Merge branch 'horde2' into 'master'

Horde

See merge request nounous/ansible!23

group_vars/horde.yml

@@ -0,0 +1,20 @@
+glob_horde:
+  secret: '{{ vault_horde_secret }}'
+  imap: imap.adm.crans.org
+  smtp: smtp.crans.org
+  maildomain: crans.org
+  db: thot.adm.crans.org
+  admins:
+    - "'paulon'"
+    - "'vulcain'"
+    - "'graillot'"
+    - "'bombar'"
+    - "'pa'"
+    - "'erdnaxe'"
+  redirection: https://wiki.crans.org/VieCrans/PagesDeDeconnexion/ERR_CHOOSE_WEBMAIL
+  src_hostname: horde.crans.org
+  dest_hostname : webmail.crans.org
+  admin_src_hostname : horde.adm.crans.org
+  admin_dest_hostname : webmail.adm.crans.org
+  zone_ipv4 : 10.231.136.0/24
+  zone_ipv6 : 2a0c:700:0:2::/64

host_vars/horde-srv.adm.crans.org.yml

@@ -0,0 +1,2 @@
+loc_horde:
+  ipv6: '[2a0c:700:0:2:5474:8dff:fe5d:e2be]'

hosts

@@ -4,6 +4,8 @@
 # > We name servers according to location, then type.
 # > Then we regroup everything in global geographic and type groups.
 
+[horde]
+horde-srv.adm.crans.org
 
 [dhcp]
 dhcp.adm.crans.org

plays/horde.yml

@@ -0,0 +1,6 @@
+#!/usr/bin/env ansible-playbook
+---
+# Moi j'aime le ocaml et lui il installe horde
+- hosts: horde
+  roles:
+    - horde

roles/horde/README.md

@@ -0,0 +1,26 @@
+# Horde
+Ce rôle ansible deploie une instance du webmail horde.
+
+## Variables
+  - glob_horde. :
+    - secret : le secret de horde
+    - imap : le serveur imap
+    - smtp : le serveur smtp (il doit juste être contactable depuis le serveur
+      imap)
+    - maildomain : le nom de domaine depuis qui envoyé les mails
+    - db : la bdd
+    - admins : la liste des admins de horde
+    - redirection : ou rediriger les utilisateurs si il essaie de voir la racine
+      du site
+    - src_hostname : on utilise deux hostnames, le premier va rediriger vers le
+      second. Ici c'est le premier
+    - dest_hostname : Ici c'est le second
+    - admin_src_hostname : même chose mais sur le réseau d'administration. Ici
+      c'est le premier
+    - admin_dest_hostname : Ici c'est le second
+    - zone_ipv4 : la zone ipv4 du réseaux sur lequel le proxy discute avec le
+      serveur
+    - zone ipv6 : la zone ipv6 du réseaux sur lequel le proxy discute avec le
+      serveur
+  - loc_horde :
+    - ipv6 : l'ipv6 du serveur

roles/horde/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Restart nginx
+  service:
+    name: nginx.service
+    state: restarted

roles/horde/tasks/main.yml

@@ -0,0 +1,45 @@
+---
+# Setup dependencies
+- name: Install horde APT dependencies
+  apt:
+    update_cache: true
+    name:
+      - nginx
+      - php-horde-webmail
+  register: apt_result
+  retries: 3
+  until: apt_result is succeeded
+
+- name: Configure horde
+  template:
+    src: '{{ item }}.j2'
+    dest: '/etc/{{ item }}'
+    owner: www-data
+    group: www-data
+    mode: 0640
+  loop:
+    - horde/horde/conf.php
+    - horde/imp/backends.php
+
+- name: Configure nginx site
+  template:
+    src: '{{ item }}.j2'
+    dest: '/etc/{{ item }}'
+    owner: root
+    group: root
+    mode: 0644
+  loop:
+    - nginx/sites-available/webmail
+    - nginx/sites-available/horde
+    - nginx/snippets/php.conf
+  notify: Restart nginx
+
+- name: Enable nginx site
+  file:
+    src: '/etc/nginx/sites-available/{{ item }}'
+    dest: '/etc/nginx/sites-enabled/{{ item }}'
+    state: link
+  loop:
+    - webmail
+    - horde
+  notify: Restart nginx

roles/horde/templates/horde/horde/conf.php.j2

@@ -0,0 +1,127 @@
+{{ ansible_header | comment(decoration='// ') }} 
+<?php
+/* CONFIG START. DO NOT CHANGE ANYTHING IN OR AFTER THIS LINE. */
+// $Id: 08fc885cd91fbae2d752e274b554c5f1645129c8 $
+$conf['vhosts'] = false;
+$conf['debug_level'] = E_ALL & ~E_NOTICE;
+$conf['max_exec_time'] = 0;
+$conf['compress_pages'] = true;
+$conf['secret_key'] = '{{ glob_horde.secret }}';
+$conf['umask'] = 077;
+$conf['testdisable'] = true;
+$conf['use_ssl'] = 1;
+$conf['server']['name'] = $_SERVER['SERVER_NAME'];
+$conf['urls']['token_lifetime'] = 30;
+$conf['urls']['hmac_lifetime'] = 30;
+$conf['urls']['pretty'] = false;
+$conf['safe_ips'] = array();
+$conf['session']['name'] = 'Horde';
+$conf['session']['use_only_cookies'] = true;
+$conf['session']['timeout'] = 0;
+$conf['session']['cache_limiter'] = 'nocache';
+$conf['session']['max_time'] = 72000;
+$conf['cookie']['domain'] = $_SERVER['SERVER_NAME'];
+$conf['cookie']['path'] = '/';
+$conf['sql']['username'] = 'www-data';
+$conf['sql']['hostspec'] = '{{ glob_horde.db }}';
+$conf['sql']['protocol'] = 'tcp';
+$conf['sql']['database'] = 'horde5';
+$conf['sql']['charset'] = 'utf-8';
+$conf['sql']['splitread'] = false;
+$conf['sql']['logqueries'] = false;
+$conf['sql']['phptype'] = 'pgsql';
+$conf['nosql']['phptype'] = false;
+$conf['ldap']['useldap'] = false;
+$conf['auth']['admins'] = array({{ glob_horde.admins | join(', ')}});
+$conf['auth']['checkip'] = false;
+$conf['auth']['checkbrowser'] = true;
+$conf['auth']['resetpassword'] = false;
+$conf['auth']['alternate_login'] = false;
+$conf['auth']['redirect_on_logout'] = false;
+$conf['auth']['list_users'] = 'list';
+$conf['auth']['params']['hostspec'] = '{{ glob_horde.imap }}';
+$conf['auth']['params']['port'] = 143;
+$conf['auth']['params']['secure'] = 'tls';
+$conf['auth']['driver'] = 'imap';
+$conf['auth']['params']['count_bad_logins'] = false;
+$conf['auth']['params']['login_block'] = false;
+$conf['auth']['params']['login_block_count'] = 5;
+$conf['auth']['params']['login_block_time'] = 5;
+$conf['signup']['allow'] = false;
+$conf['log']['priority'] = 'INFO';
+$conf['log']['ident'] = 'HORDE';
+$conf['log']['name'] = LOG_USER;
+$conf['log']['type'] = 'syslog';
+$conf['log']['enabled'] = true;
+$conf['log_accesskeys'] = false;
+$conf['prefs']['maxsize'] = 65535;
+$conf['prefs']['params']['driverconfig'] = 'horde';
+$conf['prefs']['driver'] = 'Sql';
+$conf['alarms']['params']['driverconfig'] = 'horde';
+$conf['alarms']['params']['ttl'] = 300;
+$conf['alarms']['driver'] = 'Sql';
+$conf['group']['params']['driverconfig'] = 'horde';
+$conf['group']['driver'] = 'Sql';
+$conf['perms']['driverconfig'] = 'horde';
+$conf['perms']['driver'] = 'Sql';
+$conf['share']['no_sharing'] = false;
+$conf['share']['auto_create'] = true;
+$conf['share']['world'] = true;
+$conf['share']['any_group'] = false;
+$conf['share']['hidden'] = false;
+$conf['share']['cache'] = false;
+$conf['share']['driver'] = 'Sqlng';
+$conf['cache']['default_lifetime'] = 86400;
+$conf['cache']['params']['sub'] = 0;
+$conf['cache']['driver'] = 'File';
+$conf['cache']['use_memorycache'] = '';
+$conf['cachecssparams']['url_version_param'] = true;
+$conf['cachecss'] = false;
+$conf['cachejsparams']['url_version_param'] = true;
+$conf['cachejs'] = false;
+$conf['cachethemes'] = false;
+$conf['lock']['params']['driverconfig'] = 'horde';
+$conf['lock']['driver'] = 'Sql';
+$conf['token']['params']['driverconfig'] = 'horde';
+$conf['token']['driver'] = 'Sql';
+$conf['history']['params']['driverconfig'] = 'horde';
+$conf['history']['driver'] = 'Sql';
+$conf['davstorage']['params']['driverconfig'] = 'horde';
+$conf['davstorage']['driver'] = 'Sql';
+$conf['mailer']['params']['sendmail_path'] = '/usr/lib/sendmail';
+$conf['mailer']['params']['sendmail_args'] = '-oi';
+$conf['mailer']['type'] = 'sendmail';
+$conf['vfs']['params']['driverconfig'] = 'horde';
+$conf['vfs']['type'] = 'Sql';
+$conf['sessionhandler']['type'] = 'Builtin';
+$conf['sessionhandler']['hashtable'] = false;
+$conf['spell']['driver'] = '';
+$conf['gnupg']['keyserver'] = array('pool.sks-keyservers.net');
+$conf['gnupg']['timeout'] = 10;
+$conf['nobase64_img'] = false;
+$conf['image']['driver'] = false;
+$conf['exif']['driver'] = 'Bundled';
+$conf['timezone']['location'] = 'ftp://ftp.iana.org/tz/tzdata-latest.tar.gz';
+$conf['problems']['email'] = 'webmaster@example.com';
+$conf['problems']['maildomain'] = 'example.com';
+$conf['problems']['tickets'] = false;
+$conf['problems']['attachments'] = true;
+$conf['menu']['links']['help'] = 'all';
+$conf['menu']['links']['prefs'] = 'authenticated';
+$conf['menu']['links']['problem'] = 'all';
+$conf['menu']['links']['login'] = 'all';
+$conf['menu']['links']['logout'] = 'authenticated';
+$conf['portal']['fixed_blocks'] = array();
+$conf['accounts']['driver'] = 'null';
+$conf['user']['verify_from_addr'] = false;
+$conf['user']['select_view'] = true;
+$conf['facebook']['enabled'] = false;
+$conf['twitter']['enabled'] = false;
+$conf['urlshortener'] = false;
+$conf['weather']['provider'] = false;
+$conf['imap']['enabled'] = false;
+$conf['imsp']['enabled'] = false;
+$conf['kolab']['enabled'] = false;
+$conf['hashtable']['driver'] = 'none';
+$conf['activesync']['enabled'] = false;
+/* CONFIG END. DO NOT CHANGE ANYTHING IN OR BEFORE THIS LINE. */

roles/horde/templates/horde/imp/backends.php.j2

@@ -0,0 +1,19 @@
+{{ ansible_header | comment(decoration='// ') }}
+<?php
+$servers['imp'] = array(
+    // Disabled by default
+    'disabled' => false,
+    'name' => 'IMAP Cr@ns',
+    'hostspec' => '{{ glob_horde.imap }}',
+    'hordeauth' => true,
+    'protocol' => 'imap',
+    'port' => 143,
+    'secure' => 'tls',
+    'maildomain' => '{{ glob_horde.maildomain }}',
+    'smtp' => array(
+        'host' => '{{ glob_horde.smtp }}',
+        'port' => 25,
+    ),
+    'cache' => false,
+);
+?>

roles/horde/templates/nginx/sites-available/horde.j2

@@ -0,0 +1,17 @@
+{{ ansible_header | comment }}
+server {
+        listen {{ glob_horde.admin_src_hostname }}:80;
+        listen {{ loc_horde.ipv6 }}:80 ipv6only=on;
+        server_name {{ glob_horde.admin_src_hostname }} {{ glob_horde.src_hostname }};
+
+        root /usr/share/;
+        location / {
+            return 302 https://{{ glob_horde.dest_hostname }}/horde;
+        }
+        include "snippets/php.conf";
+
+        set_real_ip_from {{ glob_horde.zone_ipv4 }};
+        set_real_ip_from {{ glob_horde.zone_ipv6 }};
+        real_ip_header P-Real-Ip;
+}
+

roles/horde/templates/nginx/sites-available/webmail.j2

@@ -0,0 +1,21 @@
+{{ ansible_header | comment }}
+server {
+        listen {{ glob_horde.admin_dest_hostname }}:80;
+        listen {{ loc_horde.ipv6 }}:80;
+        server_name {{ glob_horde.dest_hostname }} {{ glob_horde.admin_dest_hostname }};
+
+        root /usr/share/;
+        location / {
+            return 302 {{ glob_horde.redirection }};
+        }
+        location /horde {
+                try_files $uri $uri/ /horde/rampage.php?$args;
+                index index.php index.htm index.html;
+        }
+        include "snippets/php.conf";
+
+        set_real_ip_from {{ glob_horde.zone_ipv4 }};
+        set_real_ip_from {{ glob_horde.zone_ipv6 }};
+        real_ip_header P-Real-Ip;
+}
+

roles/horde/templates/nginx/snippets/php.conf.j2

@@ -0,0 +1,26 @@
+{{ ansible_header | comment }}
+
+location ~ .+\.php {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        if (!-e $document_root$fastcgi_script_name) {
+                return 404;
+        }
+        fastcgi_buffer_size   128k;
+        fastcgi_buffers   4 256k;
+        fastcgi_busy_buffers_size   256k;
+        fastcgi_pass   unix:/var/run/php/php7.3-fpm.sock;
+        fastcgi_index  index.php;
+        fastcgi_param  PATH_INFO          $fastcgi_path_info;
+        fastcgi_param  PATH_TRANSLATED    $document_root$fastcgi_path_info;
+        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+}
+
+location ~ ^/php_(ping|status)$ {
+        access_log     off;
+        allow          127.0.0.1;
+        deny           all;
+        root           /usr/share/nginx/html;
+        fastcgi_pass   unix:/var/run/php/php7.3-fpm.sock;
+        include        fastcgi_params;
+}