Joakim
4f8da38ca6
## New Features - **Nextcloud Role**: Complete cloud storage deployment using Podman Quadlet - FPM variant with Caddy reverse proxy and FastCGI - PostgreSQL database via Unix socket - Valkey/Redis for app-level caching and file locking - Automatic HTTPS with Let's Encrypt via Caddy - Dual-root pattern: Caddy serves static assets, FPM handles PHP - **Split Caching Strategy**: Redis caching WITHOUT Redis sessions - Custom redis.config.php template for app-level caching only - File-based PHP sessions for stability (avoids session lock issues) - Prevents cascading failures from session lock contention - Documented in role README with detailed rationale ## Infrastructure Updates - **Socket Permissions**: Update PostgreSQL and Valkey to mode 777 - Required for containers that switch users (root → www-data) - Nextcloud container loses supplementary groups on user switch - Security maintained via password authentication (scram-sha-256, requirepass) - Documented socket permission architecture in docs/ - **PostgreSQL**: Export client group GID as fact for dependent roles - **Valkey**: Export client group GID as fact, update socket fix service ## Documentation - New: docs/socket-permissions-architecture.md - Explains 777 vs 770 socket permission trade-offs - Documents why group-based access doesn't work for user-switching containers - Provides TCP alternative for stricter security requirements - Updated: All role READMEs with socket permission notes - New: Nextcloud README with comprehensive deployment, troubleshooting, and Redis architecture documentation ## Configuration - host_vars: Add Nextcloud vault variables and configuration - site.yml: Include Nextcloud role in main playbook ## Technical Details **Why disable Redis sessions?** The official Nextcloud container enables Redis session handling via REDIS_HOST env var, which causes severe performance issues: 1. Session lock contention under high concurrency (browser parallel asset requests) 2. Infinite lock retries (default lock_retries=-1) blocking FPM workers 3. Timeout orphaning: reverse proxy kills connection, worker keeps lock 4. Worker pool exhaustion: all 5 default workers blocked on same session lock 5. Cascading failure: new requests queue, more timeouts, more orphaned locks Solution: Use file-based sessions (reliable, fast for single-server) while keeping Redis for distributed cache and transactional file locking via custom config file. This provides optimal performance without the complexity of Redis session debugging. Tested: Fresh deployment on arch-vps (69.62.119.31) Domain: https://cloud.jnss.me/
151 lines
4.1 KiB
YAML
151 lines
4.1 KiB
YAML
---
|
|
# Nextcloud Cloud Storage Role - Main Tasks
|
|
# Self-contained deployment with FPM, PostgreSQL, and Valkey via Unix sockets
|
|
|
|
- name: Validate infrastructure facts are available
|
|
assert:
|
|
that:
|
|
- postgresql_client_group_gid is defined
|
|
- valkey_client_group_gid is defined
|
|
fail_msg: |
|
|
Required infrastructure facts are not available.
|
|
Ensure PostgreSQL and Valkey roles have run and exported client group GIDs.
|
|
tags: [validation]
|
|
|
|
- name: Setup nextcloud user and container namespaces
|
|
include_tasks: user.yml
|
|
tags: [user, setup]
|
|
|
|
- name: Setup database access and permissions
|
|
include_tasks: database.yml
|
|
tags: [database, setup]
|
|
|
|
- name: Setup cache access and permissions
|
|
include_tasks: cache.yml
|
|
tags: [cache, setup]
|
|
|
|
- name: Pull nextcloud container image
|
|
containers.podman.podman_image:
|
|
name: "{{ nextcloud_image }}:{{ nextcloud_version }}"
|
|
state: present
|
|
tags: [containers, image-pull]
|
|
|
|
- name: Create nextcloud application directories (container manages ownership)
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
# Note: No owner/group/mode specified - let container entrypoint manage ownership
|
|
# The official Nextcloud container expects to chown these to www-data (UID:33)
|
|
loop:
|
|
- "{{ nextcloud_html_dir }}"
|
|
- "{{ nextcloud_data_dir }}"
|
|
- "{{ nextcloud_config_dir }}"
|
|
- "{{ nextcloud_custom_apps_dir }}"
|
|
tags: [setup, directories]
|
|
|
|
- name: Deploy environment configuration
|
|
template:
|
|
src: nextcloud.env.j2
|
|
dest: "{{ nextcloud_home }}/.env"
|
|
mode: '0600'
|
|
backup: true
|
|
notify: restart nextcloud
|
|
tags: [config]
|
|
|
|
- name: Deploy custom Redis caching configuration
|
|
template:
|
|
src: redis.config.php.j2
|
|
dest: "{{ nextcloud_config_dir }}/redis.config.php"
|
|
mode: '0640'
|
|
notify: restart nextcloud
|
|
tags: [config, redis]
|
|
|
|
- name: Deploy Redis session lock override configuration
|
|
template:
|
|
src: redis-session-override.ini.j2
|
|
dest: "{{ nextcloud_home }}/redis-session-override.ini"
|
|
mode: '0644'
|
|
notify: restart nextcloud
|
|
tags: [config, redis]
|
|
|
|
- name: Create Quadlet systemd directory (system scope)
|
|
file:
|
|
path: /etc/containers/systemd
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Deploy Quadlet container file (system scope)
|
|
template:
|
|
src: nextcloud.container
|
|
dest: /etc/containers/systemd/nextcloud.container
|
|
mode: '0644'
|
|
notify:
|
|
- reload systemd
|
|
- restart nextcloud
|
|
tags: [containers, deployment]
|
|
|
|
- name: Deploy Caddy configuration
|
|
template:
|
|
src: nextcloud.caddy.j2
|
|
dest: "{{ caddy_sites_enabled_dir }}/nextcloud.caddy"
|
|
owner: root
|
|
group: "{{ caddy_user }}"
|
|
mode: '0644'
|
|
backup: true
|
|
notify: reload caddy
|
|
tags: [caddy, reverse-proxy]
|
|
|
|
- name: Ensure system dependencies are running
|
|
systemd:
|
|
name: "{{ item }}"
|
|
state: started
|
|
loop:
|
|
- postgresql
|
|
- valkey
|
|
|
|
- name: Wait for PostgreSQL socket to be ready
|
|
wait_for:
|
|
path: "{{ postgresql_unix_socket_directories }}/.s.PGSQL.{{ postgresql_port }}"
|
|
timeout: 30
|
|
|
|
- name: Wait for Valkey socket to be ready
|
|
wait_for:
|
|
path: "{{ valkey_unix_socket_path }}"
|
|
timeout: 30
|
|
|
|
- name: Enable and start Nextcloud service (system scope)
|
|
systemd:
|
|
name: nextcloud
|
|
enabled: "{{ nextcloud_service_enabled }}"
|
|
state: "{{ nextcloud_service_state }}"
|
|
daemon_reload: true
|
|
tags: [containers, service]
|
|
|
|
- name: Wait for Nextcloud FPM to be ready
|
|
wait_for:
|
|
host: 127.0.0.1
|
|
port: "{{ nextcloud_fpm_port }}"
|
|
timeout: 60
|
|
retries: 5
|
|
delay: 10
|
|
tags: [verification]
|
|
|
|
- name: Display Nextcloud deployment status
|
|
debug:
|
|
msg: |
|
|
✅ Nextcloud Cloud Storage deployed successfully!
|
|
|
|
🌐 Domain: {{ nextcloud_domain }}
|
|
🗄️ Database: {{ nextcloud_db_name }} (Unix socket)
|
|
🗄️ Cache: Valkey DB {{ nextcloud_valkey_db }} (Unix socket)
|
|
🐳 Container: FPM via Podman Quadlet
|
|
🔒 Admin: {{ nextcloud_admin_user }}
|
|
|
|
🚀 Ready for file storage and collaboration!
|
|
|
|
📋 Next Steps:
|
|
- Access https://{{ nextcloud_domain }} to complete setup
|
|
- Install desired Nextcloud apps
|
|
- Configure user accounts
|
|
tags: [verification]
|