Tobias Wüst
f4084ba078
- homarr_service_name removed, replaced with fixed "homarr" string - homarr_db_dir renamed to homarr_db (variable points to a file, not a dir)
333 lines
No EOL
11 KiB
YAML
333 lines
No EOL
11 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# tasks file for homarr
|
|
|
|
# =====================================================================
|
|
# 0. VALIDATION
|
|
# =====================================================================
|
|
|
|
- name: Validate encryption key
|
|
ansible.builtin.assert:
|
|
that:
|
|
- homarr_secret_encryption_key | length == 64
|
|
- homarr_secret_encryption_key is match('^[a-f0-9]+$')
|
|
fail_msg: >-
|
|
homarr_secret_encryption_key must be a 64-character hex string.
|
|
Generate with: openssl rand -hex 32
|
|
Provide via OpenBao, Ansible Vault or extra-vars.
|
|
success_msg: Encryption key validation passed
|
|
|
|
# =====================================================================
|
|
# 1. PREPARATION: packages and directories before container start
|
|
# =====================================================================
|
|
|
|
- name: Ensure required packages are installed
|
|
ansible.builtin.package:
|
|
name:
|
|
- sqlite3
|
|
- python3-docker
|
|
state: present
|
|
|
|
- name: Create docker compose directory
|
|
ansible.builtin.file:
|
|
path: "{{ homarr_docker_compose_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Create Homarr data directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "1000"
|
|
group: "1000"
|
|
mode: "0755"
|
|
loop:
|
|
- "{{ homarr_appdata_dir }}"
|
|
- "{{ homarr_appdata_dir }}/db"
|
|
|
|
- name: Check if database already exists
|
|
ansible.builtin.stat:
|
|
path: "{{ homarr_db }}"
|
|
register: db_exists
|
|
|
|
# =====================================================================
|
|
# 2. START CONTAINER
|
|
# =====================================================================
|
|
|
|
- name: Create docker-compose file for homarr
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ homarr_docker_compose_dir }}/docker-compose.yml"
|
|
mode: '0644'
|
|
|
|
- name: Start homarr containers
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ homarr_docker_compose_dir }}"
|
|
state: present
|
|
|
|
# =====================================================================
|
|
# 3. WAIT FOR DATABASE
|
|
# =====================================================================
|
|
|
|
- name: Wait for database to be created by Homarr
|
|
ansible.builtin.wait_for:
|
|
path: "{{ homarr_db }}"
|
|
state: present
|
|
timeout: 60
|
|
when: not db_exists.stat.exists
|
|
|
|
- name: Wait for database schema to be initialized
|
|
ansible.builtin.command:
|
|
cmd: sqlite3 "{{ homarr_db }}" "SELECT name FROM sqlite_master WHERE type='table' AND name='board';"
|
|
register: schema_check
|
|
until: schema_check.stdout == "board"
|
|
retries: 30
|
|
delay: 2
|
|
changed_when: false
|
|
when: not db_exists.stat.exists
|
|
|
|
# =====================================================================
|
|
# 4. GENERATE BCRYPT HASH (on controller, not on target)
|
|
# =====================================================================
|
|
|
|
- name: Generate bcrypt hash for admin password
|
|
ansible.builtin.shell:
|
|
cmd: python3 -c "import bcrypt, sys; print(bcrypt.hashpw(sys.stdin.read().encode(), bcrypt.gensalt(rounds=10)).decode())"
|
|
stdin: "{{ homarr_admin_password }}"
|
|
stdin_add_newline: false
|
|
delegate_to: localhost
|
|
become: false
|
|
register: bcrypt_result
|
|
changed_when: false
|
|
no_log: true
|
|
|
|
- name: Set bcrypt hash fact
|
|
ansible.builtin.set_fact:
|
|
homarr_bcrypt_hash: "{{ bcrypt_result.stdout }}"
|
|
no_log: true
|
|
|
|
# =====================================================================
|
|
# 5. SEED DATABASE (only if local admin user does not exist yet)
|
|
# =====================================================================
|
|
|
|
- name: Check if local admin user exists
|
|
ansible.builtin.command:
|
|
cmd: sqlite3 "{{ homarr_db }}" "SELECT id FROM user WHERE id='user-local-admin';"
|
|
register: admin_exists
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Seed Homarr database
|
|
ansible.builtin.shell: |
|
|
sqlite3 "{{ homarr_db }}" << 'SEEDSQL'
|
|
BEGIN TRANSACTION;
|
|
|
|
-- SERVER SETTINGS
|
|
INSERT OR REPLACE INTO serverSetting (setting_key, value)
|
|
VALUES
|
|
('analytics', '{"json": {"enableGeneral": false, "enableWidgetData": false, "enableIntegrationData": false, "enableUserData": false}}'),
|
|
('culture', '{"json": {"defaultLocale": "de"}}'),
|
|
('crawling', '{"json": {"crawlingEnabled": false}}'),
|
|
('board', '{"json": {"homeBoardId": "board-default", "mobileHomeBoardId": "board-default", "enableStatusByDefault": true, "forceDisableStatus": false, "defaultBoardId": "board-default"}}');
|
|
|
|
-- SKIP ONBOARDING
|
|
UPDATE onboarding SET step = 'finish', previous_step = 'settings';
|
|
|
|
-- =================================================================
|
|
-- GROUPS (must exist before groupMember)
|
|
-- =================================================================
|
|
|
|
-- OIDC admin group
|
|
INSERT OR IGNORE INTO "group" (id, name, owner_id, position)
|
|
VALUES ('group-oidc-admins', '{{ homarr_oidc_admin_group }}', NULL, 0);
|
|
|
|
INSERT OR IGNORE INTO groupPermission (group_id, permission)
|
|
VALUES
|
|
('group-oidc-admins', 'admin'),
|
|
('group-oidc-admins', 'board-create'),
|
|
('group-oidc-admins', 'board-full-access'),
|
|
('group-oidc-admins', 'integration-create'),
|
|
('group-oidc-admins', 'integration-full-access');
|
|
|
|
-- Credentials admin group
|
|
INSERT OR IGNORE INTO "group" (id, name, owner_id, position)
|
|
VALUES ('group-credentials-admin', 'credentials-admin', NULL, 1);
|
|
|
|
INSERT OR IGNORE INTO groupPermission (group_id, permission)
|
|
VALUES
|
|
('group-credentials-admin', 'admin'),
|
|
('group-credentials-admin', 'board-create'),
|
|
('group-credentials-admin', 'board-full-access'),
|
|
('group-credentials-admin', 'integration-create'),
|
|
('group-credentials-admin', 'integration-full-access');
|
|
|
|
-- =================================================================
|
|
-- LOCAL ADMIN USER
|
|
-- =================================================================
|
|
|
|
INSERT OR IGNORE INTO user (id, name, email, password, email_verified, provider)
|
|
VALUES (
|
|
'user-local-admin',
|
|
'{{ homarr_admin_username }}',
|
|
'{{ homarr_admin_email }}',
|
|
'{{ homarr_bcrypt_hash }}',
|
|
1,
|
|
'credentials'
|
|
);
|
|
|
|
-- Assign admin user to groups
|
|
INSERT OR IGNORE INTO groupMember (group_id, user_id)
|
|
VALUES
|
|
('group-credentials-admin', 'user-local-admin'),
|
|
('group-oidc-admins', 'user-local-admin');
|
|
|
|
-- =================================================================
|
|
-- BOARD
|
|
-- =================================================================
|
|
|
|
INSERT OR IGNORE INTO board (
|
|
id, name, is_public,
|
|
primary_color, secondary_color, opacity,
|
|
background_image_attachment, background_image_repeat, background_image_size,
|
|
item_radius, disable_status
|
|
)
|
|
VALUES (
|
|
'board-default',
|
|
'{{ homarr_default_board_name }}',
|
|
{% if homarr_default_board_public %}1{% else %}0{% endif %},
|
|
'#fa5252',
|
|
'#fd7e14',
|
|
100,
|
|
'fixed',
|
|
'no-repeat',
|
|
'cover',
|
|
'lg',
|
|
0
|
|
);
|
|
|
|
-- Layouts
|
|
INSERT OR IGNORE INTO layout (id, name, board_id, column_count, breakpoint)
|
|
VALUES
|
|
('layout-desktop', 'Desktop', 'board-default', 10, 0),
|
|
('layout-tablet', 'Tablet', 'board-default', 6, 768),
|
|
('layout-mobile', 'Mobile', 'board-default', 2, 480);
|
|
|
|
-- Set home board for admin user (board exists now)
|
|
UPDATE user SET home_board_id = 'board-default', mobile_home_board_id = 'board-default'
|
|
WHERE id = 'user-local-admin';
|
|
|
|
-- Section
|
|
DELETE FROM section_layout WHERE section_id = 'section-apps';
|
|
DELETE FROM item_layout WHERE section_id = 'section-apps';
|
|
DELETE FROM section WHERE id = 'section-apps';
|
|
|
|
INSERT INTO section (id, board_id, kind, x_offset, y_offset, name, options)
|
|
VALUES (
|
|
'section-apps',
|
|
'board-default',
|
|
'empty',
|
|
0,
|
|
0,
|
|
'Applications',
|
|
'{"json": {}}'
|
|
);
|
|
|
|
INSERT OR REPLACE INTO section_layout (section_id, layout_id, parent_section_id, x_offset, y_offset, width, height)
|
|
VALUES
|
|
('section-apps', 'layout-desktop', NULL, 0, 0, 10, 3),
|
|
('section-apps', 'layout-tablet', NULL, 0, 0, 6, 4),
|
|
('section-apps', 'layout-mobile', NULL, 0, 0, 2, 6);
|
|
|
|
-- Board permissions
|
|
INSERT OR IGNORE INTO boardGroupPermission (board_id, group_id, permission)
|
|
VALUES
|
|
('board-default', 'group-oidc-admins', 'full-access'),
|
|
('board-default', 'group-credentials-admin', 'full-access');
|
|
|
|
-- =================================================================
|
|
-- APPS
|
|
-- =================================================================
|
|
|
|
-- Nextcloud
|
|
INSERT OR IGNORE INTO app (id, name, description, icon_url, href)
|
|
VALUES (
|
|
'app-nextcloud',
|
|
'Nextcloud',
|
|
'Cloud Storage & Collaboration',
|
|
'https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nextcloud.png',
|
|
'https://cloud.digitalboard.ch'
|
|
);
|
|
|
|
INSERT OR IGNORE INTO item (id, board_id, kind, options, advanced_options)
|
|
VALUES (
|
|
'item-nextcloud',
|
|
'board-default',
|
|
'app',
|
|
'{"json": {"appId": "app-nextcloud"}}',
|
|
'{"json": {}}'
|
|
);
|
|
|
|
INSERT OR REPLACE INTO item_layout (item_id, section_id, layout_id, x_offset, y_offset, width, height)
|
|
VALUES
|
|
('item-nextcloud', 'section-apps', 'layout-desktop', 0, 0, 2, 1),
|
|
('item-nextcloud', 'section-apps', 'layout-tablet', 0, 0, 2, 1),
|
|
('item-nextcloud', 'section-apps', 'layout-mobile', 0, 0, 1, 1);
|
|
|
|
-- Keycloak
|
|
INSERT OR IGNORE INTO app (id, name, description, icon_url, href)
|
|
VALUES (
|
|
'app-keycloak',
|
|
'Keycloak',
|
|
'Identity & Access Management',
|
|
'https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/keycloak.png',
|
|
'https://auth.digitalboard.ch'
|
|
);
|
|
|
|
INSERT OR IGNORE INTO item (id, board_id, kind, options, advanced_options)
|
|
VALUES (
|
|
'item-keycloak',
|
|
'board-default',
|
|
'app',
|
|
'{"json": {"appId": "app-keycloak"}}',
|
|
'{"json": {}}'
|
|
);
|
|
|
|
INSERT OR REPLACE INTO item_layout (item_id, section_id, layout_id, x_offset, y_offset, width, height)
|
|
VALUES
|
|
('item-keycloak', 'section-apps', 'layout-desktop', 2, 0, 2, 1),
|
|
('item-keycloak', 'section-apps', 'layout-tablet', 2, 0, 2, 1),
|
|
('item-keycloak', 'section-apps', 'layout-mobile', 1, 0, 1, 1);
|
|
|
|
-- Mailman
|
|
INSERT OR IGNORE INTO app (id, name, description, icon_url, href)
|
|
VALUES (
|
|
'app-mailman',
|
|
'Mailman',
|
|
'Mailing List Manager',
|
|
'https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/mailman.png',
|
|
'https://lists.digitalboard.ch'
|
|
);
|
|
|
|
INSERT OR IGNORE INTO item (id, board_id, kind, options, advanced_options)
|
|
VALUES (
|
|
'item-mailman',
|
|
'board-default',
|
|
'app',
|
|
'{"json": {"appId": "app-mailman"}}',
|
|
'{"json": {}}'
|
|
);
|
|
|
|
INSERT OR REPLACE INTO item_layout (item_id, section_id, layout_id, x_offset, y_offset, width, height)
|
|
VALUES
|
|
('item-mailman', 'section-apps', 'layout-desktop', 4, 0, 2, 1),
|
|
('item-mailman', 'section-apps', 'layout-tablet', 4, 0, 2, 1),
|
|
('item-mailman', 'section-apps', 'layout-mobile', 0, 1, 1, 1);
|
|
|
|
COMMIT;
|
|
SEEDSQL
|
|
args:
|
|
executable: /bin/bash
|
|
register: seed_result
|
|
changed_when: seed_result.rc == 0
|
|
when: admin_exists.stdout == ""
|
|
notify: restart homarr |