From b6fbfd3284a859571646f1af6074b11b717b8179 Mon Sep 17 00:00:00 2001
From: cspark <work@cspark.dev>
Date: Sun, 4 May 2025 17:01:28 +0100
Subject: [PATCH] Owncloud service setup

---
 proxy_resources/etc/wireguard/wg0.conf        |   6 ++
 serversecrets.example                         |   2 +
 .../service_owncloud/.docker-compose.yml.swp  | Bin 0 -> 16384 bytes
 services/service_owncloud/ansible.cfg         |   6 ++
 services/service_owncloud/deploy-service.yml  |  27 +++++++
 services/service_owncloud/docker-compose.yml  |  69 ++++++++++++++++++
 .../service_owncloud/prox-deploy-service.yml  |  22 ++++++
 .../etc/nginx/sites-available/owncloud.domain |  51 +++++++++++++
 .../service_owncloud/servicesecrets.example   |   2 +
 9 files changed, 185 insertions(+)
 create mode 100644 services/service_owncloud/.docker-compose.yml.swp
 create mode 100755 services/service_owncloud/ansible.cfg
 create mode 100755 services/service_owncloud/deploy-service.yml
 create mode 100644 services/service_owncloud/docker-compose.yml
 create mode 100644 services/service_owncloud/prox-deploy-service.yml
 create mode 100755 services/service_owncloud/proxy_resources/etc/nginx/sites-available/owncloud.domain
 create mode 100755 services/service_owncloud/servicesecrets.example

diff --git a/proxy_resources/etc/wireguard/wg0.conf b/proxy_resources/etc/wireguard/wg0.conf
index ade6b6f..ae1d341 100755
--- a/proxy_resources/etc/wireguard/wg0.conf
+++ b/proxy_resources/etc/wireguard/wg0.conf
@@ -67,6 +67,12 @@ PublicKey = {{ penpot_service_pubkey }}
 AllowedIPs = 10.0.0.11/32
 PersistentKeepalive = 25
 
+# Owncloud Service
+[Peer]
+PublicKey = {{ owncloud_service_pubkey }}
+AllowedIPs = 10.0.0.12/32
+PersistentKeepalive = 25
+
 # Connection to backend server for nagios
 [Peer]
 PublicKey = {{ nagios_backend_pubkey }}
diff --git a/serversecrets.example b/serversecrets.example
index 170d63d..d466641 100755
--- a/serversecrets.example
+++ b/serversecrets.example
@@ -29,6 +29,7 @@ git_service_privkey: temp
 invidious_service_privkey: temp 
 searxng_service_privkey: temp 
 nextcloud_service_privkey: temp 
+owncloud_service_privkey: temp
 matrix_service_privkey: temp 
 minecraft_service_privkey: temp 
 kimai_service_privkey: temp
@@ -43,6 +44,7 @@ git_service_pubkey: temp
 invidious_service_pubkey: temp
 searxng_service_pubkey: temp
 nextcloud_service_pubkey: temp
+owncloud_service_pubkey: temp
 matrix_service_pubkey: temp
 minecraft_service_pubkey: temp
 kimai_service_pubkey: temp
diff --git a/services/service_owncloud/.docker-compose.yml.swp b/services/service_owncloud/.docker-compose.yml.swp
new file mode 100644
index 0000000000000000000000000000000000000000..c02ea2a820446963d2e78f16b97ce388c56955e7
GIT binary patch
literal 16384
zcmeI3&2QsG6u^h&Ygs6)KwOvE<kCf?PRp)DeRC3TYbl8%+u2fSC2L|&6045KvL|UP
zB#_|15yT(BAArOkz=?kVi5oXS91$ljoOyQQeykETYTDGP#?gzv=HtEJcxLjRC!O*$
zt%0{U$_Tdm$=7(>l0HCA9Fpju<kC@gb^87^T`8u~h(^<sq0dhfN{;W*fR{)RdmW!b
zK0XYkB)8|#I6JV}Vc_^|=t?eg4ro+z*dSyv-8dfjGwKkR1pz@|7J;?)$6K3eS1%SG
z;`iQd&q^q+3j%_GARq_`0)l`bAP5Kog1{{#z{5M}3$W|X#I|=P`<GtWzdSj=H`y0n
zxIZ}+J3&AY5CjAPK|l}?1Ox#=KoAfF1OY)n5Xd0`;v#hSHH4mnB=7$-|Nj>_XoLLq
zHbM_UzFtG<zqb(j5agRT5&8!L0acLi-azQLy9m7x^2zJta@L`&qgN67_Z5V`1bG1R
zI|L9u1Gx|KJp>z`fUJT14S|NAL4E-F79<8a0Qm{j!HaFh#j;;fZgfTET(+3`Da?~{
zo-~Q3^QOD3RVVqDR?$t=c>TsLT*JZzoN%3eu#7s+)V}2E&eVMF@VeEw>hdpB-evNf
zgLDNarllLoj%v3})iCXvVk!2HVySz|zTGzJGVXI8%96w!FP68r%4NwVoS=&<zFFIf
zxMk>{?%P(~#9oYHeI4cu7rMlcY2hQx`xLvdy3S|B#ly(QeG=n<rN+iNHm<2#+EcBn
zSeo86ZL?vuY^`ak)wZF^xNtPy3b{03it5QD*Hjv3R6oj_?o+fj)n-jKGTix5c#5hm
z-LNK#=0VRX8t&?5rs2^IH+~V*0r7koE0Q(5c-`w_hXq})H;kzJ=!W`KHWcp|t*Wim
zYVh2ZH`0&1z4>?xerOKJ0Zqp<Lw%;;9^v$m9Ao0ZI^uL~aWd{D!yO4j>_#4#w)_Fk
zR4q$u?wIyeGqyLE2zLSuCIs#Uy<}!c*IZ*Vg0?5H7CYg^s+x&+sqeF;Xr|Q~(6$Y&
zX}1*9+|!L3bXwvLyr2LL%=<8bF=)5Qb7?$o%j6yoNgN-t$i>}=4btn`^GdkK0^Id{
zdd>P5ajGUB0>%@4uC31Tl&&_FN?o-pim5@DXj{87PN#K*_h_d^MtHooJ|RUo%<?d=
za~u!DkVPEpAq}(|uCgGY4u6Ca|Njs0+aG}cp7{US`~5Qb{uS{1zXHGiNAUT71)u*<
zxOop`9en-@q)+qYFs30?5(ESRK|l}?1ad+E&#@KfNRzuHMRc)Bt7uq6V@@J2W8#B5
zv3!r=VycU#82du-L)&K#@$=vwFKW?gexLPv;N8gR^wO-O)p$5dcthg-;h+<Mmln&?
zh(wa_b<(J0>GZ}eus5+ZiM5uJFzb0kSK7K0yT(4MEK%;HhOVepBjyhWG+xCnX6?2c
zm8PQAP5Y@<SIvFXQXAQ807KUyAa^S|SP_Cd@DF~7h+)@@z};ujG48Sm0t4Adg8m0y
CnFF~1

literal 0
HcmV?d00001

diff --git a/services/service_owncloud/ansible.cfg b/services/service_owncloud/ansible.cfg
new file mode 100755
index 0000000..b46bfad
--- /dev/null
+++ b/services/service_owncloud/ansible.cfg
@@ -0,0 +1,6 @@
+[defaults]
+inventory = ../../hosts
+
+[privilege_escalation]
+become_method=doas
+become_ask_pass=True
diff --git a/services/service_owncloud/deploy-service.yml b/services/service_owncloud/deploy-service.yml
new file mode 100755
index 0000000..e46e9bb
--- /dev/null
+++ b/services/service_owncloud/deploy-service.yml
@@ -0,0 +1,27 @@
+- hosts: localhost
+  become: 'yes'
+  vars:
+    ansible_become_method: doas
+  tasks:
+    - name: Create necessary directories
+      ansible.builtin.file:
+        path: "{{ item }}" 
+        owner: service_owncloud
+        group: service_owncloud
+        state: directory
+      loop:
+        - "{{ services_directory }}/service_nextcloud/ocis-data"
+        - "{{ services_directory }}/service_nextcloud/ocis-config"
+        - "{{ services_directory }}/service_nextcloud/ocis-thumbnails"
+    - name: Copy docker compose config and other nextcloud files
+      ansible.builtin.template:
+        src: "{{ item }}" 
+        dest: "{{ services_directory }}/service_owncloud/{{ item }}"
+        owner: 1000
+        group: 1000
+      loop:
+        - docker-compose.yml 
+
+    - name: Debug Finish message
+      debug:
+        msg: Ansible playbook has finished!
diff --git a/services/service_owncloud/docker-compose.yml b/services/service_owncloud/docker-compose.yml
new file mode 100644
index 0000000..83526dd
--- /dev/null
+++ b/services/service_owncloud/docker-compose.yml
@@ -0,0 +1,69 @@
+services:
+
+  # Gluetun is used to connect container to VPN
+  ocis-gluetun:
+    image: qmcgaw/gluetun
+    cap_add:
+      - NET_ADMIN
+    environment:
+      - VPN_SERVICE_PROVIDER=custom
+      - VPN_TYPE=wireguard
+      - VPN_ENDPOINT_IP={{ proxy_server_ip }}
+      - VPN_ENDPOINT_PORT={{ proxy_server_vpn_port }}
+      - WIREGUARD_PUBLIC_KEY={{ vpn_server_pubkey }}
+      - WIREGUARD_PRIVATE_KEY={{ owncloud_service_privkey }}
+      - WIREGUARD_ADDRESSES=10.0.0.12/32
+      - FIREWALL_VPN_INPUT_PORTS=9200
+      - FIREWALL_INPUT_PORTS=9200
+    ports:
+      - "9200:9200"
+    deploy:
+      resources:
+        limits:
+          cpus: '0.10'
+          memory: 512M
+
+  ocis:
+    network_mode: "service:ocis-gluetun"
+    image: owncloud/ocis:latest
+    user: 1000:1000
+    entrypoint:
+      - /bin/sh
+    # run ocis init to initialize a configuration file with random secrets
+    # it will fail on subsequent runs, because the config file already exists
+    # therefore we ignore the error and then start the ocis server
+    command: ["-c", "ocis init || true; ocis server"]
+    environment:
+      OCIS_URL: "https://owncloud.{{ domain_name }}"
+      OCIS_LOG_LEVEL: error # make oCIS less verbose
+      PROXY_TLS: false # do not use SSL between reverse proxy and oCIS
+      OCIS_INSECURE: true
+      # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
+      PROXY_ENABLE_BASIC_AUTH: false
+      # admin user password
+      IDM_ADMIN_PASSWORD: "{{ service_owncloud_admin_pass }}" # this overrides the admin password from the configuration file
+      # make settings service available to oCIS Hello
+      SETTINGS_GRPC_ADDR: 0.0.0.0:9191
+      GATEWAY_GRPC_ADDR: 0.0.0.0:9142 # make the REVA gateway accessible to the app drivers
+      # email server (if configured)
+      # NOTIFICATIONS_SMTP_HOST: "xxxxxx"
+      # NOTIFICATIONS_SMTP_PORT: "xxxx"
+      # NOTIFICATIONS_SMTP_SENDER: "xxxxx"
+      # NOTIFICATIONS_SMTP_USERNAME: "xxxxxxxx"
+      # NOTIFICATIONS_SMTP_INSECURE: "xxxxxxx"
+      # PROXY_TLS is set to "false", the download url has no https
+      STORAGE_USERS_DATA_GATEWAY_URL: http://ocis:9200/data
+      # separate directory for thumbnails
+      THUMBNAILS_FILESYSTEMSTORAGE_ROOT: /var/lib/ocis-thumbnails
+    volumes:
+      - ./ocis-config:/etc/ocis
+      - ./ocis-data:/var/lib/ocis
+      - ./ocis-thumbnails:/var/lib/ocis-thumbnails
+    logging:
+      driver: "local"
+    restart: always
+    deploy:
+      resources:
+        limits:
+          cpus: '0.25'
+          memory: 512M
diff --git a/services/service_owncloud/prox-deploy-service.yml b/services/service_owncloud/prox-deploy-service.yml
new file mode 100644
index 0000000..a366acb
--- /dev/null
+++ b/services/service_owncloud/prox-deploy-service.yml
@@ -0,0 +1,22 @@
+- hosts: 
+    - "{{ proxy_server_hostname }}"
+      #    - "{{ proxy_server_hostname }}"-defaultport
+  become: 'yes'
+  vars:
+    ansible_become_method: doas
+  tasks:
+    # Ensure NGinx site reverse proxy configuration is updated
+    - name: Ensure all NGinx site configurations are updated
+      template:
+        src: proxy_resources/etc/nginx/sites-available/owncloud.domain
+        dest: "/etc/nginx/sites-available/owncloud.{{ domain_name }}"
+    - name: Ensure NGinx site reverse proxy configuration is enabled      
+      ansible.builtin.file:
+        src: "/etc/nginx/sites-available/owncloud.{{ domain_name }}"
+        dest: "/etc/nginx/sites-enabled/owncloud.{{ domain_name }}"
+        state: link
+
+    - name: Debug Finish message
+      debug:
+        msg: Ansible playbook has finished!
+
diff --git a/services/service_owncloud/proxy_resources/etc/nginx/sites-available/owncloud.domain b/services/service_owncloud/proxy_resources/etc/nginx/sites-available/owncloud.domain
new file mode 100755
index 0000000..8a6af8f
--- /dev/null
+++ b/services/service_owncloud/proxy_resources/etc/nginx/sites-available/owncloud.domain
@@ -0,0 +1,51 @@
+# {{ ansible_managed }}
+
+server {
+
+	server_name owncloud.{{ domain_name }} www.owncloud.{{ domain_name }};
+
+	client_max_body_size 0;
+    	underscores_in_headers on;
+
+	location / {
+		proxy_pass http://10.0.0.12:9200;
+		proxy_set_header Host $host;
+        	proxy_set_header X-Real-IP $remote_addr;
+        	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        	proxy_set_header X-Forwarded-Proto $scheme;
+        	add_header Front-End-Https on;
+		add_header Strict-Transport-Security "max-age=15552000; includeSubDomains"; 
+
+        	proxy_headers_hash_max_size 512;
+        	proxy_headers_hash_bucket_size 64;
+
+        	proxy_buffering off;
+        	proxy_redirect off;
+        	proxy_max_temp_file_size 0;
+	}
+
+    	listen [::]:443 ssl; # managed by Certbot
+    	listen 443 ssl; # managed by Certbot
+    	ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem; # managed by Certbot
+    	ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem; # managed by Certbot
+    	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    if ($host = www.owncloud.{{ domain_name }}) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = owncloud.{{ domain_name }}) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+        listen 80;
+        listen [::]:80;
+
+        server_name owncloud.{{ domain_name }} www.owncloud.{{ domain_name }};
+    return 404; # managed by Certbot
+}
diff --git a/services/service_owncloud/servicesecrets.example b/services/service_owncloud/servicesecrets.example
new file mode 100755
index 0000000..efed96e
--- /dev/null
+++ b/services/service_owncloud/servicesecrets.example
@@ -0,0 +1,2 @@
+# Example service secrets for owncloud docker service, to be encrypted with ansible vault and called servicesecrets.enc
+service_owncloud_admin_pass: ***