Joakim
846ab74f87
- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1) - Add podman network firewall rules to fix container DNS/HTTPS access - Implement systemd timer for reliable Nextcloud background job execution - Add database optimization tasks (indices, bigint conversion, mimetypes) - Configure maintenance window (04:00 UTC) and phone region (NO) - Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies) - Create Nextcloud removal playbook for clean uninstall - Fix nftables interface matching (podman0 vs podman+) Root cause: nftables FORWARD chain blocked container egress traffic Solution: Explicit firewall rules for podman0 bridge interface
73 lines
2.3 KiB
YAML
73 lines
2.3 KiB
YAML
---
|
|
# =================================================================
|
|
# Nextcloud Background Jobs Configuration
|
|
# =================================================================
|
|
# Rick-Infra - Nextcloud Role
|
|
#
|
|
# Configures systemd timer for reliable background job execution
|
|
# instead of Ajax-based cron (which requires user activity)
|
|
|
|
- name: Create nextcloud cron service
|
|
copy:
|
|
content: |
|
|
[Unit]
|
|
Description=Nextcloud Background Jobs (cron.php)
|
|
Documentation=https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html
|
|
After=nextcloud.service
|
|
Requires=nextcloud.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/podman exec --user www-data nextcloud php -f /var/www/html/cron.php
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=nextcloud-cron
|
|
dest: /etc/systemd/system/nextcloud-cron.service
|
|
mode: '0644'
|
|
backup: yes
|
|
notify: reload systemd
|
|
|
|
- name: Create nextcloud cron timer
|
|
copy:
|
|
content: |
|
|
[Unit]
|
|
Description=Nextcloud Background Jobs Timer
|
|
Documentation=https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html
|
|
|
|
[Timer]
|
|
OnBootSec=5min
|
|
OnUnitActiveSec={{ nextcloud_cron_interval }}
|
|
Unit=nextcloud-cron.service
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
dest: /etc/systemd/system/nextcloud-cron.timer
|
|
mode: '0644'
|
|
backup: yes
|
|
notify: reload systemd
|
|
|
|
- name: Enable and start nextcloud cron timer
|
|
systemd:
|
|
name: nextcloud-cron.timer
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: yes
|
|
|
|
- name: Configure Nextcloud to use cron for background jobs
|
|
command: >
|
|
podman exec --user www-data nextcloud
|
|
php occ background:cron
|
|
register: nextcloud_cron_mode
|
|
changed_when: "'background jobs mode changed' in nextcloud_cron_mode.stdout or 'Set mode for background jobs to' in nextcloud_cron_mode.stdout"
|
|
failed_when:
|
|
- nextcloud_cron_mode.rc != 0
|
|
- "'mode for background jobs is currently' not in nextcloud_cron_mode.stdout"
|
|
|
|
- name: Verify cron timer is active
|
|
command: systemctl is-active nextcloud-cron.timer
|
|
register: timer_status
|
|
changed_when: false
|
|
failed_when: timer_status.stdout != "active"
|