Joakim
846ab74f87
- Enable IP forwarding in security playbook (net.ipv4.ip_forward = 1) - Add podman network firewall rules to fix container DNS/HTTPS access - Implement systemd timer for reliable Nextcloud background job execution - Add database optimization tasks (indices, bigint conversion, mimetypes) - Configure maintenance window (04:00 UTC) and phone region (NO) - Add security headers (X-Robots-Tag, X-Permitted-Cross-Domain-Policies) - Create Nextcloud removal playbook for clean uninstall - Fix nftables interface matching (podman0 vs podman+) Root cause: nftables FORWARD chain blocked container egress traffic Solution: Explicit firewall rules for podman0 bridge interface
65 lines
2.6 KiB
YAML
65 lines
2.6 KiB
YAML
---
|
|
# =================================================================
|
|
# Nextcloud Database Optimization
|
|
# =================================================================
|
|
# Rick-Infra - Nextcloud Role
|
|
#
|
|
# Performs database maintenance tasks to optimize performance
|
|
# and resolve setup warnings about missing indices and migrations
|
|
|
|
- name: Add missing database indices
|
|
command: >
|
|
podman exec --user www-data nextcloud
|
|
php occ db:add-missing-indices
|
|
register: nextcloud_indices
|
|
changed_when: "'indices added' in nextcloud_indices.stdout or 'Check indices' in nextcloud_indices.stdout"
|
|
failed_when:
|
|
- nextcloud_indices.rc != 0
|
|
- "'already exists' not in nextcloud_indices.stderr"
|
|
|
|
- name: Convert filecache bigint columns
|
|
command: >
|
|
podman exec --user www-data nextcloud
|
|
php occ db:convert-filecache-bigint --no-interaction
|
|
register: nextcloud_bigint
|
|
changed_when: "'converted' in nextcloud_bigint.stdout"
|
|
failed_when:
|
|
- nextcloud_bigint.rc != 0
|
|
- "'already' not in nextcloud_bigint.stdout"
|
|
timeout: 300 # 5 minutes for large databases
|
|
|
|
- name: Update mimetype database mappings
|
|
command: >
|
|
podman exec --user www-data nextcloud
|
|
php occ maintenance:repair --include-expensive
|
|
register: nextcloud_repair
|
|
changed_when: "'updated' in nextcloud_repair.stdout or 'repaired' in nextcloud_repair.stdout"
|
|
failed_when: nextcloud_repair.rc != 0
|
|
timeout: 600 # 10 minutes for expensive repairs
|
|
|
|
- name: Configure maintenance window
|
|
command: >
|
|
podman exec --user www-data nextcloud
|
|
php occ config:system:set maintenance_window_start --value={{ nextcloud_maintenance_window_start }} --type=integer
|
|
register: nextcloud_maintenance_window
|
|
changed_when: "'set' in nextcloud_maintenance_window.stdout"
|
|
failed_when: nextcloud_maintenance_window.rc != 0
|
|
|
|
- name: Configure default phone region
|
|
command: >
|
|
podman exec --user www-data nextcloud
|
|
php occ config:system:set default_phone_region --value={{ nextcloud_default_phone_region }}
|
|
register: nextcloud_phone_region
|
|
changed_when: "'set' in nextcloud_phone_region.stdout"
|
|
failed_when: nextcloud_phone_region.rc != 0
|
|
|
|
- name: Display optimization results
|
|
debug:
|
|
msg: |
|
|
Database optimization complete:
|
|
- Indices: {{ 'Added' if 'indices added' in nextcloud_indices.stdout else 'Already optimized' }}
|
|
- BigInt: {{ 'Converted' if 'converted' in nextcloud_bigint.stdout else 'Already converted' }}
|
|
- Mimetypes: {{ 'Updated' if 'updated' in nextcloud_repair.stdout else 'Up to date' }}
|
|
- Maintenance window: {{ nextcloud_maintenance_window_start }}:00 UTC
|
|
- Phone region: {{ nextcloud_default_phone_region }}
|