Joakim
4f8da38ca6
## New Features - **Nextcloud Role**: Complete cloud storage deployment using Podman Quadlet - FPM variant with Caddy reverse proxy and FastCGI - PostgreSQL database via Unix socket - Valkey/Redis for app-level caching and file locking - Automatic HTTPS with Let's Encrypt via Caddy - Dual-root pattern: Caddy serves static assets, FPM handles PHP - **Split Caching Strategy**: Redis caching WITHOUT Redis sessions - Custom redis.config.php template for app-level caching only - File-based PHP sessions for stability (avoids session lock issues) - Prevents cascading failures from session lock contention - Documented in role README with detailed rationale ## Infrastructure Updates - **Socket Permissions**: Update PostgreSQL and Valkey to mode 777 - Required for containers that switch users (root → www-data) - Nextcloud container loses supplementary groups on user switch - Security maintained via password authentication (scram-sha-256, requirepass) - Documented socket permission architecture in docs/ - **PostgreSQL**: Export client group GID as fact for dependent roles - **Valkey**: Export client group GID as fact, update socket fix service ## Documentation - New: docs/socket-permissions-architecture.md - Explains 777 vs 770 socket permission trade-offs - Documents why group-based access doesn't work for user-switching containers - Provides TCP alternative for stricter security requirements - Updated: All role READMEs with socket permission notes - New: Nextcloud README with comprehensive deployment, troubleshooting, and Redis architecture documentation ## Configuration - host_vars: Add Nextcloud vault variables and configuration - site.yml: Include Nextcloud role in main playbook ## Technical Details **Why disable Redis sessions?** The official Nextcloud container enables Redis session handling via REDIS_HOST env var, which causes severe performance issues: 1. Session lock contention under high concurrency (browser parallel asset requests) 2. Infinite lock retries (default lock_retries=-1) blocking FPM workers 3. Timeout orphaning: reverse proxy kills connection, worker keeps lock 4. Worker pool exhaustion: all 5 default workers blocked on same session lock 5. Cascading failure: new requests queue, more timeouts, more orphaned locks Solution: Use file-based sessions (reliable, fast for single-server) while keeping Redis for distributed cache and transactional file locking via custom config file. This provides optimal performance without the complexity of Redis session debugging. Tested: Fresh deployment on arch-vps (69.62.119.31) Domain: https://cloud.jnss.me/
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
---
|
|
# Nextcloud User Management - Service-Specific User Setup
|
|
|
|
- name: Check if nextcloud group exists
|
|
getent:
|
|
database: group
|
|
key: "{{ nextcloud_group }}"
|
|
register: nextcloud_group_check
|
|
failed_when: false
|
|
|
|
- name: Create nextcloud group if not exists
|
|
group:
|
|
name: "{{ nextcloud_group }}"
|
|
system: true
|
|
when: nextcloud_group_check.ansible_facts.getent_group is not defined
|
|
|
|
- name: Check if nextcloud user exists
|
|
getent:
|
|
database: passwd
|
|
key: "{{ nextcloud_user }}"
|
|
register: nextcloud_user_check
|
|
failed_when: false
|
|
|
|
- name: Create or update nextcloud user
|
|
user:
|
|
name: "{{ nextcloud_user }}"
|
|
group: "{{ nextcloud_group }}"
|
|
groups: "{{ [postgresql_client_group, valkey_client_group] }}"
|
|
system: true
|
|
shell: /usr/bin/nologin
|
|
home: "{{ nextcloud_home }}"
|
|
create_home: true
|
|
comment: "Nextcloud cloud storage service"
|
|
append: true
|
|
|
|
- name: Create nextcloud home directory
|
|
file:
|
|
path: "{{ nextcloud_home }}"
|
|
state: directory
|
|
owner: "{{ nextcloud_user }}"
|
|
group: "{{ nextcloud_group }}"
|
|
mode: '0755'
|
|
|
|
- name: Get nextcloud user UID and GID for container configuration
|
|
shell: |
|
|
echo "uid=$(id -u {{ nextcloud_user }})"
|
|
echo "gid=$(id -g {{ nextcloud_user }})"
|
|
register: nextcloud_user_info
|
|
changed_when: false
|
|
|
|
- name: Set nextcloud UID/GID facts for container templates
|
|
set_fact:
|
|
nextcloud_uid: "{{ nextcloud_user_info.stdout_lines[0] | regex_replace('uid=', '') }}"
|
|
nextcloud_gid: "{{ nextcloud_user_info.stdout_lines[1] | regex_replace('gid=', '') }}"
|