only=on; + server_name {{ glob_horde.admin_src_hostname }} {{ glob_horde.src_hostname }}; + + root /usr/share/; + location / { + return 302 https://{{ glob_horde.dest_hostname }}/horde; + } + include "snippets/php.conf"; + + set_real_ip_from {{ glob_horde.zone_ipv4 }}; + set_real_ip_from {{ glob_horde.zone_ipv6 }}; + real_ip_header P-Real-Ip; +} + diff --git a/roles/horde/templates/nginx/sites-available/webmail.j2 b/roles/horde/templates/nginx/sites-available/webmail.j2 new file mode 100644 index 00000000..71270f89 --- /dev/null +++ b/roles/horde/templates/nginx/sites-available/webmail.j2 @@ -0,0 +1,21 @@ +{{ ansible_header | comment }} +server { + listen {{ glob_horde.admin_dest_hostname }}:80; + listen {{ loc_horde.ipv6 }}:80; + server_name {{ glob_horde.dest_hostname }} {{ glob_horde.admin_dest_hostname }}; + + root /usr/share/; + location / { + return 302 {{ glob_horde.redirection }}; + } + location /horde { + try_files $uri $uri/ /horde/rampage.php?$args; + index index.php index.htm index.html; + } + include "snippets/php.conf"; + + set_real_ip_from {{ glob_horde.zone_ipv4 }}; + set_real_ip_from {{ glob_horde.zone_ipv6 }}; + real_ip_header P-Real-Ip; +} + diff --git a/roles/horde/templates/nginx/snippets/php.conf.j2 b/roles/horde/templates/nginx/snippets/php.conf.j2 new file mode 100644 index 00000000..144ec410 --- /dev/null +++ b/roles/horde/templates/nginx/snippets/php.conf.j2 @@ -0,0 +1,26 @@ +{{ ansible_header | comment }} + +location ~ .+\.php { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + if (!-e $document_root$fastcgi_script_name) { + return 404; + } + fastcgi_buffer_size 128k; + fastcgi_buffers 4 256k; + fastcgi_busy_buffers_size 256k; + fastcgi_pass unix:/var/run/php/php7.3-fpm.sock; + fastcgi_index index.php; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include fastcgi_params; +} + +location ~ ^/php_(ping|status)$ { + access_log off; + allow 127.0.0.1; + deny all; + root /usr/share/nginx/html; + fastcgi_pass unix:/var/run/php/php7.3-fpm.sock; + include fastcgi_params; +}